xref: /titanic_51/usr/src/uts/common/inet/ip/ip_ire.c (revision c17d6d0368a95d88a7901e522b92d3f7b95da5da)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /* Copyright (c) 1990 Mentat Inc. */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 
30 /*
31  * This file contains routines that manipulate Internet Routing Entries (IREs).
32  */
33 
34 #include <sys/types.h>
35 #include <sys/stream.h>
36 #include <sys/stropts.h>
37 #include <sys/strsun.h>
38 #include <sys/ddi.h>
39 #include <sys/cmn_err.h>
40 #include <sys/policy.h>
41 
42 #include <sys/systm.h>
43 #include <sys/kmem.h>
44 #include <sys/param.h>
45 #include <sys/socket.h>
46 #include <net/if.h>
47 #include <net/route.h>
48 #include <netinet/in.h>
49 #include <net/if_dl.h>
50 #include <netinet/ip6.h>
51 #include <netinet/icmp6.h>
52 
53 #include <inet/common.h>
54 #include <inet/mi.h>
55 #include <inet/ip.h>
56 #include <inet/ip6.h>
57 #include <inet/ip_ndp.h>
58 #include <inet/arp.h>
59 #include <inet/ip_if.h>
60 #include <inet/ip_ire.h>
61 #include <inet/ip_ftable.h>
62 #include <inet/ip_rts.h>
63 #include <inet/nd.h>
64 
65 #include <net/pfkeyv2.h>
66 #include <inet/ipsec_info.h>
67 #include <inet/sadb.h>
68 #include <sys/kmem.h>
69 #include <inet/tcp.h>
70 #include <inet/ipclassifier.h>
71 #include <sys/zone.h>
72 #include <sys/cpuvar.h>
73 
74 #include <sys/tsol/label.h>
75 #include <sys/tsol/tnet.h>
76 #include <sys/dlpi.h>
77 
78 struct kmem_cache *rt_entry_cache;
79 
80 /*
81  * Synchronization notes:
82  *
83  * The fields of the ire_t struct are protected in the following way :
84  *
85  * ire_next/ire_ptpn
86  *
87  *	- bucket lock of the respective tables (cache or forwarding tables).
88  *
89  * ire_mp, ire_rfq, ire_stq, ire_u *except* ire_gateway_addr[v6], ire_mask,
90  * ire_type, ire_create_time, ire_masklen, ire_ipversion, ire_flags, ire_ipif,
91  * ire_ihandle, ire_phandle, ire_nce, ire_bucket, ire_in_ill, ire_in_src_addr
92  *
93  *	- Set in ire_create_v4/v6 and never changes after that. Thus,
94  *	  we don't need a lock whenever these fields are accessed.
95  *
96  *	- ire_bucket and ire_masklen (also set in ire_create) is set in
97  *        ire_add_v4/ire_add_v6 before inserting in the bucket and never
98  *        changes after that. Thus we don't need a lock whenever these
99  *	  fields are accessed.
100  *
101  * ire_gateway_addr_v4[v6]
102  *
103  *	- ire_gateway_addr_v4[v6] is set during ire_create and later modified
104  *	  by rts_setgwr[v6]. As ire_gateway_addr is a uint32_t, updates to
105  *	  it assumed to be atomic and hence the other parts of the code
106  *	  does not use any locks. ire_gateway_addr_v6 updates are not atomic
107  *	  and hence any access to it uses ire_lock to get/set the right value.
108  *
109  * ire_ident, ire_refcnt
110  *
111  *	- Updated atomically using atomic_add_32
112  *
113  * ire_ssthresh, ire_rtt_sd, ire_rtt, ire_ib_pkt_count, ire_ob_pkt_count
114  *
115  *	- Assumes that 32 bit writes are atomic. No locks. ire_lock is
116  *	  used to serialize updates to ire_ssthresh, ire_rtt_sd, ire_rtt.
117  *
118  * ire_max_frag, ire_frag_flag
119  *
120  *	- ire_lock is used to set/read both of them together.
121  *
122  * ire_tire_mark
123  *
124  *	- Set in ire_create and updated in ire_expire, which is called
125  *	  by only one function namely ip_trash_timer_expire. Thus only
126  *	  one function updates and examines the value.
127  *
128  * ire_marks
129  *	- bucket lock protects this.
130  *
131  * ire_ipsec_overhead/ire_ll_hdr_length
132  *
133  *	- Place holder for returning the information to the upper layers
134  *	  when IRE_DB_REQ comes down.
135  *
136  *
137  * ipv6_ire_default_count is protected by the bucket lock of
138  * ip_forwarding_table_v6[0][0].
139  *
140  * ipv6_ire_default_index is not protected as it  is just a hint
141  * at which default gateway to use. There is nothing
142  * wrong in using the same gateway for two different connections.
143  *
144  * As we always hold the bucket locks in all the places while accessing
145  * the above values, it is natural to use them for protecting them.
146  *
147  * We have a separate cache table and forwarding table for IPv4 and IPv6.
148  * Cache table (ip_cache_table/ip_cache_table_v6) is a pointer to an
149  * array of irb_t structure and forwarding table (ip_forwarding_table/
150  * ip_forwarding_table_v6) is an array of pointers to array of irb_t
151  * structure. ip_forwarding_table_v6 is allocated dynamically in
152  * ire_add_v6. ire_ft_init_lock is used to serialize multiple threads
153  * initializing the same bucket. Once a bucket is initialized, it is never
154  * de-alloacted. This assumption enables us to access
155  * ip_forwarding_table_v6[i] without any locks.
156  *
157  * Each irb_t - ire bucket structure has a lock to protect
158  * a bucket and the ires residing in the bucket have a back pointer to
159  * the bucket structure. It also has a reference count for the number
160  * of threads walking the bucket - irb_refcnt which is bumped up
161  * using the macro IRB_REFHOLD macro. The flags irb_flags can be
162  * set to IRE_MARK_CONDEMNED indicating that there are some ires
163  * in this bucket that are marked with IRE_MARK_CONDEMNED and the
164  * last thread to leave the bucket should delete the ires. Usually
165  * this is done by the IRB_REFRELE macro which is used to decrement
166  * the reference count on a bucket.
167  *
168  * IRE_REFHOLD/IRE_REFRELE macros operate on the ire which increments/
169  * decrements the reference count, ire_refcnt, atomically on the ire.
170  * ire_refcnt is modified only using this macro. Operations on the IRE
171  * could be described as follows :
172  *
173  * CREATE an ire with reference count initialized to 1.
174  *
175  * ADDITION of an ire holds the bucket lock, checks for duplicates
176  * and then adds the ire. ire_add_v4/ire_add_v6 returns the ire after
177  * bumping up once more i.e the reference count is 2. This is to avoid
178  * an extra lookup in the functions calling ire_add which wants to
179  * work with the ire after adding.
180  *
181  * LOOKUP of an ire bumps up the reference count using IRE_REFHOLD
182  * macro. It is valid to bump up the referece count of the IRE,
183  * after the lookup has returned an ire. Following are the lookup
184  * functions that return an HELD ire :
185  *
186  * ire_lookup_local[_v6], ire_ctable_lookup[_v6], ire_ftable_lookup[_v6],
187  * ire_cache_lookup[_v6], ire_lookup_multi[_v6], ire_route_lookup[_v6],
188  * ipif_to_ire[_v6], ire_mrtun_lookup, ire_srcif_table_lookup.
189  *
190  * DELETION of an ire holds the bucket lock, removes it from the list
191  * and then decrements the reference count for having removed from the list
192  * by using the IRE_REFRELE macro. If some other thread has looked up
193  * the ire, the reference count would have been bumped up and hence
194  * this ire will not be freed once deleted. It will be freed once the
195  * reference count drops to zero.
196  *
197  * Add and Delete acquires the bucket lock as RW_WRITER, while all the
198  * lookups acquire the bucket lock as RW_READER.
199  *
200  * NOTE : The only functions that does the IRE_REFRELE when an ire is
201  *	  passed as an argument are :
202  *
203  *	  1) ip_wput_ire : This is because it IRE_REFHOLD/RELEs the
204  *			   broadcast ires it looks up internally within
205  *			   the function. Currently, for simplicity it does
206  *			   not differentiate the one that is passed in and
207  *			   the ones it looks up internally. It always
208  *			   IRE_REFRELEs.
209  *	  2) ire_send
210  *	     ire_send_v6 : As ire_send calls ip_wput_ire and other functions
211  *			   that take ire as an argument, it has to selectively
212  *			   IRE_REFRELE the ire. To maintain symmetry,
213  *			   ire_send_v6 does the same.
214  *
215  * Otherwise, the general rule is to do the IRE_REFRELE in the function
216  * that is passing the ire as an argument.
217  *
218  * In trying to locate ires the following points are to be noted.
219  *
220  * IRE_MARK_CONDEMNED signifies that the ire has been logically deleted and is
221  * to be ignored when walking the ires using ire_next.
222  *
223  * IRE_MARK_HIDDEN signifies that the ire is a special ire typically for the
224  * benefit of in.mpathd which needs to probe interfaces for failures. Normal
225  * applications should not be seeing this ire and hence this ire is ignored
226  * in most cases in the search using ire_next.
227  *
228  * Zones note:
229  *	Walking IREs within a given zone also walks certain ires in other
230  *	zones.  This is done intentionally.  IRE walks with a specified
231  *	zoneid are used only when doing informational reports, and
232  *	zone users want to see things that they can access. See block
233  *	comment in ire_walk_ill_match().
234  */
235 
236 /*
237  * A per-interface routing table is created ( if not present)
238  * when the first entry is added to this special routing table.
239  * This special routing table is accessed through the ill data structure.
240  * The routing table looks like cache table. For example, currently it
241  * is used by mobile-ip foreign agent to forward data that only comes from
242  * the home agent tunnel for a mobile node. Thus if the outgoing interface
243  * is a RESOLVER interface, IP may need to resolve the hardware address for
244  * the outgoing interface. The routing entries in this table are not updated
245  * in IRE_CACHE. When MCTL msg comes back from ARP, the incoming ill informa-
246  * tion is lost as the write queue is passed to ip_wput.
247  * But, before sending the packet out, the hardware information must be updated
248  * in the special forwarding table. ire_srcif_table_count keeps track of total
249  * number of ires that are in interface based tables. Each interface based
250  * table hangs off of the incoming ill and each ill_t also keeps a refcnt
251  * of ires in that table.
252  */
253 
254 /*
255  * The minimum size of IRE cache table.  It will be recalcuated in
256  * ip_ire_init().
257  * Setable in /etc/system
258  */
259 uint32_t ip_cache_table_size = IP_CACHE_TABLE_SIZE;
260 uint32_t ip6_cache_table_size = IP6_CACHE_TABLE_SIZE;
261 
262 /*
263  * The size of the forwarding table.  We will make sure that it is a
264  * power of 2 in ip_ire_init().
265  * Setable in /etc/system
266  */
267 uint32_t ip6_ftable_hash_size = IP6_FTABLE_HASH_SIZE;
268 
269 struct	kmem_cache	*ire_cache;
270 static ire_t	ire_null;
271 
272 /*
273  * The threshold number of IRE in a bucket when the IREs are
274  * cleaned up.  This threshold is calculated later in ip_open()
275  * based on the speed of CPU and available memory.  This default
276  * value is the maximum.
277  *
278  * We have two kinds of cached IRE, temporary and
279  * non-temporary.  Temporary IREs are marked with
280  * IRE_MARK_TEMPORARY.  They are IREs created for non
281  * TCP traffic and for forwarding purposes.  All others
282  * are non-temporary IREs.  We don't mark IRE created for
283  * TCP as temporary because TCP is stateful and there are
284  * info stored in the IRE which can be shared by other TCP
285  * connections to the same destination.  For connected
286  * endpoint, we also don't want to mark the IRE used as
287  * temporary because the same IRE will be used frequently,
288  * otherwise, the app should not do a connect().  We change
289  * the marking at ip_bind_connected_*() if necessary.
290  *
291  * We want to keep the cache IRE hash bucket length reasonably
292  * short, otherwise IRE lookup functions will take "forever."
293  * We use the "crude" function that the IRE bucket
294  * length should be based on the CPU speed, which is 1 entry
295  * per x MHz, depending on the shift factor ip_ire_cpu_ratio
296  * (n).  This means that with a 750MHz CPU, the max bucket
297  * length can be (750 >> n) entries.
298  *
299  * Note that this threshold is separate for temp and non-temp
300  * IREs.  This means that the actual bucket length can be
301  * twice as that.  And while we try to keep temporary IRE
302  * length at most at the threshold value, we do not attempt to
303  * make the length for non-temporary IREs fixed, for the
304  * reason stated above.  Instead, we start trying to find
305  * "unused" non-temporary IREs when the bucket length reaches
306  * this threshold and clean them up.
307  *
308  * We also want to limit the amount of memory used by
309  * IREs.  So if we are allowed to use ~3% of memory (M)
310  * for those IREs, each bucket should not have more than
311  *
312  * 	M / num of cache bucket / sizeof (ire_t)
313  *
314  * Again the above memory uses are separate for temp and
315  * non-temp cached IREs.
316  *
317  * We may also want the limit to be a function of the number
318  * of interfaces and number of CPUs.  Doing the initialization
319  * in ip_open() means that every time an interface is plumbed,
320  * the max is re-calculated.  Right now, we don't do anything
321  * different.  In future, when we have more experience, we
322  * may want to change this behavior.
323  */
324 uint32_t ip_ire_max_bucket_cnt = 10;	/* Setable in /etc/system */
325 uint32_t ip6_ire_max_bucket_cnt = 10;
326 
327 /*
328  * The minimum of the temporary IRE bucket count.  We do not want
329  * the length of each bucket to be too short.  This may hurt
330  * performance of some apps as the temporary IREs are removed too
331  * often.
332  */
333 uint32_t ip_ire_min_bucket_cnt = 3;	/* /etc/system - not used */
334 uint32_t ip6_ire_min_bucket_cnt = 3;
335 
336 /*
337  * The ratio of memory consumed by IRE used for temporary to available
338  * memory.  This is a shift factor, so 6 means the ratio 1 to 64.  This
339  * value can be changed in /etc/system.  6 is a reasonable number.
340  */
341 uint32_t ip_ire_mem_ratio = 6;	/* /etc/system */
342 /* The shift factor for CPU speed to calculate the max IRE bucket length. */
343 uint32_t ip_ire_cpu_ratio = 7;	/* /etc/system */
344 
345 typedef struct nce_clookup_s {
346 	ipaddr_t ncecl_addr;
347 	boolean_t ncecl_found;
348 } nce_clookup_t;
349 
350 /*
351  * The maximum number of buckets in IRE cache table.  In future, we may
352  * want to make it a dynamic hash table.  For the moment, we fix the
353  * size and allocate the table in ip_ire_init() when IP is first loaded.
354  * We take into account the amount of memory a system has.
355  */
356 #define	IP_MAX_CACHE_TABLE_SIZE	4096
357 
358 /* Setable in /etc/system */
359 static uint32_t	ip_max_cache_table_size = IP_MAX_CACHE_TABLE_SIZE;
360 static uint32_t	ip6_max_cache_table_size = IP_MAX_CACHE_TABLE_SIZE;
361 
362 #define	NUM_ILLS	3	/* To build the ILL list to unlock */
363 
364 /* Zero iulp_t for initialization. */
365 const iulp_t	ire_uinfo_null = { 0 };
366 
367 static int	ire_add_v4(ire_t **ire_p, queue_t *q, mblk_t *mp,
368     ipsq_func_t func, boolean_t);
369 static int	ire_add_srcif_v4(ire_t **ire_p, queue_t *q, mblk_t *mp,
370     ipsq_func_t func);
371 static ire_t	*ire_update_srcif_v4(ire_t *ire);
372 static void	ire_delete_v4(ire_t *ire);
373 static void	ire_report_ctable(ire_t *ire, char *mp);
374 static void	ire_report_mrtun_table(ire_t *ire, char *mp);
375 static void	ire_report_srcif_table(ire_t *ire, char *mp, ip_stack_t *ipst);
376 static void	ire_walk_ipvers(pfv_t func, void *arg, uchar_t vers,
377     zoneid_t zoneid, ip_stack_t *);
378 static void	ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type,
379     pfv_t func, void *arg, uchar_t vers, ill_t *ill);
380 static void	ire_cache_cleanup(irb_t *irb, uint32_t threshold, int cnt);
381 extern void	ill_unlock_ills(ill_t **list, int cnt);
382 static	void	ip_nce_clookup_and_delete(nce_t *nce, void *arg);
383 extern void	th_trace_rrecord(th_trace_t *);
384 #ifdef IRE_DEBUG
385 static void	ire_trace_inactive(ire_t *);
386 #endif
387 
388 /*
389  * To avoid bloating the code, we call this function instead of
390  * using the macro IRE_REFRELE. Use macro only in performance
391  * critical paths.
392  *
393  * Must not be called while holding any locks. Otherwise if this is
394  * the last reference to be released there is a chance of recursive mutex
395  * panic due to ire_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
396  * to restart an ioctl. The one exception is when the caller is sure that
397  * this is not the last reference to be released. Eg. if the caller is
398  * sure that the ire has not been deleted and won't be deleted.
399  */
400 void
401 ire_refrele(ire_t *ire)
402 {
403 	IRE_REFRELE(ire);
404 }
405 
406 void
407 ire_refrele_notr(ire_t *ire)
408 {
409 	IRE_REFRELE_NOTR(ire);
410 }
411 
412 /*
413  * kmem_cache_alloc constructor for IRE in kma space.
414  * Note that when ire_mp is set the IRE is stored in that mblk and
415  * not in this cache.
416  */
417 /* ARGSUSED */
418 static int
419 ip_ire_constructor(void *buf, void *cdrarg, int kmflags)
420 {
421 	ire_t	*ire = buf;
422 
423 	ire->ire_nce = NULL;
424 
425 	return (0);
426 }
427 
428 /* ARGSUSED1 */
429 static void
430 ip_ire_destructor(void *buf, void *cdrarg)
431 {
432 	ire_t	*ire = buf;
433 
434 	ASSERT(ire->ire_nce == NULL);
435 }
436 
437 /*
438  * This function is associated with the IP_IOC_IRE_ADVISE_NO_REPLY
439  * IOCTL.  It is used by TCP (or other ULPs) to supply revised information
440  * for an existing CACHED IRE.
441  */
442 /* ARGSUSED */
443 int
444 ip_ire_advise(queue_t *q, mblk_t *mp, cred_t *ioc_cr)
445 {
446 	uchar_t	*addr_ucp;
447 	ipic_t	*ipic;
448 	ire_t	*ire;
449 	ipaddr_t	addr;
450 	in6_addr_t	v6addr;
451 	irb_t	*irb;
452 	zoneid_t	zoneid;
453 	ip_stack_t	*ipst = CONNQ_TO_IPST(q);
454 
455 	ASSERT(q->q_next == NULL);
456 	zoneid = Q_TO_CONN(q)->conn_zoneid;
457 
458 	/*
459 	 * Check privilege using the ioctl credential; if it is NULL
460 	 * then this is a kernel message and therefor privileged.
461 	 */
462 	if (ioc_cr != NULL && secpolicy_ip_config(ioc_cr, B_FALSE) != 0)
463 		return (EPERM);
464 
465 	ipic = (ipic_t *)mp->b_rptr;
466 	if (!(addr_ucp = mi_offset_param(mp, ipic->ipic_addr_offset,
467 	    ipic->ipic_addr_length))) {
468 		return (EINVAL);
469 	}
470 	if (!OK_32PTR(addr_ucp))
471 		return (EINVAL);
472 	switch (ipic->ipic_addr_length) {
473 	case IP_ADDR_LEN: {
474 		/* Extract the destination address. */
475 		addr = *(ipaddr_t *)addr_ucp;
476 		/* Find the corresponding IRE. */
477 		ire = ire_cache_lookup(addr, zoneid, NULL, ipst);
478 		break;
479 	}
480 	case IPV6_ADDR_LEN: {
481 		/* Extract the destination address. */
482 		v6addr = *(in6_addr_t *)addr_ucp;
483 		/* Find the corresponding IRE. */
484 		ire = ire_cache_lookup_v6(&v6addr, zoneid, NULL, ipst);
485 		break;
486 	}
487 	default:
488 		return (EINVAL);
489 	}
490 
491 	if (ire == NULL)
492 		return (ENOENT);
493 	/*
494 	 * Update the round trip time estimate and/or the max frag size
495 	 * and/or the slow start threshold.
496 	 *
497 	 * We serialize multiple advises using ire_lock.
498 	 */
499 	mutex_enter(&ire->ire_lock);
500 	if (ipic->ipic_rtt) {
501 		/*
502 		 * If there is no old cached values, initialize them
503 		 * conservatively.  Set them to be (1.5 * new value).
504 		 */
505 		if (ire->ire_uinfo.iulp_rtt != 0) {
506 			ire->ire_uinfo.iulp_rtt = (ire->ire_uinfo.iulp_rtt +
507 			    ipic->ipic_rtt) >> 1;
508 		} else {
509 			ire->ire_uinfo.iulp_rtt = ipic->ipic_rtt +
510 			    (ipic->ipic_rtt >> 1);
511 		}
512 		if (ire->ire_uinfo.iulp_rtt_sd != 0) {
513 			ire->ire_uinfo.iulp_rtt_sd =
514 			    (ire->ire_uinfo.iulp_rtt_sd +
515 			    ipic->ipic_rtt_sd) >> 1;
516 		} else {
517 			ire->ire_uinfo.iulp_rtt_sd = ipic->ipic_rtt_sd +
518 			    (ipic->ipic_rtt_sd >> 1);
519 		}
520 	}
521 	if (ipic->ipic_max_frag)
522 		ire->ire_max_frag = MIN(ipic->ipic_max_frag, IP_MAXPACKET);
523 	if (ipic->ipic_ssthresh != 0) {
524 		if (ire->ire_uinfo.iulp_ssthresh != 0)
525 			ire->ire_uinfo.iulp_ssthresh =
526 			    (ipic->ipic_ssthresh +
527 			    ire->ire_uinfo.iulp_ssthresh) >> 1;
528 		else
529 			ire->ire_uinfo.iulp_ssthresh = ipic->ipic_ssthresh;
530 	}
531 	/*
532 	 * Don't need the ire_lock below this. ire_type does not change
533 	 * after initialization. ire_marks is protected by irb_lock.
534 	 */
535 	mutex_exit(&ire->ire_lock);
536 
537 	if (ipic->ipic_ire_marks != 0 && ire->ire_type == IRE_CACHE) {
538 		/*
539 		 * Only increment the temporary IRE count if the original
540 		 * IRE is not already marked temporary.
541 		 */
542 		irb = ire->ire_bucket;
543 		rw_enter(&irb->irb_lock, RW_WRITER);
544 		if ((ipic->ipic_ire_marks & IRE_MARK_TEMPORARY) &&
545 		    !(ire->ire_marks & IRE_MARK_TEMPORARY)) {
546 			irb->irb_tmp_ire_cnt++;
547 		}
548 		ire->ire_marks |= ipic->ipic_ire_marks;
549 		rw_exit(&irb->irb_lock);
550 	}
551 
552 	ire_refrele(ire);
553 	return (0);
554 }
555 
556 /*
557  * This function is associated with the IP_IOC_IRE_DELETE[_NO_REPLY]
558  * IOCTL[s].  The NO_REPLY form is used by TCP to delete a route IRE
559  * for a host that is not responding.  This will force an attempt to
560  * establish a new route, if available, and flush out the ARP entry so
561  * it will re-resolve.  Management processes may want to use the
562  * version that generates a reply.
563  *
564  * This function does not support IPv6 since Neighbor Unreachability Detection
565  * means that negative advise like this is useless.
566  */
567 /* ARGSUSED */
568 int
569 ip_ire_delete(queue_t *q, mblk_t *mp, cred_t *ioc_cr)
570 {
571 	uchar_t		*addr_ucp;
572 	ipaddr_t	addr;
573 	ire_t		*ire;
574 	ipid_t		*ipid;
575 	boolean_t	routing_sock_info = B_FALSE;	/* Sent info? */
576 	zoneid_t	zoneid;
577 	ire_t		*gire = NULL;
578 	ill_t		*ill;
579 	mblk_t		*arp_mp;
580 	ip_stack_t	*ipst;
581 
582 	ASSERT(q->q_next == NULL);
583 	zoneid = Q_TO_CONN(q)->conn_zoneid;
584 	ipst = CONNQ_TO_IPST(q);
585 
586 	/*
587 	 * Check privilege using the ioctl credential; if it is NULL
588 	 * then this is a kernel message and therefor privileged.
589 	 */
590 	if (ioc_cr != NULL && secpolicy_ip_config(ioc_cr, B_FALSE) != 0)
591 		return (EPERM);
592 
593 	ipid = (ipid_t *)mp->b_rptr;
594 
595 	/* Only actions on IRE_CACHEs are acceptable at present. */
596 	if (ipid->ipid_ire_type != IRE_CACHE)
597 		return (EINVAL);
598 
599 	addr_ucp = mi_offset_param(mp, ipid->ipid_addr_offset,
600 		ipid->ipid_addr_length);
601 	if (addr_ucp == NULL || !OK_32PTR(addr_ucp))
602 		return (EINVAL);
603 	switch (ipid->ipid_addr_length) {
604 	case IP_ADDR_LEN:
605 		/* addr_ucp points at IP addr */
606 		break;
607 	case sizeof (sin_t): {
608 		sin_t	*sin;
609 		/*
610 		 * got complete (sockaddr) address - increment addr_ucp to point
611 		 * at the ip_addr field.
612 		 */
613 		sin = (sin_t *)addr_ucp;
614 		addr_ucp = (uchar_t *)&sin->sin_addr.s_addr;
615 		break;
616 	}
617 	default:
618 		return (EINVAL);
619 	}
620 	/* Extract the destination address. */
621 	bcopy(addr_ucp, &addr, IP_ADDR_LEN);
622 
623 	/* Try to find the CACHED IRE. */
624 	ire = ire_cache_lookup(addr, zoneid, NULL, ipst);
625 
626 	/* Nail it. */
627 	if (ire) {
628 		/* Allow delete only on CACHE entries */
629 		if (ire->ire_type != IRE_CACHE) {
630 			ire_refrele(ire);
631 			return (EINVAL);
632 		}
633 
634 		/*
635 		 * Verify that the IRE has been around for a while.
636 		 * This is to protect against transport protocols
637 		 * that are too eager in sending delete messages.
638 		 */
639 		if (gethrestime_sec() <
640 		    ire->ire_create_time + ipst->ips_ip_ignore_delete_time) {
641 			ire_refrele(ire);
642 			return (EINVAL);
643 		}
644 		/*
645 		 * Now we have a potentially dead cache entry. We need
646 		 * to remove it.
647 		 * If this cache entry is generated from a
648 		 * default route (i.e., ire_cmask == 0),
649 		 * search the default list and mark it dead and some
650 		 * background process will try to activate it.
651 		 */
652 		if ((ire->ire_gateway_addr != 0) && (ire->ire_cmask == 0)) {
653 			/*
654 			 * Make sure that we pick a different
655 			 * IRE_DEFAULT next time.
656 			 */
657 			ire_t *gw_ire;
658 			irb_t *irb = NULL;
659 			uint_t match_flags;
660 
661 			match_flags = (MATCH_IRE_DEFAULT | MATCH_IRE_RJ_BHOLE);
662 
663 			gire = ire_ftable_lookup(ire->ire_addr,
664 			    ire->ire_cmask, 0, 0,
665 			    ire->ire_ipif, NULL, zoneid, 0, NULL, match_flags,
666 			    ipst);
667 
668 			ip3dbg(("ire_ftable_lookup() returned gire %p\n",
669 			    (void *)gire));
670 
671 			if (gire != NULL) {
672 				irb = gire->ire_bucket;
673 
674 				/*
675 				 * We grab it as writer just to serialize
676 				 * multiple threads trying to bump up
677 				 * irb_rr_origin
678 				 */
679 				rw_enter(&irb->irb_lock, RW_WRITER);
680 				if ((gw_ire = irb->irb_rr_origin) == NULL) {
681 					rw_exit(&irb->irb_lock);
682 					goto done;
683 				}
684 
685 				DTRACE_PROBE1(ip__ire__del__origin,
686 				    (ire_t *), gw_ire);
687 
688 				/* Skip past the potentially bad gateway */
689 				if (ire->ire_gateway_addr ==
690 				    gw_ire->ire_gateway_addr) {
691 					ire_t *next = gw_ire->ire_next;
692 
693 					DTRACE_PROBE2(ip__ire__del,
694 					    (ire_t *), gw_ire, (irb_t *), irb);
695 					IRE_FIND_NEXT_ORIGIN(next);
696 					irb->irb_rr_origin = next;
697 				}
698 				rw_exit(&irb->irb_lock);
699 			}
700 		}
701 done:
702 		if (gire != NULL)
703 			IRE_REFRELE(gire);
704 		/* report the bad route to routing sockets */
705 		ip_rts_change(RTM_LOSING, ire->ire_addr, ire->ire_gateway_addr,
706 		    ire->ire_mask, ire->ire_src_addr, 0, 0, 0,
707 		    (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_IFA), ipst);
708 		routing_sock_info = B_TRUE;
709 
710 		/*
711 		 * TCP is really telling us to start over completely, and it
712 		 * expects that we'll resend the ARP query.  Tell ARP to
713 		 * discard the entry, if this is a local destination.
714 		 */
715 		ill = ire->ire_stq->q_ptr;
716 		if (ire->ire_gateway_addr == 0 &&
717 		    (arp_mp = ill_ared_alloc(ill, addr)) != NULL) {
718 			putnext(ill->ill_rq, arp_mp);
719 		}
720 
721 		ire_delete(ire);
722 		ire_refrele(ire);
723 	}
724 	/*
725 	 * Also look for an IRE_HOST type redirect ire and
726 	 * remove it if present.
727 	 */
728 	ire = ire_route_lookup(addr, 0, 0, IRE_HOST, NULL, NULL,
729 	    ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
730 
731 	/* Nail it. */
732 	if (ire != NULL) {
733 	    if (ire->ire_flags & RTF_DYNAMIC) {
734 		if (!routing_sock_info) {
735 			ip_rts_change(RTM_LOSING, ire->ire_addr,
736 			    ire->ire_gateway_addr, ire->ire_mask,
737 			    ire->ire_src_addr, 0, 0, 0,
738 			    (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_IFA),
739 			    ipst);
740 		}
741 		ire_delete(ire);
742 	    }
743 	    ire_refrele(ire);
744 	}
745 	return (0);
746 }
747 
748 /*
749  * Named Dispatch routine to produce a formatted report on all IREs.
750  * This report is accessed by using the ndd utility to "get" ND variable
751  * "ipv4_ire_status".
752  */
753 /* ARGSUSED */
754 int
755 ip_ire_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
756 {
757 	zoneid_t zoneid;
758 	ip_stack_t	*ipst;
759 
760 	if (CONN_Q(q))
761 		ipst = CONNQ_TO_IPST(q);
762 	else
763 		ipst = ILLQ_TO_IPST(q);
764 
765 	(void) mi_mpprintf(mp,
766 	    "IRE      " MI_COL_HDRPAD_STR
767 	/*   01234567[89ABCDEF] */
768 	    "rfq      " MI_COL_HDRPAD_STR
769 	/*   01234567[89ABCDEF] */
770 	    "stq      " MI_COL_HDRPAD_STR
771 	/*   01234567[89ABCDEF] */
772 	    " zone "
773 	/*   12345 */
774 	    "addr            mask            "
775 	/*   123.123.123.123 123.123.123.123 */
776 	    "src             gateway         mxfrg rtt   rtt_sd ssthresh ref "
777 	/*   123.123.123.123 123.123.123.123 12345 12345 123456 12345678 123 */
778 	    "rtomax tstamp_ok wscale_ok ecn_ok pmtud_ok sack sendpipe "
779 	/*   123456 123456789 123456789 123456 12345678 1234 12345678 */
780 	    "recvpipe in/out/forward type");
781 	/*   12345678 in/out/forward xxxxxxxxxx */
782 
783 	/*
784 	 * Because of the ndd constraint, at most we can have 64K buffer
785 	 * to put in all IRE info.  So to be more efficient, just
786 	 * allocate a 64K buffer here, assuming we need that large buffer.
787 	 * This should be OK as only root can do ndd /dev/ip.
788 	 */
789 	if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) {
790 		/* The following may work even if we cannot get a large buf. */
791 		(void) mi_mpprintf(mp, "<< Out of buffer >>\n");
792 		return (0);
793 	}
794 
795 	zoneid = Q_TO_CONN(q)->conn_zoneid;
796 	if (zoneid == GLOBAL_ZONEID)
797 		zoneid = ALL_ZONES;
798 
799 	ire_walk_v4(ire_report_ftable, mp->b_cont, zoneid, ipst);
800 	ire_walk_v4(ire_report_ctable, mp->b_cont, zoneid, ipst);
801 
802 	return (0);
803 }
804 
805 
806 /* ire_walk routine invoked for ip_ire_report for each cached IRE. */
807 static void
808 ire_report_ctable(ire_t *ire, char *mp)
809 {
810 	char	buf1[16];
811 	char	buf2[16];
812 	char	buf3[16];
813 	char	buf4[16];
814 	uint_t	fo_pkt_count;
815 	uint_t	ib_pkt_count;
816 	int	ref;
817 	uint_t	print_len, buf_len;
818 
819 	if ((ire->ire_type & IRE_CACHETABLE) == 0)
820 	    return;
821 	buf_len = ((mblk_t *)mp)->b_datap->db_lim - ((mblk_t *)mp)->b_wptr;
822 	if (buf_len <= 0)
823 		return;
824 
825 	/* Number of active references of this ire */
826 	ref = ire->ire_refcnt;
827 	/* "inbound" to a non local address is a forward */
828 	ib_pkt_count = ire->ire_ib_pkt_count;
829 	fo_pkt_count = 0;
830 	if (!(ire->ire_type & (IRE_LOCAL|IRE_BROADCAST))) {
831 		fo_pkt_count = ib_pkt_count;
832 		ib_pkt_count = 0;
833 	}
834 	print_len =  snprintf((char *)((mblk_t *)mp)->b_wptr, buf_len,
835 	    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR "%5d "
836 	    "%s %s %s %s %05d %05ld %06ld %08d %03d %06d %09d %09d %06d %08d "
837 	    "%04d %08d %08d %d/%d/%d %s\n",
838 	    (void *)ire, (void *)ire->ire_rfq, (void *)ire->ire_stq,
839 	    (int)ire->ire_zoneid,
840 	    ip_dot_addr(ire->ire_addr, buf1), ip_dot_addr(ire->ire_mask, buf2),
841 	    ip_dot_addr(ire->ire_src_addr, buf3),
842 	    ip_dot_addr(ire->ire_gateway_addr, buf4),
843 	    ire->ire_max_frag, ire->ire_uinfo.iulp_rtt,
844 	    ire->ire_uinfo.iulp_rtt_sd, ire->ire_uinfo.iulp_ssthresh, ref,
845 	    ire->ire_uinfo.iulp_rtomax,
846 	    (ire->ire_uinfo.iulp_tstamp_ok ? 1: 0),
847 	    (ire->ire_uinfo.iulp_wscale_ok ? 1: 0),
848 	    (ire->ire_uinfo.iulp_ecn_ok ? 1: 0),
849 	    (ire->ire_uinfo.iulp_pmtud_ok ? 1: 0),
850 	    ire->ire_uinfo.iulp_sack,
851 	    ire->ire_uinfo.iulp_spipe, ire->ire_uinfo.iulp_rpipe,
852 	    ib_pkt_count, ire->ire_ob_pkt_count, fo_pkt_count,
853 	    ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type));
854 	if (print_len < buf_len) {
855 		((mblk_t *)mp)->b_wptr += print_len;
856 	} else {
857 		((mblk_t *)mp)->b_wptr += buf_len;
858 	}
859 }
860 
861 /* ARGSUSED */
862 int
863 ip_ire_report_mrtun(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
864 {
865 	ip_stack_t	*ipst;
866 
867 	if (CONN_Q(q))
868 		ipst = CONNQ_TO_IPST(q);
869 	else
870 		ipst = ILLQ_TO_IPST(q);
871 
872 	(void) mi_mpprintf(mp,
873 	"IRE      " MI_COL_HDRPAD_STR
874 	/*   01234567[89ABCDEF] */
875 	"stq      " MI_COL_HDRPAD_STR
876 	/*   01234567[89ABCDEF] */
877 	"in_ill    " MI_COL_HDRPAD_STR
878 	/*   01234567[89ABCDEF] */
879 	"in_src_addr            "
880 	/*   123.123.123.123 */
881 	"max_frag      "
882 	/*   12345 */
883 	"ref     ");
884 	/*   123 */
885 
886 	ire_walk_ill_mrtun(0, 0, ire_report_mrtun_table, mp, NULL,
887 	    ipst);
888 	return (0);
889 }
890 
891 /* mrtun report table - supports ipv4_mrtun_ire_status ndd variable */
892 
893 static void
894 ire_report_mrtun_table(ire_t *ire, char *mp)
895 {
896 	char	buf1[INET_ADDRSTRLEN];
897 	int	ref;
898 
899 	/* Number of active references of this ire */
900 	ref = ire->ire_refcnt;
901 	ASSERT(ire->ire_type == IRE_MIPRTUN);
902 	(void) mi_mpprintf((mblk_t *)mp,
903 	    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR
904 	    "%s          %05d             %03d",
905 	    (void *)ire, (void *)ire->ire_stq,
906 	    (void *)ire->ire_in_ill,
907 	    ip_dot_addr(ire->ire_in_src_addr, buf1),
908 	    ire->ire_max_frag, ref);
909 }
910 
911 /*
912  * Dispatch routine to format ires in interface based routine
913  */
914 /* ARGSUSED */
915 int
916 ip_ire_report_srcif(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
917 {
918 	ip_stack_t	*ipst;
919 
920 	if (CONN_Q(q))
921 		ipst = CONNQ_TO_IPST(q);
922 	else
923 		ipst = ILLQ_TO_IPST(q);
924 
925 	/* Report all interface based ires */
926 
927 	(void) mi_mpprintf(mp,
928 	    "IRE      " MI_COL_HDRPAD_STR
929 	    /*   01234567[89ABCDEF] */
930 	    "stq      " MI_COL_HDRPAD_STR
931 	    /*   01234567[89ABCDEF] */
932 	    "in_ill    " MI_COL_HDRPAD_STR
933 	    /*   01234567[89ABCDEF] */
934 	    "addr            "
935 	    /*   123.123.123.123 */
936 	    "gateway         "
937 	    /*   123.123.123.123 */
938 	    "max_frag      "
939 	    /*   12345 */
940 	    "ref     "
941 	    /*   123 */
942 	    "type    "
943 	    /* ABCDEFGH */
944 	    "in/out/forward");
945 	ire_walk_srcif_table_v4(ire_report_srcif_table, mp, ipst);
946 	return (0);
947 }
948 
949 /* Reports the interface table ires */
950 /* ARGSUSED2 */
951 static void
952 ire_report_srcif_table(ire_t *ire, char *mp, ip_stack_t *ipst)
953 {
954 	char    buf1[INET_ADDRSTRLEN];
955 	char    buf2[INET_ADDRSTRLEN];
956 	int	ref;
957 
958 	ref = ire->ire_refcnt;
959 	(void) mi_mpprintf((mblk_t *)mp,
960 	    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR
961 	    "%s    %s      %05d       %03d      %s     %d",
962 	    (void *)ire, (void *)ire->ire_stq,
963 	    (void *)ire->ire_in_ill,
964 	    ip_dot_addr(ire->ire_addr, buf1),
965 	    ip_dot_addr(ire->ire_gateway_addr, buf2),
966 	    ire->ire_max_frag, ref,
967 	    ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type),
968 	    ire->ire_ib_pkt_count);
969 
970 }
971 /*
972  * ip_ire_req is called by ip_wput when an IRE_DB_REQ_TYPE message is handed
973  * down from the Upper Level Protocol to request a copy of the IRE (to check
974  * its type or to extract information like round-trip time estimates or the
975  * MTU.)
976  * The address is assumed to be in the ire_addr field. If no IRE is found
977  * an IRE is returned with ire_type being zero.
978  * Note that the upper lavel protocol has to check for broadcast
979  * (IRE_BROADCAST) and multicast (CLASSD(addr)).
980  * If there is a b_cont the resulting IRE_DB_TYPE mblk is placed at the
981  * end of the returned message.
982  *
983  * TCP sends down a message of this type with a connection request packet
984  * chained on. UDP and ICMP send it down to verify that a route exists for
985  * the destination address when they get connected.
986  */
987 void
988 ip_ire_req(queue_t *q, mblk_t *mp)
989 {
990 	ire_t	*inire;
991 	ire_t	*ire;
992 	mblk_t	*mp1;
993 	ire_t	*sire = NULL;
994 	zoneid_t zoneid = Q_TO_CONN(q)->conn_zoneid;
995 	ip_stack_t	*ipst = CONNQ_TO_IPST(q);
996 
997 	ASSERT(q->q_next == NULL);
998 
999 	if ((mp->b_wptr - mp->b_rptr) < sizeof (ire_t) ||
1000 	    !OK_32PTR(mp->b_rptr)) {
1001 		freemsg(mp);
1002 		return;
1003 	}
1004 	inire = (ire_t *)mp->b_rptr;
1005 	/*
1006 	 * Got it, now take our best shot at an IRE.
1007 	 */
1008 	if (inire->ire_ipversion == IPV6_VERSION) {
1009 		ire = ire_route_lookup_v6(&inire->ire_addr_v6, 0, 0, 0,
1010 		    NULL, &sire, zoneid, NULL,
1011 		    (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT), ipst);
1012 	} else {
1013 		ASSERT(inire->ire_ipversion == IPV4_VERSION);
1014 		ire = ire_route_lookup(inire->ire_addr, 0, 0, 0,
1015 		    NULL, &sire, zoneid, NULL,
1016 		    (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT), ipst);
1017 	}
1018 
1019 	/*
1020 	 * We prevent returning IRES with source address INADDR_ANY
1021 	 * as these were temporarily created for sending packets
1022 	 * from endpoints that have conn_unspec_src set.
1023 	 */
1024 	if (ire == NULL ||
1025 	    (ire->ire_ipversion == IPV4_VERSION &&
1026 	    ire->ire_src_addr == INADDR_ANY) ||
1027 	    (ire->ire_ipversion == IPV6_VERSION &&
1028 	    IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6))) {
1029 		inire->ire_type = 0;
1030 	} else {
1031 		bcopy(ire, inire, sizeof (ire_t));
1032 		/* Copy the route metrics from the parent. */
1033 		if (sire != NULL) {
1034 			bcopy(&(sire->ire_uinfo), &(inire->ire_uinfo),
1035 			    sizeof (iulp_t));
1036 		}
1037 
1038 		/*
1039 		 * As we don't lookup global policy here, we may not
1040 		 * pass the right size if per-socket policy is not
1041 		 * present. For these cases, path mtu discovery will
1042 		 * do the right thing.
1043 		 */
1044 		inire->ire_ipsec_overhead = conn_ipsec_length(Q_TO_CONN(q));
1045 
1046 		/* Pass the latest setting of the ip_path_mtu_discovery */
1047 		inire->ire_frag_flag |=
1048 		    (ipst->ips_ip_path_mtu_discovery) ? IPH_DF : 0;
1049 	}
1050 	if (ire != NULL)
1051 		ire_refrele(ire);
1052 	if (sire != NULL)
1053 		ire_refrele(sire);
1054 	mp->b_wptr = &mp->b_rptr[sizeof (ire_t)];
1055 	mp->b_datap->db_type = IRE_DB_TYPE;
1056 
1057 	/* Put the IRE_DB_TYPE mblk last in the chain */
1058 	mp1 = mp->b_cont;
1059 	if (mp1 != NULL) {
1060 		mp->b_cont = NULL;
1061 		linkb(mp1, mp);
1062 		mp = mp1;
1063 	}
1064 	qreply(q, mp);
1065 }
1066 
1067 /*
1068  * Send a packet using the specified IRE.
1069  * If ire_src_addr_v6 is all zero then discard the IRE after
1070  * the packet has been sent.
1071  */
1072 static void
1073 ire_send(queue_t *q, mblk_t *pkt, ire_t *ire)
1074 {
1075 	mblk_t *ipsec_mp;
1076 	boolean_t is_secure;
1077 	uint_t ifindex;
1078 	ill_t	*ill;
1079 	zoneid_t zoneid = ire->ire_zoneid;
1080 	ip_stack_t	*ipst = ire->ire_ipst;
1081 
1082 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
1083 	ASSERT(!(ire->ire_type & IRE_LOCAL)); /* Has different ire_zoneid */
1084 	ipsec_mp = pkt;
1085 	is_secure = (pkt->b_datap->db_type == M_CTL);
1086 	if (is_secure) {
1087 		ipsec_out_t *io;
1088 
1089 		pkt = pkt->b_cont;
1090 		io = (ipsec_out_t *)ipsec_mp->b_rptr;
1091 		if (io->ipsec_out_type == IPSEC_OUT)
1092 			zoneid = io->ipsec_out_zoneid;
1093 	}
1094 
1095 	/* If the packet originated externally then */
1096 	if (pkt->b_prev) {
1097 		ire_refrele(ire);
1098 		/*
1099 		 * Extract the ifindex from b_prev (set in ip_rput_noire).
1100 		 * Look up interface to see if it still exists (it could have
1101 		 * been unplumbed by the time the reply came back from ARP)
1102 		 */
1103 		ifindex = (uint_t)(uintptr_t)pkt->b_prev;
1104 		ill = ill_lookup_on_ifindex(ifindex, B_FALSE,
1105 		    NULL, NULL, NULL, NULL, ipst);
1106 		if (ill == NULL) {
1107 			pkt->b_prev = NULL;
1108 			pkt->b_next = NULL;
1109 			freemsg(ipsec_mp);
1110 			return;
1111 		}
1112 		q = ill->ill_rq;
1113 		pkt->b_prev = NULL;
1114 		/*
1115 		 * This packet has not gone through IPSEC processing
1116 		 * and hence we should not have any IPSEC message
1117 		 * prepended.
1118 		 */
1119 		ASSERT(ipsec_mp == pkt);
1120 		put(q, pkt);
1121 		ill_refrele(ill);
1122 	} else if (pkt->b_next) {
1123 		/* Packets from multicast router */
1124 		pkt->b_next = NULL;
1125 		/*
1126 		 * We never get the IPSEC_OUT while forwarding the
1127 		 * packet for multicast router.
1128 		 */
1129 		ASSERT(ipsec_mp == pkt);
1130 		ip_rput_forward(ire, (ipha_t *)pkt->b_rptr, ipsec_mp, NULL);
1131 		ire_refrele(ire);
1132 	} else {
1133 		/* Locally originated packets */
1134 		boolean_t is_inaddr_any;
1135 		ipha_t *ipha = (ipha_t *)pkt->b_rptr;
1136 
1137 		/*
1138 		 * We need to do an ire_delete below for which
1139 		 * we need to make sure that the IRE will be
1140 		 * around even after calling ip_wput_ire -
1141 		 * which does ire_refrele. Otherwise somebody
1142 		 * could potentially delete this ire and hence
1143 		 * free this ire and we will be calling ire_delete
1144 		 * on a freed ire below.
1145 		 */
1146 		is_inaddr_any = (ire->ire_src_addr == INADDR_ANY);
1147 		if (is_inaddr_any) {
1148 			IRE_REFHOLD(ire);
1149 		}
1150 		/*
1151 		 * If we were resolving a router we can not use the
1152 		 * routers IRE for sending the packet (since it would
1153 		 * violate the uniqness of the IP idents) thus we
1154 		 * make another pass through ip_wput to create the IRE_CACHE
1155 		 * for the destination.
1156 		 * When IRE_MARK_NOADD is set, ire_add() is not called.
1157 		 * Thus ip_wput() will never find a ire and result in an
1158 		 * infinite loop. Thus we check whether IRE_MARK_NOADD is
1159 		 * is set. This also implies that IRE_MARK_NOADD can only be
1160 		 * used to send packets to directly connected hosts.
1161 		 */
1162 		if (ipha->ipha_dst != ire->ire_addr &&
1163 		    !(ire->ire_marks & IRE_MARK_NOADD)) {
1164 			ire_refrele(ire);	/* Held in ire_add */
1165 			if (CONN_Q(q)) {
1166 				(void) ip_output(Q_TO_CONN(q), ipsec_mp, q,
1167 				    IRE_SEND);
1168 			} else {
1169 				(void) ip_output((void *)(uintptr_t)zoneid,
1170 				    ipsec_mp, q, IRE_SEND);
1171 			}
1172 		} else {
1173 			if (is_secure) {
1174 				ipsec_out_t *oi;
1175 				ipha_t *ipha;
1176 
1177 				oi = (ipsec_out_t *)ipsec_mp->b_rptr;
1178 				ipha = (ipha_t *)ipsec_mp->b_cont->b_rptr;
1179 				if (oi->ipsec_out_proc_begin) {
1180 					/*
1181 					 * This is the case where
1182 					 * ip_wput_ipsec_out could not find
1183 					 * the IRE and recreated a new one.
1184 					 * As ip_wput_ipsec_out does ire
1185 					 * lookups, ire_refrele for the extra
1186 					 * bump in ire_add.
1187 					 */
1188 					ire_refrele(ire);
1189 					ip_wput_ipsec_out(q, ipsec_mp, ipha,
1190 					    NULL, NULL);
1191 				} else {
1192 					/*
1193 					 * IRE_REFRELE will be done in
1194 					 * ip_wput_ire.
1195 					 */
1196 					ip_wput_ire(q, ipsec_mp, ire, NULL,
1197 					    IRE_SEND, zoneid);
1198 				}
1199 			} else {
1200 				/*
1201 				 * IRE_REFRELE will be done in ip_wput_ire.
1202 				 */
1203 				ip_wput_ire(q, ipsec_mp, ire, NULL,
1204 				    IRE_SEND, zoneid);
1205 			}
1206 		}
1207 		/*
1208 		 * Special code to support sending a single packet with
1209 		 * conn_unspec_src using an IRE which has no source address.
1210 		 * The IRE is deleted here after sending the packet to avoid
1211 		 * having other code trip on it. But before we delete the
1212 		 * ire, somebody could have looked up this ire.
1213 		 * We prevent returning/using this IRE by the upper layers
1214 		 * by making checks to NULL source address in other places
1215 		 * like e.g ip_ire_append, ip_ire_req and ip_bind_connected.
1216 		 * Though, this does not completely prevent other threads
1217 		 * from using this ire, this should not cause any problems.
1218 		 *
1219 		 * NOTE : We use is_inaddr_any instead of using ire_src_addr
1220 		 * because for the normal case i.e !is_inaddr_any, ire_refrele
1221 		 * above could have potentially freed the ire.
1222 		 */
1223 		if (is_inaddr_any) {
1224 			/*
1225 			 * If this IRE has been deleted by another thread, then
1226 			 * ire_bucket won't be NULL, but ire_ptpn will be NULL.
1227 			 * Thus, ire_delete will do nothing.  This check
1228 			 * guards against calling ire_delete when the IRE was
1229 			 * never inserted in the table, which is handled by
1230 			 * ire_delete as dropping another reference.
1231 			 */
1232 			if (ire->ire_bucket != NULL) {
1233 				ip1dbg(("ire_send: delete IRE\n"));
1234 				ire_delete(ire);
1235 			}
1236 			ire_refrele(ire);	/* Held above */
1237 		}
1238 	}
1239 }
1240 
1241 /*
1242  * Send a packet using the specified IRE.
1243  * If ire_src_addr_v6 is all zero then discard the IRE after
1244  * the packet has been sent.
1245  */
1246 static void
1247 ire_send_v6(queue_t *q, mblk_t *pkt, ire_t *ire)
1248 {
1249 	mblk_t *ipsec_mp;
1250 	boolean_t secure;
1251 	uint_t ifindex;
1252 	zoneid_t zoneid = ire->ire_zoneid;
1253 	ip_stack_t	*ipst = ire->ire_ipst;
1254 
1255 	ASSERT(ire->ire_ipversion == IPV6_VERSION);
1256 	ASSERT(!(ire->ire_type & IRE_LOCAL)); /* Has different ire_zoneid */
1257 	if (pkt->b_datap->db_type == M_CTL) {
1258 		ipsec_out_t *io;
1259 
1260 		ipsec_mp = pkt;
1261 		pkt = pkt->b_cont;
1262 		secure = B_TRUE;
1263 		io = (ipsec_out_t *)ipsec_mp->b_rptr;
1264 		if (io->ipsec_out_type == IPSEC_OUT)
1265 			zoneid = io->ipsec_out_zoneid;
1266 	} else {
1267 		ipsec_mp = pkt;
1268 		secure = B_FALSE;
1269 	}
1270 
1271 	/* If the packet originated externally then */
1272 	if (pkt->b_prev) {
1273 		ill_t	*ill;
1274 		/*
1275 		 * Extract the ifindex from b_prev (set in ip_rput_data_v6).
1276 		 * Look up interface to see if it still exists (it could have
1277 		 * been unplumbed by the time the reply came back from the
1278 		 * resolver).
1279 		 */
1280 		ifindex = (uint_t)(uintptr_t)pkt->b_prev;
1281 		ill = ill_lookup_on_ifindex(ifindex, B_TRUE,
1282 		    NULL, NULL, NULL, NULL, ipst);
1283 		if (ill == NULL) {
1284 			pkt->b_prev = NULL;
1285 			pkt->b_next = NULL;
1286 			freemsg(ipsec_mp);
1287 			ire_refrele(ire);	/* Held in ire_add */
1288 			return;
1289 		}
1290 		q = ill->ill_rq;
1291 		pkt->b_prev = NULL;
1292 		/*
1293 		 * This packet has not gone through IPSEC processing
1294 		 * and hence we should not have any IPSEC message
1295 		 * prepended.
1296 		 */
1297 		ASSERT(ipsec_mp == pkt);
1298 		put(q, pkt);
1299 		ill_refrele(ill);
1300 	} else if (pkt->b_next) {
1301 		/* Packets from multicast router */
1302 		pkt->b_next = NULL;
1303 		/*
1304 		 * We never get the IPSEC_OUT while forwarding the
1305 		 * packet for multicast router.
1306 		 */
1307 		ASSERT(ipsec_mp == pkt);
1308 		/*
1309 		 * XXX TODO IPv6.
1310 		 */
1311 		freemsg(pkt);
1312 #ifdef XXX
1313 		ip_rput_forward(ire, (ipha_t *)pkt->b_rptr, pkt, NULL);
1314 #endif
1315 	} else {
1316 		if (secure) {
1317 			ipsec_out_t *oi;
1318 			ip6_t *ip6h;
1319 
1320 			oi = (ipsec_out_t *)ipsec_mp->b_rptr;
1321 			ip6h = (ip6_t *)ipsec_mp->b_cont->b_rptr;
1322 			if (oi->ipsec_out_proc_begin) {
1323 				/*
1324 				 * This is the case where
1325 				 * ip_wput_ipsec_out could not find
1326 				 * the IRE and recreated a new one.
1327 				 */
1328 				ip_wput_ipsec_out_v6(q, ipsec_mp, ip6h,
1329 				    NULL, NULL);
1330 			} else {
1331 				if (CONN_Q(q)) {
1332 					(void) ip_output_v6(Q_TO_CONN(q),
1333 					    ipsec_mp, q, IRE_SEND);
1334 				} else {
1335 					(void) ip_output_v6(
1336 					    (void *)(uintptr_t)zoneid,
1337 					    ipsec_mp, q, IRE_SEND);
1338 				}
1339 			}
1340 		} else {
1341 			/*
1342 			 * Send packets through ip_output_v6 so that any
1343 			 * ip6_info header can be processed again.
1344 			 */
1345 			if (CONN_Q(q)) {
1346 				(void) ip_output_v6(Q_TO_CONN(q), ipsec_mp, q,
1347 				    IRE_SEND);
1348 			} else {
1349 				(void) ip_output_v6((void *)(uintptr_t)zoneid,
1350 				    ipsec_mp, q, IRE_SEND);
1351 			}
1352 		}
1353 		/*
1354 		 * Special code to support sending a single packet with
1355 		 * conn_unspec_src using an IRE which has no source address.
1356 		 * The IRE is deleted here after sending the packet to avoid
1357 		 * having other code trip on it. But before we delete the
1358 		 * ire, somebody could have looked up this ire.
1359 		 * We prevent returning/using this IRE by the upper layers
1360 		 * by making checks to NULL source address in other places
1361 		 * like e.g ip_ire_append_v6, ip_ire_req and
1362 		 * ip_bind_connected_v6. Though, this does not completely
1363 		 * prevent other threads from using this ire, this should
1364 		 * not cause any problems.
1365 		 */
1366 		if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6)) {
1367 			ip1dbg(("ire_send_v6: delete IRE\n"));
1368 			ire_delete(ire);
1369 		}
1370 	}
1371 	ire_refrele(ire);	/* Held in ire_add */
1372 }
1373 
1374 /*
1375  * Make sure that IRE bucket does not get too long.
1376  * This can cause lock up because ire_cache_lookup()
1377  * may take "forever" to finish.
1378  *
1379  * We just remove cnt IREs each time.  This means that
1380  * the bucket length will stay approximately constant,
1381  * depending on cnt.  This should be enough to defend
1382  * against DoS attack based on creating temporary IREs
1383  * (for forwarding and non-TCP traffic).
1384  *
1385  * Note that new IRE is normally added at the tail of the
1386  * bucket.  This means that we are removing the "oldest"
1387  * temporary IRE added.  Only if there are IREs with
1388  * the same ire_addr, do we not add it at the tail.  Refer
1389  * to ire_add_v*().  It should be OK for our purpose.
1390  *
1391  * For non-temporary cached IREs, we make sure that they
1392  * have not been used for some time (defined below), they
1393  * are non-local destinations, and there is no one using
1394  * them at the moment (refcnt == 1).
1395  *
1396  * The above means that the IRE bucket length may become
1397  * very long, consisting of mostly non-temporary IREs.
1398  * This can happen when the hash function does a bad job
1399  * so that most TCP connections cluster to a specific bucket.
1400  * This "hopefully" should never happen.  It can also
1401  * happen if most TCP connections have very long lives.
1402  * Even with the minimal hash table size of 256, there
1403  * has to be a lot of such connections to make the bucket
1404  * length unreasonably long.  This should probably not
1405  * happen either.  The third can when this can happen is
1406  * when the machine is under attack, such as SYN flooding.
1407  * TCP should already have the proper mechanism to protect
1408  * that.  So we should be safe.
1409  *
1410  * This function is called by ire_add_then_send() after
1411  * a new IRE is added and the packet is sent.
1412  *
1413  * The idle cutoff interval is set to 60s.  It can be
1414  * changed using /etc/system.
1415  */
1416 uint32_t ire_idle_cutoff_interval = 60000;
1417 
1418 static void
1419 ire_cache_cleanup(irb_t *irb, uint32_t threshold, int cnt)
1420 {
1421 	ire_t *ire;
1422 	int tmp_cnt = cnt;
1423 	clock_t cut_off = drv_usectohz(ire_idle_cutoff_interval * 1000);
1424 
1425 	/*
1426 	 * irb is NULL if the IRE is not added to the hash.  This
1427 	 * happens when IRE_MARK_NOADD is set in ire_add_then_send()
1428 	 * and when ires are returned from ire_update_srcif_v4() routine.
1429 	 */
1430 	if (irb == NULL)
1431 		return;
1432 
1433 	IRB_REFHOLD(irb);
1434 	if (irb->irb_tmp_ire_cnt > threshold) {
1435 		for (ire = irb->irb_ire; ire != NULL && tmp_cnt > 0;
1436 		    ire = ire->ire_next) {
1437 			if (ire->ire_marks & IRE_MARK_CONDEMNED)
1438 				continue;
1439 			if (ire->ire_marks & IRE_MARK_TEMPORARY) {
1440 				ASSERT(ire->ire_type == IRE_CACHE);
1441 				ire_delete(ire);
1442 				tmp_cnt--;
1443 			}
1444 		}
1445 	}
1446 	if (irb->irb_ire_cnt - irb->irb_tmp_ire_cnt > threshold) {
1447 		for (ire = irb->irb_ire; ire != NULL && cnt > 0;
1448 		    ire = ire->ire_next) {
1449 			if (ire->ire_marks & IRE_MARK_CONDEMNED)
1450 				continue;
1451 			if (ire->ire_ipversion == IPV4_VERSION) {
1452 				if (ire->ire_gateway_addr == 0)
1453 					continue;
1454 			} else {
1455 				if (IN6_IS_ADDR_UNSPECIFIED(
1456 				    &ire->ire_gateway_addr_v6))
1457 					continue;
1458 			}
1459 			if ((ire->ire_type == IRE_CACHE) &&
1460 			    (lbolt - ire->ire_last_used_time > cut_off) &&
1461 			    (ire->ire_refcnt == 1)) {
1462 				ire_delete(ire);
1463 				cnt--;
1464 			}
1465 		}
1466 	}
1467 	IRB_REFRELE(irb);
1468 }
1469 
1470 /*
1471  * ire_add_then_send is called when a new IRE has been created in order to
1472  * route an outgoing packet.  Typically, it is called from ip_wput when
1473  * a response comes back down from a resolver.  We add the IRE, and then
1474  * possibly run the packet through ip_wput or ip_rput, as appropriate.
1475  * However, we do not add the newly created IRE in the cache when
1476  * IRE_MARK_NOADD is set in the IRE. IRE_MARK_NOADD is set at
1477  * ip_newroute_ipif(). The ires with IRE_MARK_NOADD and ires returned
1478  * by ire_update_srcif_v4() are ire_refrele'd by ip_wput_ire() and get
1479  * deleted.
1480  * Multirouting support: the packet is silently discarded when the new IRE
1481  * holds the RTF_MULTIRT flag, but is not the first IRE to be added with the
1482  * RTF_MULTIRT flag for the same destination address.
1483  * In this case, we just want to register this additional ire without
1484  * sending the packet, as it has already been replicated through
1485  * existing multirt routes in ip_wput().
1486  */
1487 void
1488 ire_add_then_send(queue_t *q, ire_t *ire, mblk_t *mp)
1489 {
1490 	irb_t *irb;
1491 	boolean_t drop = B_FALSE;
1492 	/* LINTED : set but not used in function */
1493 	boolean_t mctl_present;
1494 	mblk_t *first_mp = NULL;
1495 	mblk_t *save_mp = NULL;
1496 	ire_t *dst_ire;
1497 	ipha_t *ipha;
1498 	ip6_t *ip6h;
1499 	ip_stack_t	*ipst = ire->ire_ipst;
1500 
1501 	if (mp != NULL) {
1502 		/*
1503 		 * We first have to retrieve the destination address carried
1504 		 * by the packet.
1505 		 * We can't rely on ire as it can be related to a gateway.
1506 		 * The destination address will help in determining if
1507 		 * other RTF_MULTIRT ires are already registered.
1508 		 *
1509 		 * We first need to know where we are going : v4 or V6.
1510 		 * the ire version is enough, as there is no risk that
1511 		 * we resolve an IPv6 address with an IPv4 ire
1512 		 * or vice versa.
1513 		 */
1514 		if (ire->ire_ipversion == IPV4_VERSION) {
1515 			EXTRACT_PKT_MP(mp, first_mp, mctl_present);
1516 			ipha = (ipha_t *)mp->b_rptr;
1517 			save_mp = mp;
1518 			mp = first_mp;
1519 
1520 			dst_ire = ire_cache_lookup(ipha->ipha_dst,
1521 			    ire->ire_zoneid, MBLK_GETLABEL(mp), ipst);
1522 		} else {
1523 			ASSERT(ire->ire_ipversion == IPV6_VERSION);
1524 			/*
1525 			 * Get a pointer to the beginning of the IPv6 header.
1526 			 * Ignore leading IPsec control mblks.
1527 			 */
1528 			first_mp = mp;
1529 			if (mp->b_datap->db_type == M_CTL) {
1530 				mp = mp->b_cont;
1531 			}
1532 			ip6h = (ip6_t *)mp->b_rptr;
1533 			save_mp = mp;
1534 			mp = first_mp;
1535 			dst_ire = ire_cache_lookup_v6(&ip6h->ip6_dst,
1536 			    ire->ire_zoneid, MBLK_GETLABEL(mp), ipst);
1537 		}
1538 		if (dst_ire != NULL) {
1539 			if (dst_ire->ire_flags & RTF_MULTIRT) {
1540 				/*
1541 				 * At least one resolved multirt route
1542 				 * already exists for the destination,
1543 				 * don't sent this packet: either drop it
1544 				 * or complete the pending resolution,
1545 				 * depending on the ire.
1546 				 */
1547 				drop = B_TRUE;
1548 			}
1549 			ip1dbg(("ire_add_then_send: dst_ire %p "
1550 			    "[dst %08x, gw %08x], drop %d\n",
1551 			    (void *)dst_ire,
1552 			    (dst_ire->ire_ipversion == IPV4_VERSION) ? \
1553 				ntohl(dst_ire->ire_addr) : \
1554 				ntohl(V4_PART_OF_V6(dst_ire->ire_addr_v6)),
1555 			    (dst_ire->ire_ipversion == IPV4_VERSION) ? \
1556 				ntohl(dst_ire->ire_gateway_addr) : \
1557 				ntohl(V4_PART_OF_V6(
1558 				    dst_ire->ire_gateway_addr_v6)),
1559 			    drop));
1560 			ire_refrele(dst_ire);
1561 		}
1562 	}
1563 
1564 	if (!(ire->ire_marks & IRE_MARK_NOADD)) {
1565 		/*
1566 		 * Regular packets with cache bound ires and
1567 		 * the packets from ARP response for ires which
1568 		 * belong to the ire_srcif_v4 table, are here.
1569 		 */
1570 		if (ire->ire_in_ill == NULL) {
1571 			/* Add the ire */
1572 			(void) ire_add(&ire, NULL, NULL, NULL, B_FALSE);
1573 		} else {
1574 			/*
1575 			 * This must be ARP response for ire in interface based
1576 			 * table. Note that we don't add them in cache table,
1577 			 * instead we update the existing table with dlureq_mp
1578 			 * information. The reverse tunnel ires do not come
1579 			 * here, as reverse tunnel is non-resolver interface.
1580 			 * XXX- another design alternative was to mark the
1581 			 * ires in interface based table with a special mark to
1582 			 * make absolutely sure that we operate in right ires.
1583 			 * This idea was not implemented as part of code review
1584 			 * suggestion, as ire_in_ill suffice to distinguish
1585 			 * between the regular ires and interface based
1586 			 * ires now and thus we save a bit in the ire_marks.
1587 			 */
1588 			ire = ire_update_srcif_v4(ire);
1589 		}
1590 
1591 		if (ire == NULL) {
1592 			mp->b_prev = NULL;
1593 			mp->b_next = NULL;
1594 			MULTIRT_DEBUG_UNTAG(mp);
1595 			freemsg(mp);
1596 			return;
1597 		}
1598 		if (mp == NULL) {
1599 			ire_refrele(ire);	/* Held in ire_add_v4/v6 */
1600 			return;
1601 		}
1602 	}
1603 	if (drop) {
1604 		/*
1605 		 * If we're adding an RTF_MULTIRT ire, the resolution
1606 		 * is over: we just drop the packet.
1607 		 */
1608 		if (ire->ire_flags & RTF_MULTIRT) {
1609 			if (save_mp) {
1610 				save_mp->b_prev = NULL;
1611 				save_mp->b_next = NULL;
1612 			}
1613 			MULTIRT_DEBUG_UNTAG(mp);
1614 			freemsg(mp);
1615 		} else {
1616 			/*
1617 			 * Otherwise, we're adding the ire to a gateway
1618 			 * for a multirt route.
1619 			 * Invoke ip_newroute() to complete the resolution
1620 			 * of the route. We will then come back here and
1621 			 * finally drop this packet in the above code.
1622 			 */
1623 			if (ire->ire_ipversion == IPV4_VERSION) {
1624 				/*
1625 				 * TODO: in order for CGTP to work in non-global
1626 				 * zones, ip_newroute() must create the IRE
1627 				 * cache in the zone indicated by
1628 				 * ire->ire_zoneid.
1629 				 */
1630 				ip_newroute(q, mp, ipha->ipha_dst, 0,
1631 				    (CONN_Q(q) ? Q_TO_CONN(q) : NULL),
1632 				    ire->ire_zoneid, ipst);
1633 			} else {
1634 				ASSERT(ire->ire_ipversion == IPV6_VERSION);
1635 				ip_newroute_v6(q, mp, &ip6h->ip6_dst, NULL,
1636 				    NULL, ire->ire_zoneid, ipst);
1637 			}
1638 		}
1639 
1640 		ire_refrele(ire); /* As done by ire_send(). */
1641 		return;
1642 	}
1643 	/*
1644 	 * Need to remember ire_bucket here as ire_send*() may delete
1645 	 * the ire so we cannot reference it after that.
1646 	 */
1647 	irb = ire->ire_bucket;
1648 	if (ire->ire_ipversion == IPV6_VERSION) {
1649 		ire_send_v6(q, mp, ire);
1650 		/*
1651 		 * Clean up more than 1 IRE so that the clean up does not
1652 		 * need to be done every time when a new IRE is added and
1653 		 * the threshold is reached.
1654 		 */
1655 		ire_cache_cleanup(irb, ip6_ire_max_bucket_cnt, 2);
1656 	} else {
1657 		ire_send(q, mp, ire);
1658 		ire_cache_cleanup(irb, ip_ire_max_bucket_cnt, 2);
1659 	}
1660 }
1661 
1662 /*
1663  * Initialize the ire that is specific to IPv4 part and call
1664  * ire_init_common to finish it.
1665  */
1666 ire_t *
1667 ire_init(ire_t *ire, uchar_t *addr, uchar_t *mask, uchar_t *src_addr,
1668     uchar_t *gateway, uchar_t *in_src_addr, uint_t *max_fragp, mblk_t *fp_mp,
1669     queue_t *rfq, queue_t *stq, ushort_t type, mblk_t *dlureq_mp, ipif_t *ipif,
1670     ill_t *in_ill, ipaddr_t cmask, uint32_t phandle, uint32_t ihandle,
1671     uint32_t flags, const iulp_t *ulp_info, tsol_gc_t *gc, tsol_gcgrp_t *gcgrp,
1672     ip_stack_t *ipst)
1673 {
1674 	/*
1675 	 * Reject IRE security attribute creation/initialization
1676 	 * if system is not running in Trusted mode.
1677 	 */
1678 	if ((gc != NULL || gcgrp != NULL) && !is_system_labeled())
1679 		return (NULL);
1680 
1681 	if (fp_mp != NULL) {
1682 		/*
1683 		 * We can't dupb() here as multiple threads could be
1684 		 * calling dupb on the same mp which is incorrect.
1685 		 * First dupb() should be called only by one thread.
1686 		 */
1687 		fp_mp = copyb(fp_mp);
1688 		if (fp_mp == NULL)
1689 			return (NULL);
1690 	}
1691 
1692 	if (dlureq_mp != NULL) {
1693 		/*
1694 		 * We can't dupb() here as multiple threads could be
1695 		 * calling dupb on the same mp which is incorrect.
1696 		 * First dupb() should be called only by one thread.
1697 		 */
1698 		dlureq_mp = copyb(dlureq_mp);
1699 		if (dlureq_mp == NULL) {
1700 			if (fp_mp != NULL)
1701 				freeb(fp_mp);
1702 			return (NULL);
1703 		}
1704 	}
1705 
1706 	/*
1707 	 * Check that IRE_IF_RESOLVER and IRE_IF_NORESOLVER have a
1708 	 * dlureq_mp which is the ill_resolver_mp for IRE_IF_RESOLVER
1709 	 * and DL_UNITDATA_REQ for IRE_IF_NORESOLVER.
1710 	 */
1711 	if ((type & IRE_INTERFACE) &&
1712 	    dlureq_mp == NULL) {
1713 		ASSERT(fp_mp == NULL);
1714 		ip0dbg(("ire_init: no dlureq_mp\n"));
1715 		return (NULL);
1716 	}
1717 
1718 	BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_alloced);
1719 
1720 	if (addr != NULL)
1721 		bcopy(addr, &ire->ire_addr, IP_ADDR_LEN);
1722 	if (src_addr != NULL)
1723 		bcopy(src_addr, &ire->ire_src_addr, IP_ADDR_LEN);
1724 	if (mask != NULL) {
1725 		bcopy(mask, &ire->ire_mask, IP_ADDR_LEN);
1726 		ire->ire_masklen = ip_mask_to_plen(ire->ire_mask);
1727 	}
1728 	if (gateway != NULL) {
1729 		bcopy(gateway, &ire->ire_gateway_addr, IP_ADDR_LEN);
1730 	}
1731 	if (in_src_addr != NULL) {
1732 		bcopy(in_src_addr, &ire->ire_in_src_addr, IP_ADDR_LEN);
1733 	}
1734 
1735 	if (type == IRE_CACHE)
1736 		ire->ire_cmask = cmask;
1737 
1738 	/* ire_init_common will free the mblks upon encountering any failure */
1739 	if (!ire_init_common(ire, max_fragp, fp_mp, rfq, stq, type, dlureq_mp,
1740 	    ipif, in_ill, phandle, ihandle, flags, IPV4_VERSION, ulp_info,
1741 	    gc, gcgrp, ipst))
1742 		return (NULL);
1743 
1744 	return (ire);
1745 }
1746 
1747 /*
1748  * Similar to ire_create except that it is called only when
1749  * we want to allocate ire as an mblk e.g. we have an external
1750  * resolver ARP.
1751  */
1752 ire_t *
1753 ire_create_mp(uchar_t *addr, uchar_t *mask, uchar_t *src_addr, uchar_t *gateway,
1754     uchar_t *in_src_addr, uint_t max_frag, mblk_t *fp_mp, queue_t *rfq,
1755     queue_t *stq, ushort_t type, mblk_t *dlureq_mp, ipif_t *ipif, ill_t *in_ill,
1756     ipaddr_t cmask, uint32_t phandle, uint32_t ihandle, uint32_t flags,
1757     const iulp_t *ulp_info, tsol_gc_t *gc, tsol_gcgrp_t *gcgrp,
1758     ip_stack_t *ipst)
1759 {
1760 	ire_t	*ire, *buf;
1761 	ire_t	*ret_ire;
1762 	mblk_t	*mp;
1763 	size_t	bufsize;
1764 	frtn_t	*frtnp;
1765 	ill_t	*ill;
1766 
1767 	bufsize = sizeof (ire_t) + sizeof (frtn_t);
1768 	buf = kmem_alloc(bufsize, KM_NOSLEEP);
1769 	if (buf == NULL) {
1770 		ip1dbg(("ire_create_mp: alloc failed\n"));
1771 		return (NULL);
1772 	}
1773 	frtnp = (frtn_t *)(buf + 1);
1774 	frtnp->free_arg = (caddr_t)buf;
1775 	frtnp->free_func = ire_freemblk;
1776 
1777 	/*
1778 	 * Allocate the new IRE. The ire created will hold a ref on
1779 	 * an nce_t after ire_nce_init, and this ref must either be
1780 	 * (a)  transferred to the ire_cache entry created when ire_add_v4
1781 	 *	is called after successful arp resolution, or,
1782 	 * (b)  released, when arp resolution fails
1783 	 * Case (b) is handled in ire_freemblk() which will be called
1784 	 * when mp is freed as a result of failed arp.
1785 	 */
1786 	mp = esballoc((unsigned char *)buf, bufsize, BPRI_MED, frtnp);
1787 	if (mp == NULL) {
1788 		ip1dbg(("ire_create_mp: alloc failed\n"));
1789 		kmem_free(buf, bufsize);
1790 		return (NULL);
1791 	}
1792 	ire = (ire_t *)mp->b_rptr;
1793 	mp->b_wptr = (uchar_t *)&ire[1];
1794 
1795 	/* Start clean. */
1796 	*ire = ire_null;
1797 	ire->ire_mp = mp;
1798 	mp->b_datap->db_type = IRE_DB_TYPE;
1799 	ire->ire_marks |= IRE_MARK_UNCACHED;
1800 
1801 	ret_ire = ire_init(ire, addr, mask, src_addr, gateway, in_src_addr,
1802 	    NULL, fp_mp, rfq, stq, type, dlureq_mp, ipif, in_ill, cmask,
1803 	    phandle, ihandle, flags, ulp_info, gc, gcgrp, ipst);
1804 
1805 	ill = (ill_t *)(stq->q_ptr);
1806 	if (ret_ire == NULL) {
1807 		/* ire_freemblk needs these set */
1808 		ire->ire_stq_ifindex = ill->ill_phyint->phyint_ifindex;
1809 		ire->ire_ipst = ipst;
1810 		freeb(ire->ire_mp);
1811 		return (NULL);
1812 	}
1813 	ret_ire->ire_stq_ifindex = ill->ill_phyint->phyint_ifindex;
1814 	ASSERT(ret_ire == ire);
1815 	/*
1816 	 * ire_max_frag is normally zero here and is atomically set
1817 	 * under the irebucket lock in ire_add_v[46] except for the
1818 	 * case of IRE_MARK_NOADD. In that event the the ire_max_frag
1819 	 * is non-zero here.
1820 	 */
1821 	ire->ire_max_frag = max_frag;
1822 	return (ire);
1823 }
1824 
1825 /*
1826  * ire_create is called to allocate and initialize a new IRE.
1827  *
1828  * NOTE : This is called as writer sometimes though not required
1829  * by this function.
1830  */
1831 ire_t *
1832 ire_create(uchar_t *addr, uchar_t *mask, uchar_t *src_addr, uchar_t *gateway,
1833     uchar_t *in_src_addr, uint_t *max_fragp, mblk_t *fp_mp, queue_t *rfq,
1834     queue_t *stq, ushort_t type, mblk_t *dlureq_mp, ipif_t *ipif, ill_t *in_ill,
1835     ipaddr_t cmask, uint32_t phandle, uint32_t ihandle, uint32_t flags,
1836     const iulp_t *ulp_info, tsol_gc_t *gc, tsol_gcgrp_t *gcgrp,
1837     ip_stack_t *ipst)
1838 {
1839 	ire_t	*ire;
1840 	ire_t	*ret_ire;
1841 
1842 	ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
1843 	if (ire == NULL) {
1844 		ip1dbg(("ire_create: alloc failed\n"));
1845 		return (NULL);
1846 	}
1847 	*ire = ire_null;
1848 
1849 	ret_ire = ire_init(ire, addr, mask, src_addr, gateway, in_src_addr,
1850 	    max_fragp, fp_mp, rfq, stq, type, dlureq_mp, ipif, in_ill,  cmask,
1851 	    phandle, ihandle, flags, ulp_info, gc, gcgrp, ipst);
1852 
1853 	if (ret_ire == NULL) {
1854 		kmem_cache_free(ire_cache, ire);
1855 		return (NULL);
1856 	}
1857 	ASSERT(ret_ire == ire);
1858 	return (ire);
1859 }
1860 
1861 
1862 /*
1863  * Common to IPv4 and IPv6
1864  */
1865 boolean_t
1866 ire_init_common(ire_t *ire, uint_t *max_fragp, mblk_t *fp_mp,
1867     queue_t *rfq, queue_t *stq, ushort_t type,
1868     mblk_t *dlureq_mp, ipif_t *ipif, ill_t *in_ill, uint32_t phandle,
1869     uint32_t ihandle, uint32_t flags, uchar_t ipversion,
1870     const iulp_t *ulp_info, tsol_gc_t *gc, tsol_gcgrp_t *gcgrp,
1871     ip_stack_t *ipst)
1872 {
1873 	ire->ire_max_fragp = max_fragp;
1874 	ire->ire_frag_flag |= (ipst->ips_ip_path_mtu_discovery) ? IPH_DF : 0;
1875 
1876 	ASSERT(fp_mp == NULL || fp_mp->b_datap->db_type == M_DATA);
1877 #ifdef DEBUG
1878 	if (ipif != NULL) {
1879 		if (ipif->ipif_isv6)
1880 			ASSERT(ipversion == IPV6_VERSION);
1881 		else
1882 			ASSERT(ipversion == IPV4_VERSION);
1883 	}
1884 #endif /* DEBUG */
1885 
1886 	/*
1887 	 * Create/initialize IRE security attribute only in Trusted mode;
1888 	 * if the passed in gc/gcgrp is non-NULL, we expect that the caller
1889 	 * has held a reference to it and will release it when this routine
1890 	 * returns a failure, otherwise we own the reference.  We do this
1891 	 * prior to initializing the rest IRE fields.
1892 	 *
1893 	 * Don't allocate ire_gw_secattr for the resolver case to prevent
1894 	 * memory leak (in case of external resolution failure). We'll
1895 	 * allocate it after a successful external resolution, in ire_add().
1896 	 * Note that ire->ire_mp != NULL here means this ire is headed
1897 	 * to an external resolver.
1898 	 */
1899 	if (is_system_labeled()) {
1900 		if ((type & (IRE_LOCAL | IRE_LOOPBACK | IRE_BROADCAST |
1901 		    IRE_INTERFACE)) != 0) {
1902 			/* release references on behalf of caller */
1903 			if (gc != NULL)
1904 				GC_REFRELE(gc);
1905 			if (gcgrp != NULL)
1906 				GCGRP_REFRELE(gcgrp);
1907 		} else if ((ire->ire_mp == NULL) &&
1908 		    tsol_ire_init_gwattr(ire, ipversion, gc, gcgrp) != 0) {
1909 			/* free any caller-allocated mblks upon failure */
1910 			if (fp_mp != NULL)
1911 				freeb(fp_mp);
1912 			if (dlureq_mp != NULL)
1913 				freeb(dlureq_mp);
1914 			return (B_FALSE);
1915 		}
1916 	}
1917 
1918 	ire->ire_stq = stq;
1919 	ire->ire_rfq = rfq;
1920 	ire->ire_type = type;
1921 	ire->ire_flags = RTF_UP | flags;
1922 	ire->ire_ident = TICK_TO_MSEC(lbolt);
1923 	bcopy(ulp_info, &ire->ire_uinfo, sizeof (iulp_t));
1924 
1925 	ire->ire_tire_mark = ire->ire_ob_pkt_count + ire->ire_ib_pkt_count;
1926 	ire->ire_last_used_time = lbolt;
1927 	ire->ire_create_time = (uint32_t)gethrestime_sec();
1928 
1929 	/*
1930 	 * If this IRE is an IRE_CACHE, inherit the handles from the
1931 	 * parent IREs. For others in the forwarding table, assign appropriate
1932 	 * new ones.
1933 	 *
1934 	 * The mutex protecting ire_handle is because ire_create is not always
1935 	 * called as a writer.
1936 	 */
1937 	if (ire->ire_type & IRE_OFFSUBNET) {
1938 		mutex_enter(&ipst->ips_ire_handle_lock);
1939 		ire->ire_phandle = (uint32_t)ipst->ips_ire_handle++;
1940 		mutex_exit(&ipst->ips_ire_handle_lock);
1941 	} else if (ire->ire_type & IRE_INTERFACE) {
1942 		mutex_enter(&ipst->ips_ire_handle_lock);
1943 		ire->ire_ihandle = (uint32_t)ipst->ips_ire_handle++;
1944 		mutex_exit(&ipst->ips_ire_handle_lock);
1945 	} else if (ire->ire_type == IRE_CACHE) {
1946 		ire->ire_phandle = phandle;
1947 		ire->ire_ihandle = ihandle;
1948 	}
1949 	ire->ire_in_ill = in_ill;
1950 	ire->ire_ipif = ipif;
1951 	if (ipif != NULL) {
1952 		ire->ire_ipif_seqid = ipif->ipif_seqid;
1953 		ire->ire_zoneid = ipif->ipif_zoneid;
1954 	} else {
1955 		ire->ire_zoneid = GLOBAL_ZONEID;
1956 	}
1957 	ire->ire_ipversion = ipversion;
1958 	mutex_init(&ire->ire_lock, NULL, MUTEX_DEFAULT, NULL);
1959 	if (ipversion == IPV4_VERSION) {
1960 		if (ire_nce_init(ire, fp_mp, dlureq_mp) != 0) {
1961 			/* some failure occurred. propagate error back */
1962 			return (B_FALSE);
1963 		}
1964 	} else {
1965 		ASSERT(ipversion == IPV6_VERSION);
1966 		/*
1967 		 * IPv6 initializes the ire_nce in ire_add_v6,
1968 		 * which expects to find the ire_nce to be null when
1969 		 * when it is called.
1970 		 */
1971 		if (dlureq_mp)
1972 			freemsg(dlureq_mp);
1973 		if (fp_mp)
1974 			freemsg(fp_mp);
1975 	}
1976 	ire->ire_refcnt = 1;
1977 	ire->ire_ipst = ipst;	/* No netstack_hold */
1978 
1979 #ifdef IRE_DEBUG
1980 	bzero(ire->ire_trace, sizeof (th_trace_t *) * IP_TR_HASH_MAX);
1981 #endif
1982 
1983 	return (B_TRUE);
1984 }
1985 
1986 /*
1987  * This routine is called repeatedly by ipif_up to create broadcast IREs.
1988  * It is passed a pointer to a slot in an IRE pointer array into which to
1989  * place the pointer to the new IRE, if indeed we create one.  If the
1990  * IRE corresponding to the address passed in would be a duplicate of an
1991  * existing one, we don't create the new one.  irep is incremented before
1992  * return only if we do create a new IRE.  (Always called as writer.)
1993  *
1994  * Note that with the "match_flags" parameter, we can match on either
1995  * a particular logical interface (MATCH_IRE_IPIF) or for all logical
1996  * interfaces for a given physical interface (MATCH_IRE_ILL).  Currently,
1997  * we only create broadcast ire's on a per physical interface basis. If
1998  * someone is going to be mucking with logical interfaces, it is important
1999  * to call "ipif_check_bcast_ires()" to make sure that any change to a
2000  * logical interface will not cause critical broadcast IRE's to be deleted.
2001  */
2002 ire_t **
2003 ire_check_and_create_bcast(ipif_t *ipif, ipaddr_t  addr, ire_t **irep,
2004     int match_flags)
2005 {
2006 	ire_t *ire;
2007 	uint64_t check_flags = IPIF_DEPRECATED | IPIF_NOLOCAL | IPIF_ANYCAST;
2008 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
2009 
2010 	/*
2011 	 * No broadcast IREs for the LOOPBACK interface
2012 	 * or others such as point to point and IPIF_NOXMIT.
2013 	 */
2014 	if (!(ipif->ipif_flags & IPIF_BROADCAST) ||
2015 	    (ipif->ipif_flags & IPIF_NOXMIT))
2016 		return (irep);
2017 
2018 	/* If this would be a duplicate, don't bother. */
2019 	if ((ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, ipif,
2020 	    ipif->ipif_zoneid, NULL, match_flags, ipst)) != NULL) {
2021 		/*
2022 		 * We look for non-deprecated (and non-anycast, non-nolocal)
2023 		 * ipifs as the best choice. ipifs with check_flags matching
2024 		 * (deprecated, etc) are used only if non-deprecated ipifs
2025 		 * are not available. if the existing ire's ipif is deprecated
2026 		 * and the new ipif is non-deprecated, switch to the new ipif
2027 		 */
2028 		if ((!(ire->ire_ipif->ipif_flags & check_flags)) ||
2029 		    (ipif->ipif_flags & check_flags)) {
2030 			ire_refrele(ire);
2031 			return (irep);
2032 		}
2033 		/*
2034 		 * Bcast ires exist in pairs. Both have to be deleted,
2035 		 * Since we are exclusive we can make the above assertion.
2036 		 * The 1st has to be refrele'd since it was ctable_lookup'd.
2037 		 */
2038 		ASSERT(IAM_WRITER_IPIF(ipif));
2039 		ASSERT(ire->ire_next->ire_addr == ire->ire_addr);
2040 		ire_delete(ire->ire_next);
2041 		ire_delete(ire);
2042 		ire_refrele(ire);
2043 	}
2044 
2045 	irep = ire_create_bcast(ipif, addr, irep);
2046 
2047 	return (irep);
2048 }
2049 
2050 uint_t ip_loopback_mtu = IP_LOOPBACK_MTU;
2051 
2052 /*
2053  * This routine is called from ipif_check_bcast_ires and ire_check_bcast.
2054  * It leaves all the verifying and deleting to those routines. So it always
2055  * creates 2 bcast ires and chains them into the ire array passed in.
2056  */
2057 ire_t **
2058 ire_create_bcast(ipif_t *ipif, ipaddr_t  addr, ire_t **irep)
2059 {
2060 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
2061 
2062 	*irep++ = ire_create(
2063 	    (uchar_t *)&addr,			/* dest addr */
2064 	    (uchar_t *)&ip_g_all_ones,		/* mask */
2065 	    (uchar_t *)&ipif->ipif_src_addr,	/* source addr */
2066 	    NULL,				/* no gateway */
2067 	    NULL,				/* no in_src_addr */
2068 	    &ipif->ipif_mtu,			/* max frag */
2069 	    NULL,				/* fast path header */
2070 	    ipif->ipif_rq,			/* recv-from queue */
2071 	    ipif->ipif_wq,			/* send-to queue */
2072 	    IRE_BROADCAST,
2073 	    ipif->ipif_bcast_mp,		/* xmit header */
2074 	    ipif,
2075 	    NULL,
2076 	    0,
2077 	    0,
2078 	    0,
2079 	    0,
2080 	    &ire_uinfo_null,
2081 	    NULL,
2082 	    NULL,
2083 	    ipst);
2084 
2085 	*irep++ = ire_create(
2086 		(uchar_t *)&addr,		 /* dest address */
2087 		(uchar_t *)&ip_g_all_ones,	 /* mask */
2088 		(uchar_t *)&ipif->ipif_src_addr, /* source address */
2089 		NULL,				 /* no gateway */
2090 		NULL,				 /* no in_src_addr */
2091 		&ip_loopback_mtu,		 /* max frag size */
2092 		NULL,				 /* Fast Path header */
2093 		ipif->ipif_rq,			 /* recv-from queue */
2094 		NULL,				 /* no send-to queue */
2095 		IRE_BROADCAST,		/* Needed for fanout in wput */
2096 		NULL,
2097 		ipif,
2098 		NULL,
2099 		0,
2100 		0,
2101 		0,
2102 		0,
2103 		&ire_uinfo_null,
2104 		NULL,
2105 		NULL,
2106 		ipst);
2107 
2108 	return (irep);
2109 }
2110 
2111 /*
2112  * ire_walk routine to delete or update any IRE_CACHE that might contain
2113  * stale information.
2114  * The flags state which entries to delete or update.
2115  * Garbage collection is done separately using kmem alloc callbacks to
2116  * ip_trash_ire_reclaim.
2117  * Used for both IPv4 and IPv6. However, IPv6 only uses FLUSH_MTU_TIME
2118  * since other stale information is cleaned up using NUD.
2119  */
2120 void
2121 ire_expire(ire_t *ire, char *arg)
2122 {
2123 	ire_expire_arg_t	*ieap = (ire_expire_arg_t *)(uintptr_t)arg;
2124 	ill_t			*stq_ill;
2125 	int			flush_flags = ieap->iea_flush_flag;
2126 	ip_stack_t		*ipst = ieap->iea_ipst;
2127 
2128 	if ((flush_flags & FLUSH_REDIRECT_TIME) &&
2129 	    (ire->ire_flags & RTF_DYNAMIC)) {
2130 		/* Make sure we delete the corresponding IRE_CACHE */
2131 		ip1dbg(("ire_expire: all redirects\n"));
2132 		ip_rts_rtmsg(RTM_DELETE, ire, 0, ipst);
2133 		ire_delete(ire);
2134 		atomic_dec_32(&ipst->ips_ip_redirect_cnt);
2135 		return;
2136 	}
2137 	if (ire->ire_type != IRE_CACHE)
2138 		return;
2139 
2140 	if (flush_flags & FLUSH_ARP_TIME) {
2141 		/*
2142 		 * Remove all IRE_CACHE.
2143 		 * Verify that create time is more than
2144 		 * ip_ire_arp_interval milliseconds ago.
2145 		 */
2146 		if (NCE_EXPIRED(ire->ire_nce, ipst)) {
2147 			ire_delete(ire);
2148 			return;
2149 		}
2150 	}
2151 
2152 	if (ipst->ips_ip_path_mtu_discovery && (flush_flags & FLUSH_MTU_TIME) &&
2153 	    (ire->ire_ipif != NULL)) {
2154 		/* Increase pmtu if it is less than the interface mtu */
2155 		mutex_enter(&ire->ire_lock);
2156 		/*
2157 		 * If the ipif is a vni (whose mtu is 0, since it's virtual)
2158 		 * get the mtu from the sending interfaces' ipif
2159 		 */
2160 		if (IS_VNI(ire->ire_ipif->ipif_ill)) {
2161 			stq_ill = ire->ire_stq->q_ptr;
2162 			ire->ire_max_frag = MIN(stq_ill->ill_ipif->ipif_mtu,
2163 			    IP_MAXPACKET);
2164 		} else {
2165 			ire->ire_max_frag = MIN(ire->ire_ipif->ipif_mtu,
2166 			    IP_MAXPACKET);
2167 		}
2168 		ire->ire_frag_flag |= IPH_DF;
2169 		mutex_exit(&ire->ire_lock);
2170 	}
2171 }
2172 
2173 /*
2174  * Return any local address.  We use this to target ourselves
2175  * when the src address was specified as 'default'.
2176  * Preference for IRE_LOCAL entries.
2177  */
2178 ire_t *
2179 ire_lookup_local(zoneid_t zoneid, ip_stack_t *ipst)
2180 {
2181 	ire_t	*ire;
2182 	irb_t	*irb;
2183 	ire_t	*maybe = NULL;
2184 	int i;
2185 
2186 	for (i = 0; i < ipst->ips_ip_cache_table_size;  i++) {
2187 		irb = &ipst->ips_ip_cache_table[i];
2188 		if (irb->irb_ire == NULL)
2189 			continue;
2190 		rw_enter(&irb->irb_lock, RW_READER);
2191 		for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
2192 			if ((ire->ire_marks & IRE_MARK_CONDEMNED) ||
2193 			    (ire->ire_zoneid != zoneid &&
2194 			    ire->ire_zoneid != ALL_ZONES))
2195 				continue;
2196 			switch (ire->ire_type) {
2197 			case IRE_LOOPBACK:
2198 				if (maybe == NULL) {
2199 					IRE_REFHOLD(ire);
2200 					maybe = ire;
2201 				}
2202 				break;
2203 			case IRE_LOCAL:
2204 				if (maybe != NULL) {
2205 					ire_refrele(maybe);
2206 				}
2207 				IRE_REFHOLD(ire);
2208 				rw_exit(&irb->irb_lock);
2209 				return (ire);
2210 			}
2211 		}
2212 		rw_exit(&irb->irb_lock);
2213 	}
2214 	return (maybe);
2215 }
2216 
2217 /*
2218  * If the specified IRE is associated with a particular ILL, return
2219  * that ILL pointer (May be called as writer.).
2220  *
2221  * NOTE : This is not a generic function that can be used always.
2222  * This function always returns the ill of the outgoing packets
2223  * if this ire is used.
2224  */
2225 ill_t *
2226 ire_to_ill(const ire_t *ire)
2227 {
2228 	ill_t *ill = NULL;
2229 
2230 	/*
2231 	 * 1) For an IRE_CACHE, ire_ipif is the one where it obtained
2232 	 *    the source address from. ire_stq is the one where the
2233 	 *    packets will be sent out on. We return that here.
2234 	 *
2235 	 * 2) IRE_BROADCAST normally has a loopback and a non-loopback
2236 	 *    copy and they always exist next to each other with loopback
2237 	 *    copy being the first one. If we are called on the non-loopback
2238 	 *    copy, return the one pointed by ire_stq. If it was called on
2239 	 *    a loopback copy, we still return the one pointed by the next
2240 	 *    ire's ire_stq pointer i.e the one pointed by the non-loopback
2241 	 *    copy. We don't want use ire_ipif as it might represent the
2242 	 *    source address (if we borrow source addresses for
2243 	 *    IRE_BROADCASTS in the future).
2244 	 *    However if an interface is currently coming up, the above
2245 	 *    condition may not hold during that period since the ires
2246 	 *    are added one at a time. Thus one of the pair could have been
2247 	 *    added and the other not yet added.
2248 	 * 3) For many other IREs (e.g., IRE_LOCAL), ire_rfq indicates the ill.
2249 	 * 4) For all others return the ones pointed by ire_ipif->ipif_ill.
2250 	 *    That handles IRE_LOOPBACK.
2251 	 */
2252 
2253 	if (ire->ire_type == IRE_CACHE) {
2254 		ill = (ill_t *)ire->ire_stq->q_ptr;
2255 	} else if (ire->ire_type == IRE_BROADCAST) {
2256 		if (ire->ire_stq != NULL) {
2257 			ill = (ill_t *)ire->ire_stq->q_ptr;
2258 		} else {
2259 			ire_t  *ire_next;
2260 
2261 			ire_next = ire->ire_next;
2262 			if (ire_next != NULL &&
2263 			    ire_next->ire_type == IRE_BROADCAST &&
2264 			    ire_next->ire_addr == ire->ire_addr &&
2265 			    ire_next->ire_ipif == ire->ire_ipif) {
2266 				ill = (ill_t *)ire_next->ire_stq->q_ptr;
2267 			}
2268 		}
2269 	} else if (ire->ire_rfq != NULL) {
2270 		ill = ire->ire_rfq->q_ptr;
2271 	} else if (ire->ire_ipif != NULL) {
2272 		ill = ire->ire_ipif->ipif_ill;
2273 	}
2274 	return (ill);
2275 }
2276 
2277 /* Arrange to call the specified function for every IRE in the world. */
2278 void
2279 ire_walk(pfv_t func, void *arg, ip_stack_t *ipst)
2280 {
2281 	ire_walk_ipvers(func, arg, 0, ALL_ZONES, ipst);
2282 }
2283 
2284 void
2285 ire_walk_v4(pfv_t func, void *arg, zoneid_t zoneid, ip_stack_t *ipst)
2286 {
2287 	ire_walk_ipvers(func, arg, IPV4_VERSION, zoneid, ipst);
2288 }
2289 
2290 void
2291 ire_walk_v6(pfv_t func, void *arg, zoneid_t zoneid, ip_stack_t *ipst)
2292 {
2293 	ire_walk_ipvers(func, arg, IPV6_VERSION, zoneid, ipst);
2294 }
2295 
2296 /*
2297  * Walk a particular version. version == 0 means both v4 and v6.
2298  */
2299 static void
2300 ire_walk_ipvers(pfv_t func, void *arg, uchar_t vers, zoneid_t zoneid,
2301     ip_stack_t *ipst)
2302 {
2303 	if (vers != IPV6_VERSION) {
2304 		/*
2305 		 * ip_forwarding_table variable doesn't matter for IPv4 since
2306 		 * ire_walk_ill_tables uses ips_ip_ftable for IPv4.
2307 		 */
2308 		ire_walk_ill_tables(0, 0, func, arg, IP_MASK_TABLE_SIZE,
2309 		    0, NULL,
2310 		    ipst->ips_ip_cache_table_size, ipst->ips_ip_cache_table,
2311 		    NULL, zoneid, ipst);
2312 	}
2313 	if (vers != IPV4_VERSION) {
2314 		ire_walk_ill_tables(0, 0, func, arg, IP6_MASK_TABLE_SIZE,
2315 		    ipst->ips_ip6_ftable_hash_size,
2316 		    ipst->ips_ip_forwarding_table_v6,
2317 		    ipst->ips_ip6_cache_table_size,
2318 		    ipst->ips_ip_cache_table_v6, NULL, zoneid, ipst);
2319 	}
2320 }
2321 
2322 /*
2323  * Arrange to call the specified
2324  * function for every IRE that matches the ill.
2325  */
2326 void
2327 ire_walk_ill(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg,
2328     ill_t *ill)
2329 {
2330 	ire_walk_ill_ipvers(match_flags, ire_type, func, arg, 0, ill);
2331 }
2332 
2333 void
2334 ire_walk_ill_v4(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg,
2335     ill_t *ill)
2336 {
2337 	ire_walk_ill_ipvers(match_flags, ire_type, func, arg, IPV4_VERSION,
2338 	    ill);
2339 }
2340 
2341 void
2342 ire_walk_ill_v6(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg,
2343     ill_t *ill)
2344 {
2345 	ire_walk_ill_ipvers(match_flags, ire_type, func, arg, IPV6_VERSION,
2346 	    ill);
2347 }
2348 
2349 /*
2350  * Walk a particular ill and version. version == 0 means both v4 and v6.
2351  */
2352 static void
2353 ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type, pfv_t func,
2354     void *arg, uchar_t vers, ill_t *ill)
2355 {
2356 	ip_stack_t	*ipst = ill->ill_ipst;
2357 
2358 	if (vers != IPV6_VERSION) {
2359 		ire_walk_ill_tables(match_flags, ire_type, func, arg,
2360 		    IP_MASK_TABLE_SIZE, 0,
2361 		    NULL, ipst->ips_ip_cache_table_size,
2362 		    ipst->ips_ip_cache_table, ill, ALL_ZONES, ipst);
2363 	}
2364 	if (vers != IPV4_VERSION) {
2365 		ire_walk_ill_tables(match_flags, ire_type, func, arg,
2366 		    IP6_MASK_TABLE_SIZE, ipst->ips_ip6_ftable_hash_size,
2367 		    ipst->ips_ip_forwarding_table_v6,
2368 		    ipst->ips_ip6_cache_table_size,
2369 		    ipst->ips_ip_cache_table_v6, ill, ALL_ZONES, ipst);
2370 	}
2371 }
2372 
2373 boolean_t
2374 ire_walk_ill_match(uint_t match_flags, uint_t ire_type, ire_t *ire,
2375     ill_t *ill, zoneid_t zoneid, ip_stack_t *ipst)
2376 {
2377 	ill_t *ire_stq_ill = NULL;
2378 	ill_t *ire_ipif_ill = NULL;
2379 	ill_group_t *ire_ill_group = NULL;
2380 
2381 	ASSERT(match_flags != 0 || zoneid != ALL_ZONES);
2382 	/*
2383 	 * 1) MATCH_IRE_WQ : Used specifically to match on ire_stq.
2384 	 *    The fast path update uses this to make sure it does not
2385 	 *    update the fast path header of interface X with the fast
2386 	 *    path updates it recieved on interface Y.  It is similar
2387 	 *    in handling DL_NOTE_FASTPATH_FLUSH.
2388 	 *
2389 	 * 2) MATCH_IRE_ILL/MATCH_IRE_ILL_GROUP : We match both on ill
2390 	 *    pointed by ire_stq and ire_ipif. Only in the case of
2391 	 *    IRE_CACHEs can ire_stq and ire_ipif be pointing to
2392 	 *    different ills. But we want to keep this function generic
2393 	 *    enough for future use. So, we always try to match on both.
2394 	 *    The only caller of this function ire_walk_ill_tables, will
2395 	 *    call "func" after we return from this function. We expect
2396 	 *    "func" to do the right filtering of ires in this case.
2397 	 *
2398 	 * NOTE : In the case of MATCH_IRE_ILL_GROUP, groups
2399 	 * pointed by ire_stq and ire_ipif should always be the same.
2400 	 * So, we just match on only one of them.
2401 	 */
2402 	if (match_flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP)) {
2403 		if (ire->ire_stq != NULL)
2404 			ire_stq_ill = (ill_t *)ire->ire_stq->q_ptr;
2405 		if (ire->ire_ipif != NULL)
2406 			ire_ipif_ill = ire->ire_ipif->ipif_ill;
2407 		if (ire_stq_ill != NULL)
2408 			ire_ill_group = ire_stq_ill->ill_group;
2409 		if ((ire_ill_group == NULL) && (ire_ipif_ill != NULL))
2410 			ire_ill_group = ire_ipif_ill->ill_group;
2411 	}
2412 
2413 	if (zoneid != ALL_ZONES) {
2414 		/*
2415 		 * We're walking the IREs for a specific zone. The only relevant
2416 		 * IREs are:
2417 		 * - all IREs with a matching ire_zoneid
2418 		 * - all IRE_OFFSUBNETs as they're shared across all zones
2419 		 * - IRE_INTERFACE IREs for interfaces with a usable source addr
2420 		 *   with a matching zone
2421 		 * - IRE_DEFAULTs with a gateway reachable from the zone
2422 		 * We should really match on IRE_OFFSUBNETs and IRE_DEFAULTs
2423 		 * using the same rule; but the above rules are consistent with
2424 		 * the behavior of ire_ftable_lookup[_v6]() so that all the
2425 		 * routes that can be matched during lookup are also matched
2426 		 * here.
2427 		 */
2428 		if (zoneid != ire->ire_zoneid && ire->ire_zoneid != ALL_ZONES) {
2429 			/*
2430 			 * Note, IRE_INTERFACE can have the stq as NULL. For
2431 			 * example, if the default multicast route is tied to
2432 			 * the loopback address.
2433 			 */
2434 			if ((ire->ire_type & IRE_INTERFACE) &&
2435 			    (ire->ire_stq != NULL)) {
2436 				ire_stq_ill = (ill_t *)ire->ire_stq->q_ptr;
2437 				if (ire->ire_ipversion == IPV4_VERSION) {
2438 					if (!ipif_usesrc_avail(ire_stq_ill,
2439 					    zoneid))
2440 						/* No usable src addr in zone */
2441 						return (B_FALSE);
2442 				} else if (ire_stq_ill->ill_usesrc_ifindex
2443 				    != 0) {
2444 					/*
2445 					 * For IPv6 use ipif_select_source_v6()
2446 					 * so the right scope selection is done
2447 					 */
2448 					ipif_t *src_ipif;
2449 					src_ipif =
2450 					    ipif_select_source_v6(ire_stq_ill,
2451 					    &ire->ire_addr_v6, RESTRICT_TO_NONE,
2452 					    IPV6_PREFER_SRC_DEFAULT,
2453 					    zoneid);
2454 					if (src_ipif != NULL) {
2455 						ipif_refrele(src_ipif);
2456 					} else {
2457 						return (B_FALSE);
2458 					}
2459 				} else {
2460 					return (B_FALSE);
2461 				}
2462 
2463 			} else if (!(ire->ire_type & IRE_OFFSUBNET)) {
2464 				return (B_FALSE);
2465 			}
2466 		}
2467 
2468 		/*
2469 		 * Match all default routes from the global zone, irrespective
2470 		 * of reachability. For a non-global zone only match those
2471 		 * where ire_gateway_addr has a IRE_INTERFACE for the zoneid.
2472 		 */
2473 		if (ire->ire_type == IRE_DEFAULT && zoneid != GLOBAL_ZONEID) {
2474 			int ire_match_flags = 0;
2475 			in6_addr_t gw_addr_v6;
2476 			ire_t *rire;
2477 
2478 			ire_match_flags |= MATCH_IRE_TYPE;
2479 			if (ire->ire_ipif != NULL) {
2480 				ire_match_flags |= MATCH_IRE_ILL_GROUP;
2481 			}
2482 			if (ire->ire_ipversion == IPV4_VERSION) {
2483 				rire = ire_route_lookup(ire->ire_gateway_addr,
2484 				    0, 0, IRE_INTERFACE, ire->ire_ipif, NULL,
2485 				    zoneid, NULL, ire_match_flags, ipst);
2486 			} else {
2487 				ASSERT(ire->ire_ipversion == IPV6_VERSION);
2488 				mutex_enter(&ire->ire_lock);
2489 				gw_addr_v6 = ire->ire_gateway_addr_v6;
2490 				mutex_exit(&ire->ire_lock);
2491 				rire = ire_route_lookup_v6(&gw_addr_v6,
2492 				    NULL, NULL, IRE_INTERFACE, ire->ire_ipif,
2493 				    NULL, zoneid, NULL, ire_match_flags, ipst);
2494 			}
2495 			if (rire == NULL) {
2496 				return (B_FALSE);
2497 			}
2498 			ire_refrele(rire);
2499 		}
2500 	}
2501 
2502 	if (((!(match_flags & MATCH_IRE_TYPE)) ||
2503 		(ire->ire_type & ire_type)) &&
2504 	    ((!(match_flags & MATCH_IRE_WQ)) ||
2505 		(ire->ire_stq == ill->ill_wq)) &&
2506 	    ((!(match_flags & MATCH_IRE_ILL)) ||
2507 		(ire_stq_ill == ill || ire_ipif_ill == ill)) &&
2508 	    ((!(match_flags & MATCH_IRE_ILL_GROUP)) ||
2509 		(ire_stq_ill == ill) || (ire_ipif_ill == ill) ||
2510 		(ire_ill_group != NULL &&
2511 		ire_ill_group == ill->ill_group))) {
2512 		return (B_TRUE);
2513 	}
2514 	return (B_FALSE);
2515 }
2516 
2517 int
2518 rtfunc(struct radix_node *rn, void *arg)
2519 {
2520 	struct rtfuncarg *rtf = arg;
2521 	struct rt_entry *rt;
2522 	irb_t *irb;
2523 	ire_t *ire;
2524 	boolean_t ret;
2525 
2526 	rt = (struct rt_entry *)rn;
2527 	ASSERT(rt != NULL);
2528 	irb = &rt->rt_irb;
2529 	for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
2530 		if ((rtf->rt_match_flags != 0) ||
2531 		    (rtf->rt_zoneid != ALL_ZONES)) {
2532 			ret = ire_walk_ill_match(rtf->rt_match_flags,
2533 			    rtf->rt_ire_type, ire,
2534 			    rtf->rt_ill, rtf->rt_zoneid, rtf->rt_ipst);
2535 		} else
2536 			ret = B_TRUE;
2537 		if (ret)
2538 			(*rtf->rt_func)(ire, rtf->rt_arg);
2539 	}
2540 	return (0);
2541 }
2542 
2543 /*
2544  * Walk the ftable and the ctable entries that match the ill.
2545  */
2546 void
2547 ire_walk_ill_tables(uint_t match_flags, uint_t ire_type, pfv_t func,
2548     void *arg, size_t ftbl_sz, size_t htbl_sz, irb_t **ipftbl,
2549     size_t ctbl_sz, irb_t *ipctbl, ill_t *ill, zoneid_t zoneid,
2550     ip_stack_t *ipst)
2551 {
2552 	irb_t	*irb_ptr;
2553 	irb_t	*irb;
2554 	ire_t	*ire;
2555 	int i, j;
2556 	boolean_t ret;
2557 	struct rtfuncarg rtfarg;
2558 
2559 	ASSERT((!(match_flags & (MATCH_IRE_WQ | MATCH_IRE_ILL |
2560 	    MATCH_IRE_ILL_GROUP))) || (ill != NULL));
2561 	ASSERT(!(match_flags & MATCH_IRE_TYPE) || (ire_type != 0));
2562 	/*
2563 	 * Optimize by not looking at the forwarding table if there
2564 	 * is a MATCH_IRE_TYPE specified with no IRE_FORWARDTABLE
2565 	 * specified in ire_type.
2566 	 */
2567 	if (!(match_flags & MATCH_IRE_TYPE) ||
2568 	    ((ire_type & IRE_FORWARDTABLE) != 0)) {
2569 		/* knobs such that routine is called only for v6 case */
2570 		if (ipftbl == ipst->ips_ip_forwarding_table_v6) {
2571 			for (i = (ftbl_sz - 1);  i >= 0; i--) {
2572 				if ((irb_ptr = ipftbl[i]) == NULL)
2573 					continue;
2574 				for (j = 0; j < htbl_sz; j++) {
2575 					irb = &irb_ptr[j];
2576 					if (irb->irb_ire == NULL)
2577 						continue;
2578 
2579 					IRB_REFHOLD(irb);
2580 					for (ire = irb->irb_ire; ire != NULL;
2581 						ire = ire->ire_next) {
2582 						if (match_flags == 0 &&
2583 						    zoneid == ALL_ZONES) {
2584 							ret = B_TRUE;
2585 						} else {
2586 							ret =
2587 							    ire_walk_ill_match(
2588 							    match_flags,
2589 							    ire_type, ire, ill,
2590 							    zoneid, ipst);
2591 						}
2592 						if (ret)
2593 							(*func)(ire, arg);
2594 					}
2595 					IRB_REFRELE(irb);
2596 				}
2597 			}
2598 		} else {
2599 			(void) memset(&rtfarg, 0, sizeof (rtfarg));
2600 			rtfarg.rt_func = func;
2601 			rtfarg.rt_arg = arg;
2602 			if (match_flags != 0) {
2603 				rtfarg.rt_match_flags = match_flags;
2604 			}
2605 			rtfarg.rt_ire_type = ire_type;
2606 			rtfarg.rt_ill = ill;
2607 			rtfarg.rt_zoneid = zoneid;
2608 			rtfarg.rt_ipst = ipst;	/* No netstack_hold */
2609 			(void) ipst->ips_ip_ftable->rnh_walktree_mt(
2610 			    ipst->ips_ip_ftable,
2611 			    rtfunc, &rtfarg, irb_refhold_rn, irb_refrele_rn);
2612 		}
2613 	}
2614 
2615 	/*
2616 	 * Optimize by not looking at the cache table if there
2617 	 * is a MATCH_IRE_TYPE specified with no IRE_CACHETABLE
2618 	 * specified in ire_type.
2619 	 */
2620 	if (!(match_flags & MATCH_IRE_TYPE) ||
2621 	    ((ire_type & IRE_CACHETABLE) != 0)) {
2622 		for (i = 0; i < ctbl_sz;  i++) {
2623 			irb = &ipctbl[i];
2624 			if (irb->irb_ire == NULL)
2625 				continue;
2626 			IRB_REFHOLD(irb);
2627 			for (ire = irb->irb_ire; ire != NULL;
2628 			    ire = ire->ire_next) {
2629 				if (match_flags == 0 && zoneid == ALL_ZONES) {
2630 					ret = B_TRUE;
2631 				} else {
2632 					ret = ire_walk_ill_match(
2633 					    match_flags, ire_type,
2634 					    ire, ill, zoneid, ipst);
2635 				}
2636 				if (ret)
2637 					(*func)(ire, arg);
2638 			}
2639 			IRB_REFRELE(irb);
2640 		}
2641 	}
2642 }
2643 
2644 /*
2645  * This routine walks through the ill chain to find if there is any
2646  * ire linked to the ill's interface based forwarding table
2647  * The arg could be ill or mp. This routine is called when a ill goes
2648  * down/deleted or the 'ipv4_ire_srcif_status' report is printed.
2649  */
2650 void
2651 ire_walk_srcif_table_v4(pfv_t func, void *arg, ip_stack_t *ipst)
2652 {
2653 	irb_t   *irb;
2654 	ire_t   *ire;
2655 	ill_t	*ill, *next_ill;
2656 	int	i;
2657 	int	total_count;
2658 	ill_walk_context_t ctx;
2659 
2660 	/*
2661 	 * Take care of ire's in other ill's per-interface forwarding
2662 	 * table. Check if any ire in any of the ill's ill_srcif_table
2663 	 * is pointing to this ill.
2664 	 */
2665 	mutex_enter(&ipst->ips_ire_srcif_table_lock);
2666 	if (ipst->ips_ire_srcif_table_count == 0) {
2667 		mutex_exit(&ipst->ips_ire_srcif_table_lock);
2668 		return;
2669 	}
2670 	mutex_exit(&ipst->ips_ire_srcif_table_lock);
2671 
2672 #ifdef DEBUG
2673 	/* Keep accounting of all interface based table ires */
2674 	total_count = 0;
2675 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
2676 	ill = ILL_START_WALK_V4(&ctx, ipst);
2677 	while (ill != NULL) {
2678 		mutex_enter(&ill->ill_lock);
2679 		total_count += ill->ill_srcif_refcnt;
2680 		next_ill = ill_next(&ctx, ill);
2681 		mutex_exit(&ill->ill_lock);
2682 		ill = next_ill;
2683 	}
2684 	rw_exit(&ipst->ips_ill_g_lock);
2685 
2686 	/* Hold lock here to make sure ire_srcif_table_count is stable */
2687 	mutex_enter(&ipst->ips_ire_srcif_table_lock);
2688 	i = ipst->ips_ire_srcif_table_count;
2689 	mutex_exit(&ipst->ips_ire_srcif_table_lock);
2690 	ip1dbg(("ire_walk_srcif_v4: ire_srcif_table_count %d "
2691 	    "total ill_srcif_refcnt %d\n", i, total_count));
2692 #endif
2693 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
2694 	ill = ILL_START_WALK_V4(&ctx, ipst);
2695 	while (ill != NULL) {
2696 		mutex_enter(&ill->ill_lock);
2697 		if ((ill->ill_srcif_refcnt == 0) || !ILL_CAN_LOOKUP(ill)) {
2698 			next_ill = ill_next(&ctx, ill);
2699 			mutex_exit(&ill->ill_lock);
2700 			ill = next_ill;
2701 			continue;
2702 		}
2703 		ill_refhold_locked(ill);
2704 		mutex_exit(&ill->ill_lock);
2705 		rw_exit(&ipst->ips_ill_g_lock);
2706 		if (ill->ill_srcif_table != NULL) {
2707 			for (i = 0; i < IP_SRCIF_TABLE_SIZE; i++) {
2708 				irb = &(ill->ill_srcif_table[i]);
2709 				if (irb->irb_ire == NULL)
2710 					continue;
2711 				IRB_REFHOLD(irb);
2712 				for (ire = irb->irb_ire; ire != NULL;
2713 				    ire = ire->ire_next) {
2714 					(*func)(ire, arg);
2715 				}
2716 				IRB_REFRELE(irb);
2717 			}
2718 		}
2719 		rw_enter(&ipst->ips_ill_g_lock, RW_READER);
2720 		next_ill = ill_next(&ctx, ill);
2721 		ill_refrele(ill);
2722 		ill = next_ill;
2723 	}
2724 	rw_exit(&ipst->ips_ill_g_lock);
2725 }
2726 
2727 /*
2728  * This function takes a mask and returns
2729  * number of bits set in the mask. If no
2730  * bit is set it returns 0.
2731  * Assumes a contiguous mask.
2732  */
2733 int
2734 ip_mask_to_plen(ipaddr_t mask)
2735 {
2736 	return (mask == 0 ? 0 : IP_ABITS - (ffs(ntohl(mask)) -1));
2737 }
2738 
2739 /*
2740  * Convert length for a mask to the mask.
2741  */
2742 ipaddr_t
2743 ip_plen_to_mask(uint_t masklen)
2744 {
2745 	return (htonl(IP_HOST_MASK << (IP_ABITS - masklen)));
2746 }
2747 
2748 void
2749 ire_atomic_end(irb_t *irb_ptr, ire_t *ire)
2750 {
2751 	ill_t	*ill_list[NUM_ILLS];
2752 	ip_stack_t	*ipst = ire->ire_ipst;
2753 
2754 	ill_list[0] = ire->ire_stq != NULL ? ire->ire_stq->q_ptr : NULL;
2755 	ill_list[1] = ire->ire_ipif != NULL ? ire->ire_ipif->ipif_ill : NULL;
2756 	ill_list[2] = ire->ire_in_ill;
2757 	ill_unlock_ills(ill_list, NUM_ILLS);
2758 	rw_exit(&irb_ptr->irb_lock);
2759 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
2760 }
2761 
2762 /*
2763  * ire_add_v[46] atomically make sure that the ipif or ill associated
2764  * with the new ire being added is stable and not IPIF_CHANGING or ILL_CHANGING
2765  * before adding the ire to the table. This ensures that we don't create
2766  * new IRE_CACHEs with stale values for parameters that are passed to
2767  * ire_create such as ire_max_frag. Note that ire_create() is passed a pointer
2768  * to the ipif_mtu, and not the value. The actual value is derived from the
2769  * parent ire or ipif under the bucket lock.
2770  */
2771 int
2772 ire_atomic_start(irb_t *irb_ptr, ire_t *ire, queue_t *q, mblk_t *mp,
2773     ipsq_func_t func)
2774 {
2775 	ill_t	*stq_ill;
2776 	ill_t	*ipif_ill;
2777 	ill_t	*in_ill;
2778 	ill_t	*ill_list[NUM_ILLS];
2779 	int	cnt = NUM_ILLS;
2780 	int	error = 0;
2781 	ill_t	*ill = NULL;
2782 	ip_stack_t	*ipst = ire->ire_ipst;
2783 
2784 	ill_list[0] = stq_ill = ire->ire_stq !=
2785 		NULL ? ire->ire_stq->q_ptr : NULL;
2786 	ill_list[1] = ipif_ill = ire->ire_ipif !=
2787 		NULL ? ire->ire_ipif->ipif_ill : NULL;
2788 	ill_list[2] = in_ill = ire->ire_in_ill;
2789 
2790 	ASSERT((q != NULL && mp != NULL && func != NULL) ||
2791 	    (q == NULL && mp == NULL && func == NULL));
2792 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
2793 	GRAB_CONN_LOCK(q);
2794 	rw_enter(&irb_ptr->irb_lock, RW_WRITER);
2795 	ill_lock_ills(ill_list, cnt);
2796 
2797 	/*
2798 	 * While the IRE is in the process of being added, a user may have
2799 	 * invoked the ifconfig usesrc option on the stq_ill to make it a
2800 	 * usesrc client ILL. Check for this possibility here, if it is true
2801 	 * then we fail adding the IRE_CACHE. Another check is to make sure
2802 	 * that an ipif_ill of an IRE_CACHE being added is not part of a usesrc
2803 	 * group. The ill_g_usesrc_lock is released in ire_atomic_end
2804 	 */
2805 	if ((ire->ire_type & IRE_CACHE) &&
2806 	    (ire->ire_marks & IRE_MARK_USESRC_CHECK)) {
2807 		if (stq_ill->ill_usesrc_ifindex != 0) {
2808 			ASSERT(stq_ill->ill_usesrc_grp_next != NULL);
2809 			if ((ipif_ill->ill_phyint->phyint_ifindex !=
2810 			    stq_ill->ill_usesrc_ifindex) ||
2811 			    (ipif_ill->ill_usesrc_grp_next == NULL) ||
2812 			    (ipif_ill->ill_usesrc_ifindex != 0)) {
2813 				error = EINVAL;
2814 				goto done;
2815 			}
2816 		} else if (ipif_ill->ill_usesrc_grp_next != NULL) {
2817 			error = EINVAL;
2818 			goto done;
2819 		}
2820 	}
2821 
2822 	/*
2823 	 * IPMP flag settings happen without taking the exclusive route
2824 	 * in ip_sioctl_flags. So we need to make an atomic check here
2825 	 * for FAILED/OFFLINE/INACTIVE flags or if it has hit the
2826 	 * FAILBACK=no case.
2827 	 */
2828 	if ((stq_ill != NULL) && !IAM_WRITER_ILL(stq_ill)) {
2829 		if (stq_ill->ill_state_flags & ILL_CHANGING) {
2830 			ill = stq_ill;
2831 			error = EAGAIN;
2832 		} else if ((stq_ill->ill_phyint->phyint_flags & PHYI_OFFLINE) ||
2833 		    (ill_is_probeonly(stq_ill) &&
2834 		    !(ire->ire_marks & IRE_MARK_HIDDEN))) {
2835 			error = EINVAL;
2836 		}
2837 		goto done;
2838 	}
2839 
2840 	/*
2841 	 * We don't check for OFFLINE/FAILED in this case because
2842 	 * the source address selection logic (ipif_select_source)
2843 	 * may still select a source address from such an ill. The
2844 	 * assumption is that these addresses will be moved by in.mpathd
2845 	 * soon. (i.e. this is a race). However link local addresses
2846 	 * will not move and hence ipif_select_source_v6 tries to avoid
2847 	 * FAILED ills. Please see ipif_select_source_v6 for more info
2848 	 */
2849 	if ((ipif_ill != NULL) && !IAM_WRITER_ILL(ipif_ill) &&
2850 	    (ipif_ill->ill_state_flags & ILL_CHANGING)) {
2851 		ill = ipif_ill;
2852 		error = EAGAIN;
2853 		goto done;
2854 	}
2855 
2856 	if ((in_ill != NULL) && !IAM_WRITER_ILL(in_ill) &&
2857 	    (in_ill->ill_state_flags & ILL_CHANGING)) {
2858 		ill = in_ill;
2859 		error = EAGAIN;
2860 		goto done;
2861 	}
2862 
2863 	if ((ire->ire_ipif != NULL) && !IAM_WRITER_IPIF(ire->ire_ipif) &&
2864 	    (ire->ire_ipif->ipif_state_flags & IPIF_CHANGING)) {
2865 		ill = ire->ire_ipif->ipif_ill;
2866 		ASSERT(ill != NULL);
2867 		error = EAGAIN;
2868 		goto done;
2869 	}
2870 
2871 done:
2872 	if (error == EAGAIN && ILL_CAN_WAIT(ill, q)) {
2873 		ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
2874 		mutex_enter(&ipsq->ipsq_lock);
2875 		ire_atomic_end(irb_ptr, ire);
2876 		ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
2877 		mutex_exit(&ipsq->ipsq_lock);
2878 		error = EINPROGRESS;
2879 	} else if (error != 0) {
2880 		ire_atomic_end(irb_ptr, ire);
2881 	}
2882 
2883 	RELEASE_CONN_LOCK(q);
2884 	return (error);
2885 }
2886 
2887 /*
2888  * Add a fully initialized IRE to an appropriate table based on
2889  * ire_type.
2890  *
2891  * allow_unresolved == B_FALSE indicates a legacy code-path call
2892  * that has prohibited the addition of incomplete ire's. If this
2893  * parameter is set, and we find an nce that is in a state other
2894  * than ND_REACHABLE, we fail the add. Note that nce_state could be
2895  * something other than ND_REACHABLE if the nce had just expired and
2896  * the ire_create preceding the ire_add added a new ND_INITIAL nce.
2897  */
2898 int
2899 ire_add(ire_t **irep, queue_t *q, mblk_t *mp, ipsq_func_t func,
2900     boolean_t allow_unresolved)
2901 {
2902 	ire_t	*ire1;
2903 	ill_t	*stq_ill = NULL;
2904 	ill_t	*ill;
2905 	ipif_t	*ipif = NULL;
2906 	ill_walk_context_t ctx;
2907 	ire_t	*ire = *irep;
2908 	int	error;
2909 	boolean_t ire_is_mblk = B_FALSE;
2910 	tsol_gcgrp_t *gcgrp = NULL;
2911 	tsol_gcgrp_addr_t ga;
2912 	ip_stack_t	*ipst = ire->ire_ipst;
2913 
2914 	ASSERT(ire->ire_type != IRE_MIPRTUN);
2915 
2916 	/* get ready for the day when original ire is not created as mblk */
2917 	if (ire->ire_mp != NULL) {
2918 		ire_is_mblk = B_TRUE;
2919 		/* Copy the ire to a kmem_alloc'ed area */
2920 		ire1 = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
2921 		if (ire1 == NULL) {
2922 			ip1dbg(("ire_add: alloc failed\n"));
2923 			ire_delete(ire);
2924 			*irep = NULL;
2925 			return (ENOMEM);
2926 		}
2927 		ire->ire_marks &= ~IRE_MARK_UNCACHED;
2928 		*ire1 = *ire;
2929 		ire1->ire_mp = NULL;
2930 		ire1->ire_stq_ifindex = 0;
2931 		freeb(ire->ire_mp);
2932 		ire = ire1;
2933 	}
2934 	if (ire->ire_stq != NULL)
2935 		stq_ill = (ill_t *)ire->ire_stq->q_ptr;
2936 
2937 	if (ire->ire_type == IRE_CACHE) {
2938 		/*
2939 		 * If this interface is FAILED, or INACTIVE or has hit
2940 		 * the FAILBACK=no case, we create IRE_CACHES marked
2941 		 * HIDDEN for some special cases e.g. bind to
2942 		 * IPIF_NOFAILOVER address etc. So, if this interface
2943 		 * is FAILED/INACTIVE/hit FAILBACK=no case, and we are
2944 		 * not creating hidden ires, we should not allow that.
2945 		 * This happens because the state of the interface
2946 		 * changed while we were waiting in ARP. If this is the
2947 		 * daemon sending probes, the next probe will create
2948 		 * HIDDEN ires and we will create an ire then. This
2949 		 * cannot happen with NDP currently because IRE is
2950 		 * never queued in NDP. But it can happen in the
2951 		 * future when we have external resolvers with IPv6.
2952 		 * If the interface gets marked with OFFLINE while we
2953 		 * are waiting in ARP, don't add the ire.
2954 		 */
2955 		if ((stq_ill->ill_phyint->phyint_flags & PHYI_OFFLINE) ||
2956 		    (ill_is_probeonly(stq_ill) &&
2957 		    !(ire->ire_marks & IRE_MARK_HIDDEN))) {
2958 			/*
2959 			 * We don't know whether it is a valid ipif or not.
2960 			 * unless we do the check below. So, set it to NULL.
2961 			 */
2962 			ire->ire_ipif = NULL;
2963 			ire_delete(ire);
2964 			*irep = NULL;
2965 			return (EINVAL);
2966 		}
2967 	}
2968 
2969 	if (stq_ill != NULL && ire->ire_type == IRE_CACHE &&
2970 	    stq_ill->ill_net_type == IRE_IF_RESOLVER) {
2971 		rw_enter(&ipst->ips_ill_g_lock, RW_READER);
2972 		ill = ILL_START_WALK_ALL(&ctx, ipst);
2973 		for (; ill != NULL; ill = ill_next(&ctx, ill)) {
2974 			mutex_enter(&ill->ill_lock);
2975 			if (ill->ill_state_flags & ILL_CONDEMNED) {
2976 				mutex_exit(&ill->ill_lock);
2977 				continue;
2978 			}
2979 			/*
2980 			 * We need to make sure that the ipif is a valid one
2981 			 * before adding the IRE_CACHE. This happens only
2982 			 * with IRE_CACHE when there is an external resolver.
2983 			 *
2984 			 * We can unplumb a logical interface while the
2985 			 * packet is waiting in ARP with the IRE. Then,
2986 			 * later on when we feed the IRE back, the ipif
2987 			 * has to be re-checked. This can't happen with
2988 			 * NDP currently, as we never queue the IRE with
2989 			 * the packet. We always try to recreate the IRE
2990 			 * when the resolution is completed. But, we do
2991 			 * it for IPv6 also here so that in future if
2992 			 * we have external resolvers, it will work without
2993 			 * any change.
2994 			 */
2995 			ipif = ipif_lookup_seqid(ill, ire->ire_ipif_seqid);
2996 			if (ipif != NULL) {
2997 				ipif_refhold_locked(ipif);
2998 				mutex_exit(&ill->ill_lock);
2999 				break;
3000 			}
3001 			mutex_exit(&ill->ill_lock);
3002 		}
3003 		rw_exit(&ipst->ips_ill_g_lock);
3004 		if (ipif == NULL ||
3005 		    (ipif->ipif_isv6 &&
3006 		    !IN6_ARE_ADDR_EQUAL(&ire->ire_src_addr_v6,
3007 		    &ipif->ipif_v6src_addr)) ||
3008 		    (!ipif->ipif_isv6 &&
3009 		    ire->ire_src_addr != ipif->ipif_src_addr) ||
3010 		    ire->ire_zoneid != ipif->ipif_zoneid) {
3011 
3012 			if (ipif != NULL)
3013 				ipif_refrele(ipif);
3014 			ire->ire_ipif = NULL;
3015 			ire_delete(ire);
3016 			*irep = NULL;
3017 			return (EINVAL);
3018 		}
3019 
3020 
3021 		ASSERT(ill != NULL);
3022 		/*
3023 		 * If this group was dismantled while this packets was
3024 		 * queued in ARP, don't add it here.
3025 		 */
3026 		if (ire->ire_ipif->ipif_ill->ill_group != ill->ill_group) {
3027 			/* We don't want ire_inactive bump stats for this */
3028 			ipif_refrele(ipif);
3029 			ire->ire_ipif = NULL;
3030 			ire_delete(ire);
3031 			*irep = NULL;
3032 			return (EINVAL);
3033 		}
3034 
3035 		/*
3036 		 * Since we didn't attach label security attributes to the
3037 		 * ire for the resolver case, we need to add it now. (only
3038 		 * for v4 resolver and v6 xresolv case).
3039 		 */
3040 		if (is_system_labeled() && ire_is_mblk) {
3041 			if (ire->ire_ipversion == IPV4_VERSION) {
3042 				ga.ga_af = AF_INET;
3043 				IN6_IPADDR_TO_V4MAPPED(ire->ire_gateway_addr !=
3044 				    INADDR_ANY ? ire->ire_gateway_addr :
3045 				    ire->ire_addr, &ga.ga_addr);
3046 			} else {
3047 				ga.ga_af = AF_INET6;
3048 				ga.ga_addr = IN6_IS_ADDR_UNSPECIFIED(
3049 				    &ire->ire_gateway_addr_v6) ?
3050 				    ire->ire_addr_v6 :
3051 				    ire->ire_gateway_addr_v6;
3052 			}
3053 			gcgrp = gcgrp_lookup(&ga, B_FALSE);
3054 			error = tsol_ire_init_gwattr(ire, ire->ire_ipversion,
3055 			    NULL, gcgrp);
3056 			if (error != 0) {
3057 				if (gcgrp != NULL) {
3058 					GCGRP_REFRELE(gcgrp);
3059 					gcgrp = NULL;
3060 				}
3061 				ipif_refrele(ipif);
3062 				ire->ire_ipif = NULL;
3063 				ire_delete(ire);
3064 				*irep = NULL;
3065 				return (error);
3066 			}
3067 		}
3068 	}
3069 
3070 	/*
3071 	 * In case ire was changed
3072 	 */
3073 	*irep = ire;
3074 	if (ire->ire_ipversion == IPV6_VERSION) {
3075 		error = ire_add_v6(irep, q, mp, func);
3076 	} else {
3077 		if (ire->ire_in_ill == NULL)
3078 			error = ire_add_v4(irep, q, mp, func, allow_unresolved);
3079 		else
3080 			error = ire_add_srcif_v4(irep, q, mp, func);
3081 	}
3082 	if (ipif != NULL)
3083 		ipif_refrele(ipif);
3084 	return (error);
3085 }
3086 
3087 /*
3088  * Add an initialized IRE to an appropriate table based on ire_type.
3089  *
3090  * The forward table contains IRE_PREFIX/IRE_HOST and
3091  * IRE_IF_RESOLVER/IRE_IF_NORESOLVER and IRE_DEFAULT.
3092  *
3093  * The cache table contains IRE_BROADCAST/IRE_LOCAL/IRE_LOOPBACK
3094  * and IRE_CACHE.
3095  *
3096  * NOTE : This function is called as writer though not required
3097  * by this function.
3098  */
3099 static int
3100 ire_add_v4(ire_t **ire_p, queue_t *q, mblk_t *mp, ipsq_func_t func,
3101     boolean_t allow_unresolved)
3102 {
3103 	ire_t	*ire1;
3104 	irb_t	*irb_ptr;
3105 	ire_t	**irep;
3106 	int	flags;
3107 	ire_t	*pire = NULL;
3108 	ill_t	*stq_ill;
3109 	ire_t	*ire = *ire_p;
3110 	int	error;
3111 	boolean_t need_refrele = B_FALSE;
3112 	nce_t	*nce;
3113 	ip_stack_t	*ipst = ire->ire_ipst;
3114 
3115 	if (ire->ire_ipif != NULL)
3116 		ASSERT(!MUTEX_HELD(&ire->ire_ipif->ipif_ill->ill_lock));
3117 	if (ire->ire_stq != NULL)
3118 		ASSERT(!MUTEX_HELD(
3119 		    &((ill_t *)(ire->ire_stq->q_ptr))->ill_lock));
3120 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
3121 	ASSERT(ire->ire_mp == NULL); /* Calls should go through ire_add */
3122 	ASSERT(ire->ire_in_ill == NULL); /* No srcif entries */
3123 
3124 	/* Find the appropriate list head. */
3125 	switch (ire->ire_type) {
3126 	case IRE_HOST:
3127 		ire->ire_mask = IP_HOST_MASK;
3128 		ire->ire_masklen = IP_ABITS;
3129 		if ((ire->ire_flags & RTF_SETSRC) == 0)
3130 			ire->ire_src_addr = 0;
3131 		break;
3132 	case IRE_CACHE:
3133 	case IRE_BROADCAST:
3134 	case IRE_LOCAL:
3135 	case IRE_LOOPBACK:
3136 		ire->ire_mask = IP_HOST_MASK;
3137 		ire->ire_masklen = IP_ABITS;
3138 		break;
3139 	case IRE_PREFIX:
3140 		if ((ire->ire_flags & RTF_SETSRC) == 0)
3141 			ire->ire_src_addr = 0;
3142 		break;
3143 	case IRE_DEFAULT:
3144 		if ((ire->ire_flags & RTF_SETSRC) == 0)
3145 			ire->ire_src_addr = 0;
3146 		break;
3147 	case IRE_IF_RESOLVER:
3148 	case IRE_IF_NORESOLVER:
3149 		break;
3150 	default:
3151 		ip0dbg(("ire_add_v4: ire %p has unrecognized IRE type (%d)\n",
3152 		    (void *)ire, ire->ire_type));
3153 		ire_delete(ire);
3154 		*ire_p = NULL;
3155 		return (EINVAL);
3156 	}
3157 
3158 	/* Make sure the address is properly masked. */
3159 	ire->ire_addr &= ire->ire_mask;
3160 
3161 	/*
3162 	 * ip_newroute/ip_newroute_multi are unable to prevent the deletion
3163 	 * of the interface route while adding an IRE_CACHE for an on-link
3164 	 * destination in the IRE_IF_RESOLVER case, since the ire has to
3165 	 * go to ARP and return. We can't do a REFHOLD on the
3166 	 * associated interface ire for fear of ARP freeing the message.
3167 	 * Here we look up the interface ire in the forwarding table and
3168 	 * make sure that the interface route has not been deleted.
3169 	 */
3170 	if (ire->ire_type == IRE_CACHE && ire->ire_gateway_addr == 0 &&
3171 	    ((ill_t *)ire->ire_stq->q_ptr)->ill_net_type == IRE_IF_RESOLVER) {
3172 
3173 		ASSERT(ire->ire_max_fragp == NULL);
3174 		if (CLASSD(ire->ire_addr) && !(ire->ire_flags & RTF_SETSRC)) {
3175 			/*
3176 			 * The ihandle that we used in ip_newroute_multi
3177 			 * comes from the interface route corresponding
3178 			 * to ire_ipif. Lookup here to see if it exists
3179 			 * still.
3180 			 * If the ire has a source address assigned using
3181 			 * RTF_SETSRC, ire_ipif is the logical interface holding
3182 			 * this source address, so we can't use it to check for
3183 			 * the existence of the interface route. Instead we rely
3184 			 * on the brute force ihandle search in
3185 			 * ire_ihandle_lookup_onlink() below.
3186 			 */
3187 			pire = ipif_to_ire(ire->ire_ipif);
3188 			if (pire == NULL) {
3189 				ire_delete(ire);
3190 				*ire_p = NULL;
3191 				return (EINVAL);
3192 			} else if (pire->ire_ihandle != ire->ire_ihandle) {
3193 				ire_refrele(pire);
3194 				ire_delete(ire);
3195 				*ire_p = NULL;
3196 				return (EINVAL);
3197 			}
3198 		} else {
3199 			pire = ire_ihandle_lookup_onlink(ire);
3200 			if (pire == NULL) {
3201 				ire_delete(ire);
3202 				*ire_p = NULL;
3203 				return (EINVAL);
3204 			}
3205 		}
3206 		/* Prevent pire from getting deleted */
3207 		IRB_REFHOLD(pire->ire_bucket);
3208 		/* Has it been removed already ? */
3209 		if (pire->ire_marks & IRE_MARK_CONDEMNED) {
3210 			IRB_REFRELE(pire->ire_bucket);
3211 			ire_refrele(pire);
3212 			ire_delete(ire);
3213 			*ire_p = NULL;
3214 			return (EINVAL);
3215 		}
3216 	} else {
3217 		ASSERT(ire->ire_max_fragp != NULL);
3218 	}
3219 	flags = (MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_GW);
3220 
3221 	if (ire->ire_ipif != NULL) {
3222 		/*
3223 		 * We use MATCH_IRE_IPIF while adding IRE_CACHES only
3224 		 * for historic reasons and to maintain symmetry with
3225 		 * IPv6 code path. Historically this was used by
3226 		 * multicast code to create multiple IRE_CACHES on
3227 		 * a single ill with different ipifs. This was used
3228 		 * so that multicast packets leaving the node had the
3229 		 * right source address. This is no longer needed as
3230 		 * ip_wput initializes the address correctly.
3231 		 */
3232 		flags |= MATCH_IRE_IPIF;
3233 		/*
3234 		 * If we are creating hidden ires, make sure we search on
3235 		 * this ill (MATCH_IRE_ILL) and a hidden ire,
3236 		 * while we are searching for duplicates below. Otherwise we
3237 		 * could potentially find an IRE on some other interface
3238 		 * and it may not be a IRE marked with IRE_MARK_HIDDEN. We
3239 		 * shouldn't do this as this will lead to an infinite loop
3240 		 * (if we get to ip_wput again) eventually we need an hidden
3241 		 * ire for this packet to go out. MATCH_IRE_ILL is explicitly
3242 		 * done below.
3243 		 */
3244 		if (ire->ire_type == IRE_CACHE &&
3245 		    (ire->ire_marks & IRE_MARK_HIDDEN))
3246 			flags |= (MATCH_IRE_MARK_HIDDEN);
3247 	}
3248 	if ((ire->ire_type & IRE_CACHETABLE) == 0) {
3249 		irb_ptr = ire_get_bucket(ire);
3250 		need_refrele = B_TRUE;
3251 		if (irb_ptr == NULL) {
3252 			/*
3253 			 * This assumes that the ire has not added
3254 			 * a reference to the ipif.
3255 			 */
3256 			ire->ire_ipif = NULL;
3257 			ire_delete(ire);
3258 			if (pire != NULL) {
3259 				IRB_REFRELE(pire->ire_bucket);
3260 				ire_refrele(pire);
3261 			}
3262 			*ire_p = NULL;
3263 			return (EINVAL);
3264 		}
3265 	} else {
3266 		irb_ptr = &(ipst->ips_ip_cache_table[IRE_ADDR_HASH(
3267 		    ire->ire_addr, ipst->ips_ip_cache_table_size)]);
3268 	}
3269 
3270 	/*
3271 	 * Start the atomic add of the ire. Grab the ill locks,
3272 	 * ill_g_usesrc_lock and the bucket lock. Check for condemned
3273 	 *
3274 	 * If ipif or ill is changing ire_atomic_start() may queue the
3275 	 * request and return EINPROGRESS.
3276 	 * To avoid lock order problems, get the ndp4->ndp_g_lock.
3277 	 */
3278 	mutex_enter(&ipst->ips_ndp4->ndp_g_lock);
3279 	error = ire_atomic_start(irb_ptr, ire, q, mp, func);
3280 	if (error != 0) {
3281 		mutex_exit(&ipst->ips_ndp4->ndp_g_lock);
3282 		/*
3283 		 * We don't know whether it is a valid ipif or not.
3284 		 * So, set it to NULL. This assumes that the ire has not added
3285 		 * a reference to the ipif.
3286 		 */
3287 		ire->ire_ipif = NULL;
3288 		ire_delete(ire);
3289 		if (pire != NULL) {
3290 			IRB_REFRELE(pire->ire_bucket);
3291 			ire_refrele(pire);
3292 		}
3293 		*ire_p = NULL;
3294 		if (need_refrele)
3295 			IRB_REFRELE(irb_ptr);
3296 		return (error);
3297 	}
3298 	/*
3299 	 * To avoid creating ires having stale values for the ire_max_frag
3300 	 * we get the latest value atomically here. For more details
3301 	 * see the block comment in ip_sioctl_mtu and in DL_NOTE_SDU_CHANGE
3302 	 * in ip_rput_dlpi_writer
3303 	 */
3304 	if (ire->ire_max_fragp == NULL) {
3305 		if (CLASSD(ire->ire_addr))
3306 			ire->ire_max_frag = ire->ire_ipif->ipif_mtu;
3307 		else
3308 			ire->ire_max_frag = pire->ire_max_frag;
3309 	} else {
3310 		uint_t	max_frag;
3311 
3312 		max_frag = *ire->ire_max_fragp;
3313 		ire->ire_max_fragp = NULL;
3314 		ire->ire_max_frag = max_frag;
3315 	}
3316 	/*
3317 	 * Atomically check for duplicate and insert in the table.
3318 	 */
3319 	for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) {
3320 		if (ire1->ire_marks & IRE_MARK_CONDEMNED)
3321 			continue;
3322 		if (ire->ire_ipif != NULL) {
3323 			/*
3324 			 * We do MATCH_IRE_ILL implicitly here for IREs
3325 			 * with a non-null ire_ipif, including IRE_CACHEs.
3326 			 * As ire_ipif and ire_stq could point to two
3327 			 * different ills, we can't pass just ire_ipif to
3328 			 * ire_match_args and get a match on both ills.
3329 			 * This is just needed for duplicate checks here and
3330 			 * so we don't add an extra argument to
3331 			 * ire_match_args for this. Do it locally.
3332 			 *
3333 			 * NOTE : Currently there is no part of the code
3334 			 * that asks for both MATH_IRE_IPIF and MATCH_IRE_ILL
3335 			 * match for IRE_CACHEs. Thus we don't want to
3336 			 * extend the arguments to ire_match_args.
3337 			 */
3338 			if (ire1->ire_stq != ire->ire_stq)
3339 				continue;
3340 			/*
3341 			 * Multiroute IRE_CACHEs for a given destination can
3342 			 * have the same ire_ipif, typically if their source
3343 			 * address is forced using RTF_SETSRC, and the same
3344 			 * send-to queue. We differentiate them using the parent
3345 			 * handle.
3346 			 */
3347 			if (ire->ire_type == IRE_CACHE &&
3348 			    (ire1->ire_flags & RTF_MULTIRT) &&
3349 			    (ire->ire_flags & RTF_MULTIRT) &&
3350 			    (ire1->ire_phandle != ire->ire_phandle))
3351 				continue;
3352 		}
3353 		if (ire1->ire_zoneid != ire->ire_zoneid)
3354 			continue;
3355 		if (ire_match_args(ire1, ire->ire_addr, ire->ire_mask,
3356 		    ire->ire_gateway_addr, ire->ire_type, ire->ire_ipif,
3357 		    ire->ire_zoneid, 0, NULL, flags)) {
3358 			/*
3359 			 * Return the old ire after doing a REFHOLD.
3360 			 * As most of the callers continue to use the IRE
3361 			 * after adding, we return a held ire. This will
3362 			 * avoid a lookup in the caller again. If the callers
3363 			 * don't want to use it, they need to do a REFRELE.
3364 			 */
3365 			ip1dbg(("found dup ire existing %p new %p",
3366 			    (void *)ire1, (void *)ire));
3367 			IRE_REFHOLD(ire1);
3368 			ire_atomic_end(irb_ptr, ire);
3369 			mutex_exit(&ipst->ips_ndp4->ndp_g_lock);
3370 			ire_delete(ire);
3371 			if (pire != NULL) {
3372 				/*
3373 				 * Assert that it is not removed from the
3374 				 * list yet.
3375 				 */
3376 				ASSERT(pire->ire_ptpn != NULL);
3377 				IRB_REFRELE(pire->ire_bucket);
3378 				ire_refrele(pire);
3379 			}
3380 			*ire_p = ire1;
3381 			if (need_refrele)
3382 				IRB_REFRELE(irb_ptr);
3383 			return (0);
3384 		}
3385 	}
3386 	if (ire->ire_type & IRE_CACHE) {
3387 		ASSERT(ire->ire_stq != NULL);
3388 		nce = ndp_lookup_v4(ire_to_ill(ire),
3389 		    ((ire->ire_gateway_addr != INADDR_ANY) ?
3390 		    &ire->ire_gateway_addr : &ire->ire_addr),
3391 		    B_TRUE);
3392 		if (nce != NULL)
3393 			mutex_enter(&nce->nce_lock);
3394 		/*
3395 		 * if the nce is NCE_F_CONDEMNED, or if it is not ND_REACHABLE
3396 		 * and the caller has prohibited the addition of incomplete
3397 		 * ire's, we fail the add. Note that nce_state could be
3398 		 * something other than ND_REACHABLE if the nce had
3399 		 * just expired and the ire_create preceding the
3400 		 * ire_add added a new ND_INITIAL nce.
3401 		 */
3402 		if ((nce == NULL) ||
3403 		    (nce->nce_flags & NCE_F_CONDEMNED) ||
3404 		    (!allow_unresolved &&
3405 		    (nce->nce_state != ND_REACHABLE))) {
3406 			if (nce != NULL) {
3407 				DTRACE_PROBE1(ire__bad__nce, nce_t *, nce);
3408 				mutex_exit(&nce->nce_lock);
3409 			}
3410 			ire_atomic_end(irb_ptr, ire);
3411 			mutex_exit(&ipst->ips_ndp4->ndp_g_lock);
3412 			if (nce != NULL)
3413 				NCE_REFRELE(nce);
3414 			DTRACE_PROBE1(ire__no__nce, ire_t *, ire);
3415 			ire_delete(ire);
3416 			if (pire != NULL) {
3417 				IRB_REFRELE(pire->ire_bucket);
3418 				ire_refrele(pire);
3419 			}
3420 			*ire_p = NULL;
3421 			if (need_refrele)
3422 				IRB_REFRELE(irb_ptr);
3423 			return (EINVAL);
3424 		} else {
3425 			ire->ire_nce = nce;
3426 			mutex_exit(&nce->nce_lock);
3427 			/*
3428 			 * We are associating this nce to the ire, so
3429 			 * change the nce ref taken in ndp_lookup_v4() from
3430 			 * NCE_REFHOLD to NCE_REFHOLD_NOTR
3431 			 */
3432 			NCE_REFHOLD_TO_REFHOLD_NOTR(ire->ire_nce);
3433 		}
3434 	}
3435 	/*
3436 	 * Make it easy for ip_wput_ire() to hit multiple broadcast ires by
3437 	 * grouping identical addresses together on the hash chain. We also
3438 	 * don't want to send multiple copies out if there are two ills part
3439 	 * of the same group. Thus we group the ires with same addr and same
3440 	 * ill group together so that ip_wput_ire can easily skip all the
3441 	 * ires with same addr and same group after sending the first copy.
3442 	 * We do this only for IRE_BROADCASTs as ip_wput_ire is currently
3443 	 * interested in such groupings only for broadcasts.
3444 	 *
3445 	 * NOTE : If the interfaces are brought up first and then grouped,
3446 	 * illgrp_insert will handle it. We come here when the interfaces
3447 	 * are already in group and we are bringing them UP.
3448 	 *
3449 	 * Find the first entry that matches ire_addr. *irep will be null
3450 	 * if no match.
3451 	 */
3452 	irep = (ire_t **)irb_ptr;
3453 	while ((ire1 = *irep) != NULL && ire->ire_addr != ire1->ire_addr)
3454 		irep = &ire1->ire_next;
3455 	if (ire->ire_type == IRE_BROADCAST && *irep != NULL) {
3456 		/*
3457 		 * We found some ire (i.e *irep) with a matching addr. We
3458 		 * want to group ires with same addr and same ill group
3459 		 * together.
3460 		 *
3461 		 * First get to the entry that matches our address and
3462 		 * ill group i.e stop as soon as we find the first ire
3463 		 * matching the ill group and address. If there is only
3464 		 * an address match, we should walk and look for some
3465 		 * group match. These are some of the possible scenarios :
3466 		 *
3467 		 * 1) There are no groups at all i.e all ire's ill_group
3468 		 *    are NULL. In that case we will essentially group
3469 		 *    all the ires with the same addr together. Same as
3470 		 *    the "else" block of this "if".
3471 		 *
3472 		 * 2) There are some groups and this ire's ill_group is
3473 		 *    NULL. In this case, we will first find the group
3474 		 *    that matches the address and a NULL group. Then
3475 		 *    we will insert the ire at the end of that group.
3476 		 *
3477 		 * 3) There are some groups and this ires's ill_group is
3478 		 *    non-NULL. In this case we will first find the group
3479 		 *    that matches the address and the ill_group. Then
3480 		 *    we will insert the ire at the end of that group.
3481 		 */
3482 		/* LINTED : constant in conditional context */
3483 		while (1) {
3484 			ire1 = *irep;
3485 			if ((ire1->ire_next == NULL) ||
3486 			    (ire1->ire_next->ire_addr != ire->ire_addr) ||
3487 			    (ire1->ire_type != IRE_BROADCAST) ||
3488 			    (ire1->ire_ipif->ipif_ill->ill_group ==
3489 			    ire->ire_ipif->ipif_ill->ill_group))
3490 				break;
3491 			irep = &ire1->ire_next;
3492 		}
3493 		ASSERT(*irep != NULL);
3494 		irep = &((*irep)->ire_next);
3495 
3496 		/*
3497 		 * Either we have hit the end of the list or the address
3498 		 * did not match or the group *matched*. If we found
3499 		 * a match on the group, skip to the end of the group.
3500 		 */
3501 		while (*irep != NULL) {
3502 			ire1 = *irep;
3503 			if ((ire1->ire_addr != ire->ire_addr) ||
3504 			    (ire1->ire_type != IRE_BROADCAST) ||
3505 			    (ire1->ire_ipif->ipif_ill->ill_group !=
3506 			    ire->ire_ipif->ipif_ill->ill_group))
3507 				break;
3508 			if (ire1->ire_ipif->ipif_ill->ill_group == NULL &&
3509 			    ire1->ire_ipif == ire->ire_ipif) {
3510 				irep = &ire1->ire_next;
3511 				break;
3512 			}
3513 			irep = &ire1->ire_next;
3514 		}
3515 	} else if (*irep != NULL) {
3516 		/*
3517 		 * Find the last ire which matches ire_addr.
3518 		 * Needed to do tail insertion among entries with the same
3519 		 * ire_addr.
3520 		 */
3521 		while (ire->ire_addr == ire1->ire_addr) {
3522 			irep = &ire1->ire_next;
3523 			ire1 = *irep;
3524 			if (ire1 == NULL)
3525 				break;
3526 		}
3527 	}
3528 
3529 	/* Insert at *irep */
3530 	ire1 = *irep;
3531 	if (ire1 != NULL)
3532 		ire1->ire_ptpn = &ire->ire_next;
3533 	ire->ire_next = ire1;
3534 	/* Link the new one in. */
3535 	ire->ire_ptpn = irep;
3536 
3537 	/*
3538 	 * ire_walk routines de-reference ire_next without holding
3539 	 * a lock. Before we point to the new ire, we want to make
3540 	 * sure the store that sets the ire_next of the new ire
3541 	 * reaches global visibility, so that ire_walk routines
3542 	 * don't see a truncated list of ires i.e if the ire_next
3543 	 * of the new ire gets set after we do "*irep = ire" due
3544 	 * to re-ordering, the ire_walk thread will see a NULL
3545 	 * once it accesses the ire_next of the new ire.
3546 	 * membar_producer() makes sure that the following store
3547 	 * happens *after* all of the above stores.
3548 	 */
3549 	membar_producer();
3550 	*irep = ire;
3551 	ire->ire_bucket = irb_ptr;
3552 	/*
3553 	 * We return a bumped up IRE above. Keep it symmetrical
3554 	 * so that the callers will always have to release. This
3555 	 * helps the callers of this function because they continue
3556 	 * to use the IRE after adding and hence they don't have to
3557 	 * lookup again after we return the IRE.
3558 	 *
3559 	 * NOTE : We don't have to use atomics as this is appearing
3560 	 * in the list for the first time and no one else can bump
3561 	 * up the reference count on this yet.
3562 	 */
3563 	IRE_REFHOLD_LOCKED(ire);
3564 	BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_inserted);
3565 
3566 	irb_ptr->irb_ire_cnt++;
3567 	if (irb_ptr->irb_marks & IRB_MARK_FTABLE)
3568 		irb_ptr->irb_nire++;
3569 
3570 	if (ire->ire_marks & IRE_MARK_TEMPORARY)
3571 		irb_ptr->irb_tmp_ire_cnt++;
3572 
3573 	if (ire->ire_ipif != NULL) {
3574 		ire->ire_ipif->ipif_ire_cnt++;
3575 		if (ire->ire_stq != NULL) {
3576 			stq_ill = (ill_t *)ire->ire_stq->q_ptr;
3577 			stq_ill->ill_ire_cnt++;
3578 		}
3579 	} else {
3580 		ASSERT(ire->ire_stq == NULL);
3581 	}
3582 
3583 	ire_atomic_end(irb_ptr, ire);
3584 	mutex_exit(&ipst->ips_ndp4->ndp_g_lock);
3585 
3586 	if (pire != NULL) {
3587 		/* Assert that it is not removed from the list yet */
3588 		ASSERT(pire->ire_ptpn != NULL);
3589 		IRB_REFRELE(pire->ire_bucket);
3590 		ire_refrele(pire);
3591 	}
3592 
3593 	if (ire->ire_type != IRE_CACHE) {
3594 		/*
3595 		 * For ire's with host mask see if there is an entry
3596 		 * in the cache. If there is one flush the whole cache as
3597 		 * there might be multiple entries due to RTF_MULTIRT (CGTP).
3598 		 * If no entry is found than there is no need to flush the
3599 		 * cache.
3600 		 */
3601 		if (ire->ire_mask == IP_HOST_MASK) {
3602 			ire_t *lire;
3603 			lire = ire_ctable_lookup(ire->ire_addr, NULL, IRE_CACHE,
3604 			    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
3605 			if (lire != NULL) {
3606 				ire_refrele(lire);
3607 				ire_flush_cache_v4(ire, IRE_FLUSH_ADD);
3608 			}
3609 		} else {
3610 			ire_flush_cache_v4(ire, IRE_FLUSH_ADD);
3611 		}
3612 	}
3613 	/*
3614 	 * We had to delay the fast path probe until the ire is inserted
3615 	 * in the list. Otherwise the fast path ack won't find the ire in
3616 	 * the table.
3617 	 */
3618 	if (ire->ire_type == IRE_CACHE ||
3619 	    (ire->ire_type == IRE_BROADCAST && ire->ire_stq != NULL)) {
3620 		ASSERT(ire->ire_nce != NULL);
3621 		nce_fastpath(ire->ire_nce);
3622 	}
3623 	if (ire->ire_ipif != NULL)
3624 		ASSERT(!MUTEX_HELD(&ire->ire_ipif->ipif_ill->ill_lock));
3625 	*ire_p = ire;
3626 	if (need_refrele) {
3627 		IRB_REFRELE(irb_ptr);
3628 	}
3629 	return (0);
3630 }
3631 
3632 /*
3633  * IRB_REFRELE is the only caller of the function. ire_unlink calls to
3634  * do the final cleanup for this ire.
3635  */
3636 void
3637 ire_cleanup(ire_t *ire)
3638 {
3639 	ire_t *ire_next;
3640 	ip_stack_t *ipst = ire->ire_ipst;
3641 
3642 	ASSERT(ire != NULL);
3643 
3644 	while (ire != NULL) {
3645 		ire_next = ire->ire_next;
3646 		if (ire->ire_ipversion == IPV4_VERSION) {
3647 			ire_delete_v4(ire);
3648 			BUMP_IRE_STATS(ipst->ips_ire_stats_v4,
3649 			    ire_stats_deleted);
3650 		} else {
3651 			ASSERT(ire->ire_ipversion == IPV6_VERSION);
3652 			ire_delete_v6(ire);
3653 			BUMP_IRE_STATS(ipst->ips_ire_stats_v6,
3654 			    ire_stats_deleted);
3655 		}
3656 		/*
3657 		 * Now it's really out of the list. Before doing the
3658 		 * REFRELE, set ire_next to NULL as ire_inactive asserts
3659 		 * so.
3660 		 */
3661 		ire->ire_next = NULL;
3662 		IRE_REFRELE_NOTR(ire);
3663 		ire = ire_next;
3664 	}
3665 }
3666 
3667 /*
3668  * IRB_REFRELE is the only caller of the function. It calls to unlink
3669  * all the CONDEMNED ires from this bucket.
3670  */
3671 ire_t *
3672 ire_unlink(irb_t *irb)
3673 {
3674 	ire_t *ire;
3675 	ire_t *ire1;
3676 	ire_t **ptpn;
3677 	ire_t *ire_list = NULL;
3678 
3679 	ASSERT(RW_WRITE_HELD(&irb->irb_lock));
3680 	ASSERT(((irb->irb_marks & IRB_MARK_FTABLE) && irb->irb_refcnt == 1) ||
3681 	    (irb->irb_refcnt == 0));
3682 	ASSERT(irb->irb_marks & IRB_MARK_CONDEMNED);
3683 	ASSERT(irb->irb_ire != NULL);
3684 
3685 	for (ire = irb->irb_ire; ire != NULL; ire = ire1) {
3686 		ip_stack_t	*ipst = ire->ire_ipst;
3687 
3688 		ire1 = ire->ire_next;
3689 		if (ire->ire_marks & IRE_MARK_CONDEMNED) {
3690 			ptpn = ire->ire_ptpn;
3691 			ire1 = ire->ire_next;
3692 			if (ire1)
3693 				ire1->ire_ptpn = ptpn;
3694 			*ptpn = ire1;
3695 			ire->ire_ptpn = NULL;
3696 			ire->ire_next = NULL;
3697 			if (ire->ire_type == IRE_DEFAULT) {
3698 				/*
3699 				 * IRE is out of the list. We need to adjust
3700 				 * the accounting before the caller drops
3701 				 * the lock.
3702 				 */
3703 				if (ire->ire_ipversion == IPV6_VERSION) {
3704 					ASSERT(ipst->
3705 					    ips_ipv6_ire_default_count !=
3706 					    0);
3707 					ipst->ips_ipv6_ire_default_count--;
3708 				}
3709 			}
3710 			/*
3711 			 * We need to call ire_delete_v4 or ire_delete_v6
3712 			 * to clean up the cache or the redirects pointing at
3713 			 * the default gateway. We need to drop the lock
3714 			 * as ire_flush_cache/ire_delete_host_redircts require
3715 			 * so. But we can't drop the lock, as ire_unlink needs
3716 			 * to atomically remove the ires from the list.
3717 			 * So, create a temporary list of CONDEMNED ires
3718 			 * for doing ire_delete_v4/ire_delete_v6 operations
3719 			 * later on.
3720 			 */
3721 			ire->ire_next = ire_list;
3722 			ire_list = ire;
3723 		}
3724 	}
3725 	irb->irb_marks &= ~IRB_MARK_CONDEMNED;
3726 	return (ire_list);
3727 }
3728 
3729 /*
3730  * Delete all the cache entries with this 'addr'.  When IP gets a gratuitous
3731  * ARP message on any of its interface queue, it scans the nce table and
3732  * deletes and calls ndp_delete() for the appropriate nce. This action
3733  * also deletes all the neighbor/ire cache entries for that address.
3734  * This function is called from ip_arp_news in ip.c and also for
3735  * ARP ioctl processing in ip_if.c. ip_ire_clookup_and_delete returns
3736  * true if it finds a nce entry which is used by ip_arp_news to determine if
3737  * it needs to do an ire_walk_v4. The return value is also  used for the
3738  * same purpose by ARP IOCTL processing * in ip_if.c when deleting
3739  * ARP entries. For SIOC*IFARP ioctls in addition to the address,
3740  * ip_if->ipif_ill also needs to be matched.
3741  */
3742 boolean_t
3743 ip_ire_clookup_and_delete(ipaddr_t addr, ipif_t *ipif, ip_stack_t *ipst)
3744 {
3745 	ill_t	*ill;
3746 	nce_t	*nce;
3747 
3748 	ill = (ipif ? ipif->ipif_ill : NULL);
3749 
3750 	if (ill != NULL) {
3751 		/*
3752 		 * clean up the nce (and any relevant ire's) that matches
3753 		 * on addr and ill.
3754 		 */
3755 		nce = ndp_lookup_v4(ill, &addr, B_FALSE);
3756 		if (nce != NULL) {
3757 			ndp_delete(nce);
3758 			return (B_TRUE);
3759 		}
3760 	} else {
3761 		/*
3762 		 * ill is wildcard. clean up all nce's and
3763 		 * ire's that match on addr
3764 		 */
3765 		nce_clookup_t cl;
3766 
3767 		cl.ncecl_addr = addr;
3768 		cl.ncecl_found = B_FALSE;
3769 
3770 		ndp_walk_common(ipst->ips_ndp4, NULL,
3771 		    (pfi_t)ip_nce_clookup_and_delete, (uchar_t *)&cl, B_TRUE);
3772 
3773 		/*
3774 		 *  ncecl_found would be set by ip_nce_clookup_and_delete if
3775 		 *  we found a matching nce.
3776 		 */
3777 		return (cl.ncecl_found);
3778 	}
3779 	return (B_FALSE);
3780 
3781 }
3782 
3783 /* Delete the supplied nce if its nce_addr matches the supplied address */
3784 static void
3785 ip_nce_clookup_and_delete(nce_t *nce, void *arg)
3786 {
3787 	nce_clookup_t *cl = (nce_clookup_t *)arg;
3788 	ipaddr_t nce_addr;
3789 
3790 	IN6_V4MAPPED_TO_IPADDR(&nce->nce_addr, nce_addr);
3791 	if (nce_addr == cl->ncecl_addr) {
3792 		cl->ncecl_found = B_TRUE;
3793 		/* clean up the nce (and any relevant ire's) */
3794 		ndp_delete(nce);
3795 	}
3796 }
3797 
3798 /*
3799  * Clean up the radix node for this ire. Must be called by IRB_REFRELE
3800  * when there are no ire's left in the bucket. Returns TRUE if the bucket
3801  * is deleted and freed.
3802  */
3803 boolean_t
3804 irb_inactive(irb_t *irb)
3805 {
3806 	struct rt_entry *rt;
3807 	struct radix_node *rn;
3808 	ip_stack_t *ipst = irb->irb_ipst;
3809 
3810 	ASSERT(irb->irb_ipst != NULL);
3811 
3812 	rt = IRB2RT(irb);
3813 	rn = (struct radix_node *)rt;
3814 
3815 	/* first remove it from the radix tree. */
3816 	RADIX_NODE_HEAD_WLOCK(ipst->ips_ip_ftable);
3817 	rw_enter(&irb->irb_lock, RW_WRITER);
3818 	if (irb->irb_refcnt == 1 && irb->irb_nire == 0) {
3819 		rn = ipst->ips_ip_ftable->rnh_deladdr(rn->rn_key, rn->rn_mask,
3820 		    ipst->ips_ip_ftable);
3821 		DTRACE_PROBE1(irb__free, rt_t *,  rt);
3822 		ASSERT((void *)rn == (void *)rt);
3823 		Free(rt, rt_entry_cache);
3824 		/* irb_lock is freed */
3825 		RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable);
3826 		return (B_TRUE);
3827 	}
3828 	rw_exit(&irb->irb_lock);
3829 	RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable);
3830 	return (B_FALSE);
3831 }
3832 
3833 /*
3834  * Delete the specified IRE.
3835  */
3836 void
3837 ire_delete(ire_t *ire)
3838 {
3839 	ire_t	*ire1;
3840 	ire_t	**ptpn;
3841 	irb_t *irb;
3842 	ip_stack_t	*ipst = ire->ire_ipst;
3843 
3844 	if ((irb = ire->ire_bucket) == NULL) {
3845 		/*
3846 		 * It was never inserted in the list. Should call REFRELE
3847 		 * to free this IRE.
3848 		 */
3849 		IRE_REFRELE_NOTR(ire);
3850 		return;
3851 	}
3852 
3853 	rw_enter(&irb->irb_lock, RW_WRITER);
3854 
3855 	if (irb->irb_rr_origin == ire) {
3856 		irb->irb_rr_origin = NULL;
3857 	}
3858 
3859 	/*
3860 	 * In case of V4 we might still be waiting for fastpath ack.
3861 	 */
3862 	if (ire->ire_ipversion == IPV4_VERSION &&
3863 	    (ire->ire_type == IRE_CACHE ||
3864 	    (ire->ire_type == IRE_BROADCAST && ire->ire_stq != NULL))) {
3865 		ASSERT(ire->ire_nce != NULL);
3866 		nce_fastpath_list_delete(ire->ire_nce);
3867 	}
3868 
3869 	if (ire->ire_ptpn == NULL) {
3870 		/*
3871 		 * Some other thread has removed us from the list.
3872 		 * It should have done the REFRELE for us.
3873 		 */
3874 		rw_exit(&irb->irb_lock);
3875 		return;
3876 	}
3877 
3878 	if (irb->irb_refcnt != 0) {
3879 		/*
3880 		 * The last thread to leave this bucket will
3881 		 * delete this ire.
3882 		 */
3883 		if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) {
3884 			irb->irb_ire_cnt--;
3885 			if (ire->ire_marks & IRE_MARK_TEMPORARY)
3886 				irb->irb_tmp_ire_cnt--;
3887 			ire->ire_marks |= IRE_MARK_CONDEMNED;
3888 		}
3889 		irb->irb_marks |= IRB_MARK_CONDEMNED;
3890 		rw_exit(&irb->irb_lock);
3891 		return;
3892 	}
3893 
3894 	/*
3895 	 * Normally to delete an ire, we walk the bucket. While we
3896 	 * walk the bucket, we normally bump up irb_refcnt and hence
3897 	 * we return from above where we mark CONDEMNED and the ire
3898 	 * gets deleted from ire_unlink. This case is where somebody
3899 	 * knows the ire e.g by doing a lookup, and wants to delete the
3900 	 * IRE. irb_refcnt would be 0 in this case if nobody is walking
3901 	 * the bucket.
3902 	 */
3903 	ptpn = ire->ire_ptpn;
3904 	ire1 = ire->ire_next;
3905 	if (ire1 != NULL)
3906 		ire1->ire_ptpn = ptpn;
3907 	ASSERT(ptpn != NULL);
3908 	*ptpn = ire1;
3909 	ire->ire_ptpn = NULL;
3910 	ire->ire_next = NULL;
3911 	if (ire->ire_ipversion == IPV6_VERSION) {
3912 		BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_deleted);
3913 	} else {
3914 		BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_deleted);
3915 	}
3916 	/*
3917 	 * ip_wput/ip_wput_v6 checks this flag to see whether
3918 	 * it should still use the cached ire or not.
3919 	 */
3920 	ire->ire_marks |= IRE_MARK_CONDEMNED;
3921 	if (ire->ire_type == IRE_DEFAULT) {
3922 		/*
3923 		 * IRE is out of the list. We need to adjust the
3924 		 * accounting before we drop the lock.
3925 		 */
3926 		if (ire->ire_ipversion == IPV6_VERSION) {
3927 			ASSERT(ipst->ips_ipv6_ire_default_count != 0);
3928 			ipst->ips_ipv6_ire_default_count--;
3929 		}
3930 	}
3931 	irb->irb_ire_cnt--;
3932 
3933 	if (ire->ire_marks & IRE_MARK_TEMPORARY)
3934 		irb->irb_tmp_ire_cnt--;
3935 	rw_exit(&irb->irb_lock);
3936 
3937 	if (ire->ire_ipversion == IPV6_VERSION) {
3938 		ire_delete_v6(ire);
3939 	} else {
3940 		ire_delete_v4(ire);
3941 	}
3942 	/*
3943 	 * We removed it from the list. Decrement the
3944 	 * reference count.
3945 	 */
3946 	IRE_REFRELE_NOTR(ire);
3947 }
3948 
3949 /*
3950  * Delete the specified IRE.
3951  * All calls should use ire_delete().
3952  * Sometimes called as writer though not required by this function.
3953  *
3954  * NOTE : This function is called only if the ire was added
3955  * in the list.
3956  */
3957 static void
3958 ire_delete_v4(ire_t *ire)
3959 {
3960 	ip_stack_t	*ipst = ire->ire_ipst;
3961 
3962 	ASSERT(ire->ire_refcnt >= 1);
3963 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
3964 
3965 	if (ire->ire_type != IRE_CACHE)
3966 		ire_flush_cache_v4(ire, IRE_FLUSH_DELETE);
3967 	if (ire->ire_type == IRE_DEFAULT) {
3968 		/*
3969 		 * when a default gateway is going away
3970 		 * delete all the host redirects pointing at that
3971 		 * gateway.
3972 		 */
3973 		ire_delete_host_redirects(ire->ire_gateway_addr, ipst);
3974 	}
3975 }
3976 
3977 /*
3978  * IRE_REFRELE/ire_refrele are the only caller of the function. It calls
3979  * to free the ire when the reference count goes to zero.
3980  */
3981 void
3982 ire_inactive(ire_t *ire)
3983 {
3984 	nce_t	*nce;
3985 	ill_t	*ill = NULL;
3986 	ill_t	*stq_ill = NULL;
3987 	ill_t	*in_ill = NULL;
3988 	ipif_t	*ipif;
3989 	boolean_t	need_wakeup = B_FALSE;
3990 	irb_t 	*irb;
3991 	ip_stack_t	*ipst = ire->ire_ipst;
3992 
3993 	ASSERT(ire->ire_refcnt == 0);
3994 	ASSERT(ire->ire_ptpn == NULL);
3995 	ASSERT(ire->ire_next == NULL);
3996 
3997 	if (ire->ire_gw_secattr != NULL) {
3998 		ire_gw_secattr_free(ire->ire_gw_secattr);
3999 		ire->ire_gw_secattr = NULL;
4000 	}
4001 
4002 	if (ire->ire_mp != NULL) {
4003 		ASSERT(ire->ire_bucket == NULL);
4004 		mutex_destroy(&ire->ire_lock);
4005 		BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_freed);
4006 		if (ire->ire_nce != NULL)
4007 			NCE_REFRELE_NOTR(ire->ire_nce);
4008 		freeb(ire->ire_mp);
4009 		return;
4010 	}
4011 
4012 	if ((nce = ire->ire_nce) != NULL) {
4013 		NCE_REFRELE_NOTR(nce);
4014 		ire->ire_nce = NULL;
4015 	}
4016 
4017 	if (ire->ire_ipif == NULL)
4018 		goto end;
4019 
4020 	ipif = ire->ire_ipif;
4021 	ill = ipif->ipif_ill;
4022 
4023 	if (ire->ire_bucket == NULL) {
4024 		/* The ire was never inserted in the table. */
4025 		goto end;
4026 	}
4027 
4028 	/*
4029 	 * ipif_ire_cnt on this ipif goes down by 1. If the ire_stq is
4030 	 * non-null ill_ire_count also goes down by 1. If the in_ill is
4031 	 * non-null either ill_mrtun_refcnt or ill_srcif_refcnt goes down by 1.
4032 	 *
4033 	 * The ipif that is associated with an ire is ire->ire_ipif and
4034 	 * hence when the ire->ire_ipif->ipif_ire_cnt drops to zero we call
4035 	 * ipif_ill_refrele_tail. Usually stq_ill is null or the same as
4036 	 * ire->ire_ipif->ipif_ill. So nothing more needs to be done. Only
4037 	 * in the case of IRE_CACHES when IPMP is used, stq_ill can be
4038 	 * different. If this is different from ire->ire_ipif->ipif_ill and
4039 	 * if the ill_ire_cnt on the stq_ill also has dropped to zero, we call
4040 	 * ipif_ill_refrele_tail on the stq_ill. If mobile ip is in use
4041 	 * in_ill could be non-null. If it is a reverse tunnel related ire
4042 	 * ill_mrtun_refcnt is non-zero. If it is forward tunnel related ire
4043 	 * ill_srcif_refcnt is non-null.
4044 	 */
4045 
4046 	if (ire->ire_stq != NULL)
4047 		stq_ill = (ill_t *)ire->ire_stq->q_ptr;
4048 	if (ire->ire_in_ill != NULL)
4049 		in_ill = ire->ire_in_ill;
4050 
4051 	if ((stq_ill == NULL || stq_ill == ill) && (in_ill == NULL)) {
4052 		/* Optimize the most common case */
4053 		mutex_enter(&ill->ill_lock);
4054 		ASSERT(ipif->ipif_ire_cnt != 0);
4055 		ipif->ipif_ire_cnt--;
4056 		if (ipif->ipif_ire_cnt == 0)
4057 			need_wakeup = B_TRUE;
4058 		if (stq_ill != NULL) {
4059 			ASSERT(stq_ill->ill_ire_cnt != 0);
4060 			stq_ill->ill_ire_cnt--;
4061 			if (stq_ill->ill_ire_cnt == 0)
4062 				need_wakeup = B_TRUE;
4063 		}
4064 		if (need_wakeup) {
4065 			/* Drops the ill lock */
4066 			ipif_ill_refrele_tail(ill);
4067 		} else {
4068 			mutex_exit(&ill->ill_lock);
4069 		}
4070 	} else {
4071 		/*
4072 		 * We can't grab all the ill locks at the same time.
4073 		 * It can lead to recursive lock enter in the call to
4074 		 * ipif_ill_refrele_tail and later. Instead do it 1 at
4075 		 * a time.
4076 		 */
4077 		mutex_enter(&ill->ill_lock);
4078 		ASSERT(ipif->ipif_ire_cnt != 0);
4079 		ipif->ipif_ire_cnt--;
4080 		if (ipif->ipif_ire_cnt == 0) {
4081 			/* Drops the lock */
4082 			ipif_ill_refrele_tail(ill);
4083 		} else {
4084 			mutex_exit(&ill->ill_lock);
4085 		}
4086 		if (stq_ill != NULL) {
4087 			mutex_enter(&stq_ill->ill_lock);
4088 			ASSERT(stq_ill->ill_ire_cnt != 0);
4089 			stq_ill->ill_ire_cnt--;
4090 			if (stq_ill->ill_ire_cnt == 0)  {
4091 				/* Drops the ill lock */
4092 				ipif_ill_refrele_tail(stq_ill);
4093 			} else {
4094 				mutex_exit(&stq_ill->ill_lock);
4095 			}
4096 		}
4097 		if (in_ill != NULL) {
4098 			mutex_enter(&in_ill->ill_lock);
4099 			if (ire->ire_type == IRE_MIPRTUN) {
4100 				/*
4101 				 * Mobile IP reverse tunnel ire.
4102 				 * Decrement table count and the
4103 				 * ill reference count. This signifies
4104 				 * mipagent is deleting reverse tunnel
4105 				 * route for a particular mobile node.
4106 				 */
4107 				mutex_enter(&ipst->ips_ire_mrtun_lock);
4108 				ipst->ips_ire_mrtun_count--;
4109 				mutex_exit(&ipst->ips_ire_mrtun_lock);
4110 				ASSERT(in_ill->ill_mrtun_refcnt != 0);
4111 				in_ill->ill_mrtun_refcnt--;
4112 				if (in_ill->ill_mrtun_refcnt == 0) {
4113 					/* Drops the ill lock */
4114 					ipif_ill_refrele_tail(in_ill);
4115 				} else {
4116 					mutex_exit(&in_ill->ill_lock);
4117 				}
4118 			} else {
4119 				mutex_enter(&ipst->ips_ire_srcif_table_lock);
4120 				ipst->ips_ire_srcif_table_count--;
4121 				mutex_exit(&ipst->ips_ire_srcif_table_lock);
4122 				ASSERT(in_ill->ill_srcif_refcnt != 0);
4123 				in_ill->ill_srcif_refcnt--;
4124 				if (in_ill->ill_srcif_refcnt == 0) {
4125 					/* Drops the ill lock */
4126 					ipif_ill_refrele_tail(in_ill);
4127 				} else {
4128 					mutex_exit(&in_ill->ill_lock);
4129 				}
4130 			}
4131 		}
4132 	}
4133 end:
4134 	/* This should be true for both V4 and V6 */
4135 
4136 	if ((ire->ire_type & IRE_FORWARDTABLE) &&
4137 	    (ire->ire_ipversion == IPV4_VERSION) &&
4138 	    ((irb = ire->ire_bucket) != NULL)) {
4139 		rw_enter(&irb->irb_lock, RW_WRITER);
4140 		irb->irb_nire--;
4141 		/*
4142 		 * Instead of examining the conditions for freeing
4143 		 * the radix node here, we do it by calling
4144 		 * IRB_REFRELE which is a single point in the code
4145 		 * that embeds that logic. Bump up the refcnt to
4146 		 * be able to call IRB_REFRELE
4147 		 */
4148 		IRB_REFHOLD_LOCKED(irb);
4149 		rw_exit(&irb->irb_lock);
4150 		IRB_REFRELE(irb);
4151 	}
4152 	ire->ire_ipif = NULL;
4153 
4154 	if (ire->ire_in_ill != NULL) {
4155 		ire->ire_in_ill = NULL;
4156 	}
4157 
4158 #ifdef IRE_DEBUG
4159 	ire_trace_inactive(ire);
4160 #endif
4161 	mutex_destroy(&ire->ire_lock);
4162 	if (ire->ire_ipversion == IPV6_VERSION) {
4163 		BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_freed);
4164 	} else {
4165 		BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_freed);
4166 	}
4167 	ASSERT(ire->ire_mp == NULL);
4168 	/* Has been allocated out of the cache */
4169 	kmem_cache_free(ire_cache, ire);
4170 }
4171 
4172 /*
4173  * ire_walk routine to delete all IRE_CACHE/IRE_HOST types redirect
4174  * entries that have a given gateway address.
4175  */
4176 void
4177 ire_delete_cache_gw(ire_t *ire, char *cp)
4178 {
4179 	ipaddr_t	gw_addr;
4180 
4181 	if (!(ire->ire_type & IRE_CACHE) &&
4182 	    !(ire->ire_flags & RTF_DYNAMIC))
4183 		return;
4184 
4185 	bcopy(cp, &gw_addr, sizeof (gw_addr));
4186 	if (ire->ire_gateway_addr == gw_addr) {
4187 		ip1dbg(("ire_delete_cache_gw: deleted 0x%x type %d to 0x%x\n",
4188 			(int)ntohl(ire->ire_addr), ire->ire_type,
4189 			(int)ntohl(ire->ire_gateway_addr)));
4190 		ire_delete(ire);
4191 	}
4192 }
4193 
4194 /*
4195  * Remove all IRE_CACHE entries that match the ire specified.
4196  *
4197  * The flag argument indicates if the flush request is due to addition
4198  * of new route (IRE_FLUSH_ADD) or deletion of old route (IRE_FLUSH_DELETE).
4199  *
4200  * This routine takes only the IREs from the forwarding table and flushes
4201  * the corresponding entries from the cache table.
4202  *
4203  * When flushing due to the deletion of an old route, it
4204  * just checks the cache handles (ire_phandle and ire_ihandle) and
4205  * deletes the ones that match.
4206  *
4207  * When flushing due to the creation of a new route, it checks
4208  * if a cache entry's address matches the one in the IRE and
4209  * that the cache entry's parent has a less specific mask than the
4210  * one in IRE. The destination of such a cache entry could be the
4211  * gateway for other cache entries, so we need to flush those as
4212  * well by looking for gateway addresses matching the IRE's address.
4213  */
4214 void
4215 ire_flush_cache_v4(ire_t *ire, int flag)
4216 {
4217 	int i;
4218 	ire_t *cire;
4219 	irb_t *irb;
4220 	ip_stack_t	*ipst = ire->ire_ipst;
4221 
4222 	if (ire->ire_type & IRE_CACHE)
4223 	    return;
4224 
4225 	/*
4226 	 * If a default is just created, there is no point
4227 	 * in going through the cache, as there will not be any
4228 	 * cached ires.
4229 	 */
4230 	if (ire->ire_type == IRE_DEFAULT && flag == IRE_FLUSH_ADD)
4231 		return;
4232 	if (flag == IRE_FLUSH_ADD) {
4233 		/*
4234 		 * This selective flush is due to the addition of
4235 		 * new IRE.
4236 		 */
4237 		for (i = 0; i < ipst->ips_ip_cache_table_size; i++) {
4238 			irb = &ipst->ips_ip_cache_table[i];
4239 			if ((cire = irb->irb_ire) == NULL)
4240 				continue;
4241 			IRB_REFHOLD(irb);
4242 			for (cire = irb->irb_ire; cire != NULL;
4243 			    cire = cire->ire_next) {
4244 				if (cire->ire_type != IRE_CACHE)
4245 					continue;
4246 				/*
4247 				 * If 'cire' belongs to the same subnet
4248 				 * as the new ire being added, and 'cire'
4249 				 * is derived from a prefix that is less
4250 				 * specific than the new ire being added,
4251 				 * we need to flush 'cire'; for instance,
4252 				 * when a new interface comes up.
4253 				 */
4254 				if (((cire->ire_addr & ire->ire_mask) ==
4255 				    (ire->ire_addr & ire->ire_mask)) &&
4256 				    (ip_mask_to_plen(cire->ire_cmask) <=
4257 				    ire->ire_masklen)) {
4258 					ire_delete(cire);
4259 					continue;
4260 				}
4261 				/*
4262 				 * This is the case when the ire_gateway_addr
4263 				 * of 'cire' belongs to the same subnet as
4264 				 * the new ire being added.
4265 				 * Flushing such ires is sometimes required to
4266 				 * avoid misrouting: say we have a machine with
4267 				 * two interfaces (I1 and I2), a default router
4268 				 * R on the I1 subnet, and a host route to an
4269 				 * off-link destination D with a gateway G on
4270 				 * the I2 subnet.
4271 				 * Under normal operation, we will have an
4272 				 * on-link cache entry for G and an off-link
4273 				 * cache entry for D with G as ire_gateway_addr,
4274 				 * traffic to D will reach its destination
4275 				 * through gateway G.
4276 				 * If the administrator does 'ifconfig I2 down',
4277 				 * the cache entries for D and G will be
4278 				 * flushed. However, G will now be resolved as
4279 				 * an off-link destination using R (the default
4280 				 * router) as gateway. Then D will also be
4281 				 * resolved as an off-link destination using G
4282 				 * as gateway - this behavior is due to
4283 				 * compatibility reasons, see comment in
4284 				 * ire_ihandle_lookup_offlink(). Traffic to D
4285 				 * will go to the router R and probably won't
4286 				 * reach the destination.
4287 				 * The administrator then does 'ifconfig I2 up'.
4288 				 * Since G is on the I2 subnet, this routine
4289 				 * will flush its cache entry. It must also
4290 				 * flush the cache entry for D, otherwise
4291 				 * traffic will stay misrouted until the IRE
4292 				 * times out.
4293 				 */
4294 				if ((cire->ire_gateway_addr & ire->ire_mask) ==
4295 				    (ire->ire_addr & ire->ire_mask)) {
4296 					ire_delete(cire);
4297 					continue;
4298 				}
4299 			}
4300 			IRB_REFRELE(irb);
4301 		}
4302 	} else {
4303 		/*
4304 		 * delete the cache entries based on
4305 		 * handle in the IRE as this IRE is
4306 		 * being deleted/changed.
4307 		 */
4308 		for (i = 0; i < ipst->ips_ip_cache_table_size; i++) {
4309 			irb = &ipst->ips_ip_cache_table[i];
4310 			if ((cire = irb->irb_ire) == NULL)
4311 				continue;
4312 			IRB_REFHOLD(irb);
4313 			for (cire = irb->irb_ire; cire != NULL;
4314 			    cire = cire->ire_next) {
4315 				if (cire->ire_type != IRE_CACHE)
4316 					continue;
4317 				if ((cire->ire_phandle == 0 ||
4318 				    cire->ire_phandle != ire->ire_phandle) &&
4319 				    (cire->ire_ihandle == 0 ||
4320 				    cire->ire_ihandle != ire->ire_ihandle))
4321 					continue;
4322 				ire_delete(cire);
4323 			}
4324 			IRB_REFRELE(irb);
4325 		}
4326 	}
4327 }
4328 
4329 /*
4330  * Matches the arguments passed with the values in the ire.
4331  *
4332  * Note: for match types that match using "ipif" passed in, ipif
4333  * must be checked for non-NULL before calling this routine.
4334  */
4335 boolean_t
4336 ire_match_args(ire_t *ire, ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway,
4337     int type, const ipif_t *ipif, zoneid_t zoneid, uint32_t ihandle,
4338     const ts_label_t *tsl, int match_flags)
4339 {
4340 	ill_t *ire_ill = NULL, *dst_ill;
4341 	ill_t *ipif_ill = NULL;
4342 	ill_group_t *ire_ill_group = NULL;
4343 	ill_group_t *ipif_ill_group = NULL;
4344 
4345 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
4346 	ASSERT((ire->ire_addr & ~ire->ire_mask) == 0);
4347 	ASSERT((!(match_flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP))) ||
4348 	    (ipif != NULL && !ipif->ipif_isv6));
4349 	ASSERT(!(match_flags & MATCH_IRE_WQ));
4350 
4351 	/*
4352 	 * HIDDEN cache entries have to be looked up specifically with
4353 	 * MATCH_IRE_MARK_HIDDEN. MATCH_IRE_MARK_HIDDEN is usually set
4354 	 * when the interface is FAILED or INACTIVE. In that case,
4355 	 * any IRE_CACHES that exists should be marked with
4356 	 * IRE_MARK_HIDDEN. So, we don't really need to match below
4357 	 * for IRE_MARK_HIDDEN. But we do so for consistency.
4358 	 */
4359 	if (!(match_flags & MATCH_IRE_MARK_HIDDEN) &&
4360 	    (ire->ire_marks & IRE_MARK_HIDDEN))
4361 		return (B_FALSE);
4362 
4363 	/*
4364 	 * MATCH_IRE_MARK_PRIVATE_ADDR is set when IP_NEXTHOP option
4365 	 * is used. In that case the routing table is bypassed and the
4366 	 * packets are sent directly to the specified nexthop. The
4367 	 * IRE_CACHE entry representing this route should be marked
4368 	 * with IRE_MARK_PRIVATE_ADDR.
4369 	 */
4370 
4371 	if (!(match_flags & MATCH_IRE_MARK_PRIVATE_ADDR) &&
4372 	    (ire->ire_marks & IRE_MARK_PRIVATE_ADDR))
4373 		return (B_FALSE);
4374 
4375 	if (zoneid != ALL_ZONES && zoneid != ire->ire_zoneid &&
4376 	    ire->ire_zoneid != ALL_ZONES) {
4377 		/*
4378 		 * If MATCH_IRE_ZONEONLY has been set and the supplied zoneid is
4379 		 * valid and does not match that of ire_zoneid, a failure to
4380 		 * match is reported at this point. Otherwise, since some IREs
4381 		 * that are available in the global zone can be used in local
4382 		 * zones, additional checks need to be performed:
4383 		 *
4384 		 *	IRE_BROADCAST, IRE_CACHE and IRE_LOOPBACK
4385 		 *	entries should never be matched in this situation.
4386 		 *
4387 		 *	IRE entries that have an interface associated with them
4388 		 *	should in general not match unless they are an IRE_LOCAL
4389 		 *	or in the case when MATCH_IRE_DEFAULT has been set in
4390 		 *	the caller.  In the case of the former, checking of the
4391 		 *	other fields supplied should take place.
4392 		 *
4393 		 *	In the case where MATCH_IRE_DEFAULT has been set,
4394 		 *	all of the ipif's associated with the IRE's ill are
4395 		 *	checked to see if there is a matching zoneid.  If any
4396 		 *	one ipif has a matching zoneid, this IRE is a
4397 		 *	potential candidate so checking of the other fields
4398 		 *	takes place.
4399 		 *
4400 		 *	In the case where the IRE_INTERFACE has a usable source
4401 		 *	address (indicated by ill_usesrc_ifindex) in the
4402 		 *	correct zone then it's permitted to return this IRE
4403 		 */
4404 		if (match_flags & MATCH_IRE_ZONEONLY)
4405 			return (B_FALSE);
4406 		if (ire->ire_type & (IRE_BROADCAST | IRE_CACHE | IRE_LOOPBACK))
4407 			return (B_FALSE);
4408 		/*
4409 		 * Note, IRE_INTERFACE can have the stq as NULL. For
4410 		 * example, if the default multicast route is tied to
4411 		 * the loopback address.
4412 		 */
4413 		if ((ire->ire_type & IRE_INTERFACE) &&
4414 		    (ire->ire_stq != NULL)) {
4415 			dst_ill = (ill_t *)ire->ire_stq->q_ptr;
4416 			/*
4417 			 * If there is a usable source address in the
4418 			 * zone, then it's ok to return an
4419 			 * IRE_INTERFACE
4420 			 */
4421 			if (ipif_usesrc_avail(dst_ill, zoneid)) {
4422 				ip3dbg(("ire_match_args: dst_ill %p match %d\n",
4423 				    (void *)dst_ill,
4424 				    (ire->ire_addr == (addr & mask))));
4425 			} else {
4426 				ip3dbg(("ire_match_args: src_ipif NULL"
4427 				    " dst_ill %p\n", (void *)dst_ill));
4428 				return (B_FALSE);
4429 			}
4430 		}
4431 		if (ire->ire_ipif != NULL && ire->ire_type != IRE_LOCAL &&
4432 		    !(ire->ire_type & IRE_INTERFACE)) {
4433 			ipif_t	*tipif;
4434 
4435 			if ((match_flags & MATCH_IRE_DEFAULT) == 0) {
4436 				return (B_FALSE);
4437 			}
4438 			mutex_enter(&ire->ire_ipif->ipif_ill->ill_lock);
4439 			for (tipif = ire->ire_ipif->ipif_ill->ill_ipif;
4440 			    tipif != NULL; tipif = tipif->ipif_next) {
4441 				if (IPIF_CAN_LOOKUP(tipif) &&
4442 				    (tipif->ipif_flags & IPIF_UP) &&
4443 				    (tipif->ipif_zoneid == zoneid ||
4444 				    tipif->ipif_zoneid == ALL_ZONES))
4445 					break;
4446 			}
4447 			mutex_exit(&ire->ire_ipif->ipif_ill->ill_lock);
4448 			if (tipif == NULL) {
4449 				return (B_FALSE);
4450 			}
4451 		}
4452 	}
4453 
4454 	/*
4455 	 * For IRE_CACHES, MATCH_IRE_ILL/ILL_GROUP really means that
4456 	 * somebody wants to send out on a particular interface which
4457 	 * is given by ire_stq and hence use ire_stq to derive the ill
4458 	 * value. ire_ipif for IRE_CACHES is just the means of getting
4459 	 * a source address i.e ire_src_addr = ire->ire_ipif->ipif_src_addr.
4460 	 * ire_to_ill does the right thing for this.
4461 	 */
4462 	if (match_flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP)) {
4463 		ire_ill = ire_to_ill(ire);
4464 		if (ire_ill != NULL)
4465 			ire_ill_group = ire_ill->ill_group;
4466 		ipif_ill = ipif->ipif_ill;
4467 		ipif_ill_group = ipif_ill->ill_group;
4468 	}
4469 
4470 	if ((ire->ire_addr == (addr & mask)) &&
4471 	    ((!(match_flags & MATCH_IRE_GW)) ||
4472 		(ire->ire_gateway_addr == gateway)) &&
4473 	    ((!(match_flags & MATCH_IRE_TYPE)) ||
4474 		(ire->ire_type & type)) &&
4475 	    ((!(match_flags & MATCH_IRE_SRC)) ||
4476 		(ire->ire_src_addr == ipif->ipif_src_addr)) &&
4477 	    ((!(match_flags & MATCH_IRE_IPIF)) ||
4478 		(ire->ire_ipif == ipif)) &&
4479 	    ((!(match_flags & MATCH_IRE_MARK_HIDDEN)) ||
4480 		(ire->ire_type != IRE_CACHE ||
4481 		ire->ire_marks & IRE_MARK_HIDDEN)) &&
4482 	    ((!(match_flags & MATCH_IRE_MARK_PRIVATE_ADDR)) ||
4483 		(ire->ire_type != IRE_CACHE ||
4484 		ire->ire_marks & IRE_MARK_PRIVATE_ADDR)) &&
4485 	    ((!(match_flags & MATCH_IRE_ILL)) ||
4486 		(ire_ill == ipif_ill)) &&
4487 	    ((!(match_flags & MATCH_IRE_IHANDLE)) ||
4488 		(ire->ire_ihandle == ihandle)) &&
4489 	    ((!(match_flags & MATCH_IRE_MASK)) ||
4490 		(ire->ire_mask == mask)) &&
4491 	    ((!(match_flags & MATCH_IRE_ILL_GROUP)) ||
4492 		(ire_ill == ipif_ill) ||
4493 		(ire_ill_group != NULL &&
4494 		ire_ill_group == ipif_ill_group)) &&
4495 	    ((!(match_flags & MATCH_IRE_SECATTR)) ||
4496 		(!is_system_labeled()) ||
4497 		(tsol_ire_match_gwattr(ire, tsl) == 0))) {
4498 		/* We found the matched IRE */
4499 		return (B_TRUE);
4500 	}
4501 	return (B_FALSE);
4502 }
4503 
4504 
4505 /*
4506  * Lookup for a route in all the tables
4507  */
4508 ire_t *
4509 ire_route_lookup(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway,
4510     int type, const ipif_t *ipif, ire_t **pire, zoneid_t zoneid,
4511     const ts_label_t *tsl, int flags, ip_stack_t *ipst)
4512 {
4513 	ire_t *ire = NULL;
4514 
4515 	/*
4516 	 * ire_match_args() will dereference ipif MATCH_IRE_SRC or
4517 	 * MATCH_IRE_ILL is set.
4518 	 */
4519 	if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL | MATCH_IRE_ILL_GROUP)) &&
4520 	    (ipif == NULL))
4521 		return (NULL);
4522 
4523 	/*
4524 	 * might be asking for a cache lookup,
4525 	 * This is not best way to lookup cache,
4526 	 * user should call ire_cache_lookup directly.
4527 	 *
4528 	 * If MATCH_IRE_TYPE was set, first lookup in the cache table and then
4529 	 * in the forwarding table, if the applicable type flags were set.
4530 	 */
4531 	if ((flags & MATCH_IRE_TYPE) == 0 || (type & IRE_CACHETABLE) != 0) {
4532 		ire = ire_ctable_lookup(addr, gateway, type, ipif, zoneid,
4533 		    tsl, flags, ipst);
4534 		if (ire != NULL)
4535 			return (ire);
4536 	}
4537 	if ((flags & MATCH_IRE_TYPE) == 0 || (type & IRE_FORWARDTABLE) != 0) {
4538 		ire = ire_ftable_lookup(addr, mask, gateway, type, ipif, pire,
4539 		    zoneid, 0, tsl, flags, ipst);
4540 	}
4541 	return (ire);
4542 }
4543 
4544 
4545 /*
4546  * Delete the IRE cache for the gateway and all IRE caches whose
4547  * ire_gateway_addr points to this gateway, and allow them to
4548  * be created on demand by ip_newroute.
4549  */
4550 void
4551 ire_clookup_delete_cache_gw(ipaddr_t addr, zoneid_t zoneid, ip_stack_t *ipst)
4552 {
4553 	irb_t *irb;
4554 	ire_t *ire;
4555 
4556 	irb = &ipst->ips_ip_cache_table[IRE_ADDR_HASH(addr,
4557 	    ipst->ips_ip_cache_table_size)];
4558 	IRB_REFHOLD(irb);
4559 	for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
4560 		if (ire->ire_marks & IRE_MARK_CONDEMNED)
4561 			continue;
4562 
4563 		ASSERT(ire->ire_mask == IP_HOST_MASK);
4564 		ASSERT(ire->ire_type != IRE_MIPRTUN && ire->ire_in_ill == NULL);
4565 		if (ire_match_args(ire, addr, ire->ire_mask, 0, IRE_CACHE,
4566 		    NULL, zoneid, 0, NULL, MATCH_IRE_TYPE)) {
4567 			ire_delete(ire);
4568 		}
4569 	}
4570 	IRB_REFRELE(irb);
4571 
4572 	ire_walk_v4(ire_delete_cache_gw, &addr, zoneid, ipst);
4573 }
4574 
4575 /*
4576  * Looks up cache table for a route.
4577  * specific lookup can be indicated by
4578  * passing the MATCH_* flags and the
4579  * necessary parameters.
4580  */
4581 ire_t *
4582 ire_ctable_lookup(ipaddr_t addr, ipaddr_t gateway, int type, const ipif_t *ipif,
4583     zoneid_t zoneid, const ts_label_t *tsl, int flags, ip_stack_t *ipst)
4584 {
4585 	irb_t *irb_ptr;
4586 	ire_t *ire;
4587 
4588 	/*
4589 	 * ire_match_args() will dereference ipif MATCH_IRE_SRC or
4590 	 * MATCH_IRE_ILL is set.
4591 	 */
4592 	if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL | MATCH_IRE_ILL_GROUP)) &&
4593 	    (ipif == NULL))
4594 		return (NULL);
4595 
4596 	irb_ptr = &ipst->ips_ip_cache_table[IRE_ADDR_HASH(addr,
4597 					    ipst->ips_ip_cache_table_size)];
4598 	rw_enter(&irb_ptr->irb_lock, RW_READER);
4599 	for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) {
4600 		if (ire->ire_marks & IRE_MARK_CONDEMNED)
4601 			continue;
4602 		ASSERT(ire->ire_mask == IP_HOST_MASK);
4603 		ASSERT(ire->ire_type != IRE_MIPRTUN && ire->ire_in_ill == NULL);
4604 		if (ire_match_args(ire, addr, ire->ire_mask, gateway, type,
4605 		    ipif, zoneid, 0, tsl, flags)) {
4606 			IRE_REFHOLD(ire);
4607 			rw_exit(&irb_ptr->irb_lock);
4608 			return (ire);
4609 		}
4610 	}
4611 	rw_exit(&irb_ptr->irb_lock);
4612 	return (NULL);
4613 }
4614 
4615 /*
4616  * Check whether the IRE_LOCAL and the IRE potentially used to transmit
4617  * (could be an IRE_CACHE, IRE_BROADCAST, or IRE_INTERFACE) are part of
4618  * the same ill group.
4619  */
4620 boolean_t
4621 ire_local_same_ill_group(ire_t *ire_local, ire_t *xmit_ire)
4622 {
4623 	ill_t		*recv_ill, *xmit_ill;
4624 	ill_group_t	*recv_group, *xmit_group;
4625 
4626 	ASSERT(ire_local->ire_type & (IRE_LOCAL|IRE_LOOPBACK));
4627 	ASSERT(xmit_ire->ire_type & (IRE_CACHETABLE|IRE_INTERFACE));
4628 
4629 	recv_ill = ire_to_ill(ire_local);
4630 	xmit_ill = ire_to_ill(xmit_ire);
4631 
4632 	ASSERT(recv_ill != NULL);
4633 	ASSERT(xmit_ill != NULL);
4634 
4635 	if (recv_ill == xmit_ill)
4636 		return (B_TRUE);
4637 
4638 	recv_group = recv_ill->ill_group;
4639 	xmit_group = xmit_ill->ill_group;
4640 
4641 	if (recv_group != NULL && recv_group == xmit_group)
4642 		return (B_TRUE);
4643 
4644 	return (B_FALSE);
4645 }
4646 
4647 /*
4648  * Check if the IRE_LOCAL uses the same ill (group) as another route would use.
4649  * If there is no alternate route, or the alternate is a REJECT or BLACKHOLE,
4650  * then we don't allow this IRE_LOCAL to be used.
4651  */
4652 boolean_t
4653 ire_local_ok_across_zones(ire_t *ire_local, zoneid_t zoneid, void *addr,
4654     const ts_label_t *tsl, ip_stack_t *ipst)
4655 {
4656 	ire_t		*alt_ire;
4657 	boolean_t	rval;
4658 
4659 	if (ire_local->ire_ipversion == IPV4_VERSION) {
4660 		alt_ire = ire_ftable_lookup(*((ipaddr_t *)addr), 0, 0, 0, NULL,
4661 		    NULL, zoneid, 0, tsl,
4662 		    MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
4663 		    MATCH_IRE_RJ_BHOLE, ipst);
4664 	} else {
4665 		alt_ire = ire_ftable_lookup_v6((in6_addr_t *)addr, NULL, NULL,
4666 		    0, NULL, NULL, zoneid, 0, tsl,
4667 		    MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
4668 		    MATCH_IRE_RJ_BHOLE, ipst);
4669 	}
4670 
4671 	if (alt_ire == NULL)
4672 		return (B_FALSE);
4673 
4674 	if (alt_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
4675 		ire_refrele(alt_ire);
4676 		return (B_FALSE);
4677 	}
4678 	rval = ire_local_same_ill_group(ire_local, alt_ire);
4679 
4680 	ire_refrele(alt_ire);
4681 	return (rval);
4682 }
4683 
4684 /*
4685  * Lookup cache. Don't return IRE_MARK_HIDDEN entries. Callers
4686  * should use ire_ctable_lookup with MATCH_IRE_MARK_HIDDEN to get
4687  * to the hidden ones.
4688  *
4689  * In general the zoneid has to match (where ALL_ZONES match all of them).
4690  * But for IRE_LOCAL we also need to handle the case where L2 should
4691  * conceptually loop back the packet. This is necessary since neither
4692  * Ethernet drivers nor Ethernet hardware loops back packets sent to their
4693  * own MAC address. This loopback is needed when the normal
4694  * routes (ignoring IREs with different zoneids) would send out the packet on
4695  * the same ill (or ill group) as the ill with which this IRE_LOCAL is
4696  * associated.
4697  *
4698  * Earlier versions of this code always matched an IRE_LOCAL independently of
4699  * the zoneid. We preserve that earlier behavior when
4700  * ip_restrict_interzone_loopback is turned off.
4701  */
4702 ire_t *
4703 ire_cache_lookup(ipaddr_t addr, zoneid_t zoneid, const ts_label_t *tsl,
4704     ip_stack_t *ipst)
4705 {
4706 	irb_t *irb_ptr;
4707 	ire_t *ire;
4708 
4709 	irb_ptr = &ipst->ips_ip_cache_table[IRE_ADDR_HASH(addr,
4710 					    ipst->ips_ip_cache_table_size)];
4711 	rw_enter(&irb_ptr->irb_lock, RW_READER);
4712 	for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) {
4713 		if (ire->ire_marks & (IRE_MARK_CONDEMNED |
4714 		    IRE_MARK_HIDDEN | IRE_MARK_PRIVATE_ADDR)) {
4715 			continue;
4716 		}
4717 		if (ire->ire_addr == addr) {
4718 			/*
4719 			 * Finally, check if the security policy has any
4720 			 * restriction on using this route for the specified
4721 			 * message.
4722 			 */
4723 			if (tsl != NULL &&
4724 			    ire->ire_gw_secattr != NULL &&
4725 			    tsol_ire_match_gwattr(ire, tsl) != 0) {
4726 				continue;
4727 			}
4728 
4729 			if (zoneid == ALL_ZONES || ire->ire_zoneid == zoneid ||
4730 			    ire->ire_zoneid == ALL_ZONES) {
4731 				IRE_REFHOLD(ire);
4732 				rw_exit(&irb_ptr->irb_lock);
4733 				return (ire);
4734 			}
4735 
4736 			if (ire->ire_type == IRE_LOCAL) {
4737 				if (ipst->ips_ip_restrict_interzone_loopback &&
4738 				    !ire_local_ok_across_zones(ire, zoneid,
4739 				    &addr, tsl, ipst))
4740 					continue;
4741 
4742 				IRE_REFHOLD(ire);
4743 				rw_exit(&irb_ptr->irb_lock);
4744 				return (ire);
4745 			}
4746 		}
4747 	}
4748 	rw_exit(&irb_ptr->irb_lock);
4749 	return (NULL);
4750 }
4751 
4752 /*
4753  * Locate the interface ire that is tied to the cache ire 'cire' via
4754  * cire->ire_ihandle.
4755  *
4756  * We are trying to create the cache ire for an offlink destn based
4757  * on the cache ire of the gateway in 'cire'. 'pire' is the prefix ire
4758  * as found by ip_newroute(). We are called from ip_newroute() in
4759  * the IRE_CACHE case.
4760  */
4761 ire_t *
4762 ire_ihandle_lookup_offlink(ire_t *cire, ire_t *pire)
4763 {
4764 	ire_t	*ire;
4765 	int	match_flags;
4766 	ipaddr_t gw_addr;
4767 	ipif_t	*gw_ipif;
4768 	ip_stack_t	*ipst = cire->ire_ipst;
4769 
4770 	ASSERT(cire != NULL && pire != NULL);
4771 
4772 	/*
4773 	 * We don't need to specify the zoneid to ire_ftable_lookup() below
4774 	 * because the ihandle refers to an ipif which can be in only one zone.
4775 	 */
4776 	match_flags =  MATCH_IRE_TYPE | MATCH_IRE_IHANDLE | MATCH_IRE_MASK;
4777 	/*
4778 	 * ip_newroute calls ire_ftable_lookup with MATCH_IRE_ILL only
4779 	 * for on-link hosts. We should never be here for onlink.
4780 	 * Thus, use MATCH_IRE_ILL_GROUP.
4781 	 */
4782 	if (pire->ire_ipif != NULL)
4783 		match_flags |= MATCH_IRE_ILL_GROUP;
4784 	/*
4785 	 * We know that the mask of the interface ire equals cire->ire_cmask.
4786 	 * (When ip_newroute() created 'cire' for the gateway it set its
4787 	 * cmask from the interface ire's mask)
4788 	 */
4789 	ire = ire_ftable_lookup(cire->ire_addr, cire->ire_cmask, 0,
4790 	    IRE_INTERFACE, pire->ire_ipif, NULL, ALL_ZONES, cire->ire_ihandle,
4791 	    NULL, match_flags, ipst);
4792 	if (ire != NULL)
4793 		return (ire);
4794 	/*
4795 	 * If we didn't find an interface ire above, we can't declare failure.
4796 	 * For backwards compatibility, we need to support prefix routes
4797 	 * pointing to next hop gateways that are not on-link.
4798 	 *
4799 	 * Assume we are trying to ping some offlink destn, and we have the
4800 	 * routing table below.
4801 	 *
4802 	 * Eg.	default	- gw1		<--- pire	(line 1)
4803 	 *	gw1	- gw2				(line 2)
4804 	 *	gw2	- hme0				(line 3)
4805 	 *
4806 	 * If we already have a cache ire for gw1 in 'cire', the
4807 	 * ire_ftable_lookup above would have failed, since there is no
4808 	 * interface ire to reach gw1. We will fallthru below.
4809 	 *
4810 	 * Here we duplicate the steps that ire_ftable_lookup() did in
4811 	 * getting 'cire' from 'pire', in the MATCH_IRE_RECURSIVE case.
4812 	 * The differences are the following
4813 	 * i.   We want the interface ire only, so we call ire_ftable_lookup()
4814 	 *	instead of ire_route_lookup()
4815 	 * ii.  We look for only prefix routes in the 1st call below.
4816 	 * ii.  We want to match on the ihandle in the 2nd call below.
4817 	 */
4818 	match_flags =  MATCH_IRE_TYPE;
4819 	if (pire->ire_ipif != NULL)
4820 		match_flags |= MATCH_IRE_ILL_GROUP;
4821 	ire = ire_ftable_lookup(pire->ire_gateway_addr, 0, 0, IRE_OFFSUBNET,
4822 	    pire->ire_ipif, NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
4823 	if (ire == NULL)
4824 		return (NULL);
4825 	/*
4826 	 * At this point 'ire' corresponds to the entry shown in line 2.
4827 	 * gw_addr is 'gw2' in the example above.
4828 	 */
4829 	gw_addr = ire->ire_gateway_addr;
4830 	gw_ipif = ire->ire_ipif;
4831 	ire_refrele(ire);
4832 
4833 	match_flags |= MATCH_IRE_IHANDLE;
4834 	ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE,
4835 	    gw_ipif, NULL, ALL_ZONES, cire->ire_ihandle, NULL, match_flags,
4836 	    ipst);
4837 	return (ire);
4838 }
4839 
4840 /*
4841  * ire_mrtun_lookup() is called by ip_rput() when packet is to be
4842  * tunneled through reverse tunnel. This is only supported for
4843  * IPv4 packets
4844  */
4845 
4846 ire_t *
4847 ire_mrtun_lookup(ipaddr_t srcaddr, ill_t *ill)
4848 {
4849 	irb_t *irb_ptr;
4850 	ire_t *ire;
4851 	ip_stack_t	*ipst = ill->ill_ipst;
4852 
4853 	ASSERT(ill != NULL);
4854 	ASSERT(!(ill->ill_isv6));
4855 
4856 	if (ipst->ips_ip_mrtun_table == NULL)
4857 		return (NULL);
4858 	irb_ptr = &ipst->ips_ip_mrtun_table[IRE_ADDR_HASH(srcaddr,
4859 					    IP_MRTUN_TABLE_SIZE)];
4860 	rw_enter(&irb_ptr->irb_lock, RW_READER);
4861 	for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) {
4862 		if (ire->ire_marks & IRE_MARK_CONDEMNED)
4863 			continue;
4864 		if ((ire->ire_in_src_addr == srcaddr) &&
4865 		    ire->ire_in_ill == ill) {
4866 			IRE_REFHOLD(ire);
4867 			rw_exit(&irb_ptr->irb_lock);
4868 			return (ire);
4869 		}
4870 	}
4871 	rw_exit(&irb_ptr->irb_lock);
4872 	return (NULL);
4873 }
4874 
4875 /*
4876  * Return the IRE_LOOPBACK, IRE_IF_RESOLVER or IRE_IF_NORESOLVER
4877  * ire associated with the specified ipif.
4878  *
4879  * This might occasionally be called when IPIF_UP is not set since
4880  * the IP_MULTICAST_IF as well as creating interface routes
4881  * allows specifying a down ipif (ipif_lookup* match ipifs that are down).
4882  *
4883  * Note that if IPIF_NOLOCAL, IPIF_NOXMIT, or IPIF_DEPRECATED is set on
4884  * the ipif, this routine might return NULL.
4885  */
4886 ire_t *
4887 ipif_to_ire(const ipif_t *ipif)
4888 {
4889 	ire_t	*ire;
4890 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
4891 
4892 	ASSERT(!ipif->ipif_isv6);
4893 	if (ipif->ipif_ire_type == IRE_LOOPBACK) {
4894 		ire = ire_ctable_lookup(ipif->ipif_lcl_addr, 0, IRE_LOOPBACK,
4895 		    ipif, ALL_ZONES, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF),
4896 		    ipst);
4897 	} else if (ipif->ipif_flags & IPIF_POINTOPOINT) {
4898 		/* In this case we need to lookup destination address. */
4899 		ire = ire_ftable_lookup(ipif->ipif_pp_dst_addr, IP_HOST_MASK, 0,
4900 		    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL,
4901 		    (MATCH_IRE_TYPE | MATCH_IRE_IPIF | MATCH_IRE_MASK), ipst);
4902 	} else {
4903 		ire = ire_ftable_lookup(ipif->ipif_subnet,
4904 		    ipif->ipif_net_mask, 0, IRE_INTERFACE, ipif, NULL,
4905 		    ALL_ZONES, 0, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF |
4906 		    MATCH_IRE_MASK), ipst);
4907 	}
4908 	return (ire);
4909 }
4910 
4911 /*
4912  * ire_walk function.
4913  * Count the number of IRE_CACHE entries in different categories.
4914  */
4915 void
4916 ire_cache_count(ire_t *ire, char *arg)
4917 {
4918 	ire_cache_count_t *icc = (ire_cache_count_t *)arg;
4919 
4920 	if (ire->ire_type != IRE_CACHE)
4921 		return;
4922 
4923 	icc->icc_total++;
4924 
4925 	if (ire->ire_ipversion == IPV6_VERSION) {
4926 		mutex_enter(&ire->ire_lock);
4927 		if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6)) {
4928 			mutex_exit(&ire->ire_lock);
4929 			icc->icc_onlink++;
4930 			return;
4931 		}
4932 		mutex_exit(&ire->ire_lock);
4933 	} else {
4934 		if (ire->ire_gateway_addr == 0) {
4935 			icc->icc_onlink++;
4936 			return;
4937 		}
4938 	}
4939 
4940 	ASSERT(ire->ire_ipif != NULL);
4941 	if (ire->ire_max_frag < ire->ire_ipif->ipif_mtu)
4942 		icc->icc_pmtu++;
4943 	else if (ire->ire_tire_mark != ire->ire_ob_pkt_count +
4944 	    ire->ire_ib_pkt_count)
4945 		icc->icc_offlink++;
4946 	else
4947 		icc->icc_unused++;
4948 }
4949 
4950 /*
4951  * ire_walk function called by ip_trash_ire_reclaim().
4952  * Free a fraction of the IRE_CACHE cache entries. The fractions are
4953  * different for different categories of IRE_CACHE entries.
4954  * A fraction of zero means to not free any in that category.
4955  * Use the hash bucket id plus lbolt as a random number. Thus if the fraction
4956  * is N then every Nth hash bucket chain will be freed.
4957  */
4958 void
4959 ire_cache_reclaim(ire_t *ire, char *arg)
4960 {
4961 	ire_cache_reclaim_t *icr = (ire_cache_reclaim_t *)arg;
4962 	uint_t rand;
4963 	ip_stack_t	*ipst = icr->icr_ipst;
4964 
4965 	if (ire->ire_type != IRE_CACHE)
4966 		return;
4967 
4968 	if (ire->ire_ipversion == IPV6_VERSION) {
4969 		rand = (uint_t)lbolt +
4970 		    IRE_ADDR_HASH_V6(ire->ire_addr_v6,
4971 			ipst->ips_ip6_cache_table_size);
4972 		mutex_enter(&ire->ire_lock);
4973 		if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6)) {
4974 			mutex_exit(&ire->ire_lock);
4975 			if (icr->icr_onlink != 0 &&
4976 			    (rand/icr->icr_onlink)*icr->icr_onlink == rand) {
4977 				ire_delete(ire);
4978 				return;
4979 			}
4980 			goto done;
4981 		}
4982 		mutex_exit(&ire->ire_lock);
4983 	} else {
4984 		rand = (uint_t)lbolt +
4985 		    IRE_ADDR_HASH(ire->ire_addr, ipst->ips_ip_cache_table_size);
4986 		if (ire->ire_gateway_addr == 0) {
4987 			if (icr->icr_onlink != 0 &&
4988 			    (rand/icr->icr_onlink)*icr->icr_onlink == rand) {
4989 				ire_delete(ire);
4990 				return;
4991 			}
4992 			goto done;
4993 		}
4994 	}
4995 	/* Not onlink IRE */
4996 	ASSERT(ire->ire_ipif != NULL);
4997 	if (ire->ire_max_frag < ire->ire_ipif->ipif_mtu) {
4998 		/* Use ptmu fraction */
4999 		if (icr->icr_pmtu != 0 &&
5000 		    (rand/icr->icr_pmtu)*icr->icr_pmtu == rand) {
5001 			ire_delete(ire);
5002 			return;
5003 		}
5004 	} else if (ire->ire_tire_mark != ire->ire_ob_pkt_count +
5005 	    ire->ire_ib_pkt_count) {
5006 		/* Use offlink fraction */
5007 		if (icr->icr_offlink != 0 &&
5008 		    (rand/icr->icr_offlink)*icr->icr_offlink == rand) {
5009 			ire_delete(ire);
5010 			return;
5011 		}
5012 	} else {
5013 		/* Use unused fraction */
5014 		if (icr->icr_unused != 0 &&
5015 		    (rand/icr->icr_unused)*icr->icr_unused == rand) {
5016 			ire_delete(ire);
5017 			return;
5018 		}
5019 	}
5020 done:
5021 	/*
5022 	 * Update tire_mark so that those that haven't been used since this
5023 	 * reclaim will be considered unused next time we reclaim.
5024 	 */
5025 	ire->ire_tire_mark = ire->ire_ob_pkt_count + ire->ire_ib_pkt_count;
5026 }
5027 
5028 static void
5029 power2_roundup(uint32_t *value)
5030 {
5031 	int i;
5032 
5033 	for (i = 1; i < 31; i++) {
5034 		if (*value <= (1 << i))
5035 			break;
5036 	}
5037 	*value = (1 << i);
5038 }
5039 
5040 /* Global init for all zones */
5041 void
5042 ip_ire_g_init()
5043 {
5044 	/*
5045 	 * Create ire caches, ire_reclaim()
5046 	 * will give IRE_CACHE back to system when needed.
5047 	 * This needs to be done here before anything else, since
5048 	 * ire_add() expects the cache to be created.
5049 	 */
5050 	ire_cache = kmem_cache_create("ire_cache",
5051 		sizeof (ire_t), 0, ip_ire_constructor,
5052 		ip_ire_destructor, ip_trash_ire_reclaim, NULL, NULL, 0);
5053 
5054 	rt_entry_cache = kmem_cache_create("rt_entry",
5055 	    sizeof (struct rt_entry), 0, NULL, NULL, NULL, NULL, NULL, 0);
5056 
5057 	/*
5058 	 * Have radix code setup kmem caches etc.
5059 	 */
5060 	rn_init();
5061 }
5062 
5063 void
5064 ip_ire_init(ip_stack_t *ipst)
5065 {
5066 	int i;
5067 	uint32_t mem_cnt;
5068 	uint32_t cpu_cnt;
5069 	uint32_t min_cnt;
5070 	pgcnt_t mem_avail;
5071 
5072 	/*
5073 	 * ip_ire_max_bucket_cnt is sized below based on the memory
5074 	 * size and the cpu speed of the machine. This is upper
5075 	 * bounded by the compile time value of ip_ire_max_bucket_cnt
5076 	 * and is lower bounded by the compile time value of
5077 	 * ip_ire_min_bucket_cnt.  Similar logic applies to
5078 	 * ip6_ire_max_bucket_cnt.
5079 	 *
5080 	 * We calculate this for each IP Instances in order to use
5081 	 * the kmem_avail and ip_ire_{min,max}_bucket_cnt that are
5082 	 * in effect when the zone is booted.
5083 	 */
5084 	mem_avail = kmem_avail();
5085 	mem_cnt = (mem_avail >> ip_ire_mem_ratio) /
5086 	    ip_cache_table_size / sizeof (ire_t);
5087 	cpu_cnt = CPU->cpu_type_info.pi_clock >> ip_ire_cpu_ratio;
5088 
5089 	min_cnt = MIN(cpu_cnt, mem_cnt);
5090 	if (min_cnt < ip_ire_min_bucket_cnt)
5091 		min_cnt = ip_ire_min_bucket_cnt;
5092 	if (ip_ire_max_bucket_cnt > min_cnt) {
5093 		ip_ire_max_bucket_cnt = min_cnt;
5094 	}
5095 
5096 	mem_cnt = (mem_avail >> ip_ire_mem_ratio) /
5097 	    ip6_cache_table_size / sizeof (ire_t);
5098 	min_cnt = MIN(cpu_cnt, mem_cnt);
5099 	if (min_cnt < ip6_ire_min_bucket_cnt)
5100 		min_cnt = ip6_ire_min_bucket_cnt;
5101 	if (ip6_ire_max_bucket_cnt > min_cnt) {
5102 		ip6_ire_max_bucket_cnt = min_cnt;
5103 	}
5104 
5105 	mutex_init(&ipst->ips_ire_ft_init_lock, NULL, MUTEX_DEFAULT, 0);
5106 	mutex_init(&ipst->ips_ire_handle_lock, NULL, MUTEX_DEFAULT, NULL);
5107 	mutex_init(&ipst->ips_ire_mrtun_lock, NULL, MUTEX_DEFAULT, NULL);
5108 	mutex_init(&ipst->ips_ire_srcif_table_lock, NULL, MUTEX_DEFAULT, NULL);
5109 
5110 	(void) rn_inithead((void **)&ipst->ips_ip_ftable, 32);
5111 
5112 
5113 	/* Calculate the IPv4 cache table size. */
5114 	ipst->ips_ip_cache_table_size = MAX(ip_cache_table_size,
5115 	    ((mem_avail >> ip_ire_mem_ratio) / sizeof (ire_t) /
5116 	    ip_ire_max_bucket_cnt));
5117 	if (ipst->ips_ip_cache_table_size > ip_max_cache_table_size)
5118 		ipst->ips_ip_cache_table_size = ip_max_cache_table_size;
5119 	/*
5120 	 * Make sure that the table size is always a power of 2.  The
5121 	 * hash macro IRE_ADDR_HASH() depends on that.
5122 	 */
5123 	power2_roundup(&ipst->ips_ip_cache_table_size);
5124 
5125 	ipst->ips_ip_cache_table = kmem_zalloc(ipst->ips_ip_cache_table_size *
5126 	    sizeof (irb_t), KM_SLEEP);
5127 
5128 	for (i = 0; i < ipst->ips_ip_cache_table_size; i++) {
5129 		rw_init(&ipst->ips_ip_cache_table[i].irb_lock, NULL,
5130 		    RW_DEFAULT, NULL);
5131 	}
5132 
5133 	/* Calculate the IPv6 cache table size. */
5134 	ipst->ips_ip6_cache_table_size = MAX(ip6_cache_table_size,
5135 	    ((mem_avail >> ip_ire_mem_ratio) / sizeof (ire_t) /
5136 	    ip6_ire_max_bucket_cnt));
5137 	if (ipst->ips_ip6_cache_table_size > ip6_max_cache_table_size)
5138 		ipst->ips_ip6_cache_table_size = ip6_max_cache_table_size;
5139 	/*
5140 	 * Make sure that the table size is always a power of 2.  The
5141 	 * hash macro IRE_ADDR_HASH_V6() depends on that.
5142 	 */
5143 	power2_roundup(&ipst->ips_ip6_cache_table_size);
5144 
5145 	ipst->ips_ip_cache_table_v6 = kmem_zalloc(
5146 	    ipst->ips_ip6_cache_table_size * sizeof (irb_t), KM_SLEEP);
5147 
5148 	for (i = 0; i < ipst->ips_ip6_cache_table_size; i++) {
5149 		rw_init(&ipst->ips_ip_cache_table_v6[i].irb_lock, NULL,
5150 		    RW_DEFAULT, NULL);
5151 	}
5152 
5153 	/*
5154 	 * Initialize ip_mrtun_table to NULL now, it will be
5155 	 * populated by ip_rt_add if reverse tunnel is created
5156 	 */
5157 	ipst->ips_ip_mrtun_table = NULL;
5158 
5159 	/*
5160 	 * Make sure that the forwarding table size is a power of 2.
5161 	 * The IRE*_ADDR_HASH() macroes depend on that.
5162 	 */
5163 	ipst->ips_ip6_ftable_hash_size = ip6_ftable_hash_size;
5164 	power2_roundup(&ipst->ips_ip6_ftable_hash_size);
5165 
5166 	ipst->ips_ire_handle = 1;
5167 }
5168 
5169 void
5170 ip_ire_g_fini(void)
5171 {
5172 	kmem_cache_destroy(ire_cache);
5173 	kmem_cache_destroy(rt_entry_cache);
5174 
5175 	rn_fini();
5176 }
5177 
5178 void
5179 ip_ire_fini(ip_stack_t *ipst)
5180 {
5181 	int i;
5182 
5183 	/*
5184 	 * Delete all IREs - assumes that the ill/ipifs have
5185 	 * been removed so what remains are just the ftable and IRE_CACHE.
5186 	 */
5187 	ire_walk_ill_mrtun(0, 0, ire_delete, NULL, NULL, ipst);
5188 	ire_walk(ire_delete, NULL, ipst);
5189 
5190 	rn_freehead(ipst->ips_ip_ftable);
5191 	ipst->ips_ip_ftable = NULL;
5192 
5193 	mutex_destroy(&ipst->ips_ire_ft_init_lock);
5194 	mutex_destroy(&ipst->ips_ire_handle_lock);
5195 	mutex_destroy(&ipst->ips_ire_mrtun_lock);
5196 	mutex_destroy(&ipst->ips_ire_srcif_table_lock);
5197 
5198 	for (i = 0; i < ipst->ips_ip_cache_table_size; i++) {
5199 		ASSERT(ipst->ips_ip_cache_table[i].irb_ire == NULL);
5200 		rw_destroy(&ipst->ips_ip_cache_table[i].irb_lock);
5201 	}
5202 	kmem_free(ipst->ips_ip_cache_table,
5203 	    ipst->ips_ip_cache_table_size * sizeof (irb_t));
5204 	ipst->ips_ip_cache_table = NULL;
5205 
5206 	for (i = 0; i < ipst->ips_ip6_cache_table_size; i++) {
5207 		ASSERT(ipst->ips_ip_cache_table_v6[i].irb_ire == NULL);
5208 		rw_destroy(&ipst->ips_ip_cache_table_v6[i].irb_lock);
5209 	}
5210 	kmem_free(ipst->ips_ip_cache_table_v6,
5211 	    ipst->ips_ip6_cache_table_size * sizeof (irb_t));
5212 	ipst->ips_ip_cache_table_v6 = NULL;
5213 
5214 	if (ipst->ips_ip_mrtun_table != NULL) {
5215 		for (i = 0; i < IP_MRTUN_TABLE_SIZE; i++) {
5216 			ASSERT(ipst->ips_ip_mrtun_table[i].irb_ire == NULL);
5217 			rw_destroy(&ipst->ips_ip_mrtun_table[i].irb_lock);
5218 		}
5219 		kmem_free(ipst->ips_ip_mrtun_table,
5220 		    IP_MRTUN_TABLE_SIZE * sizeof (irb_t));
5221 		ipst->ips_ip_mrtun_table = NULL;
5222 	}
5223 
5224 	for (i = 0; i < IP6_MASK_TABLE_SIZE; i++) {
5225 		irb_t *ptr;
5226 		int j;
5227 
5228 		if ((ptr = ipst->ips_ip_forwarding_table_v6[i]) == NULL)
5229 			continue;
5230 
5231 		for (j = 0; j < ipst->ips_ip6_ftable_hash_size; j++) {
5232 			ASSERT(ptr[j].irb_ire == NULL);
5233 			rw_destroy(&ptr[j].irb_lock);
5234 		}
5235 		mi_free(ptr);
5236 		ipst->ips_ip_forwarding_table_v6[i] = NULL;
5237 	}
5238 }
5239 
5240 int
5241 ire_add_mrtun(ire_t **ire_p, queue_t *q, mblk_t *mp, ipsq_func_t func)
5242 {
5243 	ire_t   *ire1;
5244 	irb_t	*irb_ptr;
5245 	ire_t	**irep;
5246 	ire_t	*ire = *ire_p;
5247 	int	i;
5248 	uint_t	max_frag;
5249 	ill_t	*stq_ill;
5250 	int error;
5251 	ip_stack_t	*ipst = ire->ire_ipst;
5252 
5253 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
5254 	/* Is ip_mrtun_table empty ? */
5255 
5256 	if (ipst->ips_ip_mrtun_table == NULL) {
5257 		/* create the mrtun table */
5258 		mutex_enter(&ipst->ips_ire_mrtun_lock);
5259 		if (ipst->ips_ip_mrtun_table == NULL) {
5260 			ipst->ips_ip_mrtun_table = kmem_zalloc(
5261 			    IP_MRTUN_TABLE_SIZE * sizeof (irb_t), KM_NOSLEEP);
5262 
5263 			if (ipst->ips_ip_mrtun_table == NULL) {
5264 				ip2dbg(("ire_add_mrtun: allocation failure\n"));
5265 				mutex_exit(&ipst->ips_ire_mrtun_lock);
5266 				ire_refrele(ire);
5267 				*ire_p = NULL;
5268 				return (ENOMEM);
5269 			}
5270 
5271 			for (i = 0; i < IP_MRTUN_TABLE_SIZE; i++) {
5272 			    rw_init(&ipst->ips_ip_mrtun_table[i].irb_lock, NULL,
5273 				    RW_DEFAULT, NULL);
5274 			}
5275 			ip2dbg(("ire_add_mrtun: mrtun table is created\n"));
5276 		}
5277 		/* some other thread got it and created the table */
5278 		mutex_exit(&ipst->ips_ire_mrtun_lock);
5279 	}
5280 
5281 	/*
5282 	 * Check for duplicate in the bucket and insert in the table
5283 	 */
5284 	irb_ptr = &(ipst->ips_ip_mrtun_table[IRE_ADDR_HASH(ire->ire_in_src_addr,
5285 	    IP_MRTUN_TABLE_SIZE)]);
5286 
5287 	/*
5288 	 * Start the atomic add of the ire. Grab the ill locks,
5289 	 * ill_g_usesrc_lock and the bucket lock.
5290 	 *
5291 	 * If ipif or ill is changing ire_atomic_start() may queue the
5292 	 * request and return EINPROGRESS.
5293 	 */
5294 	error = ire_atomic_start(irb_ptr, ire, q, mp, func);
5295 	if (error != 0) {
5296 		/*
5297 		 * We don't know whether it is a valid ipif or not.
5298 		 * So, set it to NULL. This assumes that the ire has not added
5299 		 * a reference to the ipif.
5300 		 */
5301 		ire->ire_ipif = NULL;
5302 		ire_delete(ire);
5303 		ip1dbg(("ire_add_mrtun: ire_atomic_start failed\n"));
5304 		*ire_p = NULL;
5305 		return (error);
5306 	}
5307 	for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) {
5308 		if (ire1->ire_marks & IRE_MARK_CONDEMNED)
5309 			continue;
5310 		/* has anyone inserted the route in the meanwhile ? */
5311 		if (ire1->ire_in_ill == ire->ire_in_ill &&
5312 		    ire1->ire_in_src_addr == ire->ire_in_src_addr) {
5313 			ip1dbg(("ire_add_mrtun: Duplicate entry exists\n"));
5314 			IRE_REFHOLD(ire1);
5315 			ire_atomic_end(irb_ptr, ire);
5316 			ire_delete(ire);
5317 			/* Return the old ire */
5318 			*ire_p = ire1;
5319 			return (0);
5320 		}
5321 	}
5322 
5323 	/* Atomically set the ire_max_frag */
5324 	max_frag = *ire->ire_max_fragp;
5325 	ire->ire_max_fragp = NULL;
5326 	ire->ire_max_frag = MIN(max_frag, IP_MAXPACKET);
5327 	ASSERT(ire->ire_type != IRE_CACHE);
5328 	irep = (ire_t **)irb_ptr;
5329 	if (*irep != NULL) {
5330 		/* Find the last ire which matches ire_in_src_addr */
5331 		ire1 = *irep;
5332 		while (ire1->ire_in_src_addr == ire->ire_in_src_addr) {
5333 			irep = &ire1->ire_next;
5334 			ire1 = *irep;
5335 			if (ire1 == NULL)
5336 				break;
5337 		}
5338 	}
5339 	ire1 = *irep;
5340 	if (ire1 != NULL)
5341 		ire1->ire_ptpn = &ire->ire_next;
5342 	ire->ire_next = ire1;
5343 	/* Link the new one in. */
5344 	ire->ire_ptpn = irep;
5345 	membar_producer();
5346 	*irep = ire;
5347 	ire->ire_bucket = irb_ptr;
5348 	IRE_REFHOLD_LOCKED(ire);
5349 
5350 	ip2dbg(("ire_add_mrtun: created and linked ire %p\n", (void *)*irep));
5351 
5352 	/*
5353 	 * Protect ire_mrtun_count and ill_mrtun_refcnt from
5354 	 * another thread trying to add ire in the table
5355 	 */
5356 	mutex_enter(&ipst->ips_ire_mrtun_lock);
5357 	ipst->ips_ire_mrtun_count++;
5358 	mutex_exit(&ipst->ips_ire_mrtun_lock);
5359 	/*
5360 	 * ill_mrtun_refcnt is protected by the ill_lock held via
5361 	 * ire_atomic_start
5362 	 */
5363 	ire->ire_in_ill->ill_mrtun_refcnt++;
5364 
5365 	if (ire->ire_ipif != NULL) {
5366 		ire->ire_ipif->ipif_ire_cnt++;
5367 		if (ire->ire_stq != NULL) {
5368 			stq_ill = (ill_t *)ire->ire_stq->q_ptr;
5369 			stq_ill->ill_ire_cnt++;
5370 		}
5371 	} else {
5372 		ASSERT(ire->ire_stq == NULL);
5373 	}
5374 
5375 	ire_atomic_end(irb_ptr, ire);
5376 	nce_fastpath(ire->ire_nce);
5377 	*ire_p = ire;
5378 	return (0);
5379 }
5380 
5381 
5382 /* Walks down the mrtun table */
5383 
5384 void
5385 ire_walk_ill_mrtun(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg,
5386     ill_t *ill, ip_stack_t *ipst)
5387 {
5388 	irb_t	*irb;
5389 	ire_t	*ire;
5390 	int	i;
5391 	int	ret;
5392 
5393 	ASSERT((!(match_flags & (MATCH_IRE_WQ | MATCH_IRE_ILL |
5394 	    MATCH_IRE_ILL_GROUP))) || (ill != NULL));
5395 	ASSERT(match_flags == 0 || ire_type == IRE_MIPRTUN);
5396 
5397 	mutex_enter(&ipst->ips_ire_mrtun_lock);
5398 	if (ipst->ips_ire_mrtun_count == 0) {
5399 		mutex_exit(&ipst->ips_ire_mrtun_lock);
5400 		return;
5401 	}
5402 	mutex_exit(&ipst->ips_ire_mrtun_lock);
5403 
5404 	ip2dbg(("ire_walk_ill_mrtun:walking the reverse tunnel table \n"));
5405 	for (i = 0; i < IP_MRTUN_TABLE_SIZE; i++) {
5406 
5407 		irb = &(ipst->ips_ip_mrtun_table[i]);
5408 		if (irb->irb_ire == NULL)
5409 			continue;
5410 		IRB_REFHOLD(irb);
5411 		for (ire = irb->irb_ire; ire != NULL;
5412 		    ire = ire->ire_next) {
5413 			ASSERT(ire->ire_ipversion == IPV4_VERSION);
5414 			if (match_flags != 0) {
5415 				ret = ire_walk_ill_match(
5416 				    match_flags, ire_type,
5417 				    ire, ill, ALL_ZONES, ipst);
5418 			}
5419 			if (match_flags == 0 || ret)
5420 				(*func)(ire, arg);
5421 		}
5422 		IRB_REFRELE(irb);
5423 	}
5424 }
5425 
5426 /*
5427  * Source interface based lookup routine (IPV4 only).
5428  * This routine is called only when RTA_SRCIFP bitflag is set
5429  * by routing socket while adding/deleting the route and it is
5430  * also called from ip_rput() when packets arrive from an interface
5431  * for which ill_srcif_ref_cnt is positive. This function is useful
5432  * when a packet coming from one interface must be forwarded to another
5433  * designated interface to reach the correct node. This function is also
5434  * called from ip_newroute when the link-layer address of an ire is resolved.
5435  * We need to make sure that ip_newroute searches for IRE_IF_RESOLVER type
5436  * ires--thus the ire_type parameter is needed.
5437  */
5438 
5439 ire_t *
5440 ire_srcif_table_lookup(ipaddr_t dst_addr, int ire_type, ipif_t *ipif,
5441     ill_t *in_ill, int flags)
5442 {
5443 	irb_t	*irb_ptr;
5444 	ire_t	*ire;
5445 	irb_t	*ire_srcif_table;
5446 
5447 	ASSERT(in_ill != NULL && !in_ill->ill_isv6);
5448 	ASSERT(!(flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP)) ||
5449 	    (ipif != NULL && !ipif->ipif_isv6));
5450 
5451 	/*
5452 	 * No need to lock the ill since it is refheld by the caller of this
5453 	 * function
5454 	 */
5455 	if (in_ill->ill_srcif_table == NULL) {
5456 		return (NULL);
5457 	}
5458 
5459 	if (!(flags & MATCH_IRE_TYPE)) {
5460 		flags |= MATCH_IRE_TYPE;
5461 		ire_type = IRE_INTERFACE;
5462 	}
5463 	ire_srcif_table = in_ill->ill_srcif_table;
5464 	irb_ptr = &ire_srcif_table[IRE_ADDR_HASH(dst_addr,
5465 	    IP_SRCIF_TABLE_SIZE)];
5466 	rw_enter(&irb_ptr->irb_lock, RW_READER);
5467 	for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) {
5468 		if (ire->ire_marks & IRE_MARK_CONDEMNED)
5469 			continue;
5470 		if (ire_match_args(ire, dst_addr, ire->ire_mask, 0,
5471 		    ire_type, ipif, ire->ire_zoneid, 0, NULL, flags)) {
5472 			IRE_REFHOLD(ire);
5473 			rw_exit(&irb_ptr->irb_lock);
5474 			return (ire);
5475 		}
5476 	}
5477 	/* Not Found */
5478 	rw_exit(&irb_ptr->irb_lock);
5479 	return (NULL);
5480 }
5481 
5482 
5483 /*
5484  * Adds the ire into the special routing table which is hanging off of
5485  * the src_ipif->ipif_ill. It also increments the refcnt in the ill.
5486  * The forward table contains only IRE_IF_RESOLVER, IRE_IF_NORESOLVER
5487  * i,e. IRE_INTERFACE entries. Originally the dlureq_mp field is NULL
5488  * for IRE_IF_RESOLVER entry because we do not have the dst_addr's
5489  * link-layer address at the time of addition.
5490  * Upon resolving the address from ARP, dlureq_mp field is updated with
5491  * proper information in ire_update_srcif_v4.
5492  */
5493 static int
5494 ire_add_srcif_v4(ire_t **ire_p, queue_t *q, mblk_t *mp, ipsq_func_t func)
5495 {
5496 	ire_t	*ire1;
5497 	irb_t	*ire_srcifp_table = NULL;
5498 	irb_t	*irb_ptr = NULL;
5499 	ire_t   **irep;
5500 	ire_t   *ire;
5501 	int	flags;
5502 	int	i;
5503 	ill_t	*stq_ill;
5504 	uint_t	max_frag;
5505 	int error = 0;
5506 	ip_stack_t	*ipst;
5507 
5508 	ire = *ire_p;
5509 	ipst = ire->ire_ipst;
5510 	ASSERT(ire->ire_in_ill != NULL);
5511 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
5512 	ASSERT(ire->ire_type == IRE_IF_NORESOLVER ||
5513 	    ire->ire_type == IRE_IF_RESOLVER);
5514 
5515 	ire->ire_mask = IP_HOST_MASK;
5516 	/*
5517 	 * Update ire_nce->nce_res_mp with NULL value upon creation;
5518 	 * first free the default res_mp created by ire_nce_init.
5519 	 */
5520 	freeb(ire->ire_nce->nce_res_mp);
5521 	if (ire->ire_type == IRE_IF_RESOLVER) {
5522 		/*
5523 		 * assign NULL now, it will be updated
5524 		 * with correct value upon returning from
5525 		 * ARP
5526 		 */
5527 		ire->ire_nce->nce_res_mp = NULL;
5528 	} else {
5529 		ire->ire_nce->nce_res_mp = ill_dlur_gen(NULL,
5530 		    ire->ire_ipif->ipif_ill->ill_phys_addr_length,
5531 		    ire->ire_ipif->ipif_ill->ill_sap,
5532 		    ire->ire_ipif->ipif_ill->ill_sap_length);
5533 	}
5534 	/* Make sure the address is properly masked. */
5535 	ire->ire_addr &= ire->ire_mask;
5536 
5537 	ASSERT(ire->ire_max_fragp != NULL);
5538 	max_frag = *ire->ire_max_fragp;
5539 	ire->ire_max_fragp = NULL;
5540 	ire->ire_max_frag = MIN(max_frag, IP_MAXPACKET);
5541 
5542 	mutex_enter(&ire->ire_in_ill->ill_lock);
5543 	if (ire->ire_in_ill->ill_srcif_table == NULL) {
5544 		/* create the incoming interface based table */
5545 		ire->ire_in_ill->ill_srcif_table = kmem_zalloc(
5546 		    IP_SRCIF_TABLE_SIZE * sizeof (irb_t), KM_NOSLEEP);
5547 		if (ire->ire_in_ill->ill_srcif_table == NULL) {
5548 			ip1dbg(("ire_add_srcif_v4: Allocation fail\n"));
5549 			mutex_exit(&ire->ire_in_ill->ill_lock);
5550 			ire_delete(ire);
5551 			*ire_p = NULL;
5552 			return (ENOMEM);
5553 		}
5554 		ire_srcifp_table = ire->ire_in_ill->ill_srcif_table;
5555 		for (i = 0; i < IP_SRCIF_TABLE_SIZE; i++) {
5556 			rw_init(&ire_srcifp_table[i].irb_lock, NULL,
5557 			    RW_DEFAULT, NULL);
5558 		}
5559 		ip2dbg(("ire_add_srcif_v4: table created for ill %p\n",
5560 		    (void *)ire->ire_in_ill));
5561 	}
5562 	/* Check for duplicate and insert */
5563 	ASSERT(ire->ire_in_ill->ill_srcif_table != NULL);
5564 	irb_ptr =
5565 	    &(ire->ire_in_ill->ill_srcif_table[IRE_ADDR_HASH(ire->ire_addr,
5566 	    IP_SRCIF_TABLE_SIZE)]);
5567 	mutex_exit(&ire->ire_in_ill->ill_lock);
5568 	flags = (MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_GW);
5569 	flags |= MATCH_IRE_IPIF;
5570 
5571 	/*
5572 	 * Start the atomic add of the ire. Grab the ill locks,
5573 	 * ill_g_usesrc_lock and the bucket lock.
5574 	 *
5575 	 * If ipif or ill is changing ire_atomic_start() may queue the
5576 	 * request and return EINPROGRESS.
5577 	 */
5578 	error = ire_atomic_start(irb_ptr, ire, q, mp, func);
5579 	if (error != 0) {
5580 		/*
5581 		 * We don't know whether it is a valid ipif or not.
5582 		 * So, set it to NULL. This assumes that the ire has not added
5583 		 * a reference to the ipif.
5584 		 */
5585 		ire->ire_ipif = NULL;
5586 		ire_delete(ire);
5587 		ip1dbg(("ire_add_srcif_v4: ire_atomic_start failed\n"));
5588 		*ire_p = NULL;
5589 		return (error);
5590 	}
5591 	for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) {
5592 		if (ire1->ire_marks & IRE_MARK_CONDEMNED)
5593 			continue;
5594 		if (ire1->ire_zoneid != ire->ire_zoneid)
5595 			continue;
5596 		/* Has anyone inserted route in the meanwhile ? */
5597 		if (ire_match_args(ire1, ire->ire_addr, ire->ire_mask, 0,
5598 		    ire->ire_type, ire->ire_ipif, ire->ire_zoneid, 0, NULL,
5599 		    flags)) {
5600 			ip1dbg(("ire_add_srcif_v4 : Duplicate entry exists\n"));
5601 			IRE_REFHOLD(ire1);
5602 			ire_atomic_end(irb_ptr, ire);
5603 			ire_delete(ire);
5604 			/* Return old ire as in ire_add_v4 */
5605 			*ire_p = ire1;
5606 			return (0);
5607 		}
5608 	}
5609 	irep = (ire_t **)irb_ptr;
5610 	if (*irep != NULL) {
5611 		/* Find the last ire which matches ire_addr */
5612 		ire1 = *irep;
5613 		while (ire1->ire_addr == ire->ire_addr) {
5614 			irep = &ire1->ire_next;
5615 			ire1 = *irep;
5616 			if (ire1 == NULL)
5617 				break;
5618 		}
5619 	}
5620 	ire1 = *irep;
5621 	if (ire1 != NULL)
5622 		ire1->ire_ptpn = &ire->ire_next;
5623 	ire->ire_next = ire1;
5624 	/* Link the new one in. */
5625 	ire->ire_ptpn = irep;
5626 	membar_producer();
5627 	*irep = ire;
5628 	ire->ire_bucket = irb_ptr;
5629 	IRE_REFHOLD_LOCKED(ire);
5630 
5631 	/*
5632 	 * Protect ire_in_ill->ill_srcif_refcnt and table reference count.
5633 	 * Note, ire_atomic_start already grabs the ire_in_ill->ill_lock
5634 	 * so ill_srcif_refcnt is already protected.
5635 	 */
5636 	ire->ire_in_ill->ill_srcif_refcnt++;
5637 	mutex_enter(&ipst->ips_ire_srcif_table_lock);
5638 	ipst->ips_ire_srcif_table_count++;
5639 	mutex_exit(&ipst->ips_ire_srcif_table_lock);
5640 	irb_ptr->irb_ire_cnt++;
5641 	if (ire->ire_ipif != NULL) {
5642 		ire->ire_ipif->ipif_ire_cnt++;
5643 		if (ire->ire_stq != NULL) {
5644 			stq_ill = (ill_t *)ire->ire_stq->q_ptr;
5645 			stq_ill->ill_ire_cnt++;
5646 		}
5647 	} else {
5648 		ASSERT(ire->ire_stq == NULL);
5649 	}
5650 
5651 	ire_atomic_end(irb_ptr, ire);
5652 	*ire_p = ire;
5653 	return (0);
5654 }
5655 
5656 
5657 /*
5658  * This function is called by ire_add_then_send when ARP request comes
5659  * back to ip_wput->ire_add_then_send for resolved ire in the interface
5660  * based routing table. At this point, it only needs to update the resolver
5661  * information for the ire. The passed ire is returned to the caller as it
5662  * is the ire which is created as mblk.
5663  */
5664 static ire_t *
5665 ire_update_srcif_v4(ire_t *ire)
5666 {
5667 	ire_t   *ire1;
5668 	irb_t	*irb;
5669 	int	error;
5670 
5671 	ASSERT(ire->ire_type != IRE_MIPRTUN &&
5672 	    ire->ire_ipif->ipif_net_type == IRE_IF_RESOLVER);
5673 	ASSERT(ire->ire_ipversion == IPV4_VERSION);
5674 
5675 	/*
5676 	 * This ire is from ARP. Update
5677 	 * ire_nce->nce_res_mp info
5678 	 */
5679 	ire1 = ire_srcif_table_lookup(ire->ire_addr,
5680 	    IRE_IF_RESOLVER, ire->ire_ipif,
5681 	    ire->ire_in_ill,
5682 	    MATCH_IRE_ILL | MATCH_IRE_TYPE);
5683 	if (ire1 == NULL) {
5684 		/* Mobile node registration expired ? */
5685 		ire_delete(ire);
5686 		return (NULL);
5687 	}
5688 	irb = ire1->ire_bucket;
5689 	ASSERT(irb != NULL);
5690 	/*
5691 	 * Start the atomic add of the ire. Grab the ill locks,
5692 	 * ill_g_usesrc_lock and the bucket lock.
5693 	 */
5694 	error = ire_atomic_start(irb, ire1, NULL, NULL, NULL);
5695 	if (error != 0) {
5696 		/*
5697 		 * We don't know whether it is a valid ipif or not.
5698 		 * So, set it to NULL. This assumes that the ire has not added
5699 		 * a reference to the ipif.
5700 		 */
5701 		ire->ire_ipif = NULL;
5702 		ire_delete(ire);
5703 		ip1dbg(("ire_update_srcif_v4: ire_atomic_start failed\n"));
5704 		return (NULL);
5705 	}
5706 	ASSERT(ire->ire_max_fragp == NULL);
5707 	ire->ire_max_frag = ire1->ire_max_frag;
5708 	/*
5709 	 * Update resolver information and
5710 	 * send-to queue.
5711 	 */
5712 	ASSERT(ire->ire_nce->nce_res_mp != NULL);
5713 	ire1->ire_nce->nce_res_mp = copyb(ire->ire_nce->nce_res_mp);
5714 	if (ire1->ire_nce->nce_res_mp ==  NULL) {
5715 		ip0dbg(("ire_update_srcif: copyb failed\n"));
5716 		ire_refrele(ire1);
5717 		ire_refrele(ire);
5718 		ire_atomic_end(irb, ire1);
5719 		return (NULL);
5720 	}
5721 	ire1->ire_stq = ire->ire_stq;
5722 
5723 	ASSERT(ire->ire_nce->nce_fp_mp == NULL);
5724 
5725 	ire_atomic_end(irb, ire1);
5726 	ire_refrele(ire1);
5727 	/* Return the passed ire */
5728 	return (ire);   /* Update done */
5729 }
5730 
5731 
5732 /*
5733  * Check if another multirt route resolution is needed.
5734  * B_TRUE is returned is there remain a resolvable route,
5735  * or if no route for that dst is resolved yet.
5736  * B_FALSE is returned if all routes for that dst are resolved
5737  * or if the remaining unresolved routes are actually not
5738  * resolvable.
5739  * This only works in the global zone.
5740  */
5741 boolean_t
5742 ire_multirt_need_resolve(ipaddr_t dst, const ts_label_t *tsl, ip_stack_t *ipst)
5743 {
5744 	ire_t	*first_fire;
5745 	ire_t	*first_cire;
5746 	ire_t	*fire;
5747 	ire_t	*cire;
5748 	irb_t	*firb;
5749 	irb_t	*cirb;
5750 	int	unres_cnt = 0;
5751 	boolean_t resolvable = B_FALSE;
5752 
5753 	/* Retrieve the first IRE_HOST that matches the destination */
5754 	first_fire = ire_ftable_lookup(dst, IP_HOST_MASK, 0, IRE_HOST, NULL,
5755 	    NULL, ALL_ZONES, 0, tsl,
5756 	    MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_SECATTR, ipst);
5757 
5758 	/* No route at all */
5759 	if (first_fire == NULL) {
5760 		return (B_TRUE);
5761 	}
5762 
5763 	firb = first_fire->ire_bucket;
5764 	ASSERT(firb != NULL);
5765 
5766 	/* Retrieve the first IRE_CACHE ire for that destination. */
5767 	first_cire = ire_cache_lookup(dst, GLOBAL_ZONEID, tsl, ipst);
5768 
5769 	/* No resolved route. */
5770 	if (first_cire == NULL) {
5771 		ire_refrele(first_fire);
5772 		return (B_TRUE);
5773 	}
5774 
5775 	/*
5776 	 * At least one route is resolved. Here we look through the forward
5777 	 * and cache tables, to compare the number of declared routes
5778 	 * with the number of resolved routes. The search for a resolvable
5779 	 * route is performed only if at least one route remains
5780 	 * unresolved.
5781 	 */
5782 	cirb = first_cire->ire_bucket;
5783 	ASSERT(cirb != NULL);
5784 
5785 	/* Count the number of routes to that dest that are declared. */
5786 	IRB_REFHOLD(firb);
5787 	for (fire = first_fire; fire != NULL; fire = fire->ire_next) {
5788 		if (!(fire->ire_flags & RTF_MULTIRT))
5789 			continue;
5790 		if (fire->ire_addr != dst)
5791 			continue;
5792 		unres_cnt++;
5793 	}
5794 	IRB_REFRELE(firb);
5795 
5796 	/* Then subtract the number of routes to that dst that are resolved */
5797 	IRB_REFHOLD(cirb);
5798 	for (cire = first_cire; cire != NULL; cire = cire->ire_next) {
5799 		if (!(cire->ire_flags & RTF_MULTIRT))
5800 			continue;
5801 		if (cire->ire_addr != dst)
5802 			continue;
5803 		if (cire->ire_marks & (IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN))
5804 			continue;
5805 		unres_cnt--;
5806 	}
5807 	IRB_REFRELE(cirb);
5808 
5809 	/* At least one route is unresolved; search for a resolvable route. */
5810 	if (unres_cnt > 0)
5811 		resolvable = ire_multirt_lookup(&first_cire, &first_fire,
5812 		    MULTIRT_USESTAMP | MULTIRT_CACHEGW, tsl, ipst);
5813 
5814 	if (first_fire != NULL)
5815 		ire_refrele(first_fire);
5816 
5817 	if (first_cire != NULL)
5818 		ire_refrele(first_cire);
5819 
5820 	return (resolvable);
5821 }
5822 
5823 
5824 /*
5825  * Explore a forward_table bucket, starting from fire_arg.
5826  * fire_arg MUST be an IRE_HOST entry.
5827  *
5828  * Return B_TRUE and update *ire_arg and *fire_arg
5829  * if at least one resolvable route is found. *ire_arg
5830  * is the IRE entry for *fire_arg's gateway.
5831  *
5832  * Return B_FALSE otherwise (all routes are resolved or
5833  * the remaining unresolved routes are all unresolvable).
5834  *
5835  * The IRE selection relies on a priority mechanism
5836  * driven by the flags passed in by the caller.
5837  * The caller, such as ip_newroute_ipif(), can get the most
5838  * relevant ire at each stage of a multiple route resolution.
5839  *
5840  * The rules are:
5841  *
5842  * - if MULTIRT_CACHEGW is specified in flags, IRE_CACHETABLE
5843  *   ires are preferred for the gateway. This gives the highest
5844  *   priority to routes that can be resolved without using
5845  *   a resolver.
5846  *
5847  * - if MULTIRT_CACHEGW is not specified, or if MULTIRT_CACHEGW
5848  *   is specified but no IRE_CACHETABLE ire entry for the gateway
5849  *   is found, the following rules apply.
5850  *
5851  * - if MULTIRT_USESTAMP is specified in flags, IRE_INTERFACE
5852  *   ires for the gateway, that have not been tried since
5853  *   a configurable amount of time, are preferred.
5854  *   This applies when a resolver must be invoked for
5855  *   a missing route, but we don't want to use the resolver
5856  *   upon each packet emission. If no such resolver is found,
5857  *   B_FALSE is returned.
5858  *   The MULTIRT_USESTAMP flag can be combined with
5859  *   MULTIRT_CACHEGW.
5860  *
5861  * - if MULTIRT_USESTAMP is not specified in flags, the first
5862  *   unresolved but resolvable route is selected.
5863  *
5864  * - Otherwise, there is no resolvalble route, and
5865  *   B_FALSE is returned.
5866  *
5867  * At last, MULTIRT_SETSTAMP can be specified in flags to
5868  * request the timestamp of unresolvable routes to
5869  * be refreshed. This prevents the useless exploration
5870  * of those routes for a while, when MULTIRT_USESTAMP is used.
5871  *
5872  * This only works in the global zone.
5873  */
5874 boolean_t
5875 ire_multirt_lookup(ire_t **ire_arg, ire_t **fire_arg, uint32_t flags,
5876     const ts_label_t *tsl, ip_stack_t *ipst)
5877 {
5878 	clock_t	delta;
5879 	ire_t	*best_fire = NULL;
5880 	ire_t	*best_cire = NULL;
5881 	ire_t	*first_fire;
5882 	ire_t	*first_cire;
5883 	ire_t	*fire;
5884 	ire_t	*cire;
5885 	irb_t	*firb = NULL;
5886 	irb_t	*cirb = NULL;
5887 	ire_t	*gw_ire;
5888 	boolean_t	already_resolved;
5889 	boolean_t	res;
5890 	ipaddr_t	dst;
5891 	ipaddr_t	gw;
5892 
5893 	ip2dbg(("ire_multirt_lookup: *ire_arg %p, *fire_arg %p, flags %04x\n",
5894 	    (void *)*ire_arg, (void *)*fire_arg, flags));
5895 
5896 	ASSERT(ire_arg != NULL);
5897 	ASSERT(fire_arg != NULL);
5898 
5899 	/* Not an IRE_HOST ire; give up. */
5900 	if ((*fire_arg == NULL) || ((*fire_arg)->ire_type != IRE_HOST)) {
5901 		return (B_FALSE);
5902 	}
5903 
5904 	/* This is the first IRE_HOST ire for that destination. */
5905 	first_fire = *fire_arg;
5906 	firb = first_fire->ire_bucket;
5907 	ASSERT(firb != NULL);
5908 
5909 	dst = first_fire->ire_addr;
5910 
5911 	ip2dbg(("ire_multirt_lookup: dst %08x\n", ntohl(dst)));
5912 
5913 	/*
5914 	 * Retrieve the first IRE_CACHE ire for that destination;
5915 	 * if we don't find one, no route for that dest is
5916 	 * resolved yet.
5917 	 */
5918 	first_cire = ire_cache_lookup(dst, GLOBAL_ZONEID, tsl, ipst);
5919 	if (first_cire != NULL) {
5920 		cirb = first_cire->ire_bucket;
5921 	}
5922 
5923 	ip2dbg(("ire_multirt_lookup: first_cire %p\n", (void *)first_cire));
5924 
5925 	/*
5926 	 * Search for a resolvable route, giving the top priority
5927 	 * to routes that can be resolved without any call to the resolver.
5928 	 */
5929 	IRB_REFHOLD(firb);
5930 
5931 	if (!CLASSD(dst)) {
5932 		/*
5933 		 * For all multiroute IRE_HOST ires for that destination,
5934 		 * check if the route via the IRE_HOST's gateway is
5935 		 * resolved yet.
5936 		 */
5937 		for (fire = first_fire; fire != NULL; fire = fire->ire_next) {
5938 
5939 			if (!(fire->ire_flags & RTF_MULTIRT))
5940 				continue;
5941 			if (fire->ire_addr != dst)
5942 				continue;
5943 
5944 			if (fire->ire_gw_secattr != NULL &&
5945 			    tsol_ire_match_gwattr(fire, tsl) != 0) {
5946 				continue;
5947 			}
5948 
5949 			gw = fire->ire_gateway_addr;
5950 
5951 			ip2dbg(("ire_multirt_lookup: fire %p, "
5952 			    "ire_addr %08x, ire_gateway_addr %08x\n",
5953 			    (void *)fire, ntohl(fire->ire_addr), ntohl(gw)));
5954 
5955 			already_resolved = B_FALSE;
5956 
5957 			if (first_cire != NULL) {
5958 				ASSERT(cirb != NULL);
5959 
5960 				IRB_REFHOLD(cirb);
5961 				/*
5962 				 * For all IRE_CACHE ires for that
5963 				 * destination.
5964 				 */
5965 				for (cire = first_cire;
5966 				    cire != NULL;
5967 				    cire = cire->ire_next) {
5968 
5969 					if (!(cire->ire_flags & RTF_MULTIRT))
5970 						continue;
5971 					if (cire->ire_addr != dst)
5972 						continue;
5973 					if (cire->ire_marks &
5974 					    (IRE_MARK_CONDEMNED |
5975 						IRE_MARK_HIDDEN))
5976 						continue;
5977 
5978 					if (cire->ire_gw_secattr != NULL &&
5979 					    tsol_ire_match_gwattr(cire,
5980 					    tsl) != 0) {
5981 						continue;
5982 					}
5983 
5984 					/*
5985 					 * Check if the IRE_CACHE's gateway
5986 					 * matches the IRE_HOST's gateway.
5987 					 */
5988 					if (cire->ire_gateway_addr == gw) {
5989 						already_resolved = B_TRUE;
5990 						break;
5991 					}
5992 				}
5993 				IRB_REFRELE(cirb);
5994 			}
5995 
5996 			/*
5997 			 * This route is already resolved;
5998 			 * proceed with next one.
5999 			 */
6000 			if (already_resolved) {
6001 				ip2dbg(("ire_multirt_lookup: found cire %p, "
6002 				    "already resolved\n", (void *)cire));
6003 				continue;
6004 			}
6005 
6006 			/*
6007 			 * The route is unresolved; is it actually
6008 			 * resolvable, i.e. is there a cache or a resolver
6009 			 * for the gateway?
6010 			 */
6011 			gw_ire = ire_route_lookup(gw, 0, 0, 0, NULL, NULL,
6012 			    ALL_ZONES, tsl,
6013 			    MATCH_IRE_RECURSIVE | MATCH_IRE_SECATTR, ipst);
6014 
6015 			ip2dbg(("ire_multirt_lookup: looked up gw_ire %p\n",
6016 			    (void *)gw_ire));
6017 
6018 			/*
6019 			 * If gw_ire is typed IRE_CACHETABLE,
6020 			 * this route can be resolved without any call to the
6021 			 * resolver. If the MULTIRT_CACHEGW flag is set,
6022 			 * give the top priority to this ire and exit the
6023 			 * loop.
6024 			 * This is typically the case when an ARP reply
6025 			 * is processed through ip_wput_nondata().
6026 			 */
6027 			if ((flags & MULTIRT_CACHEGW) &&
6028 			    (gw_ire != NULL) &&
6029 			    (gw_ire->ire_type & IRE_CACHETABLE)) {
6030 				ASSERT(gw_ire->ire_nce == NULL ||
6031 				    gw_ire->ire_nce->nce_state == ND_REACHABLE);
6032 				/*
6033 				 * Release the resolver associated to the
6034 				 * previous candidate best ire, if any.
6035 				 */
6036 				if (best_cire != NULL) {
6037 					ire_refrele(best_cire);
6038 					ASSERT(best_fire != NULL);
6039 				}
6040 
6041 				best_fire = fire;
6042 				best_cire = gw_ire;
6043 
6044 				ip2dbg(("ire_multirt_lookup: found top prio "
6045 				    "best_fire %p, best_cire %p\n",
6046 				    (void *)best_fire, (void *)best_cire));
6047 				break;
6048 			}
6049 
6050 			/*
6051 			 * Compute the time elapsed since our preceding
6052 			 * attempt to  resolve that route.
6053 			 * If the MULTIRT_USESTAMP flag is set, we take that
6054 			 * route into account only if this time interval
6055 			 * exceeds ip_multirt_resolution_interval;
6056 			 * this prevents us from attempting to resolve a
6057 			 * broken route upon each sending of a packet.
6058 			 */
6059 			delta = lbolt - fire->ire_last_used_time;
6060 			delta = TICK_TO_MSEC(delta);
6061 
6062 			res = (boolean_t)((delta >
6063 				ipst->ips_ip_multirt_resolution_interval) ||
6064 				(!(flags & MULTIRT_USESTAMP)));
6065 
6066 			ip2dbg(("ire_multirt_lookup: fire %p, delta %lu, "
6067 			    "res %d\n",
6068 			    (void *)fire, delta, res));
6069 
6070 			if (res) {
6071 				/*
6072 				 * We are here if MULTIRT_USESTAMP flag is set
6073 				 * and the resolver for fire's gateway
6074 				 * has not been tried since
6075 				 * ip_multirt_resolution_interval, or if
6076 				 * MULTIRT_USESTAMP is not set but gw_ire did
6077 				 * not fill the conditions for MULTIRT_CACHEGW,
6078 				 * or if neither MULTIRT_USESTAMP nor
6079 				 * MULTIRT_CACHEGW are set.
6080 				 */
6081 				if (gw_ire != NULL) {
6082 					if (best_fire == NULL) {
6083 						ASSERT(best_cire == NULL);
6084 
6085 						best_fire = fire;
6086 						best_cire = gw_ire;
6087 
6088 						ip2dbg(("ire_multirt_lookup:"
6089 						    "found candidate "
6090 						    "best_fire %p, "
6091 						    "best_cire %p\n",
6092 						    (void *)best_fire,
6093 						    (void *)best_cire));
6094 
6095 						/*
6096 						 * If MULTIRT_CACHEGW is not
6097 						 * set, we ignore the top
6098 						 * priority ires that can
6099 						 * be resolved without any
6100 						 * call to the resolver;
6101 						 * In that case, there is
6102 						 * actually no need
6103 						 * to continue the loop.
6104 						 */
6105 						if (!(flags &
6106 						    MULTIRT_CACHEGW)) {
6107 							break;
6108 						}
6109 						continue;
6110 					}
6111 				} else {
6112 					/*
6113 					 * No resolver for the gateway: the
6114 					 * route is not resolvable.
6115 					 * If the MULTIRT_SETSTAMP flag is
6116 					 * set, we stamp the IRE_HOST ire,
6117 					 * so we will not select it again
6118 					 * during this resolution interval.
6119 					 */
6120 					if (flags & MULTIRT_SETSTAMP)
6121 						fire->ire_last_used_time =
6122 						    lbolt;
6123 				}
6124 			}
6125 
6126 			if (gw_ire != NULL)
6127 				ire_refrele(gw_ire);
6128 		}
6129 	} else { /* CLASSD(dst) */
6130 
6131 		for (fire = first_fire;
6132 		    fire != NULL;
6133 		    fire = fire->ire_next) {
6134 
6135 			if (!(fire->ire_flags & RTF_MULTIRT))
6136 				continue;
6137 			if (fire->ire_addr != dst)
6138 				continue;
6139 
6140 			if (fire->ire_gw_secattr != NULL &&
6141 			    tsol_ire_match_gwattr(fire, tsl) != 0) {
6142 				continue;
6143 			}
6144 
6145 			already_resolved = B_FALSE;
6146 
6147 			gw = fire->ire_gateway_addr;
6148 
6149 			gw_ire = ire_ftable_lookup(gw, 0, 0, IRE_INTERFACE,
6150 			    NULL, NULL, ALL_ZONES, 0, tsl,
6151 			    MATCH_IRE_RECURSIVE | MATCH_IRE_TYPE |
6152 			    MATCH_IRE_SECATTR, ipst);
6153 
6154 			/* No resolver for the gateway; we skip this ire. */
6155 			if (gw_ire == NULL) {
6156 				continue;
6157 			}
6158 			ASSERT(gw_ire->ire_nce == NULL ||
6159 			    gw_ire->ire_nce->nce_state == ND_REACHABLE);
6160 
6161 			if (first_cire != NULL) {
6162 
6163 				IRB_REFHOLD(cirb);
6164 				/*
6165 				 * For all IRE_CACHE ires for that
6166 				 * destination.
6167 				 */
6168 				for (cire = first_cire;
6169 				    cire != NULL;
6170 				    cire = cire->ire_next) {
6171 
6172 					if (!(cire->ire_flags & RTF_MULTIRT))
6173 						continue;
6174 					if (cire->ire_addr != dst)
6175 						continue;
6176 					if (cire->ire_marks &
6177 					    (IRE_MARK_CONDEMNED |
6178 						IRE_MARK_HIDDEN))
6179 						continue;
6180 
6181 					if (cire->ire_gw_secattr != NULL &&
6182 					    tsol_ire_match_gwattr(cire,
6183 					    tsl) != 0) {
6184 						continue;
6185 					}
6186 
6187 					/*
6188 					 * Cache entries are linked to the
6189 					 * parent routes using the parent handle
6190 					 * (ire_phandle). If no cache entry has
6191 					 * the same handle as fire, fire is
6192 					 * still unresolved.
6193 					 */
6194 					ASSERT(cire->ire_phandle != 0);
6195 					if (cire->ire_phandle ==
6196 					    fire->ire_phandle) {
6197 						already_resolved = B_TRUE;
6198 						break;
6199 					}
6200 				}
6201 				IRB_REFRELE(cirb);
6202 			}
6203 
6204 			/*
6205 			 * This route is already resolved; proceed with
6206 			 * next one.
6207 			 */
6208 			if (already_resolved) {
6209 				ire_refrele(gw_ire);
6210 				continue;
6211 			}
6212 
6213 			/*
6214 			 * Compute the time elapsed since our preceding
6215 			 * attempt to resolve that route.
6216 			 * If the MULTIRT_USESTAMP flag is set, we take
6217 			 * that route into account only if this time
6218 			 * interval exceeds ip_multirt_resolution_interval;
6219 			 * this prevents us from attempting to resolve a
6220 			 * broken route upon each sending of a packet.
6221 			 */
6222 			delta = lbolt - fire->ire_last_used_time;
6223 			delta = TICK_TO_MSEC(delta);
6224 
6225 			res = (boolean_t)((delta >
6226 				ipst->ips_ip_multirt_resolution_interval) ||
6227 				(!(flags & MULTIRT_USESTAMP)));
6228 
6229 			ip3dbg(("ire_multirt_lookup: fire %p, delta %lx, "
6230 			    "flags %04x, res %d\n",
6231 			    (void *)fire, delta, flags, res));
6232 
6233 			if (res) {
6234 				if (best_cire != NULL) {
6235 					/*
6236 					 * Release the resolver associated
6237 					 * to the preceding candidate best
6238 					 * ire, if any.
6239 					 */
6240 					ire_refrele(best_cire);
6241 					ASSERT(best_fire != NULL);
6242 				}
6243 				best_fire = fire;
6244 				best_cire = gw_ire;
6245 				continue;
6246 			}
6247 
6248 			ire_refrele(gw_ire);
6249 		}
6250 	}
6251 
6252 	if (best_fire != NULL) {
6253 		IRE_REFHOLD(best_fire);
6254 	}
6255 	IRB_REFRELE(firb);
6256 
6257 	/* Release the first IRE_CACHE we initially looked up, if any. */
6258 	if (first_cire != NULL)
6259 		ire_refrele(first_cire);
6260 
6261 	/* Found a resolvable route. */
6262 	if (best_fire != NULL) {
6263 		ASSERT(best_cire != NULL);
6264 
6265 		if (*fire_arg != NULL)
6266 			ire_refrele(*fire_arg);
6267 		if (*ire_arg != NULL)
6268 			ire_refrele(*ire_arg);
6269 
6270 		/*
6271 		 * Update the passed-in arguments with the
6272 		 * resolvable multirt route we found.
6273 		 */
6274 		*fire_arg = best_fire;
6275 		*ire_arg = best_cire;
6276 
6277 		ip2dbg(("ire_multirt_lookup: returning B_TRUE, "
6278 		    "*fire_arg %p, *ire_arg %p\n",
6279 		    (void *)best_fire, (void *)best_cire));
6280 
6281 		return (B_TRUE);
6282 	}
6283 
6284 	ASSERT(best_cire == NULL);
6285 
6286 	ip2dbg(("ire_multirt_lookup: returning B_FALSE, *fire_arg %p, "
6287 	    "*ire_arg %p\n",
6288 	    (void *)*fire_arg, (void *)*ire_arg));
6289 
6290 	/* No resolvable route. */
6291 	return (B_FALSE);
6292 }
6293 
6294 /*
6295  * IRE iterator for inbound and loopback broadcast processing.
6296  * Given an IRE_BROADCAST ire, walk the ires with the same destination
6297  * address, but skip over the passed-in ire. Returns the next ire without
6298  * a hold - assumes that the caller holds a reference on the IRE bucket.
6299  */
6300 ire_t *
6301 ire_get_next_bcast_ire(ire_t *curr, ire_t *ire)
6302 {
6303 	ill_t *ill;
6304 
6305 	if (curr == NULL) {
6306 		for (curr = ire->ire_bucket->irb_ire; curr != NULL;
6307 		    curr = curr->ire_next) {
6308 			if (curr->ire_addr == ire->ire_addr)
6309 				break;
6310 		}
6311 	} else {
6312 		curr = curr->ire_next;
6313 	}
6314 	ill = ire_to_ill(ire);
6315 	for (; curr != NULL; curr = curr->ire_next) {
6316 		if (curr->ire_addr != ire->ire_addr) {
6317 			/*
6318 			 * All the IREs to a given destination are contiguous;
6319 			 * break out once the address doesn't match.
6320 			 */
6321 			break;
6322 		}
6323 		if (curr == ire) {
6324 			/* skip over the passed-in ire */
6325 			continue;
6326 		}
6327 		if ((curr->ire_stq != NULL && ire->ire_stq == NULL) ||
6328 		    (curr->ire_stq == NULL && ire->ire_stq != NULL)) {
6329 			/*
6330 			 * If the passed-in ire is loopback, skip over
6331 			 * non-loopback ires and vice versa.
6332 			 */
6333 			continue;
6334 		}
6335 		if (ire_to_ill(curr) != ill) {
6336 			/* skip over IREs going through a different interface */
6337 			continue;
6338 		}
6339 		if (curr->ire_marks & IRE_MARK_CONDEMNED) {
6340 			/* skip over deleted IREs */
6341 			continue;
6342 		}
6343 		return (curr);
6344 	}
6345 	return (NULL);
6346 }
6347 
6348 #ifdef IRE_DEBUG
6349 th_trace_t *
6350 th_trace_ire_lookup(ire_t *ire)
6351 {
6352 	int bucket_id;
6353 	th_trace_t *th_trace;
6354 
6355 	ASSERT(MUTEX_HELD(&ire->ire_lock));
6356 
6357 	bucket_id = IP_TR_HASH(curthread);
6358 	ASSERT(bucket_id < IP_TR_HASH_MAX);
6359 
6360 	for (th_trace = ire->ire_trace[bucket_id]; th_trace != NULL;
6361 	    th_trace = th_trace->th_next) {
6362 		if (th_trace->th_id == curthread)
6363 			return (th_trace);
6364 	}
6365 	return (NULL);
6366 }
6367 
6368 void
6369 ire_trace_ref(ire_t *ire)
6370 {
6371 	int bucket_id;
6372 	th_trace_t *th_trace;
6373 
6374 	/*
6375 	 * Attempt to locate the trace buffer for the curthread.
6376 	 * If it does not exist, then allocate a new trace buffer
6377 	 * and link it in list of trace bufs for this ipif, at the head
6378 	 */
6379 	mutex_enter(&ire->ire_lock);
6380 	if (ire->ire_trace_disable == B_TRUE) {
6381 		mutex_exit(&ire->ire_lock);
6382 		return;
6383 	}
6384 	th_trace = th_trace_ire_lookup(ire);
6385 	if (th_trace == NULL) {
6386 		bucket_id = IP_TR_HASH(curthread);
6387 		th_trace = (th_trace_t *)kmem_zalloc(sizeof (th_trace_t),
6388 		    KM_NOSLEEP);
6389 		if (th_trace == NULL) {
6390 			ire->ire_trace_disable = B_TRUE;
6391 			mutex_exit(&ire->ire_lock);
6392 			ire_trace_inactive(ire);
6393 			return;
6394 		}
6395 
6396 		th_trace->th_id = curthread;
6397 		th_trace->th_next = ire->ire_trace[bucket_id];
6398 		th_trace->th_prev = &ire->ire_trace[bucket_id];
6399 		if (th_trace->th_next != NULL)
6400 			th_trace->th_next->th_prev = &th_trace->th_next;
6401 		ire->ire_trace[bucket_id] = th_trace;
6402 	}
6403 	ASSERT(th_trace->th_refcnt < TR_BUF_MAX - 1);
6404 	th_trace->th_refcnt++;
6405 	th_trace_rrecord(th_trace);
6406 	mutex_exit(&ire->ire_lock);
6407 }
6408 
6409 void
6410 ire_trace_free(th_trace_t *th_trace)
6411 {
6412 	/* unlink th_trace and free it */
6413 	*th_trace->th_prev = th_trace->th_next;
6414 	if (th_trace->th_next != NULL)
6415 		th_trace->th_next->th_prev = th_trace->th_prev;
6416 	th_trace->th_next = NULL;
6417 	th_trace->th_prev = NULL;
6418 	kmem_free(th_trace, sizeof (th_trace_t));
6419 }
6420 
6421 void
6422 ire_untrace_ref(ire_t *ire)
6423 {
6424 	th_trace_t *th_trace;
6425 
6426 	mutex_enter(&ire->ire_lock);
6427 
6428 	if (ire->ire_trace_disable == B_TRUE) {
6429 		mutex_exit(&ire->ire_lock);
6430 		return;
6431 	}
6432 
6433 	th_trace = th_trace_ire_lookup(ire);
6434 	ASSERT(th_trace != NULL && th_trace->th_refcnt > 0);
6435 	th_trace_rrecord(th_trace);
6436 	th_trace->th_refcnt--;
6437 
6438 	if (th_trace->th_refcnt == 0)
6439 		ire_trace_free(th_trace);
6440 
6441 	mutex_exit(&ire->ire_lock);
6442 }
6443 
6444 static void
6445 ire_trace_inactive(ire_t *ire)
6446 {
6447 	th_trace_t *th_trace;
6448 	int i;
6449 
6450 	mutex_enter(&ire->ire_lock);
6451 	for (i = 0; i < IP_TR_HASH_MAX; i++) {
6452 		while (ire->ire_trace[i] != NULL) {
6453 			th_trace = ire->ire_trace[i];
6454 
6455 			/* unlink th_trace and free it */
6456 			ire->ire_trace[i] = th_trace->th_next;
6457 			if (th_trace->th_next != NULL)
6458 				th_trace->th_next->th_prev =
6459 				    &ire->ire_trace[i];
6460 
6461 			th_trace->th_next = NULL;
6462 			th_trace->th_prev = NULL;
6463 			kmem_free(th_trace, sizeof (th_trace_t));
6464 		}
6465 	}
6466 
6467 	mutex_exit(&ire->ire_lock);
6468 }
6469 
6470 /* ARGSUSED */
6471 void
6472 ire_thread_exit(ire_t *ire, caddr_t arg)
6473 {
6474 	th_trace_t	*th_trace;
6475 
6476 	mutex_enter(&ire->ire_lock);
6477 	th_trace = th_trace_ire_lookup(ire);
6478 	if (th_trace == NULL) {
6479 		mutex_exit(&ire->ire_lock);
6480 		return;
6481 	}
6482 	ASSERT(th_trace->th_refcnt == 0);
6483 
6484 	ire_trace_free(th_trace);
6485 	mutex_exit(&ire->ire_lock);
6486 }
6487 
6488 #endif
6489 
6490 /*
6491  * Generate a message chain with an arp request to resolve the in_ire.
6492  * It is assumed that in_ire itself is currently in the ire cache table,
6493  * so we create a fake_ire filled with enough information about ire_addr etc.
6494  * to retrieve in_ire when the DL_UNITDATA response from the resolver
6495  * comes back. The fake_ire itself is created by calling esballoc with
6496  * the fr_rtnp (free routine) set to ire_freemblk. This routine will be
6497  * invoked when the mblk containing fake_ire is freed.
6498  */
6499 void
6500 ire_arpresolve(ire_t *in_ire, ill_t *dst_ill)
6501 {
6502 	areq_t		*areq;
6503 	ipaddr_t	*addrp;
6504 	mblk_t 		*ire_mp, *dlureq_mp;
6505 	ire_t 		*ire, *buf;
6506 	size_t		bufsize;
6507 	frtn_t		*frtnp;
6508 	ill_t		*ill;
6509 	ip_stack_t	*ipst = dst_ill->ill_ipst;
6510 
6511 	/*
6512 	 * Construct message chain for the resolver
6513 	 * of the form:
6514 	 *	ARP_REQ_MBLK-->IRE_MBLK
6515 	 *
6516 	 * NOTE : If the response does not
6517 	 * come back, ARP frees the packet. For this reason,
6518 	 * we can't REFHOLD the bucket of save_ire to prevent
6519 	 * deletions. We may not be able to REFRELE the bucket
6520 	 * if the response never comes back. Thus, before
6521 	 * adding the ire, ire_add_v4 will make sure that the
6522 	 * interface route does not get deleted. This is the
6523 	 * only case unlike ip_newroute_v6, ip_newroute_ipif_v6
6524 	 * where we can always prevent deletions because of
6525 	 * the synchronous nature of adding IRES i.e
6526 	 * ire_add_then_send is called after creating the IRE.
6527 	 */
6528 
6529 	/*
6530 	 * We use esballoc to allocate the second part(the ire_t size mblk)
6531 	 * of the message chain depicted above. THis mblk will be freed
6532 	 * by arp when there is a  timeout, and otherwise passed to IP
6533 	 * and IP will * free it after processing the ARP response.
6534 	 */
6535 
6536 	bufsize = sizeof (ire_t) + sizeof (frtn_t);
6537 	buf = kmem_alloc(bufsize, KM_NOSLEEP);
6538 	if (buf == NULL) {
6539 		ip1dbg(("ire_arpresolver:alloc buffer failed\n "));
6540 		return;
6541 	}
6542 	frtnp = (frtn_t *)(buf + 1);
6543 	frtnp->free_arg = (caddr_t)buf;
6544 	frtnp->free_func = ire_freemblk;
6545 
6546 	ire_mp = esballoc((unsigned char *)buf, bufsize, BPRI_MED, frtnp);
6547 
6548 	if (ire_mp == NULL) {
6549 		ip1dbg(("ire_arpresolve: esballoc failed\n"));
6550 		kmem_free(buf, bufsize);
6551 		return;
6552 	}
6553 	ASSERT(in_ire->ire_nce != NULL);
6554 	dlureq_mp = copyb(dst_ill->ill_resolver_mp);
6555 	if (dlureq_mp == NULL) {
6556 		kmem_free(buf, bufsize);
6557 		return;
6558 	}
6559 
6560 	ire_mp->b_datap->db_type = IRE_ARPRESOLVE_TYPE;
6561 	ire = (ire_t *)buf;
6562 	/*
6563 	 * keep enough info in the fake ire so that we can pull up
6564 	 * the incomplete ire (in_ire) after result comes back from
6565 	 * arp and make it complete.
6566 	 */
6567 	*ire = ire_null;
6568 	ire->ire_u = in_ire->ire_u;
6569 	ire->ire_ipif_seqid = in_ire->ire_ipif_seqid;
6570 	ire->ire_ipif = in_ire->ire_ipif;
6571 	ire->ire_stq = in_ire->ire_stq;
6572 	ill = ire_to_ill(ire);
6573 	ire->ire_stq_ifindex = ill->ill_phyint->phyint_ifindex;
6574 	ire->ire_zoneid = in_ire->ire_zoneid;
6575 	ire->ire_ipst = ipst;
6576 
6577 	/*
6578 	 * ire_freemblk will be called when ire_mp is freed, both for
6579 	 * successful and failed arp resolution. IRE_MARK_UNCACHED will be set
6580 	 * when the arp resolution failed.
6581 	 */
6582 	ire->ire_marks |= IRE_MARK_UNCACHED;
6583 	ire->ire_mp = ire_mp;
6584 	ire_mp->b_wptr = (uchar_t *)&ire[1];
6585 	ire_mp->b_cont = NULL;
6586 	ASSERT(dlureq_mp != NULL);
6587 	linkb(dlureq_mp, ire_mp);
6588 
6589 	/*
6590 	 * Fill in the source and dest addrs for the resolver.
6591 	 * NOTE: this depends on memory layouts imposed by
6592 	 * ill_init().
6593 	 */
6594 	areq = (areq_t *)dlureq_mp->b_rptr;
6595 	addrp = (ipaddr_t *)((char *)areq + areq->areq_sender_addr_offset);
6596 	*addrp = ire->ire_src_addr;
6597 
6598 	addrp = (ipaddr_t *)((char *)areq + areq->areq_target_addr_offset);
6599 	if (ire->ire_gateway_addr != INADDR_ANY) {
6600 		*addrp = ire->ire_gateway_addr;
6601 	} else {
6602 		*addrp = ire->ire_addr;
6603 	}
6604 
6605 	/* Up to the resolver. */
6606 	if (canputnext(dst_ill->ill_rq)) {
6607 		putnext(dst_ill->ill_rq, dlureq_mp);
6608 	} else {
6609 		/* Prepare for cleanup */
6610 		freemsg(dlureq_mp);
6611 	}
6612 }
6613 
6614 /*
6615  * Esballoc free function for AR_ENTRY_QUERY request to clean up any
6616  * unresolved ire_t and/or nce_t structures when ARP resolution fails.
6617  *
6618  * This function can be called by ARP via free routine for ire_mp or
6619  * by IPv4(both host and forwarding path) via ire_delete
6620  * in case ARP resolution fails.
6621  * NOTE: Since IP is MT, ARP can call into IP but not vice versa
6622  * (for IP to talk to ARP, it still has to send AR* messages).
6623  *
6624  * Note that the ARP/IP merge should replace the functioanlity by providing
6625  * direct function calls to clean up unresolved entries in ire/nce lists.
6626  */
6627 void
6628 ire_freemblk(ire_t *ire_mp)
6629 {
6630 	nce_t		*nce = NULL;
6631 	ill_t		*ill;
6632 	ip_stack_t	*ipst;
6633 
6634 	ASSERT(ire_mp != NULL);
6635 
6636 	if ((ire_mp->ire_addr == NULL) && (ire_mp->ire_gateway_addr == NULL)) {
6637 		ip1dbg(("ire_freemblk(0x%p) ire_addr is NULL\n",
6638 		    (void *)ire_mp));
6639 		goto cleanup;
6640 	}
6641 	if ((ire_mp->ire_marks & IRE_MARK_UNCACHED) == 0) {
6642 		goto cleanup; /* everything succeeded. just free and return */
6643 	}
6644 
6645 	/*
6646 	 * the arp information corresponding to this ire_mp was not
6647 	 * transferred to  a ire_cache entry. Need
6648 	 * to clean up incomplete ire's and nce, if necessary.
6649 	 */
6650 	ASSERT(ire_mp->ire_stq != NULL);
6651 	ASSERT(ire_mp->ire_stq_ifindex != 0);
6652 	ASSERT(ire_mp->ire_ipst != NULL);
6653 
6654 	ipst = ire_mp->ire_ipst;
6655 
6656 	/*
6657 	 * Get any nce's corresponding to this ire_mp. We first have to
6658 	 * make sure that the ill is still around.
6659 	 */
6660 	ill = ill_lookup_on_ifindex(ire_mp->ire_stq_ifindex,
6661 	    B_FALSE, NULL, NULL, NULL, NULL, ipst);
6662 	if (ill == NULL || (ire_mp->ire_stq != ill->ill_wq) ||
6663 	    (ill->ill_state_flags & ILL_CONDEMNED)) {
6664 		/*
6665 		 * ill went away. no nce to clean up.
6666 		 * Note that the ill_state_flags could be set to
6667 		 * ILL_CONDEMNED after this point, but if we know
6668 		 * that it is CONDEMNED now, we just bail out quickly.
6669 		 */
6670 		if (ill != NULL)
6671 			ill_refrele(ill);
6672 		goto cleanup;
6673 	}
6674 	nce = ndp_lookup_v4(ill,
6675 	    ((ire_mp->ire_gateway_addr != INADDR_ANY) ?
6676 	    &ire_mp->ire_gateway_addr : &ire_mp->ire_addr),
6677 	    B_FALSE);
6678 	ill_refrele(ill);
6679 
6680 	if ((nce != NULL) && (nce->nce_state != ND_REACHABLE)) {
6681 		/*
6682 		 * some incomplete nce was found.
6683 		 */
6684 		DTRACE_PROBE2(ire__freemblk__arp__resolv__fail,
6685 		    nce_t *, nce, ire_t *, ire_mp);
6686 		/*
6687 		 * Send the icmp_unreachable messages for the queued mblks in
6688 		 * ire->ire_nce->nce_qd_mp, since ARP resolution failed
6689 		 * for this ire
6690 		 */
6691 		arp_resolv_failed(nce);
6692 		/*
6693 		 * Delete the nce and clean up all ire's pointing at this nce
6694 		 * in the cachetable
6695 		 */
6696 		ndp_delete(nce);
6697 	}
6698 	if (nce != NULL)
6699 		NCE_REFRELE(nce); /* release the ref taken by ndp_lookup_v4 */
6700 
6701 cleanup:
6702 	/*
6703 	 * Get rid of the ire buffer
6704 	 * We call kmem_free here(instead of ire_delete()), since
6705 	 * this is the freeb's callback.
6706 	 */
6707 	kmem_free(ire_mp, sizeof (ire_t) + sizeof (frtn_t));
6708 }
6709 
6710 /*
6711  * The mp passed to this function is typically res_mp.
6712  * Note that res_mp field can contain the request (ie AR_ENTRY_QUERY)
6713  * or the response (ie DL_UNITDATA_REQ). So in case of the
6714  * forwarding path, there is a small window of time between the two
6715  * when the forwarding path creates an unresolved nce and the
6716  * ip_newroute path finds this and uses this in the creation of an
6717  * ire cache. To account for this possible race case we we check
6718  * for DL_UNITDATA_REQ to make sure this is indeed the response.
6719  */
6720 boolean_t
6721 ire_nce_valid_dlureq_mp(mblk_t *mp)
6722 {
6723 	dl_unitdata_req_t *dlur;
6724 
6725 	if (mp == NULL)
6726 		return (B_FALSE);
6727 	dlur = (dl_unitdata_req_t *)mp->b_rptr;
6728 	if ((DB_TYPE(mp) == M_PROTO) &&
6729 	    (dlur->dl_primitive == DL_UNITDATA_REQ)) {
6730 		return (B_TRUE);
6731 	} else {
6732 		return (B_FALSE);
6733 	}
6734 }
6735 
6736 /*
6737  * create the neighbor cache entry  nce_t for  IRE_CACHE and
6738  * non-loopback IRE_BROADCAST ire's. Note that IRE_BROADCAST
6739  * (non-loopback) entries  have the nce_res_mp set to the
6740  * template passed in (generated from ill_bcast_mp); IRE_CACHE ire's
6741  * contain the information for  the nexthop (ire_gateway_addr) in the
6742  * case of indirect routes, and for the dst itself (ire_addr) in the
6743  * case of direct routes, with the nce_res_mp containing a template
6744  * DL_UNITDATA request.
6745  *
6746  * This function always consumes res_mp and fp_mp.
6747  *
6748  * The actual association of the ire_nce to the nce created here is
6749  * typically done in ire_add_v4 for IRE_CACHE entries. Exceptions
6750  * to this rule are SO_DONTROUTE ire's (IRE_MARK_NO_ADD), for which
6751  * the ire_nce assignment is done in ire_add_then_send, and mobile-ip
6752  * where the assignment is done in ire_add_mrtun().
6753  */
6754 int
6755 ire_nce_init(ire_t *ire, mblk_t *fp_mp, mblk_t *res_mp)
6756 {
6757 	in_addr_t	addr4, mask4;
6758 	int		err;
6759 	nce_t		*arpce = NULL;
6760 	ill_t		*ire_ill;
6761 	uint16_t	nce_state, nce_flags;
6762 	ip_stack_t	*ipst;
6763 
6764 	if (ire->ire_stq == NULL) {
6765 		if (res_mp)
6766 			freemsg(res_mp);
6767 		if (fp_mp)
6768 			freemsg(fp_mp);
6769 		return (0); /* no need to create nce for local/loopback */
6770 	}
6771 
6772 	mask4 = IP_HOST_MASK;
6773 	switch (ire->ire_type) {
6774 	case IRE_CACHE:
6775 		if (ire->ire_gateway_addr != INADDR_ANY)
6776 			addr4 = ire->ire_gateway_addr; /* 'G' route */
6777 		else
6778 			addr4 = ire->ire_addr; /* direct route */
6779 		break;
6780 	case IRE_BROADCAST:
6781 		addr4 = ire->ire_addr;
6782 		break;
6783 	default:
6784 		if (res_mp)
6785 			freemsg(res_mp);
6786 		if (fp_mp)
6787 			freemsg(fp_mp);
6788 		return (0);
6789 	}
6790 
6791 	/*
6792 	 * ire_ipif is picked based on RTF_SETSRC, usesrc etc.
6793 	 * rules in ire_forward_src_ipif. We want the dlureq_mp
6794 	 * for the outgoing interface, which we get from the ire_stq.
6795 	 */
6796 	ire_ill = ire_to_ill(ire);
6797 	ipst = ire_ill->ill_ipst;
6798 
6799 	/*
6800 	 * if we are creating an nce for the first time, and this is
6801 	 * a NORESOLVER interface, atomically create the nce in the
6802 	 * REACHABLE state; else create it in the ND_INITIAL state.
6803 	 */
6804 	if (ire_ill->ill_net_type == IRE_IF_NORESOLVER)  {
6805 		nce_state = ND_REACHABLE;
6806 		nce_flags = NCE_F_PERMANENT;
6807 	} else {
6808 		/* Make sure you have the response and not the request. */
6809 		if (ire_nce_valid_dlureq_mp(res_mp)) {
6810 			nce_state = ND_REACHABLE;
6811 		} else {
6812 			nce_state = ND_INITIAL;
6813 			ASSERT(fp_mp == NULL);
6814 		}
6815 		nce_flags = 0;
6816 	}
6817 
6818 retry_nce:
6819 	err = ndp_lookup_then_add(ire_ill, NULL,
6820 	    &addr4, &mask4, NULL, 0, nce_flags, nce_state, &arpce,
6821 	    fp_mp, res_mp);
6822 
6823 	if (err == EEXIST && NCE_EXPIRED(arpce, ipst)) {
6824 		/*
6825 		 * We looked up an expired nce.
6826 		 * Go back and try to create one again.
6827 		 * The res_mp should be intact for the EEXIST case,
6828 		 * i.e., there are no new references to it, and there
6829 		 * is no need to copyb it.
6830 		 */
6831 		ndp_delete(arpce);
6832 		NCE_REFRELE(arpce);
6833 		arpce = NULL;
6834 		goto retry_nce;
6835 	}
6836 
6837 	ip1dbg(("ire 0x%p addr 0x%lx mask 0x%lx type 0x%x; "
6838 	    "found nce 0x%p err %d\n", (void *)ire, (ulong_t)addr4,
6839 	    (ulong_t)mask4, ire->ire_type, (void *)arpce, err));
6840 
6841 	switch (err) {
6842 	case 0:
6843 		break;
6844 	case EEXIST:
6845 		/*
6846 		 * return a pointer to an existing nce_t;
6847 		 * note that the ire-nce mapping is many-one, i.e.,
6848 		 * multiple ire's could point to the same nce_t;
6849 		 */
6850 		if (fp_mp != NULL) {
6851 			freemsg(fp_mp);
6852 		}
6853 		if (res_mp != NULL) {
6854 			freemsg(res_mp);
6855 		}
6856 		break;
6857 	default:
6858 		DTRACE_PROBE2(nce__init__fail, ill_t *, ire_ill, int, err);
6859 		if (res_mp)
6860 			freemsg(res_mp);
6861 		if (fp_mp)
6862 			freemsg(fp_mp);
6863 		return (EINVAL);
6864 	}
6865 #if DEBUG
6866 	/*
6867 	 * If an nce_fp_mp was passed in by ndp_lookup_then_add()
6868 	 * we should be picking up an existing nce_t in
6869 	 * the ND_REACHABLE state.
6870 	 */
6871 	mutex_enter(&arpce->nce_lock);
6872 	ASSERT(arpce->nce_fp_mp == NULL || arpce->nce_state == ND_REACHABLE);
6873 	mutex_exit(&arpce->nce_lock);
6874 #endif
6875 	if (ire->ire_type == IRE_BROADCAST) {
6876 		/*
6877 		 * Two bcast ires are created for each interface;
6878 		 * 1. loopback copy (which does not  have an
6879 		 *    ire_stq, and therefore has no ire_nce), and,
6880 		 * 2. the non-loopback copy, which has the nce_res_mp
6881 		 *    initialized to a copy of the ill_bcast_mp, and
6882 		 *    is marked as ND_REACHABLE at this point.
6883 		 *    This nce does not undergo any further state changes,
6884 		 *    and exists as long as the interface is plumbed.
6885 		 * Note: we do the ire_nce assignment here for IRE_BROADCAST
6886 		 * because some functions like ill_mark_bcast() inline the
6887 		 * ire_add functionality;
6888 		 */
6889 		mutex_enter(&arpce->nce_lock);
6890 		arpce->nce_state = ND_REACHABLE;
6891 		arpce->nce_flags |= (NCE_F_PERMANENT | NCE_F_BCAST);
6892 		arpce->nce_last = TICK_TO_MSEC(lbolt64);
6893 		ire->ire_nce = arpce;
6894 		mutex_exit(&arpce->nce_lock);
6895 		/*
6896 		 * We are associating this nce to the ire,
6897 		 * so change the nce ref taken in
6898 		 * ndp_lookup_then_add_v4() from
6899 		 * NCE_REFHOLD to NCE_REFHOLD_NOTR
6900 		 */
6901 		NCE_REFHOLD_TO_REFHOLD_NOTR(ire->ire_nce);
6902 	} else {
6903 		/*
6904 		 * We are not using this nce_t just yet so release
6905 		 * the ref taken in ndp_lookup_then_add_v4()
6906 		 */
6907 		NCE_REFRELE(arpce);
6908 	}
6909 	return (0);
6910 }
6911