6966758 ire generation numbers changes on shared IP zone boot throws off uperf numbers

6972874 zone shutdown can fail when resetting link protection on datalinks created inside a NGZ

5 files changed, 85 insertions, 35 deletions

diff --git a/usr/src/cmd/zoneadmd/vplat.c b/usr/src/cmd/zoneadmd/vplat.c
index 3e0307ed66..209c76d9fc 100644
--- a/usr/src/cmd/zoneadmd/vplat.c
+++ b/usr/src/cmd/zoneadmd/vplat.c
@@ -3107,17 +3107,25 @@ remove_datalink_protect(zlog_t *zlogp, zoneid_t zoneid)
 	}
 
 	for (i = 0, dllink = dllinks; i < dlnum; i++, dllink++) {
+		char dlerr[DLADM_STRSIZE];
+
 		dlstatus = dladm_set_linkprop(dld_handle, *dllink,
 		    "protection", NULL, 0, DLADM_OPT_ACTIVE);
+		if (dlstatus == DLADM_STATUS_NOTFOUND) {
+			/* datalink does not belong to the GZ */
+			continue;
+		}
 		if (dlstatus != DLADM_STATUS_OK) {
-			zerror(zlogp, B_TRUE, "could not reset protection\n");
+			zerror(zlogp, B_FALSE,
+			    dladm_status2str(dlstatus, dlerr));
 			free(dllinks);
 			return (-1);
 		}
 		dlstatus = dladm_set_linkprop(dld_handle, *dllink,
 		    "allowed-ips", NULL, 0, DLADM_OPT_ACTIVE);
 		if (dlstatus != DLADM_STATUS_OK) {
-			zerror(zlogp, B_TRUE, "could not reset allowed-ips\n");
+			zerror(zlogp, B_FALSE,
+			    dladm_status2str(dlstatus, dlerr));
 			free(dllinks);
 			return (-1);
 		}
diff --git a/usr/src/uts/common/inet/ip/ip.c b/usr/src/uts/common/inet/ip/ip.c
index 85876a4b74..3f18bf4d7e 100644
--- a/usr/src/uts/common/inet/ip/ip.c
+++ b/usr/src/uts/common/inet/ip/ip.c
@@ -9378,7 +9378,7 @@ ip_input_options(ipha_t *ipha, ipaddr_t dst, mblk_t *mp,
 			 */
 			if (optval == IPOPT_SSRR) {
 				ire = ire_ftable_lookup_v4(dst, 0, 0,
-				    IRE_IF_ALL, NULL, ALL_ZONES,
+				    IRE_INTERFACE, NULL, ALL_ZONES,
 				    ira->ira_tsl,
 				    MATCH_IRE_TYPE | MATCH_IRE_SECATTR, 0, ipst,
 				    NULL);
@@ -12915,7 +12915,8 @@ ip_output_options(mblk_t *mp, ipha_t *ipha, ip_xmit_attr_t *ixa, ill_t *ill)
 			 */
 			if (optval == IPOPT_SSRR) {
 				ire = ire_ftable_lookup_v4(dst, 0, 0,
-				    IRE_IF_ALL, NULL, ALL_ZONES, ixa->ixa_tsl,
+				    IRE_INTERFACE, NULL, ALL_ZONES,
+				    ixa->ixa_tsl,
 				    MATCH_IRE_TYPE | MATCH_IRE_SECATTR, 0, ipst,
 				    NULL);
 				if (ire == NULL) {
diff --git a/usr/src/uts/common/inet/ip/ip6_ire.c b/usr/src/uts/common/inet/ip/ip6_ire.c
index 4828b831fd..62ccd43503 100644
--- a/usr/src/uts/common/inet/ip/ip6_ire.c
+++ b/usr/src/uts/common/inet/ip/ip6_ire.c
@@ -1218,6 +1218,15 @@ ire_route_recursive_impl_v6(ire_t *ire,
 			goto error;
 
 		ASSERT(!(ire->ire_type & IRE_MULTICAST)); /* Not in ftable */
+		/*
+		 * Verify that the IRE_IF_CLONE has a consistent generation
+		 * number.
+		 */
+		if ((ire->ire_type & IRE_IF_CLONE) && !ire_clone_verify(ire)) {
+			ire_refrele(ire);
+			ire = NULL;
+			continue;
+		}
 
 		/*
 		 * Don't allow anything unusual past the first iteration.
@@ -1477,26 +1486,28 @@ ire_route_recursive_dstonly_v6(const in6_addr_t *nexthop, uint_t irr_flags,
 	ASSERT(ire != NULL);
 
 	/*
-	 * If this type should have an ire_nce_cache (even if it
-	 * doesn't yet have one) then we are done. Includes
-	 * IRE_INTERFACE with a full 128 bit mask.
-	 */
-	if (ire->ire_nce_capable)
-		return (ire);
-
-	/*
 	 * If the IRE has a current cached parent we know that the whole
 	 * parent chain is current, hence we don't need to discover and
 	 * build any dependencies by doing a recursive lookup.
 	 */
 	mutex_enter(&ire->ire_lock);
-	if (ire->ire_dep_parent != NULL &&
-	    ire->ire_dep_parent->ire_generation ==
-	    ire->ire_dep_parent_generation) {
+	if (ire->ire_dep_parent != NULL) {
+		if (ire->ire_dep_parent->ire_generation ==
+		    ire->ire_dep_parent_generation) {
+			mutex_exit(&ire->ire_lock);
+			return (ire);
+		}
+		mutex_exit(&ire->ire_lock);
+	} else {
 		mutex_exit(&ire->ire_lock);
-		return (ire);
+		/*
+		 * If this type should have an ire_nce_cache (even if it
+		 * doesn't yet have one) then we are done. Includes
+		 * IRE_INTERFACE with a full 128 bit mask.
+		 */
+		if (ire->ire_nce_capable)
+			return (ire);
 	}
-	mutex_exit(&ire->ire_lock);
 
 	/*
 	 * Fallback to loop in the normal code starting with the ire
diff --git a/usr/src/uts/common/inet/ip/ip_ftable.c b/usr/src/uts/common/inet/ip/ip_ftable.c
index 18cb9beb0e..7cb83a2a76 100644
--- a/usr/src/uts/common/inet/ip/ip_ftable.c
+++ b/usr/src/uts/common/inet/ip/ip_ftable.c
@@ -19,8 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
+ * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
  */
 
 /*
@@ -1446,6 +1445,15 @@ ire_route_recursive_impl_v4(ire_t *ire,
 			goto error;
 
 		ASSERT(!(ire->ire_type & IRE_MULTICAST)); /* Not in ftable */
+		/*
+		 * Verify that the IRE_IF_CLONE has a consistent generation
+		 * number.
+		 */
+		if ((ire->ire_type & IRE_IF_CLONE) && !ire_clone_verify(ire)) {
+			ire_refrele(ire);
+			ire = NULL;
+			continue;
+		}
 
 		/*
 		 * Don't allow anything unusual past the first iteration.
@@ -1713,28 +1721,29 @@ ire_route_recursive_dstonly_v4(ipaddr_t nexthop, uint_t irr_flags,
 	ire = ire_ftable_lookup_simple_v4(nexthop, xmit_hint, ipst,
 	    &generation);
 	ASSERT(ire != NULL);
-
-	/*
-	 * If this type should have an ire_nce_cache (even if it
-	 * doesn't yet have one) then we are done. Includes
-	 * IRE_INTERFACE with a full 32 bit mask.
-	 */
-	if (ire->ire_nce_capable)
-		return (ire);
-
 	/*
 	 * If the IRE has a current cached parent we know that the whole
 	 * parent chain is current, hence we don't need to discover and
 	 * build any dependencies by doing a recursive lookup.
 	 */
 	mutex_enter(&ire->ire_lock);
-	if (ire->ire_dep_parent != NULL &&
-	    ire->ire_dep_parent->ire_generation ==
-	    ire->ire_dep_parent_generation) {
+	if (ire->ire_dep_parent != NULL) {
+		if (ire->ire_dep_parent->ire_generation ==
+		    ire->ire_dep_parent_generation) {
+			mutex_exit(&ire->ire_lock);
+			return (ire);
+		}
 		mutex_exit(&ire->ire_lock);
-		return (ire);
+	} else {
+		mutex_exit(&ire->ire_lock);
+		/*
+		 * If this type should have an ire_nce_cache (even if it
+		 * doesn't yet have one) then we are done. Includes
+		 * IRE_INTERFACE with a full 32 bit mask.
+		 */
+		if (ire->ire_nce_capable)
+			return (ire);
 	}
-	mutex_exit(&ire->ire_lock);
 
 	/*
 	 * Fallback to loop in the normal code starting with the ire
@@ -1746,3 +1755,24 @@ ire_route_recursive_dstonly_v4(ipaddr_t nexthop, uint_t irr_flags,
 	ire_refrele(ire);
 	return (ire1);
 }
+
+/*
+ * Verify that the generation numbers in the chain leading to an IRE_IF_CLONE
+ * are consistent. Return FALSE (and delete the IRE_IF_CLONE) if they
+ * are not consistent, and TRUE otherwise.
+ */
+boolean_t
+ire_clone_verify(ire_t *ire)
+{
+	ASSERT((ire->ire_type & IRE_IF_CLONE) != 0);
+	mutex_enter(&ire->ire_lock);
+	if (ire->ire_dep_parent != NULL &&
+	    ire->ire_dep_parent->ire_generation !=
+	    ire->ire_dep_parent_generation) {
+		mutex_exit(&ire->ire_lock);
+		ire_delete(ire);
+		return (B_FALSE);
+	}
+	mutex_exit(&ire->ire_lock);
+	return (B_TRUE);
+}
diff --git a/usr/src/uts/common/inet/ip_ire.h b/usr/src/uts/common/inet/ip_ire.h
index 060cb1c935..d3bb6b94d7 100644
--- a/usr/src/uts/common/inet/ip_ire.h
+++ b/usr/src/uts/common/inet/ip_ire.h
@@ -19,8 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
+ * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
  */
 /* Copyright (c) 1990 Mentat Inc. */
 
@@ -346,6 +345,7 @@ extern  boolean_t	ire_walk_ill_match(uint_t, uint_t, ire_t *, ill_t *,
 extern  void ire_increment_generation(ire_t *);
 extern  void ire_increment_multicast_generation(ip_stack_t *, boolean_t);
 extern	void ire_rebind(ire_t *);
+extern	boolean_t ire_clone_verify(ire_t *);
 
 #endif /* _KERNEL */