illumos gate

[johns@johns ~/illumos-gate]$ git show HEAD
commit bac5707c79d544cbe6b186bea95003005ddb28d8
Author: Robert Mustacchi <rm@joyent.com>
Date:   Fri Dec 16 01:57:56 2011 +0000

    1915 IPsec esp kstats shouldn't be persistent
    Reviewed by: Bryan Cantrill <bryan@joyent.com>

diff --git a/usr/src/uts/common/inet/ip/ipsecesp.c b/usr/src/uts/common/inet/ip/ipsecesp.c
index 47972a8..5e4e400 100644
--- a/usr/src/uts/common/inet/ip/ipsecesp.c
+++ b/usr/src/uts/common/inet/ip/ipsecesp.c
@@ -21,6 +21,8 @@
 /*
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ *
+ * Copyright 2011 Joyent, Inc. All rights reserved.
  */

 #include <sys/types.h>
@@ -234,8 +236,7 @@ esp_kstat_init(ipsecesp_stack_t *espstack, netstackid_t stackid)
 {
        espstack->esp_ksp = kstat_create_netstack("ipsecesp", 0, "esp_stat",
            "net", KSTAT_TYPE_NAMED,
-           sizeof (esp_kstats_t) / sizeof (kstat_named_t),
-           KSTAT_FLAG_PERSISTENT, stackid);
+           sizeof (esp_kstats_t) / sizeof (kstat_named_t), 0, stackid);

        if (espstack->esp_ksp == NULL || espstack->esp_ksp->ks_data == NULL)
                return (B_FALSE);

A similar change will be needed in ipsecah as well.

This one is also known as SmartOS bugs https://smartos.org/bugview/OS-816 and https://smartos.org/bugview/OS-6334

The cause of this bug goes WAY back to before Stack Instances. Because of the IPsec loader thread, there was thought that maybe IPsec could be unloaded, and reloaded again, so persistent kstats were desirable in the face of such a possibility. Reality proved that once loaded, IPsec would stay up for the life of the system's boot.