xref: /titanic_41/usr/src/uts/common/inet/ip/ip_if.c (revision 172a5f51e33e51ae977e619a3a0c39d4325a8886)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright (c) 1990 Mentat Inc.
24  * Copyright (c) 2013 by Delphix. All rights reserved.
25  * Copyright 2013 Joyent, Inc.
26  * Copyright (c) 2014, OmniTI Computer Consulting, Inc. All rights reserved.
27  */
28 
29 /*
30  * This file contains the interface control functions for IP.
31  */
32 
33 #include <sys/types.h>
34 #include <sys/stream.h>
35 #include <sys/dlpi.h>
36 #include <sys/stropts.h>
37 #include <sys/strsun.h>
38 #include <sys/sysmacros.h>
39 #include <sys/strsubr.h>
40 #include <sys/strlog.h>
41 #include <sys/ddi.h>
42 #include <sys/sunddi.h>
43 #include <sys/cmn_err.h>
44 #include <sys/kstat.h>
45 #include <sys/debug.h>
46 #include <sys/zone.h>
47 #include <sys/sunldi.h>
48 #include <sys/file.h>
49 #include <sys/bitmap.h>
50 #include <sys/cpuvar.h>
51 #include <sys/time.h>
52 #include <sys/ctype.h>
53 #include <sys/kmem.h>
54 #include <sys/systm.h>
55 #include <sys/param.h>
56 #include <sys/socket.h>
57 #include <sys/isa_defs.h>
58 #include <net/if.h>
59 #include <net/if_arp.h>
60 #include <net/if_types.h>
61 #include <net/if_dl.h>
62 #include <net/route.h>
63 #include <sys/sockio.h>
64 #include <netinet/in.h>
65 #include <netinet/ip6.h>
66 #include <netinet/icmp6.h>
67 #include <netinet/igmp_var.h>
68 #include <sys/policy.h>
69 #include <sys/ethernet.h>
70 #include <sys/callb.h>
71 #include <sys/md5.h>
72 
73 #include <inet/common.h>   /* for various inet/mi.h and inet/nd.h needs */
74 #include <inet/mi.h>
75 #include <inet/nd.h>
76 #include <inet/tunables.h>
77 #include <inet/arp.h>
78 #include <inet/ip_arp.h>
79 #include <inet/mib2.h>
80 #include <inet/ip.h>
81 #include <inet/ip6.h>
82 #include <inet/ip6_asp.h>
83 #include <inet/tcp.h>
84 #include <inet/ip_multi.h>
85 #include <inet/ip_ire.h>
86 #include <inet/ip_ftable.h>
87 #include <inet/ip_rts.h>
88 #include <inet/ip_ndp.h>
89 #include <inet/ip_if.h>
90 #include <inet/ip_impl.h>
91 #include <inet/sctp_ip.h>
92 #include <inet/ip_netinfo.h>
93 #include <inet/ilb_ip.h>
94 
95 #include <netinet/igmp.h>
96 #include <inet/ip_listutils.h>
97 #include <inet/ipclassifier.h>
98 #include <sys/mac_client.h>
99 #include <sys/dld.h>
100 #include <sys/mac_flow.h>
101 
102 #include <sys/systeminfo.h>
103 #include <sys/bootconf.h>
104 
105 #include <sys/tsol/tndb.h>
106 #include <sys/tsol/tnet.h>
107 
108 #include <inet/rawip_impl.h> /* needed for icmp_stack_t */
109 #include <inet/udp_impl.h> /* needed for udp_stack_t */
110 
111 /* The character which tells where the ill_name ends */
112 #define	IPIF_SEPARATOR_CHAR	':'
113 
114 /* IP ioctl function table entry */
115 typedef struct ipft_s {
116 	int	ipft_cmd;
117 	pfi_t	ipft_pfi;
118 	int	ipft_min_size;
119 	int	ipft_flags;
120 } ipft_t;
121 #define	IPFT_F_NO_REPLY		0x1	/* IP ioctl does not expect any reply */
122 #define	IPFT_F_SELF_REPLY	0x2	/* ioctl callee does the ioctl reply */
123 
124 static int	nd_ill_forward_get(queue_t *, mblk_t *, caddr_t, cred_t *);
125 static int	nd_ill_forward_set(queue_t *q, mblk_t *mp,
126 		    char *value, caddr_t cp, cred_t *ioc_cr);
127 
128 static boolean_t ill_is_quiescent(ill_t *);
129 static boolean_t ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask);
130 static ip_m_t	*ip_m_lookup(t_uscalar_t mac_type);
131 static int	ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
132     mblk_t *mp, boolean_t need_up);
133 static int	ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
134     mblk_t *mp, boolean_t need_up);
135 static int	ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
136     queue_t *q, mblk_t *mp, boolean_t need_up);
137 static int	ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q,
138     mblk_t *mp);
139 static int	ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
140     mblk_t *mp);
141 static int	ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t, in6_addr_t,
142     queue_t *q, mblk_t *mp, boolean_t need_up);
143 static int	ip_sioctl_plink_ipmod(ipsq_t *ipsq, queue_t *q, mblk_t *mp,
144     int ioccmd, struct linkblk *li);
145 static ipaddr_t	ip_subnet_mask(ipaddr_t addr, ipif_t **, ip_stack_t *);
146 static void	ip_wput_ioctl(queue_t *q, mblk_t *mp);
147 static void	ipsq_flush(ill_t *ill);
148 
149 static	int	ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen,
150     queue_t *q, mblk_t *mp, boolean_t need_up);
151 static void	ipsq_delete(ipsq_t *);
152 
153 static ipif_t	*ipif_allocate(ill_t *ill, int id, uint_t ire_type,
154     boolean_t initialize, boolean_t insert, int *errorp);
155 static ire_t	**ipif_create_bcast_ires(ipif_t *ipif, ire_t **irep);
156 static void	ipif_delete_bcast_ires(ipif_t *ipif);
157 static int	ipif_add_ires_v4(ipif_t *, boolean_t);
158 static boolean_t ipif_comp_multi(ipif_t *old_ipif, ipif_t *new_ipif,
159 		    boolean_t isv6);
160 static int	ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp);
161 static void	ipif_free(ipif_t *ipif);
162 static void	ipif_free_tail(ipif_t *ipif);
163 static void	ipif_set_default(ipif_t *ipif);
164 static int	ipif_set_values(queue_t *q, mblk_t *mp,
165     char *interf_name, uint_t *ppa);
166 static int	ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp,
167     queue_t *q);
168 static ipif_t	*ipif_lookup_on_name(char *name, size_t namelen,
169     boolean_t do_alloc, boolean_t *exists, boolean_t isv6, zoneid_t zoneid,
170     ip_stack_t *);
171 static ipif_t	*ipif_lookup_on_name_async(char *name, size_t namelen,
172     boolean_t isv6, zoneid_t zoneid, queue_t *q, mblk_t *mp, ipsq_func_t func,
173     int *error, ip_stack_t *);
174 
175 static int	ill_alloc_ppa(ill_if_t *, ill_t *);
176 static void	ill_delete_interface_type(ill_if_t *);
177 static int	ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q);
178 static void	ill_dl_down(ill_t *ill);
179 static void	ill_down(ill_t *ill);
180 static void	ill_down_ipifs(ill_t *, boolean_t);
181 static void	ill_free_mib(ill_t *ill);
182 static void	ill_glist_delete(ill_t *);
183 static void	ill_phyint_reinit(ill_t *ill);
184 static void	ill_set_nce_router_flags(ill_t *, boolean_t);
185 static void	ill_set_phys_addr_tail(ipsq_t *, queue_t *, mblk_t *, void *);
186 static void	ill_replumb_tail(ipsq_t *, queue_t *, mblk_t *, void *);
187 
188 static ip_v6intfid_func_t ip_ether_v6intfid, ip_ib_v6intfid;
189 static ip_v6intfid_func_t ip_ipv4_v6intfid, ip_ipv6_v6intfid;
190 static ip_v6intfid_func_t ip_ipmp_v6intfid, ip_nodef_v6intfid;
191 static ip_v6intfid_func_t ip_ipv4_v6destintfid, ip_ipv6_v6destintfid;
192 static ip_v4mapinfo_func_t ip_ether_v4_mapping;
193 static ip_v6mapinfo_func_t ip_ether_v6_mapping;
194 static ip_v4mapinfo_func_t ip_ib_v4_mapping;
195 static ip_v6mapinfo_func_t ip_ib_v6_mapping;
196 static ip_v4mapinfo_func_t ip_mbcast_mapping;
197 static void 	ip_cgtp_bcast_add(ire_t *, ip_stack_t *);
198 static void 	ip_cgtp_bcast_delete(ire_t *, ip_stack_t *);
199 static void	phyint_free(phyint_t *);
200 
201 static void ill_capability_dispatch(ill_t *, mblk_t *, dl_capability_sub_t *);
202 static void ill_capability_id_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
203 static void ill_capability_vrrp_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
204 static void ill_capability_hcksum_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
205 static void ill_capability_hcksum_reset_fill(ill_t *, mblk_t *);
206 static void ill_capability_zerocopy_ack(ill_t *, mblk_t *,
207     dl_capability_sub_t *);
208 static void ill_capability_zerocopy_reset_fill(ill_t *, mblk_t *);
209 static void	ill_capability_dld_reset_fill(ill_t *, mblk_t *);
210 static void	ill_capability_dld_ack(ill_t *, mblk_t *,
211 		    dl_capability_sub_t *);
212 static void	ill_capability_dld_enable(ill_t *);
213 static void	ill_capability_ack_thr(void *);
214 static void	ill_capability_lso_enable(ill_t *);
215 
216 static ill_t	*ill_prev_usesrc(ill_t *);
217 static int	ill_relink_usesrc_ills(ill_t *, ill_t *, uint_t);
218 static void	ill_disband_usesrc_group(ill_t *);
219 static void	ip_sioctl_garp_reply(mblk_t *, ill_t *, void *, int);
220 
221 #ifdef DEBUG
222 static	void	ill_trace_cleanup(const ill_t *);
223 static	void	ipif_trace_cleanup(const ipif_t *);
224 #endif
225 
226 static	void	ill_dlpi_clear_deferred(ill_t *ill);
227 
228 static	void	phyint_flags_init(phyint_t *, t_uscalar_t);
229 
230 /*
231  * if we go over the memory footprint limit more than once in this msec
232  * interval, we'll start pruning aggressively.
233  */
234 int ip_min_frag_prune_time = 0;
235 
236 static ipft_t	ip_ioctl_ftbl[] = {
237 	{ IP_IOC_IRE_DELETE, ip_ire_delete, sizeof (ipid_t), 0 },
238 	{ IP_IOC_IRE_DELETE_NO_REPLY, ip_ire_delete, sizeof (ipid_t),
239 		IPFT_F_NO_REPLY },
240 	{ IP_IOC_RTS_REQUEST, ip_rts_request, 0, IPFT_F_SELF_REPLY },
241 	{ 0 }
242 };
243 
244 /* Simple ICMP IP Header Template */
245 static ipha_t icmp_ipha = {
246 	IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
247 };
248 
249 static uchar_t	ip_six_byte_all_ones[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
250 
251 static ip_m_t   ip_m_tbl[] = {
252 	{ DL_ETHER, IFT_ETHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
253 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_ether_v6intfid,
254 	    ip_nodef_v6intfid },
255 	{ DL_CSMACD, IFT_ISO88023, ETHERTYPE_IP, ETHERTYPE_IPV6,
256 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
257 	    ip_nodef_v6intfid },
258 	{ DL_TPB, IFT_ISO88024, ETHERTYPE_IP, ETHERTYPE_IPV6,
259 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
260 	    ip_nodef_v6intfid },
261 	{ DL_TPR, IFT_ISO88025, ETHERTYPE_IP, ETHERTYPE_IPV6,
262 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
263 	    ip_nodef_v6intfid },
264 	{ DL_FDDI, IFT_FDDI, ETHERTYPE_IP, ETHERTYPE_IPV6,
265 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_ether_v6intfid,
266 	    ip_nodef_v6intfid },
267 	{ DL_IB, IFT_IB, ETHERTYPE_IP, ETHERTYPE_IPV6,
268 	    ip_ib_v4_mapping, ip_ib_v6_mapping, ip_ib_v6intfid,
269 	    ip_nodef_v6intfid },
270 	{ DL_IPV4, IFT_IPV4, IPPROTO_ENCAP, IPPROTO_IPV6,
271 	    ip_mbcast_mapping, ip_mbcast_mapping, ip_ipv4_v6intfid,
272 	    ip_ipv4_v6destintfid },
273 	{ DL_IPV6, IFT_IPV6, IPPROTO_ENCAP, IPPROTO_IPV6,
274 	    ip_mbcast_mapping, ip_mbcast_mapping, ip_ipv6_v6intfid,
275 	    ip_ipv6_v6destintfid },
276 	{ DL_6TO4, IFT_6TO4, IPPROTO_ENCAP, IPPROTO_IPV6,
277 	    ip_mbcast_mapping, ip_mbcast_mapping, ip_ipv4_v6intfid,
278 	    ip_nodef_v6intfid },
279 	{ SUNW_DL_VNI, IFT_OTHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
280 	    NULL, NULL, ip_nodef_v6intfid, ip_nodef_v6intfid },
281 	{ SUNW_DL_IPMP, IFT_OTHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
282 	    NULL, NULL, ip_ipmp_v6intfid, ip_nodef_v6intfid },
283 	{ DL_OTHER, IFT_OTHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
284 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
285 	    ip_nodef_v6intfid }
286 };
287 
288 char	ipif_loopback_name[] = "lo0";
289 
290 /* These are used by all IP network modules. */
291 sin6_t	sin6_null;	/* Zero address for quick clears */
292 sin_t	sin_null;	/* Zero address for quick clears */
293 
294 /* When set search for unused ipif_seqid */
295 static ipif_t	ipif_zero;
296 
297 /*
298  * ppa arena is created after these many
299  * interfaces have been plumbed.
300  */
301 uint_t	ill_no_arena = 12;	/* Setable in /etc/system */
302 
303 /*
304  * Allocate per-interface mibs.
305  * Returns true if ok. False otherwise.
306  *  ipsq  may not yet be allocated (loopback case ).
307  */
308 static boolean_t
ill_allocate_mibs(ill_t * ill)309 ill_allocate_mibs(ill_t *ill)
310 {
311 	/* Already allocated? */
312 	if (ill->ill_ip_mib != NULL) {
313 		if (ill->ill_isv6)
314 			ASSERT(ill->ill_icmp6_mib != NULL);
315 		return (B_TRUE);
316 	}
317 
318 	ill->ill_ip_mib = kmem_zalloc(sizeof (*ill->ill_ip_mib),
319 	    KM_NOSLEEP);
320 	if (ill->ill_ip_mib == NULL) {
321 		return (B_FALSE);
322 	}
323 
324 	/* Setup static information */
325 	SET_MIB(ill->ill_ip_mib->ipIfStatsEntrySize,
326 	    sizeof (mib2_ipIfStatsEntry_t));
327 	if (ill->ill_isv6) {
328 		ill->ill_ip_mib->ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv6;
329 		SET_MIB(ill->ill_ip_mib->ipIfStatsAddrEntrySize,
330 		    sizeof (mib2_ipv6AddrEntry_t));
331 		SET_MIB(ill->ill_ip_mib->ipIfStatsRouteEntrySize,
332 		    sizeof (mib2_ipv6RouteEntry_t));
333 		SET_MIB(ill->ill_ip_mib->ipIfStatsNetToMediaEntrySize,
334 		    sizeof (mib2_ipv6NetToMediaEntry_t));
335 		SET_MIB(ill->ill_ip_mib->ipIfStatsMemberEntrySize,
336 		    sizeof (ipv6_member_t));
337 		SET_MIB(ill->ill_ip_mib->ipIfStatsGroupSourceEntrySize,
338 		    sizeof (ipv6_grpsrc_t));
339 	} else {
340 		ill->ill_ip_mib->ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv4;
341 		SET_MIB(ill->ill_ip_mib->ipIfStatsAddrEntrySize,
342 		    sizeof (mib2_ipAddrEntry_t));
343 		SET_MIB(ill->ill_ip_mib->ipIfStatsRouteEntrySize,
344 		    sizeof (mib2_ipRouteEntry_t));
345 		SET_MIB(ill->ill_ip_mib->ipIfStatsNetToMediaEntrySize,
346 		    sizeof (mib2_ipNetToMediaEntry_t));
347 		SET_MIB(ill->ill_ip_mib->ipIfStatsMemberEntrySize,
348 		    sizeof (ip_member_t));
349 		SET_MIB(ill->ill_ip_mib->ipIfStatsGroupSourceEntrySize,
350 		    sizeof (ip_grpsrc_t));
351 
352 		/*
353 		 * For a v4 ill, we are done at this point, because per ill
354 		 * icmp mibs are only used for v6.
355 		 */
356 		return (B_TRUE);
357 	}
358 
359 	ill->ill_icmp6_mib = kmem_zalloc(sizeof (*ill->ill_icmp6_mib),
360 	    KM_NOSLEEP);
361 	if (ill->ill_icmp6_mib == NULL) {
362 		kmem_free(ill->ill_ip_mib, sizeof (*ill->ill_ip_mib));
363 		ill->ill_ip_mib = NULL;
364 		return (B_FALSE);
365 	}
366 	/* static icmp info */
367 	ill->ill_icmp6_mib->ipv6IfIcmpEntrySize =
368 	    sizeof (mib2_ipv6IfIcmpEntry_t);
369 	/*
370 	 * The ipIfStatsIfindex and ipv6IfIcmpIndex will be assigned later
371 	 * after the phyint merge occurs in ipif_set_values -> ill_glist_insert
372 	 * -> ill_phyint_reinit
373 	 */
374 	return (B_TRUE);
375 }
376 
377 /*
378  * Completely vaporize a lower level tap and all associated interfaces.
379  * ill_delete is called only out of ip_close when the device control
380  * stream is being closed.
381  */
382 void
ill_delete(ill_t * ill)383 ill_delete(ill_t *ill)
384 {
385 	ipif_t	*ipif;
386 	ill_t	*prev_ill;
387 	ip_stack_t	*ipst = ill->ill_ipst;
388 
389 	/*
390 	 * ill_delete may be forcibly entering the ipsq. The previous
391 	 * ioctl may not have completed and may need to be aborted.
392 	 * ipsq_flush takes care of it. If we don't need to enter the
393 	 * the ipsq forcibly, the 2nd invocation of ipsq_flush in
394 	 * ill_delete_tail is sufficient.
395 	 */
396 	ipsq_flush(ill);
397 
398 	/*
399 	 * Nuke all interfaces.  ipif_free will take down the interface,
400 	 * remove it from the list, and free the data structure.
401 	 * Walk down the ipif list and remove the logical interfaces
402 	 * first before removing the main ipif. We can't unplumb
403 	 * zeroth interface first in the case of IPv6 as update_conn_ill
404 	 * -> ip_ll_multireq de-references ill_ipif for checking
405 	 * POINTOPOINT.
406 	 *
407 	 * If ill_ipif was not properly initialized (i.e low on memory),
408 	 * then no interfaces to clean up. In this case just clean up the
409 	 * ill.
410 	 */
411 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
412 		ipif_free(ipif);
413 
414 	/*
415 	 * clean out all the nce_t entries that depend on this
416 	 * ill for the ill_phys_addr.
417 	 */
418 	nce_flush(ill, B_TRUE);
419 
420 	/* Clean up msgs on pending upcalls for mrouted */
421 	reset_mrt_ill(ill);
422 
423 	update_conn_ill(ill, ipst);
424 
425 	/*
426 	 * Remove multicast references added as a result of calls to
427 	 * ip_join_allmulti().
428 	 */
429 	ip_purge_allmulti(ill);
430 
431 	/*
432 	 * If the ill being deleted is under IPMP, boot it out of the illgrp.
433 	 */
434 	if (IS_UNDER_IPMP(ill))
435 		ipmp_ill_leave_illgrp(ill);
436 
437 	/*
438 	 * ill_down will arrange to blow off any IRE's dependent on this
439 	 * ILL, and shut down fragmentation reassembly.
440 	 */
441 	ill_down(ill);
442 
443 	/* Let SCTP know, so that it can remove this from its list. */
444 	sctp_update_ill(ill, SCTP_ILL_REMOVE);
445 
446 	/*
447 	 * Walk all CONNs that can have a reference on an ire or nce for this
448 	 * ill (we actually walk all that now have stale references).
449 	 */
450 	ipcl_walk(conn_ixa_cleanup, (void *)B_TRUE, ipst);
451 
452 	/* With IPv6 we have dce_ifindex. Cleanup for neatness */
453 	if (ill->ill_isv6)
454 		dce_cleanup(ill->ill_phyint->phyint_ifindex, ipst);
455 
456 	/*
457 	 * If an address on this ILL is being used as a source address then
458 	 * clear out the pointers in other ILLs that point to this ILL.
459 	 */
460 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
461 	if (ill->ill_usesrc_grp_next != NULL) {
462 		if (ill->ill_usesrc_ifindex == 0) { /* usesrc ILL ? */
463 			ill_disband_usesrc_group(ill);
464 		} else {	/* consumer of the usesrc ILL */
465 			prev_ill = ill_prev_usesrc(ill);
466 			prev_ill->ill_usesrc_grp_next =
467 			    ill->ill_usesrc_grp_next;
468 		}
469 	}
470 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
471 }
472 
473 static void
ipif_non_duplicate(ipif_t * ipif)474 ipif_non_duplicate(ipif_t *ipif)
475 {
476 	ill_t *ill = ipif->ipif_ill;
477 	mutex_enter(&ill->ill_lock);
478 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
479 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
480 		ASSERT(ill->ill_ipif_dup_count > 0);
481 		ill->ill_ipif_dup_count--;
482 	}
483 	mutex_exit(&ill->ill_lock);
484 }
485 
486 /*
487  * ill_delete_tail is called from ip_modclose after all references
488  * to the closing ill are gone. The wait is done in ip_modclose
489  */
490 void
ill_delete_tail(ill_t * ill)491 ill_delete_tail(ill_t *ill)
492 {
493 	mblk_t	**mpp;
494 	ipif_t	*ipif;
495 	ip_stack_t *ipst = ill->ill_ipst;
496 
497 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
498 		ipif_non_duplicate(ipif);
499 		(void) ipif_down_tail(ipif);
500 	}
501 
502 	ASSERT(ill->ill_ipif_dup_count == 0);
503 
504 	/*
505 	 * If polling capability is enabled (which signifies direct
506 	 * upcall into IP and driver has ill saved as a handle),
507 	 * we need to make sure that unbind has completed before we
508 	 * let the ill disappear and driver no longer has any reference
509 	 * to this ill.
510 	 */
511 	mutex_enter(&ill->ill_lock);
512 	while (ill->ill_state_flags & ILL_DL_UNBIND_IN_PROGRESS)
513 		cv_wait(&ill->ill_cv, &ill->ill_lock);
514 	mutex_exit(&ill->ill_lock);
515 	ASSERT(!(ill->ill_capabilities &
516 	    (ILL_CAPAB_DLD | ILL_CAPAB_DLD_POLL | ILL_CAPAB_DLD_DIRECT)));
517 
518 	if (ill->ill_net_type != IRE_LOOPBACK)
519 		qprocsoff(ill->ill_rq);
520 
521 	/*
522 	 * We do an ipsq_flush once again now. New messages could have
523 	 * landed up from below (M_ERROR or M_HANGUP). Similarly ioctls
524 	 * could also have landed up if an ioctl thread had looked up
525 	 * the ill before we set the ILL_CONDEMNED flag, but not yet
526 	 * enqueued the ioctl when we did the ipsq_flush last time.
527 	 */
528 	ipsq_flush(ill);
529 
530 	/*
531 	 * Free capabilities.
532 	 */
533 	if (ill->ill_hcksum_capab != NULL) {
534 		kmem_free(ill->ill_hcksum_capab, sizeof (ill_hcksum_capab_t));
535 		ill->ill_hcksum_capab = NULL;
536 	}
537 
538 	if (ill->ill_zerocopy_capab != NULL) {
539 		kmem_free(ill->ill_zerocopy_capab,
540 		    sizeof (ill_zerocopy_capab_t));
541 		ill->ill_zerocopy_capab = NULL;
542 	}
543 
544 	if (ill->ill_lso_capab != NULL) {
545 		kmem_free(ill->ill_lso_capab, sizeof (ill_lso_capab_t));
546 		ill->ill_lso_capab = NULL;
547 	}
548 
549 	if (ill->ill_dld_capab != NULL) {
550 		kmem_free(ill->ill_dld_capab, sizeof (ill_dld_capab_t));
551 		ill->ill_dld_capab = NULL;
552 	}
553 
554 	/* Clean up ill_allowed_ips* related state */
555 	if (ill->ill_allowed_ips != NULL) {
556 		ASSERT(ill->ill_allowed_ips_cnt > 0);
557 		kmem_free(ill->ill_allowed_ips,
558 		    ill->ill_allowed_ips_cnt * sizeof (in6_addr_t));
559 		ill->ill_allowed_ips = NULL;
560 		ill->ill_allowed_ips_cnt = 0;
561 	}
562 
563 	while (ill->ill_ipif != NULL)
564 		ipif_free_tail(ill->ill_ipif);
565 
566 	/*
567 	 * We have removed all references to ilm from conn and the ones joined
568 	 * within the kernel.
569 	 *
570 	 * We don't walk conns, mrts and ires because
571 	 *
572 	 * 1) update_conn_ill and reset_mrt_ill cleans up conns and mrts.
573 	 * 2) ill_down ->ill_downi walks all the ires and cleans up
574 	 *    ill references.
575 	 */
576 
577 	/*
578 	 * If this ill is an IPMP meta-interface, blow away the illgrp.  This
579 	 * is safe to do because the illgrp has already been unlinked from the
580 	 * group by I_PUNLINK, and thus SIOCSLIFGROUPNAME cannot find it.
581 	 */
582 	if (IS_IPMP(ill)) {
583 		ipmp_illgrp_destroy(ill->ill_grp);
584 		ill->ill_grp = NULL;
585 	}
586 
587 	if (ill->ill_mphysaddr_list != NULL) {
588 		multiphysaddr_t *mpa, *tmpa;
589 
590 		mpa = ill->ill_mphysaddr_list;
591 		ill->ill_mphysaddr_list = NULL;
592 		while (mpa) {
593 			tmpa = mpa->mpa_next;
594 			kmem_free(mpa, sizeof (*mpa));
595 			mpa = tmpa;
596 		}
597 	}
598 	/*
599 	 * Take us out of the list of ILLs. ill_glist_delete -> phyint_free
600 	 * could free the phyint. No more reference to the phyint after this
601 	 * point.
602 	 */
603 	(void) ill_glist_delete(ill);
604 
605 	if (ill->ill_frag_ptr != NULL) {
606 		uint_t count;
607 
608 		for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
609 			mutex_destroy(&ill->ill_frag_hash_tbl[count].ipfb_lock);
610 		}
611 		mi_free(ill->ill_frag_ptr);
612 		ill->ill_frag_ptr = NULL;
613 		ill->ill_frag_hash_tbl = NULL;
614 	}
615 
616 	freemsg(ill->ill_nd_lla_mp);
617 	/* Free all retained control messages. */
618 	mpp = &ill->ill_first_mp_to_free;
619 	do {
620 		while (mpp[0]) {
621 			mblk_t  *mp;
622 			mblk_t  *mp1;
623 
624 			mp = mpp[0];
625 			mpp[0] = mp->b_next;
626 			for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont) {
627 				mp1->b_next = NULL;
628 				mp1->b_prev = NULL;
629 			}
630 			freemsg(mp);
631 		}
632 	} while (mpp++ != &ill->ill_last_mp_to_free);
633 
634 	ill_free_mib(ill);
635 
636 #ifdef DEBUG
637 	ill_trace_cleanup(ill);
638 #endif
639 
640 	/* The default multicast interface might have changed */
641 	ire_increment_multicast_generation(ipst, ill->ill_isv6);
642 
643 	/* Drop refcnt here */
644 	netstack_rele(ill->ill_ipst->ips_netstack);
645 	ill->ill_ipst = NULL;
646 }
647 
648 static void
ill_free_mib(ill_t * ill)649 ill_free_mib(ill_t *ill)
650 {
651 	ip_stack_t *ipst = ill->ill_ipst;
652 
653 	/*
654 	 * MIB statistics must not be lost, so when an interface
655 	 * goes away the counter values will be added to the global
656 	 * MIBs.
657 	 */
658 	if (ill->ill_ip_mib != NULL) {
659 		if (ill->ill_isv6) {
660 			ip_mib2_add_ip_stats(&ipst->ips_ip6_mib,
661 			    ill->ill_ip_mib);
662 		} else {
663 			ip_mib2_add_ip_stats(&ipst->ips_ip_mib,
664 			    ill->ill_ip_mib);
665 		}
666 
667 		kmem_free(ill->ill_ip_mib, sizeof (*ill->ill_ip_mib));
668 		ill->ill_ip_mib = NULL;
669 	}
670 	if (ill->ill_icmp6_mib != NULL) {
671 		ip_mib2_add_icmp6_stats(&ipst->ips_icmp6_mib,
672 		    ill->ill_icmp6_mib);
673 		kmem_free(ill->ill_icmp6_mib, sizeof (*ill->ill_icmp6_mib));
674 		ill->ill_icmp6_mib = NULL;
675 	}
676 }
677 
678 /*
679  * Concatenate together a physical address and a sap.
680  *
681  * Sap_lengths are interpreted as follows:
682  *   sap_length == 0	==>	no sap
683  *   sap_length > 0	==>	sap is at the head of the dlpi address
684  *   sap_length < 0	==>	sap is at the tail of the dlpi address
685  */
686 static void
ill_dlur_copy_address(uchar_t * phys_src,uint_t phys_length,t_scalar_t sap_src,t_scalar_t sap_length,uchar_t * dst)687 ill_dlur_copy_address(uchar_t *phys_src, uint_t phys_length,
688     t_scalar_t sap_src, t_scalar_t sap_length, uchar_t *dst)
689 {
690 	uint16_t sap_addr = (uint16_t)sap_src;
691 
692 	if (sap_length == 0) {
693 		if (phys_src == NULL)
694 			bzero(dst, phys_length);
695 		else
696 			bcopy(phys_src, dst, phys_length);
697 	} else if (sap_length < 0) {
698 		if (phys_src == NULL)
699 			bzero(dst, phys_length);
700 		else
701 			bcopy(phys_src, dst, phys_length);
702 		bcopy(&sap_addr, (char *)dst + phys_length, sizeof (sap_addr));
703 	} else {
704 		bcopy(&sap_addr, dst, sizeof (sap_addr));
705 		if (phys_src == NULL)
706 			bzero((char *)dst + sap_length, phys_length);
707 		else
708 			bcopy(phys_src, (char *)dst + sap_length, phys_length);
709 	}
710 }
711 
712 /*
713  * Generate a dl_unitdata_req mblk for the device and address given.
714  * addr_length is the length of the physical portion of the address.
715  * If addr is NULL include an all zero address of the specified length.
716  * TRUE? In any case, addr_length is taken to be the entire length of the
717  * dlpi address, including the absolute value of sap_length.
718  */
719 mblk_t *
ill_dlur_gen(uchar_t * addr,uint_t addr_length,t_uscalar_t sap,t_scalar_t sap_length)720 ill_dlur_gen(uchar_t *addr, uint_t addr_length, t_uscalar_t sap,
721 		t_scalar_t sap_length)
722 {
723 	dl_unitdata_req_t *dlur;
724 	mblk_t	*mp;
725 	t_scalar_t	abs_sap_length;		/* absolute value */
726 
727 	abs_sap_length = ABS(sap_length);
728 	mp = ip_dlpi_alloc(sizeof (*dlur) + addr_length + abs_sap_length,
729 	    DL_UNITDATA_REQ);
730 	if (mp == NULL)
731 		return (NULL);
732 	dlur = (dl_unitdata_req_t *)mp->b_rptr;
733 	/* HACK: accomodate incompatible DLPI drivers */
734 	if (addr_length == 8)
735 		addr_length = 6;
736 	dlur->dl_dest_addr_length = addr_length + abs_sap_length;
737 	dlur->dl_dest_addr_offset = sizeof (*dlur);
738 	dlur->dl_priority.dl_min = 0;
739 	dlur->dl_priority.dl_max = 0;
740 	ill_dlur_copy_address(addr, addr_length, sap, sap_length,
741 	    (uchar_t *)&dlur[1]);
742 	return (mp);
743 }
744 
745 /*
746  * Add the pending mp to the list. There can be only 1 pending mp
747  * in the list. Any exclusive ioctl that needs to wait for a response
748  * from another module or driver needs to use this function to set
749  * the ipx_pending_mp to the ioctl mblk and wait for the response from
750  * the other module/driver. This is also used while waiting for the
751  * ipif/ill/ire refcnts to drop to zero in bringing down an ipif.
752  */
753 boolean_t
ipsq_pending_mp_add(conn_t * connp,ipif_t * ipif,queue_t * q,mblk_t * add_mp,int waitfor)754 ipsq_pending_mp_add(conn_t *connp, ipif_t *ipif, queue_t *q, mblk_t *add_mp,
755     int waitfor)
756 {
757 	ipxop_t	*ipx = ipif->ipif_ill->ill_phyint->phyint_ipsq->ipsq_xop;
758 
759 	ASSERT(IAM_WRITER_IPIF(ipif));
760 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
761 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
762 	ASSERT(ipx->ipx_pending_mp == NULL);
763 	/*
764 	 * The caller may be using a different ipif than the one passed into
765 	 * ipsq_current_start() (e.g., suppose an ioctl that came in on the V4
766 	 * ill needs to wait for the V6 ill to quiesce).  So we can't ASSERT
767 	 * that `ipx_current_ipif == ipif'.
768 	 */
769 	ASSERT(ipx->ipx_current_ipif != NULL);
770 
771 	/*
772 	 * M_IOCDATA from ioctls, M_ERROR/M_HANGUP/M_PROTO/M_PCPROTO from the
773 	 * driver.
774 	 */
775 	ASSERT((DB_TYPE(add_mp) == M_IOCDATA) || (DB_TYPE(add_mp) == M_ERROR) ||
776 	    (DB_TYPE(add_mp) == M_HANGUP) || (DB_TYPE(add_mp) == M_PROTO) ||
777 	    (DB_TYPE(add_mp) == M_PCPROTO));
778 
779 	if (connp != NULL) {
780 		ASSERT(MUTEX_HELD(&connp->conn_lock));
781 		/*
782 		 * Return error if the conn has started closing. The conn
783 		 * could have finished cleaning up the pending mp list,
784 		 * If so we should not add another mp to the list negating
785 		 * the cleanup.
786 		 */
787 		if (connp->conn_state_flags & CONN_CLOSING)
788 			return (B_FALSE);
789 	}
790 	mutex_enter(&ipx->ipx_lock);
791 	ipx->ipx_pending_ipif = ipif;
792 	/*
793 	 * Note down the queue in b_queue. This will be returned by
794 	 * ipsq_pending_mp_get. Caller will then use these values to restart
795 	 * the processing
796 	 */
797 	add_mp->b_next = NULL;
798 	add_mp->b_queue = q;
799 	ipx->ipx_pending_mp = add_mp;
800 	ipx->ipx_waitfor = waitfor;
801 	mutex_exit(&ipx->ipx_lock);
802 
803 	if (connp != NULL)
804 		connp->conn_oper_pending_ill = ipif->ipif_ill;
805 
806 	return (B_TRUE);
807 }
808 
809 /*
810  * Retrieve the ipx_pending_mp and return it. There can be only 1 mp
811  * queued in the list.
812  */
813 mblk_t *
ipsq_pending_mp_get(ipsq_t * ipsq,conn_t ** connpp)814 ipsq_pending_mp_get(ipsq_t *ipsq, conn_t **connpp)
815 {
816 	mblk_t	*curr = NULL;
817 	ipxop_t	*ipx = ipsq->ipsq_xop;
818 
819 	*connpp = NULL;
820 	mutex_enter(&ipx->ipx_lock);
821 	if (ipx->ipx_pending_mp == NULL) {
822 		mutex_exit(&ipx->ipx_lock);
823 		return (NULL);
824 	}
825 
826 	/* There can be only 1 such excl message */
827 	curr = ipx->ipx_pending_mp;
828 	ASSERT(curr->b_next == NULL);
829 	ipx->ipx_pending_ipif = NULL;
830 	ipx->ipx_pending_mp = NULL;
831 	ipx->ipx_waitfor = 0;
832 	mutex_exit(&ipx->ipx_lock);
833 
834 	if (CONN_Q(curr->b_queue)) {
835 		/*
836 		 * This mp did a refhold on the conn, at the start of the ioctl.
837 		 * So we can safely return a pointer to the conn to the caller.
838 		 */
839 		*connpp = Q_TO_CONN(curr->b_queue);
840 	} else {
841 		*connpp = NULL;
842 	}
843 	curr->b_next = NULL;
844 	curr->b_prev = NULL;
845 	return (curr);
846 }
847 
848 /*
849  * Cleanup the ioctl mp queued in ipx_pending_mp
850  * - Called in the ill_delete path
851  * - Called in the M_ERROR or M_HANGUP path on the ill.
852  * - Called in the conn close path.
853  *
854  * Returns success on finding the pending mblk associated with the ioctl or
855  * exclusive operation in progress, failure otherwise.
856  */
857 boolean_t
ipsq_pending_mp_cleanup(ill_t * ill,conn_t * connp)858 ipsq_pending_mp_cleanup(ill_t *ill, conn_t *connp)
859 {
860 	mblk_t	*mp;
861 	ipxop_t	*ipx;
862 	queue_t	*q;
863 	ipif_t	*ipif;
864 	int	cmd;
865 
866 	ASSERT(IAM_WRITER_ILL(ill));
867 	ipx = ill->ill_phyint->phyint_ipsq->ipsq_xop;
868 
869 	mutex_enter(&ipx->ipx_lock);
870 	mp = ipx->ipx_pending_mp;
871 	if (connp != NULL) {
872 		if (mp == NULL || mp->b_queue != CONNP_TO_WQ(connp)) {
873 			/*
874 			 * Nothing to clean since the conn that is closing
875 			 * does not have a matching pending mblk in
876 			 * ipx_pending_mp.
877 			 */
878 			mutex_exit(&ipx->ipx_lock);
879 			return (B_FALSE);
880 		}
881 	} else {
882 		/*
883 		 * A non-zero ill_error signifies we are called in the
884 		 * M_ERROR or M_HANGUP path and we need to unconditionally
885 		 * abort any current ioctl and do the corresponding cleanup.
886 		 * A zero ill_error means we are in the ill_delete path and
887 		 * we do the cleanup only if there is a pending mp.
888 		 */
889 		if (mp == NULL && ill->ill_error == 0) {
890 			mutex_exit(&ipx->ipx_lock);
891 			return (B_FALSE);
892 		}
893 	}
894 
895 	/* Now remove from the ipx_pending_mp */
896 	ipx->ipx_pending_mp = NULL;
897 	ipif = ipx->ipx_pending_ipif;
898 	ipx->ipx_pending_ipif = NULL;
899 	ipx->ipx_waitfor = 0;
900 	ipx->ipx_current_ipif = NULL;
901 	cmd = ipx->ipx_current_ioctl;
902 	ipx->ipx_current_ioctl = 0;
903 	ipx->ipx_current_done = B_TRUE;
904 	mutex_exit(&ipx->ipx_lock);
905 
906 	if (mp == NULL)
907 		return (B_FALSE);
908 
909 	q = mp->b_queue;
910 	mp->b_next = NULL;
911 	mp->b_prev = NULL;
912 	mp->b_queue = NULL;
913 
914 	if (DB_TYPE(mp) == M_IOCTL || DB_TYPE(mp) == M_IOCDATA) {
915 		DTRACE_PROBE4(ipif__ioctl,
916 		    char *, "ipsq_pending_mp_cleanup",
917 		    int, cmd, ill_t *, ipif == NULL ? NULL : ipif->ipif_ill,
918 		    ipif_t *, ipif);
919 		if (connp == NULL) {
920 			ip_ioctl_finish(q, mp, ENXIO, NO_COPYOUT, NULL);
921 		} else {
922 			ip_ioctl_finish(q, mp, ENXIO, CONN_CLOSE, NULL);
923 			mutex_enter(&ipif->ipif_ill->ill_lock);
924 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
925 			mutex_exit(&ipif->ipif_ill->ill_lock);
926 		}
927 	} else {
928 		inet_freemsg(mp);
929 	}
930 	return (B_TRUE);
931 }
932 
933 /*
934  * Called in the conn close path and ill delete path
935  */
936 static void
ipsq_xopq_mp_cleanup(ill_t * ill,conn_t * connp)937 ipsq_xopq_mp_cleanup(ill_t *ill, conn_t *connp)
938 {
939 	ipsq_t	*ipsq;
940 	mblk_t	*prev;
941 	mblk_t	*curr;
942 	mblk_t	*next;
943 	queue_t	*wq, *rq = NULL;
944 	mblk_t	*tmp_list = NULL;
945 
946 	ASSERT(IAM_WRITER_ILL(ill));
947 	if (connp != NULL)
948 		wq = CONNP_TO_WQ(connp);
949 	else
950 		wq = ill->ill_wq;
951 
952 	/*
953 	 * In the case of lo0 being unplumbed, ill_wq will be NULL. Guard
954 	 * against this here.
955 	 */
956 	if (wq != NULL)
957 		rq = RD(wq);
958 
959 	ipsq = ill->ill_phyint->phyint_ipsq;
960 	/*
961 	 * Cleanup the ioctl mp's queued in ipsq_xopq_pending_mp if any.
962 	 * In the case of ioctl from a conn, there can be only 1 mp
963 	 * queued on the ipsq. If an ill is being unplumbed flush all
964 	 * the messages.
965 	 */
966 	mutex_enter(&ipsq->ipsq_lock);
967 	for (prev = NULL, curr = ipsq->ipsq_xopq_mphead; curr != NULL;
968 	    curr = next) {
969 		next = curr->b_next;
970 		if (connp == NULL ||
971 		    (curr->b_queue == wq || curr->b_queue == rq)) {
972 			/* Unlink the mblk from the pending mp list */
973 			if (prev != NULL) {
974 				prev->b_next = curr->b_next;
975 			} else {
976 				ASSERT(ipsq->ipsq_xopq_mphead == curr);
977 				ipsq->ipsq_xopq_mphead = curr->b_next;
978 			}
979 			if (ipsq->ipsq_xopq_mptail == curr)
980 				ipsq->ipsq_xopq_mptail = prev;
981 			/*
982 			 * Create a temporary list and release the ipsq lock
983 			 * New elements are added to the head of the tmp_list
984 			 */
985 			curr->b_next = tmp_list;
986 			tmp_list = curr;
987 		} else {
988 			prev = curr;
989 		}
990 	}
991 	mutex_exit(&ipsq->ipsq_lock);
992 
993 	while (tmp_list != NULL) {
994 		curr = tmp_list;
995 		tmp_list = curr->b_next;
996 		curr->b_next = NULL;
997 		curr->b_prev = NULL;
998 		wq = curr->b_queue;
999 		curr->b_queue = NULL;
1000 		if (DB_TYPE(curr) == M_IOCTL || DB_TYPE(curr) == M_IOCDATA) {
1001 			DTRACE_PROBE4(ipif__ioctl,
1002 			    char *, "ipsq_xopq_mp_cleanup",
1003 			    int, 0, ill_t *, NULL, ipif_t *, NULL);
1004 			ip_ioctl_finish(wq, curr, ENXIO, connp != NULL ?
1005 			    CONN_CLOSE : NO_COPYOUT, NULL);
1006 		} else {
1007 			/*
1008 			 * IP-MT XXX In the case of TLI/XTI bind / optmgmt
1009 			 * this can't be just inet_freemsg. we have to
1010 			 * restart it otherwise the thread will be stuck.
1011 			 */
1012 			inet_freemsg(curr);
1013 		}
1014 	}
1015 }
1016 
1017 /*
1018  * This conn has started closing. Cleanup any pending ioctl from this conn.
1019  * STREAMS ensures that there can be at most 1 active ioctl on a stream.
1020  */
1021 void
conn_ioctl_cleanup(conn_t * connp)1022 conn_ioctl_cleanup(conn_t *connp)
1023 {
1024 	ipsq_t	*ipsq;
1025 	ill_t	*ill;
1026 	boolean_t refheld;
1027 
1028 	/*
1029 	 * Check for a queued ioctl. If the ioctl has not yet started, the mp
1030 	 * is pending in the list headed by ipsq_xopq_head. If the ioctl has
1031 	 * started the mp could be present in ipx_pending_mp. Note that if
1032 	 * conn_oper_pending_ill is NULL, the ioctl may still be in flight and
1033 	 * not yet queued anywhere. In this case, the conn close code will wait
1034 	 * until the conn_ref is dropped. If the stream was a tcp stream, then
1035 	 * tcp_close will wait first until all ioctls have completed for this
1036 	 * conn.
1037 	 */
1038 	mutex_enter(&connp->conn_lock);
1039 	ill = connp->conn_oper_pending_ill;
1040 	if (ill == NULL) {
1041 		mutex_exit(&connp->conn_lock);
1042 		return;
1043 	}
1044 
1045 	/*
1046 	 * We may not be able to refhold the ill if the ill/ipif
1047 	 * is changing. But we need to make sure that the ill will
1048 	 * not vanish. So we just bump up the ill_waiter count.
1049 	 */
1050 	refheld = ill_waiter_inc(ill);
1051 	mutex_exit(&connp->conn_lock);
1052 	if (refheld) {
1053 		if (ipsq_enter(ill, B_TRUE, NEW_OP)) {
1054 			ill_waiter_dcr(ill);
1055 			/*
1056 			 * Check whether this ioctl has started and is
1057 			 * pending. If it is not found there then check
1058 			 * whether this ioctl has not even started and is in
1059 			 * the ipsq_xopq list.
1060 			 */
1061 			if (!ipsq_pending_mp_cleanup(ill, connp))
1062 				ipsq_xopq_mp_cleanup(ill, connp);
1063 			ipsq = ill->ill_phyint->phyint_ipsq;
1064 			ipsq_exit(ipsq);
1065 			return;
1066 		}
1067 	}
1068 
1069 	/*
1070 	 * The ill is also closing and we could not bump up the
1071 	 * ill_waiter_count or we could not enter the ipsq. Leave
1072 	 * the cleanup to ill_delete
1073 	 */
1074 	mutex_enter(&connp->conn_lock);
1075 	while (connp->conn_oper_pending_ill != NULL)
1076 		cv_wait(&connp->conn_refcv, &connp->conn_lock);
1077 	mutex_exit(&connp->conn_lock);
1078 	if (refheld)
1079 		ill_waiter_dcr(ill);
1080 }
1081 
1082 /*
1083  * ipcl_walk function for cleaning up conn_*_ill fields.
1084  * Note that we leave ixa_multicast_ifindex, conn_incoming_ifindex, and
1085  * conn_bound_if in place. We prefer dropping
1086  * packets instead of sending them out the wrong interface, or accepting
1087  * packets from the wrong ifindex.
1088  */
1089 static void
conn_cleanup_ill(conn_t * connp,caddr_t arg)1090 conn_cleanup_ill(conn_t *connp, caddr_t arg)
1091 {
1092 	ill_t	*ill = (ill_t *)arg;
1093 
1094 	mutex_enter(&connp->conn_lock);
1095 	if (connp->conn_dhcpinit_ill == ill) {
1096 		connp->conn_dhcpinit_ill = NULL;
1097 		ASSERT(ill->ill_dhcpinit != 0);
1098 		atomic_dec_32(&ill->ill_dhcpinit);
1099 		ill_set_inputfn(ill);
1100 	}
1101 	mutex_exit(&connp->conn_lock);
1102 }
1103 
1104 static int
ill_down_ipifs_tail(ill_t * ill)1105 ill_down_ipifs_tail(ill_t *ill)
1106 {
1107 	ipif_t	*ipif;
1108 	int err;
1109 
1110 	ASSERT(IAM_WRITER_ILL(ill));
1111 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
1112 		ipif_non_duplicate(ipif);
1113 		/*
1114 		 * ipif_down_tail will call arp_ll_down on the last ipif
1115 		 * and typically return EINPROGRESS when the DL_UNBIND is sent.
1116 		 */
1117 		if ((err = ipif_down_tail(ipif)) != 0)
1118 			return (err);
1119 	}
1120 	return (0);
1121 }
1122 
1123 /* ARGSUSED */
1124 void
ipif_all_down_tail(ipsq_t * ipsq,queue_t * q,mblk_t * mp,void * dummy_arg)1125 ipif_all_down_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
1126 {
1127 	ASSERT(IAM_WRITER_IPSQ(ipsq));
1128 	(void) ill_down_ipifs_tail(q->q_ptr);
1129 	freemsg(mp);
1130 	ipsq_current_finish(ipsq);
1131 }
1132 
1133 /*
1134  * ill_down_start is called when we want to down this ill and bring it up again
1135  * It is called when we receive an M_ERROR / M_HANGUP. In this case we shut down
1136  * all interfaces, but don't tear down any plumbing.
1137  */
1138 boolean_t
ill_down_start(queue_t * q,mblk_t * mp)1139 ill_down_start(queue_t *q, mblk_t *mp)
1140 {
1141 	ill_t	*ill = q->q_ptr;
1142 	ipif_t	*ipif;
1143 
1144 	ASSERT(IAM_WRITER_ILL(ill));
1145 	/*
1146 	 * It is possible that some ioctl is already in progress while we
1147 	 * received the M_ERROR / M_HANGUP in which case, we need to abort
1148 	 * the ioctl. ill_down_start() is being processed as CUR_OP rather
1149 	 * than as NEW_OP since the cause of the M_ERROR / M_HANGUP may prevent
1150 	 * the in progress ioctl from ever completing.
1151 	 *
1152 	 * The thread that started the ioctl (if any) must have returned,
1153 	 * since we are now executing as writer. After the 2 calls below,
1154 	 * the state of the ipsq and the ill would reflect no trace of any
1155 	 * pending operation. Subsequently if there is any response to the
1156 	 * original ioctl from the driver, it would be discarded as an
1157 	 * unsolicited message from the driver.
1158 	 */
1159 	(void) ipsq_pending_mp_cleanup(ill, NULL);
1160 	ill_dlpi_clear_deferred(ill);
1161 
1162 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
1163 		(void) ipif_down(ipif, NULL, NULL);
1164 
1165 	ill_down(ill);
1166 
1167 	/*
1168 	 * Walk all CONNs that can have a reference on an ire or nce for this
1169 	 * ill (we actually walk all that now have stale references).
1170 	 */
1171 	ipcl_walk(conn_ixa_cleanup, (void *)B_TRUE, ill->ill_ipst);
1172 
1173 	/* With IPv6 we have dce_ifindex. Cleanup for neatness */
1174 	if (ill->ill_isv6)
1175 		dce_cleanup(ill->ill_phyint->phyint_ifindex, ill->ill_ipst);
1176 
1177 	ipsq_current_start(ill->ill_phyint->phyint_ipsq, ill->ill_ipif, 0);
1178 
1179 	/*
1180 	 * Atomically test and add the pending mp if references are active.
1181 	 */
1182 	mutex_enter(&ill->ill_lock);
1183 	if (!ill_is_quiescent(ill)) {
1184 		/* call cannot fail since `conn_t *' argument is NULL */
1185 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
1186 		    mp, ILL_DOWN);
1187 		mutex_exit(&ill->ill_lock);
1188 		return (B_FALSE);
1189 	}
1190 	mutex_exit(&ill->ill_lock);
1191 	return (B_TRUE);
1192 }
1193 
1194 static void
ill_down(ill_t * ill)1195 ill_down(ill_t *ill)
1196 {
1197 	mblk_t	*mp;
1198 	ip_stack_t	*ipst = ill->ill_ipst;
1199 
1200 	/*
1201 	 * Blow off any IREs dependent on this ILL.
1202 	 * The caller needs to handle conn_ixa_cleanup
1203 	 */
1204 	ill_delete_ires(ill);
1205 
1206 	ire_walk_ill(0, 0, ill_downi, ill, ill);
1207 
1208 	/* Remove any conn_*_ill depending on this ill */
1209 	ipcl_walk(conn_cleanup_ill, (caddr_t)ill, ipst);
1210 
1211 	/*
1212 	 * Free state for additional IREs.
1213 	 */
1214 	mutex_enter(&ill->ill_saved_ire_lock);
1215 	mp = ill->ill_saved_ire_mp;
1216 	ill->ill_saved_ire_mp = NULL;
1217 	ill->ill_saved_ire_cnt = 0;
1218 	mutex_exit(&ill->ill_saved_ire_lock);
1219 	freemsg(mp);
1220 }
1221 
1222 /*
1223  * ire_walk routine used to delete every IRE that depends on
1224  * 'ill'.  (Always called as writer, and may only be called from ire_walk.)
1225  *
1226  * Note: since the routes added by the kernel are deleted separately,
1227  * this will only be 1) IRE_IF_CLONE and 2) manually added IRE_INTERFACE.
1228  *
1229  * We also remove references on ire_nce_cache entries that refer to the ill.
1230  */
1231 void
ill_downi(ire_t * ire,char * ill_arg)1232 ill_downi(ire_t *ire, char *ill_arg)
1233 {
1234 	ill_t	*ill = (ill_t *)ill_arg;
1235 	nce_t	*nce;
1236 
1237 	mutex_enter(&ire->ire_lock);
1238 	nce = ire->ire_nce_cache;
1239 	if (nce != NULL && nce->nce_ill == ill)
1240 		ire->ire_nce_cache = NULL;
1241 	else
1242 		nce = NULL;
1243 	mutex_exit(&ire->ire_lock);
1244 	if (nce != NULL)
1245 		nce_refrele(nce);
1246 	if (ire->ire_ill == ill) {
1247 		/*
1248 		 * The existing interface binding for ire must be
1249 		 * deleted before trying to bind the route to another
1250 		 * interface. However, since we are using the contents of the
1251 		 * ire after ire_delete, the caller has to ensure that
1252 		 * CONDEMNED (deleted) ire's are not removed from the list
1253 		 * when ire_delete() returns. Currently ill_downi() is
1254 		 * only called as part of ire_walk*() routines, so that
1255 		 * the irb_refhold() done by ire_walk*() will ensure that
1256 		 * ire_delete() does not lead to ire_inactive().
1257 		 */
1258 		ASSERT(ire->ire_bucket->irb_refcnt > 0);
1259 		ire_delete(ire);
1260 		if (ire->ire_unbound)
1261 			ire_rebind(ire);
1262 	}
1263 }
1264 
1265 /* Remove IRE_IF_CLONE on this ill */
1266 void
ill_downi_if_clone(ire_t * ire,char * ill_arg)1267 ill_downi_if_clone(ire_t *ire, char *ill_arg)
1268 {
1269 	ill_t	*ill = (ill_t *)ill_arg;
1270 
1271 	ASSERT(ire->ire_type & IRE_IF_CLONE);
1272 	if (ire->ire_ill == ill)
1273 		ire_delete(ire);
1274 }
1275 
1276 /* Consume an M_IOCACK of the fastpath probe. */
1277 void
ill_fastpath_ack(ill_t * ill,mblk_t * mp)1278 ill_fastpath_ack(ill_t *ill, mblk_t *mp)
1279 {
1280 	mblk_t	*mp1 = mp;
1281 
1282 	/*
1283 	 * If this was the first attempt turn on the fastpath probing.
1284 	 */
1285 	mutex_enter(&ill->ill_lock);
1286 	if (ill->ill_dlpi_fastpath_state == IDS_INPROGRESS)
1287 		ill->ill_dlpi_fastpath_state = IDS_OK;
1288 	mutex_exit(&ill->ill_lock);
1289 
1290 	/* Free the M_IOCACK mblk, hold on to the data */
1291 	mp = mp->b_cont;
1292 	freeb(mp1);
1293 	if (mp == NULL)
1294 		return;
1295 	if (mp->b_cont != NULL)
1296 		nce_fastpath_update(ill, mp);
1297 	else
1298 		ip0dbg(("ill_fastpath_ack:  no b_cont\n"));
1299 	freemsg(mp);
1300 }
1301 
1302 /*
1303  * Throw an M_IOCTL message downstream asking "do you know fastpath?"
1304  * The data portion of the request is a dl_unitdata_req_t template for
1305  * what we would send downstream in the absence of a fastpath confirmation.
1306  */
1307 int
ill_fastpath_probe(ill_t * ill,mblk_t * dlur_mp)1308 ill_fastpath_probe(ill_t *ill, mblk_t *dlur_mp)
1309 {
1310 	struct iocblk	*ioc;
1311 	mblk_t	*mp;
1312 
1313 	if (dlur_mp == NULL)
1314 		return (EINVAL);
1315 
1316 	mutex_enter(&ill->ill_lock);
1317 	switch (ill->ill_dlpi_fastpath_state) {
1318 	case IDS_FAILED:
1319 		/*
1320 		 * Driver NAKed the first fastpath ioctl - assume it doesn't
1321 		 * support it.
1322 		 */
1323 		mutex_exit(&ill->ill_lock);
1324 		return (ENOTSUP);
1325 	case IDS_UNKNOWN:
1326 		/* This is the first probe */
1327 		ill->ill_dlpi_fastpath_state = IDS_INPROGRESS;
1328 		break;
1329 	default:
1330 		break;
1331 	}
1332 	mutex_exit(&ill->ill_lock);
1333 
1334 	if ((mp = mkiocb(DL_IOC_HDR_INFO)) == NULL)
1335 		return (EAGAIN);
1336 
1337 	mp->b_cont = copyb(dlur_mp);
1338 	if (mp->b_cont == NULL) {
1339 		freeb(mp);
1340 		return (EAGAIN);
1341 	}
1342 
1343 	ioc = (struct iocblk *)mp->b_rptr;
1344 	ioc->ioc_count = msgdsize(mp->b_cont);
1345 
1346 	DTRACE_PROBE3(ill__dlpi, char *, "ill_fastpath_probe",
1347 	    char *, "DL_IOC_HDR_INFO", ill_t *, ill);
1348 	putnext(ill->ill_wq, mp);
1349 	return (0);
1350 }
1351 
1352 void
ill_capability_probe(ill_t * ill)1353 ill_capability_probe(ill_t *ill)
1354 {
1355 	mblk_t	*mp;
1356 
1357 	ASSERT(IAM_WRITER_ILL(ill));
1358 
1359 	if (ill->ill_dlpi_capab_state != IDCS_UNKNOWN &&
1360 	    ill->ill_dlpi_capab_state != IDCS_FAILED)
1361 		return;
1362 
1363 	/*
1364 	 * We are starting a new cycle of capability negotiation.
1365 	 * Free up the capab reset messages of any previous incarnation.
1366 	 * We will do a fresh allocation when we get the response to our probe
1367 	 */
1368 	if (ill->ill_capab_reset_mp != NULL) {
1369 		freemsg(ill->ill_capab_reset_mp);
1370 		ill->ill_capab_reset_mp = NULL;
1371 	}
1372 
1373 	ip1dbg(("ill_capability_probe: starting capability negotiation\n"));
1374 
1375 	mp = ip_dlpi_alloc(sizeof (dl_capability_req_t), DL_CAPABILITY_REQ);
1376 	if (mp == NULL)
1377 		return;
1378 
1379 	ill_capability_send(ill, mp);
1380 	ill->ill_dlpi_capab_state = IDCS_PROBE_SENT;
1381 }
1382 
1383 void
ill_capability_reset(ill_t * ill,boolean_t reneg)1384 ill_capability_reset(ill_t *ill, boolean_t reneg)
1385 {
1386 	ASSERT(IAM_WRITER_ILL(ill));
1387 
1388 	if (ill->ill_dlpi_capab_state != IDCS_OK)
1389 		return;
1390 
1391 	ill->ill_dlpi_capab_state = reneg ? IDCS_RENEG : IDCS_RESET_SENT;
1392 
1393 	ill_capability_send(ill, ill->ill_capab_reset_mp);
1394 	ill->ill_capab_reset_mp = NULL;
1395 	/*
1396 	 * We turn off all capabilities except those pertaining to
1397 	 * direct function call capabilities viz. ILL_CAPAB_DLD*
1398 	 * which will be turned off by the corresponding reset functions.
1399 	 */
1400 	ill->ill_capabilities &= ~(ILL_CAPAB_HCKSUM  | ILL_CAPAB_ZEROCOPY);
1401 }
1402 
1403 static void
ill_capability_reset_alloc(ill_t * ill)1404 ill_capability_reset_alloc(ill_t *ill)
1405 {
1406 	mblk_t *mp;
1407 	size_t	size = 0;
1408 	int	err;
1409 	dl_capability_req_t	*capb;
1410 
1411 	ASSERT(IAM_WRITER_ILL(ill));
1412 	ASSERT(ill->ill_capab_reset_mp == NULL);
1413 
1414 	if (ILL_HCKSUM_CAPABLE(ill)) {
1415 		size += sizeof (dl_capability_sub_t) +
1416 		    sizeof (dl_capab_hcksum_t);
1417 	}
1418 
1419 	if (ill->ill_capabilities & ILL_CAPAB_ZEROCOPY) {
1420 		size += sizeof (dl_capability_sub_t) +
1421 		    sizeof (dl_capab_zerocopy_t);
1422 	}
1423 
1424 	if (ill->ill_capabilities & ILL_CAPAB_DLD) {
1425 		size += sizeof (dl_capability_sub_t) +
1426 		    sizeof (dl_capab_dld_t);
1427 	}
1428 
1429 	mp = allocb_wait(size + sizeof (dl_capability_req_t), BPRI_MED,
1430 	    STR_NOSIG, &err);
1431 
1432 	mp->b_datap->db_type = M_PROTO;
1433 	bzero(mp->b_rptr, size + sizeof (dl_capability_req_t));
1434 
1435 	capb = (dl_capability_req_t *)mp->b_rptr;
1436 	capb->dl_primitive = DL_CAPABILITY_REQ;
1437 	capb->dl_sub_offset = sizeof (dl_capability_req_t);
1438 	capb->dl_sub_length = size;
1439 
1440 	mp->b_wptr += sizeof (dl_capability_req_t);
1441 
1442 	/*
1443 	 * Each handler fills in the corresponding dl_capability_sub_t
1444 	 * inside the mblk,
1445 	 */
1446 	ill_capability_hcksum_reset_fill(ill, mp);
1447 	ill_capability_zerocopy_reset_fill(ill, mp);
1448 	ill_capability_dld_reset_fill(ill, mp);
1449 
1450 	ill->ill_capab_reset_mp = mp;
1451 }
1452 
1453 static void
ill_capability_id_ack(ill_t * ill,mblk_t * mp,dl_capability_sub_t * outers)1454 ill_capability_id_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *outers)
1455 {
1456 	dl_capab_id_t *id_ic;
1457 	uint_t sub_dl_cap = outers->dl_cap;
1458 	dl_capability_sub_t *inners;
1459 	uint8_t *capend;
1460 
1461 	ASSERT(sub_dl_cap == DL_CAPAB_ID_WRAPPER);
1462 
1463 	/*
1464 	 * Note: range checks here are not absolutely sufficient to
1465 	 * make us robust against malformed messages sent by drivers;
1466 	 * this is in keeping with the rest of IP's dlpi handling.
1467 	 * (Remember, it's coming from something else in the kernel
1468 	 * address space)
1469 	 */
1470 
1471 	capend = (uint8_t *)(outers + 1) + outers->dl_length;
1472 	if (capend > mp->b_wptr) {
1473 		cmn_err(CE_WARN, "ill_capability_id_ack: "
1474 		    "malformed sub-capability too long for mblk");
1475 		return;
1476 	}
1477 
1478 	id_ic = (dl_capab_id_t *)(outers + 1);
1479 
1480 	if (outers->dl_length < sizeof (*id_ic) ||
1481 	    (inners = &id_ic->id_subcap,
1482 	    inners->dl_length > (outers->dl_length - sizeof (*inners)))) {
1483 		cmn_err(CE_WARN, "ill_capability_id_ack: malformed "
1484 		    "encapsulated capab type %d too long for mblk",
1485 		    inners->dl_cap);
1486 		return;
1487 	}
1488 
1489 	if (!dlcapabcheckqid(&id_ic->id_mid, ill->ill_lmod_rq)) {
1490 		ip1dbg(("ill_capability_id_ack: mid token for capab type %d "
1491 		    "isn't as expected; pass-thru module(s) detected, "
1492 		    "discarding capability\n", inners->dl_cap));
1493 		return;
1494 	}
1495 
1496 	/* Process the encapsulated sub-capability */
1497 	ill_capability_dispatch(ill, mp, inners);
1498 }
1499 
1500 static void
ill_capability_dld_reset_fill(ill_t * ill,mblk_t * mp)1501 ill_capability_dld_reset_fill(ill_t *ill, mblk_t *mp)
1502 {
1503 	dl_capability_sub_t *dl_subcap;
1504 
1505 	if (!(ill->ill_capabilities & ILL_CAPAB_DLD))
1506 		return;
1507 
1508 	/*
1509 	 * The dl_capab_dld_t that follows the dl_capability_sub_t is not
1510 	 * initialized below since it is not used by DLD.
1511 	 */
1512 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
1513 	dl_subcap->dl_cap = DL_CAPAB_DLD;
1514 	dl_subcap->dl_length = sizeof (dl_capab_dld_t);
1515 
1516 	mp->b_wptr += sizeof (dl_capability_sub_t) + sizeof (dl_capab_dld_t);
1517 }
1518 
1519 static void
ill_capability_dispatch(ill_t * ill,mblk_t * mp,dl_capability_sub_t * subp)1520 ill_capability_dispatch(ill_t *ill, mblk_t *mp, dl_capability_sub_t *subp)
1521 {
1522 	/*
1523 	 * If no ipif was brought up over this ill, this DL_CAPABILITY_REQ/ACK
1524 	 * is only to get the VRRP capability.
1525 	 *
1526 	 * Note that we cannot check ill_ipif_up_count here since
1527 	 * ill_ipif_up_count is only incremented when the resolver is setup.
1528 	 * That is done asynchronously, and can race with this function.
1529 	 */
1530 	if (!ill->ill_dl_up) {
1531 		if (subp->dl_cap == DL_CAPAB_VRRP)
1532 			ill_capability_vrrp_ack(ill, mp, subp);
1533 		return;
1534 	}
1535 
1536 	switch (subp->dl_cap) {
1537 	case DL_CAPAB_HCKSUM:
1538 		ill_capability_hcksum_ack(ill, mp, subp);
1539 		break;
1540 	case DL_CAPAB_ZEROCOPY:
1541 		ill_capability_zerocopy_ack(ill, mp, subp);
1542 		break;
1543 	case DL_CAPAB_DLD:
1544 		ill_capability_dld_ack(ill, mp, subp);
1545 		break;
1546 	case DL_CAPAB_VRRP:
1547 		break;
1548 	default:
1549 		ip1dbg(("ill_capability_dispatch: unknown capab type %d\n",
1550 		    subp->dl_cap));
1551 	}
1552 }
1553 
1554 /*
1555  * Process the vrrp capability received from a DLS Provider. isub must point
1556  * to the sub-capability (DL_CAPAB_VRRP) of a DL_CAPABILITY_ACK message.
1557  */
1558 static void
ill_capability_vrrp_ack(ill_t * ill,mblk_t * mp,dl_capability_sub_t * isub)1559 ill_capability_vrrp_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1560 {
1561 	dl_capab_vrrp_t	*vrrp;
1562 	uint_t		sub_dl_cap = isub->dl_cap;
1563 	uint8_t		*capend;
1564 
1565 	ASSERT(IAM_WRITER_ILL(ill));
1566 	ASSERT(sub_dl_cap == DL_CAPAB_VRRP);
1567 
1568 	/*
1569 	 * Note: range checks here are not absolutely sufficient to
1570 	 * make us robust against malformed messages sent by drivers;
1571 	 * this is in keeping with the rest of IP's dlpi handling.
1572 	 * (Remember, it's coming from something else in the kernel
1573 	 * address space)
1574 	 */
1575 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1576 	if (capend > mp->b_wptr) {
1577 		cmn_err(CE_WARN, "ill_capability_vrrp_ack: "
1578 		    "malformed sub-capability too long for mblk");
1579 		return;
1580 	}
1581 	vrrp = (dl_capab_vrrp_t *)(isub + 1);
1582 
1583 	/*
1584 	 * Compare the IP address family and set ILLF_VRRP for the right ill.
1585 	 */
1586 	if ((vrrp->vrrp_af == AF_INET6 && ill->ill_isv6) ||
1587 	    (vrrp->vrrp_af == AF_INET && !ill->ill_isv6)) {
1588 		ill->ill_flags |= ILLF_VRRP;
1589 	}
1590 }
1591 
1592 /*
1593  * Process a hardware checksum offload capability negotiation ack received
1594  * from a DLS Provider.isub must point to the sub-capability (DL_CAPAB_HCKSUM)
1595  * of a DL_CAPABILITY_ACK message.
1596  */
1597 static void
ill_capability_hcksum_ack(ill_t * ill,mblk_t * mp,dl_capability_sub_t * isub)1598 ill_capability_hcksum_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1599 {
1600 	dl_capability_req_t	*ocap;
1601 	dl_capab_hcksum_t	*ihck, *ohck;
1602 	ill_hcksum_capab_t	**ill_hcksum;
1603 	mblk_t			*nmp = NULL;
1604 	uint_t			sub_dl_cap = isub->dl_cap;
1605 	uint8_t			*capend;
1606 
1607 	ASSERT(sub_dl_cap == DL_CAPAB_HCKSUM);
1608 
1609 	ill_hcksum = (ill_hcksum_capab_t **)&ill->ill_hcksum_capab;
1610 
1611 	/*
1612 	 * Note: range checks here are not absolutely sufficient to
1613 	 * make us robust against malformed messages sent by drivers;
1614 	 * this is in keeping with the rest of IP's dlpi handling.
1615 	 * (Remember, it's coming from something else in the kernel
1616 	 * address space)
1617 	 */
1618 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1619 	if (capend > mp->b_wptr) {
1620 		cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
1621 		    "malformed sub-capability too long for mblk");
1622 		return;
1623 	}
1624 
1625 	/*
1626 	 * There are two types of acks we process here:
1627 	 * 1. acks in reply to a (first form) generic capability req
1628 	 *    (no ENABLE flag set)
1629 	 * 2. acks in reply to a ENABLE capability req.
1630 	 *    (ENABLE flag set)
1631 	 */
1632 	ihck = (dl_capab_hcksum_t *)(isub + 1);
1633 
1634 	if (ihck->hcksum_version != HCKSUM_VERSION_1) {
1635 		cmn_err(CE_CONT, "ill_capability_hcksum_ack: "
1636 		    "unsupported hardware checksum "
1637 		    "sub-capability (version %d, expected %d)",
1638 		    ihck->hcksum_version, HCKSUM_VERSION_1);
1639 		return;
1640 	}
1641 
1642 	if (!dlcapabcheckqid(&ihck->hcksum_mid, ill->ill_lmod_rq)) {
1643 		ip1dbg(("ill_capability_hcksum_ack: mid token for hardware "
1644 		    "checksum capability isn't as expected; pass-thru "
1645 		    "module(s) detected, discarding capability\n"));
1646 		return;
1647 	}
1648 
1649 #define	CURR_HCKSUM_CAPAB				\
1650 	(HCKSUM_INET_PARTIAL | HCKSUM_INET_FULL_V4 |	\
1651 	HCKSUM_INET_FULL_V6 | HCKSUM_IPHDRCKSUM)
1652 
1653 	if ((ihck->hcksum_txflags & HCKSUM_ENABLE) &&
1654 	    (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB)) {
1655 		/* do ENABLE processing */
1656 		if (*ill_hcksum == NULL) {
1657 			*ill_hcksum = kmem_zalloc(sizeof (ill_hcksum_capab_t),
1658 			    KM_NOSLEEP);
1659 
1660 			if (*ill_hcksum == NULL) {
1661 				cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
1662 				    "could not enable hcksum version %d "
1663 				    "for %s (ENOMEM)\n", HCKSUM_CURRENT_VERSION,
1664 				    ill->ill_name);
1665 				return;
1666 			}
1667 		}
1668 
1669 		(*ill_hcksum)->ill_hcksum_version = ihck->hcksum_version;
1670 		(*ill_hcksum)->ill_hcksum_txflags = ihck->hcksum_txflags;
1671 		ill->ill_capabilities |= ILL_CAPAB_HCKSUM;
1672 		ip1dbg(("ill_capability_hcksum_ack: interface %s "
1673 		    "has enabled hardware checksumming\n ",
1674 		    ill->ill_name));
1675 	} else if (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB) {
1676 		/*
1677 		 * Enabling hardware checksum offload
1678 		 * Currently IP supports {TCP,UDP}/IPv4
1679 		 * partial and full cksum offload and
1680 		 * IPv4 header checksum offload.
1681 		 * Allocate new mblk which will
1682 		 * contain a new capability request
1683 		 * to enable hardware checksum offload.
1684 		 */
1685 		uint_t	size;
1686 		uchar_t	*rptr;
1687 
1688 		size = sizeof (dl_capability_req_t) +
1689 		    sizeof (dl_capability_sub_t) + isub->dl_length;
1690 
1691 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
1692 			cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
1693 			    "could not enable hardware cksum for %s (ENOMEM)\n",
1694 			    ill->ill_name);
1695 			return;
1696 		}
1697 
1698 		rptr = nmp->b_rptr;
1699 		/* initialize dl_capability_req_t */
1700 		ocap = (dl_capability_req_t *)nmp->b_rptr;
1701 		ocap->dl_sub_offset =
1702 		    sizeof (dl_capability_req_t);
1703 		ocap->dl_sub_length =
1704 		    sizeof (dl_capability_sub_t) +
1705 		    isub->dl_length;
1706 		nmp->b_rptr += sizeof (dl_capability_req_t);
1707 
1708 		/* initialize dl_capability_sub_t */
1709 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
1710 		nmp->b_rptr += sizeof (*isub);
1711 
1712 		/* initialize dl_capab_hcksum_t */
1713 		ohck = (dl_capab_hcksum_t *)nmp->b_rptr;
1714 		bcopy(ihck, ohck, sizeof (*ihck));
1715 
1716 		nmp->b_rptr = rptr;
1717 		ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
1718 
1719 		/* Set ENABLE flag */
1720 		ohck->hcksum_txflags &= CURR_HCKSUM_CAPAB;
1721 		ohck->hcksum_txflags |= HCKSUM_ENABLE;
1722 
1723 		/*
1724 		 * nmp points to a DL_CAPABILITY_REQ message to enable
1725 		 * hardware checksum acceleration.
1726 		 */
1727 		ill_capability_send(ill, nmp);
1728 	} else {
1729 		ip1dbg(("ill_capability_hcksum_ack: interface %s has "
1730 		    "advertised %x hardware checksum capability flags\n",
1731 		    ill->ill_name, ihck->hcksum_txflags));
1732 	}
1733 }
1734 
1735 static void
ill_capability_hcksum_reset_fill(ill_t * ill,mblk_t * mp)1736 ill_capability_hcksum_reset_fill(ill_t *ill, mblk_t *mp)
1737 {
1738 	dl_capab_hcksum_t *hck_subcap;
1739 	dl_capability_sub_t *dl_subcap;
1740 
1741 	if (!ILL_HCKSUM_CAPABLE(ill))
1742 		return;
1743 
1744 	ASSERT(ill->ill_hcksum_capab != NULL);
1745 
1746 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
1747 	dl_subcap->dl_cap = DL_CAPAB_HCKSUM;
1748 	dl_subcap->dl_length = sizeof (*hck_subcap);
1749 
1750 	hck_subcap = (dl_capab_hcksum_t *)(dl_subcap + 1);
1751 	hck_subcap->hcksum_version = ill->ill_hcksum_capab->ill_hcksum_version;
1752 	hck_subcap->hcksum_txflags = 0;
1753 
1754 	mp->b_wptr += sizeof (*dl_subcap) + sizeof (*hck_subcap);
1755 }
1756 
1757 static void
ill_capability_zerocopy_ack(ill_t * ill,mblk_t * mp,dl_capability_sub_t * isub)1758 ill_capability_zerocopy_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1759 {
1760 	mblk_t *nmp = NULL;
1761 	dl_capability_req_t *oc;
1762 	dl_capab_zerocopy_t *zc_ic, *zc_oc;
1763 	ill_zerocopy_capab_t **ill_zerocopy_capab;
1764 	uint_t sub_dl_cap = isub->dl_cap;
1765 	uint8_t *capend;
1766 
1767 	ASSERT(sub_dl_cap == DL_CAPAB_ZEROCOPY);
1768 
1769 	ill_zerocopy_capab = (ill_zerocopy_capab_t **)&ill->ill_zerocopy_capab;
1770 
1771 	/*
1772 	 * Note: range checks here are not absolutely sufficient to
1773 	 * make us robust against malformed messages sent by drivers;
1774 	 * this is in keeping with the rest of IP's dlpi handling.
1775 	 * (Remember, it's coming from something else in the kernel
1776 	 * address space)
1777 	 */
1778 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1779 	if (capend > mp->b_wptr) {
1780 		cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
1781 		    "malformed sub-capability too long for mblk");
1782 		return;
1783 	}
1784 
1785 	zc_ic = (dl_capab_zerocopy_t *)(isub + 1);
1786 	if (zc_ic->zerocopy_version != ZEROCOPY_VERSION_1) {
1787 		cmn_err(CE_CONT, "ill_capability_zerocopy_ack: "
1788 		    "unsupported ZEROCOPY sub-capability (version %d, "
1789 		    "expected %d)", zc_ic->zerocopy_version,
1790 		    ZEROCOPY_VERSION_1);
1791 		return;
1792 	}
1793 
1794 	if (!dlcapabcheckqid(&zc_ic->zerocopy_mid, ill->ill_lmod_rq)) {
1795 		ip1dbg(("ill_capability_zerocopy_ack: mid token for zerocopy "
1796 		    "capability isn't as expected; pass-thru module(s) "
1797 		    "detected, discarding capability\n"));
1798 		return;
1799 	}
1800 
1801 	if ((zc_ic->zerocopy_flags & DL_CAPAB_VMSAFE_MEM) != 0) {
1802 		if (*ill_zerocopy_capab == NULL) {
1803 			*ill_zerocopy_capab =
1804 			    kmem_zalloc(sizeof (ill_zerocopy_capab_t),
1805 			    KM_NOSLEEP);
1806 
1807 			if (*ill_zerocopy_capab == NULL) {
1808 				cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
1809 				    "could not enable Zero-copy version %d "
1810 				    "for %s (ENOMEM)\n", ZEROCOPY_VERSION_1,
1811 				    ill->ill_name);
1812 				return;
1813 			}
1814 		}
1815 
1816 		ip1dbg(("ill_capability_zerocopy_ack: interface %s "
1817 		    "supports Zero-copy version %d\n", ill->ill_name,
1818 		    ZEROCOPY_VERSION_1));
1819 
1820 		(*ill_zerocopy_capab)->ill_zerocopy_version =
1821 		    zc_ic->zerocopy_version;
1822 		(*ill_zerocopy_capab)->ill_zerocopy_flags =
1823 		    zc_ic->zerocopy_flags;
1824 
1825 		ill->ill_capabilities |= ILL_CAPAB_ZEROCOPY;
1826 	} else {
1827 		uint_t size;
1828 		uchar_t *rptr;
1829 
1830 		size = sizeof (dl_capability_req_t) +
1831 		    sizeof (dl_capability_sub_t) +
1832 		    sizeof (dl_capab_zerocopy_t);
1833 
1834 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
1835 			cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
1836 			    "could not enable zerocopy for %s (ENOMEM)\n",
1837 			    ill->ill_name);
1838 			return;
1839 		}
1840 
1841 		rptr = nmp->b_rptr;
1842 		/* initialize dl_capability_req_t */
1843 		oc = (dl_capability_req_t *)rptr;
1844 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
1845 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
1846 		    sizeof (dl_capab_zerocopy_t);
1847 		rptr += sizeof (dl_capability_req_t);
1848 
1849 		/* initialize dl_capability_sub_t */
1850 		bcopy(isub, rptr, sizeof (*isub));
1851 		rptr += sizeof (*isub);
1852 
1853 		/* initialize dl_capab_zerocopy_t */
1854 		zc_oc = (dl_capab_zerocopy_t *)rptr;
1855 		*zc_oc = *zc_ic;
1856 
1857 		ip1dbg(("ill_capability_zerocopy_ack: asking interface %s "
1858 		    "to enable zero-copy version %d\n", ill->ill_name,
1859 		    ZEROCOPY_VERSION_1));
1860 
1861 		/* set VMSAFE_MEM flag */
1862 		zc_oc->zerocopy_flags |= DL_CAPAB_VMSAFE_MEM;
1863 
1864 		/* nmp points to a DL_CAPABILITY_REQ message to enable zcopy */
1865 		ill_capability_send(ill, nmp);
1866 	}
1867 }
1868 
1869 static void
ill_capability_zerocopy_reset_fill(ill_t * ill,mblk_t * mp)1870 ill_capability_zerocopy_reset_fill(ill_t *ill, mblk_t *mp)
1871 {
1872 	dl_capab_zerocopy_t *zerocopy_subcap;
1873 	dl_capability_sub_t *dl_subcap;
1874 
1875 	if (!(ill->ill_capabilities & ILL_CAPAB_ZEROCOPY))
1876 		return;
1877 
1878 	ASSERT(ill->ill_zerocopy_capab != NULL);
1879 
1880 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
1881 	dl_subcap->dl_cap = DL_CAPAB_ZEROCOPY;
1882 	dl_subcap->dl_length = sizeof (*zerocopy_subcap);
1883 
1884 	zerocopy_subcap = (dl_capab_zerocopy_t *)(dl_subcap + 1);
1885 	zerocopy_subcap->zerocopy_version =
1886 	    ill->ill_zerocopy_capab->ill_zerocopy_version;
1887 	zerocopy_subcap->zerocopy_flags = 0;
1888 
1889 	mp->b_wptr += sizeof (*dl_subcap) + sizeof (*zerocopy_subcap);
1890 }
1891 
1892 /*
1893  * DLD capability
1894  * Refer to dld.h for more information regarding the purpose and usage
1895  * of this capability.
1896  */
1897 static void
ill_capability_dld_ack(ill_t * ill,mblk_t * mp,dl_capability_sub_t * isub)1898 ill_capability_dld_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1899 {
1900 	dl_capab_dld_t		*dld_ic, dld;
1901 	uint_t			sub_dl_cap = isub->dl_cap;
1902 	uint8_t			*capend;
1903 	ill_dld_capab_t		*idc;
1904 
1905 	ASSERT(IAM_WRITER_ILL(ill));
1906 	ASSERT(sub_dl_cap == DL_CAPAB_DLD);
1907 
1908 	/*
1909 	 * Note: range checks here are not absolutely sufficient to
1910 	 * make us robust against malformed messages sent by drivers;
1911 	 * this is in keeping with the rest of IP's dlpi handling.
1912 	 * (Remember, it's coming from something else in the kernel
1913 	 * address space)
1914 	 */
1915 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1916 	if (capend > mp->b_wptr) {
1917 		cmn_err(CE_WARN, "ill_capability_dld_ack: "
1918 		    "malformed sub-capability too long for mblk");
1919 		return;
1920 	}
1921 	dld_ic = (dl_capab_dld_t *)(isub + 1);
1922 	if (dld_ic->dld_version != DLD_CURRENT_VERSION) {
1923 		cmn_err(CE_CONT, "ill_capability_dld_ack: "
1924 		    "unsupported DLD sub-capability (version %d, "
1925 		    "expected %d)", dld_ic->dld_version,
1926 		    DLD_CURRENT_VERSION);
1927 		return;
1928 	}
1929 	if (!dlcapabcheckqid(&dld_ic->dld_mid, ill->ill_lmod_rq)) {
1930 		ip1dbg(("ill_capability_dld_ack: mid token for dld "
1931 		    "capability isn't as expected; pass-thru module(s) "
1932 		    "detected, discarding capability\n"));
1933 		return;
1934 	}
1935 
1936 	/*
1937 	 * Copy locally to ensure alignment.
1938 	 */
1939 	bcopy(dld_ic, &dld, sizeof (dl_capab_dld_t));
1940 
1941 	if ((idc = ill->ill_dld_capab) == NULL) {
1942 		idc = kmem_zalloc(sizeof (ill_dld_capab_t), KM_NOSLEEP);
1943 		if (idc == NULL) {
1944 			cmn_err(CE_WARN, "ill_capability_dld_ack: "
1945 			    "could not enable DLD version %d "
1946 			    "for %s (ENOMEM)\n", DLD_CURRENT_VERSION,
1947 			    ill->ill_name);
1948 			return;
1949 		}
1950 		ill->ill_dld_capab = idc;
1951 	}
1952 	idc->idc_capab_df = (ip_capab_func_t)dld.dld_capab;
1953 	idc->idc_capab_dh = (void *)dld.dld_capab_handle;
1954 	ip1dbg(("ill_capability_dld_ack: interface %s "
1955 	    "supports DLD version %d\n", ill->ill_name, DLD_CURRENT_VERSION));
1956 
1957 	ill_capability_dld_enable(ill);
1958 }
1959 
1960 /*
1961  * Typically capability negotiation between IP and the driver happens via
1962  * DLPI message exchange. However GLD also offers a direct function call
1963  * mechanism to exchange the DLD_DIRECT_CAPAB and DLD_POLL_CAPAB capabilities,
1964  * But arbitrary function calls into IP or GLD are not permitted, since both
1965  * of them are protected by their own perimeter mechanism. The perimeter can
1966  * be viewed as a coarse lock or serialization mechanism. The hierarchy of
1967  * these perimeters is IP -> MAC. Thus for example to enable the squeue
1968  * polling, IP needs to enter its perimeter, then call ill_mac_perim_enter
1969  * to enter the mac perimeter and then do the direct function calls into
1970  * GLD to enable squeue polling. The ring related callbacks from the mac into
1971  * the stack to add, bind, quiesce, restart or cleanup a ring are all
1972  * protected by the mac perimeter.
1973  */
1974 static void
ill_mac_perim_enter(ill_t * ill,mac_perim_handle_t * mphp)1975 ill_mac_perim_enter(ill_t *ill, mac_perim_handle_t *mphp)
1976 {
1977 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
1978 	int			err;
1979 
1980 	err = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, mphp,
1981 	    DLD_ENABLE);
1982 	ASSERT(err == 0);
1983 }
1984 
1985 static void
ill_mac_perim_exit(ill_t * ill,mac_perim_handle_t mph)1986 ill_mac_perim_exit(ill_t *ill, mac_perim_handle_t mph)
1987 {
1988 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
1989 	int			err;
1990 
1991 	err = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, mph,
1992 	    DLD_DISABLE);
1993 	ASSERT(err == 0);
1994 }
1995 
1996 boolean_t
ill_mac_perim_held(ill_t * ill)1997 ill_mac_perim_held(ill_t *ill)
1998 {
1999 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
2000 
2001 	return (idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, NULL,
2002 	    DLD_QUERY));
2003 }
2004 
2005 static void
ill_capability_direct_enable(ill_t * ill)2006 ill_capability_direct_enable(ill_t *ill)
2007 {
2008 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
2009 	ill_dld_direct_t	*idd = &idc->idc_direct;
2010 	dld_capab_direct_t	direct;
2011 	int			rc;
2012 
2013 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
2014 
2015 	bzero(&direct, sizeof (direct));
2016 	direct.di_rx_cf = (uintptr_t)ip_input;
2017 	direct.di_rx_ch = ill;
2018 
2019 	rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_DIRECT, &direct,
2020 	    DLD_ENABLE);
2021 	if (rc == 0) {
2022 		idd->idd_tx_df = (ip_dld_tx_t)direct.di_tx_df;
2023 		idd->idd_tx_dh = direct.di_tx_dh;
2024 		idd->idd_tx_cb_df = (ip_dld_callb_t)direct.di_tx_cb_df;
2025 		idd->idd_tx_cb_dh = direct.di_tx_cb_dh;
2026 		idd->idd_tx_fctl_df = (ip_dld_fctl_t)direct.di_tx_fctl_df;
2027 		idd->idd_tx_fctl_dh = direct.di_tx_fctl_dh;
2028 		ASSERT(idd->idd_tx_cb_df != NULL);
2029 		ASSERT(idd->idd_tx_fctl_df != NULL);
2030 		ASSERT(idd->idd_tx_df != NULL);
2031 		/*
2032 		 * One time registration of flow enable callback function
2033 		 */
2034 		ill->ill_flownotify_mh = idd->idd_tx_cb_df(idd->idd_tx_cb_dh,
2035 		    ill_flow_enable, ill);
2036 		ill->ill_capabilities |= ILL_CAPAB_DLD_DIRECT;
2037 		DTRACE_PROBE1(direct_on, (ill_t *), ill);
2038 	} else {
2039 		cmn_err(CE_WARN, "warning: could not enable DIRECT "
2040 		    "capability, rc = %d\n", rc);
2041 		DTRACE_PROBE2(direct_off, (ill_t *), ill, (int), rc);
2042 	}
2043 }
2044 
2045 static void
ill_capability_poll_enable(ill_t * ill)2046 ill_capability_poll_enable(ill_t *ill)
2047 {
2048 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
2049 	dld_capab_poll_t	poll;
2050 	int			rc;
2051 
2052 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
2053 
2054 	bzero(&poll, sizeof (poll));
2055 	poll.poll_ring_add_cf = (uintptr_t)ip_squeue_add_ring;
2056 	poll.poll_ring_remove_cf = (uintptr_t)ip_squeue_clean_ring;
2057 	poll.poll_ring_quiesce_cf = (uintptr_t)ip_squeue_quiesce_ring;
2058 	poll.poll_ring_restart_cf = (uintptr_t)ip_squeue_restart_ring;
2059 	poll.poll_ring_bind_cf = (uintptr_t)ip_squeue_bind_ring;
2060 	poll.poll_ring_ch = ill;
2061 	rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_POLL, &poll,
2062 	    DLD_ENABLE);
2063 	if (rc == 0) {
2064 		ill->ill_capabilities |= ILL_CAPAB_DLD_POLL;
2065 		DTRACE_PROBE1(poll_on, (ill_t *), ill);
2066 	} else {
2067 		ip1dbg(("warning: could not enable POLL "
2068 		    "capability, rc = %d\n", rc));
2069 		DTRACE_PROBE2(poll_off, (ill_t *), ill, (int), rc);
2070 	}
2071 }
2072 
2073 /*
2074  * Enable the LSO capability.
2075  */
2076 static void
ill_capability_lso_enable(ill_t * ill)2077 ill_capability_lso_enable(ill_t *ill)
2078 {
2079 	ill_dld_capab_t	*idc = ill->ill_dld_capab;
2080 	dld_capab_lso_t	lso;
2081 	int rc;
2082 
2083 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
2084 
2085 	if (ill->ill_lso_capab == NULL) {
2086 		ill->ill_lso_capab = kmem_zalloc(sizeof (ill_lso_capab_t),
2087 		    KM_NOSLEEP);
2088 		if (ill->ill_lso_capab == NULL) {
2089 			cmn_err(CE_WARN, "ill_capability_lso_enable: "
2090 			    "could not enable LSO for %s (ENOMEM)\n",
2091 			    ill->ill_name);
2092 			return;
2093 		}
2094 	}
2095 
2096 	bzero(&lso, sizeof (lso));
2097 	if ((rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_LSO, &lso,
2098 	    DLD_ENABLE)) == 0) {
2099 		ill->ill_lso_capab->ill_lso_flags = lso.lso_flags;
2100 		ill->ill_lso_capab->ill_lso_max = lso.lso_max;
2101 		ill->ill_capabilities |= ILL_CAPAB_LSO;
2102 		ip1dbg(("ill_capability_lso_enable: interface %s "
2103 		    "has enabled LSO\n ", ill->ill_name));
2104 	} else {
2105 		kmem_free(ill->ill_lso_capab, sizeof (ill_lso_capab_t));
2106 		ill->ill_lso_capab = NULL;
2107 		DTRACE_PROBE2(lso_off, (ill_t *), ill, (int), rc);
2108 	}
2109 }
2110 
2111 static void
ill_capability_dld_enable(ill_t * ill)2112 ill_capability_dld_enable(ill_t *ill)
2113 {
2114 	mac_perim_handle_t mph;
2115 
2116 	ASSERT(IAM_WRITER_ILL(ill));
2117 
2118 	if (ill->ill_isv6)
2119 		return;
2120 
2121 	ill_mac_perim_enter(ill, &mph);
2122 	if (!ill->ill_isv6) {
2123 		ill_capability_direct_enable(ill);
2124 		ill_capability_poll_enable(ill);
2125 		ill_capability_lso_enable(ill);
2126 	}
2127 	ill->ill_capabilities |= ILL_CAPAB_DLD;
2128 	ill_mac_perim_exit(ill, mph);
2129 }
2130 
2131 static void
ill_capability_dld_disable(ill_t * ill)2132 ill_capability_dld_disable(ill_t *ill)
2133 {
2134 	ill_dld_capab_t	*idc;
2135 	ill_dld_direct_t *idd;
2136 	mac_perim_handle_t	mph;
2137 
2138 	ASSERT(IAM_WRITER_ILL(ill));
2139 
2140 	if (!(ill->ill_capabilities & ILL_CAPAB_DLD))
2141 		return;
2142 
2143 	ill_mac_perim_enter(ill, &mph);
2144 
2145 	idc = ill->ill_dld_capab;
2146 	if ((ill->ill_capabilities & ILL_CAPAB_DLD_DIRECT) != 0) {
2147 		/*
2148 		 * For performance we avoid locks in the transmit data path
2149 		 * and don't maintain a count of the number of threads using
2150 		 * direct calls. Thus some threads could be using direct
2151 		 * transmit calls to GLD, even after the capability mechanism
2152 		 * turns it off. This is still safe since the handles used in
2153 		 * the direct calls continue to be valid until the unplumb is
2154 		 * completed. Remove the callback that was added (1-time) at
2155 		 * capab enable time.
2156 		 */
2157 		mutex_enter(&ill->ill_lock);
2158 		ill->ill_capabilities &= ~ILL_CAPAB_DLD_DIRECT;
2159 		mutex_exit(&ill->ill_lock);
2160 		if (ill->ill_flownotify_mh != NULL) {
2161 			idd = &idc->idc_direct;
2162 			idd->idd_tx_cb_df(idd->idd_tx_cb_dh, NULL,
2163 			    ill->ill_flownotify_mh);
2164 			ill->ill_flownotify_mh = NULL;
2165 		}
2166 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_DIRECT,
2167 		    NULL, DLD_DISABLE);
2168 	}
2169 
2170 	if ((ill->ill_capabilities & ILL_CAPAB_DLD_POLL) != 0) {
2171 		ill->ill_capabilities &= ~ILL_CAPAB_DLD_POLL;
2172 		ip_squeue_clean_all(ill);
2173 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_POLL,
2174 		    NULL, DLD_DISABLE);
2175 	}
2176 
2177 	if ((ill->ill_capabilities & ILL_CAPAB_LSO) != 0) {
2178 		ASSERT(ill->ill_lso_capab != NULL);
2179 		/*
2180 		 * Clear the capability flag for LSO but retain the
2181 		 * ill_lso_capab structure since it's possible that another
2182 		 * thread is still referring to it.  The structure only gets
2183 		 * deallocated when we destroy the ill.
2184 		 */
2185 
2186 		ill->ill_capabilities &= ~ILL_CAPAB_LSO;
2187 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_LSO,
2188 		    NULL, DLD_DISABLE);
2189 	}
2190 
2191 	ill->ill_capabilities &= ~ILL_CAPAB_DLD;
2192 	ill_mac_perim_exit(ill, mph);
2193 }
2194 
2195 /*
2196  * Capability Negotiation protocol
2197  *
2198  * We don't wait for DLPI capability operations to finish during interface
2199  * bringup or teardown. Doing so would introduce more asynchrony and the
2200  * interface up/down operations will need multiple return and restarts.
2201  * Instead the 'ipsq_current_ipif' of the ipsq is not cleared as long as
2202  * the 'ill_dlpi_deferred' chain is non-empty. This ensures that the next
2203  * exclusive operation won't start until the DLPI operations of the previous
2204  * exclusive operation complete.
2205  *
2206  * The capability state machine is shown below.
2207  *
2208  * state		next state		event, action
2209  *
2210  * IDCS_UNKNOWN 	IDCS_PROBE_SENT		ill_capability_probe
2211  * IDCS_PROBE_SENT	IDCS_OK			ill_capability_ack
2212  * IDCS_PROBE_SENT	IDCS_FAILED		ip_rput_dlpi_writer (nack)
2213  * IDCS_OK		IDCS_RENEG		Receipt of DL_NOTE_CAPAB_RENEG
2214  * IDCS_OK		IDCS_RESET_SENT		ill_capability_reset
2215  * IDCS_RESET_SENT	IDCS_UNKNOWN		ill_capability_ack_thr
2216  * IDCS_RENEG		IDCS_PROBE_SENT		ill_capability_ack_thr ->
2217  *						    ill_capability_probe.
2218  */
2219 
2220 /*
2221  * Dedicated thread started from ip_stack_init that handles capability
2222  * disable. This thread ensures the taskq dispatch does not fail by waiting
2223  * for resources using TQ_SLEEP. The taskq mechanism is used to ensure
2224  * that direct calls to DLD are done in a cv_waitable context.
2225  */
2226 void
ill_taskq_dispatch(ip_stack_t * ipst)2227 ill_taskq_dispatch(ip_stack_t *ipst)
2228 {
2229 	callb_cpr_t cprinfo;
2230 	char 	name[64];
2231 	mblk_t	*mp;
2232 
2233 	(void) snprintf(name, sizeof (name), "ill_taskq_dispatch_%d",
2234 	    ipst->ips_netstack->netstack_stackid);
2235 	CALLB_CPR_INIT(&cprinfo, &ipst->ips_capab_taskq_lock, callb_generic_cpr,
2236 	    name);
2237 	mutex_enter(&ipst->ips_capab_taskq_lock);
2238 
2239 	for (;;) {
2240 		mp = ipst->ips_capab_taskq_head;
2241 		while (mp != NULL) {
2242 			ipst->ips_capab_taskq_head = mp->b_next;
2243 			if (ipst->ips_capab_taskq_head == NULL)
2244 				ipst->ips_capab_taskq_tail = NULL;
2245 			mutex_exit(&ipst->ips_capab_taskq_lock);
2246 			mp->b_next = NULL;
2247 
2248 			VERIFY(taskq_dispatch(system_taskq,
2249 			    ill_capability_ack_thr, mp, TQ_SLEEP) != 0);
2250 			mutex_enter(&ipst->ips_capab_taskq_lock);
2251 			mp = ipst->ips_capab_taskq_head;
2252 		}
2253 
2254 		if (ipst->ips_capab_taskq_quit)
2255 			break;
2256 		CALLB_CPR_SAFE_BEGIN(&cprinfo);
2257 		cv_wait(&ipst->ips_capab_taskq_cv, &ipst->ips_capab_taskq_lock);
2258 		CALLB_CPR_SAFE_END(&cprinfo, &ipst->ips_capab_taskq_lock);
2259 	}
2260 	VERIFY(ipst->ips_capab_taskq_head == NULL);
2261 	VERIFY(ipst->ips_capab_taskq_tail == NULL);
2262 	CALLB_CPR_EXIT(&cprinfo);
2263 	thread_exit();
2264 }
2265 
2266 /*
2267  * Consume a new-style hardware capabilities negotiation ack.
2268  * Called via taskq on receipt of DL_CAPABILITY_ACK.
2269  */
2270 static void
ill_capability_ack_thr(void * arg)2271 ill_capability_ack_thr(void *arg)
2272 {
2273 	mblk_t	*mp = arg;
2274 	dl_capability_ack_t *capp;
2275 	dl_capability_sub_t *subp, *endp;
2276 	ill_t	*ill;
2277 	boolean_t reneg;
2278 
2279 	ill = (ill_t *)mp->b_prev;
2280 	mp->b_prev = NULL;
2281 
2282 	VERIFY(ipsq_enter(ill, B_FALSE, CUR_OP) == B_TRUE);
2283 
2284 	if (ill->ill_dlpi_capab_state == IDCS_RESET_SENT ||
2285 	    ill->ill_dlpi_capab_state == IDCS_RENEG) {
2286 		/*
2287 		 * We have received the ack for our DL_CAPAB reset request.
2288 		 * There isnt' anything in the message that needs processing.
2289 		 * All message based capabilities have been disabled, now
2290 		 * do the function call based capability disable.
2291 		 */
2292 		reneg = ill->ill_dlpi_capab_state == IDCS_RENEG;
2293 		ill_capability_dld_disable(ill);
2294 		ill->ill_dlpi_capab_state = IDCS_UNKNOWN;
2295 		if (reneg)
2296 			ill_capability_probe(ill);
2297 		goto done;
2298 	}
2299 
2300 	if (ill->ill_dlpi_capab_state == IDCS_PROBE_SENT)
2301 		ill->ill_dlpi_capab_state = IDCS_OK;
2302 
2303 	capp = (dl_capability_ack_t *)mp->b_rptr;
2304 
2305 	if (capp->dl_sub_length == 0) {
2306 		/* no new-style capabilities */
2307 		goto done;
2308 	}
2309 
2310 	/* make sure the driver supplied correct dl_sub_length */
2311 	if ((sizeof (*capp) + capp->dl_sub_length) > MBLKL(mp)) {
2312 		ip0dbg(("ill_capability_ack: bad DL_CAPABILITY_ACK, "
2313 		    "invalid dl_sub_length (%d)\n", capp->dl_sub_length));
2314 		goto done;
2315 	}
2316 
2317 #define	SC(base, offset) (dl_capability_sub_t *)(((uchar_t *)(base))+(offset))
2318 	/*
2319 	 * There are sub-capabilities. Process the ones we know about.
2320 	 * Loop until we don't have room for another sub-cap header..
2321 	 */
2322 	for (subp = SC(capp, capp->dl_sub_offset),
2323 	    endp = SC(subp, capp->dl_sub_length - sizeof (*subp));
2324 	    subp <= endp;
2325 	    subp = SC(subp, sizeof (dl_capability_sub_t) + subp->dl_length)) {
2326 
2327 		switch (subp->dl_cap) {
2328 		case DL_CAPAB_ID_WRAPPER:
2329 			ill_capability_id_ack(ill, mp, subp);
2330 			break;
2331 		default:
2332 			ill_capability_dispatch(ill, mp, subp);
2333 			break;
2334 		}
2335 	}
2336 #undef SC
2337 done:
2338 	inet_freemsg(mp);
2339 	ill_capability_done(ill);
2340 	ipsq_exit(ill->ill_phyint->phyint_ipsq);
2341 }
2342 
2343 /*
2344  * This needs to be started in a taskq thread to provide a cv_waitable
2345  * context.
2346  */
2347 void
ill_capability_ack(ill_t * ill,mblk_t * mp)2348 ill_capability_ack(ill_t *ill, mblk_t *mp)
2349 {
2350 	ip_stack_t	*ipst = ill->ill_ipst;
2351 
2352 	mp->b_prev = (mblk_t *)ill;
2353 	ASSERT(mp->b_next == NULL);
2354 
2355 	if (taskq_dispatch(system_taskq, ill_capability_ack_thr, mp,
2356 	    TQ_NOSLEEP) != 0)
2357 		return;
2358 
2359 	/*
2360 	 * The taskq dispatch failed. Signal the ill_taskq_dispatch thread
2361 	 * which will do the dispatch using TQ_SLEEP to guarantee success.
2362 	 */
2363 	mutex_enter(&ipst->ips_capab_taskq_lock);
2364 	if (ipst->ips_capab_taskq_head == NULL) {
2365 		ASSERT(ipst->ips_capab_taskq_tail == NULL);
2366 		ipst->ips_capab_taskq_head = mp;
2367 	} else {
2368 		ipst->ips_capab_taskq_tail->b_next = mp;
2369 	}
2370 	ipst->ips_capab_taskq_tail = mp;
2371 
2372 	cv_signal(&ipst->ips_capab_taskq_cv);
2373 	mutex_exit(&ipst->ips_capab_taskq_lock);
2374 }
2375 
2376 /*
2377  * This routine is called to scan the fragmentation reassembly table for
2378  * the specified ILL for any packets that are starting to smell.
2379  * dead_interval is the maximum time in seconds that will be tolerated.  It
2380  * will either be the value specified in ip_g_frag_timeout, or zero if the
2381  * ILL is shutting down and it is time to blow everything off.
2382  *
2383  * It returns the number of seconds (as a time_t) that the next frag timer
2384  * should be scheduled for, 0 meaning that the timer doesn't need to be
2385  * re-started.  Note that the method of calculating next_timeout isn't
2386  * entirely accurate since time will flow between the time we grab
2387  * current_time and the time we schedule the next timeout.  This isn't a
2388  * big problem since this is the timer for sending an ICMP reassembly time
2389  * exceeded messages, and it doesn't have to be exactly accurate.
2390  *
2391  * This function is
2392  * sometimes called as writer, although this is not required.
2393  */
2394 time_t
ill_frag_timeout(ill_t * ill,time_t dead_interval)2395 ill_frag_timeout(ill_t *ill, time_t dead_interval)
2396 {
2397 	ipfb_t	*ipfb;
2398 	ipfb_t	*endp;
2399 	ipf_t	*ipf;
2400 	ipf_t	*ipfnext;
2401 	mblk_t	*mp;
2402 	time_t	current_time = gethrestime_sec();
2403 	time_t	next_timeout = 0;
2404 	uint32_t	hdr_length;
2405 	mblk_t	*send_icmp_head;
2406 	mblk_t	*send_icmp_head_v6;
2407 	ip_stack_t *ipst = ill->ill_ipst;
2408 	ip_recv_attr_t iras;
2409 
2410 	bzero(&iras, sizeof (iras));
2411 	iras.ira_flags = 0;
2412 	iras.ira_ill = iras.ira_rill = ill;
2413 	iras.ira_ruifindex = ill->ill_phyint->phyint_ifindex;
2414 	iras.ira_rifindex = iras.ira_ruifindex;
2415 
2416 	ipfb = ill->ill_frag_hash_tbl;
2417 	if (ipfb == NULL)
2418 		return (B_FALSE);
2419 	endp = &ipfb[ILL_FRAG_HASH_TBL_COUNT];
2420 	/* Walk the frag hash table. */
2421 	for (; ipfb < endp; ipfb++) {
2422 		send_icmp_head = NULL;
2423 		send_icmp_head_v6 = NULL;
2424 		mutex_enter(&ipfb->ipfb_lock);
2425 		while ((ipf = ipfb->ipfb_ipf) != 0) {
2426 			time_t frag_time = current_time - ipf->ipf_timestamp;
2427 			time_t frag_timeout;
2428 
2429 			if (frag_time < dead_interval) {
2430 				/*
2431 				 * There are some outstanding fragments
2432 				 * that will timeout later.  Make note of
2433 				 * the time so that we can reschedule the
2434 				 * next timeout appropriately.
2435 				 */
2436 				frag_timeout = dead_interval - frag_time;
2437 				if (next_timeout == 0 ||
2438 				    frag_timeout < next_timeout) {
2439 					next_timeout = frag_timeout;
2440 				}
2441 				break;
2442 			}
2443 			/* Time's up.  Get it out of here. */
2444 			hdr_length = ipf->ipf_nf_hdr_len;
2445 			ipfnext = ipf->ipf_hash_next;
2446 			if (ipfnext)
2447 				ipfnext->ipf_ptphn = ipf->ipf_ptphn;
2448 			*ipf->ipf_ptphn = ipfnext;
2449 			mp = ipf->ipf_mp->b_cont;
2450 			for (; mp; mp = mp->b_cont) {
2451 				/* Extra points for neatness. */
2452 				IP_REASS_SET_START(mp, 0);
2453 				IP_REASS_SET_END(mp, 0);
2454 			}
2455 			mp = ipf->ipf_mp->b_cont;
2456 			atomic_add_32(&ill->ill_frag_count, -ipf->ipf_count);
2457 			ASSERT(ipfb->ipfb_count >= ipf->ipf_count);
2458 			ipfb->ipfb_count -= ipf->ipf_count;
2459 			ASSERT(ipfb->ipfb_frag_pkts > 0);
2460 			ipfb->ipfb_frag_pkts--;
2461 			/*
2462 			 * We do not send any icmp message from here because
2463 			 * we currently are holding the ipfb_lock for this
2464 			 * hash chain. If we try and send any icmp messages
2465 			 * from here we may end up via a put back into ip
2466 			 * trying to get the same lock, causing a recursive
2467 			 * mutex panic. Instead we build a list and send all
2468 			 * the icmp messages after we have dropped the lock.
2469 			 */
2470 			if (ill->ill_isv6) {
2471 				if (hdr_length != 0) {
2472 					mp->b_next = send_icmp_head_v6;
2473 					send_icmp_head_v6 = mp;
2474 				} else {
2475 					freemsg(mp);
2476 				}
2477 			} else {
2478 				if (hdr_length != 0) {
2479 					mp->b_next = send_icmp_head;
2480 					send_icmp_head = mp;
2481 				} else {
2482 					freemsg(mp);
2483 				}
2484 			}
2485 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmFails);
2486 			ip_drop_input("ipIfStatsReasmFails", ipf->ipf_mp, ill);
2487 			freeb(ipf->ipf_mp);
2488 		}
2489 		mutex_exit(&ipfb->ipfb_lock);
2490 		/*
2491 		 * Now need to send any icmp messages that we delayed from
2492 		 * above.
2493 		 */
2494 		while (send_icmp_head_v6 != NULL) {
2495 			ip6_t *ip6h;
2496 
2497 			mp = send_icmp_head_v6;
2498 			send_icmp_head_v6 = send_icmp_head_v6->b_next;
2499 			mp->b_next = NULL;
2500 			ip6h = (ip6_t *)mp->b_rptr;
2501 			iras.ira_flags = 0;
2502 			/*
2503 			 * This will result in an incorrect ALL_ZONES zoneid
2504 			 * for multicast packets, but we
2505 			 * don't send ICMP errors for those in any case.
2506 			 */
2507 			iras.ira_zoneid =
2508 			    ipif_lookup_addr_zoneid_v6(&ip6h->ip6_dst,
2509 			    ill, ipst);
2510 			ip_drop_input("ICMP_TIME_EXCEEDED reass", mp, ill);
2511 			icmp_time_exceeded_v6(mp,
2512 			    ICMP_REASSEMBLY_TIME_EXCEEDED, B_FALSE,
2513 			    &iras);
2514 			ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE));
2515 		}
2516 		while (send_icmp_head != NULL) {
2517 			ipaddr_t dst;
2518 
2519 			mp = send_icmp_head;
2520 			send_icmp_head = send_icmp_head->b_next;
2521 			mp->b_next = NULL;
2522 
2523 			dst = ((ipha_t *)mp->b_rptr)->ipha_dst;
2524 
2525 			iras.ira_flags = IRAF_IS_IPV4;
2526 			/*
2527 			 * This will result in an incorrect ALL_ZONES zoneid
2528 			 * for broadcast and multicast packets, but we
2529 			 * don't send ICMP errors for those in any case.
2530 			 */
2531 			iras.ira_zoneid = ipif_lookup_addr_zoneid(dst,
2532 			    ill, ipst);
2533 			ip_drop_input("ICMP_TIME_EXCEEDED reass", mp, ill);
2534 			icmp_time_exceeded(mp,
2535 			    ICMP_REASSEMBLY_TIME_EXCEEDED, &iras);
2536 			ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE));
2537 		}
2538 	}
2539 	/*
2540 	 * A non-dying ILL will use the return value to decide whether to
2541 	 * restart the frag timer, and for how long.
2542 	 */
2543 	return (next_timeout);
2544 }
2545 
2546 /*
2547  * This routine is called when the approximate count of mblk memory used
2548  * for the specified ILL has exceeded max_count.
2549  */
2550 void
ill_frag_prune(ill_t * ill,uint_t max_count)2551 ill_frag_prune(ill_t *ill, uint_t max_count)
2552 {
2553 	ipfb_t	*ipfb;
2554 	ipf_t	*ipf;
2555 	size_t	count;
2556 	clock_t now;
2557 
2558 	/*
2559 	 * If we are here within ip_min_frag_prune_time msecs remove
2560 	 * ill_frag_free_num_pkts oldest packets from each bucket and increment
2561 	 * ill_frag_free_num_pkts.
2562 	 */
2563 	mutex_enter(&ill->ill_lock);
2564 	now = ddi_get_lbolt();
2565 	if (TICK_TO_MSEC(now - ill->ill_last_frag_clean_time) <=
2566 	    (ip_min_frag_prune_time != 0 ?
2567 	    ip_min_frag_prune_time : msec_per_tick)) {
2568 
2569 		ill->ill_frag_free_num_pkts++;
2570 
2571 	} else {
2572 		ill->ill_frag_free_num_pkts = 0;
2573 	}
2574 	ill->ill_last_frag_clean_time = now;
2575 	mutex_exit(&ill->ill_lock);
2576 
2577 	/*
2578 	 * free ill_frag_free_num_pkts oldest packets from each bucket.
2579 	 */
2580 	if (ill->ill_frag_free_num_pkts != 0) {
2581 		int ix;
2582 
2583 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
2584 			ipfb = &ill->ill_frag_hash_tbl[ix];
2585 			mutex_enter(&ipfb->ipfb_lock);
2586 			if (ipfb->ipfb_ipf != NULL) {
2587 				ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf,
2588 				    ill->ill_frag_free_num_pkts);
2589 			}
2590 			mutex_exit(&ipfb->ipfb_lock);
2591 		}
2592 	}
2593 	/*
2594 	 * While the reassembly list for this ILL is too big, prune a fragment
2595 	 * queue by age, oldest first.
2596 	 */
2597 	while (ill->ill_frag_count > max_count) {
2598 		int	ix;
2599 		ipfb_t	*oipfb = NULL;
2600 		uint_t	oldest = UINT_MAX;
2601 
2602 		count = 0;
2603 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
2604 			ipfb = &ill->ill_frag_hash_tbl[ix];
2605 			mutex_enter(&ipfb->ipfb_lock);
2606 			ipf = ipfb->ipfb_ipf;
2607 			if (ipf != NULL && ipf->ipf_gen < oldest) {
2608 				oldest = ipf->ipf_gen;
2609 				oipfb = ipfb;
2610 			}
2611 			count += ipfb->ipfb_count;
2612 			mutex_exit(&ipfb->ipfb_lock);
2613 		}
2614 		if (oipfb == NULL)
2615 			break;
2616 
2617 		if (count <= max_count)
2618 			return;	/* Somebody beat us to it, nothing to do */
2619 		mutex_enter(&oipfb->ipfb_lock);
2620 		ipf = oipfb->ipfb_ipf;
2621 		if (ipf != NULL) {
2622 			ill_frag_free_pkts(ill, oipfb, ipf, 1);
2623 		}
2624 		mutex_exit(&oipfb->ipfb_lock);
2625 	}
2626 }
2627 
2628 /*
2629  * free 'free_cnt' fragmented packets starting at ipf.
2630  */
2631 void
ill_frag_free_pkts(ill_t * ill,ipfb_t * ipfb,ipf_t * ipf,int free_cnt)2632 ill_frag_free_pkts(ill_t *ill, ipfb_t *ipfb, ipf_t *ipf, int free_cnt)
2633 {
2634 	size_t	count;
2635 	mblk_t	*mp;
2636 	mblk_t	*tmp;
2637 	ipf_t **ipfp = ipf->ipf_ptphn;
2638 
2639 	ASSERT(MUTEX_HELD(&ipfb->ipfb_lock));
2640 	ASSERT(ipfp != NULL);
2641 	ASSERT(ipf != NULL);
2642 
2643 	while (ipf != NULL && free_cnt-- > 0) {
2644 		count = ipf->ipf_count;
2645 		mp = ipf->ipf_mp;
2646 		ipf = ipf->ipf_hash_next;
2647 		for (tmp = mp; tmp; tmp = tmp->b_cont) {
2648 			IP_REASS_SET_START(tmp, 0);
2649 			IP_REASS_SET_END(tmp, 0);
2650 		}
2651 		atomic_add_32(&ill->ill_frag_count, -count);
2652 		ASSERT(ipfb->ipfb_count >= count);
2653 		ipfb->ipfb_count -= count;
2654 		ASSERT(ipfb->ipfb_frag_pkts > 0);
2655 		ipfb->ipfb_frag_pkts--;
2656 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmFails);
2657 		ip_drop_input("ipIfStatsReasmFails", mp, ill);
2658 		freemsg(mp);
2659 	}
2660 
2661 	if (ipf)
2662 		ipf->ipf_ptphn = ipfp;
2663 	ipfp[0] = ipf;
2664 }
2665 
2666 /*
2667  * Helper function for ill_forward_set().
2668  */
2669 static void
ill_forward_set_on_ill(ill_t * ill,boolean_t enable)2670 ill_forward_set_on_ill(ill_t *ill, boolean_t enable)
2671 {
2672 	ip_stack_t	*ipst = ill->ill_ipst;
2673 
2674 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ipst->ips_ill_g_lock));
2675 
2676 	ip1dbg(("ill_forward_set: %s %s forwarding on %s",
2677 	    (enable ? "Enabling" : "Disabling"),
2678 	    (ill->ill_isv6 ? "IPv6" : "IPv4"), ill->ill_name));
2679 	mutex_enter(&ill->ill_lock);
2680 	if (enable)
2681 		ill->ill_flags |= ILLF_ROUTER;
2682 	else
2683 		ill->ill_flags &= ~ILLF_ROUTER;
2684 	mutex_exit(&ill->ill_lock);
2685 	if (ill->ill_isv6)
2686 		ill_set_nce_router_flags(ill, enable);
2687 	/* Notify routing socket listeners of this change. */
2688 	if (ill->ill_ipif != NULL)
2689 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
2690 }
2691 
2692 /*
2693  * Set an ill's ILLF_ROUTER flag appropriately.  Send up RTS_IFINFO routing
2694  * socket messages for each interface whose flags we change.
2695  */
2696 int
ill_forward_set(ill_t * ill,boolean_t enable)2697 ill_forward_set(ill_t *ill, boolean_t enable)
2698 {
2699 	ipmp_illgrp_t *illg;
2700 	ip_stack_t *ipst = ill->ill_ipst;
2701 
2702 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ipst->ips_ill_g_lock));
2703 
2704 	if ((enable && (ill->ill_flags & ILLF_ROUTER)) ||
2705 	    (!enable && !(ill->ill_flags & ILLF_ROUTER)))
2706 		return (0);
2707 
2708 	if (IS_LOOPBACK(ill))
2709 		return (EINVAL);
2710 
2711 	if (enable && ill->ill_allowed_ips_cnt > 0)
2712 		return (EPERM);
2713 
2714 	if (IS_IPMP(ill) || IS_UNDER_IPMP(ill)) {
2715 		/*
2716 		 * Update all of the interfaces in the group.
2717 		 */
2718 		illg = ill->ill_grp;
2719 		ill = list_head(&illg->ig_if);
2720 		for (; ill != NULL; ill = list_next(&illg->ig_if, ill))
2721 			ill_forward_set_on_ill(ill, enable);
2722 
2723 		/*
2724 		 * Update the IPMP meta-interface.
2725 		 */
2726 		ill_forward_set_on_ill(ipmp_illgrp_ipmp_ill(illg), enable);
2727 		return (0);
2728 	}
2729 
2730 	ill_forward_set_on_ill(ill, enable);
2731 	return (0);
2732 }
2733 
2734 /*
2735  * Based on the ILLF_ROUTER flag of an ill, make sure all local nce's for
2736  * addresses assigned to the ill have the NCE_F_ISROUTER flag appropriately
2737  * set or clear.
2738  */
2739 static void
ill_set_nce_router_flags(ill_t * ill,boolean_t enable)2740 ill_set_nce_router_flags(ill_t *ill, boolean_t enable)
2741 {
2742 	ipif_t *ipif;
2743 	ncec_t *ncec;
2744 	nce_t *nce;
2745 
2746 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
2747 		/*
2748 		 * NOTE: we match across the illgrp because nce's for
2749 		 * addresses on IPMP interfaces have an nce_ill that points to
2750 		 * the bound underlying ill.
2751 		 */
2752 		nce = nce_lookup_v6(ill, &ipif->ipif_v6lcl_addr);
2753 		if (nce != NULL) {
2754 			ncec = nce->nce_common;
2755 			mutex_enter(&ncec->ncec_lock);
2756 			if (enable)
2757 				ncec->ncec_flags |= NCE_F_ISROUTER;
2758 			else
2759 				ncec->ncec_flags &= ~NCE_F_ISROUTER;
2760 			mutex_exit(&ncec->ncec_lock);
2761 			nce_refrele(nce);
2762 		}
2763 	}
2764 }
2765 
2766 /*
2767  * Intializes the context structure and returns the first ill in the list
2768  * cuurently start_list and end_list can have values:
2769  * MAX_G_HEADS		Traverse both IPV4 and IPV6 lists.
2770  * IP_V4_G_HEAD		Traverse IPV4 list only.
2771  * IP_V6_G_HEAD		Traverse IPV6 list only.
2772  */
2773 
2774 /*
2775  * We don't check for CONDEMNED ills here. Caller must do that if
2776  * necessary under the ill lock.
2777  */
2778 ill_t *
ill_first(int start_list,int end_list,ill_walk_context_t * ctx,ip_stack_t * ipst)2779 ill_first(int start_list, int end_list, ill_walk_context_t *ctx,
2780     ip_stack_t *ipst)
2781 {
2782 	ill_if_t *ifp;
2783 	ill_t *ill;
2784 	avl_tree_t *avl_tree;
2785 
2786 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
2787 	ASSERT(end_list <= MAX_G_HEADS && start_list >= 0);
2788 
2789 	/*
2790 	 * setup the lists to search
2791 	 */
2792 	if (end_list != MAX_G_HEADS) {
2793 		ctx->ctx_current_list = start_list;
2794 		ctx->ctx_last_list = end_list;
2795 	} else {
2796 		ctx->ctx_last_list = MAX_G_HEADS - 1;
2797 		ctx->ctx_current_list = 0;
2798 	}
2799 
2800 	while (ctx->ctx_current_list <= ctx->ctx_last_list) {
2801 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst);
2802 		if (ifp != (ill_if_t *)
2803 		    &IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst)) {
2804 			avl_tree = &ifp->illif_avl_by_ppa;
2805 			ill = avl_first(avl_tree);
2806 			/*
2807 			 * ill is guaranteed to be non NULL or ifp should have
2808 			 * not existed.
2809 			 */
2810 			ASSERT(ill != NULL);
2811 			return (ill);
2812 		}
2813 		ctx->ctx_current_list++;
2814 	}
2815 
2816 	return (NULL);
2817 }
2818 
2819 /*
2820  * returns the next ill in the list. ill_first() must have been called
2821  * before calling ill_next() or bad things will happen.
2822  */
2823 
2824 /*
2825  * We don't check for CONDEMNED ills here. Caller must do that if
2826  * necessary under the ill lock.
2827  */
2828 ill_t *
ill_next(ill_walk_context_t * ctx,ill_t * lastill)2829 ill_next(ill_walk_context_t *ctx, ill_t *lastill)
2830 {
2831 	ill_if_t *ifp;
2832 	ill_t *ill;
2833 	ip_stack_t	*ipst = lastill->ill_ipst;
2834 
2835 	ASSERT(lastill->ill_ifptr != (ill_if_t *)
2836 	    &IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst));
2837 	if ((ill = avl_walk(&lastill->ill_ifptr->illif_avl_by_ppa, lastill,
2838 	    AVL_AFTER)) != NULL) {
2839 		return (ill);
2840 	}
2841 
2842 	/* goto next ill_ifp in the list. */
2843 	ifp = lastill->ill_ifptr->illif_next;
2844 
2845 	/* make sure not at end of circular list */
2846 	while (ifp ==
2847 	    (ill_if_t *)&IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst)) {
2848 		if (++ctx->ctx_current_list > ctx->ctx_last_list)
2849 			return (NULL);
2850 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst);
2851 	}
2852 
2853 	return (avl_first(&ifp->illif_avl_by_ppa));
2854 }
2855 
2856 /*
2857  * Check interface name for correct format: [a-zA-Z]+[a-zA-Z0-9._]*[0-9]+
2858  * The final number (PPA) must not have any leading zeros.  Upon success, a
2859  * pointer to the start of the PPA is returned; otherwise NULL is returned.
2860  */
2861 static char *
ill_get_ppa_ptr(char * name)2862 ill_get_ppa_ptr(char *name)
2863 {
2864 	int namelen = strlen(name);
2865 	int end_ndx = namelen - 1;
2866 	int ppa_ndx, i;
2867 
2868 	/*
2869 	 * Check that the first character is [a-zA-Z], and that the last
2870 	 * character is [0-9].
2871 	 */
2872 	if (namelen == 0 || !isalpha(name[0]) || !isdigit(name[end_ndx]))
2873 		return (NULL);
2874 
2875 	/*
2876 	 * Set `ppa_ndx' to the PPA start, and check for leading zeroes.
2877 	 */
2878 	for (ppa_ndx = end_ndx; ppa_ndx > 0; ppa_ndx--)
2879 		if (!isdigit(name[ppa_ndx - 1]))
2880 			break;
2881 
2882 	if (name[ppa_ndx] == '0' && ppa_ndx < end_ndx)
2883 		return (NULL);
2884 
2885 	/*
2886 	 * Check that the intermediate characters are [a-z0-9.]
2887 	 */
2888 	for (i = 1; i < ppa_ndx; i++) {
2889 		if (!isalpha(name[i]) && !isdigit(name[i]) &&
2890 		    name[i] != '.' && name[i] != '_') {
2891 			return (NULL);
2892 		}
2893 	}
2894 
2895 	return (name + ppa_ndx);
2896 }
2897 
2898 /*
2899  * use avl tree to locate the ill.
2900  */
2901 static ill_t *
ill_find_by_name(char * name,boolean_t isv6,ip_stack_t * ipst)2902 ill_find_by_name(char *name, boolean_t isv6, ip_stack_t *ipst)
2903 {
2904 	char *ppa_ptr = NULL;
2905 	int len;
2906 	uint_t ppa;
2907 	ill_t *ill = NULL;
2908 	ill_if_t *ifp;
2909 	int list;
2910 
2911 	/*
2912 	 * get ppa ptr
2913 	 */
2914 	if (isv6)
2915 		list = IP_V6_G_HEAD;
2916 	else
2917 		list = IP_V4_G_HEAD;
2918 
2919 	if ((ppa_ptr = ill_get_ppa_ptr(name)) == NULL) {
2920 		return (NULL);
2921 	}
2922 
2923 	len = ppa_ptr - name + 1;
2924 
2925 	ppa = stoi(&ppa_ptr);
2926 
2927 	ifp = IP_VX_ILL_G_LIST(list, ipst);
2928 
2929 	while (ifp != (ill_if_t *)&IP_VX_ILL_G_LIST(list, ipst)) {
2930 		/*
2931 		 * match is done on len - 1 as the name is not null
2932 		 * terminated it contains ppa in addition to the interface
2933 		 * name.
2934 		 */
2935 		if ((ifp->illif_name_len == len) &&
2936 		    bcmp(ifp->illif_name, name, len - 1) == 0) {
2937 			break;
2938 		} else {
2939 			ifp = ifp->illif_next;
2940 		}
2941 	}
2942 
2943 	if (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(list, ipst)) {
2944 		/*
2945 		 * Even the interface type does not exist.
2946 		 */
2947 		return (NULL);
2948 	}
2949 
2950 	ill = avl_find(&ifp->illif_avl_by_ppa, (void *) &ppa, NULL);
2951 	if (ill != NULL) {
2952 		mutex_enter(&ill->ill_lock);
2953 		if (ILL_CAN_LOOKUP(ill)) {
2954 			ill_refhold_locked(ill);
2955 			mutex_exit(&ill->ill_lock);
2956 			return (ill);
2957 		}
2958 		mutex_exit(&ill->ill_lock);
2959 	}
2960 	return (NULL);
2961 }
2962 
2963 /*
2964  * comparison function for use with avl.
2965  */
2966 static int
ill_compare_ppa(const void * ppa_ptr,const void * ill_ptr)2967 ill_compare_ppa(const void *ppa_ptr, const void *ill_ptr)
2968 {
2969 	uint_t ppa;
2970 	uint_t ill_ppa;
2971 
2972 	ASSERT(ppa_ptr != NULL && ill_ptr != NULL);
2973 
2974 	ppa = *((uint_t *)ppa_ptr);
2975 	ill_ppa = ((const ill_t *)ill_ptr)->ill_ppa;
2976 	/*
2977 	 * We want the ill with the lowest ppa to be on the
2978 	 * top.
2979 	 */
2980 	if (ill_ppa < ppa)
2981 		return (1);
2982 	if (ill_ppa > ppa)
2983 		return (-1);
2984 	return (0);
2985 }
2986 
2987 /*
2988  * remove an interface type from the global list.
2989  */
2990 static void
ill_delete_interface_type(ill_if_t * interface)2991 ill_delete_interface_type(ill_if_t *interface)
2992 {
2993 	ASSERT(interface != NULL);
2994 	ASSERT(avl_numnodes(&interface->illif_avl_by_ppa) == 0);
2995 
2996 	avl_destroy(&interface->illif_avl_by_ppa);
2997 	if (interface->illif_ppa_arena != NULL)
2998 		vmem_destroy(interface->illif_ppa_arena);
2999 
3000 	remque(interface);
3001 
3002 	mi_free(interface);
3003 }
3004 
3005 /*
3006  * remove ill from the global list.
3007  */
3008 static void
ill_glist_delete(ill_t * ill)3009 ill_glist_delete(ill_t *ill)
3010 {
3011 	ip_stack_t	*ipst;
3012 	phyint_t	*phyi;
3013 
3014 	if (ill == NULL)
3015 		return;
3016 	ipst = ill->ill_ipst;
3017 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
3018 
3019 	/*
3020 	 * If the ill was never inserted into the AVL tree
3021 	 * we skip the if branch.
3022 	 */
3023 	if (ill->ill_ifptr != NULL) {
3024 		/*
3025 		 * remove from AVL tree and free ppa number
3026 		 */
3027 		avl_remove(&ill->ill_ifptr->illif_avl_by_ppa, ill);
3028 
3029 		if (ill->ill_ifptr->illif_ppa_arena != NULL) {
3030 			vmem_free(ill->ill_ifptr->illif_ppa_arena,
3031 			    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
3032 		}
3033 		if (avl_numnodes(&ill->ill_ifptr->illif_avl_by_ppa) == 0) {
3034 			ill_delete_interface_type(ill->ill_ifptr);
3035 		}
3036 
3037 		/*
3038 		 * Indicate ill is no longer in the list.
3039 		 */
3040 		ill->ill_ifptr = NULL;
3041 		ill->ill_name_length = 0;
3042 		ill->ill_name[0] = '\0';
3043 		ill->ill_ppa = UINT_MAX;
3044 	}
3045 
3046 	/* Generate one last event for this ill. */
3047 	ill_nic_event_dispatch(ill, 0, NE_UNPLUMB, ill->ill_name,
3048 	    ill->ill_name_length);
3049 
3050 	ASSERT(ill->ill_phyint != NULL);
3051 	phyi = ill->ill_phyint;
3052 	ill->ill_phyint = NULL;
3053 
3054 	/*
3055 	 * ill_init allocates a phyint always to store the copy
3056 	 * of flags relevant to phyint. At that point in time, we could
3057 	 * not assign the name and hence phyint_illv4/v6 could not be
3058 	 * initialized. Later in ipif_set_values, we assign the name to
3059 	 * the ill, at which point in time we assign phyint_illv4/v6.
3060 	 * Thus we don't rely on phyint_illv6 to be initialized always.
3061 	 */
3062 	if (ill->ill_flags & ILLF_IPV6)
3063 		phyi->phyint_illv6 = NULL;
3064 	else
3065 		phyi->phyint_illv4 = NULL;
3066 
3067 	if (phyi->phyint_illv4 != NULL || phyi->phyint_illv6 != NULL) {
3068 		rw_exit(&ipst->ips_ill_g_lock);
3069 		return;
3070 	}
3071 
3072 	/*
3073 	 * There are no ills left on this phyint; pull it out of the phyint
3074 	 * avl trees, and free it.
3075 	 */
3076 	if (phyi->phyint_ifindex > 0) {
3077 		avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3078 		    phyi);
3079 		avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
3080 		    phyi);
3081 	}
3082 	rw_exit(&ipst->ips_ill_g_lock);
3083 
3084 	phyint_free(phyi);
3085 }
3086 
3087 /*
3088  * allocate a ppa, if the number of plumbed interfaces of this type are
3089  * less than ill_no_arena do a linear search to find a unused ppa.
3090  * When the number goes beyond ill_no_arena switch to using an arena.
3091  * Note: ppa value of zero cannot be allocated from vmem_arena as it
3092  * is the return value for an error condition, so allocation starts at one
3093  * and is decremented by one.
3094  */
3095 static int
ill_alloc_ppa(ill_if_t * ifp,ill_t * ill)3096 ill_alloc_ppa(ill_if_t *ifp, ill_t *ill)
3097 {
3098 	ill_t *tmp_ill;
3099 	uint_t start, end;
3100 	int ppa;
3101 
3102 	if (ifp->illif_ppa_arena == NULL &&
3103 	    (avl_numnodes(&ifp->illif_avl_by_ppa) + 1 > ill_no_arena)) {
3104 		/*
3105 		 * Create an arena.
3106 		 */
3107 		ifp->illif_ppa_arena = vmem_create(ifp->illif_name,
3108 		    (void *)1, UINT_MAX - 1, 1, NULL, NULL,
3109 		    NULL, 0, VM_SLEEP | VMC_IDENTIFIER);
3110 			/* allocate what has already been assigned */
3111 		for (tmp_ill = avl_first(&ifp->illif_avl_by_ppa);
3112 		    tmp_ill != NULL; tmp_ill = avl_walk(&ifp->illif_avl_by_ppa,
3113 		    tmp_ill, AVL_AFTER)) {
3114 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
3115 			    1,		/* size */
3116 			    1,		/* align/quantum */
3117 			    0,		/* phase */
3118 			    0,		/* nocross */
3119 			    /* minaddr */
3120 			    (void *)((uintptr_t)tmp_ill->ill_ppa + 1),
3121 			    /* maxaddr */
3122 			    (void *)((uintptr_t)tmp_ill->ill_ppa + 2),
3123 			    VM_NOSLEEP|VM_FIRSTFIT);
3124 			if (ppa == 0) {
3125 				ip1dbg(("ill_alloc_ppa: ppa allocation"
3126 				    " failed while switching"));
3127 				vmem_destroy(ifp->illif_ppa_arena);
3128 				ifp->illif_ppa_arena = NULL;
3129 				break;
3130 			}
3131 		}
3132 	}
3133 
3134 	if (ifp->illif_ppa_arena != NULL) {
3135 		if (ill->ill_ppa == UINT_MAX) {
3136 			ppa = (int)(uintptr_t)vmem_alloc(ifp->illif_ppa_arena,
3137 			    1, VM_NOSLEEP|VM_FIRSTFIT);
3138 			if (ppa == 0)
3139 				return (EAGAIN);
3140 			ill->ill_ppa = --ppa;
3141 		} else {
3142 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
3143 			    1, 		/* size */
3144 			    1, 		/* align/quantum */
3145 			    0, 		/* phase */
3146 			    0, 		/* nocross */
3147 			    (void *)(uintptr_t)(ill->ill_ppa + 1), /* minaddr */
3148 			    (void *)(uintptr_t)(ill->ill_ppa + 2), /* maxaddr */
3149 			    VM_NOSLEEP|VM_FIRSTFIT);
3150 			/*
3151 			 * Most likely the allocation failed because
3152 			 * the requested ppa was in use.
3153 			 */
3154 			if (ppa == 0)
3155 				return (EEXIST);
3156 		}
3157 		return (0);
3158 	}
3159 
3160 	/*
3161 	 * No arena is in use and not enough (>ill_no_arena) interfaces have
3162 	 * been plumbed to create one. Do a linear search to get a unused ppa.
3163 	 */
3164 	if (ill->ill_ppa == UINT_MAX) {
3165 		end = UINT_MAX - 1;
3166 		start = 0;
3167 	} else {
3168 		end = start = ill->ill_ppa;
3169 	}
3170 
3171 	tmp_ill = avl_find(&ifp->illif_avl_by_ppa, (void *)&start, NULL);
3172 	while (tmp_ill != NULL && tmp_ill->ill_ppa == start) {
3173 		if (start++ >= end) {
3174 			if (ill->ill_ppa == UINT_MAX)
3175 				return (EAGAIN);
3176 			else
3177 				return (EEXIST);
3178 		}
3179 		tmp_ill = avl_walk(&ifp->illif_avl_by_ppa, tmp_ill, AVL_AFTER);
3180 	}
3181 	ill->ill_ppa = start;
3182 	return (0);
3183 }
3184 
3185 /*
3186  * Insert ill into the list of configured ill's. Once this function completes,
3187  * the ill is globally visible and is available through lookups. More precisely
3188  * this happens after the caller drops the ill_g_lock.
3189  */
3190 static int
ill_glist_insert(ill_t * ill,char * name,boolean_t isv6)3191 ill_glist_insert(ill_t *ill, char *name, boolean_t isv6)
3192 {
3193 	ill_if_t *ill_interface;
3194 	avl_index_t where = 0;
3195 	int error;
3196 	int name_length;
3197 	int index;
3198 	boolean_t check_length = B_FALSE;
3199 	ip_stack_t	*ipst = ill->ill_ipst;
3200 
3201 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
3202 
3203 	name_length = mi_strlen(name) + 1;
3204 
3205 	if (isv6)
3206 		index = IP_V6_G_HEAD;
3207 	else
3208 		index = IP_V4_G_HEAD;
3209 
3210 	ill_interface = IP_VX_ILL_G_LIST(index, ipst);
3211 	/*
3212 	 * Search for interface type based on name
3213 	 */
3214 	while (ill_interface != (ill_if_t *)&IP_VX_ILL_G_LIST(index, ipst)) {
3215 		if ((ill_interface->illif_name_len == name_length) &&
3216 		    (strcmp(ill_interface->illif_name, name) == 0)) {
3217 			break;
3218 		}
3219 		ill_interface = ill_interface->illif_next;
3220 	}
3221 
3222 	/*
3223 	 * Interface type not found, create one.
3224 	 */
3225 	if (ill_interface == (ill_if_t *)&IP_VX_ILL_G_LIST(index, ipst)) {
3226 		ill_g_head_t ghead;
3227 
3228 		/*
3229 		 * allocate ill_if_t structure
3230 		 */
3231 		ill_interface = (ill_if_t *)mi_zalloc(sizeof (ill_if_t));
3232 		if (ill_interface == NULL) {
3233 			return (ENOMEM);
3234 		}
3235 
3236 		(void) strcpy(ill_interface->illif_name, name);
3237 		ill_interface->illif_name_len = name_length;
3238 
3239 		avl_create(&ill_interface->illif_avl_by_ppa,
3240 		    ill_compare_ppa, sizeof (ill_t),
3241 		    offsetof(struct ill_s, ill_avl_byppa));
3242 
3243 		/*
3244 		 * link the structure in the back to maintain order
3245 		 * of configuration for ifconfig output.
3246 		 */
3247 		ghead = ipst->ips_ill_g_heads[index];
3248 		insque(ill_interface, ghead.ill_g_list_tail);
3249 	}
3250 
3251 	if (ill->ill_ppa == UINT_MAX)
3252 		check_length = B_TRUE;
3253 
3254 	error = ill_alloc_ppa(ill_interface, ill);
3255 	if (error != 0) {
3256 		if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
3257 			ill_delete_interface_type(ill->ill_ifptr);
3258 		return (error);
3259 	}
3260 
3261 	/*
3262 	 * When the ppa is choosen by the system, check that there is
3263 	 * enough space to insert ppa. if a specific ppa was passed in this
3264 	 * check is not required as the interface name passed in will have
3265 	 * the right ppa in it.
3266 	 */
3267 	if (check_length) {
3268 		/*
3269 		 * UINT_MAX - 1 should fit in 10 chars, alloc 12 chars.
3270 		 */
3271 		char buf[sizeof (uint_t) * 3];
3272 
3273 		/*
3274 		 * convert ppa to string to calculate the amount of space
3275 		 * required for it in the name.
3276 		 */
3277 		numtos(ill->ill_ppa, buf);
3278 
3279 		/* Do we have enough space to insert ppa ? */
3280 
3281 		if ((mi_strlen(name) + mi_strlen(buf) + 1) > LIFNAMSIZ) {
3282 			/* Free ppa and interface type struct */
3283 			if (ill_interface->illif_ppa_arena != NULL) {
3284 				vmem_free(ill_interface->illif_ppa_arena,
3285 				    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
3286 			}
3287 			if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
3288 				ill_delete_interface_type(ill->ill_ifptr);
3289 
3290 			return (EINVAL);
3291 		}
3292 	}
3293 
3294 	(void) sprintf(ill->ill_name, "%s%u", name, ill->ill_ppa);
3295 	ill->ill_name_length = mi_strlen(ill->ill_name) + 1;
3296 
3297 	(void) avl_find(&ill_interface->illif_avl_by_ppa, &ill->ill_ppa,
3298 	    &where);
3299 	ill->ill_ifptr = ill_interface;
3300 	avl_insert(&ill_interface->illif_avl_by_ppa, ill, where);
3301 
3302 	ill_phyint_reinit(ill);
3303 	return (0);
3304 }
3305 
3306 /* Initialize the per phyint ipsq used for serialization */
3307 static boolean_t
ipsq_init(ill_t * ill,boolean_t enter)3308 ipsq_init(ill_t *ill, boolean_t enter)
3309 {
3310 	ipsq_t  *ipsq;
3311 	ipxop_t	*ipx;
3312 
3313 	if ((ipsq = kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP)) == NULL)
3314 		return (B_FALSE);
3315 
3316 	ill->ill_phyint->phyint_ipsq = ipsq;
3317 	ipx = ipsq->ipsq_xop = &ipsq->ipsq_ownxop;
3318 	ipx->ipx_ipsq = ipsq;
3319 	ipsq->ipsq_next = ipsq;
3320 	ipsq->ipsq_phyint = ill->ill_phyint;
3321 	mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, 0);
3322 	mutex_init(&ipx->ipx_lock, NULL, MUTEX_DEFAULT, 0);
3323 	ipsq->ipsq_ipst = ill->ill_ipst;	/* No netstack_hold */
3324 	if (enter) {
3325 		ipx->ipx_writer = curthread;
3326 		ipx->ipx_forced = B_FALSE;
3327 		ipx->ipx_reentry_cnt = 1;
3328 #ifdef DEBUG
3329 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
3330 #endif
3331 	}
3332 	return (B_TRUE);
3333 }
3334 
3335 /*
3336  * Here we perform initialisation of the ill_t common to both regular
3337  * interface ILLs and the special loopback ILL created by ill_lookup_on_name.
3338  */
3339 static int
ill_init_common(ill_t * ill,queue_t * q,boolean_t isv6,boolean_t is_loopback,boolean_t ipsq_enter)3340 ill_init_common(ill_t *ill, queue_t *q, boolean_t isv6, boolean_t is_loopback,
3341     boolean_t ipsq_enter)
3342 {
3343 	int count;
3344 	uchar_t *frag_ptr;
3345 
3346 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, 0);
3347 	mutex_init(&ill->ill_saved_ire_lock, NULL, MUTEX_DEFAULT, NULL);
3348 	ill->ill_saved_ire_cnt = 0;
3349 
3350 	if (is_loopback) {
3351 		ill->ill_max_frag = isv6 ? ip_loopback_mtu_v6plus :
3352 		    ip_loopback_mtuplus;
3353 		/*
3354 		 * No resolver here.
3355 		 */
3356 		ill->ill_net_type = IRE_LOOPBACK;
3357 	} else {
3358 		ill->ill_rq = q;
3359 		ill->ill_wq = WR(q);
3360 		ill->ill_ppa = UINT_MAX;
3361 	}
3362 
3363 	ill->ill_isv6 = isv6;
3364 
3365 	/*
3366 	 * Allocate sufficient space to contain our fragment hash table and
3367 	 * the device name.
3368 	 */
3369 	frag_ptr = (uchar_t *)mi_zalloc(ILL_FRAG_HASH_TBL_SIZE + 2 * LIFNAMSIZ);
3370 	if (frag_ptr == NULL)
3371 		return (ENOMEM);
3372 	ill->ill_frag_ptr = frag_ptr;
3373 	ill->ill_frag_free_num_pkts = 0;
3374 	ill->ill_last_frag_clean_time = 0;
3375 	ill->ill_frag_hash_tbl = (ipfb_t *)frag_ptr;
3376 	ill->ill_name = (char *)(frag_ptr + ILL_FRAG_HASH_TBL_SIZE);
3377 	for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
3378 		mutex_init(&ill->ill_frag_hash_tbl[count].ipfb_lock,
3379 		    NULL, MUTEX_DEFAULT, NULL);
3380 	}
3381 
3382 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
3383 	if (ill->ill_phyint == NULL) {
3384 		mi_free(frag_ptr);
3385 		return (ENOMEM);
3386 	}
3387 
3388 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
3389 	if (isv6) {
3390 		ill->ill_phyint->phyint_illv6 = ill;
3391 	} else {
3392 		ill->ill_phyint->phyint_illv4 = ill;
3393 	}
3394 	if (is_loopback) {
3395 		phyint_flags_init(ill->ill_phyint, DL_LOOP);
3396 	}
3397 
3398 	list_create(&ill->ill_nce, sizeof (nce_t), offsetof(nce_t, nce_node));
3399 
3400 	ill_set_inputfn(ill);
3401 
3402 	if (!ipsq_init(ill, ipsq_enter)) {
3403 		mi_free(frag_ptr);
3404 		mi_free(ill->ill_phyint);
3405 		return (ENOMEM);
3406 	}
3407 
3408 	/* Frag queue limit stuff */
3409 	ill->ill_frag_count = 0;
3410 	ill->ill_ipf_gen = 0;
3411 
3412 	rw_init(&ill->ill_mcast_lock, NULL, RW_DEFAULT, NULL);
3413 	mutex_init(&ill->ill_mcast_serializer, NULL, MUTEX_DEFAULT, NULL);
3414 	ill->ill_global_timer = INFINITY;
3415 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
3416 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
3417 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
3418 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
3419 
3420 	/*
3421 	 * Initialize IPv6 configuration variables.  The IP module is always
3422 	 * opened as an IPv4 module.  Instead tracking down the cases where
3423 	 * it switches to do ipv6, we'll just initialize the IPv6 configuration
3424 	 * here for convenience, this has no effect until the ill is set to do
3425 	 * IPv6.
3426 	 */
3427 	ill->ill_reachable_time = ND_REACHABLE_TIME;
3428 	ill->ill_xmit_count = ND_MAX_MULTICAST_SOLICIT;
3429 	ill->ill_max_buf = ND_MAX_Q;
3430 	ill->ill_refcnt = 0;
3431 
3432 	return (0);
3433 }
3434 
3435 /*
3436  * ill_init is called by ip_open when a device control stream is opened.
3437  * It does a few initializations, and shoots a DL_INFO_REQ message down
3438  * to the driver.  The response is later picked up in ip_rput_dlpi and
3439  * used to set up default mechanisms for talking to the driver.  (Always
3440  * called as writer.)
3441  *
3442  * If this function returns error, ip_open will call ip_close which in
3443  * turn will call ill_delete to clean up any memory allocated here that
3444  * is not yet freed.
3445  *
3446  * Note: ill_ipst and ill_zoneid must be set before calling ill_init.
3447  */
3448 int
ill_init(queue_t * q,ill_t * ill)3449 ill_init(queue_t *q, ill_t *ill)
3450 {
3451 	int ret;
3452 	dl_info_req_t	*dlir;
3453 	mblk_t	*info_mp;
3454 
3455 	info_mp = allocb(MAX(sizeof (dl_info_req_t), sizeof (dl_info_ack_t)),
3456 	    BPRI_HI);
3457 	if (info_mp == NULL)
3458 		return (ENOMEM);
3459 
3460 	/*
3461 	 * For now pretend this is a v4 ill. We need to set phyint_ill*
3462 	 * at this point because of the following reason. If we can't
3463 	 * enter the ipsq at some point and cv_wait, the writer that
3464 	 * wakes us up tries to locate us using the list of all phyints
3465 	 * in an ipsq and the ills from the phyint thru the phyint_ill*.
3466 	 * If we don't set it now, we risk a missed wakeup.
3467 	 */
3468 	if ((ret = ill_init_common(ill, q, B_FALSE, B_FALSE, B_TRUE)) != 0) {
3469 		freemsg(info_mp);
3470 		return (ret);
3471 	}
3472 
3473 	ill->ill_state_flags |= ILL_LL_SUBNET_PENDING;
3474 
3475 	/* Send down the Info Request to the driver. */
3476 	info_mp->b_datap->db_type = M_PCPROTO;
3477 	dlir = (dl_info_req_t *)info_mp->b_rptr;
3478 	info_mp->b_wptr = (uchar_t *)&dlir[1];
3479 	dlir->dl_primitive = DL_INFO_REQ;
3480 
3481 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
3482 
3483 	qprocson(q);
3484 	ill_dlpi_send(ill, info_mp);
3485 
3486 	return (0);
3487 }
3488 
3489 /*
3490  * ill_dls_info
3491  * creates datalink socket info from the device.
3492  */
3493 int
ill_dls_info(struct sockaddr_dl * sdl,const ill_t * ill)3494 ill_dls_info(struct sockaddr_dl *sdl, const ill_t *ill)
3495 {
3496 	size_t	len;
3497 
3498 	sdl->sdl_family = AF_LINK;
3499 	sdl->sdl_index = ill_get_upper_ifindex(ill);
3500 	sdl->sdl_type = ill->ill_type;
3501 	ill_get_name(ill, sdl->sdl_data, sizeof (sdl->sdl_data));
3502 	len = strlen(sdl->sdl_data);
3503 	ASSERT(len < 256);
3504 	sdl->sdl_nlen = (uchar_t)len;
3505 	sdl->sdl_alen = ill->ill_phys_addr_length;
3506 	sdl->sdl_slen = 0;
3507 	if (ill->ill_phys_addr_length != 0 && ill->ill_phys_addr != NULL)
3508 		bcopy(ill->ill_phys_addr, &sdl->sdl_data[len], sdl->sdl_alen);
3509 
3510 	return (sizeof (struct sockaddr_dl));
3511 }
3512 
3513 /*
3514  * ill_xarp_info
3515  * creates xarp info from the device.
3516  */
3517 static int
ill_xarp_info(struct sockaddr_dl * sdl,ill_t * ill)3518 ill_xarp_info(struct sockaddr_dl *sdl, ill_t *ill)
3519 {
3520 	sdl->sdl_family = AF_LINK;
3521 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
3522 	sdl->sdl_type = ill->ill_type;
3523 	ill_get_name(ill, sdl->sdl_data, sizeof (sdl->sdl_data));
3524 	sdl->sdl_nlen = (uchar_t)mi_strlen(sdl->sdl_data);
3525 	sdl->sdl_alen = ill->ill_phys_addr_length;
3526 	sdl->sdl_slen = 0;
3527 	return (sdl->sdl_nlen);
3528 }
3529 
3530 static int
loopback_kstat_update(kstat_t * ksp,int rw)3531 loopback_kstat_update(kstat_t *ksp, int rw)
3532 {
3533 	kstat_named_t *kn;
3534 	netstackid_t	stackid;
3535 	netstack_t	*ns;
3536 	ip_stack_t	*ipst;
3537 
3538 	if (ksp == NULL || ksp->ks_data == NULL)
3539 		return (EIO);
3540 
3541 	if (rw == KSTAT_WRITE)
3542 		return (EACCES);
3543 
3544 	kn = KSTAT_NAMED_PTR(ksp);
3545 	stackid = (zoneid_t)(uintptr_t)ksp->ks_private;
3546 
3547 	ns = netstack_find_by_stackid(stackid);
3548 	if (ns == NULL)
3549 		return (-1);
3550 
3551 	ipst = ns->netstack_ip;
3552 	if (ipst == NULL) {
3553 		netstack_rele(ns);
3554 		return (-1);
3555 	}
3556 	kn[0].value.ui32 = ipst->ips_loopback_packets;
3557 	kn[1].value.ui32 = ipst->ips_loopback_packets;
3558 	netstack_rele(ns);
3559 	return (0);
3560 }
3561 
3562 /*
3563  * Has ifindex been plumbed already?
3564  */
3565 static boolean_t
phyint_exists(uint_t index,ip_stack_t * ipst)3566 phyint_exists(uint_t index, ip_stack_t *ipst)
3567 {
3568 	ASSERT(index != 0);
3569 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
3570 
3571 	return (avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3572 	    &index, NULL) != NULL);
3573 }
3574 
3575 /*
3576  * Pick a unique ifindex.
3577  * When the index counter passes IF_INDEX_MAX for the first time, the wrap
3578  * flag is set so that next time time ip_assign_ifindex() is called, it
3579  * falls through and resets the index counter back to 1, the minimum value
3580  * for the interface index. The logic below assumes that ips_ill_index
3581  * can hold a value of IF_INDEX_MAX+1 without there being any loss
3582  * (i.e. reset back to 0.)
3583  */
3584 boolean_t
ip_assign_ifindex(uint_t * indexp,ip_stack_t * ipst)3585 ip_assign_ifindex(uint_t *indexp, ip_stack_t *ipst)
3586 {
3587 	uint_t loops;
3588 
3589 	if (!ipst->ips_ill_index_wrap) {
3590 		*indexp = ipst->ips_ill_index++;
3591 		if (ipst->ips_ill_index > IF_INDEX_MAX) {
3592 			/*
3593 			 * Reached the maximum ifindex value, set the wrap
3594 			 * flag to indicate that it is no longer possible
3595 			 * to assume that a given index is unallocated.
3596 			 */
3597 			ipst->ips_ill_index_wrap = B_TRUE;
3598 		}
3599 		return (B_TRUE);
3600 	}
3601 
3602 	if (ipst->ips_ill_index > IF_INDEX_MAX)
3603 		ipst->ips_ill_index = 1;
3604 
3605 	/*
3606 	 * Start reusing unused indexes. Note that we hold the ill_g_lock
3607 	 * at this point and don't want to call any function that attempts
3608 	 * to get the lock again.
3609 	 */
3610 	for (loops = IF_INDEX_MAX; loops > 0; loops--) {
3611 		if (!phyint_exists(ipst->ips_ill_index, ipst)) {
3612 			/* found unused index - use it */
3613 			*indexp = ipst->ips_ill_index;
3614 			return (B_TRUE);
3615 		}
3616 
3617 		ipst->ips_ill_index++;
3618 		if (ipst->ips_ill_index > IF_INDEX_MAX)
3619 			ipst->ips_ill_index = 1;
3620 	}
3621 
3622 	/*
3623 	 * all interface indicies are inuse.
3624 	 */
3625 	return (B_FALSE);
3626 }
3627 
3628 /*
3629  * Assign a unique interface index for the phyint.
3630  */
3631 static boolean_t
phyint_assign_ifindex(phyint_t * phyi,ip_stack_t * ipst)3632 phyint_assign_ifindex(phyint_t *phyi, ip_stack_t *ipst)
3633 {
3634 	ASSERT(phyi->phyint_ifindex == 0);
3635 	return (ip_assign_ifindex(&phyi->phyint_ifindex, ipst));
3636 }
3637 
3638 /*
3639  * Initialize the flags on `phyi' as per the provided mactype.
3640  */
3641 static void
phyint_flags_init(phyint_t * phyi,t_uscalar_t mactype)3642 phyint_flags_init(phyint_t *phyi, t_uscalar_t mactype)
3643 {
3644 	uint64_t flags = 0;
3645 
3646 	/*
3647 	 * Initialize PHYI_RUNNING and PHYI_FAILED.  For non-IPMP interfaces,
3648 	 * we always presume the underlying hardware is working and set
3649 	 * PHYI_RUNNING (if it's not, the driver will subsequently send a
3650 	 * DL_NOTE_LINK_DOWN message).  For IPMP interfaces, at initialization
3651 	 * there are no active interfaces in the group so we set PHYI_FAILED.
3652 	 */
3653 	if (mactype == SUNW_DL_IPMP)
3654 		flags |= PHYI_FAILED;
3655 	else
3656 		flags |= PHYI_RUNNING;
3657 
3658 	switch (mactype) {
3659 	case SUNW_DL_VNI:
3660 		flags |= PHYI_VIRTUAL;
3661 		break;
3662 	case SUNW_DL_IPMP:
3663 		flags |= PHYI_IPMP;
3664 		break;
3665 	case DL_LOOP:
3666 		flags |= (PHYI_LOOPBACK | PHYI_VIRTUAL);
3667 		break;
3668 	}
3669 
3670 	mutex_enter(&phyi->phyint_lock);
3671 	phyi->phyint_flags |= flags;
3672 	mutex_exit(&phyi->phyint_lock);
3673 }
3674 
3675 /*
3676  * Return a pointer to the ill which matches the supplied name.  Note that
3677  * the ill name length includes the null termination character.  (May be
3678  * called as writer.)
3679  * If do_alloc and the interface is "lo0" it will be automatically created.
3680  * Cannot bump up reference on condemned ills. So dup detect can't be done
3681  * using this func.
3682  */
3683 ill_t *
ill_lookup_on_name(char * name,boolean_t do_alloc,boolean_t isv6,boolean_t * did_alloc,ip_stack_t * ipst)3684 ill_lookup_on_name(char *name, boolean_t do_alloc, boolean_t isv6,
3685     boolean_t *did_alloc, ip_stack_t *ipst)
3686 {
3687 	ill_t	*ill;
3688 	ipif_t	*ipif;
3689 	ipsq_t	*ipsq;
3690 	kstat_named_t	*kn;
3691 	boolean_t isloopback;
3692 	in6_addr_t ov6addr;
3693 
3694 	isloopback = mi_strcmp(name, ipif_loopback_name) == 0;
3695 
3696 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3697 	ill = ill_find_by_name(name, isv6, ipst);
3698 	rw_exit(&ipst->ips_ill_g_lock);
3699 	if (ill != NULL)
3700 		return (ill);
3701 
3702 	/*
3703 	 * Couldn't find it.  Does this happen to be a lookup for the
3704 	 * loopback device and are we allowed to allocate it?
3705 	 */
3706 	if (!isloopback || !do_alloc)
3707 		return (NULL);
3708 
3709 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
3710 	ill = ill_find_by_name(name, isv6, ipst);
3711 	if (ill != NULL) {
3712 		rw_exit(&ipst->ips_ill_g_lock);
3713 		return (ill);
3714 	}
3715 
3716 	/* Create the loopback device on demand */
3717 	ill = (ill_t *)(mi_alloc(sizeof (ill_t) +
3718 	    sizeof (ipif_loopback_name), BPRI_MED));
3719 	if (ill == NULL)
3720 		goto done;
3721 
3722 	bzero(ill, sizeof (*ill));
3723 	ill->ill_ipst = ipst;
3724 	netstack_hold(ipst->ips_netstack);
3725 	/*
3726 	 * For exclusive stacks we set the zoneid to zero
3727 	 * to make IP operate as if in the global zone.
3728 	 */
3729 	ill->ill_zoneid = GLOBAL_ZONEID;
3730 
3731 	if (ill_init_common(ill, NULL, isv6, B_TRUE, B_FALSE) != 0)
3732 		goto done;
3733 
3734 	if (!ill_allocate_mibs(ill))
3735 		goto done;
3736 
3737 	ill->ill_current_frag = ill->ill_max_frag;
3738 	ill->ill_mtu = ill->ill_max_frag;	/* Initial value */
3739 	ill->ill_mc_mtu = ill->ill_mtu;
3740 	/*
3741 	 * ipif_loopback_name can't be pointed at directly because its used
3742 	 * by both the ipv4 and ipv6 interfaces.  When the ill is removed
3743 	 * from the glist, ill_glist_delete() sets the first character of
3744 	 * ill_name to '\0'.
3745 	 */
3746 	ill->ill_name = (char *)ill + sizeof (*ill);
3747 	(void) strcpy(ill->ill_name, ipif_loopback_name);
3748 	ill->ill_name_length = sizeof (ipif_loopback_name);
3749 	/* Set ill_dlpi_pending for ipsq_current_finish() to work properly */
3750 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
3751 
3752 	ipif = ipif_allocate(ill, 0L, IRE_LOOPBACK, B_TRUE, B_TRUE, NULL);
3753 	if (ipif == NULL)
3754 		goto done;
3755 
3756 	ill->ill_flags = ILLF_MULTICAST;
3757 
3758 	ov6addr = ipif->ipif_v6lcl_addr;
3759 	/* Set up default loopback address and mask. */
3760 	if (!isv6) {
3761 		ipaddr_t inaddr_loopback = htonl(INADDR_LOOPBACK);
3762 
3763 		IN6_IPADDR_TO_V4MAPPED(inaddr_loopback, &ipif->ipif_v6lcl_addr);
3764 		V4MASK_TO_V6(htonl(IN_CLASSA_NET), ipif->ipif_v6net_mask);
3765 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
3766 		    ipif->ipif_v6subnet);
3767 		ill->ill_flags |= ILLF_IPV4;
3768 	} else {
3769 		ipif->ipif_v6lcl_addr = ipv6_loopback;
3770 		ipif->ipif_v6net_mask = ipv6_all_ones;
3771 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
3772 		    ipif->ipif_v6subnet);
3773 		ill->ill_flags |= ILLF_IPV6;
3774 	}
3775 
3776 	/*
3777 	 * Chain us in at the end of the ill list. hold the ill
3778 	 * before we make it globally visible. 1 for the lookup.
3779 	 */
3780 	ill_refhold(ill);
3781 
3782 	ipsq = ill->ill_phyint->phyint_ipsq;
3783 
3784 	if (ill_glist_insert(ill, "lo", isv6) != 0)
3785 		cmn_err(CE_PANIC, "cannot insert loopback interface");
3786 
3787 	/* Let SCTP know so that it can add this to its list */
3788 	sctp_update_ill(ill, SCTP_ILL_INSERT);
3789 
3790 	/*
3791 	 * We have already assigned ipif_v6lcl_addr above, but we need to
3792 	 * call sctp_update_ipif_addr() after SCTP_ILL_INSERT, which
3793 	 * requires to be after ill_glist_insert() since we need the
3794 	 * ill_index set. Pass on ipv6_loopback as the old address.
3795 	 */
3796 	sctp_update_ipif_addr(ipif, ov6addr);
3797 
3798 	ip_rts_newaddrmsg(RTM_CHGADDR, 0, ipif, RTSQ_DEFAULT);
3799 
3800 	/*
3801 	 * ill_glist_insert() -> ill_phyint_reinit() may have merged IPSQs.
3802 	 * If so, free our original one.
3803 	 */
3804 	if (ipsq != ill->ill_phyint->phyint_ipsq)
3805 		ipsq_delete(ipsq);
3806 
3807 	if (ipst->ips_loopback_ksp == NULL) {
3808 		/* Export loopback interface statistics */
3809 		ipst->ips_loopback_ksp = kstat_create_netstack("lo", 0,
3810 		    ipif_loopback_name, "net",
3811 		    KSTAT_TYPE_NAMED, 2, 0,
3812 		    ipst->ips_netstack->netstack_stackid);
3813 		if (ipst->ips_loopback_ksp != NULL) {
3814 			ipst->ips_loopback_ksp->ks_update =
3815 			    loopback_kstat_update;
3816 			kn = KSTAT_NAMED_PTR(ipst->ips_loopback_ksp);
3817 			kstat_named_init(&kn[0], "ipackets", KSTAT_DATA_UINT32);
3818 			kstat_named_init(&kn[1], "opackets", KSTAT_DATA_UINT32);
3819 			ipst->ips_loopback_ksp->ks_private =
3820 			    (void *)(uintptr_t)ipst->ips_netstack->
3821 			    netstack_stackid;
3822 			kstat_install(ipst->ips_loopback_ksp);
3823 		}
3824 	}
3825 
3826 	*did_alloc = B_TRUE;
3827 	rw_exit(&ipst->ips_ill_g_lock);
3828 	ill_nic_event_dispatch(ill, MAP_IPIF_ID(ill->ill_ipif->ipif_id),
3829 	    NE_PLUMB, ill->ill_name, ill->ill_name_length);
3830 	return (ill);
3831 done:
3832 	if (ill != NULL) {
3833 		if (ill->ill_phyint != NULL) {
3834 			ipsq = ill->ill_phyint->phyint_ipsq;
3835 			if (ipsq != NULL) {
3836 				ipsq->ipsq_phyint = NULL;
3837 				ipsq_delete(ipsq);
3838 			}
3839 			mi_free(ill->ill_phyint);
3840 		}
3841 		ill_free_mib(ill);
3842 		if (ill->ill_ipst != NULL)
3843 			netstack_rele(ill->ill_ipst->ips_netstack);
3844 		mi_free(ill);
3845 	}
3846 	rw_exit(&ipst->ips_ill_g_lock);
3847 	return (NULL);
3848 }
3849 
3850 /*
3851  * For IPP calls - use the ip_stack_t for global stack.
3852  */
3853 ill_t *
ill_lookup_on_ifindex_global_instance(uint_t index,boolean_t isv6)3854 ill_lookup_on_ifindex_global_instance(uint_t index, boolean_t isv6)
3855 {
3856 	ip_stack_t	*ipst;
3857 	ill_t		*ill;
3858 
3859 	ipst = netstack_find_by_stackid(GLOBAL_NETSTACKID)->netstack_ip;
3860 	if (ipst == NULL) {
3861 		cmn_err(CE_WARN, "No ip_stack_t for zoneid zero!\n");
3862 		return (NULL);
3863 	}
3864 
3865 	ill = ill_lookup_on_ifindex(index, isv6, ipst);
3866 	netstack_rele(ipst->ips_netstack);
3867 	return (ill);
3868 }
3869 
3870 /*
3871  * Return a pointer to the ill which matches the index and IP version type.
3872  */
3873 ill_t *
ill_lookup_on_ifindex(uint_t index,boolean_t isv6,ip_stack_t * ipst)3874 ill_lookup_on_ifindex(uint_t index, boolean_t isv6, ip_stack_t *ipst)
3875 {
3876 	ill_t	*ill;
3877 	phyint_t *phyi;
3878 
3879 	/*
3880 	 * Indexes are stored in the phyint - a common structure
3881 	 * to both IPv4 and IPv6.
3882 	 */
3883 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3884 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3885 	    (void *) &index, NULL);
3886 	if (phyi != NULL) {
3887 		ill = isv6 ? phyi->phyint_illv6: phyi->phyint_illv4;
3888 		if (ill != NULL) {
3889 			mutex_enter(&ill->ill_lock);
3890 			if (!ILL_IS_CONDEMNED(ill)) {
3891 				ill_refhold_locked(ill);
3892 				mutex_exit(&ill->ill_lock);
3893 				rw_exit(&ipst->ips_ill_g_lock);
3894 				return (ill);
3895 			}
3896 			mutex_exit(&ill->ill_lock);
3897 		}
3898 	}
3899 	rw_exit(&ipst->ips_ill_g_lock);
3900 	return (NULL);
3901 }
3902 
3903 /*
3904  * Verify whether or not an interface index is valid for the specified zoneid
3905  * to transmit packets.
3906  * It can be zero (meaning "reset") or an interface index assigned
3907  * to a non-VNI interface. (We don't use VNI interface to send packets.)
3908  */
3909 boolean_t
ip_xmit_ifindex_valid(uint_t ifindex,zoneid_t zoneid,boolean_t isv6,ip_stack_t * ipst)3910 ip_xmit_ifindex_valid(uint_t ifindex, zoneid_t zoneid, boolean_t isv6,
3911     ip_stack_t *ipst)
3912 {
3913 	ill_t		*ill;
3914 
3915 	if (ifindex == 0)
3916 		return (B_TRUE);
3917 
3918 	ill = ill_lookup_on_ifindex_zoneid(ifindex, zoneid, isv6, ipst);
3919 	if (ill == NULL)
3920 		return (B_FALSE);
3921 	if (IS_VNI(ill)) {
3922 		ill_refrele(ill);
3923 		return (B_FALSE);
3924 	}
3925 	ill_refrele(ill);
3926 	return (B_TRUE);
3927 }
3928 
3929 /*
3930  * Return the ifindex next in sequence after the passed in ifindex.
3931  * If there is no next ifindex for the given protocol, return 0.
3932  */
3933 uint_t
ill_get_next_ifindex(uint_t index,boolean_t isv6,ip_stack_t * ipst)3934 ill_get_next_ifindex(uint_t index, boolean_t isv6, ip_stack_t *ipst)
3935 {
3936 	phyint_t *phyi;
3937 	phyint_t *phyi_initial;
3938 	uint_t   ifindex;
3939 
3940 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3941 
3942 	if (index == 0) {
3943 		phyi = avl_first(
3944 		    &ipst->ips_phyint_g_list->phyint_list_avl_by_index);
3945 	} else {
3946 		phyi = phyi_initial = avl_find(
3947 		    &ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3948 		    (void *) &index, NULL);
3949 	}
3950 
3951 	for (; phyi != NULL;
3952 	    phyi = avl_walk(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3953 	    phyi, AVL_AFTER)) {
3954 		/*
3955 		 * If we're not returning the first interface in the tree
3956 		 * and we still haven't moved past the phyint_t that
3957 		 * corresponds to index, avl_walk needs to be called again
3958 		 */
3959 		if (!((index != 0) && (phyi == phyi_initial))) {
3960 			if (isv6) {
3961 				if ((phyi->phyint_illv6) &&
3962 				    ILL_CAN_LOOKUP(phyi->phyint_illv6) &&
3963 				    (phyi->phyint_illv6->ill_isv6 == 1))
3964 					break;
3965 			} else {
3966 				if ((phyi->phyint_illv4) &&
3967 				    ILL_CAN_LOOKUP(phyi->phyint_illv4) &&
3968 				    (phyi->phyint_illv4->ill_isv6 == 0))
3969 					break;
3970 			}
3971 		}
3972 	}
3973 
3974 	rw_exit(&ipst->ips_ill_g_lock);
3975 
3976 	if (phyi != NULL)
3977 		ifindex = phyi->phyint_ifindex;
3978 	else
3979 		ifindex = 0;
3980 
3981 	return (ifindex);
3982 }
3983 
3984 /*
3985  * Return the ifindex for the named interface.
3986  * If there is no next ifindex for the interface, return 0.
3987  */
3988 uint_t
ill_get_ifindex_by_name(char * name,ip_stack_t * ipst)3989 ill_get_ifindex_by_name(char *name, ip_stack_t *ipst)
3990 {
3991 	phyint_t	*phyi;
3992 	avl_index_t	where = 0;
3993 	uint_t		ifindex;
3994 
3995 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3996 
3997 	if ((phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
3998 	    name, &where)) == NULL) {
3999 		rw_exit(&ipst->ips_ill_g_lock);
4000 		return (0);
4001 	}
4002 
4003 	ifindex = phyi->phyint_ifindex;
4004 
4005 	rw_exit(&ipst->ips_ill_g_lock);
4006 
4007 	return (ifindex);
4008 }
4009 
4010 /*
4011  * Return the ifindex to be used by upper layer protocols for instance
4012  * for IPV6_RECVPKTINFO. If IPMP this is the one for the upper ill.
4013  */
4014 uint_t
ill_get_upper_ifindex(const ill_t * ill)4015 ill_get_upper_ifindex(const ill_t *ill)
4016 {
4017 	if (IS_UNDER_IPMP(ill))
4018 		return (ipmp_ill_get_ipmp_ifindex(ill));
4019 	else
4020 		return (ill->ill_phyint->phyint_ifindex);
4021 }
4022 
4023 
4024 /*
4025  * Obtain a reference to the ill. The ill_refcnt is a dynamic refcnt
4026  * that gives a running thread a reference to the ill. This reference must be
4027  * released by the thread when it is done accessing the ill and related
4028  * objects. ill_refcnt can not be used to account for static references
4029  * such as other structures pointing to an ill. Callers must generally
4030  * check whether an ill can be refheld by using ILL_CAN_LOOKUP macros
4031  * or be sure that the ill is not being deleted or changing state before
4032  * calling the refhold functions. A non-zero ill_refcnt ensures that the
4033  * ill won't change any of its critical state such as address, netmask etc.
4034  */
4035 void
ill_refhold(ill_t * ill)4036 ill_refhold(ill_t *ill)
4037 {
4038 	mutex_enter(&ill->ill_lock);
4039 	ill->ill_refcnt++;
4040 	ILL_TRACE_REF(ill);
4041 	mutex_exit(&ill->ill_lock);
4042 }
4043 
4044 void
ill_refhold_locked(ill_t * ill)4045 ill_refhold_locked(ill_t *ill)
4046 {
4047 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4048 	ill->ill_refcnt++;
4049 	ILL_TRACE_REF(ill);
4050 }
4051 
4052 /* Returns true if we managed to get a refhold */
4053 boolean_t
ill_check_and_refhold(ill_t * ill)4054 ill_check_and_refhold(ill_t *ill)
4055 {
4056 	mutex_enter(&ill->ill_lock);
4057 	if (!ILL_IS_CONDEMNED(ill)) {
4058 		ill_refhold_locked(ill);
4059 		mutex_exit(&ill->ill_lock);
4060 		return (B_TRUE);
4061 	}
4062 	mutex_exit(&ill->ill_lock);
4063 	return (B_FALSE);
4064 }
4065 
4066 /*
4067  * Must not be called while holding any locks. Otherwise if this is
4068  * the last reference to be released, there is a chance of recursive mutex
4069  * panic due to ill_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
4070  * to restart an ioctl.
4071  */
4072 void
ill_refrele(ill_t * ill)4073 ill_refrele(ill_t *ill)
4074 {
4075 	mutex_enter(&ill->ill_lock);
4076 	ASSERT(ill->ill_refcnt != 0);
4077 	ill->ill_refcnt--;
4078 	ILL_UNTRACE_REF(ill);
4079 	if (ill->ill_refcnt != 0) {
4080 		/* Every ire pointing to the ill adds 1 to ill_refcnt */
4081 		mutex_exit(&ill->ill_lock);
4082 		return;
4083 	}
4084 
4085 	/* Drops the ill_lock */
4086 	ipif_ill_refrele_tail(ill);
4087 }
4088 
4089 /*
4090  * Obtain a weak reference count on the ill. This reference ensures the
4091  * ill won't be freed, but the ill may change any of its critical state
4092  * such as netmask, address etc. Returns an error if the ill has started
4093  * closing.
4094  */
4095 boolean_t
ill_waiter_inc(ill_t * ill)4096 ill_waiter_inc(ill_t *ill)
4097 {
4098 	mutex_enter(&ill->ill_lock);
4099 	if (ill->ill_state_flags & ILL_CONDEMNED) {
4100 		mutex_exit(&ill->ill_lock);
4101 		return (B_FALSE);
4102 	}
4103 	ill->ill_waiters++;
4104 	mutex_exit(&ill->ill_lock);
4105 	return (B_TRUE);
4106 }
4107 
4108 void
ill_waiter_dcr(ill_t * ill)4109 ill_waiter_dcr(ill_t *ill)
4110 {
4111 	mutex_enter(&ill->ill_lock);
4112 	ill->ill_waiters--;
4113 	if (ill->ill_waiters == 0)
4114 		cv_broadcast(&ill->ill_cv);
4115 	mutex_exit(&ill->ill_lock);
4116 }
4117 
4118 /*
4119  * ip_ll_subnet_defaults is called when we get the DL_INFO_ACK back from the
4120  * driver.  We construct best guess defaults for lower level information that
4121  * we need.  If an interface is brought up without injection of any overriding
4122  * information from outside, we have to be ready to go with these defaults.
4123  * When we get the first DL_INFO_ACK (from ip_open() sending a DL_INFO_REQ)
4124  * we primarely want the dl_provider_style.
4125  * The subsequent DL_INFO_ACK is received after doing a DL_ATTACH and DL_BIND
4126  * at which point we assume the other part of the information is valid.
4127  */
4128 void
ip_ll_subnet_defaults(ill_t * ill,mblk_t * mp)4129 ip_ll_subnet_defaults(ill_t *ill, mblk_t *mp)
4130 {
4131 	uchar_t		*brdcst_addr;
4132 	uint_t		brdcst_addr_length, phys_addr_length;
4133 	t_scalar_t	sap_length;
4134 	dl_info_ack_t	*dlia;
4135 	ip_m_t		*ipm;
4136 	dl_qos_cl_sel1_t *sel1;
4137 	int		min_mtu;
4138 
4139 	ASSERT(IAM_WRITER_ILL(ill));
4140 
4141 	/*
4142 	 * Till the ill is fully up  the ill is not globally visible.
4143 	 * So no need for a lock.
4144 	 */
4145 	dlia = (dl_info_ack_t *)mp->b_rptr;
4146 	ill->ill_mactype = dlia->dl_mac_type;
4147 
4148 	ipm = ip_m_lookup(dlia->dl_mac_type);
4149 	if (ipm == NULL) {
4150 		ipm = ip_m_lookup(DL_OTHER);
4151 		ASSERT(ipm != NULL);
4152 	}
4153 	ill->ill_media = ipm;
4154 
4155 	/*
4156 	 * When the new DLPI stuff is ready we'll pull lengths
4157 	 * from dlia.
4158 	 */
4159 	if (dlia->dl_version == DL_VERSION_2) {
4160 		brdcst_addr_length = dlia->dl_brdcst_addr_length;
4161 		brdcst_addr = mi_offset_param(mp, dlia->dl_brdcst_addr_offset,
4162 		    brdcst_addr_length);
4163 		if (brdcst_addr == NULL) {
4164 			brdcst_addr_length = 0;
4165 		}
4166 		sap_length = dlia->dl_sap_length;
4167 		phys_addr_length = dlia->dl_addr_length - ABS(sap_length);
4168 		ip1dbg(("ip: bcast_len %d, sap_len %d, phys_len %d\n",
4169 		    brdcst_addr_length, sap_length, phys_addr_length));
4170 	} else {
4171 		brdcst_addr_length = 6;
4172 		brdcst_addr = ip_six_byte_all_ones;
4173 		sap_length = -2;
4174 		phys_addr_length = brdcst_addr_length;
4175 	}
4176 
4177 	ill->ill_bcast_addr_length = brdcst_addr_length;
4178 	ill->ill_phys_addr_length = phys_addr_length;
4179 	ill->ill_sap_length = sap_length;
4180 
4181 	/*
4182 	 * Synthetic DLPI types such as SUNW_DL_IPMP specify a zero SDU,
4183 	 * but we must ensure a minimum IP MTU is used since other bits of
4184 	 * IP will fly apart otherwise.
4185 	 */
4186 	min_mtu = ill->ill_isv6 ? IPV6_MIN_MTU : IP_MIN_MTU;
4187 	ill->ill_max_frag = MAX(min_mtu, dlia->dl_max_sdu);
4188 	ill->ill_current_frag = ill->ill_max_frag;
4189 	ill->ill_mtu = ill->ill_max_frag;
4190 	ill->ill_mc_mtu = ill->ill_mtu;	/* Overridden by DL_NOTE_SDU_SIZE2 */
4191 
4192 	ill->ill_type = ipm->ip_m_type;
4193 
4194 	if (!ill->ill_dlpi_style_set) {
4195 		if (dlia->dl_provider_style == DL_STYLE2)
4196 			ill->ill_needs_attach = 1;
4197 
4198 		phyint_flags_init(ill->ill_phyint, ill->ill_mactype);
4199 
4200 		/*
4201 		 * Allocate the first ipif on this ill.  We don't delay it
4202 		 * further as ioctl handling assumes at least one ipif exists.
4203 		 *
4204 		 * At this point we don't know whether the ill is v4 or v6.
4205 		 * We will know this whan the SIOCSLIFNAME happens and
4206 		 * the correct value for ill_isv6 will be assigned in
4207 		 * ipif_set_values(). We need to hold the ill lock and
4208 		 * clear the ILL_LL_SUBNET_PENDING flag and atomically do
4209 		 * the wakeup.
4210 		 */
4211 		(void) ipif_allocate(ill, 0, IRE_LOCAL,
4212 		    dlia->dl_provider_style != DL_STYLE2, B_TRUE, NULL);
4213 		mutex_enter(&ill->ill_lock);
4214 		ASSERT(ill->ill_dlpi_style_set == 0);
4215 		ill->ill_dlpi_style_set = 1;
4216 		ill->ill_state_flags &= ~ILL_LL_SUBNET_PENDING;
4217 		cv_broadcast(&ill->ill_cv);
4218 		mutex_exit(&ill->ill_lock);
4219 		freemsg(mp);
4220 		return;
4221 	}
4222 	ASSERT(ill->ill_ipif != NULL);
4223 	/*
4224 	 * We know whether it is IPv4 or IPv6 now, as this is the
4225 	 * second DL_INFO_ACK we are recieving in response to the
4226 	 * DL_INFO_REQ sent in ipif_set_values.
4227 	 */
4228 	ill->ill_sap = (ill->ill_isv6) ? ipm->ip_m_ipv6sap : ipm->ip_m_ipv4sap;
4229 	/*
4230 	 * Clear all the flags that were set based on ill_bcast_addr_length
4231 	 * and ill_phys_addr_length (in ipif_set_values) as these could have
4232 	 * changed now and we need to re-evaluate.
4233 	 */
4234 	ill->ill_flags &= ~(ILLF_MULTICAST | ILLF_NONUD | ILLF_NOARP);
4235 	ill->ill_ipif->ipif_flags &= ~(IPIF_BROADCAST | IPIF_POINTOPOINT);
4236 
4237 	/*
4238 	 * Free ill_bcast_mp as things could have changed now.
4239 	 *
4240 	 * NOTE: The IPMP meta-interface is special-cased because it starts
4241 	 * with no underlying interfaces (and thus an unknown broadcast
4242 	 * address length), but we enforce that an interface is broadcast-
4243 	 * capable as part of allowing it to join a group.
4244 	 */
4245 	if (ill->ill_bcast_addr_length == 0 && !IS_IPMP(ill)) {
4246 		if (ill->ill_bcast_mp != NULL)
4247 			freemsg(ill->ill_bcast_mp);
4248 		ill->ill_net_type = IRE_IF_NORESOLVER;
4249 
4250 		ill->ill_bcast_mp = ill_dlur_gen(NULL,
4251 		    ill->ill_phys_addr_length,
4252 		    ill->ill_sap,
4253 		    ill->ill_sap_length);
4254 
4255 		if (ill->ill_isv6)
4256 			/*
4257 			 * Note: xresolv interfaces will eventually need NOARP
4258 			 * set here as well, but that will require those
4259 			 * external resolvers to have some knowledge of
4260 			 * that flag and act appropriately. Not to be changed
4261 			 * at present.
4262 			 */
4263 			ill->ill_flags |= ILLF_NONUD;
4264 		else
4265 			ill->ill_flags |= ILLF_NOARP;
4266 
4267 		if (ill->ill_mactype == SUNW_DL_VNI) {
4268 			ill->ill_ipif->ipif_flags |= IPIF_NOXMIT;
4269 		} else if (ill->ill_phys_addr_length == 0 ||
4270 		    ill->ill_mactype == DL_IPV4 ||
4271 		    ill->ill_mactype == DL_IPV6) {
4272 			/*
4273 			 * The underying link is point-to-point, so mark the
4274 			 * interface as such.  We can do IP multicast over
4275 			 * such a link since it transmits all network-layer
4276 			 * packets to the remote side the same way.
4277 			 */
4278 			ill->ill_flags |= ILLF_MULTICAST;
4279 			ill->ill_ipif->ipif_flags |= IPIF_POINTOPOINT;
4280 		}
4281 	} else {
4282 		ill->ill_net_type = IRE_IF_RESOLVER;
4283 		if (ill->ill_bcast_mp != NULL)
4284 			freemsg(ill->ill_bcast_mp);
4285 		ill->ill_bcast_mp = ill_dlur_gen(brdcst_addr,
4286 		    ill->ill_bcast_addr_length, ill->ill_sap,
4287 		    ill->ill_sap_length);
4288 		/*
4289 		 * Later detect lack of DLPI driver multicast
4290 		 * capability by catching DL_ENABMULTI errors in
4291 		 * ip_rput_dlpi.
4292 		 */
4293 		ill->ill_flags |= ILLF_MULTICAST;
4294 		if (!ill->ill_isv6)
4295 			ill->ill_ipif->ipif_flags |= IPIF_BROADCAST;
4296 	}
4297 
4298 	/* For IPMP, PHYI_IPMP should already be set by phyint_flags_init() */
4299 	if (ill->ill_mactype == SUNW_DL_IPMP)
4300 		ASSERT(ill->ill_phyint->phyint_flags & PHYI_IPMP);
4301 
4302 	/* By default an interface does not support any CoS marking */
4303 	ill->ill_flags &= ~ILLF_COS_ENABLED;
4304 
4305 	/*
4306 	 * If we get QoS information in DL_INFO_ACK, the device supports
4307 	 * some form of CoS marking, set ILLF_COS_ENABLED.
4308 	 */
4309 	sel1 = (dl_qos_cl_sel1_t *)mi_offset_param(mp, dlia->dl_qos_offset,
4310 	    dlia->dl_qos_length);
4311 	if ((sel1 != NULL) && (sel1->dl_qos_type == DL_QOS_CL_SEL1)) {
4312 		ill->ill_flags |= ILLF_COS_ENABLED;
4313 	}
4314 
4315 	/* Clear any previous error indication. */
4316 	ill->ill_error = 0;
4317 	freemsg(mp);
4318 }
4319 
4320 /*
4321  * Perform various checks to verify that an address would make sense as a
4322  * local, remote, or subnet interface address.
4323  */
4324 static boolean_t
ip_addr_ok_v4(ipaddr_t addr,ipaddr_t subnet_mask)4325 ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask)
4326 {
4327 	ipaddr_t	net_mask;
4328 
4329 	/*
4330 	 * Don't allow all zeroes, or all ones, but allow
4331 	 * all ones netmask.
4332 	 */
4333 	if ((net_mask = ip_net_mask(addr)) == 0)
4334 		return (B_FALSE);
4335 	/* A given netmask overrides the "guess" netmask */
4336 	if (subnet_mask != 0)
4337 		net_mask = subnet_mask;
4338 	if ((net_mask != ~(ipaddr_t)0) && ((addr == (addr & net_mask)) ||
4339 	    (addr == (addr | ~net_mask)))) {
4340 		return (B_FALSE);
4341 	}
4342 
4343 	/*
4344 	 * Even if the netmask is all ones, we do not allow address to be
4345 	 * 255.255.255.255
4346 	 */
4347 	if (addr == INADDR_BROADCAST)
4348 		return (B_FALSE);
4349 
4350 	if (CLASSD(addr))
4351 		return (B_FALSE);
4352 
4353 	return (B_TRUE);
4354 }
4355 
4356 #define	V6_IPIF_LINKLOCAL(p)	\
4357 	IN6_IS_ADDR_LINKLOCAL(&(p)->ipif_v6lcl_addr)
4358 
4359 /*
4360  * Compare two given ipifs and check if the second one is better than
4361  * the first one using the order of preference (not taking deprecated
4362  * into acount) specified in ipif_lookup_multicast().
4363  */
4364 static boolean_t
ipif_comp_multi(ipif_t * old_ipif,ipif_t * new_ipif,boolean_t isv6)4365 ipif_comp_multi(ipif_t *old_ipif, ipif_t *new_ipif, boolean_t isv6)
4366 {
4367 	/* Check the least preferred first. */
4368 	if (IS_LOOPBACK(old_ipif->ipif_ill)) {
4369 		/* If both ipifs are the same, use the first one. */
4370 		if (IS_LOOPBACK(new_ipif->ipif_ill))
4371 			return (B_FALSE);
4372 		else
4373 			return (B_TRUE);
4374 	}
4375 
4376 	/* For IPv6, check for link local address. */
4377 	if (isv6 && V6_IPIF_LINKLOCAL(old_ipif)) {
4378 		if (IS_LOOPBACK(new_ipif->ipif_ill) ||
4379 		    V6_IPIF_LINKLOCAL(new_ipif)) {
4380 			/* The second one is equal or less preferred. */
4381 			return (B_FALSE);
4382 		} else {
4383 			return (B_TRUE);
4384 		}
4385 	}
4386 
4387 	/* Then check for point to point interface. */
4388 	if (old_ipif->ipif_flags & IPIF_POINTOPOINT) {
4389 		if (IS_LOOPBACK(new_ipif->ipif_ill) ||
4390 		    (isv6 && V6_IPIF_LINKLOCAL(new_ipif)) ||
4391 		    (new_ipif->ipif_flags & IPIF_POINTOPOINT)) {
4392 			return (B_FALSE);
4393 		} else {
4394 			return (B_TRUE);
4395 		}
4396 	}
4397 
4398 	/* old_ipif is a normal interface, so no need to use the new one. */
4399 	return (B_FALSE);
4400 }
4401 
4402 /*
4403  * Find a mulitcast-capable ipif given an IP instance and zoneid.
4404  * The ipif must be up, and its ill must multicast-capable, not
4405  * condemned, not an underlying interface in an IPMP group, and
4406  * not a VNI interface.  Order of preference:
4407  *
4408  * 	1a. normal
4409  * 	1b. normal, but deprecated
4410  * 	2a. point to point
4411  * 	2b. point to point, but deprecated
4412  * 	3a. link local
4413  * 	3b. link local, but deprecated
4414  * 	4. loopback.
4415  */
4416 static ipif_t *
ipif_lookup_multicast(ip_stack_t * ipst,zoneid_t zoneid,boolean_t isv6)4417 ipif_lookup_multicast(ip_stack_t *ipst, zoneid_t zoneid, boolean_t isv6)
4418 {
4419 	ill_t			*ill;
4420 	ill_walk_context_t	ctx;
4421 	ipif_t			*ipif;
4422 	ipif_t			*saved_ipif = NULL;
4423 	ipif_t			*dep_ipif = NULL;
4424 
4425 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4426 	if (isv6)
4427 		ill = ILL_START_WALK_V6(&ctx, ipst);
4428 	else
4429 		ill = ILL_START_WALK_V4(&ctx, ipst);
4430 
4431 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4432 		mutex_enter(&ill->ill_lock);
4433 		if (IS_VNI(ill) || IS_UNDER_IPMP(ill) ||
4434 		    ILL_IS_CONDEMNED(ill) ||
4435 		    !(ill->ill_flags & ILLF_MULTICAST)) {
4436 			mutex_exit(&ill->ill_lock);
4437 			continue;
4438 		}
4439 		for (ipif = ill->ill_ipif; ipif != NULL;
4440 		    ipif = ipif->ipif_next) {
4441 			if (zoneid != ipif->ipif_zoneid &&
4442 			    zoneid != ALL_ZONES &&
4443 			    ipif->ipif_zoneid != ALL_ZONES) {
4444 				continue;
4445 			}
4446 			if (!(ipif->ipif_flags & IPIF_UP) ||
4447 			    IPIF_IS_CONDEMNED(ipif)) {
4448 				continue;
4449 			}
4450 
4451 			/*
4452 			 * Found one candidate.  If it is deprecated,
4453 			 * remember it in dep_ipif.  If it is not deprecated,
4454 			 * remember it in saved_ipif.
4455 			 */
4456 			if (ipif->ipif_flags & IPIF_DEPRECATED) {
4457 				if (dep_ipif == NULL) {
4458 					dep_ipif = ipif;
4459 				} else if (ipif_comp_multi(dep_ipif, ipif,
4460 				    isv6)) {
4461 					/*
4462 					 * If the previous dep_ipif does not
4463 					 * belong to the same ill, we've done
4464 					 * a ipif_refhold() on it.  So we need
4465 					 * to release it.
4466 					 */
4467 					if (dep_ipif->ipif_ill != ill)
4468 						ipif_refrele(dep_ipif);
4469 					dep_ipif = ipif;
4470 				}
4471 				continue;
4472 			}
4473 			if (saved_ipif == NULL) {
4474 				saved_ipif = ipif;
4475 			} else {
4476 				if (ipif_comp_multi(saved_ipif, ipif, isv6)) {
4477 					if (saved_ipif->ipif_ill != ill)
4478 						ipif_refrele(saved_ipif);
4479 					saved_ipif = ipif;
4480 				}
4481 			}
4482 		}
4483 		/*
4484 		 * Before going to the next ill, do a ipif_refhold() on the
4485 		 * saved ones.
4486 		 */
4487 		if (saved_ipif != NULL && saved_ipif->ipif_ill == ill)
4488 			ipif_refhold_locked(saved_ipif);
4489 		if (dep_ipif != NULL && dep_ipif->ipif_ill == ill)
4490 			ipif_refhold_locked(dep_ipif);
4491 		mutex_exit(&ill->ill_lock);
4492 	}
4493 	rw_exit(&ipst->ips_ill_g_lock);
4494 
4495 	/*
4496 	 * If we have only the saved_ipif, return it.  But if we have both
4497 	 * saved_ipif and dep_ipif, check to see which one is better.
4498 	 */
4499 	if (saved_ipif != NULL) {
4500 		if (dep_ipif != NULL) {
4501 			if (ipif_comp_multi(saved_ipif, dep_ipif, isv6)) {
4502 				ipif_refrele(saved_ipif);
4503 				return (dep_ipif);
4504 			} else {
4505 				ipif_refrele(dep_ipif);
4506 				return (saved_ipif);
4507 			}
4508 		}
4509 		return (saved_ipif);
4510 	} else {
4511 		return (dep_ipif);
4512 	}
4513 }
4514 
4515 ill_t *
ill_lookup_multicast(ip_stack_t * ipst,zoneid_t zoneid,boolean_t isv6)4516 ill_lookup_multicast(ip_stack_t *ipst, zoneid_t zoneid, boolean_t isv6)
4517 {
4518 	ipif_t *ipif;
4519 	ill_t *ill;
4520 
4521 	ipif = ipif_lookup_multicast(ipst, zoneid, isv6);
4522 	if (ipif == NULL)
4523 		return (NULL);
4524 
4525 	ill = ipif->ipif_ill;
4526 	ill_refhold(ill);
4527 	ipif_refrele(ipif);
4528 	return (ill);
4529 }
4530 
4531 /*
4532  * This function is called when an application does not specify an interface
4533  * to be used for multicast traffic (joining a group/sending data).  It
4534  * calls ire_lookup_multi() to look for an interface route for the
4535  * specified multicast group.  Doing this allows the administrator to add
4536  * prefix routes for multicast to indicate which interface to be used for
4537  * multicast traffic in the above scenario.  The route could be for all
4538  * multicast (224.0/4), for a single multicast group (a /32 route) or
4539  * anything in between.  If there is no such multicast route, we just find
4540  * any multicast capable interface and return it.  The returned ipif
4541  * is refhold'ed.
4542  *
4543  * We support MULTIRT and RTF_SETSRC on the multicast routes added to the
4544  * unicast table. This is used by CGTP.
4545  */
4546 ill_t *
ill_lookup_group_v4(ipaddr_t group,zoneid_t zoneid,ip_stack_t * ipst,boolean_t * multirtp,ipaddr_t * setsrcp)4547 ill_lookup_group_v4(ipaddr_t group, zoneid_t zoneid, ip_stack_t *ipst,
4548     boolean_t *multirtp, ipaddr_t *setsrcp)
4549 {
4550 	ill_t			*ill;
4551 
4552 	ill = ire_lookup_multi_ill_v4(group, zoneid, ipst, multirtp, setsrcp);
4553 	if (ill != NULL)
4554 		return (ill);
4555 
4556 	return (ill_lookup_multicast(ipst, zoneid, B_FALSE));
4557 }
4558 
4559 /*
4560  * Look for an ipif with the specified interface address and destination.
4561  * The destination address is used only for matching point-to-point interfaces.
4562  */
4563 ipif_t *
ipif_lookup_interface(ipaddr_t if_addr,ipaddr_t dst,ip_stack_t * ipst)4564 ipif_lookup_interface(ipaddr_t if_addr, ipaddr_t dst, ip_stack_t *ipst)
4565 {
4566 	ipif_t	*ipif;
4567 	ill_t	*ill;
4568 	ill_walk_context_t ctx;
4569 
4570 	/*
4571 	 * First match all the point-to-point interfaces
4572 	 * before looking at non-point-to-point interfaces.
4573 	 * This is done to avoid returning non-point-to-point
4574 	 * ipif instead of unnumbered point-to-point ipif.
4575 	 */
4576 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4577 	ill = ILL_START_WALK_V4(&ctx, ipst);
4578 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4579 		mutex_enter(&ill->ill_lock);
4580 		for (ipif = ill->ill_ipif; ipif != NULL;
4581 		    ipif = ipif->ipif_next) {
4582 			/* Allow the ipif to be down */
4583 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
4584 			    (ipif->ipif_lcl_addr == if_addr) &&
4585 			    (ipif->ipif_pp_dst_addr == dst)) {
4586 				if (!IPIF_IS_CONDEMNED(ipif)) {
4587 					ipif_refhold_locked(ipif);
4588 					mutex_exit(&ill->ill_lock);
4589 					rw_exit(&ipst->ips_ill_g_lock);
4590 					return (ipif);
4591 				}
4592 			}
4593 		}
4594 		mutex_exit(&ill->ill_lock);
4595 	}
4596 	rw_exit(&ipst->ips_ill_g_lock);
4597 
4598 	/* lookup the ipif based on interface address */
4599 	ipif = ipif_lookup_addr(if_addr, NULL, ALL_ZONES, ipst);
4600 	ASSERT(ipif == NULL || !ipif->ipif_isv6);
4601 	return (ipif);
4602 }
4603 
4604 /*
4605  * Common function for ipif_lookup_addr() and ipif_lookup_addr_exact().
4606  */
4607 static ipif_t *
ipif_lookup_addr_common(ipaddr_t addr,ill_t * match_ill,uint32_t match_flags,zoneid_t zoneid,ip_stack_t * ipst)4608 ipif_lookup_addr_common(ipaddr_t addr, ill_t *match_ill, uint32_t match_flags,
4609     zoneid_t zoneid, ip_stack_t *ipst)
4610 {
4611 	ipif_t  *ipif;
4612 	ill_t   *ill;
4613 	boolean_t ptp = B_FALSE;
4614 	ill_walk_context_t	ctx;
4615 	boolean_t match_illgrp = (match_flags & IPIF_MATCH_ILLGRP);
4616 	boolean_t no_duplicate = (match_flags & IPIF_MATCH_NONDUP);
4617 
4618 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4619 	/*
4620 	 * Repeat twice, first based on local addresses and
4621 	 * next time for pointopoint.
4622 	 */
4623 repeat:
4624 	ill = ILL_START_WALK_V4(&ctx, ipst);
4625 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4626 		if (match_ill != NULL && ill != match_ill &&
4627 		    (!match_illgrp || !IS_IN_SAME_ILLGRP(ill, match_ill))) {
4628 			continue;
4629 		}
4630 		mutex_enter(&ill->ill_lock);
4631 		for (ipif = ill->ill_ipif; ipif != NULL;
4632 		    ipif = ipif->ipif_next) {
4633 			if (zoneid != ALL_ZONES &&
4634 			    zoneid != ipif->ipif_zoneid &&
4635 			    ipif->ipif_zoneid != ALL_ZONES)
4636 				continue;
4637 
4638 			if (no_duplicate && !(ipif->ipif_flags & IPIF_UP))
4639 				continue;
4640 
4641 			/* Allow the ipif to be down */
4642 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
4643 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
4644 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
4645 			    (ipif->ipif_pp_dst_addr == addr))) {
4646 				if (!IPIF_IS_CONDEMNED(ipif)) {
4647 					ipif_refhold_locked(ipif);
4648 					mutex_exit(&ill->ill_lock);
4649 					rw_exit(&ipst->ips_ill_g_lock);
4650 					return (ipif);
4651 				}
4652 			}
4653 		}
4654 		mutex_exit(&ill->ill_lock);
4655 	}
4656 
4657 	/* If we already did the ptp case, then we are done */
4658 	if (ptp) {
4659 		rw_exit(&ipst->ips_ill_g_lock);
4660 		return (NULL);
4661 	}
4662 	ptp = B_TRUE;
4663 	goto repeat;
4664 }
4665 
4666 /*
4667  * Lookup an ipif with the specified address.  For point-to-point links we
4668  * look for matches on either the destination address or the local address,
4669  * but we skip the local address check if IPIF_UNNUMBERED is set.  If the
4670  * `match_ill' argument is non-NULL, the lookup is restricted to that ill
4671  * (or illgrp if `match_ill' is in an IPMP group).
4672  */
4673 ipif_t *
ipif_lookup_addr(ipaddr_t addr,ill_t * match_ill,zoneid_t zoneid,ip_stack_t * ipst)4674 ipif_lookup_addr(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid,
4675     ip_stack_t *ipst)
4676 {
4677 	return (ipif_lookup_addr_common(addr, match_ill, IPIF_MATCH_ILLGRP,
4678 	    zoneid, ipst));
4679 }
4680 
4681 /*
4682  * Lookup an ipif with the specified address. Similar to ipif_lookup_addr,
4683  * except that we will only return an address if it is not marked as
4684  * IPIF_DUPLICATE
4685  */
4686 ipif_t *
ipif_lookup_addr_nondup(ipaddr_t addr,ill_t * match_ill,zoneid_t zoneid,ip_stack_t * ipst)4687 ipif_lookup_addr_nondup(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid,
4688     ip_stack_t *ipst)
4689 {
4690 	return (ipif_lookup_addr_common(addr, match_ill,
4691 	    (IPIF_MATCH_ILLGRP | IPIF_MATCH_NONDUP),
4692 	    zoneid, ipst));
4693 }
4694 
4695 /*
4696  * Special abbreviated version of ipif_lookup_addr() that doesn't match
4697  * `match_ill' across the IPMP group.  This function is only needed in some
4698  * corner-cases; almost everything should use ipif_lookup_addr().
4699  */
4700 ipif_t *
ipif_lookup_addr_exact(ipaddr_t addr,ill_t * match_ill,ip_stack_t * ipst)4701 ipif_lookup_addr_exact(ipaddr_t addr, ill_t *match_ill, ip_stack_t *ipst)
4702 {
4703 	ASSERT(match_ill != NULL);
4704 	return (ipif_lookup_addr_common(addr, match_ill, 0, ALL_ZONES,
4705 	    ipst));
4706 }
4707 
4708 /*
4709  * Look for an ipif with the specified address. For point-point links
4710  * we look for matches on either the destination address and the local
4711  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
4712  * is set.
4713  * If the `match_ill' argument is non-NULL, the lookup is restricted to that
4714  * ill (or illgrp if `match_ill' is in an IPMP group).
4715  * Return the zoneid for the ipif which matches. ALL_ZONES if no match.
4716  */
4717 zoneid_t
ipif_lookup_addr_zoneid(ipaddr_t addr,ill_t * match_ill,ip_stack_t * ipst)4718 ipif_lookup_addr_zoneid(ipaddr_t addr, ill_t *match_ill, ip_stack_t *ipst)
4719 {
4720 	zoneid_t zoneid;
4721 	ipif_t  *ipif;
4722 	ill_t   *ill;
4723 	boolean_t ptp = B_FALSE;
4724 	ill_walk_context_t	ctx;
4725 
4726 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4727 	/*
4728 	 * Repeat twice, first based on local addresses and
4729 	 * next time for pointopoint.
4730 	 */
4731 repeat:
4732 	ill = ILL_START_WALK_V4(&ctx, ipst);
4733 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4734 		if (match_ill != NULL && ill != match_ill &&
4735 		    !IS_IN_SAME_ILLGRP(ill, match_ill)) {
4736 			continue;
4737 		}
4738 		mutex_enter(&ill->ill_lock);
4739 		for (ipif = ill->ill_ipif; ipif != NULL;
4740 		    ipif = ipif->ipif_next) {
4741 			/* Allow the ipif to be down */
4742 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
4743 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
4744 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
4745 			    (ipif->ipif_pp_dst_addr == addr)) &&
4746 			    !(ipif->ipif_state_flags & IPIF_CONDEMNED)) {
4747 				zoneid = ipif->ipif_zoneid;
4748 				mutex_exit(&ill->ill_lock);
4749 				rw_exit(&ipst->ips_ill_g_lock);
4750 				/*
4751 				 * If ipif_zoneid was ALL_ZONES then we have
4752 				 * a trusted extensions shared IP address.
4753 				 * In that case GLOBAL_ZONEID works to send.
4754 				 */
4755 				if (zoneid == ALL_ZONES)
4756 					zoneid = GLOBAL_ZONEID;
4757 				return (zoneid);
4758 			}
4759 		}
4760 		mutex_exit(&ill->ill_lock);
4761 	}
4762 
4763 	/* If we already did the ptp case, then we are done */
4764 	if (ptp) {
4765 		rw_exit(&ipst->ips_ill_g_lock);
4766 		return (ALL_ZONES);
4767 	}
4768 	ptp = B_TRUE;
4769 	goto repeat;
4770 }
4771 
4772 /*
4773  * Look for an ipif that matches the specified remote address i.e. the
4774  * ipif that would receive the specified packet.
4775  * First look for directly connected interfaces and then do a recursive
4776  * IRE lookup and pick the first ipif corresponding to the source address in the
4777  * ire.
4778  * Returns: held ipif
4779  *
4780  * This is only used for ICMP_ADDRESS_MASK_REQUESTs
4781  */
4782 ipif_t *
ipif_lookup_remote(ill_t * ill,ipaddr_t addr,zoneid_t zoneid)4783 ipif_lookup_remote(ill_t *ill, ipaddr_t addr, zoneid_t zoneid)
4784 {
4785 	ipif_t	*ipif;
4786 
4787 	ASSERT(!ill->ill_isv6);
4788 
4789 	/*
4790 	 * Someone could be changing this ipif currently or change it
4791 	 * after we return this. Thus  a few packets could use the old
4792 	 * old values. However structure updates/creates (ire, ilg, ilm etc)
4793 	 * will atomically be updated or cleaned up with the new value
4794 	 * Thus we don't need a lock to check the flags or other attrs below.
4795 	 */
4796 	mutex_enter(&ill->ill_lock);
4797 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
4798 		if (IPIF_IS_CONDEMNED(ipif))
4799 			continue;
4800 		if (zoneid != ALL_ZONES && zoneid != ipif->ipif_zoneid &&
4801 		    ipif->ipif_zoneid != ALL_ZONES)
4802 			continue;
4803 		/* Allow the ipif to be down */
4804 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
4805 			if ((ipif->ipif_pp_dst_addr == addr) ||
4806 			    (!(ipif->ipif_flags & IPIF_UNNUMBERED) &&
4807 			    ipif->ipif_lcl_addr == addr)) {
4808 				ipif_refhold_locked(ipif);
4809 				mutex_exit(&ill->ill_lock);
4810 				return (ipif);
4811 			}
4812 		} else if (ipif->ipif_subnet == (addr & ipif->ipif_net_mask)) {
4813 			ipif_refhold_locked(ipif);
4814 			mutex_exit(&ill->ill_lock);
4815 			return (ipif);
4816 		}
4817 	}
4818 	mutex_exit(&ill->ill_lock);
4819 	/*
4820 	 * For a remote destination it isn't possible to nail down a particular
4821 	 * ipif.
4822 	 */
4823 
4824 	/* Pick the first interface */
4825 	ipif = ipif_get_next_ipif(NULL, ill);
4826 	return (ipif);
4827 }
4828 
4829 /*
4830  * This func does not prevent refcnt from increasing. But if
4831  * the caller has taken steps to that effect, then this func
4832  * can be used to determine whether the ill has become quiescent
4833  */
4834 static boolean_t
ill_is_quiescent(ill_t * ill)4835 ill_is_quiescent(ill_t *ill)
4836 {
4837 	ipif_t	*ipif;
4838 
4839 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4840 
4841 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
4842 		if (ipif->ipif_refcnt != 0)
4843 			return (B_FALSE);
4844 	}
4845 	if (!ILL_DOWN_OK(ill) || ill->ill_refcnt != 0) {
4846 		return (B_FALSE);
4847 	}
4848 	return (B_TRUE);
4849 }
4850 
4851 boolean_t
ill_is_freeable(ill_t * ill)4852 ill_is_freeable(ill_t *ill)
4853 {
4854 	ipif_t	*ipif;
4855 
4856 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4857 
4858 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
4859 		if (ipif->ipif_refcnt != 0) {
4860 			return (B_FALSE);
4861 		}
4862 	}
4863 	if (!ILL_FREE_OK(ill) || ill->ill_refcnt != 0) {
4864 		return (B_FALSE);
4865 	}
4866 	return (B_TRUE);
4867 }
4868 
4869 /*
4870  * This func does not prevent refcnt from increasing. But if
4871  * the caller has taken steps to that effect, then this func
4872  * can be used to determine whether the ipif has become quiescent
4873  */
4874 static boolean_t
ipif_is_quiescent(ipif_t * ipif)4875 ipif_is_quiescent(ipif_t *ipif)
4876 {
4877 	ill_t *ill;
4878 
4879 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
4880 
4881 	if (ipif->ipif_refcnt != 0)
4882 		return (B_FALSE);
4883 
4884 	ill = ipif->ipif_ill;
4885 	if (ill->ill_ipif_up_count != 0 || ill->ill_ipif_dup_count != 0 ||
4886 	    ill->ill_logical_down) {
4887 		return (B_TRUE);
4888 	}
4889 
4890 	/* This is the last ipif going down or being deleted on this ill */
4891 	if (ill->ill_ire_cnt != 0 || ill->ill_refcnt != 0) {
4892 		return (B_FALSE);
4893 	}
4894 
4895 	return (B_TRUE);
4896 }
4897 
4898 /*
4899  * return true if the ipif can be destroyed: the ipif has to be quiescent
4900  * with zero references from ire/ilm to it.
4901  */
4902 static boolean_t
ipif_is_freeable(ipif_t * ipif)4903 ipif_is_freeable(ipif_t *ipif)
4904 {
4905 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
4906 	ASSERT(ipif->ipif_id != 0);
4907 	return (ipif->ipif_refcnt == 0);
4908 }
4909 
4910 /*
4911  * The ipif/ill/ire has been refreled. Do the tail processing.
4912  * Determine if the ipif or ill in question has become quiescent and if so
4913  * wakeup close and/or restart any queued pending ioctl that is waiting
4914  * for the ipif_down (or ill_down)
4915  */
4916 void
ipif_ill_refrele_tail(ill_t * ill)4917 ipif_ill_refrele_tail(ill_t *ill)
4918 {
4919 	mblk_t	*mp;
4920 	conn_t	*connp;
4921 	ipsq_t	*ipsq;
4922 	ipxop_t	*ipx;
4923 	ipif_t	*ipif;
4924 	dl_notify_ind_t *dlindp;
4925 
4926 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4927 
4928 	if ((ill->ill_state_flags & ILL_CONDEMNED) && ill_is_freeable(ill)) {
4929 		/* ip_modclose() may be waiting */
4930 		cv_broadcast(&ill->ill_cv);
4931 	}
4932 
4933 	ipsq = ill->ill_phyint->phyint_ipsq;
4934 	mutex_enter(&ipsq->ipsq_lock);
4935 	ipx = ipsq->ipsq_xop;
4936 	mutex_enter(&ipx->ipx_lock);
4937 	if (ipx->ipx_waitfor == 0)	/* no one's waiting; bail */
4938 		goto unlock;
4939 
4940 	ASSERT(ipx->ipx_pending_mp != NULL && ipx->ipx_pending_ipif != NULL);
4941 
4942 	ipif = ipx->ipx_pending_ipif;
4943 	if (ipif->ipif_ill != ill) 	/* wait is for another ill; bail */
4944 		goto unlock;
4945 
4946 	switch (ipx->ipx_waitfor) {
4947 	case IPIF_DOWN:
4948 		if (!ipif_is_quiescent(ipif))
4949 			goto unlock;
4950 		break;
4951 	case IPIF_FREE:
4952 		if (!ipif_is_freeable(ipif))
4953 			goto unlock;
4954 		break;
4955 	case ILL_DOWN:
4956 		if (!ill_is_quiescent(ill))
4957 			goto unlock;
4958 		break;
4959 	case ILL_FREE:
4960 		/*
4961 		 * ILL_FREE is only for loopback; normal ill teardown waits
4962 		 * synchronously in ip_modclose() without using ipx_waitfor,
4963 		 * handled by the cv_broadcast() at the top of this function.
4964 		 */
4965 		if (!ill_is_freeable(ill))
4966 			goto unlock;
4967 		break;
4968 	default:
4969 		cmn_err(CE_PANIC, "ipsq: %p unknown ipx_waitfor %d\n",
4970 		    (void *)ipsq, ipx->ipx_waitfor);
4971 	}
4972 
4973 	ill_refhold_locked(ill);	/* for qwriter_ip() call below */
4974 	mutex_exit(&ipx->ipx_lock);
4975 	mp = ipsq_pending_mp_get(ipsq, &connp);
4976 	mutex_exit(&ipsq->ipsq_lock);
4977 	mutex_exit(&ill->ill_lock);
4978 
4979 	ASSERT(mp != NULL);
4980 	/*
4981 	 * NOTE: all of the qwriter_ip() calls below use CUR_OP since
4982 	 * we can only get here when the current operation decides it
4983 	 * it needs to quiesce via ipsq_pending_mp_add().
4984 	 */
4985 	switch (mp->b_datap->db_type) {
4986 	case M_PCPROTO:
4987 	case M_PROTO:
4988 		/*
4989 		 * For now, only DL_NOTIFY_IND messages can use this facility.
4990 		 */
4991 		dlindp = (dl_notify_ind_t *)mp->b_rptr;
4992 		ASSERT(dlindp->dl_primitive == DL_NOTIFY_IND);
4993 
4994 		switch (dlindp->dl_notification) {
4995 		case DL_NOTE_PHYS_ADDR:
4996 			qwriter_ip(ill, ill->ill_rq, mp,
4997 			    ill_set_phys_addr_tail, CUR_OP, B_TRUE);
4998 			return;
4999 		case DL_NOTE_REPLUMB:
5000 			qwriter_ip(ill, ill->ill_rq, mp,
5001 			    ill_replumb_tail, CUR_OP, B_TRUE);
5002 			return;
5003 		default:
5004 			ASSERT(0);
5005 			ill_refrele(ill);
5006 		}
5007 		break;
5008 
5009 	case M_ERROR:
5010 	case M_HANGUP:
5011 		qwriter_ip(ill, ill->ill_rq, mp, ipif_all_down_tail, CUR_OP,
5012 		    B_TRUE);
5013 		return;
5014 
5015 	case M_IOCTL:
5016 	case M_IOCDATA:
5017 		qwriter_ip(ill, (connp != NULL ? CONNP_TO_WQ(connp) :
5018 		    ill->ill_wq), mp, ip_reprocess_ioctl, CUR_OP, B_TRUE);
5019 		return;
5020 
5021 	default:
5022 		cmn_err(CE_PANIC, "ipif_ill_refrele_tail mp %p "
5023 		    "db_type %d\n", (void *)mp, mp->b_datap->db_type);
5024 	}
5025 	return;
5026 unlock:
5027 	mutex_exit(&ipsq->ipsq_lock);
5028 	mutex_exit(&ipx->ipx_lock);
5029 	mutex_exit(&ill->ill_lock);
5030 }
5031 
5032 #ifdef DEBUG
5033 /* Reuse trace buffer from beginning (if reached the end) and record trace */
5034 static void
th_trace_rrecord(th_trace_t * th_trace)5035 th_trace_rrecord(th_trace_t *th_trace)
5036 {
5037 	tr_buf_t *tr_buf;
5038 	uint_t lastref;
5039 
5040 	lastref = th_trace->th_trace_lastref;
5041 	lastref++;
5042 	if (lastref == TR_BUF_MAX)
5043 		lastref = 0;
5044 	th_trace->th_trace_lastref = lastref;
5045 	tr_buf = &th_trace->th_trbuf[lastref];
5046 	tr_buf->tr_time = ddi_get_lbolt();
5047 	tr_buf->tr_depth = getpcstack(tr_buf->tr_stack, TR_STACK_DEPTH);
5048 }
5049 
5050 static void
th_trace_free(void * value)5051 th_trace_free(void *value)
5052 {
5053 	th_trace_t *th_trace = value;
5054 
5055 	ASSERT(th_trace->th_refcnt == 0);
5056 	kmem_free(th_trace, sizeof (*th_trace));
5057 }
5058 
5059 /*
5060  * Find or create the per-thread hash table used to track object references.
5061  * The ipst argument is NULL if we shouldn't allocate.
5062  *
5063  * Accesses per-thread data, so there's no need to lock here.
5064  */
5065 static mod_hash_t *
th_trace_gethash(ip_stack_t * ipst)5066 th_trace_gethash(ip_stack_t *ipst)
5067 {
5068 	th_hash_t *thh;
5069 
5070 	if ((thh = tsd_get(ip_thread_data)) == NULL && ipst != NULL) {
5071 		mod_hash_t *mh;
5072 		char name[256];
5073 		size_t objsize, rshift;
5074 		int retv;
5075 
5076 		if ((thh = kmem_alloc(sizeof (*thh), KM_NOSLEEP)) == NULL)
5077 			return (NULL);
5078 		(void) snprintf(name, sizeof (name), "th_trace_%p",
5079 		    (void *)curthread);
5080 
5081 		/*
5082 		 * We use mod_hash_create_extended here rather than the more
5083 		 * obvious mod_hash_create_ptrhash because the latter has a
5084 		 * hard-coded KM_SLEEP, and we'd prefer to fail rather than
5085 		 * block.
5086 		 */
5087 		objsize = MAX(MAX(sizeof (ill_t), sizeof (ipif_t)),
5088 		    MAX(sizeof (ire_t), sizeof (ncec_t)));
5089 		rshift = highbit(objsize);
5090 		mh = mod_hash_create_extended(name, 64, mod_hash_null_keydtor,
5091 		    th_trace_free, mod_hash_byptr, (void *)rshift,
5092 		    mod_hash_ptrkey_cmp, KM_NOSLEEP);
5093 		if (mh == NULL) {
5094 			kmem_free(thh, sizeof (*thh));
5095 			return (NULL);
5096 		}
5097 		thh->thh_hash = mh;
5098 		thh->thh_ipst = ipst;
5099 		/*
5100 		 * We trace ills, ipifs, ires, and nces.  All of these are
5101 		 * per-IP-stack, so the lock on the thread list is as well.
5102 		 */
5103 		rw_enter(&ip_thread_rwlock, RW_WRITER);
5104 		list_insert_tail(&ip_thread_list, thh);
5105 		rw_exit(&ip_thread_rwlock);
5106 		retv = tsd_set(ip_thread_data, thh);
5107 		ASSERT(retv == 0);
5108 	}
5109 	return (thh != NULL ? thh->thh_hash : NULL);
5110 }
5111 
5112 boolean_t
th_trace_ref(const void * obj,ip_stack_t * ipst)5113 th_trace_ref(const void *obj, ip_stack_t *ipst)
5114 {
5115 	th_trace_t *th_trace;
5116 	mod_hash_t *mh;
5117 	mod_hash_val_t val;
5118 
5119 	if ((mh = th_trace_gethash(ipst)) == NULL)
5120 		return (B_FALSE);
5121 
5122 	/*
5123 	 * Attempt to locate the trace buffer for this obj and thread.
5124 	 * If it does not exist, then allocate a new trace buffer and
5125 	 * insert into the hash.
5126 	 */
5127 	if (mod_hash_find(mh, (mod_hash_key_t)obj, &val) == MH_ERR_NOTFOUND) {
5128 		th_trace = kmem_zalloc(sizeof (th_trace_t), KM_NOSLEEP);
5129 		if (th_trace == NULL)
5130 			return (B_FALSE);
5131 
5132 		th_trace->th_id = curthread;
5133 		if (mod_hash_insert(mh, (mod_hash_key_t)obj,
5134 		    (mod_hash_val_t)th_trace) != 0) {
5135 			kmem_free(th_trace, sizeof (th_trace_t));
5136 			return (B_FALSE);
5137 		}
5138 	} else {
5139 		th_trace = (th_trace_t *)val;
5140 	}
5141 
5142 	ASSERT(th_trace->th_refcnt >= 0 &&
5143 	    th_trace->th_refcnt < TR_BUF_MAX - 1);
5144 
5145 	th_trace->th_refcnt++;
5146 	th_trace_rrecord(th_trace);
5147 	return (B_TRUE);
5148 }
5149 
5150 /*
5151  * For the purpose of tracing a reference release, we assume that global
5152  * tracing is always on and that the same thread initiated the reference hold
5153  * is releasing.
5154  */
5155 void
th_trace_unref(const void * obj)5156 th_trace_unref(const void *obj)
5157 {
5158 	int retv;
5159 	mod_hash_t *mh;
5160 	th_trace_t *th_trace;
5161 	mod_hash_val_t val;
5162 
5163 	mh = th_trace_gethash(NULL);
5164 	retv = mod_hash_find(mh, (mod_hash_key_t)obj, &val);
5165 	ASSERT(retv == 0);
5166 	th_trace = (th_trace_t *)val;
5167 
5168 	ASSERT(th_trace->th_refcnt > 0);
5169 	th_trace->th_refcnt--;
5170 	th_trace_rrecord(th_trace);
5171 }
5172 
5173 /*
5174  * If tracing has been disabled, then we assume that the reference counts are
5175  * now useless, and we clear them out before destroying the entries.
5176  */
5177 void
th_trace_cleanup(const void * obj,boolean_t trace_disable)5178 th_trace_cleanup(const void *obj, boolean_t trace_disable)
5179 {
5180 	th_hash_t	*thh;
5181 	mod_hash_t	*mh;
5182 	mod_hash_val_t	val;
5183 	th_trace_t	*th_trace;
5184 	int		retv;
5185 
5186 	rw_enter(&ip_thread_rwlock, RW_READER);
5187 	for (thh = list_head(&ip_thread_list); thh != NULL;
5188 	    thh = list_next(&ip_thread_list, thh)) {
5189 		if (mod_hash_find(mh = thh->thh_hash, (mod_hash_key_t)obj,
5190 		    &val) == 0) {
5191 			th_trace = (th_trace_t *)val;
5192 			if (trace_disable)
5193 				th_trace->th_refcnt = 0;
5194 			retv = mod_hash_destroy(mh, (mod_hash_key_t)obj);
5195 			ASSERT(retv == 0);
5196 		}
5197 	}
5198 	rw_exit(&ip_thread_rwlock);
5199 }
5200 
5201 void
ipif_trace_ref(ipif_t * ipif)5202 ipif_trace_ref(ipif_t *ipif)
5203 {
5204 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5205 
5206 	if (ipif->ipif_trace_disable)
5207 		return;
5208 
5209 	if (!th_trace_ref(ipif, ipif->ipif_ill->ill_ipst)) {
5210 		ipif->ipif_trace_disable = B_TRUE;
5211 		ipif_trace_cleanup(ipif);
5212 	}
5213 }
5214 
5215 void
ipif_untrace_ref(ipif_t * ipif)5216 ipif_untrace_ref(ipif_t *ipif)
5217 {
5218 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5219 
5220 	if (!ipif->ipif_trace_disable)
5221 		th_trace_unref(ipif);
5222 }
5223 
5224 void
ill_trace_ref(ill_t * ill)5225 ill_trace_ref(ill_t *ill)
5226 {
5227 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5228 
5229 	if (ill->ill_trace_disable)
5230 		return;
5231 
5232 	if (!th_trace_ref(ill, ill->ill_ipst)) {
5233 		ill->ill_trace_disable = B_TRUE;
5234 		ill_trace_cleanup(ill);
5235 	}
5236 }
5237 
5238 void
ill_untrace_ref(ill_t * ill)5239 ill_untrace_ref(ill_t *ill)
5240 {
5241 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5242 
5243 	if (!ill->ill_trace_disable)
5244 		th_trace_unref(ill);
5245 }
5246 
5247 /*
5248  * Called when ipif is unplumbed or when memory alloc fails.  Note that on
5249  * failure, ipif_trace_disable is set.
5250  */
5251 static void
ipif_trace_cleanup(const ipif_t * ipif)5252 ipif_trace_cleanup(const ipif_t *ipif)
5253 {
5254 	th_trace_cleanup(ipif, ipif->ipif_trace_disable);
5255 }
5256 
5257 /*
5258  * Called when ill is unplumbed or when memory alloc fails.  Note that on
5259  * failure, ill_trace_disable is set.
5260  */
5261 static void
ill_trace_cleanup(const ill_t * ill)5262 ill_trace_cleanup(const ill_t *ill)
5263 {
5264 	th_trace_cleanup(ill, ill->ill_trace_disable);
5265 }
5266 #endif /* DEBUG */
5267 
5268 void
ipif_refhold_locked(ipif_t * ipif)5269 ipif_refhold_locked(ipif_t *ipif)
5270 {
5271 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5272 	ipif->ipif_refcnt++;
5273 	IPIF_TRACE_REF(ipif);
5274 }
5275 
5276 void
ipif_refhold(ipif_t * ipif)5277 ipif_refhold(ipif_t *ipif)
5278 {
5279 	ill_t	*ill;
5280 
5281 	ill = ipif->ipif_ill;
5282 	mutex_enter(&ill->ill_lock);
5283 	ipif->ipif_refcnt++;
5284 	IPIF_TRACE_REF(ipif);
5285 	mutex_exit(&ill->ill_lock);
5286 }
5287 
5288 /*
5289  * Must not be called while holding any locks. Otherwise if this is
5290  * the last reference to be released there is a chance of recursive mutex
5291  * panic due to ipif_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
5292  * to restart an ioctl.
5293  */
5294 void
ipif_refrele(ipif_t * ipif)5295 ipif_refrele(ipif_t *ipif)
5296 {
5297 	ill_t	*ill;
5298 
5299 	ill = ipif->ipif_ill;
5300 
5301 	mutex_enter(&ill->ill_lock);
5302 	ASSERT(ipif->ipif_refcnt != 0);
5303 	ipif->ipif_refcnt--;
5304 	IPIF_UNTRACE_REF(ipif);
5305 	if (ipif->ipif_refcnt != 0) {
5306 		mutex_exit(&ill->ill_lock);
5307 		return;
5308 	}
5309 
5310 	/* Drops the ill_lock */
5311 	ipif_ill_refrele_tail(ill);
5312 }
5313 
5314 ipif_t *
ipif_get_next_ipif(ipif_t * curr,ill_t * ill)5315 ipif_get_next_ipif(ipif_t *curr, ill_t *ill)
5316 {
5317 	ipif_t	*ipif;
5318 
5319 	mutex_enter(&ill->ill_lock);
5320 	for (ipif = (curr == NULL ? ill->ill_ipif : curr->ipif_next);
5321 	    ipif != NULL; ipif = ipif->ipif_next) {
5322 		if (IPIF_IS_CONDEMNED(ipif))
5323 			continue;
5324 		ipif_refhold_locked(ipif);
5325 		mutex_exit(&ill->ill_lock);
5326 		return (ipif);
5327 	}
5328 	mutex_exit(&ill->ill_lock);
5329 	return (NULL);
5330 }
5331 
5332 /*
5333  * TODO: make this table extendible at run time
5334  * Return a pointer to the mac type info for 'mac_type'
5335  */
5336 static ip_m_t *
ip_m_lookup(t_uscalar_t mac_type)5337 ip_m_lookup(t_uscalar_t mac_type)
5338 {
5339 	ip_m_t	*ipm;
5340 
5341 	for (ipm = ip_m_tbl; ipm < A_END(ip_m_tbl); ipm++)
5342 		if (ipm->ip_m_mac_type == mac_type)
5343 			return (ipm);
5344 	return (NULL);
5345 }
5346 
5347 /*
5348  * Make a link layer address from the multicast IP address *addr.
5349  * To form the link layer address, invoke the ip_m_v*mapping function
5350  * associated with the link-layer type.
5351  */
5352 void
ip_mcast_mapping(ill_t * ill,uchar_t * addr,uchar_t * hwaddr)5353 ip_mcast_mapping(ill_t *ill, uchar_t *addr, uchar_t *hwaddr)
5354 {
5355 	ip_m_t *ipm;
5356 
5357 	if (ill->ill_net_type == IRE_IF_NORESOLVER)
5358 		return;
5359 
5360 	ASSERT(addr != NULL);
5361 
5362 	ipm = ip_m_lookup(ill->ill_mactype);
5363 	if (ipm == NULL ||
5364 	    (ill->ill_isv6 && ipm->ip_m_v6mapping == NULL) ||
5365 	    (!ill->ill_isv6 && ipm->ip_m_v4mapping == NULL)) {
5366 		ip0dbg(("no mapping for ill %s mactype 0x%x\n",
5367 		    ill->ill_name, ill->ill_mactype));
5368 		return;
5369 	}
5370 	if (ill->ill_isv6)
5371 		(*ipm->ip_m_v6mapping)(ill, addr, hwaddr);
5372 	else
5373 		(*ipm->ip_m_v4mapping)(ill, addr, hwaddr);
5374 }
5375 
5376 /*
5377  * Returns B_FALSE if the IPv4 netmask pointed by `mask' is non-contiguous.
5378  * Otherwise returns B_TRUE.
5379  *
5380  * The netmask can be verified to be contiguous with 32 shifts and or
5381  * operations. Take the contiguous mask (in host byte order) and compute
5382  * 	mask | mask << 1 | mask << 2 | ... | mask << 31
5383  * the result will be the same as the 'mask' for contiguous mask.
5384  */
5385 static boolean_t
ip_contiguous_mask(uint32_t mask)5386 ip_contiguous_mask(uint32_t mask)
5387 {
5388 	uint32_t	m = mask;
5389 	int		i;
5390 
5391 	for (i = 1; i < 32; i++)
5392 		m |= (mask << i);
5393 
5394 	return (m == mask);
5395 }
5396 
5397 /*
5398  * ip_rt_add is called to add an IPv4 route to the forwarding table.
5399  * ill is passed in to associate it with the correct interface.
5400  * If ire_arg is set, then we return the held IRE in that location.
5401  */
5402 int
ip_rt_add(ipaddr_t dst_addr,ipaddr_t mask,ipaddr_t gw_addr,ipaddr_t src_addr,int flags,ill_t * ill,ire_t ** ire_arg,boolean_t ioctl_msg,struct rtsa_s * sp,ip_stack_t * ipst,zoneid_t zoneid)5403 ip_rt_add(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
5404     ipaddr_t src_addr, int flags, ill_t *ill, ire_t **ire_arg,
5405     boolean_t ioctl_msg, struct rtsa_s *sp, ip_stack_t *ipst, zoneid_t zoneid)
5406 {
5407 	ire_t	*ire, *nire;
5408 	ire_t	*gw_ire = NULL;
5409 	ipif_t	*ipif = NULL;
5410 	uint_t	type;
5411 	int	match_flags = MATCH_IRE_TYPE;
5412 	tsol_gc_t *gc = NULL;
5413 	tsol_gcgrp_t *gcgrp = NULL;
5414 	boolean_t gcgrp_xtraref = B_FALSE;
5415 	boolean_t cgtp_broadcast;
5416 	boolean_t unbound = B_FALSE;
5417 
5418 	ip1dbg(("ip_rt_add:"));
5419 
5420 	if (ire_arg != NULL)
5421 		*ire_arg = NULL;
5422 
5423 	/* disallow non-contiguous netmasks */
5424 	if (!ip_contiguous_mask(ntohl(mask)))
5425 		return (ENOTSUP);
5426 
5427 	/*
5428 	 * If this is the case of RTF_HOST being set, then we set the netmask
5429 	 * to all ones (regardless if one was supplied).
5430 	 */
5431 	if (flags & RTF_HOST)
5432 		mask = IP_HOST_MASK;
5433 
5434 	/*
5435 	 * Prevent routes with a zero gateway from being created (since
5436 	 * interfaces can currently be plumbed and brought up no assigned
5437 	 * address).
5438 	 */
5439 	if (gw_addr == 0)
5440 		return (ENETUNREACH);
5441 	/*
5442 	 * Get the ipif, if any, corresponding to the gw_addr
5443 	 * If -ifp was specified we restrict ourselves to the ill, otherwise
5444 	 * we match on the gatway and destination to handle unnumbered pt-pt
5445 	 * interfaces.
5446 	 */
5447 	if (ill != NULL)
5448 		ipif = ipif_lookup_addr(gw_addr, ill, ALL_ZONES, ipst);
5449 	else
5450 		ipif = ipif_lookup_interface(gw_addr, dst_addr, ipst);
5451 	if (ipif != NULL) {
5452 		if (IS_VNI(ipif->ipif_ill)) {
5453 			ipif_refrele(ipif);
5454 			return (EINVAL);
5455 		}
5456 	}
5457 
5458 	/*
5459 	 * GateD will attempt to create routes with a loopback interface
5460 	 * address as the gateway and with RTF_GATEWAY set.  We allow
5461 	 * these routes to be added, but create them as interface routes
5462 	 * since the gateway is an interface address.
5463 	 */
5464 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
5465 		flags &= ~RTF_GATEWAY;
5466 		if (gw_addr == INADDR_LOOPBACK && dst_addr == INADDR_LOOPBACK &&
5467 		    mask == IP_HOST_MASK) {
5468 			ire = ire_ftable_lookup_v4(dst_addr, 0, 0, IRE_LOOPBACK,
5469 			    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst,
5470 			    NULL);
5471 			if (ire != NULL) {
5472 				ire_refrele(ire);
5473 				ipif_refrele(ipif);
5474 				return (EEXIST);
5475 			}
5476 			ip1dbg(("ip_rt_add: 0x%p creating IRE 0x%x"
5477 			    "for 0x%x\n", (void *)ipif,
5478 			    ipif->ipif_ire_type,
5479 			    ntohl(ipif->ipif_lcl_addr)));
5480 			ire = ire_create(
5481 			    (uchar_t *)&dst_addr,	/* dest address */
5482 			    (uchar_t *)&mask,		/* mask */
5483 			    NULL,			/* no gateway */
5484 			    ipif->ipif_ire_type,	/* LOOPBACK */
5485 			    ipif->ipif_ill,
5486 			    zoneid,
5487 			    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
5488 			    NULL,
5489 			    ipst);
5490 
5491 			if (ire == NULL) {
5492 				ipif_refrele(ipif);
5493 				return (ENOMEM);
5494 			}
5495 			/* src address assigned by the caller? */
5496 			if ((src_addr != INADDR_ANY) && (flags & RTF_SETSRC))
5497 				ire->ire_setsrc_addr = src_addr;
5498 
5499 			nire = ire_add(ire);
5500 			if (nire == NULL) {
5501 				/*
5502 				 * In the result of failure, ire_add() will have
5503 				 * already deleted the ire in question, so there
5504 				 * is no need to do that here.
5505 				 */
5506 				ipif_refrele(ipif);
5507 				return (ENOMEM);
5508 			}
5509 			/*
5510 			 * Check if it was a duplicate entry. This handles
5511 			 * the case of two racing route adds for the same route
5512 			 */
5513 			if (nire != ire) {
5514 				ASSERT(nire->ire_identical_ref > 1);
5515 				ire_delete(nire);
5516 				ire_refrele(nire);
5517 				ipif_refrele(ipif);
5518 				return (EEXIST);
5519 			}
5520 			ire = nire;
5521 			goto save_ire;
5522 		}
5523 	}
5524 
5525 	/*
5526 	 * The routes for multicast with CGTP are quite special in that
5527 	 * the gateway is the local interface address, yet RTF_GATEWAY
5528 	 * is set. We turn off RTF_GATEWAY to provide compatibility with
5529 	 * this undocumented and unusual use of multicast routes.
5530 	 */
5531 	if ((flags & RTF_MULTIRT) && ipif != NULL)
5532 		flags &= ~RTF_GATEWAY;
5533 
5534 	/*
5535 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
5536 	 * and the gateway address provided is one of the system's interface
5537 	 * addresses.  By using the routing socket interface and supplying an
5538 	 * RTA_IFP sockaddr with an interface index, an alternate method of
5539 	 * specifying an interface route to be created is available which uses
5540 	 * the interface index that specifies the outgoing interface rather than
5541 	 * the address of an outgoing interface (which may not be able to
5542 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
5543 	 * flag, routes can be specified which not only specify the next-hop to
5544 	 * be used when routing to a certain prefix, but also which outgoing
5545 	 * interface should be used.
5546 	 *
5547 	 * Previously, interfaces would have unique addresses assigned to them
5548 	 * and so the address assigned to a particular interface could be used
5549 	 * to identify a particular interface.  One exception to this was the
5550 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
5551 	 *
5552 	 * With the advent of IPv6 and its link-local addresses, this
5553 	 * restriction was relaxed and interfaces could share addresses between
5554 	 * themselves.  In fact, typically all of the link-local interfaces on
5555 	 * an IPv6 node or router will have the same link-local address.  In
5556 	 * order to differentiate between these interfaces, the use of an
5557 	 * interface index is necessary and this index can be carried inside a
5558 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
5559 	 * of using the interface index, however, is that all of the ipif's that
5560 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
5561 	 * cannot be used to differentiate between ipif's (or logical
5562 	 * interfaces) that belong to the same ill (physical interface).
5563 	 *
5564 	 * For example, in the following case involving IPv4 interfaces and
5565 	 * logical interfaces
5566 	 *
5567 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
5568 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0
5569 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0
5570 	 *
5571 	 * the ipif's corresponding to each of these interface routes can be
5572 	 * uniquely identified by the "gateway" (actually interface address).
5573 	 *
5574 	 * In this case involving multiple IPv6 default routes to a particular
5575 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
5576 	 * default route is of interest:
5577 	 *
5578 	 *	default		fe80::123:4567:89ab:cdef	U	if0
5579 	 *	default		fe80::123:4567:89ab:cdef	U	if1
5580 	 */
5581 
5582 	/* RTF_GATEWAY not set */
5583 	if (!(flags & RTF_GATEWAY)) {
5584 		if (sp != NULL) {
5585 			ip2dbg(("ip_rt_add: gateway security attributes "
5586 			    "cannot be set with interface route\n"));
5587 			if (ipif != NULL)
5588 				ipif_refrele(ipif);
5589 			return (EINVAL);
5590 		}
5591 
5592 		/*
5593 		 * Whether or not ill (RTA_IFP) is set, we require that
5594 		 * the gateway is one of our local addresses.
5595 		 */
5596 		if (ipif == NULL)
5597 			return (ENETUNREACH);
5598 
5599 		/*
5600 		 * We use MATCH_IRE_ILL here. If the caller specified an
5601 		 * interface (from the RTA_IFP sockaddr) we use it, otherwise
5602 		 * we use the ill derived from the gateway address.
5603 		 * We can always match the gateway address since we record it
5604 		 * in ire_gateway_addr.
5605 		 * We don't allow RTA_IFP to specify a different ill than the
5606 		 * one matching the ipif to make sure we can delete the route.
5607 		 */
5608 		match_flags |= MATCH_IRE_GW | MATCH_IRE_ILL;
5609 		if (ill == NULL) {
5610 			ill = ipif->ipif_ill;
5611 		} else if (ill != ipif->ipif_ill) {
5612 			ipif_refrele(ipif);
5613 			return (EINVAL);
5614 		}
5615 
5616 		/*
5617 		 * We check for an existing entry at this point.
5618 		 *
5619 		 * Since a netmask isn't passed in via the ioctl interface
5620 		 * (SIOCADDRT), we don't check for a matching netmask in that
5621 		 * case.
5622 		 */
5623 		if (!ioctl_msg)
5624 			match_flags |= MATCH_IRE_MASK;
5625 		ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr,
5626 		    IRE_INTERFACE, ill, ALL_ZONES, NULL, match_flags, 0, ipst,
5627 		    NULL);
5628 		if (ire != NULL) {
5629 			ire_refrele(ire);
5630 			ipif_refrele(ipif);
5631 			return (EEXIST);
5632 		}
5633 
5634 		/*
5635 		 * Some software (for example, GateD and Sun Cluster) attempts
5636 		 * to create (what amount to) IRE_PREFIX routes with the
5637 		 * loopback address as the gateway.  This is primarily done to
5638 		 * set up prefixes with the RTF_REJECT flag set (for example,
5639 		 * when generating aggregate routes.)
5640 		 *
5641 		 * If the IRE type (as defined by ill->ill_net_type) would be
5642 		 * IRE_LOOPBACK, then we map the request into a
5643 		 * IRE_IF_NORESOLVER. We also OR in the RTF_BLACKHOLE flag as
5644 		 * these interface routes, by definition, can only be that.
5645 		 *
5646 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
5647 		 * routine, but rather using ire_create() directly.
5648 		 *
5649 		 */
5650 		type = ill->ill_net_type;
5651 		if (type == IRE_LOOPBACK) {
5652 			type = IRE_IF_NORESOLVER;
5653 			flags |= RTF_BLACKHOLE;
5654 		}
5655 
5656 		/*
5657 		 * Create a copy of the IRE_IF_NORESOLVER or
5658 		 * IRE_IF_RESOLVER with the modified address, netmask, and
5659 		 * gateway.
5660 		 */
5661 		ire = ire_create(
5662 		    (uchar_t *)&dst_addr,
5663 		    (uint8_t *)&mask,
5664 		    (uint8_t *)&gw_addr,
5665 		    type,
5666 		    ill,
5667 		    zoneid,
5668 		    flags,
5669 		    NULL,
5670 		    ipst);
5671 		if (ire == NULL) {
5672 			ipif_refrele(ipif);
5673 			return (ENOMEM);
5674 		}
5675 
5676 		/* src address assigned by the caller? */
5677 		if ((src_addr != INADDR_ANY) && (flags & RTF_SETSRC))
5678 			ire->ire_setsrc_addr = src_addr;
5679 
5680 		nire = ire_add(ire);
5681 		if (nire == NULL) {
5682 			/*
5683 			 * In the result of failure, ire_add() will have
5684 			 * already deleted the ire in question, so there
5685 			 * is no need to do that here.
5686 			 */
5687 			ipif_refrele(ipif);
5688 			return (ENOMEM);
5689 		}
5690 		/*
5691 		 * Check if it was a duplicate entry. This handles
5692 		 * the case of two racing route adds for the same route
5693 		 */
5694 		if (nire != ire) {
5695 			ire_delete(nire);
5696 			ire_refrele(nire);
5697 			ipif_refrele(ipif);
5698 			return (EEXIST);
5699 		}
5700 		ire = nire;
5701 		goto save_ire;
5702 	}
5703 
5704 	/*
5705 	 * Get an interface IRE for the specified gateway.
5706 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
5707 	 * gateway, it is currently unreachable and we fail the request
5708 	 * accordingly. We reject any RTF_GATEWAY routes where the gateway
5709 	 * is an IRE_LOCAL or IRE_LOOPBACK.
5710 	 * If RTA_IFP was specified we look on that particular ill.
5711 	 */
5712 	if (ill != NULL)
5713 		match_flags |= MATCH_IRE_ILL;
5714 
5715 	/* Check whether the gateway is reachable. */
5716 again:
5717 	type = IRE_INTERFACE | IRE_LOCAL | IRE_LOOPBACK;
5718 	if (flags & RTF_INDIRECT)
5719 		type |= IRE_OFFLINK;
5720 
5721 	gw_ire = ire_ftable_lookup_v4(gw_addr, 0, 0, type, ill,
5722 	    ALL_ZONES, NULL, match_flags, 0, ipst, NULL);
5723 	if (gw_ire == NULL) {
5724 		/*
5725 		 * With IPMP, we allow host routes to influence in.mpathd's
5726 		 * target selection.  However, if the test addresses are on
5727 		 * their own network, the above lookup will fail since the
5728 		 * underlying IRE_INTERFACEs are marked hidden.  So allow
5729 		 * hidden test IREs to be found and try again.
5730 		 */
5731 		if (!(match_flags & MATCH_IRE_TESTHIDDEN))  {
5732 			match_flags |= MATCH_IRE_TESTHIDDEN;
5733 			goto again;
5734 		}
5735 		if (ipif != NULL)
5736 			ipif_refrele(ipif);
5737 		return (ENETUNREACH);
5738 	}
5739 	if (gw_ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK)) {
5740 		ire_refrele(gw_ire);
5741 		if (ipif != NULL)
5742 			ipif_refrele(ipif);
5743 		return (ENETUNREACH);
5744 	}
5745 
5746 	if (ill == NULL && !(flags & RTF_INDIRECT)) {
5747 		unbound = B_TRUE;
5748 		if (ipst->ips_ip_strict_src_multihoming > 0)
5749 			ill = gw_ire->ire_ill;
5750 	}
5751 
5752 	/*
5753 	 * We create one of three types of IREs as a result of this request
5754 	 * based on the netmask.  A netmask of all ones (which is automatically
5755 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
5756 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
5757 	 * created.  Otherwise, an IRE_PREFIX route is created for the
5758 	 * destination prefix.
5759 	 */
5760 	if (mask == IP_HOST_MASK)
5761 		type = IRE_HOST;
5762 	else if (mask == 0)
5763 		type = IRE_DEFAULT;
5764 	else
5765 		type = IRE_PREFIX;
5766 
5767 	/* check for a duplicate entry */
5768 	ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr, type, ill,
5769 	    ALL_ZONES, NULL, match_flags | MATCH_IRE_MASK | MATCH_IRE_GW,
5770 	    0, ipst, NULL);
5771 	if (ire != NULL) {
5772 		if (ipif != NULL)
5773 			ipif_refrele(ipif);
5774 		ire_refrele(gw_ire);
5775 		ire_refrele(ire);
5776 		return (EEXIST);
5777 	}
5778 
5779 	/* Security attribute exists */
5780 	if (sp != NULL) {
5781 		tsol_gcgrp_addr_t ga;
5782 
5783 		/* find or create the gateway credentials group */
5784 		ga.ga_af = AF_INET;
5785 		IN6_IPADDR_TO_V4MAPPED(gw_addr, &ga.ga_addr);
5786 
5787 		/* we hold reference to it upon success */
5788 		gcgrp = gcgrp_lookup(&ga, B_TRUE);
5789 		if (gcgrp == NULL) {
5790 			if (ipif != NULL)
5791 				ipif_refrele(ipif);
5792 			ire_refrele(gw_ire);
5793 			return (ENOMEM);
5794 		}
5795 
5796 		/*
5797 		 * Create and add the security attribute to the group; a
5798 		 * reference to the group is made upon allocating a new
5799 		 * entry successfully.  If it finds an already-existing
5800 		 * entry for the security attribute in the group, it simply
5801 		 * returns it and no new reference is made to the group.
5802 		 */
5803 		gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
5804 		if (gc == NULL) {
5805 			if (ipif != NULL)
5806 				ipif_refrele(ipif);
5807 			/* release reference held by gcgrp_lookup */
5808 			GCGRP_REFRELE(gcgrp);
5809 			ire_refrele(gw_ire);
5810 			return (ENOMEM);
5811 		}
5812 	}
5813 
5814 	/* Create the IRE. */
5815 	ire = ire_create(
5816 	    (uchar_t *)&dst_addr,		/* dest address */
5817 	    (uchar_t *)&mask,			/* mask */
5818 	    (uchar_t *)&gw_addr,		/* gateway address */
5819 	    (ushort_t)type,			/* IRE type */
5820 	    ill,
5821 	    zoneid,
5822 	    flags,
5823 	    gc,					/* security attribute */
5824 	    ipst);
5825 
5826 	/*
5827 	 * The ire holds a reference to the 'gc' and the 'gc' holds a
5828 	 * reference to the 'gcgrp'. We can now release the extra reference
5829 	 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
5830 	 */
5831 	if (gcgrp_xtraref)
5832 		GCGRP_REFRELE(gcgrp);
5833 	if (ire == NULL) {
5834 		if (gc != NULL)
5835 			GC_REFRELE(gc);
5836 		if (ipif != NULL)
5837 			ipif_refrele(ipif);
5838 		ire_refrele(gw_ire);
5839 		return (ENOMEM);
5840 	}
5841 
5842 	/* Before we add, check if an extra CGTP broadcast is needed */
5843 	cgtp_broadcast = ((flags & RTF_MULTIRT) &&
5844 	    ip_type_v4(ire->ire_addr, ipst) == IRE_BROADCAST);
5845 
5846 	/* src address assigned by the caller? */
5847 	if ((src_addr != INADDR_ANY) && (flags & RTF_SETSRC))
5848 		ire->ire_setsrc_addr = src_addr;
5849 
5850 	ire->ire_unbound = unbound;
5851 
5852 	/*
5853 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
5854 	 * SUN/OS socket stuff does but do we really want to allow 0.0.0.0?
5855 	 */
5856 
5857 	/* Add the new IRE. */
5858 	nire = ire_add(ire);
5859 	if (nire == NULL) {
5860 		/*
5861 		 * In the result of failure, ire_add() will have
5862 		 * already deleted the ire in question, so there
5863 		 * is no need to do that here.
5864 		 */
5865 		if (ipif != NULL)
5866 			ipif_refrele(ipif);
5867 		ire_refrele(gw_ire);
5868 		return (ENOMEM);
5869 	}
5870 	/*
5871 	 * Check if it was a duplicate entry. This handles
5872 	 * the case of two racing route adds for the same route
5873 	 */
5874 	if (nire != ire) {
5875 		ire_delete(nire);
5876 		ire_refrele(nire);
5877 		if (ipif != NULL)
5878 			ipif_refrele(ipif);
5879 		ire_refrele(gw_ire);
5880 		return (EEXIST);
5881 	}
5882 	ire = nire;
5883 
5884 	if (flags & RTF_MULTIRT) {
5885 		/*
5886 		 * Invoke the CGTP (multirouting) filtering module
5887 		 * to add the dst address in the filtering database.
5888 		 * Replicated inbound packets coming from that address
5889 		 * will be filtered to discard the duplicates.
5890 		 * It is not necessary to call the CGTP filter hook
5891 		 * when the dst address is a broadcast or multicast,
5892 		 * because an IP source address cannot be a broadcast
5893 		 * or a multicast.
5894 		 */
5895 		if (cgtp_broadcast) {
5896 			ip_cgtp_bcast_add(ire, ipst);
5897 			goto save_ire;
5898 		}
5899 		if (ipst->ips_ip_cgtp_filter_ops != NULL &&
5900 		    !CLASSD(ire->ire_addr)) {
5901 			int res;
5902 			ipif_t *src_ipif;
5903 
5904 			/* Find the source address corresponding to gw_ire */
5905 			src_ipif = ipif_lookup_addr(gw_ire->ire_gateway_addr,
5906 			    NULL, zoneid, ipst);
5907 			if (src_ipif != NULL) {
5908 				res = ipst->ips_ip_cgtp_filter_ops->
5909 				    cfo_add_dest_v4(
5910 				    ipst->ips_netstack->netstack_stackid,
5911 				    ire->ire_addr,
5912 				    ire->ire_gateway_addr,
5913 				    ire->ire_setsrc_addr,
5914 				    src_ipif->ipif_lcl_addr);
5915 				ipif_refrele(src_ipif);
5916 			} else {
5917 				res = EADDRNOTAVAIL;
5918 			}
5919 			if (res != 0) {
5920 				if (ipif != NULL)
5921 					ipif_refrele(ipif);
5922 				ire_refrele(gw_ire);
5923 				ire_delete(ire);
5924 				ire_refrele(ire);	/* Held in ire_add */
5925 				return (res);
5926 			}
5927 		}
5928 	}
5929 
5930 save_ire:
5931 	if (gw_ire != NULL) {
5932 		ire_refrele(gw_ire);
5933 		gw_ire = NULL;
5934 	}
5935 	if (ill != NULL) {
5936 		/*
5937 		 * Save enough information so that we can recreate the IRE if
5938 		 * the interface goes down and then up.  The metrics associated
5939 		 * with the route will be saved as well when rts_setmetrics() is
5940 		 * called after the IRE has been created.  In the case where
5941 		 * memory cannot be allocated, none of this information will be
5942 		 * saved.
5943 		 */
5944 		ill_save_ire(ill, ire);
5945 	}
5946 	if (ioctl_msg)
5947 		ip_rts_rtmsg(RTM_OLDADD, ire, 0, ipst);
5948 	if (ire_arg != NULL) {
5949 		/*
5950 		 * Store the ire that was successfully added into where ire_arg
5951 		 * points to so that callers don't have to look it up
5952 		 * themselves (but they are responsible for ire_refrele()ing
5953 		 * the ire when they are finished with it).
5954 		 */
5955 		*ire_arg = ire;
5956 	} else {
5957 		ire_refrele(ire);		/* Held in ire_add */
5958 	}
5959 	if (ipif != NULL)
5960 		ipif_refrele(ipif);
5961 	return (0);
5962 }
5963 
5964 /*
5965  * ip_rt_delete is called to delete an IPv4 route.
5966  * ill is passed in to associate it with the correct interface.
5967  */
5968 /* ARGSUSED4 */
5969 int
ip_rt_delete(ipaddr_t dst_addr,ipaddr_t mask,ipaddr_t gw_addr,uint_t rtm_addrs,int flags,ill_t * ill,boolean_t ioctl_msg,ip_stack_t * ipst,zoneid_t zoneid)5970 ip_rt_delete(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
5971     uint_t rtm_addrs, int flags, ill_t *ill, boolean_t ioctl_msg,
5972     ip_stack_t *ipst, zoneid_t zoneid)
5973 {
5974 	ire_t	*ire = NULL;
5975 	ipif_t	*ipif;
5976 	uint_t	type;
5977 	uint_t	match_flags = MATCH_IRE_TYPE;
5978 	int	err = 0;
5979 
5980 	ip1dbg(("ip_rt_delete:"));
5981 	/*
5982 	 * If this is the case of RTF_HOST being set, then we set the netmask
5983 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
5984 	 */
5985 	if (flags & RTF_HOST) {
5986 		mask = IP_HOST_MASK;
5987 		match_flags |= MATCH_IRE_MASK;
5988 	} else if (rtm_addrs & RTA_NETMASK) {
5989 		match_flags |= MATCH_IRE_MASK;
5990 	}
5991 
5992 	/*
5993 	 * Note that RTF_GATEWAY is never set on a delete, therefore
5994 	 * we check if the gateway address is one of our interfaces first,
5995 	 * and fall back on RTF_GATEWAY routes.
5996 	 *
5997 	 * This makes it possible to delete an original
5998 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
5999 	 * However, we have RTF_KERNEL set on the ones created by ipif_up
6000 	 * and those can not be deleted here.
6001 	 *
6002 	 * We use MATCH_IRE_ILL if we know the interface. If the caller
6003 	 * specified an interface (from the RTA_IFP sockaddr) we use it,
6004 	 * otherwise we use the ill derived from the gateway address.
6005 	 * We can always match the gateway address since we record it
6006 	 * in ire_gateway_addr.
6007 	 *
6008 	 * For more detail on specifying routes by gateway address and by
6009 	 * interface index, see the comments in ip_rt_add().
6010 	 */
6011 	ipif = ipif_lookup_interface(gw_addr, dst_addr, ipst);
6012 	if (ipif != NULL) {
6013 		ill_t	*ill_match;
6014 
6015 		if (ill != NULL)
6016 			ill_match = ill;
6017 		else
6018 			ill_match = ipif->ipif_ill;
6019 
6020 		match_flags |= MATCH_IRE_ILL;
6021 		if (ipif->ipif_ire_type == IRE_LOOPBACK) {
6022 			ire = ire_ftable_lookup_v4(dst_addr, mask, 0,
6023 			    IRE_LOOPBACK, ill_match, ALL_ZONES, NULL,
6024 			    match_flags, 0, ipst, NULL);
6025 		}
6026 		if (ire == NULL) {
6027 			match_flags |= MATCH_IRE_GW;
6028 			ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr,
6029 			    IRE_INTERFACE, ill_match, ALL_ZONES, NULL,
6030 			    match_flags, 0, ipst, NULL);
6031 		}
6032 		/* Avoid deleting routes created by kernel from an ipif */
6033 		if (ire != NULL && (ire->ire_flags & RTF_KERNEL)) {
6034 			ire_refrele(ire);
6035 			ire = NULL;
6036 		}
6037 
6038 		/* Restore in case we didn't find a match */
6039 		match_flags &= ~(MATCH_IRE_GW|MATCH_IRE_ILL);
6040 	}
6041 
6042 	if (ire == NULL) {
6043 		/*
6044 		 * At this point, the gateway address is not one of our own
6045 		 * addresses or a matching interface route was not found.  We
6046 		 * set the IRE type to lookup based on whether
6047 		 * this is a host route, a default route or just a prefix.
6048 		 *
6049 		 * If an ill was passed in, then the lookup is based on an
6050 		 * interface index so MATCH_IRE_ILL is added to match_flags.
6051 		 */
6052 		match_flags |= MATCH_IRE_GW;
6053 		if (ill != NULL)
6054 			match_flags |= MATCH_IRE_ILL;
6055 		if (mask == IP_HOST_MASK)
6056 			type = IRE_HOST;
6057 		else if (mask == 0)
6058 			type = IRE_DEFAULT;
6059 		else
6060 			type = IRE_PREFIX;
6061 		ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr, type, ill,
6062 		    ALL_ZONES, NULL, match_flags, 0, ipst, NULL);
6063 	}
6064 
6065 	if (ipif != NULL) {
6066 		ipif_refrele(ipif);
6067 		ipif = NULL;
6068 	}
6069 
6070 	if (ire == NULL)
6071 		return (ESRCH);
6072 
6073 	if (ire->ire_flags & RTF_MULTIRT) {
6074 		/*
6075 		 * Invoke the CGTP (multirouting) filtering module
6076 		 * to remove the dst address from the filtering database.
6077 		 * Packets coming from that address will no longer be
6078 		 * filtered to remove duplicates.
6079 		 */
6080 		if (ipst->ips_ip_cgtp_filter_ops != NULL) {
6081 			err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v4(
6082 			    ipst->ips_netstack->netstack_stackid,
6083 			    ire->ire_addr, ire->ire_gateway_addr);
6084 		}
6085 		ip_cgtp_bcast_delete(ire, ipst);
6086 	}
6087 
6088 	ill = ire->ire_ill;
6089 	if (ill != NULL)
6090 		ill_remove_saved_ire(ill, ire);
6091 	if (ioctl_msg)
6092 		ip_rts_rtmsg(RTM_OLDDEL, ire, 0, ipst);
6093 	ire_delete(ire);
6094 	ire_refrele(ire);
6095 	return (err);
6096 }
6097 
6098 /*
6099  * ip_siocaddrt is called to complete processing of an SIOCADDRT IOCTL.
6100  */
6101 /* ARGSUSED */
6102 int
ip_siocaddrt(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_if_req)6103 ip_siocaddrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
6104     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
6105 {
6106 	ipaddr_t dst_addr;
6107 	ipaddr_t gw_addr;
6108 	ipaddr_t mask;
6109 	int error = 0;
6110 	mblk_t *mp1;
6111 	struct rtentry *rt;
6112 	ipif_t *ipif = NULL;
6113 	ip_stack_t	*ipst;
6114 
6115 	ASSERT(q->q_next == NULL);
6116 	ipst = CONNQ_TO_IPST(q);
6117 
6118 	ip1dbg(("ip_siocaddrt:"));
6119 	/* Existence of mp1 verified in ip_wput_nondata */
6120 	mp1 = mp->b_cont->b_cont;
6121 	rt = (struct rtentry *)mp1->b_rptr;
6122 
6123 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
6124 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
6125 
6126 	/*
6127 	 * If the RTF_HOST flag is on, this is a request to assign a gateway
6128 	 * to a particular host address.  In this case, we set the netmask to
6129 	 * all ones for the particular destination address.  Otherwise,
6130 	 * determine the netmask to be used based on dst_addr and the interfaces
6131 	 * in use.
6132 	 */
6133 	if (rt->rt_flags & RTF_HOST) {
6134 		mask = IP_HOST_MASK;
6135 	} else {
6136 		/*
6137 		 * Note that ip_subnet_mask returns a zero mask in the case of
6138 		 * default (an all-zeroes address).
6139 		 */
6140 		mask = ip_subnet_mask(dst_addr, &ipif, ipst);
6141 	}
6142 
6143 	error = ip_rt_add(dst_addr, mask, gw_addr, 0, rt->rt_flags, NULL, NULL,
6144 	    B_TRUE, NULL, ipst, ALL_ZONES);
6145 	if (ipif != NULL)
6146 		ipif_refrele(ipif);
6147 	return (error);
6148 }
6149 
6150 /*
6151  * ip_siocdelrt is called to complete processing of an SIOCDELRT IOCTL.
6152  */
6153 /* ARGSUSED */
6154 int
ip_siocdelrt(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_if_req)6155 ip_siocdelrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
6156     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
6157 {
6158 	ipaddr_t dst_addr;
6159 	ipaddr_t gw_addr;
6160 	ipaddr_t mask;
6161 	int error;
6162 	mblk_t *mp1;
6163 	struct rtentry *rt;
6164 	ipif_t *ipif = NULL;
6165 	ip_stack_t	*ipst;
6166 
6167 	ASSERT(q->q_next == NULL);
6168 	ipst = CONNQ_TO_IPST(q);
6169 
6170 	ip1dbg(("ip_siocdelrt:"));
6171 	/* Existence of mp1 verified in ip_wput_nondata */
6172 	mp1 = mp->b_cont->b_cont;
6173 	rt = (struct rtentry *)mp1->b_rptr;
6174 
6175 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
6176 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
6177 
6178 	/*
6179 	 * If the RTF_HOST flag is on, this is a request to delete a gateway
6180 	 * to a particular host address.  In this case, we set the netmask to
6181 	 * all ones for the particular destination address.  Otherwise,
6182 	 * determine the netmask to be used based on dst_addr and the interfaces
6183 	 * in use.
6184 	 */
6185 	if (rt->rt_flags & RTF_HOST) {
6186 		mask = IP_HOST_MASK;
6187 	} else {
6188 		/*
6189 		 * Note that ip_subnet_mask returns a zero mask in the case of
6190 		 * default (an all-zeroes address).
6191 		 */
6192 		mask = ip_subnet_mask(dst_addr, &ipif, ipst);
6193 	}
6194 
6195 	error = ip_rt_delete(dst_addr, mask, gw_addr,
6196 	    RTA_DST | RTA_GATEWAY | RTA_NETMASK, rt->rt_flags, NULL, B_TRUE,
6197 	    ipst, ALL_ZONES);
6198 	if (ipif != NULL)
6199 		ipif_refrele(ipif);
6200 	return (error);
6201 }
6202 
6203 /*
6204  * Enqueue the mp onto the ipsq, chained by b_next.
6205  * b_prev stores the function to be executed later, and b_queue the queue
6206  * where this mp originated.
6207  */
6208 void
ipsq_enq(ipsq_t * ipsq,queue_t * q,mblk_t * mp,ipsq_func_t func,int type,ill_t * pending_ill)6209 ipsq_enq(ipsq_t *ipsq, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
6210     ill_t *pending_ill)
6211 {
6212 	conn_t	*connp;
6213 	ipxop_t *ipx = ipsq->ipsq_xop;
6214 
6215 	ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
6216 	ASSERT(MUTEX_HELD(&ipx->ipx_lock));
6217 	ASSERT(func != NULL);
6218 
6219 	mp->b_queue = q;
6220 	mp->b_prev = (void *)func;
6221 	mp->b_next = NULL;
6222 
6223 	switch (type) {
6224 	case CUR_OP:
6225 		if (ipx->ipx_mptail != NULL) {
6226 			ASSERT(ipx->ipx_mphead != NULL);
6227 			ipx->ipx_mptail->b_next = mp;
6228 		} else {
6229 			ASSERT(ipx->ipx_mphead == NULL);
6230 			ipx->ipx_mphead = mp;
6231 		}
6232 		ipx->ipx_mptail = mp;
6233 		break;
6234 
6235 	case NEW_OP:
6236 		if (ipsq->ipsq_xopq_mptail != NULL) {
6237 			ASSERT(ipsq->ipsq_xopq_mphead != NULL);
6238 			ipsq->ipsq_xopq_mptail->b_next = mp;
6239 		} else {
6240 			ASSERT(ipsq->ipsq_xopq_mphead == NULL);
6241 			ipsq->ipsq_xopq_mphead = mp;
6242 		}
6243 		ipsq->ipsq_xopq_mptail = mp;
6244 		ipx->ipx_ipsq_queued = B_TRUE;
6245 		break;
6246 
6247 	case SWITCH_OP:
6248 		ASSERT(ipsq->ipsq_swxop != NULL);
6249 		/* only one switch operation is currently allowed */
6250 		ASSERT(ipsq->ipsq_switch_mp == NULL);
6251 		ipsq->ipsq_switch_mp = mp;
6252 		ipx->ipx_ipsq_queued = B_TRUE;
6253 		break;
6254 	default:
6255 		cmn_err(CE_PANIC, "ipsq_enq %d type \n", type);
6256 	}
6257 
6258 	if (CONN_Q(q) && pending_ill != NULL) {
6259 		connp = Q_TO_CONN(q);
6260 		ASSERT(MUTEX_HELD(&connp->conn_lock));
6261 		connp->conn_oper_pending_ill = pending_ill;
6262 	}
6263 }
6264 
6265 /*
6266  * Dequeue the next message that requested exclusive access to this IPSQ's
6267  * xop.  Specifically:
6268  *
6269  *  1. If we're still processing the current operation on `ipsq', then
6270  *     dequeue the next message for the operation (from ipx_mphead), or
6271  *     return NULL if there are no queued messages for the operation.
6272  *     These messages are queued via CUR_OP to qwriter_ip() and friends.
6273  *
6274  *  2. If the current operation on `ipsq' has completed (ipx_current_ipif is
6275  *     not set) see if the ipsq has requested an xop switch.  If so, switch
6276  *     `ipsq' to a different xop.  Xop switches only happen when joining or
6277  *     leaving IPMP groups and require a careful dance -- see the comments
6278  *     in-line below for details.  If we're leaving a group xop or if we're
6279  *     joining a group xop and become writer on it, then we proceed to (3).
6280  *     Otherwise, we return NULL and exit the xop.
6281  *
6282  *  3. For each IPSQ in the xop, return any switch operation stored on
6283  *     ipsq_switch_mp (set via SWITCH_OP); these must be processed before
6284  *     any other messages queued on the IPSQ.  Otherwise, dequeue the next
6285  *     exclusive operation (queued via NEW_OP) stored on ipsq_xopq_mphead.
6286  *     Note that if the phyint tied to `ipsq' is not using IPMP there will
6287  *     only be one IPSQ in the xop.  Otherwise, there will be one IPSQ for
6288  *     each phyint in the group, including the IPMP meta-interface phyint.
6289  */
6290 static mblk_t *
ipsq_dq(ipsq_t * ipsq)6291 ipsq_dq(ipsq_t *ipsq)
6292 {
6293 	ill_t	*illv4, *illv6;
6294 	mblk_t	*mp;
6295 	ipsq_t	*xopipsq;
6296 	ipsq_t	*leftipsq = NULL;
6297 	ipxop_t *ipx;
6298 	phyint_t *phyi = ipsq->ipsq_phyint;
6299 	ip_stack_t *ipst = ipsq->ipsq_ipst;
6300 	boolean_t emptied = B_FALSE;
6301 
6302 	/*
6303 	 * Grab all the locks we need in the defined order (ill_g_lock ->
6304 	 * ipsq_lock -> ipx_lock); ill_g_lock is needed to use ipsq_next.
6305 	 */
6306 	rw_enter(&ipst->ips_ill_g_lock,
6307 	    ipsq->ipsq_swxop != NULL ? RW_WRITER : RW_READER);
6308 	mutex_enter(&ipsq->ipsq_lock);
6309 	ipx = ipsq->ipsq_xop;
6310 	mutex_enter(&ipx->ipx_lock);
6311 
6312 	/*
6313 	 * Dequeue the next message associated with the current exclusive
6314 	 * operation, if any.
6315 	 */
6316 	if ((mp = ipx->ipx_mphead) != NULL) {
6317 		ipx->ipx_mphead = mp->b_next;
6318 		if (ipx->ipx_mphead == NULL)
6319 			ipx->ipx_mptail = NULL;
6320 		mp->b_next = (void *)ipsq;
6321 		goto out;
6322 	}
6323 
6324 	if (ipx->ipx_current_ipif != NULL)
6325 		goto empty;
6326 
6327 	if (ipsq->ipsq_swxop != NULL) {
6328 		/*
6329 		 * The exclusive operation that is now being completed has
6330 		 * requested a switch to a different xop.  This happens
6331 		 * when an interface joins or leaves an IPMP group.  Joins
6332 		 * happen through SIOCSLIFGROUPNAME (ip_sioctl_groupname()).
6333 		 * Leaves happen via SIOCSLIFGROUPNAME, interface unplumb
6334 		 * (phyint_free()), or interface plumb for an ill type
6335 		 * not in the IPMP group (ip_rput_dlpi_writer()).
6336 		 *
6337 		 * Xop switches are not allowed on the IPMP meta-interface.
6338 		 */
6339 		ASSERT(phyi == NULL || !(phyi->phyint_flags & PHYI_IPMP));
6340 		ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
6341 		DTRACE_PROBE1(ipsq__switch, (ipsq_t *), ipsq);
6342 
6343 		if (ipsq->ipsq_swxop == &ipsq->ipsq_ownxop) {
6344 			/*
6345 			 * We're switching back to our own xop, so we have two
6346 			 * xop's to drain/exit: our own, and the group xop
6347 			 * that we are leaving.
6348 			 *
6349 			 * First, pull ourselves out of the group ipsq list.
6350 			 * This is safe since we're writer on ill_g_lock.
6351 			 */
6352 			ASSERT(ipsq->ipsq_xop != &ipsq->ipsq_ownxop);
6353 
6354 			xopipsq = ipx->ipx_ipsq;
6355 			while (xopipsq->ipsq_next != ipsq)
6356 				xopipsq = xopipsq->ipsq_next;
6357 
6358 			xopipsq->ipsq_next = ipsq->ipsq_next;
6359 			ipsq->ipsq_next = ipsq;
6360 			ipsq->ipsq_xop = ipsq->ipsq_swxop;
6361 			ipsq->ipsq_swxop = NULL;
6362 
6363 			/*
6364 			 * Second, prepare to exit the group xop.  The actual
6365 			 * ipsq_exit() is done at the end of this function
6366 			 * since we cannot hold any locks across ipsq_exit().
6367 			 * Note that although we drop the group's ipx_lock, no
6368 			 * threads can proceed since we're still ipx_writer.
6369 			 */
6370 			leftipsq = xopipsq;
6371 			mutex_exit(&ipx->ipx_lock);
6372 
6373 			/*
6374 			 * Third, set ipx to point to our own xop (which was
6375 			 * inactive and therefore can be entered).
6376 			 */
6377 			ipx = ipsq->ipsq_xop;
6378 			mutex_enter(&ipx->ipx_lock);
6379 			ASSERT(ipx->ipx_writer == NULL);
6380 			ASSERT(ipx->ipx_current_ipif == NULL);
6381 		} else {
6382 			/*
6383 			 * We're switching from our own xop to a group xop.
6384 			 * The requestor of the switch must ensure that the
6385 			 * group xop cannot go away (e.g. by ensuring the
6386 			 * phyint associated with the xop cannot go away).
6387 			 *
6388 			 * If we can become writer on our new xop, then we'll
6389 			 * do the drain.  Otherwise, the current writer of our
6390 			 * new xop will do the drain when it exits.
6391 			 *
6392 			 * First, splice ourselves into the group IPSQ list.
6393 			 * This is safe since we're writer on ill_g_lock.
6394 			 */
6395 			ASSERT(ipsq->ipsq_xop == &ipsq->ipsq_ownxop);
6396 
6397 			xopipsq = ipsq->ipsq_swxop->ipx_ipsq;
6398 			while (xopipsq->ipsq_next != ipsq->ipsq_swxop->ipx_ipsq)
6399 				xopipsq = xopipsq->ipsq_next;
6400 
6401 			xopipsq->ipsq_next = ipsq;
6402 			ipsq->ipsq_next = ipsq->ipsq_swxop->ipx_ipsq;
6403 			ipsq->ipsq_xop = ipsq->ipsq_swxop;
6404 			ipsq->ipsq_swxop = NULL;
6405 
6406 			/*
6407 			 * Second, exit our own xop, since it's now unused.
6408 			 * This is safe since we've got the only reference.
6409 			 */
6410 			ASSERT(ipx->ipx_writer == curthread);
6411 			ipx->ipx_writer = NULL;
6412 			VERIFY(--ipx->ipx_reentry_cnt == 0);
6413 			ipx->ipx_ipsq_queued = B_FALSE;
6414 			mutex_exit(&ipx->ipx_lock);
6415 
6416 			/*
6417 			 * Third, set ipx to point to our new xop, and check
6418 			 * if we can become writer on it.  If we cannot, then
6419 			 * the current writer will drain the IPSQ group when
6420 			 * it exits.  Our ipsq_xop is guaranteed to be stable
6421 			 * because we're still holding ipsq_lock.
6422 			 */
6423 			ipx = ipsq->ipsq_xop;
6424 			mutex_enter(&ipx->ipx_lock);
6425 			if (ipx->ipx_writer != NULL ||
6426 			    ipx->ipx_current_ipif != NULL) {
6427 				goto out;
6428 			}
6429 		}
6430 
6431 		/*
6432 		 * Fourth, become writer on our new ipx before we continue
6433 		 * with the drain.  Note that we never dropped ipsq_lock
6434 		 * above, so no other thread could've raced with us to
6435 		 * become writer first.  Also, we're holding ipx_lock, so
6436 		 * no other thread can examine the ipx right now.
6437 		 */
6438 		ASSERT(ipx->ipx_current_ipif == NULL);
6439 		ASSERT(ipx->ipx_mphead == NULL && ipx->ipx_mptail == NULL);
6440 		VERIFY(ipx->ipx_reentry_cnt++ == 0);
6441 		ipx->ipx_writer = curthread;
6442 		ipx->ipx_forced = B_FALSE;
6443 #ifdef DEBUG
6444 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
6445 #endif
6446 	}
6447 
6448 	xopipsq = ipsq;
6449 	do {
6450 		/*
6451 		 * So that other operations operate on a consistent and
6452 		 * complete phyint, a switch message on an IPSQ must be
6453 		 * handled prior to any other operations on that IPSQ.
6454 		 */
6455 		if ((mp = xopipsq->ipsq_switch_mp) != NULL) {
6456 			xopipsq->ipsq_switch_mp = NULL;
6457 			ASSERT(mp->b_next == NULL);
6458 			mp->b_next = (void *)xopipsq;
6459 			goto out;
6460 		}
6461 
6462 		if ((mp = xopipsq->ipsq_xopq_mphead) != NULL) {
6463 			xopipsq->ipsq_xopq_mphead = mp->b_next;
6464 			if (xopipsq->ipsq_xopq_mphead == NULL)
6465 				xopipsq->ipsq_xopq_mptail = NULL;
6466 			mp->b_next = (void *)xopipsq;
6467 			goto out;
6468 		}
6469 	} while ((xopipsq = xopipsq->ipsq_next) != ipsq);
6470 empty:
6471 	/*
6472 	 * There are no messages.  Further, we are holding ipx_lock, hence no
6473 	 * new messages can end up on any IPSQ in the xop.
6474 	 */
6475 	ipx->ipx_writer = NULL;
6476 	ipx->ipx_forced = B_FALSE;
6477 	VERIFY(--ipx->ipx_reentry_cnt == 0);
6478 	ipx->ipx_ipsq_queued = B_FALSE;
6479 	emptied = B_TRUE;
6480 #ifdef	DEBUG
6481 	ipx->ipx_depth = 0;
6482 #endif
6483 out:
6484 	mutex_exit(&ipx->ipx_lock);
6485 	mutex_exit(&ipsq->ipsq_lock);
6486 
6487 	/*
6488 	 * If we completely emptied the xop, then wake up any threads waiting
6489 	 * to enter any of the IPSQ's associated with it.
6490 	 */
6491 	if (emptied) {
6492 		xopipsq = ipsq;
6493 		do {
6494 			if ((phyi = xopipsq->ipsq_phyint) == NULL)
6495 				continue;
6496 
6497 			illv4 = phyi->phyint_illv4;
6498 			illv6 = phyi->phyint_illv6;
6499 
6500 			GRAB_ILL_LOCKS(illv4, illv6);
6501 			if (illv4 != NULL)
6502 				cv_broadcast(&illv4->ill_cv);
6503 			if (illv6 != NULL)
6504 				cv_broadcast(&illv6->ill_cv);
6505 			RELEASE_ILL_LOCKS(illv4, illv6);
6506 		} while ((xopipsq = xopipsq->ipsq_next) != ipsq);
6507 	}
6508 	rw_exit(&ipst->ips_ill_g_lock);
6509 
6510 	/*
6511 	 * Now that all locks are dropped, exit the IPSQ we left.
6512 	 */
6513 	if (leftipsq != NULL)
6514 		ipsq_exit(leftipsq);
6515 
6516 	return (mp);
6517 }
6518 
6519 /*
6520  * Return completion status of previously initiated DLPI operations on
6521  * ills in the purview of an ipsq.
6522  */
6523 static boolean_t
ipsq_dlpi_done(ipsq_t * ipsq)6524 ipsq_dlpi_done(ipsq_t *ipsq)
6525 {
6526 	ipsq_t		*ipsq_start;
6527 	phyint_t	*phyi;
6528 	ill_t		*ill;
6529 
6530 	ASSERT(RW_LOCK_HELD(&ipsq->ipsq_ipst->ips_ill_g_lock));
6531 	ipsq_start = ipsq;
6532 
6533 	do {
6534 		/*
6535 		 * The only current users of this function are ipsq_try_enter
6536 		 * and ipsq_enter which have made sure that ipsq_writer is
6537 		 * NULL before we reach here. ill_dlpi_pending is modified
6538 		 * only by an ipsq writer
6539 		 */
6540 		ASSERT(ipsq->ipsq_xop->ipx_writer == NULL);
6541 		phyi = ipsq->ipsq_phyint;
6542 		/*
6543 		 * phyi could be NULL if a phyint that is part of an
6544 		 * IPMP group is being unplumbed. A more detailed
6545 		 * comment is in ipmp_grp_update_kstats()
6546 		 */
6547 		if (phyi != NULL) {
6548 			ill = phyi->phyint_illv4;
6549 			if (ill != NULL &&
6550 			    (ill->ill_dlpi_pending != DL_PRIM_INVAL ||
6551 			    ill->ill_arl_dlpi_pending))
6552 				return (B_FALSE);
6553 
6554 			ill = phyi->phyint_illv6;
6555 			if (ill != NULL &&
6556 			    ill->ill_dlpi_pending != DL_PRIM_INVAL)
6557 				return (B_FALSE);
6558 		}
6559 
6560 	} while ((ipsq = ipsq->ipsq_next) != ipsq_start);
6561 
6562 	return (B_TRUE);
6563 }
6564 
6565 /*
6566  * Enter the ipsq corresponding to ill, by waiting synchronously till
6567  * we can enter the ipsq exclusively. Unless 'force' is used, the ipsq
6568  * will have to drain completely before ipsq_enter returns success.
6569  * ipx_current_ipif will be set if some exclusive op is in progress,
6570  * and the ipsq_exit logic will start the next enqueued op after
6571  * completion of the current op. If 'force' is used, we don't wait
6572  * for the enqueued ops. This is needed when a conn_close wants to
6573  * enter the ipsq and abort an ioctl that is somehow stuck. Unplumb
6574  * of an ill can also use this option. But we dont' use it currently.
6575  */
6576 #define	ENTER_SQ_WAIT_TICKS 100
6577 boolean_t
ipsq_enter(ill_t * ill,boolean_t force,int type)6578 ipsq_enter(ill_t *ill, boolean_t force, int type)
6579 {
6580 	ipsq_t	*ipsq;
6581 	ipxop_t *ipx;
6582 	boolean_t waited_enough = B_FALSE;
6583 	ip_stack_t *ipst = ill->ill_ipst;
6584 
6585 	/*
6586 	 * Note that the relationship between ill and ipsq is fixed as long as
6587 	 * the ill is not ILL_CONDEMNED.  Holding ipsq_lock ensures the
6588 	 * relationship between the IPSQ and xop cannot change.  However,
6589 	 * since we cannot hold ipsq_lock across the cv_wait(), it may change
6590 	 * while we're waiting.  We wait on ill_cv and rely on ipsq_exit()
6591 	 * waking up all ills in the xop when it becomes available.
6592 	 */
6593 	for (;;) {
6594 		rw_enter(&ipst->ips_ill_g_lock, RW_READER);
6595 		mutex_enter(&ill->ill_lock);
6596 		if (ill->ill_state_flags & ILL_CONDEMNED) {
6597 			mutex_exit(&ill->ill_lock);
6598 			rw_exit(&ipst->ips_ill_g_lock);
6599 			return (B_FALSE);
6600 		}
6601 
6602 		ipsq = ill->ill_phyint->phyint_ipsq;
6603 		mutex_enter(&ipsq->ipsq_lock);
6604 		ipx = ipsq->ipsq_xop;
6605 		mutex_enter(&ipx->ipx_lock);
6606 
6607 		if (ipx->ipx_writer == NULL && (type == CUR_OP ||
6608 		    (ipx->ipx_current_ipif == NULL && ipsq_dlpi_done(ipsq)) ||
6609 		    waited_enough))
6610 			break;
6611 
6612 		rw_exit(&ipst->ips_ill_g_lock);
6613 
6614 		if (!force || ipx->ipx_writer != NULL) {
6615 			mutex_exit(&ipx->ipx_lock);
6616 			mutex_exit(&ipsq->ipsq_lock);
6617 			cv_wait(&ill->ill_cv, &ill->ill_lock);
6618 		} else {
6619 			mutex_exit(&ipx->ipx_lock);
6620 			mutex_exit(&ipsq->ipsq_lock);
6621 			(void) cv_reltimedwait(&ill->ill_cv,
6622 			    &ill->ill_lock, ENTER_SQ_WAIT_TICKS, TR_CLOCK_TICK);
6623 			waited_enough = B_TRUE;
6624 		}
6625 		mutex_exit(&ill->ill_lock);
6626 	}
6627 
6628 	ASSERT(ipx->ipx_mphead == NULL && ipx->ipx_mptail == NULL);
6629 	ASSERT(ipx->ipx_reentry_cnt == 0);
6630 	ipx->ipx_writer = curthread;
6631 	ipx->ipx_forced = (ipx->ipx_current_ipif != NULL);
6632 	ipx->ipx_reentry_cnt++;
6633 #ifdef DEBUG
6634 	ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
6635 #endif
6636 	mutex_exit(&ipx->ipx_lock);
6637 	mutex_exit(&ipsq->ipsq_lock);
6638 	mutex_exit(&ill->ill_lock);
6639 	rw_exit(&ipst->ips_ill_g_lock);
6640 
6641 	return (B_TRUE);
6642 }
6643 
6644 /*
6645  * ipif_set_values() has a constraint that it cannot drop the ips_ill_g_lock
6646  * across the call to the core interface ipsq_try_enter() and hence calls this
6647  * function directly. This is explained more fully in ipif_set_values().
6648  * In order to support the above constraint, ipsq_try_enter is implemented as
6649  * a wrapper that grabs the ips_ill_g_lock and calls this function subsequently
6650  */
6651 static ipsq_t *
ipsq_try_enter_internal(ill_t * ill,queue_t * q,mblk_t * mp,ipsq_func_t func,int type,boolean_t reentry_ok)6652 ipsq_try_enter_internal(ill_t *ill, queue_t *q, mblk_t *mp, ipsq_func_t func,
6653     int type, boolean_t reentry_ok)
6654 {
6655 	ipsq_t	*ipsq;
6656 	ipxop_t	*ipx;
6657 	ip_stack_t *ipst = ill->ill_ipst;
6658 
6659 	/*
6660 	 * lock ordering:
6661 	 * ill_g_lock -> conn_lock -> ill_lock -> ipsq_lock -> ipx_lock.
6662 	 *
6663 	 * ipx of an ipsq can't change when ipsq_lock is held.
6664 	 */
6665 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
6666 	GRAB_CONN_LOCK(q);
6667 	mutex_enter(&ill->ill_lock);
6668 	ipsq = ill->ill_phyint->phyint_ipsq;
6669 	mutex_enter(&ipsq->ipsq_lock);
6670 	ipx = ipsq->ipsq_xop;
6671 	mutex_enter(&ipx->ipx_lock);
6672 
6673 	/*
6674 	 * 1. Enter the ipsq if we are already writer and reentry is ok.
6675 	 *    (Note: If the caller does not specify reentry_ok then neither
6676 	 *    'func' nor any of its callees must ever attempt to enter the ipsq
6677 	 *    again. Otherwise it can lead to an infinite loop
6678 	 * 2. Enter the ipsq if there is no current writer and this attempted
6679 	 *    entry is part of the current operation
6680 	 * 3. Enter the ipsq if there is no current writer and this is a new
6681 	 *    operation and the operation queue is empty and there is no
6682 	 *    operation currently in progress and if all previously initiated
6683 	 *    DLPI operations have completed.
6684 	 */
6685 	if ((ipx->ipx_writer == curthread && reentry_ok) ||
6686 	    (ipx->ipx_writer == NULL && (type == CUR_OP || (type == NEW_OP &&
6687 	    !ipx->ipx_ipsq_queued && ipx->ipx_current_ipif == NULL &&
6688 	    ipsq_dlpi_done(ipsq))))) {
6689 		/* Success. */
6690 		ipx->ipx_reentry_cnt++;
6691 		ipx->ipx_writer = curthread;
6692 		ipx->ipx_forced = B_FALSE;
6693 		mutex_exit(&ipx->ipx_lock);
6694 		mutex_exit(&ipsq->ipsq_lock);
6695 		mutex_exit(&ill->ill_lock);
6696 		RELEASE_CONN_LOCK(q);
6697 #ifdef DEBUG
6698 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
6699 #endif
6700 		return (ipsq);
6701 	}
6702 
6703 	if (func != NULL)
6704 		ipsq_enq(ipsq, q, mp, func, type, ill);
6705 
6706 	mutex_exit(&ipx->ipx_lock);
6707 	mutex_exit(&ipsq->ipsq_lock);
6708 	mutex_exit(&ill->ill_lock);
6709 	RELEASE_CONN_LOCK(q);
6710 	return (NULL);
6711 }
6712 
6713 /*
6714  * The ipsq_t (ipsq) is the synchronization data structure used to serialize
6715  * certain critical operations like plumbing (i.e. most set ioctls), etc.
6716  * There is one ipsq per phyint. The ipsq
6717  * serializes exclusive ioctls issued by applications on a per ipsq basis in
6718  * ipsq_xopq_mphead. It also protects against multiple threads executing in
6719  * the ipsq. Responses from the driver pertain to the current ioctl (say a
6720  * DL_BIND_ACK in response to a DL_BIND_REQ initiated as part of bringing
6721  * up the interface) and are enqueued in ipx_mphead.
6722  *
6723  * If a thread does not want to reenter the ipsq when it is already writer,
6724  * it must make sure that the specified reentry point to be called later
6725  * when the ipsq is empty, nor any code path starting from the specified reentry
6726  * point must never ever try to enter the ipsq again. Otherwise it can lead
6727  * to an infinite loop. The reentry point ip_rput_dlpi_writer is an example.
6728  * When the thread that is currently exclusive finishes, it (ipsq_exit)
6729  * dequeues the requests waiting to become exclusive in ipx_mphead and calls
6730  * the reentry point. When the list at ipx_mphead becomes empty ipsq_exit
6731  * proceeds to dequeue the next ioctl in ipsq_xopq_mphead and start the next
6732  * ioctl if the current ioctl has completed. If the current ioctl is still
6733  * in progress it simply returns. The current ioctl could be waiting for
6734  * a response from another module (the driver or could be waiting for
6735  * the ipif/ill/ire refcnts to drop to zero. In such a case the ipx_pending_mp
6736  * and ipx_pending_ipif are set. ipx_current_ipif is set throughout the
6737  * execution of the ioctl and ipsq_exit does not start the next ioctl unless
6738  * ipx_current_ipif is NULL which happens only once the ioctl is complete and
6739  * all associated DLPI operations have completed.
6740  */
6741 
6742 /*
6743  * Try to enter the IPSQ corresponding to `ipif' or `ill' exclusively (`ipif'
6744  * and `ill' cannot both be specified).  Returns a pointer to the entered IPSQ
6745  * on success, or NULL on failure.  The caller ensures ipif/ill is valid by
6746  * refholding it as necessary.  If the IPSQ cannot be entered and `func' is
6747  * non-NULL, then `func' will be called back with `q' and `mp' once the IPSQ
6748  * can be entered.  If `func' is NULL, then `q' and `mp' are ignored.
6749  */
6750 ipsq_t *
ipsq_try_enter(ipif_t * ipif,ill_t * ill,queue_t * q,mblk_t * mp,ipsq_func_t func,int type,boolean_t reentry_ok)6751 ipsq_try_enter(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
6752     ipsq_func_t func, int type, boolean_t reentry_ok)
6753 {
6754 	ip_stack_t	*ipst;
6755 	ipsq_t		*ipsq;
6756 
6757 	/* Only 1 of ipif or ill can be specified */
6758 	ASSERT((ipif != NULL) ^ (ill != NULL));
6759 
6760 	if (ipif != NULL)
6761 		ill = ipif->ipif_ill;
6762 	ipst = ill->ill_ipst;
6763 
6764 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
6765 	ipsq = ipsq_try_enter_internal(ill, q, mp, func, type, reentry_ok);
6766 	rw_exit(&ipst->ips_ill_g_lock);
6767 
6768 	return (ipsq);
6769 }
6770 
6771 /*
6772  * Try to enter the IPSQ corresponding to `ill' as writer.  The caller ensures
6773  * ill is valid by refholding it if necessary; we will refrele.  If the IPSQ
6774  * cannot be entered, the mp is queued for completion.
6775  */
6776 void
qwriter_ip(ill_t * ill,queue_t * q,mblk_t * mp,ipsq_func_t func,int type,boolean_t reentry_ok)6777 qwriter_ip(ill_t *ill, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
6778     boolean_t reentry_ok)
6779 {
6780 	ipsq_t	*ipsq;
6781 
6782 	ipsq = ipsq_try_enter(NULL, ill, q, mp, func, type, reentry_ok);
6783 
6784 	/*
6785 	 * Drop the caller's refhold on the ill.  This is safe since we either
6786 	 * entered the IPSQ (and thus are exclusive), or failed to enter the
6787 	 * IPSQ, in which case we return without accessing ill anymore.  This
6788 	 * is needed because func needs to see the correct refcount.
6789 	 * e.g. removeif can work only then.
6790 	 */
6791 	ill_refrele(ill);
6792 	if (ipsq != NULL) {
6793 		(*func)(ipsq, q, mp, NULL);
6794 		ipsq_exit(ipsq);
6795 	}
6796 }
6797 
6798 /*
6799  * Exit the specified IPSQ.  If this is the final exit on it then drain it
6800  * prior to exiting.  Caller must be writer on the specified IPSQ.
6801  */
6802 void
ipsq_exit(ipsq_t * ipsq)6803 ipsq_exit(ipsq_t *ipsq)
6804 {
6805 	mblk_t *mp;
6806 	ipsq_t *mp_ipsq;
6807 	queue_t	*q;
6808 	phyint_t *phyi;
6809 	ipsq_func_t func;
6810 
6811 	ASSERT(IAM_WRITER_IPSQ(ipsq));
6812 
6813 	ASSERT(ipsq->ipsq_xop->ipx_reentry_cnt >= 1);
6814 	if (ipsq->ipsq_xop->ipx_reentry_cnt != 1) {
6815 		ipsq->ipsq_xop->ipx_reentry_cnt--;
6816 		return;
6817 	}
6818 
6819 	for (;;) {
6820 		phyi = ipsq->ipsq_phyint;
6821 		mp = ipsq_dq(ipsq);
6822 		mp_ipsq = (mp == NULL) ? NULL : (ipsq_t *)mp->b_next;
6823 
6824 		/*
6825 		 * If we've changed to a new IPSQ, and the phyint associated
6826 		 * with the old one has gone away, free the old IPSQ.  Note
6827 		 * that this cannot happen while the IPSQ is in a group.
6828 		 */
6829 		if (mp_ipsq != ipsq && phyi == NULL) {
6830 			ASSERT(ipsq->ipsq_next == ipsq);
6831 			ASSERT(ipsq->ipsq_xop == &ipsq->ipsq_ownxop);
6832 			ipsq_delete(ipsq);
6833 		}
6834 
6835 		if (mp == NULL)
6836 			break;
6837 
6838 		q = mp->b_queue;
6839 		func = (ipsq_func_t)mp->b_prev;
6840 		ipsq = mp_ipsq;
6841 		mp->b_next = mp->b_prev = NULL;
6842 		mp->b_queue = NULL;
6843 
6844 		/*
6845 		 * If 'q' is an conn queue, it is valid, since we did a
6846 		 * a refhold on the conn at the start of the ioctl.
6847 		 * If 'q' is an ill queue, it is valid, since close of an
6848 		 * ill will clean up its IPSQ.
6849 		 */
6850 		(*func)(ipsq, q, mp, NULL);
6851 	}
6852 }
6853 
6854 /*
6855  * Used to start any igmp or mld timers that could not be started
6856  * while holding ill_mcast_lock. The timers can't be started while holding
6857  * the lock, since mld/igmp_start_timers may need to call untimeout()
6858  * which can't be done while holding the lock which the timeout handler
6859  * acquires. Otherwise
6860  * there could be a deadlock since the timeout handlers
6861  * mld_timeout_handler_per_ill/igmp_timeout_handler_per_ill also acquire
6862  * ill_mcast_lock.
6863  */
6864 void
ill_mcast_timer_start(ip_stack_t * ipst)6865 ill_mcast_timer_start(ip_stack_t *ipst)
6866 {
6867 	int		next;
6868 
6869 	mutex_enter(&ipst->ips_igmp_timer_lock);
6870 	next = ipst->ips_igmp_deferred_next;
6871 	ipst->ips_igmp_deferred_next = INFINITY;
6872 	mutex_exit(&ipst->ips_igmp_timer_lock);
6873 
6874 	if (next != INFINITY)
6875 		igmp_start_timers(next, ipst);
6876 
6877 	mutex_enter(&ipst->ips_mld_timer_lock);
6878 	next = ipst->ips_mld_deferred_next;
6879 	ipst->ips_mld_deferred_next = INFINITY;
6880 	mutex_exit(&ipst->ips_mld_timer_lock);
6881 
6882 	if (next != INFINITY)
6883 		mld_start_timers(next, ipst);
6884 }
6885 
6886 /*
6887  * Start the current exclusive operation on `ipsq'; associate it with `ipif'
6888  * and `ioccmd'.
6889  */
6890 void
ipsq_current_start(ipsq_t * ipsq,ipif_t * ipif,int ioccmd)6891 ipsq_current_start(ipsq_t *ipsq, ipif_t *ipif, int ioccmd)
6892 {
6893 	ill_t *ill = ipif->ipif_ill;
6894 	ipxop_t *ipx = ipsq->ipsq_xop;
6895 
6896 	ASSERT(IAM_WRITER_IPSQ(ipsq));
6897 	ASSERT(ipx->ipx_current_ipif == NULL);
6898 	ASSERT(ipx->ipx_current_ioctl == 0);
6899 
6900 	ipx->ipx_current_done = B_FALSE;
6901 	ipx->ipx_current_ioctl = ioccmd;
6902 	mutex_enter(&ipx->ipx_lock);
6903 	ipx->ipx_current_ipif = ipif;
6904 	mutex_exit(&ipx->ipx_lock);
6905 
6906 	/*
6907 	 * Set IPIF_CHANGING on one or more ipifs associated with the
6908 	 * current exclusive operation.  IPIF_CHANGING prevents any new
6909 	 * references to the ipif (so that the references will eventually
6910 	 * drop to zero) and also prevents any "get" operations (e.g.,
6911 	 * SIOCGLIFFLAGS) from being able to access the ipif until the
6912 	 * operation has completed and the ipif is again in a stable state.
6913 	 *
6914 	 * For ioctls, IPIF_CHANGING is set on the ipif associated with the
6915 	 * ioctl.  For internal operations (where ioccmd is zero), all ipifs
6916 	 * on the ill are marked with IPIF_CHANGING since it's unclear which
6917 	 * ipifs will be affected.
6918 	 *
6919 	 * Note that SIOCLIFREMOVEIF is a special case as it sets
6920 	 * IPIF_CONDEMNED internally after identifying the right ipif to
6921 	 * operate on.
6922 	 */
6923 	switch (ioccmd) {
6924 	case SIOCLIFREMOVEIF:
6925 		break;
6926 	case 0:
6927 		mutex_enter(&ill->ill_lock);
6928 		ipif = ipif->ipif_ill->ill_ipif;
6929 		for (; ipif != NULL; ipif = ipif->ipif_next)
6930 			ipif->ipif_state_flags |= IPIF_CHANGING;
6931 		mutex_exit(&ill->ill_lock);
6932 		break;
6933 	default:
6934 		mutex_enter(&ill->ill_lock);
6935 		ipif->ipif_state_flags |= IPIF_CHANGING;
6936 		mutex_exit(&ill->ill_lock);
6937 	}
6938 }
6939 
6940 /*
6941  * Finish the current exclusive operation on `ipsq'.  Usually, this will allow
6942  * the next exclusive operation to begin once we ipsq_exit().  However, if
6943  * pending DLPI operations remain, then we will wait for the queue to drain
6944  * before allowing the next exclusive operation to begin.  This ensures that
6945  * DLPI operations from one exclusive operation are never improperly processed
6946  * as part of a subsequent exclusive operation.
6947  */
6948 void
ipsq_current_finish(ipsq_t * ipsq)6949 ipsq_current_finish(ipsq_t *ipsq)
6950 {
6951 	ipxop_t	*ipx = ipsq->ipsq_xop;
6952 	t_uscalar_t dlpi_pending = DL_PRIM_INVAL;
6953 	ipif_t	*ipif = ipx->ipx_current_ipif;
6954 
6955 	ASSERT(IAM_WRITER_IPSQ(ipsq));
6956 
6957 	/*
6958 	 * For SIOCLIFREMOVEIF, the ipif has been already been blown away
6959 	 * (but in that case, IPIF_CHANGING will already be clear and no
6960 	 * pending DLPI messages can remain).
6961 	 */
6962 	if (ipx->ipx_current_ioctl != SIOCLIFREMOVEIF) {
6963 		ill_t *ill = ipif->ipif_ill;
6964 
6965 		mutex_enter(&ill->ill_lock);
6966 		dlpi_pending = ill->ill_dlpi_pending;
6967 		if (ipx->ipx_current_ioctl == 0) {
6968 			ipif = ill->ill_ipif;
6969 			for (; ipif != NULL; ipif = ipif->ipif_next)
6970 				ipif->ipif_state_flags &= ~IPIF_CHANGING;
6971 		} else {
6972 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
6973 		}
6974 		mutex_exit(&ill->ill_lock);
6975 	}
6976 
6977 	ASSERT(!ipx->ipx_current_done);
6978 	ipx->ipx_current_done = B_TRUE;
6979 	ipx->ipx_current_ioctl = 0;
6980 	if (dlpi_pending == DL_PRIM_INVAL) {
6981 		mutex_enter(&ipx->ipx_lock);
6982 		ipx->ipx_current_ipif = NULL;
6983 		mutex_exit(&ipx->ipx_lock);
6984 	}
6985 }
6986 
6987 /*
6988  * The ill is closing. Flush all messages on the ipsq that originated
6989  * from this ill. Usually there wont' be any messages on the ipsq_xopq_mphead
6990  * for this ill since ipsq_enter could not have entered until then.
6991  * New messages can't be queued since the CONDEMNED flag is set.
6992  */
6993 static void
ipsq_flush(ill_t * ill)6994 ipsq_flush(ill_t *ill)
6995 {
6996 	queue_t	*q;
6997 	mblk_t	*prev;
6998 	mblk_t	*mp;
6999 	mblk_t	*mp_next;
7000 	ipxop_t	*ipx = ill->ill_phyint->phyint_ipsq->ipsq_xop;
7001 
7002 	ASSERT(IAM_WRITER_ILL(ill));
7003 
7004 	/*
7005 	 * Flush any messages sent up by the driver.
7006 	 */
7007 	mutex_enter(&ipx->ipx_lock);
7008 	for (prev = NULL, mp = ipx->ipx_mphead; mp != NULL; mp = mp_next) {
7009 		mp_next = mp->b_next;
7010 		q = mp->b_queue;
7011 		if (q == ill->ill_rq || q == ill->ill_wq) {
7012 			/* dequeue mp */
7013 			if (prev == NULL)
7014 				ipx->ipx_mphead = mp->b_next;
7015 			else
7016 				prev->b_next = mp->b_next;
7017 			if (ipx->ipx_mptail == mp) {
7018 				ASSERT(mp_next == NULL);
7019 				ipx->ipx_mptail = prev;
7020 			}
7021 			inet_freemsg(mp);
7022 		} else {
7023 			prev = mp;
7024 		}
7025 	}
7026 	mutex_exit(&ipx->ipx_lock);
7027 	(void) ipsq_pending_mp_cleanup(ill, NULL);
7028 	ipsq_xopq_mp_cleanup(ill, NULL);
7029 }
7030 
7031 /*
7032  * Parse an ifreq or lifreq struct coming down ioctls and refhold
7033  * and return the associated ipif.
7034  * Return value:
7035  *	Non zero: An error has occurred. ci may not be filled out.
7036  *	zero : ci is filled out with the ioctl cmd in ci.ci_name, and
7037  *	a held ipif in ci.ci_ipif.
7038  */
7039 int
ip_extract_lifreq(queue_t * q,mblk_t * mp,const ip_ioctl_cmd_t * ipip,cmd_info_t * ci)7040 ip_extract_lifreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
7041     cmd_info_t *ci)
7042 {
7043 	char		*name;
7044 	struct ifreq    *ifr;
7045 	struct lifreq    *lifr;
7046 	ipif_t		*ipif = NULL;
7047 	ill_t		*ill;
7048 	conn_t		*connp;
7049 	boolean_t	isv6;
7050 	int		err;
7051 	mblk_t		*mp1;
7052 	zoneid_t	zoneid;
7053 	ip_stack_t	*ipst;
7054 
7055 	if (q->q_next != NULL) {
7056 		ill = (ill_t *)q->q_ptr;
7057 		isv6 = ill->ill_isv6;
7058 		connp = NULL;
7059 		zoneid = ALL_ZONES;
7060 		ipst = ill->ill_ipst;
7061 	} else {
7062 		ill = NULL;
7063 		connp = Q_TO_CONN(q);
7064 		isv6 = (connp->conn_family == AF_INET6);
7065 		zoneid = connp->conn_zoneid;
7066 		if (zoneid == GLOBAL_ZONEID) {
7067 			/* global zone can access ipifs in all zones */
7068 			zoneid = ALL_ZONES;
7069 		}
7070 		ipst = connp->conn_netstack->netstack_ip;
7071 	}
7072 
7073 	/* Has been checked in ip_wput_nondata */
7074 	mp1 = mp->b_cont->b_cont;
7075 
7076 	if (ipip->ipi_cmd_type == IF_CMD) {
7077 		/* This a old style SIOC[GS]IF* command */
7078 		ifr = (struct ifreq *)mp1->b_rptr;
7079 		/*
7080 		 * Null terminate the string to protect against buffer
7081 		 * overrun. String was generated by user code and may not
7082 		 * be trusted.
7083 		 */
7084 		ifr->ifr_name[IFNAMSIZ - 1] = '\0';
7085 		name = ifr->ifr_name;
7086 		ci->ci_sin = (sin_t *)&ifr->ifr_addr;
7087 		ci->ci_sin6 = NULL;
7088 		ci->ci_lifr = (struct lifreq *)ifr;
7089 	} else {
7090 		/* This a new style SIOC[GS]LIF* command */
7091 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
7092 		lifr = (struct lifreq *)mp1->b_rptr;
7093 		/*
7094 		 * Null terminate the string to protect against buffer
7095 		 * overrun. String was generated by user code and may not
7096 		 * be trusted.
7097 		 */
7098 		lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
7099 		name = lifr->lifr_name;
7100 		ci->ci_sin = (sin_t *)&lifr->lifr_addr;
7101 		ci->ci_sin6 = (sin6_t *)&lifr->lifr_addr;
7102 		ci->ci_lifr = lifr;
7103 	}
7104 
7105 	if (ipip->ipi_cmd == SIOCSLIFNAME) {
7106 		/*
7107 		 * The ioctl will be failed if the ioctl comes down
7108 		 * an conn stream
7109 		 */
7110 		if (ill == NULL) {
7111 			/*
7112 			 * Not an ill queue, return EINVAL same as the
7113 			 * old error code.
7114 			 */
7115 			return (ENXIO);
7116 		}
7117 		ipif = ill->ill_ipif;
7118 		ipif_refhold(ipif);
7119 	} else {
7120 		/*
7121 		 * Ensure that ioctls don't see any internal state changes
7122 		 * caused by set ioctls by deferring them if IPIF_CHANGING is
7123 		 * set.
7124 		 */
7125 		ipif = ipif_lookup_on_name_async(name, mi_strlen(name),
7126 		    isv6, zoneid, q, mp, ip_process_ioctl, &err, ipst);
7127 		if (ipif == NULL) {
7128 			if (err == EINPROGRESS)
7129 				return (err);
7130 			err = 0;	/* Ensure we don't use it below */
7131 		}
7132 	}
7133 
7134 	/*
7135 	 * Old style [GS]IFCMD does not admit IPv6 ipif
7136 	 */
7137 	if (ipif != NULL && ipif->ipif_isv6 && ipip->ipi_cmd_type == IF_CMD) {
7138 		ipif_refrele(ipif);
7139 		return (ENXIO);
7140 	}
7141 
7142 	if (ipif == NULL && ill != NULL && ill->ill_ipif != NULL &&
7143 	    name[0] == '\0') {
7144 		/*
7145 		 * Handle a or a SIOC?IF* with a null name
7146 		 * during plumb (on the ill queue before the I_PLINK).
7147 		 */
7148 		ipif = ill->ill_ipif;
7149 		ipif_refhold(ipif);
7150 	}
7151 
7152 	if (ipif == NULL)
7153 		return (ENXIO);
7154 
7155 	DTRACE_PROBE4(ipif__ioctl, char *, "ip_extract_lifreq",
7156 	    int, ipip->ipi_cmd, ill_t *, ipif->ipif_ill, ipif_t *, ipif);
7157 
7158 	ci->ci_ipif = ipif;
7159 	return (0);
7160 }
7161 
7162 /*
7163  * Return the total number of ipifs.
7164  */
7165 static uint_t
ip_get_numifs(zoneid_t zoneid,ip_stack_t * ipst)7166 ip_get_numifs(zoneid_t zoneid, ip_stack_t *ipst)
7167 {
7168 	uint_t numifs = 0;
7169 	ill_t	*ill;
7170 	ill_walk_context_t	ctx;
7171 	ipif_t	*ipif;
7172 
7173 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7174 	ill = ILL_START_WALK_V4(&ctx, ipst);
7175 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7176 		if (IS_UNDER_IPMP(ill))
7177 			continue;
7178 		for (ipif = ill->ill_ipif; ipif != NULL;
7179 		    ipif = ipif->ipif_next) {
7180 			if (ipif->ipif_zoneid == zoneid ||
7181 			    ipif->ipif_zoneid == ALL_ZONES)
7182 				numifs++;
7183 		}
7184 	}
7185 	rw_exit(&ipst->ips_ill_g_lock);
7186 	return (numifs);
7187 }
7188 
7189 /*
7190  * Return the total number of ipifs.
7191  */
7192 static uint_t
ip_get_numlifs(int family,int lifn_flags,zoneid_t zoneid,ip_stack_t * ipst)7193 ip_get_numlifs(int family, int lifn_flags, zoneid_t zoneid, ip_stack_t *ipst)
7194 {
7195 	uint_t numifs = 0;
7196 	ill_t	*ill;
7197 	ipif_t	*ipif;
7198 	ill_walk_context_t	ctx;
7199 
7200 	ip1dbg(("ip_get_numlifs(%d %u %d)\n", family, lifn_flags, (int)zoneid));
7201 
7202 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7203 	if (family == AF_INET)
7204 		ill = ILL_START_WALK_V4(&ctx, ipst);
7205 	else if (family == AF_INET6)
7206 		ill = ILL_START_WALK_V6(&ctx, ipst);
7207 	else
7208 		ill = ILL_START_WALK_ALL(&ctx, ipst);
7209 
7210 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7211 		if (IS_UNDER_IPMP(ill) && !(lifn_flags & LIFC_UNDER_IPMP))
7212 			continue;
7213 
7214 		for (ipif = ill->ill_ipif; ipif != NULL;
7215 		    ipif = ipif->ipif_next) {
7216 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
7217 			    !(lifn_flags & LIFC_NOXMIT))
7218 				continue;
7219 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
7220 			    !(lifn_flags & LIFC_TEMPORARY))
7221 				continue;
7222 			if (((ipif->ipif_flags &
7223 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
7224 			    IPIF_DEPRECATED)) ||
7225 			    IS_LOOPBACK(ill) ||
7226 			    !(ipif->ipif_flags & IPIF_UP)) &&
7227 			    (lifn_flags & LIFC_EXTERNAL_SOURCE))
7228 				continue;
7229 
7230 			if (zoneid != ipif->ipif_zoneid &&
7231 			    ipif->ipif_zoneid != ALL_ZONES &&
7232 			    (zoneid != GLOBAL_ZONEID ||
7233 			    !(lifn_flags & LIFC_ALLZONES)))
7234 				continue;
7235 
7236 			numifs++;
7237 		}
7238 	}
7239 	rw_exit(&ipst->ips_ill_g_lock);
7240 	return (numifs);
7241 }
7242 
7243 uint_t
ip_get_lifsrcofnum(ill_t * ill)7244 ip_get_lifsrcofnum(ill_t *ill)
7245 {
7246 	uint_t numifs = 0;
7247 	ill_t	*ill_head = ill;
7248 	ip_stack_t	*ipst = ill->ill_ipst;
7249 
7250 	/*
7251 	 * ill_g_usesrc_lock protects ill_usesrc_grp_next, for example, some
7252 	 * other thread may be trying to relink the ILLs in this usesrc group
7253 	 * and adjusting the ill_usesrc_grp_next pointers
7254 	 */
7255 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
7256 	if ((ill->ill_usesrc_ifindex == 0) &&
7257 	    (ill->ill_usesrc_grp_next != NULL)) {
7258 		for (; (ill != NULL) && (ill->ill_usesrc_grp_next != ill_head);
7259 		    ill = ill->ill_usesrc_grp_next)
7260 			numifs++;
7261 	}
7262 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
7263 
7264 	return (numifs);
7265 }
7266 
7267 /* Null values are passed in for ipif, sin, and ifreq */
7268 /* ARGSUSED */
7269 int
ip_sioctl_get_ifnum(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)7270 ip_sioctl_get_ifnum(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7271     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7272 {
7273 	int *nump;
7274 	conn_t *connp = Q_TO_CONN(q);
7275 
7276 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
7277 
7278 	/* Existence of b_cont->b_cont checked in ip_wput_nondata */
7279 	nump = (int *)mp->b_cont->b_cont->b_rptr;
7280 
7281 	*nump = ip_get_numifs(connp->conn_zoneid,
7282 	    connp->conn_netstack->netstack_ip);
7283 	ip1dbg(("ip_sioctl_get_ifnum numifs %d", *nump));
7284 	return (0);
7285 }
7286 
7287 /* Null values are passed in for ipif, sin, and ifreq */
7288 /* ARGSUSED */
7289 int
ip_sioctl_get_lifnum(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)7290 ip_sioctl_get_lifnum(ipif_t *dummy_ipif, sin_t *dummy_sin,
7291     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7292 {
7293 	struct lifnum *lifn;
7294 	mblk_t	*mp1;
7295 	conn_t *connp = Q_TO_CONN(q);
7296 
7297 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
7298 
7299 	/* Existence checked in ip_wput_nondata */
7300 	mp1 = mp->b_cont->b_cont;
7301 
7302 	lifn = (struct lifnum *)mp1->b_rptr;
7303 	switch (lifn->lifn_family) {
7304 	case AF_UNSPEC:
7305 	case AF_INET:
7306 	case AF_INET6:
7307 		break;
7308 	default:
7309 		return (EAFNOSUPPORT);
7310 	}
7311 
7312 	lifn->lifn_count = ip_get_numlifs(lifn->lifn_family, lifn->lifn_flags,
7313 	    connp->conn_zoneid, connp->conn_netstack->netstack_ip);
7314 	ip1dbg(("ip_sioctl_get_lifnum numifs %d", lifn->lifn_count));
7315 	return (0);
7316 }
7317 
7318 /* ARGSUSED */
7319 int
ip_sioctl_get_ifconf(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)7320 ip_sioctl_get_ifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7321     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7322 {
7323 	STRUCT_HANDLE(ifconf, ifc);
7324 	mblk_t *mp1;
7325 	struct iocblk *iocp;
7326 	struct ifreq *ifr;
7327 	ill_walk_context_t	ctx;
7328 	ill_t	*ill;
7329 	ipif_t	*ipif;
7330 	struct sockaddr_in *sin;
7331 	int32_t	ifclen;
7332 	zoneid_t zoneid;
7333 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
7334 
7335 	ASSERT(q->q_next == NULL); /* not valid ioctls for ip as a module */
7336 
7337 	ip1dbg(("ip_sioctl_get_ifconf"));
7338 	/* Existence verified in ip_wput_nondata */
7339 	mp1 = mp->b_cont->b_cont;
7340 	iocp = (struct iocblk *)mp->b_rptr;
7341 	zoneid = Q_TO_CONN(q)->conn_zoneid;
7342 
7343 	/*
7344 	 * The original SIOCGIFCONF passed in a struct ifconf which specified
7345 	 * the user buffer address and length into which the list of struct
7346 	 * ifreqs was to be copied.  Since AT&T Streams does not seem to
7347 	 * allow M_COPYOUT to be used in conjunction with I_STR IOCTLS,
7348 	 * the SIOCGIFCONF operation was redefined to simply provide
7349 	 * a large output buffer into which we are supposed to jam the ifreq
7350 	 * array.  The same ioctl command code was used, despite the fact that
7351 	 * both the applications and the kernel code had to change, thus making
7352 	 * it impossible to support both interfaces.
7353 	 *
7354 	 * For reasons not good enough to try to explain, the following
7355 	 * algorithm is used for deciding what to do with one of these:
7356 	 * If the IOCTL comes in as an I_STR, it is assumed to be of the new
7357 	 * form with the output buffer coming down as the continuation message.
7358 	 * If it arrives as a TRANSPARENT IOCTL, it is assumed to be old style,
7359 	 * and we have to copy in the ifconf structure to find out how big the
7360 	 * output buffer is and where to copy out to.  Sure no problem...
7361 	 *
7362 	 */
7363 	STRUCT_SET_HANDLE(ifc, iocp->ioc_flag, NULL);
7364 	if ((mp1->b_wptr - mp1->b_rptr) == STRUCT_SIZE(ifc)) {
7365 		int numifs = 0;
7366 		size_t ifc_bufsize;
7367 
7368 		/*
7369 		 * Must be (better be!) continuation of a TRANSPARENT
7370 		 * IOCTL.  We just copied in the ifconf structure.
7371 		 */
7372 		STRUCT_SET_HANDLE(ifc, iocp->ioc_flag,
7373 		    (struct ifconf *)mp1->b_rptr);
7374 
7375 		/*
7376 		 * Allocate a buffer to hold requested information.
7377 		 *
7378 		 * If ifc_len is larger than what is needed, we only
7379 		 * allocate what we will use.
7380 		 *
7381 		 * If ifc_len is smaller than what is needed, return
7382 		 * EINVAL.
7383 		 *
7384 		 * XXX: the ill_t structure can hava 2 counters, for
7385 		 * v4 and v6 (not just ill_ipif_up_count) to store the
7386 		 * number of interfaces for a device, so we don't need
7387 		 * to count them here...
7388 		 */
7389 		numifs = ip_get_numifs(zoneid, ipst);
7390 
7391 		ifclen = STRUCT_FGET(ifc, ifc_len);
7392 		ifc_bufsize = numifs * sizeof (struct ifreq);
7393 		if (ifc_bufsize > ifclen) {
7394 			if (iocp->ioc_cmd == O_SIOCGIFCONF) {
7395 				/* old behaviour */
7396 				return (EINVAL);
7397 			} else {
7398 				ifc_bufsize = ifclen;
7399 			}
7400 		}
7401 
7402 		mp1 = mi_copyout_alloc(q, mp,
7403 		    STRUCT_FGETP(ifc, ifc_buf), ifc_bufsize, B_FALSE);
7404 		if (mp1 == NULL)
7405 			return (ENOMEM);
7406 
7407 		mp1->b_wptr = mp1->b_rptr + ifc_bufsize;
7408 	}
7409 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
7410 	/*
7411 	 * the SIOCGIFCONF ioctl only knows about
7412 	 * IPv4 addresses, so don't try to tell
7413 	 * it about interfaces with IPv6-only
7414 	 * addresses. (Last parm 'isv6' is B_FALSE)
7415 	 */
7416 
7417 	ifr = (struct ifreq *)mp1->b_rptr;
7418 
7419 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7420 	ill = ILL_START_WALK_V4(&ctx, ipst);
7421 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7422 		if (IS_UNDER_IPMP(ill))
7423 			continue;
7424 		for (ipif = ill->ill_ipif; ipif != NULL;
7425 		    ipif = ipif->ipif_next) {
7426 			if (zoneid != ipif->ipif_zoneid &&
7427 			    ipif->ipif_zoneid != ALL_ZONES)
7428 				continue;
7429 			if ((uchar_t *)&ifr[1] > mp1->b_wptr) {
7430 				if (iocp->ioc_cmd == O_SIOCGIFCONF) {
7431 					/* old behaviour */
7432 					rw_exit(&ipst->ips_ill_g_lock);
7433 					return (EINVAL);
7434 				} else {
7435 					goto if_copydone;
7436 				}
7437 			}
7438 			ipif_get_name(ipif, ifr->ifr_name,
7439 			    sizeof (ifr->ifr_name));
7440 			sin = (sin_t *)&ifr->ifr_addr;
7441 			*sin = sin_null;
7442 			sin->sin_family = AF_INET;
7443 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
7444 			ifr++;
7445 		}
7446 	}
7447 if_copydone:
7448 	rw_exit(&ipst->ips_ill_g_lock);
7449 	mp1->b_wptr = (uchar_t *)ifr;
7450 
7451 	if (STRUCT_BUF(ifc) != NULL) {
7452 		STRUCT_FSET(ifc, ifc_len,
7453 		    (int)((uchar_t *)ifr - mp1->b_rptr));
7454 	}
7455 	return (0);
7456 }
7457 
7458 /*
7459  * Get the interfaces using the address hosted on the interface passed in,
7460  * as a source adddress
7461  */
7462 /* ARGSUSED */
7463 int
ip_sioctl_get_lifsrcof(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)7464 ip_sioctl_get_lifsrcof(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7465     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7466 {
7467 	mblk_t *mp1;
7468 	ill_t	*ill, *ill_head;
7469 	ipif_t	*ipif, *orig_ipif;
7470 	int	numlifs = 0;
7471 	size_t	lifs_bufsize, lifsmaxlen;
7472 	struct	lifreq *lifr;
7473 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7474 	uint_t	ifindex;
7475 	zoneid_t zoneid;
7476 	boolean_t isv6 = B_FALSE;
7477 	struct	sockaddr_in	*sin;
7478 	struct	sockaddr_in6	*sin6;
7479 	STRUCT_HANDLE(lifsrcof, lifs);
7480 	ip_stack_t		*ipst;
7481 
7482 	ipst = CONNQ_TO_IPST(q);
7483 
7484 	ASSERT(q->q_next == NULL);
7485 
7486 	zoneid = Q_TO_CONN(q)->conn_zoneid;
7487 
7488 	/* Existence verified in ip_wput_nondata */
7489 	mp1 = mp->b_cont->b_cont;
7490 
7491 	/*
7492 	 * Must be (better be!) continuation of a TRANSPARENT
7493 	 * IOCTL.  We just copied in the lifsrcof structure.
7494 	 */
7495 	STRUCT_SET_HANDLE(lifs, iocp->ioc_flag,
7496 	    (struct lifsrcof *)mp1->b_rptr);
7497 
7498 	if (MBLKL(mp1) != STRUCT_SIZE(lifs))
7499 		return (EINVAL);
7500 
7501 	ifindex = STRUCT_FGET(lifs, lifs_ifindex);
7502 	isv6 = (Q_TO_CONN(q))->conn_family == AF_INET6;
7503 	ipif = ipif_lookup_on_ifindex(ifindex, isv6, zoneid, ipst);
7504 	if (ipif == NULL) {
7505 		ip1dbg(("ip_sioctl_get_lifsrcof: no ipif for ifindex %d\n",
7506 		    ifindex));
7507 		return (ENXIO);
7508 	}
7509 
7510 	/* Allocate a buffer to hold requested information */
7511 	numlifs = ip_get_lifsrcofnum(ipif->ipif_ill);
7512 	lifs_bufsize = numlifs * sizeof (struct lifreq);
7513 	lifsmaxlen =  STRUCT_FGET(lifs, lifs_maxlen);
7514 	/* The actual size needed is always returned in lifs_len */
7515 	STRUCT_FSET(lifs, lifs_len, lifs_bufsize);
7516 
7517 	/* If the amount we need is more than what is passed in, abort */
7518 	if (lifs_bufsize > lifsmaxlen || lifs_bufsize == 0) {
7519 		ipif_refrele(ipif);
7520 		return (0);
7521 	}
7522 
7523 	mp1 = mi_copyout_alloc(q, mp,
7524 	    STRUCT_FGETP(lifs, lifs_buf), lifs_bufsize, B_FALSE);
7525 	if (mp1 == NULL) {
7526 		ipif_refrele(ipif);
7527 		return (ENOMEM);
7528 	}
7529 
7530 	mp1->b_wptr = mp1->b_rptr + lifs_bufsize;
7531 	bzero(mp1->b_rptr, lifs_bufsize);
7532 
7533 	lifr = (struct lifreq *)mp1->b_rptr;
7534 
7535 	ill = ill_head = ipif->ipif_ill;
7536 	orig_ipif = ipif;
7537 
7538 	/* ill_g_usesrc_lock protects ill_usesrc_grp_next */
7539 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
7540 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7541 
7542 	ill = ill->ill_usesrc_grp_next; /* start from next ill */
7543 	for (; (ill != NULL) && (ill != ill_head);
7544 	    ill = ill->ill_usesrc_grp_next) {
7545 
7546 		if ((uchar_t *)&lifr[1] > mp1->b_wptr)
7547 			break;
7548 
7549 		ipif = ill->ill_ipif;
7550 		ipif_get_name(ipif, lifr->lifr_name, sizeof (lifr->lifr_name));
7551 		if (ipif->ipif_isv6) {
7552 			sin6 = (sin6_t *)&lifr->lifr_addr;
7553 			*sin6 = sin6_null;
7554 			sin6->sin6_family = AF_INET6;
7555 			sin6->sin6_addr = ipif->ipif_v6lcl_addr;
7556 			lifr->lifr_addrlen = ip_mask_to_plen_v6(
7557 			    &ipif->ipif_v6net_mask);
7558 		} else {
7559 			sin = (sin_t *)&lifr->lifr_addr;
7560 			*sin = sin_null;
7561 			sin->sin_family = AF_INET;
7562 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
7563 			lifr->lifr_addrlen = ip_mask_to_plen(
7564 			    ipif->ipif_net_mask);
7565 		}
7566 		lifr++;
7567 	}
7568 	rw_exit(&ipst->ips_ill_g_lock);
7569 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
7570 	ipif_refrele(orig_ipif);
7571 	mp1->b_wptr = (uchar_t *)lifr;
7572 	STRUCT_FSET(lifs, lifs_len, (int)((uchar_t *)lifr - mp1->b_rptr));
7573 
7574 	return (0);
7575 }
7576 
7577 /* ARGSUSED */
7578 int
ip_sioctl_get_lifconf(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)7579 ip_sioctl_get_lifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7580     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7581 {
7582 	mblk_t *mp1;
7583 	int	list;
7584 	ill_t	*ill;
7585 	ipif_t	*ipif;
7586 	int	flags;
7587 	int	numlifs = 0;
7588 	size_t	lifc_bufsize;
7589 	struct	lifreq *lifr;
7590 	sa_family_t	family;
7591 	struct	sockaddr_in	*sin;
7592 	struct	sockaddr_in6	*sin6;
7593 	ill_walk_context_t	ctx;
7594 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7595 	int32_t	lifclen;
7596 	zoneid_t zoneid;
7597 	STRUCT_HANDLE(lifconf, lifc);
7598 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
7599 
7600 	ip1dbg(("ip_sioctl_get_lifconf"));
7601 
7602 	ASSERT(q->q_next == NULL);
7603 
7604 	zoneid = Q_TO_CONN(q)->conn_zoneid;
7605 
7606 	/* Existence verified in ip_wput_nondata */
7607 	mp1 = mp->b_cont->b_cont;
7608 
7609 	/*
7610 	 * An extended version of SIOCGIFCONF that takes an
7611 	 * additional address family and flags field.
7612 	 * AF_UNSPEC retrieve both IPv4 and IPv6.
7613 	 * Unless LIFC_NOXMIT is specified the IPIF_NOXMIT
7614 	 * interfaces are omitted.
7615 	 * Similarly, IPIF_TEMPORARY interfaces are omitted
7616 	 * unless LIFC_TEMPORARY is specified.
7617 	 * If LIFC_EXTERNAL_SOURCE is specified, IPIF_NOXMIT,
7618 	 * IPIF_NOLOCAL, PHYI_LOOPBACK, IPIF_DEPRECATED and
7619 	 * not IPIF_UP interfaces are omitted. LIFC_EXTERNAL_SOURCE
7620 	 * has priority over LIFC_NOXMIT.
7621 	 */
7622 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, NULL);
7623 
7624 	if ((mp1->b_wptr - mp1->b_rptr) != STRUCT_SIZE(lifc))
7625 		return (EINVAL);
7626 
7627 	/*
7628 	 * Must be (better be!) continuation of a TRANSPARENT
7629 	 * IOCTL.  We just copied in the lifconf structure.
7630 	 */
7631 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, (struct lifconf *)mp1->b_rptr);
7632 
7633 	family = STRUCT_FGET(lifc, lifc_family);
7634 	flags = STRUCT_FGET(lifc, lifc_flags);
7635 
7636 	switch (family) {
7637 	case AF_UNSPEC:
7638 		/*
7639 		 * walk all ILL's.
7640 		 */
7641 		list = MAX_G_HEADS;
7642 		break;
7643 	case AF_INET:
7644 		/*
7645 		 * walk only IPV4 ILL's.
7646 		 */
7647 		list = IP_V4_G_HEAD;
7648 		break;
7649 	case AF_INET6:
7650 		/*
7651 		 * walk only IPV6 ILL's.
7652 		 */
7653 		list = IP_V6_G_HEAD;
7654 		break;
7655 	default:
7656 		return (EAFNOSUPPORT);
7657 	}
7658 
7659 	/*
7660 	 * Allocate a buffer to hold requested information.
7661 	 *
7662 	 * If lifc_len is larger than what is needed, we only
7663 	 * allocate what we will use.
7664 	 *
7665 	 * If lifc_len is smaller than what is needed, return
7666 	 * EINVAL.
7667 	 */
7668 	numlifs = ip_get_numlifs(family, flags, zoneid, ipst);
7669 	lifc_bufsize = numlifs * sizeof (struct lifreq);
7670 	lifclen = STRUCT_FGET(lifc, lifc_len);
7671 	if (lifc_bufsize > lifclen) {
7672 		if (iocp->ioc_cmd == O_SIOCGLIFCONF)
7673 			return (EINVAL);
7674 		else
7675 			lifc_bufsize = lifclen;
7676 	}
7677 
7678 	mp1 = mi_copyout_alloc(q, mp,
7679 	    STRUCT_FGETP(lifc, lifc_buf), lifc_bufsize, B_FALSE);
7680 	if (mp1 == NULL)
7681 		return (ENOMEM);
7682 
7683 	mp1->b_wptr = mp1->b_rptr + lifc_bufsize;
7684 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
7685 
7686 	lifr = (struct lifreq *)mp1->b_rptr;
7687 
7688 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7689 	ill = ill_first(list, list, &ctx, ipst);
7690 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7691 		if (IS_UNDER_IPMP(ill) && !(flags & LIFC_UNDER_IPMP))
7692 			continue;
7693 
7694 		for (ipif = ill->ill_ipif; ipif != NULL;
7695 		    ipif = ipif->ipif_next) {
7696 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
7697 			    !(flags & LIFC_NOXMIT))
7698 				continue;
7699 
7700 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
7701 			    !(flags & LIFC_TEMPORARY))
7702 				continue;
7703 
7704 			if (((ipif->ipif_flags &
7705 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
7706 			    IPIF_DEPRECATED)) ||
7707 			    IS_LOOPBACK(ill) ||
7708 			    !(ipif->ipif_flags & IPIF_UP)) &&
7709 			    (flags & LIFC_EXTERNAL_SOURCE))
7710 				continue;
7711 
7712 			if (zoneid != ipif->ipif_zoneid &&
7713 			    ipif->ipif_zoneid != ALL_ZONES &&
7714 			    (zoneid != GLOBAL_ZONEID ||
7715 			    !(flags & LIFC_ALLZONES)))
7716 				continue;
7717 
7718 			if ((uchar_t *)&lifr[1] > mp1->b_wptr) {
7719 				if (iocp->ioc_cmd == O_SIOCGLIFCONF) {
7720 					rw_exit(&ipst->ips_ill_g_lock);
7721 					return (EINVAL);
7722 				} else {
7723 					goto lif_copydone;
7724 				}
7725 			}
7726 
7727 			ipif_get_name(ipif, lifr->lifr_name,
7728 			    sizeof (lifr->lifr_name));
7729 			lifr->lifr_type = ill->ill_type;
7730 			if (ipif->ipif_isv6) {
7731 				sin6 = (sin6_t *)&lifr->lifr_addr;
7732 				*sin6 = sin6_null;
7733 				sin6->sin6_family = AF_INET6;
7734 				sin6->sin6_addr =
7735 				    ipif->ipif_v6lcl_addr;
7736 				lifr->lifr_addrlen =
7737 				    ip_mask_to_plen_v6(
7738 				    &ipif->ipif_v6net_mask);
7739 			} else {
7740 				sin = (sin_t *)&lifr->lifr_addr;
7741 				*sin = sin_null;
7742 				sin->sin_family = AF_INET;
7743 				sin->sin_addr.s_addr =
7744 				    ipif->ipif_lcl_addr;
7745 				lifr->lifr_addrlen =
7746 				    ip_mask_to_plen(
7747 				    ipif->ipif_net_mask);
7748 			}
7749 			lifr++;
7750 		}
7751 	}
7752 lif_copydone:
7753 	rw_exit(&ipst->ips_ill_g_lock);
7754 
7755 	mp1->b_wptr = (uchar_t *)lifr;
7756 	if (STRUCT_BUF(lifc) != NULL) {
7757 		STRUCT_FSET(lifc, lifc_len,
7758 		    (int)((uchar_t *)lifr - mp1->b_rptr));
7759 	}
7760 	return (0);
7761 }
7762 
7763 static void
ip_sioctl_ip6addrpolicy(queue_t * q,mblk_t * mp)7764 ip_sioctl_ip6addrpolicy(queue_t *q, mblk_t *mp)
7765 {
7766 	ip6_asp_t *table;
7767 	size_t table_size;
7768 	mblk_t *data_mp;
7769 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7770 	ip_stack_t	*ipst;
7771 
7772 	if (q->q_next == NULL)
7773 		ipst = CONNQ_TO_IPST(q);
7774 	else
7775 		ipst = ILLQ_TO_IPST(q);
7776 
7777 	/* These two ioctls are I_STR only */
7778 	if (iocp->ioc_count == TRANSPARENT) {
7779 		miocnak(q, mp, 0, EINVAL);
7780 		return;
7781 	}
7782 
7783 	data_mp = mp->b_cont;
7784 	if (data_mp == NULL) {
7785 		/* The user passed us a NULL argument */
7786 		table = NULL;
7787 		table_size = iocp->ioc_count;
7788 	} else {
7789 		/*
7790 		 * The user provided a table.  The stream head
7791 		 * may have copied in the user data in chunks,
7792 		 * so make sure everything is pulled up
7793 		 * properly.
7794 		 */
7795 		if (MBLKL(data_mp) < iocp->ioc_count) {
7796 			mblk_t *new_data_mp;
7797 			if ((new_data_mp = msgpullup(data_mp, -1)) ==
7798 			    NULL) {
7799 				miocnak(q, mp, 0, ENOMEM);
7800 				return;
7801 			}
7802 			freemsg(data_mp);
7803 			data_mp = new_data_mp;
7804 			mp->b_cont = data_mp;
7805 		}
7806 		table = (ip6_asp_t *)data_mp->b_rptr;
7807 		table_size = iocp->ioc_count;
7808 	}
7809 
7810 	switch (iocp->ioc_cmd) {
7811 	case SIOCGIP6ADDRPOLICY:
7812 		iocp->ioc_rval = ip6_asp_get(table, table_size, ipst);
7813 		if (iocp->ioc_rval == -1)
7814 			iocp->ioc_error = EINVAL;
7815 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
7816 		else if (table != NULL &&
7817 		    (iocp->ioc_flag & IOC_MODELS) == IOC_ILP32) {
7818 			ip6_asp_t *src = table;
7819 			ip6_asp32_t *dst = (void *)table;
7820 			int count = table_size / sizeof (ip6_asp_t);
7821 			int i;
7822 
7823 			/*
7824 			 * We need to do an in-place shrink of the array
7825 			 * to match the alignment attributes of the
7826 			 * 32-bit ABI looking at it.
7827 			 */
7828 			/* LINTED: logical expression always true: op "||" */
7829 			ASSERT(sizeof (*src) > sizeof (*dst));
7830 			for (i = 1; i < count; i++)
7831 				bcopy(src + i, dst + i, sizeof (*dst));
7832 		}
7833 #endif
7834 		break;
7835 
7836 	case SIOCSIP6ADDRPOLICY:
7837 		ASSERT(mp->b_prev == NULL);
7838 		mp->b_prev = (void *)q;
7839 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
7840 		/*
7841 		 * We pass in the datamodel here so that the ip6_asp_replace()
7842 		 * routine can handle converting from 32-bit to native formats
7843 		 * where necessary.
7844 		 *
7845 		 * A better way to handle this might be to convert the inbound
7846 		 * data structure here, and hang it off a new 'mp'; thus the
7847 		 * ip6_asp_replace() logic would always be dealing with native
7848 		 * format data structures..
7849 		 *
7850 		 * (An even simpler way to handle these ioctls is to just
7851 		 * add a 32-bit trailing 'pad' field to the ip6_asp_t structure
7852 		 * and just recompile everything that depends on it.)
7853 		 */
7854 #endif
7855 		ip6_asp_replace(mp, table, table_size, B_FALSE, ipst,
7856 		    iocp->ioc_flag & IOC_MODELS);
7857 		return;
7858 	}
7859 
7860 	DB_TYPE(mp) =  (iocp->ioc_error == 0) ? M_IOCACK : M_IOCNAK;
7861 	qreply(q, mp);
7862 }
7863 
7864 static void
ip_sioctl_dstinfo(queue_t * q,mblk_t * mp)7865 ip_sioctl_dstinfo(queue_t *q, mblk_t *mp)
7866 {
7867 	mblk_t 		*data_mp;
7868 	struct dstinforeq	*dir;
7869 	uint8_t		*end, *cur;
7870 	in6_addr_t	*daddr, *saddr;
7871 	ipaddr_t	v4daddr;
7872 	ire_t		*ire;
7873 	ipaddr_t	v4setsrc;
7874 	in6_addr_t	v6setsrc;
7875 	char		*slabel, *dlabel;
7876 	boolean_t	isipv4;
7877 	int		match_ire;
7878 	ill_t		*dst_ill;
7879 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7880 	conn_t		*connp = Q_TO_CONN(q);
7881 	zoneid_t	zoneid = IPCL_ZONEID(connp);
7882 	ip_stack_t	*ipst = connp->conn_netstack->netstack_ip;
7883 	uint64_t	ipif_flags;
7884 
7885 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
7886 
7887 	/*
7888 	 * This ioctl is I_STR only, and must have a
7889 	 * data mblk following the M_IOCTL mblk.
7890 	 */
7891 	data_mp = mp->b_cont;
7892 	if (iocp->ioc_count == TRANSPARENT || data_mp == NULL) {
7893 		miocnak(q, mp, 0, EINVAL);
7894 		return;
7895 	}
7896 
7897 	if (MBLKL(data_mp) < iocp->ioc_count) {
7898 		mblk_t *new_data_mp;
7899 
7900 		if ((new_data_mp = msgpullup(data_mp, -1)) == NULL) {
7901 			miocnak(q, mp, 0, ENOMEM);
7902 			return;
7903 		}
7904 		freemsg(data_mp);
7905 		data_mp = new_data_mp;
7906 		mp->b_cont = data_mp;
7907 	}
7908 	match_ire = MATCH_IRE_DSTONLY;
7909 
7910 	for (cur = data_mp->b_rptr, end = data_mp->b_wptr;
7911 	    end - cur >= sizeof (struct dstinforeq);
7912 	    cur += sizeof (struct dstinforeq)) {
7913 		dir = (struct dstinforeq *)cur;
7914 		daddr = &dir->dir_daddr;
7915 		saddr = &dir->dir_saddr;
7916 
7917 		/*
7918 		 * ip_addr_scope_v6() and ip6_asp_lookup() handle
7919 		 * v4 mapped addresses; ire_ftable_lookup_v6()
7920 		 * and ip_select_source_v6() do not.
7921 		 */
7922 		dir->dir_dscope = ip_addr_scope_v6(daddr);
7923 		dlabel = ip6_asp_lookup(daddr, &dir->dir_precedence, ipst);
7924 
7925 		isipv4 = IN6_IS_ADDR_V4MAPPED(daddr);
7926 		if (isipv4) {
7927 			IN6_V4MAPPED_TO_IPADDR(daddr, v4daddr);
7928 			v4setsrc = INADDR_ANY;
7929 			ire = ire_route_recursive_v4(v4daddr, 0, NULL, zoneid,
7930 			    NULL, match_ire, IRR_ALLOCATE, 0, ipst, &v4setsrc,
7931 			    NULL, NULL);
7932 		} else {
7933 			v6setsrc = ipv6_all_zeros;
7934 			ire = ire_route_recursive_v6(daddr, 0, NULL, zoneid,
7935 			    NULL, match_ire, IRR_ALLOCATE, 0, ipst, &v6setsrc,
7936 			    NULL, NULL);
7937 		}
7938 		ASSERT(ire != NULL);
7939 		if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
7940 			ire_refrele(ire);
7941 			dir->dir_dreachable = 0;
7942 
7943 			/* move on to next dst addr */
7944 			continue;
7945 		}
7946 		dir->dir_dreachable = 1;
7947 
7948 		dst_ill = ire_nexthop_ill(ire);
7949 		if (dst_ill == NULL) {
7950 			ire_refrele(ire);
7951 			continue;
7952 		}
7953 
7954 		/* With ipmp we most likely look at the ipmp ill here */
7955 		dir->dir_dmactype = dst_ill->ill_mactype;
7956 
7957 		if (isipv4) {
7958 			ipaddr_t v4saddr;
7959 
7960 			if (ip_select_source_v4(dst_ill, v4setsrc, v4daddr,
7961 			    connp->conn_ixa->ixa_multicast_ifaddr, zoneid, ipst,
7962 			    &v4saddr, NULL, &ipif_flags) != 0) {
7963 				v4saddr = INADDR_ANY;
7964 				ipif_flags = 0;
7965 			}
7966 			IN6_IPADDR_TO_V4MAPPED(v4saddr, saddr);
7967 		} else {
7968 			if (ip_select_source_v6(dst_ill, &v6setsrc, daddr,
7969 			    zoneid, ipst, B_FALSE, IPV6_PREFER_SRC_DEFAULT,
7970 			    saddr, NULL, &ipif_flags) != 0) {
7971 				*saddr = ipv6_all_zeros;
7972 				ipif_flags = 0;
7973 			}
7974 		}
7975 
7976 		dir->dir_sscope = ip_addr_scope_v6(saddr);
7977 		slabel = ip6_asp_lookup(saddr, NULL, ipst);
7978 		dir->dir_labelmatch = ip6_asp_labelcmp(dlabel, slabel);
7979 		dir->dir_sdeprecated = (ipif_flags & IPIF_DEPRECATED) ? 1 : 0;
7980 		ire_refrele(ire);
7981 		ill_refrele(dst_ill);
7982 	}
7983 	miocack(q, mp, iocp->ioc_count, 0);
7984 }
7985 
7986 /*
7987  * Check if this is an address assigned to this machine.
7988  * Skips interfaces that are down by using ire checks.
7989  * Translates mapped addresses to v4 addresses and then
7990  * treats them as such, returning true if the v4 address
7991  * associated with this mapped address is configured.
7992  * Note: Applications will have to be careful what they do
7993  * with the response; use of mapped addresses limits
7994  * what can be done with the socket, especially with
7995  * respect to socket options and ioctls - neither IPv4
7996  * options nor IPv6 sticky options/ancillary data options
7997  * may be used.
7998  */
7999 /* ARGSUSED */
8000 int
ip_sioctl_tmyaddr(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_ifreq)8001 ip_sioctl_tmyaddr(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8002     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
8003 {
8004 	struct sioc_addrreq *sia;
8005 	sin_t *sin;
8006 	ire_t *ire;
8007 	mblk_t *mp1;
8008 	zoneid_t zoneid;
8009 	ip_stack_t	*ipst;
8010 
8011 	ip1dbg(("ip_sioctl_tmyaddr"));
8012 
8013 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8014 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8015 	ipst = CONNQ_TO_IPST(q);
8016 
8017 	/* Existence verified in ip_wput_nondata */
8018 	mp1 = mp->b_cont->b_cont;
8019 	sia = (struct sioc_addrreq *)mp1->b_rptr;
8020 	sin = (sin_t *)&sia->sa_addr;
8021 	switch (sin->sin_family) {
8022 	case AF_INET6: {
8023 		sin6_t *sin6 = (sin6_t *)sin;
8024 
8025 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
8026 			ipaddr_t v4_addr;
8027 
8028 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
8029 			    v4_addr);
8030 			ire = ire_ftable_lookup_v4(v4_addr, 0, 0,
8031 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid, NULL,
8032 			    MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, 0, ipst, NULL);
8033 		} else {
8034 			in6_addr_t v6addr;
8035 
8036 			v6addr = sin6->sin6_addr;
8037 			ire = ire_ftable_lookup_v6(&v6addr, 0, 0,
8038 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid, NULL,
8039 			    MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, 0, ipst, NULL);
8040 		}
8041 		break;
8042 	}
8043 	case AF_INET: {
8044 		ipaddr_t v4addr;
8045 
8046 		v4addr = sin->sin_addr.s_addr;
8047 		ire = ire_ftable_lookup_v4(v4addr, 0, 0,
8048 		    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
8049 		    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, 0, ipst, NULL);
8050 		break;
8051 	}
8052 	default:
8053 		return (EAFNOSUPPORT);
8054 	}
8055 	if (ire != NULL) {
8056 		sia->sa_res = 1;
8057 		ire_refrele(ire);
8058 	} else {
8059 		sia->sa_res = 0;
8060 	}
8061 	return (0);
8062 }
8063 
8064 /*
8065  * Check if this is an address assigned on-link i.e. neighbor,
8066  * and makes sure it's reachable from the current zone.
8067  * Returns true for my addresses as well.
8068  * Translates mapped addresses to v4 addresses and then
8069  * treats them as such, returning true if the v4 address
8070  * associated with this mapped address is configured.
8071  * Note: Applications will have to be careful what they do
8072  * with the response; use of mapped addresses limits
8073  * what can be done with the socket, especially with
8074  * respect to socket options and ioctls - neither IPv4
8075  * options nor IPv6 sticky options/ancillary data options
8076  * may be used.
8077  */
8078 /* ARGSUSED */
8079 int
ip_sioctl_tonlink(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * duymmy_ifreq)8080 ip_sioctl_tonlink(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8081     ip_ioctl_cmd_t *ipip, void *duymmy_ifreq)
8082 {
8083 	struct sioc_addrreq *sia;
8084 	sin_t *sin;
8085 	mblk_t	*mp1;
8086 	ire_t *ire = NULL;
8087 	zoneid_t zoneid;
8088 	ip_stack_t	*ipst;
8089 
8090 	ip1dbg(("ip_sioctl_tonlink"));
8091 
8092 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8093 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8094 	ipst = CONNQ_TO_IPST(q);
8095 
8096 	/* Existence verified in ip_wput_nondata */
8097 	mp1 = mp->b_cont->b_cont;
8098 	sia = (struct sioc_addrreq *)mp1->b_rptr;
8099 	sin = (sin_t *)&sia->sa_addr;
8100 
8101 	/*
8102 	 * We check for IRE_ONLINK and exclude IRE_BROADCAST|IRE_MULTICAST
8103 	 * to make sure we only look at on-link unicast address.
8104 	 */
8105 	switch (sin->sin_family) {
8106 	case AF_INET6: {
8107 		sin6_t *sin6 = (sin6_t *)sin;
8108 
8109 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
8110 			ipaddr_t v4_addr;
8111 
8112 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
8113 			    v4_addr);
8114 			if (!CLASSD(v4_addr)) {
8115 				ire = ire_ftable_lookup_v4(v4_addr, 0, 0, 0,
8116 				    NULL, zoneid, NULL, MATCH_IRE_DSTONLY,
8117 				    0, ipst, NULL);
8118 			}
8119 		} else {
8120 			in6_addr_t v6addr;
8121 
8122 			v6addr = sin6->sin6_addr;
8123 			if (!IN6_IS_ADDR_MULTICAST(&v6addr)) {
8124 				ire = ire_ftable_lookup_v6(&v6addr, 0, 0, 0,
8125 				    NULL, zoneid, NULL, MATCH_IRE_DSTONLY, 0,
8126 				    ipst, NULL);
8127 			}
8128 		}
8129 		break;
8130 	}
8131 	case AF_INET: {
8132 		ipaddr_t v4addr;
8133 
8134 		v4addr = sin->sin_addr.s_addr;
8135 		if (!CLASSD(v4addr)) {
8136 			ire = ire_ftable_lookup_v4(v4addr, 0, 0, 0, NULL,
8137 			    zoneid, NULL, MATCH_IRE_DSTONLY, 0, ipst, NULL);
8138 		}
8139 		break;
8140 	}
8141 	default:
8142 		return (EAFNOSUPPORT);
8143 	}
8144 	sia->sa_res = 0;
8145 	if (ire != NULL) {
8146 		ASSERT(!(ire->ire_type & IRE_MULTICAST));
8147 
8148 		if ((ire->ire_type & IRE_ONLINK) &&
8149 		    !(ire->ire_type & IRE_BROADCAST))
8150 			sia->sa_res = 1;
8151 		ire_refrele(ire);
8152 	}
8153 	return (0);
8154 }
8155 
8156 /*
8157  * TBD: implement when kernel maintaines a list of site prefixes.
8158  */
8159 /* ARGSUSED */
8160 int
ip_sioctl_tmysite(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)8161 ip_sioctl_tmysite(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
8162     ip_ioctl_cmd_t *ipip, void *ifreq)
8163 {
8164 	return (ENXIO);
8165 }
8166 
8167 /* ARP IOCTLs. */
8168 /* ARGSUSED */
8169 int
ip_sioctl_arp(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_ifreq)8170 ip_sioctl_arp(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
8171     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
8172 {
8173 	int		err;
8174 	ipaddr_t	ipaddr;
8175 	struct iocblk	*iocp;
8176 	conn_t		*connp;
8177 	struct arpreq	*ar;
8178 	struct xarpreq	*xar;
8179 	int		arp_flags, flags, alength;
8180 	uchar_t		*lladdr;
8181 	ip_stack_t	*ipst;
8182 	ill_t		*ill = ipif->ipif_ill;
8183 	ill_t		*proxy_ill = NULL;
8184 	ipmp_arpent_t	*entp = NULL;
8185 	boolean_t	proxyarp = B_FALSE;
8186 	boolean_t	if_arp_ioctl = B_FALSE;
8187 	ncec_t		*ncec = NULL;
8188 	nce_t		*nce;
8189 
8190 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
8191 	connp = Q_TO_CONN(q);
8192 	ipst = connp->conn_netstack->netstack_ip;
8193 	iocp = (struct iocblk *)mp->b_rptr;
8194 
8195 	if (ipip->ipi_cmd_type == XARP_CMD) {
8196 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->XARPREQ_MBLK */
8197 		xar = (struct xarpreq *)mp->b_cont->b_cont->b_rptr;
8198 		ar = NULL;
8199 
8200 		arp_flags = xar->xarp_flags;
8201 		lladdr = (uchar_t *)LLADDR(&xar->xarp_ha);
8202 		if_arp_ioctl = (xar->xarp_ha.sdl_nlen != 0);
8203 		/*
8204 		 * Validate against user's link layer address length
8205 		 * input and name and addr length limits.
8206 		 */
8207 		alength = ill->ill_phys_addr_length;
8208 		if (ipip->ipi_cmd == SIOCSXARP) {
8209 			if (alength != xar->xarp_ha.sdl_alen ||
8210 			    (alength + xar->xarp_ha.sdl_nlen >
8211 			    sizeof (xar->xarp_ha.sdl_data)))
8212 				return (EINVAL);
8213 		}
8214 	} else {
8215 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->ARPREQ_MBLK */
8216 		ar = (struct arpreq *)mp->b_cont->b_cont->b_rptr;
8217 		xar = NULL;
8218 
8219 		arp_flags = ar->arp_flags;
8220 		lladdr = (uchar_t *)ar->arp_ha.sa_data;
8221 		/*
8222 		 * Theoretically, the sa_family could tell us what link
8223 		 * layer type this operation is trying to deal with. By
8224 		 * common usage AF_UNSPEC means ethernet. We'll assume
8225 		 * any attempt to use the SIOC?ARP ioctls is for ethernet,
8226 		 * for now. Our new SIOC*XARP ioctls can be used more
8227 		 * generally.
8228 		 *
8229 		 * If the underlying media happens to have a non 6 byte
8230 		 * address, arp module will fail set/get, but the del
8231 		 * operation will succeed.
8232 		 */
8233 		alength = 6;
8234 		if ((ipip->ipi_cmd != SIOCDARP) &&
8235 		    (alength != ill->ill_phys_addr_length)) {
8236 			return (EINVAL);
8237 		}
8238 	}
8239 
8240 	/* Translate ATF* flags to NCE* flags */
8241 	flags = 0;
8242 	if (arp_flags & ATF_AUTHORITY)
8243 		flags |= NCE_F_AUTHORITY;
8244 	if (arp_flags & ATF_PERM)
8245 		flags |= NCE_F_NONUD; /* not subject to aging */
8246 	if (arp_flags & ATF_PUBL)
8247 		flags |= NCE_F_PUBLISH;
8248 
8249 	/*
8250 	 * IPMP ARP special handling:
8251 	 *
8252 	 * 1. Since ARP mappings must appear consistent across the group,
8253 	 *    prohibit changing ARP mappings on the underlying interfaces.
8254 	 *
8255 	 * 2. Since ARP mappings for IPMP data addresses are maintained by
8256 	 *    IP itself, prohibit changing them.
8257 	 *
8258 	 * 3. For proxy ARP, use a functioning hardware address in the group,
8259 	 *    provided one exists.  If one doesn't, just add the entry as-is;
8260 	 *    ipmp_illgrp_refresh_arpent() will refresh it if things change.
8261 	 */
8262 	if (IS_UNDER_IPMP(ill)) {
8263 		if (ipip->ipi_cmd != SIOCGARP && ipip->ipi_cmd != SIOCGXARP)
8264 			return (EPERM);
8265 	}
8266 	if (IS_IPMP(ill)) {
8267 		ipmp_illgrp_t *illg = ill->ill_grp;
8268 
8269 		switch (ipip->ipi_cmd) {
8270 		case SIOCSARP:
8271 		case SIOCSXARP:
8272 			proxy_ill = ipmp_illgrp_find_ill(illg, lladdr, alength);
8273 			if (proxy_ill != NULL) {
8274 				proxyarp = B_TRUE;
8275 				if (!ipmp_ill_is_active(proxy_ill))
8276 					proxy_ill = ipmp_illgrp_next_ill(illg);
8277 				if (proxy_ill != NULL)
8278 					lladdr = proxy_ill->ill_phys_addr;
8279 			}
8280 			/* FALLTHRU */
8281 		}
8282 	}
8283 
8284 	ipaddr = sin->sin_addr.s_addr;
8285 	/*
8286 	 * don't match across illgrp per case (1) and (2).
8287 	 * XXX use IS_IPMP(ill) like ndp_sioc_update?
8288 	 */
8289 	nce = nce_lookup_v4(ill, &ipaddr);
8290 	if (nce != NULL)
8291 		ncec = nce->nce_common;
8292 
8293 	switch (iocp->ioc_cmd) {
8294 	case SIOCDARP:
8295 	case SIOCDXARP: {
8296 		/*
8297 		 * Delete the NCE if any.
8298 		 */
8299 		if (ncec == NULL) {
8300 			iocp->ioc_error = ENXIO;
8301 			break;
8302 		}
8303 		/* Don't allow changes to arp mappings of local addresses. */
8304 		if (NCE_MYADDR(ncec)) {
8305 			nce_refrele(nce);
8306 			return (ENOTSUP);
8307 		}
8308 		iocp->ioc_error = 0;
8309 
8310 		/*
8311 		 * Delete the nce_common which has ncec_ill set to ipmp_ill.
8312 		 * This will delete all the nce entries on the under_ills.
8313 		 */
8314 		ncec_delete(ncec);
8315 		/*
8316 		 * Once the NCE has been deleted, then the ire_dep* consistency
8317 		 * mechanism will find any IRE which depended on the now
8318 		 * condemned NCE (as part of sending packets).
8319 		 * That mechanism handles redirects by deleting redirects
8320 		 * that refer to UNREACHABLE nces.
8321 		 */
8322 		break;
8323 	}
8324 	case SIOCGARP:
8325 	case SIOCGXARP:
8326 		if (ncec != NULL) {
8327 			lladdr = ncec->ncec_lladdr;
8328 			flags = ncec->ncec_flags;
8329 			iocp->ioc_error = 0;
8330 			ip_sioctl_garp_reply(mp, ncec->ncec_ill, lladdr, flags);
8331 		} else {
8332 			iocp->ioc_error = ENXIO;
8333 		}
8334 		break;
8335 	case SIOCSARP:
8336 	case SIOCSXARP:
8337 		/* Don't allow changes to arp mappings of local addresses. */
8338 		if (ncec != NULL && NCE_MYADDR(ncec)) {
8339 			nce_refrele(nce);
8340 			return (ENOTSUP);
8341 		}
8342 
8343 		/* static arp entries will undergo NUD if ATF_PERM is not set */
8344 		flags |= NCE_F_STATIC;
8345 		if (!if_arp_ioctl) {
8346 			ip_nce_lookup_and_update(&ipaddr, NULL, ipst,
8347 			    lladdr, alength, flags);
8348 		} else {
8349 			ipif_t *ipif = ipif_get_next_ipif(NULL, ill);
8350 			if (ipif != NULL) {
8351 				ip_nce_lookup_and_update(&ipaddr, ipif, ipst,
8352 				    lladdr, alength, flags);
8353 				ipif_refrele(ipif);
8354 			}
8355 		}
8356 		if (nce != NULL) {
8357 			nce_refrele(nce);
8358 			nce = NULL;
8359 		}
8360 		/*
8361 		 * NCE_F_STATIC entries will be added in state ND_REACHABLE
8362 		 * by nce_add_common()
8363 		 */
8364 		err = nce_lookup_then_add_v4(ill, lladdr,
8365 		    ill->ill_phys_addr_length, &ipaddr, flags, ND_UNCHANGED,
8366 		    &nce);
8367 		if (err == EEXIST) {
8368 			ncec = nce->nce_common;
8369 			mutex_enter(&ncec->ncec_lock);
8370 			ncec->ncec_state = ND_REACHABLE;
8371 			ncec->ncec_flags = flags;
8372 			nce_update(ncec, ND_UNCHANGED, lladdr);
8373 			mutex_exit(&ncec->ncec_lock);
8374 			err = 0;
8375 		}
8376 		if (nce != NULL) {
8377 			nce_refrele(nce);
8378 			nce = NULL;
8379 		}
8380 		if (IS_IPMP(ill) && err == 0) {
8381 			entp = ipmp_illgrp_create_arpent(ill->ill_grp,
8382 			    proxyarp, ipaddr, lladdr, ill->ill_phys_addr_length,
8383 			    flags);
8384 			if (entp == NULL || (proxyarp && proxy_ill == NULL)) {
8385 				iocp->ioc_error = (entp == NULL ? ENOMEM : 0);
8386 				break;
8387 			}
8388 		}
8389 		iocp->ioc_error = err;
8390 	}
8391 
8392 	if (nce != NULL) {
8393 		nce_refrele(nce);
8394 	}
8395 
8396 	/*
8397 	 * If we created an IPMP ARP entry, mark that we've notified ARP.
8398 	 */
8399 	if (entp != NULL)
8400 		ipmp_illgrp_mark_arpent(ill->ill_grp, entp);
8401 
8402 	return (iocp->ioc_error);
8403 }
8404 
8405 /*
8406  * Parse an [x]arpreq structure coming down SIOC[GSD][X]ARP ioctls, identify
8407  * the associated sin and refhold and return the associated ipif via `ci'.
8408  */
8409 int
ip_extract_arpreq(queue_t * q,mblk_t * mp,const ip_ioctl_cmd_t * ipip,cmd_info_t * ci)8410 ip_extract_arpreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
8411     cmd_info_t *ci)
8412 {
8413 	mblk_t	*mp1;
8414 	sin_t	*sin;
8415 	conn_t	*connp;
8416 	ipif_t	*ipif;
8417 	ire_t	*ire = NULL;
8418 	ill_t	*ill = NULL;
8419 	boolean_t exists;
8420 	ip_stack_t *ipst;
8421 	struct arpreq *ar;
8422 	struct xarpreq *xar;
8423 	struct sockaddr_dl *sdl;
8424 
8425 	/* ioctl comes down on a conn */
8426 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
8427 	connp = Q_TO_CONN(q);
8428 	if (connp->conn_family == AF_INET6)
8429 		return (ENXIO);
8430 
8431 	ipst = connp->conn_netstack->netstack_ip;
8432 
8433 	/* Verified in ip_wput_nondata */
8434 	mp1 = mp->b_cont->b_cont;
8435 
8436 	if (ipip->ipi_cmd_type == XARP_CMD) {
8437 		ASSERT(MBLKL(mp1) >= sizeof (struct xarpreq));
8438 		xar = (struct xarpreq *)mp1->b_rptr;
8439 		sin = (sin_t *)&xar->xarp_pa;
8440 		sdl = &xar->xarp_ha;
8441 
8442 		if (sdl->sdl_family != AF_LINK || sin->sin_family != AF_INET)
8443 			return (ENXIO);
8444 		if (sdl->sdl_nlen >= LIFNAMSIZ)
8445 			return (EINVAL);
8446 	} else {
8447 		ASSERT(ipip->ipi_cmd_type == ARP_CMD);
8448 		ASSERT(MBLKL(mp1) >= sizeof (struct arpreq));
8449 		ar = (struct arpreq *)mp1->b_rptr;
8450 		sin = (sin_t *)&ar->arp_pa;
8451 	}
8452 
8453 	if (ipip->ipi_cmd_type == XARP_CMD && sdl->sdl_nlen != 0) {
8454 		ipif = ipif_lookup_on_name(sdl->sdl_data, sdl->sdl_nlen,
8455 		    B_FALSE, &exists, B_FALSE, ALL_ZONES, ipst);
8456 		if (ipif == NULL)
8457 			return (ENXIO);
8458 		if (ipif->ipif_id != 0) {
8459 			ipif_refrele(ipif);
8460 			return (ENXIO);
8461 		}
8462 	} else {
8463 		/*
8464 		 * Either an SIOC[DGS]ARP or an SIOC[DGS]XARP with an sdl_nlen
8465 		 * of 0: use the IP address to find the ipif.  If the IP
8466 		 * address is an IPMP test address, ire_ftable_lookup() will
8467 		 * find the wrong ill, so we first do an ipif_lookup_addr().
8468 		 */
8469 		ipif = ipif_lookup_addr(sin->sin_addr.s_addr, NULL, ALL_ZONES,
8470 		    ipst);
8471 		if (ipif == NULL) {
8472 			ire = ire_ftable_lookup_v4(sin->sin_addr.s_addr,
8473 			    0, 0, IRE_IF_RESOLVER, NULL, ALL_ZONES,
8474 			    NULL, MATCH_IRE_TYPE, 0, ipst, NULL);
8475 			if (ire == NULL || ((ill = ire->ire_ill) == NULL)) {
8476 				if (ire != NULL)
8477 					ire_refrele(ire);
8478 				return (ENXIO);
8479 			}
8480 			ASSERT(ire != NULL && ill != NULL);
8481 			ipif = ill->ill_ipif;
8482 			ipif_refhold(ipif);
8483 			ire_refrele(ire);
8484 		}
8485 	}
8486 
8487 	if (ipif->ipif_ill->ill_net_type != IRE_IF_RESOLVER) {
8488 		ipif_refrele(ipif);
8489 		return (ENXIO);
8490 	}
8491 
8492 	ci->ci_sin = sin;
8493 	ci->ci_ipif = ipif;
8494 	return (0);
8495 }
8496 
8497 /*
8498  * Link or unlink the illgrp on IPMP meta-interface `ill' depending on the
8499  * value of `ioccmd'.  While an illgrp is linked to an ipmp_grp_t, it is
8500  * accessible from that ipmp_grp_t, which means SIOCSLIFGROUPNAME can look it
8501  * up and thus an ill can join that illgrp.
8502  *
8503  * We use I_PLINK/I_PUNLINK to do the link/unlink operations rather than
8504  * open()/close() primarily because close() is not allowed to fail or block
8505  * forever.  On the other hand, I_PUNLINK *can* fail, and there's no reason
8506  * why anyone should ever need to I_PUNLINK an in-use IPMP stream.  To ensure
8507  * symmetric behavior (e.g., doing an I_PLINK after and I_PUNLINK undoes the
8508  * I_PUNLINK) we defer linking to I_PLINK.  Separately, we also fail attempts
8509  * to I_LINK since I_UNLINK is optional and we'd end up in an inconsistent
8510  * state if I_UNLINK didn't occur.
8511  *
8512  * Note that for each plumb/unplumb operation, we may end up here more than
8513  * once because of the way ifconfig works.  However, it's OK to link the same
8514  * illgrp more than once, or unlink an illgrp that's already unlinked.
8515  */
8516 static int
ip_sioctl_plink_ipmp(ill_t * ill,int ioccmd)8517 ip_sioctl_plink_ipmp(ill_t *ill, int ioccmd)
8518 {
8519 	int err;
8520 	ip_stack_t *ipst = ill->ill_ipst;
8521 
8522 	ASSERT(IS_IPMP(ill));
8523 	ASSERT(IAM_WRITER_ILL(ill));
8524 
8525 	switch (ioccmd) {
8526 	case I_LINK:
8527 		return (ENOTSUP);
8528 
8529 	case I_PLINK:
8530 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
8531 		ipmp_illgrp_link_grp(ill->ill_grp, ill->ill_phyint->phyint_grp);
8532 		rw_exit(&ipst->ips_ipmp_lock);
8533 		break;
8534 
8535 	case I_PUNLINK:
8536 		/*
8537 		 * Require all UP ipifs be brought down prior to unlinking the
8538 		 * illgrp so any associated IREs (and other state) is torched.
8539 		 */
8540 		if (ill->ill_ipif_up_count + ill->ill_ipif_dup_count > 0)
8541 			return (EBUSY);
8542 
8543 		/*
8544 		 * NOTE: We hold ipmp_lock across the unlink to prevent a race
8545 		 * with an SIOCSLIFGROUPNAME request from an ill trying to
8546 		 * join this group.  Specifically: ills trying to join grab
8547 		 * ipmp_lock and bump a "pending join" counter checked by
8548 		 * ipmp_illgrp_unlink_grp().  During the unlink no new pending
8549 		 * joins can occur (since we have ipmp_lock).  Once we drop
8550 		 * ipmp_lock, subsequent SIOCSLIFGROUPNAME requests will not
8551 		 * find the illgrp (since we unlinked it) and will return
8552 		 * EAFNOSUPPORT.  This will then take them back through the
8553 		 * IPMP meta-interface plumbing logic in ifconfig, and thus
8554 		 * back through I_PLINK above.
8555 		 */
8556 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
8557 		err = ipmp_illgrp_unlink_grp(ill->ill_grp);
8558 		rw_exit(&ipst->ips_ipmp_lock);
8559 		return (err);
8560 	default:
8561 		break;
8562 	}
8563 	return (0);
8564 }
8565 
8566 /*
8567  * Do I_PLINK/I_LINK or I_PUNLINK/I_UNLINK with consistency checks and also
8568  * atomically set/clear the muxids. Also complete the ioctl by acking or
8569  * naking it.  Note that the code is structured such that the link type,
8570  * whether it's persistent or not, is treated equally.  ifconfig(1M) and
8571  * its clones use the persistent link, while pppd(1M) and perhaps many
8572  * other daemons may use non-persistent link.  When combined with some
8573  * ill_t states, linking and unlinking lower streams may be used as
8574  * indicators of dynamic re-plumbing events [see PSARC/1999/348].
8575  */
8576 /* ARGSUSED */
8577 void
ip_sioctl_plink(ipsq_t * ipsq,queue_t * q,mblk_t * mp,void * dummy_arg)8578 ip_sioctl_plink(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
8579 {
8580 	mblk_t		*mp1;
8581 	struct linkblk	*li;
8582 	int		ioccmd = ((struct iocblk *)mp->b_rptr)->ioc_cmd;
8583 	int		err = 0;
8584 
8585 	ASSERT(ioccmd == I_PLINK || ioccmd == I_PUNLINK ||
8586 	    ioccmd == I_LINK || ioccmd == I_UNLINK);
8587 
8588 	mp1 = mp->b_cont;	/* This is the linkblk info */
8589 	li = (struct linkblk *)mp1->b_rptr;
8590 
8591 	err = ip_sioctl_plink_ipmod(ipsq, q, mp, ioccmd, li);
8592 	if (err == EINPROGRESS)
8593 		return;
8594 	if (err == 0)
8595 		miocack(q, mp, 0, 0);
8596 	else
8597 		miocnak(q, mp, 0, err);
8598 
8599 	/* Conn was refheld in ip_sioctl_copyin_setup */
8600 	if (CONN_Q(q)) {
8601 		CONN_DEC_IOCTLREF(Q_TO_CONN(q));
8602 		CONN_OPER_PENDING_DONE(Q_TO_CONN(q));
8603 	}
8604 }
8605 
8606 /*
8607  * Process I_{P}LINK and I_{P}UNLINK requests named by `ioccmd' and pointed to
8608  * by `mp' and `li' for the IP module stream (if li->q_bot is in fact an IP
8609  * module stream).
8610  * Returns zero on success, EINPROGRESS if the operation is still pending, or
8611  * an error code on failure.
8612  */
8613 static int
ip_sioctl_plink_ipmod(ipsq_t * ipsq,queue_t * q,mblk_t * mp,int ioccmd,struct linkblk * li)8614 ip_sioctl_plink_ipmod(ipsq_t *ipsq, queue_t *q, mblk_t *mp, int ioccmd,
8615     struct linkblk *li)
8616 {
8617 	int		err = 0;
8618 	ill_t  		*ill;
8619 	queue_t		*ipwq, *dwq;
8620 	const char	*name;
8621 	struct qinit	*qinfo;
8622 	boolean_t	islink = (ioccmd == I_PLINK || ioccmd == I_LINK);
8623 	boolean_t	entered_ipsq = B_FALSE;
8624 	boolean_t	is_ip = B_FALSE;
8625 	arl_t		*arl;
8626 
8627 	/*
8628 	 * Walk the lower stream to verify it's the IP module stream.
8629 	 * The IP module is identified by its name, wput function,
8630 	 * and non-NULL q_next.  STREAMS ensures that the lower stream
8631 	 * (li->l_qbot) will not vanish until this ioctl completes.
8632 	 */
8633 	for (ipwq = li->l_qbot; ipwq != NULL; ipwq = ipwq->q_next) {
8634 		qinfo = ipwq->q_qinfo;
8635 		name = qinfo->qi_minfo->mi_idname;
8636 		if (name != NULL && strcmp(name, ip_mod_info.mi_idname) == 0 &&
8637 		    qinfo->qi_putp != (pfi_t)ip_lwput && ipwq->q_next != NULL) {
8638 			is_ip = B_TRUE;
8639 			break;
8640 		}
8641 		if (name != NULL && strcmp(name, arp_mod_info.mi_idname) == 0 &&
8642 		    qinfo->qi_putp != (pfi_t)ip_lwput && ipwq->q_next != NULL) {
8643 			break;
8644 		}
8645 	}
8646 
8647 	/*
8648 	 * If this isn't an IP module stream, bail.
8649 	 */
8650 	if (ipwq == NULL)
8651 		return (0);
8652 
8653 	if (!is_ip) {
8654 		arl = (arl_t *)ipwq->q_ptr;
8655 		ill = arl_to_ill(arl);
8656 		if (ill == NULL)
8657 			return (0);
8658 	} else {
8659 		ill = ipwq->q_ptr;
8660 	}
8661 	ASSERT(ill != NULL);
8662 
8663 	if (ipsq == NULL) {
8664 		ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_sioctl_plink,
8665 		    NEW_OP, B_FALSE);
8666 		if (ipsq == NULL) {
8667 			if (!is_ip)
8668 				ill_refrele(ill);
8669 			return (EINPROGRESS);
8670 		}
8671 		entered_ipsq = B_TRUE;
8672 	}
8673 	ASSERT(IAM_WRITER_ILL(ill));
8674 	mutex_enter(&ill->ill_lock);
8675 	if (!is_ip) {
8676 		if (islink && ill->ill_muxid == 0) {
8677 			/*
8678 			 * Plumbing has to be done with IP plumbed first, arp
8679 			 * second, but here we have arp being plumbed first.
8680 			 */
8681 			mutex_exit(&ill->ill_lock);
8682 			if (entered_ipsq)
8683 				ipsq_exit(ipsq);
8684 			ill_refrele(ill);
8685 			return (EINVAL);
8686 		}
8687 	}
8688 	mutex_exit(&ill->ill_lock);
8689 	if (!is_ip) {
8690 		arl->arl_muxid = islink ? li->l_index : 0;
8691 		ill_refrele(ill);
8692 		goto done;
8693 	}
8694 
8695 	if (IS_IPMP(ill) && (err = ip_sioctl_plink_ipmp(ill, ioccmd)) != 0)
8696 		goto done;
8697 
8698 	/*
8699 	 * As part of I_{P}LINKing, stash the number of downstream modules and
8700 	 * the read queue of the module immediately below IP in the ill.
8701 	 * These are used during the capability negotiation below.
8702 	 */
8703 	ill->ill_lmod_rq = NULL;
8704 	ill->ill_lmod_cnt = 0;
8705 	if (islink && ((dwq = ipwq->q_next) != NULL)) {
8706 		ill->ill_lmod_rq = RD(dwq);
8707 		for (; dwq != NULL; dwq = dwq->q_next)
8708 			ill->ill_lmod_cnt++;
8709 	}
8710 
8711 	ill->ill_muxid = islink ? li->l_index : 0;
8712 
8713 	/*
8714 	 * Mark the ipsq busy until the capability operations initiated below
8715 	 * complete. The PLINK/UNLINK ioctl itself completes when our caller
8716 	 * returns, but the capability operation may complete asynchronously
8717 	 * much later.
8718 	 */
8719 	ipsq_current_start(ipsq, ill->ill_ipif, ioccmd);
8720 	/*
8721 	 * If there's at least one up ipif on this ill, then we're bound to
8722 	 * the underlying driver via DLPI.  In that case, renegotiate
8723 	 * capabilities to account for any possible change in modules
8724 	 * interposed between IP and the driver.
8725 	 */
8726 	if (ill->ill_ipif_up_count > 0) {
8727 		if (islink)
8728 			ill_capability_probe(ill);
8729 		else
8730 			ill_capability_reset(ill, B_FALSE);
8731 	}
8732 	ipsq_current_finish(ipsq);
8733 done:
8734 	if (entered_ipsq)
8735 		ipsq_exit(ipsq);
8736 
8737 	return (err);
8738 }
8739 
8740 /*
8741  * Search the ioctl command in the ioctl tables and return a pointer
8742  * to the ioctl command information. The ioctl command tables are
8743  * static and fully populated at compile time.
8744  */
8745 ip_ioctl_cmd_t *
ip_sioctl_lookup(int ioc_cmd)8746 ip_sioctl_lookup(int ioc_cmd)
8747 {
8748 	int index;
8749 	ip_ioctl_cmd_t *ipip;
8750 	ip_ioctl_cmd_t *ipip_end;
8751 
8752 	if (ioc_cmd == IPI_DONTCARE)
8753 		return (NULL);
8754 
8755 	/*
8756 	 * Do a 2 step search. First search the indexed table
8757 	 * based on the least significant byte of the ioctl cmd.
8758 	 * If we don't find a match, then search the misc table
8759 	 * serially.
8760 	 */
8761 	index = ioc_cmd & 0xFF;
8762 	if (index < ip_ndx_ioctl_count) {
8763 		ipip = &ip_ndx_ioctl_table[index];
8764 		if (ipip->ipi_cmd == ioc_cmd) {
8765 			/* Found a match in the ndx table */
8766 			return (ipip);
8767 		}
8768 	}
8769 
8770 	/* Search the misc table */
8771 	ipip_end = &ip_misc_ioctl_table[ip_misc_ioctl_count];
8772 	for (ipip = ip_misc_ioctl_table; ipip < ipip_end; ipip++) {
8773 		if (ipip->ipi_cmd == ioc_cmd)
8774 			/* Found a match in the misc table */
8775 			return (ipip);
8776 	}
8777 
8778 	return (NULL);
8779 }
8780 
8781 /*
8782  * helper function for ip_sioctl_getsetprop(), which does some sanity checks
8783  */
8784 static boolean_t
getset_ioctl_checks(mblk_t * mp)8785 getset_ioctl_checks(mblk_t *mp)
8786 {
8787 	struct iocblk	*iocp = (struct iocblk *)mp->b_rptr;
8788 	mblk_t		*mp1 = mp->b_cont;
8789 	mod_ioc_prop_t	*pioc;
8790 	uint_t		flags;
8791 	uint_t		pioc_size;
8792 
8793 	/* do sanity checks on various arguments */
8794 	if (mp1 == NULL || iocp->ioc_count == 0 ||
8795 	    iocp->ioc_count == TRANSPARENT) {
8796 		return (B_FALSE);
8797 	}
8798 	if (msgdsize(mp1) < iocp->ioc_count) {
8799 		if (!pullupmsg(mp1, iocp->ioc_count))
8800 			return (B_FALSE);
8801 	}
8802 
8803 	pioc = (mod_ioc_prop_t *)mp1->b_rptr;
8804 
8805 	/* sanity checks on mpr_valsize */
8806 	pioc_size = sizeof (mod_ioc_prop_t);
8807 	if (pioc->mpr_valsize != 0)
8808 		pioc_size += pioc->mpr_valsize - 1;
8809 
8810 	if (iocp->ioc_count != pioc_size)
8811 		return (B_FALSE);
8812 
8813 	flags = pioc->mpr_flags;
8814 	if (iocp->ioc_cmd == SIOCSETPROP) {
8815 		/*
8816 		 * One can either reset the value to it's default value or
8817 		 * change the current value or append/remove the value from
8818 		 * a multi-valued properties.
8819 		 */
8820 		if ((flags & MOD_PROP_DEFAULT) != MOD_PROP_DEFAULT &&
8821 		    flags != MOD_PROP_ACTIVE &&
8822 		    flags != (MOD_PROP_ACTIVE|MOD_PROP_APPEND) &&
8823 		    flags != (MOD_PROP_ACTIVE|MOD_PROP_REMOVE))
8824 			return (B_FALSE);
8825 	} else {
8826 		ASSERT(iocp->ioc_cmd == SIOCGETPROP);
8827 
8828 		/*
8829 		 * One can retrieve only one kind of property information
8830 		 * at a time.
8831 		 */
8832 		if ((flags & MOD_PROP_ACTIVE) != MOD_PROP_ACTIVE &&
8833 		    (flags & MOD_PROP_DEFAULT) != MOD_PROP_DEFAULT &&
8834 		    (flags & MOD_PROP_POSSIBLE) != MOD_PROP_POSSIBLE &&
8835 		    (flags & MOD_PROP_PERM) != MOD_PROP_PERM)
8836 			return (B_FALSE);
8837 	}
8838 
8839 	return (B_TRUE);
8840 }
8841 
8842 /*
8843  * process the SIOC{SET|GET}PROP ioctl's
8844  */
8845 /* ARGSUSED */
8846 static void
ip_sioctl_getsetprop(queue_t * q,mblk_t * mp)8847 ip_sioctl_getsetprop(queue_t *q, mblk_t *mp)
8848 {
8849 	struct iocblk	*iocp = (struct iocblk *)mp->b_rptr;
8850 	mblk_t		*mp1 = mp->b_cont;
8851 	mod_ioc_prop_t	*pioc;
8852 	mod_prop_info_t *ptbl = NULL, *pinfo = NULL;
8853 	ip_stack_t	*ipst;
8854 	netstack_t	*stack;
8855 	cred_t		*cr;
8856 	boolean_t	set;
8857 	int		err;
8858 
8859 	ASSERT(q->q_next == NULL);
8860 	ASSERT(CONN_Q(q));
8861 
8862 	if (!getset_ioctl_checks(mp)) {
8863 		miocnak(q, mp, 0, EINVAL);
8864 		return;
8865 	}
8866 	ipst = CONNQ_TO_IPST(q);
8867 	stack = ipst->ips_netstack;
8868 	pioc = (mod_ioc_prop_t *)mp1->b_rptr;
8869 
8870 	switch (pioc->mpr_proto) {
8871 	case MOD_PROTO_IP:
8872 	case MOD_PROTO_IPV4:
8873 	case MOD_PROTO_IPV6:
8874 		ptbl = ipst->ips_propinfo_tbl;
8875 		break;
8876 	case MOD_PROTO_RAWIP:
8877 		ptbl = stack->netstack_icmp->is_propinfo_tbl;
8878 		break;
8879 	case MOD_PROTO_TCP:
8880 		ptbl = stack->netstack_tcp->tcps_propinfo_tbl;
8881 		break;
8882 	case MOD_PROTO_UDP:
8883 		ptbl = stack->netstack_udp->us_propinfo_tbl;
8884 		break;
8885 	case MOD_PROTO_SCTP:
8886 		ptbl = stack->netstack_sctp->sctps_propinfo_tbl;
8887 		break;
8888 	default:
8889 		miocnak(q, mp, 0, EINVAL);
8890 		return;
8891 	}
8892 
8893 	pinfo = mod_prop_lookup(ptbl, pioc->mpr_name, pioc->mpr_proto);
8894 	if (pinfo == NULL) {
8895 		miocnak(q, mp, 0, ENOENT);
8896 		return;
8897 	}
8898 
8899 	set = (iocp->ioc_cmd == SIOCSETPROP) ? B_TRUE : B_FALSE;
8900 	if (set && pinfo->mpi_setf != NULL) {
8901 		cr = msg_getcred(mp, NULL);
8902 		if (cr == NULL)
8903 			cr = iocp->ioc_cr;
8904 		err = pinfo->mpi_setf(stack, cr, pinfo, pioc->mpr_ifname,
8905 		    pioc->mpr_val, pioc->mpr_flags);
8906 	} else if (!set && pinfo->mpi_getf != NULL) {
8907 		err = pinfo->mpi_getf(stack, pinfo, pioc->mpr_ifname,
8908 		    pioc->mpr_val, pioc->mpr_valsize, pioc->mpr_flags);
8909 	} else {
8910 		err = EPERM;
8911 	}
8912 
8913 	if (err != 0) {
8914 		miocnak(q, mp, 0, err);
8915 	} else {
8916 		if (set)
8917 			miocack(q, mp, 0, 0);
8918 		else    /* For get, we need to return back the data */
8919 			miocack(q, mp, iocp->ioc_count, 0);
8920 	}
8921 }
8922 
8923 /*
8924  * process the legacy ND_GET, ND_SET ioctl just for {ip|ip6}_forwarding
8925  * as several routing daemons have unfortunately used this 'unpublished'
8926  * but well-known ioctls.
8927  */
8928 /* ARGSUSED */
8929 static void
ip_process_legacy_nddprop(queue_t * q,mblk_t * mp)8930 ip_process_legacy_nddprop(queue_t *q, mblk_t *mp)
8931 {
8932 	struct iocblk	*iocp = (struct iocblk *)mp->b_rptr;
8933 	mblk_t		*mp1 = mp->b_cont;
8934 	char		*pname, *pval, *buf;
8935 	uint_t		bufsize, proto;
8936 	mod_prop_info_t *pinfo = NULL;
8937 	ip_stack_t	*ipst;
8938 	int		err = 0;
8939 
8940 	ASSERT(CONN_Q(q));
8941 	ipst = CONNQ_TO_IPST(q);
8942 
8943 	if (iocp->ioc_count == 0 || mp1 == NULL) {
8944 		miocnak(q, mp, 0, EINVAL);
8945 		return;
8946 	}
8947 
8948 	mp1->b_datap->db_lim[-1] = '\0';	/* Force null termination */
8949 	pval = buf = pname = (char *)mp1->b_rptr;
8950 	bufsize = MBLKL(mp1);
8951 
8952 	if (strcmp(pname, "ip_forwarding") == 0) {
8953 		pname = "forwarding";
8954 		proto = MOD_PROTO_IPV4;
8955 	} else if (strcmp(pname, "ip6_forwarding") == 0) {
8956 		pname = "forwarding";
8957 		proto = MOD_PROTO_IPV6;
8958 	} else {
8959 		miocnak(q, mp, 0, EINVAL);
8960 		return;
8961 	}
8962 
8963 	pinfo = mod_prop_lookup(ipst->ips_propinfo_tbl, pname, proto);
8964 
8965 	switch (iocp->ioc_cmd) {
8966 	case ND_GET:
8967 		if ((err = pinfo->mpi_getf(ipst->ips_netstack, pinfo, NULL, buf,
8968 		    bufsize, 0)) == 0) {
8969 			miocack(q, mp, iocp->ioc_count, 0);
8970 			return;
8971 		}
8972 		break;
8973 	case ND_SET:
8974 		/*
8975 		 * buffer will have property name and value in the following
8976 		 * format,
8977 		 * <property name>'\0'<property value>'\0', extract them;
8978 		 */
8979 		while (*pval++)
8980 			noop;
8981 
8982 		if (!*pval || pval >= (char *)mp1->b_wptr) {
8983 			err = EINVAL;
8984 		} else if ((err = pinfo->mpi_setf(ipst->ips_netstack, NULL,
8985 		    pinfo, NULL, pval, 0)) == 0) {
8986 			miocack(q, mp, 0, 0);
8987 			return;
8988 		}
8989 		break;
8990 	default:
8991 		err = EINVAL;
8992 		break;
8993 	}
8994 	miocnak(q, mp, 0, err);
8995 }
8996 
8997 /*
8998  * Wrapper function for resuming deferred ioctl processing
8999  * Used for SIOCGDSTINFO, SIOCGIP6ADDRPOLICY, SIOCGMSFILTER,
9000  * SIOCSMSFILTER, SIOCGIPMSFILTER, and SIOCSIPMSFILTER currently.
9001  */
9002 /* ARGSUSED */
9003 void
ip_sioctl_copyin_resume(ipsq_t * dummy_ipsq,queue_t * q,mblk_t * mp,void * dummy_arg)9004 ip_sioctl_copyin_resume(ipsq_t *dummy_ipsq, queue_t *q, mblk_t *mp,
9005     void *dummy_arg)
9006 {
9007 	ip_sioctl_copyin_setup(q, mp);
9008 }
9009 
9010 /*
9011  * ip_sioctl_copyin_setup is called by ip_wput_nondata with any M_IOCTL message
9012  * that arrives.  Most of the IOCTLs are "socket" IOCTLs which we handle
9013  * in either I_STR or TRANSPARENT form, using the mi_copy facility.
9014  * We establish here the size of the block to be copied in.  mi_copyin
9015  * arranges for this to happen, an processing continues in ip_wput_nondata with
9016  * an M_IOCDATA message.
9017  */
9018 void
ip_sioctl_copyin_setup(queue_t * q,mblk_t * mp)9019 ip_sioctl_copyin_setup(queue_t *q, mblk_t *mp)
9020 {
9021 	int	copyin_size;
9022 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
9023 	ip_ioctl_cmd_t *ipip;
9024 	cred_t *cr;
9025 	ip_stack_t	*ipst;
9026 
9027 	if (CONN_Q(q))
9028 		ipst = CONNQ_TO_IPST(q);
9029 	else
9030 		ipst = ILLQ_TO_IPST(q);
9031 
9032 	ipip = ip_sioctl_lookup(iocp->ioc_cmd);
9033 	if (ipip == NULL) {
9034 		/*
9035 		 * The ioctl is not one we understand or own.
9036 		 * Pass it along to be processed down stream,
9037 		 * if this is a module instance of IP, else nak
9038 		 * the ioctl.
9039 		 */
9040 		if (q->q_next == NULL) {
9041 			goto nak;
9042 		} else {
9043 			putnext(q, mp);
9044 			return;
9045 		}
9046 	}
9047 
9048 	/*
9049 	 * If this is deferred, then we will do all the checks when we
9050 	 * come back.
9051 	 */
9052 	if ((iocp->ioc_cmd == SIOCGDSTINFO ||
9053 	    iocp->ioc_cmd == SIOCGIP6ADDRPOLICY) && !ip6_asp_can_lookup(ipst)) {
9054 		ip6_asp_pending_op(q, mp, ip_sioctl_copyin_resume);
9055 		return;
9056 	}
9057 
9058 	/*
9059 	 * Only allow a very small subset of IP ioctls on this stream if
9060 	 * IP is a module and not a driver. Allowing ioctls to be processed
9061 	 * in this case may cause assert failures or data corruption.
9062 	 * Typically G[L]IFFLAGS, SLIFNAME/IF_UNITSEL are the only few
9063 	 * ioctls allowed on an IP module stream, after which this stream
9064 	 * normally becomes a multiplexor (at which time the stream head
9065 	 * will fail all ioctls).
9066 	 */
9067 	if ((q->q_next != NULL) && !(ipip->ipi_flags & IPI_MODOK)) {
9068 		goto nak;
9069 	}
9070 
9071 	/* Make sure we have ioctl data to process. */
9072 	if (mp->b_cont == NULL && !(ipip->ipi_flags & IPI_NULL_BCONT))
9073 		goto nak;
9074 
9075 	/*
9076 	 * Prefer dblk credential over ioctl credential; some synthesized
9077 	 * ioctls have kcred set because there's no way to crhold()
9078 	 * a credential in some contexts.  (ioc_cr is not crfree() by
9079 	 * the framework; the caller of ioctl needs to hold the reference
9080 	 * for the duration of the call).
9081 	 */
9082 	cr = msg_getcred(mp, NULL);
9083 	if (cr == NULL)
9084 		cr = iocp->ioc_cr;
9085 
9086 	/* Make sure normal users don't send down privileged ioctls */
9087 	if ((ipip->ipi_flags & IPI_PRIV) &&
9088 	    (cr != NULL) && secpolicy_ip_config(cr, B_TRUE) != 0) {
9089 		/* We checked the privilege earlier but log it here */
9090 		miocnak(q, mp, 0, secpolicy_ip_config(cr, B_FALSE));
9091 		return;
9092 	}
9093 
9094 	/*
9095 	 * The ioctl command tables can only encode fixed length
9096 	 * ioctl data. If the length is variable, the table will
9097 	 * encode the length as zero. Such special cases are handled
9098 	 * below in the switch.
9099 	 */
9100 	if (ipip->ipi_copyin_size != 0) {
9101 		mi_copyin(q, mp, NULL, ipip->ipi_copyin_size);
9102 		return;
9103 	}
9104 
9105 	switch (iocp->ioc_cmd) {
9106 	case O_SIOCGIFCONF:
9107 	case SIOCGIFCONF:
9108 		/*
9109 		 * This IOCTL is hilarious.  See comments in
9110 		 * ip_sioctl_get_ifconf for the story.
9111 		 */
9112 		if (iocp->ioc_count == TRANSPARENT)
9113 			copyin_size = SIZEOF_STRUCT(ifconf,
9114 			    iocp->ioc_flag);
9115 		else
9116 			copyin_size = iocp->ioc_count;
9117 		mi_copyin(q, mp, NULL, copyin_size);
9118 		return;
9119 
9120 	case O_SIOCGLIFCONF:
9121 	case SIOCGLIFCONF:
9122 		copyin_size = SIZEOF_STRUCT(lifconf, iocp->ioc_flag);
9123 		mi_copyin(q, mp, NULL, copyin_size);
9124 		return;
9125 
9126 	case SIOCGLIFSRCOF:
9127 		copyin_size = SIZEOF_STRUCT(lifsrcof, iocp->ioc_flag);
9128 		mi_copyin(q, mp, NULL, copyin_size);
9129 		return;
9130 
9131 	case SIOCGIP6ADDRPOLICY:
9132 		ip_sioctl_ip6addrpolicy(q, mp);
9133 		ip6_asp_table_refrele(ipst);
9134 		return;
9135 
9136 	case SIOCSIP6ADDRPOLICY:
9137 		ip_sioctl_ip6addrpolicy(q, mp);
9138 		return;
9139 
9140 	case SIOCGDSTINFO:
9141 		ip_sioctl_dstinfo(q, mp);
9142 		ip6_asp_table_refrele(ipst);
9143 		return;
9144 
9145 	case ND_SET:
9146 	case ND_GET:
9147 		ip_process_legacy_nddprop(q, mp);
9148 		return;
9149 
9150 	case SIOCSETPROP:
9151 	case SIOCGETPROP:
9152 		ip_sioctl_getsetprop(q, mp);
9153 		return;
9154 
9155 	case I_PLINK:
9156 	case I_PUNLINK:
9157 	case I_LINK:
9158 	case I_UNLINK:
9159 		/*
9160 		 * We treat non-persistent link similarly as the persistent
9161 		 * link case, in terms of plumbing/unplumbing, as well as
9162 		 * dynamic re-plumbing events indicator.  See comments
9163 		 * in ip_sioctl_plink() for more.
9164 		 *
9165 		 * Request can be enqueued in the 'ipsq' while waiting
9166 		 * to become exclusive. So bump up the conn ref.
9167 		 */
9168 		if (CONN_Q(q)) {
9169 			CONN_INC_REF(Q_TO_CONN(q));
9170 			CONN_INC_IOCTLREF(Q_TO_CONN(q))
9171 		}
9172 		ip_sioctl_plink(NULL, q, mp, NULL);
9173 		return;
9174 
9175 	case IP_IOCTL:
9176 		ip_wput_ioctl(q, mp);
9177 		return;
9178 
9179 	case SIOCILB:
9180 		/* The ioctl length varies depending on the ILB command. */
9181 		copyin_size = iocp->ioc_count;
9182 		if (copyin_size < sizeof (ilb_cmd_t))
9183 			goto nak;
9184 		mi_copyin(q, mp, NULL, copyin_size);
9185 		return;
9186 
9187 	default:
9188 		cmn_err(CE_WARN, "Unknown ioctl %d/0x%x slipped through.",
9189 		    iocp->ioc_cmd, iocp->ioc_cmd);
9190 		/* FALLTHRU */
9191 	}
9192 nak:
9193 	if (mp->b_cont != NULL) {
9194 		freemsg(mp->b_cont);
9195 		mp->b_cont = NULL;
9196 	}
9197 	iocp->ioc_error = EINVAL;
9198 	mp->b_datap->db_type = M_IOCNAK;
9199 	iocp->ioc_count = 0;
9200 	qreply(q, mp);
9201 }
9202 
9203 static void
ip_sioctl_garp_reply(mblk_t * mp,ill_t * ill,void * hwaddr,int flags)9204 ip_sioctl_garp_reply(mblk_t *mp, ill_t *ill, void *hwaddr, int flags)
9205 {
9206 	struct arpreq *ar;
9207 	struct xarpreq *xar;
9208 	mblk_t	*tmp;
9209 	struct iocblk *iocp;
9210 	int x_arp_ioctl = B_FALSE;
9211 	int *flagsp;
9212 	char *storage = NULL;
9213 
9214 	ASSERT(ill != NULL);
9215 
9216 	iocp = (struct iocblk *)mp->b_rptr;
9217 	ASSERT(iocp->ioc_cmd == SIOCGXARP || iocp->ioc_cmd == SIOCGARP);
9218 
9219 	tmp = (mp->b_cont)->b_cont; /* xarpreq/arpreq */
9220 	if ((iocp->ioc_cmd == SIOCGXARP) ||
9221 	    (iocp->ioc_cmd == SIOCSXARP)) {
9222 		x_arp_ioctl = B_TRUE;
9223 		xar = (struct xarpreq *)tmp->b_rptr;
9224 		flagsp = &xar->xarp_flags;
9225 		storage = xar->xarp_ha.sdl_data;
9226 	} else {
9227 		ar = (struct arpreq *)tmp->b_rptr;
9228 		flagsp = &ar->arp_flags;
9229 		storage = ar->arp_ha.sa_data;
9230 	}
9231 
9232 	/*
9233 	 * We're done if this is not an SIOCG{X}ARP
9234 	 */
9235 	if (x_arp_ioctl) {
9236 		storage += ill_xarp_info(&xar->xarp_ha, ill);
9237 		if ((ill->ill_phys_addr_length + ill->ill_name_length) >
9238 		    sizeof (xar->xarp_ha.sdl_data)) {
9239 			iocp->ioc_error = EINVAL;
9240 			return;
9241 		}
9242 	}
9243 	*flagsp = ATF_INUSE;
9244 	/*
9245 	 * If /sbin/arp told us we are the authority using the "permanent"
9246 	 * flag, or if this is one of my addresses print "permanent"
9247 	 * in the /sbin/arp output.
9248 	 */
9249 	if ((flags & NCE_F_MYADDR) || (flags & NCE_F_AUTHORITY))
9250 		*flagsp |= ATF_AUTHORITY;
9251 	if (flags & NCE_F_NONUD)
9252 		*flagsp |= ATF_PERM; /* not subject to aging */
9253 	if (flags & NCE_F_PUBLISH)
9254 		*flagsp |= ATF_PUBL;
9255 	if (hwaddr != NULL) {
9256 		*flagsp |= ATF_COM;
9257 		bcopy((char *)hwaddr, storage, ill->ill_phys_addr_length);
9258 	}
9259 }
9260 
9261 /*
9262  * Create a new logical interface. If ipif_id is zero (i.e. not a logical
9263  * interface) create the next available logical interface for this
9264  * physical interface.
9265  * If ipif is NULL (i.e. the lookup didn't find one) attempt to create an
9266  * ipif with the specified name.
9267  *
9268  * If the address family is not AF_UNSPEC then set the address as well.
9269  *
9270  * If ip_sioctl_addr returns EINPROGRESS then the ioctl (the copyout)
9271  * is completed when the DL_BIND_ACK arrive in ip_rput_dlpi_writer.
9272  *
9273  * Executed as a writer on the ill.
9274  * So no lock is needed to traverse the ipif chain, or examine the
9275  * phyint flags.
9276  */
9277 /* ARGSUSED */
9278 int
ip_sioctl_addif(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * dummy_ipip,void * dummy_ifreq)9279 ip_sioctl_addif(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9280     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
9281 {
9282 	mblk_t	*mp1;
9283 	struct lifreq *lifr;
9284 	boolean_t	isv6;
9285 	boolean_t	exists;
9286 	char 	*name;
9287 	char	*endp;
9288 	char	*cp;
9289 	int	namelen;
9290 	ipif_t	*ipif;
9291 	long	id;
9292 	ipsq_t	*ipsq;
9293 	ill_t	*ill;
9294 	sin_t	*sin;
9295 	int	err = 0;
9296 	boolean_t found_sep = B_FALSE;
9297 	conn_t	*connp;
9298 	zoneid_t zoneid;
9299 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
9300 
9301 	ASSERT(q->q_next == NULL);
9302 	ip1dbg(("ip_sioctl_addif\n"));
9303 	/* Existence of mp1 has been checked in ip_wput_nondata */
9304 	mp1 = mp->b_cont->b_cont;
9305 	/*
9306 	 * Null terminate the string to protect against buffer
9307 	 * overrun. String was generated by user code and may not
9308 	 * be trusted.
9309 	 */
9310 	lifr = (struct lifreq *)mp1->b_rptr;
9311 	lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
9312 	name = lifr->lifr_name;
9313 	ASSERT(CONN_Q(q));
9314 	connp = Q_TO_CONN(q);
9315 	isv6 = (connp->conn_family == AF_INET6);
9316 	zoneid = connp->conn_zoneid;
9317 	namelen = mi_strlen(name);
9318 	if (namelen == 0)
9319 		return (EINVAL);
9320 
9321 	exists = B_FALSE;
9322 	if ((namelen + 1 == sizeof (ipif_loopback_name)) &&
9323 	    (mi_strcmp(name, ipif_loopback_name) == 0)) {
9324 		/*
9325 		 * Allow creating lo0 using SIOCLIFADDIF.
9326 		 * can't be any other writer thread. So can pass null below
9327 		 * for the last 4 args to ipif_lookup_name.
9328 		 */
9329 		ipif = ipif_lookup_on_name(lifr->lifr_name, namelen, B_TRUE,
9330 		    &exists, isv6, zoneid, ipst);
9331 		/* Prevent any further action */
9332 		if (ipif == NULL) {
9333 			return (ENOBUFS);
9334 		} else if (!exists) {
9335 			/* We created the ipif now and as writer */
9336 			ipif_refrele(ipif);
9337 			return (0);
9338 		} else {
9339 			ill = ipif->ipif_ill;
9340 			ill_refhold(ill);
9341 			ipif_refrele(ipif);
9342 		}
9343 	} else {
9344 		/* Look for a colon in the name. */
9345 		endp = &name[namelen];
9346 		for (cp = endp; --cp > name; ) {
9347 			if (*cp == IPIF_SEPARATOR_CHAR) {
9348 				found_sep = B_TRUE;
9349 				/*
9350 				 * Reject any non-decimal aliases for plumbing
9351 				 * of logical interfaces. Aliases with leading
9352 				 * zeroes are also rejected as they introduce
9353 				 * ambiguity in the naming of the interfaces.
9354 				 * Comparing with "0" takes care of all such
9355 				 * cases.
9356 				 */
9357 				if ((strncmp("0", cp+1, 1)) == 0)
9358 					return (EINVAL);
9359 
9360 				if (ddi_strtol(cp+1, &endp, 10, &id) != 0 ||
9361 				    id <= 0 || *endp != '\0') {
9362 					return (EINVAL);
9363 				}
9364 				*cp = '\0';
9365 				break;
9366 			}
9367 		}
9368 		ill = ill_lookup_on_name(name, B_FALSE, isv6, NULL, ipst);
9369 		if (found_sep)
9370 			*cp = IPIF_SEPARATOR_CHAR;
9371 		if (ill == NULL)
9372 			return (ENXIO);
9373 	}
9374 
9375 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_process_ioctl, NEW_OP,
9376 	    B_TRUE);
9377 
9378 	/*
9379 	 * Release the refhold due to the lookup, now that we are excl
9380 	 * or we are just returning
9381 	 */
9382 	ill_refrele(ill);
9383 
9384 	if (ipsq == NULL)
9385 		return (EINPROGRESS);
9386 
9387 	/* We are now exclusive on the IPSQ */
9388 	ASSERT(IAM_WRITER_ILL(ill));
9389 
9390 	if (found_sep) {
9391 		/* Now see if there is an IPIF with this unit number. */
9392 		for (ipif = ill->ill_ipif; ipif != NULL;
9393 		    ipif = ipif->ipif_next) {
9394 			if (ipif->ipif_id == id) {
9395 				err = EEXIST;
9396 				goto done;
9397 			}
9398 		}
9399 	}
9400 
9401 	/*
9402 	 * We use IRE_LOCAL for lo0:1 etc. for "receive only" use
9403 	 * of lo0.  Plumbing for lo0:0 happens in ipif_lookup_on_name()
9404 	 * instead.
9405 	 */
9406 	if ((ipif = ipif_allocate(ill, found_sep ? id : -1, IRE_LOCAL,
9407 	    B_TRUE, B_TRUE, &err)) == NULL) {
9408 		goto done;
9409 	}
9410 
9411 	/* Return created name with ioctl */
9412 	(void) sprintf(lifr->lifr_name, "%s%c%d", ill->ill_name,
9413 	    IPIF_SEPARATOR_CHAR, ipif->ipif_id);
9414 	ip1dbg(("created %s\n", lifr->lifr_name));
9415 
9416 	/* Set address */
9417 	sin = (sin_t *)&lifr->lifr_addr;
9418 	if (sin->sin_family != AF_UNSPEC) {
9419 		err = ip_sioctl_addr(ipif, sin, q, mp,
9420 		    &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], lifr);
9421 	}
9422 
9423 done:
9424 	ipsq_exit(ipsq);
9425 	return (err);
9426 }
9427 
9428 /*
9429  * Remove an existing logical interface. If ipif_id is zero (i.e. not a logical
9430  * interface) delete it based on the IP address (on this physical interface).
9431  * Otherwise delete it based on the ipif_id.
9432  * Also, special handling to allow a removeif of lo0.
9433  */
9434 /* ARGSUSED */
9435 int
ip_sioctl_removeif(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_if_req)9436 ip_sioctl_removeif(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9437     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
9438 {
9439 	conn_t		*connp;
9440 	ill_t		*ill = ipif->ipif_ill;
9441 	boolean_t	 success;
9442 	ip_stack_t	*ipst;
9443 
9444 	ipst = CONNQ_TO_IPST(q);
9445 
9446 	ASSERT(q->q_next == NULL);
9447 	ip1dbg(("ip_sioctl_remove_if(%s:%u %p)\n",
9448 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
9449 	ASSERT(IAM_WRITER_IPIF(ipif));
9450 
9451 	connp = Q_TO_CONN(q);
9452 	/*
9453 	 * Special case for unplumbing lo0 (the loopback physical interface).
9454 	 * If unplumbing lo0, the incoming address structure has been
9455 	 * initialized to all zeros. When unplumbing lo0, all its logical
9456 	 * interfaces must be removed too.
9457 	 *
9458 	 * Note that this interface may be called to remove a specific
9459 	 * loopback logical interface (eg, lo0:1). But in that case
9460 	 * ipif->ipif_id != 0 so that the code path for that case is the
9461 	 * same as any other interface (meaning it skips the code directly
9462 	 * below).
9463 	 */
9464 	if (ipif->ipif_id == 0 && ill->ill_net_type == IRE_LOOPBACK) {
9465 		if (sin->sin_family == AF_UNSPEC &&
9466 		    (IN6_IS_ADDR_UNSPECIFIED(&((sin6_t *)sin)->sin6_addr))) {
9467 			/*
9468 			 * Mark it condemned. No new ref. will be made to ill.
9469 			 */
9470 			mutex_enter(&ill->ill_lock);
9471 			ill->ill_state_flags |= ILL_CONDEMNED;
9472 			for (ipif = ill->ill_ipif; ipif != NULL;
9473 			    ipif = ipif->ipif_next) {
9474 				ipif->ipif_state_flags |= IPIF_CONDEMNED;
9475 			}
9476 			mutex_exit(&ill->ill_lock);
9477 
9478 			ipif = ill->ill_ipif;
9479 			/* unplumb the loopback interface */
9480 			ill_delete(ill);
9481 			mutex_enter(&connp->conn_lock);
9482 			mutex_enter(&ill->ill_lock);
9483 
9484 			/* Are any references to this ill active */
9485 			if (ill_is_freeable(ill)) {
9486 				mutex_exit(&ill->ill_lock);
9487 				mutex_exit(&connp->conn_lock);
9488 				ill_delete_tail(ill);
9489 				mi_free(ill);
9490 				return (0);
9491 			}
9492 			success = ipsq_pending_mp_add(connp, ipif,
9493 			    CONNP_TO_WQ(connp), mp, ILL_FREE);
9494 			mutex_exit(&connp->conn_lock);
9495 			mutex_exit(&ill->ill_lock);
9496 			if (success)
9497 				return (EINPROGRESS);
9498 			else
9499 				return (EINTR);
9500 		}
9501 	}
9502 
9503 	if (ipif->ipif_id == 0) {
9504 		ipsq_t *ipsq;
9505 
9506 		/* Find based on address */
9507 		if (ipif->ipif_isv6) {
9508 			sin6_t *sin6;
9509 
9510 			if (sin->sin_family != AF_INET6)
9511 				return (EAFNOSUPPORT);
9512 
9513 			sin6 = (sin6_t *)sin;
9514 			/* We are a writer, so we should be able to lookup */
9515 			ipif = ipif_lookup_addr_exact_v6(&sin6->sin6_addr, ill,
9516 			    ipst);
9517 		} else {
9518 			if (sin->sin_family != AF_INET)
9519 				return (EAFNOSUPPORT);
9520 
9521 			/* We are a writer, so we should be able to lookup */
9522 			ipif = ipif_lookup_addr_exact(sin->sin_addr.s_addr, ill,
9523 			    ipst);
9524 		}
9525 		if (ipif == NULL) {
9526 			return (EADDRNOTAVAIL);
9527 		}
9528 
9529 		/*
9530 		 * It is possible for a user to send an SIOCLIFREMOVEIF with
9531 		 * lifr_name of the physical interface but with an ip address
9532 		 * lifr_addr of a logical interface plumbed over it.
9533 		 * So update ipx_current_ipif now that ipif points to the
9534 		 * correct one.
9535 		 */
9536 		ipsq = ipif->ipif_ill->ill_phyint->phyint_ipsq;
9537 		ipsq->ipsq_xop->ipx_current_ipif = ipif;
9538 
9539 		/* This is a writer */
9540 		ipif_refrele(ipif);
9541 	}
9542 
9543 	/*
9544 	 * Can not delete instance zero since it is tied to the ill.
9545 	 */
9546 	if (ipif->ipif_id == 0)
9547 		return (EBUSY);
9548 
9549 	mutex_enter(&ill->ill_lock);
9550 	ipif->ipif_state_flags |= IPIF_CONDEMNED;
9551 	mutex_exit(&ill->ill_lock);
9552 
9553 	ipif_free(ipif);
9554 
9555 	mutex_enter(&connp->conn_lock);
9556 	mutex_enter(&ill->ill_lock);
9557 
9558 	/* Are any references to this ipif active */
9559 	if (ipif_is_freeable(ipif)) {
9560 		mutex_exit(&ill->ill_lock);
9561 		mutex_exit(&connp->conn_lock);
9562 		ipif_non_duplicate(ipif);
9563 		(void) ipif_down_tail(ipif);
9564 		ipif_free_tail(ipif); /* frees ipif */
9565 		return (0);
9566 	}
9567 	success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp), mp,
9568 	    IPIF_FREE);
9569 	mutex_exit(&ill->ill_lock);
9570 	mutex_exit(&connp->conn_lock);
9571 	if (success)
9572 		return (EINPROGRESS);
9573 	else
9574 		return (EINTR);
9575 }
9576 
9577 /*
9578  * Restart the removeif ioctl. The refcnt has gone down to 0.
9579  * The ipif is already condemned. So can't find it thru lookups.
9580  */
9581 /* ARGSUSED */
9582 int
ip_sioctl_removeif_restart(ipif_t * ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_if_req)9583 ip_sioctl_removeif_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
9584     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_if_req)
9585 {
9586 	ill_t *ill = ipif->ipif_ill;
9587 
9588 	ASSERT(IAM_WRITER_IPIF(ipif));
9589 	ASSERT(ipif->ipif_state_flags & IPIF_CONDEMNED);
9590 
9591 	ip1dbg(("ip_sioctl_removeif_restart(%s:%u %p)\n",
9592 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
9593 
9594 	if (ipif->ipif_id == 0 && ill->ill_net_type == IRE_LOOPBACK) {
9595 		ASSERT(ill->ill_state_flags & ILL_CONDEMNED);
9596 		ill_delete_tail(ill);
9597 		mi_free(ill);
9598 		return (0);
9599 	}
9600 
9601 	ipif_non_duplicate(ipif);
9602 	(void) ipif_down_tail(ipif);
9603 	ipif_free_tail(ipif);
9604 
9605 	return (0);
9606 }
9607 
9608 /*
9609  * Set the local interface address using the given prefix and ill_token.
9610  */
9611 /* ARGSUSED */
9612 int
ip_sioctl_prefix(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * dummy_ipip,void * dummy_ifreq)9613 ip_sioctl_prefix(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9614     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
9615 {
9616 	int err;
9617 	in6_addr_t v6addr;
9618 	sin6_t *sin6;
9619 	ill_t *ill;
9620 	int i;
9621 
9622 	ip1dbg(("ip_sioctl_prefix(%s:%u %p)\n",
9623 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9624 
9625 	ASSERT(IAM_WRITER_IPIF(ipif));
9626 
9627 	if (!ipif->ipif_isv6)
9628 		return (EINVAL);
9629 
9630 	if (sin->sin_family != AF_INET6)
9631 		return (EAFNOSUPPORT);
9632 
9633 	sin6 = (sin6_t *)sin;
9634 	v6addr = sin6->sin6_addr;
9635 	ill = ipif->ipif_ill;
9636 
9637 	if (IN6_IS_ADDR_UNSPECIFIED(&v6addr) ||
9638 	    IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token))
9639 		return (EADDRNOTAVAIL);
9640 
9641 	for (i = 0; i < 4; i++)
9642 		sin6->sin6_addr.s6_addr32[i] |= ill->ill_token.s6_addr32[i];
9643 
9644 	err = ip_sioctl_addr(ipif, sin, q, mp,
9645 	    &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], dummy_ifreq);
9646 	return (err);
9647 }
9648 
9649 /*
9650  * Restart entry point to restart the address set operation after the
9651  * refcounts have dropped to zero.
9652  */
9653 /* ARGSUSED */
9654 int
ip_sioctl_prefix_restart(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)9655 ip_sioctl_prefix_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9656     ip_ioctl_cmd_t *ipip, void *ifreq)
9657 {
9658 	ip1dbg(("ip_sioctl_prefix_restart(%s:%u %p)\n",
9659 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9660 	return (ip_sioctl_addr_restart(ipif, sin, q, mp, ipip, ifreq));
9661 }
9662 
9663 /*
9664  * Set the local interface address.
9665  * Allow an address of all zero when the interface is down.
9666  */
9667 /* ARGSUSED */
9668 int
ip_sioctl_addr(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * dummy_ipip,void * dummy_ifreq)9669 ip_sioctl_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9670     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
9671 {
9672 	int err = 0;
9673 	in6_addr_t v6addr;
9674 	boolean_t need_up = B_FALSE;
9675 	ill_t *ill;
9676 	int i;
9677 
9678 	ip1dbg(("ip_sioctl_addr(%s:%u %p)\n",
9679 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9680 
9681 	ASSERT(IAM_WRITER_IPIF(ipif));
9682 
9683 	ill = ipif->ipif_ill;
9684 	if (ipif->ipif_isv6) {
9685 		sin6_t *sin6;
9686 		phyint_t *phyi;
9687 
9688 		if (sin->sin_family != AF_INET6)
9689 			return (EAFNOSUPPORT);
9690 
9691 		sin6 = (sin6_t *)sin;
9692 		v6addr = sin6->sin6_addr;
9693 		phyi = ill->ill_phyint;
9694 
9695 		/*
9696 		 * Enforce that true multicast interfaces have a link-local
9697 		 * address for logical unit 0.
9698 		 *
9699 		 * However for those ipif's for which link-local address was
9700 		 * not created by default, also allow setting :: as the address.
9701 		 * This scenario would arise, when we delete an address on ipif
9702 		 * with logical unit 0, we would want to set :: as the address.
9703 		 */
9704 		if (ipif->ipif_id == 0 &&
9705 		    (ill->ill_flags & ILLF_MULTICAST) &&
9706 		    !(ipif->ipif_flags & (IPIF_POINTOPOINT)) &&
9707 		    !(phyi->phyint_flags & (PHYI_LOOPBACK)) &&
9708 		    !IN6_IS_ADDR_LINKLOCAL(&v6addr)) {
9709 
9710 			/*
9711 			 * if default link-local was not created by kernel for
9712 			 * this ill, allow setting :: as the address on ipif:0.
9713 			 */
9714 			if (ill->ill_flags & ILLF_NOLINKLOCAL) {
9715 				if (!IN6_IS_ADDR_UNSPECIFIED(&v6addr))
9716 					return (EADDRNOTAVAIL);
9717 			} else {
9718 				return (EADDRNOTAVAIL);
9719 			}
9720 		}
9721 
9722 		/*
9723 		 * up interfaces shouldn't have the unspecified address
9724 		 * unless they also have the IPIF_NOLOCAL flags set and
9725 		 * have a subnet assigned.
9726 		 */
9727 		if ((ipif->ipif_flags & IPIF_UP) &&
9728 		    IN6_IS_ADDR_UNSPECIFIED(&v6addr) &&
9729 		    (!(ipif->ipif_flags & IPIF_NOLOCAL) ||
9730 		    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) {
9731 			return (EADDRNOTAVAIL);
9732 		}
9733 
9734 		if (!ip_local_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
9735 			return (EADDRNOTAVAIL);
9736 	} else {
9737 		ipaddr_t addr;
9738 
9739 		if (sin->sin_family != AF_INET)
9740 			return (EAFNOSUPPORT);
9741 
9742 		addr = sin->sin_addr.s_addr;
9743 
9744 		/* Allow INADDR_ANY as the local address. */
9745 		if (addr != INADDR_ANY &&
9746 		    !ip_addr_ok_v4(addr, ipif->ipif_net_mask))
9747 			return (EADDRNOTAVAIL);
9748 
9749 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
9750 	}
9751 	/*
9752 	 * verify that the address being configured is permitted by the
9753 	 * ill_allowed_ips[] for the interface.
9754 	 */
9755 	if (ill->ill_allowed_ips_cnt > 0) {
9756 		for (i = 0; i < ill->ill_allowed_ips_cnt; i++) {
9757 			if (IN6_ARE_ADDR_EQUAL(&ill->ill_allowed_ips[i],
9758 			    &v6addr))
9759 				break;
9760 		}
9761 		if (i == ill->ill_allowed_ips_cnt) {
9762 			pr_addr_dbg("!allowed addr %s\n", AF_INET6, &v6addr);
9763 			return (EPERM);
9764 		}
9765 	}
9766 	/*
9767 	 * Even if there is no change we redo things just to rerun
9768 	 * ipif_set_default.
9769 	 */
9770 	if (ipif->ipif_flags & IPIF_UP) {
9771 		/*
9772 		 * Setting a new local address, make sure
9773 		 * we have net and subnet bcast ire's for
9774 		 * the old address if we need them.
9775 		 */
9776 		/*
9777 		 * If the interface is already marked up,
9778 		 * we call ipif_down which will take care
9779 		 * of ditching any IREs that have been set
9780 		 * up based on the old interface address.
9781 		 */
9782 		err = ipif_logical_down(ipif, q, mp);
9783 		if (err == EINPROGRESS)
9784 			return (err);
9785 		(void) ipif_down_tail(ipif);
9786 		need_up = 1;
9787 	}
9788 
9789 	err = ip_sioctl_addr_tail(ipif, sin, q, mp, need_up);
9790 	return (err);
9791 }
9792 
9793 int
ip_sioctl_addr_tail(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,boolean_t need_up)9794 ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9795     boolean_t need_up)
9796 {
9797 	in6_addr_t v6addr;
9798 	in6_addr_t ov6addr;
9799 	ipaddr_t addr;
9800 	sin6_t	*sin6;
9801 	int	sinlen;
9802 	int	err = 0;
9803 	ill_t	*ill = ipif->ipif_ill;
9804 	boolean_t need_dl_down;
9805 	boolean_t need_arp_down;
9806 	struct iocblk *iocp;
9807 
9808 	iocp = (mp != NULL) ? (struct iocblk *)mp->b_rptr : NULL;
9809 
9810 	ip1dbg(("ip_sioctl_addr_tail(%s:%u %p)\n",
9811 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
9812 	ASSERT(IAM_WRITER_IPIF(ipif));
9813 
9814 	/* Must cancel any pending timer before taking the ill_lock */
9815 	if (ipif->ipif_recovery_id != 0)
9816 		(void) untimeout(ipif->ipif_recovery_id);
9817 	ipif->ipif_recovery_id = 0;
9818 
9819 	if (ipif->ipif_isv6) {
9820 		sin6 = (sin6_t *)sin;
9821 		v6addr = sin6->sin6_addr;
9822 		sinlen = sizeof (struct sockaddr_in6);
9823 	} else {
9824 		addr = sin->sin_addr.s_addr;
9825 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
9826 		sinlen = sizeof (struct sockaddr_in);
9827 	}
9828 	mutex_enter(&ill->ill_lock);
9829 	ov6addr = ipif->ipif_v6lcl_addr;
9830 	ipif->ipif_v6lcl_addr = v6addr;
9831 	sctp_update_ipif_addr(ipif, ov6addr);
9832 	ipif->ipif_addr_ready = 0;
9833 
9834 	ip_rts_newaddrmsg(RTM_CHGADDR, 0, ipif, RTSQ_DEFAULT);
9835 
9836 	/*
9837 	 * If the interface was previously marked as a duplicate, then since
9838 	 * we've now got a "new" address, it should no longer be considered a
9839 	 * duplicate -- even if the "new" address is the same as the old one.
9840 	 * Note that if all ipifs are down, we may have a pending ARP down
9841 	 * event to handle.  This is because we want to recover from duplicates
9842 	 * and thus delay tearing down ARP until the duplicates have been
9843 	 * removed or disabled.
9844 	 */
9845 	need_dl_down = need_arp_down = B_FALSE;
9846 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
9847 		need_arp_down = !need_up;
9848 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
9849 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
9850 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
9851 			need_dl_down = B_TRUE;
9852 		}
9853 	}
9854 
9855 	ipif_set_default(ipif);
9856 
9857 	/*
9858 	 * If we've just manually set the IPv6 link-local address (0th ipif),
9859 	 * tag the ill so that future updates to the interface ID don't result
9860 	 * in this address getting automatically reconfigured from under the
9861 	 * administrator.
9862 	 */
9863 	if (ipif->ipif_isv6 && ipif->ipif_id == 0) {
9864 		if (iocp == NULL || (iocp->ioc_cmd == SIOCSLIFADDR &&
9865 		    !IN6_IS_ADDR_UNSPECIFIED(&v6addr)))
9866 			ill->ill_manual_linklocal = 1;
9867 	}
9868 
9869 	/*
9870 	 * When publishing an interface address change event, we only notify
9871 	 * the event listeners of the new address.  It is assumed that if they
9872 	 * actively care about the addresses assigned that they will have
9873 	 * already discovered the previous address assigned (if there was one.)
9874 	 *
9875 	 * Don't attach nic event message for SIOCLIFADDIF ioctl.
9876 	 */
9877 	if (iocp != NULL && iocp->ioc_cmd != SIOCLIFADDIF) {
9878 		ill_nic_event_dispatch(ill, MAP_IPIF_ID(ipif->ipif_id),
9879 		    NE_ADDRESS_CHANGE, sin, sinlen);
9880 	}
9881 
9882 	mutex_exit(&ill->ill_lock);
9883 
9884 	if (need_up) {
9885 		/*
9886 		 * Now bring the interface back up.  If this
9887 		 * is the only IPIF for the ILL, ipif_up
9888 		 * will have to re-bind to the device, so
9889 		 * we may get back EINPROGRESS, in which
9890 		 * case, this IOCTL will get completed in
9891 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
9892 		 */
9893 		err = ipif_up(ipif, q, mp);
9894 	} else {
9895 		/* Perhaps ilgs should use this ill */
9896 		update_conn_ill(NULL, ill->ill_ipst);
9897 	}
9898 
9899 	if (need_dl_down)
9900 		ill_dl_down(ill);
9901 
9902 	if (need_arp_down && !ill->ill_isv6)
9903 		(void) ipif_arp_down(ipif);
9904 
9905 	/*
9906 	 * The default multicast interface might have changed (for
9907 	 * instance if the IPv6 scope of the address changed)
9908 	 */
9909 	ire_increment_multicast_generation(ill->ill_ipst, ill->ill_isv6);
9910 
9911 	return (err);
9912 }
9913 
9914 /*
9915  * Restart entry point to restart the address set operation after the
9916  * refcounts have dropped to zero.
9917  */
9918 /* ARGSUSED */
9919 int
ip_sioctl_addr_restart(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)9920 ip_sioctl_addr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9921     ip_ioctl_cmd_t *ipip, void *ifreq)
9922 {
9923 	ip1dbg(("ip_sioctl_addr_restart(%s:%u %p)\n",
9924 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9925 	ASSERT(IAM_WRITER_IPIF(ipif));
9926 	(void) ipif_down_tail(ipif);
9927 	return (ip_sioctl_addr_tail(ipif, sin, q, mp, B_TRUE));
9928 }
9929 
9930 /* ARGSUSED */
9931 int
ip_sioctl_get_addr(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)9932 ip_sioctl_get_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9933     ip_ioctl_cmd_t *ipip, void *if_req)
9934 {
9935 	sin6_t *sin6 = (struct sockaddr_in6 *)sin;
9936 	struct lifreq *lifr = (struct lifreq *)if_req;
9937 
9938 	ip1dbg(("ip_sioctl_get_addr(%s:%u %p)\n",
9939 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9940 	/*
9941 	 * The net mask and address can't change since we have a
9942 	 * reference to the ipif. So no lock is necessary.
9943 	 */
9944 	if (ipif->ipif_isv6) {
9945 		*sin6 = sin6_null;
9946 		sin6->sin6_family = AF_INET6;
9947 		sin6->sin6_addr = ipif->ipif_v6lcl_addr;
9948 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
9949 		lifr->lifr_addrlen =
9950 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
9951 	} else {
9952 		*sin = sin_null;
9953 		sin->sin_family = AF_INET;
9954 		sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
9955 		if (ipip->ipi_cmd_type == LIF_CMD) {
9956 			lifr->lifr_addrlen =
9957 			    ip_mask_to_plen(ipif->ipif_net_mask);
9958 		}
9959 	}
9960 	return (0);
9961 }
9962 
9963 /*
9964  * Set the destination address for a pt-pt interface.
9965  */
9966 /* ARGSUSED */
9967 int
ip_sioctl_dstaddr(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)9968 ip_sioctl_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9969     ip_ioctl_cmd_t *ipip, void *if_req)
9970 {
9971 	int err = 0;
9972 	in6_addr_t v6addr;
9973 	boolean_t need_up = B_FALSE;
9974 
9975 	ip1dbg(("ip_sioctl_dstaddr(%s:%u %p)\n",
9976 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9977 	ASSERT(IAM_WRITER_IPIF(ipif));
9978 
9979 	if (ipif->ipif_isv6) {
9980 		sin6_t *sin6;
9981 
9982 		if (sin->sin_family != AF_INET6)
9983 			return (EAFNOSUPPORT);
9984 
9985 		sin6 = (sin6_t *)sin;
9986 		v6addr = sin6->sin6_addr;
9987 
9988 		if (!ip_remote_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
9989 			return (EADDRNOTAVAIL);
9990 	} else {
9991 		ipaddr_t addr;
9992 
9993 		if (sin->sin_family != AF_INET)
9994 			return (EAFNOSUPPORT);
9995 
9996 		addr = sin->sin_addr.s_addr;
9997 		if (addr != INADDR_ANY &&
9998 		    !ip_addr_ok_v4(addr, ipif->ipif_net_mask)) {
9999 			return (EADDRNOTAVAIL);
10000 		}
10001 
10002 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10003 	}
10004 
10005 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, &v6addr))
10006 		return (0);	/* No change */
10007 
10008 	if (ipif->ipif_flags & IPIF_UP) {
10009 		/*
10010 		 * If the interface is already marked up,
10011 		 * we call ipif_down which will take care
10012 		 * of ditching any IREs that have been set
10013 		 * up based on the old pp dst address.
10014 		 */
10015 		err = ipif_logical_down(ipif, q, mp);
10016 		if (err == EINPROGRESS)
10017 			return (err);
10018 		(void) ipif_down_tail(ipif);
10019 		need_up = B_TRUE;
10020 	}
10021 	/*
10022 	 * could return EINPROGRESS. If so ioctl will complete in
10023 	 * ip_rput_dlpi_writer
10024 	 */
10025 	err = ip_sioctl_dstaddr_tail(ipif, sin, q, mp, need_up);
10026 	return (err);
10027 }
10028 
10029 static int
ip_sioctl_dstaddr_tail(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,boolean_t need_up)10030 ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10031     boolean_t need_up)
10032 {
10033 	in6_addr_t v6addr;
10034 	ill_t	*ill = ipif->ipif_ill;
10035 	int	err = 0;
10036 	boolean_t need_dl_down;
10037 	boolean_t need_arp_down;
10038 
10039 	ip1dbg(("ip_sioctl_dstaddr_tail(%s:%u %p)\n", ill->ill_name,
10040 	    ipif->ipif_id, (void *)ipif));
10041 
10042 	/* Must cancel any pending timer before taking the ill_lock */
10043 	if (ipif->ipif_recovery_id != 0)
10044 		(void) untimeout(ipif->ipif_recovery_id);
10045 	ipif->ipif_recovery_id = 0;
10046 
10047 	if (ipif->ipif_isv6) {
10048 		sin6_t *sin6;
10049 
10050 		sin6 = (sin6_t *)sin;
10051 		v6addr = sin6->sin6_addr;
10052 	} else {
10053 		ipaddr_t addr;
10054 
10055 		addr = sin->sin_addr.s_addr;
10056 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10057 	}
10058 	mutex_enter(&ill->ill_lock);
10059 	/* Set point to point destination address. */
10060 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
10061 		/*
10062 		 * Allow this as a means of creating logical
10063 		 * pt-pt interfaces on top of e.g. an Ethernet.
10064 		 * XXX Undocumented HACK for testing.
10065 		 * pt-pt interfaces are created with NUD disabled.
10066 		 */
10067 		ipif->ipif_flags |= IPIF_POINTOPOINT;
10068 		ipif->ipif_flags &= ~IPIF_BROADCAST;
10069 		if (ipif->ipif_isv6)
10070 			ill->ill_flags |= ILLF_NONUD;
10071 	}
10072 
10073 	/*
10074 	 * If the interface was previously marked as a duplicate, then since
10075 	 * we've now got a "new" address, it should no longer be considered a
10076 	 * duplicate -- even if the "new" address is the same as the old one.
10077 	 * Note that if all ipifs are down, we may have a pending ARP down
10078 	 * event to handle.
10079 	 */
10080 	need_dl_down = need_arp_down = B_FALSE;
10081 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
10082 		need_arp_down = !need_up;
10083 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
10084 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
10085 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
10086 			need_dl_down = B_TRUE;
10087 		}
10088 	}
10089 
10090 	/*
10091 	 * If we've just manually set the IPv6 destination link-local address
10092 	 * (0th ipif), tag the ill so that future updates to the destination
10093 	 * interface ID (as can happen with interfaces over IP tunnels) don't
10094 	 * result in this address getting automatically reconfigured from
10095 	 * under the administrator.
10096 	 */
10097 	if (ipif->ipif_isv6 && ipif->ipif_id == 0)
10098 		ill->ill_manual_dst_linklocal = 1;
10099 
10100 	/* Set the new address. */
10101 	ipif->ipif_v6pp_dst_addr = v6addr;
10102 	/* Make sure subnet tracks pp_dst */
10103 	ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
10104 	mutex_exit(&ill->ill_lock);
10105 
10106 	if (need_up) {
10107 		/*
10108 		 * Now bring the interface back up.  If this
10109 		 * is the only IPIF for the ILL, ipif_up
10110 		 * will have to re-bind to the device, so
10111 		 * we may get back EINPROGRESS, in which
10112 		 * case, this IOCTL will get completed in
10113 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
10114 		 */
10115 		err = ipif_up(ipif, q, mp);
10116 	}
10117 
10118 	if (need_dl_down)
10119 		ill_dl_down(ill);
10120 	if (need_arp_down && !ipif->ipif_isv6)
10121 		(void) ipif_arp_down(ipif);
10122 
10123 	return (err);
10124 }
10125 
10126 /*
10127  * Restart entry point to restart the dstaddress set operation after the
10128  * refcounts have dropped to zero.
10129  */
10130 /* ARGSUSED */
10131 int
ip_sioctl_dstaddr_restart(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)10132 ip_sioctl_dstaddr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10133     ip_ioctl_cmd_t *ipip, void *ifreq)
10134 {
10135 	ip1dbg(("ip_sioctl_dstaddr_restart(%s:%u %p)\n",
10136 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10137 	(void) ipif_down_tail(ipif);
10138 	return (ip_sioctl_dstaddr_tail(ipif, sin, q, mp, B_TRUE));
10139 }
10140 
10141 /* ARGSUSED */
10142 int
ip_sioctl_get_dstaddr(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10143 ip_sioctl_get_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10144     ip_ioctl_cmd_t *ipip, void *if_req)
10145 {
10146 	sin6_t	*sin6 = (struct sockaddr_in6 *)sin;
10147 
10148 	ip1dbg(("ip_sioctl_get_dstaddr(%s:%u %p)\n",
10149 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10150 	/*
10151 	 * Get point to point destination address. The addresses can't
10152 	 * change since we hold a reference to the ipif.
10153 	 */
10154 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0)
10155 		return (EADDRNOTAVAIL);
10156 
10157 	if (ipif->ipif_isv6) {
10158 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
10159 		*sin6 = sin6_null;
10160 		sin6->sin6_family = AF_INET6;
10161 		sin6->sin6_addr = ipif->ipif_v6pp_dst_addr;
10162 	} else {
10163 		*sin = sin_null;
10164 		sin->sin_family = AF_INET;
10165 		sin->sin_addr.s_addr = ipif->ipif_pp_dst_addr;
10166 	}
10167 	return (0);
10168 }
10169 
10170 /*
10171  * Check which flags will change by the given flags being set
10172  * silently ignore flags which userland is not allowed to control.
10173  * (Because these flags may change between SIOCGLIFFLAGS and
10174  * SIOCSLIFFLAGS, and that's outside of userland's control,
10175  * we need to silently ignore them rather than fail.)
10176  */
10177 static void
ip_sioctl_flags_onoff(ipif_t * ipif,uint64_t flags,uint64_t * onp,uint64_t * offp)10178 ip_sioctl_flags_onoff(ipif_t *ipif, uint64_t flags, uint64_t *onp,
10179     uint64_t *offp)
10180 {
10181 	ill_t		*ill = ipif->ipif_ill;
10182 	phyint_t 	*phyi = ill->ill_phyint;
10183 	uint64_t	cantchange_flags, intf_flags;
10184 	uint64_t	turn_on, turn_off;
10185 
10186 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
10187 	cantchange_flags = IFF_CANTCHANGE;
10188 	if (IS_IPMP(ill))
10189 		cantchange_flags |= IFF_IPMP_CANTCHANGE;
10190 	turn_on = (flags ^ intf_flags) & ~cantchange_flags;
10191 	turn_off = intf_flags & turn_on;
10192 	turn_on ^= turn_off;
10193 	*onp = turn_on;
10194 	*offp = turn_off;
10195 }
10196 
10197 /*
10198  * Set interface flags.  Many flags require special handling (e.g.,
10199  * bringing the interface down); see below for details.
10200  *
10201  * NOTE : We really don't enforce that ipif_id zero should be used
10202  *	  for setting any flags other than IFF_LOGINT_FLAGS. This
10203  *	  is because applications generally does SICGLIFFLAGS and
10204  *	  ORs in the new flags (that affects the logical) and does a
10205  *	  SIOCSLIFFLAGS. Thus, "flags" below could contain bits other
10206  *	  than IFF_LOGINT_FLAGS. One could check whether "turn_on" - the
10207  *	  flags that will be turned on is correct with respect to
10208  *	  ipif_id 0. For backward compatibility reasons, it is not done.
10209  */
10210 /* ARGSUSED */
10211 int
ip_sioctl_flags(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10212 ip_sioctl_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10213     ip_ioctl_cmd_t *ipip, void *if_req)
10214 {
10215 	uint64_t turn_on;
10216 	uint64_t turn_off;
10217 	int	err = 0;
10218 	phyint_t *phyi;
10219 	ill_t *ill;
10220 	conn_t *connp;
10221 	uint64_t intf_flags;
10222 	boolean_t phyint_flags_modified = B_FALSE;
10223 	uint64_t flags;
10224 	struct ifreq *ifr;
10225 	struct lifreq *lifr;
10226 	boolean_t set_linklocal = B_FALSE;
10227 
10228 	ip1dbg(("ip_sioctl_flags(%s:%u %p)\n",
10229 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10230 
10231 	ASSERT(IAM_WRITER_IPIF(ipif));
10232 
10233 	ill = ipif->ipif_ill;
10234 	phyi = ill->ill_phyint;
10235 
10236 	if (ipip->ipi_cmd_type == IF_CMD) {
10237 		ifr = (struct ifreq *)if_req;
10238 		flags =  (uint64_t)(ifr->ifr_flags & 0x0000ffff);
10239 	} else {
10240 		lifr = (struct lifreq *)if_req;
10241 		flags = lifr->lifr_flags;
10242 	}
10243 
10244 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
10245 
10246 	/*
10247 	 * Have the flags been set correctly until now?
10248 	 */
10249 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
10250 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
10251 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
10252 	/*
10253 	 * Compare the new flags to the old, and partition
10254 	 * into those coming on and those going off.
10255 	 * For the 16 bit command keep the bits above bit 16 unchanged.
10256 	 */
10257 	if (ipip->ipi_cmd == SIOCSIFFLAGS)
10258 		flags |= intf_flags & ~0xFFFF;
10259 
10260 	/*
10261 	 * Explicitly fail attempts to change flags that are always invalid on
10262 	 * an IPMP meta-interface.
10263 	 */
10264 	if (IS_IPMP(ill) && ((flags ^ intf_flags) & IFF_IPMP_INVALID))
10265 		return (EINVAL);
10266 
10267 	ip_sioctl_flags_onoff(ipif, flags, &turn_on, &turn_off);
10268 	if ((turn_on|turn_off) == 0)
10269 		return (0);	/* No change */
10270 
10271 	/*
10272 	 * All test addresses must be IFF_DEPRECATED (to ensure source address
10273 	 * selection avoids them) -- so force IFF_DEPRECATED on, and do not
10274 	 * allow it to be turned off.
10275 	 */
10276 	if ((turn_off & (IFF_DEPRECATED|IFF_NOFAILOVER)) == IFF_DEPRECATED &&
10277 	    (turn_on|intf_flags) & IFF_NOFAILOVER)
10278 		return (EINVAL);
10279 
10280 	if ((connp = Q_TO_CONN(q)) == NULL)
10281 		return (EINVAL);
10282 
10283 	/*
10284 	 * Only vrrp control socket is allowed to change IFF_UP and
10285 	 * IFF_NOACCEPT flags when IFF_VRRP is set.
10286 	 */
10287 	if ((intf_flags & IFF_VRRP) && ((turn_off | turn_on) & IFF_UP)) {
10288 		if (!connp->conn_isvrrp)
10289 			return (EINVAL);
10290 	}
10291 
10292 	/*
10293 	 * The IFF_NOACCEPT flag can only be set on an IFF_VRRP IP address by
10294 	 * VRRP control socket.
10295 	 */
10296 	if ((turn_off | turn_on) & IFF_NOACCEPT) {
10297 		if (!connp->conn_isvrrp || !(intf_flags & IFF_VRRP))
10298 			return (EINVAL);
10299 	}
10300 
10301 	if (turn_on & IFF_NOFAILOVER) {
10302 		turn_on |= IFF_DEPRECATED;
10303 		flags |= IFF_DEPRECATED;
10304 	}
10305 
10306 	/*
10307 	 * On underlying interfaces, only allow applications to manage test
10308 	 * addresses -- otherwise, they may get confused when the address
10309 	 * moves as part of being brought up.  Likewise, prevent an
10310 	 * application-managed test address from being converted to a data
10311 	 * address.  To prevent migration of administratively up addresses in
10312 	 * the kernel, we don't allow them to be converted either.
10313 	 */
10314 	if (IS_UNDER_IPMP(ill)) {
10315 		const uint64_t appflags = IFF_DHCPRUNNING | IFF_ADDRCONF;
10316 
10317 		if ((turn_on & appflags) && !(flags & IFF_NOFAILOVER))
10318 			return (EINVAL);
10319 
10320 		if ((turn_off & IFF_NOFAILOVER) &&
10321 		    (flags & (appflags | IFF_UP | IFF_DUPLICATE)))
10322 			return (EINVAL);
10323 	}
10324 
10325 	/*
10326 	 * Only allow IFF_TEMPORARY flag to be set on
10327 	 * IPv6 interfaces.
10328 	 */
10329 	if ((turn_on & IFF_TEMPORARY) && !(ipif->ipif_isv6))
10330 		return (EINVAL);
10331 
10332 	/*
10333 	 * cannot turn off IFF_NOXMIT on  VNI interfaces.
10334 	 */
10335 	if ((turn_off & IFF_NOXMIT) && IS_VNI(ipif->ipif_ill))
10336 		return (EINVAL);
10337 
10338 	/*
10339 	 * Don't allow the IFF_ROUTER flag to be turned on on loopback
10340 	 * interfaces.  It makes no sense in that context.
10341 	 */
10342 	if ((turn_on & IFF_ROUTER) && (phyi->phyint_flags & PHYI_LOOPBACK))
10343 		return (EINVAL);
10344 
10345 	/*
10346 	 * For IPv6 ipif_id 0, don't allow the interface to be up without
10347 	 * a link local address if IFF_NOLOCAL or IFF_ANYCAST are not set.
10348 	 * If the link local address isn't set, and can be set, it will get
10349 	 * set later on in this function.
10350 	 */
10351 	if (ipif->ipif_id == 0 && ipif->ipif_isv6 &&
10352 	    (flags & IFF_UP) && !(flags & (IFF_NOLOCAL|IFF_ANYCAST)) &&
10353 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
10354 		if (ipif_cant_setlinklocal(ipif))
10355 			return (EINVAL);
10356 		set_linklocal = B_TRUE;
10357 	}
10358 
10359 	/*
10360 	 * If we modify physical interface flags, we'll potentially need to
10361 	 * send up two routing socket messages for the changes (one for the
10362 	 * IPv4 ill, and another for the IPv6 ill).  Note that here.
10363 	 */
10364 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
10365 		phyint_flags_modified = B_TRUE;
10366 
10367 	/*
10368 	 * All functioning PHYI_STANDBY interfaces start life PHYI_INACTIVE
10369 	 * (otherwise, we'd immediately use them, defeating standby).  Also,
10370 	 * since PHYI_INACTIVE has a separate meaning when PHYI_STANDBY is not
10371 	 * set, don't allow PHYI_STANDBY to be set if PHYI_INACTIVE is already
10372 	 * set, and clear PHYI_INACTIVE if PHYI_STANDBY is being cleared.  We
10373 	 * also don't allow PHYI_STANDBY if VNI is enabled since its semantics
10374 	 * will not be honored.
10375 	 */
10376 	if (turn_on & PHYI_STANDBY) {
10377 		/*
10378 		 * No need to grab ill_g_usesrc_lock here; see the
10379 		 * synchronization notes in ip.c.
10380 		 */
10381 		if (ill->ill_usesrc_grp_next != NULL ||
10382 		    intf_flags & PHYI_INACTIVE)
10383 			return (EINVAL);
10384 		if (!(flags & PHYI_FAILED)) {
10385 			flags |= PHYI_INACTIVE;
10386 			turn_on |= PHYI_INACTIVE;
10387 		}
10388 	}
10389 
10390 	if (turn_off & PHYI_STANDBY) {
10391 		flags &= ~PHYI_INACTIVE;
10392 		turn_off |= PHYI_INACTIVE;
10393 	}
10394 
10395 	/*
10396 	 * PHYI_FAILED and PHYI_INACTIVE are mutually exclusive; fail if both
10397 	 * would end up on.
10398 	 */
10399 	if ((flags & (PHYI_FAILED | PHYI_INACTIVE)) ==
10400 	    (PHYI_FAILED | PHYI_INACTIVE))
10401 		return (EINVAL);
10402 
10403 	/*
10404 	 * If ILLF_ROUTER changes, we need to change the ip forwarding
10405 	 * status of the interface.
10406 	 */
10407 	if ((turn_on | turn_off) & ILLF_ROUTER) {
10408 		err = ill_forward_set(ill, ((turn_on & ILLF_ROUTER) != 0));
10409 		if (err != 0)
10410 			return (err);
10411 	}
10412 
10413 	/*
10414 	 * If the interface is not UP and we are not going to
10415 	 * bring it UP, record the flags and return. When the
10416 	 * interface comes UP later, the right actions will be
10417 	 * taken.
10418 	 */
10419 	if (!(ipif->ipif_flags & IPIF_UP) &&
10420 	    !(turn_on & IPIF_UP)) {
10421 		/* Record new flags in their respective places. */
10422 		mutex_enter(&ill->ill_lock);
10423 		mutex_enter(&ill->ill_phyint->phyint_lock);
10424 		ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
10425 		ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
10426 		ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
10427 		ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
10428 		phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
10429 		phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
10430 		mutex_exit(&ill->ill_lock);
10431 		mutex_exit(&ill->ill_phyint->phyint_lock);
10432 
10433 		/*
10434 		 * PHYI_FAILED, PHYI_INACTIVE, and PHYI_OFFLINE are all the
10435 		 * same to the kernel: if any of them has been set by
10436 		 * userland, the interface cannot be used for data traffic.
10437 		 */
10438 		if ((turn_on|turn_off) &
10439 		    (PHYI_FAILED | PHYI_INACTIVE | PHYI_OFFLINE)) {
10440 			ASSERT(!IS_IPMP(ill));
10441 			/*
10442 			 * It's possible the ill is part of an "anonymous"
10443 			 * IPMP group rather than a real group.  In that case,
10444 			 * there are no other interfaces in the group and thus
10445 			 * no need to call ipmp_phyint_refresh_active().
10446 			 */
10447 			if (IS_UNDER_IPMP(ill))
10448 				ipmp_phyint_refresh_active(phyi);
10449 		}
10450 
10451 		if (phyint_flags_modified) {
10452 			if (phyi->phyint_illv4 != NULL) {
10453 				ip_rts_ifmsg(phyi->phyint_illv4->
10454 				    ill_ipif, RTSQ_DEFAULT);
10455 			}
10456 			if (phyi->phyint_illv6 != NULL) {
10457 				ip_rts_ifmsg(phyi->phyint_illv6->
10458 				    ill_ipif, RTSQ_DEFAULT);
10459 			}
10460 		}
10461 		/* The default multicast interface might have changed */
10462 		ire_increment_multicast_generation(ill->ill_ipst,
10463 		    ill->ill_isv6);
10464 
10465 		return (0);
10466 	} else if (set_linklocal) {
10467 		mutex_enter(&ill->ill_lock);
10468 		if (set_linklocal)
10469 			ipif->ipif_state_flags |= IPIF_SET_LINKLOCAL;
10470 		mutex_exit(&ill->ill_lock);
10471 	}
10472 
10473 	/*
10474 	 * Disallow IPv6 interfaces coming up that have the unspecified address,
10475 	 * or point-to-point interfaces with an unspecified destination. We do
10476 	 * allow the address to be unspecified for IPIF_NOLOCAL interfaces that
10477 	 * have a subnet assigned, which is how in.ndpd currently manages its
10478 	 * onlink prefix list when no addresses are configured with those
10479 	 * prefixes.
10480 	 */
10481 	if (ipif->ipif_isv6 &&
10482 	    ((IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
10483 	    (!(ipif->ipif_flags & IPIF_NOLOCAL) && !(turn_on & IPIF_NOLOCAL) ||
10484 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) ||
10485 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
10486 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)))) {
10487 		return (EINVAL);
10488 	}
10489 
10490 	/*
10491 	 * Prevent IPv4 point-to-point interfaces with a 0.0.0.0 destination
10492 	 * from being brought up.
10493 	 */
10494 	if (!ipif->ipif_isv6 &&
10495 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
10496 	    ipif->ipif_pp_dst_addr == INADDR_ANY)) {
10497 		return (EINVAL);
10498 	}
10499 
10500 	/*
10501 	 * If we are going to change one or more of the flags that are
10502 	 * IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT, IPIF_NOLOCAL, ILLF_NOARP,
10503 	 * ILLF_NONUD, IPIF_PRIVATE, IPIF_ANYCAST, IPIF_PREFERRED, and
10504 	 * IPIF_NOFAILOVER, we will take special action.  This is
10505 	 * done by bring the ipif down, changing the flags and bringing
10506 	 * it back up again.  For IPIF_NOFAILOVER, the act of bringing it
10507 	 * back up will trigger the address to be moved.
10508 	 *
10509 	 * If we are going to change IFF_NOACCEPT, we need to bring
10510 	 * all the ipifs down then bring them up again.	 The act of
10511 	 * bringing all the ipifs back up will trigger the local
10512 	 * ires being recreated with "no_accept" set/cleared.
10513 	 *
10514 	 * Note that ILLF_NOACCEPT is always set separately from the
10515 	 * other flags.
10516 	 */
10517 	if ((turn_on|turn_off) &
10518 	    (IPIF_UP|IPIF_DEPRECATED|IPIF_NOXMIT|IPIF_NOLOCAL|ILLF_NOARP|
10519 	    ILLF_NONUD|IPIF_PRIVATE|IPIF_ANYCAST|IPIF_PREFERRED|
10520 	    IPIF_NOFAILOVER)) {
10521 		/*
10522 		 * ipif_down() will ire_delete bcast ire's for the subnet,
10523 		 * while the ire_identical_ref tracks the case of IRE_BROADCAST
10524 		 * entries shared between multiple ipifs on the same subnet.
10525 		 */
10526 		if (((ipif->ipif_flags | turn_on) & IPIF_UP) &&
10527 		    !(turn_off & IPIF_UP)) {
10528 			if (ipif->ipif_flags & IPIF_UP)
10529 				ill->ill_logical_down = 1;
10530 			turn_on &= ~IPIF_UP;
10531 		}
10532 		err = ipif_down(ipif, q, mp);
10533 		ip1dbg(("ipif_down returns %d err ", err));
10534 		if (err == EINPROGRESS)
10535 			return (err);
10536 		(void) ipif_down_tail(ipif);
10537 	} else if ((turn_on|turn_off) & ILLF_NOACCEPT) {
10538 		/*
10539 		 * If we can quiesce the ill, then continue.  If not, then
10540 		 * ip_sioctl_flags_tail() will be called from
10541 		 * ipif_ill_refrele_tail().
10542 		 */
10543 		ill_down_ipifs(ill, B_TRUE);
10544 
10545 		mutex_enter(&connp->conn_lock);
10546 		mutex_enter(&ill->ill_lock);
10547 		if (!ill_is_quiescent(ill)) {
10548 			boolean_t success;
10549 
10550 			success = ipsq_pending_mp_add(connp, ill->ill_ipif,
10551 			    q, mp, ILL_DOWN);
10552 			mutex_exit(&ill->ill_lock);
10553 			mutex_exit(&connp->conn_lock);
10554 			return (success ? EINPROGRESS : EINTR);
10555 		}
10556 		mutex_exit(&ill->ill_lock);
10557 		mutex_exit(&connp->conn_lock);
10558 	}
10559 	return (ip_sioctl_flags_tail(ipif, flags, q, mp));
10560 }
10561 
10562 static int
ip_sioctl_flags_tail(ipif_t * ipif,uint64_t flags,queue_t * q,mblk_t * mp)10563 ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q, mblk_t *mp)
10564 {
10565 	ill_t	*ill;
10566 	phyint_t *phyi;
10567 	uint64_t turn_on, turn_off;
10568 	boolean_t phyint_flags_modified = B_FALSE;
10569 	int	err = 0;
10570 	boolean_t set_linklocal = B_FALSE;
10571 
10572 	ip1dbg(("ip_sioctl_flags_tail(%s:%u)\n",
10573 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
10574 
10575 	ASSERT(IAM_WRITER_IPIF(ipif));
10576 
10577 	ill = ipif->ipif_ill;
10578 	phyi = ill->ill_phyint;
10579 
10580 	ip_sioctl_flags_onoff(ipif, flags, &turn_on, &turn_off);
10581 
10582 	/*
10583 	 * IFF_UP is handled separately.
10584 	 */
10585 	turn_on &= ~IFF_UP;
10586 	turn_off &= ~IFF_UP;
10587 
10588 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
10589 		phyint_flags_modified = B_TRUE;
10590 
10591 	/*
10592 	 * Now we change the flags. Track current value of
10593 	 * other flags in their respective places.
10594 	 */
10595 	mutex_enter(&ill->ill_lock);
10596 	mutex_enter(&phyi->phyint_lock);
10597 	ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
10598 	ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
10599 	ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
10600 	ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
10601 	phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
10602 	phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
10603 	if (ipif->ipif_state_flags & IPIF_SET_LINKLOCAL) {
10604 		set_linklocal = B_TRUE;
10605 		ipif->ipif_state_flags &= ~IPIF_SET_LINKLOCAL;
10606 	}
10607 
10608 	mutex_exit(&ill->ill_lock);
10609 	mutex_exit(&phyi->phyint_lock);
10610 
10611 	if (set_linklocal)
10612 		(void) ipif_setlinklocal(ipif);
10613 
10614 	/*
10615 	 * PHYI_FAILED, PHYI_INACTIVE, and PHYI_OFFLINE are all the same to
10616 	 * the kernel: if any of them has been set by userland, the interface
10617 	 * cannot be used for data traffic.
10618 	 */
10619 	if ((turn_on|turn_off) & (PHYI_FAILED | PHYI_INACTIVE | PHYI_OFFLINE)) {
10620 		ASSERT(!IS_IPMP(ill));
10621 		/*
10622 		 * It's possible the ill is part of an "anonymous" IPMP group
10623 		 * rather than a real group.  In that case, there are no other
10624 		 * interfaces in the group and thus no need for us to call
10625 		 * ipmp_phyint_refresh_active().
10626 		 */
10627 		if (IS_UNDER_IPMP(ill))
10628 			ipmp_phyint_refresh_active(phyi);
10629 	}
10630 
10631 	if ((turn_on|turn_off) & ILLF_NOACCEPT) {
10632 		/*
10633 		 * If the ILLF_NOACCEPT flag is changed, bring up all the
10634 		 * ipifs that were brought down.
10635 		 *
10636 		 * The routing sockets messages are sent as the result
10637 		 * of ill_up_ipifs(), further, SCTP's IPIF list was updated
10638 		 * as well.
10639 		 */
10640 		err = ill_up_ipifs(ill, q, mp);
10641 	} else if ((flags & IFF_UP) && !(ipif->ipif_flags & IPIF_UP)) {
10642 		/*
10643 		 * XXX ipif_up really does not know whether a phyint flags
10644 		 * was modified or not. So, it sends up information on
10645 		 * only one routing sockets message. As we don't bring up
10646 		 * the interface and also set PHYI_ flags simultaneously
10647 		 * it should be okay.
10648 		 */
10649 		err = ipif_up(ipif, q, mp);
10650 	} else {
10651 		/*
10652 		 * Make sure routing socket sees all changes to the flags.
10653 		 * ipif_up_done* handles this when we use ipif_up.
10654 		 */
10655 		if (phyint_flags_modified) {
10656 			if (phyi->phyint_illv4 != NULL) {
10657 				ip_rts_ifmsg(phyi->phyint_illv4->
10658 				    ill_ipif, RTSQ_DEFAULT);
10659 			}
10660 			if (phyi->phyint_illv6 != NULL) {
10661 				ip_rts_ifmsg(phyi->phyint_illv6->
10662 				    ill_ipif, RTSQ_DEFAULT);
10663 			}
10664 		} else {
10665 			ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
10666 		}
10667 		/*
10668 		 * Update the flags in SCTP's IPIF list, ipif_up() will do
10669 		 * this in need_up case.
10670 		 */
10671 		sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
10672 	}
10673 
10674 	/* The default multicast interface might have changed */
10675 	ire_increment_multicast_generation(ill->ill_ipst, ill->ill_isv6);
10676 	return (err);
10677 }
10678 
10679 /*
10680  * Restart the flags operation now that the refcounts have dropped to zero.
10681  */
10682 /* ARGSUSED */
10683 int
ip_sioctl_flags_restart(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10684 ip_sioctl_flags_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10685     ip_ioctl_cmd_t *ipip, void *if_req)
10686 {
10687 	uint64_t flags;
10688 	struct ifreq *ifr = if_req;
10689 	struct lifreq *lifr = if_req;
10690 	uint64_t turn_on, turn_off;
10691 
10692 	ip1dbg(("ip_sioctl_flags_restart(%s:%u %p)\n",
10693 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10694 
10695 	if (ipip->ipi_cmd_type == IF_CMD) {
10696 		/* cast to uint16_t prevents unwanted sign extension */
10697 		flags = (uint16_t)ifr->ifr_flags;
10698 	} else {
10699 		flags = lifr->lifr_flags;
10700 	}
10701 
10702 	/*
10703 	 * If this function call is a result of the ILLF_NOACCEPT flag
10704 	 * change, do not call ipif_down_tail(). See ip_sioctl_flags().
10705 	 */
10706 	ip_sioctl_flags_onoff(ipif, flags, &turn_on, &turn_off);
10707 	if (!((turn_on|turn_off) & ILLF_NOACCEPT))
10708 		(void) ipif_down_tail(ipif);
10709 
10710 	return (ip_sioctl_flags_tail(ipif, flags, q, mp));
10711 }
10712 
10713 /*
10714  * Can operate on either a module or a driver queue.
10715  */
10716 /* ARGSUSED */
10717 int
ip_sioctl_get_flags(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10718 ip_sioctl_get_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10719     ip_ioctl_cmd_t *ipip, void *if_req)
10720 {
10721 	/*
10722 	 * Has the flags been set correctly till now ?
10723 	 */
10724 	ill_t *ill = ipif->ipif_ill;
10725 	phyint_t *phyi = ill->ill_phyint;
10726 
10727 	ip1dbg(("ip_sioctl_get_flags(%s:%u %p)\n",
10728 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10729 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
10730 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
10731 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
10732 
10733 	/*
10734 	 * Need a lock since some flags can be set even when there are
10735 	 * references to the ipif.
10736 	 */
10737 	mutex_enter(&ill->ill_lock);
10738 	if (ipip->ipi_cmd_type == IF_CMD) {
10739 		struct ifreq *ifr = (struct ifreq *)if_req;
10740 
10741 		/* Get interface flags (low 16 only). */
10742 		ifr->ifr_flags = ((ipif->ipif_flags |
10743 		    ill->ill_flags | phyi->phyint_flags) & 0xffff);
10744 	} else {
10745 		struct lifreq *lifr = (struct lifreq *)if_req;
10746 
10747 		/* Get interface flags. */
10748 		lifr->lifr_flags = ipif->ipif_flags |
10749 		    ill->ill_flags | phyi->phyint_flags;
10750 	}
10751 	mutex_exit(&ill->ill_lock);
10752 	return (0);
10753 }
10754 
10755 /*
10756  * We allow the MTU to be set on an ILL, but not have it be different
10757  * for different IPIFs since we don't actually send packets on IPIFs.
10758  */
10759 /* ARGSUSED */
10760 int
ip_sioctl_mtu(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10761 ip_sioctl_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10762     ip_ioctl_cmd_t *ipip, void *if_req)
10763 {
10764 	int mtu;
10765 	int ip_min_mtu;
10766 	struct ifreq	*ifr;
10767 	struct lifreq *lifr;
10768 	ill_t	*ill;
10769 
10770 	ip1dbg(("ip_sioctl_mtu(%s:%u %p)\n", ipif->ipif_ill->ill_name,
10771 	    ipif->ipif_id, (void *)ipif));
10772 	if (ipip->ipi_cmd_type == IF_CMD) {
10773 		ifr = (struct ifreq *)if_req;
10774 		mtu = ifr->ifr_metric;
10775 	} else {
10776 		lifr = (struct lifreq *)if_req;
10777 		mtu = lifr->lifr_mtu;
10778 	}
10779 	/* Only allow for logical unit zero i.e. not on "bge0:17" */
10780 	if (ipif->ipif_id != 0)
10781 		return (EINVAL);
10782 
10783 	ill = ipif->ipif_ill;
10784 	if (ipif->ipif_isv6)
10785 		ip_min_mtu = IPV6_MIN_MTU;
10786 	else
10787 		ip_min_mtu = IP_MIN_MTU;
10788 
10789 	mutex_enter(&ill->ill_lock);
10790 	if (mtu > ill->ill_max_frag || mtu < ip_min_mtu) {
10791 		mutex_exit(&ill->ill_lock);
10792 		return (EINVAL);
10793 	}
10794 	/* Avoid increasing ill_mc_mtu */
10795 	if (ill->ill_mc_mtu > mtu)
10796 		ill->ill_mc_mtu = mtu;
10797 
10798 	/*
10799 	 * The dce and fragmentation code can handle changes to ill_mtu
10800 	 * concurrent with sending/fragmenting packets.
10801 	 */
10802 	ill->ill_mtu = mtu;
10803 	ill->ill_flags |= ILLF_FIXEDMTU;
10804 	mutex_exit(&ill->ill_lock);
10805 
10806 	/*
10807 	 * Make sure all dce_generation checks find out
10808 	 * that ill_mtu/ill_mc_mtu has changed.
10809 	 */
10810 	dce_increment_all_generations(ill->ill_isv6, ill->ill_ipst);
10811 
10812 	/*
10813 	 * Refresh IPMP meta-interface MTU if necessary.
10814 	 */
10815 	if (IS_UNDER_IPMP(ill))
10816 		ipmp_illgrp_refresh_mtu(ill->ill_grp);
10817 
10818 	/* Update the MTU in SCTP's list */
10819 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
10820 	return (0);
10821 }
10822 
10823 /* Get interface MTU. */
10824 /* ARGSUSED */
10825 int
ip_sioctl_get_mtu(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10826 ip_sioctl_get_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10827 	ip_ioctl_cmd_t *ipip, void *if_req)
10828 {
10829 	struct ifreq	*ifr;
10830 	struct lifreq	*lifr;
10831 
10832 	ip1dbg(("ip_sioctl_get_mtu(%s:%u %p)\n",
10833 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10834 
10835 	/*
10836 	 * We allow a get on any logical interface even though the set
10837 	 * can only be done on logical unit 0.
10838 	 */
10839 	if (ipip->ipi_cmd_type == IF_CMD) {
10840 		ifr = (struct ifreq *)if_req;
10841 		ifr->ifr_metric = ipif->ipif_ill->ill_mtu;
10842 	} else {
10843 		lifr = (struct lifreq *)if_req;
10844 		lifr->lifr_mtu = ipif->ipif_ill->ill_mtu;
10845 	}
10846 	return (0);
10847 }
10848 
10849 /* Set interface broadcast address. */
10850 /* ARGSUSED2 */
10851 int
ip_sioctl_brdaddr(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10852 ip_sioctl_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10853 	ip_ioctl_cmd_t *ipip, void *if_req)
10854 {
10855 	ipaddr_t addr;
10856 	ire_t	*ire;
10857 	ill_t		*ill = ipif->ipif_ill;
10858 	ip_stack_t	*ipst = ill->ill_ipst;
10859 
10860 	ip1dbg(("ip_sioctl_brdaddr(%s:%u)\n", ill->ill_name,
10861 	    ipif->ipif_id));
10862 
10863 	ASSERT(IAM_WRITER_IPIF(ipif));
10864 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
10865 		return (EADDRNOTAVAIL);
10866 
10867 	ASSERT(!(ipif->ipif_isv6));	/* No IPv6 broadcast */
10868 
10869 	if (sin->sin_family != AF_INET)
10870 		return (EAFNOSUPPORT);
10871 
10872 	addr = sin->sin_addr.s_addr;
10873 
10874 	if (ipif->ipif_flags & IPIF_UP) {
10875 		/*
10876 		 * If we are already up, make sure the new
10877 		 * broadcast address makes sense.  If it does,
10878 		 * there should be an IRE for it already.
10879 		 */
10880 		ire = ire_ftable_lookup_v4(addr, 0, 0, IRE_BROADCAST,
10881 		    ill, ipif->ipif_zoneid, NULL,
10882 		    (MATCH_IRE_ILL | MATCH_IRE_TYPE), 0, ipst, NULL);
10883 		if (ire == NULL) {
10884 			return (EINVAL);
10885 		} else {
10886 			ire_refrele(ire);
10887 		}
10888 	}
10889 	/*
10890 	 * Changing the broadcast addr for this ipif. Since the IRE_BROADCAST
10891 	 * needs to already exist we never need to change the set of
10892 	 * IRE_BROADCASTs when we are UP.
10893 	 */
10894 	if (addr != ipif->ipif_brd_addr)
10895 		IN6_IPADDR_TO_V4MAPPED(addr, &ipif->ipif_v6brd_addr);
10896 
10897 	return (0);
10898 }
10899 
10900 /* Get interface broadcast address. */
10901 /* ARGSUSED */
10902 int
ip_sioctl_get_brdaddr(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10903 ip_sioctl_get_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10904     ip_ioctl_cmd_t *ipip, void *if_req)
10905 {
10906 	ip1dbg(("ip_sioctl_get_brdaddr(%s:%u %p)\n",
10907 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10908 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
10909 		return (EADDRNOTAVAIL);
10910 
10911 	/* IPIF_BROADCAST not possible with IPv6 */
10912 	ASSERT(!ipif->ipif_isv6);
10913 	*sin = sin_null;
10914 	sin->sin_family = AF_INET;
10915 	sin->sin_addr.s_addr = ipif->ipif_brd_addr;
10916 	return (0);
10917 }
10918 
10919 /*
10920  * This routine is called to handle the SIOCS*IFNETMASK IOCTL.
10921  */
10922 /* ARGSUSED */
10923 int
ip_sioctl_netmask(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10924 ip_sioctl_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10925     ip_ioctl_cmd_t *ipip, void *if_req)
10926 {
10927 	int err = 0;
10928 	in6_addr_t v6mask;
10929 
10930 	ip1dbg(("ip_sioctl_netmask(%s:%u %p)\n",
10931 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10932 
10933 	ASSERT(IAM_WRITER_IPIF(ipif));
10934 
10935 	if (ipif->ipif_isv6) {
10936 		sin6_t *sin6;
10937 
10938 		if (sin->sin_family != AF_INET6)
10939 			return (EAFNOSUPPORT);
10940 
10941 		sin6 = (sin6_t *)sin;
10942 		v6mask = sin6->sin6_addr;
10943 	} else {
10944 		ipaddr_t mask;
10945 
10946 		if (sin->sin_family != AF_INET)
10947 			return (EAFNOSUPPORT);
10948 
10949 		mask = sin->sin_addr.s_addr;
10950 		if (!ip_contiguous_mask(ntohl(mask)))
10951 			return (ENOTSUP);
10952 		V4MASK_TO_V6(mask, v6mask);
10953 	}
10954 
10955 	/*
10956 	 * No big deal if the interface isn't already up, or the mask
10957 	 * isn't really changing, or this is pt-pt.
10958 	 */
10959 	if (!(ipif->ipif_flags & IPIF_UP) ||
10960 	    IN6_ARE_ADDR_EQUAL(&v6mask, &ipif->ipif_v6net_mask) ||
10961 	    (ipif->ipif_flags & IPIF_POINTOPOINT)) {
10962 		ipif->ipif_v6net_mask = v6mask;
10963 		if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
10964 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
10965 			    ipif->ipif_v6net_mask,
10966 			    ipif->ipif_v6subnet);
10967 		}
10968 		return (0);
10969 	}
10970 	/*
10971 	 * Make sure we have valid net and subnet broadcast ire's
10972 	 * for the old netmask, if needed by other logical interfaces.
10973 	 */
10974 	err = ipif_logical_down(ipif, q, mp);
10975 	if (err == EINPROGRESS)
10976 		return (err);
10977 	(void) ipif_down_tail(ipif);
10978 	err = ip_sioctl_netmask_tail(ipif, sin, q, mp);
10979 	return (err);
10980 }
10981 
10982 static int
ip_sioctl_netmask_tail(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp)10983 ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp)
10984 {
10985 	in6_addr_t v6mask;
10986 	int err = 0;
10987 
10988 	ip1dbg(("ip_sioctl_netmask_tail(%s:%u %p)\n",
10989 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10990 
10991 	if (ipif->ipif_isv6) {
10992 		sin6_t *sin6;
10993 
10994 		sin6 = (sin6_t *)sin;
10995 		v6mask = sin6->sin6_addr;
10996 	} else {
10997 		ipaddr_t mask;
10998 
10999 		mask = sin->sin_addr.s_addr;
11000 		V4MASK_TO_V6(mask, v6mask);
11001 	}
11002 
11003 	ipif->ipif_v6net_mask = v6mask;
11004 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11005 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
11006 		    ipif->ipif_v6subnet);
11007 	}
11008 	err = ipif_up(ipif, q, mp);
11009 
11010 	if (err == 0 || err == EINPROGRESS) {
11011 		/*
11012 		 * The interface must be DL_BOUND if this packet has to
11013 		 * go out on the wire. Since we only go through a logical
11014 		 * down and are bound with the driver during an internal
11015 		 * down/up that is satisfied.
11016 		 */
11017 		if (!ipif->ipif_isv6 && ipif->ipif_ill->ill_wq != NULL) {
11018 			/* Potentially broadcast an address mask reply. */
11019 			ipif_mask_reply(ipif);
11020 		}
11021 	}
11022 	return (err);
11023 }
11024 
11025 /* ARGSUSED */
11026 int
ip_sioctl_netmask_restart(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11027 ip_sioctl_netmask_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11028     ip_ioctl_cmd_t *ipip, void *if_req)
11029 {
11030 	ip1dbg(("ip_sioctl_netmask_restart(%s:%u %p)\n",
11031 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11032 	(void) ipif_down_tail(ipif);
11033 	return (ip_sioctl_netmask_tail(ipif, sin, q, mp));
11034 }
11035 
11036 /* Get interface net mask. */
11037 /* ARGSUSED */
11038 int
ip_sioctl_get_netmask(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11039 ip_sioctl_get_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11040     ip_ioctl_cmd_t *ipip, void *if_req)
11041 {
11042 	struct lifreq *lifr = (struct lifreq *)if_req;
11043 	struct sockaddr_in6 *sin6 = (sin6_t *)sin;
11044 
11045 	ip1dbg(("ip_sioctl_get_netmask(%s:%u %p)\n",
11046 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11047 
11048 	/*
11049 	 * net mask can't change since we have a reference to the ipif.
11050 	 */
11051 	if (ipif->ipif_isv6) {
11052 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11053 		*sin6 = sin6_null;
11054 		sin6->sin6_family = AF_INET6;
11055 		sin6->sin6_addr = ipif->ipif_v6net_mask;
11056 		lifr->lifr_addrlen =
11057 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
11058 	} else {
11059 		*sin = sin_null;
11060 		sin->sin_family = AF_INET;
11061 		sin->sin_addr.s_addr = ipif->ipif_net_mask;
11062 		if (ipip->ipi_cmd_type == LIF_CMD) {
11063 			lifr->lifr_addrlen =
11064 			    ip_mask_to_plen(ipif->ipif_net_mask);
11065 		}
11066 	}
11067 	return (0);
11068 }
11069 
11070 /* ARGSUSED */
11071 int
ip_sioctl_metric(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11072 ip_sioctl_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11073     ip_ioctl_cmd_t *ipip, void *if_req)
11074 {
11075 	ip1dbg(("ip_sioctl_metric(%s:%u %p)\n",
11076 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11077 
11078 	/*
11079 	 * Since no applications should ever be setting metrics on underlying
11080 	 * interfaces, we explicitly fail to smoke 'em out.
11081 	 */
11082 	if (IS_UNDER_IPMP(ipif->ipif_ill))
11083 		return (EINVAL);
11084 
11085 	/*
11086 	 * Set interface metric.  We don't use this for
11087 	 * anything but we keep track of it in case it is
11088 	 * important to routing applications or such.
11089 	 */
11090 	if (ipip->ipi_cmd_type == IF_CMD) {
11091 		struct ifreq    *ifr;
11092 
11093 		ifr = (struct ifreq *)if_req;
11094 		ipif->ipif_ill->ill_metric = ifr->ifr_metric;
11095 	} else {
11096 		struct lifreq   *lifr;
11097 
11098 		lifr = (struct lifreq *)if_req;
11099 		ipif->ipif_ill->ill_metric = lifr->lifr_metric;
11100 	}
11101 	return (0);
11102 }
11103 
11104 /* ARGSUSED */
11105 int
ip_sioctl_get_metric(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11106 ip_sioctl_get_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11107     ip_ioctl_cmd_t *ipip, void *if_req)
11108 {
11109 	/* Get interface metric. */
11110 	ip1dbg(("ip_sioctl_get_metric(%s:%u %p)\n",
11111 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11112 
11113 	if (ipip->ipi_cmd_type == IF_CMD) {
11114 		struct ifreq    *ifr;
11115 
11116 		ifr = (struct ifreq *)if_req;
11117 		ifr->ifr_metric = ipif->ipif_ill->ill_metric;
11118 	} else {
11119 		struct lifreq   *lifr;
11120 
11121 		lifr = (struct lifreq *)if_req;
11122 		lifr->lifr_metric = ipif->ipif_ill->ill_metric;
11123 	}
11124 
11125 	return (0);
11126 }
11127 
11128 /* ARGSUSED */
11129 int
ip_sioctl_muxid(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11130 ip_sioctl_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11131     ip_ioctl_cmd_t *ipip, void *if_req)
11132 {
11133 	int	arp_muxid;
11134 
11135 	ip1dbg(("ip_sioctl_muxid(%s:%u %p)\n",
11136 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11137 	/*
11138 	 * Set the muxid returned from I_PLINK.
11139 	 */
11140 	if (ipip->ipi_cmd_type == IF_CMD) {
11141 		struct ifreq *ifr = (struct ifreq *)if_req;
11142 
11143 		ipif->ipif_ill->ill_muxid = ifr->ifr_ip_muxid;
11144 		arp_muxid = ifr->ifr_arp_muxid;
11145 	} else {
11146 		struct lifreq *lifr = (struct lifreq *)if_req;
11147 
11148 		ipif->ipif_ill->ill_muxid = lifr->lifr_ip_muxid;
11149 		arp_muxid = lifr->lifr_arp_muxid;
11150 	}
11151 	arl_set_muxid(ipif->ipif_ill, arp_muxid);
11152 	return (0);
11153 }
11154 
11155 /* ARGSUSED */
11156 int
ip_sioctl_get_muxid(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11157 ip_sioctl_get_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11158     ip_ioctl_cmd_t *ipip, void *if_req)
11159 {
11160 	int	arp_muxid = 0;
11161 
11162 	ip1dbg(("ip_sioctl_get_muxid(%s:%u %p)\n",
11163 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11164 	/*
11165 	 * Get the muxid saved in ill for I_PUNLINK.
11166 	 */
11167 	arp_muxid = arl_get_muxid(ipif->ipif_ill);
11168 	if (ipip->ipi_cmd_type == IF_CMD) {
11169 		struct ifreq *ifr = (struct ifreq *)if_req;
11170 
11171 		ifr->ifr_ip_muxid = ipif->ipif_ill->ill_muxid;
11172 		ifr->ifr_arp_muxid = arp_muxid;
11173 	} else {
11174 		struct lifreq *lifr = (struct lifreq *)if_req;
11175 
11176 		lifr->lifr_ip_muxid = ipif->ipif_ill->ill_muxid;
11177 		lifr->lifr_arp_muxid = arp_muxid;
11178 	}
11179 	return (0);
11180 }
11181 
11182 /*
11183  * Set the subnet prefix. Does not modify the broadcast address.
11184  */
11185 /* ARGSUSED */
11186 int
ip_sioctl_subnet(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11187 ip_sioctl_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11188     ip_ioctl_cmd_t *ipip, void *if_req)
11189 {
11190 	int err = 0;
11191 	in6_addr_t v6addr;
11192 	in6_addr_t v6mask;
11193 	boolean_t need_up = B_FALSE;
11194 	int addrlen;
11195 
11196 	ip1dbg(("ip_sioctl_subnet(%s:%u %p)\n",
11197 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11198 
11199 	ASSERT(IAM_WRITER_IPIF(ipif));
11200 	addrlen = ((struct lifreq *)if_req)->lifr_addrlen;
11201 
11202 	if (ipif->ipif_isv6) {
11203 		sin6_t *sin6;
11204 
11205 		if (sin->sin_family != AF_INET6)
11206 			return (EAFNOSUPPORT);
11207 
11208 		sin6 = (sin6_t *)sin;
11209 		v6addr = sin6->sin6_addr;
11210 		if (!ip_remote_addr_ok_v6(&v6addr, &ipv6_all_ones))
11211 			return (EADDRNOTAVAIL);
11212 	} else {
11213 		ipaddr_t addr;
11214 
11215 		if (sin->sin_family != AF_INET)
11216 			return (EAFNOSUPPORT);
11217 
11218 		addr = sin->sin_addr.s_addr;
11219 		if (!ip_addr_ok_v4(addr, 0xFFFFFFFF))
11220 			return (EADDRNOTAVAIL);
11221 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11222 		/* Add 96 bits */
11223 		addrlen += IPV6_ABITS - IP_ABITS;
11224 	}
11225 
11226 	if (ip_plen_to_mask_v6(addrlen, &v6mask) == NULL)
11227 		return (EINVAL);
11228 
11229 	/* Check if bits in the address is set past the mask */
11230 	if (!V6_MASK_EQ(v6addr, v6mask, v6addr))
11231 		return (EINVAL);
11232 
11233 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6subnet, &v6addr) &&
11234 	    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6net_mask, &v6mask))
11235 		return (0);	/* No change */
11236 
11237 	if (ipif->ipif_flags & IPIF_UP) {
11238 		/*
11239 		 * If the interface is already marked up,
11240 		 * we call ipif_down which will take care
11241 		 * of ditching any IREs that have been set
11242 		 * up based on the old interface address.
11243 		 */
11244 		err = ipif_logical_down(ipif, q, mp);
11245 		if (err == EINPROGRESS)
11246 			return (err);
11247 		(void) ipif_down_tail(ipif);
11248 		need_up = B_TRUE;
11249 	}
11250 
11251 	err = ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, need_up);
11252 	return (err);
11253 }
11254 
11255 static int
ip_sioctl_subnet_tail(ipif_t * ipif,in6_addr_t v6addr,in6_addr_t v6mask,queue_t * q,mblk_t * mp,boolean_t need_up)11256 ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t v6addr, in6_addr_t v6mask,
11257     queue_t *q, mblk_t *mp, boolean_t need_up)
11258 {
11259 	ill_t	*ill = ipif->ipif_ill;
11260 	int	err = 0;
11261 
11262 	ip1dbg(("ip_sioctl_subnet_tail(%s:%u %p)\n",
11263 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11264 
11265 	/* Set the new address. */
11266 	mutex_enter(&ill->ill_lock);
11267 	ipif->ipif_v6net_mask = v6mask;
11268 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11269 		V6_MASK_COPY(v6addr, ipif->ipif_v6net_mask,
11270 		    ipif->ipif_v6subnet);
11271 	}
11272 	mutex_exit(&ill->ill_lock);
11273 
11274 	if (need_up) {
11275 		/*
11276 		 * Now bring the interface back up.  If this
11277 		 * is the only IPIF for the ILL, ipif_up
11278 		 * will have to re-bind to the device, so
11279 		 * we may get back EINPROGRESS, in which
11280 		 * case, this IOCTL will get completed in
11281 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11282 		 */
11283 		err = ipif_up(ipif, q, mp);
11284 		if (err == EINPROGRESS)
11285 			return (err);
11286 	}
11287 	return (err);
11288 }
11289 
11290 /* ARGSUSED */
11291 int
ip_sioctl_subnet_restart(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11292 ip_sioctl_subnet_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11293     ip_ioctl_cmd_t *ipip, void *if_req)
11294 {
11295 	int	addrlen;
11296 	in6_addr_t v6addr;
11297 	in6_addr_t v6mask;
11298 	struct lifreq *lifr = (struct lifreq *)if_req;
11299 
11300 	ip1dbg(("ip_sioctl_subnet_restart(%s:%u %p)\n",
11301 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11302 	(void) ipif_down_tail(ipif);
11303 
11304 	addrlen = lifr->lifr_addrlen;
11305 	if (ipif->ipif_isv6) {
11306 		sin6_t *sin6;
11307 
11308 		sin6 = (sin6_t *)sin;
11309 		v6addr = sin6->sin6_addr;
11310 	} else {
11311 		ipaddr_t addr;
11312 
11313 		addr = sin->sin_addr.s_addr;
11314 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11315 		addrlen += IPV6_ABITS - IP_ABITS;
11316 	}
11317 	(void) ip_plen_to_mask_v6(addrlen, &v6mask);
11318 
11319 	return (ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, B_TRUE));
11320 }
11321 
11322 /* ARGSUSED */
11323 int
ip_sioctl_get_subnet(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11324 ip_sioctl_get_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11325     ip_ioctl_cmd_t *ipip, void *if_req)
11326 {
11327 	struct lifreq *lifr = (struct lifreq *)if_req;
11328 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sin;
11329 
11330 	ip1dbg(("ip_sioctl_get_subnet(%s:%u %p)\n",
11331 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11332 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11333 
11334 	if (ipif->ipif_isv6) {
11335 		*sin6 = sin6_null;
11336 		sin6->sin6_family = AF_INET6;
11337 		sin6->sin6_addr = ipif->ipif_v6subnet;
11338 		lifr->lifr_addrlen =
11339 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
11340 	} else {
11341 		*sin = sin_null;
11342 		sin->sin_family = AF_INET;
11343 		sin->sin_addr.s_addr = ipif->ipif_subnet;
11344 		lifr->lifr_addrlen = ip_mask_to_plen(ipif->ipif_net_mask);
11345 	}
11346 	return (0);
11347 }
11348 
11349 /*
11350  * Set the IPv6 address token.
11351  */
11352 /* ARGSUSED */
11353 int
ip_sioctl_token(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipi,void * if_req)11354 ip_sioctl_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11355     ip_ioctl_cmd_t *ipi, void *if_req)
11356 {
11357 	ill_t *ill = ipif->ipif_ill;
11358 	int err;
11359 	in6_addr_t v6addr;
11360 	in6_addr_t v6mask;
11361 	boolean_t need_up = B_FALSE;
11362 	int i;
11363 	sin6_t *sin6 = (sin6_t *)sin;
11364 	struct lifreq *lifr = (struct lifreq *)if_req;
11365 	int addrlen;
11366 
11367 	ip1dbg(("ip_sioctl_token(%s:%u %p)\n",
11368 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11369 	ASSERT(IAM_WRITER_IPIF(ipif));
11370 
11371 	addrlen = lifr->lifr_addrlen;
11372 	/* Only allow for logical unit zero i.e. not on "le0:17" */
11373 	if (ipif->ipif_id != 0)
11374 		return (EINVAL);
11375 
11376 	if (!ipif->ipif_isv6)
11377 		return (EINVAL);
11378 
11379 	if (addrlen > IPV6_ABITS)
11380 		return (EINVAL);
11381 
11382 	v6addr = sin6->sin6_addr;
11383 
11384 	/*
11385 	 * The length of the token is the length from the end.  To get
11386 	 * the proper mask for this, compute the mask of the bits not
11387 	 * in the token; ie. the prefix, and then xor to get the mask.
11388 	 */
11389 	if (ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask) == NULL)
11390 		return (EINVAL);
11391 	for (i = 0; i < 4; i++) {
11392 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
11393 	}
11394 
11395 	if (V6_MASK_EQ(v6addr, v6mask, ill->ill_token) &&
11396 	    ill->ill_token_length == addrlen)
11397 		return (0);	/* No change */
11398 
11399 	if (ipif->ipif_flags & IPIF_UP) {
11400 		err = ipif_logical_down(ipif, q, mp);
11401 		if (err == EINPROGRESS)
11402 			return (err);
11403 		(void) ipif_down_tail(ipif);
11404 		need_up = B_TRUE;
11405 	}
11406 	err = ip_sioctl_token_tail(ipif, sin6, addrlen, q, mp, need_up);
11407 	return (err);
11408 }
11409 
11410 static int
ip_sioctl_token_tail(ipif_t * ipif,sin6_t * sin6,int addrlen,queue_t * q,mblk_t * mp,boolean_t need_up)11411 ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen, queue_t *q,
11412     mblk_t *mp, boolean_t need_up)
11413 {
11414 	in6_addr_t v6addr;
11415 	in6_addr_t v6mask;
11416 	ill_t	*ill = ipif->ipif_ill;
11417 	int	i;
11418 	int	err = 0;
11419 
11420 	ip1dbg(("ip_sioctl_token_tail(%s:%u %p)\n",
11421 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11422 	v6addr = sin6->sin6_addr;
11423 	/*
11424 	 * The length of the token is the length from the end.  To get
11425 	 * the proper mask for this, compute the mask of the bits not
11426 	 * in the token; ie. the prefix, and then xor to get the mask.
11427 	 */
11428 	(void) ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask);
11429 	for (i = 0; i < 4; i++)
11430 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
11431 
11432 	mutex_enter(&ill->ill_lock);
11433 	V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
11434 	ill->ill_token_length = addrlen;
11435 	ill->ill_manual_token = 1;
11436 
11437 	/* Reconfigure the link-local address based on this new token */
11438 	ipif_setlinklocal(ill->ill_ipif);
11439 
11440 	mutex_exit(&ill->ill_lock);
11441 
11442 	if (need_up) {
11443 		/*
11444 		 * Now bring the interface back up.  If this
11445 		 * is the only IPIF for the ILL, ipif_up
11446 		 * will have to re-bind to the device, so
11447 		 * we may get back EINPROGRESS, in which
11448 		 * case, this IOCTL will get completed in
11449 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11450 		 */
11451 		err = ipif_up(ipif, q, mp);
11452 		if (err == EINPROGRESS)
11453 			return (err);
11454 	}
11455 	return (err);
11456 }
11457 
11458 /* ARGSUSED */
11459 int
ip_sioctl_get_token(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipi,void * if_req)11460 ip_sioctl_get_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11461     ip_ioctl_cmd_t *ipi, void *if_req)
11462 {
11463 	ill_t *ill;
11464 	sin6_t *sin6 = (sin6_t *)sin;
11465 	struct lifreq *lifr = (struct lifreq *)if_req;
11466 
11467 	ip1dbg(("ip_sioctl_get_token(%s:%u %p)\n",
11468 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11469 	if (ipif->ipif_id != 0)
11470 		return (EINVAL);
11471 
11472 	ill = ipif->ipif_ill;
11473 	if (!ill->ill_isv6)
11474 		return (ENXIO);
11475 
11476 	*sin6 = sin6_null;
11477 	sin6->sin6_family = AF_INET6;
11478 	ASSERT(!IN6_IS_ADDR_V4MAPPED(&ill->ill_token));
11479 	sin6->sin6_addr = ill->ill_token;
11480 	lifr->lifr_addrlen = ill->ill_token_length;
11481 	return (0);
11482 }
11483 
11484 /*
11485  * Set (hardware) link specific information that might override
11486  * what was acquired through the DL_INFO_ACK.
11487  */
11488 /* ARGSUSED */
11489 int
ip_sioctl_lnkinfo(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipi,void * if_req)11490 ip_sioctl_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11491     ip_ioctl_cmd_t *ipi, void *if_req)
11492 {
11493 	ill_t		*ill = ipif->ipif_ill;
11494 	int		ip_min_mtu;
11495 	struct lifreq	*lifr = (struct lifreq *)if_req;
11496 	lif_ifinfo_req_t *lir;
11497 
11498 	ip1dbg(("ip_sioctl_lnkinfo(%s:%u %p)\n",
11499 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11500 	lir = &lifr->lifr_ifinfo;
11501 	ASSERT(IAM_WRITER_IPIF(ipif));
11502 
11503 	/* Only allow for logical unit zero i.e. not on "bge0:17" */
11504 	if (ipif->ipif_id != 0)
11505 		return (EINVAL);
11506 
11507 	/* Set interface MTU. */
11508 	if (ipif->ipif_isv6)
11509 		ip_min_mtu = IPV6_MIN_MTU;
11510 	else
11511 		ip_min_mtu = IP_MIN_MTU;
11512 
11513 	/*
11514 	 * Verify values before we set anything. Allow zero to
11515 	 * mean unspecified.
11516 	 *
11517 	 * XXX We should be able to set the user-defined lir_mtu to some value
11518 	 * that is greater than ill_current_frag but less than ill_max_frag- the
11519 	 * ill_max_frag value tells us the max MTU that can be handled by the
11520 	 * datalink, whereas the ill_current_frag is dynamically computed for
11521 	 * some link-types like tunnels, based on the tunnel PMTU. However,
11522 	 * since there is currently no way of distinguishing between
11523 	 * administratively fixed link mtu values (e.g., those set via
11524 	 * /sbin/dladm) and dynamically discovered MTUs (e.g., those discovered
11525 	 * for tunnels) we conservatively choose the  ill_current_frag as the
11526 	 * upper-bound.
11527 	 */
11528 	if (lir->lir_maxmtu != 0 &&
11529 	    (lir->lir_maxmtu > ill->ill_current_frag ||
11530 	    lir->lir_maxmtu < ip_min_mtu))
11531 		return (EINVAL);
11532 	if (lir->lir_reachtime != 0 &&
11533 	    lir->lir_reachtime > ND_MAX_REACHTIME)
11534 		return (EINVAL);
11535 	if (lir->lir_reachretrans != 0 &&
11536 	    lir->lir_reachretrans > ND_MAX_REACHRETRANSTIME)
11537 		return (EINVAL);
11538 
11539 	mutex_enter(&ill->ill_lock);
11540 	/*
11541 	 * The dce and fragmentation code can handle changes to ill_mtu
11542 	 * concurrent with sending/fragmenting packets.
11543 	 */
11544 	if (lir->lir_maxmtu != 0)
11545 		ill->ill_user_mtu = lir->lir_maxmtu;
11546 
11547 	if (lir->lir_reachtime != 0)
11548 		ill->ill_reachable_time = lir->lir_reachtime;
11549 
11550 	if (lir->lir_reachretrans != 0)
11551 		ill->ill_reachable_retrans_time = lir->lir_reachretrans;
11552 
11553 	ill->ill_max_hops = lir->lir_maxhops;
11554 	ill->ill_max_buf = ND_MAX_Q;
11555 	if (!(ill->ill_flags & ILLF_FIXEDMTU) && ill->ill_user_mtu != 0) {
11556 		/*
11557 		 * ill_mtu is the actual interface MTU, obtained as the min
11558 		 * of user-configured mtu and the value announced by the
11559 		 * driver (via DL_NOTE_SDU_SIZE/DL_INFO_ACK). Note that since
11560 		 * we have already made the choice of requiring
11561 		 * ill_user_mtu < ill_current_frag by the time we get here,
11562 		 * the ill_mtu effectively gets assigned to the ill_user_mtu
11563 		 * here.
11564 		 */
11565 		ill->ill_mtu = MIN(ill->ill_current_frag, ill->ill_user_mtu);
11566 		ill->ill_mc_mtu = MIN(ill->ill_mc_mtu, ill->ill_user_mtu);
11567 	}
11568 	mutex_exit(&ill->ill_lock);
11569 
11570 	/*
11571 	 * Make sure all dce_generation checks find out
11572 	 * that ill_mtu/ill_mc_mtu has changed.
11573 	 */
11574 	if (!(ill->ill_flags & ILLF_FIXEDMTU) && (lir->lir_maxmtu != 0))
11575 		dce_increment_all_generations(ill->ill_isv6, ill->ill_ipst);
11576 
11577 	/*
11578 	 * Refresh IPMP meta-interface MTU if necessary.
11579 	 */
11580 	if (IS_UNDER_IPMP(ill))
11581 		ipmp_illgrp_refresh_mtu(ill->ill_grp);
11582 
11583 	return (0);
11584 }
11585 
11586 /* ARGSUSED */
11587 int
ip_sioctl_get_lnkinfo(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipi,void * if_req)11588 ip_sioctl_get_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11589     ip_ioctl_cmd_t *ipi, void *if_req)
11590 {
11591 	struct lif_ifinfo_req *lir;
11592 	ill_t *ill = ipif->ipif_ill;
11593 
11594 	ip1dbg(("ip_sioctl_get_lnkinfo(%s:%u %p)\n",
11595 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11596 	if (ipif->ipif_id != 0)
11597 		return (EINVAL);
11598 
11599 	lir = &((struct lifreq *)if_req)->lifr_ifinfo;
11600 	lir->lir_maxhops = ill->ill_max_hops;
11601 	lir->lir_reachtime = ill->ill_reachable_time;
11602 	lir->lir_reachretrans = ill->ill_reachable_retrans_time;
11603 	lir->lir_maxmtu = ill->ill_mtu;
11604 
11605 	return (0);
11606 }
11607 
11608 /*
11609  * Return best guess as to the subnet mask for the specified address.
11610  * Based on the subnet masks for all the configured interfaces.
11611  *
11612  * We end up returning a zero mask in the case of default, multicast or
11613  * experimental.
11614  */
11615 static ipaddr_t
ip_subnet_mask(ipaddr_t addr,ipif_t ** ipifp,ip_stack_t * ipst)11616 ip_subnet_mask(ipaddr_t addr, ipif_t **ipifp, ip_stack_t *ipst)
11617 {
11618 	ipaddr_t net_mask;
11619 	ill_t	*ill;
11620 	ipif_t	*ipif;
11621 	ill_walk_context_t ctx;
11622 	ipif_t	*fallback_ipif = NULL;
11623 
11624 	net_mask = ip_net_mask(addr);
11625 	if (net_mask == 0) {
11626 		*ipifp = NULL;
11627 		return (0);
11628 	}
11629 
11630 	/* Let's check to see if this is maybe a local subnet route. */
11631 	/* this function only applies to IPv4 interfaces */
11632 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
11633 	ill = ILL_START_WALK_V4(&ctx, ipst);
11634 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
11635 		mutex_enter(&ill->ill_lock);
11636 		for (ipif = ill->ill_ipif; ipif != NULL;
11637 		    ipif = ipif->ipif_next) {
11638 			if (IPIF_IS_CONDEMNED(ipif))
11639 				continue;
11640 			if (!(ipif->ipif_flags & IPIF_UP))
11641 				continue;
11642 			if ((ipif->ipif_subnet & net_mask) ==
11643 			    (addr & net_mask)) {
11644 				/*
11645 				 * Don't trust pt-pt interfaces if there are
11646 				 * other interfaces.
11647 				 */
11648 				if (ipif->ipif_flags & IPIF_POINTOPOINT) {
11649 					if (fallback_ipif == NULL) {
11650 						ipif_refhold_locked(ipif);
11651 						fallback_ipif = ipif;
11652 					}
11653 					continue;
11654 				}
11655 
11656 				/*
11657 				 * Fine. Just assume the same net mask as the
11658 				 * directly attached subnet interface is using.
11659 				 */
11660 				ipif_refhold_locked(ipif);
11661 				mutex_exit(&ill->ill_lock);
11662 				rw_exit(&ipst->ips_ill_g_lock);
11663 				if (fallback_ipif != NULL)
11664 					ipif_refrele(fallback_ipif);
11665 				*ipifp = ipif;
11666 				return (ipif->ipif_net_mask);
11667 			}
11668 		}
11669 		mutex_exit(&ill->ill_lock);
11670 	}
11671 	rw_exit(&ipst->ips_ill_g_lock);
11672 
11673 	*ipifp = fallback_ipif;
11674 	return ((fallback_ipif != NULL) ?
11675 	    fallback_ipif->ipif_net_mask : net_mask);
11676 }
11677 
11678 /*
11679  * ip_sioctl_copyin_setup calls ip_wput_ioctl to process the IP_IOCTL ioctl.
11680  */
11681 static void
ip_wput_ioctl(queue_t * q,mblk_t * mp)11682 ip_wput_ioctl(queue_t *q, mblk_t *mp)
11683 {
11684 	IOCP	iocp;
11685 	ipft_t	*ipft;
11686 	ipllc_t	*ipllc;
11687 	mblk_t	*mp1;
11688 	cred_t	*cr;
11689 	int	error = 0;
11690 	conn_t	*connp;
11691 
11692 	ip1dbg(("ip_wput_ioctl"));
11693 	iocp = (IOCP)mp->b_rptr;
11694 	mp1 = mp->b_cont;
11695 	if (mp1 == NULL) {
11696 		iocp->ioc_error = EINVAL;
11697 		mp->b_datap->db_type = M_IOCNAK;
11698 		iocp->ioc_count = 0;
11699 		qreply(q, mp);
11700 		return;
11701 	}
11702 
11703 	/*
11704 	 * These IOCTLs provide various control capabilities to
11705 	 * upstream agents such as ULPs and processes.	There
11706 	 * are currently two such IOCTLs implemented.  They
11707 	 * are used by TCP to provide update information for
11708 	 * existing IREs and to forcibly delete an IRE for a
11709 	 * host that is not responding, thereby forcing an
11710 	 * attempt at a new route.
11711 	 */
11712 	iocp->ioc_error = EINVAL;
11713 	if (!pullupmsg(mp1, sizeof (ipllc->ipllc_cmd)))
11714 		goto done;
11715 
11716 	ipllc = (ipllc_t *)mp1->b_rptr;
11717 	for (ipft = ip_ioctl_ftbl; ipft->ipft_pfi; ipft++) {
11718 		if (ipllc->ipllc_cmd == ipft->ipft_cmd)
11719 			break;
11720 	}
11721 	/*
11722 	 * prefer credential from mblk over ioctl;
11723 	 * see ip_sioctl_copyin_setup
11724 	 */
11725 	cr = msg_getcred(mp, NULL);
11726 	if (cr == NULL)
11727 		cr = iocp->ioc_cr;
11728 
11729 	/*
11730 	 * Refhold the conn in case the request gets queued up in some lookup
11731 	 */
11732 	ASSERT(CONN_Q(q));
11733 	connp = Q_TO_CONN(q);
11734 	CONN_INC_REF(connp);
11735 	CONN_INC_IOCTLREF(connp);
11736 	if (ipft->ipft_pfi &&
11737 	    ((mp1->b_wptr - mp1->b_rptr) >= ipft->ipft_min_size ||
11738 	    pullupmsg(mp1, ipft->ipft_min_size))) {
11739 		error = (*ipft->ipft_pfi)(q,
11740 		    (ipft->ipft_flags & IPFT_F_SELF_REPLY) ? mp : mp1, cr);
11741 	}
11742 	if (ipft->ipft_flags & IPFT_F_SELF_REPLY) {
11743 		/*
11744 		 * CONN_OPER_PENDING_DONE happens in the function called
11745 		 * through ipft_pfi above.
11746 		 */
11747 		return;
11748 	}
11749 
11750 	CONN_DEC_IOCTLREF(connp);
11751 	CONN_OPER_PENDING_DONE(connp);
11752 	if (ipft->ipft_flags & IPFT_F_NO_REPLY) {
11753 		freemsg(mp);
11754 		return;
11755 	}
11756 	iocp->ioc_error = error;
11757 
11758 done:
11759 	mp->b_datap->db_type = M_IOCACK;
11760 	if (iocp->ioc_error)
11761 		iocp->ioc_count = 0;
11762 	qreply(q, mp);
11763 }
11764 
11765 /*
11766  * Assign a unique id for the ipif. This is used by sctp_addr.c
11767  * Note: remove if sctp_addr.c is redone to not shadow ill/ipif data structures.
11768  */
11769 static void
ipif_assign_seqid(ipif_t * ipif)11770 ipif_assign_seqid(ipif_t *ipif)
11771 {
11772 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
11773 
11774 	ipif->ipif_seqid = atomic_inc_64_nv(&ipst->ips_ipif_g_seqid);
11775 }
11776 
11777 /*
11778  * Clone the contents of `sipif' to `dipif'.  Requires that both ipifs are
11779  * administratively down (i.e., no DAD), of the same type, and locked.  Note
11780  * that the clone is complete -- including the seqid -- and the expectation is
11781  * that the caller will either free or overwrite `sipif' before it's unlocked.
11782  */
11783 static void
ipif_clone(const ipif_t * sipif,ipif_t * dipif)11784 ipif_clone(const ipif_t *sipif, ipif_t *dipif)
11785 {
11786 	ASSERT(MUTEX_HELD(&sipif->ipif_ill->ill_lock));
11787 	ASSERT(MUTEX_HELD(&dipif->ipif_ill->ill_lock));
11788 	ASSERT(!(sipif->ipif_flags & (IPIF_UP|IPIF_DUPLICATE)));
11789 	ASSERT(!(dipif->ipif_flags & (IPIF_UP|IPIF_DUPLICATE)));
11790 	ASSERT(sipif->ipif_ire_type == dipif->ipif_ire_type);
11791 
11792 	dipif->ipif_flags = sipif->ipif_flags;
11793 	dipif->ipif_zoneid = sipif->ipif_zoneid;
11794 	dipif->ipif_v6subnet = sipif->ipif_v6subnet;
11795 	dipif->ipif_v6lcl_addr = sipif->ipif_v6lcl_addr;
11796 	dipif->ipif_v6net_mask = sipif->ipif_v6net_mask;
11797 	dipif->ipif_v6brd_addr = sipif->ipif_v6brd_addr;
11798 	dipif->ipif_v6pp_dst_addr = sipif->ipif_v6pp_dst_addr;
11799 
11800 	/*
11801 	 * As per the comment atop the function, we assume that these sipif
11802 	 * fields will be changed before sipif is unlocked.
11803 	 */
11804 	dipif->ipif_seqid = sipif->ipif_seqid;
11805 	dipif->ipif_state_flags = sipif->ipif_state_flags;
11806 }
11807 
11808 /*
11809  * Transfer the contents of `sipif' to `dipif', and then free (if `virgipif'
11810  * is NULL) or overwrite `sipif' with `virgipif', which must be a virgin
11811  * (unreferenced) ipif.  Also, if `sipif' is used by the current xop, then
11812  * transfer the xop to `dipif'.  Requires that all ipifs are administratively
11813  * down (i.e., no DAD), of the same type, and unlocked.
11814  */
11815 static void
ipif_transfer(ipif_t * sipif,ipif_t * dipif,ipif_t * virgipif)11816 ipif_transfer(ipif_t *sipif, ipif_t *dipif, ipif_t *virgipif)
11817 {
11818 	ipsq_t *ipsq = sipif->ipif_ill->ill_phyint->phyint_ipsq;
11819 	ipxop_t *ipx = ipsq->ipsq_xop;
11820 
11821 	ASSERT(sipif != dipif);
11822 	ASSERT(sipif != virgipif);
11823 
11824 	/*
11825 	 * Grab all of the locks that protect the ipif in a defined order.
11826 	 */
11827 	GRAB_ILL_LOCKS(sipif->ipif_ill, dipif->ipif_ill);
11828 
11829 	ipif_clone(sipif, dipif);
11830 	if (virgipif != NULL) {
11831 		ipif_clone(virgipif, sipif);
11832 		mi_free(virgipif);
11833 	}
11834 
11835 	RELEASE_ILL_LOCKS(sipif->ipif_ill, dipif->ipif_ill);
11836 
11837 	/*
11838 	 * Transfer ownership of the current xop, if necessary.
11839 	 */
11840 	if (ipx->ipx_current_ipif == sipif) {
11841 		ASSERT(ipx->ipx_pending_ipif == NULL);
11842 		mutex_enter(&ipx->ipx_lock);
11843 		ipx->ipx_current_ipif = dipif;
11844 		mutex_exit(&ipx->ipx_lock);
11845 	}
11846 
11847 	if (virgipif == NULL)
11848 		mi_free(sipif);
11849 }
11850 
11851 /*
11852  * checks if:
11853  *	- <ill_name>:<ipif_id> is at most LIFNAMSIZ - 1 and
11854  *	- logical interface is within the allowed range
11855  */
11856 static int
is_lifname_valid(ill_t * ill,unsigned int ipif_id)11857 is_lifname_valid(ill_t *ill, unsigned int ipif_id)
11858 {
11859 	if (snprintf(NULL, 0, "%s:%d", ill->ill_name, ipif_id) >= LIFNAMSIZ)
11860 		return (ENAMETOOLONG);
11861 
11862 	if (ipif_id >= ill->ill_ipst->ips_ip_addrs_per_if)
11863 		return (ERANGE);
11864 	return (0);
11865 }
11866 
11867 /*
11868  * Insert the ipif, so that the list of ipifs on the ill will be sorted
11869  * with respect to ipif_id. Note that an ipif with an ipif_id of -1 will
11870  * be inserted into the first space available in the list. The value of
11871  * ipif_id will then be set to the appropriate value for its position.
11872  */
11873 static int
ipif_insert(ipif_t * ipif,boolean_t acquire_g_lock)11874 ipif_insert(ipif_t *ipif, boolean_t acquire_g_lock)
11875 {
11876 	ill_t *ill;
11877 	ipif_t *tipif;
11878 	ipif_t **tipifp;
11879 	int id, err;
11880 	ip_stack_t	*ipst;
11881 
11882 	ASSERT(ipif->ipif_ill->ill_net_type == IRE_LOOPBACK ||
11883 	    IAM_WRITER_IPIF(ipif));
11884 
11885 	ill = ipif->ipif_ill;
11886 	ASSERT(ill != NULL);
11887 	ipst = ill->ill_ipst;
11888 
11889 	/*
11890 	 * In the case of lo0:0 we already hold the ill_g_lock.
11891 	 * ill_lookup_on_name (acquires ill_g_lock) -> ipif_allocate ->
11892 	 * ipif_insert.
11893 	 */
11894 	if (acquire_g_lock)
11895 		rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
11896 	mutex_enter(&ill->ill_lock);
11897 	id = ipif->ipif_id;
11898 	tipifp = &(ill->ill_ipif);
11899 	if (id == -1) {	/* need to find a real id */
11900 		id = 0;
11901 		while ((tipif = *tipifp) != NULL) {
11902 			ASSERT(tipif->ipif_id >= id);
11903 			if (tipif->ipif_id != id)
11904 				break; /* non-consecutive id */
11905 			id++;
11906 			tipifp = &(tipif->ipif_next);
11907 		}
11908 		if ((err = is_lifname_valid(ill, id)) != 0) {
11909 			mutex_exit(&ill->ill_lock);
11910 			if (acquire_g_lock)
11911 				rw_exit(&ipst->ips_ill_g_lock);
11912 			return (err);
11913 		}
11914 		ipif->ipif_id = id; /* assign new id */
11915 	} else if ((err = is_lifname_valid(ill, id)) == 0) {
11916 		/* we have a real id; insert ipif in the right place */
11917 		while ((tipif = *tipifp) != NULL) {
11918 			ASSERT(tipif->ipif_id != id);
11919 			if (tipif->ipif_id > id)
11920 				break; /* found correct location */
11921 			tipifp = &(tipif->ipif_next);
11922 		}
11923 	} else {
11924 		mutex_exit(&ill->ill_lock);
11925 		if (acquire_g_lock)
11926 			rw_exit(&ipst->ips_ill_g_lock);
11927 		return (err);
11928 	}
11929 
11930 	ASSERT(tipifp != &(ill->ill_ipif) || id == 0);
11931 
11932 	ipif->ipif_next = tipif;
11933 	*tipifp = ipif;
11934 	mutex_exit(&ill->ill_lock);
11935 	if (acquire_g_lock)
11936 		rw_exit(&ipst->ips_ill_g_lock);
11937 
11938 	return (0);
11939 }
11940 
11941 static void
ipif_remove(ipif_t * ipif)11942 ipif_remove(ipif_t *ipif)
11943 {
11944 	ipif_t	**ipifp;
11945 	ill_t	*ill = ipif->ipif_ill;
11946 
11947 	ASSERT(RW_WRITE_HELD(&ill->ill_ipst->ips_ill_g_lock));
11948 
11949 	mutex_enter(&ill->ill_lock);
11950 	ipifp = &ill->ill_ipif;
11951 	for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
11952 		if (*ipifp == ipif) {
11953 			*ipifp = ipif->ipif_next;
11954 			break;
11955 		}
11956 	}
11957 	mutex_exit(&ill->ill_lock);
11958 }
11959 
11960 /*
11961  * Allocate and initialize a new interface control structure.  (Always
11962  * called as writer.)
11963  * When ipif_allocate() is called from ip_ll_subnet_defaults, the ill
11964  * is not part of the global linked list of ills. ipif_seqid is unique
11965  * in the system and to preserve the uniqueness, it is assigned only
11966  * when ill becomes part of the global list. At that point ill will
11967  * have a name. If it doesn't get assigned here, it will get assigned
11968  * in ipif_set_values() as part of SIOCSLIFNAME processing.
11969  * Aditionally, if we come here from ip_ll_subnet_defaults, we don't set
11970  * the interface flags or any other information from the DL_INFO_ACK for
11971  * DL_STYLE2 drivers (initialize == B_FALSE), since we won't have them at
11972  * this point. The flags etc. will be set in ip_ll_subnet_defaults when the
11973  * second DL_INFO_ACK comes in from the driver.
11974  */
11975 static ipif_t *
ipif_allocate(ill_t * ill,int id,uint_t ire_type,boolean_t initialize,boolean_t insert,int * errorp)11976 ipif_allocate(ill_t *ill, int id, uint_t ire_type, boolean_t initialize,
11977     boolean_t insert, int *errorp)
11978 {
11979 	int err;
11980 	ipif_t	*ipif;
11981 	ip_stack_t *ipst = ill->ill_ipst;
11982 
11983 	ip1dbg(("ipif_allocate(%s:%d ill %p)\n",
11984 	    ill->ill_name, id, (void *)ill));
11985 	ASSERT(ire_type == IRE_LOOPBACK || IAM_WRITER_ILL(ill));
11986 
11987 	if (errorp != NULL)
11988 		*errorp = 0;
11989 
11990 	if ((ipif = mi_alloc(sizeof (ipif_t), BPRI_MED)) == NULL) {
11991 		if (errorp != NULL)
11992 			*errorp = ENOMEM;
11993 		return (NULL);
11994 	}
11995 	*ipif = ipif_zero;	/* start clean */
11996 
11997 	ipif->ipif_ill = ill;
11998 	ipif->ipif_id = id;	/* could be -1 */
11999 	/*
12000 	 * Inherit the zoneid from the ill; for the shared stack instance
12001 	 * this is always the global zone
12002 	 */
12003 	ipif->ipif_zoneid = ill->ill_zoneid;
12004 
12005 	ipif->ipif_refcnt = 0;
12006 
12007 	if (insert) {
12008 		if ((err = ipif_insert(ipif, ire_type != IRE_LOOPBACK)) != 0) {
12009 			mi_free(ipif);
12010 			if (errorp != NULL)
12011 				*errorp = err;
12012 			return (NULL);
12013 		}
12014 		/* -1 id should have been replaced by real id */
12015 		id = ipif->ipif_id;
12016 		ASSERT(id >= 0);
12017 	}
12018 
12019 	if (ill->ill_name[0] != '\0')
12020 		ipif_assign_seqid(ipif);
12021 
12022 	/*
12023 	 * If this is the zeroth ipif on the IPMP ill, create the illgrp
12024 	 * (which must not exist yet because the zeroth ipif is created once
12025 	 * per ill).  However, do not not link it to the ipmp_grp_t until
12026 	 * I_PLINK is called; see ip_sioctl_plink_ipmp() for details.
12027 	 */
12028 	if (id == 0 && IS_IPMP(ill)) {
12029 		if (ipmp_illgrp_create(ill) == NULL) {
12030 			if (insert) {
12031 				rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
12032 				ipif_remove(ipif);
12033 				rw_exit(&ipst->ips_ill_g_lock);
12034 			}
12035 			mi_free(ipif);
12036 			if (errorp != NULL)
12037 				*errorp = ENOMEM;
12038 			return (NULL);
12039 		}
12040 	}
12041 
12042 	/*
12043 	 * We grab ill_lock to protect the flag changes.  The ipif is still
12044 	 * not up and can't be looked up until the ioctl completes and the
12045 	 * IPIF_CHANGING flag is cleared.
12046 	 */
12047 	mutex_enter(&ill->ill_lock);
12048 
12049 	ipif->ipif_ire_type = ire_type;
12050 
12051 	if (ipif->ipif_isv6) {
12052 		ill->ill_flags |= ILLF_IPV6;
12053 	} else {
12054 		ipaddr_t inaddr_any = INADDR_ANY;
12055 
12056 		ill->ill_flags |= ILLF_IPV4;
12057 
12058 		/* Keep the IN6_IS_ADDR_V4MAPPED assertions happy */
12059 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12060 		    &ipif->ipif_v6lcl_addr);
12061 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12062 		    &ipif->ipif_v6subnet);
12063 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12064 		    &ipif->ipif_v6net_mask);
12065 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12066 		    &ipif->ipif_v6brd_addr);
12067 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12068 		    &ipif->ipif_v6pp_dst_addr);
12069 	}
12070 
12071 	/*
12072 	 * Don't set the interface flags etc. now, will do it in
12073 	 * ip_ll_subnet_defaults.
12074 	 */
12075 	if (!initialize)
12076 		goto out;
12077 
12078 	/*
12079 	 * NOTE: The IPMP meta-interface is special-cased because it starts
12080 	 * with no underlying interfaces (and thus an unknown broadcast
12081 	 * address length), but all interfaces that can be placed into an IPMP
12082 	 * group are required to be broadcast-capable.
12083 	 */
12084 	if (ill->ill_bcast_addr_length != 0 || IS_IPMP(ill)) {
12085 		/*
12086 		 * Later detect lack of DLPI driver multicast capability by
12087 		 * catching DL_ENABMULTI_REQ errors in ip_rput_dlpi().
12088 		 */
12089 		ill->ill_flags |= ILLF_MULTICAST;
12090 		if (!ipif->ipif_isv6)
12091 			ipif->ipif_flags |= IPIF_BROADCAST;
12092 	} else {
12093 		if (ill->ill_net_type != IRE_LOOPBACK) {
12094 			if (ipif->ipif_isv6)
12095 				/*
12096 				 * Note: xresolv interfaces will eventually need
12097 				 * NOARP set here as well, but that will require
12098 				 * those external resolvers to have some
12099 				 * knowledge of that flag and act appropriately.
12100 				 * Not to be changed at present.
12101 				 */
12102 				ill->ill_flags |= ILLF_NONUD;
12103 			else
12104 				ill->ill_flags |= ILLF_NOARP;
12105 		}
12106 		if (ill->ill_phys_addr_length == 0) {
12107 			if (IS_VNI(ill)) {
12108 				ipif->ipif_flags |= IPIF_NOXMIT;
12109 			} else {
12110 				/* pt-pt supports multicast. */
12111 				ill->ill_flags |= ILLF_MULTICAST;
12112 				if (ill->ill_net_type != IRE_LOOPBACK)
12113 					ipif->ipif_flags |= IPIF_POINTOPOINT;
12114 			}
12115 		}
12116 	}
12117 out:
12118 	mutex_exit(&ill->ill_lock);
12119 	return (ipif);
12120 }
12121 
12122 /*
12123  * Remove the neighbor cache entries associated with this logical
12124  * interface.
12125  */
12126 int
ipif_arp_down(ipif_t * ipif)12127 ipif_arp_down(ipif_t *ipif)
12128 {
12129 	ill_t	*ill = ipif->ipif_ill;
12130 	int	err = 0;
12131 
12132 	ip1dbg(("ipif_arp_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
12133 	ASSERT(IAM_WRITER_IPIF(ipif));
12134 
12135 	DTRACE_PROBE3(ipif__downup, char *, "ipif_arp_down",
12136 	    ill_t *, ill, ipif_t *, ipif);
12137 	ipif_nce_down(ipif);
12138 
12139 	/*
12140 	 * If this is the last ipif that is going down and there are no
12141 	 * duplicate addresses we may yet attempt to re-probe, then we need to
12142 	 * clean up ARP completely.
12143 	 */
12144 	if (ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
12145 	    !ill->ill_logical_down && ill->ill_net_type == IRE_IF_RESOLVER) {
12146 		/*
12147 		 * If this was the last ipif on an IPMP interface, purge any
12148 		 * static ARP entries associated with it.
12149 		 */
12150 		if (IS_IPMP(ill))
12151 			ipmp_illgrp_refresh_arpent(ill->ill_grp);
12152 
12153 		/* UNBIND, DETACH */
12154 		err = arp_ll_down(ill);
12155 	}
12156 
12157 	return (err);
12158 }
12159 
12160 /*
12161  * Get the resolver set up for a new IP address.  (Always called as writer.)
12162  * Called both for IPv4 and IPv6 interfaces, though it only does some
12163  * basic DAD related initialization for IPv6. Honors ILLF_NOARP.
12164  *
12165  * The enumerated value res_act tunes the behavior:
12166  * 	* Res_act_initial: set up all the resolver structures for a new
12167  *	  IP address.
12168  *	* Res_act_defend: tell ARP that it needs to send a single gratuitous
12169  *	  ARP message in defense of the address.
12170  *	* Res_act_rebind: tell ARP to change the hardware address for an IP
12171  *	  address (and issue gratuitous ARPs).  Used by ipmp_ill_bind_ipif().
12172  *
12173  * Returns zero on success, or an errno upon failure.
12174  */
12175 int
ipif_resolver_up(ipif_t * ipif,enum ip_resolver_action res_act)12176 ipif_resolver_up(ipif_t *ipif, enum ip_resolver_action res_act)
12177 {
12178 	ill_t		*ill = ipif->ipif_ill;
12179 	int		err;
12180 	boolean_t	was_dup;
12181 
12182 	ip1dbg(("ipif_resolver_up(%s:%u) flags 0x%x\n",
12183 	    ill->ill_name, ipif->ipif_id, (uint_t)ipif->ipif_flags));
12184 	ASSERT(IAM_WRITER_IPIF(ipif));
12185 
12186 	was_dup = B_FALSE;
12187 	if (res_act == Res_act_initial) {
12188 		ipif->ipif_addr_ready = 0;
12189 		/*
12190 		 * We're bringing an interface up here.  There's no way that we
12191 		 * should need to shut down ARP now.
12192 		 */
12193 		mutex_enter(&ill->ill_lock);
12194 		if (ipif->ipif_flags & IPIF_DUPLICATE) {
12195 			ipif->ipif_flags &= ~IPIF_DUPLICATE;
12196 			ill->ill_ipif_dup_count--;
12197 			was_dup = B_TRUE;
12198 		}
12199 		mutex_exit(&ill->ill_lock);
12200 	}
12201 	if (ipif->ipif_recovery_id != 0)
12202 		(void) untimeout(ipif->ipif_recovery_id);
12203 	ipif->ipif_recovery_id = 0;
12204 	if (ill->ill_net_type != IRE_IF_RESOLVER) {
12205 		ipif->ipif_addr_ready = 1;
12206 		return (0);
12207 	}
12208 	/* NDP will set the ipif_addr_ready flag when it's ready */
12209 	if (ill->ill_isv6)
12210 		return (0);
12211 
12212 	err = ipif_arp_up(ipif, res_act, was_dup);
12213 	return (err);
12214 }
12215 
12216 /*
12217  * This routine restarts IPv4/IPv6 duplicate address detection (DAD)
12218  * when a link has just gone back up.
12219  */
12220 static void
ipif_nce_start_dad(ipif_t * ipif)12221 ipif_nce_start_dad(ipif_t *ipif)
12222 {
12223 	ncec_t *ncec;
12224 	ill_t *ill = ipif->ipif_ill;
12225 	boolean_t isv6 = ill->ill_isv6;
12226 
12227 	if (isv6) {
12228 		ncec = ncec_lookup_illgrp_v6(ipif->ipif_ill,
12229 		    &ipif->ipif_v6lcl_addr);
12230 	} else {
12231 		ipaddr_t v4addr;
12232 
12233 		if (ill->ill_net_type != IRE_IF_RESOLVER ||
12234 		    (ipif->ipif_flags & IPIF_UNNUMBERED) ||
12235 		    ipif->ipif_lcl_addr == INADDR_ANY) {
12236 			/*
12237 			 * If we can't contact ARP for some reason,
12238 			 * that's not really a problem.  Just send
12239 			 * out the routing socket notification that
12240 			 * DAD completion would have done, and continue.
12241 			 */
12242 			ipif_mask_reply(ipif);
12243 			ipif_up_notify(ipif);
12244 			ipif->ipif_addr_ready = 1;
12245 			return;
12246 		}
12247 
12248 		IN6_V4MAPPED_TO_IPADDR(&ipif->ipif_v6lcl_addr, v4addr);
12249 		ncec = ncec_lookup_illgrp_v4(ipif->ipif_ill, &v4addr);
12250 	}
12251 
12252 	if (ncec == NULL) {
12253 		ip1dbg(("couldn't find ncec for ipif %p leaving !ready\n",
12254 		    (void *)ipif));
12255 		return;
12256 	}
12257 	if (!nce_restart_dad(ncec)) {
12258 		/*
12259 		 * If we can't restart DAD for some reason, that's not really a
12260 		 * problem.  Just send out the routing socket notification that
12261 		 * DAD completion would have done, and continue.
12262 		 */
12263 		ipif_up_notify(ipif);
12264 		ipif->ipif_addr_ready = 1;
12265 	}
12266 	ncec_refrele(ncec);
12267 }
12268 
12269 /*
12270  * Restart duplicate address detection on all interfaces on the given ill.
12271  *
12272  * This is called when an interface transitions from down to up
12273  * (DL_NOTE_LINK_UP) or up to down (DL_NOTE_LINK_DOWN).
12274  *
12275  * Note that since the underlying physical link has transitioned, we must cause
12276  * at least one routing socket message to be sent here, either via DAD
12277  * completion or just by default on the first ipif.  (If we don't do this, then
12278  * in.mpathd will see long delays when doing link-based failure recovery.)
12279  */
12280 void
ill_restart_dad(ill_t * ill,boolean_t went_up)12281 ill_restart_dad(ill_t *ill, boolean_t went_up)
12282 {
12283 	ipif_t *ipif;
12284 
12285 	if (ill == NULL)
12286 		return;
12287 
12288 	/*
12289 	 * If layer two doesn't support duplicate address detection, then just
12290 	 * send the routing socket message now and be done with it.
12291 	 */
12292 	if (!ill->ill_isv6 && arp_no_defense) {
12293 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
12294 		return;
12295 	}
12296 
12297 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12298 		if (went_up) {
12299 
12300 			if (ipif->ipif_flags & IPIF_UP) {
12301 				ipif_nce_start_dad(ipif);
12302 			} else if (ipif->ipif_flags & IPIF_DUPLICATE) {
12303 				/*
12304 				 * kick off the bring-up process now.
12305 				 */
12306 				ipif_do_recovery(ipif);
12307 			} else {
12308 				/*
12309 				 * Unfortunately, the first ipif is "special"
12310 				 * and represents the underlying ill in the
12311 				 * routing socket messages.  Thus, when this
12312 				 * one ipif is down, we must still notify so
12313 				 * that the user knows the IFF_RUNNING status
12314 				 * change.  (If the first ipif is up, then
12315 				 * we'll handle eventual routing socket
12316 				 * notification via DAD completion.)
12317 				 */
12318 				if (ipif == ill->ill_ipif) {
12319 					ip_rts_ifmsg(ill->ill_ipif,
12320 					    RTSQ_DEFAULT);
12321 				}
12322 			}
12323 		} else {
12324 			/*
12325 			 * After link down, we'll need to send a new routing
12326 			 * message when the link comes back, so clear
12327 			 * ipif_addr_ready.
12328 			 */
12329 			ipif->ipif_addr_ready = 0;
12330 		}
12331 	}
12332 
12333 	/*
12334 	 * If we've torn down links, then notify the user right away.
12335 	 */
12336 	if (!went_up)
12337 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
12338 }
12339 
12340 static void
ipsq_delete(ipsq_t * ipsq)12341 ipsq_delete(ipsq_t *ipsq)
12342 {
12343 	ipxop_t *ipx = ipsq->ipsq_xop;
12344 
12345 	ipsq->ipsq_ipst = NULL;
12346 	ASSERT(ipsq->ipsq_phyint == NULL);
12347 	ASSERT(ipsq->ipsq_xop != NULL);
12348 	ASSERT(ipsq->ipsq_xopq_mphead == NULL && ipx->ipx_mphead == NULL);
12349 	ASSERT(ipx->ipx_pending_mp == NULL);
12350 	kmem_free(ipsq, sizeof (ipsq_t));
12351 }
12352 
12353 static int
ill_up_ipifs_on_ill(ill_t * ill,queue_t * q,mblk_t * mp)12354 ill_up_ipifs_on_ill(ill_t *ill, queue_t *q, mblk_t *mp)
12355 {
12356 	int err = 0;
12357 	ipif_t *ipif;
12358 
12359 	if (ill == NULL)
12360 		return (0);
12361 
12362 	ASSERT(IAM_WRITER_ILL(ill));
12363 	ill->ill_up_ipifs = B_TRUE;
12364 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12365 		if (ipif->ipif_was_up) {
12366 			if (!(ipif->ipif_flags & IPIF_UP))
12367 				err = ipif_up(ipif, q, mp);
12368 			ipif->ipif_was_up = B_FALSE;
12369 			if (err != 0) {
12370 				ASSERT(err == EINPROGRESS);
12371 				return (err);
12372 			}
12373 		}
12374 	}
12375 	ill->ill_up_ipifs = B_FALSE;
12376 	return (0);
12377 }
12378 
12379 /*
12380  * This function is called to bring up all the ipifs that were up before
12381  * bringing the ill down via ill_down_ipifs().
12382  */
12383 int
ill_up_ipifs(ill_t * ill,queue_t * q,mblk_t * mp)12384 ill_up_ipifs(ill_t *ill, queue_t *q, mblk_t *mp)
12385 {
12386 	int err;
12387 
12388 	ASSERT(IAM_WRITER_ILL(ill));
12389 
12390 	if (ill->ill_replumbing) {
12391 		ill->ill_replumbing = 0;
12392 		/*
12393 		 * Send down REPLUMB_DONE notification followed by the
12394 		 * BIND_REQ on the arp stream.
12395 		 */
12396 		if (!ill->ill_isv6)
12397 			arp_send_replumb_conf(ill);
12398 	}
12399 	err = ill_up_ipifs_on_ill(ill->ill_phyint->phyint_illv4, q, mp);
12400 	if (err != 0)
12401 		return (err);
12402 
12403 	return (ill_up_ipifs_on_ill(ill->ill_phyint->phyint_illv6, q, mp));
12404 }
12405 
12406 /*
12407  * Bring down any IPIF_UP ipifs on ill. If "logical" is B_TRUE, we bring
12408  * down the ipifs without sending DL_UNBIND_REQ to the driver.
12409  */
12410 static void
ill_down_ipifs(ill_t * ill,boolean_t logical)12411 ill_down_ipifs(ill_t *ill, boolean_t logical)
12412 {
12413 	ipif_t *ipif;
12414 
12415 	ASSERT(IAM_WRITER_ILL(ill));
12416 
12417 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12418 		/*
12419 		 * We go through the ipif_down logic even if the ipif
12420 		 * is already down, since routes can be added based
12421 		 * on down ipifs. Going through ipif_down once again
12422 		 * will delete any IREs created based on these routes.
12423 		 */
12424 		if (ipif->ipif_flags & IPIF_UP)
12425 			ipif->ipif_was_up = B_TRUE;
12426 
12427 		if (logical) {
12428 			(void) ipif_logical_down(ipif, NULL, NULL);
12429 			ipif_non_duplicate(ipif);
12430 			(void) ipif_down_tail(ipif);
12431 		} else {
12432 			(void) ipif_down(ipif, NULL, NULL);
12433 		}
12434 	}
12435 }
12436 
12437 /*
12438  * Redo source address selection.  This makes IXAF_VERIFY_SOURCE take
12439  * a look again at valid source addresses.
12440  * This should be called each time after the set of source addresses has been
12441  * changed.
12442  */
12443 void
ip_update_source_selection(ip_stack_t * ipst)12444 ip_update_source_selection(ip_stack_t *ipst)
12445 {
12446 	/* We skip past SRC_GENERATION_VERIFY */
12447 	if (atomic_inc_32_nv(&ipst->ips_src_generation) ==
12448 	    SRC_GENERATION_VERIFY)
12449 		atomic_inc_32(&ipst->ips_src_generation);
12450 }
12451 
12452 /*
12453  * Finish the group join started in ip_sioctl_groupname().
12454  */
12455 /* ARGSUSED */
12456 static void
ip_join_illgrps(ipsq_t * ipsq,queue_t * q,mblk_t * mp,void * dummy)12457 ip_join_illgrps(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy)
12458 {
12459 	ill_t		*ill = q->q_ptr;
12460 	phyint_t	*phyi = ill->ill_phyint;
12461 	ipmp_grp_t	*grp = phyi->phyint_grp;
12462 	ip_stack_t	*ipst = ill->ill_ipst;
12463 
12464 	/* IS_UNDER_IPMP() won't work until ipmp_ill_join_illgrp() is called */
12465 	ASSERT(!IS_IPMP(ill) && grp != NULL);
12466 	ASSERT(IAM_WRITER_IPSQ(ipsq));
12467 
12468 	if (phyi->phyint_illv4 != NULL) {
12469 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
12470 		VERIFY(grp->gr_pendv4-- > 0);
12471 		rw_exit(&ipst->ips_ipmp_lock);
12472 		ipmp_ill_join_illgrp(phyi->phyint_illv4, grp->gr_v4);
12473 	}
12474 	if (phyi->phyint_illv6 != NULL) {
12475 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
12476 		VERIFY(grp->gr_pendv6-- > 0);
12477 		rw_exit(&ipst->ips_ipmp_lock);
12478 		ipmp_ill_join_illgrp(phyi->phyint_illv6, grp->gr_v6);
12479 	}
12480 	freemsg(mp);
12481 }
12482 
12483 /*
12484  * Process an SIOCSLIFGROUPNAME request.
12485  */
12486 /* ARGSUSED */
12487 int
ip_sioctl_groupname(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)12488 ip_sioctl_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12489     ip_ioctl_cmd_t *ipip, void *ifreq)
12490 {
12491 	struct lifreq	*lifr = ifreq;
12492 	ill_t		*ill = ipif->ipif_ill;
12493 	ip_stack_t	*ipst = ill->ill_ipst;
12494 	phyint_t	*phyi = ill->ill_phyint;
12495 	ipmp_grp_t	*grp = phyi->phyint_grp;
12496 	mblk_t		*ipsq_mp;
12497 	int		err = 0;
12498 
12499 	/*
12500 	 * Note that phyint_grp can only change here, where we're exclusive.
12501 	 */
12502 	ASSERT(IAM_WRITER_ILL(ill));
12503 
12504 	if (ipif->ipif_id != 0 || ill->ill_usesrc_grp_next != NULL ||
12505 	    (phyi->phyint_flags & PHYI_VIRTUAL))
12506 		return (EINVAL);
12507 
12508 	lifr->lifr_groupname[LIFGRNAMSIZ - 1] = '\0';
12509 
12510 	rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
12511 
12512 	/*
12513 	 * If the name hasn't changed, there's nothing to do.
12514 	 */
12515 	if (grp != NULL && strcmp(grp->gr_name, lifr->lifr_groupname) == 0)
12516 		goto unlock;
12517 
12518 	/*
12519 	 * Handle requests to rename an IPMP meta-interface.
12520 	 *
12521 	 * Note that creation of the IPMP meta-interface is handled in
12522 	 * userland through the standard plumbing sequence.  As part of the
12523 	 * plumbing the IPMP meta-interface, its initial groupname is set to
12524 	 * the name of the interface (see ipif_set_values_tail()).
12525 	 */
12526 	if (IS_IPMP(ill)) {
12527 		err = ipmp_grp_rename(grp, lifr->lifr_groupname);
12528 		goto unlock;
12529 	}
12530 
12531 	/*
12532 	 * Handle requests to add or remove an IP interface from a group.
12533 	 */
12534 	if (lifr->lifr_groupname[0] != '\0') {			/* add */
12535 		/*
12536 		 * Moves are handled by first removing the interface from
12537 		 * its existing group, and then adding it to another group.
12538 		 * So, fail if it's already in a group.
12539 		 */
12540 		if (IS_UNDER_IPMP(ill)) {
12541 			err = EALREADY;
12542 			goto unlock;
12543 		}
12544 
12545 		grp = ipmp_grp_lookup(lifr->lifr_groupname, ipst);
12546 		if (grp == NULL) {
12547 			err = ENOENT;
12548 			goto unlock;
12549 		}
12550 
12551 		/*
12552 		 * Check if the phyint and its ills are suitable for
12553 		 * inclusion into the group.
12554 		 */
12555 		if ((err = ipmp_grp_vet_phyint(grp, phyi)) != 0)
12556 			goto unlock;
12557 
12558 		/*
12559 		 * Checks pass; join the group, and enqueue the remaining
12560 		 * illgrp joins for when we've become part of the group xop
12561 		 * and are exclusive across its IPSQs.  Since qwriter_ip()
12562 		 * requires an mblk_t to scribble on, and since `mp' will be
12563 		 * freed as part of completing the ioctl, allocate another.
12564 		 */
12565 		if ((ipsq_mp = allocb(0, BPRI_MED)) == NULL) {
12566 			err = ENOMEM;
12567 			goto unlock;
12568 		}
12569 
12570 		/*
12571 		 * Before we drop ipmp_lock, bump gr_pend* to ensure that the
12572 		 * IPMP meta-interface ills needed by `phyi' cannot go away
12573 		 * before ip_join_illgrps() is called back.  See the comments
12574 		 * in ip_sioctl_plink_ipmp() for more.
12575 		 */
12576 		if (phyi->phyint_illv4 != NULL)
12577 			grp->gr_pendv4++;
12578 		if (phyi->phyint_illv6 != NULL)
12579 			grp->gr_pendv6++;
12580 
12581 		rw_exit(&ipst->ips_ipmp_lock);
12582 
12583 		ipmp_phyint_join_grp(phyi, grp);
12584 		ill_refhold(ill);
12585 		qwriter_ip(ill, ill->ill_rq, ipsq_mp, ip_join_illgrps,
12586 		    SWITCH_OP, B_FALSE);
12587 		return (0);
12588 	} else {
12589 		/*
12590 		 * Request to remove the interface from a group.  If the
12591 		 * interface is not in a group, this trivially succeeds.
12592 		 */
12593 		rw_exit(&ipst->ips_ipmp_lock);
12594 		if (IS_UNDER_IPMP(ill))
12595 			ipmp_phyint_leave_grp(phyi);
12596 		return (0);
12597 	}
12598 unlock:
12599 	rw_exit(&ipst->ips_ipmp_lock);
12600 	return (err);
12601 }
12602 
12603 /*
12604  * Process an SIOCGLIFBINDING request.
12605  */
12606 /* ARGSUSED */
12607 int
ip_sioctl_get_binding(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)12608 ip_sioctl_get_binding(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12609     ip_ioctl_cmd_t *ipip, void *ifreq)
12610 {
12611 	ill_t		*ill;
12612 	struct lifreq	*lifr = ifreq;
12613 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
12614 
12615 	if (!IS_IPMP(ipif->ipif_ill))
12616 		return (EINVAL);
12617 
12618 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
12619 	if ((ill = ipif->ipif_bound_ill) == NULL)
12620 		lifr->lifr_binding[0] = '\0';
12621 	else
12622 		(void) strlcpy(lifr->lifr_binding, ill->ill_name, LIFNAMSIZ);
12623 	rw_exit(&ipst->ips_ipmp_lock);
12624 	return (0);
12625 }
12626 
12627 /*
12628  * Process an SIOCGLIFGROUPNAME request.
12629  */
12630 /* ARGSUSED */
12631 int
ip_sioctl_get_groupname(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)12632 ip_sioctl_get_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12633     ip_ioctl_cmd_t *ipip, void *ifreq)
12634 {
12635 	ipmp_grp_t	*grp;
12636 	struct lifreq	*lifr = ifreq;
12637 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
12638 
12639 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
12640 	if ((grp = ipif->ipif_ill->ill_phyint->phyint_grp) == NULL)
12641 		lifr->lifr_groupname[0] = '\0';
12642 	else
12643 		(void) strlcpy(lifr->lifr_groupname, grp->gr_name, LIFGRNAMSIZ);
12644 	rw_exit(&ipst->ips_ipmp_lock);
12645 	return (0);
12646 }
12647 
12648 /*
12649  * Process an SIOCGLIFGROUPINFO request.
12650  */
12651 /* ARGSUSED */
12652 int
ip_sioctl_groupinfo(ipif_t * dummy_ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy)12653 ip_sioctl_groupinfo(ipif_t *dummy_ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12654     ip_ioctl_cmd_t *ipip, void *dummy)
12655 {
12656 	ipmp_grp_t	*grp;
12657 	lifgroupinfo_t	*lifgr;
12658 	ip_stack_t	*ipst = CONNQ_TO_IPST(q);
12659 
12660 	/* ip_wput_nondata() verified mp->b_cont->b_cont */
12661 	lifgr = (lifgroupinfo_t *)mp->b_cont->b_cont->b_rptr;
12662 	lifgr->gi_grname[LIFGRNAMSIZ - 1] = '\0';
12663 
12664 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
12665 	if ((grp = ipmp_grp_lookup(lifgr->gi_grname, ipst)) == NULL) {
12666 		rw_exit(&ipst->ips_ipmp_lock);
12667 		return (ENOENT);
12668 	}
12669 	ipmp_grp_info(grp, lifgr);
12670 	rw_exit(&ipst->ips_ipmp_lock);
12671 	return (0);
12672 }
12673 
12674 static void
ill_dl_down(ill_t * ill)12675 ill_dl_down(ill_t *ill)
12676 {
12677 	DTRACE_PROBE2(ill__downup, char *, "ill_dl_down", ill_t *, ill);
12678 
12679 	/*
12680 	 * The ill is down; unbind but stay attached since we're still
12681 	 * associated with a PPA. If we have negotiated DLPI capabilites
12682 	 * with the data link service provider (IDS_OK) then reset them.
12683 	 * The interval between unbinding and rebinding is potentially
12684 	 * unbounded hence we cannot assume things will be the same.
12685 	 * The DLPI capabilities will be probed again when the data link
12686 	 * is brought up.
12687 	 */
12688 	mblk_t	*mp = ill->ill_unbind_mp;
12689 
12690 	ip1dbg(("ill_dl_down(%s)\n", ill->ill_name));
12691 
12692 	if (!ill->ill_replumbing) {
12693 		/* Free all ilms for this ill */
12694 		update_conn_ill(ill, ill->ill_ipst);
12695 	} else {
12696 		ill_leave_multicast(ill);
12697 	}
12698 
12699 	ill->ill_unbind_mp = NULL;
12700 	if (mp != NULL) {
12701 		ip1dbg(("ill_dl_down: %s (%u) for %s\n",
12702 		    dl_primstr(*(int *)mp->b_rptr), *(int *)mp->b_rptr,
12703 		    ill->ill_name));
12704 		mutex_enter(&ill->ill_lock);
12705 		ill->ill_state_flags |= ILL_DL_UNBIND_IN_PROGRESS;
12706 		mutex_exit(&ill->ill_lock);
12707 		/*
12708 		 * ip_rput does not pass up normal (M_PROTO) DLPI messages
12709 		 * after ILL_CONDEMNED is set. So in the unplumb case, we call
12710 		 * ill_capability_dld_disable disable rightaway. If this is not
12711 		 * an unplumb operation then the disable happens on receipt of
12712 		 * the capab ack via ip_rput_dlpi_writer ->
12713 		 * ill_capability_ack_thr. In both cases the order of
12714 		 * the operations seen by DLD is capability disable followed
12715 		 * by DL_UNBIND. Also the DLD capability disable needs a
12716 		 * cv_wait'able context.
12717 		 */
12718 		if (ill->ill_state_flags & ILL_CONDEMNED)
12719 			ill_capability_dld_disable(ill);
12720 		ill_capability_reset(ill, B_FALSE);
12721 		ill_dlpi_send(ill, mp);
12722 	}
12723 	mutex_enter(&ill->ill_lock);
12724 	ill->ill_dl_up = 0;
12725 	ill_nic_event_dispatch(ill, 0, NE_DOWN, NULL, 0);
12726 	mutex_exit(&ill->ill_lock);
12727 }
12728 
12729 void
ill_dlpi_dispatch(ill_t * ill,mblk_t * mp)12730 ill_dlpi_dispatch(ill_t *ill, mblk_t *mp)
12731 {
12732 	union DL_primitives *dlp;
12733 	t_uscalar_t prim;
12734 	boolean_t waitack = B_FALSE;
12735 
12736 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
12737 
12738 	dlp = (union DL_primitives *)mp->b_rptr;
12739 	prim = dlp->dl_primitive;
12740 
12741 	ip1dbg(("ill_dlpi_dispatch: sending %s (%u) to %s\n",
12742 	    dl_primstr(prim), prim, ill->ill_name));
12743 
12744 	switch (prim) {
12745 	case DL_PHYS_ADDR_REQ:
12746 	{
12747 		dl_phys_addr_req_t *dlpap = (dl_phys_addr_req_t *)mp->b_rptr;
12748 		ill->ill_phys_addr_pend = dlpap->dl_addr_type;
12749 		break;
12750 	}
12751 	case DL_BIND_REQ:
12752 		mutex_enter(&ill->ill_lock);
12753 		ill->ill_state_flags &= ~ILL_DL_UNBIND_IN_PROGRESS;
12754 		mutex_exit(&ill->ill_lock);
12755 		break;
12756 	}
12757 
12758 	/*
12759 	 * Except for the ACKs for the M_PCPROTO messages, all other ACKs
12760 	 * are dropped by ip_rput() if ILL_CONDEMNED is set. Therefore
12761 	 * we only wait for the ACK of the DL_UNBIND_REQ.
12762 	 */
12763 	mutex_enter(&ill->ill_lock);
12764 	if (!(ill->ill_state_flags & ILL_CONDEMNED) ||
12765 	    (prim == DL_UNBIND_REQ)) {
12766 		ill->ill_dlpi_pending = prim;
12767 		waitack = B_TRUE;
12768 	}
12769 
12770 	mutex_exit(&ill->ill_lock);
12771 	DTRACE_PROBE3(ill__dlpi, char *, "ill_dlpi_dispatch",
12772 	    char *, dl_primstr(prim), ill_t *, ill);
12773 	putnext(ill->ill_wq, mp);
12774 
12775 	/*
12776 	 * There is no ack for DL_NOTIFY_CONF messages
12777 	 */
12778 	if (waitack && prim == DL_NOTIFY_CONF)
12779 		ill_dlpi_done(ill, prim);
12780 }
12781 
12782 /*
12783  * Helper function for ill_dlpi_send().
12784  */
12785 /* ARGSUSED */
12786 static void
ill_dlpi_send_writer(ipsq_t * ipsq,queue_t * q,mblk_t * mp,void * arg)12787 ill_dlpi_send_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
12788 {
12789 	ill_dlpi_send(q->q_ptr, mp);
12790 }
12791 
12792 /*
12793  * Send a DLPI control message to the driver but make sure there
12794  * is only one outstanding message. Uses ill_dlpi_pending to tell
12795  * when it must queue. ip_rput_dlpi_writer calls ill_dlpi_done()
12796  * when an ACK or a NAK is received to process the next queued message.
12797  */
12798 void
ill_dlpi_send(ill_t * ill,mblk_t * mp)12799 ill_dlpi_send(ill_t *ill, mblk_t *mp)
12800 {
12801 	mblk_t **mpp;
12802 
12803 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
12804 
12805 	/*
12806 	 * To ensure that any DLPI requests for current exclusive operation
12807 	 * are always completely sent before any DLPI messages for other
12808 	 * operations, require writer access before enqueuing.
12809 	 */
12810 	if (!IAM_WRITER_ILL(ill)) {
12811 		ill_refhold(ill);
12812 		/* qwriter_ip() does the ill_refrele() */
12813 		qwriter_ip(ill, ill->ill_wq, mp, ill_dlpi_send_writer,
12814 		    NEW_OP, B_TRUE);
12815 		return;
12816 	}
12817 
12818 	mutex_enter(&ill->ill_lock);
12819 	if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
12820 		/* Must queue message. Tail insertion */
12821 		mpp = &ill->ill_dlpi_deferred;
12822 		while (*mpp != NULL)
12823 			mpp = &((*mpp)->b_next);
12824 
12825 		ip1dbg(("ill_dlpi_send: deferring request for %s "
12826 		    "while %s pending\n", ill->ill_name,
12827 		    dl_primstr(ill->ill_dlpi_pending)));
12828 
12829 		*mpp = mp;
12830 		mutex_exit(&ill->ill_lock);
12831 		return;
12832 	}
12833 	mutex_exit(&ill->ill_lock);
12834 	ill_dlpi_dispatch(ill, mp);
12835 }
12836 
12837 void
ill_capability_send(ill_t * ill,mblk_t * mp)12838 ill_capability_send(ill_t *ill, mblk_t *mp)
12839 {
12840 	ill->ill_capab_pending_cnt++;
12841 	ill_dlpi_send(ill, mp);
12842 }
12843 
12844 void
ill_capability_done(ill_t * ill)12845 ill_capability_done(ill_t *ill)
12846 {
12847 	ASSERT(ill->ill_capab_pending_cnt != 0);
12848 
12849 	ill_dlpi_done(ill, DL_CAPABILITY_REQ);
12850 
12851 	ill->ill_capab_pending_cnt--;
12852 	if (ill->ill_capab_pending_cnt == 0 &&
12853 	    ill->ill_dlpi_capab_state == IDCS_OK)
12854 		ill_capability_reset_alloc(ill);
12855 }
12856 
12857 /*
12858  * Send all deferred DLPI messages without waiting for their ACKs.
12859  */
12860 void
ill_dlpi_send_deferred(ill_t * ill)12861 ill_dlpi_send_deferred(ill_t *ill)
12862 {
12863 	mblk_t *mp, *nextmp;
12864 
12865 	/*
12866 	 * Clear ill_dlpi_pending so that the message is not queued in
12867 	 * ill_dlpi_send().
12868 	 */
12869 	mutex_enter(&ill->ill_lock);
12870 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
12871 	mp = ill->ill_dlpi_deferred;
12872 	ill->ill_dlpi_deferred = NULL;
12873 	mutex_exit(&ill->ill_lock);
12874 
12875 	for (; mp != NULL; mp = nextmp) {
12876 		nextmp = mp->b_next;
12877 		mp->b_next = NULL;
12878 		ill_dlpi_send(ill, mp);
12879 	}
12880 }
12881 
12882 /*
12883  * Clear all the deferred DLPI messages. Called on receiving an M_ERROR
12884  * or M_HANGUP
12885  */
12886 static void
ill_dlpi_clear_deferred(ill_t * ill)12887 ill_dlpi_clear_deferred(ill_t *ill)
12888 {
12889 	mblk_t	*mp, *nextmp;
12890 
12891 	mutex_enter(&ill->ill_lock);
12892 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
12893 	mp = ill->ill_dlpi_deferred;
12894 	ill->ill_dlpi_deferred = NULL;
12895 	mutex_exit(&ill->ill_lock);
12896 
12897 	for (; mp != NULL; mp = nextmp) {
12898 		nextmp = mp->b_next;
12899 		inet_freemsg(mp);
12900 	}
12901 }
12902 
12903 /*
12904  * Check if the DLPI primitive `prim' is pending; print a warning if not.
12905  */
12906 boolean_t
ill_dlpi_pending(ill_t * ill,t_uscalar_t prim)12907 ill_dlpi_pending(ill_t *ill, t_uscalar_t prim)
12908 {
12909 	t_uscalar_t pending;
12910 
12911 	mutex_enter(&ill->ill_lock);
12912 	if (ill->ill_dlpi_pending == prim) {
12913 		mutex_exit(&ill->ill_lock);
12914 		return (B_TRUE);
12915 	}
12916 
12917 	/*
12918 	 * During teardown, ill_dlpi_dispatch() will send DLPI requests
12919 	 * without waiting, so don't print any warnings in that case.
12920 	 */
12921 	if (ill->ill_state_flags & ILL_CONDEMNED) {
12922 		mutex_exit(&ill->ill_lock);
12923 		return (B_FALSE);
12924 	}
12925 	pending = ill->ill_dlpi_pending;
12926 	mutex_exit(&ill->ill_lock);
12927 
12928 	if (pending == DL_PRIM_INVAL) {
12929 		(void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
12930 		    "received unsolicited ack for %s on %s\n",
12931 		    dl_primstr(prim), ill->ill_name);
12932 	} else {
12933 		(void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
12934 		    "received unexpected ack for %s on %s (expecting %s)\n",
12935 		    dl_primstr(prim), ill->ill_name, dl_primstr(pending));
12936 	}
12937 	return (B_FALSE);
12938 }
12939 
12940 /*
12941  * Complete the current DLPI operation associated with `prim' on `ill' and
12942  * start the next queued DLPI operation (if any).  If there are no queued DLPI
12943  * operations and the ill's current exclusive IPSQ operation has finished
12944  * (i.e., ipsq_current_finish() was called), then clear ipsq_current_ipif to
12945  * allow the next exclusive IPSQ operation to begin upon ipsq_exit().  See
12946  * the comments above ipsq_current_finish() for details.
12947  */
12948 void
ill_dlpi_done(ill_t * ill,t_uscalar_t prim)12949 ill_dlpi_done(ill_t *ill, t_uscalar_t prim)
12950 {
12951 	mblk_t *mp;
12952 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
12953 	ipxop_t *ipx = ipsq->ipsq_xop;
12954 
12955 	ASSERT(IAM_WRITER_IPSQ(ipsq));
12956 	mutex_enter(&ill->ill_lock);
12957 
12958 	ASSERT(prim != DL_PRIM_INVAL);
12959 	ASSERT(ill->ill_dlpi_pending == prim);
12960 
12961 	ip1dbg(("ill_dlpi_done: %s has completed %s (%u)\n", ill->ill_name,
12962 	    dl_primstr(ill->ill_dlpi_pending), ill->ill_dlpi_pending));
12963 
12964 	if ((mp = ill->ill_dlpi_deferred) == NULL) {
12965 		ill->ill_dlpi_pending = DL_PRIM_INVAL;
12966 		if (ipx->ipx_current_done) {
12967 			mutex_enter(&ipx->ipx_lock);
12968 			ipx->ipx_current_ipif = NULL;
12969 			mutex_exit(&ipx->ipx_lock);
12970 		}
12971 		cv_signal(&ill->ill_cv);
12972 		mutex_exit(&ill->ill_lock);
12973 		return;
12974 	}
12975 
12976 	ill->ill_dlpi_deferred = mp->b_next;
12977 	mp->b_next = NULL;
12978 	mutex_exit(&ill->ill_lock);
12979 
12980 	ill_dlpi_dispatch(ill, mp);
12981 }
12982 
12983 /*
12984  * Queue a (multicast) DLPI control message to be sent to the driver by
12985  * later calling ill_dlpi_send_queued.
12986  * We queue them while holding a lock (ill_mcast_lock) to ensure that they
12987  * are sent in order i.e., prevent a DL_DISABMULTI_REQ and DL_ENABMULTI_REQ
12988  * for the same group to race.
12989  * We send DLPI control messages in order using ill_lock.
12990  * For IPMP we should be called on the cast_ill.
12991  */
12992 void
ill_dlpi_queue(ill_t * ill,mblk_t * mp)12993 ill_dlpi_queue(ill_t *ill, mblk_t *mp)
12994 {
12995 	mblk_t **mpp;
12996 
12997 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
12998 
12999 	mutex_enter(&ill->ill_lock);
13000 	/* Must queue message. Tail insertion */
13001 	mpp = &ill->ill_dlpi_deferred;
13002 	while (*mpp != NULL)
13003 		mpp = &((*mpp)->b_next);
13004 
13005 	*mpp = mp;
13006 	mutex_exit(&ill->ill_lock);
13007 }
13008 
13009 /*
13010  * Send the messages that were queued. Make sure there is only
13011  * one outstanding message. ip_rput_dlpi_writer calls ill_dlpi_done()
13012  * when an ACK or a NAK is received to process the next queued message.
13013  * For IPMP we are called on the upper ill, but when send what is queued
13014  * on the cast_ill.
13015  */
13016 void
ill_dlpi_send_queued(ill_t * ill)13017 ill_dlpi_send_queued(ill_t *ill)
13018 {
13019 	mblk_t	*mp;
13020 	union DL_primitives *dlp;
13021 	t_uscalar_t prim;
13022 	ill_t *release_ill = NULL;
13023 
13024 	if (IS_IPMP(ill)) {
13025 		/* On the upper IPMP ill. */
13026 		release_ill = ipmp_illgrp_hold_cast_ill(ill->ill_grp);
13027 		if (release_ill == NULL) {
13028 			/* Avoid ever sending anything down to the ipmpstub */
13029 			return;
13030 		}
13031 		ill = release_ill;
13032 	}
13033 	mutex_enter(&ill->ill_lock);
13034 	while ((mp = ill->ill_dlpi_deferred) != NULL) {
13035 		if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
13036 			/* Can't send. Somebody else will send it */
13037 			mutex_exit(&ill->ill_lock);
13038 			goto done;
13039 		}
13040 		ill->ill_dlpi_deferred = mp->b_next;
13041 		mp->b_next = NULL;
13042 		if (!ill->ill_dl_up) {
13043 			/*
13044 			 * Nobody there. All multicast addresses will be
13045 			 * re-joined when we get the DL_BIND_ACK bringing the
13046 			 * interface up.
13047 			 */
13048 			freemsg(mp);
13049 			continue;
13050 		}
13051 		dlp = (union DL_primitives *)mp->b_rptr;
13052 		prim = dlp->dl_primitive;
13053 
13054 		if (!(ill->ill_state_flags & ILL_CONDEMNED) ||
13055 		    (prim == DL_UNBIND_REQ)) {
13056 			ill->ill_dlpi_pending = prim;
13057 		}
13058 		mutex_exit(&ill->ill_lock);
13059 
13060 		DTRACE_PROBE3(ill__dlpi, char *, "ill_dlpi_send_queued",
13061 		    char *, dl_primstr(prim), ill_t *, ill);
13062 		putnext(ill->ill_wq, mp);
13063 		mutex_enter(&ill->ill_lock);
13064 	}
13065 	mutex_exit(&ill->ill_lock);
13066 done:
13067 	if (release_ill != NULL)
13068 		ill_refrele(release_ill);
13069 }
13070 
13071 /*
13072  * Queue an IP (IGMP/MLD) message to be sent by IP from
13073  * ill_mcast_send_queued
13074  * We queue them while holding a lock (ill_mcast_lock) to ensure that they
13075  * are sent in order i.e., prevent a IGMP leave and IGMP join for the same
13076  * group to race.
13077  * We send them in order using ill_lock.
13078  * For IPMP we are called on the upper ill, but we queue on the cast_ill.
13079  */
13080 void
ill_mcast_queue(ill_t * ill,mblk_t * mp)13081 ill_mcast_queue(ill_t *ill, mblk_t *mp)
13082 {
13083 	mblk_t **mpp;
13084 	ill_t *release_ill = NULL;
13085 
13086 	ASSERT(RW_LOCK_HELD(&ill->ill_mcast_lock));
13087 
13088 	if (IS_IPMP(ill)) {
13089 		/* On the upper IPMP ill. */
13090 		release_ill = ipmp_illgrp_hold_cast_ill(ill->ill_grp);
13091 		if (release_ill == NULL) {
13092 			/* Discard instead of queuing for the ipmp interface */
13093 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
13094 			ip_drop_output("ipIfStatsOutDiscards - no cast_ill",
13095 			    mp, ill);
13096 			freemsg(mp);
13097 			return;
13098 		}
13099 		ill = release_ill;
13100 	}
13101 
13102 	mutex_enter(&ill->ill_lock);
13103 	/* Must queue message. Tail insertion */
13104 	mpp = &ill->ill_mcast_deferred;
13105 	while (*mpp != NULL)
13106 		mpp = &((*mpp)->b_next);
13107 
13108 	*mpp = mp;
13109 	mutex_exit(&ill->ill_lock);
13110 	if (release_ill != NULL)
13111 		ill_refrele(release_ill);
13112 }
13113 
13114 /*
13115  * Send the IP packets that were queued by ill_mcast_queue.
13116  * These are IGMP/MLD packets.
13117  *
13118  * For IPMP we are called on the upper ill, but when send what is queued
13119  * on the cast_ill.
13120  *
13121  * Request loopback of the report if we are acting as a multicast
13122  * router, so that the process-level routing demon can hear it.
13123  * This will run multiple times for the same group if there are members
13124  * on the same group for multiple ipif's on the same ill. The
13125  * igmp_input/mld_input code will suppress this due to the loopback thus we
13126  * always loopback membership report.
13127  *
13128  * We also need to make sure that this does not get load balanced
13129  * by IPMP. We do this by passing an ill to ip_output_simple.
13130  */
13131 void
ill_mcast_send_queued(ill_t * ill)13132 ill_mcast_send_queued(ill_t *ill)
13133 {
13134 	mblk_t	*mp;
13135 	ip_xmit_attr_t ixas;
13136 	ill_t *release_ill = NULL;
13137 
13138 	if (IS_IPMP(ill)) {
13139 		/* On the upper IPMP ill. */
13140 		release_ill = ipmp_illgrp_hold_cast_ill(ill->ill_grp);
13141 		if (release_ill == NULL) {
13142 			/*
13143 			 * We should have no messages on the ipmp interface
13144 			 * but no point in trying to send them.
13145 			 */
13146 			return;
13147 		}
13148 		ill = release_ill;
13149 	}
13150 	bzero(&ixas, sizeof (ixas));
13151 	ixas.ixa_zoneid = ALL_ZONES;
13152 	ixas.ixa_cred = kcred;
13153 	ixas.ixa_cpid = NOPID;
13154 	ixas.ixa_tsl = NULL;
13155 	/*
13156 	 * Here we set ixa_ifindex. If IPMP it will be the lower ill which
13157 	 * makes ip_select_route pick the IRE_MULTICAST for the cast_ill.
13158 	 * That is necessary to handle IGMP/MLD snooping switches.
13159 	 */
13160 	ixas.ixa_ifindex = ill->ill_phyint->phyint_ifindex;
13161 	ixas.ixa_ipst = ill->ill_ipst;
13162 
13163 	mutex_enter(&ill->ill_lock);
13164 	while ((mp = ill->ill_mcast_deferred) != NULL) {
13165 		ill->ill_mcast_deferred = mp->b_next;
13166 		mp->b_next = NULL;
13167 		if (!ill->ill_dl_up) {
13168 			/*
13169 			 * Nobody there. Just drop the ip packets.
13170 			 * IGMP/MLD will resend later, if this is a replumb.
13171 			 */
13172 			freemsg(mp);
13173 			continue;
13174 		}
13175 		mutex_enter(&ill->ill_phyint->phyint_lock);
13176 		if (IS_UNDER_IPMP(ill) && !ipmp_ill_is_active(ill)) {
13177 			/*
13178 			 * When the ill is getting deactivated, we only want to
13179 			 * send the DLPI messages, so drop IGMP/MLD packets.
13180 			 * DLPI messages are handled by ill_dlpi_send_queued()
13181 			 */
13182 			mutex_exit(&ill->ill_phyint->phyint_lock);
13183 			freemsg(mp);
13184 			continue;
13185 		}
13186 		mutex_exit(&ill->ill_phyint->phyint_lock);
13187 		mutex_exit(&ill->ill_lock);
13188 
13189 		/* Check whether we are sending IPv4 or IPv6. */
13190 		if (ill->ill_isv6) {
13191 			ip6_t  *ip6h = (ip6_t *)mp->b_rptr;
13192 
13193 			ixas.ixa_multicast_ttl = ip6h->ip6_hops;
13194 			ixas.ixa_flags = IXAF_BASIC_SIMPLE_V6;
13195 		} else {
13196 			ipha_t *ipha = (ipha_t *)mp->b_rptr;
13197 
13198 			ixas.ixa_multicast_ttl = ipha->ipha_ttl;
13199 			ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
13200 			ixas.ixa_flags &= ~IXAF_SET_ULP_CKSUM;
13201 		}
13202 		ixas.ixa_flags &= ~IXAF_VERIFY_SOURCE;
13203 		ixas.ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_SOURCE;
13204 		(void) ip_output_simple(mp, &ixas);
13205 		ixa_cleanup(&ixas);
13206 
13207 		mutex_enter(&ill->ill_lock);
13208 	}
13209 	mutex_exit(&ill->ill_lock);
13210 
13211 done:
13212 	if (release_ill != NULL)
13213 		ill_refrele(release_ill);
13214 }
13215 
13216 /*
13217  * Take down a specific interface, but don't lose any information about it.
13218  * (Always called as writer.)
13219  * This function goes through the down sequence even if the interface is
13220  * already down. There are 2 reasons.
13221  * a. Currently we permit interface routes that depend on down interfaces
13222  *    to be added. This behaviour itself is questionable. However it appears
13223  *    that both Solaris and 4.3 BSD have exhibited this behaviour for a long
13224  *    time. We go thru the cleanup in order to remove these routes.
13225  * b. The bringup of the interface could fail in ill_dl_up i.e. we get
13226  *    DL_ERROR_ACK in response to the DL_BIND request. The interface is
13227  *    down, but we need to cleanup i.e. do ill_dl_down and
13228  *    ip_rput_dlpi_writer (DL_ERROR_ACK) -> ipif_down.
13229  *
13230  * IP-MT notes:
13231  *
13232  * Model of reference to interfaces.
13233  *
13234  * The following members in ipif_t track references to the ipif.
13235  *	int     ipif_refcnt;    Active reference count
13236  *
13237  * The following members in ill_t track references to the ill.
13238  *	int             ill_refcnt;     active refcnt
13239  *	uint_t          ill_ire_cnt;	Number of ires referencing ill
13240  *	uint_t          ill_ncec_cnt;	Number of ncecs referencing ill
13241  *	uint_t          ill_nce_cnt;	Number of nces referencing ill
13242  *	uint_t          ill_ilm_cnt;	Number of ilms referencing ill
13243  *
13244  * Reference to an ipif or ill can be obtained in any of the following ways.
13245  *
13246  * Through the lookup functions ipif_lookup_* / ill_lookup_* functions
13247  * Pointers to ipif / ill from other data structures viz ire and conn.
13248  * Implicit reference to the ipif / ill by holding a reference to the ire.
13249  *
13250  * The ipif/ill lookup functions return a reference held ipif / ill.
13251  * ipif_refcnt and ill_refcnt track the reference counts respectively.
13252  * This is a purely dynamic reference count associated with threads holding
13253  * references to the ipif / ill. Pointers from other structures do not
13254  * count towards this reference count.
13255  *
13256  * ill_ire_cnt is the number of ire's associated with the
13257  * ill. This is incremented whenever a new ire is created referencing the
13258  * ill. This is done atomically inside ire_add_v[46] where the ire is
13259  * actually added to the ire hash table. The count is decremented in
13260  * ire_inactive where the ire is destroyed.
13261  *
13262  * ill_ncec_cnt is the number of ncec's referencing the ill thru ncec_ill.
13263  * This is incremented atomically in
13264  * ndp_add_v4()/ndp_add_v6() where the nce is actually added to the
13265  * table. Similarly it is decremented in ncec_inactive() where the ncec
13266  * is destroyed.
13267  *
13268  * ill_nce_cnt is the number of nce's referencing the ill thru nce_ill. This is
13269  * incremented atomically in nce_add() where the nce is actually added to the
13270  * ill_nce. Similarly it is decremented in nce_inactive() where the nce
13271  * is destroyed.
13272  *
13273  * ill_ilm_cnt is the ilm's reference to the ill. It is incremented in
13274  * ilm_add() and decremented before the ilm is freed in ilm_delete().
13275  *
13276  * Flow of ioctls involving interface down/up
13277  *
13278  * The following is the sequence of an attempt to set some critical flags on an
13279  * up interface.
13280  * ip_sioctl_flags
13281  * ipif_down
13282  * wait for ipif to be quiescent
13283  * ipif_down_tail
13284  * ip_sioctl_flags_tail
13285  *
13286  * All set ioctls that involve down/up sequence would have a skeleton similar
13287  * to the above. All the *tail functions are called after the refcounts have
13288  * dropped to the appropriate values.
13289  *
13290  * SIOC ioctls during the IPIF_CHANGING interval.
13291  *
13292  * Threads handling SIOC set ioctls serialize on the squeue, but this
13293  * is not done for SIOC get ioctls. Since a set ioctl can cause several
13294  * steps of internal changes to the state, some of which are visible in
13295  * ipif_flags (such as IFF_UP being cleared and later set), and we want
13296  * the set ioctl to be atomic related to the get ioctls, the SIOC get code
13297  * will wait and restart ioctls if IPIF_CHANGING is set. The mblk is then
13298  * enqueued in the ipsq and the operation is restarted by ipsq_exit() when
13299  * the current exclusive operation completes. The IPIF_CHANGING check
13300  * and enqueue is atomic using the ill_lock and ipsq_lock. The
13301  * lookup is done holding the ill_lock. Hence the ill/ipif state flags can't
13302  * change while the ill_lock is held. Before dropping the ill_lock we acquire
13303  * the ipsq_lock and call ipsq_enq. This ensures that ipsq_exit can't finish
13304  * until we release the ipsq_lock, even though the ill/ipif state flags
13305  * can change after we drop the ill_lock.
13306  */
13307 int
ipif_down(ipif_t * ipif,queue_t * q,mblk_t * mp)13308 ipif_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
13309 {
13310 	ill_t		*ill = ipif->ipif_ill;
13311 	conn_t		*connp;
13312 	boolean_t	success;
13313 	boolean_t	ipif_was_up = B_FALSE;
13314 	ip_stack_t	*ipst = ill->ill_ipst;
13315 
13316 	ASSERT(IAM_WRITER_IPIF(ipif));
13317 
13318 	ip1dbg(("ipif_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
13319 
13320 	DTRACE_PROBE3(ipif__downup, char *, "ipif_down",
13321 	    ill_t *, ill, ipif_t *, ipif);
13322 
13323 	if (ipif->ipif_flags & IPIF_UP) {
13324 		mutex_enter(&ill->ill_lock);
13325 		ipif->ipif_flags &= ~IPIF_UP;
13326 		ASSERT(ill->ill_ipif_up_count > 0);
13327 		--ill->ill_ipif_up_count;
13328 		mutex_exit(&ill->ill_lock);
13329 		ipif_was_up = B_TRUE;
13330 		/* Update status in SCTP's list */
13331 		sctp_update_ipif(ipif, SCTP_IPIF_DOWN);
13332 		ill_nic_event_dispatch(ipif->ipif_ill,
13333 		    MAP_IPIF_ID(ipif->ipif_id), NE_LIF_DOWN, NULL, 0);
13334 	}
13335 
13336 	/*
13337 	 * Removal of the last ipif from an ill may result in a DL_UNBIND
13338 	 * being sent to the driver, and we must not send any data packets to
13339 	 * the driver after the DL_UNBIND_REQ. To ensure this, all the
13340 	 * ire and nce entries used in the data path will be cleaned
13341 	 * up, and we also set  the ILL_DOWN_IN_PROGRESS bit to make
13342 	 * sure on new entries will be added until the ill is bound
13343 	 * again. The ILL_DOWN_IN_PROGRESS bit is turned off upon
13344 	 * receipt of a DL_BIND_ACK.
13345 	 */
13346 	if (ill->ill_wq != NULL && !ill->ill_logical_down &&
13347 	    ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
13348 	    ill->ill_dl_up) {
13349 		ill->ill_state_flags |= ILL_DOWN_IN_PROGRESS;
13350 	}
13351 
13352 	/*
13353 	 * Blow away memberships we established in ipif_multicast_up().
13354 	 */
13355 	ipif_multicast_down(ipif);
13356 
13357 	/*
13358 	 * Remove from the mapping for __sin6_src_id. We insert only
13359 	 * when the address is not INADDR_ANY. As IPv4 addresses are
13360 	 * stored as mapped addresses, we need to check for mapped
13361 	 * INADDR_ANY also.
13362 	 */
13363 	if (ipif_was_up && !IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
13364 	    !IN6_IS_ADDR_V4MAPPED_ANY(&ipif->ipif_v6lcl_addr) &&
13365 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
13366 		int err;
13367 
13368 		err = ip_srcid_remove(&ipif->ipif_v6lcl_addr,
13369 		    ipif->ipif_zoneid, ipst);
13370 		if (err != 0) {
13371 			ip0dbg(("ipif_down: srcid_remove %d\n", err));
13372 		}
13373 	}
13374 
13375 	if (ipif_was_up) {
13376 		/* only delete if we'd added ire's before */
13377 		if (ipif->ipif_isv6)
13378 			ipif_delete_ires_v6(ipif);
13379 		else
13380 			ipif_delete_ires_v4(ipif);
13381 	}
13382 
13383 	if (ipif_was_up && ill->ill_ipif_up_count == 0) {
13384 		/*
13385 		 * Since the interface is now down, it may have just become
13386 		 * inactive.  Note that this needs to be done even for a
13387 		 * lll_logical_down(), or ARP entries will not get correctly
13388 		 * restored when the interface comes back up.
13389 		 */
13390 		if (IS_UNDER_IPMP(ill))
13391 			ipmp_ill_refresh_active(ill);
13392 	}
13393 
13394 	/*
13395 	 * neighbor-discovery or arp entries for this interface. The ipif
13396 	 * has to be quiesced, so we walk all the nce's and delete those
13397 	 * that point at the ipif->ipif_ill. At the same time, we also
13398 	 * update IPMP so that ipifs for data addresses are unbound. We dont
13399 	 * call ipif_arp_down to DL_UNBIND the arp stream itself here, but defer
13400 	 * that for ipif_down_tail()
13401 	 */
13402 	ipif_nce_down(ipif);
13403 
13404 	/*
13405 	 * If this is the last ipif on the ill, we also need to remove
13406 	 * any IREs with ire_ill set. Otherwise ipif_is_quiescent() will
13407 	 * never succeed.
13408 	 */
13409 	if (ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0)
13410 		ire_walk_ill(0, 0, ill_downi, ill, ill);
13411 
13412 	/*
13413 	 * Walk all CONNs that can have a reference on an ire for this
13414 	 * ipif (we actually walk all that now have stale references).
13415 	 */
13416 	ipcl_walk(conn_ixa_cleanup, (void *)B_TRUE, ipst);
13417 
13418 	/*
13419 	 * If mp is NULL the caller will wait for the appropriate refcnt.
13420 	 * Eg. ip_sioctl_removeif -> ipif_free  -> ipif_down
13421 	 * and ill_delete -> ipif_free -> ipif_down
13422 	 */
13423 	if (mp == NULL) {
13424 		ASSERT(q == NULL);
13425 		return (0);
13426 	}
13427 
13428 	if (CONN_Q(q)) {
13429 		connp = Q_TO_CONN(q);
13430 		mutex_enter(&connp->conn_lock);
13431 	} else {
13432 		connp = NULL;
13433 	}
13434 	mutex_enter(&ill->ill_lock);
13435 	/*
13436 	 * Are there any ire's pointing to this ipif that are still active ?
13437 	 * If this is the last ipif going down, are there any ire's pointing
13438 	 * to this ill that are still active ?
13439 	 */
13440 	if (ipif_is_quiescent(ipif)) {
13441 		mutex_exit(&ill->ill_lock);
13442 		if (connp != NULL)
13443 			mutex_exit(&connp->conn_lock);
13444 		return (0);
13445 	}
13446 
13447 	ip1dbg(("ipif_down: need to wait, adding pending mp %s ill %p",
13448 	    ill->ill_name, (void *)ill));
13449 	/*
13450 	 * Enqueue the mp atomically in ipsq_pending_mp. When the refcount
13451 	 * drops down, the operation will be restarted by ipif_ill_refrele_tail
13452 	 * which in turn is called by the last refrele on the ipif/ill/ire.
13453 	 */
13454 	success = ipsq_pending_mp_add(connp, ipif, q, mp, IPIF_DOWN);
13455 	if (!success) {
13456 		/* The conn is closing. So just return */
13457 		ASSERT(connp != NULL);
13458 		mutex_exit(&ill->ill_lock);
13459 		mutex_exit(&connp->conn_lock);
13460 		return (EINTR);
13461 	}
13462 
13463 	mutex_exit(&ill->ill_lock);
13464 	if (connp != NULL)
13465 		mutex_exit(&connp->conn_lock);
13466 	return (EINPROGRESS);
13467 }
13468 
13469 int
ipif_down_tail(ipif_t * ipif)13470 ipif_down_tail(ipif_t *ipif)
13471 {
13472 	ill_t	*ill = ipif->ipif_ill;
13473 	int	err = 0;
13474 
13475 	DTRACE_PROBE3(ipif__downup, char *, "ipif_down_tail",
13476 	    ill_t *, ill, ipif_t *, ipif);
13477 
13478 	/*
13479 	 * Skip any loopback interface (null wq).
13480 	 * If this is the last logical interface on the ill
13481 	 * have ill_dl_down tell the driver we are gone (unbind)
13482 	 * Note that lun 0 can ipif_down even though
13483 	 * there are other logical units that are up.
13484 	 * This occurs e.g. when we change a "significant" IFF_ flag.
13485 	 */
13486 	if (ill->ill_wq != NULL && !ill->ill_logical_down &&
13487 	    ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
13488 	    ill->ill_dl_up) {
13489 		ill_dl_down(ill);
13490 	}
13491 	if (!ipif->ipif_isv6)
13492 		err = ipif_arp_down(ipif);
13493 
13494 	ill->ill_logical_down = 0;
13495 
13496 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
13497 	ip_rts_newaddrmsg(RTM_DELETE, 0, ipif, RTSQ_DEFAULT);
13498 	return (err);
13499 }
13500 
13501 /*
13502  * Bring interface logically down without bringing the physical interface
13503  * down e.g. when the netmask is changed. This avoids long lasting link
13504  * negotiations between an ethernet interface and a certain switches.
13505  */
13506 static int
ipif_logical_down(ipif_t * ipif,queue_t * q,mblk_t * mp)13507 ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
13508 {
13509 	DTRACE_PROBE3(ipif__downup, char *, "ipif_logical_down",
13510 	    ill_t *, ipif->ipif_ill, ipif_t *, ipif);
13511 
13512 	/*
13513 	 * The ill_logical_down flag is a transient flag. It is set here
13514 	 * and is cleared once the down has completed in ipif_down_tail.
13515 	 * This flag does not indicate whether the ill stream is in the
13516 	 * DL_BOUND state with the driver. Instead this flag is used by
13517 	 * ipif_down_tail to determine whether to DL_UNBIND the stream with
13518 	 * the driver. The state of the ill stream i.e. whether it is
13519 	 * DL_BOUND with the driver or not is indicated by the ill_dl_up flag.
13520 	 */
13521 	ipif->ipif_ill->ill_logical_down = 1;
13522 	return (ipif_down(ipif, q, mp));
13523 }
13524 
13525 /*
13526  * Initiate deallocate of an IPIF. Always called as writer. Called by
13527  * ill_delete or ip_sioctl_removeif.
13528  */
13529 static void
ipif_free(ipif_t * ipif)13530 ipif_free(ipif_t *ipif)
13531 {
13532 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
13533 
13534 	ASSERT(IAM_WRITER_IPIF(ipif));
13535 
13536 	if (ipif->ipif_recovery_id != 0)
13537 		(void) untimeout(ipif->ipif_recovery_id);
13538 	ipif->ipif_recovery_id = 0;
13539 
13540 	/*
13541 	 * Take down the interface. We can be called either from ill_delete
13542 	 * or from ip_sioctl_removeif.
13543 	 */
13544 	(void) ipif_down(ipif, NULL, NULL);
13545 
13546 	/*
13547 	 * Now that the interface is down, there's no chance it can still
13548 	 * become a duplicate.  Cancel any timer that may have been set while
13549 	 * tearing down.
13550 	 */
13551 	if (ipif->ipif_recovery_id != 0)
13552 		(void) untimeout(ipif->ipif_recovery_id);
13553 	ipif->ipif_recovery_id = 0;
13554 
13555 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
13556 	/* Remove pointers to this ill in the multicast routing tables */
13557 	reset_mrt_vif_ipif(ipif);
13558 	/* If necessary, clear the cached source ipif rotor. */
13559 	if (ipif->ipif_ill->ill_src_ipif == ipif)
13560 		ipif->ipif_ill->ill_src_ipif = NULL;
13561 	rw_exit(&ipst->ips_ill_g_lock);
13562 }
13563 
13564 static void
ipif_free_tail(ipif_t * ipif)13565 ipif_free_tail(ipif_t *ipif)
13566 {
13567 	ip_stack_t *ipst = ipif->ipif_ill->ill_ipst;
13568 
13569 	/*
13570 	 * Need to hold both ill_g_lock and ill_lock while
13571 	 * inserting or removing an ipif from the linked list
13572 	 * of ipifs hanging off the ill.
13573 	 */
13574 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
13575 
13576 #ifdef DEBUG
13577 	ipif_trace_cleanup(ipif);
13578 #endif
13579 
13580 	/* Ask SCTP to take it out of it list */
13581 	sctp_update_ipif(ipif, SCTP_IPIF_REMOVE);
13582 	ip_rts_newaddrmsg(RTM_FREEADDR, 0, ipif, RTSQ_DEFAULT);
13583 
13584 	/* Get it out of the ILL interface list. */
13585 	ipif_remove(ipif);
13586 	rw_exit(&ipst->ips_ill_g_lock);
13587 
13588 	ASSERT(!(ipif->ipif_flags & (IPIF_UP | IPIF_DUPLICATE)));
13589 	ASSERT(ipif->ipif_recovery_id == 0);
13590 	ASSERT(ipif->ipif_ire_local == NULL);
13591 	ASSERT(ipif->ipif_ire_if == NULL);
13592 
13593 	/* Free the memory. */
13594 	mi_free(ipif);
13595 }
13596 
13597 /*
13598  * Sets `buf' to an ipif name of the form "ill_name:id", or "ill_name" if "id"
13599  * is zero.
13600  */
13601 void
ipif_get_name(const ipif_t * ipif,char * buf,int len)13602 ipif_get_name(const ipif_t *ipif, char *buf, int len)
13603 {
13604 	char	lbuf[LIFNAMSIZ];
13605 	char	*name;
13606 	size_t	name_len;
13607 
13608 	buf[0] = '\0';
13609 	name = ipif->ipif_ill->ill_name;
13610 	name_len = ipif->ipif_ill->ill_name_length;
13611 	if (ipif->ipif_id != 0) {
13612 		(void) sprintf(lbuf, "%s%c%d", name, IPIF_SEPARATOR_CHAR,
13613 		    ipif->ipif_id);
13614 		name = lbuf;
13615 		name_len = mi_strlen(name) + 1;
13616 	}
13617 	len -= 1;
13618 	buf[len] = '\0';
13619 	len = MIN(len, name_len);
13620 	bcopy(name, buf, len);
13621 }
13622 
13623 /*
13624  * Sets `buf' to an ill name.
13625  */
13626 void
ill_get_name(const ill_t * ill,char * buf,int len)13627 ill_get_name(const ill_t *ill, char *buf, int len)
13628 {
13629 	char	*name;
13630 	size_t	name_len;
13631 
13632 	name = ill->ill_name;
13633 	name_len = ill->ill_name_length;
13634 	len -= 1;
13635 	buf[len] = '\0';
13636 	len = MIN(len, name_len);
13637 	bcopy(name, buf, len);
13638 }
13639 
13640 /*
13641  * Find an IPIF based on the name passed in.  Names can be of the form <phys>
13642  * (e.g., le0) or <phys>:<#> (e.g., le0:1).  When there is no colon, the
13643  * implied unit id is zero. <phys> must correspond to the name of an ILL.
13644  * (May be called as writer.)
13645  */
13646 static ipif_t *
ipif_lookup_on_name(char * name,size_t namelen,boolean_t do_alloc,boolean_t * exists,boolean_t isv6,zoneid_t zoneid,ip_stack_t * ipst)13647 ipif_lookup_on_name(char *name, size_t namelen, boolean_t do_alloc,
13648     boolean_t *exists, boolean_t isv6, zoneid_t zoneid, ip_stack_t *ipst)
13649 {
13650 	char	*cp;
13651 	char	*endp;
13652 	long	id;
13653 	ill_t	*ill;
13654 	ipif_t	*ipif;
13655 	uint_t	ire_type;
13656 	boolean_t did_alloc = B_FALSE;
13657 	char	last;
13658 
13659 	/*
13660 	 * If the caller wants to us to create the ipif, make sure we have a
13661 	 * valid zoneid
13662 	 */
13663 	ASSERT(!do_alloc || zoneid != ALL_ZONES);
13664 
13665 	if (namelen == 0) {
13666 		return (NULL);
13667 	}
13668 
13669 	*exists = B_FALSE;
13670 	/* Look for a colon in the name. */
13671 	endp = &name[namelen];
13672 	for (cp = endp; --cp > name; ) {
13673 		if (*cp == IPIF_SEPARATOR_CHAR)
13674 			break;
13675 	}
13676 
13677 	if (*cp == IPIF_SEPARATOR_CHAR) {
13678 		/*
13679 		 * Reject any non-decimal aliases for logical
13680 		 * interfaces. Aliases with leading zeroes
13681 		 * are also rejected as they introduce ambiguity
13682 		 * in the naming of the interfaces.
13683 		 * In order to confirm with existing semantics,
13684 		 * and to not break any programs/script relying
13685 		 * on that behaviour, if<0>:0 is considered to be
13686 		 * a valid interface.
13687 		 *
13688 		 * If alias has two or more digits and the first
13689 		 * is zero, fail.
13690 		 */
13691 		if (&cp[2] < endp && cp[1] == '0') {
13692 			return (NULL);
13693 		}
13694 	}
13695 
13696 	if (cp <= name) {
13697 		cp = endp;
13698 	}
13699 	last = *cp;
13700 	*cp = '\0';
13701 
13702 	/*
13703 	 * Look up the ILL, based on the portion of the name
13704 	 * before the slash. ill_lookup_on_name returns a held ill.
13705 	 * Temporary to check whether ill exists already. If so
13706 	 * ill_lookup_on_name will clear it.
13707 	 */
13708 	ill = ill_lookup_on_name(name, do_alloc, isv6,
13709 	    &did_alloc, ipst);
13710 	*cp = last;
13711 	if (ill == NULL)
13712 		return (NULL);
13713 
13714 	/* Establish the unit number in the name. */
13715 	id = 0;
13716 	if (cp < endp && *endp == '\0') {
13717 		/* If there was a colon, the unit number follows. */
13718 		cp++;
13719 		if (ddi_strtol(cp, NULL, 0, &id) != 0) {
13720 			ill_refrele(ill);
13721 			return (NULL);
13722 		}
13723 	}
13724 
13725 	mutex_enter(&ill->ill_lock);
13726 	/* Now see if there is an IPIF with this unit number. */
13727 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13728 		if (ipif->ipif_id == id) {
13729 			if (zoneid != ALL_ZONES &&
13730 			    zoneid != ipif->ipif_zoneid &&
13731 			    ipif->ipif_zoneid != ALL_ZONES) {
13732 				mutex_exit(&ill->ill_lock);
13733 				ill_refrele(ill);
13734 				return (NULL);
13735 			}
13736 			if (IPIF_CAN_LOOKUP(ipif)) {
13737 				ipif_refhold_locked(ipif);
13738 				mutex_exit(&ill->ill_lock);
13739 				if (!did_alloc)
13740 					*exists = B_TRUE;
13741 				/*
13742 				 * Drop locks before calling ill_refrele
13743 				 * since it can potentially call into
13744 				 * ipif_ill_refrele_tail which can end up
13745 				 * in trying to acquire any lock.
13746 				 */
13747 				ill_refrele(ill);
13748 				return (ipif);
13749 			}
13750 		}
13751 	}
13752 
13753 	if (!do_alloc) {
13754 		mutex_exit(&ill->ill_lock);
13755 		ill_refrele(ill);
13756 		return (NULL);
13757 	}
13758 
13759 	/*
13760 	 * If none found, atomically allocate and return a new one.
13761 	 * Historically, we used IRE_LOOPBACK only for lun 0, and IRE_LOCAL
13762 	 * to support "receive only" use of lo0:1 etc. as is still done
13763 	 * below as an initial guess.
13764 	 * However, this is now likely to be overriden later in ipif_up_done()
13765 	 * when we know for sure what address has been configured on the
13766 	 * interface, since we might have more than one loopback interface
13767 	 * with a loopback address, e.g. in the case of zones, and all the
13768 	 * interfaces with loopback addresses need to be marked IRE_LOOPBACK.
13769 	 */
13770 	if (ill->ill_net_type == IRE_LOOPBACK && id == 0)
13771 		ire_type = IRE_LOOPBACK;
13772 	else
13773 		ire_type = IRE_LOCAL;
13774 	ipif = ipif_allocate(ill, id, ire_type, B_TRUE, B_TRUE, NULL);
13775 	if (ipif != NULL)
13776 		ipif_refhold_locked(ipif);
13777 	mutex_exit(&ill->ill_lock);
13778 	ill_refrele(ill);
13779 	return (ipif);
13780 }
13781 
13782 /*
13783  * Variant of the above that queues the request on the ipsq when
13784  * IPIF_CHANGING is set.
13785  */
13786 static ipif_t *
ipif_lookup_on_name_async(char * name,size_t namelen,boolean_t isv6,zoneid_t zoneid,queue_t * q,mblk_t * mp,ipsq_func_t func,int * error,ip_stack_t * ipst)13787 ipif_lookup_on_name_async(char *name, size_t namelen, boolean_t isv6,
13788     zoneid_t zoneid, queue_t *q, mblk_t *mp, ipsq_func_t func, int *error,
13789     ip_stack_t *ipst)
13790 {
13791 	char	*cp;
13792 	char	*endp;
13793 	long	id;
13794 	ill_t	*ill;
13795 	ipif_t	*ipif;
13796 	boolean_t did_alloc = B_FALSE;
13797 	ipsq_t	*ipsq;
13798 
13799 	if (error != NULL)
13800 		*error = 0;
13801 
13802 	if (namelen == 0) {
13803 		if (error != NULL)
13804 			*error = ENXIO;
13805 		return (NULL);
13806 	}
13807 
13808 	/* Look for a colon in the name. */
13809 	endp = &name[namelen];
13810 	for (cp = endp; --cp > name; ) {
13811 		if (*cp == IPIF_SEPARATOR_CHAR)
13812 			break;
13813 	}
13814 
13815 	if (*cp == IPIF_SEPARATOR_CHAR) {
13816 		/*
13817 		 * Reject any non-decimal aliases for logical
13818 		 * interfaces. Aliases with leading zeroes
13819 		 * are also rejected as they introduce ambiguity
13820 		 * in the naming of the interfaces.
13821 		 * In order to confirm with existing semantics,
13822 		 * and to not break any programs/script relying
13823 		 * on that behaviour, if<0>:0 is considered to be
13824 		 * a valid interface.
13825 		 *
13826 		 * If alias has two or more digits and the first
13827 		 * is zero, fail.
13828 		 */
13829 		if (&cp[2] < endp && cp[1] == '0') {
13830 			if (error != NULL)
13831 				*error = EINVAL;
13832 			return (NULL);
13833 		}
13834 	}
13835 
13836 	if (cp <= name) {
13837 		cp = endp;
13838 	} else {
13839 		*cp = '\0';
13840 	}
13841 
13842 	/*
13843 	 * Look up the ILL, based on the portion of the name
13844 	 * before the slash. ill_lookup_on_name returns a held ill.
13845 	 * Temporary to check whether ill exists already. If so
13846 	 * ill_lookup_on_name will clear it.
13847 	 */
13848 	ill = ill_lookup_on_name(name, B_FALSE, isv6, &did_alloc, ipst);
13849 	if (cp != endp)
13850 		*cp = IPIF_SEPARATOR_CHAR;
13851 	if (ill == NULL)
13852 		return (NULL);
13853 
13854 	/* Establish the unit number in the name. */
13855 	id = 0;
13856 	if (cp < endp && *endp == '\0') {
13857 		/* If there was a colon, the unit number follows. */
13858 		cp++;
13859 		if (ddi_strtol(cp, NULL, 0, &id) != 0) {
13860 			ill_refrele(ill);
13861 			if (error != NULL)
13862 				*error = ENXIO;
13863 			return (NULL);
13864 		}
13865 	}
13866 
13867 	GRAB_CONN_LOCK(q);
13868 	mutex_enter(&ill->ill_lock);
13869 	/* Now see if there is an IPIF with this unit number. */
13870 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13871 		if (ipif->ipif_id == id) {
13872 			if (zoneid != ALL_ZONES &&
13873 			    zoneid != ipif->ipif_zoneid &&
13874 			    ipif->ipif_zoneid != ALL_ZONES) {
13875 				mutex_exit(&ill->ill_lock);
13876 				RELEASE_CONN_LOCK(q);
13877 				ill_refrele(ill);
13878 				if (error != NULL)
13879 					*error = ENXIO;
13880 				return (NULL);
13881 			}
13882 
13883 			if (!(IPIF_IS_CHANGING(ipif) ||
13884 			    IPIF_IS_CONDEMNED(ipif)) ||
13885 			    IAM_WRITER_IPIF(ipif)) {
13886 				ipif_refhold_locked(ipif);
13887 				mutex_exit(&ill->ill_lock);
13888 				/*
13889 				 * Drop locks before calling ill_refrele
13890 				 * since it can potentially call into
13891 				 * ipif_ill_refrele_tail which can end up
13892 				 * in trying to acquire any lock.
13893 				 */
13894 				RELEASE_CONN_LOCK(q);
13895 				ill_refrele(ill);
13896 				return (ipif);
13897 			} else if (q != NULL && !IPIF_IS_CONDEMNED(ipif)) {
13898 				ipsq = ill->ill_phyint->phyint_ipsq;
13899 				mutex_enter(&ipsq->ipsq_lock);
13900 				mutex_enter(&ipsq->ipsq_xop->ipx_lock);
13901 				mutex_exit(&ill->ill_lock);
13902 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
13903 				mutex_exit(&ipsq->ipsq_xop->ipx_lock);
13904 				mutex_exit(&ipsq->ipsq_lock);
13905 				RELEASE_CONN_LOCK(q);
13906 				ill_refrele(ill);
13907 				if (error != NULL)
13908 					*error = EINPROGRESS;
13909 				return (NULL);
13910 			}
13911 		}
13912 	}
13913 	RELEASE_CONN_LOCK(q);
13914 	mutex_exit(&ill->ill_lock);
13915 	ill_refrele(ill);
13916 	if (error != NULL)
13917 		*error = ENXIO;
13918 	return (NULL);
13919 }
13920 
13921 /*
13922  * This routine is called whenever a new address comes up on an ipif.  If
13923  * we are configured to respond to address mask requests, then we are supposed
13924  * to broadcast an address mask reply at this time.  This routine is also
13925  * called if we are already up, but a netmask change is made.  This is legal
13926  * but might not make the system manager very popular.	(May be called
13927  * as writer.)
13928  */
13929 void
ipif_mask_reply(ipif_t * ipif)13930 ipif_mask_reply(ipif_t *ipif)
13931 {
13932 	icmph_t	*icmph;
13933 	ipha_t	*ipha;
13934 	mblk_t	*mp;
13935 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
13936 	ip_xmit_attr_t ixas;
13937 
13938 #define	REPLY_LEN	(sizeof (icmp_ipha) + sizeof (icmph_t) + IP_ADDR_LEN)
13939 
13940 	if (!ipst->ips_ip_respond_to_address_mask_broadcast)
13941 		return;
13942 
13943 	/* ICMP mask reply is IPv4 only */
13944 	ASSERT(!ipif->ipif_isv6);
13945 	/* ICMP mask reply is not for a loopback interface */
13946 	ASSERT(ipif->ipif_ill->ill_wq != NULL);
13947 
13948 	if (ipif->ipif_lcl_addr == INADDR_ANY)
13949 		return;
13950 
13951 	mp = allocb(REPLY_LEN, BPRI_HI);
13952 	if (mp == NULL)
13953 		return;
13954 	mp->b_wptr = mp->b_rptr + REPLY_LEN;
13955 
13956 	ipha = (ipha_t *)mp->b_rptr;
13957 	bzero(ipha, REPLY_LEN);
13958 	*ipha = icmp_ipha;
13959 	ipha->ipha_ttl = ipst->ips_ip_broadcast_ttl;
13960 	ipha->ipha_src = ipif->ipif_lcl_addr;
13961 	ipha->ipha_dst = ipif->ipif_brd_addr;
13962 	ipha->ipha_length = htons(REPLY_LEN);
13963 	ipha->ipha_ident = 0;
13964 
13965 	icmph = (icmph_t *)&ipha[1];
13966 	icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY;
13967 	bcopy(&ipif->ipif_net_mask, &icmph[1], IP_ADDR_LEN);
13968 	icmph->icmph_checksum = IP_CSUM(mp, sizeof (ipha_t), 0);
13969 
13970 	bzero(&ixas, sizeof (ixas));
13971 	ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
13972 	ixas.ixa_zoneid = ALL_ZONES;
13973 	ixas.ixa_ifindex = 0;
13974 	ixas.ixa_ipst = ipst;
13975 	ixas.ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
13976 	(void) ip_output_simple(mp, &ixas);
13977 	ixa_cleanup(&ixas);
13978 #undef	REPLY_LEN
13979 }
13980 
13981 /*
13982  * Join the ipif specific multicast groups.
13983  * Must be called after a mapping has been set up in the resolver.  (Always
13984  * called as writer.)
13985  */
13986 void
ipif_multicast_up(ipif_t * ipif)13987 ipif_multicast_up(ipif_t *ipif)
13988 {
13989 	int err;
13990 	ill_t *ill;
13991 	ilm_t *ilm;
13992 
13993 	ASSERT(IAM_WRITER_IPIF(ipif));
13994 
13995 	ill = ipif->ipif_ill;
13996 
13997 	ip1dbg(("ipif_multicast_up\n"));
13998 	if (!(ill->ill_flags & ILLF_MULTICAST) ||
13999 	    ipif->ipif_allhosts_ilm != NULL)
14000 		return;
14001 
14002 	if (ipif->ipif_isv6) {
14003 		in6_addr_t v6allmc = ipv6_all_hosts_mcast;
14004 		in6_addr_t v6solmc = ipv6_solicited_node_mcast;
14005 
14006 		v6solmc.s6_addr32[3] |= ipif->ipif_v6lcl_addr.s6_addr32[3];
14007 
14008 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
14009 			return;
14010 
14011 		ip1dbg(("ipif_multicast_up - addmulti\n"));
14012 
14013 		/*
14014 		 * Join the all hosts multicast address.  We skip this for
14015 		 * underlying IPMP interfaces since they should be invisible.
14016 		 */
14017 		if (!IS_UNDER_IPMP(ill)) {
14018 			ilm = ip_addmulti(&v6allmc, ill, ipif->ipif_zoneid,
14019 			    &err);
14020 			if (ilm == NULL) {
14021 				ASSERT(err != 0);
14022 				ip0dbg(("ipif_multicast_up: "
14023 				    "all_hosts_mcast failed %d\n", err));
14024 				return;
14025 			}
14026 			ipif->ipif_allhosts_ilm = ilm;
14027 		}
14028 
14029 		/*
14030 		 * Enable multicast for the solicited node multicast address.
14031 		 * If IPMP we need to put the membership on the upper ill.
14032 		 */
14033 		if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
14034 			ill_t *mcast_ill = NULL;
14035 			boolean_t need_refrele;
14036 
14037 			if (IS_UNDER_IPMP(ill) &&
14038 			    (mcast_ill = ipmp_ill_hold_ipmp_ill(ill)) != NULL) {
14039 				need_refrele = B_TRUE;
14040 			} else {
14041 				mcast_ill = ill;
14042 				need_refrele = B_FALSE;
14043 			}
14044 
14045 			ilm = ip_addmulti(&v6solmc, mcast_ill,
14046 			    ipif->ipif_zoneid, &err);
14047 			if (need_refrele)
14048 				ill_refrele(mcast_ill);
14049 
14050 			if (ilm == NULL) {
14051 				ASSERT(err != 0);
14052 				ip0dbg(("ipif_multicast_up: solicited MC"
14053 				    " failed %d\n", err));
14054 				if ((ilm = ipif->ipif_allhosts_ilm) != NULL) {
14055 					ipif->ipif_allhosts_ilm = NULL;
14056 					(void) ip_delmulti(ilm);
14057 				}
14058 				return;
14059 			}
14060 			ipif->ipif_solmulti_ilm = ilm;
14061 		}
14062 	} else {
14063 		in6_addr_t v6group;
14064 
14065 		if (ipif->ipif_lcl_addr == INADDR_ANY || IS_UNDER_IPMP(ill))
14066 			return;
14067 
14068 		/* Join the all hosts multicast address */
14069 		ip1dbg(("ipif_multicast_up - addmulti\n"));
14070 		IN6_IPADDR_TO_V4MAPPED(htonl(INADDR_ALLHOSTS_GROUP), &v6group);
14071 
14072 		ilm = ip_addmulti(&v6group, ill, ipif->ipif_zoneid, &err);
14073 		if (ilm == NULL) {
14074 			ASSERT(err != 0);
14075 			ip0dbg(("ipif_multicast_up: failed %d\n", err));
14076 			return;
14077 		}
14078 		ipif->ipif_allhosts_ilm = ilm;
14079 	}
14080 }
14081 
14082 /*
14083  * Blow away any multicast groups that we joined in ipif_multicast_up().
14084  * (ilms from explicit memberships are handled in conn_update_ill.)
14085  */
14086 void
ipif_multicast_down(ipif_t * ipif)14087 ipif_multicast_down(ipif_t *ipif)
14088 {
14089 	ASSERT(IAM_WRITER_IPIF(ipif));
14090 
14091 	ip1dbg(("ipif_multicast_down\n"));
14092 
14093 	if (ipif->ipif_allhosts_ilm != NULL) {
14094 		(void) ip_delmulti(ipif->ipif_allhosts_ilm);
14095 		ipif->ipif_allhosts_ilm = NULL;
14096 	}
14097 	if (ipif->ipif_solmulti_ilm != NULL) {
14098 		(void) ip_delmulti(ipif->ipif_solmulti_ilm);
14099 		ipif->ipif_solmulti_ilm = NULL;
14100 	}
14101 }
14102 
14103 /*
14104  * Used when an interface comes up to recreate any extra routes on this
14105  * interface.
14106  */
14107 int
ill_recover_saved_ire(ill_t * ill)14108 ill_recover_saved_ire(ill_t *ill)
14109 {
14110 	mblk_t		*mp;
14111 	ip_stack_t	*ipst = ill->ill_ipst;
14112 
14113 	ip1dbg(("ill_recover_saved_ire(%s)", ill->ill_name));
14114 
14115 	mutex_enter(&ill->ill_saved_ire_lock);
14116 	for (mp = ill->ill_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
14117 		ire_t		*ire, *nire;
14118 		ifrt_t		*ifrt;
14119 
14120 		ifrt = (ifrt_t *)mp->b_rptr;
14121 		/*
14122 		 * Create a copy of the IRE with the saved address and netmask.
14123 		 */
14124 		if (ill->ill_isv6) {
14125 			ire = ire_create_v6(
14126 			    &ifrt->ifrt_v6addr,
14127 			    &ifrt->ifrt_v6mask,
14128 			    &ifrt->ifrt_v6gateway_addr,
14129 			    ifrt->ifrt_type,
14130 			    ill,
14131 			    ifrt->ifrt_zoneid,
14132 			    ifrt->ifrt_flags,
14133 			    NULL,
14134 			    ipst);
14135 		} else {
14136 			ire = ire_create(
14137 			    (uint8_t *)&ifrt->ifrt_addr,
14138 			    (uint8_t *)&ifrt->ifrt_mask,
14139 			    (uint8_t *)&ifrt->ifrt_gateway_addr,
14140 			    ifrt->ifrt_type,
14141 			    ill,
14142 			    ifrt->ifrt_zoneid,
14143 			    ifrt->ifrt_flags,
14144 			    NULL,
14145 			    ipst);
14146 		}
14147 		if (ire == NULL) {
14148 			mutex_exit(&ill->ill_saved_ire_lock);
14149 			return (ENOMEM);
14150 		}
14151 
14152 		if (ifrt->ifrt_flags & RTF_SETSRC) {
14153 			if (ill->ill_isv6) {
14154 				ire->ire_setsrc_addr_v6 =
14155 				    ifrt->ifrt_v6setsrc_addr;
14156 			} else {
14157 				ire->ire_setsrc_addr = ifrt->ifrt_setsrc_addr;
14158 			}
14159 		}
14160 
14161 		/*
14162 		 * Some software (for example, GateD and Sun Cluster) attempts
14163 		 * to create (what amount to) IRE_PREFIX routes with the
14164 		 * loopback address as the gateway.  This is primarily done to
14165 		 * set up prefixes with the RTF_REJECT flag set (for example,
14166 		 * when generating aggregate routes.)
14167 		 *
14168 		 * If the IRE type (as defined by ill->ill_net_type) is
14169 		 * IRE_LOOPBACK, then we map the request into a
14170 		 * IRE_IF_NORESOLVER.
14171 		 */
14172 		if (ill->ill_net_type == IRE_LOOPBACK)
14173 			ire->ire_type = IRE_IF_NORESOLVER;
14174 
14175 		/*
14176 		 * ire held by ire_add, will be refreled' towards the
14177 		 * the end of ipif_up_done
14178 		 */
14179 		nire = ire_add(ire);
14180 		/*
14181 		 * Check if it was a duplicate entry. This handles
14182 		 * the case of two racing route adds for the same route
14183 		 */
14184 		if (nire == NULL) {
14185 			ip1dbg(("ill_recover_saved_ire: FAILED\n"));
14186 		} else if (nire != ire) {
14187 			ip1dbg(("ill_recover_saved_ire: duplicate ire %p\n",
14188 			    (void *)nire));
14189 			ire_delete(nire);
14190 		} else {
14191 			ip1dbg(("ill_recover_saved_ire: added ire %p\n",
14192 			    (void *)nire));
14193 		}
14194 		if (nire != NULL)
14195 			ire_refrele(nire);
14196 	}
14197 	mutex_exit(&ill->ill_saved_ire_lock);
14198 	return (0);
14199 }
14200 
14201 /*
14202  * Used to set the netmask and broadcast address to default values when the
14203  * interface is brought up.  (Always called as writer.)
14204  */
14205 static void
ipif_set_default(ipif_t * ipif)14206 ipif_set_default(ipif_t *ipif)
14207 {
14208 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
14209 
14210 	if (!ipif->ipif_isv6) {
14211 		/*
14212 		 * Interface holds an IPv4 address. Default
14213 		 * mask is the natural netmask.
14214 		 */
14215 		if (!ipif->ipif_net_mask) {
14216 			ipaddr_t	v4mask;
14217 
14218 			v4mask = ip_net_mask(ipif->ipif_lcl_addr);
14219 			V4MASK_TO_V6(v4mask, ipif->ipif_v6net_mask);
14220 		}
14221 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
14222 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
14223 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
14224 		} else {
14225 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
14226 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
14227 		}
14228 		/*
14229 		 * NOTE: SunOS 4.X does this even if the broadcast address
14230 		 * has been already set thus we do the same here.
14231 		 */
14232 		if (ipif->ipif_flags & IPIF_BROADCAST) {
14233 			ipaddr_t	v4addr;
14234 
14235 			v4addr = ipif->ipif_subnet | ~ipif->ipif_net_mask;
14236 			IN6_IPADDR_TO_V4MAPPED(v4addr, &ipif->ipif_v6brd_addr);
14237 		}
14238 	} else {
14239 		/*
14240 		 * Interface holds an IPv6-only address.  Default
14241 		 * mask is all-ones.
14242 		 */
14243 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
14244 			ipif->ipif_v6net_mask = ipv6_all_ones;
14245 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
14246 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
14247 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
14248 		} else {
14249 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
14250 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
14251 		}
14252 	}
14253 }
14254 
14255 /*
14256  * Return 0 if this address can be used as local address without causing
14257  * duplicate address problems. Otherwise, return EADDRNOTAVAIL if the address
14258  * is already up on a different ill, and EADDRINUSE if it's up on the same ill.
14259  * Note that the same IPv6 link-local address is allowed as long as the ills
14260  * are not on the same link.
14261  */
14262 int
ip_addr_availability_check(ipif_t * new_ipif)14263 ip_addr_availability_check(ipif_t *new_ipif)
14264 {
14265 	in6_addr_t our_v6addr;
14266 	ill_t *ill;
14267 	ipif_t *ipif;
14268 	ill_walk_context_t ctx;
14269 	ip_stack_t	*ipst = new_ipif->ipif_ill->ill_ipst;
14270 
14271 	ASSERT(IAM_WRITER_IPIF(new_ipif));
14272 	ASSERT(MUTEX_HELD(&ipst->ips_ip_addr_avail_lock));
14273 	ASSERT(RW_READ_HELD(&ipst->ips_ill_g_lock));
14274 
14275 	new_ipif->ipif_flags &= ~IPIF_UNNUMBERED;
14276 	if (IN6_IS_ADDR_UNSPECIFIED(&new_ipif->ipif_v6lcl_addr) ||
14277 	    IN6_IS_ADDR_V4MAPPED_ANY(&new_ipif->ipif_v6lcl_addr))
14278 		return (0);
14279 
14280 	our_v6addr = new_ipif->ipif_v6lcl_addr;
14281 
14282 	if (new_ipif->ipif_isv6)
14283 		ill = ILL_START_WALK_V6(&ctx, ipst);
14284 	else
14285 		ill = ILL_START_WALK_V4(&ctx, ipst);
14286 
14287 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
14288 		for (ipif = ill->ill_ipif; ipif != NULL;
14289 		    ipif = ipif->ipif_next) {
14290 			if ((ipif == new_ipif) ||
14291 			    !(ipif->ipif_flags & IPIF_UP) ||
14292 			    (ipif->ipif_flags & IPIF_UNNUMBERED) ||
14293 			    !IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
14294 			    &our_v6addr))
14295 				continue;
14296 
14297 			if (new_ipif->ipif_flags & IPIF_POINTOPOINT)
14298 				new_ipif->ipif_flags |= IPIF_UNNUMBERED;
14299 			else if (ipif->ipif_flags & IPIF_POINTOPOINT)
14300 				ipif->ipif_flags |= IPIF_UNNUMBERED;
14301 			else if ((IN6_IS_ADDR_LINKLOCAL(&our_v6addr) ||
14302 			    IN6_IS_ADDR_SITELOCAL(&our_v6addr)) &&
14303 			    !IS_ON_SAME_LAN(ill, new_ipif->ipif_ill))
14304 				continue;
14305 			else if (new_ipif->ipif_zoneid != ipif->ipif_zoneid &&
14306 			    ipif->ipif_zoneid != ALL_ZONES && IS_LOOPBACK(ill))
14307 				continue;
14308 			else if (new_ipif->ipif_ill == ill)
14309 				return (EADDRINUSE);
14310 			else
14311 				return (EADDRNOTAVAIL);
14312 		}
14313 	}
14314 
14315 	return (0);
14316 }
14317 
14318 /*
14319  * Bring up an ipif: bring up arp/ndp, bring up the DLPI stream, and add
14320  * IREs for the ipif.
14321  * When the routine returns EINPROGRESS then mp has been consumed and
14322  * the ioctl will be acked from ip_rput_dlpi.
14323  */
14324 int
ipif_up(ipif_t * ipif,queue_t * q,mblk_t * mp)14325 ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp)
14326 {
14327 	ill_t		*ill = ipif->ipif_ill;
14328 	boolean_t 	isv6 = ipif->ipif_isv6;
14329 	int		err = 0;
14330 	boolean_t	success;
14331 	uint_t		ipif_orig_id;
14332 	ip_stack_t	*ipst = ill->ill_ipst;
14333 
14334 	ASSERT(IAM_WRITER_IPIF(ipif));
14335 
14336 	ip1dbg(("ipif_up(%s:%u)\n", ill->ill_name, ipif->ipif_id));
14337 	DTRACE_PROBE3(ipif__downup, char *, "ipif_up",
14338 	    ill_t *, ill, ipif_t *, ipif);
14339 
14340 	/* Shouldn't get here if it is already up. */
14341 	if (ipif->ipif_flags & IPIF_UP)
14342 		return (EALREADY);
14343 
14344 	/*
14345 	 * If this is a request to bring up a data address on an interface
14346 	 * under IPMP, then move the address to its IPMP meta-interface and
14347 	 * try to bring it up.  One complication is that the zeroth ipif for
14348 	 * an ill is special, in that every ill always has one, and that code
14349 	 * throughout IP deferences ill->ill_ipif without holding any locks.
14350 	 */
14351 	if (IS_UNDER_IPMP(ill) && ipmp_ipif_is_dataaddr(ipif) &&
14352 	    (!ipif->ipif_isv6 || !V6_IPIF_LINKLOCAL(ipif))) {
14353 		ipif_t	*stubipif = NULL, *moveipif = NULL;
14354 		ill_t	*ipmp_ill = ipmp_illgrp_ipmp_ill(ill->ill_grp);
14355 
14356 		/*
14357 		 * The ipif being brought up should be quiesced.  If it's not,
14358 		 * something has gone amiss and we need to bail out.  (If it's
14359 		 * quiesced, we know it will remain so via IPIF_CONDEMNED.)
14360 		 */
14361 		mutex_enter(&ill->ill_lock);
14362 		if (!ipif_is_quiescent(ipif)) {
14363 			mutex_exit(&ill->ill_lock);
14364 			return (EINVAL);
14365 		}
14366 		mutex_exit(&ill->ill_lock);
14367 
14368 		/*
14369 		 * If we're going to need to allocate ipifs, do it prior
14370 		 * to starting the move (and grabbing locks).
14371 		 */
14372 		if (ipif->ipif_id == 0) {
14373 			if ((moveipif = ipif_allocate(ill, 0, IRE_LOCAL, B_TRUE,
14374 			    B_FALSE, &err)) == NULL) {
14375 				return (err);
14376 			}
14377 			if ((stubipif = ipif_allocate(ill, 0, IRE_LOCAL, B_TRUE,
14378 			    B_FALSE, &err)) == NULL) {
14379 				mi_free(moveipif);
14380 				return (err);
14381 			}
14382 		}
14383 
14384 		/*
14385 		 * Grab or transfer the ipif to move.  During the move, keep
14386 		 * ill_g_lock held to prevent any ill walker threads from
14387 		 * seeing things in an inconsistent state.
14388 		 */
14389 		rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
14390 		if (ipif->ipif_id != 0) {
14391 			ipif_remove(ipif);
14392 		} else {
14393 			ipif_transfer(ipif, moveipif, stubipif);
14394 			ipif = moveipif;
14395 		}
14396 
14397 		/*
14398 		 * Place the ipif on the IPMP ill.  If the zeroth ipif on
14399 		 * the IPMP ill is a stub (0.0.0.0 down address) then we
14400 		 * replace that one.  Otherwise, pick the next available slot.
14401 		 */
14402 		ipif->ipif_ill = ipmp_ill;
14403 		ipif_orig_id = ipif->ipif_id;
14404 
14405 		if (ipmp_ipif_is_stubaddr(ipmp_ill->ill_ipif)) {
14406 			ipif_transfer(ipif, ipmp_ill->ill_ipif, NULL);
14407 			ipif = ipmp_ill->ill_ipif;
14408 		} else {
14409 			ipif->ipif_id = -1;
14410 			if ((err = ipif_insert(ipif, B_FALSE)) != 0) {
14411 				/*
14412 				 * No more available ipif_id's -- put it back
14413 				 * on the original ill and fail the operation.
14414 				 * Since we're writer on the ill, we can be
14415 				 * sure our old slot is still available.
14416 				 */
14417 				ipif->ipif_id = ipif_orig_id;
14418 				ipif->ipif_ill = ill;
14419 				if (ipif_orig_id == 0) {
14420 					ipif_transfer(ipif, ill->ill_ipif,
14421 					    NULL);
14422 				} else {
14423 					VERIFY(ipif_insert(ipif, B_FALSE) == 0);
14424 				}
14425 				rw_exit(&ipst->ips_ill_g_lock);
14426 				return (err);
14427 			}
14428 		}
14429 		rw_exit(&ipst->ips_ill_g_lock);
14430 
14431 		/*
14432 		 * Tell SCTP that the ipif has moved.  Note that even if we
14433 		 * had to allocate a new ipif, the original sequence id was
14434 		 * preserved and therefore SCTP won't know.
14435 		 */
14436 		sctp_move_ipif(ipif, ill, ipmp_ill);
14437 
14438 		/*
14439 		 * If the ipif being brought up was on slot zero, then we
14440 		 * first need to bring up the placeholder we stuck there.  In
14441 		 * ip_rput_dlpi_writer(), arp_bringup_done(), or the recursive
14442 		 * call to ipif_up() itself, if we successfully bring up the
14443 		 * placeholder, we'll check ill_move_ipif and bring it up too.
14444 		 */
14445 		if (ipif_orig_id == 0) {
14446 			ASSERT(ill->ill_move_ipif == NULL);
14447 			ill->ill_move_ipif = ipif;
14448 			if ((err = ipif_up(ill->ill_ipif, q, mp)) == 0)
14449 				ASSERT(ill->ill_move_ipif == NULL);
14450 			if (err != EINPROGRESS)
14451 				ill->ill_move_ipif = NULL;
14452 			return (err);
14453 		}
14454 
14455 		/*
14456 		 * Bring it up on the IPMP ill.
14457 		 */
14458 		return (ipif_up(ipif, q, mp));
14459 	}
14460 
14461 	/* Skip arp/ndp for any loopback interface. */
14462 	if (ill->ill_wq != NULL) {
14463 		conn_t *connp = CONN_Q(q) ? Q_TO_CONN(q) : NULL;
14464 		ipsq_t	*ipsq = ill->ill_phyint->phyint_ipsq;
14465 
14466 		if (!ill->ill_dl_up) {
14467 			/*
14468 			 * ill_dl_up is not yet set. i.e. we are yet to
14469 			 * DL_BIND with the driver and this is the first
14470 			 * logical interface on the ill to become "up".
14471 			 * Tell the driver to get going (via DL_BIND_REQ).
14472 			 * Note that changing "significant" IFF_ flags
14473 			 * address/netmask etc cause a down/up dance, but
14474 			 * does not cause an unbind (DL_UNBIND) with the driver
14475 			 */
14476 			return (ill_dl_up(ill, ipif, mp, q));
14477 		}
14478 
14479 		/*
14480 		 * ipif_resolver_up may end up needeing to bind/attach
14481 		 * the ARP stream, which in turn necessitates a
14482 		 * DLPI message exchange with the driver. ioctls are
14483 		 * serialized and so we cannot send more than one
14484 		 * interface up message at a time. If ipif_resolver_up
14485 		 * does need to wait for the DLPI handshake for the ARP stream,
14486 		 * we get EINPROGRESS and we will complete in arp_bringup_done.
14487 		 */
14488 
14489 		ASSERT(connp != NULL || !CONN_Q(q));
14490 		if (connp != NULL)
14491 			mutex_enter(&connp->conn_lock);
14492 		mutex_enter(&ill->ill_lock);
14493 		success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
14494 		mutex_exit(&ill->ill_lock);
14495 		if (connp != NULL)
14496 			mutex_exit(&connp->conn_lock);
14497 		if (!success)
14498 			return (EINTR);
14499 
14500 		/*
14501 		 * Crank up IPv6 neighbor discovery. Unlike ARP, this should
14502 		 * complete when ipif_ndp_up returns.
14503 		 */
14504 		err = ipif_resolver_up(ipif, Res_act_initial);
14505 		if (err == EINPROGRESS) {
14506 			/* We will complete it in arp_bringup_done() */
14507 			return (err);
14508 		}
14509 
14510 		if (isv6 && err == 0)
14511 			err = ipif_ndp_up(ipif, B_TRUE);
14512 
14513 		ASSERT(err != EINPROGRESS);
14514 		mp = ipsq_pending_mp_get(ipsq, &connp);
14515 		ASSERT(mp != NULL);
14516 		if (err != 0)
14517 			return (err);
14518 	} else {
14519 		/*
14520 		 * Interfaces without underlying hardware don't do duplicate
14521 		 * address detection.
14522 		 */
14523 		ASSERT(!(ipif->ipif_flags & IPIF_DUPLICATE));
14524 		ipif->ipif_addr_ready = 1;
14525 		err = ill_add_ires(ill);
14526 		/* allocation failure? */
14527 		if (err != 0)
14528 			return (err);
14529 	}
14530 
14531 	err = (isv6 ? ipif_up_done_v6(ipif) : ipif_up_done(ipif));
14532 	if (err == 0 && ill->ill_move_ipif != NULL) {
14533 		ipif = ill->ill_move_ipif;
14534 		ill->ill_move_ipif = NULL;
14535 		return (ipif_up(ipif, q, mp));
14536 	}
14537 	return (err);
14538 }
14539 
14540 /*
14541  * Add any IREs tied to the ill. For now this is just an IRE_MULTICAST.
14542  * The identical set of IREs need to be removed in ill_delete_ires().
14543  */
14544 int
ill_add_ires(ill_t * ill)14545 ill_add_ires(ill_t *ill)
14546 {
14547 	ire_t	*ire;
14548 	in6_addr_t dummy6 = {(uint32_t)V6_MCAST, 0, 0, 1};
14549 	in_addr_t dummy4 = htonl(INADDR_ALLHOSTS_GROUP);
14550 
14551 	if (ill->ill_ire_multicast != NULL)
14552 		return (0);
14553 
14554 	/*
14555 	 * provide some dummy ire_addr for creating the ire.
14556 	 */
14557 	if (ill->ill_isv6) {
14558 		ire = ire_create_v6(&dummy6, 0, 0, IRE_MULTICAST, ill,
14559 		    ALL_ZONES, RTF_UP, NULL, ill->ill_ipst);
14560 	} else {
14561 		ire = ire_create((uchar_t *)&dummy4, 0, 0, IRE_MULTICAST, ill,
14562 		    ALL_ZONES, RTF_UP, NULL, ill->ill_ipst);
14563 	}
14564 	if (ire == NULL)
14565 		return (ENOMEM);
14566 
14567 	ill->ill_ire_multicast = ire;
14568 	return (0);
14569 }
14570 
14571 void
ill_delete_ires(ill_t * ill)14572 ill_delete_ires(ill_t *ill)
14573 {
14574 	if (ill->ill_ire_multicast != NULL) {
14575 		/*
14576 		 * BIND/ATTACH completed; Release the ref for ill_ire_multicast
14577 		 * which was taken without any th_tracing enabled.
14578 		 * We also mark it as condemned (note that it was never added)
14579 		 * so that caching conn's can move off of it.
14580 		 */
14581 		ire_make_condemned(ill->ill_ire_multicast);
14582 		ire_refrele_notr(ill->ill_ire_multicast);
14583 		ill->ill_ire_multicast = NULL;
14584 	}
14585 }
14586 
14587 /*
14588  * Perform a bind for the physical device.
14589  * When the routine returns EINPROGRESS then mp has been consumed and
14590  * the ioctl will be acked from ip_rput_dlpi.
14591  * Allocate an unbind message and save it until ipif_down.
14592  */
14593 static int
ill_dl_up(ill_t * ill,ipif_t * ipif,mblk_t * mp,queue_t * q)14594 ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
14595 {
14596 	mblk_t	*bind_mp = NULL;
14597 	mblk_t	*unbind_mp = NULL;
14598 	conn_t	*connp;
14599 	boolean_t success;
14600 	int	err;
14601 
14602 	DTRACE_PROBE2(ill__downup, char *, "ill_dl_up", ill_t *, ill);
14603 
14604 	ip1dbg(("ill_dl_up(%s)\n", ill->ill_name));
14605 	ASSERT(IAM_WRITER_ILL(ill));
14606 	ASSERT(mp != NULL);
14607 
14608 	/*
14609 	 * Make sure we have an IRE_MULTICAST in case we immediately
14610 	 * start receiving packets.
14611 	 */
14612 	err = ill_add_ires(ill);
14613 	if (err != 0)
14614 		goto bad;
14615 
14616 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
14617 	    DL_BIND_REQ);
14618 	if (bind_mp == NULL)
14619 		goto bad;
14620 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
14621 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
14622 
14623 	/*
14624 	 * ill_unbind_mp would be non-null if the following sequence had
14625 	 * happened:
14626 	 * - send DL_BIND_REQ to driver, wait for response
14627 	 * - multiple ioctls that need to bring the ipif up are encountered,
14628 	 *   but they cannot enter the ipsq due to the outstanding DL_BIND_REQ.
14629 	 *   These ioctls will then be enqueued on the ipsq
14630 	 * - a DL_ERROR_ACK is returned for the DL_BIND_REQ
14631 	 * At this point, the pending ioctls in the ipsq will be drained, and
14632 	 * since ill->ill_dl_up was not set, ill_dl_up would be invoked with
14633 	 * a non-null ill->ill_unbind_mp
14634 	 */
14635 	if (ill->ill_unbind_mp == NULL) {
14636 		unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t),
14637 		    DL_UNBIND_REQ);
14638 		if (unbind_mp == NULL)
14639 			goto bad;
14640 	}
14641 	/*
14642 	 * Record state needed to complete this operation when the
14643 	 * DL_BIND_ACK shows up.  Also remember the pre-allocated mblks.
14644 	 */
14645 	connp = CONN_Q(q) ? Q_TO_CONN(q) : NULL;
14646 	ASSERT(connp != NULL || !CONN_Q(q));
14647 	GRAB_CONN_LOCK(q);
14648 	mutex_enter(&ipif->ipif_ill->ill_lock);
14649 	success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
14650 	mutex_exit(&ipif->ipif_ill->ill_lock);
14651 	RELEASE_CONN_LOCK(q);
14652 	if (!success)
14653 		goto bad;
14654 
14655 	/*
14656 	 * Save the unbind message for ill_dl_down(); it will be consumed when
14657 	 * the interface goes down.
14658 	 */
14659 	if (ill->ill_unbind_mp == NULL)
14660 		ill->ill_unbind_mp = unbind_mp;
14661 
14662 	ill_dlpi_send(ill, bind_mp);
14663 	/* Send down link-layer capabilities probe if not already done. */
14664 	ill_capability_probe(ill);
14665 
14666 	/*
14667 	 * Sysid used to rely on the fact that netboots set domainname
14668 	 * and the like. Now that miniroot boots aren't strictly netboots
14669 	 * and miniroot network configuration is driven from userland
14670 	 * these things still need to be set. This situation can be detected
14671 	 * by comparing the interface being configured here to the one
14672 	 * dhcifname was set to reference by the boot loader. Once sysid is
14673 	 * converted to use dhcp_ipc_getinfo() this call can go away.
14674 	 */
14675 	if ((ipif->ipif_flags & IPIF_DHCPRUNNING) &&
14676 	    (strcmp(ill->ill_name, dhcifname) == 0) &&
14677 	    (strlen(srpc_domain) == 0)) {
14678 		if (dhcpinit() != 0)
14679 			cmn_err(CE_WARN, "no cached dhcp response");
14680 	}
14681 
14682 	/*
14683 	 * This operation will complete in ip_rput_dlpi with either
14684 	 * a DL_BIND_ACK or DL_ERROR_ACK.
14685 	 */
14686 	return (EINPROGRESS);
14687 bad:
14688 	ip1dbg(("ill_dl_up(%s) FAILED\n", ill->ill_name));
14689 
14690 	freemsg(bind_mp);
14691 	freemsg(unbind_mp);
14692 	return (ENOMEM);
14693 }
14694 
14695 /* Add room for tcp+ip headers */
14696 uint_t ip_loopback_mtuplus = IP_LOOPBACK_MTU + IP_SIMPLE_HDR_LENGTH + 20;
14697 
14698 /*
14699  * DLPI and ARP is up.
14700  * Create all the IREs associated with an interface. Bring up multicast.
14701  * Set the interface flag and finish other initialization
14702  * that potentially had to be deferred to after DL_BIND_ACK.
14703  */
14704 int
ipif_up_done(ipif_t * ipif)14705 ipif_up_done(ipif_t *ipif)
14706 {
14707 	ill_t		*ill = ipif->ipif_ill;
14708 	int		err = 0;
14709 	boolean_t	loopback = B_FALSE;
14710 	boolean_t	update_src_selection = B_TRUE;
14711 	ipif_t		*tmp_ipif;
14712 
14713 	ip1dbg(("ipif_up_done(%s:%u)\n",
14714 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
14715 	DTRACE_PROBE3(ipif__downup, char *, "ipif_up_done",
14716 	    ill_t *, ill, ipif_t *, ipif);
14717 
14718 	/* Check if this is a loopback interface */
14719 	if (ipif->ipif_ill->ill_wq == NULL)
14720 		loopback = B_TRUE;
14721 
14722 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
14723 
14724 	/*
14725 	 * If all other interfaces for this ill are down or DEPRECATED,
14726 	 * or otherwise unsuitable for source address selection,
14727 	 * reset the src generation numbers to make sure source
14728 	 * address selection gets to take this new ipif into account.
14729 	 * No need to hold ill_lock while traversing the ipif list since
14730 	 * we are writer
14731 	 */
14732 	for (tmp_ipif = ill->ill_ipif; tmp_ipif;
14733 	    tmp_ipif = tmp_ipif->ipif_next) {
14734 		if (((tmp_ipif->ipif_flags &
14735 		    (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
14736 		    !(tmp_ipif->ipif_flags & IPIF_UP)) ||
14737 		    (tmp_ipif == ipif))
14738 			continue;
14739 		/* first useable pre-existing interface */
14740 		update_src_selection = B_FALSE;
14741 		break;
14742 	}
14743 	if (update_src_selection)
14744 		ip_update_source_selection(ill->ill_ipst);
14745 
14746 	if (IS_LOOPBACK(ill) || ill->ill_net_type == IRE_IF_NORESOLVER) {
14747 		nce_t *loop_nce = NULL;
14748 		uint16_t flags = (NCE_F_MYADDR | NCE_F_AUTHORITY | NCE_F_NONUD);
14749 
14750 		/*
14751 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
14752 		 * ipif_lookup_on_name(), but in the case of zones we can have
14753 		 * several loopback addresses on lo0. So all the interfaces with
14754 		 * loopback addresses need to be marked IRE_LOOPBACK.
14755 		 */
14756 		if (V4_PART_OF_V6(ipif->ipif_v6lcl_addr) ==
14757 		    htonl(INADDR_LOOPBACK))
14758 			ipif->ipif_ire_type = IRE_LOOPBACK;
14759 		else
14760 			ipif->ipif_ire_type = IRE_LOCAL;
14761 		if (ill->ill_net_type != IRE_LOOPBACK)
14762 			flags |= NCE_F_PUBLISH;
14763 
14764 		/* add unicast nce for the local addr */
14765 		err = nce_lookup_then_add_v4(ill, NULL,
14766 		    ill->ill_phys_addr_length, &ipif->ipif_lcl_addr, flags,
14767 		    ND_REACHABLE, &loop_nce);
14768 		/* A shared-IP zone sees EEXIST for lo0:N */
14769 		if (err == 0 || err == EEXIST) {
14770 			ipif->ipif_added_nce = 1;
14771 			loop_nce->nce_ipif_cnt++;
14772 			nce_refrele(loop_nce);
14773 			err = 0;
14774 		} else {
14775 			ASSERT(loop_nce == NULL);
14776 			return (err);
14777 		}
14778 	}
14779 
14780 	/* Create all the IREs associated with this interface */
14781 	err = ipif_add_ires_v4(ipif, loopback);
14782 	if (err != 0) {
14783 		/*
14784 		 * see comments about return value from
14785 		 * ip_addr_availability_check() in ipif_add_ires_v4().
14786 		 */
14787 		if (err != EADDRINUSE) {
14788 			(void) ipif_arp_down(ipif);
14789 		} else {
14790 			/*
14791 			 * Make IPMP aware of the deleted ipif so that
14792 			 * the needed ipmp cleanup (e.g., of ipif_bound_ill)
14793 			 * can be completed. Note that we do not want to
14794 			 * destroy the nce that was created on the ipmp_ill
14795 			 * for the active copy of the duplicate address in
14796 			 * use.
14797 			 */
14798 			if (IS_IPMP(ill))
14799 				ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
14800 			err = EADDRNOTAVAIL;
14801 		}
14802 		return (err);
14803 	}
14804 
14805 	if (ill->ill_ipif_up_count == 1 && !loopback) {
14806 		/* Recover any additional IREs entries for this ill */
14807 		(void) ill_recover_saved_ire(ill);
14808 	}
14809 
14810 	if (ill->ill_need_recover_multicast) {
14811 		/*
14812 		 * Need to recover all multicast memberships in the driver.
14813 		 * This had to be deferred until we had attached.  The same
14814 		 * code exists in ipif_up_done_v6() to recover IPv6
14815 		 * memberships.
14816 		 *
14817 		 * Note that it would be preferable to unconditionally do the
14818 		 * ill_recover_multicast() in ill_dl_up(), but we cannot do
14819 		 * that since ill_join_allmulti() depends on ill_dl_up being
14820 		 * set, and it is not set until we receive a DL_BIND_ACK after
14821 		 * having called ill_dl_up().
14822 		 */
14823 		ill_recover_multicast(ill);
14824 	}
14825 
14826 	if (ill->ill_ipif_up_count == 1) {
14827 		/*
14828 		 * Since the interface is now up, it may now be active.
14829 		 */
14830 		if (IS_UNDER_IPMP(ill))
14831 			ipmp_ill_refresh_active(ill);
14832 
14833 		/*
14834 		 * If this is an IPMP interface, we may now be able to
14835 		 * establish ARP entries.
14836 		 */
14837 		if (IS_IPMP(ill))
14838 			ipmp_illgrp_refresh_arpent(ill->ill_grp);
14839 	}
14840 
14841 	/* Join the allhosts multicast address */
14842 	ipif_multicast_up(ipif);
14843 
14844 	if (!loopback && !update_src_selection &&
14845 	    !(ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)))
14846 		ip_update_source_selection(ill->ill_ipst);
14847 
14848 	if (!loopback && ipif->ipif_addr_ready) {
14849 		/* Broadcast an address mask reply. */
14850 		ipif_mask_reply(ipif);
14851 	}
14852 	/* Perhaps ilgs should use this ill */
14853 	update_conn_ill(NULL, ill->ill_ipst);
14854 
14855 	/*
14856 	 * This had to be deferred until we had bound.  Tell routing sockets and
14857 	 * others that this interface is up if it looks like the address has
14858 	 * been validated.  Otherwise, if it isn't ready yet, wait for
14859 	 * duplicate address detection to do its thing.
14860 	 */
14861 	if (ipif->ipif_addr_ready)
14862 		ipif_up_notify(ipif);
14863 	return (0);
14864 }
14865 
14866 /*
14867  * Add the IREs associated with the ipif.
14868  * Those MUST be explicitly removed in ipif_delete_ires_v4.
14869  */
14870 static int
ipif_add_ires_v4(ipif_t * ipif,boolean_t loopback)14871 ipif_add_ires_v4(ipif_t *ipif, boolean_t loopback)
14872 {
14873 	ill_t		*ill = ipif->ipif_ill;
14874 	ip_stack_t	*ipst = ill->ill_ipst;
14875 	ire_t		*ire_array[20];
14876 	ire_t		**irep = ire_array;
14877 	ire_t		**irep1;
14878 	ipaddr_t	net_mask = 0;
14879 	ipaddr_t	subnet_mask, route_mask;
14880 	int		err;
14881 	ire_t		*ire_local = NULL;	/* LOCAL or LOOPBACK */
14882 	ire_t		*ire_if = NULL;
14883 	uchar_t		*gw;
14884 
14885 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14886 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14887 		/*
14888 		 * If we're on a labeled system then make sure that zone-
14889 		 * private addresses have proper remote host database entries.
14890 		 */
14891 		if (is_system_labeled() &&
14892 		    ipif->ipif_ire_type != IRE_LOOPBACK &&
14893 		    !tsol_check_interface_address(ipif))
14894 			return (EINVAL);
14895 
14896 		/* Register the source address for __sin6_src_id */
14897 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
14898 		    ipif->ipif_zoneid, ipst);
14899 		if (err != 0) {
14900 			ip0dbg(("ipif_add_ires: srcid_insert %d\n", err));
14901 			return (err);
14902 		}
14903 
14904 		if (loopback)
14905 			gw = (uchar_t *)&ipif->ipif_lcl_addr;
14906 		else
14907 			gw = NULL;
14908 
14909 		/* If the interface address is set, create the local IRE. */
14910 		ire_local = ire_create(
14911 		    (uchar_t *)&ipif->ipif_lcl_addr,	/* dest address */
14912 		    (uchar_t *)&ip_g_all_ones,		/* mask */
14913 		    gw,					/* gateway */
14914 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
14915 		    ipif->ipif_ill,
14916 		    ipif->ipif_zoneid,
14917 		    ((ipif->ipif_flags & IPIF_PRIVATE) ?
14918 		    RTF_PRIVATE : 0) | RTF_KERNEL,
14919 		    NULL,
14920 		    ipst);
14921 		ip1dbg(("ipif_add_ires: 0x%p creating IRE %p type 0x%x"
14922 		    " for 0x%x\n", (void *)ipif, (void *)ire_local,
14923 		    ipif->ipif_ire_type,
14924 		    ntohl(ipif->ipif_lcl_addr)));
14925 		if (ire_local == NULL) {
14926 			ip1dbg(("ipif_up_done: NULL ire_local\n"));
14927 			err = ENOMEM;
14928 			goto bad;
14929 		}
14930 	} else {
14931 		ip1dbg((
14932 		    "ipif_add_ires: not creating IRE %d for 0x%x: flags 0x%x\n",
14933 		    ipif->ipif_ire_type,
14934 		    ntohl(ipif->ipif_lcl_addr),
14935 		    (uint_t)ipif->ipif_flags));
14936 	}
14937 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14938 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14939 		net_mask = ip_net_mask(ipif->ipif_lcl_addr);
14940 	} else {
14941 		net_mask = htonl(IN_CLASSA_NET);	/* fallback */
14942 	}
14943 
14944 	subnet_mask = ipif->ipif_net_mask;
14945 
14946 	/*
14947 	 * If mask was not specified, use natural netmask of
14948 	 * interface address. Also, store this mask back into the
14949 	 * ipif struct.
14950 	 */
14951 	if (subnet_mask == 0) {
14952 		subnet_mask = net_mask;
14953 		V4MASK_TO_V6(subnet_mask, ipif->ipif_v6net_mask);
14954 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
14955 		    ipif->ipif_v6subnet);
14956 	}
14957 
14958 	/* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */
14959 	if (!loopback && !(ipif->ipif_flags & IPIF_NOXMIT) &&
14960 	    ipif->ipif_subnet != INADDR_ANY) {
14961 		/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
14962 
14963 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
14964 			route_mask = IP_HOST_MASK;
14965 		} else {
14966 			route_mask = subnet_mask;
14967 		}
14968 
14969 		ip1dbg(("ipif_add_ires: ipif 0x%p ill 0x%p "
14970 		    "creating if IRE ill_net_type 0x%x for 0x%x\n",
14971 		    (void *)ipif, (void *)ill, ill->ill_net_type,
14972 		    ntohl(ipif->ipif_subnet)));
14973 		ire_if = ire_create(
14974 		    (uchar_t *)&ipif->ipif_subnet,
14975 		    (uchar_t *)&route_mask,
14976 		    (uchar_t *)&ipif->ipif_lcl_addr,
14977 		    ill->ill_net_type,
14978 		    ill,
14979 		    ipif->ipif_zoneid,
14980 		    ((ipif->ipif_flags & IPIF_PRIVATE) ?
14981 		    RTF_PRIVATE: 0) | RTF_KERNEL,
14982 		    NULL,
14983 		    ipst);
14984 		if (ire_if == NULL) {
14985 			ip1dbg(("ipif_up_done: NULL ire_if\n"));
14986 			err = ENOMEM;
14987 			goto bad;
14988 		}
14989 	}
14990 
14991 	/*
14992 	 * Create any necessary broadcast IREs.
14993 	 */
14994 	if ((ipif->ipif_flags & IPIF_BROADCAST) &&
14995 	    !(ipif->ipif_flags & IPIF_NOXMIT))
14996 		irep = ipif_create_bcast_ires(ipif, irep);
14997 
14998 	/* If an earlier ire_create failed, get out now */
14999 	for (irep1 = irep; irep1 > ire_array; ) {
15000 		irep1--;
15001 		if (*irep1 == NULL) {
15002 			ip1dbg(("ipif_up_done: NULL ire found in ire_array\n"));
15003 			err = ENOMEM;
15004 			goto bad;
15005 		}
15006 	}
15007 
15008 	/*
15009 	 * Need to atomically check for IP address availability under
15010 	 * ip_addr_avail_lock.  ill_g_lock is held as reader to ensure no new
15011 	 * ills or new ipifs can be added while we are checking availability.
15012 	 */
15013 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
15014 	mutex_enter(&ipst->ips_ip_addr_avail_lock);
15015 	/* Mark it up, and increment counters. */
15016 	ipif->ipif_flags |= IPIF_UP;
15017 	ill->ill_ipif_up_count++;
15018 	err = ip_addr_availability_check(ipif);
15019 	mutex_exit(&ipst->ips_ip_addr_avail_lock);
15020 	rw_exit(&ipst->ips_ill_g_lock);
15021 
15022 	if (err != 0) {
15023 		/*
15024 		 * Our address may already be up on the same ill. In this case,
15025 		 * the ARP entry for our ipif replaced the one for the other
15026 		 * ipif. So we don't want to delete it (otherwise the other ipif
15027 		 * would be unable to send packets).
15028 		 * ip_addr_availability_check() identifies this case for us and
15029 		 * returns EADDRINUSE; Caller should turn it into EADDRNOTAVAIL
15030 		 * which is the expected error code.
15031 		 */
15032 		ill->ill_ipif_up_count--;
15033 		ipif->ipif_flags &= ~IPIF_UP;
15034 		goto bad;
15035 	}
15036 
15037 	/*
15038 	 * Add in all newly created IREs.  ire_create_bcast() has
15039 	 * already checked for duplicates of the IRE_BROADCAST type.
15040 	 * We add the IRE_INTERFACE before the IRE_LOCAL to ensure
15041 	 * that lookups find the IRE_LOCAL even if the IRE_INTERFACE is
15042 	 * a /32 route.
15043 	 */
15044 	if (ire_if != NULL) {
15045 		ire_if = ire_add(ire_if);
15046 		if (ire_if == NULL) {
15047 			err = ENOMEM;
15048 			goto bad2;
15049 		}
15050 #ifdef DEBUG
15051 		ire_refhold_notr(ire_if);
15052 		ire_refrele(ire_if);
15053 #endif
15054 	}
15055 	if (ire_local != NULL) {
15056 		ire_local = ire_add(ire_local);
15057 		if (ire_local == NULL) {
15058 			err = ENOMEM;
15059 			goto bad2;
15060 		}
15061 #ifdef DEBUG
15062 		ire_refhold_notr(ire_local);
15063 		ire_refrele(ire_local);
15064 #endif
15065 	}
15066 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15067 	if (ire_local != NULL)
15068 		ipif->ipif_ire_local = ire_local;
15069 	if (ire_if != NULL)
15070 		ipif->ipif_ire_if = ire_if;
15071 	rw_exit(&ipst->ips_ill_g_lock);
15072 	ire_local = NULL;
15073 	ire_if = NULL;
15074 
15075 	/*
15076 	 * We first add all of them, and if that succeeds we refrele the
15077 	 * bunch. That enables us to delete all of them should any of the
15078 	 * ire_adds fail.
15079 	 */
15080 	for (irep1 = irep; irep1 > ire_array; ) {
15081 		irep1--;
15082 		ASSERT(!MUTEX_HELD(&((*irep1)->ire_ill->ill_lock)));
15083 		*irep1 = ire_add(*irep1);
15084 		if (*irep1 == NULL) {
15085 			err = ENOMEM;
15086 			goto bad2;
15087 		}
15088 	}
15089 
15090 	for (irep1 = irep; irep1 > ire_array; ) {
15091 		irep1--;
15092 		/* refheld by ire_add. */
15093 		if (*irep1 != NULL) {
15094 			ire_refrele(*irep1);
15095 			*irep1 = NULL;
15096 		}
15097 	}
15098 
15099 	if (!loopback) {
15100 		/*
15101 		 * If the broadcast address has been set, make sure it makes
15102 		 * sense based on the interface address.
15103 		 * Only match on ill since we are sharing broadcast addresses.
15104 		 */
15105 		if ((ipif->ipif_brd_addr != INADDR_ANY) &&
15106 		    (ipif->ipif_flags & IPIF_BROADCAST)) {
15107 			ire_t	*ire;
15108 
15109 			ire = ire_ftable_lookup_v4(ipif->ipif_brd_addr, 0, 0,
15110 			    IRE_BROADCAST, ipif->ipif_ill, ALL_ZONES, NULL,
15111 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL), 0, ipst, NULL);
15112 
15113 			if (ire == NULL) {
15114 				/*
15115 				 * If there isn't a matching broadcast IRE,
15116 				 * revert to the default for this netmask.
15117 				 */
15118 				ipif->ipif_v6brd_addr = ipv6_all_zeros;
15119 				mutex_enter(&ipif->ipif_ill->ill_lock);
15120 				ipif_set_default(ipif);
15121 				mutex_exit(&ipif->ipif_ill->ill_lock);
15122 			} else {
15123 				ire_refrele(ire);
15124 			}
15125 		}
15126 
15127 	}
15128 	return (0);
15129 
15130 bad2:
15131 	ill->ill_ipif_up_count--;
15132 	ipif->ipif_flags &= ~IPIF_UP;
15133 
15134 bad:
15135 	ip1dbg(("ipif_add_ires: FAILED \n"));
15136 	if (ire_local != NULL)
15137 		ire_delete(ire_local);
15138 	if (ire_if != NULL)
15139 		ire_delete(ire_if);
15140 
15141 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15142 	ire_local = ipif->ipif_ire_local;
15143 	ipif->ipif_ire_local = NULL;
15144 	ire_if = ipif->ipif_ire_if;
15145 	ipif->ipif_ire_if = NULL;
15146 	rw_exit(&ipst->ips_ill_g_lock);
15147 	if (ire_local != NULL) {
15148 		ire_delete(ire_local);
15149 		ire_refrele_notr(ire_local);
15150 	}
15151 	if (ire_if != NULL) {
15152 		ire_delete(ire_if);
15153 		ire_refrele_notr(ire_if);
15154 	}
15155 
15156 	while (irep > ire_array) {
15157 		irep--;
15158 		if (*irep != NULL) {
15159 			ire_delete(*irep);
15160 		}
15161 	}
15162 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst);
15163 
15164 	return (err);
15165 }
15166 
15167 /* Remove all the IREs created by ipif_add_ires_v4 */
15168 void
ipif_delete_ires_v4(ipif_t * ipif)15169 ipif_delete_ires_v4(ipif_t *ipif)
15170 {
15171 	ill_t		*ill = ipif->ipif_ill;
15172 	ip_stack_t	*ipst = ill->ill_ipst;
15173 	ire_t		*ire;
15174 
15175 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15176 	ire = ipif->ipif_ire_local;
15177 	ipif->ipif_ire_local = NULL;
15178 	rw_exit(&ipst->ips_ill_g_lock);
15179 	if (ire != NULL) {
15180 		/*
15181 		 * Move count to ipif so we don't loose the count due to
15182 		 * a down/up dance.
15183 		 */
15184 		atomic_add_32(&ipif->ipif_ib_pkt_count, ire->ire_ib_pkt_count);
15185 
15186 		ire_delete(ire);
15187 		ire_refrele_notr(ire);
15188 	}
15189 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15190 	ire = ipif->ipif_ire_if;
15191 	ipif->ipif_ire_if = NULL;
15192 	rw_exit(&ipst->ips_ill_g_lock);
15193 	if (ire != NULL) {
15194 		ire_delete(ire);
15195 		ire_refrele_notr(ire);
15196 	}
15197 
15198 	/*
15199 	 * Delete the broadcast IREs.
15200 	 */
15201 	if ((ipif->ipif_flags & IPIF_BROADCAST) &&
15202 	    !(ipif->ipif_flags & IPIF_NOXMIT))
15203 		ipif_delete_bcast_ires(ipif);
15204 }
15205 
15206 /*
15207  * Checks for availbility of a usable source address (if there is one) when the
15208  * destination ILL has the ill_usesrc_ifindex pointing to another ILL. Note
15209  * this selection is done regardless of the destination.
15210  */
15211 boolean_t
ipif_zone_avail(uint_t ifindex,boolean_t isv6,zoneid_t zoneid,ip_stack_t * ipst)15212 ipif_zone_avail(uint_t ifindex, boolean_t isv6, zoneid_t zoneid,
15213     ip_stack_t *ipst)
15214 {
15215 	ipif_t		*ipif = NULL;
15216 	ill_t		*uill;
15217 
15218 	ASSERT(ifindex != 0);
15219 
15220 	uill = ill_lookup_on_ifindex(ifindex, isv6, ipst);
15221 	if (uill == NULL)
15222 		return (B_FALSE);
15223 
15224 	mutex_enter(&uill->ill_lock);
15225 	for (ipif = uill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
15226 		if (IPIF_IS_CONDEMNED(ipif))
15227 			continue;
15228 		if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
15229 			continue;
15230 		if (!(ipif->ipif_flags & IPIF_UP))
15231 			continue;
15232 		if (ipif->ipif_zoneid != zoneid)
15233 			continue;
15234 		if (isv6 ? IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) :
15235 		    ipif->ipif_lcl_addr == INADDR_ANY)
15236 			continue;
15237 		mutex_exit(&uill->ill_lock);
15238 		ill_refrele(uill);
15239 		return (B_TRUE);
15240 	}
15241 	mutex_exit(&uill->ill_lock);
15242 	ill_refrele(uill);
15243 	return (B_FALSE);
15244 }
15245 
15246 /*
15247  * Find an ipif with a good local address on the ill+zoneid.
15248  */
15249 ipif_t *
ipif_good_addr(ill_t * ill,zoneid_t zoneid)15250 ipif_good_addr(ill_t *ill, zoneid_t zoneid)
15251 {
15252 	ipif_t		*ipif;
15253 
15254 	mutex_enter(&ill->ill_lock);
15255 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
15256 		if (IPIF_IS_CONDEMNED(ipif))
15257 			continue;
15258 		if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
15259 			continue;
15260 		if (!(ipif->ipif_flags & IPIF_UP))
15261 			continue;
15262 		if (ipif->ipif_zoneid != zoneid &&
15263 		    ipif->ipif_zoneid != ALL_ZONES && zoneid != ALL_ZONES)
15264 			continue;
15265 		if (ill->ill_isv6 ?
15266 		    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) :
15267 		    ipif->ipif_lcl_addr == INADDR_ANY)
15268 			continue;
15269 		ipif_refhold_locked(ipif);
15270 		mutex_exit(&ill->ill_lock);
15271 		return (ipif);
15272 	}
15273 	mutex_exit(&ill->ill_lock);
15274 	return (NULL);
15275 }
15276 
15277 /*
15278  * IP source address type, sorted from worst to best.  For a given type,
15279  * always prefer IP addresses on the same subnet.  All-zones addresses are
15280  * suboptimal because they pose problems with unlabeled destinations.
15281  */
15282 typedef enum {
15283 	IPIF_NONE,
15284 	IPIF_DIFFNET_DEPRECATED, 	/* deprecated and different subnet */
15285 	IPIF_SAMENET_DEPRECATED, 	/* deprecated and same subnet */
15286 	IPIF_DIFFNET_ALLZONES,		/* allzones and different subnet */
15287 	IPIF_SAMENET_ALLZONES,		/* allzones and same subnet */
15288 	IPIF_DIFFNET,			/* normal and different subnet */
15289 	IPIF_SAMENET,			/* normal and same subnet */
15290 	IPIF_LOCALADDR			/* local loopback */
15291 } ipif_type_t;
15292 
15293 /*
15294  * Pick the optimal ipif on `ill' for sending to destination `dst' from zone
15295  * `zoneid'.  We rate usable ipifs from low -> high as per the ipif_type_t
15296  * enumeration, and return the highest-rated ipif.  If there's a tie, we pick
15297  * the first one, unless IPMP is used in which case we round-robin among them;
15298  * see below for more.
15299  *
15300  * Returns NULL if there is no suitable source address for the ill.
15301  * This only occurs when there is no valid source address for the ill.
15302  */
15303 ipif_t *
ipif_select_source_v4(ill_t * ill,ipaddr_t dst,zoneid_t zoneid,boolean_t allow_usesrc,boolean_t * notreadyp)15304 ipif_select_source_v4(ill_t *ill, ipaddr_t dst, zoneid_t zoneid,
15305     boolean_t allow_usesrc, boolean_t *notreadyp)
15306 {
15307 	ill_t	*usill = NULL;
15308 	ill_t	*ipmp_ill = NULL;
15309 	ipif_t	*start_ipif, *next_ipif, *ipif, *best_ipif;
15310 	ipif_type_t type, best_type;
15311 	tsol_tpc_t *src_rhtp, *dst_rhtp;
15312 	ip_stack_t *ipst = ill->ill_ipst;
15313 	boolean_t samenet;
15314 
15315 	if (ill->ill_usesrc_ifindex != 0 && allow_usesrc) {
15316 		usill = ill_lookup_on_ifindex(ill->ill_usesrc_ifindex,
15317 		    B_FALSE, ipst);
15318 		if (usill != NULL)
15319 			ill = usill;	/* Select source from usesrc ILL */
15320 		else
15321 			return (NULL);
15322 	}
15323 
15324 	/*
15325 	 * Test addresses should never be used for source address selection,
15326 	 * so if we were passed one, switch to the IPMP meta-interface.
15327 	 */
15328 	if (IS_UNDER_IPMP(ill)) {
15329 		if ((ipmp_ill = ipmp_ill_hold_ipmp_ill(ill)) != NULL)
15330 			ill = ipmp_ill;	/* Select source from IPMP ill */
15331 		else
15332 			return (NULL);
15333 	}
15334 
15335 	/*
15336 	 * If we're dealing with an unlabeled destination on a labeled system,
15337 	 * make sure that we ignore source addresses that are incompatible with
15338 	 * the destination's default label.  That destination's default label
15339 	 * must dominate the minimum label on the source address.
15340 	 */
15341 	dst_rhtp = NULL;
15342 	if (is_system_labeled()) {
15343 		dst_rhtp = find_tpc(&dst, IPV4_VERSION, B_FALSE);
15344 		if (dst_rhtp == NULL)
15345 			return (NULL);
15346 		if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
15347 			TPC_RELE(dst_rhtp);
15348 			dst_rhtp = NULL;
15349 		}
15350 	}
15351 
15352 	/*
15353 	 * Hold the ill_g_lock as reader. This makes sure that no ipif/ill
15354 	 * can be deleted. But an ipif/ill can get CONDEMNED any time.
15355 	 * After selecting the right ipif, under ill_lock make sure ipif is
15356 	 * not condemned, and increment refcnt. If ipif is CONDEMNED,
15357 	 * we retry. Inside the loop we still need to check for CONDEMNED,
15358 	 * but not under a lock.
15359 	 */
15360 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
15361 retry:
15362 	/*
15363 	 * For source address selection, we treat the ipif list as circular
15364 	 * and continue until we get back to where we started.  This allows
15365 	 * IPMP to vary source address selection (which improves inbound load
15366 	 * spreading) by caching its last ending point and starting from
15367 	 * there.  NOTE: we don't have to worry about ill_src_ipif changing
15368 	 * ills since that can't happen on the IPMP ill.
15369 	 */
15370 	start_ipif = ill->ill_ipif;
15371 	if (IS_IPMP(ill) && ill->ill_src_ipif != NULL)
15372 		start_ipif = ill->ill_src_ipif;
15373 
15374 	ipif = start_ipif;
15375 	best_ipif = NULL;
15376 	best_type = IPIF_NONE;
15377 	do {
15378 		if ((next_ipif = ipif->ipif_next) == NULL)
15379 			next_ipif = ill->ill_ipif;
15380 
15381 		if (IPIF_IS_CONDEMNED(ipif))
15382 			continue;
15383 		/* Always skip NOLOCAL and ANYCAST interfaces */
15384 		if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
15385 			continue;
15386 		/* Always skip NOACCEPT interfaces */
15387 		if (ipif->ipif_ill->ill_flags & ILLF_NOACCEPT)
15388 			continue;
15389 		if (!(ipif->ipif_flags & IPIF_UP))
15390 			continue;
15391 
15392 		if (!ipif->ipif_addr_ready) {
15393 			if (notreadyp != NULL)
15394 				*notreadyp = B_TRUE;
15395 			continue;
15396 		}
15397 
15398 		if (zoneid != ALL_ZONES &&
15399 		    ipif->ipif_zoneid != zoneid &&
15400 		    ipif->ipif_zoneid != ALL_ZONES)
15401 			continue;
15402 
15403 		/*
15404 		 * Interfaces with 0.0.0.0 address are allowed to be UP, but
15405 		 * are not valid as source addresses.
15406 		 */
15407 		if (ipif->ipif_lcl_addr == INADDR_ANY)
15408 			continue;
15409 
15410 		/*
15411 		 * Check compatibility of local address for destination's
15412 		 * default label if we're on a labeled system.	Incompatible
15413 		 * addresses can't be used at all.
15414 		 */
15415 		if (dst_rhtp != NULL) {
15416 			boolean_t incompat;
15417 
15418 			src_rhtp = find_tpc(&ipif->ipif_lcl_addr,
15419 			    IPV4_VERSION, B_FALSE);
15420 			if (src_rhtp == NULL)
15421 				continue;
15422 			incompat = src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
15423 			    src_rhtp->tpc_tp.tp_doi !=
15424 			    dst_rhtp->tpc_tp.tp_doi ||
15425 			    (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
15426 			    &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
15427 			    !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
15428 			    src_rhtp->tpc_tp.tp_sl_set_cipso));
15429 			TPC_RELE(src_rhtp);
15430 			if (incompat)
15431 				continue;
15432 		}
15433 
15434 		samenet = ((ipif->ipif_net_mask & dst) == ipif->ipif_subnet);
15435 
15436 		if (ipif->ipif_lcl_addr == dst) {
15437 			type = IPIF_LOCALADDR;
15438 		} else if (ipif->ipif_flags & IPIF_DEPRECATED) {
15439 			type = samenet ? IPIF_SAMENET_DEPRECATED :
15440 			    IPIF_DIFFNET_DEPRECATED;
15441 		} else if (ipif->ipif_zoneid == ALL_ZONES) {
15442 			type = samenet ? IPIF_SAMENET_ALLZONES :
15443 			    IPIF_DIFFNET_ALLZONES;
15444 		} else {
15445 			type = samenet ? IPIF_SAMENET : IPIF_DIFFNET;
15446 		}
15447 
15448 		if (type > best_type) {
15449 			best_type = type;
15450 			best_ipif = ipif;
15451 			if (best_type == IPIF_LOCALADDR)
15452 				break; /* can't get better */
15453 		}
15454 	} while ((ipif = next_ipif) != start_ipif);
15455 
15456 	if ((ipif = best_ipif) != NULL) {
15457 		mutex_enter(&ipif->ipif_ill->ill_lock);
15458 		if (IPIF_IS_CONDEMNED(ipif)) {
15459 			mutex_exit(&ipif->ipif_ill->ill_lock);
15460 			goto retry;
15461 		}
15462 		ipif_refhold_locked(ipif);
15463 
15464 		/*
15465 		 * For IPMP, update the source ipif rotor to the next ipif,
15466 		 * provided we can look it up.  (We must not use it if it's
15467 		 * IPIF_CONDEMNED since we may have grabbed ill_g_lock after
15468 		 * ipif_free() checked ill_src_ipif.)
15469 		 */
15470 		if (IS_IPMP(ill) && ipif != NULL) {
15471 			next_ipif = ipif->ipif_next;
15472 			if (next_ipif != NULL && !IPIF_IS_CONDEMNED(next_ipif))
15473 				ill->ill_src_ipif = next_ipif;
15474 			else
15475 				ill->ill_src_ipif = NULL;
15476 		}
15477 		mutex_exit(&ipif->ipif_ill->ill_lock);
15478 	}
15479 
15480 	rw_exit(&ipst->ips_ill_g_lock);
15481 	if (usill != NULL)
15482 		ill_refrele(usill);
15483 	if (ipmp_ill != NULL)
15484 		ill_refrele(ipmp_ill);
15485 	if (dst_rhtp != NULL)
15486 		TPC_RELE(dst_rhtp);
15487 
15488 #ifdef DEBUG
15489 	if (ipif == NULL) {
15490 		char buf1[INET6_ADDRSTRLEN];
15491 
15492 		ip1dbg(("ipif_select_source_v4(%s, %s) -> NULL\n",
15493 		    ill->ill_name,
15494 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1))));
15495 	} else {
15496 		char buf1[INET6_ADDRSTRLEN];
15497 		char buf2[INET6_ADDRSTRLEN];
15498 
15499 		ip1dbg(("ipif_select_source_v4(%s, %s) -> %s\n",
15500 		    ipif->ipif_ill->ill_name,
15501 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1)),
15502 		    inet_ntop(AF_INET, &ipif->ipif_lcl_addr,
15503 		    buf2, sizeof (buf2))));
15504 	}
15505 #endif /* DEBUG */
15506 	return (ipif);
15507 }
15508 
15509 /*
15510  * Pick a source address based on the destination ill and an optional setsrc
15511  * address.
15512  * The result is stored in srcp. If generation is set, then put the source
15513  * generation number there before we look for the source address (to avoid
15514  * missing changes in the set of source addresses.
15515  * If flagsp is set, then us it to pass back ipif_flags.
15516  *
15517  * If the caller wants to cache the returned source address and detect when
15518  * that might be stale, the caller should pass in a generation argument,
15519  * which the caller can later compare against ips_src_generation
15520  *
15521  * The precedence order for selecting an IPv4 source address is:
15522  *  - RTF_SETSRC on the offlink ire always wins.
15523  *  - If usrsrc is set, swap the ill to be the usesrc one.
15524  *  - If IPMP is used on the ill, select a random address from the most
15525  *    preferred ones below:
15526  * 1. If onlink destination, same subnet and not deprecated, not ALL_ZONES
15527  * 2. Not deprecated, not ALL_ZONES
15528  * 3. If onlink destination, same subnet and not deprecated, ALL_ZONES
15529  * 4. Not deprecated, ALL_ZONES
15530  * 5. If onlink destination, same subnet and deprecated
15531  * 6. Deprecated.
15532  *
15533  * We have lower preference for ALL_ZONES IP addresses,
15534  * as they pose problems with unlabeled destinations.
15535  *
15536  * Note that when multiple IP addresses match e.g., #1 we pick
15537  * the first one if IPMP is not in use. With IPMP we randomize.
15538  */
15539 int
ip_select_source_v4(ill_t * ill,ipaddr_t setsrc,ipaddr_t dst,ipaddr_t multicast_ifaddr,zoneid_t zoneid,ip_stack_t * ipst,ipaddr_t * srcp,uint32_t * generation,uint64_t * flagsp)15540 ip_select_source_v4(ill_t *ill, ipaddr_t setsrc, ipaddr_t dst,
15541     ipaddr_t multicast_ifaddr,
15542     zoneid_t zoneid, ip_stack_t *ipst, ipaddr_t *srcp,
15543     uint32_t *generation, uint64_t *flagsp)
15544 {
15545 	ipif_t *ipif;
15546 	boolean_t notready = B_FALSE;	/* Set if !ipif_addr_ready found */
15547 
15548 	if (flagsp != NULL)
15549 		*flagsp = 0;
15550 
15551 	/*
15552 	 * Need to grab the generation number before we check to
15553 	 * avoid a race with a change to the set of local addresses.
15554 	 * No lock needed since the thread which updates the set of local
15555 	 * addresses use ipif/ill locks and exit those (hence a store memory
15556 	 * barrier) before doing the atomic increase of ips_src_generation.
15557 	 */
15558 	if (generation != NULL) {
15559 		*generation = ipst->ips_src_generation;
15560 	}
15561 
15562 	if (CLASSD(dst) && multicast_ifaddr != INADDR_ANY) {
15563 		*srcp = multicast_ifaddr;
15564 		return (0);
15565 	}
15566 
15567 	/* Was RTF_SETSRC set on the first IRE in the recursive lookup? */
15568 	if (setsrc != INADDR_ANY) {
15569 		*srcp = setsrc;
15570 		return (0);
15571 	}
15572 	ipif = ipif_select_source_v4(ill, dst, zoneid, B_TRUE, &notready);
15573 	if (ipif == NULL) {
15574 		if (notready)
15575 			return (ENETDOWN);
15576 		else
15577 			return (EADDRNOTAVAIL);
15578 	}
15579 	*srcp = ipif->ipif_lcl_addr;
15580 	if (flagsp != NULL)
15581 		*flagsp = ipif->ipif_flags;
15582 	ipif_refrele(ipif);
15583 	return (0);
15584 }
15585 
15586 /* ARGSUSED */
15587 int
if_unitsel_restart(ipif_t * ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_ifreq)15588 if_unitsel_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
15589 	ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15590 {
15591 	/*
15592 	 * ill_phyint_reinit merged the v4 and v6 into a single
15593 	 * ipsq.  We might not have been able to complete the
15594 	 * operation in ipif_set_values, if we could not become
15595 	 * exclusive.  If so restart it here.
15596 	 */
15597 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
15598 }
15599 
15600 /*
15601  * Can operate on either a module or a driver queue.
15602  * Returns an error if not a module queue.
15603  */
15604 /* ARGSUSED */
15605 int
if_unitsel(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_ifreq)15606 if_unitsel(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
15607     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15608 {
15609 	queue_t		*q1 = q;
15610 	char 		*cp;
15611 	char		interf_name[LIFNAMSIZ];
15612 	uint_t		ppa = *(uint_t *)mp->b_cont->b_cont->b_rptr;
15613 
15614 	if (q->q_next == NULL) {
15615 		ip1dbg((
15616 		    "if_unitsel: IF_UNITSEL: no q_next\n"));
15617 		return (EINVAL);
15618 	}
15619 
15620 	if (((ill_t *)(q->q_ptr))->ill_name[0] != '\0')
15621 		return (EALREADY);
15622 
15623 	do {
15624 		q1 = q1->q_next;
15625 	} while (q1->q_next);
15626 	cp = q1->q_qinfo->qi_minfo->mi_idname;
15627 	(void) sprintf(interf_name, "%s%d", cp, ppa);
15628 
15629 	/*
15630 	 * Here we are not going to delay the ioack until after
15631 	 * ACKs from DL_ATTACH_REQ/DL_BIND_REQ. So no need to save the
15632 	 * original ioctl message before sending the requests.
15633 	 */
15634 	return (ipif_set_values(q, mp, interf_name, &ppa));
15635 }
15636 
15637 /* ARGSUSED */
15638 int
ip_sioctl_sifname(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_ifreq)15639 ip_sioctl_sifname(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
15640     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15641 {
15642 	return (ENXIO);
15643 }
15644 
15645 /*
15646  * Create any IRE_BROADCAST entries for `ipif', and store those entries in
15647  * `irep'.  Returns a pointer to the next free `irep' entry
15648  * A mirror exists in ipif_delete_bcast_ires().
15649  *
15650  * The management of any "extra" or seemingly duplicate IRE_BROADCASTs is
15651  * done in ire_add.
15652  */
15653 static ire_t **
ipif_create_bcast_ires(ipif_t * ipif,ire_t ** irep)15654 ipif_create_bcast_ires(ipif_t *ipif, ire_t **irep)
15655 {
15656 	ipaddr_t addr;
15657 	ipaddr_t netmask = ip_net_mask(ipif->ipif_lcl_addr);
15658 	ipaddr_t subnetmask = ipif->ipif_net_mask;
15659 	ill_t *ill = ipif->ipif_ill;
15660 	zoneid_t zoneid = ipif->ipif_zoneid;
15661 
15662 	ip1dbg(("ipif_create_bcast_ires: creating broadcast IREs\n"));
15663 
15664 	ASSERT(ipif->ipif_flags & IPIF_BROADCAST);
15665 	ASSERT(!(ipif->ipif_flags & IPIF_NOXMIT));
15666 
15667 	if (ipif->ipif_lcl_addr == INADDR_ANY ||
15668 	    (ipif->ipif_flags & IPIF_NOLOCAL))
15669 		netmask = htonl(IN_CLASSA_NET);		/* fallback */
15670 
15671 	irep = ire_create_bcast(ill, 0, zoneid, irep);
15672 	irep = ire_create_bcast(ill, INADDR_BROADCAST, zoneid, irep);
15673 
15674 	/*
15675 	 * For backward compatibility, we create net broadcast IREs based on
15676 	 * the old "IP address class system", since some old machines only
15677 	 * respond to these class derived net broadcast.  However, we must not
15678 	 * create these net broadcast IREs if the subnetmask is shorter than
15679 	 * the IP address class based derived netmask.  Otherwise, we may
15680 	 * create a net broadcast address which is the same as an IP address
15681 	 * on the subnet -- and then TCP will refuse to talk to that address.
15682 	 */
15683 	if (netmask < subnetmask) {
15684 		addr = netmask & ipif->ipif_subnet;
15685 		irep = ire_create_bcast(ill, addr, zoneid, irep);
15686 		irep = ire_create_bcast(ill, ~netmask | addr, zoneid, irep);
15687 	}
15688 
15689 	/*
15690 	 * Don't create IRE_BROADCAST IREs for the interface if the subnetmask
15691 	 * is 0xFFFFFFFF, as an IRE_LOCAL for that interface is already
15692 	 * created.  Creating these broadcast IREs will only create confusion
15693 	 * as `addr' will be the same as the IP address.
15694 	 */
15695 	if (subnetmask != 0xFFFFFFFF) {
15696 		addr = ipif->ipif_subnet;
15697 		irep = ire_create_bcast(ill, addr, zoneid, irep);
15698 		irep = ire_create_bcast(ill, ~subnetmask | addr, zoneid, irep);
15699 	}
15700 
15701 	return (irep);
15702 }
15703 
15704 /*
15705  * Mirror of ipif_create_bcast_ires()
15706  */
15707 static void
ipif_delete_bcast_ires(ipif_t * ipif)15708 ipif_delete_bcast_ires(ipif_t *ipif)
15709 {
15710 	ipaddr_t	addr;
15711 	ipaddr_t	netmask = ip_net_mask(ipif->ipif_lcl_addr);
15712 	ipaddr_t	subnetmask = ipif->ipif_net_mask;
15713 	ill_t		*ill = ipif->ipif_ill;
15714 	zoneid_t	zoneid = ipif->ipif_zoneid;
15715 	ire_t		*ire;
15716 
15717 	ASSERT(ipif->ipif_flags & IPIF_BROADCAST);
15718 	ASSERT(!(ipif->ipif_flags & IPIF_NOXMIT));
15719 
15720 	if (ipif->ipif_lcl_addr == INADDR_ANY ||
15721 	    (ipif->ipif_flags & IPIF_NOLOCAL))
15722 		netmask = htonl(IN_CLASSA_NET);		/* fallback */
15723 
15724 	ire = ire_lookup_bcast(ill, 0, zoneid);
15725 	ASSERT(ire != NULL);
15726 	ire_delete(ire); ire_refrele(ire);
15727 	ire = ire_lookup_bcast(ill, INADDR_BROADCAST, zoneid);
15728 	ASSERT(ire != NULL);
15729 	ire_delete(ire); ire_refrele(ire);
15730 
15731 	/*
15732 	 * For backward compatibility, we create net broadcast IREs based on
15733 	 * the old "IP address class system", since some old machines only
15734 	 * respond to these class derived net broadcast.  However, we must not
15735 	 * create these net broadcast IREs if the subnetmask is shorter than
15736 	 * the IP address class based derived netmask.  Otherwise, we may
15737 	 * create a net broadcast address which is the same as an IP address
15738 	 * on the subnet -- and then TCP will refuse to talk to that address.
15739 	 */
15740 	if (netmask < subnetmask) {
15741 		addr = netmask & ipif->ipif_subnet;
15742 		ire = ire_lookup_bcast(ill, addr, zoneid);
15743 		ASSERT(ire != NULL);
15744 		ire_delete(ire); ire_refrele(ire);
15745 		ire = ire_lookup_bcast(ill, ~netmask | addr, zoneid);
15746 		ASSERT(ire != NULL);
15747 		ire_delete(ire); ire_refrele(ire);
15748 	}
15749 
15750 	/*
15751 	 * Don't create IRE_BROADCAST IREs for the interface if the subnetmask
15752 	 * is 0xFFFFFFFF, as an IRE_LOCAL for that interface is already
15753 	 * created.  Creating these broadcast IREs will only create confusion
15754 	 * as `addr' will be the same as the IP address.
15755 	 */
15756 	if (subnetmask != 0xFFFFFFFF) {
15757 		addr = ipif->ipif_subnet;
15758 		ire = ire_lookup_bcast(ill, addr, zoneid);
15759 		ASSERT(ire != NULL);
15760 		ire_delete(ire); ire_refrele(ire);
15761 		ire = ire_lookup_bcast(ill, ~subnetmask | addr, zoneid);
15762 		ASSERT(ire != NULL);
15763 		ire_delete(ire); ire_refrele(ire);
15764 	}
15765 }
15766 
15767 /*
15768  * Extract both the flags (including IFF_CANTCHANGE) such as IFF_IPV*
15769  * from lifr_flags and the name from lifr_name.
15770  * Set IFF_IPV* and ill_isv6 prior to doing the lookup
15771  * since ipif_lookup_on_name uses the _isv6 flags when matching.
15772  * Returns EINPROGRESS when mp has been consumed by queueing it on
15773  * ipx_pending_mp and the ioctl will complete in ip_rput.
15774  *
15775  * Can operate on either a module or a driver queue.
15776  * Returns an error if not a module queue.
15777  */
15778 /* ARGSUSED */
15779 int
ip_sioctl_slifname(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)15780 ip_sioctl_slifname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15781     ip_ioctl_cmd_t *ipip, void *if_req)
15782 {
15783 	ill_t	*ill = q->q_ptr;
15784 	phyint_t *phyi;
15785 	ip_stack_t *ipst;
15786 	struct lifreq *lifr = if_req;
15787 	uint64_t new_flags;
15788 
15789 	ASSERT(ipif != NULL);
15790 	ip1dbg(("ip_sioctl_slifname %s\n", lifr->lifr_name));
15791 
15792 	if (q->q_next == NULL) {
15793 		ip1dbg(("if_sioctl_slifname: SIOCSLIFNAME: no q_next\n"));
15794 		return (EINVAL);
15795 	}
15796 
15797 	/*
15798 	 * If we are not writer on 'q' then this interface exists already
15799 	 * and previous lookups (ip_extract_lifreq()) found this ipif --
15800 	 * so return EALREADY.
15801 	 */
15802 	if (ill != ipif->ipif_ill)
15803 		return (EALREADY);
15804 
15805 	if (ill->ill_name[0] != '\0')
15806 		return (EALREADY);
15807 
15808 	/*
15809 	 * If there's another ill already with the requested name, ensure
15810 	 * that it's of the same type.  Otherwise, ill_phyint_reinit() will
15811 	 * fuse together two unrelated ills, which will cause chaos.
15812 	 */
15813 	ipst = ill->ill_ipst;
15814 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
15815 	    lifr->lifr_name, NULL);
15816 	if (phyi != NULL) {
15817 		ill_t *ill_mate = phyi->phyint_illv4;
15818 
15819 		if (ill_mate == NULL)
15820 			ill_mate = phyi->phyint_illv6;
15821 		ASSERT(ill_mate != NULL);
15822 
15823 		if (ill_mate->ill_media->ip_m_mac_type !=
15824 		    ill->ill_media->ip_m_mac_type) {
15825 			ip1dbg(("if_sioctl_slifname: SIOCSLIFNAME: attempt to "
15826 			    "use the same ill name on differing media\n"));
15827 			return (EINVAL);
15828 		}
15829 	}
15830 
15831 	/*
15832 	 * We start off as IFF_IPV4 in ipif_allocate and become
15833 	 * IFF_IPV4 or IFF_IPV6 here depending  on lifr_flags value.
15834 	 * The only flags that we read from user space are IFF_IPV4,
15835 	 * IFF_IPV6, and IFF_BROADCAST.
15836 	 *
15837 	 * This ill has not been inserted into the global list.
15838 	 * So we are still single threaded and don't need any lock
15839 	 *
15840 	 * Saniy check the flags.
15841 	 */
15842 
15843 	if ((lifr->lifr_flags & IFF_BROADCAST) &&
15844 	    ((lifr->lifr_flags & IFF_IPV6) ||
15845 	    (!ill->ill_needs_attach && ill->ill_bcast_addr_length == 0))) {
15846 		ip1dbg(("ip_sioctl_slifname: link not broadcast capable "
15847 		    "or IPv6 i.e., no broadcast \n"));
15848 		return (EINVAL);
15849 	}
15850 
15851 	new_flags =
15852 	    lifr->lifr_flags & (IFF_IPV6|IFF_IPV4|IFF_BROADCAST);
15853 
15854 	if ((new_flags ^ (IFF_IPV6|IFF_IPV4)) == 0) {
15855 		ip1dbg(("ip_sioctl_slifname: flags must be exactly one of "
15856 		    "IFF_IPV4 or IFF_IPV6\n"));
15857 		return (EINVAL);
15858 	}
15859 
15860 	/*
15861 	 * We always start off as IPv4, so only need to check for IPv6.
15862 	 */
15863 	if ((new_flags & IFF_IPV6) != 0) {
15864 		ill->ill_flags |= ILLF_IPV6;
15865 		ill->ill_flags &= ~ILLF_IPV4;
15866 
15867 		if (lifr->lifr_flags & IFF_NOLINKLOCAL)
15868 			ill->ill_flags |= ILLF_NOLINKLOCAL;
15869 	}
15870 
15871 	if ((new_flags & IFF_BROADCAST) != 0)
15872 		ipif->ipif_flags |= IPIF_BROADCAST;
15873 	else
15874 		ipif->ipif_flags &= ~IPIF_BROADCAST;
15875 
15876 	/* We started off as V4. */
15877 	if (ill->ill_flags & ILLF_IPV6) {
15878 		ill->ill_phyint->phyint_illv6 = ill;
15879 		ill->ill_phyint->phyint_illv4 = NULL;
15880 	}
15881 
15882 	return (ipif_set_values(q, mp, lifr->lifr_name, &lifr->lifr_ppa));
15883 }
15884 
15885 /* ARGSUSED */
15886 int
ip_sioctl_slifname_restart(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)15887 ip_sioctl_slifname_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15888     ip_ioctl_cmd_t *ipip, void *if_req)
15889 {
15890 	/*
15891 	 * ill_phyint_reinit merged the v4 and v6 into a single
15892 	 * ipsq.  We might not have been able to complete the
15893 	 * slifname in ipif_set_values, if we could not become
15894 	 * exclusive.  If so restart it here
15895 	 */
15896 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
15897 }
15898 
15899 /*
15900  * Return a pointer to the ipif which matches the index, IP version type and
15901  * zoneid.
15902  */
15903 ipif_t *
ipif_lookup_on_ifindex(uint_t index,boolean_t isv6,zoneid_t zoneid,ip_stack_t * ipst)15904 ipif_lookup_on_ifindex(uint_t index, boolean_t isv6, zoneid_t zoneid,
15905     ip_stack_t *ipst)
15906 {
15907 	ill_t	*ill;
15908 	ipif_t	*ipif = NULL;
15909 
15910 	ill = ill_lookup_on_ifindex(index, isv6, ipst);
15911 	if (ill != NULL) {
15912 		mutex_enter(&ill->ill_lock);
15913 		for (ipif = ill->ill_ipif; ipif != NULL;
15914 		    ipif = ipif->ipif_next) {
15915 			if (!IPIF_IS_CONDEMNED(ipif) && (zoneid == ALL_ZONES ||
15916 			    zoneid == ipif->ipif_zoneid ||
15917 			    ipif->ipif_zoneid == ALL_ZONES)) {
15918 				ipif_refhold_locked(ipif);
15919 				break;
15920 			}
15921 		}
15922 		mutex_exit(&ill->ill_lock);
15923 		ill_refrele(ill);
15924 	}
15925 	return (ipif);
15926 }
15927 
15928 /*
15929  * Change an existing physical interface's index. If the new index
15930  * is acceptable we update the index and the phyint_list_avl_by_index tree.
15931  * Finally, we update other systems which may have a dependence on the
15932  * index value.
15933  */
15934 /* ARGSUSED */
15935 int
ip_sioctl_slifindex(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)15936 ip_sioctl_slifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15937     ip_ioctl_cmd_t *ipip, void *ifreq)
15938 {
15939 	ill_t		*ill;
15940 	phyint_t	*phyi;
15941 	struct ifreq	*ifr = (struct ifreq *)ifreq;
15942 	struct lifreq	*lifr = (struct lifreq *)ifreq;
15943 	uint_t	old_index, index;
15944 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
15945 	avl_index_t	where;
15946 
15947 	if (ipip->ipi_cmd_type == IF_CMD)
15948 		index = ifr->ifr_index;
15949 	else
15950 		index = lifr->lifr_index;
15951 
15952 	/*
15953 	 * Only allow on physical interface. Also, index zero is illegal.
15954 	 */
15955 	ill = ipif->ipif_ill;
15956 	phyi = ill->ill_phyint;
15957 	if (ipif->ipif_id != 0 || index == 0 || index > IF_INDEX_MAX) {
15958 		return (EINVAL);
15959 	}
15960 
15961 	/* If the index is not changing, no work to do */
15962 	if (phyi->phyint_ifindex == index)
15963 		return (0);
15964 
15965 	/*
15966 	 * Use phyint_exists() to determine if the new interface index
15967 	 * is already in use. If the index is unused then we need to
15968 	 * change the phyint's position in the phyint_list_avl_by_index
15969 	 * tree. If we do not do this, subsequent lookups (using the new
15970 	 * index value) will not find the phyint.
15971 	 */
15972 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15973 	if (phyint_exists(index, ipst)) {
15974 		rw_exit(&ipst->ips_ill_g_lock);
15975 		return (EEXIST);
15976 	}
15977 
15978 	/*
15979 	 * The new index is unused. Set it in the phyint. However we must not
15980 	 * forget to trigger NE_IFINDEX_CHANGE event before the ifindex
15981 	 * changes. The event must be bound to old ifindex value.
15982 	 */
15983 	ill_nic_event_dispatch(ill, 0, NE_IFINDEX_CHANGE,
15984 	    &index, sizeof (index));
15985 
15986 	old_index = phyi->phyint_ifindex;
15987 	phyi->phyint_ifindex = index;
15988 
15989 	avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_index, phyi);
15990 	(void) avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
15991 	    &index, &where);
15992 	avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
15993 	    phyi, where);
15994 	rw_exit(&ipst->ips_ill_g_lock);
15995 
15996 	/* Update SCTP's ILL list */
15997 	sctp_ill_reindex(ill, old_index);
15998 
15999 	/* Send the routing sockets message */
16000 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
16001 	if (ILL_OTHER(ill))
16002 		ip_rts_ifmsg(ILL_OTHER(ill)->ill_ipif, RTSQ_DEFAULT);
16003 
16004 	/* Perhaps ilgs should use this ill */
16005 	update_conn_ill(NULL, ill->ill_ipst);
16006 	return (0);
16007 }
16008 
16009 /* ARGSUSED */
16010 int
ip_sioctl_get_lifindex(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)16011 ip_sioctl_get_lifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16012     ip_ioctl_cmd_t *ipip, void *ifreq)
16013 {
16014 	struct ifreq	*ifr = (struct ifreq *)ifreq;
16015 	struct lifreq	*lifr = (struct lifreq *)ifreq;
16016 
16017 	ip1dbg(("ip_sioctl_get_lifindex(%s:%u %p)\n",
16018 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16019 	/* Get the interface index */
16020 	if (ipip->ipi_cmd_type == IF_CMD) {
16021 		ifr->ifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
16022 	} else {
16023 		lifr->lifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
16024 	}
16025 	return (0);
16026 }
16027 
16028 /* ARGSUSED */
16029 int
ip_sioctl_get_lifzone(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)16030 ip_sioctl_get_lifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16031     ip_ioctl_cmd_t *ipip, void *ifreq)
16032 {
16033 	struct lifreq	*lifr = (struct lifreq *)ifreq;
16034 
16035 	ip1dbg(("ip_sioctl_get_lifzone(%s:%u %p)\n",
16036 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16037 	/* Get the interface zone */
16038 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
16039 	lifr->lifr_zoneid = ipif->ipif_zoneid;
16040 	return (0);
16041 }
16042 
16043 /*
16044  * Set the zoneid of an interface.
16045  */
16046 /* ARGSUSED */
16047 int
ip_sioctl_slifzone(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)16048 ip_sioctl_slifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16049     ip_ioctl_cmd_t *ipip, void *ifreq)
16050 {
16051 	struct lifreq	*lifr = (struct lifreq *)ifreq;
16052 	int err = 0;
16053 	boolean_t need_up = B_FALSE;
16054 	zone_t *zptr;
16055 	zone_status_t status;
16056 	zoneid_t zoneid;
16057 
16058 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
16059 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES) {
16060 		if (!is_system_labeled())
16061 			return (ENOTSUP);
16062 		zoneid = GLOBAL_ZONEID;
16063 	}
16064 
16065 	/* cannot assign instance zero to a non-global zone */
16066 	if (ipif->ipif_id == 0 && zoneid != GLOBAL_ZONEID)
16067 		return (ENOTSUP);
16068 
16069 	/*
16070 	 * Cannot assign to a zone that doesn't exist or is shutting down.  In
16071 	 * the event of a race with the zone shutdown processing, since IP
16072 	 * serializes this ioctl and SIOCGLIFCONF/SIOCLIFREMOVEIF, we know the
16073 	 * interface will be cleaned up even if the zone is shut down
16074 	 * immediately after the status check. If the interface can't be brought
16075 	 * down right away, and the zone is shut down before the restart
16076 	 * function is called, we resolve the possible races by rechecking the
16077 	 * zone status in the restart function.
16078 	 */
16079 	if ((zptr = zone_find_by_id(zoneid)) == NULL)
16080 		return (EINVAL);
16081 	status = zone_status_get(zptr);
16082 	zone_rele(zptr);
16083 
16084 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING)
16085 		return (EINVAL);
16086 
16087 	if (ipif->ipif_flags & IPIF_UP) {
16088 		/*
16089 		 * If the interface is already marked up,
16090 		 * we call ipif_down which will take care
16091 		 * of ditching any IREs that have been set
16092 		 * up based on the old interface address.
16093 		 */
16094 		err = ipif_logical_down(ipif, q, mp);
16095 		if (err == EINPROGRESS)
16096 			return (err);
16097 		(void) ipif_down_tail(ipif);
16098 		need_up = B_TRUE;
16099 	}
16100 
16101 	err = ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp, need_up);
16102 	return (err);
16103 }
16104 
16105 static int
ip_sioctl_slifzone_tail(ipif_t * ipif,zoneid_t zoneid,queue_t * q,mblk_t * mp,boolean_t need_up)16106 ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
16107     queue_t *q, mblk_t *mp, boolean_t need_up)
16108 {
16109 	int	err = 0;
16110 	ip_stack_t	*ipst;
16111 
16112 	ip1dbg(("ip_sioctl_zoneid_tail(%s:%u %p)\n",
16113 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16114 
16115 	if (CONN_Q(q))
16116 		ipst = CONNQ_TO_IPST(q);
16117 	else
16118 		ipst = ILLQ_TO_IPST(q);
16119 
16120 	/*
16121 	 * For exclusive stacks we don't allow a different zoneid than
16122 	 * global.
16123 	 */
16124 	if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID &&
16125 	    zoneid != GLOBAL_ZONEID)
16126 		return (EINVAL);
16127 
16128 	/* Set the new zone id. */
16129 	ipif->ipif_zoneid = zoneid;
16130 
16131 	/* Update sctp list */
16132 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
16133 
16134 	/* The default multicast interface might have changed */
16135 	ire_increment_multicast_generation(ipst, ipif->ipif_ill->ill_isv6);
16136 
16137 	if (need_up) {
16138 		/*
16139 		 * Now bring the interface back up.  If this
16140 		 * is the only IPIF for the ILL, ipif_up
16141 		 * will have to re-bind to the device, so
16142 		 * we may get back EINPROGRESS, in which
16143 		 * case, this IOCTL will get completed in
16144 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
16145 		 */
16146 		err = ipif_up(ipif, q, mp);
16147 	}
16148 	return (err);
16149 }
16150 
16151 /* ARGSUSED */
16152 int
ip_sioctl_slifzone_restart(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)16153 ip_sioctl_slifzone_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16154     ip_ioctl_cmd_t *ipip, void *if_req)
16155 {
16156 	struct lifreq *lifr = (struct lifreq *)if_req;
16157 	zoneid_t zoneid;
16158 	zone_t *zptr;
16159 	zone_status_t status;
16160 
16161 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
16162 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES)
16163 		zoneid = GLOBAL_ZONEID;
16164 
16165 	ip1dbg(("ip_sioctl_slifzone_restart(%s:%u %p)\n",
16166 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16167 
16168 	/*
16169 	 * We recheck the zone status to resolve the following race condition:
16170 	 * 1) process sends SIOCSLIFZONE to put hme0:1 in zone "myzone";
16171 	 * 2) hme0:1 is up and can't be brought down right away;
16172 	 * ip_sioctl_slifzone() returns EINPROGRESS and the request is queued;
16173 	 * 3) zone "myzone" is halted; the zone status switches to
16174 	 * 'shutting_down' and the zones framework sends SIOCGLIFCONF to list
16175 	 * the interfaces to remove - hme0:1 is not returned because it's not
16176 	 * yet in "myzone", so it won't be removed;
16177 	 * 4) the restart function for SIOCSLIFZONE is called; without the
16178 	 * status check here, we would have hme0:1 in "myzone" after it's been
16179 	 * destroyed.
16180 	 * Note that if the status check fails, we need to bring the interface
16181 	 * back to its state prior to ip_sioctl_slifzone(), hence the call to
16182 	 * ipif_up_done[_v6]().
16183 	 */
16184 	status = ZONE_IS_UNINITIALIZED;
16185 	if ((zptr = zone_find_by_id(zoneid)) != NULL) {
16186 		status = zone_status_get(zptr);
16187 		zone_rele(zptr);
16188 	}
16189 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING) {
16190 		if (ipif->ipif_isv6) {
16191 			(void) ipif_up_done_v6(ipif);
16192 		} else {
16193 			(void) ipif_up_done(ipif);
16194 		}
16195 		return (EINVAL);
16196 	}
16197 
16198 	(void) ipif_down_tail(ipif);
16199 
16200 	return (ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp,
16201 	    B_TRUE));
16202 }
16203 
16204 /*
16205  * Return the number of addresses on `ill' with one or more of the values
16206  * in `set' set and all of the values in `clear' clear.
16207  */
16208 static uint_t
ill_flagaddr_cnt(const ill_t * ill,uint64_t set,uint64_t clear)16209 ill_flagaddr_cnt(const ill_t *ill, uint64_t set, uint64_t clear)
16210 {
16211 	ipif_t	*ipif;
16212 	uint_t	cnt = 0;
16213 
16214 	ASSERT(IAM_WRITER_ILL(ill));
16215 
16216 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
16217 		if ((ipif->ipif_flags & set) && !(ipif->ipif_flags & clear))
16218 			cnt++;
16219 
16220 	return (cnt);
16221 }
16222 
16223 /*
16224  * Return the number of migratable addresses on `ill' that are under
16225  * application control.
16226  */
16227 uint_t
ill_appaddr_cnt(const ill_t * ill)16228 ill_appaddr_cnt(const ill_t *ill)
16229 {
16230 	return (ill_flagaddr_cnt(ill, IPIF_DHCPRUNNING | IPIF_ADDRCONF,
16231 	    IPIF_NOFAILOVER));
16232 }
16233 
16234 /*
16235  * Return the number of point-to-point addresses on `ill'.
16236  */
16237 uint_t
ill_ptpaddr_cnt(const ill_t * ill)16238 ill_ptpaddr_cnt(const ill_t *ill)
16239 {
16240 	return (ill_flagaddr_cnt(ill, IPIF_POINTOPOINT, 0));
16241 }
16242 
16243 /* ARGSUSED */
16244 int
ip_sioctl_get_lifusesrc(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)16245 ip_sioctl_get_lifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16246 	ip_ioctl_cmd_t *ipip, void *ifreq)
16247 {
16248 	struct lifreq	*lifr = ifreq;
16249 
16250 	ASSERT(q->q_next == NULL);
16251 	ASSERT(CONN_Q(q));
16252 
16253 	ip1dbg(("ip_sioctl_get_lifusesrc(%s:%u %p)\n",
16254 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16255 	lifr->lifr_index = ipif->ipif_ill->ill_usesrc_ifindex;
16256 	ip1dbg(("ip_sioctl_get_lifusesrc:lifr_index = %d\n", lifr->lifr_index));
16257 
16258 	return (0);
16259 }
16260 
16261 /* Find the previous ILL in this usesrc group */
16262 static ill_t *
ill_prev_usesrc(ill_t * uill)16263 ill_prev_usesrc(ill_t *uill)
16264 {
16265 	ill_t *ill;
16266 
16267 	for (ill = uill->ill_usesrc_grp_next;
16268 	    ASSERT(ill), ill->ill_usesrc_grp_next != uill;
16269 	    ill = ill->ill_usesrc_grp_next)
16270 		/* do nothing */;
16271 	return (ill);
16272 }
16273 
16274 /*
16275  * Release all members of the usesrc group. This routine is called
16276  * from ill_delete when the interface being unplumbed is the
16277  * group head.
16278  *
16279  * This silently clears the usesrc that ifconfig setup.
16280  * An alternative would be to keep that ifindex, and drop packets on the floor
16281  * since no source address can be selected.
16282  * Even if we keep the current semantics, don't need a lock and a linked list.
16283  * Can walk all the ills checking if they have a ill_usesrc_ifindex matching
16284  * the one that is being removed. Issue is how we return the usesrc users
16285  * (SIOCGLIFSRCOF). We want to be able to find the ills which have an
16286  * ill_usesrc_ifindex matching a target ill. We could also do that with an
16287  * ill walk, but the walker would need to insert in the ioctl response.
16288  */
16289 static void
ill_disband_usesrc_group(ill_t * uill)16290 ill_disband_usesrc_group(ill_t *uill)
16291 {
16292 	ill_t *next_ill, *tmp_ill;
16293 	ip_stack_t	*ipst = uill->ill_ipst;
16294 
16295 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_usesrc_lock));
16296 	next_ill = uill->ill_usesrc_grp_next;
16297 
16298 	do {
16299 		ASSERT(next_ill != NULL);
16300 		tmp_ill = next_ill->ill_usesrc_grp_next;
16301 		ASSERT(tmp_ill != NULL);
16302 		next_ill->ill_usesrc_grp_next = NULL;
16303 		next_ill->ill_usesrc_ifindex = 0;
16304 		next_ill = tmp_ill;
16305 	} while (next_ill->ill_usesrc_ifindex != 0);
16306 	uill->ill_usesrc_grp_next = NULL;
16307 }
16308 
16309 /*
16310  * Remove the client usesrc ILL from the list and relink to a new list
16311  */
16312 int
ill_relink_usesrc_ills(ill_t * ucill,ill_t * uill,uint_t ifindex)16313 ill_relink_usesrc_ills(ill_t *ucill, ill_t *uill, uint_t ifindex)
16314 {
16315 	ill_t *ill, *tmp_ill;
16316 	ip_stack_t	*ipst = ucill->ill_ipst;
16317 
16318 	ASSERT((ucill != NULL) && (ucill->ill_usesrc_grp_next != NULL) &&
16319 	    (uill != NULL) && RW_WRITE_HELD(&ipst->ips_ill_g_usesrc_lock));
16320 
16321 	/*
16322 	 * Check if the usesrc client ILL passed in is not already
16323 	 * in use as a usesrc ILL i.e one whose source address is
16324 	 * in use OR a usesrc ILL is not already in use as a usesrc
16325 	 * client ILL
16326 	 */
16327 	if ((ucill->ill_usesrc_ifindex == 0) ||
16328 	    (uill->ill_usesrc_ifindex != 0)) {
16329 		return (-1);
16330 	}
16331 
16332 	ill = ill_prev_usesrc(ucill);
16333 	ASSERT(ill->ill_usesrc_grp_next != NULL);
16334 
16335 	/* Remove from the current list */
16336 	if (ill->ill_usesrc_grp_next->ill_usesrc_grp_next == ill) {
16337 		/* Only two elements in the list */
16338 		ASSERT(ill->ill_usesrc_ifindex == 0);
16339 		ill->ill_usesrc_grp_next = NULL;
16340 	} else {
16341 		ill->ill_usesrc_grp_next = ucill->ill_usesrc_grp_next;
16342 	}
16343 
16344 	if (ifindex == 0) {
16345 		ucill->ill_usesrc_ifindex = 0;
16346 		ucill->ill_usesrc_grp_next = NULL;
16347 		return (0);
16348 	}
16349 
16350 	ucill->ill_usesrc_ifindex = ifindex;
16351 	tmp_ill = uill->ill_usesrc_grp_next;
16352 	uill->ill_usesrc_grp_next = ucill;
16353 	ucill->ill_usesrc_grp_next =
16354 	    (tmp_ill != NULL) ? tmp_ill : uill;
16355 	return (0);
16356 }
16357 
16358 /*
16359  * Set the ill_usesrc and ill_usesrc_head fields. See synchronization notes in
16360  * ip.c for locking details.
16361  */
16362 /* ARGSUSED */
16363 int
ip_sioctl_slifusesrc(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)16364 ip_sioctl_slifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16365     ip_ioctl_cmd_t *ipip, void *ifreq)
16366 {
16367 	struct lifreq *lifr = (struct lifreq *)ifreq;
16368 	boolean_t isv6 = B_FALSE, reset_flg = B_FALSE;
16369 	ill_t *usesrc_ill, *usesrc_cli_ill = ipif->ipif_ill;
16370 	int err = 0, ret;
16371 	uint_t ifindex;
16372 	ipsq_t *ipsq = NULL;
16373 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
16374 
16375 	ASSERT(IAM_WRITER_IPIF(ipif));
16376 	ASSERT(q->q_next == NULL);
16377 	ASSERT(CONN_Q(q));
16378 
16379 	isv6 = (Q_TO_CONN(q))->conn_family == AF_INET6;
16380 
16381 	ifindex = lifr->lifr_index;
16382 	if (ifindex == 0) {
16383 		if (usesrc_cli_ill->ill_usesrc_grp_next == NULL) {
16384 			/* non usesrc group interface, nothing to reset */
16385 			return (0);
16386 		}
16387 		ifindex = usesrc_cli_ill->ill_usesrc_ifindex;
16388 		/* valid reset request */
16389 		reset_flg = B_TRUE;
16390 	}
16391 
16392 	usesrc_ill = ill_lookup_on_ifindex(ifindex, isv6, ipst);
16393 	if (usesrc_ill == NULL)
16394 		return (ENXIO);
16395 	if (usesrc_ill == ipif->ipif_ill) {
16396 		ill_refrele(usesrc_ill);
16397 		return (EINVAL);
16398 	}
16399 
16400 	ipsq = ipsq_try_enter(NULL, usesrc_ill, q, mp, ip_process_ioctl,
16401 	    NEW_OP, B_TRUE);
16402 	if (ipsq == NULL) {
16403 		err = EINPROGRESS;
16404 		/* Operation enqueued on the ipsq of the usesrc ILL */
16405 		goto done;
16406 	}
16407 
16408 	/* USESRC isn't currently supported with IPMP */
16409 	if (IS_IPMP(usesrc_ill) || IS_UNDER_IPMP(usesrc_ill)) {
16410 		err = ENOTSUP;
16411 		goto done;
16412 	}
16413 
16414 	/*
16415 	 * USESRC isn't compatible with the STANDBY flag.  (STANDBY is only
16416 	 * used by IPMP underlying interfaces, but someone might think it's
16417 	 * more general and try to use it independently with VNI.)
16418 	 */
16419 	if (usesrc_ill->ill_phyint->phyint_flags & PHYI_STANDBY) {
16420 		err = ENOTSUP;
16421 		goto done;
16422 	}
16423 
16424 	/*
16425 	 * If the client is already in use as a usesrc_ill or a usesrc_ill is
16426 	 * already a client then return EINVAL
16427 	 */
16428 	if (IS_USESRC_ILL(usesrc_cli_ill) || IS_USESRC_CLI_ILL(usesrc_ill)) {
16429 		err = EINVAL;
16430 		goto done;
16431 	}
16432 
16433 	/*
16434 	 * If the ill_usesrc_ifindex field is already set to what it needs to
16435 	 * be then this is a duplicate operation.
16436 	 */
16437 	if (!reset_flg && usesrc_cli_ill->ill_usesrc_ifindex == ifindex) {
16438 		err = 0;
16439 		goto done;
16440 	}
16441 
16442 	ip1dbg(("ip_sioctl_slifusesrc: usesrc_cli_ill %s, usesrc_ill %s,"
16443 	    " v6 = %d", usesrc_cli_ill->ill_name, usesrc_ill->ill_name,
16444 	    usesrc_ill->ill_isv6));
16445 
16446 	/*
16447 	 * ill_g_usesrc_lock global lock protects the ill_usesrc_grp_next
16448 	 * and the ill_usesrc_ifindex fields
16449 	 */
16450 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
16451 
16452 	if (reset_flg) {
16453 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill, 0);
16454 		if (ret != 0) {
16455 			err = EINVAL;
16456 		}
16457 		rw_exit(&ipst->ips_ill_g_usesrc_lock);
16458 		goto done;
16459 	}
16460 
16461 	/*
16462 	 * Four possibilities to consider:
16463 	 * 1. Both usesrc_ill and usesrc_cli_ill are not part of any usesrc grp
16464 	 * 2. usesrc_ill is part of a group but usesrc_cli_ill isn't
16465 	 * 3. usesrc_cli_ill is part of a group but usesrc_ill isn't
16466 	 * 4. Both are part of their respective usesrc groups
16467 	 */
16468 	if ((usesrc_ill->ill_usesrc_grp_next == NULL) &&
16469 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
16470 		ASSERT(usesrc_ill->ill_usesrc_ifindex == 0);
16471 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
16472 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
16473 		usesrc_cli_ill->ill_usesrc_grp_next = usesrc_ill;
16474 	} else if ((usesrc_ill->ill_usesrc_grp_next != NULL) &&
16475 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
16476 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
16477 		/* Insert at head of list */
16478 		usesrc_cli_ill->ill_usesrc_grp_next =
16479 		    usesrc_ill->ill_usesrc_grp_next;
16480 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
16481 	} else {
16482 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill,
16483 		    ifindex);
16484 		if (ret != 0)
16485 			err = EINVAL;
16486 	}
16487 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
16488 
16489 done:
16490 	if (ipsq != NULL)
16491 		ipsq_exit(ipsq);
16492 	/* The refrele on the lifr_name ipif is done by ip_process_ioctl */
16493 	ill_refrele(usesrc_ill);
16494 
16495 	/* Let conn_ixa caching know that source address selection changed */
16496 	ip_update_source_selection(ipst);
16497 
16498 	return (err);
16499 }
16500 
16501 /* ARGSUSED */
16502 int
ip_sioctl_get_dadstate(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)16503 ip_sioctl_get_dadstate(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16504     ip_ioctl_cmd_t *ipip, void *if_req)
16505 {
16506 	struct lifreq	*lifr = (struct lifreq *)if_req;
16507 	ill_t		*ill = ipif->ipif_ill;
16508 
16509 	/*
16510 	 * Need a lock since IFF_UP can be set even when there are
16511 	 * references to the ipif.
16512 	 */
16513 	mutex_enter(&ill->ill_lock);
16514 	if ((ipif->ipif_flags & IPIF_UP) && ipif->ipif_addr_ready == 0)
16515 		lifr->lifr_dadstate = DAD_IN_PROGRESS;
16516 	else
16517 		lifr->lifr_dadstate = DAD_DONE;
16518 	mutex_exit(&ill->ill_lock);
16519 	return (0);
16520 }
16521 
16522 /*
16523  * comparison function used by avl.
16524  */
16525 static int
ill_phyint_compare_index(const void * index_ptr,const void * phyip)16526 ill_phyint_compare_index(const void *index_ptr, const void *phyip)
16527 {
16528 
16529 	uint_t index;
16530 
16531 	ASSERT(phyip != NULL && index_ptr != NULL);
16532 
16533 	index = *((uint_t *)index_ptr);
16534 	/*
16535 	 * let the phyint with the lowest index be on top.
16536 	 */
16537 	if (((phyint_t *)phyip)->phyint_ifindex < index)
16538 		return (1);
16539 	if (((phyint_t *)phyip)->phyint_ifindex > index)
16540 		return (-1);
16541 	return (0);
16542 }
16543 
16544 /*
16545  * comparison function used by avl.
16546  */
16547 static int
ill_phyint_compare_name(const void * name_ptr,const void * phyip)16548 ill_phyint_compare_name(const void *name_ptr, const void *phyip)
16549 {
16550 	ill_t *ill;
16551 	int res = 0;
16552 
16553 	ASSERT(phyip != NULL && name_ptr != NULL);
16554 
16555 	if (((phyint_t *)phyip)->phyint_illv4)
16556 		ill = ((phyint_t *)phyip)->phyint_illv4;
16557 	else
16558 		ill = ((phyint_t *)phyip)->phyint_illv6;
16559 	ASSERT(ill != NULL);
16560 
16561 	res = strcmp(ill->ill_name, (char *)name_ptr);
16562 	if (res > 0)
16563 		return (1);
16564 	else if (res < 0)
16565 		return (-1);
16566 	return (0);
16567 }
16568 
16569 /*
16570  * This function is called on the unplumb path via ill_glist_delete() when
16571  * there are no ills left on the phyint and thus the phyint can be freed.
16572  */
16573 static void
phyint_free(phyint_t * phyi)16574 phyint_free(phyint_t *phyi)
16575 {
16576 	ip_stack_t *ipst = PHYINT_TO_IPST(phyi);
16577 
16578 	ASSERT(phyi->phyint_illv4 == NULL && phyi->phyint_illv6 == NULL);
16579 
16580 	/*
16581 	 * If this phyint was an IPMP meta-interface, blow away the group.
16582 	 * This is safe to do because all of the illgrps have already been
16583 	 * removed by I_PUNLINK, and thus SIOCSLIFGROUPNAME cannot find us.
16584 	 * If we're cleaning up as a result of failed initialization,
16585 	 * phyint_grp may be NULL.
16586 	 */
16587 	if ((phyi->phyint_flags & PHYI_IPMP) && (phyi->phyint_grp != NULL)) {
16588 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
16589 		ipmp_grp_destroy(phyi->phyint_grp);
16590 		phyi->phyint_grp = NULL;
16591 		rw_exit(&ipst->ips_ipmp_lock);
16592 	}
16593 
16594 	/*
16595 	 * If this interface was under IPMP, take it out of the group.
16596 	 */
16597 	if (phyi->phyint_grp != NULL)
16598 		ipmp_phyint_leave_grp(phyi);
16599 
16600 	/*
16601 	 * Delete the phyint and disassociate its ipsq.  The ipsq itself
16602 	 * will be freed in ipsq_exit().
16603 	 */
16604 	phyi->phyint_ipsq->ipsq_phyint = NULL;
16605 	phyi->phyint_name[0] = '\0';
16606 
16607 	mi_free(phyi);
16608 }
16609 
16610 /*
16611  * Attach the ill to the phyint structure which can be shared by both
16612  * IPv4 and IPv6 ill. ill_init allocates a phyint to just hold flags. This
16613  * function is called from ipif_set_values and ill_lookup_on_name (for
16614  * loopback) where we know the name of the ill. We lookup the ill and if
16615  * there is one present already with the name use that phyint. Otherwise
16616  * reuse the one allocated by ill_init.
16617  */
16618 static void
ill_phyint_reinit(ill_t * ill)16619 ill_phyint_reinit(ill_t *ill)
16620 {
16621 	boolean_t isv6 = ill->ill_isv6;
16622 	phyint_t *phyi_old;
16623 	phyint_t *phyi;
16624 	avl_index_t where = 0;
16625 	ill_t	*ill_other = NULL;
16626 	ip_stack_t	*ipst = ill->ill_ipst;
16627 
16628 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
16629 
16630 	phyi_old = ill->ill_phyint;
16631 	ASSERT(isv6 || (phyi_old->phyint_illv4 == ill &&
16632 	    phyi_old->phyint_illv6 == NULL));
16633 	ASSERT(!isv6 || (phyi_old->phyint_illv6 == ill &&
16634 	    phyi_old->phyint_illv4 == NULL));
16635 	ASSERT(phyi_old->phyint_ifindex == 0);
16636 
16637 	/*
16638 	 * Now that our ill has a name, set it in the phyint.
16639 	 */
16640 	(void) strlcpy(ill->ill_phyint->phyint_name, ill->ill_name, LIFNAMSIZ);
16641 
16642 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
16643 	    ill->ill_name, &where);
16644 
16645 	/*
16646 	 * 1. We grabbed the ill_g_lock before inserting this ill into
16647 	 *    the global list of ills. So no other thread could have located
16648 	 *    this ill and hence the ipsq of this ill is guaranteed to be empty.
16649 	 * 2. Now locate the other protocol instance of this ill.
16650 	 * 3. Now grab both ill locks in the right order, and the phyint lock of
16651 	 *    the new ipsq. Holding ill locks + ill_g_lock ensures that the ipsq
16652 	 *    of neither ill can change.
16653 	 * 4. Merge the phyint and thus the ipsq as well of this ill onto the
16654 	 *    other ill.
16655 	 * 5. Release all locks.
16656 	 */
16657 
16658 	/*
16659 	 * Look for IPv4 if we are initializing IPv6 or look for IPv6 if
16660 	 * we are initializing IPv4.
16661 	 */
16662 	if (phyi != NULL) {
16663 		ill_other = (isv6) ? phyi->phyint_illv4 : phyi->phyint_illv6;
16664 		ASSERT(ill_other->ill_phyint != NULL);
16665 		ASSERT((isv6 && !ill_other->ill_isv6) ||
16666 		    (!isv6 && ill_other->ill_isv6));
16667 		GRAB_ILL_LOCKS(ill, ill_other);
16668 		/*
16669 		 * We are potentially throwing away phyint_flags which
16670 		 * could be different from the one that we obtain from
16671 		 * ill_other->ill_phyint. But it is okay as we are assuming
16672 		 * that the state maintained within IP is correct.
16673 		 */
16674 		mutex_enter(&phyi->phyint_lock);
16675 		if (isv6) {
16676 			ASSERT(phyi->phyint_illv6 == NULL);
16677 			phyi->phyint_illv6 = ill;
16678 		} else {
16679 			ASSERT(phyi->phyint_illv4 == NULL);
16680 			phyi->phyint_illv4 = ill;
16681 		}
16682 
16683 		/*
16684 		 * Delete the old phyint and make its ipsq eligible
16685 		 * to be freed in ipsq_exit().
16686 		 */
16687 		phyi_old->phyint_illv4 = NULL;
16688 		phyi_old->phyint_illv6 = NULL;
16689 		phyi_old->phyint_ipsq->ipsq_phyint = NULL;
16690 		phyi_old->phyint_name[0] = '\0';
16691 		mi_free(phyi_old);
16692 	} else {
16693 		mutex_enter(&ill->ill_lock);
16694 		/*
16695 		 * We don't need to acquire any lock, since
16696 		 * the ill is not yet visible globally  and we
16697 		 * have not yet released the ill_g_lock.
16698 		 */
16699 		phyi = phyi_old;
16700 		mutex_enter(&phyi->phyint_lock);
16701 		/* XXX We need a recovery strategy here. */
16702 		if (!phyint_assign_ifindex(phyi, ipst))
16703 			cmn_err(CE_PANIC, "phyint_assign_ifindex() failed");
16704 
16705 		avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
16706 		    (void *)phyi, where);
16707 
16708 		(void) avl_find(&ipst->ips_phyint_g_list->
16709 		    phyint_list_avl_by_index,
16710 		    &phyi->phyint_ifindex, &where);
16711 		avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
16712 		    (void *)phyi, where);
16713 	}
16714 
16715 	/*
16716 	 * Reassigning ill_phyint automatically reassigns the ipsq also.
16717 	 * pending mp is not affected because that is per ill basis.
16718 	 */
16719 	ill->ill_phyint = phyi;
16720 
16721 	/*
16722 	 * Now that the phyint's ifindex has been assigned, complete the
16723 	 * remaining
16724 	 */
16725 	ill->ill_ip_mib->ipIfStatsIfIndex = ill->ill_phyint->phyint_ifindex;
16726 	if (ill->ill_isv6) {
16727 		ill->ill_icmp6_mib->ipv6IfIcmpIfIndex =
16728 		    ill->ill_phyint->phyint_ifindex;
16729 		ill->ill_mcast_type = ipst->ips_mld_max_version;
16730 	} else {
16731 		ill->ill_mcast_type = ipst->ips_igmp_max_version;
16732 	}
16733 
16734 	/*
16735 	 * Generate an event within the hooks framework to indicate that
16736 	 * a new interface has just been added to IP.  For this event to
16737 	 * be generated, the network interface must, at least, have an
16738 	 * ifindex assigned to it.  (We don't generate the event for
16739 	 * loopback since ill_lookup_on_name() has its own NE_PLUMB event.)
16740 	 *
16741 	 * This needs to be run inside the ill_g_lock perimeter to ensure
16742 	 * that the ordering of delivered events to listeners matches the
16743 	 * order of them in the kernel.
16744 	 */
16745 	if (!IS_LOOPBACK(ill)) {
16746 		ill_nic_event_dispatch(ill, 0, NE_PLUMB, ill->ill_name,
16747 		    ill->ill_name_length);
16748 	}
16749 	RELEASE_ILL_LOCKS(ill, ill_other);
16750 	mutex_exit(&phyi->phyint_lock);
16751 }
16752 
16753 /*
16754  * Notify any downstream modules of the name of this interface.
16755  * An M_IOCTL is used even though we don't expect a successful reply.
16756  * Any reply message from the driver (presumably an M_IOCNAK) will
16757  * eventually get discarded somewhere upstream.  The message format is
16758  * simply an SIOCSLIFNAME ioctl just as might be sent from ifconfig
16759  * to IP.
16760  */
16761 static void
ip_ifname_notify(ill_t * ill,queue_t * q)16762 ip_ifname_notify(ill_t *ill, queue_t *q)
16763 {
16764 	mblk_t *mp1, *mp2;
16765 	struct iocblk *iocp;
16766 	struct lifreq *lifr;
16767 
16768 	mp1 = mkiocb(SIOCSLIFNAME);
16769 	if (mp1 == NULL)
16770 		return;
16771 	mp2 = allocb(sizeof (struct lifreq), BPRI_HI);
16772 	if (mp2 == NULL) {
16773 		freeb(mp1);
16774 		return;
16775 	}
16776 
16777 	mp1->b_cont = mp2;
16778 	iocp = (struct iocblk *)mp1->b_rptr;
16779 	iocp->ioc_count = sizeof (struct lifreq);
16780 
16781 	lifr = (struct lifreq *)mp2->b_rptr;
16782 	mp2->b_wptr += sizeof (struct lifreq);
16783 	bzero(lifr, sizeof (struct lifreq));
16784 
16785 	(void) strncpy(lifr->lifr_name, ill->ill_name, LIFNAMSIZ);
16786 	lifr->lifr_ppa = ill->ill_ppa;
16787 	lifr->lifr_flags = (ill->ill_flags & (ILLF_IPV4|ILLF_IPV6));
16788 
16789 	DTRACE_PROBE3(ill__dlpi, char *, "ip_ifname_notify",
16790 	    char *, "SIOCSLIFNAME", ill_t *, ill);
16791 	putnext(q, mp1);
16792 }
16793 
16794 static int
ipif_set_values_tail(ill_t * ill,ipif_t * ipif,mblk_t * mp,queue_t * q)16795 ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
16796 {
16797 	int		err;
16798 	ip_stack_t	*ipst = ill->ill_ipst;
16799 	phyint_t	*phyi = ill->ill_phyint;
16800 
16801 	/*
16802 	 * Now that ill_name is set, the configuration for the IPMP
16803 	 * meta-interface can be performed.
16804 	 */
16805 	if (IS_IPMP(ill)) {
16806 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
16807 		/*
16808 		 * If phyi->phyint_grp is NULL, then this is the first IPMP
16809 		 * meta-interface and we need to create the IPMP group.
16810 		 */
16811 		if (phyi->phyint_grp == NULL) {
16812 			/*
16813 			 * If someone has renamed another IPMP group to have
16814 			 * the same name as our interface, bail.
16815 			 */
16816 			if (ipmp_grp_lookup(ill->ill_name, ipst) != NULL) {
16817 				rw_exit(&ipst->ips_ipmp_lock);
16818 				return (EEXIST);
16819 			}
16820 			phyi->phyint_grp = ipmp_grp_create(ill->ill_name, phyi);
16821 			if (phyi->phyint_grp == NULL) {
16822 				rw_exit(&ipst->ips_ipmp_lock);
16823 				return (ENOMEM);
16824 			}
16825 		}
16826 		rw_exit(&ipst->ips_ipmp_lock);
16827 	}
16828 
16829 	/* Tell downstream modules where they are. */
16830 	ip_ifname_notify(ill, q);
16831 
16832 	/*
16833 	 * ill_dl_phys returns EINPROGRESS in the usual case.
16834 	 * Error cases are ENOMEM ...
16835 	 */
16836 	err = ill_dl_phys(ill, ipif, mp, q);
16837 
16838 	if (ill->ill_isv6) {
16839 		mutex_enter(&ipst->ips_mld_slowtimeout_lock);
16840 		if (ipst->ips_mld_slowtimeout_id == 0) {
16841 			ipst->ips_mld_slowtimeout_id = timeout(mld_slowtimo,
16842 			    (void *)ipst,
16843 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
16844 		}
16845 		mutex_exit(&ipst->ips_mld_slowtimeout_lock);
16846 	} else {
16847 		mutex_enter(&ipst->ips_igmp_slowtimeout_lock);
16848 		if (ipst->ips_igmp_slowtimeout_id == 0) {
16849 			ipst->ips_igmp_slowtimeout_id = timeout(igmp_slowtimo,
16850 			    (void *)ipst,
16851 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
16852 		}
16853 		mutex_exit(&ipst->ips_igmp_slowtimeout_lock);
16854 	}
16855 
16856 	return (err);
16857 }
16858 
16859 /*
16860  * Common routine for ppa and ifname setting. Should be called exclusive.
16861  *
16862  * Returns EINPROGRESS when mp has been consumed by queueing it on
16863  * ipx_pending_mp and the ioctl will complete in ip_rput.
16864  *
16865  * NOTE : If ppa is UNIT_MAX, we assign the next valid ppa and return
16866  * the new name and new ppa in lifr_name and lifr_ppa respectively.
16867  * For SLIFNAME, we pass these values back to the userland.
16868  */
16869 static int
ipif_set_values(queue_t * q,mblk_t * mp,char * interf_name,uint_t * new_ppa_ptr)16870 ipif_set_values(queue_t *q, mblk_t *mp, char *interf_name, uint_t *new_ppa_ptr)
16871 {
16872 	ill_t	*ill;
16873 	ipif_t	*ipif;
16874 	ipsq_t	*ipsq;
16875 	char	*ppa_ptr;
16876 	char	*old_ptr;
16877 	char	old_char;
16878 	int	error;
16879 	ip_stack_t	*ipst;
16880 
16881 	ip1dbg(("ipif_set_values: interface %s\n", interf_name));
16882 	ASSERT(q->q_next != NULL);
16883 	ASSERT(interf_name != NULL);
16884 
16885 	ill = (ill_t *)q->q_ptr;
16886 	ipst = ill->ill_ipst;
16887 
16888 	ASSERT(ill->ill_ipst != NULL);
16889 	ASSERT(ill->ill_name[0] == '\0');
16890 	ASSERT(IAM_WRITER_ILL(ill));
16891 	ASSERT((mi_strlen(interf_name) + 1) <= LIFNAMSIZ);
16892 	ASSERT(ill->ill_ppa == UINT_MAX);
16893 
16894 	ill->ill_defend_start = ill->ill_defend_count = 0;
16895 	/* The ppa is sent down by ifconfig or is chosen */
16896 	if ((ppa_ptr = ill_get_ppa_ptr(interf_name)) == NULL) {
16897 		return (EINVAL);
16898 	}
16899 
16900 	/*
16901 	 * make sure ppa passed in is same as ppa in the name.
16902 	 * This check is not made when ppa == UINT_MAX in that case ppa
16903 	 * in the name could be anything. System will choose a ppa and
16904 	 * update new_ppa_ptr and inter_name to contain the choosen ppa.
16905 	 */
16906 	if (*new_ppa_ptr != UINT_MAX) {
16907 		/* stoi changes the pointer */
16908 		old_ptr = ppa_ptr;
16909 		/*
16910 		 * ifconfig passed in 0 for the ppa for DLPI 1 style devices
16911 		 * (they don't have an externally visible ppa).  We assign one
16912 		 * here so that we can manage the interface.  Note that in
16913 		 * the past this value was always 0 for DLPI 1 drivers.
16914 		 */
16915 		if (*new_ppa_ptr == 0)
16916 			*new_ppa_ptr = stoi(&old_ptr);
16917 		else if (*new_ppa_ptr != (uint_t)stoi(&old_ptr))
16918 			return (EINVAL);
16919 	}
16920 	/*
16921 	 * terminate string before ppa
16922 	 * save char at that location.
16923 	 */
16924 	old_char = ppa_ptr[0];
16925 	ppa_ptr[0] = '\0';
16926 
16927 	ill->ill_ppa = *new_ppa_ptr;
16928 	/*
16929 	 * Finish as much work now as possible before calling ill_glist_insert
16930 	 * which makes the ill globally visible and also merges it with the
16931 	 * other protocol instance of this phyint. The remaining work is
16932 	 * done after entering the ipsq which may happen sometime later.
16933 	 */
16934 	ipif = ill->ill_ipif;
16935 
16936 	/* We didn't do this when we allocated ipif in ip_ll_subnet_defaults */
16937 	ipif_assign_seqid(ipif);
16938 
16939 	if (!(ill->ill_flags & (ILLF_IPV4|ILLF_IPV6)))
16940 		ill->ill_flags |= ILLF_IPV4;
16941 
16942 	ASSERT(ipif->ipif_next == NULL);	/* Only one ipif on ill */
16943 	ASSERT((ipif->ipif_flags & IPIF_UP) == 0);
16944 
16945 	if (ill->ill_flags & ILLF_IPV6) {
16946 
16947 		ill->ill_isv6 = B_TRUE;
16948 		ill_set_inputfn(ill);
16949 		if (ill->ill_rq != NULL) {
16950 			ill->ill_rq->q_qinfo = &iprinitv6;
16951 		}
16952 
16953 		/* Keep the !IN6_IS_ADDR_V4MAPPED assertions happy */
16954 		ipif->ipif_v6lcl_addr = ipv6_all_zeros;
16955 		ipif->ipif_v6subnet = ipv6_all_zeros;
16956 		ipif->ipif_v6net_mask = ipv6_all_zeros;
16957 		ipif->ipif_v6brd_addr = ipv6_all_zeros;
16958 		ipif->ipif_v6pp_dst_addr = ipv6_all_zeros;
16959 		ill->ill_reachable_retrans_time = ND_RETRANS_TIMER;
16960 		/*
16961 		 * point-to-point or Non-mulicast capable
16962 		 * interfaces won't do NUD unless explicitly
16963 		 * configured to do so.
16964 		 */
16965 		if (ipif->ipif_flags & IPIF_POINTOPOINT ||
16966 		    !(ill->ill_flags & ILLF_MULTICAST)) {
16967 			ill->ill_flags |= ILLF_NONUD;
16968 		}
16969 		/* Make sure IPv4 specific flag is not set on IPv6 if */
16970 		if (ill->ill_flags & ILLF_NOARP) {
16971 			/*
16972 			 * Note: xresolv interfaces will eventually need
16973 			 * NOARP set here as well, but that will require
16974 			 * those external resolvers to have some
16975 			 * knowledge of that flag and act appropriately.
16976 			 * Not to be changed at present.
16977 			 */
16978 			ill->ill_flags &= ~ILLF_NOARP;
16979 		}
16980 		/*
16981 		 * Set the ILLF_ROUTER flag according to the global
16982 		 * IPv6 forwarding policy.
16983 		 */
16984 		if (ipst->ips_ipv6_forwarding != 0)
16985 			ill->ill_flags |= ILLF_ROUTER;
16986 	} else if (ill->ill_flags & ILLF_IPV4) {
16987 		ill->ill_isv6 = B_FALSE;
16988 		ill_set_inputfn(ill);
16989 		ill->ill_reachable_retrans_time = ARP_RETRANS_TIMER;
16990 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6lcl_addr);
16991 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6subnet);
16992 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6net_mask);
16993 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6brd_addr);
16994 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6pp_dst_addr);
16995 		/*
16996 		 * Set the ILLF_ROUTER flag according to the global
16997 		 * IPv4 forwarding policy.
16998 		 */
16999 		if (ipst->ips_ip_forwarding != 0)
17000 			ill->ill_flags |= ILLF_ROUTER;
17001 	}
17002 
17003 	ASSERT(ill->ill_phyint != NULL);
17004 
17005 	/*
17006 	 * The ipIfStatsIfindex and ipv6IfIcmpIfIndex assignments will
17007 	 * be completed in ill_glist_insert -> ill_phyint_reinit
17008 	 */
17009 	if (!ill_allocate_mibs(ill))
17010 		return (ENOMEM);
17011 
17012 	/*
17013 	 * Pick a default sap until we get the DL_INFO_ACK back from
17014 	 * the driver.
17015 	 */
17016 	ill->ill_sap = (ill->ill_isv6) ? ill->ill_media->ip_m_ipv6sap :
17017 	    ill->ill_media->ip_m_ipv4sap;
17018 
17019 	ill->ill_ifname_pending = 1;
17020 	ill->ill_ifname_pending_err = 0;
17021 
17022 	/*
17023 	 * When the first ipif comes up in ipif_up_done(), multicast groups
17024 	 * that were joined while this ill was not bound to the DLPI link need
17025 	 * to be recovered by ill_recover_multicast().
17026 	 */
17027 	ill->ill_need_recover_multicast = 1;
17028 
17029 	ill_refhold(ill);
17030 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
17031 	if ((error = ill_glist_insert(ill, interf_name,
17032 	    (ill->ill_flags & ILLF_IPV6) == ILLF_IPV6)) > 0) {
17033 		ill->ill_ppa = UINT_MAX;
17034 		ill->ill_name[0] = '\0';
17035 		/*
17036 		 * undo null termination done above.
17037 		 */
17038 		ppa_ptr[0] = old_char;
17039 		rw_exit(&ipst->ips_ill_g_lock);
17040 		ill_refrele(ill);
17041 		return (error);
17042 	}
17043 
17044 	ASSERT(ill->ill_name_length <= LIFNAMSIZ);
17045 
17046 	/*
17047 	 * When we return the buffer pointed to by interf_name should contain
17048 	 * the same name as in ill_name.
17049 	 * If a ppa was choosen by the system (ppa passed in was UINT_MAX)
17050 	 * the buffer pointed to by new_ppa_ptr would not contain the right ppa
17051 	 * so copy full name and update the ppa ptr.
17052 	 * When ppa passed in != UINT_MAX all values are correct just undo
17053 	 * null termination, this saves a bcopy.
17054 	 */
17055 	if (*new_ppa_ptr == UINT_MAX) {
17056 		bcopy(ill->ill_name, interf_name, ill->ill_name_length);
17057 		*new_ppa_ptr = ill->ill_ppa;
17058 	} else {
17059 		/*
17060 		 * undo null termination done above.
17061 		 */
17062 		ppa_ptr[0] = old_char;
17063 	}
17064 
17065 	/* Let SCTP know about this ILL */
17066 	sctp_update_ill(ill, SCTP_ILL_INSERT);
17067 
17068 	/*
17069 	 * ill_glist_insert has made the ill visible globally, and
17070 	 * ill_phyint_reinit could have changed the ipsq. At this point,
17071 	 * we need to hold the ips_ill_g_lock across the call to enter the
17072 	 * ipsq to enforce atomicity and prevent reordering. In the event
17073 	 * the ipsq has changed, and if the new ipsq is currently busy,
17074 	 * we need to make sure that this half-completed ioctl is ahead of
17075 	 * any subsequent ioctl. We achieve this by not dropping the
17076 	 * ips_ill_g_lock which prevents any ill lookup itself thereby
17077 	 * ensuring that new ioctls can't start.
17078 	 */
17079 	ipsq = ipsq_try_enter_internal(ill, q, mp, ip_reprocess_ioctl, NEW_OP,
17080 	    B_TRUE);
17081 
17082 	rw_exit(&ipst->ips_ill_g_lock);
17083 	ill_refrele(ill);
17084 	if (ipsq == NULL)
17085 		return (EINPROGRESS);
17086 
17087 	/*
17088 	 * If ill_phyint_reinit() changed our ipsq, then start on the new ipsq.
17089 	 */
17090 	if (ipsq->ipsq_xop->ipx_current_ipif == NULL)
17091 		ipsq_current_start(ipsq, ipif, SIOCSLIFNAME);
17092 	else
17093 		ASSERT(ipsq->ipsq_xop->ipx_current_ipif == ipif);
17094 
17095 	error = ipif_set_values_tail(ill, ipif, mp, q);
17096 	ipsq_exit(ipsq);
17097 	if (error != 0 && error != EINPROGRESS) {
17098 		/*
17099 		 * restore previous values
17100 		 */
17101 		ill->ill_isv6 = B_FALSE;
17102 		ill_set_inputfn(ill);
17103 	}
17104 	return (error);
17105 }
17106 
17107 void
ipif_init(ip_stack_t * ipst)17108 ipif_init(ip_stack_t *ipst)
17109 {
17110 	int i;
17111 
17112 	for (i = 0; i < MAX_G_HEADS; i++) {
17113 		ipst->ips_ill_g_heads[i].ill_g_list_head =
17114 		    (ill_if_t *)&ipst->ips_ill_g_heads[i];
17115 		ipst->ips_ill_g_heads[i].ill_g_list_tail =
17116 		    (ill_if_t *)&ipst->ips_ill_g_heads[i];
17117 	}
17118 
17119 	avl_create(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
17120 	    ill_phyint_compare_index,
17121 	    sizeof (phyint_t),
17122 	    offsetof(struct phyint, phyint_avl_by_index));
17123 	avl_create(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
17124 	    ill_phyint_compare_name,
17125 	    sizeof (phyint_t),
17126 	    offsetof(struct phyint, phyint_avl_by_name));
17127 }
17128 
17129 /*
17130  * Save enough information so that we can recreate the IRE if
17131  * the interface goes down and then up.
17132  */
17133 void
ill_save_ire(ill_t * ill,ire_t * ire)17134 ill_save_ire(ill_t *ill, ire_t *ire)
17135 {
17136 	mblk_t	*save_mp;
17137 
17138 	save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
17139 	if (save_mp != NULL) {
17140 		ifrt_t	*ifrt;
17141 
17142 		save_mp->b_wptr += sizeof (ifrt_t);
17143 		ifrt = (ifrt_t *)save_mp->b_rptr;
17144 		bzero(ifrt, sizeof (ifrt_t));
17145 		ifrt->ifrt_type = ire->ire_type;
17146 		if (ire->ire_ipversion == IPV4_VERSION) {
17147 			ASSERT(!ill->ill_isv6);
17148 			ifrt->ifrt_addr = ire->ire_addr;
17149 			ifrt->ifrt_gateway_addr = ire->ire_gateway_addr;
17150 			ifrt->ifrt_setsrc_addr = ire->ire_setsrc_addr;
17151 			ifrt->ifrt_mask = ire->ire_mask;
17152 		} else {
17153 			ASSERT(ill->ill_isv6);
17154 			ifrt->ifrt_v6addr = ire->ire_addr_v6;
17155 			/* ire_gateway_addr_v6 can change due to RTM_CHANGE */
17156 			mutex_enter(&ire->ire_lock);
17157 			ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6;
17158 			mutex_exit(&ire->ire_lock);
17159 			ifrt->ifrt_v6setsrc_addr = ire->ire_setsrc_addr_v6;
17160 			ifrt->ifrt_v6mask = ire->ire_mask_v6;
17161 		}
17162 		ifrt->ifrt_flags = ire->ire_flags;
17163 		ifrt->ifrt_zoneid = ire->ire_zoneid;
17164 		mutex_enter(&ill->ill_saved_ire_lock);
17165 		save_mp->b_cont = ill->ill_saved_ire_mp;
17166 		ill->ill_saved_ire_mp = save_mp;
17167 		ill->ill_saved_ire_cnt++;
17168 		mutex_exit(&ill->ill_saved_ire_lock);
17169 	}
17170 }
17171 
17172 /*
17173  * Remove one entry from ill_saved_ire_mp.
17174  */
17175 void
ill_remove_saved_ire(ill_t * ill,ire_t * ire)17176 ill_remove_saved_ire(ill_t *ill, ire_t *ire)
17177 {
17178 	mblk_t	**mpp;
17179 	mblk_t	*mp;
17180 	ifrt_t	*ifrt;
17181 
17182 	/* Remove from ill_saved_ire_mp list if it is there */
17183 	mutex_enter(&ill->ill_saved_ire_lock);
17184 	for (mpp = &ill->ill_saved_ire_mp; *mpp != NULL;
17185 	    mpp = &(*mpp)->b_cont) {
17186 		in6_addr_t	gw_addr_v6;
17187 
17188 		/*
17189 		 * On a given ill, the tuple of address, gateway, mask,
17190 		 * ire_type, and zoneid is unique for each saved IRE.
17191 		 */
17192 		mp = *mpp;
17193 		ifrt = (ifrt_t *)mp->b_rptr;
17194 		/* ire_gateway_addr_v6 can change - need lock */
17195 		mutex_enter(&ire->ire_lock);
17196 		gw_addr_v6 = ire->ire_gateway_addr_v6;
17197 		mutex_exit(&ire->ire_lock);
17198 
17199 		if (ifrt->ifrt_zoneid != ire->ire_zoneid ||
17200 		    ifrt->ifrt_type != ire->ire_type)
17201 			continue;
17202 
17203 		if (ill->ill_isv6 ?
17204 		    (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr,
17205 		    &ire->ire_addr_v6) &&
17206 		    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr,
17207 		    &gw_addr_v6) &&
17208 		    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask,
17209 		    &ire->ire_mask_v6)) :
17210 		    (ifrt->ifrt_addr == ire->ire_addr &&
17211 		    ifrt->ifrt_gateway_addr == ire->ire_gateway_addr &&
17212 		    ifrt->ifrt_mask == ire->ire_mask)) {
17213 			*mpp = mp->b_cont;
17214 			ill->ill_saved_ire_cnt--;
17215 			freeb(mp);
17216 			break;
17217 		}
17218 	}
17219 	mutex_exit(&ill->ill_saved_ire_lock);
17220 }
17221 
17222 /*
17223  * IP multirouting broadcast routes handling
17224  * Append CGTP broadcast IREs to regular ones created
17225  * at ifconfig time.
17226  * The usage is a route add <cgtp_bc> <nic_bc> -multirt i.e., both
17227  * the destination and the gateway are broadcast addresses.
17228  * The caller has verified that the destination is an IRE_BROADCAST and that
17229  * RTF_MULTIRT was set. Here if the gateway is a broadcast address, then
17230  * we create a MULTIRT IRE_BROADCAST.
17231  * Note that the IRE_HOST created by ire_rt_add doesn't get found by anything
17232  * since the IRE_BROADCAST takes precedence; ire_add_v4 does head insertion.
17233  */
17234 static void
ip_cgtp_bcast_add(ire_t * ire,ip_stack_t * ipst)17235 ip_cgtp_bcast_add(ire_t *ire, ip_stack_t *ipst)
17236 {
17237 	ire_t *ire_prim;
17238 
17239 	ASSERT(ire != NULL);
17240 
17241 	ire_prim = ire_ftable_lookup_v4(ire->ire_gateway_addr, 0, 0,
17242 	    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst,
17243 	    NULL);
17244 	if (ire_prim != NULL) {
17245 		/*
17246 		 * We are in the special case of broadcasts for
17247 		 * CGTP. We add an IRE_BROADCAST that holds
17248 		 * the RTF_MULTIRT flag, the destination
17249 		 * address and the low level
17250 		 * info of ire_prim. In other words, CGTP
17251 		 * broadcast is added to the redundant ipif.
17252 		 */
17253 		ill_t *ill_prim;
17254 		ire_t  *bcast_ire;
17255 
17256 		ill_prim = ire_prim->ire_ill;
17257 
17258 		ip2dbg(("ip_cgtp_filter_bcast_add: ire_prim %p, ill_prim %p\n",
17259 		    (void *)ire_prim, (void *)ill_prim));
17260 
17261 		bcast_ire = ire_create(
17262 		    (uchar_t *)&ire->ire_addr,
17263 		    (uchar_t *)&ip_g_all_ones,
17264 		    (uchar_t *)&ire->ire_gateway_addr,
17265 		    IRE_BROADCAST,
17266 		    ill_prim,
17267 		    GLOBAL_ZONEID,	/* CGTP is only for the global zone */
17268 		    ire->ire_flags | RTF_KERNEL,
17269 		    NULL,
17270 		    ipst);
17271 
17272 		/*
17273 		 * Here we assume that ire_add does head insertion so that
17274 		 * the added IRE_BROADCAST comes before the existing IRE_HOST.
17275 		 */
17276 		if (bcast_ire != NULL) {
17277 			if (ire->ire_flags & RTF_SETSRC) {
17278 				bcast_ire->ire_setsrc_addr =
17279 				    ire->ire_setsrc_addr;
17280 			}
17281 			bcast_ire = ire_add(bcast_ire);
17282 			if (bcast_ire != NULL) {
17283 				ip2dbg(("ip_cgtp_filter_bcast_add: "
17284 				    "added bcast_ire %p\n",
17285 				    (void *)bcast_ire));
17286 
17287 				ill_save_ire(ill_prim, bcast_ire);
17288 				ire_refrele(bcast_ire);
17289 			}
17290 		}
17291 		ire_refrele(ire_prim);
17292 	}
17293 }
17294 
17295 /*
17296  * IP multirouting broadcast routes handling
17297  * Remove the broadcast ire.
17298  * The usage is a route delete <cgtp_bc> <nic_bc> -multirt i.e., both
17299  * the destination and the gateway are broadcast addresses.
17300  * The caller has only verified that RTF_MULTIRT was set. We check
17301  * that the destination is broadcast and that the gateway is a broadcast
17302  * address, and if so delete the IRE added by ip_cgtp_bcast_add().
17303  */
17304 static void
ip_cgtp_bcast_delete(ire_t * ire,ip_stack_t * ipst)17305 ip_cgtp_bcast_delete(ire_t *ire, ip_stack_t *ipst)
17306 {
17307 	ASSERT(ire != NULL);
17308 
17309 	if (ip_type_v4(ire->ire_addr, ipst) == IRE_BROADCAST) {
17310 		ire_t *ire_prim;
17311 
17312 		ire_prim = ire_ftable_lookup_v4(ire->ire_gateway_addr, 0, 0,
17313 		    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0,
17314 		    ipst, NULL);
17315 		if (ire_prim != NULL) {
17316 			ill_t *ill_prim;
17317 			ire_t  *bcast_ire;
17318 
17319 			ill_prim = ire_prim->ire_ill;
17320 
17321 			ip2dbg(("ip_cgtp_filter_bcast_delete: "
17322 			    "ire_prim %p, ill_prim %p\n",
17323 			    (void *)ire_prim, (void *)ill_prim));
17324 
17325 			bcast_ire = ire_ftable_lookup_v4(ire->ire_addr, 0,
17326 			    ire->ire_gateway_addr, IRE_BROADCAST,
17327 			    ill_prim, ALL_ZONES, NULL,
17328 			    MATCH_IRE_TYPE | MATCH_IRE_GW | MATCH_IRE_ILL |
17329 			    MATCH_IRE_MASK, 0, ipst, NULL);
17330 
17331 			if (bcast_ire != NULL) {
17332 				ip2dbg(("ip_cgtp_filter_bcast_delete: "
17333 				    "looked up bcast_ire %p\n",
17334 				    (void *)bcast_ire));
17335 				ill_remove_saved_ire(bcast_ire->ire_ill,
17336 				    bcast_ire);
17337 				ire_delete(bcast_ire);
17338 				ire_refrele(bcast_ire);
17339 			}
17340 			ire_refrele(ire_prim);
17341 		}
17342 	}
17343 }
17344 
17345 /*
17346  * Derive an interface id from the link layer address.
17347  * Knows about IEEE 802 and IEEE EUI-64 mappings.
17348  */
17349 static void
ip_ether_v6intfid(ill_t * ill,in6_addr_t * v6addr)17350 ip_ether_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17351 {
17352 	char		*addr;
17353 
17354 	/*
17355 	 * Note that some IPv6 interfaces get plumbed over links that claim to
17356 	 * be DL_ETHER, but don't actually have Ethernet MAC addresses (e.g.
17357 	 * PPP links).  The ETHERADDRL check here ensures that we only set the
17358 	 * interface ID on IPv6 interfaces above links that actually have real
17359 	 * Ethernet addresses.
17360 	 */
17361 	if (ill->ill_phys_addr_length == ETHERADDRL) {
17362 		/* Form EUI-64 like address */
17363 		addr = (char *)&v6addr->s6_addr32[2];
17364 		bcopy(ill->ill_phys_addr, addr, 3);
17365 		addr[0] ^= 0x2;		/* Toggle Universal/Local bit */
17366 		addr[3] = (char)0xff;
17367 		addr[4] = (char)0xfe;
17368 		bcopy(ill->ill_phys_addr + 3, addr + 5, 3);
17369 	}
17370 }
17371 
17372 /* ARGSUSED */
17373 static void
ip_nodef_v6intfid(ill_t * ill,in6_addr_t * v6addr)17374 ip_nodef_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17375 {
17376 }
17377 
17378 typedef struct ipmp_ifcookie {
17379 	uint32_t	ic_hostid;
17380 	char		ic_ifname[LIFNAMSIZ];
17381 	char		ic_zonename[ZONENAME_MAX];
17382 } ipmp_ifcookie_t;
17383 
17384 /*
17385  * Construct a pseudo-random interface ID for the IPMP interface that's both
17386  * predictable and (almost) guaranteed to be unique.
17387  */
17388 static void
ip_ipmp_v6intfid(ill_t * ill,in6_addr_t * v6addr)17389 ip_ipmp_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17390 {
17391 	zone_t		*zp;
17392 	uint8_t		*addr;
17393 	uchar_t		hash[16];
17394 	ulong_t 	hostid;
17395 	MD5_CTX		ctx;
17396 	ipmp_ifcookie_t	ic = { 0 };
17397 
17398 	ASSERT(IS_IPMP(ill));
17399 
17400 	(void) ddi_strtoul(hw_serial, NULL, 10, &hostid);
17401 	ic.ic_hostid = htonl((uint32_t)hostid);
17402 
17403 	(void) strlcpy(ic.ic_ifname, ill->ill_name, LIFNAMSIZ);
17404 
17405 	if ((zp = zone_find_by_id(ill->ill_zoneid)) != NULL) {
17406 		(void) strlcpy(ic.ic_zonename, zp->zone_name, ZONENAME_MAX);
17407 		zone_rele(zp);
17408 	}
17409 
17410 	MD5Init(&ctx);
17411 	MD5Update(&ctx, &ic, sizeof (ic));
17412 	MD5Final(hash, &ctx);
17413 
17414 	/*
17415 	 * Map the hash to an interface ID per the basic approach in RFC3041.
17416 	 */
17417 	addr = &v6addr->s6_addr8[8];
17418 	bcopy(hash + 8, addr, sizeof (uint64_t));
17419 	addr[0] &= ~0x2;				/* set local bit */
17420 }
17421 
17422 /*
17423  * Map the multicast in6_addr_t in m_ip6addr to the physaddr for ethernet.
17424  */
17425 static void
ip_ether_v6_mapping(ill_t * ill,uchar_t * m_ip6addr,uchar_t * m_physaddr)17426 ip_ether_v6_mapping(ill_t *ill, uchar_t *m_ip6addr, uchar_t *m_physaddr)
17427 {
17428 	phyint_t *phyi = ill->ill_phyint;
17429 
17430 	/*
17431 	 * Check PHYI_MULTI_BCAST and length of physical
17432 	 * address to determine if we use the mapping or the
17433 	 * broadcast address.
17434 	 */
17435 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) != 0 ||
17436 	    ill->ill_phys_addr_length != ETHERADDRL) {
17437 		ip_mbcast_mapping(ill, m_ip6addr, m_physaddr);
17438 		return;
17439 	}
17440 	m_physaddr[0] = 0x33;
17441 	m_physaddr[1] = 0x33;
17442 	m_physaddr[2] = m_ip6addr[12];
17443 	m_physaddr[3] = m_ip6addr[13];
17444 	m_physaddr[4] = m_ip6addr[14];
17445 	m_physaddr[5] = m_ip6addr[15];
17446 }
17447 
17448 /*
17449  * Map the multicast ipaddr_t in m_ipaddr to the physaddr for ethernet.
17450  */
17451 static void
ip_ether_v4_mapping(ill_t * ill,uchar_t * m_ipaddr,uchar_t * m_physaddr)17452 ip_ether_v4_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17453 {
17454 	phyint_t *phyi = ill->ill_phyint;
17455 
17456 	/*
17457 	 * Check PHYI_MULTI_BCAST and length of physical
17458 	 * address to determine if we use the mapping or the
17459 	 * broadcast address.
17460 	 */
17461 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) != 0 ||
17462 	    ill->ill_phys_addr_length != ETHERADDRL) {
17463 		ip_mbcast_mapping(ill, m_ipaddr, m_physaddr);
17464 		return;
17465 	}
17466 	m_physaddr[0] = 0x01;
17467 	m_physaddr[1] = 0x00;
17468 	m_physaddr[2] = 0x5e;
17469 	m_physaddr[3] = m_ipaddr[1] & 0x7f;
17470 	m_physaddr[4] = m_ipaddr[2];
17471 	m_physaddr[5] = m_ipaddr[3];
17472 }
17473 
17474 /* ARGSUSED */
17475 static void
ip_mbcast_mapping(ill_t * ill,uchar_t * m_ipaddr,uchar_t * m_physaddr)17476 ip_mbcast_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17477 {
17478 	/*
17479 	 * for the MULTI_BCAST case and other cases when we want to
17480 	 * use the link-layer broadcast address for multicast.
17481 	 */
17482 	uint8_t	*bphys_addr;
17483 	dl_unitdata_req_t *dlur;
17484 
17485 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
17486 	if (ill->ill_sap_length < 0) {
17487 		bphys_addr = (uchar_t *)dlur +
17488 		    dlur->dl_dest_addr_offset;
17489 	} else  {
17490 		bphys_addr = (uchar_t *)dlur +
17491 		    dlur->dl_dest_addr_offset + ill->ill_sap_length;
17492 	}
17493 
17494 	bcopy(bphys_addr, m_physaddr, ill->ill_phys_addr_length);
17495 }
17496 
17497 /*
17498  * Derive IPoIB interface id from the link layer address.
17499  */
17500 static void
ip_ib_v6intfid(ill_t * ill,in6_addr_t * v6addr)17501 ip_ib_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17502 {
17503 	char		*addr;
17504 
17505 	ASSERT(ill->ill_phys_addr_length == 20);
17506 	addr = (char *)&v6addr->s6_addr32[2];
17507 	bcopy(ill->ill_phys_addr + 12, addr, 8);
17508 	/*
17509 	 * In IBA 1.1 timeframe, some vendors erroneously set the u/l bit
17510 	 * in the globally assigned EUI-64 GUID to 1, in violation of IEEE
17511 	 * rules. In these cases, the IBA considers these GUIDs to be in
17512 	 * "Modified EUI-64" format, and thus toggling the u/l bit is not
17513 	 * required; vendors are required not to assign global EUI-64's
17514 	 * that differ only in u/l bit values, thus guaranteeing uniqueness
17515 	 * of the interface identifier. Whether the GUID is in modified
17516 	 * or proper EUI-64 format, the ipv6 identifier must have the u/l
17517 	 * bit set to 1.
17518 	 */
17519 	addr[0] |= 2;			/* Set Universal/Local bit to 1 */
17520 }
17521 
17522 /*
17523  * Map the multicast ipaddr_t in m_ipaddr to the physaddr for InfiniBand.
17524  * Note on mapping from multicast IP addresses to IPoIB multicast link
17525  * addresses. IPoIB multicast link addresses are based on IBA link addresses.
17526  * The format of an IPoIB multicast address is:
17527  *
17528  *  4 byte QPN      Scope Sign.  Pkey
17529  * +--------------------------------------------+
17530  * | 00FFFFFF | FF | 1X | X01B | Pkey | GroupID |
17531  * +--------------------------------------------+
17532  *
17533  * The Scope and Pkey components are properties of the IBA port and
17534  * network interface. They can be ascertained from the broadcast address.
17535  * The Sign. part is the signature, and is 401B for IPv4 and 601B for IPv6.
17536  */
17537 static void
ip_ib_v4_mapping(ill_t * ill,uchar_t * m_ipaddr,uchar_t * m_physaddr)17538 ip_ib_v4_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17539 {
17540 	static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
17541 	    0xff, 0x10, 0x40, 0x1b, 0x00, 0x00, 0x00, 0x00,
17542 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
17543 	uint8_t	*bphys_addr;
17544 	dl_unitdata_req_t *dlur;
17545 
17546 	bcopy(ipv4_g_phys_ibmulti_addr, m_physaddr, ill->ill_phys_addr_length);
17547 
17548 	/*
17549 	 * RFC 4391: IPv4 MGID is 28-bit long.
17550 	 */
17551 	m_physaddr[16] = m_ipaddr[0] & 0x0f;
17552 	m_physaddr[17] = m_ipaddr[1];
17553 	m_physaddr[18] = m_ipaddr[2];
17554 	m_physaddr[19] = m_ipaddr[3];
17555 
17556 
17557 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
17558 	if (ill->ill_sap_length < 0) {
17559 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
17560 	} else  {
17561 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset +
17562 		    ill->ill_sap_length;
17563 	}
17564 	/*
17565 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
17566 	 */
17567 	m_physaddr[5] = bphys_addr[5];
17568 	m_physaddr[8] = bphys_addr[8];
17569 	m_physaddr[9] = bphys_addr[9];
17570 }
17571 
17572 static void
ip_ib_v6_mapping(ill_t * ill,uchar_t * m_ipaddr,uchar_t * m_physaddr)17573 ip_ib_v6_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17574 {
17575 	static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
17576 	    0xff, 0x10, 0x60, 0x1b, 0x00, 0x00, 0x00, 0x00,
17577 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
17578 	uint8_t	*bphys_addr;
17579 	dl_unitdata_req_t *dlur;
17580 
17581 	bcopy(ipv4_g_phys_ibmulti_addr, m_physaddr, ill->ill_phys_addr_length);
17582 
17583 	/*
17584 	 * RFC 4391: IPv4 MGID is 80-bit long.
17585 	 */
17586 	bcopy(&m_ipaddr[6], &m_physaddr[10], 10);
17587 
17588 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
17589 	if (ill->ill_sap_length < 0) {
17590 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
17591 	} else  {
17592 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset +
17593 		    ill->ill_sap_length;
17594 	}
17595 	/*
17596 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
17597 	 */
17598 	m_physaddr[5] = bphys_addr[5];
17599 	m_physaddr[8] = bphys_addr[8];
17600 	m_physaddr[9] = bphys_addr[9];
17601 }
17602 
17603 /*
17604  * Derive IPv6 interface id from an IPv4 link-layer address (e.g. from an IPv4
17605  * tunnel).  The IPv4 address simply get placed in the lower 4 bytes of the
17606  * IPv6 interface id.  This is a suggested mechanism described in section 3.7
17607  * of RFC4213.
17608  */
17609 static void
ip_ipv4_genv6intfid(ill_t * ill,uint8_t * physaddr,in6_addr_t * v6addr)17610 ip_ipv4_genv6intfid(ill_t *ill, uint8_t *physaddr, in6_addr_t *v6addr)
17611 {
17612 	ASSERT(ill->ill_phys_addr_length == sizeof (ipaddr_t));
17613 	v6addr->s6_addr32[2] = 0;
17614 	bcopy(physaddr, &v6addr->s6_addr32[3], sizeof (ipaddr_t));
17615 }
17616 
17617 /*
17618  * Derive IPv6 interface id from an IPv6 link-layer address (e.g. from an IPv6
17619  * tunnel).  The lower 8 bytes of the IPv6 address simply become the interface
17620  * id.
17621  */
17622 static void
ip_ipv6_genv6intfid(ill_t * ill,uint8_t * physaddr,in6_addr_t * v6addr)17623 ip_ipv6_genv6intfid(ill_t *ill, uint8_t *physaddr, in6_addr_t *v6addr)
17624 {
17625 	in6_addr_t *v6lladdr = (in6_addr_t *)physaddr;
17626 
17627 	ASSERT(ill->ill_phys_addr_length == sizeof (in6_addr_t));
17628 	bcopy(&v6lladdr->s6_addr32[2], &v6addr->s6_addr32[2], 8);
17629 }
17630 
17631 static void
ip_ipv6_v6intfid(ill_t * ill,in6_addr_t * v6addr)17632 ip_ipv6_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17633 {
17634 	ip_ipv6_genv6intfid(ill, ill->ill_phys_addr, v6addr);
17635 }
17636 
17637 static void
ip_ipv6_v6destintfid(ill_t * ill,in6_addr_t * v6addr)17638 ip_ipv6_v6destintfid(ill_t *ill, in6_addr_t *v6addr)
17639 {
17640 	ip_ipv6_genv6intfid(ill, ill->ill_dest_addr, v6addr);
17641 }
17642 
17643 static void
ip_ipv4_v6intfid(ill_t * ill,in6_addr_t * v6addr)17644 ip_ipv4_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17645 {
17646 	ip_ipv4_genv6intfid(ill, ill->ill_phys_addr, v6addr);
17647 }
17648 
17649 static void
ip_ipv4_v6destintfid(ill_t * ill,in6_addr_t * v6addr)17650 ip_ipv4_v6destintfid(ill_t *ill, in6_addr_t *v6addr)
17651 {
17652 	ip_ipv4_genv6intfid(ill, ill->ill_dest_addr, v6addr);
17653 }
17654 
17655 /*
17656  * Lookup an ill and verify that the zoneid has an ipif on that ill.
17657  * Returns an held ill, or NULL.
17658  */
17659 ill_t *
ill_lookup_on_ifindex_zoneid(uint_t index,zoneid_t zoneid,boolean_t isv6,ip_stack_t * ipst)17660 ill_lookup_on_ifindex_zoneid(uint_t index, zoneid_t zoneid, boolean_t isv6,
17661     ip_stack_t *ipst)
17662 {
17663 	ill_t	*ill;
17664 	ipif_t	*ipif;
17665 
17666 	ill = ill_lookup_on_ifindex(index, isv6, ipst);
17667 	if (ill == NULL)
17668 		return (NULL);
17669 
17670 	mutex_enter(&ill->ill_lock);
17671 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17672 		if (IPIF_IS_CONDEMNED(ipif))
17673 			continue;
17674 		if (zoneid != ALL_ZONES && ipif->ipif_zoneid != zoneid &&
17675 		    ipif->ipif_zoneid != ALL_ZONES)
17676 			continue;
17677 
17678 		mutex_exit(&ill->ill_lock);
17679 		return (ill);
17680 	}
17681 	mutex_exit(&ill->ill_lock);
17682 	ill_refrele(ill);
17683 	return (NULL);
17684 }
17685 
17686 /*
17687  * Return a pointer to an ipif_t given a combination of (ill_idx,ipif_id)
17688  * If a pointer to an ipif_t is returned then the caller will need to do
17689  * an ill_refrele().
17690  */
17691 ipif_t *
ipif_getby_indexes(uint_t ifindex,uint_t lifidx,boolean_t isv6,ip_stack_t * ipst)17692 ipif_getby_indexes(uint_t ifindex, uint_t lifidx, boolean_t isv6,
17693     ip_stack_t *ipst)
17694 {
17695 	ipif_t *ipif;
17696 	ill_t *ill;
17697 
17698 	ill = ill_lookup_on_ifindex(ifindex, isv6, ipst);
17699 	if (ill == NULL)
17700 		return (NULL);
17701 
17702 	mutex_enter(&ill->ill_lock);
17703 	if (ill->ill_state_flags & ILL_CONDEMNED) {
17704 		mutex_exit(&ill->ill_lock);
17705 		ill_refrele(ill);
17706 		return (NULL);
17707 	}
17708 
17709 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17710 		if (!IPIF_CAN_LOOKUP(ipif))
17711 			continue;
17712 		if (lifidx == ipif->ipif_id) {
17713 			ipif_refhold_locked(ipif);
17714 			break;
17715 		}
17716 	}
17717 
17718 	mutex_exit(&ill->ill_lock);
17719 	ill_refrele(ill);
17720 	return (ipif);
17721 }
17722 
17723 /*
17724  * Set ill_inputfn based on the current know state.
17725  * This needs to be called when any of the factors taken into
17726  * account changes.
17727  */
17728 void
ill_set_inputfn(ill_t * ill)17729 ill_set_inputfn(ill_t *ill)
17730 {
17731 	ip_stack_t	*ipst = ill->ill_ipst;
17732 
17733 	if (ill->ill_isv6) {
17734 		if (is_system_labeled())
17735 			ill->ill_inputfn = ill_input_full_v6;
17736 		else
17737 			ill->ill_inputfn = ill_input_short_v6;
17738 	} else {
17739 		if (is_system_labeled())
17740 			ill->ill_inputfn = ill_input_full_v4;
17741 		else if (ill->ill_dhcpinit != 0)
17742 			ill->ill_inputfn = ill_input_full_v4;
17743 		else if (ipst->ips_ipcl_proto_fanout_v4[IPPROTO_RSVP].connf_head
17744 		    != NULL)
17745 			ill->ill_inputfn = ill_input_full_v4;
17746 		else if (ipst->ips_ip_cgtp_filter &&
17747 		    ipst->ips_ip_cgtp_filter_ops != NULL)
17748 			ill->ill_inputfn = ill_input_full_v4;
17749 		else
17750 			ill->ill_inputfn = ill_input_short_v4;
17751 	}
17752 }
17753 
17754 /*
17755  * Re-evaluate ill_inputfn for all the IPv4 ills.
17756  * Used when RSVP and CGTP comes and goes.
17757  */
17758 void
ill_set_inputfn_all(ip_stack_t * ipst)17759 ill_set_inputfn_all(ip_stack_t *ipst)
17760 {
17761 	ill_walk_context_t	ctx;
17762 	ill_t			*ill;
17763 
17764 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
17765 	ill = ILL_START_WALK_V4(&ctx, ipst);
17766 	for (; ill != NULL; ill = ill_next(&ctx, ill))
17767 		ill_set_inputfn(ill);
17768 
17769 	rw_exit(&ipst->ips_ill_g_lock);
17770 }
17771 
17772 /*
17773  * Set the physical address information for `ill' to the contents of the
17774  * dl_notify_ind_t pointed to by `mp'.  Must be called as writer, and will be
17775  * asynchronous if `ill' cannot immediately be quiesced -- in which case
17776  * EINPROGRESS will be returned.
17777  */
17778 int
ill_set_phys_addr(ill_t * ill,mblk_t * mp)17779 ill_set_phys_addr(ill_t *ill, mblk_t *mp)
17780 {
17781 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
17782 	dl_notify_ind_t	*dlindp = (dl_notify_ind_t *)mp->b_rptr;
17783 
17784 	ASSERT(IAM_WRITER_IPSQ(ipsq));
17785 
17786 	if (dlindp->dl_data != DL_IPV6_LINK_LAYER_ADDR &&
17787 	    dlindp->dl_data != DL_CURR_DEST_ADDR &&
17788 	    dlindp->dl_data != DL_CURR_PHYS_ADDR) {
17789 		/* Changing DL_IPV6_TOKEN is not yet supported */
17790 		return (0);
17791 	}
17792 
17793 	/*
17794 	 * We need to store up to two copies of `mp' in `ill'.  Due to the
17795 	 * design of ipsq_pending_mp_add(), we can't pass them as separate
17796 	 * arguments to ill_set_phys_addr_tail().  Instead, chain them
17797 	 * together here, then pull 'em apart in ill_set_phys_addr_tail().
17798 	 */
17799 	if ((mp = copyb(mp)) == NULL || (mp->b_cont = copyb(mp)) == NULL) {
17800 		freemsg(mp);
17801 		return (ENOMEM);
17802 	}
17803 
17804 	ipsq_current_start(ipsq, ill->ill_ipif, 0);
17805 
17806 	/*
17807 	 * Since we'll only do a logical down, we can't rely on ipif_down
17808 	 * to turn on ILL_DOWN_IN_PROGRESS, or for the DL_BIND_ACK to reset
17809 	 * ILL_DOWN_IN_PROGRESS. We instead manage this separately for this
17810 	 * case, to quiesce ire's and nce's for ill_is_quiescent.
17811 	 */
17812 	mutex_enter(&ill->ill_lock);
17813 	ill->ill_state_flags |= ILL_DOWN_IN_PROGRESS;
17814 	/* no more ire/nce addition allowed */
17815 	mutex_exit(&ill->ill_lock);
17816 
17817 	/*
17818 	 * If we can quiesce the ill, then set the address.  If not, then
17819 	 * ill_set_phys_addr_tail() will be called from ipif_ill_refrele_tail().
17820 	 */
17821 	ill_down_ipifs(ill, B_TRUE);
17822 	mutex_enter(&ill->ill_lock);
17823 	if (!ill_is_quiescent(ill)) {
17824 		/* call cannot fail since `conn_t *' argument is NULL */
17825 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
17826 		    mp, ILL_DOWN);
17827 		mutex_exit(&ill->ill_lock);
17828 		return (EINPROGRESS);
17829 	}
17830 	mutex_exit(&ill->ill_lock);
17831 
17832 	ill_set_phys_addr_tail(ipsq, ill->ill_rq, mp, NULL);
17833 	return (0);
17834 }
17835 
17836 /*
17837  * When the allowed-ips link property is set on the datalink, IP receives a
17838  * DL_NOTE_ALLOWED_IPS notification that is processed in ill_set_allowed_ips()
17839  * to initialize the ill_allowed_ips[] array in the ill_t. This array is then
17840  * used to vet addresses passed to ip_sioctl_addr() and to ensure that the
17841  * only IP addresses configured on the ill_t are those in the ill_allowed_ips[]
17842  * array.
17843  */
17844 void
ill_set_allowed_ips(ill_t * ill,mblk_t * mp)17845 ill_set_allowed_ips(ill_t *ill, mblk_t *mp)
17846 {
17847 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
17848 	dl_notify_ind_t	*dlip = (dl_notify_ind_t *)mp->b_rptr;
17849 	mac_protect_t *mrp;
17850 	int i;
17851 
17852 	ASSERT(IAM_WRITER_IPSQ(ipsq));
17853 	mrp = (mac_protect_t *)&dlip[1];
17854 
17855 	if (mrp->mp_ipaddrcnt == 0) { /* reset allowed-ips */
17856 		kmem_free(ill->ill_allowed_ips,
17857 		    ill->ill_allowed_ips_cnt * sizeof (in6_addr_t));
17858 		ill->ill_allowed_ips_cnt = 0;
17859 		ill->ill_allowed_ips = NULL;
17860 		mutex_enter(&ill->ill_phyint->phyint_lock);
17861 		ill->ill_phyint->phyint_flags &= ~PHYI_L3PROTECT;
17862 		mutex_exit(&ill->ill_phyint->phyint_lock);
17863 		return;
17864 	}
17865 
17866 	if (ill->ill_allowed_ips != NULL) {
17867 		kmem_free(ill->ill_allowed_ips,
17868 		    ill->ill_allowed_ips_cnt * sizeof (in6_addr_t));
17869 	}
17870 	ill->ill_allowed_ips_cnt = mrp->mp_ipaddrcnt;
17871 	ill->ill_allowed_ips = kmem_alloc(
17872 	    ill->ill_allowed_ips_cnt * sizeof (in6_addr_t), KM_SLEEP);
17873 	for (i = 0; i < mrp->mp_ipaddrcnt;  i++)
17874 		ill->ill_allowed_ips[i] = mrp->mp_ipaddrs[i].ip_addr;
17875 
17876 	mutex_enter(&ill->ill_phyint->phyint_lock);
17877 	ill->ill_phyint->phyint_flags |= PHYI_L3PROTECT;
17878 	mutex_exit(&ill->ill_phyint->phyint_lock);
17879 }
17880 
17881 /*
17882  * Once the ill associated with `q' has quiesced, set its physical address
17883  * information to the values in `addrmp'.  Note that two copies of `addrmp'
17884  * are passed (linked by b_cont), since we sometimes need to save two distinct
17885  * copies in the ill_t, and our context doesn't permit sleeping or allocation
17886  * failure (we'll free the other copy if it's not needed).  Since the ill_t
17887  * is quiesced, we know any stale nce's with the old address information have
17888  * already been removed, so we don't need to call nce_flush().
17889  */
17890 /* ARGSUSED */
17891 static void
ill_set_phys_addr_tail(ipsq_t * ipsq,queue_t * q,mblk_t * addrmp,void * dummy)17892 ill_set_phys_addr_tail(ipsq_t *ipsq, queue_t *q, mblk_t *addrmp, void *dummy)
17893 {
17894 	ill_t		*ill = q->q_ptr;
17895 	mblk_t		*addrmp2 = unlinkb(addrmp);
17896 	dl_notify_ind_t	*dlindp = (dl_notify_ind_t *)addrmp->b_rptr;
17897 	uint_t		addrlen, addroff;
17898 	int		status;
17899 
17900 	ASSERT(IAM_WRITER_IPSQ(ipsq));
17901 
17902 	addroff	= dlindp->dl_addr_offset;
17903 	addrlen = dlindp->dl_addr_length - ABS(ill->ill_sap_length);
17904 
17905 	switch (dlindp->dl_data) {
17906 	case DL_IPV6_LINK_LAYER_ADDR:
17907 		ill_set_ndmp(ill, addrmp, addroff, addrlen);
17908 		freemsg(addrmp2);
17909 		break;
17910 
17911 	case DL_CURR_DEST_ADDR:
17912 		freemsg(ill->ill_dest_addr_mp);
17913 		ill->ill_dest_addr = addrmp->b_rptr + addroff;
17914 		ill->ill_dest_addr_mp = addrmp;
17915 		if (ill->ill_isv6) {
17916 			ill_setdesttoken(ill);
17917 			ipif_setdestlinklocal(ill->ill_ipif);
17918 		}
17919 		freemsg(addrmp2);
17920 		break;
17921 
17922 	case DL_CURR_PHYS_ADDR:
17923 		freemsg(ill->ill_phys_addr_mp);
17924 		ill->ill_phys_addr = addrmp->b_rptr + addroff;
17925 		ill->ill_phys_addr_mp = addrmp;
17926 		ill->ill_phys_addr_length = addrlen;
17927 		if (ill->ill_isv6)
17928 			ill_set_ndmp(ill, addrmp2, addroff, addrlen);
17929 		else
17930 			freemsg(addrmp2);
17931 		if (ill->ill_isv6) {
17932 			ill_setdefaulttoken(ill);
17933 			ipif_setlinklocal(ill->ill_ipif);
17934 		}
17935 		break;
17936 	default:
17937 		ASSERT(0);
17938 	}
17939 
17940 	/*
17941 	 * reset ILL_DOWN_IN_PROGRESS so that we can successfully add ires
17942 	 * as we bring the ipifs up again.
17943 	 */
17944 	mutex_enter(&ill->ill_lock);
17945 	ill->ill_state_flags &= ~ILL_DOWN_IN_PROGRESS;
17946 	mutex_exit(&ill->ill_lock);
17947 	/*
17948 	 * If there are ipifs to bring up, ill_up_ipifs() will return
17949 	 * EINPROGRESS, and ipsq_current_finish() will be called by
17950 	 * ip_rput_dlpi_writer() or arp_bringup_done() when the last ipif is
17951 	 * brought up.
17952 	 */
17953 	status = ill_up_ipifs(ill, q, addrmp);
17954 	if (status != EINPROGRESS)
17955 		ipsq_current_finish(ipsq);
17956 }
17957 
17958 /*
17959  * Helper routine for setting the ill_nd_lla fields.
17960  */
17961 void
ill_set_ndmp(ill_t * ill,mblk_t * ndmp,uint_t addroff,uint_t addrlen)17962 ill_set_ndmp(ill_t *ill, mblk_t *ndmp, uint_t addroff, uint_t addrlen)
17963 {
17964 	freemsg(ill->ill_nd_lla_mp);
17965 	ill->ill_nd_lla = ndmp->b_rptr + addroff;
17966 	ill->ill_nd_lla_mp = ndmp;
17967 	ill->ill_nd_lla_len = addrlen;
17968 }
17969 
17970 /*
17971  * Replumb the ill.
17972  */
17973 int
ill_replumb(ill_t * ill,mblk_t * mp)17974 ill_replumb(ill_t *ill, mblk_t *mp)
17975 {
17976 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
17977 
17978 	ASSERT(IAM_WRITER_IPSQ(ipsq));
17979 
17980 	ipsq_current_start(ipsq, ill->ill_ipif, 0);
17981 
17982 	/*
17983 	 * If we can quiesce the ill, then continue.  If not, then
17984 	 * ill_replumb_tail() will be called from ipif_ill_refrele_tail().
17985 	 */
17986 	ill_down_ipifs(ill, B_FALSE);
17987 
17988 	mutex_enter(&ill->ill_lock);
17989 	if (!ill_is_quiescent(ill)) {
17990 		/* call cannot fail since `conn_t *' argument is NULL */
17991 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
17992 		    mp, ILL_DOWN);
17993 		mutex_exit(&ill->ill_lock);
17994 		return (EINPROGRESS);
17995 	}
17996 	mutex_exit(&ill->ill_lock);
17997 
17998 	ill_replumb_tail(ipsq, ill->ill_rq, mp, NULL);
17999 	return (0);
18000 }
18001 
18002 /* ARGSUSED */
18003 static void
ill_replumb_tail(ipsq_t * ipsq,queue_t * q,mblk_t * mp,void * dummy)18004 ill_replumb_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy)
18005 {
18006 	ill_t *ill = q->q_ptr;
18007 	int err;
18008 	conn_t *connp = NULL;
18009 
18010 	ASSERT(IAM_WRITER_IPSQ(ipsq));
18011 	freemsg(ill->ill_replumb_mp);
18012 	ill->ill_replumb_mp = copyb(mp);
18013 
18014 	if (ill->ill_replumb_mp == NULL) {
18015 		/* out of memory */
18016 		ipsq_current_finish(ipsq);
18017 		return;
18018 	}
18019 
18020 	mutex_enter(&ill->ill_lock);
18021 	ill->ill_up_ipifs = ipsq_pending_mp_add(NULL, ill->ill_ipif,
18022 	    ill->ill_rq, ill->ill_replumb_mp, 0);
18023 	mutex_exit(&ill->ill_lock);
18024 
18025 	if (!ill->ill_up_ipifs) {
18026 		/* already closing */
18027 		ipsq_current_finish(ipsq);
18028 		return;
18029 	}
18030 	ill->ill_replumbing = 1;
18031 	err = ill_down_ipifs_tail(ill);
18032 
18033 	/*
18034 	 * Successfully quiesced and brought down the interface, now we send
18035 	 * the DL_NOTE_REPLUMB_DONE message down to the driver. Reuse the
18036 	 * DL_NOTE_REPLUMB message.
18037 	 */
18038 	mp = mexchange(NULL, mp, sizeof (dl_notify_conf_t), M_PROTO,
18039 	    DL_NOTIFY_CONF);
18040 	ASSERT(mp != NULL);
18041 	((dl_notify_conf_t *)mp->b_rptr)->dl_notification =
18042 	    DL_NOTE_REPLUMB_DONE;
18043 	ill_dlpi_send(ill, mp);
18044 
18045 	/*
18046 	 * For IPv4, we would usually get EINPROGRESS because the ETHERTYPE_ARP
18047 	 * streams have to be unbound. When all the DLPI exchanges are done,
18048 	 * ipsq_current_finish() will be called by arp_bringup_done(). The
18049 	 * remainder of ipif bringup via ill_up_ipifs() will also be done in
18050 	 * arp_bringup_done().
18051 	 */
18052 	ASSERT(ill->ill_replumb_mp != NULL);
18053 	if (err == EINPROGRESS)
18054 		return;
18055 	else
18056 		ill->ill_replumb_mp = ipsq_pending_mp_get(ipsq, &connp);
18057 	ASSERT(connp == NULL);
18058 	if (err == 0 && ill->ill_replumb_mp != NULL &&
18059 	    ill_up_ipifs(ill, q, ill->ill_replumb_mp) == EINPROGRESS) {
18060 		return;
18061 	}
18062 	ipsq_current_finish(ipsq);
18063 }
18064 
18065 /*
18066  * Issue ioctl `cmd' on `lh'; caller provides the initial payload in `buf'
18067  * which is `bufsize' bytes.  On success, zero is returned and `buf' updated
18068  * as per the ioctl.  On failure, an errno is returned.
18069  */
18070 static int
ip_ioctl(ldi_handle_t lh,int cmd,void * buf,uint_t bufsize,cred_t * cr)18071 ip_ioctl(ldi_handle_t lh, int cmd, void *buf, uint_t bufsize, cred_t *cr)
18072 {
18073 	int rval;
18074 	struct strioctl iocb;
18075 
18076 	iocb.ic_cmd = cmd;
18077 	iocb.ic_timout = 15;
18078 	iocb.ic_len = bufsize;
18079 	iocb.ic_dp = buf;
18080 
18081 	return (ldi_ioctl(lh, I_STR, (intptr_t)&iocb, FKIOCTL, cr, &rval));
18082 }
18083 
18084 /*
18085  * Issue an SIOCGLIFCONF for address family `af' and store the result into a
18086  * dynamically-allocated `lifcp' that will be `bufsizep' bytes on success.
18087  */
18088 static int
ip_lifconf_ioctl(ldi_handle_t lh,int af,struct lifconf * lifcp,uint_t * bufsizep,cred_t * cr)18089 ip_lifconf_ioctl(ldi_handle_t lh, int af, struct lifconf *lifcp,
18090     uint_t *bufsizep, cred_t *cr)
18091 {
18092 	int err;
18093 	struct lifnum lifn;
18094 
18095 	bzero(&lifn, sizeof (lifn));
18096 	lifn.lifn_family = af;
18097 	lifn.lifn_flags = LIFC_UNDER_IPMP;
18098 
18099 	if ((err = ip_ioctl(lh, SIOCGLIFNUM, &lifn, sizeof (lifn), cr)) != 0)
18100 		return (err);
18101 
18102 	/*
18103 	 * Pad the interface count to account for additional interfaces that
18104 	 * may have been configured between the SIOCGLIFNUM and SIOCGLIFCONF.
18105 	 */
18106 	lifn.lifn_count += 4;
18107 	bzero(lifcp, sizeof (*lifcp));
18108 	lifcp->lifc_flags = LIFC_UNDER_IPMP;
18109 	lifcp->lifc_family = af;
18110 	lifcp->lifc_len = *bufsizep = lifn.lifn_count * sizeof (struct lifreq);
18111 	lifcp->lifc_buf = kmem_zalloc(*bufsizep, KM_SLEEP);
18112 
18113 	err = ip_ioctl(lh, SIOCGLIFCONF, lifcp, sizeof (*lifcp), cr);
18114 	if (err != 0) {
18115 		kmem_free(lifcp->lifc_buf, *bufsizep);
18116 		return (err);
18117 	}
18118 
18119 	return (0);
18120 }
18121 
18122 /*
18123  * Helper for ip_interface_cleanup() that removes the loopback interface.
18124  */
18125 static void
ip_loopback_removeif(ldi_handle_t lh,boolean_t isv6,cred_t * cr)18126 ip_loopback_removeif(ldi_handle_t lh, boolean_t isv6, cred_t *cr)
18127 {
18128 	int err;
18129 	struct lifreq lifr;
18130 
18131 	bzero(&lifr, sizeof (lifr));
18132 	(void) strcpy(lifr.lifr_name, ipif_loopback_name);
18133 
18134 	/*
18135 	 * Attempt to remove the interface.  It may legitimately not exist
18136 	 * (e.g. the zone administrator unplumbed it), so ignore ENXIO.
18137 	 */
18138 	err = ip_ioctl(lh, SIOCLIFREMOVEIF, &lifr, sizeof (lifr), cr);
18139 	if (err != 0 && err != ENXIO) {
18140 		ip0dbg(("ip_loopback_removeif: IP%s SIOCLIFREMOVEIF failed: "
18141 		    "error %d\n", isv6 ? "v6" : "v4", err));
18142 	}
18143 }
18144 
18145 /*
18146  * Helper for ip_interface_cleanup() that ensures no IP interfaces are in IPMP
18147  * groups and that IPMP data addresses are down.  These conditions must be met
18148  * so that IPMP interfaces can be I_PUNLINK'd, as per ip_sioctl_plink_ipmp().
18149  */
18150 static void
ip_ipmp_cleanup(ldi_handle_t lh,boolean_t isv6,cred_t * cr)18151 ip_ipmp_cleanup(ldi_handle_t lh, boolean_t isv6, cred_t *cr)
18152 {
18153 	int af = isv6 ? AF_INET6 : AF_INET;
18154 	int i, nifs;
18155 	int err;
18156 	uint_t bufsize;
18157 	uint_t lifrsize = sizeof (struct lifreq);
18158 	struct lifconf lifc;
18159 	struct lifreq *lifrp;
18160 
18161 	if ((err = ip_lifconf_ioctl(lh, af, &lifc, &bufsize, cr)) != 0) {
18162 		cmn_err(CE_WARN, "ip_ipmp_cleanup: cannot get interface list "
18163 		    "(error %d); any IPMP interfaces cannot be shutdown", err);
18164 		return;
18165 	}
18166 
18167 	nifs = lifc.lifc_len / lifrsize;
18168 	for (lifrp = lifc.lifc_req, i = 0; i < nifs; i++, lifrp++) {
18169 		err = ip_ioctl(lh, SIOCGLIFFLAGS, lifrp, lifrsize, cr);
18170 		if (err != 0) {
18171 			cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot get "
18172 			    "flags: error %d", lifrp->lifr_name, err);
18173 			continue;
18174 		}
18175 
18176 		if (lifrp->lifr_flags & IFF_IPMP) {
18177 			if ((lifrp->lifr_flags & (IFF_UP|IFF_DUPLICATE)) == 0)
18178 				continue;
18179 
18180 			lifrp->lifr_flags &= ~IFF_UP;
18181 			err = ip_ioctl(lh, SIOCSLIFFLAGS, lifrp, lifrsize, cr);
18182 			if (err != 0) {
18183 				cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot "
18184 				    "bring down (error %d); IPMP interface may "
18185 				    "not be shutdown", lifrp->lifr_name, err);
18186 			}
18187 
18188 			/*
18189 			 * Check if IFF_DUPLICATE is still set -- and if so,
18190 			 * reset the address to clear it.
18191 			 */
18192 			err = ip_ioctl(lh, SIOCGLIFFLAGS, lifrp, lifrsize, cr);
18193 			if (err != 0 || !(lifrp->lifr_flags & IFF_DUPLICATE))
18194 				continue;
18195 
18196 			err = ip_ioctl(lh, SIOCGLIFADDR, lifrp, lifrsize, cr);
18197 			if (err != 0 || (err = ip_ioctl(lh, SIOCGLIFADDR,
18198 			    lifrp, lifrsize, cr)) != 0) {
18199 				cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot "
18200 				    "reset DAD (error %d); IPMP interface may "
18201 				    "not be shutdown", lifrp->lifr_name, err);
18202 			}
18203 			continue;
18204 		}
18205 
18206 		if (strchr(lifrp->lifr_name, IPIF_SEPARATOR_CHAR) == 0) {
18207 			lifrp->lifr_groupname[0] = '\0';
18208 			if ((err = ip_ioctl(lh, SIOCSLIFGROUPNAME, lifrp,
18209 			    lifrsize, cr)) != 0) {
18210 				cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot "
18211 				    "leave IPMP group (error %d); associated "
18212 				    "IPMP interface may not be shutdown",
18213 				    lifrp->lifr_name, err);
18214 				continue;
18215 			}
18216 		}
18217 	}
18218 
18219 	kmem_free(lifc.lifc_buf, bufsize);
18220 }
18221 
18222 #define	UDPDEV		"/devices/pseudo/udp@0:udp"
18223 #define	UDP6DEV		"/devices/pseudo/udp6@0:udp6"
18224 
18225 /*
18226  * Remove the loopback interfaces and prep the IPMP interfaces to be torn down.
18227  * Non-loopback interfaces are either I_LINK'd or I_PLINK'd; the former go away
18228  * when the user-level processes in the zone are killed and the latter are
18229  * cleaned up by str_stack_shutdown().
18230  */
18231 void
ip_interface_cleanup(ip_stack_t * ipst)18232 ip_interface_cleanup(ip_stack_t *ipst)
18233 {
18234 	ldi_handle_t	lh;
18235 	ldi_ident_t	li;
18236 	cred_t		*cr;
18237 	int		err;
18238 	int		i;
18239 	char		*devs[] = { UDP6DEV, UDPDEV };
18240 	netstackid_t	stackid = ipst->ips_netstack->netstack_stackid;
18241 
18242 	if ((err = ldi_ident_from_major(ddi_name_to_major("ip"), &li)) != 0) {
18243 		cmn_err(CE_WARN, "ip_interface_cleanup: cannot get ldi ident:"
18244 		    " error %d", err);
18245 		return;
18246 	}
18247 
18248 	cr = zone_get_kcred(netstackid_to_zoneid(stackid));
18249 	ASSERT(cr != NULL);
18250 
18251 	/*
18252 	 * NOTE: loop executes exactly twice and is hardcoded to know that the
18253 	 * first iteration is IPv6.  (Unrolling yields repetitious code, hence
18254 	 * the loop.)
18255 	 */
18256 	for (i = 0; i < 2; i++) {
18257 		err = ldi_open_by_name(devs[i], FREAD|FWRITE, cr, &lh, li);
18258 		if (err != 0) {
18259 			cmn_err(CE_WARN, "ip_interface_cleanup: cannot open %s:"
18260 			    " error %d", devs[i], err);
18261 			continue;
18262 		}
18263 
18264 		ip_loopback_removeif(lh, i == 0, cr);
18265 		ip_ipmp_cleanup(lh, i == 0, cr);
18266 
18267 		(void) ldi_close(lh, FREAD|FWRITE, cr);
18268 	}
18269 
18270 	ldi_ident_release(li);
18271 	crfree(cr);
18272 }
18273 
18274 /*
18275  * This needs to be in-sync with nic_event_t definition
18276  */
18277 static const char *
ill_hook_event2str(nic_event_t event)18278 ill_hook_event2str(nic_event_t event)
18279 {
18280 	switch (event) {
18281 	case NE_PLUMB:
18282 		return ("PLUMB");
18283 	case NE_UNPLUMB:
18284 		return ("UNPLUMB");
18285 	case NE_UP:
18286 		return ("UP");
18287 	case NE_DOWN:
18288 		return ("DOWN");
18289 	case NE_ADDRESS_CHANGE:
18290 		return ("ADDRESS_CHANGE");
18291 	case NE_LIF_UP:
18292 		return ("LIF_UP");
18293 	case NE_LIF_DOWN:
18294 		return ("LIF_DOWN");
18295 	case NE_IFINDEX_CHANGE:
18296 		return ("IFINDEX_CHANGE");
18297 	default:
18298 		return ("UNKNOWN");
18299 	}
18300 }
18301 
18302 void
ill_nic_event_dispatch(ill_t * ill,lif_if_t lif,nic_event_t event,nic_event_data_t data,size_t datalen)18303 ill_nic_event_dispatch(ill_t *ill, lif_if_t lif, nic_event_t event,
18304     nic_event_data_t data, size_t datalen)
18305 {
18306 	ip_stack_t		*ipst = ill->ill_ipst;
18307 	hook_nic_event_int_t	*info;
18308 	const char		*str = NULL;
18309 
18310 	/* create a new nic event info */
18311 	if ((info = kmem_alloc(sizeof (*info), KM_NOSLEEP)) == NULL)
18312 		goto fail;
18313 
18314 	info->hnei_event.hne_nic = ill->ill_phyint->phyint_ifindex;
18315 	info->hnei_event.hne_lif = lif;
18316 	info->hnei_event.hne_event = event;
18317 	info->hnei_event.hne_protocol = ill->ill_isv6 ?
18318 	    ipst->ips_ipv6_net_data : ipst->ips_ipv4_net_data;
18319 	info->hnei_event.hne_data = NULL;
18320 	info->hnei_event.hne_datalen = 0;
18321 	info->hnei_stackid = ipst->ips_netstack->netstack_stackid;
18322 
18323 	if (data != NULL && datalen != 0) {
18324 		info->hnei_event.hne_data = kmem_alloc(datalen, KM_NOSLEEP);
18325 		if (info->hnei_event.hne_data == NULL)
18326 			goto fail;
18327 		bcopy(data, info->hnei_event.hne_data, datalen);
18328 		info->hnei_event.hne_datalen = datalen;
18329 	}
18330 
18331 	if (ddi_taskq_dispatch(eventq_queue_nic, ip_ne_queue_func, info,
18332 	    DDI_NOSLEEP) == DDI_SUCCESS)
18333 		return;
18334 
18335 fail:
18336 	if (info != NULL) {
18337 		if (info->hnei_event.hne_data != NULL) {
18338 			kmem_free(info->hnei_event.hne_data,
18339 			    info->hnei_event.hne_datalen);
18340 		}
18341 		kmem_free(info, sizeof (hook_nic_event_t));
18342 	}
18343 	str = ill_hook_event2str(event);
18344 	ip2dbg(("ill_nic_event_dispatch: could not dispatch %s nic event "
18345 	    "information for %s (ENOMEM)\n", str, ill->ill_name));
18346 }
18347 
18348 static int
ipif_arp_up_done_tail(ipif_t * ipif,enum ip_resolver_action res_act)18349 ipif_arp_up_done_tail(ipif_t *ipif, enum ip_resolver_action res_act)
18350 {
18351 	int		err = 0;
18352 	const in_addr_t	*addr = NULL;
18353 	nce_t		*nce = NULL;
18354 	ill_t		*ill = ipif->ipif_ill;
18355 	ill_t		*bound_ill;
18356 	boolean_t	added_ipif = B_FALSE;
18357 	uint16_t	state;
18358 	uint16_t	flags;
18359 
18360 	DTRACE_PROBE3(ipif__downup, char *, "ipif_arp_up_done_tail",
18361 	    ill_t *, ill, ipif_t *, ipif);
18362 	if (ipif->ipif_lcl_addr != INADDR_ANY) {
18363 		addr = &ipif->ipif_lcl_addr;
18364 	}
18365 
18366 	if ((ipif->ipif_flags & IPIF_UNNUMBERED) || addr == NULL) {
18367 		if (res_act != Res_act_initial)
18368 			return (EINVAL);
18369 	}
18370 
18371 	if (addr != NULL) {
18372 		ipmp_illgrp_t	*illg = ill->ill_grp;
18373 
18374 		/* add unicast nce for the local addr */
18375 
18376 		if (IS_IPMP(ill)) {
18377 			/*
18378 			 * If we're here via ipif_up(), then the ipif
18379 			 * won't be bound yet -- add it to the group,
18380 			 * which will bind it if possible. (We would
18381 			 * add it in ipif_up(), but deleting on failure
18382 			 * there is gruesome.)  If we're here via
18383 			 * ipmp_ill_bind_ipif(), then the ipif has
18384 			 * already been added to the group and we
18385 			 * just need to use the binding.
18386 			 */
18387 			if ((bound_ill = ipmp_ipif_bound_ill(ipif)) == NULL) {
18388 				bound_ill  = ipmp_illgrp_add_ipif(illg, ipif);
18389 				if (bound_ill == NULL) {
18390 					/*
18391 					 * We couldn't bind the ipif to an ill
18392 					 * yet, so we have nothing to publish.
18393 					 * Mark the address as ready and return.
18394 					 */
18395 					ipif->ipif_addr_ready = 1;
18396 					return (0);
18397 				}
18398 				added_ipif = B_TRUE;
18399 			}
18400 		} else {
18401 			bound_ill = ill;
18402 		}
18403 
18404 		flags = (NCE_F_MYADDR | NCE_F_PUBLISH | NCE_F_AUTHORITY |
18405 		    NCE_F_NONUD);
18406 		/*
18407 		 * If this is an initial bring-up (or the ipif was never
18408 		 * completely brought up), do DAD.  Otherwise, we're here
18409 		 * because IPMP has rebound an address to this ill: send
18410 		 * unsolicited advertisements (ARP announcements) to
18411 		 * inform others.
18412 		 */
18413 		if (res_act == Res_act_initial || !ipif->ipif_addr_ready) {
18414 			state = ND_UNCHANGED; /* compute in nce_add_common() */
18415 		} else {
18416 			state = ND_REACHABLE;
18417 			flags |= NCE_F_UNSOL_ADV;
18418 		}
18419 
18420 retry:
18421 		err = nce_lookup_then_add_v4(ill,
18422 		    bound_ill->ill_phys_addr, bound_ill->ill_phys_addr_length,
18423 		    addr, flags, state, &nce);
18424 
18425 		/*
18426 		 * note that we may encounter EEXIST if we are moving
18427 		 * the nce as a result of a rebind operation.
18428 		 */
18429 		switch (err) {
18430 		case 0:
18431 			ipif->ipif_added_nce = 1;
18432 			nce->nce_ipif_cnt++;
18433 			break;
18434 		case EEXIST:
18435 			ip1dbg(("ipif_arp_up: NCE already exists for %s\n",
18436 			    ill->ill_name));
18437 			if (!NCE_MYADDR(nce->nce_common)) {
18438 				/*
18439 				 * A leftover nce from before this address
18440 				 * existed
18441 				 */
18442 				ncec_delete(nce->nce_common);
18443 				nce_refrele(nce);
18444 				nce = NULL;
18445 				goto retry;
18446 			}
18447 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
18448 				nce_refrele(nce);
18449 				nce = NULL;
18450 				ip1dbg(("ipif_arp_up: NCE already exists "
18451 				    "for %s:%u\n", ill->ill_name,
18452 				    ipif->ipif_id));
18453 				goto arp_up_done;
18454 			}
18455 			/*
18456 			 * Duplicate local addresses are permissible for
18457 			 * IPIF_POINTOPOINT interfaces which will get marked
18458 			 * IPIF_UNNUMBERED later in
18459 			 * ip_addr_availability_check().
18460 			 *
18461 			 * The nce_ipif_cnt field tracks the number of
18462 			 * ipifs that have nce_addr as their local address.
18463 			 */
18464 			ipif->ipif_addr_ready = 1;
18465 			ipif->ipif_added_nce = 1;
18466 			nce->nce_ipif_cnt++;
18467 			err = 0;
18468 			break;
18469 		default:
18470 			ASSERT(nce == NULL);
18471 			goto arp_up_done;
18472 		}
18473 		if (arp_no_defense) {
18474 			if ((ipif->ipif_flags & IPIF_UP) &&
18475 			    !ipif->ipif_addr_ready)
18476 				ipif_up_notify(ipif);
18477 			ipif->ipif_addr_ready = 1;
18478 		}
18479 	} else {
18480 		/* zero address. nothing to publish */
18481 		ipif->ipif_addr_ready = 1;
18482 	}
18483 	if (nce != NULL)
18484 		nce_refrele(nce);
18485 arp_up_done:
18486 	if (added_ipif && err != 0)
18487 		ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
18488 	return (err);
18489 }
18490 
18491 int
ipif_arp_up(ipif_t * ipif,enum ip_resolver_action res_act,boolean_t was_dup)18492 ipif_arp_up(ipif_t *ipif, enum ip_resolver_action res_act, boolean_t was_dup)
18493 {
18494 	int 		err = 0;
18495 	ill_t 		*ill = ipif->ipif_ill;
18496 	boolean_t	first_interface, wait_for_dlpi = B_FALSE;
18497 
18498 	DTRACE_PROBE3(ipif__downup, char *, "ipif_arp_up",
18499 	    ill_t *, ill, ipif_t *, ipif);
18500 
18501 	/*
18502 	 * need to bring up ARP or setup mcast mapping only
18503 	 * when the first interface is coming UP.
18504 	 */
18505 	first_interface = (ill->ill_ipif_up_count == 0 &&
18506 	    ill->ill_ipif_dup_count == 0 && !was_dup);
18507 
18508 	if (res_act == Res_act_initial && first_interface) {
18509 		/*
18510 		 * Send ATTACH + BIND
18511 		 */
18512 		err = arp_ll_up(ill);
18513 		if (err != EINPROGRESS && err != 0)
18514 			return (err);
18515 
18516 		/*
18517 		 * Add NCE for local address. Start DAD.
18518 		 * we'll wait to hear that DAD has finished
18519 		 * before using the interface.
18520 		 */
18521 		if (err == EINPROGRESS)
18522 			wait_for_dlpi = B_TRUE;
18523 	}
18524 
18525 	if (!wait_for_dlpi)
18526 		(void) ipif_arp_up_done_tail(ipif, res_act);
18527 
18528 	return (!wait_for_dlpi ? 0 : EINPROGRESS);
18529 }
18530 
18531 /*
18532  * Finish processing of "arp_up" after all the DLPI message
18533  * exchanges have completed between arp and the driver.
18534  */
18535 void
arp_bringup_done(ill_t * ill,int err)18536 arp_bringup_done(ill_t *ill, int err)
18537 {
18538 	mblk_t	*mp1;
18539 	ipif_t  *ipif;
18540 	conn_t *connp = NULL;
18541 	ipsq_t	*ipsq;
18542 	queue_t *q;
18543 
18544 	ip1dbg(("arp_bringup_done(%s)\n", ill->ill_name));
18545 
18546 	ASSERT(IAM_WRITER_ILL(ill));
18547 
18548 	ipsq = ill->ill_phyint->phyint_ipsq;
18549 	ipif = ipsq->ipsq_xop->ipx_pending_ipif;
18550 	mp1 = ipsq_pending_mp_get(ipsq, &connp);
18551 	ASSERT(!((mp1 != NULL) ^ (ipif != NULL)));
18552 	if (mp1 == NULL) /* bringup was aborted by the user */
18553 		return;
18554 
18555 	/*
18556 	 * If an IOCTL is waiting on this (ipsq_current_ioctl != 0), then we
18557 	 * must have an associated conn_t.  Otherwise, we're bringing this
18558 	 * interface back up as part of handling an asynchronous event (e.g.,
18559 	 * physical address change).
18560 	 */
18561 	if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18562 		ASSERT(connp != NULL);
18563 		q = CONNP_TO_WQ(connp);
18564 	} else {
18565 		ASSERT(connp == NULL);
18566 		q = ill->ill_rq;
18567 	}
18568 	if (err == 0) {
18569 		if (ipif->ipif_isv6) {
18570 			if ((err = ipif_up_done_v6(ipif)) != 0)
18571 				ip0dbg(("arp_bringup_done: init failed\n"));
18572 		} else {
18573 			err = ipif_arp_up_done_tail(ipif, Res_act_initial);
18574 			if (err != 0 ||
18575 			    (err = ipif_up_done(ipif)) != 0) {
18576 				ip0dbg(("arp_bringup_done: "
18577 				    "init failed err %x\n", err));
18578 				(void) ipif_arp_down(ipif);
18579 			}
18580 
18581 		}
18582 	} else {
18583 		ip0dbg(("arp_bringup_done: DL_BIND_REQ failed\n"));
18584 	}
18585 
18586 	if ((err == 0) && (ill->ill_up_ipifs)) {
18587 		err = ill_up_ipifs(ill, q, mp1);
18588 		if (err == EINPROGRESS)
18589 			return;
18590 	}
18591 
18592 	/*
18593 	 * If we have a moved ipif to bring up, and everything has succeeded
18594 	 * to this point, bring it up on the IPMP ill.  Otherwise, leave it
18595 	 * down -- the admin can try to bring it up by hand if need be.
18596 	 */
18597 	if (ill->ill_move_ipif != NULL) {
18598 		ipif = ill->ill_move_ipif;
18599 		ip1dbg(("bringing up ipif %p on ill %s\n", (void *)ipif,
18600 		    ipif->ipif_ill->ill_name));
18601 		ill->ill_move_ipif = NULL;
18602 		if (err == 0) {
18603 			err = ipif_up(ipif, q, mp1);
18604 			if (err == EINPROGRESS)
18605 				return;
18606 		}
18607 	}
18608 
18609 	/*
18610 	 * The operation must complete without EINPROGRESS since
18611 	 * ipsq_pending_mp_get() has removed the mblk from ipsq_pending_mp.
18612 	 * Otherwise, the operation will be stuck forever in the ipsq.
18613 	 */
18614 	ASSERT(err != EINPROGRESS);
18615 	if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18616 		DTRACE_PROBE4(ipif__ioctl, char *, "arp_bringup_done finish",
18617 		    int, ipsq->ipsq_xop->ipx_current_ioctl,
18618 		    ill_t *, ill, ipif_t *, ipif);
18619 		ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq);
18620 	} else {
18621 		ipsq_current_finish(ipsq);
18622 	}
18623 }
18624 
18625 /*
18626  * Finish processing of arp replumb after all the DLPI message
18627  * exchanges have completed between arp and the driver.
18628  */
18629 void
arp_replumb_done(ill_t * ill,int err)18630 arp_replumb_done(ill_t *ill, int err)
18631 {
18632 	mblk_t	*mp1;
18633 	ipif_t  *ipif;
18634 	conn_t *connp = NULL;
18635 	ipsq_t	*ipsq;
18636 	queue_t *q;
18637 
18638 	ASSERT(IAM_WRITER_ILL(ill));
18639 
18640 	ipsq = ill->ill_phyint->phyint_ipsq;
18641 	ipif = ipsq->ipsq_xop->ipx_pending_ipif;
18642 	mp1 = ipsq_pending_mp_get(ipsq, &connp);
18643 	ASSERT(!((mp1 != NULL) ^ (ipif != NULL)));
18644 	if (mp1 == NULL) {
18645 		ip0dbg(("arp_replumb_done: bringup aborted ioctl %x\n",
18646 		    ipsq->ipsq_xop->ipx_current_ioctl));
18647 		/* bringup was aborted by the user */
18648 		return;
18649 	}
18650 	/*
18651 	 * If an IOCTL is waiting on this (ipsq_current_ioctl != 0), then we
18652 	 * must have an associated conn_t.  Otherwise, we're bringing this
18653 	 * interface back up as part of handling an asynchronous event (e.g.,
18654 	 * physical address change).
18655 	 */
18656 	if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18657 		ASSERT(connp != NULL);
18658 		q = CONNP_TO_WQ(connp);
18659 	} else {
18660 		ASSERT(connp == NULL);
18661 		q = ill->ill_rq;
18662 	}
18663 	if ((err == 0) && (ill->ill_up_ipifs)) {
18664 		err = ill_up_ipifs(ill, q, mp1);
18665 		if (err == EINPROGRESS)
18666 			return;
18667 	}
18668 	/*
18669 	 * The operation must complete without EINPROGRESS since
18670 	 * ipsq_pending_mp_get() has removed the mblk from ipsq_pending_mp.
18671 	 * Otherwise, the operation will be stuck forever in the ipsq.
18672 	 */
18673 	ASSERT(err != EINPROGRESS);
18674 	if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18675 		DTRACE_PROBE4(ipif__ioctl, char *,
18676 		    "arp_replumb_done finish",
18677 		    int, ipsq->ipsq_xop->ipx_current_ioctl,
18678 		    ill_t *, ill, ipif_t *, ipif);
18679 		ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq);
18680 	} else {
18681 		ipsq_current_finish(ipsq);
18682 	}
18683 }
18684 
18685 void
ipif_up_notify(ipif_t * ipif)18686 ipif_up_notify(ipif_t *ipif)
18687 {
18688 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
18689 	ip_rts_newaddrmsg(RTM_ADD, 0, ipif, RTSQ_DEFAULT);
18690 	sctp_update_ipif(ipif, SCTP_IPIF_UP);
18691 	ill_nic_event_dispatch(ipif->ipif_ill, MAP_IPIF_ID(ipif->ipif_id),
18692 	    NE_LIF_UP, NULL, 0);
18693 }
18694 
18695 /*
18696  * ILB ioctl uses cv_wait (such as deleting a rule or adding a server) and
18697  * this assumes the context is cv_wait'able.  Hence it shouldnt' be used on
18698  * TPI end points with STREAMS modules pushed above.  This is assured by not
18699  * having the IPI_MODOK flag for the ioctl.  And IP ensures the ILB ioctl
18700  * never ends up on an ipsq, otherwise we may end up processing the ioctl
18701  * while unwinding from the ispq and that could be a thread from the bottom.
18702  */
18703 /* ARGSUSED */
18704 int
ip_sioctl_ilb_cmd(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * arg)18705 ip_sioctl_ilb_cmd(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
18706     ip_ioctl_cmd_t *ipip, void *arg)
18707 {
18708 	mblk_t *cmd_mp = mp->b_cont->b_cont;
18709 	ilb_cmd_t command = *((ilb_cmd_t *)cmd_mp->b_rptr);
18710 	int ret = 0;
18711 	int i;
18712 	size_t size;
18713 	ip_stack_t *ipst;
18714 	zoneid_t zoneid;
18715 	ilb_stack_t *ilbs;
18716 
18717 	ipst = CONNQ_TO_IPST(q);
18718 	ilbs = ipst->ips_netstack->netstack_ilb;
18719 	zoneid = Q_TO_CONN(q)->conn_zoneid;
18720 
18721 	switch (command) {
18722 	case ILB_CREATE_RULE: {
18723 		ilb_rule_cmd_t *cmd = (ilb_rule_cmd_t *)cmd_mp->b_rptr;
18724 
18725 		if (MBLKL(cmd_mp) != sizeof (ilb_rule_cmd_t)) {
18726 			ret = EINVAL;
18727 			break;
18728 		}
18729 
18730 		ret = ilb_rule_add(ilbs, zoneid, cmd);
18731 		break;
18732 	}
18733 	case ILB_DESTROY_RULE:
18734 	case ILB_ENABLE_RULE:
18735 	case ILB_DISABLE_RULE: {
18736 		ilb_name_cmd_t *cmd = (ilb_name_cmd_t *)cmd_mp->b_rptr;
18737 
18738 		if (MBLKL(cmd_mp) != sizeof (ilb_name_cmd_t)) {
18739 			ret = EINVAL;
18740 			break;
18741 		}
18742 
18743 		if (cmd->flags & ILB_RULE_ALLRULES) {
18744 			if (command == ILB_DESTROY_RULE) {
18745 				ilb_rule_del_all(ilbs, zoneid);
18746 				break;
18747 			} else if (command == ILB_ENABLE_RULE) {
18748 				ilb_rule_enable_all(ilbs, zoneid);
18749 				break;
18750 			} else if (command == ILB_DISABLE_RULE) {
18751 				ilb_rule_disable_all(ilbs, zoneid);
18752 				break;
18753 			}
18754 		} else {
18755 			if (command == ILB_DESTROY_RULE) {
18756 				ret = ilb_rule_del(ilbs, zoneid, cmd->name);
18757 			} else if (command == ILB_ENABLE_RULE) {
18758 				ret = ilb_rule_enable(ilbs, zoneid, cmd->name,
18759 				    NULL);
18760 			} else if (command == ILB_DISABLE_RULE) {
18761 				ret = ilb_rule_disable(ilbs, zoneid, cmd->name,
18762 				    NULL);
18763 			}
18764 		}
18765 		break;
18766 	}
18767 	case ILB_NUM_RULES: {
18768 		ilb_num_rules_cmd_t *cmd;
18769 
18770 		if (MBLKL(cmd_mp) != sizeof (ilb_num_rules_cmd_t)) {
18771 			ret = EINVAL;
18772 			break;
18773 		}
18774 		cmd = (ilb_num_rules_cmd_t *)cmd_mp->b_rptr;
18775 		ilb_get_num_rules(ilbs, zoneid, &(cmd->num));
18776 		break;
18777 	}
18778 	case ILB_RULE_NAMES: {
18779 		ilb_rule_names_cmd_t *cmd;
18780 
18781 		cmd = (ilb_rule_names_cmd_t *)cmd_mp->b_rptr;
18782 		if (MBLKL(cmd_mp) < sizeof (ilb_rule_names_cmd_t) ||
18783 		    cmd->num_names == 0) {
18784 			ret = EINVAL;
18785 			break;
18786 		}
18787 		size = cmd->num_names * ILB_RULE_NAMESZ;
18788 		if (cmd_mp->b_rptr + offsetof(ilb_rule_names_cmd_t, buf) +
18789 		    size != cmd_mp->b_wptr) {
18790 			ret = EINVAL;
18791 			break;
18792 		}
18793 		ilb_get_rulenames(ilbs, zoneid, &cmd->num_names, cmd->buf);
18794 		break;
18795 	}
18796 	case ILB_NUM_SERVERS: {
18797 		ilb_num_servers_cmd_t *cmd;
18798 
18799 		if (MBLKL(cmd_mp) != sizeof (ilb_num_servers_cmd_t)) {
18800 			ret = EINVAL;
18801 			break;
18802 		}
18803 		cmd = (ilb_num_servers_cmd_t *)cmd_mp->b_rptr;
18804 		ret = ilb_get_num_servers(ilbs, zoneid, cmd->name,
18805 		    &(cmd->num));
18806 		break;
18807 	}
18808 	case ILB_LIST_RULE: {
18809 		ilb_rule_cmd_t *cmd = (ilb_rule_cmd_t *)cmd_mp->b_rptr;
18810 
18811 		if (MBLKL(cmd_mp) != sizeof (ilb_rule_cmd_t)) {
18812 			ret = EINVAL;
18813 			break;
18814 		}
18815 		ret = ilb_rule_list(ilbs, zoneid, cmd);
18816 		break;
18817 	}
18818 	case ILB_LIST_SERVERS: {
18819 		ilb_servers_info_cmd_t *cmd;
18820 
18821 		cmd = (ilb_servers_info_cmd_t *)cmd_mp->b_rptr;
18822 		if (MBLKL(cmd_mp) < sizeof (ilb_servers_info_cmd_t) ||
18823 		    cmd->num_servers == 0) {
18824 			ret = EINVAL;
18825 			break;
18826 		}
18827 		size = cmd->num_servers * sizeof (ilb_server_info_t);
18828 		if (cmd_mp->b_rptr + offsetof(ilb_servers_info_cmd_t, servers) +
18829 		    size != cmd_mp->b_wptr) {
18830 			ret = EINVAL;
18831 			break;
18832 		}
18833 
18834 		ret = ilb_get_servers(ilbs, zoneid, cmd->name, cmd->servers,
18835 		    &cmd->num_servers);
18836 		break;
18837 	}
18838 	case ILB_ADD_SERVERS: {
18839 		ilb_servers_info_cmd_t *cmd;
18840 		ilb_rule_t *rule;
18841 
18842 		cmd = (ilb_servers_info_cmd_t *)cmd_mp->b_rptr;
18843 		if (MBLKL(cmd_mp) < sizeof (ilb_servers_info_cmd_t)) {
18844 			ret = EINVAL;
18845 			break;
18846 		}
18847 		size = cmd->num_servers * sizeof (ilb_server_info_t);
18848 		if (cmd_mp->b_rptr + offsetof(ilb_servers_info_cmd_t, servers) +
18849 		    size != cmd_mp->b_wptr) {
18850 			ret = EINVAL;
18851 			break;
18852 		}
18853 		rule = ilb_find_rule(ilbs, zoneid, cmd->name, &ret);
18854 		if (rule == NULL) {
18855 			ASSERT(ret != 0);
18856 			break;
18857 		}
18858 		for (i = 0; i < cmd->num_servers; i++) {
18859 			ilb_server_info_t *s;
18860 
18861 			s = &cmd->servers[i];
18862 			s->err = ilb_server_add(ilbs, rule, s);
18863 		}
18864 		ILB_RULE_REFRELE(rule);
18865 		break;
18866 	}
18867 	case ILB_DEL_SERVERS:
18868 	case ILB_ENABLE_SERVERS:
18869 	case ILB_DISABLE_SERVERS: {
18870 		ilb_servers_cmd_t *cmd;
18871 		ilb_rule_t *rule;
18872 		int (*f)();
18873 
18874 		cmd = (ilb_servers_cmd_t *)cmd_mp->b_rptr;
18875 		if (MBLKL(cmd_mp) < sizeof (ilb_servers_cmd_t)) {
18876 			ret = EINVAL;
18877 			break;
18878 		}
18879 		size = cmd->num_servers * sizeof (ilb_server_arg_t);
18880 		if (cmd_mp->b_rptr + offsetof(ilb_servers_cmd_t, servers) +
18881 		    size != cmd_mp->b_wptr) {
18882 			ret = EINVAL;
18883 			break;
18884 		}
18885 
18886 		if (command == ILB_DEL_SERVERS)
18887 			f = ilb_server_del;
18888 		else if (command == ILB_ENABLE_SERVERS)
18889 			f = ilb_server_enable;
18890 		else if (command == ILB_DISABLE_SERVERS)
18891 			f = ilb_server_disable;
18892 
18893 		rule = ilb_find_rule(ilbs, zoneid, cmd->name, &ret);
18894 		if (rule == NULL) {
18895 			ASSERT(ret != 0);
18896 			break;
18897 		}
18898 
18899 		for (i = 0; i < cmd->num_servers; i++) {
18900 			ilb_server_arg_t *s;
18901 
18902 			s = &cmd->servers[i];
18903 			s->err = f(ilbs, zoneid, NULL, rule, &s->addr);
18904 		}
18905 		ILB_RULE_REFRELE(rule);
18906 		break;
18907 	}
18908 	case ILB_LIST_NAT_TABLE: {
18909 		ilb_list_nat_cmd_t *cmd;
18910 
18911 		cmd = (ilb_list_nat_cmd_t *)cmd_mp->b_rptr;
18912 		if (MBLKL(cmd_mp) < sizeof (ilb_list_nat_cmd_t)) {
18913 			ret = EINVAL;
18914 			break;
18915 		}
18916 		size = cmd->num_nat * sizeof (ilb_nat_entry_t);
18917 		if (cmd_mp->b_rptr + offsetof(ilb_list_nat_cmd_t, entries) +
18918 		    size != cmd_mp->b_wptr) {
18919 			ret = EINVAL;
18920 			break;
18921 		}
18922 
18923 		ret = ilb_list_nat(ilbs, zoneid, cmd->entries, &cmd->num_nat,
18924 		    &cmd->flags);
18925 		break;
18926 	}
18927 	case ILB_LIST_STICKY_TABLE: {
18928 		ilb_list_sticky_cmd_t *cmd;
18929 
18930 		cmd = (ilb_list_sticky_cmd_t *)cmd_mp->b_rptr;
18931 		if (MBLKL(cmd_mp) < sizeof (ilb_list_sticky_cmd_t)) {
18932 			ret = EINVAL;
18933 			break;
18934 		}
18935 		size = cmd->num_sticky * sizeof (ilb_sticky_entry_t);
18936 		if (cmd_mp->b_rptr + offsetof(ilb_list_sticky_cmd_t, entries) +
18937 		    size != cmd_mp->b_wptr) {
18938 			ret = EINVAL;
18939 			break;
18940 		}
18941 
18942 		ret = ilb_list_sticky(ilbs, zoneid, cmd->entries,
18943 		    &cmd->num_sticky, &cmd->flags);
18944 		break;
18945 	}
18946 	default:
18947 		ret = EINVAL;
18948 		break;
18949 	}
18950 done:
18951 	return (ret);
18952 }
18953 
18954 /* Remove all cache entries for this logical interface */
18955 void
ipif_nce_down(ipif_t * ipif)18956 ipif_nce_down(ipif_t *ipif)
18957 {
18958 	ill_t *ill = ipif->ipif_ill;
18959 	nce_t *nce;
18960 
18961 	DTRACE_PROBE3(ipif__downup, char *, "ipif_nce_down",
18962 	    ill_t *, ill, ipif_t *, ipif);
18963 	if (ipif->ipif_added_nce) {
18964 		if (ipif->ipif_isv6)
18965 			nce = nce_lookup_v6(ill, &ipif->ipif_v6lcl_addr);
18966 		else
18967 			nce = nce_lookup_v4(ill, &ipif->ipif_lcl_addr);
18968 		if (nce != NULL) {
18969 			if (--nce->nce_ipif_cnt == 0)
18970 				ncec_delete(nce->nce_common);
18971 			ipif->ipif_added_nce = 0;
18972 			nce_refrele(nce);
18973 		} else {
18974 			/*
18975 			 * nce may already be NULL because it was already
18976 			 * flushed, e.g., due to a call to nce_flush
18977 			 */
18978 			ipif->ipif_added_nce = 0;
18979 		}
18980 	}
18981 	/*
18982 	 * Make IPMP aware of the deleted data address.
18983 	 */
18984 	if (IS_IPMP(ill))
18985 		ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
18986 
18987 	/*
18988 	 * Remove all other nces dependent on this ill when the last ipif
18989 	 * is going away.
18990 	 */
18991 	if (ill->ill_ipif_up_count == 0) {
18992 		ncec_walk(ill, (pfi_t)ncec_delete_per_ill,
18993 		    (uchar_t *)ill, ill->ill_ipst);
18994 		if (IS_UNDER_IPMP(ill))
18995 			nce_flush(ill, B_TRUE);
18996 	}
18997 }
18998 
18999 /*
19000  * find the first interface that uses usill for its source address.
19001  */
19002 ill_t *
ill_lookup_usesrc(ill_t * usill)19003 ill_lookup_usesrc(ill_t *usill)
19004 {
19005 	ip_stack_t *ipst = usill->ill_ipst;
19006 	ill_t *ill;
19007 
19008 	ASSERT(usill != NULL);
19009 
19010 	/* ill_g_usesrc_lock protects ill_usesrc_grp_next */
19011 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
19012 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
19013 	for (ill = usill->ill_usesrc_grp_next; ill != NULL && ill != usill;
19014 	    ill = ill->ill_usesrc_grp_next) {
19015 		if (!IS_UNDER_IPMP(ill) && (ill->ill_flags & ILLF_MULTICAST) &&
19016 		    !ILL_IS_CONDEMNED(ill)) {
19017 			ill_refhold(ill);
19018 			break;
19019 		}
19020 	}
19021 	rw_exit(&ipst->ips_ill_g_lock);
19022 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
19023 	return (ill);
19024 }
19025 
19026 /*
19027  * This comment applies to both ip_sioctl_get_ifhwaddr and
19028  * ip_sioctl_get_lifhwaddr as the basic function of these two functions
19029  * is the same.
19030  *
19031  * The goal here is to find an IP interface that corresponds to the name
19032  * provided by the caller in the ifreq/lifreq structure held in the mblk_t
19033  * chain and to fill out a sockaddr/sockaddr_storage structure with the
19034  * mac address.
19035  *
19036  * The SIOCGIFHWADDR/SIOCGLIFHWADDR ioctl may return an error for a number
19037  * of different reasons:
19038  * ENXIO - the device name is not known to IP.
19039  * EADDRNOTAVAIL - the device has no hardware address. This is indicated
19040  * by ill_phys_addr not pointing to an actual address.
19041  * EPFNOSUPPORT - this will indicate that a request is being made for a
19042  * mac address that will not fit in the data structure supplier (struct
19043  * sockaddr).
19044  *
19045  */
19046 /* ARGSUSED */
19047 int
ip_sioctl_get_ifhwaddr(ipif_t * ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)19048 ip_sioctl_get_ifhwaddr(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
19049     ip_ioctl_cmd_t *ipip, void *if_req)
19050 {
19051 	struct sockaddr *sock;
19052 	struct ifreq *ifr;
19053 	mblk_t *mp1;
19054 	ill_t *ill;
19055 
19056 	ASSERT(ipif != NULL);
19057 	ill = ipif->ipif_ill;
19058 
19059 	if (ill->ill_phys_addr == NULL) {
19060 		return (EADDRNOTAVAIL);
19061 	}
19062 	if (ill->ill_phys_addr_length > sizeof (sock->sa_data)) {
19063 		return (EPFNOSUPPORT);
19064 	}
19065 
19066 	ip1dbg(("ip_sioctl_get_hwaddr(%s)\n", ill->ill_name));
19067 
19068 	/* Existence of mp1 has been checked in ip_wput_nondata */
19069 	mp1 = mp->b_cont->b_cont;
19070 	ifr = (struct ifreq *)mp1->b_rptr;
19071 
19072 	sock = &ifr->ifr_addr;
19073 	/*
19074 	 * The "family" field in the returned structure is set to a value
19075 	 * that represents the type of device to which the address belongs.
19076 	 * The value returned may differ to that on Linux but it will still
19077 	 * represent the correct symbol on Solaris.
19078 	 */
19079 	sock->sa_family = arp_hw_type(ill->ill_mactype);
19080 	bcopy(ill->ill_phys_addr, &sock->sa_data, ill->ill_phys_addr_length);
19081 
19082 	return (0);
19083 }
19084 
19085 /*
19086  * The expection of applications using SIOCGIFHWADDR is that data will
19087  * be returned in the sa_data field of the sockaddr structure. With
19088  * SIOCGLIFHWADDR, we're breaking new ground as there is no Linux
19089  * equivalent. In light of this, struct sockaddr_dl is used as it
19090  * offers more space for address storage in sll_data.
19091  */
19092 /* ARGSUSED */
19093 int
ip_sioctl_get_lifhwaddr(ipif_t * ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)19094 ip_sioctl_get_lifhwaddr(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
19095     ip_ioctl_cmd_t *ipip, void *if_req)
19096 {
19097 	struct sockaddr_dl *sock;
19098 	struct lifreq *lifr;
19099 	mblk_t *mp1;
19100 	ill_t *ill;
19101 
19102 	ASSERT(ipif != NULL);
19103 	ill = ipif->ipif_ill;
19104 
19105 	if (ill->ill_phys_addr == NULL) {
19106 		return (EADDRNOTAVAIL);
19107 	}
19108 	if (ill->ill_phys_addr_length > sizeof (sock->sdl_data)) {
19109 		return (EPFNOSUPPORT);
19110 	}
19111 
19112 	ip1dbg(("ip_sioctl_get_lifhwaddr(%s)\n", ill->ill_name));
19113 
19114 	/* Existence of mp1 has been checked in ip_wput_nondata */
19115 	mp1 = mp->b_cont->b_cont;
19116 	lifr = (struct lifreq *)mp1->b_rptr;
19117 
19118 	/*
19119 	 * sockaddr_ll is used here because it is also the structure used in
19120 	 * responding to the same ioctl in sockpfp. The only other choice is
19121 	 * sockaddr_dl which contains fields that are not required here
19122 	 * because its purpose is different.
19123 	 */
19124 	lifr->lifr_type = ill->ill_type;
19125 	sock = (struct sockaddr_dl *)&lifr->lifr_addr;
19126 	sock->sdl_family = AF_LINK;
19127 	sock->sdl_index = ill->ill_phyint->phyint_ifindex;
19128 	sock->sdl_type = ill->ill_mactype;
19129 	sock->sdl_nlen = 0;
19130 	sock->sdl_slen = 0;
19131 	sock->sdl_alen = ill->ill_phys_addr_length;
19132 	bcopy(ill->ill_phys_addr, sock->sdl_data, ill->ill_phys_addr_length);
19133 
19134 	return (0);
19135 }
19136