Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

===================================================================
RCS file: /ftp/cvs/cvsroot/src/sys/netinet6/ip6_input.c,v
rcsdiff: /ftp/cvs/cvsroot/src/sys/netinet6/ip6_input.c,v: warning: Unknown phrases like `commitid ...;' are present.
retrieving revision 1.147
retrieving revision 1.152
diff -u -p -r1.147 -r1.152
--- src/sys/netinet6/ip6_input.c	2014/06/05 16:06:49	1.147
+++ src/sys/netinet6/ip6_input.c	2015/08/24 22:21:27	1.152
@@ -1,4 +1,4 @@
-/*	$NetBSD: ip6_input.c,v 1.147 2014/06/05 16:06:49 roy Exp $	*/
+/*	$NetBSD: ip6_input.c,v 1.152 2015/08/24 22:21:27 pooka Exp $	*/
 /*	$KAME: ip6_input.c,v 1.188 2001/03/29 05:34:31 itojun Exp $	*/
 
 /*
@@ -62,13 +62,15 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.147 2014/06/05 16:06:49 roy Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.152 2015/08/24 22:21:27 pooka Exp $");
 
+#ifdef _KERNEL_OPT
 #include "opt_gateway.h"
 #include "opt_inet.h"
 #include "opt_inet6.h"
 #include "opt_ipsec.h"
 #include "opt_compat_netbsd.h"
+#endif
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -90,13 +92,14 @@ __KERNEL_RCSID(0, "$NetBSD: ip6_input.c,
 #include <net/if_types.h>
 #include <net/if_dl.h>
 #include <net/route.h>
-#include <net/netisr.h>
+#include <net/pktqueue.h>
 #include <net/pfil.h>
 
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
 #ifdef INET
 #include <netinet/ip.h>
+#include <netinet/ip_var.h>
 #include <netinet/ip_icmp.h>
 #endif /* INET */
 #include <netinet/ip6.h>
@@ -135,9 +138,8 @@ __KERNEL_RCSID(0, "$NetBSD: ip6_input.c,
 extern struct domain inet6domain;
 
 u_char ip6_protox[IPPROTO_MAX];
-static int ip6qmaxlen = IFQ_MAXLEN;
 struct in6_ifaddr *in6_ifaddr;
-struct ifqueue ip6intrq;
+pktqueue_t *ip6_pktq __read_mostly;
 
 extern callout_t in6_tmpaddrtimer_ch;
 
@@ -150,6 +152,7 @@ pfil_head_t *inet6_pfil_hook;
 percpu_t *ip6stat_percpu;
 
 static void ip6_init2(void *);
+static void ip6intr(void *);
 static struct m_tag *ip6_setdstifaddr(struct mbuf *, const struct in6_ifaddr *);
 
 static int ip6_process_hopopts(struct mbuf *, u_int8_t *, int, u_int32_t *,
@@ -178,7 +181,10 @@ ip6_init(void)
 		if (pr->pr_domain->dom_family == PF_INET6 &&
 		    pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW)
 			ip6_protox[pr->pr_protocol] = pr - inet6sw;
-	ip6intrq.ifq_maxlen = ip6qmaxlen;
+
+	ip6_pktq = pktq_create(IFQ_MAXLEN, ip6intr, NULL);
+	KASSERT(ip6_pktq != NULL);
+
 	scope6_init();
 	addrsel_policy_init();
 	nd6_init();
@@ -215,28 +221,24 @@ ip6_init2(void *dummy)
 /*
  * IP6 input interrupt handling. Just pass the packet to ip6_input.
  */
-void
-ip6intr(void)
+static void
+ip6intr(void *arg __unused)
 {
-	int s;
 	struct mbuf *m;
 
 	mutex_enter(softnet_lock);
-	KERNEL_LOCK(1, NULL);
-	for (;;) {
-		s = splnet();
-		IF_DEQUEUE(&ip6intrq, m);
-		splx(s);
-		if (m == 0)
-			break;
-		/* drop the packet if IPv6 operation is disabled on the IF */
-		if ((ND_IFINFO(m->m_pkthdr.rcvif)->flags & ND6_IFF_IFDISABLED)) {
+	while ((m = pktq_dequeue(ip6_pktq)) != NULL) {
+		const ifnet_t *ifp = m->m_pkthdr.rcvif;
+
+		/*
+		 * Drop the packet if IPv6 is disabled on the interface.
+		 */
+		if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED)) {
 			m_freem(m);
-			break;
+			continue;
 		}
 		ip6_input(m);
 	}
-	KERNEL_UNLOCK_ONE(NULL);
 	mutex_exit(softnet_lock);
 }
 
@@ -748,11 +750,6 @@ ip6_input(struct mbuf *m)
 
 #ifdef IPSEC
 		if (ipsec_used) {
-			struct m_tag *mtag;
-			struct tdb_ident *tdbi;
-			struct secpolicy *sp;
-			int s, error;
-
 			/*
 			 * enforce IPsec policy checking if we are seeing last
 			 * header. note that we do not visit this with
@@ -760,39 +757,7 @@ ip6_input(struct mbuf *m)
 			 */
 			if ((inet6sw[ip_protox[nxt]].pr_flags
 			    & PR_LASTHDR) != 0) {
-				/*
-				 * Check if the packet has already had IPsec
-				 * processing done. If so, then just pass it
-				 * along. This tag gets set during AH, ESP,
-				 * etc. input handling, before the packet is
-				 * returned to the ip input queue for delivery.
-				 */
-				mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE,
-				    NULL);
-				s = splsoftnet();
-				if (mtag != NULL) {
-					tdbi = (struct tdb_ident *)(mtag + 1);
-					sp = ipsec_getpolicy(tdbi,
-					    IPSEC_DIR_INBOUND);
-				} else {
-					sp = ipsec_getpolicybyaddr(m,
-					    IPSEC_DIR_INBOUND, IP_FORWARDING,
-					    &error);
-				}
-				if (sp != NULL) {
-					/*
-					 * Check security policy against packet
-					 * attributes.
-					 */
-					error = ipsec_in_reject(sp, m);
-					KEY_FREESP(&sp);
-				} else {
-					/* XXX error stat??? */
-					error = EINVAL;
-					DPRINTF(("ip6_input: no SP, packet"
-					    " discarded\n"));/*XXX*/
-				}
-				splx(s);
+				int error = ipsec6_input(m);
 				if (error)
 					goto bad;
 			}
@@ -1902,6 +1867,14 @@ sysctl_net_inet6_ip6_setup(struct sysctl
 		       CTL_CREATE, CTL_EOL);
 	sysctl_createv(clog, 0, NULL, NULL,
 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
+		       CTLTYPE_INT, "prefer_tempaddr",
+		       SYSCTL_DESCR("Prefer temporary address as source "
+		                    "address"),
+		       NULL, 0, &ip6_prefer_tempaddr, 0,
+		       CTL_NET, PF_INET6, IPPROTO_IPV6,
+		       CTL_CREATE, CTL_EOL);
+	sysctl_createv(clog, 0, NULL, NULL,
+		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
 		       CTLTYPE_INT, "temppltime",
 		       SYSCTL_DESCR("preferred lifetime of a temporary address"),
 		       NULL, 0, &ip6_temp_preferred_lifetime, 0,