]> git.saurik.com Git - apple/xnu.git/blobdiff - bsd/netinet/in_arp.c
xnu-4570.51.1.tar.gz
[apple/xnu.git] / bsd / netinet / in_arp.c
index 88652830622b7972b7d022f24b68d2dd4f199bfe..674da52bf91ad700f29c42729985ad1c85b9dfad 100644 (file)
@@ -1,8 +1,8 @@
 /*
 /*
- * Copyright (c) 2004-2009 Apple Inc. All rights reserved.
+ * Copyright (c) 2004-2017 Apple Inc. All rights reserved.
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
- * 
+ *
  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in
  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in
  * unlawful or unlicensed copies of an Apple operating system, or to
  * circumvent, violate, or enable the circumvention or violation of, any
  * terms of an Apple operating system software license agreement.
  * unlawful or unlicensed copies of an Apple operating system, or to
  * circumvent, violate, or enable the circumvention or violation of, any
  * terms of an Apple operating system software license agreement.
- * 
+ *
  * Please obtain a copy of the License at
  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  * Please obtain a copy of the License at
  * http://www.opensource.apple.com/apsl/ and read it before using this file.
- * 
+ *
  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
@@ -22,7 +22,7 @@
  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  * Please see the License for the specific language governing rights and
  * limitations under the License.
  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  * Please see the License for the specific language governing rights and
  * limitations under the License.
- * 
+ *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 /*
  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 /*
 #include <sys/kernel.h>
 #include <sys/mbuf.h>
 #include <sys/sysctl.h>
 #include <sys/kernel.h>
 #include <sys/mbuf.h>
 #include <sys/sysctl.h>
+#include <sys/mcache.h>
+#include <sys/protosw.h>
 #include <string.h>
 #include <net/if_arp.h>
 #include <net/if_dl.h>
 #include <net/dlil.h>
 #include <net/if_types.h>
 #include <string.h>
 #include <net/if_arp.h>
 #include <net/if_dl.h>
 #include <net/dlil.h>
 #include <net/if_types.h>
+#include <net/if_llreach.h>
 #include <net/route.h>
 #include <net/route.h>
+#include <net/nwk_wq.h>
+
 #include <netinet/if_ether.h>
 #include <netinet/in_var.h>
 #include <kern/zalloc.h>
 
 #include <netinet/if_ether.h>
 #include <netinet/in_var.h>
 #include <kern/zalloc.h>
 
-#define        SA(p) ((struct sockaddr *)(p))
-#define SIN(s) ((struct sockaddr_in *)s)
-#define CONST_LLADDR(s) ((const u_char*)((s)->sdl_data + (s)->sdl_nlen))
-#define        rt_expire rt_rmx.rmx_expire
-#define        equal(a1, a2) (bcmp((caddr_t)(a1), (caddr_t)(a2), (a1)->sa_len) == 0)
+#include <kern/thread.h>
+#include <kern/sched_prim.h>
 
 
-static const size_t MAX_HW_LEN = 10;
+#define        CONST_LLADDR(s) ((const u_char*)((s)->sdl_data + (s)->sdl_nlen))
 
 
-SYSCTL_DECL(_net_link_ether);
-SYSCTL_NODE(_net_link_ether, PF_INET, inet, CTLFLAG_RW|CTLFLAG_LOCKED, 0, "");
-
-/* timer values */
-static int arpt_prune = (5*60*1); /* walk list every 5 minutes */
-static int arpt_keep = (20*60); /* once resolved, good for 20 more minutes */
-static int arpt_down = 20;     /* once declared down, don't send for 20 sec */
-
-/* Apple Hardware SUM16 checksuming */
-int apple_hwcksum_tx = 1;
-int apple_hwcksum_rx = 1;
-
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, prune_intvl, CTLFLAG_RW,
-          &arpt_prune, 0, "");
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, max_age, CTLFLAG_RW, 
-          &arpt_keep, 0, "");
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, host_down_time, CTLFLAG_RW,
-          &arpt_down, 0, "");
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, apple_hwcksum_tx, CTLFLAG_RW,
-          &apple_hwcksum_tx, 0, "");
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, apple_hwcksum_rx, CTLFLAG_RW,
-          &apple_hwcksum_rx, 0, "");
-
-struct llinfo_arp {
-       /*
-        * The following are protected by rnh_lock
-        */
-       LIST_ENTRY(llinfo_arp) la_le;
-       struct  rtentry *la_rt;
-       /*
-        * The following are protected by rt_lock
-        */
-       struct  mbuf *la_hold;          /* last packet until resolved/timeout */
-       int32_t la_asked;               /* last time we QUERIED for this addr */
-};
+static const size_t MAX_HW_LEN = 10;
 
 /*
  * Synchronization notes:
 
 /*
  * Synchronization notes:
@@ -140,7 +108,7 @@ struct llinfo_arp {
  *
  *     - Routing lock (rnh_lock)
  *
  *
  *     - Routing lock (rnh_lock)
  *
- * la_hold, la_asked
+ * la_holdq, la_asked, la_llreach, la_lastused, la_flags
  *
  *     - Routing entry lock (rt_lock)
  *
  *
  *     - Routing entry lock (rt_lock)
  *
@@ -149,49 +117,143 @@ struct llinfo_arp {
  * it is simply removed from the global list but the memory is not
  * freed until the route itself is freed.
  */
  * it is simply removed from the global list but the memory is not
  * freed until the route itself is freed.
  */
+struct llinfo_arp {
+       /*
+        * The following are protected by rnh_lock
+        */
+       LIST_ENTRY(llinfo_arp) la_le;
+       struct  rtentry *la_rt;
+       /*
+        * The following are protected by rt_lock
+        */
+       class_queue_t la_holdq;         /* packets awaiting resolution */
+       struct  if_llreach *la_llreach; /* link-layer reachability record */
+       u_int64_t la_lastused;          /* last used timestamp */
+       u_int32_t la_asked;             /* # of requests sent */
+       u_int32_t la_maxtries;          /* retry limit */
+       u_int64_t la_probeexp;          /* probe deadline timestamp */
+       u_int32_t la_prbreq_cnt;        /* probe request count */
+       u_int32_t la_flags;
+#define LLINFO_RTRFAIL_EVTSENT         0x1 /* sent an ARP event */
+#define LLINFO_PROBING                 0x2 /* waiting for an ARP reply */
+};
+
 static LIST_HEAD(, llinfo_arp) llinfo_arp;
 
 static LIST_HEAD(, llinfo_arp) llinfo_arp;
 
-static int     arp_inuse, arp_allocated;
+static thread_call_t arp_timeout_tcall;
+static int arp_timeout_run;            /* arp_timeout is scheduled to run */
+static void arp_timeout(thread_call_param_t arg0, thread_call_param_t arg1);
+static void arp_sched_timeout(struct timeval *);
+
+static thread_call_t arp_probe_tcall;
+static int arp_probe_run;              /* arp_probe is scheduled to run */
+static void arp_probe(thread_call_param_t arg0, thread_call_param_t arg1);
+static void arp_sched_probe(struct timeval *);
+
+static void arptfree(struct llinfo_arp *, void *);
+static errno_t arp_lookup_route(const struct in_addr *, int,
+    int, route_t *, unsigned int);
+static int arp_getstat SYSCTL_HANDLER_ARGS;
+
+static struct llinfo_arp *arp_llinfo_alloc(int);
+static void arp_llinfo_free(void *);
+static uint32_t arp_llinfo_flushq(struct llinfo_arp *);
+static void arp_llinfo_purge(struct rtentry *);
+static void arp_llinfo_get_ri(struct rtentry *, struct rt_reach_info *);
+static void arp_llinfo_get_iflri(struct rtentry *, struct ifnet_llreach_info *);
+static void arp_llinfo_refresh(struct rtentry *);
+
+static __inline void arp_llreach_use(struct llinfo_arp *);
+static __inline int arp_llreach_reachable(struct llinfo_arp *);
+static void arp_llreach_alloc(struct rtentry *, struct ifnet *, void *,
+    unsigned int, boolean_t, uint32_t *);
+
+extern int tvtohz(struct timeval *);
+
+static int arpinit_done;
+
+SYSCTL_DECL(_net_link_ether);
+SYSCTL_NODE(_net_link_ether, PF_INET, inet, CTLFLAG_RW|CTLFLAG_LOCKED, 0, "");
 
 
-static int     arp_maxtries = 5;
-static int     useloopback = 1; /* use loopback interface for local traffic */
-static int     arp_proxyall = 0;
-static int     arp_sendllconflict = 0;
+static int arpt_prune = (5*60*1); /* walk list every 5 minutes */
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, prune_intvl,
+       CTLFLAG_RW | CTLFLAG_LOCKED, &arpt_prune, 0, "");
 
 
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, maxtries, CTLFLAG_RW,
-          &arp_maxtries, 0, "");
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, useloopback, CTLFLAG_RW,
-          &useloopback, 0, "");
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, proxyall, CTLFLAG_RW,
-          &arp_proxyall, 0, "");
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, sendllconflict, CTLFLAG_RW,
-          &arp_sendllconflict, 0, "");
+#define ARP_PROBE_TIME        7 /* seconds */
+static u_int32_t arpt_probe = ARP_PROBE_TIME;
+SYSCTL_UINT(_net_link_ether_inet, OID_AUTO, probe_intvl,
+       CTLFLAG_RW | CTLFLAG_LOCKED, &arpt_probe, 0, "");
 
 
-static int log_arp_warnings = 0;
+static int arpt_keep = (20*60); /* once resolved, good for 20 more minutes */
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, max_age,
+       CTLFLAG_RW | CTLFLAG_LOCKED, &arpt_keep, 0, "");
 
 
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, log_arp_warnings, CTLFLAG_RW,
+static int arpt_down = 20;     /* once declared down, don't send for 20 sec */
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, host_down_time,
+       CTLFLAG_RW | CTLFLAG_LOCKED, &arpt_down, 0, "");
+
+static int arp_llreach_base = 120;     /* seconds */
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, arp_llreach_base,
+       CTLFLAG_RW | CTLFLAG_LOCKED, &arp_llreach_base, 0,
+       "default ARP link-layer reachability max lifetime (in seconds)");
+
+#define        ARP_UNICAST_LIMIT 3     /* # of probes until ARP refresh broadcast */
+static u_int32_t arp_unicast_lim = ARP_UNICAST_LIMIT;
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, arp_unicast_lim,
+       CTLFLAG_RW | CTLFLAG_LOCKED, &arp_unicast_lim, ARP_UNICAST_LIMIT,
+       "number of unicast ARP refresh probes before using broadcast");
+
+static u_int32_t arp_maxtries = 5;
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, maxtries,
+       CTLFLAG_RW | CTLFLAG_LOCKED, &arp_maxtries, 0, "");
+
+static u_int32_t arp_maxhold = 16;
+SYSCTL_UINT(_net_link_ether_inet, OID_AUTO, maxhold,
+       CTLFLAG_RW | CTLFLAG_LOCKED, &arp_maxhold, 0, "");
+
+static int useloopback = 1;    /* use loopback interface for local traffic */
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, useloopback,
+       CTLFLAG_RW | CTLFLAG_LOCKED, &useloopback, 0, "");
+
+static int arp_proxyall = 0;
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, proxyall,
+       CTLFLAG_RW | CTLFLAG_LOCKED, &arp_proxyall, 0, "");
+
+static int arp_sendllconflict = 0;
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, sendllconflict,
+       CTLFLAG_RW | CTLFLAG_LOCKED, &arp_sendllconflict, 0, "");
+
+static int log_arp_warnings = 0;       /* Thread safe: no accumulated state */
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, log_arp_warnings,
+       CTLFLAG_RW | CTLFLAG_LOCKED,
        &log_arp_warnings, 0,
        "log arp warning messages");
 
        &log_arp_warnings, 0,
        "log arp warning messages");
 
-static int keep_announcements = 1;
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, keep_announcements, CTLFLAG_RW,
+static int keep_announcements = 1;     /* Thread safe: no aging of state */
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, keep_announcements,
+       CTLFLAG_RW | CTLFLAG_LOCKED,
        &keep_announcements, 0,
        "keep arp announcements");
 
        &keep_announcements, 0,
        "keep arp announcements");
 
-static int send_conflicting_probes = 1;
-SYSCTL_INT(_net_link_ether_inet, OID_AUTO, send_conflicting_probes, CTLFLAG_RW,
+static int send_conflicting_probes = 1;        /* Thread safe: no accumulated state */
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, send_conflicting_probes,
+       CTLFLAG_RW | CTLFLAG_LOCKED,
        &send_conflicting_probes, 0,
        "send conflicting link-local arp probes");
 
        &send_conflicting_probes, 0,
        "send conflicting link-local arp probes");
 
-static errno_t arp_lookup_route(const struct in_addr *, int,
-    int, route_t *, unsigned int);
-static void arptimer(void *);
-static struct llinfo_arp *arp_llinfo_alloc(void);
-static void arp_llinfo_free(void *);
+static int arp_verbose;
+SYSCTL_INT(_net_link_ether_inet, OID_AUTO, verbose,
+       CTLFLAG_RW | CTLFLAG_LOCKED, &arp_verbose, 0, "");
 
 
-extern u_int32_t       ipv4_ll_arp_aware;
-
-static int arpinit_done;
+/*
+ * Generally protected by rnh_lock; use atomic operations on fields
+ * that are also modified outside of that lock (if needed).
+ */
+struct arpstat arpstat __attribute__((aligned(sizeof (uint64_t))));
+SYSCTL_PROC(_net_link_ether_inet, OID_AUTO, stats,
+       CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
+       0, 0, arp_getstat, "S,arpstat",
+       "ARP statistics (struct arpstat, net/if_arp.h)");
 
 static struct zone *llinfo_arp_zone;
 #define        LLINFO_ARP_ZONE_MAX     256             /* maximum elements in zone */
 
 static struct zone *llinfo_arp_zone;
 #define        LLINFO_ARP_ZONE_MAX     256             /* maximum elements in zone */
@@ -200,10 +262,7 @@ static struct zone *llinfo_arp_zone;
 void
 arp_init(void)
 {
 void
 arp_init(void)
 {
-       if (arpinit_done) {
-               log(LOG_NOTICE, "arp_init called more than once (ignored)\n");
-               return;
-       }
+       VERIFY(!arpinit_done);
 
        LIST_INIT(&llinfo_arp);
 
 
        LIST_INIT(&llinfo_arp);
 
@@ -214,17 +273,30 @@ arp_init(void)
                panic("%s: failed allocating llinfo_arp_zone", __func__);
 
        zone_change(llinfo_arp_zone, Z_EXPAND, TRUE);
                panic("%s: failed allocating llinfo_arp_zone", __func__);
 
        zone_change(llinfo_arp_zone, Z_EXPAND, TRUE);
+       zone_change(llinfo_arp_zone, Z_CALLERACCT, FALSE);
 
        arpinit_done = 1;
 
        arpinit_done = 1;
-
-       /* start timer */
-       timeout(arptimer, (caddr_t)0, hz);
 }
 
 static struct llinfo_arp *
 }
 
 static struct llinfo_arp *
-arp_llinfo_alloc(void)
+arp_llinfo_alloc(int how)
 {
 {
-       return (zalloc(llinfo_arp_zone));
+       struct llinfo_arp *la;
+
+       la = (how == M_WAITOK) ? zalloc(llinfo_arp_zone) :
+           zalloc_noblock(llinfo_arp_zone);
+       if (la != NULL) {
+               bzero(la, sizeof (*la));
+               /*
+                * The type of queue (Q_DROPHEAD) here is just a hint;
+                * the actual logic that works on this queue performs
+                * a head drop, details in arp_llinfo_addq().
+                */
+               _qinit(&la->la_holdq, Q_DROPHEAD, (arp_maxhold == 0) ?
+                   (uint32_t)-1 : arp_maxhold, QP_MBUF);
+       }
+
+       return (la);
 }
 
 static void
 }
 
 static void
@@ -237,63 +309,424 @@ arp_llinfo_free(void *arg)
                /* NOTREACHED */
        }
 
                /* NOTREACHED */
        }
 
-       /* Just in case there's anything there, free it */
-       if (la->la_hold != NULL) {
-               m_freem(la->la_hold);
-               la->la_hold = NULL;
-       }
+       /* Free any held packets */
+       (void) arp_llinfo_flushq(la);
+
+       /* Purge any link-layer info caching */
+       VERIFY(la->la_rt->rt_llinfo == la);
+       if (la->la_rt->rt_llinfo_purge != NULL)
+               la->la_rt->rt_llinfo_purge(la->la_rt);
 
        zfree(llinfo_arp_zone, la);
 }
 
 
        zfree(llinfo_arp_zone, la);
 }
 
+static void
+arp_llinfo_addq(struct llinfo_arp *la, struct mbuf *m)
+{
+       if (qlen(&la->la_holdq) >= qlimit(&la->la_holdq)) {
+               struct mbuf *_m;
+               /* prune less than CTL, else take what's at the head */
+               _m = _getq_scidx_lt(&la->la_holdq, SCIDX_CTL);
+               if (_m == NULL)
+                       _m = _getq(&la->la_holdq);
+               VERIFY(_m != NULL);
+               if (arp_verbose) {
+                       log(LOG_DEBUG, "%s: dropping packet (scidx %u)\n",
+                           __func__, MBUF_SCIDX(mbuf_get_service_class(_m)));
+               }
+               m_freem(_m);
+               atomic_add_32(&arpstat.dropped, 1);
+               atomic_add_32(&arpstat.held, -1);
+       }
+       _addq(&la->la_holdq, m);
+       atomic_add_32(&arpstat.held, 1);
+       if (arp_verbose) {
+               log(LOG_DEBUG, "%s: enqueued packet (scidx %u), qlen now %u\n",
+                   __func__, MBUF_SCIDX(mbuf_get_service_class(m)),
+                   qlen(&la->la_holdq));
+       }
+}
+
+static uint32_t
+arp_llinfo_flushq(struct llinfo_arp *la)
+{
+       uint32_t held = qlen(&la->la_holdq);
+
+       if (held != 0) {
+               atomic_add_32(&arpstat.purged, held);
+               atomic_add_32(&arpstat.held, -held);
+               _flushq(&la->la_holdq);
+       }
+       la->la_prbreq_cnt = 0;
+       VERIFY(qempty(&la->la_holdq));
+       return (held);
+}
+
+static void
+arp_llinfo_purge(struct rtentry *rt)
+{
+       struct llinfo_arp *la = rt->rt_llinfo;
+
+       RT_LOCK_ASSERT_HELD(rt);
+       VERIFY(rt->rt_llinfo_purge == arp_llinfo_purge && la != NULL);
+
+       if (la->la_llreach != NULL) {
+               RT_CONVERT_LOCK(rt);
+               ifnet_llreach_free(la->la_llreach);
+               la->la_llreach = NULL;
+       }
+       la->la_lastused = 0;
+}
+
+static void
+arp_llinfo_get_ri(struct rtentry *rt, struct rt_reach_info *ri)
+{
+       struct llinfo_arp *la = rt->rt_llinfo;
+       struct if_llreach *lr = la->la_llreach;
+
+       if (lr == NULL) {
+               bzero(ri, sizeof (*ri));
+               ri->ri_rssi = IFNET_RSSI_UNKNOWN;
+               ri->ri_lqm = IFNET_LQM_THRESH_OFF;
+               ri->ri_npm = IFNET_NPM_THRESH_UNKNOWN;
+       } else {
+               IFLR_LOCK(lr);
+               /* Export to rt_reach_info structure */
+               ifnet_lr2ri(lr, ri);
+               /* Export ARP send expiration (calendar) time */
+               ri->ri_snd_expire =
+                   ifnet_llreach_up2calexp(lr, la->la_lastused);
+               IFLR_UNLOCK(lr);
+       }
+}
+
+static void
+arp_llinfo_get_iflri(struct rtentry *rt, struct ifnet_llreach_info *iflri)
+{
+       struct llinfo_arp *la = rt->rt_llinfo;
+       struct if_llreach *lr = la->la_llreach;
+
+       if (lr == NULL) {
+               bzero(iflri, sizeof (*iflri));
+               iflri->iflri_rssi = IFNET_RSSI_UNKNOWN;
+               iflri->iflri_lqm = IFNET_LQM_THRESH_OFF;
+               iflri->iflri_npm = IFNET_NPM_THRESH_UNKNOWN;
+       } else {
+               IFLR_LOCK(lr);
+               /* Export to ifnet_llreach_info structure */
+               ifnet_lr2iflri(lr, iflri);
+               /* Export ARP send expiration (uptime) time */
+               iflri->iflri_snd_expire =
+                   ifnet_llreach_up2upexp(lr, la->la_lastused);
+               IFLR_UNLOCK(lr);
+       }
+}
+
+static void
+arp_llinfo_refresh(struct rtentry *rt)
+{
+       uint64_t timenow = net_uptime();
+       /*
+        * If route entry is permanent or if expiry is less
+        * than timenow and extra time taken for unicast probe
+        * we can't expedite the refresh
+        */
+       if ((rt->rt_expire == 0) ||
+           (rt->rt_flags & RTF_STATIC) ||
+           !(rt->rt_flags & RTF_LLINFO)) {
+               return;
+       }
+
+       if (rt->rt_expire > timenow)
+               rt->rt_expire = timenow;
+       return;
+}
+
+void
+arp_llreach_set_reachable(struct ifnet *ifp, void *addr, unsigned int alen)
+{
+       /* Nothing more to do if it's disabled */
+       if (arp_llreach_base == 0)
+               return;
+
+       ifnet_llreach_set_reachable(ifp, ETHERTYPE_IP, addr, alen);
+}
+
+static __inline void
+arp_llreach_use(struct llinfo_arp *la)
+{
+       if (la->la_llreach != NULL)
+               la->la_lastused = net_uptime();
+}
+
+static __inline int
+arp_llreach_reachable(struct llinfo_arp *la)
+{
+       struct if_llreach *lr;
+       const char *why = NULL;
+
+       /* Nothing more to do if it's disabled; pretend it's reachable  */
+       if (arp_llreach_base == 0)
+               return (1);
+
+       if ((lr = la->la_llreach) == NULL) {
+               /*
+                * Link-layer reachability record isn't present for this
+                * ARP entry; pretend it's reachable and use it as is.
+                */
+               return (1);
+       } else if (ifnet_llreach_reachable(lr)) {
+               /*
+                * Record is present, it's not shared with other ARP
+                * entries and a packet has recently been received
+                * from the remote host; consider it reachable.
+                */
+               if (lr->lr_reqcnt == 1)
+                       return (1);
+
+               /* Prime it up, if this is the first time */
+               if (la->la_lastused == 0) {
+                       VERIFY(la->la_llreach != NULL);
+                       arp_llreach_use(la);
+               }
+
+               /*
+                * Record is present and shared with one or more ARP
+                * entries, and a packet has recently been received
+                * from the remote host.  Since it's shared by more
+                * than one IP addresses, we can't rely on the link-
+                * layer reachability alone; consider it reachable if
+                * this ARP entry has been used "recently."
+                */
+               if (ifnet_llreach_reachable_delta(lr, la->la_lastused))
+                       return (1);
+
+               why = "has alias(es) and hasn't been used in a while";
+       } else {
+               why = "haven't heard from it in a while";
+       }
+
+       if (arp_verbose > 1) {
+               char tmp[MAX_IPv4_STR_LEN];
+               u_int64_t now = net_uptime();
+
+               log(LOG_DEBUG, "%s: ARP probe(s) needed for %s; "
+                   "%s [lastused %lld, lastrcvd %lld] secs ago\n",
+                   if_name(lr->lr_ifp), inet_ntop(AF_INET,
+                   &SIN(rt_key(la->la_rt))->sin_addr, tmp, sizeof (tmp)), why,
+                   (la->la_lastused ? (int64_t)(now - la->la_lastused) : -1),
+                   (lr->lr_lastrcvd ? (int64_t)(now - lr->lr_lastrcvd) : -1));
+
+       }
+       return (0);
+}
+
+/*
+ * Obtain a link-layer source cache entry for the sender.
+ *
+ * NOTE: This is currently only for ARP/Ethernet.
+ */
+static void
+arp_llreach_alloc(struct rtentry *rt, struct ifnet *ifp, void *addr,
+    unsigned int alen, boolean_t solicited, uint32_t *p_rt_event_code)
+{
+       VERIFY(rt->rt_expire == 0 || rt->rt_rmx.rmx_expire != 0);
+       VERIFY(rt->rt_expire != 0 || rt->rt_rmx.rmx_expire == 0);
+
+       if (arp_llreach_base != 0 && rt->rt_expire != 0 &&
+           !(rt->rt_ifp->if_flags & IFF_LOOPBACK) &&
+           ifp->if_addrlen == IF_LLREACH_MAXLEN &&     /* Ethernet */
+           alen == ifp->if_addrlen) {
+               struct llinfo_arp *la = rt->rt_llinfo;
+               struct if_llreach *lr;
+               const char *why = NULL, *type = "";
+
+               /* Become a regular mutex, just in case */
+               RT_CONVERT_LOCK(rt);
+
+               if ((lr = la->la_llreach) != NULL) {
+                       type = (solicited ? "ARP reply" : "ARP announcement");
+                       /*
+                        * If target has changed, create a new record;
+                        * otherwise keep existing record.
+                        */
+                       IFLR_LOCK(lr);
+                       if (bcmp(addr, lr->lr_key.addr, alen) != 0) {
+                               IFLR_UNLOCK(lr);
+                               /* Purge any link-layer info caching */
+                               VERIFY(rt->rt_llinfo_purge != NULL);
+                               rt->rt_llinfo_purge(rt);
+                               lr = NULL;
+                               why = " for different target HW address; "
+                                   "using new llreach record";
+                               *p_rt_event_code = ROUTE_LLENTRY_CHANGED;
+                       } else {
+                               /*
+                                * If we were doing unicast probing, we need to
+                                * deliver an event for neighbor cache resolution
+                                */
+                               if (lr->lr_probes != 0)
+                                       *p_rt_event_code = ROUTE_LLENTRY_RESOLVED;
+
+                               lr->lr_probes = 0;      /* reset probe count */
+                               IFLR_UNLOCK(lr);
+                               if (solicited) {
+                                       why = " for same target HW address; "
+                                           "keeping existing llreach record";
+                               }
+                       }
+               }
+
+               if (lr == NULL) {
+                       lr = la->la_llreach = ifnet_llreach_alloc(ifp,
+                           ETHERTYPE_IP, addr, alen, arp_llreach_base);
+                       if (lr != NULL) {
+                               lr->lr_probes = 0;      /* reset probe count */
+                               if (why == NULL)
+                                       why = "creating new llreach record";
+                       }
+                       *p_rt_event_code = ROUTE_LLENTRY_RESOLVED;
+               }
+
+               if (arp_verbose > 1 && lr != NULL && why != NULL) {
+                       char tmp[MAX_IPv4_STR_LEN];
+
+                       log(LOG_DEBUG, "%s: %s%s for %s\n", if_name(ifp),
+                           type, why, inet_ntop(AF_INET,
+                           &SIN(rt_key(rt))->sin_addr, tmp, sizeof (tmp)));
+               }
+       }
+}
+
+struct arptf_arg {
+       boolean_t draining;
+       boolean_t probing;
+       uint32_t killed;
+       uint32_t aging;
+       uint32_t sticky;
+       uint32_t found;
+       uint32_t qlen;
+       uint32_t qsize;
+};
+
 /*
  * Free an arp entry.
  */
 static void
 /*
  * Free an arp entry.
  */
 static void
-arptfree(struct llinfo_arp *la)
+arptfree(struct llinfo_arp *la, void *arg)
 {
 {
+       struct arptf_arg *ap = arg;
        struct rtentry *rt = la->la_rt;
        struct rtentry *rt = la->la_rt;
-       struct sockaddr_dl *sdl;
+       uint64_t timenow;
 
 
-       lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_OWNED);
-       RT_LOCK_ASSERT_HELD(rt);
+       LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
+
+       /* rnh_lock acquired by caller protects rt from going away */
+       RT_LOCK(rt);
 
 
-       if (rt->rt_refcnt > 0 && (sdl = SDL(rt->rt_gateway)) &&
-           sdl->sdl_family == AF_LINK) {
-               sdl->sdl_alen = 0;
-               la->la_asked = 0;
-               rt->rt_flags &= ~RTF_REJECT;
+       VERIFY(rt->rt_expire == 0 || rt->rt_rmx.rmx_expire != 0);
+       VERIFY(rt->rt_expire != 0 || rt->rt_rmx.rmx_expire == 0);
+
+       ap->found++;
+       timenow = net_uptime();
+
+       /* If we're probing, flush out held packets upon probe expiration */
+       if (ap->probing && (la->la_flags & LLINFO_PROBING) &&
+           la->la_probeexp <= timenow) {
+               struct sockaddr_dl *sdl = SDL(rt->rt_gateway);
+               if (sdl != NULL)
+                       sdl->sdl_alen = 0;
+               (void) arp_llinfo_flushq(la);
+               /*
+                * Enqueue work item to invoke callback for this route entry
+                */
+               route_event_enqueue_nwk_wq_entry(rt, NULL,
+                   ROUTE_LLENTRY_UNREACH, NULL, TRUE);
+       }
+
+       /*
+        * The following is mostly being used to arm the timer
+        * again and for logging.
+        * qlen is used to re-arm the timer. Therefore, pure probe
+        * requests can be considered as 0 length packets
+        * contributing only to length but not to the size.
+        */
+       ap->qlen += qlen(&la->la_holdq);
+       ap->qlen += la->la_prbreq_cnt;
+       ap->qsize += qsize(&la->la_holdq);
+
+       if (rt->rt_expire == 0 || (rt->rt_flags & RTF_STATIC)) {
+               ap->sticky++;
+               /* ARP entry is permanent? */
+               if (rt->rt_expire == 0) {
+                       RT_UNLOCK(rt);
+                       return;
+               }
+       }
+
+       /* ARP entry hasn't expired and we're not draining? */
+       if (!ap->draining && rt->rt_expire > timenow) {
                RT_UNLOCK(rt);
                RT_UNLOCK(rt);
-       } else {
+               ap->aging++;
+               return;
+       }
+
+       if (rt->rt_refcnt > 0) {
+               /*
+                * ARP entry has expired, with outstanding refcnt.
+                * If we're not draining, force ARP query to be
+                * generated next time this entry is used.
+                */
+               if (!ap->draining && !ap->probing) {
+                       struct sockaddr_dl *sdl = SDL(rt->rt_gateway);
+                       if (sdl != NULL)
+                               sdl->sdl_alen = 0;
+                       la->la_asked = 0;
+                       rt->rt_flags &= ~RTF_REJECT;
+               }
+               RT_UNLOCK(rt);
+       } else if (!(rt->rt_flags & RTF_STATIC) && !ap->probing) {
                /*
                /*
-                * Safe to drop rt_lock and use rt_key, since holding
+                * ARP entry has no outstanding refcnt, and we're either
+                * draining or it has expired; delete it from the routing
+                * table.  Safe to drop rt_lock and use rt_key, since holding
                 * rnh_lock here prevents another thread from calling
                 * rt_setgate() on this route.
                 */
                RT_UNLOCK(rt);
                 * rnh_lock here prevents another thread from calling
                 * rt_setgate() on this route.
                 */
                RT_UNLOCK(rt);
-               rtrequest_locked(RTM_DELETE, rt_key(rt), NULL, rt_mask(rt),
-                   0, NULL);
+               rtrequest_locked(RTM_DELETE, rt_key(rt), NULL,
+                   rt_mask(rt), 0, NULL);
+               arpstat.timeouts++;
+               ap->killed++;
+       } else {
+               /* ARP entry is static; let it linger */
+               RT_UNLOCK(rt);
        }
 }
 
 void
        }
 }
 
 void
-in_arpdrain(void *ignored_arg)
+in_arpdrain(void *arg)
 {
 {
-#pragma unused (ignored_arg)
+#pragma unused(arg)
        struct llinfo_arp *la, *ola;
        struct llinfo_arp *la, *ola;
-       struct timeval timenow;
+       struct arptf_arg farg;
+
+       if (arp_verbose)
+               log(LOG_DEBUG, "%s: draining ARP entries\n", __func__);
 
        lck_mtx_lock(rnh_lock);
        la = llinfo_arp.lh_first;
 
        lck_mtx_lock(rnh_lock);
        la = llinfo_arp.lh_first;
-       getmicrotime(&timenow);
-       while ((ola = la) != 0) {
-               struct rtentry *rt = la->la_rt;
+       bzero(&farg, sizeof (farg));
+       farg.draining = TRUE;
+       while ((ola = la) != NULL) {
                la = la->la_le.le_next;
                la = la->la_le.le_next;
-               RT_LOCK(rt);
-               if (rt->rt_expire && rt->rt_expire <= timenow.tv_sec)
-                       arptfree(ola); /* timer has expired, clear */
-               else
-                       RT_UNLOCK(rt);
+               arptfree(ola, &farg);
+       }
+       if (arp_verbose) {
+               log(LOG_DEBUG, "%s: found %u, aging %u, sticky %u, killed %u; "
+                   "%u pkts held (%u bytes)\n", __func__, farg.found,
+                   farg.aging, farg.sticky, farg.killed, farg.qlen,
+                   farg.qsize);
        }
        lck_mtx_unlock(rnh_lock);
 }
        }
        lck_mtx_unlock(rnh_lock);
 }
@@ -301,56 +734,178 @@ in_arpdrain(void *ignored_arg)
 /*
  * Timeout routine.  Age arp_tab entries periodically.
  */
 /*
  * Timeout routine.  Age arp_tab entries periodically.
  */
-/* ARGSUSED */
 static void
 static void
-arptimer(void *ignored_arg)
+arp_timeout(thread_call_param_t arg0, thread_call_param_t arg1)
 {
 {
-#pragma unused (ignored_arg)
-       in_arpdrain(NULL);
-       timeout(arptimer, (caddr_t)0, arpt_prune * hz);
+#pragma unused(arg0, arg1)
+       struct llinfo_arp *la, *ola;
+       struct timeval atv;
+       struct arptf_arg farg;
+
+       lck_mtx_lock(rnh_lock);
+       la = llinfo_arp.lh_first;
+       bzero(&farg, sizeof (farg));
+       while ((ola = la) != NULL) {
+               la = la->la_le.le_next;
+               arptfree(ola, &farg);
+       }
+       if (arp_verbose) {
+               log(LOG_DEBUG, "%s: found %u, aging %u, sticky %u, killed %u; "
+                   "%u pkts held (%u bytes)\n", __func__, farg.found,
+                   farg.aging, farg.sticky, farg.killed, farg.qlen,
+                   farg.qsize);
+       }
+       atv.tv_usec = 0;
+       atv.tv_sec = MAX(arpt_prune, 5);
+       /* re-arm the timer if there's work to do */
+       arp_timeout_run = 0;
+       if (farg.aging > 0)
+               arp_sched_timeout(&atv);
+       else if (arp_verbose)
+               log(LOG_DEBUG, "%s: not rescheduling timer\n", __func__);
+       lck_mtx_unlock(rnh_lock);
+}
+
+static void
+arp_sched_timeout(struct timeval *atv)
+{
+       LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
+
+       if (!arp_timeout_run) {
+               struct timeval tv;
+               uint64_t deadline = 0;
+
+               if (arp_timeout_tcall == NULL) {
+                       arp_timeout_tcall =
+                           thread_call_allocate(arp_timeout, NULL);
+                       VERIFY(arp_timeout_tcall != NULL);
+               }
+
+               if (atv == NULL) {
+                       tv.tv_usec = 0;
+                       tv.tv_sec = MAX(arpt_prune / 5, 1);
+                       atv = &tv;
+               }
+               if (arp_verbose) {
+                       log(LOG_DEBUG, "%s: timer scheduled in "
+                           "T+%llus.%lluu\n", __func__,
+                           (uint64_t)atv->tv_sec, (uint64_t)atv->tv_usec);
+               }
+               arp_timeout_run = 1;
+
+               clock_deadline_for_periodic_event(atv->tv_sec * NSEC_PER_SEC,
+                   mach_absolute_time(), &deadline);
+               (void) thread_call_enter_delayed(arp_timeout_tcall, deadline);
+       }
 }
 
 /*
 }
 
 /*
- * Parallel to llc_rtrequest.
+ * Probe routine.
  */
 static void
  */
 static void
-arp_rtrequest(
-       int req,
-       struct rtentry *rt,
-       __unused struct sockaddr *sa)
+arp_probe(thread_call_param_t arg0, thread_call_param_t arg1)
 {
 {
+#pragma unused(arg0, arg1)
+       struct llinfo_arp *la, *ola;
+       struct timeval atv;
+       struct arptf_arg farg;
+
+       lck_mtx_lock(rnh_lock);
+       la = llinfo_arp.lh_first;
+       bzero(&farg, sizeof (farg));
+       farg.probing = TRUE;
+       while ((ola = la) != NULL) {
+               la = la->la_le.le_next;
+               arptfree(ola, &farg);
+       }
+       if (arp_verbose) {
+               log(LOG_DEBUG, "%s: found %u, aging %u, sticky %u, killed %u; "
+                   "%u pkts held (%u bytes)\n", __func__, farg.found,
+                   farg.aging, farg.sticky, farg.killed, farg.qlen,
+                   farg.qsize);
+       }
+       atv.tv_usec = 0;
+       atv.tv_sec = MAX(arpt_probe, ARP_PROBE_TIME);
+       /* re-arm the probe if there's work to do */
+       arp_probe_run = 0;
+       if (farg.qlen > 0)
+               arp_sched_probe(&atv);
+       else if (arp_verbose)
+               log(LOG_DEBUG, "%s: not rescheduling probe\n", __func__);
+       lck_mtx_unlock(rnh_lock);
+}
+
+static void
+arp_sched_probe(struct timeval *atv)
+{
+       LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
+
+       if (!arp_probe_run) {
+               struct timeval tv;
+               uint64_t deadline = 0;
+
+               if (arp_probe_tcall == NULL) {
+                       arp_probe_tcall =
+                           thread_call_allocate(arp_probe, NULL);
+                       VERIFY(arp_probe_tcall != NULL);
+               }
+
+               if (atv == NULL) {
+                       tv.tv_usec = 0;
+                       tv.tv_sec = MAX(arpt_probe, ARP_PROBE_TIME);
+                       atv = &tv;
+               }
+               if (arp_verbose) {
+                       log(LOG_DEBUG, "%s: probe scheduled in "
+                           "T+%llus.%lluu\n", __func__,
+                           (uint64_t)atv->tv_sec, (uint64_t)atv->tv_usec);
+               }
+               arp_probe_run = 1;
+
+               clock_deadline_for_periodic_event(atv->tv_sec * NSEC_PER_SEC,
+                   mach_absolute_time(), &deadline);
+               (void) thread_call_enter_delayed(arp_probe_tcall, deadline);
+       }
+}
+
+/*
+ * ifa_rtrequest() callback
+ */
+static void
+arp_rtrequest(int req, struct rtentry *rt, struct sockaddr *sa)
+{
+#pragma unused(sa)
        struct sockaddr *gate = rt->rt_gateway;
        struct llinfo_arp *la = rt->rt_llinfo;
        struct sockaddr *gate = rt->rt_gateway;
        struct llinfo_arp *la = rt->rt_llinfo;
-       static struct sockaddr_dl null_sdl = {sizeof(null_sdl), AF_LINK, 0, 0, 0, 0, 0, {0}};
-       struct timeval timenow;
+       static struct sockaddr_dl null_sdl =
+           { .sdl_len = sizeof (null_sdl), .sdl_family = AF_LINK };
+       uint64_t timenow;
+       char buf[MAX_IPv4_STR_LEN];
 
 
-       if (!arpinit_done) {
-               panic("%s: ARP has not been initialized", __func__);
-               /* NOTREACHED */
-       }
-       lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_OWNED);
+       VERIFY(arpinit_done);
+       LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
        RT_LOCK_ASSERT_HELD(rt);
 
        if (rt->rt_flags & RTF_GATEWAY)
                return;
        RT_LOCK_ASSERT_HELD(rt);
 
        if (rt->rt_flags & RTF_GATEWAY)
                return;
-       getmicrotime(&timenow);
-       switch (req) {
 
 
+       timenow = net_uptime();
+       switch (req) {
        case RTM_ADD:
                /*
                 * XXX: If this is a manually added route to interface
                 * such as older version of routed or gated might provide,
                 * restore cloning bit.
                 */
        case RTM_ADD:
                /*
                 * XXX: If this is a manually added route to interface
                 * such as older version of routed or gated might provide,
                 * restore cloning bit.
                 */
-               if ((rt->rt_flags & RTF_HOST) == 0 &&
-                   SIN(rt_mask(rt))->sin_addr.s_addr != 0xffffffff)
+               if (!(rt->rt_flags & RTF_HOST) && rt_mask(rt) != NULL &&
+                   SIN(rt_mask(rt))->sin_addr.s_addr != INADDR_BROADCAST)
                        rt->rt_flags |= RTF_CLONING;
                        rt->rt_flags |= RTF_CLONING;
+
                if (rt->rt_flags & RTF_CLONING) {
                        /*
                         * Case 1: This route should come from a route to iface.
                         */
                if (rt->rt_flags & RTF_CLONING) {
                        /*
                         * Case 1: This route should come from a route to iface.
                         */
-                       if (rt_setgate(rt, rt_key(rt),
-                           (struct sockaddr *)&null_sdl) == 0) {
+                       if (rt_setgate(rt, rt_key(rt), SA(&null_sdl)) == 0) {
                                gate = rt->rt_gateway;
                                SDL(gate)->sdl_type = rt->rt_ifp->if_type;
                                SDL(gate)->sdl_index = rt->rt_ifp->if_index;
                                gate = rt->rt_gateway;
                                SDL(gate)->sdl_type = rt->rt_ifp->if_type;
                                SDL(gate)->sdl_index = rt->rt_ifp->if_index;
@@ -358,105 +913,147 @@ arp_rtrequest(
                                 * In case we're called before 1.0 sec.
                                 * has elapsed.
                                 */
                                 * In case we're called before 1.0 sec.
                                 * has elapsed.
                                 */
-                               rt->rt_expire = MAX(timenow.tv_sec, 1);
+                               rt_setexpire(rt, MAX(timenow, 1));
                        }
                        break;
                }
                /* Announce a new entry if requested. */
                if (rt->rt_flags & RTF_ANNOUNCE) {
                        }
                        break;
                }
                /* Announce a new entry if requested. */
                if (rt->rt_flags & RTF_ANNOUNCE) {
+                       if (la != NULL)
+                               arp_llreach_use(la); /* Mark use timestamp */
                        RT_UNLOCK(rt);
                        dlil_send_arp(rt->rt_ifp, ARPOP_REQUEST,
                        RT_UNLOCK(rt);
                        dlil_send_arp(rt->rt_ifp, ARPOP_REQUEST,
-                           SDL(gate), rt_key(rt), NULL, rt_key(rt));
+                           SDL(gate), rt_key(rt), NULL, rt_key(rt), 0);
                        RT_LOCK(rt);
                        RT_LOCK(rt);
+                       arpstat.txannounces++;
                }
                }
-               /*FALLTHROUGH*/
+               /* FALLTHRU */
        case RTM_RESOLVE:
                if (gate->sa_family != AF_LINK ||
        case RTM_RESOLVE:
                if (gate->sa_family != AF_LINK ||
-                   gate->sa_len < sizeof(null_sdl)) {
-                       if (log_arp_warnings)
-                               log(LOG_DEBUG, "arp_rtrequest: bad gateway value\n");
+                   gate->sa_len < sizeof (null_sdl)) {
+                       arpstat.invalidreqs++;
+                       log(LOG_ERR, "%s: route to %s has bad gateway address "
+                           "(sa_family %u sa_len %u) on %s\n",
+                           __func__, inet_ntop(AF_INET,
+                           &SIN(rt_key(rt))->sin_addr.s_addr, buf,
+                           sizeof (buf)), gate->sa_family, gate->sa_len,
+                           if_name(rt->rt_ifp));
                        break;
                }
                SDL(gate)->sdl_type = rt->rt_ifp->if_type;
                SDL(gate)->sdl_index = rt->rt_ifp->if_index;
                        break;
                }
                SDL(gate)->sdl_type = rt->rt_ifp->if_type;
                SDL(gate)->sdl_index = rt->rt_ifp->if_index;
-               if (la != 0)
+
+               if (la != NULL)
                        break; /* This happens on a route change */
                        break; /* This happens on a route change */
+
                /*
                 * Case 2:  This route may come from cloning, or a manual route
                 * add with a LL address.
                 */
                /*
                 * Case 2:  This route may come from cloning, or a manual route
                 * add with a LL address.
                 */
-               rt->rt_llinfo = la = arp_llinfo_alloc();
+               rt->rt_llinfo = la = arp_llinfo_alloc(M_WAITOK);
                if (la == NULL) {
                if (la == NULL) {
-                       if (log_arp_warnings)
-                               log(LOG_DEBUG, "%s: malloc failed\n", __func__);
+                       arpstat.reqnobufs++;
                        break;
                }
                        break;
                }
-               rt->rt_llinfo_free = arp_llinfo_free;
-
-               arp_inuse++, arp_allocated++;
-               Bzero(la, sizeof(*la));
-               la->la_rt = rt;
+               rt->rt_llinfo_get_ri    = arp_llinfo_get_ri;
+               rt->rt_llinfo_get_iflri = arp_llinfo_get_iflri;
+               rt->rt_llinfo_purge     = arp_llinfo_purge;
+               rt->rt_llinfo_free      = arp_llinfo_free;
+               rt->rt_llinfo_refresh   = arp_llinfo_refresh;
                rt->rt_flags |= RTF_LLINFO;
                rt->rt_flags |= RTF_LLINFO;
+               la->la_rt = rt;
                LIST_INSERT_HEAD(&llinfo_arp, la, la_le);
                LIST_INSERT_HEAD(&llinfo_arp, la, la_le);
+               arpstat.inuse++;
+
+               /* We have at least one entry; arm the timer if not already */
+               arp_sched_timeout(NULL);
 
                /*
                 * This keeps the multicast addresses from showing up
                 * in `arp -a' listings as unresolved.  It's not actually
 
                /*
                 * This keeps the multicast addresses from showing up
                 * in `arp -a' listings as unresolved.  It's not actually
-                * functional.  Then the same for broadcast.
+                * functional.  Then the same for broadcast.  For IPv4
+                * link-local address, keep the entry around even after
+                * it has expired.
                 */
                if (IN_MULTICAST(ntohl(SIN(rt_key(rt))->sin_addr.s_addr))) {
                        RT_UNLOCK(rt);
                        dlil_resolve_multi(rt->rt_ifp, rt_key(rt), gate,
                 */
                if (IN_MULTICAST(ntohl(SIN(rt_key(rt))->sin_addr.s_addr))) {
                        RT_UNLOCK(rt);
                        dlil_resolve_multi(rt->rt_ifp, rt_key(rt), gate,
-                           sizeof(struct sockaddr_dl));
+                           sizeof (struct sockaddr_dl));
                        RT_LOCK(rt);
                        RT_LOCK(rt);
-                       rt->rt_expire = 0;
-               }
-               else if (in_broadcast(SIN(rt_key(rt))->sin_addr, rt->rt_ifp)) {
-                       struct sockaddr_dl      *gate_ll = SDL(gate);
-                       size_t  broadcast_len;
+                       rt_setexpire(rt, 0);
+               } else if (in_broadcast(SIN(rt_key(rt))->sin_addr,
+                   rt->rt_ifp)) {
+                       struct sockaddr_dl *gate_ll = SDL(gate);
+                       size_t broadcast_len;
                        ifnet_llbroadcast_copy_bytes(rt->rt_ifp,
                        ifnet_llbroadcast_copy_bytes(rt->rt_ifp,
-                           LLADDR(gate_ll), sizeof(gate_ll->sdl_data),
+                           LLADDR(gate_ll), sizeof (gate_ll->sdl_data),
                            &broadcast_len);
                        gate_ll->sdl_alen = broadcast_len;
                        gate_ll->sdl_family = AF_LINK;
                            &broadcast_len);
                        gate_ll->sdl_alen = broadcast_len;
                        gate_ll->sdl_family = AF_LINK;
-                       gate_ll->sdl_len = sizeof(struct sockaddr_dl);
+                       gate_ll->sdl_len = sizeof (struct sockaddr_dl);
                        /* In case we're called before 1.0 sec. has elapsed */
                        /* In case we're called before 1.0 sec. has elapsed */
-                       rt->rt_expire = MAX(timenow.tv_sec, 1);
+                       rt_setexpire(rt, MAX(timenow, 1));
+               } else if (IN_LINKLOCAL(ntohl(SIN(rt_key(rt))->
+                   sin_addr.s_addr))) {
+                       rt->rt_flags |= RTF_STATIC;
                }
 
                }
 
+               /* Set default maximum number of retries */
+               la->la_maxtries = arp_maxtries;
+
+               /* Become a regular mutex, just in case */
+               RT_CONVERT_LOCK(rt);
+               IFA_LOCK_SPIN(rt->rt_ifa);
                if (SIN(rt_key(rt))->sin_addr.s_addr ==
                    (IA_SIN(rt->rt_ifa))->sin_addr.s_addr) {
                if (SIN(rt_key(rt))->sin_addr.s_addr ==
                    (IA_SIN(rt->rt_ifa))->sin_addr.s_addr) {
-                   /*
-                    * This test used to be
-                    *  if (loif.if_flags & IFF_UP)
-                    * It allowed local traffic to be forced
-                    * through the hardware by configuring the loopback down.
-                    * However, it causes problems during network configuration
-                    * for boards that can't receive packets they send.
-                    * It is now necessary to clear "useloopback" and remove
-                    * the route to force traffic out to the hardware.
-                    */
-                       rt->rt_expire = 0;
-                       ifnet_lladdr_copy_bytes(rt->rt_ifp, LLADDR(SDL(gate)), SDL(gate)->sdl_alen = 6);
+                       IFA_UNLOCK(rt->rt_ifa);
+                       /*
+                        * This test used to be
+                        *      if (loif.if_flags & IFF_UP)
+                        * It allowed local traffic to be forced through the
+                        * hardware by configuring the loopback down.  However,
+                        * it causes problems during network configuration
+                        * for boards that can't receive packets they send.
+                        * It is now necessary to clear "useloopback" and
+                        * remove the route to force traffic out to the
+                        * hardware.
+                        */
+                       rt_setexpire(rt, 0);
+                       ifnet_lladdr_copy_bytes(rt->rt_ifp, LLADDR(SDL(gate)),
+                           SDL(gate)->sdl_alen = rt->rt_ifp->if_addrlen);
                        if (useloopback) {
                        if (useloopback) {
-#if IFNET_ROUTE_REFCNT
-                               /* Adjust route ref count for the interfaces */
-                               if (rt->rt_if_ref_fn != NULL &&
-                                   rt->rt_ifp != lo_ifp) {
-                                       rt->rt_if_ref_fn(lo_ifp, 1);
-                                       rt->rt_if_ref_fn(rt->rt_ifp, -1);
+                               if (rt->rt_ifp != lo_ifp) {
+                                       /*
+                                        * Purge any link-layer info caching.
+                                        */
+                                       if (rt->rt_llinfo_purge != NULL)
+                                               rt->rt_llinfo_purge(rt);
+
+                                       /*
+                                        * Adjust route ref count for the
+                                        * interfaces.
+                                        */
+                                       if (rt->rt_if_ref_fn != NULL) {
+                                               rt->rt_if_ref_fn(lo_ifp, 1);
+                                               rt->rt_if_ref_fn(rt->rt_ifp, -1);
+                                       }
                                }
                                }
-#endif /* IFNET_ROUTE_REFCNT */
                                rt->rt_ifp = lo_ifp;
                                rt->rt_ifp = lo_ifp;
+                               /*
+                                * If rmx_mtu is not locked, update it
+                                * to the MTU used by the new interface.
+                                */
+                               if (!(rt->rt_rmx.rmx_locks & RTV_MTU))
+                                       rt->rt_rmx.rmx_mtu = rt->rt_ifp->if_mtu;
                        }
                        }
-
+               } else {
+                       IFA_UNLOCK(rt->rt_ifa);
                }
                break;
 
        case RTM_DELETE:
                }
                break;
 
        case RTM_DELETE:
-               if (la == 0)
+               if (la == NULL)
                        break;
                        break;
-               arp_inuse--;
                /*
                 * Unchain it but defer the actual freeing until the route
                 * itself is to be freed.  rt->rt_llinfo still points to
                /*
                 * Unchain it but defer the actual freeing until the route
                 * itself is to be freed.  rt->rt_llinfo still points to
@@ -466,10 +1063,16 @@ arp_rtrequest(
                LIST_REMOVE(la, la_le);
                la->la_le.le_next = NULL;
                la->la_le.le_prev = NULL;
                LIST_REMOVE(la, la_le);
                la->la_le.le_next = NULL;
                la->la_le.le_prev = NULL;
+               arpstat.inuse--;
+
+               /*
+                * Purge any link-layer info caching.
+                */
+               if (rt->rt_llinfo_purge != NULL)
+                       rt->rt_llinfo_purge(rt);
+
                rt->rt_flags &= ~RTF_LLINFO;
                rt->rt_flags &= ~RTF_LLINFO;
-               if (la->la_hold != NULL)
-                       m_freem(la->la_hold);
-               la->la_hold = NULL;
+               (void) arp_llinfo_flushq(la);
        }
 }
 
        }
 }
 
@@ -477,16 +1080,16 @@ arp_rtrequest(
  * convert hardware address to hex string for logging errors.
  */
 static const char *
  * convert hardware address to hex string for logging errors.
  */
 static const char *
-sdl_addr_to_hex(const struct sockaddr_dl *sdl, char * orig_buf, int buflen)
+sdl_addr_to_hex(const struct sockaddr_dl *sdl, char *orig_buf, int buflen)
 {
 {
-       char *          buf = orig_buf;
-       int             i;
-       const u_char *  lladdr = (u_char *)(size_t)sdl->sdl_data;
-       int                     maxbytes = buflen / 3;
-       
+       char *buf = orig_buf;
+       int i;
+       const u_char *lladdr = (u_char *)(size_t)sdl->sdl_data;
+       int maxbytes = buflen / 3;
+
        if (maxbytes > sdl->sdl_alen) {
                maxbytes = sdl->sdl_alen;
        if (maxbytes > sdl->sdl_alen) {
                maxbytes = sdl->sdl_alen;
-       }       
+       }
        *buf = '\0';
        for (i = 0; i < maxbytes; i++) {
                snprintf(buf, 3, "%02x", lladdr[i]);
        *buf = '\0';
        for (i = 0; i < maxbytes; i++) {
                snprintf(buf, 3, "%02x", lladdr[i]);
@@ -508,7 +1111,8 @@ static errno_t
 arp_lookup_route(const struct in_addr *addr, int create, int proxy,
     route_t *route, unsigned int ifscope)
 {
 arp_lookup_route(const struct in_addr *addr, int create, int proxy,
     route_t *route, unsigned int ifscope)
 {
-       struct sockaddr_inarp sin = {sizeof(sin), AF_INET, 0, {0}, {0}, 0, 0};
+       struct sockaddr_inarp sin =
+           { sizeof (sin), AF_INET, 0, { 0 }, { 0 }, 0, 0 };
        const char *why = NULL;
        errno_t error = 0;
        route_t rt;
        const char *why = NULL;
        errno_t error = 0;
        route_t rt;
@@ -518,7 +1122,14 @@ arp_lookup_route(const struct in_addr *addr, int create, int proxy,
        sin.sin_addr.s_addr = addr->s_addr;
        sin.sin_other = proxy ? SIN_PROXY : 0;
 
        sin.sin_addr.s_addr = addr->s_addr;
        sin.sin_other = proxy ? SIN_PROXY : 0;
 
-       rt = rtalloc1_scoped((struct sockaddr*)&sin, create, 0, ifscope);
+       /*
+        * If the destination is a link-local address, don't
+        * constrain the lookup (don't scope it).
+        */
+       if (IN_LINKLOCAL(ntohl(addr->s_addr)))
+               ifscope = IFSCOPE_NONE;
+
+       rt = rtalloc1_scoped((struct sockaddr *)&sin, create, 0, ifscope);
        if (rt == NULL)
                return (ENETUNREACH);
 
        if (rt == NULL)
                return (ENETUNREACH);
 
@@ -536,10 +1147,10 @@ arp_lookup_route(const struct in_addr *addr, int create, int proxy,
        }
 
        if (error != 0) {
        }
 
        if (error != 0) {
-               if (create && log_arp_warnings) {
+               if (create && (arp_verbose || log_arp_warnings)) {
                        char tmp[MAX_IPv4_STR_LEN];
                        char tmp[MAX_IPv4_STR_LEN];
-                       log(LOG_DEBUG, "arplookup link#%d %s failed: %s\n",
-                           ifscope, inet_ntop(AF_INET, addr, tmp,
+                       log(LOG_DEBUG, "%s: link#%d %s failed: %s\n",
+                           __func__, ifscope, inet_ntop(AF_INET, addr, tmp,
                            sizeof (tmp)), why);
                }
 
                            sizeof (tmp)), why);
                }
 
@@ -560,7 +1171,7 @@ arp_lookup_route(const struct in_addr *addr, int create, int proxy,
                        rt->rt_flags |= RTF_CONDEMNED;
                        RT_UNLOCK(rt);
                        rtrequest(RTM_DELETE, rt_key(rt), rt->rt_gateway,
                        rt->rt_flags |= RTF_CONDEMNED;
                        RT_UNLOCK(rt);
                        rtrequest(RTM_DELETE, rt_key(rt), rt->rt_gateway,
-                           rt_mask(rt), rt->rt_flags, 0);
+                           rt_mask(rt), rt->rt_flags, NULL);
                        rtfree(rt);
                } else {
                        RT_REMREF_LOCKED(rt);
                        rtfree(rt);
                } else {
                        RT_REMREF_LOCKED(rt);
@@ -576,189 +1187,18 @@ arp_lookup_route(const struct in_addr *addr, int create, int proxy,
        return (0);
 }
 
        return (0);
 }
 
-/*
- * arp_route_to_gateway_route will find the gateway route for a given route.
- *
- * If the route is down, look the route up again.
- * If the route goes through a gateway, get the route to the gateway.
- * If the gateway route is down, look it up again.
- * If the route is set to reject, verify it hasn't expired.
- *
- * If the returned route is non-NULL, the caller is responsible for
- * releasing the reference and unlocking the route.
- */
-#define senderr(e) { error = (e); goto bad; }
-__private_extern__ errno_t
-arp_route_to_gateway_route(const struct sockaddr *net_dest, route_t hint0,
-     route_t *out_route)
+boolean_t
+arp_is_entry_probing (route_t p_route)
 {
 {
-       struct timeval timenow;
-       route_t rt = hint0, hint = hint0;
-       errno_t error = 0;
+       struct llinfo_arp *llinfo = p_route->rt_llinfo;
 
 
-       *out_route = NULL;
+       if (llinfo != NULL &&
+           llinfo->la_llreach != NULL &&
+           llinfo->la_llreach->lr_probes != 0)
+               return (TRUE);
 
 
-       /*
-        * Next hop determination.  Because we may involve the gateway route
-        * in addition to the original route, locking is rather complicated.
-        * The general concept is that regardless of whether the route points
-        * to the original route or to the gateway route, this routine takes
-        * an extra reference on such a route.  This extra reference will be
-        * released at the end.
-        *
-        * Care must be taken to ensure that the "hint0" route never gets freed
-        * via rtfree(), since the caller may have stored it inside a struct
-        * route with a reference held for that placeholder.
-        */
-       if (rt != NULL) {
-               unsigned int ifindex;
-
-               RT_LOCK_SPIN(rt);
-               ifindex = rt->rt_ifp->if_index;
-               RT_ADDREF_LOCKED(rt);
-               if (!(rt->rt_flags & RTF_UP)) {
-                       RT_REMREF_LOCKED(rt);
-                       RT_UNLOCK(rt);
-                       /* route is down, find a new one */
-                       hint = rt = rtalloc1_scoped((struct sockaddr *)
-                           (size_t)net_dest, 1, 0, ifindex);
-                       if (hint != NULL) {
-                               RT_LOCK_SPIN(rt);
-                               ifindex = rt->rt_ifp->if_index;
-                       } else {
-                               senderr(EHOSTUNREACH);
-                       }
-               }
-
-               /*
-                * We have a reference to "rt" by now; it will either
-                * be released or freed at the end of this routine.
-                */
-               RT_LOCK_ASSERT_HELD(rt);
-               if (rt->rt_flags & RTF_GATEWAY) {
-                       struct rtentry *gwrt = rt->rt_gwroute;
-                       struct sockaddr_in gw;
-
-                       /* If there's no gateway rt, look it up */
-                       if (gwrt == NULL) {
-                               gw = *((struct sockaddr_in *)rt->rt_gateway);
-                               RT_UNLOCK(rt);
-                               goto lookup;
-                       }
-                       /* Become a regular mutex */
-                       RT_CONVERT_LOCK(rt);
-
-                       /*
-                        * Take gwrt's lock while holding route's lock;
-                        * this is okay since gwrt never points back
-                        * to "rt", so no lock ordering issues.
-                        */
-                       RT_LOCK_SPIN(gwrt);
-                       if (!(gwrt->rt_flags & RTF_UP)) {
-                               struct rtentry *ogwrt;
-
-                               rt->rt_gwroute = NULL;
-                               RT_UNLOCK(gwrt);
-                               gw = *((struct sockaddr_in *)rt->rt_gateway);
-                               RT_UNLOCK(rt);
-                               rtfree(gwrt);
-lookup:
-                               gwrt = rtalloc1_scoped(
-                                   (struct sockaddr *)&gw, 1, 0, ifindex);
-
-                               RT_LOCK(rt);
-                               /*
-                                * Bail out if the route is down, no route
-                                * to gateway, circular route, or if the
-                                * gateway portion of "rt" has changed.
-                                */
-                               if (!(rt->rt_flags & RTF_UP) ||
-                                   gwrt == NULL || gwrt == rt ||
-                                   !equal(SA(&gw), rt->rt_gateway)) {
-                                       if (gwrt == rt) {
-                                               RT_REMREF_LOCKED(gwrt);
-                                               gwrt = NULL;
-                                       }
-                                       RT_UNLOCK(rt);
-                                       if (gwrt != NULL)
-                                               rtfree(gwrt);
-                                       senderr(EHOSTUNREACH);
-                               }
-
-                               /* Remove any existing gwrt */
-                               ogwrt = rt->rt_gwroute;
-                               if ((rt->rt_gwroute = gwrt) != NULL)
-                                       RT_ADDREF(gwrt);
-
-                               /* Clean up "rt" now while we can */
-                               if (rt == hint0) {
-                                       RT_REMREF_LOCKED(rt);
-                                       RT_UNLOCK(rt);
-                               } else {
-                                       RT_UNLOCK(rt);
-                                       rtfree(rt);
-                               }
-                               rt = gwrt;
-                               /* Now free the replaced gwrt */
-                               if (ogwrt != NULL)
-                                       rtfree(ogwrt);
-                               /* If still no route to gateway, bail out */
-                               if (rt == NULL)
-                                       senderr(EHOSTUNREACH);
-                       } else {
-                               RT_ADDREF_LOCKED(gwrt);
-                               RT_UNLOCK(gwrt);
-                               /* Clean up "rt" now while we can */
-                               if (rt == hint0) {
-                                       RT_REMREF_LOCKED(rt);
-                                       RT_UNLOCK(rt);
-                               } else {
-                                       RT_UNLOCK(rt);
-                                       rtfree(rt);
-                               }
-                               rt = gwrt;
-                       }
-
-                       /* rt == gwrt; if it is now down, give up */
-                       RT_LOCK_SPIN(rt);
-                       if (!(rt->rt_flags & RTF_UP)) {
-                               RT_UNLOCK(rt);
-                               senderr(EHOSTUNREACH);
-                       }
-               }
-
-               if (rt->rt_flags & RTF_REJECT) {
-                       getmicrotime(&timenow);
-                       if (rt->rt_rmx.rmx_expire == 0 ||
-                           timenow.tv_sec < rt->rt_rmx.rmx_expire) {
-                               RT_UNLOCK(rt);
-                               senderr(rt == hint ? EHOSTDOWN : EHOSTUNREACH);
-                       }
-               }
-
-               /* Become a regular mutex */
-               RT_CONVERT_LOCK(rt);
-
-               /* Caller is responsible for cleaning up "rt" */
-               *out_route = rt;
-       }
-       return (0);
-
-bad:
-       /* Clean up route (either it is "rt" or "gwrt") */
-       if (rt != NULL) {
-               RT_LOCK_SPIN(rt);
-               if (rt == hint0) {
-                       RT_REMREF_LOCKED(rt);
-                       RT_UNLOCK(rt);
-               } else {
-                       RT_UNLOCK(rt);
-                       rtfree(rt);
-               }
-       }
-       return (error);
+       return (FALSE);
 }
 }
-#undef senderr
 
 /*
  * This is the ARP pre-output routine; care must be taken to ensure that
 
 /*
  * This is the ARP pre-output routine; care must be taken to ensure that
@@ -773,9 +1213,19 @@ arp_lookup_ip(ifnet_t ifp, const struct sockaddr_in *net_dest,
 {
        route_t route = NULL;   /* output route */
        errno_t result = 0;
 {
        route_t route = NULL;   /* output route */
        errno_t result = 0;
-       struct sockaddr_dl      *gateway;
-       struct llinfo_arp       *llinfo;
-       struct timeval timenow;
+       struct sockaddr_dl *gateway;
+       struct llinfo_arp *llinfo = NULL;
+       boolean_t usable, probing = FALSE;
+       uint64_t timenow;
+       struct if_llreach *lr;
+       struct ifaddr *rt_ifa;
+       struct sockaddr *sa;
+       uint32_t rtflags;
+       struct sockaddr_dl sdl;
+       boolean_t send_probe_notif = FALSE;
+
+       if (ifp == NULL || net_dest == NULL)
+               return (EINVAL);
 
        if (net_dest->sin_family != AF_INET)
                return (EAFNOSUPPORT);
 
        if (net_dest->sin_family != AF_INET)
                return (EAFNOSUPPORT);
@@ -791,7 +1241,7 @@ arp_lookup_ip(ifnet_t ifp, const struct sockaddr_in *net_dest,
                 * Callee holds a reference on the route and returns
                 * with the route entry locked, upon success.
                 */
                 * Callee holds a reference on the route and returns
                 * with the route entry locked, upon success.
                 */
-               result = arp_route_to_gateway_route((const struct sockaddr*)
+               result = route_to_gwroute((const struct sockaddr *)
                    net_dest, hint, &route);
                if (result != 0)
                        return (result);
                    net_dest, hint, &route);
                if (result != 0)
                        return (result);
@@ -799,8 +1249,9 @@ arp_lookup_ip(ifnet_t ifp, const struct sockaddr_in *net_dest,
                        RT_LOCK_ASSERT_HELD(route);
        }
 
                        RT_LOCK_ASSERT_HELD(route);
        }
 
-       if (packet->m_flags & M_BCAST) {
-               size_t  broadcast_len;
+       if ((packet != NULL && (packet->m_flags & M_BCAST)) ||
+           in_broadcast(net_dest->sin_addr, ifp)) {
+               size_t broadcast_len;
                bzero(ll_dest, ll_dest_len);
                result = ifnet_llbroadcast_copy_bytes(ifp, LLADDR(ll_dest),
                    ll_dest_len - offsetof(struct sockaddr_dl, sdl_data),
                bzero(ll_dest, ll_dest_len);
                result = ifnet_llbroadcast_copy_bytes(ifp, LLADDR(ll_dest),
                    ll_dest_len - offsetof(struct sockaddr_dl, sdl_data),
@@ -808,16 +1259,18 @@ arp_lookup_ip(ifnet_t ifp, const struct sockaddr_in *net_dest,
                if (result == 0) {
                        ll_dest->sdl_alen = broadcast_len;
                        ll_dest->sdl_family = AF_LINK;
                if (result == 0) {
                        ll_dest->sdl_alen = broadcast_len;
                        ll_dest->sdl_family = AF_LINK;
-                       ll_dest->sdl_len = sizeof(struct sockaddr_dl);
+                       ll_dest->sdl_len = sizeof (struct sockaddr_dl);
                }
                goto release;
        }
                }
                goto release;
        }
-       if (packet->m_flags & M_MCAST) {
+       if ((packet != NULL && (packet->m_flags & M_MCAST)) ||
+           ((ifp->if_flags & IFF_MULTICAST) &&
+           IN_MULTICAST(ntohl(net_dest->sin_addr.s_addr)))) {
                if (route != NULL)
                        RT_UNLOCK(route);
                result = dlil_resolve_multi(ifp,
                if (route != NULL)
                        RT_UNLOCK(route);
                result = dlil_resolve_multi(ifp,
-                   (const struct sockaddr*)net_dest,
-                   (struct sockaddr*)ll_dest, ll_dest_len);
+                   (const struct sockaddr *)net_dest,
+                   (struct sockaddr *)ll_dest, ll_dest_len);
                if (route != NULL)
                        RT_LOCK(route);
                goto release;
                if (route != NULL)
                        RT_LOCK(route);
                goto release;
@@ -849,18 +1302,17 @@ arp_lookup_ip(ifnet_t ifp, const struct sockaddr_in *net_dest,
                        RT_LOCK_ASSERT_HELD(route);
        }
 
                        RT_LOCK_ASSERT_HELD(route);
        }
 
-       if (result || route == NULL || route->rt_llinfo == NULL) {
-               char    tmp[MAX_IPv4_STR_LEN];
-
+       if (result || route == NULL || (llinfo = route->rt_llinfo) == NULL) {
                /* In case result is 0 but no route, return an error */
                if (result == 0)
                        result = EHOSTUNREACH;
 
                /* In case result is 0 but no route, return an error */
                if (result == 0)
                        result = EHOSTUNREACH;
 
-               if (log_arp_warnings &&
-                   route != NULL && route->rt_llinfo == NULL)
-                       log(LOG_DEBUG, "arpresolve: can't allocate llinfo "
-                           "for %s\n", inet_ntop(AF_INET, &net_dest->sin_addr,
-                           tmp, sizeof(tmp)));
+               if (route != NULL && route->rt_llinfo == NULL) {
+                       char tmp[MAX_IPv4_STR_LEN];
+                       log(LOG_ERR, "%s: can't allocate llinfo for %s\n",
+                           __func__, inet_ntop(AF_INET, &net_dest->sin_addr,
+                           tmp, sizeof (tmp)));
+               }
                goto release;
        }
 
                goto release;
        }
 
@@ -868,13 +1320,88 @@ arp_lookup_ip(ifnet_t ifp, const struct sockaddr_in *net_dest,
         * Now that we have the right route, is it filled in?
         */
        gateway = SDL(route->rt_gateway);
         * Now that we have the right route, is it filled in?
         */
        gateway = SDL(route->rt_gateway);
-       getmicrotime(&timenow);
-       if ((route->rt_rmx.rmx_expire == 0 ||
-           route->rt_rmx.rmx_expire > timenow.tv_sec) && gateway != NULL &&
-           gateway->sdl_family == AF_LINK && gateway->sdl_alen != 0) {
+       timenow = net_uptime();
+       VERIFY(route->rt_expire == 0 || route->rt_rmx.rmx_expire != 0);
+       VERIFY(route->rt_expire != 0 || route->rt_rmx.rmx_expire == 0);
+
+       usable = ((route->rt_expire == 0 || route->rt_expire > timenow) &&
+           gateway != NULL && gateway->sdl_family == AF_LINK &&
+           gateway->sdl_alen != 0);
+
+       if (usable) {
+               boolean_t unreachable = !arp_llreach_reachable(llinfo);
+
+               /* Entry is usable, so fill in info for caller */
                bcopy(gateway, ll_dest, MIN(gateway->sdl_len, ll_dest_len));
                result = 0;
                bcopy(gateway, ll_dest, MIN(gateway->sdl_len, ll_dest_len));
                result = 0;
-               goto release;
+               arp_llreach_use(llinfo);        /* Mark use timestamp */
+
+               lr = llinfo->la_llreach;
+               if (lr == NULL)
+                       goto release;
+               rt_ifa = route->rt_ifa;
+
+               /* Become a regular mutex, just in case */
+               RT_CONVERT_LOCK(route);
+               IFLR_LOCK_SPIN(lr);
+
+               if ((unreachable || (llinfo->la_flags & LLINFO_PROBING)) &&
+                   lr->lr_probes < arp_unicast_lim) {
+                       /*
+                        * Thus mark the entry with la_probeexp deadline to
+                        * trigger the probe timer to be scheduled (if not
+                        * already).  This gets cleared the moment we get
+                        * an ARP reply.
+                        */
+                       probing = TRUE;
+                       if (lr->lr_probes == 0) {
+                               llinfo->la_probeexp = (timenow + arpt_probe);
+                               llinfo->la_flags |= LLINFO_PROBING;
+                               /*
+                                * Provide notification that ARP unicast
+                                * probing has started.
+                                * We only do it for the first unicast probe
+                                * attempt.
+                                */
+                               send_probe_notif = TRUE;
+                       }
+
+                       /*
+                        * Start the unicast probe and anticipate a reply;
+                        * afterwards, return existing entry to caller and
+                        * let it be used anyway.  If peer is non-existent
+                        * we'll broadcast ARP next time around.
+                        */
+                       lr->lr_probes++;
+                       bzero(&sdl, sizeof (sdl));
+                       sdl.sdl_alen = ifp->if_addrlen;
+                       bcopy(&lr->lr_key.addr, LLADDR(&sdl),
+                           ifp->if_addrlen);
+                       IFLR_UNLOCK(lr);
+                       IFA_LOCK_SPIN(rt_ifa);
+                       IFA_ADDREF_LOCKED(rt_ifa);
+                       sa = rt_ifa->ifa_addr;
+                       IFA_UNLOCK(rt_ifa);
+                       rtflags = route->rt_flags;
+                       RT_UNLOCK(route);
+                       dlil_send_arp(ifp, ARPOP_REQUEST, NULL, sa,
+                           (const struct sockaddr_dl *)&sdl,
+                           (const struct sockaddr *)net_dest, rtflags);
+                       IFA_REMREF(rt_ifa);
+                       RT_LOCK(route);
+                       goto release;
+               } else {
+                       IFLR_UNLOCK(lr);
+                       if (!unreachable &&
+                           !(llinfo->la_flags & LLINFO_PROBING)) {
+                               /*
+                                * Normal case where peer is still reachable,
+                                * we're not probing and if_addrlen is anything
+                                * but IF_LLREACH_MAXLEN.
+                                */
+                               goto release;
+                       }
+               }
        }
 
        if (ifp->if_flags & IFF_NOARP) {
        }
 
        if (ifp->if_flags & IFF_NOARP) {
@@ -883,48 +1410,153 @@ arp_lookup_ip(ifnet_t ifp, const struct sockaddr_in *net_dest,
        }
 
        /*
        }
 
        /*
-        * Route wasn't complete/valid. We need to arp.
+        * Route wasn't complete/valid; we need to send out ARP request.
+        * If we've exceeded the limit of la_holdq, drop from the head
+        * of queue and add this packet to the tail.  If we end up with
+        * RTF_REJECT below, we'll dequeue this from tail and have the
+        * caller free the packet instead.  It's safe to do that since
+        * we still hold the route's rt_lock.
         */
         */
-       llinfo = route->rt_llinfo;
-       if (packet != NULL) {
-               if (llinfo->la_hold != NULL)
-                       m_freem(llinfo->la_hold);
-               llinfo->la_hold = packet;
+       if (packet != NULL)
+               arp_llinfo_addq(llinfo, packet);
+       else
+               llinfo->la_prbreq_cnt++;
+       /*
+        * Regardless of permanent vs. expirable entry, we need to
+        * avoid having packets sit in la_holdq forever; thus mark the
+        * entry with la_probeexp deadline to trigger the probe timer
+        * to be scheduled (if not already).  This gets cleared the
+        * moment we get an ARP reply.
+        */
+       probing = TRUE;
+       if ((qlen(&llinfo->la_holdq) + llinfo->la_prbreq_cnt) == 1) {
+               llinfo->la_probeexp = (timenow + arpt_probe);
+               llinfo->la_flags |= LLINFO_PROBING;
        }
 
        }
 
-       if (route->rt_rmx.rmx_expire) {
+       if (route->rt_expire) {
                route->rt_flags &= ~RTF_REJECT;
                route->rt_flags &= ~RTF_REJECT;
-               if (llinfo->la_asked == 0 ||
-                   route->rt_rmx.rmx_expire != timenow.tv_sec) {
-                       route->rt_rmx.rmx_expire = timenow.tv_sec;
-                       if (llinfo->la_asked++ < arp_maxtries) {
-                               struct ifaddr *rt_ifa = route->rt_ifa;
-                               ifaref(rt_ifa);
+               if (llinfo->la_asked == 0 || route->rt_expire != timenow) {
+                       rt_setexpire(route, timenow);
+                       if (llinfo->la_asked++ < llinfo->la_maxtries) {
+                               struct kev_msg ev_msg;
+                               struct kev_in_arpfailure in_arpfailure;
+                               boolean_t sendkev = FALSE;
+
+                               rt_ifa = route->rt_ifa;
+                               lr = llinfo->la_llreach;
+                               /* Become a regular mutex, just in case */
+                               RT_CONVERT_LOCK(route);
+                               /* Update probe count, if applicable */
+                               if (lr != NULL) {
+                                       IFLR_LOCK_SPIN(lr);
+                                       lr->lr_probes++;
+                                       IFLR_UNLOCK(lr);
+                               }
+                               if (ifp->if_addrlen == IF_LLREACH_MAXLEN &&
+                                   route->rt_flags & RTF_ROUTER &&
+                                   llinfo->la_asked > 1) {
+                                       sendkev = TRUE;
+                                       llinfo->la_flags |= LLINFO_RTRFAIL_EVTSENT;
+                               }
+                               IFA_LOCK_SPIN(rt_ifa);
+                               IFA_ADDREF_LOCKED(rt_ifa);
+                               sa = rt_ifa->ifa_addr;
+                               IFA_UNLOCK(rt_ifa);
+                               arp_llreach_use(llinfo); /* Mark use tstamp */
+                               rtflags = route->rt_flags;
                                RT_UNLOCK(route);
                                RT_UNLOCK(route);
-                               dlil_send_arp(ifp, ARPOP_REQUEST, NULL,
-                                   rt_ifa->ifa_addr, NULL,
-                                   (const struct sockaddr*)net_dest);
-                               ifafree(rt_ifa);
-                               RT_LOCK(route);
+                               dlil_send_arp(ifp, ARPOP_REQUEST, NULL, sa,
+                                   NULL, (const struct sockaddr *)net_dest,
+                                   rtflags);
+                               IFA_REMREF(rt_ifa);
+                               if (sendkev) {
+                                       bzero(&ev_msg, sizeof(ev_msg));
+                                       bzero(&in_arpfailure,
+                                           sizeof(in_arpfailure));
+                                       in_arpfailure.link_data.if_family =
+                                           ifp->if_family;
+                                       in_arpfailure.link_data.if_unit =
+                                           ifp->if_unit;
+                                       strlcpy(in_arpfailure.link_data.if_name,
+                                           ifp->if_name, IFNAMSIZ);
+                                       ev_msg.vendor_code = KEV_VENDOR_APPLE;
+                                       ev_msg.kev_class = KEV_NETWORK_CLASS;
+                                       ev_msg.kev_subclass = KEV_INET_SUBCLASS;
+                                       ev_msg.event_code =
+                                           KEV_INET_ARPRTRFAILURE;
+                                       ev_msg.dv[0].data_ptr = &in_arpfailure;
+                                       ev_msg.dv[0].data_length =
+                                           sizeof(struct
+                                               kev_in_arpfailure);
+                                       dlil_post_complete_msg(NULL, &ev_msg);
+                               }
                                result = EJUSTRETURN;
                                result = EJUSTRETURN;
+                               RT_LOCK(route);
                                goto release;
                        } else {
                                route->rt_flags |= RTF_REJECT;
                                goto release;
                        } else {
                                route->rt_flags |= RTF_REJECT;
-                               route->rt_rmx.rmx_expire = rt_expiry(route,
-                                   route->rt_rmx.rmx_expire, arpt_down);
+                               rt_setexpire(route,
+                                   route->rt_expire + arpt_down);
                                llinfo->la_asked = 0;
                                llinfo->la_asked = 0;
-                               llinfo->la_hold = NULL;
+                               /*
+                                * Remove the packet that was just added above;
+                                * don't free it since we're not returning
+                                * EJUSTRETURN.  The caller will handle the
+                                * freeing.  Since we haven't dropped rt_lock
+                                * from the time of _addq() above, this packet
+                                * must be at the tail.
+                                */
+                               if (packet != NULL) {
+                                       struct mbuf *_m =
+                                           _getq_tail(&llinfo->la_holdq);
+                                       atomic_add_32(&arpstat.held, -1);
+                                       VERIFY(_m == packet);
+                               }
                                result = EHOSTUNREACH;
                                result = EHOSTUNREACH;
+
+                               /*
+                                * Enqueue work item to invoke callback for this route entry
+                                */
+                               route_event_enqueue_nwk_wq_entry(route, NULL,
+                                   ROUTE_LLENTRY_UNREACH, NULL, TRUE);
                                goto release;
                        }
                }
        }
 
                                goto release;
                        }
                }
        }
 
-       /* The packet is now held inside la_hold (can "packet" be NULL?) */
+       /* The packet is now held inside la_holdq */
        result = EJUSTRETURN;
 
 release:
        result = EJUSTRETURN;
 
 release:
+       if (result == EHOSTUNREACH)
+               atomic_add_32(&arpstat.dropped, 1);
+
        if (route != NULL) {
        if (route != NULL) {
+               if (send_probe_notif) {
+                       route_event_enqueue_nwk_wq_entry(route, NULL,
+                           ROUTE_LLENTRY_PROBED, NULL, TRUE);
+
+                       if (route->rt_flags & RTF_ROUTER) {
+                               struct radix_node_head  *rnh = NULL;
+                               struct route_event rt_ev;
+                               route_event_init(&rt_ev, route, NULL, ROUTE_LLENTRY_PROBED);
+                               /*
+                                * We already have a reference on rt. The function
+                                * frees it before returning.
+                                */
+                               RT_UNLOCK(route);
+                               lck_mtx_lock(rnh_lock);
+                               rnh = rt_tables[AF_INET];
+
+                               if (rnh != NULL)
+                                       (void) rnh->rnh_walktree(rnh,
+                                           route_event_walktree, (void *)&rt_ev);
+                               lck_mtx_unlock(rnh_lock);
+                               RT_LOCK(route);
+                       }
+               }
+
                if (route == hint) {
                        RT_REMREF_LOCKED(route);
                        RT_UNLOCK(route);
                if (route == hint) {
                        RT_REMREF_LOCKED(route);
                        RT_UNLOCK(route);
@@ -933,70 +1565,93 @@ release:
                        rtfree(route);
                }
        }
                        rtfree(route);
                }
        }
+       if (probing) {
+               /* Do this after we drop rt_lock to preserve ordering */
+               lck_mtx_lock(rnh_lock);
+               arp_sched_probe(NULL);
+               lck_mtx_unlock(rnh_lock);
+       }
        return (result);
 }
 
 errno_t
        return (result);
 }
 
 errno_t
-arp_ip_handle_input(
-       ifnet_t         ifp,
-       u_short         arpop,
-       const struct sockaddr_dl *sender_hw,
-       const struct sockaddr_in *sender_ip,
-       const struct sockaddr_in *target_ip)
+arp_ip_handle_input(ifnet_t ifp, u_short arpop,
+    const struct sockaddr_dl *sender_hw, const struct sockaddr_in *sender_ip,
+    const struct sockaddr_in *target_ip)
 {
 {
-       char    ipv4str[MAX_IPv4_STR_LEN];
+       char ipv4str[MAX_IPv4_STR_LEN];
        struct sockaddr_dl proxied;
        struct sockaddr_dl *gateway, *target_hw = NULL;
        struct ifaddr *ifa;
        struct in_ifaddr *ia;
        struct in_ifaddr *best_ia = NULL;
        struct sockaddr_dl proxied;
        struct sockaddr_dl *gateway, *target_hw = NULL;
        struct ifaddr *ifa;
        struct in_ifaddr *ia;
        struct in_ifaddr *best_ia = NULL;
+       struct sockaddr_in best_ia_sin;
        route_t route = NULL;
        route_t route = NULL;
-       char buf[3 * MAX_HW_LEN]; // enough for MAX_HW_LEN byte hw address
+       char buf[3 * MAX_HW_LEN]; /* enough for MAX_HW_LEN byte hw address */
        struct llinfo_arp *llinfo;
        errno_t error;
        int created_announcement = 0;
        int bridged = 0, is_bridge = 0;
        struct llinfo_arp *llinfo;
        errno_t error;
        int created_announcement = 0;
        int bridged = 0, is_bridge = 0;
-       
+       uint32_t rt_evcode = 0;
+
+       /*
+        * Here and other places within this routine where we don't hold
+        * rnh_lock, trade accuracy for speed for the common scenarios
+        * and avoid the use of atomic updates.
+        */
+       arpstat.received++;
+
        /* Do not respond to requests for 0.0.0.0 */
        /* Do not respond to requests for 0.0.0.0 */
-       if (target_ip->sin_addr.s_addr == 0 && arpop == ARPOP_REQUEST)
+       if (target_ip->sin_addr.s_addr == INADDR_ANY && arpop == ARPOP_REQUEST)
                goto done;
                goto done;
-       
-       if (ifp->if_bridge)
+
+       if (ifp->if_bridge)
                bridged = 1;
        if (ifp->if_type == IFT_BRIDGE)
                is_bridge = 1;
 
                bridged = 1;
        if (ifp->if_type == IFT_BRIDGE)
                is_bridge = 1;
 
+       if (arpop == ARPOP_REPLY)
+               arpstat.rxreplies++;
+
        /*
         * Determine if this ARP is for us
        /*
         * Determine if this ARP is for us
-        * For a bridge, we want to check the address irrespective 
+        * For a bridge, we want to check the address irrespective
         * of the receive interface.
         */
        lck_rw_lock_shared(in_ifaddr_rwlock);
        TAILQ_FOREACH(ia, INADDR_HASH(target_ip->sin_addr.s_addr), ia_hash) {
         * of the receive interface.
         */
        lck_rw_lock_shared(in_ifaddr_rwlock);
        TAILQ_FOREACH(ia, INADDR_HASH(target_ip->sin_addr.s_addr), ia_hash) {
+               IFA_LOCK_SPIN(&ia->ia_ifa);
                if (((bridged && ia->ia_ifp->if_bridge != NULL) ||
                if (((bridged && ia->ia_ifp->if_bridge != NULL) ||
-                       (ia->ia_ifp == ifp)) &&
+                   (ia->ia_ifp == ifp)) &&
                    ia->ia_addr.sin_addr.s_addr == target_ip->sin_addr.s_addr) {
                    ia->ia_addr.sin_addr.s_addr == target_ip->sin_addr.s_addr) {
-                               best_ia = ia;
-                               ifaref(&best_ia->ia_ifa);
-                               lck_rw_done(in_ifaddr_rwlock);
-                               goto match;
+                       best_ia = ia;
+                       best_ia_sin = best_ia->ia_addr;
+                       IFA_ADDREF_LOCKED(&ia->ia_ifa);
+                       IFA_UNLOCK(&ia->ia_ifa);
+                       lck_rw_done(in_ifaddr_rwlock);
+                       goto match;
                }
                }
+               IFA_UNLOCK(&ia->ia_ifa);
        }
 
        TAILQ_FOREACH(ia, INADDR_HASH(sender_ip->sin_addr.s_addr), ia_hash) {
        }
 
        TAILQ_FOREACH(ia, INADDR_HASH(sender_ip->sin_addr.s_addr), ia_hash) {
+               IFA_LOCK_SPIN(&ia->ia_ifa);
                if (((bridged && ia->ia_ifp->if_bridge != NULL) ||
                if (((bridged && ia->ia_ifp->if_bridge != NULL) ||
-                       (ia->ia_ifp == ifp)) &&
+                   (ia->ia_ifp == ifp)) &&
                    ia->ia_addr.sin_addr.s_addr == sender_ip->sin_addr.s_addr) {
                    ia->ia_addr.sin_addr.s_addr == sender_ip->sin_addr.s_addr) {
-                               best_ia = ia;
-                               ifaref(&best_ia->ia_ifa);
-                               lck_rw_done(in_ifaddr_rwlock);
-                               goto match;
+                       best_ia = ia;
+                       best_ia_sin = best_ia->ia_addr;
+                       IFA_ADDREF_LOCKED(&ia->ia_ifa);
+                       IFA_UNLOCK(&ia->ia_ifa);
+                       lck_rw_done(in_ifaddr_rwlock);
+                       goto match;
                }
                }
+               IFA_UNLOCK(&ia->ia_ifa);
        }
 
        }
 
-#define BDG_MEMBER_MATCHES_ARP(addr, ifp, ia)                                                          \
-       (ia->ia_ifp->if_bridge == ifp->if_softc &&                                                              \
-       !bcmp(ifnet_lladdr(ia->ia_ifp), ifnet_lladdr(ifp), ifp->if_addrlen) &&  \
+#define        BDG_MEMBER_MATCHES_ARP(addr, ifp, ia)                                \
+       (ia->ia_ifp->if_bridge == ifp->if_softc &&                           \
+       bcmp(IF_LLADDR(ia->ia_ifp), IF_LLADDR(ifp), ifp->if_addrlen) == 0 && \
        addr == ia->ia_addr.sin_addr.s_addr)
        /*
         * Check the case when bridge shares its MAC address with
        addr == ia->ia_addr.sin_addr.s_addr)
        /*
         * Check the case when bridge shares its MAC address with
@@ -1005,16 +1660,23 @@ arp_ip_handle_input(
         * meant to be destined to the bridge member.
         */
        if (is_bridge) {
         * meant to be destined to the bridge member.
         */
        if (is_bridge) {
-               TAILQ_FOREACH(ia, INADDR_HASH(target_ip->sin_addr.s_addr), ia_hash) {
-                       if (BDG_MEMBER_MATCHES_ARP(target_ip->sin_addr.s_addr, ifp, ia)) {
+               TAILQ_FOREACH(ia, INADDR_HASH(target_ip->sin_addr.s_addr),
+                   ia_hash) {
+                       IFA_LOCK_SPIN(&ia->ia_ifa);
+                       if (BDG_MEMBER_MATCHES_ARP(target_ip->sin_addr.s_addr,
+                           ifp, ia)) {
                                ifp = ia->ia_ifp;
                                best_ia = ia;
                                ifp = ia->ia_ifp;
                                best_ia = ia;
-                               ifaref(&best_ia->ia_ifa);
+                               best_ia_sin = best_ia->ia_addr;
+                               IFA_ADDREF_LOCKED(&ia->ia_ifa);
+                               IFA_UNLOCK(&ia->ia_ifa);
                                lck_rw_done(in_ifaddr_rwlock);
                                goto match;
                        }
                                lck_rw_done(in_ifaddr_rwlock);
                                goto match;
                        }
+                       IFA_UNLOCK(&ia->ia_ifa);
                }
        }
                }
        }
+#undef BDG_MEMBER_MATCHES_ARP
        lck_rw_done(in_ifaddr_rwlock);
 
        /*
        lck_rw_done(in_ifaddr_rwlock);
 
        /*
@@ -1024,10 +1686,15 @@ arp_ip_handle_input(
         */
        ifnet_lock_shared(ifp);
        TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
         */
        ifnet_lock_shared(ifp);
        TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
-               if (ifa->ifa_addr->sa_family != AF_INET)
+               IFA_LOCK_SPIN(ifa);
+               if (ifa->ifa_addr->sa_family != AF_INET) {
+                       IFA_UNLOCK(ifa);
                        continue;
                        continue;
+               }
                best_ia = (struct in_ifaddr *)ifa;
                best_ia = (struct in_ifaddr *)ifa;
-               ifaref(&best_ia->ia_ifa);
+               best_ia_sin = best_ia->ia_addr;
+               IFA_ADDREF_LOCKED(ifa);
+               IFA_UNLOCK(ifa);
                ifnet_lock_done(ifp);
                goto match;
        }
                ifnet_lock_done(ifp);
                goto match;
        }
@@ -1042,37 +1709,46 @@ arp_ip_handle_input(
 
 match:
        /* If the packet is from this interface, ignore the packet */
 
 match:
        /* If the packet is from this interface, ignore the packet */
-       if (!bcmp(CONST_LLADDR(sender_hw), ifnet_lladdr(ifp), sender_hw->sdl_len)) {
+       if (bcmp(CONST_LLADDR(sender_hw), IF_LLADDR(ifp),
+           sender_hw->sdl_alen) == 0)
                goto done;
                goto done;
-       }
 
        /* Check for a conflict */
 
        /* Check for a conflict */
-       if (!bridged && sender_ip->sin_addr.s_addr == best_ia->ia_addr.sin_addr.s_addr) {
-               struct kev_msg        ev_msg;
+       if (!bridged &&
+           sender_ip->sin_addr.s_addr == best_ia_sin.sin_addr.s_addr) {
+               struct kev_msg ev_msg;
                struct kev_in_collision *in_collision;
                struct kev_in_collision *in_collision;
-               u_char  storage[sizeof(struct kev_in_collision) + MAX_HW_LEN];
-               in_collision = (struct kev_in_collision*)storage;
-               log(LOG_ERR, "%s%d duplicate IP address %s sent from address %s\n",
-                       ifp->if_name, ifp->if_unit,
-                       inet_ntop(AF_INET, &sender_ip->sin_addr, ipv4str, sizeof(ipv4str)),
-                       sdl_addr_to_hex(sender_hw, buf, sizeof(buf)));
+               u_char storage[sizeof (struct kev_in_collision) + MAX_HW_LEN];
+
+               bzero(&ev_msg, sizeof (struct kev_msg));
+               bzero(storage, (sizeof (struct kev_in_collision) + MAX_HW_LEN));
+               in_collision = (struct kev_in_collision *)(void *)storage;
+               log(LOG_ERR, "%s duplicate IP address %s sent from "
+                   "address %s\n", if_name(ifp),
+                   inet_ntop(AF_INET, &sender_ip->sin_addr, ipv4str,
+                   sizeof (ipv4str)), sdl_addr_to_hex(sender_hw, buf,
+                   sizeof (buf)));
 
                /* Send a kernel event so anyone can learn of the conflict */
                in_collision->link_data.if_family = ifp->if_family;
                in_collision->link_data.if_unit = ifp->if_unit;
 
                /* Send a kernel event so anyone can learn of the conflict */
                in_collision->link_data.if_family = ifp->if_family;
                in_collision->link_data.if_unit = ifp->if_unit;
-               strncpy(&in_collision->link_data.if_name[0], ifp->if_name, IFNAMSIZ);
+               strlcpy(&in_collision->link_data.if_name[0],
+                   ifp->if_name, IFNAMSIZ);
                in_collision->ia_ipaddr = sender_ip->sin_addr;
                in_collision->ia_ipaddr = sender_ip->sin_addr;
-               in_collision->hw_len = sender_hw->sdl_alen < MAX_HW_LEN ? sender_hw->sdl_alen : MAX_HW_LEN;
-               bcopy(CONST_LLADDR(sender_hw), (caddr_t)in_collision->hw_addr, in_collision->hw_len);
+               in_collision->hw_len = (sender_hw->sdl_alen < MAX_HW_LEN) ?
+                   sender_hw->sdl_alen : MAX_HW_LEN;
+               bcopy(CONST_LLADDR(sender_hw), (caddr_t)in_collision->hw_addr,
+                   in_collision->hw_len);
                ev_msg.vendor_code = KEV_VENDOR_APPLE;
                ev_msg.kev_class = KEV_NETWORK_CLASS;
                ev_msg.kev_subclass = KEV_INET_SUBCLASS;
                ev_msg.event_code = KEV_INET_ARPCOLLISION;
                ev_msg.dv[0].data_ptr = in_collision;
                ev_msg.vendor_code = KEV_VENDOR_APPLE;
                ev_msg.kev_class = KEV_NETWORK_CLASS;
                ev_msg.kev_subclass = KEV_INET_SUBCLASS;
                ev_msg.event_code = KEV_INET_ARPCOLLISION;
                ev_msg.dv[0].data_ptr = in_collision;
-               ev_msg.dv[0].data_length = sizeof(struct kev_in_collision) + in_collision->hw_len;
+               ev_msg.dv[0].data_length =
+                   sizeof (struct kev_in_collision) + in_collision->hw_len;
                ev_msg.dv[1].data_length = 0;
                ev_msg.dv[1].data_length = 0;
-               kev_post_msg(&ev_msg);
-
+               dlil_post_complete_msg(NULL, &ev_msg);
+               atomic_add_32(&arpstat.dupips, 1);
                goto respond;
        }
 
                goto respond;
        }
 
@@ -1083,24 +1759,23 @@ match:
         * entry locked, upon success.
         */
        error = arp_lookup_route(&sender_ip->sin_addr,
         * entry locked, upon success.
         */
        error = arp_lookup_route(&sender_ip->sin_addr,
-           (target_ip->sin_addr.s_addr == best_ia->ia_addr.sin_addr.s_addr &&
+           (target_ip->sin_addr.s_addr == best_ia_sin.sin_addr.s_addr &&
            sender_ip->sin_addr.s_addr != 0), 0, &route, ifp->if_index);
 
        if (error == 0)
                RT_LOCK_ASSERT_HELD(route);
 
            sender_ip->sin_addr.s_addr != 0), 0, &route, ifp->if_index);
 
        if (error == 0)
                RT_LOCK_ASSERT_HELD(route);
 
-       if (error || route == 0 || route->rt_gateway == 0) {
-               if (arpop != ARPOP_REQUEST) {
+       if (error || route == NULL || route->rt_gateway == NULL) {
+               if (arpop != ARPOP_REQUEST)
                        goto respond;
                        goto respond;
-               }
-               if (arp_sendllconflict
-                   && send_conflicting_probes != 0
-                   && (ifp->if_eflags & IFEF_ARPLL) != 0 
-                   && IN_LINKLOCAL(ntohl(target_ip->sin_addr.s_addr))
-                   && sender_ip->sin_addr.s_addr == 0) {
+
+               if (arp_sendllconflict && send_conflicting_probes != 0 &&
+                   (ifp->if_eflags & IFEF_ARPLL) &&
+                   IN_LINKLOCAL(ntohl(target_ip->sin_addr.s_addr)) &&
+                   sender_ip->sin_addr.s_addr == INADDR_ANY) {
                        /*
                        /*
-                        * Verify this ARP probe doesn't conflict with an IPv4LL we know of
-                        * on another interface.
+                        * Verify this ARP probe doesn't conflict with
+                        * an IPv4LL we know of on another interface.
                         */
                        if (route != NULL) {
                                RT_REMREF_LOCKED(route);
                         */
                        if (route != NULL) {
                                RT_REMREF_LOCKED(route);
@@ -1114,66 +1789,76 @@ match:
                        error = arp_lookup_route(&target_ip->sin_addr, 0, 0,
                            &route, ifp->if_index);
 
                        error = arp_lookup_route(&target_ip->sin_addr, 0, 0,
                            &route, ifp->if_index);
 
-                       if (error == 0)
-                               RT_LOCK_ASSERT_HELD(route);
+                       if (error != 0 || route == NULL ||
+                           route->rt_gateway == NULL)
+                               goto respond;
 
 
-                       if (error == 0 && route && route->rt_gateway) {
-                               gateway = SDL(route->rt_gateway);
-                               if (route->rt_ifp != ifp && gateway->sdl_alen != 0 
-                                   && (gateway->sdl_alen != sender_hw->sdl_alen 
-                                       || bcmp(CONST_LLADDR(gateway), CONST_LLADDR(sender_hw),
-                                               gateway->sdl_alen) != 0)) {
-                                       /*
-                                        * A node is probing for an IPv4LL we know exists on a
-                                        * different interface. We respond with a conflicting probe
-                                        * to force the new device to pick a different IPv4LL
-                                        * address.
-                                        */
-                                       if (log_arp_warnings) {
-                                           log(LOG_INFO,
-                                               "arp: %s on %s%d sent probe for %s, already on %s%d\n",
-                                               sdl_addr_to_hex(sender_hw, buf, sizeof(buf)),
-                                               ifp->if_name, ifp->if_unit,
-                                               inet_ntop(AF_INET, &target_ip->sin_addr, ipv4str,
-                                                                 sizeof(ipv4str)),
-                                               route->rt_ifp->if_name, route->rt_ifp->if_unit);
-                                           log(LOG_INFO,
-                                               "arp: sending conflicting probe to %s on %s%d\n",
-                                               sdl_addr_to_hex(sender_hw, buf, sizeof(buf)),
-                                               ifp->if_name, ifp->if_unit);
-                                       }
-                                       /* We're done with the route */
-                                       RT_REMREF_LOCKED(route);
-                                       RT_UNLOCK(route);
-                                       route = NULL;
-                                       /*
-                                        * Send a conservative unicast "ARP probe".
-                                        * This should force the other device to pick a new number.
-                                        * This will not force the device to pick a new number if the device
-                                        * has already assigned that number.
-                                        * This will not imply to the device that we own that address.
-                                        */
-                                       ifnet_lock_shared(ifp);
-                                       ifa = TAILQ_FIRST(&ifp->if_addrhead);
-                                       if (ifa != NULL)
-                                               ifaref(ifa);
-                                       ifnet_lock_done(ifp);
-                                       dlil_send_arp_internal(ifp, ARPOP_REQUEST,
-                                               ifa != NULL ? SDL(ifa->ifa_addr) : NULL,
-                                               (const struct sockaddr*)sender_ip, sender_hw,
-                                               (const struct sockaddr*)target_ip);
-                                       if (ifa != NULL) {
-                                               ifafree(ifa);
-                                               ifa = NULL;
-                                       }
-                               }
+                       RT_LOCK_ASSERT_HELD(route);
+
+                       gateway = SDL(route->rt_gateway);
+                       if (route->rt_ifp != ifp && gateway->sdl_alen != 0 &&
+                           (gateway->sdl_alen != sender_hw->sdl_alen ||
+                           bcmp(CONST_LLADDR(gateway), CONST_LLADDR(sender_hw),
+                           gateway->sdl_alen) != 0)) {
+                               /*
+                                * A node is probing for an IPv4LL we know
+                                * exists on a different interface. We respond
+                                * with a conflicting probe to force the new
+                                * device to pick a different IPv4LL address.
+                                */
+                               if (arp_verbose || log_arp_warnings) {
+                                       log(LOG_INFO, "arp: %s on %s sent "
+                                           "probe for %s, already on %s\n",
+                                           sdl_addr_to_hex(sender_hw, buf,
+                                           sizeof (buf)), if_name(ifp),
+                                           inet_ntop(AF_INET,
+                                           &target_ip->sin_addr, ipv4str,
+                                           sizeof (ipv4str)),
+                                           if_name(route->rt_ifp));
+                                       log(LOG_INFO, "arp: sending "
+                                           "conflicting probe to %s on %s\n",
+                                           sdl_addr_to_hex(sender_hw, buf,
+                                           sizeof (buf)), if_name(ifp));
+                               }
+                               /* Mark use timestamp */
+                               if (route->rt_llinfo != NULL)
+                                       arp_llreach_use(route->rt_llinfo);
+                               /* We're done with the route */
+                               RT_REMREF_LOCKED(route);
+                               RT_UNLOCK(route);
+                               route = NULL;
+                               /*
+                                * Send a conservative unicast "ARP probe".
+                                * This should force the other device to pick
+                                * a new number.  This will not force the
+                                * device to pick a new number if the device
+                                * has already assigned that number.  This will
+                                * not imply to the device that we own that
+                                * address.  The link address is always
+                                * present; it's never freed.
+                                */
+                               ifnet_lock_shared(ifp);
+                               ifa = ifp->if_lladdr;
+                               IFA_ADDREF(ifa);
+                               ifnet_lock_done(ifp);
+                               dlil_send_arp_internal(ifp, ARPOP_REQUEST,
+                                   SDL(ifa->ifa_addr),
+                                   (const struct sockaddr *)sender_ip,
+                                   sender_hw,
+                                   (const struct sockaddr *)target_ip);
+                               IFA_REMREF(ifa);
+                               ifa = NULL;
+                               atomic_add_32(&arpstat.txconflicts, 1);
                        }
                        goto respond;
                        }
                        goto respond;
-               } else if (keep_announcements != 0
-                          && target_ip->sin_addr.s_addr == sender_ip->sin_addr.s_addr) {
-                       /* don't create entry if link-local address and link-local is disabled */
-                       if (!IN_LINKLOCAL(ntohl(sender_ip->sin_addr.s_addr)) 
-                           || (ifp->if_eflags & IFEF_ARPLL) != 0) {
+               } else if (keep_announcements != 0 &&
+                   target_ip->sin_addr.s_addr == sender_ip->sin_addr.s_addr) {
+                       /*
+                        * Don't create entry if link-local address and
+                        * link-local is disabled
+                        */
+                       if (!IN_LINKLOCAL(ntohl(sender_ip->sin_addr.s_addr)) ||
+                           (ifp->if_eflags & IFEF_ARPLL)) {
                                if (route != NULL) {
                                        RT_REMREF_LOCKED(route);
                                        RT_UNLOCK(route);
                                if (route != NULL) {
                                        RT_REMREF_LOCKED(route);
                                        RT_UNLOCK(route);
@@ -1190,37 +1875,38 @@ match:
                                if (error == 0)
                                        RT_LOCK_ASSERT_HELD(route);
 
                                if (error == 0)
                                        RT_LOCK_ASSERT_HELD(route);
 
-                               if (error == 0 && route != NULL && route->rt_gateway != NULL) {
+                               if (error == 0 && route != NULL &&
+                                   route->rt_gateway != NULL)
                                        created_announcement = 1;
                                        created_announcement = 1;
-                               }
                        }
                        }
-                       if (created_announcement == 0) {
+                       if (created_announcement == 0)
                                goto respond;
                                goto respond;
-                       }
                } else {
                        goto respond;
                }
        }
 
        RT_LOCK_ASSERT_HELD(route);
                } else {
                        goto respond;
                }
        }
 
        RT_LOCK_ASSERT_HELD(route);
+       VERIFY(route->rt_expire == 0 || route->rt_rmx.rmx_expire != 0);
+       VERIFY(route->rt_expire != 0 || route->rt_rmx.rmx_expire == 0);
+
        gateway = SDL(route->rt_gateway);
        if (!bridged && route->rt_ifp != ifp) {
        gateway = SDL(route->rt_gateway);
        if (!bridged && route->rt_ifp != ifp) {
-               if (!IN_LINKLOCAL(ntohl(sender_ip->sin_addr.s_addr)) || (ifp->if_eflags & IFEF_ARPLL) == 0) {
-                       if (log_arp_warnings)
-                               log(LOG_ERR, "arp: %s is on %s%d but got reply from %s on %s%d\n",
-                                       inet_ntop(AF_INET, &sender_ip->sin_addr, ipv4str,
-                                                         sizeof(ipv4str)),
-                                       route->rt_ifp->if_name,
-                                       route->rt_ifp->if_unit,
-                                       sdl_addr_to_hex(sender_hw, buf, sizeof(buf)),
-                                       ifp->if_name, ifp->if_unit);
+               if (!IN_LINKLOCAL(ntohl(sender_ip->sin_addr.s_addr)) ||
+                   !(ifp->if_eflags & IFEF_ARPLL)) {
+                       if (arp_verbose || log_arp_warnings)
+                               log(LOG_ERR, "arp: %s is on %s but got "
+                                   "reply from %s on %s\n",
+                                   inet_ntop(AF_INET, &sender_ip->sin_addr,
+                                   ipv4str, sizeof (ipv4str)),
+                                   if_name(route->rt_ifp),
+                                   sdl_addr_to_hex(sender_hw, buf,
+                                   sizeof (buf)), if_name(ifp));
                        goto respond;
                        goto respond;
-               }
-               else {
+               } else {
                        /* Don't change a permanent address */
                        /* Don't change a permanent address */
-                       if (route->rt_rmx.rmx_expire == 0) {
+                       if (route->rt_expire == 0)
                                goto respond;
                                goto respond;
-                       }
 
                        /*
                         * We're about to check and/or change the route's ifp
 
                        /*
                         * We're about to check and/or change the route's ifp
@@ -1240,7 +1926,8 @@ match:
                         * accessed now that we have acquired rnh_lock.
                         */
                        gateway = SDL(route->rt_gateway);
                         * accessed now that we have acquired rnh_lock.
                         */
                        gateway = SDL(route->rt_gateway);
-                       if ((gateway->sdl_alen != 0 && route->rt_parent &&
+                       if ((gateway->sdl_alen != 0 &&
+                           route->rt_parent != NULL &&
                            route->rt_parent->rt_ifp == route->rt_ifp) ||
                            (route->rt_flags & RTF_CONDEMNED)) {
                                RT_REMREF_LOCKED(route);
                            route->rt_parent->rt_ifp == route->rt_ifp) ||
                            (route->rt_flags & RTF_CONDEMNED)) {
                                RT_REMREF_LOCKED(route);
@@ -1249,16 +1936,28 @@ match:
                                lck_mtx_unlock(rnh_lock);
                                goto respond;
                        }
                                lck_mtx_unlock(rnh_lock);
                                goto respond;
                        }
-#if IFNET_ROUTE_REFCNT
-                       /* Adjust route ref count for the interfaces */
-                       if (route->rt_if_ref_fn != NULL &&
-                           route->rt_ifp != ifp) {
-                               route->rt_if_ref_fn(ifp, 1);
-                               route->rt_if_ref_fn(route->rt_ifp, -1);
+                       if (route->rt_ifp != ifp) {
+                               /*
+                                * Purge any link-layer info caching.
+                                */
+                               if (route->rt_llinfo_purge != NULL)
+                                       route->rt_llinfo_purge(route);
+
+                               /* Adjust route ref count for the interfaces */
+                               if (route->rt_if_ref_fn != NULL) {
+                                       route->rt_if_ref_fn(ifp, 1);
+                                       route->rt_if_ref_fn(route->rt_ifp, -1);
+                               }
                        }
                        }
-#endif /* IFNET_ROUTE_REFCNT */
                        /* Change the interface when the existing route is on */
                        route->rt_ifp = ifp;
                        /* Change the interface when the existing route is on */
                        route->rt_ifp = ifp;
+                       /*
+                        * If rmx_mtu is not locked, update it
+                        * to the MTU used by the new interface.
+                        */
+                       if (!(route->rt_rmx.rmx_locks & RTV_MTU))
+                               route->rt_rmx.rmx_mtu = route->rt_ifp->if_mtu;
+
                        rtsetifa(route, &best_ia->ia_ifa);
                        gateway->sdl_index = ifp->if_index;
                        RT_UNLOCK(route);
                        rtsetifa(route, &best_ia->ia_ifa);
                        gateway->sdl_index = ifp->if_index;
                        RT_UNLOCK(route);
@@ -1273,25 +1972,26 @@ match:
                RT_LOCK_ASSERT_HELD(route);
        }
 
                RT_LOCK_ASSERT_HELD(route);
        }
 
-       if (gateway->sdl_alen && bcmp(LLADDR(gateway), CONST_LLADDR(sender_hw), gateway->sdl_alen)) {
-               if (route->rt_rmx.rmx_expire && log_arp_warnings) {
+       if (gateway->sdl_alen != 0 && bcmp(LLADDR(gateway),
+           CONST_LLADDR(sender_hw), gateway->sdl_alen) != 0) {
+               if (route->rt_expire != 0 &&
+                   (arp_verbose || log_arp_warnings)) {
                        char buf2[3 * MAX_HW_LEN];
                        char buf2[3 * MAX_HW_LEN];
-                       log(LOG_INFO, "arp: %s moved from %s to %s on %s%d\n",
+                       log(LOG_INFO, "arp: %s moved from %s to %s on %s\n",
                            inet_ntop(AF_INET, &sender_ip->sin_addr, ipv4str,
                            inet_ntop(AF_INET, &sender_ip->sin_addr, ipv4str,
-                           sizeof(ipv4str)),
-                           sdl_addr_to_hex(gateway, buf, sizeof(buf)),
-                           sdl_addr_to_hex(sender_hw, buf2, sizeof(buf2)),
-                           ifp->if_name, ifp->if_unit);
-               }
-               else if (route->rt_rmx.rmx_expire == 0) {
-                       if (log_arp_warnings) {
+                           sizeof (ipv4str)),
+                           sdl_addr_to_hex(gateway, buf, sizeof (buf)),
+                           sdl_addr_to_hex(sender_hw, buf2, sizeof (buf2)),
+                           if_name(ifp));
+               } else if (route->rt_expire == 0) {
+                       if (arp_verbose || log_arp_warnings) {
                                log(LOG_ERR, "arp: %s attempts to modify "
                                log(LOG_ERR, "arp: %s attempts to modify "
-                                   "permanent entry for %s on %s%d\n",
+                                   "permanent entry for %s on %s\n",
                                    sdl_addr_to_hex(sender_hw, buf,
                                    sdl_addr_to_hex(sender_hw, buf,
-                                   sizeof(buf)),
+                                   sizeof (buf)),
                                    inet_ntop(AF_INET, &sender_ip->sin_addr,
                                    inet_ntop(AF_INET, &sender_ip->sin_addr,
-                                   ipv4str, sizeof(ipv4str)),
-                                   ifp->if_name, ifp->if_unit);
+                                   ipv4str, sizeof (ipv4str)),
+                                   if_name(ifp));
                        }
                        goto respond;
                }
                        }
                        goto respond;
                }
@@ -1302,31 +2002,91 @@ match:
        bcopy(CONST_LLADDR(sender_hw), LLADDR(gateway), gateway->sdl_alen);
 
        /* Update the expire time for the route and clear the reject flag */
        bcopy(CONST_LLADDR(sender_hw), LLADDR(gateway), gateway->sdl_alen);
 
        /* Update the expire time for the route and clear the reject flag */
-       if (route->rt_rmx.rmx_expire) {
-               struct timeval timenow;
-
-               getmicrotime(&timenow);
-               route->rt_rmx.rmx_expire =
-                   rt_expiry(route, timenow.tv_sec, arpt_keep);
-       }
+       if (route->rt_expire != 0)
+               rt_setexpire(route, net_uptime() + arpt_keep);
        route->rt_flags &= ~RTF_REJECT;
 
        route->rt_flags &= ~RTF_REJECT;
 
-       /* update the llinfo, send a queued packet if there is one */
+       /* cache the gateway (sender HW) address */
+       arp_llreach_alloc(route, ifp, LLADDR(gateway), gateway->sdl_alen,
+           (arpop == ARPOP_REPLY), &rt_evcode);
+
        llinfo = route->rt_llinfo;
        llinfo = route->rt_llinfo;
+       /* send a notification that the route is back up */
+       if (ifp->if_addrlen == IF_LLREACH_MAXLEN &&
+           route->rt_flags & RTF_ROUTER &&
+           llinfo->la_flags & LLINFO_RTRFAIL_EVTSENT) {
+               struct kev_msg ev_msg;
+               struct kev_in_arpalive in_arpalive;
+
+               llinfo->la_flags &= ~LLINFO_RTRFAIL_EVTSENT;
+               RT_UNLOCK(route);
+               bzero(&ev_msg, sizeof(ev_msg));
+               bzero(&in_arpalive, sizeof(in_arpalive));
+               in_arpalive.link_data.if_family = ifp->if_family;
+               in_arpalive.link_data.if_unit = ifp->if_unit;
+               strlcpy(in_arpalive.link_data.if_name, ifp->if_name, IFNAMSIZ);
+               ev_msg.vendor_code = KEV_VENDOR_APPLE;
+               ev_msg.kev_class = KEV_NETWORK_CLASS;
+               ev_msg.kev_subclass = KEV_INET_SUBCLASS;
+               ev_msg.event_code = KEV_INET_ARPRTRALIVE;
+               ev_msg.dv[0].data_ptr = &in_arpalive;
+               ev_msg.dv[0].data_length = sizeof(struct kev_in_arpalive);
+               dlil_post_complete_msg(NULL, &ev_msg);
+               RT_LOCK(route);
+       }
+       /* Update the llinfo, send out all queued packets at once */
        llinfo->la_asked = 0;
        llinfo->la_asked = 0;
-       if (llinfo->la_hold) {
-               struct mbuf *m0;
-               m0 = llinfo->la_hold;
-               llinfo->la_hold = 0;
+       llinfo->la_flags &= ~LLINFO_PROBING;
+       llinfo->la_prbreq_cnt = 0;
+
+       if (rt_evcode) {
+               /*
+                * Enqueue work item to invoke callback for this route entry
+                */
+               route_event_enqueue_nwk_wq_entry(route, NULL, rt_evcode, NULL, TRUE);
 
 
+               if (route->rt_flags & RTF_ROUTER) {
+                       struct radix_node_head  *rnh = NULL;
+                       struct route_event rt_ev;
+                       route_event_init(&rt_ev, route, NULL, rt_evcode);
+                       /*
+                        * We already have a reference on rt. The function
+                        * frees it before returning.
+                        */
+                       RT_UNLOCK(route);
+                       lck_mtx_lock(rnh_lock);
+                       rnh = rt_tables[AF_INET];
+
+                       if (rnh != NULL)
+                               (void) rnh->rnh_walktree(rnh, route_event_walktree,
+                                   (void *)&rt_ev);
+                       lck_mtx_unlock(rnh_lock);
+                       RT_LOCK(route);
+               }
+       }
+
+       if (!qempty(&llinfo->la_holdq)) {
+               uint32_t held;
+               struct mbuf *m0 =
+                   _getq_all(&llinfo->la_holdq, NULL, &held, NULL);
+               if (arp_verbose) {
+                       log(LOG_DEBUG, "%s: sending %u held packets\n",
+                           __func__, held);
+               }
+               atomic_add_32(&arpstat.held, -held);
+               VERIFY(qempty(&llinfo->la_holdq));
                RT_UNLOCK(route);
                RT_UNLOCK(route);
-               dlil_output(ifp, PF_INET, m0, (caddr_t)route, rt_key(route), 0);
+               dlil_output(ifp, PF_INET, m0, (caddr_t)route,
+                   rt_key(route), 0, NULL);
                RT_REMREF(route);
                route = NULL;
        }
 
 respond:
        if (route != NULL) {
                RT_REMREF(route);
                route = NULL;
        }
 
 respond:
        if (route != NULL) {
+               /* Mark use timestamp if we're going to send a reply */
+               if (arpop == ARPOP_REQUEST && route->rt_llinfo != NULL)
+                       arp_llreach_use(route->rt_llinfo);
                RT_REMREF_LOCKED(route);
                RT_UNLOCK(route);
                route = NULL;
                RT_REMREF_LOCKED(route);
                RT_UNLOCK(route);
                route = NULL;
@@ -1335,8 +2095,11 @@ respond:
        if (arpop != ARPOP_REQUEST)
                goto done;
 
        if (arpop != ARPOP_REQUEST)
                goto done;
 
+       /* See comments at the beginning of this routine */
+       arpstat.rxrequests++;
+
        /* If we are not the target, check if we should proxy */
        /* If we are not the target, check if we should proxy */
-       if (target_ip->sin_addr.s_addr != best_ia->ia_addr.sin_addr.s_addr) {
+       if (target_ip->sin_addr.s_addr != best_ia_sin.sin_addr.s_addr) {
                /*
                 * Find a proxy route; callee holds a reference on the
                 * route and returns with the route entry locked, upon
                /*
                 * Find a proxy route; callee holds a reference on the
                 * route and returns with the route entry locked, upon
@@ -1354,12 +2117,12 @@ respond:
                         * proxying for.
                         */
                        if (route->rt_ifp != ifp &&
                         * proxying for.
                         */
                        if (route->rt_ifp != ifp &&
-                               (route->rt_ifp->if_bridge != ifp->if_bridge ||
-                                ifp->if_bridge == NULL)) {
-                                       RT_REMREF_LOCKED(route);
-                                       RT_UNLOCK(route);
-                                       goto done;
-                               }
+                           (route->rt_ifp->if_bridge != ifp->if_bridge ||
+                           ifp->if_bridge == NULL)) {
+                               RT_REMREF_LOCKED(route);
+                               RT_UNLOCK(route);
+                               goto done;
+                       }
                        proxied = *SDL(route->rt_gateway);
                        target_hw = &proxied;
                } else {
                        proxied = *SDL(route->rt_gateway);
                        target_hw = &proxied;
                } else {
@@ -1390,26 +2153,42 @@ respond:
                                goto done;
                        }
                }
                                goto done;
                        }
                }
+               /* Mark use timestamp */
+               if (route->rt_llinfo != NULL)
+                       arp_llreach_use(route->rt_llinfo);
                RT_REMREF_LOCKED(route);
                RT_UNLOCK(route);
        }
 
        dlil_send_arp(ifp, ARPOP_REPLY,
                RT_REMREF_LOCKED(route);
                RT_UNLOCK(route);
        }
 
        dlil_send_arp(ifp, ARPOP_REPLY,
-           target_hw, (const struct sockaddr*)target_ip,
-           sender_hw, (const struct sockaddr*)sender_ip);
+           target_hw, (const struct sockaddr *)target_ip,
+           sender_hw, (const struct sockaddr *)sender_ip, 0);
 
 done:
        if (best_ia != NULL)
 
 done:
        if (best_ia != NULL)
-               ifafree(&best_ia->ia_ifa);
-       return 0;
+               IFA_REMREF(&best_ia->ia_ifa);
+       return (0);
 }
 
 void
 }
 
 void
-arp_ifinit(
-       struct ifnet *ifp,
-       struct ifaddr *ifa)
+arp_ifinit(struct ifnet *ifp, struct ifaddr *ifa)
 {
 {
+       struct sockaddr *sa;
+
+       IFA_LOCK(ifa);
        ifa->ifa_rtrequest = arp_rtrequest;
        ifa->ifa_flags |= RTF_CLONING;
        ifa->ifa_rtrequest = arp_rtrequest;
        ifa->ifa_flags |= RTF_CLONING;
-       dlil_send_arp(ifp, ARPOP_REQUEST, NULL, ifa->ifa_addr, NULL, ifa->ifa_addr);
+       sa = ifa->ifa_addr;
+       IFA_UNLOCK(ifa);
+       dlil_send_arp(ifp, ARPOP_REQUEST, NULL, sa, NULL, sa, 0);
+}
+
+static int
+arp_getstat SYSCTL_HANDLER_ARGS
+{
+#pragma unused(oidp, arg1, arg2)
+       if (req->oldptr == USER_ADDR_NULL)
+               req->oldlen = (size_t)sizeof (struct arpstat);
+
+       return (SYSCTL_OUT(req, &arpstat, MIN(sizeof (arpstat), req->oldlen)));
 }
 }