usr/src/uts/common/inet/ip/ip_ire.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1990 Mentat Inc. */

#pragma ident	"%Z%%M%	%I%	%E% SMI"


/*
 * This file contains routines that manipulate Internet Routing Entries (IREs).
 */

#include <sys/types.h>
#include <sys/stream.h>
#include <sys/stropts.h>
#include <sys/strsun.h>
#include <sys/ddi.h>
#include <sys/cmn_err.h>
#include <sys/policy.h>

#include <sys/systm.h>
#include <sys/kmem.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <net/if.h>
#include <net/route.h>
#include <netinet/in.h>
#include <net/if_dl.h>
#include <netinet/ip6.h>
#include <netinet/icmp6.h>

#include <inet/common.h>
#include <inet/mi.h>
#include <inet/ip.h>
#include <inet/ip6.h>
#include <inet/ip_ndp.h>
#include <inet/ip_if.h>
#include <inet/ip_ire.h>
#include <inet/ip_rts.h>
#include <inet/nd.h>

#include <net/pfkeyv2.h>
#include <inet/ipsec_info.h>
#include <inet/sadb.h>
#include <sys/kmem.h>
#include <inet/tcp.h>
#include <inet/ipclassifier.h>
#include <sys/zone.h>

#include <sys/tsol/label.h>
#include <sys/tsol/tnet.h>

/*
 * Synchronization notes:
 *
 * The fields of the ire_t struct are protected in the following way :
 *
 * ire_next/ire_ptpn
 *
 *	- bucket lock of the respective tables (cache or forwarding tables).
 *
 * ire_fp_mp
 * ire_dlureq_mp
 *
 *	- ire_lock protects multiple threads updating ire_fp_mp
 *	  simultaneously. Otherwise no locks are used while accessing
 *	  (both read/write) both the fields.
 *
 * ire_mp, ire_rfq, ire_stq, ire_u *except* ire_gateway_addr[v6], ire_mask,
 * ire_type, ire_create_time, ire_masklen, ire_ipversion, ire_flags, ire_ipif,
 * ire_ihandle, ire_phandle, ire_nce, ire_bucket, ire_in_ill, ire_in_src_addr
 *
 *	- Set in ire_create_v4/v6 and never changes after that. Thus,
 *	  we don't need a lock whenever these fields are accessed.
 *
 *	- ire_bucket and ire_masklen (also set in ire_create) is set in
 *        ire_add_v4/ire_add_v6 before inserting in the bucket and never
 *        changes after that. Thus we don't need a lock whenever these
 *	  fields are accessed.
 *
 * ire_gateway_addr_v4[v6]
 *
 *	- ire_gateway_addr_v4[v6] is set during ire_create and later modified
 *	  by rts_setgwr[v6]. As ire_gateway_addr is a uint32_t, updates to
 *	  it assumed to be atomic and hence the other parts of the code
 *	  does not use any locks. ire_gateway_addr_v6 updates are not atomic
 *	  and hence any access to it uses ire_lock to get/set the right value.
 *
 * ire_ident, ire_refcnt
 *
 *	- Updated atomically using atomic_add_32
 *
 * ire_ssthresh, ire_rtt_sd, ire_rtt, ire_ib_pkt_count, ire_ob_pkt_count
 *
 *	- Assumes that 32 bit writes are atomic. No locks. ire_lock is
 *	  used to serialize updates to ire_ssthresh, ire_rtt_sd, ire_rtt.
 *
 * ire_max_frag, ire_frag_flag
 *
 *	- ire_lock is used to set/read both of them together.
 *
 * ire_tire_mark
 *
 *	- Set in ire_create and updated in ire_expire, which is called
 *	  by only one function namely ip_trash_timer_expire. Thus only
 *	  one function updates and examines the value.
 *
 * ire_marks
 *	- bucket lock protects this.
 *
 * ire_ipsec_overhead/ire_ll_hdr_length
 *
 *	- Place holder for returning the information to the upper layers
 *	  when IRE_DB_REQ comes down.
 *
 * ip_ire_default_count protected by the bucket lock of
 * ip_forwarding_table[0][0].
 *
 * ipv6_ire_default_count is protected by the bucket lock of
 * ip_forwarding_table_v6[0][0].
 *
 * ip_ire_default_index/ipv6_ire_default_index is not protected as it
 * is just a hint at which default gateway to use. There is nothing
 * wrong in using the same gateway for two different connections.
 *
 * As we always hold the bucket locks in all the places while accessing
 * the above values, it is natural to use them for protecting them.
 *
 * We have a separate cache table and forwarding table for IPv4 and IPv6.
 * Cache table (ip_cache_table/ip_cache_table_v6) is a pointer to an
 * array of irb_t structure and forwarding table (ip_forwarding_table/
 * ip_forwarding_table_v6) is an array of pointers to array of irb_t
 * structure. ip_forwarding_table[_v6] is allocated dynamically in
 * ire_add_v4/v6. ire_ft_init_lock is used to serialize multiple threads
 * initializing the same bucket. Once a bucket is initialized, it is never
 * de-alloacted. This assumption enables us to access ip_forwarding_table[i]
 * or ip_forwarding_table_v6[i] without any locks.
 *
 * Each irb_t - ire bucket structure has a lock to protect
 * a bucket and the ires residing in the bucket have a back pointer to
 * the bucket structure. It also has a reference count for the number
 * of threads walking the bucket - irb_refcnt which is bumped up
 * using the macro IRB_REFHOLD macro. The flags irb_flags can be
 * set to IRE_MARK_CONDEMNED indicating that there are some ires
 * in this bucket that are marked with IRE_MARK_CONDEMNED and the
 * last thread to leave the bucket should delete the ires. Usually
 * this is done by the IRB_REFRELE macro which is used to decrement
 * the reference count on a bucket.
 *
 * IRE_REFHOLD/IRE_REFRELE macros operate on the ire which increments/
 * decrements the reference count, ire_refcnt, atomically on the ire.
 * ire_refcnt is modified only using this macro. Operations on the IRE
 * could be described as follows :
 *
 * CREATE an ire with reference count initialized to 1.
 *
 * ADDITION of an ire holds the bucket lock, checks for duplicates
 * and then adds the ire. ire_add_v4/ire_add_v6 returns the ire after
 * bumping up once more i.e the reference count is 2. This is to avoid
 * an extra lookup in the functions calling ire_add which wants to
 * work with the ire after adding.
 *
 * LOOKUP of an ire bumps up the reference count using IRE_REFHOLD
 * macro. It is valid to bump up the referece count of the IRE,
 * after the lookup has returned an ire. Following are the lookup
 * functions that return an HELD ire :
 *
 * ire_lookup_local[_v6], ire_ctable_lookup[_v6], ire_ftable_lookup[_v6],
 * ire_cache_lookup[_v6], ire_lookup_multi[_v6], ire_route_lookup[_v6],
 * ipif_to_ire[_v6], ire_mrtun_lookup, ire_srcif_table_lookup.
 *
 * DELETION of an ire holds the bucket lock, removes it from the list
 * and then decrements the reference count for having removed from the list
 * by using the IRE_REFRELE macro. If some other thread has looked up
 * the ire, the reference count would have been bumped up and hence
 * this ire will not be freed once deleted. It will be freed once the
 * reference count drops to zero.
 *
 * Add and Delete acquires the bucket lock as RW_WRITER, while all the
 * lookups acquire the bucket lock as RW_READER.
 *
 * NOTE : The only functions that does the IRE_REFRELE when an ire is
 *	  passed as an argument are :
 *
 *	  1) ip_wput_ire : This is because it IRE_REFHOLD/RELEs the
 *			   broadcast ires it looks up internally within
 *			   the function. Currently, for simplicity it does
 *			   not differentiate the one that is passed in and
 *			   the ones it looks up internally. It always
 *			   IRE_REFRELEs.
 *	  2) ire_send
 *	     ire_send_v6 : As ire_send calls ip_wput_ire and other functions
 *			   that take ire as an argument, it has to selectively
 *			   IRE_REFRELE the ire. To maintain symmetry,
 *			   ire_send_v6 does the same.
 *
 * Otherwise, the general rule is to do the IRE_REFRELE in the function
 * that is passing the ire as an argument.
 *
 * In trying to locate ires the following points are to be noted.
 *
 * IRE_MARK_CONDEMNED signifies that the ire has been logically deleted and is
 * to be ignored when walking the ires using ire_next.
 *
 * IRE_MARK_HIDDEN signifies that the ire is a special ire typically for the
 * benefit of in.mpathd which needs to probe interfaces for failures. Normal
 * applications should not be seeing this ire and hence this ire is ignored
 * in most cases in the search using ire_next.
 *
 * Zones note:
 *	Walking IREs within a given zone also walks certain ires in other
 *	zones.  This is done intentionally.  IRE walks with a specified
 *	zoneid are used only when doing informational reports, and
 *	zone users want to see things that they can access. See block
 *	comment in ire_walk_ill_match().
 */

static irb_t *ip_forwarding_table[IP_MASK_TABLE_SIZE];
/* This is dynamically allocated in ip_ire_init */
static irb_t *ip_cache_table;
/* This is dynamically allocated in ire_add_mrtun */
irb_t	*ip_mrtun_table;

uint32_t	ire_handle = 1;
/*
 * ire_ft_init_lock is used while initializing ip_forwarding_table
 * dynamically in ire_add.
 */
kmutex_t	ire_ft_init_lock;
kmutex_t	ire_mrtun_lock;  /* Protects creation of table and it's count */
kmutex_t	ire_srcif_table_lock; /* Same as above */
/*
 * The following counts are used to determine whether a walk is
 * needed through the reverse tunnel table or through ills
 */
kmutex_t ire_handle_lock;	/* Protects ire_handle */
uint_t	ire_mrtun_count;	/* Number of ires in reverse tun table */

/*
 * A per-interface routing table is created ( if not present)
 * when the first entry is added to this special routing table.
 * This special routing table is accessed through the ill data structure.
 * The routing table looks like cache table. For example, currently it
 * is used by mobile-ip foreign agent to forward data that only comes from
 * the home agent tunnel for a mobile node. Thus if the outgoing interface
 * is a RESOLVER interface, IP may need to resolve the hardware address for
 * the outgoing interface. The routing entries in this table are not updated
 * in IRE_CACHE. When MCTL msg comes back from ARP, the incoming ill informa-
 * tion is lost as the write queue is passed to ip_wput.
 * But, before sending the packet out, the hardware information must be updated
 * in the special forwarding table. ire_srcif_table_count keeps track of total
 * number of ires that are in interface based tables. Each interface based
 * table hangs off of the incoming ill and each ill_t also keeps a refcnt
 * of ires in that table.
 */

uint_t	ire_srcif_table_count; /* Number of ires in all srcif tables */

/*
 * The minimum size of IRE cache table.  It will be recalcuated in
 * ip_ire_init().
 */
uint32_t ip_cache_table_size = IP_CACHE_TABLE_SIZE;
uint32_t ip6_cache_table_size = IP6_CACHE_TABLE_SIZE;

/*
 * The size of the forwarding table.  We will make sure that it is a
 * power of 2 in ip_ire_init().
 */
uint32_t ip_ftable_hash_size = IP_FTABLE_HASH_SIZE;
uint32_t ip6_ftable_hash_size = IP6_FTABLE_HASH_SIZE;

struct	kmem_cache	*ire_cache;
static ire_t	ire_null;

ire_stats_t ire_stats_v4;	/* IPv4 ire statistics */
ire_stats_t ire_stats_v6;	/* IPv6 ire statistics */

/*
 * The threshold number of IRE in a bucket when the IREs are
 * cleaned up.  This threshold is calculated later in ip_open()
 * based on the speed of CPU and available memory.  This default
 * value is the maximum.
 *
 * We have two kinds of cached IRE, temporary and
 * non-temporary.  Temporary IREs are marked with
 * IRE_MARK_TEMPORARY.  They are IREs created for non
 * TCP traffic and for forwarding purposes.  All others
 * are non-temporary IREs.  We don't mark IRE created for
 * TCP as temporary because TCP is stateful and there are
 * info stored in the IRE which can be shared by other TCP
 * connections to the same destination.  For connected
 * endpoint, we also don't want to mark the IRE used as
 * temporary because the same IRE will be used frequently,
 * otherwise, the app should not do a connect().  We change
 * the marking at ip_bind_connected_*() if necessary.
 *
 * We want to keep the cache IRE hash bucket length reasonably
 * short, otherwise IRE lookup functions will take "forever."
 * We use the "crude" function that the IRE bucket
 * length should be based on the CPU speed, which is 1 entry
 * per x MHz, depending on the shift factor ip_ire_cpu_ratio
 * (n).  This means that with a 750MHz CPU, the max bucket
 * length can be (750 >> n) entries.
 *
 * Note that this threshold is separate for temp and non-temp
 * IREs.  This means that the actual bucket length can be
 * twice as that.  And while we try to keep temporary IRE
 * length at most at the threshold value, we do not attempt to
 * make the length for non-temporary IREs fixed, for the
 * reason stated above.  Instead, we start trying to find
 * "unused" non-temporary IREs when the bucket length reaches
 * this threshold and clean them up.
 *
 * We also want to limit the amount of memory used by
 * IREs.  So if we are allowed to use ~3% of memory (M)
 * for those IREs, each bucket should not have more than
 *
 * 	M / num of cache bucket / sizeof (ire_t)
 *
 * Again the above memory uses are separate for temp and
 * non-temp cached IREs.
 *
 * We may also want the limit to be a function of the number
 * of interfaces and number of CPUs.  Doing the initialization
 * in ip_open() means that every time an interface is plumbed,
 * the max is re-calculated.  Right now, we don't do anything
 * different.  In future, when we have more experience, we
 * may want to change this behavior.
 */
uint32_t ip_ire_max_bucket_cnt = 10;
uint32_t ip6_ire_max_bucket_cnt = 10;

/*
 * The minimum of the temporary IRE bucket count.  We do not want
 * the length of each bucket to be too short.  This may hurt
 * performance of some apps as the temporary IREs are removed too
 * often.
 */
uint32_t ip_ire_min_bucket_cnt = 3;
uint32_t ip6_ire_min_bucket_cnt = 3;

/*
 * The ratio of memory consumed by IRE used for temporary to available
 * memory.  This is a shift factor, so 6 means the ratio 1 to 64.  This
 * value can be changed in /etc/system.  6 is a reasonable number.
 */
uint32_t ip_ire_mem_ratio = 6;
/* The shift factor for CPU speed to calculate the max IRE bucket length. */
uint32_t ip_ire_cpu_ratio = 7;

/*
 * The maximum number of buckets in IRE cache table.  In future, we may
 * want to make it a dynamic hash table.  For the moment, we fix the
 * size and allocate the table in ip_ire_init() when IP is first loaded.
 * We take into account the amount of memory a system has.
 */
#define	IP_MAX_CACHE_TABLE_SIZE	4096

static uint32_t	ip_max_cache_table_size = IP_MAX_CACHE_TABLE_SIZE;
static uint32_t	ip6_max_cache_table_size = IP_MAX_CACHE_TABLE_SIZE;

#define	NUM_ILLS	3	/* To build the ILL list to unlock */

/* Zero iulp_t for initialization. */
const iulp_t	ire_uinfo_null = { 0 };

static int	ire_add_v4(ire_t **ire_p, queue_t *q, mblk_t *mp,
    ipsq_func_t func);
static int	ire_add_srcif_v4(ire_t **ire_p, queue_t *q, mblk_t *mp,
    ipsq_func_t func);
static ire_t	*ire_update_srcif_v4(ire_t *ire);
static void	ire_delete_v4(ire_t *ire);
static void	ire_report_ftable(ire_t *ire, char *mp);
static void	ire_report_ctable(ire_t *ire, char *mp);
static void	ire_report_mrtun_table(ire_t *ire, char *mp);
static void	ire_report_srcif_table(ire_t *ire, char *mp);
static void	ire_walk_ipvers(pfv_t func, void *arg, uchar_t vers,
    zoneid_t zoneid);
static void	ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type,
    pfv_t func, void *arg, uchar_t vers, ill_t *ill);
static	void	ire_walk_ill_tables(uint_t match_flags, uint_t ire_type,
    pfv_t func, void *arg, size_t ftbl_sz, size_t htbl_sz, irb_t **ipftbl,
    size_t ctbl_sz, irb_t *ipctbl, ill_t *ill, zoneid_t zoneid);
static void	ire_delete_host_redirects(ipaddr_t gateway);
static boolean_t ire_match_args(ire_t *ire, ipaddr_t addr, ipaddr_t mask,
    ipaddr_t gateway, int type, const ipif_t *ipif, zoneid_t zoneid,
    uint32_t ihandle, const ts_label_t *tsl, int match_flags);
static void	ire_cache_cleanup(irb_t *irb, uint32_t threshold, int cnt);
extern void	ill_unlock_ills(ill_t **list, int cnt);
static void	ire_fastpath_list_add(ill_t *ill, ire_t *ire);
extern void	th_trace_rrecord(th_trace_t *);
#ifdef IRE_DEBUG
static void	ire_trace_inactive(ire_t *);
#endif

/*
 * To avoid bloating the code, we call this function instead of
 * using the macro IRE_REFRELE. Use macro only in performance
 * critical paths.
 *
 * Must not be called while holding any locks. Otherwise if this is
 * the last reference to be released there is a chance of recursive mutex
 * panic due to ire_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
 * to restart an ioctl. The one exception is when the caller is sure that
 * this is not the last reference to be released. Eg. if the caller is
 * sure that the ire has not been deleted and won't be deleted.
 */
void
ire_refrele(ire_t *ire)
{
	IRE_REFRELE(ire);
}

void
ire_refrele_notr(ire_t *ire)
{
	IRE_REFRELE_NOTR(ire);
}

/*
 * kmem_cache_alloc constructor for IRE in kma space.
 * Note that when ire_mp is set the IRE is stored in that mblk and
 * not in this cache.
 */
/* ARGSUSED */
static int
ip_ire_constructor(void *buf, void *cdrarg, int kmflags)
{
	ire_t	*ire = buf;

	ire->ire_fp_mp = NULL;
	ire->ire_dlureq_mp = NULL;

	return (0);
}

/* ARGSUSED1 */
static void
ip_ire_destructor(void *buf, void *cdrarg)
{
	ire_t	*ire = buf;

	ASSERT(ire->ire_fp_mp == NULL);
	ASSERT(ire->ire_dlureq_mp == NULL);
}

/*
 * This function is associated with the IP_IOC_IRE_ADVISE_NO_REPLY
 * IOCTL.  It is used by TCP (or other ULPs) to supply revised information
 * for an existing CACHED IRE.
 */
/* ARGSUSED */
int
ip_ire_advise(queue_t *q, mblk_t *mp, cred_t *ioc_cr)
{
	uchar_t	*addr_ucp;
	ipic_t	*ipic;
	ire_t	*ire;
	ipaddr_t	addr;
	in6_addr_t	v6addr;
	irb_t	*irb;
	zoneid_t	zoneid;

	ASSERT(q->q_next == NULL);
	zoneid = Q_TO_CONN(q)->conn_zoneid;

	/*
	 * Check privilege using the ioctl credential; if it is NULL
	 * then this is a kernel message and therefor privileged.
	 */
	if (ioc_cr != NULL && secpolicy_net_config(ioc_cr, B_FALSE) != 0)
		return (EPERM);

	ipic = (ipic_t *)mp->b_rptr;
	if (!(addr_ucp = mi_offset_param(mp, ipic->ipic_addr_offset,
	    ipic->ipic_addr_length))) {
		return (EINVAL);
	}
	if (!OK_32PTR(addr_ucp))
		return (EINVAL);
	switch (ipic->ipic_addr_length) {
	case IP_ADDR_LEN: {
		/* Extract the destination address. */
		addr = *(ipaddr_t *)addr_ucp;
		/* Find the corresponding IRE. */
		ire = ire_cache_lookup(addr, zoneid, NULL);
		break;
	}
	case IPV6_ADDR_LEN: {
		/* Extract the destination address. */
		v6addr = *(in6_addr_t *)addr_ucp;
		/* Find the corresponding IRE. */
		ire = ire_cache_lookup_v6(&v6addr, zoneid, NULL);
		break;
	}
	default:
		return (EINVAL);
	}

	if (ire == NULL)
		return (ENOENT);
	/*
	 * Update the round trip time estimate and/or the max frag size
	 * and/or the slow start threshold.
	 *
	 * We serialize multiple advises using ire_lock.
	 */
	mutex_enter(&ire->ire_lock);
	if (ipic->ipic_rtt) {
		/*
		 * If there is no old cached values, initialize them
		 * conservatively.  Set them to be (1.5 * new value).
		 */
		if (ire->ire_uinfo.iulp_rtt != 0) {
			ire->ire_uinfo.iulp_rtt = (ire->ire_uinfo.iulp_rtt +
			    ipic->ipic_rtt) >> 1;
		} else {
			ire->ire_uinfo.iulp_rtt = ipic->ipic_rtt +
			    (ipic->ipic_rtt >> 1);
		}
		if (ire->ire_uinfo.iulp_rtt_sd != 0) {
			ire->ire_uinfo.iulp_rtt_sd =
			    (ire->ire_uinfo.iulp_rtt_sd +
			    ipic->ipic_rtt_sd) >> 1;
		} else {
			ire->ire_uinfo.iulp_rtt_sd = ipic->ipic_rtt_sd +
			    (ipic->ipic_rtt_sd >> 1);
		}
	}
	if (ipic->ipic_max_frag)
		ire->ire_max_frag = MIN(ipic->ipic_max_frag, IP_MAXPACKET);
	if (ipic->ipic_ssthresh != 0) {
		if (ire->ire_uinfo.iulp_ssthresh != 0)
			ire->ire_uinfo.iulp_ssthresh =
			    (ipic->ipic_ssthresh +
			    ire->ire_uinfo.iulp_ssthresh) >> 1;
		else
			ire->ire_uinfo.iulp_ssthresh = ipic->ipic_ssthresh;
	}
	/*
	 * Don't need the ire_lock below this. ire_type does not change
	 * after initialization. ire_marks is protected by irb_lock.
	 */
	mutex_exit(&ire->ire_lock);

	if (ipic->ipic_ire_marks != 0 && ire->ire_type == IRE_CACHE) {
		/*
		 * Only increment the temporary IRE count if the original
		 * IRE is not already marked temporary.
		 */
		irb = ire->ire_bucket;
		rw_enter(&irb->irb_lock, RW_WRITER);
		if ((ipic->ipic_ire_marks & IRE_MARK_TEMPORARY) &&
		    !(ire->ire_marks & IRE_MARK_TEMPORARY)) {
			irb->irb_tmp_ire_cnt++;
		}
		ire->ire_marks |= ipic->ipic_ire_marks;
		rw_exit(&irb->irb_lock);
	}

	ire_refrele(ire);
	return (0);
}

/*
 * This function is associated with the IP_IOC_IRE_DELETE[_NO_REPLY]
 * IOCTL[s].  The NO_REPLY form is used by TCP to delete a route IRE
 * for a host that is not responding.  This will force an attempt to
 * establish a new route, if available.  Management processes may want
 * to use the version that generates a reply.
 *
 * This function does not support IPv6 since Neighbor Unreachability Detection
 * means that negative advise like this is useless.
 */
/* ARGSUSED */
int
ip_ire_delete(queue_t *q, mblk_t *mp, cred_t *ioc_cr)
{
	uchar_t	*addr_ucp;
	ipaddr_t	addr;
	ire_t	*ire;
	ipid_t	*ipid;
	boolean_t routing_sock_info = B_FALSE;	/* Sent info? */
	zoneid_t	zoneid;

	ASSERT(q->q_next == NULL);
	zoneid = Q_TO_CONN(q)->conn_zoneid;

	/*
	 * Check privilege using the ioctl credential; if it is NULL
	 * then this is a kernel message and therefor privileged.
	 */
	if (ioc_cr != NULL && secpolicy_net_config(ioc_cr, B_FALSE) != 0)
		return (EPERM);

	ipid = (ipid_t *)mp->b_rptr;

	/* Only actions on IRE_CACHEs are acceptable at present. */
	if (ipid->ipid_ire_type != IRE_CACHE)
		return (EINVAL);

	addr_ucp = mi_offset_param(mp, ipid->ipid_addr_offset,
		ipid->ipid_addr_length);
	if (addr_ucp == NULL || !OK_32PTR(addr_ucp))
		return (EINVAL);
	switch (ipid->ipid_addr_length) {
	case IP_ADDR_LEN:
		/* addr_ucp points at IP addr */
		break;
	case sizeof (sin_t): {
		sin_t	*sin;
		/*
		 * got complete (sockaddr) address - increment addr_ucp to point
		 * at the ip_addr field.
		 */
		sin = (sin_t *)addr_ucp;
		addr_ucp = (uchar_t *)&sin->sin_addr.s_addr;
		break;
	}
	default:
		return (EINVAL);
	}
	/* Extract the destination address. */
	bcopy(addr_ucp, &addr, IP_ADDR_LEN);

	/* Try to find the CACHED IRE. */
	ire = ire_cache_lookup(addr, zoneid, NULL);

	/* Nail it. */
	if (ire) {
		/* Allow delete only on CACHE entries */
		if (ire->ire_type != IRE_CACHE) {
			ire_refrele(ire);
			return (EINVAL);
		}

		/*
		 * Verify that the IRE has been around for a while.
		 * This is to protect against transport protocols
		 * that are too eager in sending delete messages.
		 */
		if (gethrestime_sec() <
		    ire->ire_create_time + ip_ignore_delete_time) {
			ire_refrele(ire);
			return (EINVAL);
		}
		/*
		 * Now we have a potentially dead cache entry. We need
		 * to remove it.
		 * If this cache entry is generated from a default route,
		 * search the default list and mark it dead and some
		 * background process will try to activate it.
		 */
		if ((ire->ire_gateway_addr != 0) && (ire->ire_cmask == 0)) {
			/*
			 * Make sure that we pick a different
			 * IRE_DEFAULT next time.
			 * The ip_ire_default_count tracks the number of
			 * IRE_DEFAULT entries. However, the
			 * ip_forwarding_table[0] also contains
			 * interface routes thus the count can be zero.
			 */
			ire_t *gw_ire;
			irb_t *irb_ptr;
			irb_t *irb;

			if (((irb_ptr = ip_forwarding_table[0]) != NULL) &&
			    (irb = &irb_ptr[0])->irb_ire != NULL &&
			    ip_ire_default_count != 0) {
				uint_t index;

				/*
				 * We grab it as writer just to serialize
				 * multiple threads trying to bump up
				 * ip_ire_default_index.
				 */
				rw_enter(&irb->irb_lock, RW_WRITER);
				if ((gw_ire = irb->irb_ire) == NULL) {
					rw_exit(&irb->irb_lock);
					goto done;
				}
				index = ip_ire_default_index %
				    ip_ire_default_count;
				while (index-- && gw_ire->ire_next != NULL)
					gw_ire = gw_ire->ire_next;

				/* Skip past the potentially bad gateway */
				if (ire->ire_gateway_addr ==
				    gw_ire->ire_gateway_addr)
					ip_ire_default_index++;

				rw_exit(&irb->irb_lock);
		    }
		}
done:
		/* report the bad route to routing sockets */
		ip_rts_change(RTM_LOSING, ire->ire_addr, ire->ire_gateway_addr,
		    ire->ire_mask, ire->ire_src_addr, 0, 0, 0,
		    (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_IFA));
		routing_sock_info = B_TRUE;
		ire_delete(ire);
		ire_refrele(ire);
	}
	/* Also look for an IRE_HOST_REDIRECT and remove it if present */
	ire = ire_route_lookup(addr, 0, 0, IRE_HOST_REDIRECT, NULL, NULL,
	    ALL_ZONES, NULL, MATCH_IRE_TYPE);

	/* Nail it. */
	if (ire) {
		if (!routing_sock_info) {
			ip_rts_change(RTM_LOSING, ire->ire_addr,
			    ire->ire_gateway_addr, ire->ire_mask,
			    ire->ire_src_addr, 0, 0, 0,
			    (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_IFA));
		}
		ire_delete(ire);
		ire_refrele(ire);
	}
	return (0);
}

/*
 * Named Dispatch routine to produce a formatted report on all IREs.
 * This report is accessed by using the ndd utility to "get" ND variable
 * "ipv4_ire_status".
 */
/* ARGSUSED */
int
ip_ire_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
{
	zoneid_t zoneid;

	(void) mi_mpprintf(mp,
	    "IRE      " MI_COL_HDRPAD_STR
	/*   01234567[89ABCDEF] */
	    "rfq      " MI_COL_HDRPAD_STR
	/*   01234567[89ABCDEF] */
	    "stq      " MI_COL_HDRPAD_STR
	/*   01234567[89ABCDEF] */
	    " zone "
	/*   12345 */
	    "addr            mask            "
	/*   123.123.123.123 123.123.123.123 */
	    "src             gateway         mxfrg rtt   rtt_sd ssthresh ref "
	/*   123.123.123.123 123.123.123.123 12345 12345 123456 12345678 123 */
	    "rtomax tstamp_ok wscale_ok ecn_ok pmtud_ok sack sendpipe "
	/*   123456 123456789 123456789 123456 12345678 1234 12345678 */
	    "recvpipe in/out/forward type");
	/*   12345678 in/out/forward xxxxxxxxxx */

	/*
	 * Because of the ndd constraint, at most we can have 64K buffer
	 * to put in all IRE info.  So to be more efficient, just
	 * allocate a 64K buffer here, assuming we need that large buffer.
	 * This should be OK as only root can do ndd /dev/ip.
	 */
	if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) {
		/* The following may work even if we cannot get a large buf. */
		(void) mi_mpprintf(mp, "<< Out of buffer >>\n");
		return (0);
	}

	zoneid = Q_TO_CONN(q)->conn_zoneid;
	if (zoneid == GLOBAL_ZONEID)
		zoneid = ALL_ZONES;

	ire_walk_v4(ire_report_ftable, mp->b_cont, zoneid);
	ire_walk_v4(ire_report_ctable, mp->b_cont, zoneid);

	return (0);
}

/* ire_walk routine invoked for ip_ire_report for each IRE. */
static void
ire_report_ftable(ire_t *ire, char *mp)
{
	char	buf1[16];
	char	buf2[16];
	char	buf3[16];
	char	buf4[16];
	uint_t	fo_pkt_count;
	uint_t	ib_pkt_count;
	int	ref;
	uint_t	print_len, buf_len;

	if (ire->ire_type & IRE_CACHETABLE)
	    return;
	buf_len = ((mblk_t *)mp)->b_datap->db_lim - ((mblk_t *)mp)->b_wptr;
	if (buf_len <= 0)
		return;

	/* Number of active references of this ire */
	ref = ire->ire_refcnt;
	/* "inbound" to a non local address is a forward */
	ib_pkt_count = ire->ire_ib_pkt_count;
	fo_pkt_count = 0;
	if (!(ire->ire_type & (IRE_LOCAL|IRE_BROADCAST))) {
		fo_pkt_count = ib_pkt_count;
		ib_pkt_count = 0;
	}
	print_len = snprintf((char *)((mblk_t *)mp)->b_wptr, buf_len,
	    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR "%5d "
	    "%s %s %s %s %05d %05ld %06ld %08d %03d %06d %09d %09d %06d %08d "
	    "%04d %08d %08d %d/%d/%d %s\n",
	    (void *)ire, (void *)ire->ire_rfq, (void *)ire->ire_stq,
	    (int)ire->ire_zoneid,
	    ip_dot_addr(ire->ire_addr, buf1), ip_dot_addr(ire->ire_mask, buf2),
	    ip_dot_addr(ire->ire_src_addr, buf3),
	    ip_dot_addr(ire->ire_gateway_addr, buf4),
	    ire->ire_max_frag, ire->ire_uinfo.iulp_rtt,
	    ire->ire_uinfo.iulp_rtt_sd,
	    ire->ire_uinfo.iulp_ssthresh, ref,
	    ire->ire_uinfo.iulp_rtomax,
	    (ire->ire_uinfo.iulp_tstamp_ok ? 1: 0),
	    (ire->ire_uinfo.iulp_wscale_ok ? 1: 0),
	    (ire->ire_uinfo.iulp_ecn_ok ? 1: 0),
	    (ire->ire_uinfo.iulp_pmtud_ok ? 1: 0),
	    ire->ire_uinfo.iulp_sack,
	    ire->ire_uinfo.iulp_spipe, ire->ire_uinfo.iulp_rpipe,
	    ib_pkt_count, ire->ire_ob_pkt_count, fo_pkt_count,
	    ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type));
	if (print_len < buf_len) {
		((mblk_t *)mp)->b_wptr += print_len;
	} else {
		((mblk_t *)mp)->b_wptr += buf_len;
	}
}

/* ire_walk routine invoked for ip_ire_report for each cached IRE. */
static void
ire_report_ctable(ire_t *ire, char *mp)
{
	char	buf1[16];
	char	buf2[16];
	char	buf3[16];
	char	buf4[16];
	uint_t	fo_pkt_count;
	uint_t	ib_pkt_count;
	int	ref;
	uint_t	print_len, buf_len;

	if ((ire->ire_type & IRE_CACHETABLE) == 0)
	    return;
	buf_len = ((mblk_t *)mp)->b_datap->db_lim - ((mblk_t *)mp)->b_wptr;
	if (buf_len <= 0)
		return;

	/* Number of active references of this ire */
	ref = ire->ire_refcnt;
	/* "inbound" to a non local address is a forward */
	ib_pkt_count = ire->ire_ib_pkt_count;
	fo_pkt_count = 0;
	if (!(ire->ire_type & (IRE_LOCAL|IRE_BROADCAST))) {
		fo_pkt_count = ib_pkt_count;
		ib_pkt_count = 0;
	}
	print_len =  snprintf((char *)((mblk_t *)mp)->b_wptr, buf_len,
	    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR "%5d "
	    "%s %s %s %s %05d %05ld %06ld %08d %03d %06d %09d %09d %06d %08d "
	    "%04d %08d %08d %d/%d/%d %s\n",
	    (void *)ire, (void *)ire->ire_rfq, (void *)ire->ire_stq,
	    (int)ire->ire_zoneid,
	    ip_dot_addr(ire->ire_addr, buf1), ip_dot_addr(ire->ire_mask, buf2),
	    ip_dot_addr(ire->ire_src_addr, buf3),
	    ip_dot_addr(ire->ire_gateway_addr, buf4),
	    ire->ire_max_frag, ire->ire_uinfo.iulp_rtt,
	    ire->ire_uinfo.iulp_rtt_sd, ire->ire_uinfo.iulp_ssthresh, ref,
	    ire->ire_uinfo.iulp_rtomax,
	    (ire->ire_uinfo.iulp_tstamp_ok ? 1: 0),
	    (ire->ire_uinfo.iulp_wscale_ok ? 1: 0),
	    (ire->ire_uinfo.iulp_ecn_ok ? 1: 0),
	    (ire->ire_uinfo.iulp_pmtud_ok ? 1: 0),
	    ire->ire_uinfo.iulp_sack,
	    ire->ire_uinfo.iulp_spipe, ire->ire_uinfo.iulp_rpipe,
	    ib_pkt_count, ire->ire_ob_pkt_count, fo_pkt_count,
	    ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type));
	if (print_len < buf_len) {
		((mblk_t *)mp)->b_wptr += print_len;
	} else {
		((mblk_t *)mp)->b_wptr += buf_len;
	}
}

/* ARGSUSED */
int
ip_ire_report_mrtun(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
{
	(void) mi_mpprintf(mp,
	"IRE      " MI_COL_HDRPAD_STR
	/*   01234567[89ABCDEF] */
	"stq      " MI_COL_HDRPAD_STR
	/*   01234567[89ABCDEF] */
	"in_ill    " MI_COL_HDRPAD_STR
	/*   01234567[89ABCDEF] */
	"in_src_addr            "
	/*   123.123.123.123 */
	"max_frag      "
	/*   12345 */
	"ref     ");
	/*   123 */

	ire_walk_ill_mrtun(0, 0, ire_report_mrtun_table, mp, NULL);
	return (0);
}

/* mrtun report table - supports ipv4_mrtun_ire_status ndd variable */

static void
ire_report_mrtun_table(ire_t *ire, char *mp)
{
	char	buf1[INET_ADDRSTRLEN];
	int	ref;

	/* Number of active references of this ire */
	ref = ire->ire_refcnt;
	ASSERT(ire->ire_type == IRE_MIPRTUN);
	(void) mi_mpprintf((mblk_t *)mp,
	    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR
	    "%s          %05d             %03d",
	    (void *)ire, (void *)ire->ire_stq,
	    (void *)ire->ire_in_ill,
	    ip_dot_addr(ire->ire_in_src_addr, buf1),
	    ire->ire_max_frag, ref);
}

/*
 * Dispatch routine to format ires in interface based routine
 */
/* ARGSUSED */
int
ip_ire_report_srcif(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
{

	/* Report all interface based ires */

	(void) mi_mpprintf(mp,
	    "IRE      " MI_COL_HDRPAD_STR
	    /*   01234567[89ABCDEF] */
	    "stq      " MI_COL_HDRPAD_STR
	    /*   01234567[89ABCDEF] */
	    "in_ill    " MI_COL_HDRPAD_STR
	    /*   01234567[89ABCDEF] */
	    "addr            "
	    /*   123.123.123.123 */
	    "gateway         "
	    /*   123.123.123.123 */
	    "max_frag      "
	    /*   12345 */
	    "ref     "
	    /*   123 */
	    "type    "
	    /* ABCDEFGH */
	    "in/out/forward");
	ire_walk_srcif_table_v4(ire_report_srcif_table, mp);
	return (0);
}

/* Reports the interface table ires */
static void
ire_report_srcif_table(ire_t *ire, char *mp)
{
	char    buf1[INET_ADDRSTRLEN];
	char    buf2[INET_ADDRSTRLEN];
	int	ref;

	ref = ire->ire_refcnt;
	(void) mi_mpprintf((mblk_t *)mp,
	    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR
	    "%s    %s      %05d       %03d      %s     %d",
	    (void *)ire, (void *)ire->ire_stq,
	    (void *)ire->ire_in_ill,
	    ip_dot_addr(ire->ire_addr, buf1),
	    ip_dot_addr(ire->ire_gateway_addr, buf2),
	    ire->ire_max_frag, ref,
	    ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type),
	    ire->ire_ib_pkt_count);

}
/*
 * ip_ire_req is called by ip_wput when an IRE_DB_REQ_TYPE message is handed
 * down from the Upper Level Protocol to request a copy of the IRE (to check
 * its type or to extract information like round-trip time estimates or the
 * MTU.)
 * The address is assumed to be in the ire_addr field. If no IRE is found
 * an IRE is returned with ire_type being zero.
 * Note that the upper lavel protocol has to check for broadcast
 * (IRE_BROADCAST) and multicast (CLASSD(addr)).
 * If there is a b_cont the resulting IRE_DB_TYPE mblk is placed at the
 * end of the returned message.
 *
 * TCP sends down a message of this type with a connection request packet
 * chained on. UDP and ICMP send it down to verify that a route exists for
 * the destination address when they get connected.
 */
void
ip_ire_req(queue_t *q, mblk_t *mp)
{
	ire_t	*inire;
	ire_t	*ire;
	mblk_t	*mp1;
	ire_t	*sire = NULL;
	zoneid_t zoneid = Q_TO_CONN(q)->conn_zoneid;

	if ((mp->b_wptr - mp->b_rptr) < sizeof (ire_t) ||
	    !OK_32PTR(mp->b_rptr)) {
		freemsg(mp);
		return;
	}
	inire = (ire_t *)mp->b_rptr;
	/*
	 * Got it, now take our best shot at an IRE.
	 */
	if (inire->ire_ipversion == IPV6_VERSION) {
		ire = ire_route_lookup_v6(&inire->ire_addr_v6, 0, 0, 0,
		    NULL, &sire, zoneid, NULL,
		    (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT));
	} else {
		ASSERT(inire->ire_ipversion == IPV4_VERSION);
		ire = ire_route_lookup(inire->ire_addr, 0, 0, 0,
		    NULL, &sire, zoneid, NULL,
		    (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT));
	}

	/*
	 * We prevent returning IRES with source address INADDR_ANY
	 * as these were temporarily created for sending packets
	 * from endpoints that have conn_unspec_src set.
	 */
	if (ire == NULL ||
	    (ire->ire_ipversion == IPV4_VERSION &&
	    ire->ire_src_addr == INADDR_ANY) ||
	    (ire->ire_ipversion == IPV6_VERSION &&
	    IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6))) {
		inire->ire_type = 0;
	} else {
		bcopy(ire, inire, sizeof (ire_t));
		/* Copy the route metrics from the parent. */
		if (sire != NULL) {
			bcopy(&(sire->ire_uinfo), &(inire->ire_uinfo),
			    sizeof (iulp_t));
		}

		/*
		 * As we don't lookup global policy here, we may not
		 * pass the right size if per-socket policy is not
		 * present. For these cases, path mtu discovery will
		 * do the right thing.
		 */
		inire->ire_ipsec_overhead = conn_ipsec_length(Q_TO_CONN(q));

		/* Pass the latest setting of the ip_path_mtu_discovery */
		inire->ire_frag_flag |= (ip_path_mtu_discovery) ? IPH_DF : 0;
	}
	if (ire != NULL)
		ire_refrele(ire);
	if (sire != NULL)
		ire_refrele(sire);
	mp->b_wptr = &mp->b_rptr[sizeof (ire_t)];
	mp->b_datap->db_type = IRE_DB_TYPE;

	/* Put the IRE_DB_TYPE mblk last in the chain */
	mp1 = mp->b_cont;
	if (mp1 != NULL) {
		mp->b_cont = NULL;
		linkb(mp1, mp);
		mp = mp1;
	}
	qreply(q, mp);
}

/*
 * Send a packet using the specified IRE.
 * If ire_src_addr_v6 is all zero then discard the IRE after
 * the packet has been sent.
 */
static void
ire_send(queue_t *q, mblk_t *pkt, ire_t *ire)
{
	mblk_t *mp;
	mblk_t *ipsec_mp;
	boolean_t is_secure;
	uint_t ifindex;
	ill_t	*ill;

	ASSERT(ire->ire_ipversion == IPV4_VERSION);
	ipsec_mp = pkt;
	is_secure = (pkt->b_datap->db_type == M_CTL);
	if (is_secure)
		pkt = pkt->b_cont;

	/* If the packet originated externally then */
	if (pkt->b_prev) {
		ire_refrele(ire);
		/*
		 * Extract the ifindex from b_prev (set in ip_rput_noire).
		 * Look up interface to see if it still exists (it could have
		 * been unplumbed by the time the reply came back from ARP)
		 */
		ifindex = (uint_t)(uintptr_t)pkt->b_prev;
		ill = ill_lookup_on_ifindex(ifindex, B_FALSE,
		    NULL, NULL, NULL, NULL);
		if (ill == NULL) {
			pkt->b_prev = NULL;
			pkt->b_next = NULL;
			freemsg(ipsec_mp);
			return;
		}
		q = ill->ill_rq;
		pkt->b_prev = NULL;
		mp = allocb(0, BPRI_HI);
		if (mp == NULL) {
			ill_refrele(ill);
			pkt->b_next = NULL;
			freemsg(ipsec_mp);
			return;
		}
		mp->b_datap->db_type = M_BREAK;
		/*
		 * This packet has not gone through IPSEC processing
		 * and hence we should not have any IPSEC message
		 * prepended.
		 */
		ASSERT(ipsec_mp == pkt);
		mp->b_cont = ipsec_mp;
		put(q, mp);
		ill_refrele(ill);
	} else if (pkt->b_next) {
		/* Packets from multicast router */
		pkt->b_next = NULL;
		/*
		 * We never get the IPSEC_OUT while forwarding the
		 * packet for multicast router.
		 */
		ASSERT(ipsec_mp == pkt);
		ip_rput_forward(ire, (ipha_t *)pkt->b_rptr, ipsec_mp, NULL);
		ire_refrele(ire);
	} else {
		/* Locally originated packets */
		boolean_t is_inaddr_any;
		ipha_t *ipha = (ipha_t *)pkt->b_rptr;

		/*
		 * We need to do an ire_delete below for which
		 * we need to make sure that the IRE will be
		 * around even after calling ip_wput_ire -
		 * which does ire_refrele. Otherwise somebody
		 * could potentially delete this ire and hence
		 * free this ire and we will be calling ire_delete
		 * on a freed ire below.
		 */
		is_inaddr_any = (ire->ire_src_addr == INADDR_ANY);
		if (is_inaddr_any) {
			IRE_REFHOLD(ire);
		}
		/*
		 * If we were resolving a router we can not use the
		 * routers IRE for sending the packet (since it would
		 * violate the uniqness of the IP idents) thus we
		 * make another pass through ip_wput to create the IRE_CACHE
		 * for the destination.
		 * When IRE_MARK_NOADD is set, ire_add() is not called.
		 * Thus ip_wput() will never find a ire and result in an
		 * infinite loop. Thus we check whether IRE_MARK_NOADD is
		 * is set. This also implies that IRE_MARK_NOADD can only be
		 * used to send packets to directly connected hosts.
		 */
		if (ipha->ipha_dst != ire->ire_addr &&
		    !(ire->ire_marks & IRE_MARK_NOADD)) {
			ire_refrele(ire);	/* Held in ire_add */
			(void) ip_output(Q_TO_CONN(q), ipsec_mp, q, IRE_SEND);
		} else {
			if (is_secure) {
				ipsec_out_t *oi;
				ipha_t *ipha;

				oi = (ipsec_out_t *)ipsec_mp->b_rptr;
				ipha = (ipha_t *)ipsec_mp->b_cont->b_rptr;
				if (oi->ipsec_out_proc_begin) {
					/*
					 * This is the case where
					 * ip_wput_ipsec_out could not find
					 * the IRE and recreated a new one.
					 * As ip_wput_ipsec_out does ire
					 * lookups, ire_refrele for the extra
					 * bump in ire_add.
					 */
					ire_refrele(ire);
					ip_wput_ipsec_out(q, ipsec_mp, ipha,
					    NULL, NULL);
				} else {
					/*
					 * IRE_REFRELE will be done in
					 * ip_wput_ire.
					 */
					ip_wput_ire(q, ipsec_mp, ire, NULL,
					    IRE_SEND);
				}
			} else {
				/*
				 * IRE_REFRELE will be done in ip_wput_ire.
				 */
				ip_wput_ire(q, ipsec_mp, ire, NULL,
				    IRE_SEND);
			}
		}
		/*
		 * Special code to support sending a single packet with
		 * conn_unspec_src using an IRE which has no source address.
		 * The IRE is deleted here after sending the packet to avoid
		 * having other code trip on it. But before we delete the
		 * ire, somebody could have looked up this ire.
		 * We prevent returning/using this IRE by the upper layers
		 * by making checks to NULL source address in other places
		 * like e.g ip_ire_append, ip_ire_req and ip_bind_connected.
		 * Though, this does not completely prevent other threads
		 * from using this ire, this should not cause any problems.
		 *
		 * NOTE : We use is_inaddr_any instead of using ire_src_addr
		 * because for the normal case i.e !is_inaddr_any, ire_refrele
		 * above could have potentially freed the ire.
		 */
		if (is_inaddr_any) {
			/*
			 * If this IRE has been deleted by another thread, then
			 * ire_bucket won't be NULL, but ire_ptpn will be NULL.
			 * Thus, ire_delete will do nothing.  This check
			 * guards against calling ire_delete when the IRE was
			 * never inserted in the table, which is handled by
			 * ire_delete as dropping another reference.
			 */
			if (ire->ire_bucket != NULL) {
				ip1dbg(("ire_send: delete IRE\n"));
				ire_delete(ire);
			}
			ire_refrele(ire);	/* Held above */
		}
	}
}

/*
 * Send a packet using the specified IRE.
 * If ire_src_addr_v6 is all zero then discard the IRE after
 * the packet has been sent.
 */
static void
ire_send_v6(queue_t *q, mblk_t *pkt, ire_t *ire)
{
	mblk_t *ipsec_mp;
	boolean_t secure;
	uint_t ifindex;

	ASSERT(ire->ire_ipversion == IPV6_VERSION);
	if (pkt->b_datap->db_type == M_CTL) {
		ipsec_mp = pkt;
		pkt = pkt->b_cont;
		secure = B_TRUE;
	} else {
		ipsec_mp = pkt;
		secure = B_FALSE;
	}

	/* If the packet originated externally then */
	if (pkt->b_prev) {
		ill_t	*ill;
		/*
		 * Extract the ifindex from b_prev (set in ip_rput_data_v6).
		 * Look up interface to see if it still exists (it could have
		 * been unplumbed by the time the reply came back from the
		 * resolver). Unlike IPv4 there is no need for a prepended
		 * M_BREAK since ip_rput_data_v6 does not process options
		 * before finding an IRE.
		 */
		ifindex = (uint_t)(uintptr_t)pkt->b_prev;
		ill = ill_lookup_on_ifindex(ifindex, B_TRUE,
		    NULL, NULL, NULL, NULL);
		if (ill == NULL) {
			pkt->b_prev = NULL;
			pkt->b_next = NULL;
			freemsg(ipsec_mp);
			ire_refrele(ire);	/* Held in ire_add */
			return;
		}
		q = ill->ill_rq;
		pkt->b_prev = NULL;
		/*
		 * This packet has not gone through IPSEC processing
		 * and hence we should not have any IPSEC message
		 * prepended.
		 */
		ASSERT(ipsec_mp == pkt);
		put(q, pkt);
		ill_refrele(ill);
	} else if (pkt->b_next) {
		/* Packets from multicast router */
		pkt->b_next = NULL;
		/*
		 * We never get the IPSEC_OUT while forwarding the
		 * packet for multicast router.
		 */
		ASSERT(ipsec_mp == pkt);
		/*
		 * XXX TODO IPv6.
		 */
		freemsg(pkt);
#ifdef XXX
		ip_rput_forward(ire, (ipha_t *)pkt->b_rptr, pkt, NULL);
#endif
	} else {
		if (secure) {
			ipsec_out_t *oi;
			ip6_t *ip6h;

			oi = (ipsec_out_t *)ipsec_mp->b_rptr;
			ip6h = (ip6_t *)ipsec_mp->b_cont->b_rptr;
			if (oi->ipsec_out_proc_begin) {
				/*
				 * This is the case where
				 * ip_wput_ipsec_out could not find
				 * the IRE and recreated a new one.
				 */
				ip_wput_ipsec_out_v6(q, ipsec_mp, ip6h,
				    NULL, NULL);
			} else {
				(void) ip_output_v6(Q_TO_CONN(q), ipsec_mp,
				    q, IRE_SEND);
			}
		} else {
			/*
			 * Send packets through ip_output_v6 so that any
			 * ip6_info header can be processed again.
			 */
			(void) ip_output_v6(Q_TO_CONN(q), ipsec_mp, q,
			    IRE_SEND);
		}
		/*
		 * Special code to support sending a single packet with
		 * conn_unspec_src using an IRE which has no source address.
		 * The IRE is deleted here after sending the packet to avoid
		 * having other code trip on it. But before we delete the
		 * ire, somebody could have looked up this ire.
		 * We prevent returning/using this IRE by the upper layers
		 * by making checks to NULL source address in other places
		 * like e.g ip_ire_append_v6, ip_ire_req and
		 * ip_bind_connected_v6. Though, this does not completely
		 * prevent other threads from using this ire, this should
		 * not cause any problems.
		 */
		if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6)) {
			ip1dbg(("ire_send_v6: delete IRE\n"));
			ire_delete(ire);
		}
	}
	ire_refrele(ire);	/* Held in ire_add */
}

/*
 * Make sure that IRE bucket does not get too long.
 * This can cause lock up because ire_cache_lookup()
 * may take "forever" to finish.
 *
 * We just remove cnt IREs each time.  This means that
 * the bucket length will stay approximately constant,
 * depending on cnt.  This should be enough to defend
 * against DoS attack based on creating temporary IREs
 * (for forwarding and non-TCP traffic).
 *
 * Note that new IRE is normally added at the tail of the
 * bucket.  This means that we are removing the "oldest"
 * temporary IRE added.  Only if there are IREs with
 * the same ire_addr, do we not add it at the tail.  Refer
 * to ire_add_v*().  It should be OK for our purpose.
 *
 * For non-temporary cached IREs, we make sure that they
 * have not been used for some time (defined below), they
 * are non-local destinations, and there is no one using
 * them at the moment (refcnt == 1).
 *
 * The above means that the IRE bucket length may become
 * very long, consisting of mostly non-temporary IREs.
 * This can happen when the hash function does a bad job
 * so that most TCP connections cluster to a specific bucket.
 * This "hopefully" should never happen.  It can also
 * happen if most TCP connections have very long lives.
 * Even with the minimal hash table size of 256, there
 * has to be a lot of such connections to make the bucket
 * length unreasonably long.  This should probably not
 * happen either.  The third can when this can happen is
 * when the machine is under attack, such as SYN flooding.
 * TCP should already have the proper mechanism to protect
 * that.  So we should be safe.
 *
 * This function is called by ire_add_then_send() after
 * a new IRE is added and the packet is sent.
 *
 * The idle cutoff interval is set to 60s.  It can be
 * changed using /etc/system.
 */
uint32_t ire_idle_cutoff_interval = 60000;

static void
ire_cache_cleanup(irb_t *irb, uint32_t threshold, int cnt)
{
	ire_t *ire;
	int tmp_cnt = cnt;
	clock_t cut_off = drv_usectohz(ire_idle_cutoff_interval * 1000);

	/*
	 * irb is NULL if the IRE is not added to the hash.  This
	 * happens when IRE_MARK_NOADD is set in ire_add_then_send()
	 * and when ires are returned from ire_update_srcif_v4() routine.
	 */
	if (irb == NULL)
		return;

	IRB_REFHOLD(irb);
	if (irb->irb_tmp_ire_cnt > threshold) {
		for (ire = irb->irb_ire; ire != NULL && tmp_cnt > 0;
		    ire = ire->ire_next) {
			if (ire->ire_marks & IRE_MARK_CONDEMNED)
				continue;
			if (ire->ire_marks & IRE_MARK_TEMPORARY) {
				ASSERT(ire->ire_type == IRE_CACHE);
				ire_delete(ire);
				tmp_cnt--;
			}
		}
	}
	if (irb->irb_ire_cnt - irb->irb_tmp_ire_cnt > threshold) {
		for (ire = irb->irb_ire; ire != NULL && cnt > 0;
		    ire = ire->ire_next) {
			if (ire->ire_marks & IRE_MARK_CONDEMNED ||
			    ire->ire_gateway_addr == 0) {
				continue;
			}
			if ((ire->ire_type == IRE_CACHE) &&
			    (lbolt - ire->ire_last_used_time > cut_off) &&
			    (ire->ire_refcnt == 1)) {
				ire_delete(ire);
				cnt--;
			}
		}
	}
	IRB_REFRELE(irb);
}

/*
 * ire_add_then_send is called when a new IRE has been created in order to
 * route an outgoing packet.  Typically, it is called from ip_wput when
 * a response comes back down from a resolver.  We add the IRE, and then
 * possibly run the packet through ip_wput or ip_rput, as appropriate.
 * However, we do not add the newly created IRE in the cache when
 * IRE_MARK_NOADD is set in the IRE. IRE_MARK_NOADD is set at
 * ip_newroute_ipif(). The ires with IRE_MARK_NOADD and ires returned
 * by ire_update_srcif_v4() are ire_refrele'd by ip_wput_ire() and get
 * deleted.
 * Multirouting support: the packet is silently discarded when the new IRE
 * holds the RTF_MULTIRT flag, but is not the first IRE to be added with the
 * RTF_MULTIRT flag for the same destination address.
 * In this case, we just want to register this additional ire without
 * sending the packet, as it has already been replicated through
 * existing multirt routes in ip_wput().
 */
void
ire_add_then_send(queue_t *q, ire_t *ire, mblk_t *mp)
{
	irb_t *irb;
	boolean_t drop = B_FALSE;
	/* LINTED : set but not used in function */
	boolean_t mctl_present;
	mblk_t *first_mp = NULL;
	mblk_t *save_mp = NULL;
	ire_t *dst_ire;
	ipha_t *ipha;
	ip6_t *ip6h;

	if (mp != NULL) {
		/*
		 * We first have to retrieve the destination address carried
		 * by the packet.
		 * We can't rely on ire as it can be related to a gateway.
		 * The destination address will help in determining if
		 * other RTF_MULTIRT ires are already registered.
		 *
		 * We first need to know where we are going : v4 or V6.
		 * the ire version is enough, as there is no risk that
		 * we resolve an IPv6 address with an IPv4 ire
		 * or vice versa.
		 */
		if (ire->ire_ipversion == IPV4_VERSION) {
			EXTRACT_PKT_MP(mp, first_mp, mctl_present);
			ipha = (ipha_t *)mp->b_rptr;
			save_mp = mp;
			mp = first_mp;

			dst_ire = ire_cache_lookup(ipha->ipha_dst,
			    ire->ire_zoneid, MBLK_GETLABEL(mp));
		} else {
			/*
			 * Get a pointer to the beginning of the IPv6 header.
			 * Ignore leading IPsec control mblks.
			 */
			first_mp = mp;
			if (mp->b_datap->db_type == M_CTL) {
				mp = mp->b_cont;
			}
			ip6h = (ip6_t *)mp->b_rptr;
			save_mp = mp;
			mp = first_mp;
			dst_ire = ire_cache_lookup_v6(&ip6h->ip6_dst,
			    ire->ire_zoneid, MBLK_GETLABEL(mp));
		}
		if (dst_ire != NULL) {
			if (dst_ire->ire_flags & RTF_MULTIRT) {
				/*
				 * At least one resolved multirt route
				 * already exists for the destination,
				 * don't sent this packet: either drop it
				 * or complete the pending resolution,
				 * depending on the ire.
				 */
				drop = B_TRUE;
			}
			ip1dbg(("ire_add_then_send: dst_ire %p "
			    "[dst %08x, gw %08x], drop %d\n",
			    (void *)dst_ire,
			    (dst_ire->ire_ipversion == IPV4_VERSION) ? \
				ntohl(dst_ire->ire_addr) : \
				ntohl(V4_PART_OF_V6(dst_ire->ire_addr_v6)),
			    (dst_ire->ire_ipversion == IPV4_VERSION) ? \
				ntohl(dst_ire->ire_gateway_addr) : \
				ntohl(V4_PART_OF_V6(
				    dst_ire->ire_gateway_addr_v6)),
			    drop));
			ire_refrele(dst_ire);
		}
	}

	if (!(ire->ire_marks & IRE_MARK_NOADD)) {
		/*
		 * Regular packets with cache bound ires and
		 * the packets from ARP response for ires which
		 * belong to the ire_srcif_v4 table, are here.
		 */
		if (ire->ire_in_ill == NULL) {
			/* Add the ire */
			(void) ire_add(&ire, NULL, NULL, NULL);
		} else {
			/*
			 * This must be ARP response for ire in interface based
			 * table. Note that we don't add them in cache table,
			 * instead we update the existing table with dlureq_mp
			 * information. The reverse tunnel ires do not come
			 * here, as reverse tunnel is non-resolver interface.
			 * XXX- another design alternative was to mark the
			 * ires in interface based table with a special mark to
			 * make absolutely sure that we operate in right ires.
			 * This idea was not implemented as part of code review
			 * suggestion, as ire_in_ill suffice to distinguish
			 * between the regular ires and interface based
			 * ires now and thus we save a bit in the ire_marks.
			 */
			ire = ire_update_srcif_v4(ire);
		}

		if (ire == NULL) {
			mp->b_prev = NULL;
			mp->b_next = NULL;
			MULTIRT_DEBUG_UNTAG(mp);
			freemsg(mp);
			return;
		}
		if (mp == NULL) {
			ire_refrele(ire);	/* Held in ire_add_v4/v6 */
			return;
		}
	}
	if (drop) {
		/*
		 * If we're adding an RTF_MULTIRT ire, the resolution
		 * is over: we just drop the packet.
		 */
		if (ire->ire_flags & RTF_MULTIRT) {
			if (save_mp) {
				save_mp->b_prev = NULL;
				save_mp->b_next = NULL;
			}
			MULTIRT_DEBUG_UNTAG(mp);
			freemsg(mp);
		} else {
			/*
			 * Otherwise, we're adding the ire to a gateway
			 * for a multirt route.
			 * Invoke ip_newroute() to complete the resolution
			 * of the route. We will then come back here and
			 * finally drop this packet in the above code.
			 */
			if (ire->ire_ipversion == IPV4_VERSION) {
				/*
				 * TODO: in order for CGTP to work in non-global
				 * zones, ip_newroute() must create the IRE
				 * cache in the zone indicated by
				 * ire->ire_zoneid.
				 */
				ip_newroute(q, mp, ipha->ipha_dst, 0,
				    (CONN_Q(q) ? Q_TO_CONN(q) : NULL));
			} else {
				ip_newroute_v6(q, mp, &ip6h->ip6_dst, NULL,
				    NULL, ire->ire_zoneid);
			}
		}

		ire_refrele(ire); /* As done by ire_send(). */
		return;
	}
	/*
	 * Need to remember ire_bucket here as ire_send*() may delete
	 * the ire so we cannot reference it after that.
	 */
	irb = ire->ire_bucket;
	if (ire->ire_ipversion == IPV6_VERSION) {
		ire_send_v6(q, mp, ire);
		/*
		 * Clean up more than 1 IRE so that the clean up does not
		 * need to be done every time when a new IRE is added and
		 * the threshold is reached.
		 */
		ire_cache_cleanup(irb, ip6_ire_max_bucket_cnt, 2);
	} else {
		ire_send(q, mp, ire);
		ire_cache_cleanup(irb, ip_ire_max_bucket_cnt, 2);
	}
}

/*
 * Initialize the ire that is specific to IPv4 part and call
 * ire_init_common to finish it.
 */
ire_t *
ire_init(ire_t *ire, uchar_t *addr, uchar_t *mask, uchar_t *src_addr,
    uchar_t *gateway, uchar_t *in_src_addr, uint_t *max_fragp, mblk_t *fp_mp,
    queue_t *rfq, queue_t *stq, ushort_t type, mblk_t *dlureq_mp, ipif_t *ipif,
    ill_t *in_ill, ipaddr_t cmask, uint32_t phandle, uint32_t ihandle,
    uint32_t flags, const iulp_t *ulp_info, tsol_gc_t *gc, tsol_gcgrp_t *gcgrp)
{
	/*
	 * Reject IRE security attribute creation/initialization
	 * if system is not running in Trusted mode.
	 */
	if ((gc != NULL || gcgrp != NULL) && !is_system_labeled())
		return (NULL);

	if (fp_mp != NULL) {
		/*
		 * We can't dupb() here as multiple threads could be
		 * calling dupb on the same mp which is incorrect.
		 * First dupb() should be called only by one thread.
		 */
		fp_mp = copyb(fp_mp);
		if (fp_mp == NULL)
			return (NULL);
	}

	if (dlureq_mp != NULL) {
		/*
		 * We can't dupb() here as multiple threads could be
		 * calling dupb on the same mp which is incorrect.
		 * First dupb() should be called only by one thread.
		 */
		dlureq_mp = copyb(dlureq_mp);
		if (dlureq_mp == NULL) {
			if (fp_mp != NULL)
				freeb(fp_mp);
			return (NULL);
		}
	}

	/*
	 * Check that IRE_IF_RESOLVER and IRE_IF_NORESOLVER have a
	 * dlureq_mp which is the ill_resolver_mp for IRE_IF_RESOLVER
	 * and DL_UNITDATA_REQ for IRE_IF_NORESOLVER.
	 */
	if ((type & IRE_INTERFACE) &&
	    dlureq_mp == NULL) {
		ASSERT(fp_mp == NULL);
		ip0dbg(("ire_init: no dlureq_mp\n"));
		return (NULL);
	}

	BUMP_IRE_STATS(ire_stats_v4, ire_stats_alloced);

	if (addr != NULL)
		bcopy(addr, &ire->ire_addr, IP_ADDR_LEN);
	if (src_addr != NULL)
		bcopy(src_addr, &ire->ire_src_addr, IP_ADDR_LEN);
	if (mask != NULL) {
		bcopy(mask, &ire->ire_mask, IP_ADDR_LEN);
		ire->ire_masklen = ip_mask_to_plen(ire->ire_mask);
	}
	if (gateway != NULL) {
		bcopy(gateway, &ire->ire_gateway_addr, IP_ADDR_LEN);
	}
	if (in_src_addr != NULL) {
		bcopy(in_src_addr, &ire->ire_in_src_addr, IP_ADDR_LEN);
	}

	if (type == IRE_CACHE)
		ire->ire_cmask = cmask;

	/* ire_init_common will free the mblks upon encountering any failure */
	if (!ire_init_common(ire, max_fragp, fp_mp, rfq, stq, type, dlureq_mp,
	    ipif, in_ill, phandle, ihandle, flags, IPV4_VERSION, ulp_info,
	    gc, gcgrp))
		return (NULL);

	return (ire);
}

/*
 * Similar to ire_create except that it is called only when
 * we want to allocate ire as an mblk e.g. we have an external
 * resolver ARP.
 */
ire_t *
ire_create_mp(uchar_t *addr, uchar_t *mask, uchar_t *src_addr, uchar_t *gateway,
    uchar_t *in_src_addr, uint_t max_frag, mblk_t *fp_mp, queue_t *rfq,
    queue_t *stq, ushort_t type, mblk_t *dlureq_mp, ipif_t *ipif, ill_t *in_ill,
    ipaddr_t cmask, uint32_t phandle, uint32_t ihandle, uint32_t flags,
    const iulp_t *ulp_info, tsol_gc_t *gc, tsol_gcgrp_t *gcgrp)
{
	ire_t	*ire;
	ire_t	*ret_ire;
	mblk_t	*mp;

	/* Allocate the new IRE. */
	mp = allocb(sizeof (ire_t), BPRI_MED);
	if (mp == NULL) {
		ip1dbg(("ire_create_mp: alloc failed\n"));
		return (NULL);
	}

	ire = (ire_t *)mp->b_rptr;
	mp->b_wptr = (uchar_t *)&ire[1];

	/* Start clean. */
	*ire = ire_null;
	ire->ire_mp = mp;
	mp->b_datap->db_type = IRE_DB_TYPE;

	ret_ire = ire_init(ire, addr, mask, src_addr, gateway, in_src_addr,
	    NULL, fp_mp, rfq, stq, type, dlureq_mp, ipif, in_ill, cmask,
	    phandle, ihandle, flags, ulp_info, gc, gcgrp);

	if (ret_ire == NULL) {
		freeb(ire->ire_mp);
		return (NULL);
	}
	ASSERT(ret_ire == ire);
	/*
	 * ire_max_frag is normally zero here and is atomically set
	 * under the irebucket lock in ire_add_v[46] except for the
	 * case of IRE_MARK_NOADD. In that event the the ire_max_frag
	 * is non-zero here.
	 */
	ire->ire_max_frag = max_frag;
	return (ire);
}

/*
 * ire_create is called to allocate and initialize a new IRE.
 *
 * NOTE : This is called as writer sometimes though not required
 * by this function.
 */
ire_t *
ire_create(uchar_t *addr, uchar_t *mask, uchar_t *src_addr, uchar_t *gateway,
    uchar_t *in_src_addr, uint_t *max_fragp, mblk_t *fp_mp, queue_t *rfq,
    queue_t *stq, ushort_t type, mblk_t *dlureq_mp, ipif_t *ipif, ill_t *in_ill,
    ipaddr_t cmask, uint32_t phandle, uint32_t ihandle, uint32_t flags,
    const iulp_t *ulp_info, tsol_gc_t *gc, tsol_gcgrp_t *gcgrp)
{
	ire_t	*ire;
	ire_t	*ret_ire;

	ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
	if (ire == NULL) {
		ip1dbg(("ire_create: alloc failed\n"));
		return (NULL);
	}
	*ire = ire_null;

	ret_ire = ire_init(ire, addr, mask, src_addr, gateway, in_src_addr,
	    max_fragp, fp_mp, rfq, stq, type, dlureq_mp, ipif, in_ill,  cmask,
	    phandle, ihandle, flags, ulp_info, gc, gcgrp);

	if (ret_ire == NULL) {
		kmem_cache_free(ire_cache, ire);
		return (NULL);
	}
	ASSERT(ret_ire == ire);
	return (ire);
}


/*
 * Common to IPv4 and IPv6
 */
boolean_t
ire_init_common(ire_t *ire, uint_t *max_fragp, mblk_t *fp_mp,
    queue_t *rfq, queue_t *stq, ushort_t type,
    mblk_t *dlureq_mp, ipif_t *ipif, ill_t *in_ill, uint32_t phandle,
    uint32_t ihandle, uint32_t flags, uchar_t ipversion,
    const iulp_t *ulp_info, tsol_gc_t *gc, tsol_gcgrp_t *gcgrp)
{
	ire->ire_max_fragp = max_fragp;
	ire->ire_frag_flag |= (ip_path_mtu_discovery) ? IPH_DF : 0;

	ASSERT(fp_mp == NULL || fp_mp->b_datap->db_type == M_DATA);
#ifdef DEBUG
	if (ipif != NULL) {
		if (ipif->ipif_isv6)
			ASSERT(ipversion == IPV6_VERSION);
		else
			ASSERT(ipversion == IPV4_VERSION);
	}
#endif /* DEBUG */

	/*
	 * Create/initialize IRE security attribute only in Trusted mode;
	 * if the passed in gc/gcgrp is non-NULL, we expect that the caller
	 * has held a reference to it and will release it when this routine
	 * returns a failure, otherwise we own the reference.  We do this
	 * prior to initializing the rest IRE fields.
	 */
	if (is_system_labeled()) {
		if ((type & (IRE_LOCAL | IRE_LOOPBACK | IRE_BROADCAST |
		    IRE_INTERFACE)) != 0) {
			/* release references on behalf of caller */
			if (gc != NULL)
				GC_REFRELE(gc);
			if (gcgrp != NULL)
				GCGRP_REFRELE(gcgrp);
		} else if (tsol_ire_init_gwattr(ire, ipversion,
		    gc, gcgrp) != 0) {
			/* free any caller-allocated mblks upon failure */
			if (fp_mp != NULL)
				freeb(fp_mp);
			if (dlureq_mp != NULL)
				freeb(dlureq_mp);
			return (B_FALSE);
		}
	}

	ire->ire_fp_mp = fp_mp;
	ire->ire_dlureq_mp = dlureq_mp;
	ire->ire_stq = stq;
	ire->ire_rfq = rfq;
	ire->ire_type = type;
	ire->ire_flags = RTF_UP | flags;
	ire->ire_ident = TICK_TO_MSEC(lbolt);
	bcopy(ulp_info, &ire->ire_uinfo, sizeof (iulp_t));

	ire->ire_tire_mark = ire->ire_ob_pkt_count + ire->ire_ib_pkt_count;
	ire->ire_last_used_time = lbolt;
	ire->ire_create_time = (uint32_t)gethrestime_sec();

	/*
	 * If this IRE is an IRE_CACHE, inherit the handles from the
	 * parent IREs. For others in the forwarding table, assign appropriate
	 * new ones.
	 *
	 * The mutex protecting ire_handle is because ire_create is not always
	 * called as a writer.
	 */
	if (ire->ire_type & IRE_OFFSUBNET) {
		mutex_enter(&ire_handle_lock);
		ire->ire_phandle = (uint32_t)ire_handle++;
		mutex_exit(&ire_handle_lock);
	} else if (ire->ire_type & IRE_INTERFACE) {
		mutex_enter(&ire_handle_lock);
		ire->ire_ihandle = (uint32_t)ire_handle++;
		mutex_exit(&ire_handle_lock);
	} else if (ire->ire_type == IRE_CACHE) {
		ire->ire_phandle = phandle;
		ire->ire_ihandle = ihandle;
	}
	ire->ire_in_ill = in_ill;
	ire->ire_ipif = ipif;
	if (ipif != NULL) {
		ire->ire_ipif_seqid = ipif->ipif_seqid;
		ire->ire_zoneid = ipif->ipif_zoneid;
	} else {
		ire->ire_zoneid = GLOBAL_ZONEID;
	}
	ire->ire_ipversion = ipversion;
	ire->ire_refcnt = 1;
	mutex_init(&ire->ire_lock, NULL, MUTEX_DEFAULT, NULL);

#ifdef IRE_DEBUG
	bzero(ire->ire_trace, sizeof (th_trace_t *) * IP_TR_HASH_MAX);
#endif

	return (B_TRUE);
}

/*
 * This routine is called repeatedly by ipif_up to create broadcast IREs.
 * It is passed a pointer to a slot in an IRE pointer array into which to
 * place the pointer to the new IRE, if indeed we create one.  If the
 * IRE corresponding to the address passed in would be a duplicate of an
 * existing one, we don't create the new one.  irep is incremented before
 * return only if we do create a new IRE.  (Always called as writer.)
 *
 * Note that with the "match_flags" parameter, we can match on either
 * a particular logical interface (MATCH_IRE_IPIF) or for all logical
 * interfaces for a given physical interface (MATCH_IRE_ILL).  Currently,
 * we only create broadcast ire's on a per physical interface basis. If
 * someone is going to be mucking with logical interfaces, it is important
 * to call "ipif_check_bcast_ires()" to make sure that any change to a
 * logical interface will not cause critical broadcast IRE's to be deleted.
 */
ire_t **
ire_check_and_create_bcast(ipif_t *ipif, ipaddr_t  addr, ire_t **irep,
    int match_flags)
{
	ire_t *ire;
	uint64_t check_flags = IPIF_DEPRECATED | IPIF_NOLOCAL | IPIF_ANYCAST;

	/*
	 * No broadcast IREs for the LOOPBACK interface
	 * or others such as point to point and IPIF_NOXMIT.
	 */
	if (!(ipif->ipif_flags & IPIF_BROADCAST) ||
	    (ipif->ipif_flags & IPIF_NOXMIT))
		return (irep);

	/* If this would be a duplicate, don't bother. */
	if ((ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, ipif,
	    ipif->ipif_zoneid, NULL, match_flags)) != NULL) {
		/*
		 * We look for non-deprecated (and non-anycast, non-nolocal)
		 * ipifs as the best choice. ipifs with check_flags matching
		 * (deprecated, etc) are used only if non-deprecated ipifs
		 * are not available. if the existing ire's ipif is deprecated
		 * and the new ipif is non-deprecated, switch to the new ipif
		 */
		if ((!(ire->ire_ipif->ipif_flags & check_flags)) ||
		    (ipif->ipif_flags & check_flags)) {
			ire_refrele(ire);
			return (irep);
		}
		/*
		 * Bcast ires exist in pairs. Both have to be deleted,
		 * Since we are exclusive we can make the above assertion.
		 * The 1st has to be refrele'd since it was ctable_lookup'd.
		 */
		ASSERT(IAM_WRITER_IPIF(ipif));
		ASSERT(ire->ire_next->ire_addr == ire->ire_addr);
		ire_delete(ire->ire_next);
		ire_delete(ire);
		ire_refrele(ire);
	}

	irep = ire_create_bcast(ipif, addr, irep);

	return (irep);
}

uint_t ip_loopback_mtu = IP_LOOPBACK_MTU;

/*
 * This routine is called from ipif_check_bcast_ires and ire_check_bcast.
 * It leaves all the verifying and deleting to those routines. So it always
 * creates 2 bcast ires and chains them into the ire array passed in.
 */
ire_t **
ire_create_bcast(ipif_t *ipif, ipaddr_t  addr, ire_t **irep)
{
	*irep++ = ire_create(
	    (uchar_t *)&addr,			/* dest addr */
	    (uchar_t *)&ip_g_all_ones,		/* mask */
	    (uchar_t *)&ipif->ipif_src_addr,	/* source addr */
	    NULL,				/* no gateway */
	    NULL,				/* no in_src_addr */
	    &ipif->ipif_mtu,			/* max frag */
	    NULL,				/* fast path header */
	    ipif->ipif_rq,			/* recv-from queue */
	    ipif->ipif_wq,			/* send-to queue */
	    IRE_BROADCAST,
	    ipif->ipif_bcast_mp,		/* xmit header */
	    ipif,
	    NULL,
	    0,
	    0,
	    0,
	    0,
	    &ire_uinfo_null,
	    NULL,
	    NULL);

	*irep++ = ire_create(
		(uchar_t *)&addr,		 /* dest address */
		(uchar_t *)&ip_g_all_ones,	 /* mask */
		(uchar_t *)&ipif->ipif_src_addr, /* source address */
		NULL,				 /* no gateway */
		NULL,				 /* no in_src_addr */
		&ip_loopback_mtu,		 /* max frag size */
		NULL,				 /* Fast Path header */
		ipif->ipif_rq,			 /* recv-from queue */
		NULL,				 /* no send-to queue */
		IRE_BROADCAST,		/* Needed for fanout in wput */
		NULL,
		ipif,
		NULL,
		0,
		0,
		0,
		0,
		&ire_uinfo_null,
		NULL,
		NULL);

	return (irep);
}

/*
 * ire_walk routine to delete or update any IRE_CACHE that might contain
 * stale information.
 * The flags state which entries to delete or update.
 * Garbage collection is done separately using kmem alloc callbacks to
 * ip_trash_ire_reclaim.
 * Used for both IPv4 and IPv6. However, IPv6 only uses FLUSH_MTU_TIME
 * since other stale information is cleaned up using NUD.
 */
void
ire_expire(ire_t *ire, char *arg)
{
	int flush_flags = (int)(uintptr_t)arg;
	ill_t	*stq_ill;

	if ((flush_flags & FLUSH_REDIRECT_TIME) &&
	    ire->ire_type == IRE_HOST_REDIRECT) {
		/* Make sure we delete the corresponding IRE_CACHE */
		ip1dbg(("ire_expire: all redirects\n"));
		ip_rts_rtmsg(RTM_DELETE, ire, 0);
		ire_delete(ire);
		return;
	}
	if (ire->ire_type != IRE_CACHE)
		return;

	if (flush_flags & FLUSH_ARP_TIME) {
		/*
		 * Remove all IRE_CACHE.
		 * Verify that create time is more than
		 * ip_ire_arp_interval milliseconds ago.
		 */
		if (((uint32_t)gethrestime_sec() - ire->ire_create_time) *
		    MILLISEC > ip_ire_arp_interval) {
			ip1dbg(("ire_expire: all IRE_CACHE\n"));
			ire_delete(ire);
			return;
		}
	}

	if (ip_path_mtu_discovery && (flush_flags & FLUSH_MTU_TIME) &&
	    (ire->ire_ipif != NULL)) {
		/* Increase pmtu if it is less than the interface mtu */
		mutex_enter(&ire->ire_lock);
		/*
		 * If the ipif is a vni (whose mtu is 0, since it's virtual)
		 * get the mtu from the sending interfaces' ipif
		 */
		if (IS_VNI(ire->ire_ipif->ipif_ill)) {
			stq_ill = ire->ire_stq->q_ptr;
			ire->ire_max_frag = MIN(stq_ill->ill_ipif->ipif_mtu,
			    IP_MAXPACKET);
		} else {
			ire->ire_max_frag = MIN(ire->ire_ipif->ipif_mtu,
			    IP_MAXPACKET);
		}
		ire->ire_frag_flag |= IPH_DF;
		mutex_exit(&ire->ire_lock);
	}
}

/*
 * Do fast path probing if necessary.
 */
static void
ire_fastpath(ire_t *ire)
{
	ill_t	*ill;
	int res;

	if (ire->ire_fp_mp != NULL || ire->ire_dlureq_mp == NULL ||
	    (ire->ire_stq == NULL)) {
		/*
		 * Already contains fastpath info or
		 * doesn't have DL_UNITDATA_REQ header
		 * or is a loopback broadcast ire i.e. no stq.
		 */
		return;
	}
	ill = ire_to_ill(ire);
	if (ill == NULL)
		return;
	ire_fastpath_list_add(ill, ire);
	res = ill_fastpath_probe(ill, ire->ire_dlureq_mp);
	/*
	 * EAGAIN is an indication of a transient error
	 * i.e. allocation failure etc. leave the ire in the list it will
	 * be updated when another probe happens for another ire if not
	 * it will be taken out of the list when the ire is deleted.
	 */
	if (res != 0 && res != EAGAIN)
		ire_fastpath_list_delete(ill, ire);
}

/*
 * Update all IRE's that are not in fastpath mode and
 * have an dlureq_mp that matches mp. mp->b_cont contains
 * the fastpath header.
 *
 * Returns TRUE if entry should be dequeued, or FALSE otherwise.
 */
boolean_t
ire_fastpath_update(ire_t *ire, void *arg)
{
	mblk_t 	*mp, *fp_mp;
	uchar_t 	*up, *up2;
	ptrdiff_t	cmplen;

	ASSERT((ire->ire_type & (IRE_CACHE | IRE_BROADCAST |
	    IRE_MIPRTUN)) != 0);

	/*
	 * Already contains fastpath info or doesn't have
	 * DL_UNITDATA_REQ header.
	 */
	if (ire->ire_fp_mp != NULL || ire->ire_dlureq_mp == NULL)
		return (B_TRUE);

	ip2dbg(("ire_fastpath_update: trying\n"));
	mp = (mblk_t *)arg;
	up = mp->b_rptr;
	cmplen = mp->b_wptr - up;
	/* Serialize multiple fast path updates */
	mutex_enter(&ire->ire_lock);
	up2 = ire->ire_dlureq_mp->b_rptr;
	ASSERT(cmplen >= 0);
	if (ire->ire_dlureq_mp->b_wptr - up2 != cmplen ||
	    bcmp(up, up2, cmplen) != 0) {
		mutex_exit(&ire->ire_lock);
		/*
		 * Don't take the ire off the fastpath list yet,
		 * since the response may come later.
		 */
		return (B_FALSE);
	}
	/* Matched - install mp as the ire_fp_mp */
	ip1dbg(("ire_fastpath_update: match\n"));
	fp_mp = dupb(mp->b_cont);
	if (fp_mp) {
		/*
		 * We checked ire_fp_mp above. Check it again with the
		 * lock. Update fp_mp only if it has not been done
		 * already.
		 */
		if (ire->ire_fp_mp == NULL) {
			/*
			 * ire_ll_hdr_length is just an optimization to
			 * store the length. It is used to return the
			 * fast path header length to the upper layers.
			 */
			ire->ire_fp_mp = fp_mp;
			ire->ire_ll_hdr_length =
			    (uint_t)(fp_mp->b_wptr - fp_mp->b_rptr);
		} else {
			freeb(fp_mp);
		}
	}
	mutex_exit(&ire->ire_lock);
	return (B_TRUE);
}

/*
 * This function handles the DL_NOTE_FASTPATH_FLUSH notification from the
 * driver.
 */
/* ARGSUSED */
void
ire_fastpath_flush(ire_t *ire, void *arg)
{
	ill_t	*ill;
	int	res;

	/* No fastpath info? */
	if (ire->ire_fp_mp == NULL || ire->ire_dlureq_mp == NULL)
		return;

	/*
	 * Just remove the IRE if it is for non-broadcast dest.  Then
	 * we will create another one which will have the correct
	 * fastpath info.
	 */
	switch (ire->ire_type) {
	case IRE_CACHE:
		ire_delete(ire);
		break;
	case IRE_MIPRTUN:
	case IRE_BROADCAST:
		/*
		 * We can't delete the ire since it is difficult to
		 * recreate these ire's without going through the
		 * ipif down/up dance. The ire_fp_mp is protected by the
		 * ire_lock in the case of IRE_MIPRTUN and IRE_BROADCAST.
		 * All access to ire_fp_mp in the case of these 2 ire types
		 * is protected by ire_lock.
		 */
		mutex_enter(&ire->ire_lock);
		if (ire->ire_fp_mp != NULL) {
			freeb(ire->ire_fp_mp);
			ire->ire_fp_mp = NULL;
			mutex_exit(&ire->ire_lock);
			/*
			 * No fastpath probe if there is no stq i.e.
			 * i.e. the case of loopback broadcast ire.
			 */
			if (ire->ire_stq == NULL)
				break;
			ill = (ill_t *)((ire->ire_stq)->q_ptr);
			ire_fastpath_list_add(ill, ire);
			res = ill_fastpath_probe(ill, ire->ire_dlureq_mp);
			/*
			 * EAGAIN is an indication of a transient error
			 * i.e. allocation failure etc. leave the ire in the
			 * list it will be updated when another probe happens
			 * for another ire if not it will be taken out of the
			 * list when the ire is deleted.
			 */
			if (res != 0 && res != EAGAIN)
				ire_fastpath_list_delete(ill, ire);
		} else {
			mutex_exit(&ire->ire_lock);
		}
		break;
	default:
		/* This should not happen! */
		ip0dbg(("ire_fastpath_flush: Wrong ire type %s\n",
		    ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type)));
		break;
	}
}

/*
 * Drain the list of ire's waiting for fastpath response.
 */
void
ire_fastpath_list_dispatch(ill_t *ill, boolean_t (*func)(ire_t *, void *),
    void *arg)
{
	ire_t	 *next_ire;
	ire_t	 *current_ire;
	ire_t	 *first_ire;
	ire_t	 *prev_ire = NULL;

	ASSERT(ill != NULL);

	mutex_enter(&ill->ill_lock);
	first_ire = current_ire = (ire_t *)ill->ill_fastpath_list;
	while (current_ire != (ire_t *)&ill->ill_fastpath_list) {
		next_ire = current_ire->ire_fastpath;
		/*
		 * Take it off the list if we're flushing, or if the callback
		 * routine tells us to do so.  Otherwise, leave the ire in the
		 * fastpath list to handle any pending response from the lower
		 * layer.  We can't drain the list when the callback routine
		 * comparison failed, because the response is asynchronous in
		 * nature, and may not arrive in the same order as the list
		 * insertion.
		 */
		if (func == NULL || func(current_ire, arg)) {
			current_ire->ire_fastpath = NULL;
			if (current_ire == first_ire)
				ill->ill_fastpath_list = first_ire = next_ire;
			else
				prev_ire->ire_fastpath = next_ire;
		} else {
			/* previous element that is still in the list */
			prev_ire = current_ire;
		}
		current_ire = next_ire;
	}
	mutex_exit(&ill->ill_lock);
}

/*
 * Add ire to the ire fastpath list.
 */
static void
ire_fastpath_list_add(ill_t *ill, ire_t *ire)
{
	ASSERT(ill != NULL);
	ASSERT(ire->ire_stq != NULL);

	rw_enter(&ire->ire_bucket->irb_lock, RW_READER);
	mutex_enter(&ill->ill_lock);

	/*
	 * if ire has not been deleted and
	 * is not already in the list add it.
	 */
	if (((ire->ire_marks & IRE_MARK_CONDEMNED) == 0) &&
	    (ire->ire_fastpath == NULL)) {
		ire->ire_fastpath = (ire_t *)ill->ill_fastpath_list;
		ill->ill_fastpath_list = ire;
	}

	mutex_exit(&ill->ill_lock);
	rw_exit(&ire->ire_bucket->irb_lock);
}

/*
 * remove ire from the ire fastpath list.
 */
void
ire_fastpath_list_delete(ill_t *ill, ire_t *ire)
{
	ire_t	*ire_ptr;

	ASSERT(ire->ire_stq != NULL && ill != NULL);

	mutex_enter(&ill->ill_lock);
	if (ire->ire_fastpath == NULL)
		goto done;

	ASSERT(ill->ill_fastpath_list != &ill->ill_fastpath_list);

	if (ill->ill_fastpath_list == ire) {
		ill->ill_fastpath_list = ire->ire_fastpath;
	} else {
		ire_ptr = ill->ill_fastpath_list;
		while (ire_ptr != (ire_t *)&ill->ill_fastpath_list) {
			if (ire_ptr->ire_fastpath == ire) {
				ire_ptr->ire_fastpath = ire->ire_fastpath;
				break;
			}
			ire_ptr = ire_ptr->ire_fastpath;
		}
	}
	ire->ire_fastpath = NULL;
done:
	mutex_exit(&ill->ill_lock);
}


/*
 * Find an IRE_INTERFACE for the multicast group.
 * Allows different routes for multicast addresses
 * in the unicast routing table (akin to 224.0.0.0 but could be more specific)
 * which point at different interfaces. This is used when IP_MULTICAST_IF
 * isn't specified (when sending) and when IP_ADD_MEMBERSHIP doesn't
 * specify the interface to join on.
 *
 * Supports IP_BOUND_IF by following the ipif/ill when recursing.
 */
ire_t *
ire_lookup_multi(ipaddr_t group, zoneid_t zoneid)
{
	ire_t	*ire;
	ipif_t	*ipif = NULL;
	int	match_flags = MATCH_IRE_TYPE;
	ipaddr_t gw_addr;

	ire = ire_ftable_lookup(group, 0, 0, 0, NULL, NULL, zoneid,
	    0, NULL, MATCH_IRE_DEFAULT);

	/* We search a resolvable ire in case of multirouting. */
	if ((ire != NULL) && (ire->ire_flags & RTF_MULTIRT)) {
		ire_t *cire = NULL;
		/*
		 * If the route is not resolvable, the looked up ire
		 * may be changed here. In that case, ire_multirt_lookup()
		 * IRE_REFRELE the original ire and change it.
		 */
		(void) ire_multirt_lookup(&cire, &ire, MULTIRT_CACHEGW, NULL);
		if (cire != NULL)
			ire_refrele(cire);
	}
	if (ire == NULL)
		return (NULL);
	/*
	 * Make sure we follow ire_ipif.
	 *
	 * We need to determine the interface route through
	 * which the gateway will be reached. We don't really
	 * care which interface is picked if the interface is
	 * part of a group.
	 */
	if (ire->ire_ipif != NULL) {
		ipif = ire->ire_ipif;
		match_flags |= MATCH_IRE_ILL_GROUP;
	}

	switch (ire->ire_type) {
	case IRE_DEFAULT:
	case IRE_PREFIX:
	case IRE_HOST:
		gw_addr = ire->ire_gateway_addr;
		ire_refrele(ire);
		ire = ire_ftable_lookup(gw_addr, 0, 0,
		    IRE_INTERFACE, ipif, NULL, zoneid, 0,
		    NULL, match_flags);
		return (ire);
	case IRE_IF_NORESOLVER:
	case IRE_IF_RESOLVER:
		return (ire);
	default:
		ire_refrele(ire);
		return (NULL);
	}
}

/*
 * Return any local address.  We use this to target ourselves
 * when the src address was specified as 'default'.
 * Preference for IRE_LOCAL entries.
 */
ire_t *
ire_lookup_local(zoneid_t zoneid)
{
	ire_t	*ire;
	irb_t	*irb;
	ire_t	*maybe = NULL;
	int i;

	for (i = 0; i < ip_cache_table_size;  i++) {
		irb = &ip_cache_table[i];
		if (irb->irb_ire == NULL)
			continue;
		rw_enter(&irb->irb_lock, RW_READER);
		for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
			if ((ire->ire_marks & IRE_MARK_CONDEMNED) ||
			    (ire->ire_zoneid != zoneid &&
			    ire->ire_zoneid != ALL_ZONES))
				continue;
			switch (ire->ire_type) {
			case IRE_LOOPBACK:
				if (maybe == NULL) {
					IRE_REFHOLD(ire);
					maybe = ire;
				}
				break;
			case IRE_LOCAL:
				if (maybe != NULL) {
					ire_refrele(maybe);
				}
				IRE_REFHOLD(ire);
				rw_exit(&irb->irb_lock);
				return (ire);
			}
		}
		rw_exit(&irb->irb_lock);
	}
	return (maybe);
}

/*
 * If the specified IRE is associated with a particular ILL, return
 * that ILL pointer (May be called as writer.).
 *
 * NOTE : This is not a generic function that can be used always.
 * This function always returns the ill of the outgoing packets
 * if this ire is used.
 */
ill_t *
ire_to_ill(const ire_t *ire)
{
	ill_t *ill = NULL;

	/*
	 * 1) For an IRE_CACHE, ire_ipif is the one where it obtained
	 *    the source address from. ire_stq is the one where the
	 *    packets will be sent out on. We return that here.
	 *
	 * 2) IRE_BROADCAST normally has a loopback and a non-loopback
	 *    copy and they always exist next to each other with loopback
	 *    copy being the first one. If we are called on the non-loopback
	 *    copy, return the one pointed by ire_stq. If it was called on
	 *    a loopback copy, we still return the one pointed by the next
	 *    ire's ire_stq pointer i.e the one pointed by the non-loopback
	 *    copy. We don't want use ire_ipif as it might represent the
	 *    source address (if we borrow source addresses for
	 *    IRE_BROADCASTS in the future).
	 *    However if an interface is currently coming up, the above
	 *    condition may not hold during that period since the ires
	 *    are added one at a time. Thus one of the pair could have been
	 *    added and the other not yet added.
	 * 3) For all others return the ones pointed by ire_ipif->ipif_ill.
	 */

	if (ire->ire_type == IRE_CACHE) {
		ill = (ill_t *)ire->ire_stq->q_ptr;
	} else if (ire->ire_type == IRE_BROADCAST) {
		if (ire->ire_stq != NULL) {
			ill = (ill_t *)ire->ire_stq->q_ptr;
		} else {
			ire_t  *ire_next;

			ire_next = ire->ire_next;
			if (ire_next != NULL &&
			    ire_next->ire_type == IRE_BROADCAST &&
			    ire_next->ire_addr == ire->ire_addr &&
			    ire_next->ire_ipif == ire->ire_ipif) {
				ill = (ill_t *)ire_next->ire_stq->q_ptr;
			}
		}
	} else if (ire->ire_ipif != NULL) {
		ill = ire->ire_ipif->ipif_ill;
	}
	return (ill);
}

/* Arrange to call the specified function for every IRE in the world. */
void
ire_walk(pfv_t func, void *arg)
{
	ire_walk_ipvers(func, arg, 0, ALL_ZONES);
}

void
ire_walk_v4(pfv_t func, void *arg, zoneid_t zoneid)
{
	ire_walk_ipvers(func, arg, IPV4_VERSION, zoneid);
}

void
ire_walk_v6(pfv_t func, void *arg, zoneid_t zoneid)
{
	ire_walk_ipvers(func, arg, IPV6_VERSION, zoneid);
}

/*
 * Walk a particular version. version == 0 means both v4 and v6.
 */
static void
ire_walk_ipvers(pfv_t func, void *arg, uchar_t vers, zoneid_t zoneid)
{
	if (vers != IPV6_VERSION) {
		ire_walk_ill_tables(0, 0, func, arg, IP_MASK_TABLE_SIZE,
		    ip_ftable_hash_size, ip_forwarding_table,
		    ip_cache_table_size, ip_cache_table, NULL, zoneid);
	}
	if (vers != IPV4_VERSION) {
		ire_walk_ill_tables(0, 0, func, arg, IP6_MASK_TABLE_SIZE,
		    ip6_ftable_hash_size, ip_forwarding_table_v6,
		    ip6_cache_table_size, ip_cache_table_v6, NULL, zoneid);
	}
}

/*
 * Arrange to call the specified
 * function for every IRE that matches the ill.
 */
void
ire_walk_ill(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg,
    ill_t *ill)
{
	ire_walk_ill_ipvers(match_flags, ire_type, func, arg, 0, ill);
}

void
ire_walk_ill_v4(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg,
    ill_t *ill)
{
	ire_walk_ill_ipvers(match_flags, ire_type, func, arg, IPV4_VERSION,
	    ill);
}

void
ire_walk_ill_v6(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg,
    ill_t *ill)
{
	ire_walk_ill_ipvers(match_flags, ire_type, func, arg, IPV6_VERSION,
	    ill);
}

/*
 * Walk a particular ill and version. version == 0 means both v4 and v6.
 */
static void
ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type, pfv_t func,
    void *arg, uchar_t vers, ill_t *ill)
{
	if (vers != IPV6_VERSION) {
		ire_walk_ill_tables(match_flags, ire_type, func, arg,
		    IP_MASK_TABLE_SIZE, ip_ftable_hash_size,
		    ip_forwarding_table, ip_cache_table_size,
		    ip_cache_table, ill, ALL_ZONES);
	}
	if (vers != IPV4_VERSION) {
		ire_walk_ill_tables(match_flags, ire_type, func, arg,
		    IP6_MASK_TABLE_SIZE, ip6_ftable_hash_size,
		    ip_forwarding_table_v6, ip6_cache_table_size,
		    ip_cache_table_v6, ill, ALL_ZONES);
	}
}

static boolean_t
ire_walk_ill_match(uint_t match_flags, uint_t ire_type, ire_t *ire,
    ill_t *ill, zoneid_t zoneid)
{
	ill_t *ire_stq_ill = NULL;
	ill_t *ire_ipif_ill = NULL;
	ill_group_t *ire_ill_group = NULL;

	ASSERT(match_flags != 0 || zoneid != ALL_ZONES);
	/*
	 * 1) MATCH_IRE_WQ : Used specifically to match on ire_stq.
	 *    The fast path update uses this to make sure it does not
	 *    update the fast path header of interface X with the fast
	 *    path updates it recieved on interface Y.  It is similar
	 *    in handling DL_NOTE_FASTPATH_FLUSH.
	 *
	 * 2) MATCH_IRE_ILL/MATCH_IRE_ILL_GROUP : We match both on ill
	 *    pointed by ire_stq and ire_ipif. Only in the case of
	 *    IRE_CACHEs can ire_stq and ire_ipif be pointing to
	 *    different ills. But we want to keep this function generic
	 *    enough for future use. So, we always try to match on both.
	 *    The only caller of this function ire_walk_ill_tables, will
	 *    call "func" after we return from this function. We expect
	 *    "func" to do the right filtering of ires in this case.
	 *
	 * NOTE : In the case of MATCH_IRE_ILL_GROUP, groups
	 * pointed by ire_stq and ire_ipif should always be the same.
	 * So, we just match on only one of them.
	 */
	if (match_flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP)) {
		if (ire->ire_stq != NULL)
			ire_stq_ill = (ill_t *)ire->ire_stq->q_ptr;
		if (ire->ire_ipif != NULL)
			ire_ipif_ill = ire->ire_ipif->ipif_ill;
		if (ire_stq_ill != NULL)
			ire_ill_group = ire_stq_ill->ill_group;
		if ((ire_ill_group == NULL) && (ire_ipif_ill != NULL))
			ire_ill_group = ire_ipif_ill->ill_group;
	}

	if (zoneid != ALL_ZONES) {
		/*
		 * We're walking the IREs for a specific zone. The only relevant
		 * IREs are:
		 * - all IREs with a matching ire_zoneid
		 * - all IRE_OFFSUBNETs as they're shared across all zones
		 * - IRE_INTERFACE IREs for interfaces with a usable source addr
		 *   with a matching zone
		 * - IRE_DEFAULTs with a gateway reachable from the zone
		 * We should really match on IRE_OFFSUBNETs and IRE_DEFAULTs
		 * using the same rule; but the above rules are consistent with
		 * the behavior of ire_ftable_lookup[_v6]() so that all the
		 * routes that can be matched during lookup are also matched
		 * here.
		 */
		if (zoneid != ire->ire_zoneid && ire->ire_zoneid != ALL_ZONES) {
			/*
			 * Note, IRE_INTERFACE can have the stq as NULL. For
			 * example, if the default multicast route is tied to
			 * the loopback address.
			 */
			if ((ire->ire_type & IRE_INTERFACE) &&
			    (ire->ire_stq != NULL)) {
				ire_stq_ill = (ill_t *)ire->ire_stq->q_ptr;
				if (ire->ire_ipversion == IPV4_VERSION) {
					if (!ipif_usesrc_avail(ire_stq_ill,
					    zoneid))
						/* No usable src addr in zone */
						return (B_FALSE);
				} else if (ire_stq_ill->ill_usesrc_ifindex
				    != 0) {
					/*
					 * For IPv6 use ipif_select_source_v6()
					 * so the right scope selection is done
					 */
					ipif_t *src_ipif;
					src_ipif =
					    ipif_select_source_v6(ire_stq_ill,
					    &ire->ire_addr_v6, B_FALSE,
					    IPV6_PREFER_SRC_DEFAULT,
					    zoneid);
					if (src_ipif != NULL) {
						ipif_refrele(src_ipif);
					} else {
						return (B_FALSE);
					}
				} else {
					return (B_FALSE);
				}

			} else if (!(ire->ire_type & IRE_OFFSUBNET)) {
				return (B_FALSE);
			}
		}

		/*
		 * Match all default routes from the global zone, irrespective
		 * of reachability.
		 */
		if (ire->ire_type == IRE_DEFAULT && zoneid != GLOBAL_ZONEID) {
			int ire_match_flags = 0;
			in6_addr_t gw_addr_v6;
			ire_t *rire;

			if (ire->ire_ipif != NULL) {
				ire_match_flags |= MATCH_IRE_ILL_GROUP;
			}
			if (ire->ire_ipversion == IPV4_VERSION) {
				rire = ire_route_lookup(ire->ire_gateway_addr,
				    0, 0, 0, ire->ire_ipif, NULL, zoneid, NULL,
				    ire_match_flags);
			} else {
				ASSERT(ire->ire_ipversion == IPV6_VERSION);
				mutex_enter(&ire->ire_lock);
				gw_addr_v6 = ire->ire_gateway_addr_v6;
				mutex_exit(&ire->ire_lock);
				rire = ire_route_lookup_v6(&gw_addr_v6,
				    NULL, NULL, 0, ire->ire_ipif, NULL, zoneid,
				    NULL, ire_match_flags);
			}
			if (rire == NULL) {
				return (B_FALSE);
			}
			ire_refrele(rire);
		}
	}

	if (((!(match_flags & MATCH_IRE_TYPE)) ||
		(ire->ire_type & ire_type)) &&
	    ((!(match_flags & MATCH_IRE_WQ)) ||
		(ire->ire_stq == ill->ill_wq)) &&
	    ((!(match_flags & MATCH_IRE_ILL)) ||
		(ire_stq_ill == ill || ire_ipif_ill == ill)) &&
	    ((!(match_flags & MATCH_IRE_ILL_GROUP)) ||
		(ire_stq_ill == ill) || (ire_ipif_ill == ill) ||
		(ire_ill_group != NULL &&
		ire_ill_group == ill->ill_group))) {
		return (B_TRUE);
	}
	return (B_FALSE);
}

/*
 * Walk the ftable and the ctable entries that match the ill.
 */
static void
ire_walk_ill_tables(uint_t match_flags, uint_t ire_type, pfv_t func,
    void *arg, size_t ftbl_sz, size_t htbl_sz, irb_t **ipftbl,
    size_t ctbl_sz, irb_t *ipctbl, ill_t *ill, zoneid_t zoneid)
{
	irb_t	*irb_ptr;
	irb_t	*irb;
	ire_t	*ire;
	int i, j;
	boolean_t ret;

	ASSERT((!(match_flags & (MATCH_IRE_WQ | MATCH_IRE_ILL |
	    MATCH_IRE_ILL_GROUP))) || (ill != NULL));
	ASSERT(!(match_flags & MATCH_IRE_TYPE) || (ire_type != 0));
	/*
	 * Optimize by not looking at the forwarding table if there
	 * is a MATCH_IRE_TYPE specified with no IRE_FORWARDTABLE
	 * specified in ire_type.
	 */
	if (!(match_flags & MATCH_IRE_TYPE) ||
	    ((ire_type & IRE_FORWARDTABLE) != 0)) {
		for (i = (ftbl_sz - 1);  i >= 0; i--) {
			if ((irb_ptr = ipftbl[i]) == NULL)
				continue;
			for (j = 0; j < htbl_sz; j++) {
				irb = &irb_ptr[j];
				if (irb->irb_ire == NULL)
					continue;
				IRB_REFHOLD(irb);
				for (ire = irb->irb_ire; ire != NULL;
				    ire = ire->ire_next) {
					if (match_flags == 0 &&
					    zoneid == ALL_ZONES) {
						ret = B_TRUE;
					} else {
						ret = ire_walk_ill_match(
						    match_flags, ire_type,
						    ire, ill, zoneid);
					}
					if (ret)
						(*func)(ire, arg);
				}
				IRB_REFRELE(irb);
			}
		}
	}

	/*
	 * Optimize by not looking at the cache table if there
	 * is a MATCH_IRE_TYPE specified with no IRE_CACHETABLE
	 * specified in ire_type.
	 */
	if (!(match_flags & MATCH_IRE_TYPE) ||
	    ((ire_type & IRE_CACHETABLE) != 0)) {
		for (i = 0; i < ctbl_sz;  i++) {
			irb = &ipctbl[i];
			if (irb->irb_ire == NULL)
				continue;
			IRB_REFHOLD(irb);
			for (ire = irb->irb_ire; ire != NULL;
			    ire = ire->ire_next) {
				if (match_flags == 0 && zoneid == ALL_ZONES) {
					ret = B_TRUE;
				} else {
					ret = ire_walk_ill_match(
					    match_flags, ire_type,
					    ire, ill, zoneid);
				}
				if (ret)
					(*func)(ire, arg);
			}
			IRB_REFRELE(irb);
		}
	}
}

/*
 * This routine walks through the ill chain to find if there is any
 * ire linked to the ill's interface based forwarding table
 * The arg could be ill or mp. This routine is called when a ill goes
 * down/deleted or the 'ipv4_ire_srcif_status' report is printed.
 */
void
ire_walk_srcif_table_v4(pfv_t func, void *arg)
{
	irb_t   *irb;
	ire_t   *ire;
	ill_t	*ill, *next_ill;
	int	i;
	int	total_count;
	ill_walk_context_t ctx;

	/*
	 * Take care of ire's in other ill's per-interface forwarding
	 * table. Check if any ire in any of the ill's ill_srcif_table
	 * is pointing to this ill.
	 */
	mutex_enter(&ire_