/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License, Version 1.0 only

 * (the "License").  You may not use this file except in compliance

 * with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Use is subject to license terms.

 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

#include <sys/types.h>

#include <sys/stream.h>

#include <sys/stropts.h>

#include <sys/sysmacros.h>

#include <sys/errno.h>

#include <sys/strlog.h>

#include <sys/dlpi.h>

#include <sys/sockio.h>

#include <sys/tiuser.h>

#include <sys/tihdr.h>

#include <sys/socket.h>

#include <sys/ddi.h>

#include <sys/cmn_err.h>

#include <sys/debug.h>

#include <sys/vtrace.h>

#include <sys/kmem.h>

#include <sys/zone.h>

#include <net/if.h>

#include <net/if_types.h>

#include <net/if_dl.h>

#include <net/route.h>

#include <sys/sockio.h>

#include <netinet/in.h>

#include <netinet/in_systm.h>

#include <netinet/ip6.h>

#include <netinet/icmp6.h>

#include <inet/common.h>

#include <inet/mi.h>

#include <inet/mib2.h>

#include <inet/nd.h>

#include <inet/arp.h>

#include <inet/ip.h>

#include <inet/ip_multi.h>

#include <inet/ip_if.h>

#include <inet/ip_ire.h>

#include <inet/ip_rts.h>

#include <inet/ip6.h>

#include <inet/ip_ndp.h>

#include <inet/ipsec_impl.h>

#include <inet/ipsec_info.h>

/*

 * Function names with nce_ prefix are static while function

 * names with ndp_ prefix are used by rest of the IP.

 */

static	boolean_t nce_cmp_ll_addr(nce_t *nce, char *new_ll_addr,

    uint32_t ll_addr_len);

static	void	nce_fastpath(nce_t *nce);

static	void	nce_ire_delete(nce_t *nce);

static	void	nce_ire_delete1(ire_t *ire, char *nce_arg);

static	void 	nce_set_ll(nce_t *nce, uchar_t *ll_addr);

static	nce_t	*nce_lookup_addr(ill_t *ill, const in6_addr_t *addr);

static	nce_t	*nce_lookup_mapping(ill_t *ill, const in6_addr_t *addr);

static	void	nce_make_mapping(nce_t *nce, uchar_t *addrpos,

    uchar_t *addr);

static	int	nce_set_multicast(ill_t *ill, const in6_addr_t *addr);

static	void	nce_queue_mp(nce_t *nce, mblk_t *mp);

static	void	nce_report1(nce_t *nce, uchar_t *mp_arg);

static	mblk_t	*nce_udreq_alloc(ill_t *ill);

static	void	nce_update(nce_t *nce, uint16_t new_state,

    uchar_t *new_ll_addr);

static	uint32_t	nce_solicit(nce_t *nce, mblk_t *mp);

static	boolean_t	nce_xmit(ill_t *ill, uint32_t operation,

    ill_t *hwaddr_ill, boolean_t use_lla_addr, const in6_addr_t *sender,

    const in6_addr_t *target, int flag);

static	void	lla2ascii(uint8_t *lla, int addrlen, uchar_t *buf);

extern void	th_trace_rrecord(th_trace_t *);

#ifdef NCE_DEBUG

void	nce_trace_inactive(nce_t *);

#endif

/* NDP Cache Entry Hash Table */

#define	NCE_TABLE_SIZE	256

static	nce_t	*nce_hash_tbl[NCE_TABLE_SIZE];

static	nce_t	*nce_mask_entries;	/* mask not all ones */

static	int	ndp_g_walker = 0;	/* # of active thread */

					/* walking nce hash list */

/* ndp_g_walker_cleanup will be true, when deletion have to be defered */

static	boolean_t	ndp_g_walker_cleanup = B_FALSE;

#ifdef _BIG_ENDIAN

#define	IN6_IS_ADDR_MC_SOLICITEDNODE(addr) \

	((((addr)->s6_addr32[0] & 0xff020000) == 0xff020000) && \

	((addr)->s6_addr32[1] == 0x0) && \

	((addr)->s6_addr32[2] == 0x00000001) && \

	((addr)->s6_addr32[3] & 0xff000000) == 0xff000000)

#else	/* _BIG_ENDIAN */

#define	IN6_IS_ADDR_MC_SOLICITEDNODE(addr) \

	((((addr)->s6_addr32[0] & 0x000002ff) == 0x000002ff) && \

	((addr)->s6_addr32[1] == 0x0) && \

	((addr)->s6_addr32[2] == 0x01000000) && \

	((addr)->s6_addr32[3] & 0x000000ff) == 0x000000ff)

#endif

#define	NCE_HASH_PTR(addr) \

	(&(nce_hash_tbl[NCE_ADDR_HASH_V6(addr, NCE_TABLE_SIZE)]))

/*

 * NDP Cache Entry creation routine.

 * Mapped entries will never do NUD .

 * This routine must always be called with ndp_g_lock held.

 * Prior to return, nce_refcnt is incremented.

 */

int

ndp_add(ill_t *ill, uchar_t *hw_addr, const in6_addr_t *addr,

    const in6_addr_t *mask, const in6_addr_t *extract_mask,

    uint32_t hw_extract_start, uint16_t flags, uint16_t state,

    nce_t **newnce)

{

static	nce_t		nce_nil;

	nce_t		*nce;

	mblk_t		*mp;

	mblk_t		*template;

	nce_t		**ncep;

	boolean_t	dropped = B_FALSE;

	ASSERT(MUTEX_HELD(&ndp_g_lock));

	ASSERT(ill != NULL);

	if (IN6_IS_ADDR_UNSPECIFIED(addr)) {

		ip0dbg(("ndp_add: no addr\n"));

		return (EINVAL);

	}

	if ((flags & ~NCE_EXTERNAL_FLAGS_MASK)) {

		ip0dbg(("ndp_add: flags = %x\n", (int)flags));

		return (EINVAL);

	}

	if (IN6_IS_ADDR_UNSPECIFIED(extract_mask) &&

	    (flags & NCE_F_MAPPING)) {

		ip0dbg(("ndp_add: extract mask zero for mapping"));

		return (EINVAL);

	}

	/*

	 * Allocate the mblk to hold the nce.

	 *

	 * XXX This can come out of a separate cache - nce_cache.

	 * We don't need the mp anymore as there are no more

	 * "qwriter"s

	 */

	mp = allocb(sizeof (nce_t), BPRI_MED);

	if (mp == NULL)

		return (ENOMEM);

	nce = (nce_t *)mp->b_rptr;

	mp->b_wptr = (uchar_t *)&nce[1];

	*nce = nce_nil;

	/*

	 * This one holds link layer address

	 */

	if (ill->ill_net_type == IRE_IF_RESOLVER) {

		template = nce_udreq_alloc(ill);

	} else {

		ASSERT((ill->ill_net_type == IRE_IF_NORESOLVER));

		ASSERT((ill->ill_resolver_mp != NULL));

		template = copyb(ill->ill_resolver_mp);

	}

	if (template == NULL) {

		freeb(mp);

		return (ENOMEM);

	}

	nce->nce_ill = ill;

	nce->nce_flags = flags;

	nce->nce_state = state;

	nce->nce_pcnt = ND_MAX_UNICAST_SOLICIT;

	nce->nce_rcnt = ill->ill_xmit_count;

	nce->nce_addr = *addr;

	nce->nce_mask = *mask;

	nce->nce_extract_mask = *extract_mask;

	nce->nce_ll_extract_start = hw_extract_start;

	nce->nce_fp_mp = NULL;

	nce->nce_res_mp = template;

	if (state == ND_REACHABLE)

		nce->nce_last = TICK_TO_MSEC(lbolt64);

	else

		nce->nce_last = 0;

	nce->nce_qd_mp = NULL;

	nce->nce_mp = mp;

	if (hw_addr != NULL)

		nce_set_ll(nce, hw_addr);

	/* This one is for nce getting created */

	nce->nce_refcnt = 1;

	mutex_init(&nce->nce_lock, NULL, MUTEX_DEFAULT, NULL);

	if (nce->nce_flags & NCE_F_MAPPING) {

		ASSERT(IN6_IS_ADDR_MULTICAST(addr));

		ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&nce->nce_mask));

		ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&nce->nce_extract_mask));

		ncep = &nce_mask_entries;

	} else {

		ncep = ((nce_t **)NCE_HASH_PTR(*addr));

	}

#ifdef NCE_DEBUG

	bzero(nce->nce_trace, sizeof (th_trace_t *) * IP_TR_HASH_MAX);

#endif

	/*

	 * Atomically ensure that the ill is not CONDEMNED, before

	 * adding the NCE.

	 */

	mutex_enter(&ill->ill_lock);

	if (ill->ill_state_flags & ILL_CONDEMNED) {

		mutex_exit(&ill->ill_lock);

		freeb(mp);

		return (EINVAL);

	}

	if ((nce->nce_next = *ncep) != NULL)

		nce->nce_next->nce_ptpn = &nce->nce_next;

	*ncep = nce;

	nce->nce_ptpn = ncep;

	*newnce = nce;

	/* This one is for nce being used by an active thread */

	NCE_REFHOLD(*newnce);

	/* Bump up the number of nce's referencing this ill */

	ill->ill_nce_cnt++;

	mutex_exit(&ill->ill_lock);

	/*

	 * Before we insert the nce, honor the UNSOL_ADV flag.

	 * We cannot hold the ndp_g_lock and call nce_xmit

	 * which does a putnext.

	 */

	if (flags & NCE_F_UNSOL_ADV) {

		flags |= NDP_ORIDE;

		/*

		 * We account for the transmit below by assigning one

		 * less than the ndd variable. Subsequent decrements

		 * are done in ndp_timer.

		 */

		mutex_enter(&nce->nce_lock);

		mutex_exit(&ndp_g_lock);

		nce->nce_unsolicit_count = ip_ndp_unsolicit_count - 1;

		mutex_exit(&nce->nce_lock);

		dropped = nce_xmit(ill,

		    ND_NEIGHBOR_ADVERT,

		    ill,	/* ill to be used for extracting ill_nd_lla */

		    B_TRUE,	/* use ill_nd_lla */

		    addr,	/* Source and target of the advertisement pkt */

		    &ipv6_all_hosts_mcast, /* Destination of the packet */

		    flags);

		mutex_enter(&nce->nce_lock);

		if (dropped)

			nce->nce_unsolicit_count++;

		if (nce->nce_unsolicit_count != 0) {

			nce->nce_timeout_id = timeout(ndp_timer, nce,

			    MSEC_TO_TICK(ip_ndp_unsolicit_interval));

		}

		mutex_exit(&nce->nce_lock);

		mutex_enter(&ndp_g_lock);

	}

}

int

ndp_lookup_then_add(ill_t *ill, uchar_t *hw_addr, const in6_addr_t *addr,

    const in6_addr_t *mask, const in6_addr_t *extract_mask,

    uint32_t hw_extract_start, uint16_t flags, uint16_t state,

    nce_t **newnce)

{

	int	err = 0;

	nce_t	*nce;

	mutex_enter(&ndp_g_lock);

	nce = nce_lookup_addr(ill, addr);

	if (nce == NULL) {

		err = ndp_add(ill,

		    hw_addr,

		    addr,

		    mask,

		    extract_mask,

		    hw_extract_start,

		    flags,

		    state,

		    newnce);

	} else {

		*newnce = nce;

		err = EEXIST;

	}

	mutex_exit(&ndp_g_lock);

	return (err);

}

/*

 * Remove all the CONDEMNED nces from the appropriate hash table.

 * We create a private list of NCEs, these may have ires pointing

 * to them, so the list will be passed through to clean up dependent

 * ires and only then we can do NCE_REFRELE which can make NCE inactive.

 */

static void

nce_remove(nce_t *nce, nce_t **free_nce_list)

{

	nce_t *nce1;

	nce_t **ptpn;

	ASSERT(MUTEX_HELD(&ndp_g_lock));

	ASSERT(ndp_g_walker == 0);

	for (; nce; nce = nce1) {

		nce1 = nce->nce_next;

		mutex_enter(&nce->nce_lock);

		if (nce->nce_flags & NCE_F_CONDEMNED) {

			ptpn = nce->nce_ptpn;

			nce1 = nce->nce_next;

			if (nce1 != NULL)

				nce1->nce_ptpn = ptpn;

			*ptpn = nce1;

			nce->nce_ptpn = NULL;

			nce->nce_next = NULL;

			nce->nce_next = *free_nce_list;

			*free_nce_list = nce;

		}

		mutex_exit(&nce->nce_lock);

	}

}

/*

 * 1. Mark the nce CONDEMNED. This ensures that no new nce_lookup()

 *    will return this NCE. Also no new IREs will be created that

 *    point to this NCE (See ire_add_v6).  Also no new timeouts will

 *    be started (See NDP_RESTART_TIMER).

 * 2. Cancel any currently running timeouts.

 * 3. If there is an ndp walker, return. The walker will do the cleanup.

 *    This ensures that walkers see a consistent list of NCEs while walking.

 * 4. Otherwise remove the NCE from the list of NCEs

 * 5. Delete all IREs pointing to this NCE.

 */

void

ndp_delete(nce_t *nce)

{

	nce_t	**ptpn;

	nce_t	*nce1;

	/* Serialize deletes */

	mutex_enter(&nce->nce_lock);

	if (nce->nce_flags & NCE_F_CONDEMNED) {

		/* Some other thread is doing the delete */

		mutex_exit(&nce->nce_lock);

		return;

	}

	/*

	 * Caller has a refhold. Also 1 ref for being in the list. Thus

	 * refcnt has to be >= 2

	 */

	ASSERT(nce->nce_refcnt >= 2);

	nce->nce_flags |= NCE_F_CONDEMNED;

	mutex_exit(&nce->nce_lock);

	nce_fastpath_list_delete(nce);

	/*

	 * Cancel any running timer. Timeout can't be restarted

	 * since CONDEMNED is set. Can't hold nce_lock across untimeout.

	 * Passing invalid timeout id is fine.

	 */

	if (nce->nce_timeout_id != 0) {

		(void) untimeout(nce->nce_timeout_id);

		nce->nce_timeout_id = 0;

	}

	mutex_enter(&ndp_g_lock);

	if (nce->nce_ptpn == NULL) {

		/*

		 * The last ndp walker has already removed this nce from

		 * the list after we marked the nce CONDEMNED and before

		 * we grabbed the ndp_g_lock.

		 */

		mutex_exit(&ndp_g_lock);

		return;

	}

	if (ndp_g_walker > 0) {

		/*

		 * Can't unlink. The walker will clean up

		 */

		ndp_g_walker_cleanup = B_TRUE;

		mutex_exit(&ndp_g_lock);

		return;

	}

	/*

	 * Now remove the nce from the list. NDP_RESTART_TIMER won't restart

	 * the timer since it is marked CONDEMNED.

	 */

	ptpn = nce->nce_ptpn;

	nce1 = nce->nce_next;

	if (nce1 != NULL)

		nce1->nce_ptpn = ptpn;

	*ptpn = nce1;

	nce->nce_ptpn = NULL;

	nce->nce_next = NULL;

	mutex_exit(&ndp_g_lock);

	nce_ire_delete(nce);

}

void

ndp_inactive(nce_t *nce)

{

	mblk_t		**mpp;

	ill_t		*ill;

	ASSERT(nce->nce_refcnt == 0);

	ASSERT(MUTEX_HELD(&nce->nce_lock));

	ASSERT(nce->nce_fastpath == NULL);

	/* Free all nce allocated messages */

	mpp = &nce->nce_first_mp_to_free;

	do {

		while (*mpp != NULL) {

			mblk_t  *mp;

			mp = *mpp;

			*mpp = mp->b_next;

			mp->b_next = NULL;

			mp->b_prev = NULL;

			freemsg(mp);

		}

	} while (mpp++ != &nce->nce_last_mp_to_free);

#ifdef NCE_DEBUG

	nce_trace_inactive(nce);

#endif

	ill = nce->nce_ill;

	mutex_enter(&ill->ill_lock);

	ill->ill_nce_cnt--;

	/*

	 * If the number of nce's associated with this ill have dropped

	 * to zero, check whether we need to restart any operation that

	 * is waiting for this to happen.

	 */

	if (ill->ill_nce_cnt == 0) {

		/* ipif_ill_refrele_tail drops the ill_lock */

		ipif_ill_refrele_tail(ill);

	} else {

		mutex_exit(&ill->ill_lock);

	}

	mutex_destroy(&nce->nce_lock);

	freeb(nce->nce_mp);

}

/*

 * ndp_walk routine.  Delete the nce if it is associated with the ill

 * that is going away.  Always called as a writer.

 */

void

ndp_delete_per_ill(nce_t *nce, uchar_t *arg)

{

	if ((nce != NULL) && nce->nce_ill == (ill_t *)arg) {

		ndp_delete(nce);

	}

}

/*

 * Walk a list of to be inactive NCEs and blow away all the ires.

 */

static void

nce_ire_delete_list(nce_t *nce)

{

	nce_t *nce_next;

	ASSERT(nce != NULL);

	while (nce != NULL) {

		nce_next = nce->nce_next;

		nce->nce_next = NULL;

		/*

		 * It is possible for the last ndp walker (this thread)

		 * to come here after ndp_delete has marked the nce CONDEMNED

		 * and before it has removed the nce from the fastpath list

		 * or called untimeout. So we need to do it here. It is safe

		 * for both ndp_delete and this thread to do it twice or

		 * even simultaneously since each of the threads has a

		 * reference on the nce.

		 */

		nce_fastpath_list_delete(nce);

		/*

		 * Cancel any running timer. Timeout can't be restarted

		 * since CONDEMNED is set. Can't hold nce_lock across untimeout.

		 * Passing invalid timeout id is fine.

		 */

		if (nce->nce_timeout_id != 0) {

			(void) untimeout(nce->nce_timeout_id);

			nce->nce_timeout_id = 0;

		}

		ire_walk_ill_v6(MATCH_IRE_ILL | MATCH_IRE_TYPE, IRE_CACHE,

		    nce_ire_delete1, (char *)nce, nce->nce_ill);

		NCE_REFRELE_NOTR(nce);

		nce = nce_next;