ip4_rewrite_inline: fix variable error
[vpp.git] / src / vnet / ip / ip4_forward.c
index 677f88c..f523ae6 100644 (file)
@@ -88,9 +88,8 @@
       ip_adjacency_t @c adj->lookup_next_index
       (where @c adj is the lookup result adjacency).
 */
-static uword
-ip4_lookup (vlib_main_t * vm,
-           vlib_node_runtime_t * node, vlib_frame_t * frame)
+VLIB_NODE_FN (ip4_lookup_node) (vlib_main_t * vm, vlib_node_runtime_t * node,
+                               vlib_frame_t * frame)
 {
   return ip4_lookup_inline (vm, node, frame,
                            /* lookup_for_responses_to_locally_received_packets */
@@ -103,7 +102,6 @@ static u8 *format_ip4_lookup_trace (u8 * s, va_list * args);
 /* *INDENT-OFF* */
 VLIB_REGISTER_NODE (ip4_lookup_node) =
 {
-  .function = ip4_lookup,
   .name = "ip4-lookup",
   .vector_size = sizeof (u32),
   .format_trace = format_ip4_lookup_trace,
@@ -112,24 +110,19 @@ VLIB_REGISTER_NODE (ip4_lookup_node) =
 };
 /* *INDENT-ON* */
 
-VLIB_NODE_FUNCTION_MULTIARCH (ip4_lookup_node, ip4_lookup);
-
-always_inline uword
-ip4_load_balance (vlib_main_t * vm,
-                 vlib_node_runtime_t * node, vlib_frame_t * frame)
+VLIB_NODE_FN (ip4_load_balance_node) (vlib_main_t * vm,
+                                     vlib_node_runtime_t * node,
+                                     vlib_frame_t * frame)
 {
   vlib_combined_counter_main_t *cm = &load_balance_main.lbm_via_counters;
   u32 n_left_from, n_left_to_next, *from, *to_next;
   ip_lookup_next_t next;
-  u32 thread_index = vlib_get_thread_index ();
+  u32 thread_index = vm->thread_index;
 
   from = vlib_frame_vector_args (frame);
   n_left_from = frame->n_vectors;
   next = node->cached_next_index;
 
-  if (node->flags & VLIB_NODE_FLAG_TRACE)
-    ip4_forward_next_trace (vm, node, frame, VLIB_TX);
-
   while (n_left_from > 0)
     {
       vlib_get_next_frame (vm, node, next, to_next, n_left_to_next);
@@ -298,23 +291,23 @@ ip4_load_balance (vlib_main_t * vm,
       vlib_put_next_frame (vm, node, next, n_left_to_next);
     }
 
+  if (node->flags & VLIB_NODE_FLAG_TRACE)
+    ip4_forward_next_trace (vm, node, frame, VLIB_TX);
+
   return frame->n_vectors;
 }
 
 /* *INDENT-OFF* */
 VLIB_REGISTER_NODE (ip4_load_balance_node) =
 {
-  .function = ip4_load_balance,
   .name = "ip4-load-balance",
   .vector_size = sizeof (u32),
   .sibling_of = "ip4-lookup",
-  .format_trace =
-  format_ip4_lookup_trace,
+  .format_trace = format_ip4_lookup_trace,
 };
 /* *INDENT-ON* */
 
-VLIB_NODE_FUNCTION_MULTIARCH (ip4_load_balance_node, ip4_load_balance);
-
+#ifndef CLIB_MARCH_VARIANT
 /* get first interface address */
 ip4_address_t *
 ip4_interface_first_address (ip4_main_t * im, u32 sw_if_index,
@@ -340,6 +333,45 @@ ip4_interface_first_address (ip4_main_t * im, u32 sw_if_index,
   return result;
 }
 
+static void
+ip4_add_subnet_bcast_route (u32 fib_index,
+                            fib_prefix_t *pfx,
+                            u32 sw_if_index)
+{
+  vnet_sw_interface_flags_t iflags;
+
+  iflags = vnet_sw_interface_get_flags(vnet_get_main(), sw_if_index);
+
+  fib_table_entry_special_remove(fib_index,
+                                 pfx,
+                                 FIB_SOURCE_INTERFACE);
+
+  if (iflags & VNET_SW_INTERFACE_FLAG_DIRECTED_BCAST)
+    {
+      fib_table_entry_update_one_path (fib_index, pfx,
+                                       FIB_SOURCE_INTERFACE,
+                                       FIB_ENTRY_FLAG_NONE,
+                                       DPO_PROTO_IP4,
+                                       /* No next-hop address */
+                                       &ADJ_BCAST_ADDR,
+                                       sw_if_index,
+                                       // invalid FIB index
+                                       ~0,
+                                       1,
+                                       // no out-label stack
+                                       NULL,
+                                       FIB_ROUTE_PATH_FLAG_NONE);
+    }
+  else
+    {
+        fib_table_entry_special_add(fib_index,
+                                    pfx,
+                                    FIB_SOURCE_INTERFACE,
+                                    (FIB_ENTRY_FLAG_DROP |
+                                     FIB_ENTRY_FLAG_LOOSE_URPF_EXEMPT));
+    }
+}
+
 static void
 ip4_add_interface_routes (u32 sw_if_index,
                          ip4_main_t * im, u32 fib_index,
@@ -385,11 +417,7 @@ ip4_add_interface_routes (u32 sw_if_index,
                                      FIB_ENTRY_FLAG_LOOSE_URPF_EXEMPT));
       net_pfx.fp_addr.ip4.as_u32 |= ~im->fib_masks[pfx.fp_len];
       if (net_pfx.fp_addr.ip4.as_u32 != pfx.fp_addr.ip4.as_u32)
-        fib_table_entry_special_add(fib_index,
-                                    &net_pfx,
-                                    FIB_SOURCE_INTERFACE,
-                                    (FIB_ENTRY_FLAG_DROP |
-                                     FIB_ENTRY_FLAG_LOOSE_URPF_EXEMPT));
+        ip4_add_subnet_bcast_route(fib_index, &net_pfx, sw_if_index);
     }
   else if (pfx.fp_len == 31)
     {
@@ -637,12 +665,53 @@ ip4_add_del_interface_address (vlib_main_t * vm,
     (vm, sw_if_index, address, address_length, is_del);
 }
 
+void
+ip4_directed_broadcast (u32 sw_if_index, u8 enable)
+{
+  ip_interface_address_t *ia;
+  ip4_main_t *im;
+
+  im = &ip4_main;
+
+  /*
+   * when directed broadcast is enabled, the subnet braodcast route will forward
+   * packets using an adjacency with a broadcast MAC. otherwise it drops
+   */
+  /* *INDENT-OFF* */
+  foreach_ip_interface_address(&im->lookup_main, ia,
+                               sw_if_index, 0,
+     ({
+       if (ia->address_length <= 30)
+         {
+           ip4_address_t *ipa;
+
+           ipa = ip_interface_address_get_address (&im->lookup_main, ia);
+
+           fib_prefix_t pfx = {
+             .fp_len = 32,
+             .fp_proto = FIB_PROTOCOL_IP4,
+             .fp_addr = {
+               .ip4.as_u32 = (ipa->as_u32 | ~im->fib_masks[ia->address_length]),
+             },
+           };
+
+           ip4_add_subnet_bcast_route
+             (fib_table_get_index_for_sw_if_index(FIB_PROTOCOL_IP4,
+                                                  sw_if_index),
+              &pfx, sw_if_index);
+         }
+     }));
+  /* *INDENT-ON* */
+}
+#endif
+
 /* Built-in ip4 unicast rx feature path definition */
 /* *INDENT-OFF* */
 VNET_FEATURE_ARC_INIT (ip4_unicast, static) =
 {
   .arc_name = "ip4-unicast",
   .start_nodes = VNET_FEATURES ("ip4-input", "ip4-input-no-checksum"),
+  .last_in_arc = "ip4-lookup",
   .arc_index_ptr = &ip4_main.lookup_main.ucast_feature_arc_index,
 };
 
@@ -685,13 +754,13 @@ VNET_FEATURE_INIT (ip4_policer_classify, static) =
 {
   .arc_name = "ip4-unicast",
   .node_name = "ip4-policer-classify",
-  .runs_before = VNET_FEATURES ("ipsec-input-ip4"),
+  .runs_before = VNET_FEATURES ("ipsec4-input-feature"),
 };
 
 VNET_FEATURE_INIT (ip4_ipsec, static) =
 {
   .arc_name = "ip4-unicast",
-  .node_name = "ipsec-input-ip4",
+  .node_name = "ipsec4-input-feature",
   .runs_before = VNET_FEATURES ("vpath-input-ip4"),
 };
 
@@ -728,6 +797,7 @@ VNET_FEATURE_ARC_INIT (ip4_multicast, static) =
 {
   .arc_name = "ip4-multicast",
   .start_nodes = VNET_FEATURES ("ip4-input", "ip4-input-no-checksum"),
+  .last_in_arc = "ip4-mfib-forward-lookup",
   .arc_index_ptr = &ip4_main.lookup_main.mcast_feature_arc_index,
 };
 
@@ -757,6 +827,7 @@ VNET_FEATURE_ARC_INIT (ip4_output, static) =
 {
   .arc_name = "ip4-output",
   .start_nodes = VNET_FEATURES ("ip4-rewrite", "ip4-midchain", "ip4-dvr-dpo"),
+  .last_in_arc = "interface-output",
   .arc_index_ptr = &ip4_main.lookup_main.output_feature_arc_index,
 };
 
@@ -771,13 +842,13 @@ VNET_FEATURE_INIT (ip4_outacl, static) =
 {
   .arc_name = "ip4-output",
   .node_name = "ip4-outacl",
-  .runs_before = VNET_FEATURES ("ipsec-output-ip4"),
+  .runs_before = VNET_FEATURES ("ipsec4-output-feature"),
 };
 
 VNET_FEATURE_INIT (ip4_ipsec_output, static) =
 {
   .arc_name = "ip4-output",
-  .node_name = "ipsec-output-ip4",
+  .node_name = "ipsec4-output-feature",
   .runs_before = VNET_FEATURES ("interface-output"),
 };
 
@@ -831,7 +902,7 @@ VNET_SW_INTERFACE_ADD_DEL_FUNCTION (ip4_sw_interface_add_del);
 /* Global IP4 main. */
 ip4_main_t ip4_main;
 
-clib_error_t *
+static clib_error_t *
 ip4_lookup_init (vlib_main_t * vm)
 {
   ip4_main_t *im = &ip4_main;
@@ -875,11 +946,11 @@ ip4_lookup_init (vlib_main_t * vm)
   {
     ethernet_arp_header_t h;
 
-    memset (&h, 0, sizeof (h));
+    clib_memset (&h, 0, sizeof (h));
 
     /* Set target ethernet address to all zeros. */
-    memset (h.ip4_over_ethernet[1].ethernet, 0,
-           sizeof (h.ip4_over_ethernet[1].ethernet));
+    clib_memset (h.ip4_over_ethernet[1].ethernet, 0,
+                sizeof (h.ip4_over_ethernet[1].ethernet));
 
 #define _16(f,v) h.f = clib_host_to_net_u16 (v);
 #define _8(f,v) h.f = v;
@@ -915,6 +986,7 @@ typedef struct
 }
 ip4_forward_next_trace_t;
 
+#ifndef CLIB_MARCH_VARIANT
 u8 *
 format_ip4_forward_next_trace (u8 * s, va_list * args)
 {
@@ -927,6 +999,7 @@ format_ip4_forward_next_trace (u8 * s, va_list * args)
              format_ip4_header, t->packet_data, sizeof (t->packet_data));
   return s;
 }
+#endif
 
 static u8 *
 format_ip4_lookup_trace (u8 * s, va_list * args)
@@ -962,6 +1035,7 @@ format_ip4_rewrite_trace (u8 * s, va_list * args)
   return s;
 }
 
+#ifndef CLIB_MARCH_VARIANT
 /* Common trace function for all ip4-forward next nodes. */
 void
 ip4_forward_next_trace (vlib_main_t * vm,
@@ -1001,9 +1075,9 @@ ip4_forward_next_trace (vlib_main_t * vm,
            vec_elt (im->fib_index_by_sw_if_index,
                     vnet_buffer (b0)->sw_if_index[VLIB_RX]);
 
-         clib_memcpy (t0->packet_data,
-                      vlib_buffer_get_current (b0),
-                      sizeof (t0->packet_data));
+         clib_memcpy_fast (t0->packet_data,
+                           vlib_buffer_get_current (b0),
+                           sizeof (t0->packet_data));
        }
       if (b1->flags & VLIB_BUFFER_IS_TRACED)
        {
@@ -1015,8 +1089,8 @@ ip4_forward_next_trace (vlib_main_t * vm,
             (u32) ~ 0) ? vnet_buffer (b1)->sw_if_index[VLIB_TX] :
            vec_elt (im->fib_index_by_sw_if_index,
                     vnet_buffer (b1)->sw_if_index[VLIB_RX]);
-         clib_memcpy (t1->packet_data, vlib_buffer_get_current (b1),
-                      sizeof (t1->packet_data));
+         clib_memcpy_fast (t1->packet_data, vlib_buffer_get_current (b1),
+                           sizeof (t1->packet_data));
        }
       from += 2;
       n_left -= 2;
@@ -1042,8 +1116,8 @@ ip4_forward_next_trace (vlib_main_t * vm,
             (u32) ~ 0) ? vnet_buffer (b0)->sw_if_index[VLIB_TX] :
            vec_elt (im->fib_index_by_sw_if_index,
                     vnet_buffer (b0)->sw_if_index[VLIB_RX]);
-         clib_memcpy (t0->packet_data, vlib_buffer_get_current (b0),
-                      sizeof (t0->packet_data));
+         clib_memcpy_fast (t0->packet_data, vlib_buffer_get_current (b0),
+                           sizeof (t0->packet_data));
        }
       from += 1;
       n_left -= 1;
@@ -1134,12 +1208,14 @@ ip4_tcp_udp_validate_checksum (vlib_main_t * vm, vlib_buffer_t * p0)
 
   return p0->flags;
 }
+#endif
 
 /* *INDENT-OFF* */
 VNET_FEATURE_ARC_INIT (ip4_local) =
 {
   .arc_name  = "ip4-local",
   .start_nodes = VNET_FEATURES ("ip4-local"),
+  .last_in_arc = "ip4-local-end-of-arc",
 };
 /* *INDENT-ON* */
 
@@ -1258,6 +1334,7 @@ typedef struct
   ip4_address_t src;
   u32 lbi;
   u8 error;
+  u8 first;
 } ip4_local_last_check_t;
 
 static inline void
@@ -1274,7 +1351,8 @@ ip4_local_check_src (vlib_buffer_t * b, ip4_header_t * ip0,
     vnet_buffer (b)->sw_if_index[VLIB_TX] != ~0 ?
     vnet_buffer (b)->sw_if_index[VLIB_TX] : vnet_buffer (b)->ip.fib_index;
 
-  if (PREDICT_FALSE (last_check->src.as_u32 != ip0->src_address.as_u32))
+  if (PREDICT_FALSE (last_check->first ||
+                    (last_check->src.as_u32 != ip0->src_address.as_u32)))
     {
       mtrie0 = &ip4_fib_get (vnet_buffer (b)->ip.fib_index)->mtrie;
       leaf0 = ip4_fib_mtrie_lookup_step_one (mtrie0, &ip0->src_address);
@@ -1316,6 +1394,7 @@ ip4_local_check_src (vlib_buffer_t * b, ip4_header_t * ip0,
       vnet_buffer (b)->ip.adj_index[VLIB_TX] = last_check->lbi;
       vnet_buffer (b)->ip.adj_index[VLIB_RX] = last_check->lbi;
       *error0 = last_check->error;
+      last_check->first = 0;
     }
 }
 
@@ -1327,9 +1406,10 @@ ip4_local_check_src_x2 (vlib_buffer_t ** b, ip4_header_t ** ip,
   ip4_fib_mtrie_t *mtrie[2];
   const dpo_id_t *dpo[2];
   load_balance_t *lb[2];
-  u32 not_last_hit = 0;
+  u32 not_last_hit;
   u32 lbi[2];
 
+  not_last_hit = last_check->first;
   not_last_hit |= ip[0]->src_address.as_u32 ^ last_check->src.as_u32;
   not_last_hit |= ip[1]->src_address.as_u32 ^ last_check->src.as_u32;
 
@@ -1406,28 +1486,67 @@ ip4_local_check_src_x2 (vlib_buffer_t ** b, ip4_header_t ** ip,
 
       error[0] = last_check->error;
       error[1] = last_check->error;
+      last_check->first = 0;
     }
 }
 
+enum ip_local_packet_type_e
+{
+  IP_LOCAL_PACKET_TYPE_L4,
+  IP_LOCAL_PACKET_TYPE_NAT,
+  IP_LOCAL_PACKET_TYPE_FRAG,
+};
+
+/**
+ * Determine packet type and next node.
+ *
+ * The expectation is that all packets that are not L4 will skip
+ * checksums and source checks.
+ */
+always_inline u8
+ip4_local_classify (vlib_buffer_t * b, ip4_header_t * ip, u16 * next)
+{
+  ip_lookup_main_t *lm = &ip4_main.lookup_main;
+
+  if (PREDICT_FALSE (ip4_is_fragment (ip)))
+    {
+      *next = IP_LOCAL_NEXT_REASSEMBLY;
+      return IP_LOCAL_PACKET_TYPE_FRAG;
+    }
+  if (PREDICT_FALSE (b->flags & VNET_BUFFER_F_IS_NATED))
+    {
+      *next = lm->local_next_by_ip_protocol[ip->protocol];
+      return IP_LOCAL_PACKET_TYPE_NAT;
+    }
+
+  *next = lm->local_next_by_ip_protocol[ip->protocol];
+  return IP_LOCAL_PACKET_TYPE_L4;
+}
+
 static inline uword
 ip4_local_inline (vlib_main_t * vm,
                  vlib_node_runtime_t * node,
                  vlib_frame_t * frame, int head_of_feature_arc)
 {
-  ip4_main_t *im = &ip4_main;
-  ip_lookup_main_t *lm = &im->lookup_main;
   u32 *from, n_left_from;
   vlib_node_runtime_t *error_node =
     vlib_node_get_runtime (vm, ip4_input_node.index);
   u16 nexts[VLIB_FRAME_SIZE], *next;
   vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
   ip4_header_t *ip[2];
-  u8 error[2];
+  u8 error[2], pt[2];
 
   ip4_local_last_check_t last_check = {
+    /*
+     * 0.0.0.0 can appear as the source address of an IP packet,
+     * as can any other address, hence the need to use the 'first'
+     * member to make sure the .lbi is initialised for the first
+     * packet.
+     */
     .src = {.as_u32 = 0},
     .lbi = ~0,
-    .error = IP4_ERROR_UNKNOWN_PROTOCOL
+    .error = IP4_ERROR_UNKNOWN_PROTOCOL,
+    .first = 1,
   };
 
   from = vlib_frame_vector_args (frame);
@@ -1442,7 +1561,7 @@ ip4_local_inline (vlib_main_t * vm,
 
   while (n_left_from >= 6)
     {
-      u32 is_nat, not_batch = 0;
+      u8 not_batch = 0;
 
       /* Prefetch next iteration. */
       {
@@ -1461,10 +1580,12 @@ ip4_local_inline (vlib_main_t * vm,
       vnet_buffer (b[0])->l3_hdr_offset = b[0]->current_data;
       vnet_buffer (b[1])->l3_hdr_offset = b[1]->current_data;
 
-      is_nat = b[0]->flags & VNET_BUFFER_F_IS_NATED;
-      not_batch |= is_nat ^ (b[1]->flags & VNET_BUFFER_F_IS_NATED);
+      pt[0] = ip4_local_classify (b[0], ip[0], &next[0]);
+      pt[1] = ip4_local_classify (b[1], ip[1], &next[1]);
+
+      not_batch = pt[0] ^ pt[1];
 
-      if (head_of_feature_arc == 0 || (is_nat && not_batch == 0))
+      if (head_of_feature_arc == 0 || (pt[0] && not_batch == 0))
        goto skip_checks;
 
       if (PREDICT_TRUE (not_batch == 0))
@@ -1474,12 +1595,12 @@ ip4_local_inline (vlib_main_t * vm,
        }
       else
        {
-         if (!(b[0]->flags & VNET_BUFFER_F_IS_NATED))
+         if (!pt[0])
            {
              ip4_local_check_l4_csum (vm, b[0], ip[0], &error[0]);
              ip4_local_check_src (b[0], ip[0], &last_check, &error[0]);
            }
-         if (!(b[1]->flags & VNET_BUFFER_F_IS_NATED))
+         if (!pt[1])
            {
              ip4_local_check_l4_csum (vm, b[1], ip[1], &error[1]);
              ip4_local_check_src (b[1], ip[1], &last_check, &error[1]);
@@ -1488,8 +1609,6 @@ ip4_local_inline (vlib_main_t * vm,
 
     skip_checks:
 
-      next[0] = lm->local_next_by_ip_protocol[ip[0]->protocol];
-      next[1] = lm->local_next_by_ip_protocol[ip[1]->protocol];
       ip4_local_set_next_and_error (error_node, b[0], &next[0], error[0],
                                    head_of_feature_arc);
       ip4_local_set_next_and_error (error_node, b[1], &next[1], error[1],
@@ -1506,8 +1625,9 @@ ip4_local_inline (vlib_main_t * vm,
 
       ip[0] = vlib_buffer_get_current (b[0]);
       vnet_buffer (b[0])->l3_hdr_offset = b[0]->current_data;
+      pt[0] = ip4_local_classify (b[0], ip[0], &next[0]);
 
-      if (head_of_feature_arc == 0 || (b[0]->flags & VNET_BUFFER_F_IS_NATED))
+      if (head_of_feature_arc == 0 || pt[0])
        goto skip_check;
 
       ip4_local_check_l4_csum (vm, b[0], ip[0], &error[0]);
@@ -1515,7 +1635,6 @@ ip4_local_inline (vlib_main_t * vm,
 
     skip_check:
 
-      next[0] = lm->local_next_by_ip_protocol[ip[0]->protocol];
       ip4_local_set_next_and_error (error_node, b[0], &next[0], error[0],
                                    head_of_feature_arc);
 
@@ -1528,8 +1647,8 @@ ip4_local_inline (vlib_main_t * vm,
   return frame->n_vectors;
 }
 
-static uword
-ip4_local (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
+VLIB_NODE_FN (ip4_local_node) (vlib_main_t * vm, vlib_node_runtime_t * node,
+                              vlib_frame_t * frame)
 {
   return ip4_local_inline (vm, node, frame, 1 /* head of feature arc */ );
 }
@@ -1537,7 +1656,6 @@ ip4_local (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
 /* *INDENT-OFF* */
 VLIB_REGISTER_NODE (ip4_local_node) =
 {
-  .function = ip4_local,
   .name = "ip4-local",
   .vector_size = sizeof (u32),
   .format_trace = format_ip4_forward_next_trace,
@@ -1548,22 +1666,21 @@ VLIB_REGISTER_NODE (ip4_local_node) =
     [IP_LOCAL_NEXT_PUNT] = "ip4-punt",
     [IP_LOCAL_NEXT_UDP_LOOKUP] = "ip4-udp-lookup",
     [IP_LOCAL_NEXT_ICMP] = "ip4-icmp-input",
+    [IP_LOCAL_NEXT_REASSEMBLY] = "ip4-reassembly",
   },
 };
 /* *INDENT-ON* */
 
-VLIB_NODE_FUNCTION_MULTIARCH (ip4_local_node, ip4_local);
 
-static uword
-ip4_local_end_of_arc (vlib_main_t * vm,
-                     vlib_node_runtime_t * node, vlib_frame_t * frame)
+VLIB_NODE_FN (ip4_local_end_of_arc_node) (vlib_main_t * vm,
+                                         vlib_node_runtime_t * node,
+                                         vlib_frame_t * frame)
 {
   return ip4_local_inline (vm, node, frame, 0 /* head of feature arc */ );
 }
 
 /* *INDENT-OFF* */
-VLIB_REGISTER_NODE (ip4_local_end_of_arc_node,static) = {
-  .function = ip4_local_end_of_arc,
+VLIB_REGISTER_NODE (ip4_local_end_of_arc_node) = {
   .name = "ip4-local-end-of-arc",
   .vector_size = sizeof (u32),
 
@@ -1571,8 +1688,6 @@ VLIB_REGISTER_NODE (ip4_local_end_of_arc_node,static) = {
   .sibling_of = "ip4-local",
 };
 
-VLIB_NODE_FUNCTION_MULTIARCH (ip4_local_end_of_arc_node, ip4_local_end_of_arc)
-
 VNET_FEATURE_INIT (ip4_local_end_of_arc, static) = {
   .arc_name = "ip4-local",
   .node_name = "ip4-local-end-of-arc",
@@ -1580,6 +1695,7 @@ VNET_FEATURE_INIT (ip4_local_end_of_arc, static) = {
 };
 /* *INDENT-ON* */
 
+#ifndef CLIB_MARCH_VARIANT
 void
 ip4_register_protocol (u32 protocol, u32 node_index)
 {
@@ -1591,6 +1707,7 @@ ip4_register_protocol (u32 protocol, u32 node_index)
   lm->local_next_by_ip_protocol[protocol] =
     vlib_node_add_next (vm, ip4_local_node.index, node_index);
 }
+#endif
 
 static clib_error_t *
 show_ip_local_command_fn (vlib_main_t * vm,
@@ -1648,29 +1765,13 @@ ip4_arp_inline (vlib_main_t * vm,
   ip_lookup_main_t *lm = &im->lookup_main;
   u32 *from, *to_next_drop;
   uword n_left_from, n_left_to_next_drop, next_index;
-  static f64 time_last_seed_change = -1e100;
-  static u32 hash_seeds[3];
-  static uword hash_bitmap[256 / BITS (uword)];
-  f64 time_now;
+  u32 thread_index = vm->thread_index;
+  u64 seed;
 
   if (node->flags & VLIB_NODE_FLAG_TRACE)
     ip4_forward_next_trace (vm, node, frame, VLIB_TX);
 
-  time_now = vlib_time_now (vm);
-  if (time_now - time_last_seed_change > 1e-3)
-    {
-      uword i;
-      u32 *r = clib_random_buffer_get_data (&vm->random_buffer,
-                                           sizeof (hash_seeds));
-      for (i = 0; i < ARRAY_LEN (hash_seeds); i++)
-       hash_seeds[i] = r[i];
-
-      /* Mark all hash keys as been no-seen before. */
-      for (i = 0; i < ARRAY_LEN (hash_bitmap); i++)
-       hash_bitmap[i] = 0;
-
-      time_last_seed_change = time_now;
-    }
+  seed = throttle_seed (&im->arp_throttle, thread_index, vlib_time_now (vm));
 
   from = vlib_frame_vector_args (frame);
   n_left_from = frame->n_vectors;
@@ -1685,73 +1786,58 @@ ip4_arp_inline (vlib_main_t * vm,
 
       while (n_left_from > 0 && n_left_to_next_drop > 0)
        {
-         u32 pi0, adj_index0, a0, b0, c0, m0, sw_if_index0, drop0;
+         u32 pi0, bi0, adj_index0, sw_if_index0;
          ip_adjacency_t *adj0;
-         vlib_buffer_t *p0;
-         ip4_header_t *ip0;
-         uword bm0;
+         vlib_buffer_t *p0, *b0;
+         ip4_address_t resolve0;
+         ethernet_arp_header_t *h0;
+         vnet_hw_interface_t *hw_if0;
+         u64 r0;
 
          pi0 = from[0];
-
          p0 = vlib_get_buffer (vm, pi0);
 
+         from += 1;
+         n_left_from -= 1;
+         to_next_drop[0] = pi0;
+         to_next_drop += 1;
+         n_left_to_next_drop -= 1;
+
          adj_index0 = vnet_buffer (p0)->ip.adj_index[VLIB_TX];
          adj0 = adj_get (adj_index0);
-         ip0 = vlib_buffer_get_current (p0);
-
-         a0 = hash_seeds[0];
-         b0 = hash_seeds[1];
-         c0 = hash_seeds[2];
-
-         sw_if_index0 = adj0->rewrite_header.sw_if_index;
-         vnet_buffer (p0)->sw_if_index[VLIB_TX] = sw_if_index0;
 
          if (is_glean)
            {
-             /*
-              * this is the Glean case, so we are ARPing for the
-              * packet's destination
-              */
-             a0 ^= ip0->dst_address.data_u32;
+             /* resolve the packet's destination */
+             ip4_header_t *ip0 = vlib_buffer_get_current (p0);
+             resolve0 = ip0->dst_address;
            }
          else
            {
-             a0 ^= adj0->sub_type.nbr.next_hop.ip4.data_u32;
+             /* resolve the incomplete adj */
+             resolve0 = adj0->sub_type.nbr.next_hop.ip4;
            }
-         b0 ^= sw_if_index0;
-
-         hash_v3_mix32 (a0, b0, c0);
-         hash_v3_finalize32 (a0, b0, c0);
-
-         c0 &= BITS (hash_bitmap) - 1;
-         m0 = (uword) 1 << (c0 % BITS (uword));
-         c0 = c0 / BITS (uword);
-
-         bm0 = hash_bitmap[c0];
-         drop0 = (bm0 & m0) != 0;
 
-         /* Mark it as seen. */
-         hash_bitmap[c0] = bm0 | m0;
-
-         from += 1;
-         n_left_from -= 1;
-         to_next_drop[0] = pi0;
-         to_next_drop += 1;
-         n_left_to_next_drop -= 1;
+         /* combine the address and interface for the hash key */
+         sw_if_index0 = adj0->rewrite_header.sw_if_index;
+         r0 = (u64) resolve0.data_u32 << 32;
+         r0 |= sw_if_index0;
 
-         p0->error =
-           node->errors[drop0 ? IP4_ARP_ERROR_DROP :
-                        IP4_ARP_ERROR_REQUEST_SENT];
+         if (throttle_check (&im->arp_throttle, thread_index, r0, seed))
+           {
+             p0->error = node->errors[IP4_ARP_ERROR_THROTTLED];
+             continue;
+           }
 
          /*
           * the adj has been updated to a rewrite but the node the DPO that got
           * us here hasn't - yet. no big deal. we'll drop while we wait.
           */
          if (IP_LOOKUP_NEXT_REWRITE == adj0->lookup_next_index)
-           continue;
-
-         if (drop0)
-           continue;
+           {
+             p0->error = node->errors[IP4_ARP_ERROR_RESOLVED];
+             continue;
+           }
 
          /*
           * Can happen if the control-plane is programming tables
@@ -1761,77 +1847,61 @@ ip4_arp_inline (vlib_main_t * vm,
              || (!is_glean && adj0->lookup_next_index != IP_LOOKUP_NEXT_ARP))
            {
              p0->error = node->errors[IP4_ARP_ERROR_NON_ARP_ADJ];
+             continue;
            }
-         else
-           /* Send ARP request. */
+         /* Send ARP request. */
+         h0 =
+           vlib_packet_template_get_packet (vm,
+                                            &im->ip4_arp_request_packet_template,
+                                            &bi0);
+
+         /* Seems we're out of buffers */
+         if (PREDICT_FALSE (!h0))
            {
-             u32 bi0 = 0;
-             vlib_buffer_t *b0;
-             ethernet_arp_header_t *h0;
-             vnet_hw_interface_t *hw_if0;
-
-             h0 =
-               vlib_packet_template_get_packet (vm,
-                                                &im->ip4_arp_request_packet_template,
-                                                &bi0);
-
-             /* Seems we're out of buffers */
-             if (PREDICT_FALSE (!h0))
-               continue;
-
-             /* Add rewrite/encap string for ARP packet. */
-             vnet_rewrite_one_header (adj0[0], h0,
-                                      sizeof (ethernet_header_t));
+             p0->error = node->errors[IP4_ARP_ERROR_NO_BUFFERS];
+             continue;
+           }
 
-             hw_if0 = vnet_get_sup_hw_interface (vnm, sw_if_index0);
+         /* Add rewrite/encap string for ARP packet. */
+         vnet_rewrite_one_header (adj0[0], h0, sizeof (ethernet_header_t));
 
-             /* Src ethernet address in ARP header. */
-             clib_memcpy (h0->ip4_over_ethernet[0].ethernet,
-                          hw_if0->hw_address,
-                          sizeof (h0->ip4_over_ethernet[0].ethernet));
+         hw_if0 = vnet_get_sup_hw_interface (vnm, sw_if_index0);
 
-             if (is_glean)
-               {
-                 /* The interface's source address is stashed in the Glean Adj */
-                 h0->ip4_over_ethernet[0].ip4 =
-                   adj0->sub_type.glean.receive_addr.ip4;
-
-                 /* Copy in destination address we are requesting. This is the
-                  * glean case, so it's the packet's destination.*/
-                 h0->ip4_over_ethernet[1].ip4.data_u32 =
-                   ip0->dst_address.data_u32;
-               }
-             else
+         /* Src ethernet address in ARP header. */
+         clib_memcpy_fast (h0->ip4_over_ethernet[0].ethernet,
+                           hw_if0->hw_address,
+                           sizeof (h0->ip4_over_ethernet[0].ethernet));
+         if (is_glean)
+           {
+             /* The interface's source address is stashed in the Glean Adj */
+             h0->ip4_over_ethernet[0].ip4 =
+               adj0->sub_type.glean.receive_addr.ip4;
+           }
+         else
+           {
+             /* Src IP address in ARP header. */
+             if (ip4_src_address_for_packet (lm, sw_if_index0,
+                                             &h0->ip4_over_ethernet[0].ip4))
                {
-                 /* Src IP address in ARP header. */
-                 if (ip4_src_address_for_packet (lm, sw_if_index0,
-                                                 &h0->
-                                                 ip4_over_ethernet[0].ip4))
-                   {
-                     /* No source address available */
-                     p0->error =
-                       node->errors[IP4_ARP_ERROR_NO_SOURCE_ADDRESS];
-                     vlib_buffer_free (vm, &bi0, 1);
-                     continue;
-                   }
-
-                 /* Copy in destination address we are requesting from the
-                    incomplete adj */
-                 h0->ip4_over_ethernet[1].ip4.data_u32 =
-                   adj0->sub_type.nbr.next_hop.ip4.as_u32;
+                 /* No source address available */
+                 p0->error = node->errors[IP4_ARP_ERROR_NO_SOURCE_ADDRESS];
+                 vlib_buffer_free (vm, &bi0, 1);
+                 continue;
                }
+           }
+         h0->ip4_over_ethernet[1].ip4 = resolve0;
 
-             vlib_buffer_copy_trace_flag (vm, p0, bi0);
-             b0 = vlib_get_buffer (vm, bi0);
-             VLIB_BUFFER_TRACE_TRAJECTORY_INIT (b0);
-             vnet_buffer (b0)->sw_if_index[VLIB_TX] = sw_if_index0;
+         p0->error = node->errors[IP4_ARP_ERROR_REQUEST_SENT];
 
-             vlib_buffer_advance (b0, -adj0->rewrite_header.data_bytes);
+         vlib_buffer_copy_trace_flag (vm, p0, bi0);
+         b0 = vlib_get_buffer (vm, bi0);
+         VLIB_BUFFER_TRACE_TRAJECTORY_INIT (b0);
+         vnet_buffer (b0)->sw_if_index[VLIB_TX] = sw_if_index0;
 
-             vlib_set_next_frame_buffer (vm, node,
-                                         adj0->rewrite_header.next_index,
-                                         bi0);
-           }
+         vlib_buffer_advance (b0, -adj0->rewrite_header.data_bytes);
+
+         vlib_set_next_frame_buffer (vm, node,
+                                     adj0->rewrite_header.next_index, bi0);
        }
 
       vlib_put_next_frame (vm, node, IP4_ARP_NEXT_DROP, n_left_to_next_drop);
@@ -1840,31 +1910,30 @@ ip4_arp_inline (vlib_main_t * vm,
   return frame->n_vectors;
 }
 
-static uword
-ip4_arp (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
+VLIB_NODE_FN (ip4_arp_node) (vlib_main_t * vm, vlib_node_runtime_t * node,
+                            vlib_frame_t * frame)
 {
   return (ip4_arp_inline (vm, node, frame, 0));
 }
 
-static uword
-ip4_glean (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
+VLIB_NODE_FN (ip4_glean_node) (vlib_main_t * vm, vlib_node_runtime_t * node,
+                              vlib_frame_t * frame)
 {
   return (ip4_arp_inline (vm, node, frame, 1));
 }
 
 static char *ip4_arp_error_strings[] = {
-  [IP4_ARP_ERROR_DROP] = "address overflow drops",
+  [IP4_ARP_ERROR_THROTTLED] = "ARP requests throttled",
+  [IP4_ARP_ERROR_RESOLVED] = "ARP requests resolved",
+  [IP4_ARP_ERROR_NO_BUFFERS] = "ARP requests out of buffer",
   [IP4_ARP_ERROR_REQUEST_SENT] = "ARP requests sent",
   [IP4_ARP_ERROR_NON_ARP_ADJ] = "ARPs to non-ARP adjacencies",
-  [IP4_ARP_ERROR_REPLICATE_DROP] = "ARP replication completed",
-  [IP4_ARP_ERROR_REPLICATE_FAIL] = "ARP replication failed",
   [IP4_ARP_ERROR_NO_SOURCE_ADDRESS] = "no source address for ARP request",
 };
 
 /* *INDENT-OFF* */
 VLIB_REGISTER_NODE (ip4_arp_node) =
 {
-  .function = ip4_arp,
   .name = "ip4-arp",
   .vector_size = sizeof (u32),
   .format_trace = format_ip4_forward_next_trace,
@@ -1879,7 +1948,6 @@ VLIB_REGISTER_NODE (ip4_arp_node) =
 
 VLIB_REGISTER_NODE (ip4_glean_node) =
 {
-  .function = ip4_glean,
   .name = "ip4-glean",
   .vector_size = sizeof (u32),
   .format_trace = format_ip4_forward_next_trace,
@@ -1893,12 +1961,14 @@ VLIB_REGISTER_NODE (ip4_glean_node) =
 /* *INDENT-ON* */
 
 #define foreach_notrace_ip4_arp_error           \
-_(DROP)                                         \
+_(THROTTLED)                                    \
+_(RESOLVED)                                     \
+_(NO_BUFFERS)                                   \
 _(REQUEST_SENT)                                 \
-_(REPLICATE_DROP)                               \
-_(REPLICATE_FAIL)
+_(NON_ARP_ADJ)                                  \
+_(NO_SOURCE_ADDRESS)
 
-clib_error_t *
+static clib_error_t *
 arp_notrace_init (vlib_main_t * vm)
 {
   vlib_node_runtime_t *rt = vlib_node_get_runtime (vm, ip4_arp_node.index);
@@ -1916,6 +1986,7 @@ arp_notrace_init (vlib_main_t * vm)
 VLIB_INIT_FUNCTION (arp_notrace_init);
 
 
+#ifndef CLIB_MARCH_VARIANT
 /* Send an ARP request to see if given destination is reachable on given interface. */
 clib_error_t *
 ip4_probe_neighbor (vlib_main_t * vm, ip4_address_t * dst, u32 sw_if_index,
@@ -1972,8 +2043,8 @@ ip4_probe_neighbor (vlib_main_t * vm, ip4_address_t * dst, u32 sw_if_index,
                                sw_if_index);
     }
 
-  clib_memcpy (h->ip4_over_ethernet[0].ethernet, hi->hw_address,
-              sizeof (h->ip4_over_ethernet[0].ethernet));
+  clib_memcpy_fast (h->ip4_over_ethernet[0].ethernet, hi->hw_address,
+                   sizeof (h->ip4_over_ethernet[0].ethernet));
 
   h->ip4_over_ethernet[0].ip4 = src[0];
   h->ip4_over_ethernet[1].ip4 = dst[0];
@@ -2024,6 +2095,7 @@ ip4_probe_neighbor (vlib_main_t * vm, ip4_address_t * dst, u32 sw_if_index,
   adj_unlock (ai);
   return /* no error */ 0;
 }
+#endif
 
 typedef enum
 {
@@ -2045,7 +2117,7 @@ typedef enum
 
 always_inline void
 ip4_mtu_check (vlib_buffer_t * b, u16 packet_len,
-              u16 adj_packet_bytes, bool df, u32 * next, u32 * error)
+              u16 adj_packet_bytes, bool df, u16 * next, u32 * error)
 {
   if (packet_len > adj_packet_bytes)
     {
@@ -2061,13 +2133,59 @@ ip4_mtu_check (vlib_buffer_t * b, u16 packet_len,
       else
        {
          /* IP fragmentation */
-         ip_frag_set_vnet_buffer (b, 0, adj_packet_bytes,
-                                  IP4_FRAG_NEXT_IP4_LOOKUP, 0);
+         ip_frag_set_vnet_buffer (b, adj_packet_bytes,
+                                  IP4_FRAG_NEXT_IP4_REWRITE, 0);
          *next = IP4_REWRITE_NEXT_FRAGMENT;
        }
     }
 }
 
+/* Decrement TTL & update checksum.
+   Works either endian, so no need for byte swap. */
+static_always_inline void
+ip4_ttl_and_checksum_check (vlib_buffer_t * b, ip4_header_t * ip, u16 * next,
+                           u32 * error)
+{
+  i32 ttl;
+  u32 checksum;
+  if (PREDICT_FALSE (b->flags & VNET_BUFFER_F_LOCALLY_ORIGINATED))
+    {
+      b->flags &= ~VNET_BUFFER_F_LOCALLY_ORIGINATED;
+      return;
+    }
+
+  ttl = ip->ttl;
+
+  /* Input node should have reject packets with ttl 0. */
+  ASSERT (ip->ttl > 0);
+
+  checksum = ip->checksum + clib_host_to_net_u16 (0x0100);
+  checksum += checksum >= 0xffff;
+
+  ip->checksum = checksum;
+  ttl -= 1;
+  ip->ttl = ttl;
+
+  /*
+   * If the ttl drops below 1 when forwarding, generate
+   * an ICMP response.
+   */
+  if (PREDICT_FALSE (ttl <= 0))
+    {
+      *error = IP4_ERROR_TIME_EXPIRED;
+      vnet_buffer (b)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+      icmp4_error_set_vnet_buffer (b, ICMP4_time_exceeded,
+                                  ICMP4_time_exceeded_ttl_exceeded_in_transit,
+                                  0);
+      *next = IP4_REWRITE_NEXT_ICMP_ERROR;
+    }
+
+  /* Verify checksum. */
+  ASSERT ((ip->checksum == ip4_header_checksum (ip)) ||
+         (b->flags & VNET_BUFFER_F_OFFLOAD_IP_CKSUM));
+}
+
+
 always_inline uword
 ip4_rewrite_inline (vlib_main_t * vm,
                    vlib_node_runtime_t * node,
@@ -2076,406 +2194,275 @@ ip4_rewrite_inline (vlib_main_t * vm,
 {
   ip_lookup_main_t *lm = &ip4_main.lookup_main;
   u32 *from = vlib_frame_vector_args (frame);
-  u32 n_left_from, n_left_to_next, *to_next, next_index;
+  vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
+  u16 nexts[VLIB_FRAME_SIZE], *next;
+  u32 n_left_from;
   vlib_node_runtime_t *error_node =
     vlib_node_get_runtime (vm, ip4_input_node.index);
 
   n_left_from = frame->n_vectors;
-  next_index = node->cached_next_index;
-  u32 thread_index = vlib_get_thread_index ();
-
-  while (n_left_from > 0)
-    {
-      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
-
-      while (n_left_from >= 4 && n_left_to_next >= 2)
-       {
-         ip_adjacency_t *adj0, *adj1;
-         vlib_buffer_t *p0, *p1;
-         ip4_header_t *ip0, *ip1;
-         u32 pi0, rw_len0, next0, error0, checksum0, adj_index0;
-         u32 pi1, rw_len1, next1, error1, checksum1, adj_index1;
-         u32 tx_sw_if_index0, tx_sw_if_index1;
-
-         /* Prefetch next iteration. */
-         {
-           vlib_buffer_t *p2, *p3;
-
-           p2 = vlib_get_buffer (vm, from[2]);
-           p3 = vlib_get_buffer (vm, from[3]);
-
-           vlib_prefetch_buffer_header (p2, STORE);
-           vlib_prefetch_buffer_header (p3, STORE);
+  u32 thread_index = vm->thread_index;
 
-           CLIB_PREFETCH (p2->data, sizeof (ip0[0]), STORE);
-           CLIB_PREFETCH (p3->data, sizeof (ip0[0]), STORE);
-         }
-
-         pi0 = to_next[0] = from[0];
-         pi1 = to_next[1] = from[1];
-
-         from += 2;
-         n_left_from -= 2;
-         to_next += 2;
-         n_left_to_next -= 2;
-
-         p0 = vlib_get_buffer (vm, pi0);
-         p1 = vlib_get_buffer (vm, pi1);
-
-         adj_index0 = vnet_buffer (p0)->ip.adj_index[VLIB_TX];
-         adj_index1 = vnet_buffer (p1)->ip.adj_index[VLIB_TX];
-
-         /*
-          * pre-fetch the per-adjacency counters
-          */
-         if (do_counters)
-           {
-             vlib_prefetch_combined_counter (&adjacency_counters,
-                                             thread_index, adj_index0);
-             vlib_prefetch_combined_counter (&adjacency_counters,
-                                             thread_index, adj_index1);
-           }
-
-         ip0 = vlib_buffer_get_current (p0);
-         ip1 = vlib_buffer_get_current (p1);
-
-         error0 = error1 = IP4_ERROR_NONE;
-         next0 = next1 = IP4_REWRITE_NEXT_DROP;
-
-         /* Decrement TTL & update checksum.
-            Works either endian, so no need for byte swap. */
-         if (PREDICT_TRUE (!(p0->flags & VNET_BUFFER_F_LOCALLY_ORIGINATED)))
-           {
-             i32 ttl0 = ip0->ttl;
-
-             /* Input node should have reject packets with ttl 0. */
-             ASSERT (ip0->ttl > 0);
-
-             checksum0 = ip0->checksum + clib_host_to_net_u16 (0x0100);
-             checksum0 += checksum0 >= 0xffff;
-
-             ip0->checksum = checksum0;
-             ttl0 -= 1;
-             ip0->ttl = ttl0;
-
-             /*
-              * If the ttl drops below 1 when forwarding, generate
-              * an ICMP response.
-              */
-             if (PREDICT_FALSE (ttl0 <= 0))
-               {
-                 error0 = IP4_ERROR_TIME_EXPIRED;
-                 vnet_buffer (p0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
-                 icmp4_error_set_vnet_buffer (p0, ICMP4_time_exceeded,
-                                              ICMP4_time_exceeded_ttl_exceeded_in_transit,
-                                              0);
-                 next0 = IP4_REWRITE_NEXT_ICMP_ERROR;
-               }
+  vlib_get_buffers (vm, from, bufs, n_left_from);
+  clib_memset_u16 (nexts, IP4_REWRITE_NEXT_DROP, n_left_from);
 
-             /* Verify checksum. */
-             ASSERT ((ip0->checksum == ip4_header_checksum (ip0)) ||
-                     (p0->flags & VNET_BUFFER_F_OFFLOAD_IP_CKSUM));
-           }
-         else
-           {
-             p0->flags &= ~VNET_BUFFER_F_LOCALLY_ORIGINATED;
-           }
-         if (PREDICT_TRUE (!(p1->flags & VNET_BUFFER_F_LOCALLY_ORIGINATED)))
-           {
-             i32 ttl1 = ip1->ttl;
+  if (n_left_from >= 6)
+    {
+      int i;
+      for (i = 2; i < 6; i++)
+       vlib_prefetch_buffer_header (bufs[i], LOAD);
+    }
 
-             /* Input node should have reject packets with ttl 0. */
-             ASSERT (ip1->ttl > 0);
+  next = nexts;
+  b = bufs;
+  while (n_left_from >= 8)
+    {
+      ip_adjacency_t *adj0, *adj1;
+      ip4_header_t *ip0, *ip1;
+      u32 rw_len0, error0, adj_index0;
+      u32 rw_len1, error1, adj_index1;
+      u32 tx_sw_if_index0, tx_sw_if_index1;
+      u8 *p;
 
-             checksum1 = ip1->checksum + clib_host_to_net_u16 (0x0100);
-             checksum1 += checksum1 >= 0xffff;
+      vlib_prefetch_buffer_header (b[6], LOAD);
+      vlib_prefetch_buffer_header (b[7], LOAD);
 
-             ip1->checksum = checksum1;
-             ttl1 -= 1;
-             ip1->ttl = ttl1;
+      adj_index0 = vnet_buffer (b[0])->ip.adj_index[VLIB_TX];
+      adj_index1 = vnet_buffer (b[1])->ip.adj_index[VLIB_TX];
 
-             /*
-              * If the ttl drops below 1 when forwarding, generate
-              * an ICMP response.
-              */
-             if (PREDICT_FALSE (ttl1 <= 0))
-               {
-                 error1 = IP4_ERROR_TIME_EXPIRED;
-                 vnet_buffer (p1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
-                 icmp4_error_set_vnet_buffer (p1, ICMP4_time_exceeded,
-                                              ICMP4_time_exceeded_ttl_exceeded_in_transit,
-                                              0);
-                 next1 = IP4_REWRITE_NEXT_ICMP_ERROR;
-               }
+      /*
+       * pre-fetch the per-adjacency counters
+       */
+      if (do_counters)
+       {
+         vlib_prefetch_combined_counter (&adjacency_counters,
+                                         thread_index, adj_index0);
+         vlib_prefetch_combined_counter (&adjacency_counters,
+                                         thread_index, adj_index1);
+       }
 
-             /* Verify checksum. */
-             ASSERT ((ip1->checksum == ip4_header_checksum (ip1)) ||
-                     (p1->flags & VNET_BUFFER_F_OFFLOAD_IP_CKSUM));
-           }
-         else
-           {
-             p1->flags &= ~VNET_BUFFER_F_LOCALLY_ORIGINATED;
-           }
+      ip0 = vlib_buffer_get_current (b[0]);
+      ip1 = vlib_buffer_get_current (b[1]);
+
+      error0 = error1 = IP4_ERROR_NONE;
+
+      ip4_ttl_and_checksum_check (b[0], ip0, next + 0, &error0);
+      ip4_ttl_and_checksum_check (b[1], ip1, next + 1, &error1);
+
+      /* Rewrite packet header and updates lengths. */
+      adj0 = adj_get (adj_index0);
+      adj1 = adj_get (adj_index1);
+
+      /* Worth pipelining. No guarantee that adj0,1 are hot... */
+      rw_len0 = adj0[0].rewrite_header.data_bytes;
+      rw_len1 = adj1[0].rewrite_header.data_bytes;
+      vnet_buffer (b[0])->ip.save_rewrite_length = rw_len0;
+      vnet_buffer (b[1])->ip.save_rewrite_length = rw_len1;
+
+      p = vlib_buffer_get_current (b[2]);
+      CLIB_PREFETCH (p - CLIB_CACHE_LINE_BYTES, CLIB_CACHE_LINE_BYTES, STORE);
+      CLIB_PREFETCH (p, CLIB_CACHE_LINE_BYTES, LOAD);
+
+      p = vlib_buffer_get_current (b[3]);
+      CLIB_PREFETCH (p - CLIB_CACHE_LINE_BYTES, CLIB_CACHE_LINE_BYTES, STORE);
+      CLIB_PREFETCH (p, CLIB_CACHE_LINE_BYTES, LOAD);
+
+      /* Check MTU of outgoing interface. */
+      ip4_mtu_check (b[0], clib_net_to_host_u16 (ip0->length),
+                    adj0[0].rewrite_header.max_l3_packet_bytes,
+                    ip0->flags_and_fragment_offset &
+                    clib_host_to_net_u16 (IP4_HEADER_FLAG_DONT_FRAGMENT),
+                    next + 0, &error0);
+      ip4_mtu_check (b[1], clib_net_to_host_u16 (ip1->length),
+                    adj1[0].rewrite_header.max_l3_packet_bytes,
+                    ip1->flags_and_fragment_offset &
+                    clib_host_to_net_u16 (IP4_HEADER_FLAG_DONT_FRAGMENT),
+                    next + 1, &error1);
+
+      if (is_mcast)
+       {
+         error0 = ((adj0[0].rewrite_header.sw_if_index ==
+                    vnet_buffer (b[0])->sw_if_index[VLIB_RX]) ?
+                   IP4_ERROR_SAME_INTERFACE : error0);
+         error1 = ((adj1[0].rewrite_header.sw_if_index ==
+                    vnet_buffer (b[1])->sw_if_index[VLIB_RX]) ?
+                   IP4_ERROR_SAME_INTERFACE : error1);
+       }
 
-         /* Rewrite packet header and updates lengths. */
-         adj0 = adj_get (adj_index0);
-         adj1 = adj_get (adj_index1);
-
-         /* Worth pipelining. No guarantee that adj0,1 are hot... */
-         rw_len0 = adj0[0].rewrite_header.data_bytes;
-         rw_len1 = adj1[0].rewrite_header.data_bytes;
-         vnet_buffer (p0)->ip.save_rewrite_length = rw_len0;
-         vnet_buffer (p1)->ip.save_rewrite_length = rw_len1;
-
-         /* Check MTU of outgoing interface. */
-         ip4_mtu_check (p0, clib_net_to_host_u16 (ip0->length),
-                        adj0[0].rewrite_header.max_l3_packet_bytes,
-                        ip0->flags_and_fragment_offset &
-                        clib_host_to_net_u16 (IP4_HEADER_FLAG_DONT_FRAGMENT),
-                        &next0, &error0);
-         ip4_mtu_check (p1, clib_net_to_host_u16 (ip1->length),
-                        adj1[0].rewrite_header.max_l3_packet_bytes,
-                        ip1->flags_and_fragment_offset &
-                        clib_host_to_net_u16 (IP4_HEADER_FLAG_DONT_FRAGMENT),
-                        &next1, &error1);
-
-         if (is_mcast)
-           {
-             error0 = ((adj0[0].rewrite_header.sw_if_index ==
-                        vnet_buffer (p0)->sw_if_index[VLIB_RX]) ?
-                       IP4_ERROR_SAME_INTERFACE : error0);
-             error1 = ((adj1[0].rewrite_header.sw_if_index ==
-                        vnet_buffer (p1)->sw_if_index[VLIB_RX]) ?
-                       IP4_ERROR_SAME_INTERFACE : error1);
-           }
+      b[0]->error = error_node->errors[error0];
+      b[1]->error = error_node->errors[error1];
+      /* Don't adjust the buffer for ttl issue; icmp-error node wants
+       * to see the IP headerr */
+      if (PREDICT_TRUE (error0 == IP4_ERROR_NONE))
+       {
+         u32 next_index = adj0[0].rewrite_header.next_index;
+         b[0]->current_data -= rw_len0;
+         b[0]->current_length += rw_len0;
+         tx_sw_if_index0 = adj0[0].rewrite_header.sw_if_index;
+         vnet_buffer (b[0])->sw_if_index[VLIB_TX] = tx_sw_if_index0;
+
+         if (PREDICT_FALSE
+             (adj0[0].rewrite_header.flags & VNET_REWRITE_HAS_FEATURES))
+           vnet_feature_arc_start (lm->output_feature_arc_index,
+                                   tx_sw_if_index0, &next_index, b[0]);
+         next[0] = next_index;
+       }
+      if (PREDICT_TRUE (error1 == IP4_ERROR_NONE))
+       {
+         u32 next_index = adj1[0].rewrite_header.next_index;
+         b[1]->current_data -= rw_len1;
+         b[1]->current_length += rw_len1;
+
+         tx_sw_if_index1 = adj1[0].rewrite_header.sw_if_index;
+         vnet_buffer (b[1])->sw_if_index[VLIB_TX] = tx_sw_if_index1;
+
+         if (PREDICT_FALSE
+             (adj1[0].rewrite_header.flags & VNET_REWRITE_HAS_FEATURES))
+           vnet_feature_arc_start (lm->output_feature_arc_index,
+                                   tx_sw_if_index1, &next_index, b[1]);
+         next[1] = next_index;
+       }
 
-         p0->error = error_node->errors[error0];
-         p1->error = error_node->errors[error1];
-         /* Don't adjust the buffer for ttl issue; icmp-error node wants
-          * to see the IP headerr */
-         if (PREDICT_TRUE (error0 == IP4_ERROR_NONE))
-           {
-             next0 = adj0[0].rewrite_header.next_index;
-             p0->current_data -= rw_len0;
-             p0->current_length += rw_len0;
-             tx_sw_if_index0 = adj0[0].rewrite_header.sw_if_index;
-             vnet_buffer (p0)->sw_if_index[VLIB_TX] = tx_sw_if_index0;
-
-             if (PREDICT_FALSE
-                 (adj0[0].rewrite_header.flags & VNET_REWRITE_HAS_FEATURES))
-               vnet_feature_arc_start (lm->output_feature_arc_index,
-                                       tx_sw_if_index0, &next0, p0);
-           }
-         if (PREDICT_TRUE (error1 == IP4_ERROR_NONE))
-           {
-             next1 = adj1[0].rewrite_header.next_index;
-             p1->current_data -= rw_len1;
-             p1->current_length += rw_len1;
+      /* Guess we are only writing on simple Ethernet header. */
+      vnet_rewrite_two_headers (adj0[0], adj1[0],
+                               ip0, ip1, sizeof (ethernet_header_t));
 
-             tx_sw_if_index1 = adj1[0].rewrite_header.sw_if_index;
-             vnet_buffer (p1)->sw_if_index[VLIB_TX] = tx_sw_if_index1;
+      /*
+       * Bump the per-adjacency counters
+       */
+      if (do_counters)
+       {
+         vlib_increment_combined_counter
+           (&adjacency_counters,
+            thread_index,
+            adj_index0, 1, vlib_buffer_length_in_chain (vm, b[0]) + rw_len0);
 
-             if (PREDICT_FALSE
-                 (adj1[0].rewrite_header.flags & VNET_REWRITE_HAS_FEATURES))
-               vnet_feature_arc_start (lm->output_feature_arc_index,
-                                       tx_sw_if_index1, &next1, p1);
-           }
+         vlib_increment_combined_counter
+           (&adjacency_counters,
+            thread_index,
+            adj_index1, 1, vlib_buffer_length_in_chain (vm, b[1]) + rw_len1);
+       }
 
-         /* Guess we are only writing on simple Ethernet header. */
-         vnet_rewrite_two_headers (adj0[0], adj1[0],
-                                   ip0, ip1, sizeof (ethernet_header_t));
+      if (is_midchain)
+       {
+         adj0->sub_type.midchain.fixup_func
+           (vm, adj0, b[0], adj0->sub_type.midchain.fixup_data);
+         adj1->sub_type.midchain.fixup_func
+           (vm, adj1, b[1], adj1->sub_type.midchain.fixup_data);
+       }
 
+      if (is_mcast)
+       {
          /*
-          * Bump the per-adjacency counters
+          * copy bytes from the IP address into the MAC rewrite
           */
-         if (do_counters)
-           {
-             vlib_increment_combined_counter
-               (&adjacency_counters,
-                thread_index,
-                adj_index0, 1,
-                vlib_buffer_length_in_chain (vm, p0) + rw_len0);
-
-             vlib_increment_combined_counter
-               (&adjacency_counters,
-                thread_index,
-                adj_index1, 1,
-                vlib_buffer_length_in_chain (vm, p1) + rw_len1);
-           }
-
-         if (is_midchain)
-           {
-             adj0->sub_type.midchain.fixup_func
-               (vm, adj0, p0, adj0->sub_type.midchain.fixup_data);
-             adj1->sub_type.midchain.fixup_func
-               (vm, adj1, p1, adj0->sub_type.midchain.fixup_data);
-           }
-         if (is_mcast)
-           {
-             /*
-              * copy bytes from the IP address into the MAC rewrite
-              */
-             vnet_ip_mcast_fixup_header (IP4_MCAST_ADDR_MASK,
-                                         adj0->
-                                         rewrite_header.dst_mcast_offset,
-                                         &ip0->dst_address.as_u32,
-                                         (u8 *) ip0);
-             vnet_ip_mcast_fixup_header (IP4_MCAST_ADDR_MASK,
-                                         adj0->
-                                         rewrite_header.dst_mcast_offset,
-                                         &ip1->dst_address.as_u32,
-                                         (u8 *) ip1);
-           }
-
-         vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
-                                          to_next, n_left_to_next,
-                                          pi0, pi1, next0, next1);
+         vnet_ip_mcast_fixup_header (IP4_MCAST_ADDR_MASK,
+                                     adj0->rewrite_header.dst_mcast_offset,
+                                     &ip0->dst_address.as_u32, (u8 *) ip0);
+         vnet_ip_mcast_fixup_header (IP4_MCAST_ADDR_MASK,
+                                     adj1->rewrite_header.dst_mcast_offset,
+                                     &ip1->dst_address.as_u32, (u8 *) ip1);
        }
 
-      while (n_left_from > 0 && n_left_to_next > 0)
-       {
-         ip_adjacency_t *adj0;
-         vlib_buffer_t *p0;
-         ip4_header_t *ip0;
-         u32 pi0, rw_len0, adj_index0, next0, error0, checksum0;
-         u32 tx_sw_if_index0;
-
-         pi0 = to_next[0] = from[0];
-
-         p0 = vlib_get_buffer (vm, pi0);
-
-         adj_index0 = vnet_buffer (p0)->ip.adj_index[VLIB_TX];
-
-         adj0 = adj_get (adj_index0);
-
-         ip0 = vlib_buffer_get_current (p0);
-
-         error0 = IP4_ERROR_NONE;
-         next0 = IP4_REWRITE_NEXT_DROP;        /* drop on error */
-
-         /* Decrement TTL & update checksum. */
-         if (PREDICT_TRUE (!(p0->flags & VNET_BUFFER_F_LOCALLY_ORIGINATED)))
-           {
-             i32 ttl0 = ip0->ttl;
-
-             checksum0 = ip0->checksum + clib_host_to_net_u16 (0x0100);
-
-             checksum0 += checksum0 >= 0xffff;
-
-             ip0->checksum = checksum0;
-
-             ASSERT (ip0->ttl > 0);
-
-             ttl0 -= 1;
+      next += 2;
+      b += 2;
+      n_left_from -= 2;
+    }
 
-             ip0->ttl = ttl0;
+  while (n_left_from > 0)
+    {
+      ip_adjacency_t *adj0;
+      ip4_header_t *ip0;
+      u32 rw_len0, adj_index0, error0;
+      u32 tx_sw_if_index0;
 
-             ASSERT ((ip0->checksum == ip4_header_checksum (ip0)) ||
-                     (p0->flags & VNET_BUFFER_F_OFFLOAD_IP_CKSUM));
+      adj_index0 = vnet_buffer (b[0])->ip.adj_index[VLIB_TX];
 
-             if (PREDICT_FALSE (ttl0 <= 0))
-               {
-                 /*
-                  * If the ttl drops below 1 when forwarding, generate
-                  * an ICMP response.
-                  */
-                 error0 = IP4_ERROR_TIME_EXPIRED;
-                 next0 = IP4_REWRITE_NEXT_ICMP_ERROR;
-                 vnet_buffer (p0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
-                 icmp4_error_set_vnet_buffer (p0, ICMP4_time_exceeded,
-                                              ICMP4_time_exceeded_ttl_exceeded_in_transit,
-                                              0);
-               }
-           }
-         else
-           {
-             p0->flags &= ~VNET_BUFFER_F_LOCALLY_ORIGINATED;
-           }
+      adj0 = adj_get (adj_index0);
 
-         if (do_counters)
-           vlib_prefetch_combined_counter (&adjacency_counters,
-                                           thread_index, adj_index0);
+      if (do_counters)
+       vlib_prefetch_combined_counter (&adjacency_counters,
+                                       thread_index, adj_index0);
 
-         /* Guess we are only writing on simple Ethernet header. */
-         vnet_rewrite_one_header (adj0[0], ip0, sizeof (ethernet_header_t));
-         if (is_mcast)
-           {
-             /*
-              * copy bytes from the IP address into the MAC rewrite
-              */
-             vnet_ip_mcast_fixup_header (IP4_MCAST_ADDR_MASK,
-                                         adj0->
-                                         rewrite_header.dst_mcast_offset,
-                                         &ip0->dst_address.as_u32,
-                                         (u8 *) ip0);
-           }
+      ip0 = vlib_buffer_get_current (b[0]);
 
-         /* Update packet buffer attributes/set output interface. */
-         rw_len0 = adj0[0].rewrite_header.data_bytes;
-         vnet_buffer (p0)->ip.save_rewrite_length = rw_len0;
+      error0 = IP4_ERROR_NONE;
 
-         if (do_counters)
-           vlib_increment_combined_counter
-             (&adjacency_counters,
-              thread_index, adj_index0, 1,
-              vlib_buffer_length_in_chain (vm, p0) + rw_len0);
+      ip4_ttl_and_checksum_check (b[0], ip0, next + 0, &error0);
 
-         /* Check MTU of outgoing interface. */
-         ip4_mtu_check (p0, clib_net_to_host_u16 (ip0->length),
-                        adj0[0].rewrite_header.max_l3_packet_bytes,
-                        ip0->flags_and_fragment_offset &
-                        clib_host_to_net_u16 (IP4_HEADER_FLAG_DONT_FRAGMENT),
-                        &next0, &error0);
 
-         if (is_mcast)
-           {
-             error0 = ((adj0[0].rewrite_header.sw_if_index ==
-                        vnet_buffer (p0)->sw_if_index[VLIB_RX]) ?
-                       IP4_ERROR_SAME_INTERFACE : error0);
-           }
-         p0->error = error_node->errors[error0];
+      /* Update packet buffer attributes/set output interface. */
+      rw_len0 = adj0[0].rewrite_header.data_bytes;
+      vnet_buffer (b[0])->ip.save_rewrite_length = rw_len0;
 
-         /* Don't adjust the buffer for ttl issue; icmp-error node wants
-          * to see the IP headerr */
-         if (PREDICT_TRUE (error0 == IP4_ERROR_NONE))
-           {
-             p0->current_data -= rw_len0;
-             p0->current_length += rw_len0;
-             tx_sw_if_index0 = adj0[0].rewrite_header.sw_if_index;
+      /* Check MTU of outgoing interface. */
+      ip4_mtu_check (b[0], clib_net_to_host_u16 (ip0->length),
+                    adj0[0].rewrite_header.max_l3_packet_bytes,
+                    ip0->flags_and_fragment_offset &
+                    clib_host_to_net_u16 (IP4_HEADER_FLAG_DONT_FRAGMENT),
+                    next + 0, &error0);
 
-             vnet_buffer (p0)->sw_if_index[VLIB_TX] = tx_sw_if_index0;
-             next0 = adj0[0].rewrite_header.next_index;
+      if (is_mcast)
+       {
+         error0 = ((adj0[0].rewrite_header.sw_if_index ==
+                    vnet_buffer (b[0])->sw_if_index[VLIB_RX]) ?
+                   IP4_ERROR_SAME_INTERFACE : error0);
+       }
+      b[0]->error = error_node->errors[error0];
 
-             if (is_midchain)
-               {
-                 adj0->sub_type.midchain.fixup_func
-                   (vm, adj0, p0, adj0->sub_type.midchain.fixup_data);
-               }
+      /* Don't adjust the buffer for ttl issue; icmp-error node wants
+       * to see the IP headerr */
+      if (PREDICT_TRUE (error0 == IP4_ERROR_NONE))
+       {
+         u32 next_index = adj0[0].rewrite_header.next_index;
+         b[0]->current_data -= rw_len0;
+         b[0]->current_length += rw_len0;
+         tx_sw_if_index0 = adj0[0].rewrite_header.sw_if_index;
+         vnet_buffer (b[0])->sw_if_index[VLIB_TX] = tx_sw_if_index0;
+
+         if (PREDICT_FALSE
+             (adj0[0].rewrite_header.flags & VNET_REWRITE_HAS_FEATURES))
+           vnet_feature_arc_start (lm->output_feature_arc_index,
+                                   tx_sw_if_index0, &next_index, b[0]);
+         next[0] = next_index;
+       }
 
-             if (PREDICT_FALSE
-                 (adj0[0].rewrite_header.flags & VNET_REWRITE_HAS_FEATURES))
-               vnet_feature_arc_start (lm->output_feature_arc_index,
-                                       tx_sw_if_index0, &next0, p0);
+      /* Guess we are only writing on simple Ethernet header. */
+      vnet_rewrite_one_header (adj0[0], ip0, sizeof (ethernet_header_t));
 
-           }
+      if (do_counters)
+       vlib_increment_combined_counter
+         (&adjacency_counters,
+          thread_index, adj_index0, 1,
+          vlib_buffer_length_in_chain (vm, b[0]) + rw_len0);
 
-         from += 1;
-         n_left_from -= 1;
-         to_next += 1;
-         n_left_to_next -= 1;
+      if (is_midchain)
+       {
+         adj0->sub_type.midchain.fixup_func
+           (vm, adj0, b[0], adj0->sub_type.midchain.fixup_data);
+       }
 
-         vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
-                                          to_next, n_left_to_next,
-                                          pi0, next0);
+      if (is_mcast)
+       {
+         /*
+          * copy bytes from the IP address into the MAC rewrite
+          */
+         vnet_ip_mcast_fixup_header (IP4_MCAST_ADDR_MASK,
+                                     adj0->rewrite_header.dst_mcast_offset,
+                                     &ip0->dst_address.as_u32, (u8 *) ip0);
        }
 
-      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+      next += 1;
+      b += 1;
+      n_left_from -= 1;
     }
 
+
   /* Need to do trace after rewrites to pick up new packet data. */
   if (node->flags & VLIB_NODE_FLAG_TRACE)
     ip4_forward_next_trace (vm, node, frame, VLIB_TX);
 
+  vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
   return frame->n_vectors;
 }
 
@@ -2511,9 +2498,19 @@ ip4_rewrite_inline (vlib_main_t * vm,
     - <code> adj->rewrite_header.next_index </code>
       or @c ip4-drop
 */
-static uword
-ip4_rewrite (vlib_main_t * vm,
-            vlib_node_runtime_t * node, vlib_frame_t * frame)
+
+VLIB_NODE_FN (ip4_rewrite_node) (vlib_main_t * vm, vlib_node_runtime_t * node,
+                                vlib_frame_t * frame)
+{
+  if (adj_are_counters_enabled ())
+    return ip4_rewrite_inline (vm, node, frame, 1, 0, 0);
+  else
+    return ip4_rewrite_inline (vm, node, frame, 0, 0, 0);
+}
+
+VLIB_NODE_FN (ip4_rewrite_bcast_node) (vlib_main_t * vm,
+                                      vlib_node_runtime_t * node,
+                                      vlib_frame_t * frame)
 {
   if (adj_are_counters_enabled ())
     return ip4_rewrite_inline (vm, node, frame, 1, 0, 0);
@@ -2521,9 +2518,9 @@ ip4_rewrite (vlib_main_t * vm,
     return ip4_rewrite_inline (vm, node, frame, 0, 0, 0);
 }
 
-static uword
-ip4_midchain (vlib_main_t * vm,
-             vlib_node_runtime_t * node, vlib_frame_t * frame)
+VLIB_NODE_FN (ip4_midchain_node) (vlib_main_t * vm,
+                                 vlib_node_runtime_t * node,
+                                 vlib_frame_t * frame)
 {
   if (adj_are_counters_enabled ())
     return ip4_rewrite_inline (vm, node, frame, 1, 1, 0);
@@ -2531,9 +2528,9 @@ ip4_midchain (vlib_main_t * vm,
     return ip4_rewrite_inline (vm, node, frame, 0, 1, 0);
 }
 
-static uword
-ip4_rewrite_mcast (vlib_main_t * vm,
-                  vlib_node_runtime_t * node, vlib_frame_t * frame)
+VLIB_NODE_FN (ip4_rewrite_mcast_node) (vlib_main_t * vm,
+                                      vlib_node_runtime_t * node,
+                                      vlib_frame_t * frame)
 {
   if (adj_are_counters_enabled ())
     return ip4_rewrite_inline (vm, node, frame, 1, 0, 1);
@@ -2541,9 +2538,9 @@ ip4_rewrite_mcast (vlib_main_t * vm,
     return ip4_rewrite_inline (vm, node, frame, 0, 0, 1);
 }
 
-static uword
-ip4_mcast_midchain (vlib_main_t * vm,
-                   vlib_node_runtime_t * node, vlib_frame_t * frame)
+VLIB_NODE_FN (ip4_mcast_midchain_node) (vlib_main_t * vm,
+                                       vlib_node_runtime_t * node,
+                                       vlib_frame_t * frame)
 {
   if (adj_are_counters_enabled ())
     return ip4_rewrite_inline (vm, node, frame, 1, 1, 1);
@@ -2553,7 +2550,6 @@ ip4_mcast_midchain (vlib_main_t * vm,
 
 /* *INDENT-OFF* */
 VLIB_REGISTER_NODE (ip4_rewrite_node) = {
-  .function = ip4_rewrite,
   .name = "ip4-rewrite",
   .vector_size = sizeof (u32),
 
@@ -2566,39 +2562,40 @@ VLIB_REGISTER_NODE (ip4_rewrite_node) = {
     [IP4_REWRITE_NEXT_FRAGMENT] = "ip4-frag",
   },
 };
-VLIB_NODE_FUNCTION_MULTIARCH (ip4_rewrite_node, ip4_rewrite)
+
+VLIB_REGISTER_NODE (ip4_rewrite_bcast_node) = {
+  .name = "ip4-rewrite-bcast",
+  .vector_size = sizeof (u32),
+
+  .format_trace = format_ip4_rewrite_trace,
+  .sibling_of = "ip4-rewrite",
+};
 
 VLIB_REGISTER_NODE (ip4_rewrite_mcast_node) = {
-  .function = ip4_rewrite_mcast,
   .name = "ip4-rewrite-mcast",
   .vector_size = sizeof (u32),
 
   .format_trace = format_ip4_rewrite_trace,
   .sibling_of = "ip4-rewrite",
 };
-VLIB_NODE_FUNCTION_MULTIARCH (ip4_rewrite_mcast_node, ip4_rewrite_mcast)
 
-VLIB_REGISTER_NODE (ip4_mcast_midchain_node, static) = {
-  .function = ip4_mcast_midchain,
+VLIB_REGISTER_NODE (ip4_mcast_midchain_node) = {
   .name = "ip4-mcast-midchain",
   .vector_size = sizeof (u32),
 
   .format_trace = format_ip4_rewrite_trace,
   .sibling_of = "ip4-rewrite",
 };
-VLIB_NODE_FUNCTION_MULTIARCH (ip4_mcast_midchain_node, ip4_mcast_midchain)
 
 VLIB_REGISTER_NODE (ip4_midchain_node) = {
-  .function = ip4_midchain,
   .name = "ip4-midchain",
   .vector_size = sizeof (u32),
   .format_trace = format_ip4_forward_next_trace,
   .sibling_of =  "ip4-rewrite",
 };
-VLIB_NODE_FUNCTION_MULTIARCH (ip4_midchain_node, ip4_midchain);
 /* *INDENT-ON */
 
-int
+static int
 ip4_lookup_validate (ip4_address_t * a, u32 fib_index0)
 {
   ip4_fib_mtrie_t *mtrie0;
@@ -2695,6 +2692,7 @@ VLIB_CLI_COMMAND (lookup_test_command, static) =
 };
 /* *INDENT-ON* */
 
+#ifndef CLIB_MARCH_VARIANT
 int
 vnet_set_ip4_flow_hash (u32 table_id, u32 flow_hash_config)
 {
@@ -2710,6 +2708,7 @@ vnet_set_ip4_flow_hash (u32 table_id, u32 flow_hash_config)
 
   return 0;
 }
+#endif
 
 static clib_error_t *
 set_ip_flow_hash_command_fn (vlib_main_t * vm,
@@ -2847,6 +2846,7 @@ VLIB_CLI_COMMAND (set_ip_flow_hash_command, static) =
 };
 /* *INDENT-ON* */
 
+#ifndef CLIB_MARCH_VARIANT
 int
 vnet_set_ip4_classify_intfc (vlib_main_t * vm, u32 sw_if_index,
                             u32 table_index)
@@ -2906,6 +2906,7 @@ vnet_set_ip4_classify_intfc (vlib_main_t * vm, u32 sw_if_index,
 
   return 0;
 }
+#endif
 
 static clib_error_t *
 set_ip_classify_command_fn (vlib_main_t * vm,