xref: /illumos-gate/usr/src/uts/common/inet/ip/ip_if.c (revision 8a57cef6afbd3163c64efedaa20cbfab2c46b9cd)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /* Copyright (c) 1990 Mentat Inc. */
26 
27 /*
28  * This file contains the interface control functions for IP.
29  */
30 
31 #include <sys/types.h>
32 #include <sys/stream.h>
33 #include <sys/dlpi.h>
34 #include <sys/stropts.h>
35 #include <sys/strsun.h>
36 #include <sys/sysmacros.h>
37 #include <sys/strsubr.h>
38 #include <sys/strlog.h>
39 #include <sys/ddi.h>
40 #include <sys/sunddi.h>
41 #include <sys/cmn_err.h>
42 #include <sys/kstat.h>
43 #include <sys/debug.h>
44 #include <sys/zone.h>
45 #include <sys/sunldi.h>
46 #include <sys/file.h>
47 #include <sys/bitmap.h>
48 #include <sys/cpuvar.h>
49 #include <sys/time.h>
50 #include <sys/ctype.h>
51 #include <sys/kmem.h>
52 #include <sys/systm.h>
53 #include <sys/param.h>
54 #include <sys/socket.h>
55 #include <sys/isa_defs.h>
56 #include <net/if.h>
57 #include <net/if_arp.h>
58 #include <net/if_types.h>
59 #include <net/if_dl.h>
60 #include <net/route.h>
61 #include <sys/sockio.h>
62 #include <netinet/in.h>
63 #include <netinet/ip6.h>
64 #include <netinet/icmp6.h>
65 #include <netinet/igmp_var.h>
66 #include <sys/policy.h>
67 #include <sys/ethernet.h>
68 #include <sys/callb.h>
69 #include <sys/md5.h>
70 
71 #include <inet/common.h>   /* for various inet/mi.h and inet/nd.h needs */
72 #include <inet/mi.h>
73 #include <inet/nd.h>
74 #include <inet/arp.h>
75 #include <inet/mib2.h>
76 #include <inet/ip.h>
77 #include <inet/ip6.h>
78 #include <inet/ip6_asp.h>
79 #include <inet/tcp.h>
80 #include <inet/ip_multi.h>
81 #include <inet/ip_ire.h>
82 #include <inet/ip_ftable.h>
83 #include <inet/ip_rts.h>
84 #include <inet/ip_ndp.h>
85 #include <inet/ip_if.h>
86 #include <inet/ip_impl.h>
87 #include <inet/tun.h>
88 #include <inet/sctp_ip.h>
89 #include <inet/ip_netinfo.h>
90 
91 #include <net/pfkeyv2.h>
92 #include <inet/ipsec_info.h>
93 #include <inet/sadb.h>
94 #include <inet/ipsec_impl.h>
95 #include <sys/iphada.h>
96 
97 #include <netinet/igmp.h>
98 #include <inet/ip_listutils.h>
99 #include <inet/ipclassifier.h>
100 #include <sys/mac_client.h>
101 #include <sys/dld.h>
102 
103 #include <sys/systeminfo.h>
104 #include <sys/bootconf.h>
105 
106 #include <sys/tsol/tndb.h>
107 #include <sys/tsol/tnet.h>
108 
109 /* The character which tells where the ill_name ends */
110 #define	IPIF_SEPARATOR_CHAR	':'
111 
112 /* IP ioctl function table entry */
113 typedef struct ipft_s {
114 	int	ipft_cmd;
115 	pfi_t	ipft_pfi;
116 	int	ipft_min_size;
117 	int	ipft_flags;
118 } ipft_t;
119 #define	IPFT_F_NO_REPLY		0x1	/* IP ioctl does not expect any reply */
120 #define	IPFT_F_SELF_REPLY	0x2	/* ioctl callee does the ioctl reply */
121 
122 typedef struct ip_sock_ar_s {
123 	union {
124 		area_t	ip_sock_area;
125 		ared_t	ip_sock_ared;
126 		areq_t	ip_sock_areq;
127 	} ip_sock_ar_u;
128 	queue_t	*ip_sock_ar_q;
129 } ip_sock_ar_t;
130 
131 static int	nd_ill_forward_get(queue_t *, mblk_t *, caddr_t, cred_t *);
132 static int	nd_ill_forward_set(queue_t *q, mblk_t *mp,
133 		    char *value, caddr_t cp, cred_t *ioc_cr);
134 
135 static boolean_t ill_is_quiescent(ill_t *);
136 static boolean_t ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask);
137 static ip_m_t	*ip_m_lookup(t_uscalar_t mac_type);
138 static int	ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
139     mblk_t *mp, boolean_t need_up);
140 static int	ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
141     mblk_t *mp, boolean_t need_up);
142 static int	ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
143     queue_t *q, mblk_t *mp, boolean_t need_up);
144 static int	ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q,
145     mblk_t *mp);
146 static int	ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
147     mblk_t *mp);
148 static int	ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t, in6_addr_t,
149     queue_t *q, mblk_t *mp, boolean_t need_up);
150 static int	ip_sioctl_plink_ipmod(ipsq_t *ipsq, queue_t *q, mblk_t *mp,
151     int ioccmd, struct linkblk *li, boolean_t doconsist);
152 static ipaddr_t	ip_subnet_mask(ipaddr_t addr, ipif_t **, ip_stack_t *);
153 static void	ip_wput_ioctl(queue_t *q, mblk_t *mp);
154 static void	ipsq_flush(ill_t *ill);
155 
156 static	int	ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen,
157     queue_t *q, mblk_t *mp, boolean_t need_up);
158 static void	ipsq_delete(ipsq_t *);
159 
160 static ipif_t	*ipif_allocate(ill_t *ill, int id, uint_t ire_type,
161     boolean_t initialize, boolean_t insert);
162 static void	ipif_check_bcast_ires(ipif_t *test_ipif);
163 static ire_t	**ipif_create_bcast_ires(ipif_t *ipif, ire_t **irep);
164 static boolean_t ipif_comp_multi(ipif_t *old_ipif, ipif_t *new_ipif,
165 		    boolean_t isv6);
166 static void	ipif_down_delete_ire(ire_t *ire, char *ipif);
167 static void	ipif_delete_cache_ire(ire_t *, char *);
168 static int	ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp);
169 static void	ipif_free(ipif_t *ipif);
170 static void	ipif_free_tail(ipif_t *ipif);
171 static void	ipif_mtu_change(ire_t *ire, char *ipif_arg);
172 static void	ipif_recreate_interface_routes(ipif_t *old_ipif, ipif_t *ipif);
173 static void	ipif_set_default(ipif_t *ipif);
174 static int	ipif_set_values(queue_t *q, mblk_t *mp,
175     char *interf_name, uint_t *ppa);
176 static int	ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp,
177     queue_t *q);
178 static ipif_t	*ipif_lookup_on_name(char *name, size_t namelen,
179     boolean_t do_alloc, boolean_t *exists, boolean_t isv6, zoneid_t zoneid,
180     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *);
181 static void	ipif_update_other_ipifs(ipif_t *old_ipif);
182 
183 static int	ill_alloc_ppa(ill_if_t *, ill_t *);
184 static int	ill_arp_off(ill_t *ill);
185 static int	ill_arp_on(ill_t *ill);
186 static void	ill_delete_interface_type(ill_if_t *);
187 static int	ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q);
188 static void	ill_dl_down(ill_t *ill);
189 static void	ill_down(ill_t *ill);
190 static void	ill_downi(ire_t *ire, char *ill_arg);
191 static void	ill_free_mib(ill_t *ill);
192 static void	ill_glist_delete(ill_t *);
193 static void	ill_phyint_reinit(ill_t *ill);
194 static void	ill_set_nce_router_flags(ill_t *, boolean_t);
195 static void	ill_set_phys_addr_tail(ipsq_t *, queue_t *, mblk_t *, void *);
196 static void	ill_replumb_tail(ipsq_t *, queue_t *, mblk_t *, void *);
197 
198 static ip_v6intfid_func_t ip_ether_v6intfid, ip_ib_v6intfid;
199 static ip_v6intfid_func_t ip_ipmp_v6intfid, ip_nodef_v6intfid;
200 static ip_v6mapinfo_func_t ip_ether_v6mapinfo, ip_ib_v6mapinfo;
201 static ip_v4mapinfo_func_t ip_ether_v4mapinfo, ip_ib_v4mapinfo;
202 static void	ipif_save_ire(ipif_t *, ire_t *);
203 static void	ipif_remove_ire(ipif_t *, ire_t *);
204 static void 	ip_cgtp_bcast_add(ire_t *, ire_t *, ip_stack_t *);
205 static void 	ip_cgtp_bcast_delete(ire_t *, ip_stack_t *);
206 static void	phyint_free(phyint_t *);
207 
208 /*
209  * Per-ill IPsec capabilities management.
210  */
211 static ill_ipsec_capab_t *ill_ipsec_capab_alloc(void);
212 static void	ill_ipsec_capab_free(ill_ipsec_capab_t *);
213 static void	ill_ipsec_capab_add(ill_t *, uint_t, boolean_t);
214 static void	ill_ipsec_capab_delete(ill_t *, uint_t);
215 static boolean_t ill_ipsec_capab_resize_algparm(ill_ipsec_capab_t *, int);
216 static void ill_capability_dispatch(ill_t *, mblk_t *, dl_capability_sub_t *,
217     boolean_t);
218 static void ill_capability_id_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
219 static void ill_capability_mdt_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
220 static void ill_capability_mdt_reset_fill(ill_t *, mblk_t *);
221 static void ill_capability_ipsec_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
222 static void ill_capability_ipsec_reset_fill(ill_t *, mblk_t *);
223 static void ill_capability_hcksum_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
224 static void ill_capability_hcksum_reset_fill(ill_t *, mblk_t *);
225 static void ill_capability_zerocopy_ack(ill_t *, mblk_t *,
226     dl_capability_sub_t *);
227 static void ill_capability_zerocopy_reset_fill(ill_t *, mblk_t *);
228 static int  ill_capability_ipsec_reset_size(ill_t *, int *, int *, int *,
229     int *);
230 static void	ill_capability_dld_reset_fill(ill_t *, mblk_t *);
231 static void	ill_capability_dld_ack(ill_t *, mblk_t *,
232 		    dl_capability_sub_t *);
233 static void	ill_capability_dld_enable(ill_t *);
234 static void	ill_capability_ack_thr(void *);
235 static void	ill_capability_lso_enable(ill_t *);
236 static void	ill_capability_send(ill_t *, mblk_t *);
237 
238 static ill_t	*ill_prev_usesrc(ill_t *);
239 static int	ill_relink_usesrc_ills(ill_t *, ill_t *, uint_t);
240 static void	ill_disband_usesrc_group(ill_t *);
241 static void	conn_cleanup_stale_ire(conn_t *, caddr_t);
242 
243 #ifdef DEBUG
244 static  void    ill_trace_cleanup(const ill_t *);
245 static  void    ipif_trace_cleanup(const ipif_t *);
246 #endif
247 
248 /*
249  * if we go over the memory footprint limit more than once in this msec
250  * interval, we'll start pruning aggressively.
251  */
252 int ip_min_frag_prune_time = 0;
253 
254 /*
255  * max # of IPsec algorithms supported.  Limited to 1 byte by PF_KEY
256  * and the IPsec DOI
257  */
258 #define	MAX_IPSEC_ALGS	256
259 
260 #define	BITSPERBYTE	8
261 #define	BITS(type)	(BITSPERBYTE * (long)sizeof (type))
262 
263 #define	IPSEC_ALG_ENABLE(algs, algid) \
264 		((algs)[(algid) / BITS(ipsec_capab_elem_t)] |= \
265 		(1 << ((algid) % BITS(ipsec_capab_elem_t))))
266 
267 #define	IPSEC_ALG_IS_ENABLED(algid, algs) \
268 		((algs)[(algid) / BITS(ipsec_capab_elem_t)] & \
269 		(1 << ((algid) % BITS(ipsec_capab_elem_t))))
270 
271 typedef uint8_t ipsec_capab_elem_t;
272 
273 /*
274  * Per-algorithm parameters.  Note that at present, only encryption
275  * algorithms have variable keysize (IKE does not provide a way to negotiate
276  * auth algorithm keysize).
277  *
278  * All sizes here are in bits.
279  */
280 typedef struct
281 {
282 	uint16_t	minkeylen;
283 	uint16_t	maxkeylen;
284 } ipsec_capab_algparm_t;
285 
286 /*
287  * Per-ill capabilities.
288  */
289 struct ill_ipsec_capab_s {
290 	ipsec_capab_elem_t *encr_hw_algs;
291 	ipsec_capab_elem_t *auth_hw_algs;
292 	uint32_t algs_size;	/* size of _hw_algs in bytes */
293 	/* algorithm key lengths */
294 	ipsec_capab_algparm_t *encr_algparm;
295 	uint32_t encr_algparm_size;
296 	uint32_t encr_algparm_end;
297 };
298 
299 /*
300  * The field values are larger than strictly necessary for simple
301  * AR_ENTRY_ADDs but the padding lets us accomodate the socket ioctls.
302  */
303 static area_t	ip_area_template = {
304 	AR_ENTRY_ADD,			/* area_cmd */
305 	sizeof (ip_sock_ar_t) + (IP_ADDR_LEN*2) + sizeof (struct sockaddr_dl),
306 					/* area_name_offset */
307 	/* area_name_length temporarily holds this structure length */
308 	sizeof (area_t),			/* area_name_length */
309 	IP_ARP_PROTO_TYPE,		/* area_proto */
310 	sizeof (ip_sock_ar_t),		/* area_proto_addr_offset */
311 	IP_ADDR_LEN,			/* area_proto_addr_length */
312 	sizeof (ip_sock_ar_t) + IP_ADDR_LEN,
313 					/* area_proto_mask_offset */
314 	0,				/* area_flags */
315 	sizeof (ip_sock_ar_t) + IP_ADDR_LEN + IP_ADDR_LEN,
316 					/* area_hw_addr_offset */
317 	/* Zero length hw_addr_length means 'use your idea of the address' */
318 	0				/* area_hw_addr_length */
319 };
320 
321 /*
322  * AR_ENTRY_ADD/DELETE templates have been added for IPv6 external resolver
323  * support
324  */
325 static area_t	ip6_area_template = {
326 	AR_ENTRY_ADD,			/* area_cmd */
327 	sizeof (ip_sock_ar_t) + (IPV6_ADDR_LEN*2) + sizeof (sin6_t),
328 					/* area_name_offset */
329 	/* area_name_length temporarily holds this structure length */
330 	sizeof (area_t),			/* area_name_length */
331 	IP_ARP_PROTO_TYPE,		/* area_proto */
332 	sizeof (ip_sock_ar_t),		/* area_proto_addr_offset */
333 	IPV6_ADDR_LEN,			/* area_proto_addr_length */
334 	sizeof (ip_sock_ar_t) + IPV6_ADDR_LEN,
335 					/* area_proto_mask_offset */
336 	0,				/* area_flags */
337 	sizeof (ip_sock_ar_t) + IPV6_ADDR_LEN + IPV6_ADDR_LEN,
338 					/* area_hw_addr_offset */
339 	/* Zero length hw_addr_length means 'use your idea of the address' */
340 	0				/* area_hw_addr_length */
341 };
342 
343 static ared_t	ip_ared_template = {
344 	AR_ENTRY_DELETE,
345 	sizeof (ared_t) + IP_ADDR_LEN,
346 	sizeof (ared_t),
347 	IP_ARP_PROTO_TYPE,
348 	sizeof (ared_t),
349 	IP_ADDR_LEN,
350 	0
351 };
352 
353 static ared_t	ip6_ared_template = {
354 	AR_ENTRY_DELETE,
355 	sizeof (ared_t) + IPV6_ADDR_LEN,
356 	sizeof (ared_t),
357 	IP_ARP_PROTO_TYPE,
358 	sizeof (ared_t),
359 	IPV6_ADDR_LEN,
360 	0
361 };
362 
363 /*
364  * A template for an IPv6 AR_ENTRY_QUERY template has not been created, as
365  * as the areq doesn't include an IP address in ill_dl_up() (the only place a
366  * areq is used).
367  */
368 static areq_t	ip_areq_template = {
369 	AR_ENTRY_QUERY,			/* cmd */
370 	sizeof (areq_t)+(2*IP_ADDR_LEN),	/* name offset */
371 	sizeof (areq_t),	/* name len (filled by ill_arp_alloc) */
372 	IP_ARP_PROTO_TYPE,		/* protocol, from arps perspective */
373 	sizeof (areq_t),			/* target addr offset */
374 	IP_ADDR_LEN,			/* target addr_length */
375 	0,				/* flags */
376 	sizeof (areq_t) + IP_ADDR_LEN,	/* sender addr offset */
377 	IP_ADDR_LEN,			/* sender addr length */
378 	AR_EQ_DEFAULT_XMIT_COUNT,	/* xmit_count */
379 	AR_EQ_DEFAULT_XMIT_INTERVAL,	/* (re)xmit_interval in milliseconds */
380 	AR_EQ_DEFAULT_MAX_BUFFERED	/* max # of requests to buffer */
381 	/* anything else filled in by the code */
382 };
383 
384 static arc_t	ip_aru_template = {
385 	AR_INTERFACE_UP,
386 	sizeof (arc_t),		/* Name offset */
387 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
388 };
389 
390 static arc_t	ip_ard_template = {
391 	AR_INTERFACE_DOWN,
392 	sizeof (arc_t),		/* Name offset */
393 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
394 };
395 
396 static arc_t	ip_aron_template = {
397 	AR_INTERFACE_ON,
398 	sizeof (arc_t),		/* Name offset */
399 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
400 };
401 
402 static arc_t	ip_aroff_template = {
403 	AR_INTERFACE_OFF,
404 	sizeof (arc_t),		/* Name offset */
405 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
406 };
407 
408 static arma_t	ip_arma_multi_template = {
409 	AR_MAPPING_ADD,
410 	sizeof (arma_t) + 3*IP_ADDR_LEN + IP_MAX_HW_LEN,
411 				/* Name offset */
412 	sizeof (arma_t),	/* Name length (set by ill_arp_alloc) */
413 	IP_ARP_PROTO_TYPE,
414 	sizeof (arma_t),			/* proto_addr_offset */
415 	IP_ADDR_LEN,				/* proto_addr_length */
416 	sizeof (arma_t) + IP_ADDR_LEN,		/* proto_mask_offset */
417 	sizeof (arma_t) + 2*IP_ADDR_LEN,	/* proto_extract_mask_offset */
418 	ACE_F_PERMANENT | ACE_F_MAPPING,	/* flags */
419 	sizeof (arma_t) + 3*IP_ADDR_LEN,	/* hw_addr_offset */
420 	IP_MAX_HW_LEN,				/* hw_addr_length */
421 	0,					/* hw_mapping_start */
422 };
423 
424 static ipft_t	ip_ioctl_ftbl[] = {
425 	{ IP_IOC_IRE_DELETE, ip_ire_delete, sizeof (ipid_t), 0 },
426 	{ IP_IOC_IRE_DELETE_NO_REPLY, ip_ire_delete, sizeof (ipid_t),
427 		IPFT_F_NO_REPLY },
428 	{ IP_IOC_IRE_ADVISE_NO_REPLY, ip_ire_advise, sizeof (ipic_t),
429 		IPFT_F_NO_REPLY },
430 	{ IP_IOC_RTS_REQUEST, ip_rts_request, 0, IPFT_F_SELF_REPLY },
431 	{ 0 }
432 };
433 
434 /* Simple ICMP IP Header Template */
435 static ipha_t icmp_ipha = {
436 	IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
437 };
438 
439 static uchar_t	ip_six_byte_all_ones[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
440 
441 static ip_m_t   ip_m_tbl[] = {
442 	{ DL_ETHER, IFT_ETHER, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
443 	    ip_ether_v6intfid },
444 	{ DL_CSMACD, IFT_ISO88023, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
445 	    ip_nodef_v6intfid },
446 	{ DL_TPB, IFT_ISO88024, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
447 	    ip_nodef_v6intfid },
448 	{ DL_TPR, IFT_ISO88025, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
449 	    ip_nodef_v6intfid },
450 	{ DL_FDDI, IFT_FDDI, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
451 	    ip_ether_v6intfid },
452 	{ DL_IB, IFT_IB, ip_ib_v4mapinfo, ip_ib_v6mapinfo,
453 	    ip_ib_v6intfid },
454 	{ SUNW_DL_VNI, IFT_OTHER, NULL, NULL, NULL },
455 	{ SUNW_DL_IPMP, IFT_OTHER, NULL, NULL, ip_ipmp_v6intfid },
456 	{ DL_OTHER, IFT_OTHER, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
457 	    ip_nodef_v6intfid }
458 };
459 
460 static ill_t	ill_null;		/* Empty ILL for init. */
461 char	ipif_loopback_name[] = "lo0";
462 static char *ipv4_forward_suffix = ":ip_forwarding";
463 static char *ipv6_forward_suffix = ":ip6_forwarding";
464 static	sin6_t	sin6_null;	/* Zero address for quick clears */
465 static	sin_t	sin_null;	/* Zero address for quick clears */
466 
467 /* When set search for unused ipif_seqid */
468 static ipif_t	ipif_zero;
469 
470 /*
471  * ppa arena is created after these many
472  * interfaces have been plumbed.
473  */
474 uint_t	ill_no_arena = 12;	/* Setable in /etc/system */
475 
476 /*
477  * Allocate per-interface mibs.
478  * Returns true if ok. False otherwise.
479  *  ipsq  may not yet be allocated (loopback case ).
480  */
481 static boolean_t
482 ill_allocate_mibs(ill_t *ill)
483 {
484 	/* Already allocated? */
485 	if (ill->ill_ip_mib != NULL) {
486 		if (ill->ill_isv6)
487 			ASSERT(ill->ill_icmp6_mib != NULL);
488 		return (B_TRUE);
489 	}
490 
491 	ill->ill_ip_mib = kmem_zalloc(sizeof (*ill->ill_ip_mib),
492 	    KM_NOSLEEP);
493 	if (ill->ill_ip_mib == NULL) {
494 		return (B_FALSE);
495 	}
496 
497 	/* Setup static information */
498 	SET_MIB(ill->ill_ip_mib->ipIfStatsEntrySize,
499 	    sizeof (mib2_ipIfStatsEntry_t));
500 	if (ill->ill_isv6) {
501 		ill->ill_ip_mib->ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv6;
502 		SET_MIB(ill->ill_ip_mib->ipIfStatsAddrEntrySize,
503 		    sizeof (mib2_ipv6AddrEntry_t));
504 		SET_MIB(ill->ill_ip_mib->ipIfStatsRouteEntrySize,
505 		    sizeof (mib2_ipv6RouteEntry_t));
506 		SET_MIB(ill->ill_ip_mib->ipIfStatsNetToMediaEntrySize,
507 		    sizeof (mib2_ipv6NetToMediaEntry_t));
508 		SET_MIB(ill->ill_ip_mib->ipIfStatsMemberEntrySize,
509 		    sizeof (ipv6_member_t));
510 		SET_MIB(ill->ill_ip_mib->ipIfStatsGroupSourceEntrySize,
511 		    sizeof (ipv6_grpsrc_t));
512 	} else {
513 		ill->ill_ip_mib->ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv4;
514 		SET_MIB(ill->ill_ip_mib->ipIfStatsAddrEntrySize,
515 		    sizeof (mib2_ipAddrEntry_t));
516 		SET_MIB(ill->ill_ip_mib->ipIfStatsRouteEntrySize,
517 		    sizeof (mib2_ipRouteEntry_t));
518 		SET_MIB(ill->ill_ip_mib->ipIfStatsNetToMediaEntrySize,
519 		    sizeof (mib2_ipNetToMediaEntry_t));
520 		SET_MIB(ill->ill_ip_mib->ipIfStatsMemberEntrySize,
521 		    sizeof (ip_member_t));
522 		SET_MIB(ill->ill_ip_mib->ipIfStatsGroupSourceEntrySize,
523 		    sizeof (ip_grpsrc_t));
524 
525 		/*
526 		 * For a v4 ill, we are done at this point, because per ill
527 		 * icmp mibs are only used for v6.
528 		 */
529 		return (B_TRUE);
530 	}
531 
532 	ill->ill_icmp6_mib = kmem_zalloc(sizeof (*ill->ill_icmp6_mib),
533 	    KM_NOSLEEP);
534 	if (ill->ill_icmp6_mib == NULL) {
535 		kmem_free(ill->ill_ip_mib, sizeof (*ill->ill_ip_mib));
536 		ill->ill_ip_mib = NULL;
537 		return (B_FALSE);
538 	}
539 	/* static icmp info */
540 	ill->ill_icmp6_mib->ipv6IfIcmpEntrySize =
541 	    sizeof (mib2_ipv6IfIcmpEntry_t);
542 	/*
543 	 * The ipIfStatsIfindex and ipv6IfIcmpIndex will be assigned later
544 	 * after the phyint merge occurs in ipif_set_values -> ill_glist_insert
545 	 * -> ill_phyint_reinit
546 	 */
547 	return (B_TRUE);
548 }
549 
550 /*
551  * Common code for preparation of ARP commands.  Two points to remember:
552  * 	1) The ill_name is tacked on at the end of the allocated space so
553  *	   the templates name_offset field must contain the total space
554  *	   to allocate less the name length.
555  *
556  *	2) The templates name_length field should contain the *template*
557  *	   length.  We use it as a parameter to bcopy() and then write
558  *	   the real ill_name_length into the name_length field of the copy.
559  * (Always called as writer.)
560  */
561 mblk_t *
562 ill_arp_alloc(ill_t *ill, const uchar_t *template, caddr_t addr)
563 {
564 	arc_t	*arc = (arc_t *)template;
565 	char	*cp;
566 	int	len;
567 	mblk_t	*mp;
568 	uint_t	name_length = ill->ill_name_length;
569 	uint_t	template_len = arc->arc_name_length;
570 
571 	len = arc->arc_name_offset + name_length;
572 	mp = allocb(len, BPRI_HI);
573 	if (mp == NULL)
574 		return (NULL);
575 	cp = (char *)mp->b_rptr;
576 	mp->b_wptr = (uchar_t *)&cp[len];
577 	if (template_len)
578 		bcopy(template, cp, template_len);
579 	if (len > template_len)
580 		bzero(&cp[template_len], len - template_len);
581 	mp->b_datap->db_type = M_PROTO;
582 
583 	arc = (arc_t *)cp;
584 	arc->arc_name_length = name_length;
585 	cp = (char *)arc + arc->arc_name_offset;
586 	bcopy(ill->ill_name, cp, name_length);
587 
588 	if (addr) {
589 		area_t	*area = (area_t *)mp->b_rptr;
590 
591 		cp = (char *)area + area->area_proto_addr_offset;
592 		bcopy(addr, cp, area->area_proto_addr_length);
593 		if (area->area_cmd == AR_ENTRY_ADD) {
594 			cp = (char *)area;
595 			len = area->area_proto_addr_length;
596 			if (area->area_proto_mask_offset)
597 				cp += area->area_proto_mask_offset;
598 			else
599 				cp += area->area_proto_addr_offset + len;
600 			while (len-- > 0)
601 				*cp++ = (char)~0;
602 		}
603 	}
604 	return (mp);
605 }
606 
607 mblk_t *
608 ipif_area_alloc(ipif_t *ipif, uint_t optflags)
609 {
610 	caddr_t	addr;
611 	mblk_t 	*mp;
612 	area_t	*area;
613 	uchar_t	*areap;
614 	ill_t	*ill = ipif->ipif_ill;
615 
616 	if (ill->ill_isv6) {
617 		ASSERT(ill->ill_flags & ILLF_XRESOLV);
618 		addr = (caddr_t)&ipif->ipif_v6lcl_addr;
619 		areap = (uchar_t *)&ip6_area_template;
620 	} else {
621 		addr = (caddr_t)&ipif->ipif_lcl_addr;
622 		areap = (uchar_t *)&ip_area_template;
623 	}
624 
625 	if ((mp = ill_arp_alloc(ill, areap, addr)) == NULL)
626 		return (NULL);
627 
628 	/*
629 	 * IPMP requires that the hardware address be included in all
630 	 * AR_ENTRY_ADD requests so that ARP can deduce the arl to send on.
631 	 * If there are no active underlying ills in the group (and thus no
632 	 * hardware address, DAD will be deferred until an underlying ill
633 	 * becomes active.
634 	 */
635 	if (IS_IPMP(ill)) {
636 		if ((ill = ipmp_ipif_hold_bound_ill(ipif)) == NULL) {
637 			freemsg(mp);
638 			return (NULL);
639 		}
640 	} else {
641 		ill_refhold(ill);
642 	}
643 
644 	area = (area_t *)mp->b_rptr;
645 	area->area_flags = ACE_F_PERMANENT | ACE_F_PUBLISH | ACE_F_MYADDR;
646 	area->area_flags |= optflags;
647 	area->area_hw_addr_length = ill->ill_phys_addr_length;
648 	bcopy(ill->ill_phys_addr, mp->b_rptr + area->area_hw_addr_offset,
649 	    area->area_hw_addr_length);
650 
651 	ill_refrele(ill);
652 	return (mp);
653 }
654 
655 mblk_t *
656 ipif_ared_alloc(ipif_t *ipif)
657 {
658 	caddr_t	addr;
659 	uchar_t	*aredp;
660 
661 	if (ipif->ipif_ill->ill_isv6) {
662 		ASSERT(ipif->ipif_ill->ill_flags & ILLF_XRESOLV);
663 		addr = (caddr_t)&ipif->ipif_v6lcl_addr;
664 		aredp = (uchar_t *)&ip6_ared_template;
665 	} else {
666 		addr = (caddr_t)&ipif->ipif_lcl_addr;
667 		aredp = (uchar_t *)&ip_ared_template;
668 	}
669 
670 	return (ill_arp_alloc(ipif->ipif_ill, aredp, addr));
671 }
672 
673 mblk_t *
674 ill_ared_alloc(ill_t *ill, ipaddr_t addr)
675 {
676 	return (ill_arp_alloc(ill, (uchar_t *)&ip_ared_template,
677 	    (char *)&addr));
678 }
679 
680 mblk_t *
681 ill_arie_alloc(ill_t *ill, const char *grifname, const void *template)
682 {
683 	mblk_t	*mp = ill_arp_alloc(ill, template, 0);
684 	arie_t	*arie;
685 
686 	if (mp != NULL) {
687 		arie = (arie_t *)mp->b_rptr;
688 		(void) strlcpy(arie->arie_grifname, grifname, LIFNAMSIZ);
689 	}
690 	return (mp);
691 }
692 
693 /*
694  * Completely vaporize a lower level tap and all associated interfaces.
695  * ill_delete is called only out of ip_close when the device control
696  * stream is being closed.
697  */
698 void
699 ill_delete(ill_t *ill)
700 {
701 	ipif_t	*ipif;
702 	ill_t	*prev_ill;
703 	ip_stack_t	*ipst = ill->ill_ipst;
704 
705 	/*
706 	 * ill_delete may be forcibly entering the ipsq. The previous
707 	 * ioctl may not have completed and may need to be aborted.
708 	 * ipsq_flush takes care of it. If we don't need to enter the
709 	 * the ipsq forcibly, the 2nd invocation of ipsq_flush in
710 	 * ill_delete_tail is sufficient.
711 	 */
712 	ipsq_flush(ill);
713 
714 	/*
715 	 * Nuke all interfaces.  ipif_free will take down the interface,
716 	 * remove it from the list, and free the data structure.
717 	 * Walk down the ipif list and remove the logical interfaces
718 	 * first before removing the main ipif. We can't unplumb
719 	 * zeroth interface first in the case of IPv6 as reset_conn_ill
720 	 * -> ip_ll_delmulti_v6 de-references ill_ipif for checking
721 	 * POINTOPOINT.
722 	 *
723 	 * If ill_ipif was not properly initialized (i.e low on memory),
724 	 * then no interfaces to clean up. In this case just clean up the
725 	 * ill.
726 	 */
727 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
728 		ipif_free(ipif);
729 
730 	/*
731 	 * Used only by ill_arp_on and ill_arp_off, which are writers.
732 	 * So nobody can be using this mp now. Free the mp allocated for
733 	 * honoring ILLF_NOARP
734 	 */
735 	freemsg(ill->ill_arp_on_mp);
736 	ill->ill_arp_on_mp = NULL;
737 
738 	/* Clean up msgs on pending upcalls for mrouted */
739 	reset_mrt_ill(ill);
740 
741 	/*
742 	 * ipif_free -> reset_conn_ipif will remove all multicast
743 	 * references for IPv4. For IPv6, we need to do it here as
744 	 * it points only at ills.
745 	 */
746 	reset_conn_ill(ill);
747 
748 	/*
749 	 * Remove multicast references added as a result of calls to
750 	 * ip_join_allmulti().
751 	 */
752 	ip_purge_allmulti(ill);
753 
754 	/*
755 	 * If the ill being deleted is under IPMP, boot it out of the illgrp.
756 	 */
757 	if (IS_UNDER_IPMP(ill))
758 		ipmp_ill_leave_illgrp(ill);
759 
760 	/*
761 	 * ill_down will arrange to blow off any IRE's dependent on this
762 	 * ILL, and shut down fragmentation reassembly.
763 	 */
764 	ill_down(ill);
765 
766 	/* Let SCTP know, so that it can remove this from its list. */
767 	sctp_update_ill(ill, SCTP_ILL_REMOVE);
768 
769 	/*
770 	 * If an address on this ILL is being used as a source address then
771 	 * clear out the pointers in other ILLs that point to this ILL.
772 	 */
773 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
774 	if (ill->ill_usesrc_grp_next != NULL) {
775 		if (ill->ill_usesrc_ifindex == 0) { /* usesrc ILL ? */
776 			ill_disband_usesrc_group(ill);
777 		} else {	/* consumer of the usesrc ILL */
778 			prev_ill = ill_prev_usesrc(ill);
779 			prev_ill->ill_usesrc_grp_next =
780 			    ill->ill_usesrc_grp_next;
781 		}
782 	}
783 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
784 }
785 
786 static void
787 ipif_non_duplicate(ipif_t *ipif)
788 {
789 	ill_t *ill = ipif->ipif_ill;
790 	mutex_enter(&ill->ill_lock);
791 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
792 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
793 		ASSERT(ill->ill_ipif_dup_count > 0);
794 		ill->ill_ipif_dup_count--;
795 	}
796 	mutex_exit(&ill->ill_lock);
797 }
798 
799 /*
800  * ill_delete_tail is called from ip_modclose after all references
801  * to the closing ill are gone. The wait is done in ip_modclose
802  */
803 void
804 ill_delete_tail(ill_t *ill)
805 {
806 	mblk_t	**mpp;
807 	ipif_t	*ipif;
808 	ip_stack_t	*ipst = ill->ill_ipst;
809 
810 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
811 		ipif_non_duplicate(ipif);
812 		ipif_down_tail(ipif);
813 	}
814 
815 	ASSERT(ill->ill_ipif_dup_count == 0 &&
816 	    ill->ill_arp_down_mp == NULL &&
817 	    ill->ill_arp_del_mapping_mp == NULL);
818 
819 	/*
820 	 * If polling capability is enabled (which signifies direct
821 	 * upcall into IP and driver has ill saved as a handle),
822 	 * we need to make sure that unbind has completed before we
823 	 * let the ill disappear and driver no longer has any reference
824 	 * to this ill.
825 	 */
826 	mutex_enter(&ill->ill_lock);
827 	while (ill->ill_state_flags & ILL_DL_UNBIND_IN_PROGRESS)
828 		cv_wait(&ill->ill_cv, &ill->ill_lock);
829 	mutex_exit(&ill->ill_lock);
830 	ASSERT(!(ill->ill_capabilities &
831 	    (ILL_CAPAB_DLD | ILL_CAPAB_DLD_POLL | ILL_CAPAB_DLD_DIRECT)));
832 
833 	if (ill->ill_net_type != IRE_LOOPBACK)
834 		qprocsoff(ill->ill_rq);
835 
836 	/*
837 	 * We do an ipsq_flush once again now. New messages could have
838 	 * landed up from below (M_ERROR or M_HANGUP). Similarly ioctls
839 	 * could also have landed up if an ioctl thread had looked up
840 	 * the ill before we set the ILL_CONDEMNED flag, but not yet
841 	 * enqueued the ioctl when we did the ipsq_flush last time.
842 	 */
843 	ipsq_flush(ill);
844 
845 	/*
846 	 * Free capabilities.
847 	 */
848 	if (ill->ill_ipsec_capab_ah != NULL) {
849 		ill_ipsec_capab_delete(ill, DL_CAPAB_IPSEC_AH);
850 		ill_ipsec_capab_free(ill->ill_ipsec_capab_ah);
851 		ill->ill_ipsec_capab_ah = NULL;
852 	}
853 
854 	if (ill->ill_ipsec_capab_esp != NULL) {
855 		ill_ipsec_capab_delete(ill, DL_CAPAB_IPSEC_ESP);
856 		ill_ipsec_capab_free(ill->ill_ipsec_capab_esp);
857 		ill->ill_ipsec_capab_esp = NULL;
858 	}
859 
860 	if (ill->ill_mdt_capab != NULL) {
861 		kmem_free(ill->ill_mdt_capab, sizeof (ill_mdt_capab_t));
862 		ill->ill_mdt_capab = NULL;
863 	}
864 
865 	if (ill->ill_hcksum_capab != NULL) {
866 		kmem_free(ill->ill_hcksum_capab, sizeof (ill_hcksum_capab_t));
867 		ill->ill_hcksum_capab = NULL;
868 	}
869 
870 	if (ill->ill_zerocopy_capab != NULL) {
871 		kmem_free(ill->ill_zerocopy_capab,
872 		    sizeof (ill_zerocopy_capab_t));
873 		ill->ill_zerocopy_capab = NULL;
874 	}
875 
876 	if (ill->ill_lso_capab != NULL) {
877 		kmem_free(ill->ill_lso_capab, sizeof (ill_lso_capab_t));
878 		ill->ill_lso_capab = NULL;
879 	}
880 
881 	if (ill->ill_dld_capab != NULL) {
882 		kmem_free(ill->ill_dld_capab, sizeof (ill_dld_capab_t));
883 		ill->ill_dld_capab = NULL;
884 	}
885 
886 	while (ill->ill_ipif != NULL)
887 		ipif_free_tail(ill->ill_ipif);
888 
889 	/*
890 	 * We have removed all references to ilm from conn and the ones joined
891 	 * within the kernel.
892 	 *
893 	 * We don't walk conns, mrts and ires because
894 	 *
895 	 * 1) reset_conn_ill and reset_mrt_ill cleans up conns and mrts.
896 	 * 2) ill_down ->ill_downi walks all the ires and cleans up
897 	 *    ill references.
898 	 */
899 	ASSERT(ilm_walk_ill(ill) == 0);
900 
901 	/*
902 	 * If this ill is an IPMP meta-interface, blow away the illgrp.  This
903 	 * is safe to do because the illgrp has already been unlinked from the
904 	 * group by I_PUNLINK, and thus SIOCSLIFGROUPNAME cannot find it.
905 	 */
906 	if (IS_IPMP(ill)) {
907 		ipmp_illgrp_destroy(ill->ill_grp);
908 		ill->ill_grp = NULL;
909 	}
910 
911 	/*
912 	 * Take us out of the list of ILLs. ill_glist_delete -> phyint_free
913 	 * could free the phyint. No more reference to the phyint after this
914 	 * point.
915 	 */
916 	(void) ill_glist_delete(ill);
917 
918 	rw_enter(&ipst->ips_ip_g_nd_lock, RW_WRITER);
919 	if (ill->ill_ndd_name != NULL)
920 		nd_unload(&ipst->ips_ip_g_nd, ill->ill_ndd_name);
921 	rw_exit(&ipst->ips_ip_g_nd_lock);
922 
923 	if (ill->ill_frag_ptr != NULL) {
924 		uint_t count;
925 
926 		for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
927 			mutex_destroy(&ill->ill_frag_hash_tbl[count].ipfb_lock);
928 		}
929 		mi_free(ill->ill_frag_ptr);
930 		ill->ill_frag_ptr = NULL;
931 		ill->ill_frag_hash_tbl = NULL;
932 	}
933 
934 	freemsg(ill->ill_nd_lla_mp);
935 	/* Free all retained control messages. */
936 	mpp = &ill->ill_first_mp_to_free;
937 	do {
938 		while (mpp[0]) {
939 			mblk_t  *mp;
940 			mblk_t  *mp1;
941 
942 			mp = mpp[0];
943 			mpp[0] = mp->b_next;
944 			for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont) {
945 				mp1->b_next = NULL;
946 				mp1->b_prev = NULL;
947 			}
948 			freemsg(mp);
949 		}
950 	} while (mpp++ != &ill->ill_last_mp_to_free);
951 
952 	ill_free_mib(ill);
953 
954 #ifdef DEBUG
955 	ill_trace_cleanup(ill);
956 #endif
957 
958 	/* Drop refcnt here */
959 	netstack_rele(ill->ill_ipst->ips_netstack);
960 	ill->ill_ipst = NULL;
961 }
962 
963 static void
964 ill_free_mib(ill_t *ill)
965 {
966 	ip_stack_t *ipst = ill->ill_ipst;
967 
968 	/*
969 	 * MIB statistics must not be lost, so when an interface
970 	 * goes away the counter values will be added to the global
971 	 * MIBs.
972 	 */
973 	if (ill->ill_ip_mib != NULL) {
974 		if (ill->ill_isv6) {
975 			ip_mib2_add_ip_stats(&ipst->ips_ip6_mib,
976 			    ill->ill_ip_mib);
977 		} else {
978 			ip_mib2_add_ip_stats(&ipst->ips_ip_mib,
979 			    ill->ill_ip_mib);
980 		}
981 
982 		kmem_free(ill->ill_ip_mib, sizeof (*ill->ill_ip_mib));
983 		ill->ill_ip_mib = NULL;
984 	}
985 	if (ill->ill_icmp6_mib != NULL) {
986 		ip_mib2_add_icmp6_stats(&ipst->ips_icmp6_mib,
987 		    ill->ill_icmp6_mib);
988 		kmem_free(ill->ill_icmp6_mib, sizeof (*ill->ill_icmp6_mib));
989 		ill->ill_icmp6_mib = NULL;
990 	}
991 }
992 
993 /*
994  * Concatenate together a physical address and a sap.
995  *
996  * Sap_lengths are interpreted as follows:
997  *   sap_length == 0	==>	no sap
998  *   sap_length > 0	==>	sap is at the head of the dlpi address
999  *   sap_length < 0	==>	sap is at the tail of the dlpi address
1000  */
1001 static void
1002 ill_dlur_copy_address(uchar_t *phys_src, uint_t phys_length,
1003     t_scalar_t sap_src, t_scalar_t sap_length, uchar_t *dst)
1004 {
1005 	uint16_t sap_addr = (uint16_t)sap_src;
1006 
1007 	if (sap_length == 0) {
1008 		if (phys_src == NULL)
1009 			bzero(dst, phys_length);
1010 		else
1011 			bcopy(phys_src, dst, phys_length);
1012 	} else if (sap_length < 0) {
1013 		if (phys_src == NULL)
1014 			bzero(dst, phys_length);
1015 		else
1016 			bcopy(phys_src, dst, phys_length);
1017 		bcopy(&sap_addr, (char *)dst + phys_length, sizeof (sap_addr));
1018 	} else {
1019 		bcopy(&sap_addr, dst, sizeof (sap_addr));
1020 		if (phys_src == NULL)
1021 			bzero((char *)dst + sap_length, phys_length);
1022 		else
1023 			bcopy(phys_src, (char *)dst + sap_length, phys_length);
1024 	}
1025 }
1026 
1027 /*
1028  * Generate a dl_unitdata_req mblk for the device and address given.
1029  * addr_length is the length of the physical portion of the address.
1030  * If addr is NULL include an all zero address of the specified length.
1031  * TRUE? In any case, addr_length is taken to be the entire length of the
1032  * dlpi address, including the absolute value of sap_length.
1033  */
1034 mblk_t *
1035 ill_dlur_gen(uchar_t *addr, uint_t addr_length, t_uscalar_t sap,
1036 		t_scalar_t sap_length)
1037 {
1038 	dl_unitdata_req_t *dlur;
1039 	mblk_t	*mp;
1040 	t_scalar_t	abs_sap_length;		/* absolute value */
1041 
1042 	abs_sap_length = ABS(sap_length);
1043 	mp = ip_dlpi_alloc(sizeof (*dlur) + addr_length + abs_sap_length,
1044 	    DL_UNITDATA_REQ);
1045 	if (mp == NULL)
1046 		return (NULL);
1047 	dlur = (dl_unitdata_req_t *)mp->b_rptr;
1048 	/* HACK: accomodate incompatible DLPI drivers */
1049 	if (addr_length == 8)
1050 		addr_length = 6;
1051 	dlur->dl_dest_addr_length = addr_length + abs_sap_length;
1052 	dlur->dl_dest_addr_offset = sizeof (*dlur);
1053 	dlur->dl_priority.dl_min = 0;
1054 	dlur->dl_priority.dl_max = 0;
1055 	ill_dlur_copy_address(addr, addr_length, sap, sap_length,
1056 	    (uchar_t *)&dlur[1]);
1057 	return (mp);
1058 }
1059 
1060 /*
1061  * Add the 'mp' to the list of pending mp's headed by ill_pending_mp
1062  * Return an error if we already have 1 or more ioctls in progress.
1063  * This is used only for non-exclusive ioctls. Currently this is used
1064  * for SIOC*ARP and SIOCGTUNPARAM ioctls. Most set ioctls are exclusive
1065  * and thus need to use ipsq_pending_mp_add.
1066  */
1067 boolean_t
1068 ill_pending_mp_add(ill_t *ill, conn_t *connp, mblk_t *add_mp)
1069 {
1070 	ASSERT(MUTEX_HELD(&ill->ill_lock));
1071 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
1072 	/*
1073 	 * M_IOCDATA from ioctls, M_IOCTL from tunnel ioctls.
1074 	 */
1075 	ASSERT((add_mp->b_datap->db_type == M_IOCDATA) ||
1076 	    (add_mp->b_datap->db_type == M_IOCTL));
1077 
1078 	ASSERT(MUTEX_HELD(&connp->conn_lock));
1079 	/*
1080 	 * Return error if the conn has started closing. The conn
1081 	 * could have finished cleaning up the pending mp list,
1082 	 * If so we should not add another mp to the list negating
1083 	 * the cleanup.
1084 	 */
1085 	if (connp->conn_state_flags & CONN_CLOSING)
1086 		return (B_FALSE);
1087 	/*
1088 	 * Add the pending mp to the head of the list, chained by b_next.
1089 	 * Note down the conn on which the ioctl request came, in b_prev.
1090 	 * This will be used to later get the conn, when we get a response
1091 	 * on the ill queue, from some other module (typically arp)
1092 	 */
1093 	add_mp->b_next = (void *)ill->ill_pending_mp;
1094 	add_mp->b_queue = CONNP_TO_WQ(connp);
1095 	ill->ill_pending_mp = add_mp;
1096 	if (connp != NULL)
1097 		connp->conn_oper_pending_ill = ill;
1098 	return (B_TRUE);
1099 }
1100 
1101 /*
1102  * Retrieve the ill_pending_mp and return it. We have to walk the list
1103  * of mblks starting at ill_pending_mp, and match based on the ioc_id.
1104  */
1105 mblk_t *
1106 ill_pending_mp_get(ill_t *ill, conn_t **connpp, uint_t ioc_id)
1107 {
1108 	mblk_t	*prev = NULL;
1109 	mblk_t	*curr = NULL;
1110 	uint_t	id;
1111 	conn_t	*connp;
1112 
1113 	/*
1114 	 * When the conn closes, conn_ioctl_cleanup needs to clean
1115 	 * up the pending mp, but it does not know the ioc_id and
1116 	 * passes in a zero for it.
1117 	 */
1118 	mutex_enter(&ill->ill_lock);
1119 	if (ioc_id != 0)
1120 		*connpp = NULL;
1121 
1122 	/* Search the list for the appropriate ioctl based on ioc_id */
1123 	for (prev = NULL, curr = ill->ill_pending_mp; curr != NULL;
1124 	    prev = curr, curr = curr->b_next) {
1125 		id = ((struct iocblk *)curr->b_rptr)->ioc_id;
1126 		connp = Q_TO_CONN(curr->b_queue);
1127 		/* Match based on the ioc_id or based on the conn */
1128 		if ((id == ioc_id) || (ioc_id == 0 && connp == *connpp))
1129 			break;
1130 	}
1131 
1132 	if (curr != NULL) {
1133 		/* Unlink the mblk from the pending mp list */
1134 		if (prev != NULL) {
1135 			prev->b_next = curr->b_next;
1136 		} else {
1137 			ASSERT(ill->ill_pending_mp == curr);
1138 			ill->ill_pending_mp = curr->b_next;
1139 		}
1140 
1141 		/*
1142 		 * conn refcnt must have been bumped up at the start of
1143 		 * the ioctl. So we can safely access the conn.
1144 		 */
1145 		ASSERT(CONN_Q(curr->b_queue));
1146 		*connpp = Q_TO_CONN(curr->b_queue);
1147 		curr->b_next = NULL;
1148 		curr->b_queue = NULL;
1149 	}
1150 
1151 	mutex_exit(&ill->ill_lock);
1152 
1153 	return (curr);
1154 }
1155 
1156 /*
1157  * Add the pending mp to the list. There can be only 1 pending mp
1158  * in the list. Any exclusive ioctl that needs to wait for a response
1159  * from another module or driver needs to use this function to set
1160  * the ipx_pending_mp to the ioctl mblk and wait for the response from
1161  * the other module/driver. This is also used while waiting for the
1162  * ipif/ill/ire refcnts to drop to zero in bringing down an ipif.
1163  */
1164 boolean_t
1165 ipsq_pending_mp_add(conn_t *connp, ipif_t *ipif, queue_t *q, mblk_t *add_mp,
1166     int waitfor)
1167 {
1168 	ipxop_t	*ipx = ipif->ipif_ill->ill_phyint->phyint_ipsq->ipsq_xop;
1169 
1170 	ASSERT(IAM_WRITER_IPIF(ipif));
1171 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
1172 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
1173 	ASSERT(ipx->ipx_pending_mp == NULL);
1174 	/*
1175 	 * The caller may be using a different ipif than the one passed into
1176 	 * ipsq_current_start() (e.g., suppose an ioctl that came in on the V4
1177 	 * ill needs to wait for the V6 ill to quiesce).  So we can't ASSERT
1178 	 * that `ipx_current_ipif == ipif'.
1179 	 */
1180 	ASSERT(ipx->ipx_current_ipif != NULL);
1181 
1182 	/*
1183 	 * M_IOCDATA from ioctls, M_IOCTL from tunnel ioctls,
1184 	 * M_ERROR/M_HANGUP/M_PROTO/M_PCPROTO from the driver.
1185 	 */
1186 	ASSERT((DB_TYPE(add_mp) == M_IOCDATA) || (DB_TYPE(add_mp) == M_IOCTL) ||
1187 	    (DB_TYPE(add_mp) == M_ERROR) || (DB_TYPE(add_mp) == M_HANGUP) ||
1188 	    (DB_TYPE(add_mp) == M_PROTO) || (DB_TYPE(add_mp) == M_PCPROTO));
1189 
1190 	if (connp != NULL) {
1191 		ASSERT(MUTEX_HELD(&connp->conn_lock));
1192 		/*
1193 		 * Return error if the conn has started closing. The conn
1194 		 * could have finished cleaning up the pending mp list,
1195 		 * If so we should not add another mp to the list negating
1196 		 * the cleanup.
1197 		 */
1198 		if (connp->conn_state_flags & CONN_CLOSING)
1199 			return (B_FALSE);
1200 	}
1201 	mutex_enter(&ipx->ipx_lock);
1202 	ipx->ipx_pending_ipif = ipif;
1203 	/*
1204 	 * Note down the queue in b_queue. This will be returned by
1205 	 * ipsq_pending_mp_get. Caller will then use these values to restart
1206 	 * the processing
1207 	 */
1208 	add_mp->b_next = NULL;
1209 	add_mp->b_queue = q;
1210 	ipx->ipx_pending_mp = add_mp;
1211 	ipx->ipx_waitfor = waitfor;
1212 	mutex_exit(&ipx->ipx_lock);
1213 
1214 	if (connp != NULL)
1215 		connp->conn_oper_pending_ill = ipif->ipif_ill;
1216 
1217 	return (B_TRUE);
1218 }
1219 
1220 /*
1221  * Retrieve the ipx_pending_mp and return it. There can be only 1 mp
1222  * queued in the list.
1223  */
1224 mblk_t *
1225 ipsq_pending_mp_get(ipsq_t *ipsq, conn_t **connpp)
1226 {
1227 	mblk_t	*curr = NULL;
1228 	ipxop_t	*ipx = ipsq->ipsq_xop;
1229 
1230 	*connpp = NULL;
1231 	mutex_enter(&ipx->ipx_lock);
1232 	if (ipx->ipx_pending_mp == NULL) {
1233 		mutex_exit(&ipx->ipx_lock);
1234 		return (NULL);
1235 	}
1236 
1237 	/* There can be only 1 such excl message */
1238 	curr = ipx->ipx_pending_mp;
1239 	ASSERT(curr->b_next == NULL);
1240 	ipx->ipx_pending_ipif = NULL;
1241 	ipx->ipx_pending_mp = NULL;
1242 	ipx->ipx_waitfor = 0;
1243 	mutex_exit(&ipx->ipx_lock);
1244 
1245 	if (CONN_Q(curr->b_queue)) {
1246 		/*
1247 		 * This mp did a refhold on the conn, at the start of the ioctl.
1248 		 * So we can safely return a pointer to the conn to the caller.
1249 		 */
1250 		*connpp = Q_TO_CONN(curr->b_queue);
1251 	} else {
1252 		*connpp = NULL;
1253 	}
1254 	curr->b_next = NULL;
1255 	curr->b_prev = NULL;
1256 	return (curr);
1257 }
1258 
1259 /*
1260  * Cleanup the ioctl mp queued in ipx_pending_mp
1261  * - Called in the ill_delete path
1262  * - Called in the M_ERROR or M_HANGUP path on the ill.
1263  * - Called in the conn close path.
1264  */
1265 boolean_t
1266 ipsq_pending_mp_cleanup(ill_t *ill, conn_t *connp)
1267 {
1268 	mblk_t	*mp;
1269 	ipxop_t	*ipx;
1270 	queue_t	*q;
1271 	ipif_t	*ipif;
1272 
1273 	ASSERT(IAM_WRITER_ILL(ill));
1274 	ipx = ill->ill_phyint->phyint_ipsq->ipsq_xop;
1275 
1276 	/*
1277 	 * If connp is null, unconditionally clean up the ipx_pending_mp.
1278 	 * This happens in M_ERROR/M_HANGUP. We need to abort the current ioctl
1279 	 * even if it is meant for another ill, since we have to enqueue
1280 	 * a new mp now in ipx_pending_mp to complete the ipif_down.
1281 	 * If connp is non-null we are called from the conn close path.
1282 	 */
1283 	mutex_enter(&ipx->ipx_lock);
1284 	mp = ipx->ipx_pending_mp;
1285 	if (mp == NULL || (connp != NULL &&
1286 	    mp->b_queue != CONNP_TO_WQ(connp))) {
1287 		mutex_exit(&ipx->ipx_lock);
1288 		return (B_FALSE);
1289 	}
1290 	/* Now remove from the ipx_pending_mp */
1291 	ipx->ipx_pending_mp = NULL;
1292 	q = mp->b_queue;
1293 	mp->b_next = NULL;
1294 	mp->b_prev = NULL;
1295 	mp->b_queue = NULL;
1296 
1297 	ipif = ipx->ipx_pending_ipif;
1298 	ipx->ipx_pending_ipif = NULL;
1299 	ipx->ipx_waitfor = 0;
1300 	ipx->ipx_current_ipif = NULL;
1301 	ipx->ipx_current_ioctl = 0;
1302 	ipx->ipx_current_done = B_TRUE;
1303 	mutex_exit(&ipx->ipx_lock);
1304 
1305 	if (DB_TYPE(mp) == M_IOCTL || DB_TYPE(mp) == M_IOCDATA) {
1306 		if (connp == NULL) {
1307 			ip_ioctl_finish(q, mp, ENXIO, NO_COPYOUT, NULL);
1308 		} else {
1309 			ip_ioctl_finish(q, mp, ENXIO, CONN_CLOSE, NULL);
1310 			mutex_enter(&ipif->ipif_ill->ill_lock);
1311 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
1312 			mutex_exit(&ipif->ipif_ill->ill_lock);
1313 		}
1314 	} else {
1315 		/*
1316 		 * IP-MT XXX In the case of TLI/XTI bind / optmgmt this can't
1317 		 * be just inet_freemsg. we have to restart it
1318 		 * otherwise the thread will be stuck.
1319 		 */
1320 		inet_freemsg(mp);
1321 	}
1322 	return (B_TRUE);
1323 }
1324 
1325 /*
1326  * The ill is closing. Cleanup all the pending mps. Called exclusively
1327  * towards the end of ill_delete. The refcount has gone to 0. So nobody
1328  * knows this ill, and hence nobody can add an mp to this list
1329  */
1330 static void
1331 ill_pending_mp_cleanup(ill_t *ill)
1332 {
1333 	mblk_t	*mp;
1334 	queue_t	*q;
1335 
1336 	ASSERT(IAM_WRITER_ILL(ill));
1337 
1338 	mutex_enter(&ill->ill_lock);
1339 	/*
1340 	 * Every mp on the pending mp list originating from an ioctl
1341 	 * added 1 to the conn refcnt, at the start of the ioctl.
1342 	 * So bump it down now.  See comments in ip_wput_nondata()
1343 	 */
1344 	while (ill->ill_pending_mp != NULL) {
1345 		mp = ill->ill_pending_mp;
1346 		ill->ill_pending_mp = mp->b_next;
1347 		mutex_exit(&ill->ill_lock);
1348 
1349 		q = mp->b_queue;
1350 		ASSERT(CONN_Q(q));
1351 		mp->b_next = NULL;
1352 		mp->b_prev = NULL;
1353 		mp->b_queue = NULL;
1354 		ip_ioctl_finish(q, mp, ENXIO, NO_COPYOUT, NULL);
1355 		mutex_enter(&ill->ill_lock);
1356 	}
1357 	ill->ill_pending_ipif = NULL;
1358 
1359 	mutex_exit(&ill->ill_lock);
1360 }
1361 
1362 /*
1363  * Called in the conn close path and ill delete path
1364  */
1365 static void
1366 ipsq_xopq_mp_cleanup(ill_t *ill, conn_t *connp)
1367 {
1368 	ipsq_t	*ipsq;
1369 	mblk_t	*prev;
1370 	mblk_t	*curr;
1371 	mblk_t	*next;
1372 	queue_t	*q;
1373 	mblk_t	*tmp_list = NULL;
1374 
1375 	ASSERT(IAM_WRITER_ILL(ill));
1376 	if (connp != NULL)
1377 		q = CONNP_TO_WQ(connp);
1378 	else
1379 		q = ill->ill_wq;
1380 
1381 	ipsq = ill->ill_phyint->phyint_ipsq;
1382 	/*
1383 	 * Cleanup the ioctl mp's queued in ipsq_xopq_pending_mp if any.
1384 	 * In the case of ioctl from a conn, there can be only 1 mp
1385 	 * queued on the ipsq. If an ill is being unplumbed, only messages
1386 	 * related to this ill are flushed, like M_ERROR or M_HANGUP message.
1387 	 * ioctls meant for this ill form conn's are not flushed. They will
1388 	 * be processed during ipsq_exit and will not find the ill and will
1389 	 * return error.
1390 	 */
1391 	mutex_enter(&ipsq->ipsq_lock);
1392 	for (prev = NULL, curr = ipsq->ipsq_xopq_mphead; curr != NULL;
1393 	    curr = next) {
1394 		next = curr->b_next;
1395 		if (curr->b_queue == q || curr->b_queue == RD(q)) {
1396 			/* Unlink the mblk from the pending mp list */
1397 			if (prev != NULL) {
1398 				prev->b_next = curr->b_next;
1399 			} else {
1400 				ASSERT(ipsq->ipsq_xopq_mphead == curr);
1401 				ipsq->ipsq_xopq_mphead = curr->b_next;
1402 			}
1403 			if (ipsq->ipsq_xopq_mptail == curr)
1404 				ipsq->ipsq_xopq_mptail = prev;
1405 			/*
1406 			 * Create a temporary list and release the ipsq lock
1407 			 * New elements are added to the head of the tmp_list
1408 			 */
1409 			curr->b_next = tmp_list;
1410 			tmp_list = curr;
1411 		} else {
1412 			prev = curr;
1413 		}
1414 	}
1415 	mutex_exit(&ipsq->ipsq_lock);
1416 
1417 	while (tmp_list != NULL) {
1418 		curr = tmp_list;
1419 		tmp_list = curr->b_next;
1420 		curr->b_next = NULL;
1421 		curr->b_prev = NULL;
1422 		curr->b_queue = NULL;
1423 		if (DB_TYPE(curr) == M_IOCTL || DB_TYPE(curr) == M_IOCDATA) {
1424 			ip_ioctl_finish(q, curr, ENXIO, connp != NULL ?
1425 			    CONN_CLOSE : NO_COPYOUT, NULL);
1426 		} else {
1427 			/*
1428 			 * IP-MT XXX In the case of TLI/XTI bind / optmgmt
1429 			 * this can't be just inet_freemsg. we have to
1430 			 * restart it otherwise the thread will be stuck.
1431 			 */
1432 			inet_freemsg(curr);
1433 		}
1434 	}
1435 }
1436 
1437 /*
1438  * This conn has started closing. Cleanup any pending ioctl from this conn.
1439  * STREAMS ensures that there can be at most 1 ioctl pending on a stream.
1440  */
1441 void
1442 conn_ioctl_cleanup(conn_t *connp)
1443 {
1444 	mblk_t *curr;
1445 	ipsq_t	*ipsq;
1446 	ill_t	*ill;
1447 	boolean_t refheld;
1448 
1449 	/*
1450 	 * Is any exclusive ioctl pending ? If so clean it up. If the
1451 	 * ioctl has not yet started, the mp is pending in the list headed by
1452 	 * ipsq_xopq_head. If the ioctl has started the mp could be present in
1453 	 * ipx_pending_mp. If the ioctl timed out in the streamhead but
1454 	 * is currently executing now the mp is not queued anywhere but
1455 	 * conn_oper_pending_ill is null. The conn close will wait
1456 	 * till the conn_ref drops to zero.
1457 	 */
1458 	mutex_enter(&connp->conn_lock);
1459 	ill = connp->conn_oper_pending_ill;
1460 	if (ill == NULL) {
1461 		mutex_exit(&connp->conn_lock);
1462 		return;
1463 	}
1464 
1465 	curr = ill_pending_mp_get(ill, &connp, 0);
1466 	if (curr != NULL) {
1467 		mutex_exit(&connp->conn_lock);
1468 		CONN_DEC_REF(connp);
1469 		inet_freemsg(curr);
1470 		return;
1471 	}
1472 	/*
1473 	 * We may not be able to refhold the ill if the ill/ipif
1474 	 * is changing. But we need to make sure that the ill will
1475 	 * not vanish. So we just bump up the ill_waiter count.
1476 	 */
1477 	refheld = ill_waiter_inc(ill);
1478 	mutex_exit(&connp->conn_lock);
1479 	if (refheld) {
1480 		if (ipsq_enter(ill, B_TRUE, NEW_OP)) {
1481 			ill_waiter_dcr(ill);
1482 			/*
1483 			 * Check whether this ioctl has started and is
1484 			 * pending. If it is not found there then check
1485 			 * whether this ioctl has not even started and is in
1486 			 * the ipsq_xopq list.
1487 			 */
1488 			if (!ipsq_pending_mp_cleanup(ill, connp))
1489 				ipsq_xopq_mp_cleanup(ill, connp);
1490 			ipsq = ill->ill_phyint->phyint_ipsq;
1491 			ipsq_exit(ipsq);
1492 			return;
1493 		}
1494 	}
1495 
1496 	/*
1497 	 * The ill is also closing and we could not bump up the
1498 	 * ill_waiter_count or we could not enter the ipsq. Leave
1499 	 * the cleanup to ill_delete
1500 	 */
1501 	mutex_enter(&connp->conn_lock);
1502 	while (connp->conn_oper_pending_ill != NULL)
1503 		cv_wait(&connp->conn_refcv, &connp->conn_lock);
1504 	mutex_exit(&connp->conn_lock);
1505 	if (refheld)
1506 		ill_waiter_dcr(ill);
1507 }
1508 
1509 /*
1510  * ipcl_walk function for cleaning up conn_*_ill fields.
1511  */
1512 static void
1513 conn_cleanup_ill(conn_t *connp, caddr_t arg)
1514 {
1515 	ill_t	*ill = (ill_t *)arg;
1516 	ire_t	*ire;
1517 
1518 	mutex_enter(&connp->conn_lock);
1519 	if (connp->conn_multicast_ill == ill) {
1520 		/* Revert to late binding */
1521 		connp->conn_multicast_ill = NULL;
1522 	}
1523 	if (connp->conn_incoming_ill == ill)
1524 		connp->conn_incoming_ill = NULL;
1525 	if (connp->conn_outgoing_ill == ill)
1526 		connp->conn_outgoing_ill = NULL;
1527 	if (connp->conn_dhcpinit_ill == ill) {
1528 		connp->conn_dhcpinit_ill = NULL;
1529 		ASSERT(ill->ill_dhcpinit != 0);
1530 		atomic_dec_32(&ill->ill_dhcpinit);
1531 	}
1532 	if (connp->conn_ire_cache != NULL) {
1533 		ire = connp->conn_ire_cache;
1534 		/*
1535 		 * Source address selection makes it possible for IRE_CACHE
1536 		 * entries to be created with ire_stq coming from interface X
1537 		 * and ipif coming from interface Y.  Thus whenever interface
1538 		 * X goes down, remove all references to it by checking both
1539 		 * on ire_ipif and ire_stq.
1540 		 */
1541 		if ((ire->ire_ipif != NULL && ire->ire_ipif->ipif_ill == ill) ||
1542 		    (ire->ire_type == IRE_CACHE &&
1543 		    ire->ire_stq == ill->ill_wq)) {
1544 			connp->conn_ire_cache = NULL;
1545 			mutex_exit(&connp->conn_lock);
1546 			ire_refrele_notr(ire);
1547 			return;
1548 		}
1549 	}
1550 	mutex_exit(&connp->conn_lock);
1551 }
1552 
1553 static void
1554 ill_down_ipifs_tail(ill_t *ill)
1555 {
1556 	ipif_t	*ipif;
1557 
1558 	ASSERT(IAM_WRITER_ILL(ill));
1559 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
1560 		ipif_non_duplicate(ipif);
1561 		ipif_down_tail(ipif);
1562 	}
1563 }
1564 
1565 /* ARGSUSED */
1566 void
1567 ipif_all_down_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
1568 {
1569 	ASSERT(IAM_WRITER_IPSQ(ipsq));
1570 	ill_down_ipifs_tail(q->q_ptr);
1571 	freemsg(mp);
1572 	ipsq_current_finish(ipsq);
1573 }
1574 
1575 /*
1576  * ill_down_start is called when we want to down this ill and bring it up again
1577  * It is called when we receive an M_ERROR / M_HANGUP. In this case we shut down
1578  * all interfaces, but don't tear down any plumbing.
1579  */
1580 boolean_t
1581 ill_down_start(queue_t *q, mblk_t *mp)
1582 {
1583 	ill_t	*ill = q->q_ptr;
1584 	ipif_t	*ipif;
1585 
1586 	ASSERT(IAM_WRITER_ILL(ill));
1587 
1588 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
1589 		(void) ipif_down(ipif, NULL, NULL);
1590 
1591 	ill_down(ill);
1592 
1593 	(void) ipsq_pending_mp_cleanup(ill, NULL);
1594 
1595 	ipsq_current_start(ill->ill_phyint->phyint_ipsq, ill->ill_ipif, 0);
1596 
1597 	/*
1598 	 * Atomically test and add the pending mp if references are active.
1599 	 */
1600 	mutex_enter(&ill->ill_lock);
1601 	if (!ill_is_quiescent(ill)) {
1602 		/* call cannot fail since `conn_t *' argument is NULL */
1603 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
1604 		    mp, ILL_DOWN);
1605 		mutex_exit(&ill->ill_lock);
1606 		return (B_FALSE);
1607 	}
1608 	mutex_exit(&ill->ill_lock);
1609 	return (B_TRUE);
1610 }
1611 
1612 static void
1613 ill_down(ill_t *ill)
1614 {
1615 	ip_stack_t	*ipst = ill->ill_ipst;
1616 
1617 	/* Blow off any IREs dependent on this ILL. */
1618 	ire_walk(ill_downi, ill, ipst);
1619 
1620 	/* Remove any conn_*_ill depending on this ill */
1621 	ipcl_walk(conn_cleanup_ill, (caddr_t)ill, ipst);
1622 }
1623 
1624 /*
1625  * ire_walk routine used to delete every IRE that depends on queues
1626  * associated with 'ill'.  (Always called as writer.)
1627  */
1628 static void
1629 ill_downi(ire_t *ire, char *ill_arg)
1630 {
1631 	ill_t	*ill = (ill_t *)ill_arg;
1632 
1633 	/*
1634 	 * Source address selection makes it possible for IRE_CACHE
1635 	 * entries to be created with ire_stq coming from interface X
1636 	 * and ipif coming from interface Y.  Thus whenever interface
1637 	 * X goes down, remove all references to it by checking both
1638 	 * on ire_ipif and ire_stq.
1639 	 */
1640 	if ((ire->ire_ipif != NULL && ire->ire_ipif->ipif_ill == ill) ||
1641 	    (ire->ire_type == IRE_CACHE && ire->ire_stq == ill->ill_wq)) {
1642 		ire_delete(ire);
1643 	}
1644 }
1645 
1646 /*
1647  * Remove ire/nce from the fastpath list.
1648  */
1649 void
1650 ill_fastpath_nack(ill_t *ill)
1651 {
1652 	nce_fastpath_list_dispatch(ill, NULL, NULL);
1653 }
1654 
1655 /* Consume an M_IOCACK of the fastpath probe. */
1656 void
1657 ill_fastpath_ack(ill_t *ill, mblk_t *mp)
1658 {
1659 	mblk_t	*mp1 = mp;
1660 
1661 	/*
1662 	 * If this was the first attempt turn on the fastpath probing.
1663 	 */
1664 	mutex_enter(&ill->ill_lock);
1665 	if (ill->ill_dlpi_fastpath_state == IDS_INPROGRESS)
1666 		ill->ill_dlpi_fastpath_state = IDS_OK;
1667 	mutex_exit(&ill->ill_lock);
1668 
1669 	/* Free the M_IOCACK mblk, hold on to the data */
1670 	mp = mp->b_cont;
1671 	freeb(mp1);
1672 	if (mp == NULL)
1673 		return;
1674 	if (mp->b_cont != NULL) {
1675 		/*
1676 		 * Update all IRE's or NCE's that are waiting for
1677 		 * fastpath update.
1678 		 */
1679 		nce_fastpath_list_dispatch(ill, ndp_fastpath_update, mp);
1680 		mp1 = mp->b_cont;
1681 		freeb(mp);
1682 		mp = mp1;
1683 	} else {
1684 		ip0dbg(("ill_fastpath_ack:  no b_cont\n"));
1685 	}
1686 
1687 	freeb(mp);
1688 }
1689 
1690 /*
1691  * Throw an M_IOCTL message downstream asking "do you know fastpath?"
1692  * The data portion of the request is a dl_unitdata_req_t template for
1693  * what we would send downstream in the absence of a fastpath confirmation.
1694  */
1695 int
1696 ill_fastpath_probe(ill_t *ill, mblk_t *dlur_mp)
1697 {
1698 	struct iocblk	*ioc;
1699 	mblk_t	*mp;
1700 
1701 	if (dlur_mp == NULL)
1702 		return (EINVAL);
1703 
1704 	mutex_enter(&ill->ill_lock);
1705 	switch (ill->ill_dlpi_fastpath_state) {
1706 	case IDS_FAILED:
1707 		/*
1708 		 * Driver NAKed the first fastpath ioctl - assume it doesn't
1709 		 * support it.
1710 		 */
1711 		mutex_exit(&ill->ill_lock);
1712 		return (ENOTSUP);
1713 	case IDS_UNKNOWN:
1714 		/* This is the first probe */
1715 		ill->ill_dlpi_fastpath_state = IDS_INPROGRESS;
1716 		break;
1717 	default:
1718 		break;
1719 	}
1720 	mutex_exit(&ill->ill_lock);
1721 
1722 	if ((mp = mkiocb(DL_IOC_HDR_INFO)) == NULL)
1723 		return (EAGAIN);
1724 
1725 	mp->b_cont = copyb(dlur_mp);
1726 	if (mp->b_cont == NULL) {
1727 		freeb(mp);
1728 		return (EAGAIN);
1729 	}
1730 
1731 	ioc = (struct iocblk *)mp->b_rptr;
1732 	ioc->ioc_count = msgdsize(mp->b_cont);
1733 
1734 	putnext(ill->ill_wq, mp);
1735 	return (0);
1736 }
1737 
1738 void
1739 ill_capability_probe(ill_t *ill)
1740 {
1741 	mblk_t	*mp;
1742 
1743 	ASSERT(IAM_WRITER_ILL(ill));
1744 
1745 	if (ill->ill_dlpi_capab_state != IDCS_UNKNOWN &&
1746 	    ill->ill_dlpi_capab_state != IDCS_FAILED)
1747 		return;
1748 
1749 	/*
1750 	 * We are starting a new cycle of capability negotiation.
1751 	 * Free up the capab reset messages of any previous incarnation.
1752 	 * We will do a fresh allocation when we get the response to our probe
1753 	 */
1754 	if (ill->ill_capab_reset_mp != NULL) {
1755 		freemsg(ill->ill_capab_reset_mp);
1756 		ill->ill_capab_reset_mp = NULL;
1757 	}
1758 
1759 	ip1dbg(("ill_capability_probe: starting capability negotiation\n"));
1760 
1761 	mp = ip_dlpi_alloc(sizeof (dl_capability_req_t), DL_CAPABILITY_REQ);
1762 	if (mp == NULL)
1763 		return;
1764 
1765 	ill_capability_send(ill, mp);
1766 	ill->ill_dlpi_capab_state = IDCS_PROBE_SENT;
1767 }
1768 
1769 void
1770 ill_capability_reset(ill_t *ill, boolean_t reneg)
1771 {
1772 	ASSERT(IAM_WRITER_ILL(ill));
1773 
1774 	if (ill->ill_dlpi_capab_state != IDCS_OK)
1775 		return;
1776 
1777 	ill->ill_dlpi_capab_state = reneg ? IDCS_RENEG : IDCS_RESET_SENT;
1778 
1779 	ill_capability_send(ill, ill->ill_capab_reset_mp);
1780 	ill->ill_capab_reset_mp = NULL;
1781 	/*
1782 	 * We turn off all capabilities except those pertaining to
1783 	 * direct function call capabilities viz. ILL_CAPAB_DLD*
1784 	 * which will be turned off by the corresponding reset functions.
1785 	 */
1786 	ill->ill_capabilities &= ~(ILL_CAPAB_MDT | ILL_CAPAB_HCKSUM  |
1787 	    ILL_CAPAB_ZEROCOPY | ILL_CAPAB_AH | ILL_CAPAB_ESP);
1788 }
1789 
1790 static void
1791 ill_capability_reset_alloc(ill_t *ill)
1792 {
1793 	mblk_t *mp;
1794 	size_t	size = 0;
1795 	int	err;
1796 	dl_capability_req_t	*capb;
1797 
1798 	ASSERT(IAM_WRITER_ILL(ill));
1799 	ASSERT(ill->ill_capab_reset_mp == NULL);
1800 
1801 	if (ILL_MDT_CAPABLE(ill))
1802 		size += sizeof (dl_capability_sub_t) + sizeof (dl_capab_mdt_t);
1803 
1804 	if (ILL_HCKSUM_CAPABLE(ill)) {
1805 		size += sizeof (dl_capability_sub_t) +
1806 		    sizeof (dl_capab_hcksum_t);
1807 	}
1808 
1809 	if (ill->ill_capabilities & ILL_CAPAB_ZEROCOPY) {
1810 		size += sizeof (dl_capability_sub_t) +
1811 		    sizeof (dl_capab_zerocopy_t);
1812 	}
1813 
1814 	if (ill->ill_capabilities & (ILL_CAPAB_AH | ILL_CAPAB_ESP)) {
1815 		size += sizeof (dl_capability_sub_t);
1816 		size += ill_capability_ipsec_reset_size(ill, NULL, NULL,
1817 		    NULL, NULL);
1818 	}
1819 
1820 	if (ill->ill_capabilities & ILL_CAPAB_DLD) {
1821 		size += sizeof (dl_capability_sub_t) +
1822 		    sizeof (dl_capab_dld_t);
1823 	}
1824 
1825 	mp = allocb_wait(size + sizeof (dl_capability_req_t), BPRI_MED,
1826 	    STR_NOSIG, &err);
1827 
1828 	mp->b_datap->db_type = M_PROTO;
1829 	bzero(mp->b_rptr, size + sizeof (dl_capability_req_t));
1830 
1831 	capb = (dl_capability_req_t *)mp->b_rptr;
1832 	capb->dl_primitive = DL_CAPABILITY_REQ;
1833 	capb->dl_sub_offset = sizeof (dl_capability_req_t);
1834 	capb->dl_sub_length = size;
1835 
1836 	mp->b_wptr += sizeof (dl_capability_req_t);
1837 
1838 	/*
1839 	 * Each handler fills in the corresponding dl_capability_sub_t
1840 	 * inside the mblk,
1841 	 */
1842 	ill_capability_mdt_reset_fill(ill, mp);
1843 	ill_capability_hcksum_reset_fill(ill, mp);
1844 	ill_capability_zerocopy_reset_fill(ill, mp);
1845 	ill_capability_ipsec_reset_fill(ill, mp);
1846 	ill_capability_dld_reset_fill(ill, mp);
1847 
1848 	ill->ill_capab_reset_mp = mp;
1849 }
1850 
1851 static void
1852 ill_capability_id_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *outers)
1853 {
1854 	dl_capab_id_t *id_ic;
1855 	uint_t sub_dl_cap = outers->dl_cap;
1856 	dl_capability_sub_t *inners;
1857 	uint8_t *capend;
1858 
1859 	ASSERT(sub_dl_cap == DL_CAPAB_ID_WRAPPER);
1860 
1861 	/*
1862 	 * Note: range checks here are not absolutely sufficient to
1863 	 * make us robust against malformed messages sent by drivers;
1864 	 * this is in keeping with the rest of IP's dlpi handling.
1865 	 * (Remember, it's coming from something else in the kernel
1866 	 * address space)
1867 	 */
1868 
1869 	capend = (uint8_t *)(outers + 1) + outers->dl_length;
1870 	if (capend > mp->b_wptr) {
1871 		cmn_err(CE_WARN, "ill_capability_id_ack: "
1872 		    "malformed sub-capability too long for mblk");
1873 		return;
1874 	}
1875 
1876 	id_ic = (dl_capab_id_t *)(outers + 1);
1877 
1878 	if (outers->dl_length < sizeof (*id_ic) ||
1879 	    (inners = &id_ic->id_subcap,
1880 	    inners->dl_length > (outers->dl_length - sizeof (*inners)))) {
1881 		cmn_err(CE_WARN, "ill_capability_id_ack: malformed "
1882 		    "encapsulated capab type %d too long for mblk",
1883 		    inners->dl_cap);
1884 		return;
1885 	}
1886 
1887 	if (!dlcapabcheckqid(&id_ic->id_mid, ill->ill_lmod_rq)) {
1888 		ip1dbg(("ill_capability_id_ack: mid token for capab type %d "
1889 		    "isn't as expected; pass-thru module(s) detected, "
1890 		    "discarding capability\n", inners->dl_cap));
1891 		return;
1892 	}
1893 
1894 	/* Process the encapsulated sub-capability */
1895 	ill_capability_dispatch(ill, mp, inners, B_TRUE);
1896 }
1897 
1898 /*
1899  * Process Multidata Transmit capability negotiation ack received from a
1900  * DLS Provider.  isub must point to the sub-capability (DL_CAPAB_MDT) of a
1901  * DL_CAPABILITY_ACK message.
1902  */
1903 static void
1904 ill_capability_mdt_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1905 {
1906 	mblk_t *nmp = NULL;
1907 	dl_capability_req_t *oc;
1908 	dl_capab_mdt_t *mdt_ic, *mdt_oc;
1909 	ill_mdt_capab_t **ill_mdt_capab;
1910 	uint_t sub_dl_cap = isub->dl_cap;
1911 	uint8_t *capend;
1912 
1913 	ASSERT(sub_dl_cap == DL_CAPAB_MDT);
1914 
1915 	ill_mdt_capab = (ill_mdt_capab_t **)&ill->ill_mdt_capab;
1916 
1917 	/*
1918 	 * Note: range checks here are not absolutely sufficient to
1919 	 * make us robust against malformed messages sent by drivers;
1920 	 * this is in keeping with the rest of IP's dlpi handling.
1921 	 * (Remember, it's coming from something else in the kernel
1922 	 * address space)
1923 	 */
1924 
1925 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1926 	if (capend > mp->b_wptr) {
1927 		cmn_err(CE_WARN, "ill_capability_mdt_ack: "
1928 		    "malformed sub-capability too long for mblk");
1929 		return;
1930 	}
1931 
1932 	mdt_ic = (dl_capab_mdt_t *)(isub + 1);
1933 
1934 	if (mdt_ic->mdt_version != MDT_VERSION_2) {
1935 		cmn_err(CE_CONT, "ill_capability_mdt_ack: "
1936 		    "unsupported MDT sub-capability (version %d, expected %d)",
1937 		    mdt_ic->mdt_version, MDT_VERSION_2);
1938 		return;
1939 	}
1940 
1941 	if (!dlcapabcheckqid(&mdt_ic->mdt_mid, ill->ill_lmod_rq)) {
1942 		ip1dbg(("ill_capability_mdt_ack: mid token for MDT "
1943 		    "capability isn't as expected; pass-thru module(s) "
1944 		    "detected, discarding capability\n"));
1945 		return;
1946 	}
1947 
1948 	if (mdt_ic->mdt_flags & DL_CAPAB_MDT_ENABLE) {
1949 
1950 		if (*ill_mdt_capab == NULL) {
1951 			*ill_mdt_capab = kmem_zalloc(sizeof (ill_mdt_capab_t),
1952 			    KM_NOSLEEP);
1953 			if (*ill_mdt_capab == NULL) {
1954 				cmn_err(CE_WARN, "ill_capability_mdt_ack: "
1955 				    "could not enable MDT version %d "
1956 				    "for %s (ENOMEM)\n", MDT_VERSION_2,
1957 				    ill->ill_name);
1958 				return;
1959 			}
1960 		}
1961 
1962 		ip1dbg(("ill_capability_mdt_ack: interface %s supports "
1963 		    "MDT version %d (%d bytes leading, %d bytes trailing "
1964 		    "header spaces, %d max pld bufs, %d span limit)\n",
1965 		    ill->ill_name, MDT_VERSION_2,
1966 		    mdt_ic->mdt_hdr_head, mdt_ic->mdt_hdr_tail,
1967 		    mdt_ic->mdt_max_pld, mdt_ic->mdt_span_limit));
1968 
1969 		(*ill_mdt_capab)->ill_mdt_version = MDT_VERSION_2;
1970 		(*ill_mdt_capab)->ill_mdt_on = 1;
1971 		/*
1972 		 * Round the following values to the nearest 32-bit; ULP
1973 		 * may further adjust them to accomodate for additional
1974 		 * protocol headers.  We pass these values to ULP during
1975 		 * bind time.
1976 		 */
1977 		(*ill_mdt_capab)->ill_mdt_hdr_head =
1978 		    roundup(mdt_ic->mdt_hdr_head, 4);
1979 		(*ill_mdt_capab)->ill_mdt_hdr_tail =
1980 		    roundup(mdt_ic->mdt_hdr_tail, 4);
1981 		(*ill_mdt_capab)->ill_mdt_max_pld = mdt_ic->mdt_max_pld;
1982 		(*ill_mdt_capab)->ill_mdt_span_limit = mdt_ic->mdt_span_limit;
1983 
1984 		ill->ill_capabilities |= ILL_CAPAB_MDT;
1985 	} else {
1986 		uint_t size;
1987 		uchar_t *rptr;
1988 
1989 		size = sizeof (dl_capability_req_t) +
1990 		    sizeof (dl_capability_sub_t) + sizeof (dl_capab_mdt_t);
1991 
1992 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
1993 			cmn_err(CE_WARN, "ill_capability_mdt_ack: "
1994 			    "could not enable MDT for %s (ENOMEM)\n",
1995 			    ill->ill_name);
1996 			return;
1997 		}
1998 
1999 		rptr = nmp->b_rptr;
2000 		/* initialize dl_capability_req_t */
2001 		oc = (dl_capability_req_t *)nmp->b_rptr;
2002 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
2003 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
2004 		    sizeof (dl_capab_mdt_t);
2005 		nmp->b_rptr += sizeof (dl_capability_req_t);
2006 
2007 		/* initialize dl_capability_sub_t */
2008 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
2009 		nmp->b_rptr += sizeof (*isub);
2010 
2011 		/* initialize dl_capab_mdt_t */
2012 		mdt_oc = (dl_capab_mdt_t *)nmp->b_rptr;
2013 		bcopy(mdt_ic, mdt_oc, sizeof (*mdt_ic));
2014 
2015 		nmp->b_rptr = rptr;
2016 
2017 		ip1dbg(("ill_capability_mdt_ack: asking interface %s "
2018 		    "to enable MDT version %d\n", ill->ill_name,
2019 		    MDT_VERSION_2));
2020 
2021 		/* set ENABLE flag */
2022 		mdt_oc->mdt_flags |= DL_CAPAB_MDT_ENABLE;
2023 
2024 		/* nmp points to a DL_CAPABILITY_REQ message to enable MDT */
2025 		ill_capability_send(ill, nmp);
2026 	}
2027 }
2028 
2029 static void
2030 ill_capability_mdt_reset_fill(ill_t *ill, mblk_t *mp)
2031 {
2032 	dl_capab_mdt_t *mdt_subcap;
2033 	dl_capability_sub_t *dl_subcap;
2034 
2035 	if (!ILL_MDT_CAPABLE(ill))
2036 		return;
2037 
2038 	ASSERT(ill->ill_mdt_capab != NULL);
2039 
2040 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2041 	dl_subcap->dl_cap = DL_CAPAB_MDT;
2042 	dl_subcap->dl_length = sizeof (*mdt_subcap);
2043 
2044 	mdt_subcap = (dl_capab_mdt_t *)(dl_subcap + 1);
2045 	mdt_subcap->mdt_version = ill->ill_mdt_capab->ill_mdt_version;
2046 	mdt_subcap->mdt_flags = 0;
2047 	mdt_subcap->mdt_hdr_head = 0;
2048 	mdt_subcap->mdt_hdr_tail = 0;
2049 
2050 	mp->b_wptr += sizeof (*dl_subcap) + sizeof (*mdt_subcap);
2051 }
2052 
2053 static void
2054 ill_capability_dld_reset_fill(ill_t *ill, mblk_t *mp)
2055 {
2056 	dl_capability_sub_t *dl_subcap;
2057 
2058 	if (!(ill->ill_capabilities & ILL_CAPAB_DLD))
2059 		return;
2060 
2061 	/*
2062 	 * The dl_capab_dld_t that follows the dl_capability_sub_t is not
2063 	 * initialized below since it is not used by DLD.
2064 	 */
2065 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2066 	dl_subcap->dl_cap = DL_CAPAB_DLD;
2067 	dl_subcap->dl_length = sizeof (dl_capab_dld_t);
2068 
2069 	mp->b_wptr += sizeof (dl_capability_sub_t) + sizeof (dl_capab_dld_t);
2070 }
2071 
2072 /*
2073  * Allocate an IPsec capability request which will be filled by our
2074  * caller to turn on support for one or more algorithms.
2075  */
2076 /* ARGSUSED */
2077 static mblk_t *
2078 ill_alloc_ipsec_cap_req(ill_t *ill, dl_capability_sub_t *isub)
2079 {
2080 	mblk_t *nmp;
2081 	dl_capability_req_t	*ocap;
2082 	dl_capab_ipsec_t	*ocip;
2083 	dl_capab_ipsec_t	*icip;
2084 	uint8_t			*ptr;
2085 	icip = (dl_capab_ipsec_t *)(isub + 1);
2086 
2087 	/*
2088 	 * Allocate new mblk which will contain a new capability
2089 	 * request to enable the capabilities.
2090 	 */
2091 
2092 	nmp = ip_dlpi_alloc(sizeof (dl_capability_req_t) +
2093 	    sizeof (dl_capability_sub_t) + isub->dl_length, DL_CAPABILITY_REQ);
2094 	if (nmp == NULL)
2095 		return (NULL);
2096 
2097 	ptr = nmp->b_rptr;
2098 
2099 	/* initialize dl_capability_req_t */
2100 	ocap = (dl_capability_req_t *)ptr;
2101 	ocap->dl_sub_offset = sizeof (dl_capability_req_t);
2102 	ocap->dl_sub_length = sizeof (dl_capability_sub_t) + isub->dl_length;
2103 	ptr += sizeof (dl_capability_req_t);
2104 
2105 	/* initialize dl_capability_sub_t */
2106 	bcopy(isub, ptr, sizeof (*isub));
2107 	ptr += sizeof (*isub);
2108 
2109 	/* initialize dl_capab_ipsec_t */
2110 	ocip = (dl_capab_ipsec_t *)ptr;
2111 	bcopy(icip, ocip, sizeof (*icip));
2112 
2113 	nmp->b_wptr = (uchar_t *)(&ocip->cip_data[0]);
2114 	return (nmp);
2115 }
2116 
2117 /*
2118  * Process an IPsec capability negotiation ack received from a DLS Provider.
2119  * isub must point to the sub-capability (DL_CAPAB_IPSEC_AH or
2120  * DL_CAPAB_IPSEC_ESP) of a DL_CAPABILITY_ACK message.
2121  */
2122 static void
2123 ill_capability_ipsec_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2124 {
2125 	dl_capab_ipsec_t	*icip;
2126 	dl_capab_ipsec_alg_t	*ialg;	/* ptr to input alg spec. */
2127 	dl_capab_ipsec_alg_t	*oalg;	/* ptr to output alg spec. */
2128 	uint_t cipher, nciphers;
2129 	mblk_t *nmp;
2130 	uint_t alg_len;
2131 	boolean_t need_sadb_dump;
2132 	uint_t sub_dl_cap = isub->dl_cap;
2133 	ill_ipsec_capab_t **ill_capab;
2134 	uint64_t ill_capab_flag;
2135 	uint8_t *capend, *ciphend;
2136 	boolean_t sadb_resync;
2137 
2138 	ASSERT(sub_dl_cap == DL_CAPAB_IPSEC_AH ||
2139 	    sub_dl_cap == DL_CAPAB_IPSEC_ESP);
2140 
2141 	if (sub_dl_cap == DL_CAPAB_IPSEC_AH) {
2142 		ill_capab = (ill_ipsec_capab_t **)&ill->ill_ipsec_capab_ah;
2143 		ill_capab_flag = ILL_CAPAB_AH;
2144 	} else {
2145 		ill_capab = (ill_ipsec_capab_t **)&ill->ill_ipsec_capab_esp;
2146 		ill_capab_flag = ILL_CAPAB_ESP;
2147 	}
2148 
2149 	/*
2150 	 * If the ill capability structure exists, then this incoming
2151 	 * DL_CAPABILITY_ACK is a response to a "renegotiation" cycle.
2152 	 * If this is so, then we'd need to resynchronize the SADB
2153 	 * after re-enabling the offloaded ciphers.
2154 	 */
2155 	sadb_resync = (*ill_capab != NULL);
2156 
2157 	/*
2158 	 * Note: range checks here are not absolutely sufficient to
2159 	 * make us robust against malformed messages sent by drivers;
2160 	 * this is in keeping with the rest of IP's dlpi handling.
2161 	 * (Remember, it's coming from something else in the kernel
2162 	 * address space)
2163 	 */
2164 
2165 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2166 	if (capend > mp->b_wptr) {
2167 		cmn_err(CE_WARN, "ill_capability_ipsec_ack: "
2168 		    "malformed sub-capability too long for mblk");
2169 		return;
2170 	}
2171 
2172 	/*
2173 	 * There are two types of acks we process here:
2174 	 * 1. acks in reply to a (first form) generic capability req
2175 	 *    (no ENABLE flag set)
2176 	 * 2. acks in reply to a ENABLE capability req.
2177 	 *    (ENABLE flag set)
2178 	 *
2179 	 * We process the subcapability passed as argument as follows:
2180 	 * 1 do initializations
2181 	 *   1.1 initialize nmp = NULL
2182 	 *   1.2 set need_sadb_dump to B_FALSE
2183 	 * 2 for each cipher in subcapability:
2184 	 *   2.1 if ENABLE flag is set:
2185 	 *	2.1.1 update per-ill ipsec capabilities info
2186 	 *	2.1.2 set need_sadb_dump to B_TRUE
2187 	 *   2.2 if ENABLE flag is not set:
2188 	 *	2.2.1 if nmp is NULL:
2189 	 *		2.2.1.1 allocate and initialize nmp
2190 	 *		2.2.1.2 init current pos in nmp
2191 	 *	2.2.2 copy current cipher to current pos in nmp
2192 	 *	2.2.3 set ENABLE flag in nmp
2193 	 *	2.2.4 update current pos
2194 	 * 3 if nmp is not equal to NULL, send enable request
2195 	 *   3.1 send capability request
2196 	 * 4 if need_sadb_dump is B_TRUE
2197 	 *   4.1 enable promiscuous on/off notifications
2198 	 *   4.2 call ill_dlpi_send(isub->dlcap) to send all
2199 	 *	AH or ESP SA's to interface.
2200 	 */
2201 
2202 	nmp = NULL;
2203 	oalg = NULL;
2204 	need_sadb_dump = B_FALSE;
2205 	icip = (dl_capab_ipsec_t *)(isub + 1);
2206 	ialg = (dl_capab_ipsec_alg_t *)(&icip->cip_data[0]);
2207 
2208 	nciphers = icip->cip_nciphers;
2209 	ciphend = (uint8_t *)(ialg + icip->cip_nciphers);
2210 
2211 	if (ciphend > capend) {
2212 		cmn_err(CE_WARN, "ill_capability_ipsec_ack: "
2213 		    "too many ciphers for sub-capability len");
2214 		return;
2215 	}
2216 
2217 	for (cipher = 0; cipher < nciphers; cipher++) {
2218 		alg_len = sizeof (dl_capab_ipsec_alg_t);
2219 
2220 		if (ialg->alg_flag & DL_CAPAB_ALG_ENABLE) {
2221 			/*
2222 			 * TBD: when we provide a way to disable capabilities
2223 			 * from above, need to manage the request-pending state
2224 			 * and fail if we were not expecting this ACK.
2225 			 */
2226 			IPSECHW_DEBUG(IPSECHW_CAPAB,
2227 			    ("ill_capability_ipsec_ack: got ENABLE ACK\n"));
2228 
2229 			/*
2230 			 * Update IPsec capabilities for this ill
2231 			 */
2232 
2233 			if (*ill_capab == NULL) {
2234 				IPSECHW_DEBUG(IPSECHW_CAPAB,
2235 				    ("ill_capability_ipsec_ack: "
2236 				    "allocating ipsec_capab for ill\n"));
2237 				*ill_capab = ill_ipsec_capab_alloc();
2238 
2239 				if (*ill_capab == NULL) {
2240 					cmn_err(CE_WARN,
2241 					    "ill_capability_ipsec_ack: "
2242 					    "could not enable IPsec Hardware "
2243 					    "acceleration for %s (ENOMEM)\n",
2244 					    ill->ill_name);
2245 					return;
2246 				}
2247 			}
2248 
2249 			ASSERT(ialg->alg_type == DL_CAPAB_IPSEC_ALG_AUTH ||
2250 			    ialg->alg_type == DL_CAPAB_IPSEC_ALG_ENCR);
2251 
2252 			if (ialg->alg_prim >= MAX_IPSEC_ALGS) {
2253 				cmn_err(CE_WARN,
2254 				    "ill_capability_ipsec_ack: "
2255 				    "malformed IPsec algorithm id %d",
2256 				    ialg->alg_prim);
2257 				continue;
2258 			}
2259 
2260 			if (ialg->alg_type == DL_CAPAB_IPSEC_ALG_AUTH) {
2261 				IPSEC_ALG_ENABLE((*ill_capab)->auth_hw_algs,
2262 				    ialg->alg_prim);
2263 			} else {
2264 				ipsec_capab_algparm_t *alp;
2265 
2266 				IPSEC_ALG_ENABLE((*ill_capab)->encr_hw_algs,
2267 				    ialg->alg_prim);
2268 				if (!ill_ipsec_capab_resize_algparm(*ill_capab,
2269 				    ialg->alg_prim)) {
2270 					cmn_err(CE_WARN,
2271 					    "ill_capability_ipsec_ack: "
2272 					    "no space for IPsec alg id %d",
2273 					    ialg->alg_prim);
2274 					continue;
2275 				}
2276 				alp = &((*ill_capab)->encr_algparm[
2277 				    ialg->alg_prim]);
2278 				alp->minkeylen = ialg->alg_minbits;
2279 				alp->maxkeylen = ialg->alg_maxbits;
2280 			}
2281 			ill->ill_capabilities |= ill_capab_flag;
2282 			/*
2283 			 * indicate that a capability was enabled, which
2284 			 * will be used below to kick off a SADB dump
2285 			 * to the ill.
2286 			 */
2287 			need_sadb_dump = B_TRUE;
2288 		} else {
2289 			IPSECHW_DEBUG(IPSECHW_CAPAB,
2290 			    ("ill_capability_ipsec_ack: enabling alg 0x%x\n",
2291 			    ialg->alg_prim));
2292 
2293 			if (nmp == NULL) {
2294 				nmp = ill_alloc_ipsec_cap_req(ill, isub);
2295 				if (nmp == NULL) {
2296 					/*
2297 					 * Sending the PROMISC_ON/OFF
2298 					 * notification request failed.
2299 					 * We cannot enable the algorithms
2300 					 * since the Provider will not
2301 					 * notify IP of promiscous mode
2302 					 * changes, which could lead
2303 					 * to leakage of packets.
2304 					 */
2305 					cmn_err(CE_WARN,
2306 					    "ill_capability_ipsec_ack: "
2307 					    "could not enable IPsec Hardware "
2308 					    "acceleration for %s (ENOMEM)\n",
2309 					    ill->ill_name);
2310 					return;
2311 				}
2312 				/* ptr to current output alg specifier */
2313 				oalg = (dl_capab_ipsec_alg_t *)nmp->b_wptr;
2314 			}
2315 
2316 			/*
2317 			 * Copy current alg specifier, set ENABLE
2318 			 * flag, and advance to next output alg.
2319 			 * For now we enable all IPsec capabilities.
2320 			 */
2321 			ASSERT(oalg != NULL);
2322 			bcopy(ialg, oalg, alg_len);
2323 			oalg->alg_flag |= DL_CAPAB_ALG_ENABLE;
2324 			nmp->b_wptr += alg_len;
2325 			oalg = (dl_capab_ipsec_alg_t *)nmp->b_wptr;
2326 		}
2327 
2328 		/* move to next input algorithm specifier */
2329 		ialg = (dl_capab_ipsec_alg_t *)
2330 		    ((char *)ialg + alg_len);
2331 	}
2332 
2333 	if (nmp != NULL)
2334 		/*
2335 		 * nmp points to a DL_CAPABILITY_REQ message to enable
2336 		 * IPsec hardware acceleration.
2337 		 */
2338 		ill_capability_send(ill, nmp);
2339 
2340 	if (need_sadb_dump)
2341 		/*
2342 		 * An acknowledgement corresponding to a request to
2343 		 * enable acceleration was received, notify SADB.
2344 		 */
2345 		ill_ipsec_capab_add(ill, sub_dl_cap, sadb_resync);
2346 }
2347 
2348 /*
2349  * Given an mblk with enough space in it, create sub-capability entries for
2350  * DL_CAPAB_IPSEC_{AH,ESP} types which consist of previously-advertised
2351  * offloaded ciphers (both AUTH and ENCR) with their enable flags cleared,
2352  * in preparation for the reset the DL_CAPABILITY_REQ message.
2353  */
2354 static void
2355 ill_fill_ipsec_reset(uint_t nciphers, int stype, uint_t slen,
2356     ill_ipsec_capab_t *ill_cap, mblk_t *mp)
2357 {
2358 	dl_capab_ipsec_t *oipsec;
2359 	dl_capab_ipsec_alg_t *oalg;
2360 	dl_capability_sub_t *dl_subcap;
2361 	int i, k;
2362 
2363 	ASSERT(nciphers > 0);
2364 	ASSERT(ill_cap != NULL);
2365 	ASSERT(mp != NULL);
2366 	ASSERT(MBLKTAIL(mp) >= sizeof (*dl_subcap) + sizeof (*oipsec) + slen);
2367 
2368 	/* dl_capability_sub_t for "stype" */
2369 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2370 	dl_subcap->dl_cap = stype;
2371 	dl_subcap->dl_length = sizeof (dl_capab_ipsec_t) + slen;
2372 	mp->b_wptr += sizeof (dl_capability_sub_t);
2373 
2374 	/* dl_capab_ipsec_t for "stype" */
2375 	oipsec = (dl_capab_ipsec_t *)mp->b_wptr;
2376 	oipsec->cip_version = 1;
2377 	oipsec->cip_nciphers = nciphers;
2378 	mp->b_wptr = (uchar_t *)&oipsec->cip_data[0];
2379 
2380 	/* create entries for "stype" AUTH ciphers */
2381 	for (i = 0; i < ill_cap->algs_size; i++) {
2382 		for (k = 0; k < BITSPERBYTE; k++) {
2383 			if ((ill_cap->auth_hw_algs[i] & (1 << k)) == 0)
2384 				continue;
2385 
2386 			oalg = (dl_capab_ipsec_alg_t *)mp->b_wptr;
2387 			bzero((void *)oalg, sizeof (*oalg));
2388 			oalg->alg_type = DL_CAPAB_IPSEC_ALG_AUTH;
2389 			oalg->alg_prim = k + (BITSPERBYTE * i);
2390 			mp->b_wptr += sizeof (dl_capab_ipsec_alg_t);
2391 		}
2392 	}
2393 	/* create entries for "stype" ENCR ciphers */
2394 	for (i = 0; i < ill_cap->algs_size; i++) {
2395 		for (k = 0; k < BITSPERBYTE; k++) {
2396 			if ((ill_cap->encr_hw_algs[i] & (1 << k)) == 0)
2397 				continue;
2398 
2399 			oalg = (dl_capab_ipsec_alg_t *)mp->b_wptr;
2400 			bzero((void *)oalg, sizeof (*oalg));
2401 			oalg->alg_type = DL_CAPAB_IPSEC_ALG_ENCR;
2402 			oalg->alg_prim = k + (BITSPERBYTE * i);
2403 			mp->b_wptr += sizeof (dl_capab_ipsec_alg_t);
2404 		}
2405 	}
2406 }
2407 
2408 /*
2409  * Macro to count number of 1s in a byte (8-bit word).  The total count is
2410  * accumulated into the passed-in argument (sum).  We could use SPARCv9's
2411  * POPC instruction, but our macro is more flexible for an arbitrary length
2412  * of bytes, such as {auth,encr}_hw_algs.  These variables are currently
2413  * 256-bits long (MAX_IPSEC_ALGS), so if we know for sure that the length
2414  * stays that way, we can reduce the number of iterations required.
2415  */
2416 #define	COUNT_1S(val, sum) {					\
2417 	uint8_t x = val & 0xff;					\
2418 	x = (x & 0x55) + ((x >> 1) & 0x55);			\
2419 	x = (x & 0x33) + ((x >> 2) & 0x33);			\
2420 	sum += (x & 0xf) + ((x >> 4) & 0xf);			\
2421 }
2422 
2423 /* ARGSUSED */
2424 static int
2425 ill_capability_ipsec_reset_size(ill_t *ill, int *ah_cntp, int *ah_lenp,
2426     int *esp_cntp, int *esp_lenp)
2427 {
2428 	ill_ipsec_capab_t *cap_ah = ill->ill_ipsec_capab_ah;
2429 	ill_ipsec_capab_t *cap_esp = ill->ill_ipsec_capab_esp;
2430 	uint64_t ill_capabilities = ill->ill_capabilities;
2431 	int ah_cnt = 0, esp_cnt = 0;
2432 	int ah_len = 0, esp_len = 0;
2433 	int i, size = 0;
2434 
2435 	if (!(ill_capabilities & (ILL_CAPAB_AH | ILL_CAPAB_ESP)))
2436 		return (0);
2437 
2438 	ASSERT(cap_ah != NULL || !(ill_capabilities & ILL_CAPAB_AH));
2439 	ASSERT(cap_esp != NULL || !(ill_capabilities & ILL_CAPAB_ESP));
2440 
2441 	/* Find out the number of ciphers for AH */
2442 	if (cap_ah != NULL) {
2443 		for (i = 0; i < cap_ah->algs_size; i++) {
2444 			COUNT_1S(cap_ah->auth_hw_algs[i], ah_cnt);
2445 			COUNT_1S(cap_ah->encr_hw_algs[i], ah_cnt);
2446 		}
2447 		if (ah_cnt > 0) {
2448 			size += sizeof (dl_capability_sub_t) +
2449 			    sizeof (dl_capab_ipsec_t);
2450 			/* dl_capab_ipsec_t contains one dl_capab_ipsec_alg_t */
2451 			ah_len = (ah_cnt - 1) * sizeof (dl_capab_ipsec_alg_t);
2452 			size += ah_len;
2453 		}
2454 	}
2455 
2456 	/* Find out the number of ciphers for ESP */
2457 	if (cap_esp != NULL) {
2458 		for (i = 0; i < cap_esp->algs_size; i++) {
2459 			COUNT_1S(cap_esp->auth_hw_algs[i], esp_cnt);
2460 			COUNT_1S(cap_esp->encr_hw_algs[i], esp_cnt);
2461 		}
2462 		if (esp_cnt > 0) {
2463 			size += sizeof (dl_capability_sub_t) +
2464 			    sizeof (dl_capab_ipsec_t);
2465 			/* dl_capab_ipsec_t contains one dl_capab_ipsec_alg_t */
2466 			esp_len = (esp_cnt - 1) * sizeof (dl_capab_ipsec_alg_t);
2467 			size += esp_len;
2468 		}
2469 	}
2470 
2471 	if (ah_cntp != NULL)
2472 		*ah_cntp = ah_cnt;
2473 	if (ah_lenp != NULL)
2474 		*ah_lenp = ah_len;
2475 	if (esp_cntp != NULL)
2476 		*esp_cntp = esp_cnt;
2477 	if (esp_lenp != NULL)
2478 		*esp_lenp = esp_len;
2479 
2480 	return (size);
2481 }
2482 
2483 /* ARGSUSED */
2484 static void
2485 ill_capability_ipsec_reset_fill(ill_t *ill, mblk_t *mp)
2486 {
2487 	ill_ipsec_capab_t *cap_ah = ill->ill_ipsec_capab_ah;
2488 	ill_ipsec_capab_t *cap_esp = ill->ill_ipsec_capab_esp;
2489 	int ah_cnt = 0, esp_cnt = 0;
2490 	int ah_len = 0, esp_len = 0;
2491 	int size;
2492 
2493 	size = ill_capability_ipsec_reset_size(ill, &ah_cnt, &ah_len,
2494 	    &esp_cnt, &esp_len);
2495 	if (size == 0)
2496 		return;
2497 
2498 	/*
2499 	 * Clear the capability flags for IPsec HA but retain the ill
2500 	 * capability structures since it's possible that another thread
2501 	 * is still referring to them.  The structures only get deallocated
2502 	 * when we destroy the ill.
2503 	 *
2504 	 * Various places check the flags to see if the ill is capable of
2505 	 * hardware acceleration, and by clearing them we ensure that new
2506 	 * outbound IPsec packets are sent down encrypted.
2507 	 */
2508 
2509 	/* Fill in DL_CAPAB_IPSEC_AH sub-capability entries */
2510 	if (ah_cnt > 0) {
2511 		ill_fill_ipsec_reset(ah_cnt, DL_CAPAB_IPSEC_AH, ah_len,
2512 		    cap_ah, mp);
2513 	}
2514 
2515 	/* Fill in DL_CAPAB_IPSEC_ESP sub-capability entries */
2516 	if (esp_cnt > 0) {
2517 		ill_fill_ipsec_reset(esp_cnt, DL_CAPAB_IPSEC_ESP, esp_len,
2518 		    cap_esp, mp);
2519 	}
2520 
2521 	/*
2522 	 * At this point we've composed a bunch of sub-capabilities to be
2523 	 * encapsulated in a DL_CAPABILITY_REQ and later sent downstream
2524 	 * by the caller.  Upon receiving this reset message, the driver
2525 	 * must stop inbound decryption (by destroying all inbound SAs)
2526 	 * and let the corresponding packets come in encrypted.
2527 	 */
2528 }
2529 
2530 static void
2531 ill_capability_dispatch(ill_t *ill, mblk_t *mp, dl_capability_sub_t *subp,
2532     boolean_t encapsulated)
2533 {
2534 	boolean_t legacy = B_FALSE;
2535 
2536 	/*
2537 	 * Note that only the following two sub-capabilities may be
2538 	 * considered as "legacy", since their original definitions
2539 	 * do not incorporate the dl_mid_t module ID token, and hence
2540 	 * may require the use of the wrapper sub-capability.
2541 	 */
2542 	switch (subp->dl_cap) {
2543 	case DL_CAPAB_IPSEC_AH:
2544 	case DL_CAPAB_IPSEC_ESP:
2545 		legacy = B_TRUE;
2546 		break;
2547 	}
2548 
2549 	/*
2550 	 * For legacy sub-capabilities which don't incorporate a queue_t
2551 	 * pointer in their structures, discard them if we detect that
2552 	 * there are intermediate modules in between IP and the driver.
2553 	 */
2554 	if (!encapsulated && legacy && ill->ill_lmod_cnt > 1) {
2555 		ip1dbg(("ill_capability_dispatch: unencapsulated capab type "
2556 		    "%d discarded; %d module(s) present below IP\n",
2557 		    subp->dl_cap, ill->ill_lmod_cnt));
2558 		return;
2559 	}
2560 
2561 	switch (subp->dl_cap) {
2562 	case DL_CAPAB_IPSEC_AH:
2563 	case DL_CAPAB_IPSEC_ESP:
2564 		ill_capability_ipsec_ack(ill, mp, subp);
2565 		break;
2566 	case DL_CAPAB_MDT:
2567 		ill_capability_mdt_ack(ill, mp, subp);
2568 		break;
2569 	case DL_CAPAB_HCKSUM:
2570 		ill_capability_hcksum_ack(ill, mp, subp);
2571 		break;
2572 	case DL_CAPAB_ZEROCOPY:
2573 		ill_capability_zerocopy_ack(ill, mp, subp);
2574 		break;
2575 	case DL_CAPAB_DLD:
2576 		ill_capability_dld_ack(ill, mp, subp);
2577 		break;
2578 	default:
2579 		ip1dbg(("ill_capability_dispatch: unknown capab type %d\n",
2580 		    subp->dl_cap));
2581 	}
2582 }
2583 
2584 /*
2585  * Process a hardware checksum offload capability negotiation ack received
2586  * from a DLS Provider.isub must point to the sub-capability (DL_CAPAB_HCKSUM)
2587  * of a DL_CAPABILITY_ACK message.
2588  */
2589 static void
2590 ill_capability_hcksum_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2591 {
2592 	dl_capability_req_t	*ocap;
2593 	dl_capab_hcksum_t	*ihck, *ohck;
2594 	ill_hcksum_capab_t	**ill_hcksum;
2595 	mblk_t			*nmp = NULL;
2596 	uint_t			sub_dl_cap = isub->dl_cap;
2597 	uint8_t			*capend;
2598 
2599 	ASSERT(sub_dl_cap == DL_CAPAB_HCKSUM);
2600 
2601 	ill_hcksum = (ill_hcksum_capab_t **)&ill->ill_hcksum_capab;
2602 
2603 	/*
2604 	 * Note: range checks here are not absolutely sufficient to
2605 	 * make us robust against malformed messages sent by drivers;
2606 	 * this is in keeping with the rest of IP's dlpi handling.
2607 	 * (Remember, it's coming from something else in the kernel
2608 	 * address space)
2609 	 */
2610 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2611 	if (capend > mp->b_wptr) {
2612 		cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
2613 		    "malformed sub-capability too long for mblk");
2614 		return;
2615 	}
2616 
2617 	/*
2618 	 * There are two types of acks we process here:
2619 	 * 1. acks in reply to a (first form) generic capability req
2620 	 *    (no ENABLE flag set)
2621 	 * 2. acks in reply to a ENABLE capability req.
2622 	 *    (ENABLE flag set)
2623 	 */
2624 	ihck = (dl_capab_hcksum_t *)(isub + 1);
2625 
2626 	if (ihck->hcksum_version != HCKSUM_VERSION_1) {
2627 		cmn_err(CE_CONT, "ill_capability_hcksum_ack: "
2628 		    "unsupported hardware checksum "
2629 		    "sub-capability (version %d, expected %d)",
2630 		    ihck->hcksum_version, HCKSUM_VERSION_1);
2631 		return;
2632 	}
2633 
2634 	if (!dlcapabcheckqid(&ihck->hcksum_mid, ill->ill_lmod_rq)) {
2635 		ip1dbg(("ill_capability_hcksum_ack: mid token for hardware "
2636 		    "checksum capability isn't as expected; pass-thru "
2637 		    "module(s) detected, discarding capability\n"));
2638 		return;
2639 	}
2640 
2641 #define	CURR_HCKSUM_CAPAB				\
2642 	(HCKSUM_INET_PARTIAL | HCKSUM_INET_FULL_V4 |	\
2643 	HCKSUM_INET_FULL_V6 | HCKSUM_IPHDRCKSUM)
2644 
2645 	if ((ihck->hcksum_txflags & HCKSUM_ENABLE) &&
2646 	    (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB)) {
2647 		/* do ENABLE processing */
2648 		if (*ill_hcksum == NULL) {
2649 			*ill_hcksum = kmem_zalloc(sizeof (ill_hcksum_capab_t),
2650 			    KM_NOSLEEP);
2651 
2652 			if (*ill_hcksum == NULL) {
2653 				cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
2654 				    "could not enable hcksum version %d "
2655 				    "for %s (ENOMEM)\n", HCKSUM_CURRENT_VERSION,
2656 				    ill->ill_name);
2657 				return;
2658 			}
2659 		}
2660 
2661 		(*ill_hcksum)->ill_hcksum_version = ihck->hcksum_version;
2662 		(*ill_hcksum)->ill_hcksum_txflags = ihck->hcksum_txflags;
2663 		ill->ill_capabilities |= ILL_CAPAB_HCKSUM;
2664 		ip1dbg(("ill_capability_hcksum_ack: interface %s "
2665 		    "has enabled hardware checksumming\n ",
2666 		    ill->ill_name));
2667 	} else if (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB) {
2668 		/*
2669 		 * Enabling hardware checksum offload
2670 		 * Currently IP supports {TCP,UDP}/IPv4
2671 		 * partial and full cksum offload and
2672 		 * IPv4 header checksum offload.
2673 		 * Allocate new mblk which will
2674 		 * contain a new capability request
2675 		 * to enable hardware checksum offload.
2676 		 */
2677 		uint_t	size;
2678 		uchar_t	*rptr;
2679 
2680 		size = sizeof (dl_capability_req_t) +
2681 		    sizeof (dl_capability_sub_t) + isub->dl_length;
2682 
2683 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2684 			cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
2685 			    "could not enable hardware cksum for %s (ENOMEM)\n",
2686 			    ill->ill_name);
2687 			return;
2688 		}
2689 
2690 		rptr = nmp->b_rptr;
2691 		/* initialize dl_capability_req_t */
2692 		ocap = (dl_capability_req_t *)nmp->b_rptr;
2693 		ocap->dl_sub_offset =
2694 		    sizeof (dl_capability_req_t);
2695 		ocap->dl_sub_length =
2696 		    sizeof (dl_capability_sub_t) +
2697 		    isub->dl_length;
2698 		nmp->b_rptr += sizeof (dl_capability_req_t);
2699 
2700 		/* initialize dl_capability_sub_t */
2701 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
2702 		nmp->b_rptr += sizeof (*isub);
2703 
2704 		/* initialize dl_capab_hcksum_t */
2705 		ohck = (dl_capab_hcksum_t *)nmp->b_rptr;
2706 		bcopy(ihck, ohck, sizeof (*ihck));
2707 
2708 		nmp->b_rptr = rptr;
2709 		ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
2710 
2711 		/* Set ENABLE flag */
2712 		ohck->hcksum_txflags &= CURR_HCKSUM_CAPAB;
2713 		ohck->hcksum_txflags |= HCKSUM_ENABLE;
2714 
2715 		/*
2716 		 * nmp points to a DL_CAPABILITY_REQ message to enable
2717 		 * hardware checksum acceleration.
2718 		 */
2719 		ill_capability_send(ill, nmp);
2720 	} else {
2721 		ip1dbg(("ill_capability_hcksum_ack: interface %s has "
2722 		    "advertised %x hardware checksum capability flags\n",
2723 		    ill->ill_name, ihck->hcksum_txflags));
2724 	}
2725 }
2726 
2727 static void
2728 ill_capability_hcksum_reset_fill(ill_t *ill, mblk_t *mp)
2729 {
2730 	dl_capab_hcksum_t *hck_subcap;
2731 	dl_capability_sub_t *dl_subcap;
2732 
2733 	if (!ILL_HCKSUM_CAPABLE(ill))
2734 		return;
2735 
2736 	ASSERT(ill->ill_hcksum_capab != NULL);
2737 
2738 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2739 	dl_subcap->dl_cap = DL_CAPAB_HCKSUM;
2740 	dl_subcap->dl_length = sizeof (*hck_subcap);
2741 
2742 	hck_subcap = (dl_capab_hcksum_t *)(dl_subcap + 1);
2743 	hck_subcap->hcksum_version = ill->ill_hcksum_capab->ill_hcksum_version;
2744 	hck_subcap->hcksum_txflags = 0;
2745 
2746 	mp->b_wptr += sizeof (*dl_subcap) + sizeof (*hck_subcap);
2747 }
2748 
2749 static void
2750 ill_capability_zerocopy_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2751 {
2752 	mblk_t *nmp = NULL;
2753 	dl_capability_req_t *oc;
2754 	dl_capab_zerocopy_t *zc_ic, *zc_oc;
2755 	ill_zerocopy_capab_t **ill_zerocopy_capab;
2756 	uint_t sub_dl_cap = isub->dl_cap;
2757 	uint8_t *capend;
2758 
2759 	ASSERT(sub_dl_cap == DL_CAPAB_ZEROCOPY);
2760 
2761 	ill_zerocopy_capab = (ill_zerocopy_capab_t **)&ill->ill_zerocopy_capab;
2762 
2763 	/*
2764 	 * Note: range checks here are not absolutely sufficient to
2765 	 * make us robust against malformed messages sent by drivers;
2766 	 * this is in keeping with the rest of IP's dlpi handling.
2767 	 * (Remember, it's coming from something else in the kernel
2768 	 * address space)
2769 	 */
2770 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2771 	if (capend > mp->b_wptr) {
2772 		cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
2773 		    "malformed sub-capability too long for mblk");
2774 		return;
2775 	}
2776 
2777 	zc_ic = (dl_capab_zerocopy_t *)(isub + 1);
2778 	if (zc_ic->zerocopy_version != ZEROCOPY_VERSION_1) {
2779 		cmn_err(CE_CONT, "ill_capability_zerocopy_ack: "
2780 		    "unsupported ZEROCOPY sub-capability (version %d, "
2781 		    "expected %d)", zc_ic->zerocopy_version,
2782 		    ZEROCOPY_VERSION_1);
2783 		return;
2784 	}
2785 
2786 	if (!dlcapabcheckqid(&zc_ic->zerocopy_mid, ill->ill_lmod_rq)) {
2787 		ip1dbg(("ill_capability_zerocopy_ack: mid token for zerocopy "
2788 		    "capability isn't as expected; pass-thru module(s) "
2789 		    "detected, discarding capability\n"));
2790 		return;
2791 	}
2792 
2793 	if ((zc_ic->zerocopy_flags & DL_CAPAB_VMSAFE_MEM) != 0) {
2794 		if (*ill_zerocopy_capab == NULL) {
2795 			*ill_zerocopy_capab =
2796 			    kmem_zalloc(sizeof (ill_zerocopy_capab_t),
2797 			    KM_NOSLEEP);
2798 
2799 			if (*ill_zerocopy_capab == NULL) {
2800 				cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
2801 				    "could not enable Zero-copy version %d "
2802 				    "for %s (ENOMEM)\n", ZEROCOPY_VERSION_1,
2803 				    ill->ill_name);
2804 				return;
2805 			}
2806 		}
2807 
2808 		ip1dbg(("ill_capability_zerocopy_ack: interface %s "
2809 		    "supports Zero-copy version %d\n", ill->ill_name,
2810 		    ZEROCOPY_VERSION_1));
2811 
2812 		(*ill_zerocopy_capab)->ill_zerocopy_version =
2813 		    zc_ic->zerocopy_version;
2814 		(*ill_zerocopy_capab)->ill_zerocopy_flags =
2815 		    zc_ic->zerocopy_flags;
2816 
2817 		ill->ill_capabilities |= ILL_CAPAB_ZEROCOPY;
2818 	} else {
2819 		uint_t size;
2820 		uchar_t *rptr;
2821 
2822 		size = sizeof (dl_capability_req_t) +
2823 		    sizeof (dl_capability_sub_t) +
2824 		    sizeof (dl_capab_zerocopy_t);
2825 
2826 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2827 			cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
2828 			    "could not enable zerocopy for %s (ENOMEM)\n",
2829 			    ill->ill_name);
2830 			return;
2831 		}
2832 
2833 		rptr = nmp->b_rptr;
2834 		/* initialize dl_capability_req_t */
2835 		oc = (dl_capability_req_t *)rptr;
2836 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
2837 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
2838 		    sizeof (dl_capab_zerocopy_t);
2839 		rptr += sizeof (dl_capability_req_t);
2840 
2841 		/* initialize dl_capability_sub_t */
2842 		bcopy(isub, rptr, sizeof (*isub));
2843 		rptr += sizeof (*isub);
2844 
2845 		/* initialize dl_capab_zerocopy_t */
2846 		zc_oc = (dl_capab_zerocopy_t *)rptr;
2847 		*zc_oc = *zc_ic;
2848 
2849 		ip1dbg(("ill_capability_zerocopy_ack: asking interface %s "
2850 		    "to enable zero-copy version %d\n", ill->ill_name,
2851 		    ZEROCOPY_VERSION_1));
2852 
2853 		/* set VMSAFE_MEM flag */
2854 		zc_oc->zerocopy_flags |= DL_CAPAB_VMSAFE_MEM;
2855 
2856 		/* nmp points to a DL_CAPABILITY_REQ message to enable zcopy */
2857 		ill_capability_send(ill, nmp);
2858 	}
2859 }
2860 
2861 static void
2862 ill_capability_zerocopy_reset_fill(ill_t *ill, mblk_t *mp)
2863 {
2864 	dl_capab_zerocopy_t *zerocopy_subcap;
2865 	dl_capability_sub_t *dl_subcap;
2866 
2867 	if (!(ill->ill_capabilities & ILL_CAPAB_ZEROCOPY))
2868 		return;
2869 
2870 	ASSERT(ill->ill_zerocopy_capab != NULL);
2871 
2872 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2873 	dl_subcap->dl_cap = DL_CAPAB_ZEROCOPY;
2874 	dl_subcap->dl_length = sizeof (*zerocopy_subcap);
2875 
2876 	zerocopy_subcap = (dl_capab_zerocopy_t *)(dl_subcap + 1);
2877 	zerocopy_subcap->zerocopy_version =
2878 	    ill->ill_zerocopy_capab->ill_zerocopy_version;
2879 	zerocopy_subcap->zerocopy_flags = 0;
2880 
2881 	mp->b_wptr += sizeof (*dl_subcap) + sizeof (*zerocopy_subcap);
2882 }
2883 
2884 /*
2885  * DLD capability
2886  * Refer to dld.h for more information regarding the purpose and usage
2887  * of this capability.
2888  */
2889 static void
2890 ill_capability_dld_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2891 {
2892 	dl_capab_dld_t		*dld_ic, dld;
2893 	uint_t			sub_dl_cap = isub->dl_cap;
2894 	uint8_t			*capend;
2895 	ill_dld_capab_t		*idc;
2896 
2897 	ASSERT(IAM_WRITER_ILL(ill));
2898 	ASSERT(sub_dl_cap == DL_CAPAB_DLD);
2899 
2900 	/*
2901 	 * Note: range checks here are not absolutely sufficient to
2902 	 * make us robust against malformed messages sent by drivers;
2903 	 * this is in keeping with the rest of IP's dlpi handling.
2904 	 * (Remember, it's coming from something else in the kernel
2905 	 * address space)
2906 	 */
2907 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2908 	if (capend > mp->b_wptr) {
2909 		cmn_err(CE_WARN, "ill_capability_dld_ack: "
2910 		    "malformed sub-capability too long for mblk");
2911 		return;
2912 	}
2913 	dld_ic = (dl_capab_dld_t *)(isub + 1);
2914 	if (dld_ic->dld_version != DLD_CURRENT_VERSION) {
2915 		cmn_err(CE_CONT, "ill_capability_dld_ack: "
2916 		    "unsupported DLD sub-capability (version %d, "
2917 		    "expected %d)", dld_ic->dld_version,
2918 		    DLD_CURRENT_VERSION);
2919 		return;
2920 	}
2921 	if (!dlcapabcheckqid(&dld_ic->dld_mid, ill->ill_lmod_rq)) {
2922 		ip1dbg(("ill_capability_dld_ack: mid token for dld "
2923 		    "capability isn't as expected; pass-thru module(s) "
2924 		    "detected, discarding capability\n"));
2925 		return;
2926 	}
2927 
2928 	/*
2929 	 * Copy locally to ensure alignment.
2930 	 */
2931 	bcopy(dld_ic, &dld, sizeof (dl_capab_dld_t));
2932 
2933 	if ((idc = ill->ill_dld_capab) == NULL) {
2934 		idc = kmem_zalloc(sizeof (ill_dld_capab_t), KM_NOSLEEP);
2935 		if (idc == NULL) {
2936 			cmn_err(CE_WARN, "ill_capability_dld_ack: "
2937 			    "could not enable DLD version %d "
2938 			    "for %s (ENOMEM)\n", DLD_CURRENT_VERSION,
2939 			    ill->ill_name);
2940 			return;
2941 		}
2942 		ill->ill_dld_capab = idc;
2943 	}
2944 	idc->idc_capab_df = (ip_capab_func_t)dld.dld_capab;
2945 	idc->idc_capab_dh = (void *)dld.dld_capab_handle;
2946 	ip1dbg(("ill_capability_dld_ack: interface %s "
2947 	    "supports DLD version %d\n", ill->ill_name, DLD_CURRENT_VERSION));
2948 
2949 	ill_capability_dld_enable(ill);
2950 }
2951 
2952 /*
2953  * Typically capability negotiation between IP and the driver happens via
2954  * DLPI message exchange. However GLD also offers a direct function call
2955  * mechanism to exchange the DLD_DIRECT_CAPAB and DLD_POLL_CAPAB capabilities,
2956  * But arbitrary function calls into IP or GLD are not permitted, since both
2957  * of them are protected by their own perimeter mechanism. The perimeter can
2958  * be viewed as a coarse lock or serialization mechanism. The hierarchy of
2959  * these perimeters is IP -> MAC. Thus for example to enable the squeue
2960  * polling, IP needs to enter its perimeter, then call ill_mac_perim_enter
2961  * to enter the mac perimeter and then do the direct function calls into
2962  * GLD to enable squeue polling. The ring related callbacks from the mac into
2963  * the stack to add, bind, quiesce, restart or cleanup a ring are all
2964  * protected by the mac perimeter.
2965  */
2966 static void
2967 ill_mac_perim_enter(ill_t *ill, mac_perim_handle_t *mphp)
2968 {
2969 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
2970 	int			err;
2971 
2972 	err = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, mphp,
2973 	    DLD_ENABLE);
2974 	ASSERT(err == 0);
2975 }
2976 
2977 static void
2978 ill_mac_perim_exit(ill_t *ill, mac_perim_handle_t mph)
2979 {
2980 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
2981 	int			err;
2982 
2983 	err = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, mph,
2984 	    DLD_DISABLE);
2985 	ASSERT(err == 0);
2986 }
2987 
2988 boolean_t
2989 ill_mac_perim_held(ill_t *ill)
2990 {
2991 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
2992 
2993 	return (idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, NULL,
2994 	    DLD_QUERY));
2995 }
2996 
2997 static void
2998 ill_capability_direct_enable(ill_t *ill)
2999 {
3000 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
3001 	ill_dld_direct_t	*idd = &idc->idc_direct;
3002 	dld_capab_direct_t	direct;
3003 	int			rc;
3004 
3005 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
3006 
3007 	bzero(&direct, sizeof (direct));
3008 	direct.di_rx_cf = (uintptr_t)ip_input;
3009 	direct.di_rx_ch = ill;
3010 
3011 	rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_DIRECT, &direct,
3012 	    DLD_ENABLE);
3013 	if (rc == 0) {
3014 		idd->idd_tx_df = (ip_dld_tx_t)direct.di_tx_df;
3015 		idd->idd_tx_dh = direct.di_tx_dh;
3016 		idd->idd_tx_cb_df = (ip_dld_callb_t)direct.di_tx_cb_df;
3017 		idd->idd_tx_cb_dh = direct.di_tx_cb_dh;
3018 		idd->idd_tx_fctl_df = (ip_dld_fctl_t)direct.di_tx_fctl_df;
3019 		idd->idd_tx_fctl_dh = direct.di_tx_fctl_dh;
3020 		ASSERT(idd->idd_tx_cb_df != NULL);
3021 		ASSERT(idd->idd_tx_fctl_df != NULL);
3022 		ASSERT(idd->idd_tx_df != NULL);
3023 		/*
3024 		 * One time registration of flow enable callback function
3025 		 */
3026 		ill->ill_flownotify_mh = idd->idd_tx_cb_df(idd->idd_tx_cb_dh,
3027 		    ill_flow_enable, ill);
3028 		ill->ill_capabilities |= ILL_CAPAB_DLD_DIRECT;
3029 		DTRACE_PROBE1(direct_on, (ill_t *), ill);
3030 	} else {
3031 		cmn_err(CE_WARN, "warning: could not enable DIRECT "
3032 		    "capability, rc = %d\n", rc);
3033 		DTRACE_PROBE2(direct_off, (ill_t *), ill, (int), rc);
3034 	}
3035 }
3036 
3037 static void
3038 ill_capability_poll_enable(ill_t *ill)
3039 {
3040 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
3041 	dld_capab_poll_t	poll;
3042 	int			rc;
3043 
3044 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
3045 
3046 	bzero(&poll, sizeof (poll));
3047 	poll.poll_ring_add_cf = (uintptr_t)ip_squeue_add_ring;
3048 	poll.poll_ring_remove_cf = (uintptr_t)ip_squeue_clean_ring;
3049 	poll.poll_ring_quiesce_cf = (uintptr_t)ip_squeue_quiesce_ring;
3050 	poll.poll_ring_restart_cf = (uintptr_t)ip_squeue_restart_ring;
3051 	poll.poll_ring_bind_cf = (uintptr_t)ip_squeue_bind_ring;
3052 	poll.poll_ring_ch = ill;
3053 	rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_POLL, &poll,
3054 	    DLD_ENABLE);
3055 	if (rc == 0) {
3056 		ill->ill_capabilities |= ILL_CAPAB_DLD_POLL;
3057 		DTRACE_PROBE1(poll_on, (ill_t *), ill);
3058 	} else {
3059 		ip1dbg(("warning: could not enable POLL "
3060 		    "capability, rc = %d\n", rc));
3061 		DTRACE_PROBE2(poll_off, (ill_t *), ill, (int), rc);
3062 	}
3063 }
3064 
3065 /*
3066  * Enable the LSO capability.
3067  */
3068 static void
3069 ill_capability_lso_enable(ill_t *ill)
3070 {
3071 	ill_dld_capab_t	*idc = ill->ill_dld_capab;
3072 	dld_capab_lso_t	lso;
3073 	int rc;
3074 
3075 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
3076 
3077 	if (ill->ill_lso_capab == NULL) {
3078 		ill->ill_lso_capab = kmem_zalloc(sizeof (ill_lso_capab_t),
3079 		    KM_NOSLEEP);
3080 		if (ill->ill_lso_capab == NULL) {
3081 			cmn_err(CE_WARN, "ill_capability_lso_enable: "
3082 			    "could not enable LSO for %s (ENOMEM)\n",
3083 			    ill->ill_name);
3084 			return;
3085 		}
3086 	}
3087 
3088 	bzero(&lso, sizeof (lso));
3089 	if ((rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_LSO, &lso,
3090 	    DLD_ENABLE)) == 0) {
3091 		ill->ill_lso_capab->ill_lso_flags = lso.lso_flags;
3092 		ill->ill_lso_capab->ill_lso_max = lso.lso_max;
3093 		ill->ill_capabilities |= ILL_CAPAB_DLD_LSO;
3094 		ip1dbg(("ill_capability_lso_enable: interface %s "
3095 		    "has enabled LSO\n ", ill->ill_name));
3096 	} else {
3097 		kmem_free(ill->ill_lso_capab, sizeof (ill_lso_capab_t));
3098 		ill->ill_lso_capab = NULL;
3099 		DTRACE_PROBE2(lso_off, (ill_t *), ill, (int), rc);
3100 	}
3101 }
3102 
3103 static void
3104 ill_capability_dld_enable(ill_t *ill)
3105 {
3106 	mac_perim_handle_t mph;
3107 
3108 	ASSERT(IAM_WRITER_ILL(ill));
3109 
3110 	if (ill->ill_isv6)
3111 		return;
3112 
3113 	ill_mac_perim_enter(ill, &mph);
3114 	if (!ill->ill_isv6) {
3115 		ill_capability_direct_enable(ill);
3116 		ill_capability_poll_enable(ill);
3117 		ill_capability_lso_enable(ill);
3118 	}
3119 	ill->ill_capabilities |= ILL_CAPAB_DLD;
3120 	ill_mac_perim_exit(ill, mph);
3121 }
3122 
3123 static void
3124 ill_capability_dld_disable(ill_t *ill)
3125 {
3126 	ill_dld_capab_t	*idc;
3127 	ill_dld_direct_t *idd;
3128 	mac_perim_handle_t	mph;
3129 
3130 	ASSERT(IAM_WRITER_ILL(ill));
3131 
3132 	if (!(ill->ill_capabilities & ILL_CAPAB_DLD))
3133 		return;
3134 
3135 	ill_mac_perim_enter(ill, &mph);
3136 
3137 	idc = ill->ill_dld_capab;
3138 	if ((ill->ill_capabilities & ILL_CAPAB_DLD_DIRECT) != 0) {
3139 		/*
3140 		 * For performance we avoid locks in the transmit data path
3141 		 * and don't maintain a count of the number of threads using
3142 		 * direct calls. Thus some threads could be using direct
3143 		 * transmit calls to GLD, even after the capability mechanism
3144 		 * turns it off. This is still safe since the handles used in
3145 		 * the direct calls continue to be valid until the unplumb is
3146 		 * completed. Remove the callback that was added (1-time) at
3147 		 * capab enable time.
3148 		 */
3149 		mutex_enter(&ill->ill_lock);
3150 		ill->ill_capabilities &= ~ILL_CAPAB_DLD_DIRECT;
3151 		mutex_exit(&ill->ill_lock);
3152 		if (ill->ill_flownotify_mh != NULL) {
3153 			idd = &idc->idc_direct;
3154 			idd->idd_tx_cb_df(idd->idd_tx_cb_dh, NULL,
3155 			    ill->ill_flownotify_mh);
3156 			ill->ill_flownotify_mh = NULL;
3157 		}
3158 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_DIRECT,
3159 		    NULL, DLD_DISABLE);
3160 	}
3161 
3162 	if ((ill->ill_capabilities & ILL_CAPAB_DLD_POLL) != 0) {
3163 		ill->ill_capabilities &= ~ILL_CAPAB_DLD_POLL;
3164 		ip_squeue_clean_all(ill);
3165 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_POLL,
3166 		    NULL, DLD_DISABLE);
3167 	}
3168 
3169 	if ((ill->ill_capabilities & ILL_CAPAB_DLD_LSO) != 0) {
3170 		ASSERT(ill->ill_lso_capab != NULL);
3171 		/*
3172 		 * Clear the capability flag for LSO but retain the
3173 		 * ill_lso_capab structure since it's possible that another
3174 		 * thread is still referring to it.  The structure only gets
3175 		 * deallocated when we destroy the ill.
3176 		 */
3177 
3178 		ill->ill_capabilities &= ~ILL_CAPAB_DLD_LSO;
3179 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_LSO,
3180 		    NULL, DLD_DISABLE);
3181 	}
3182 
3183 	ill->ill_capabilities &= ~ILL_CAPAB_DLD;
3184 	ill_mac_perim_exit(ill, mph);
3185 }
3186 
3187 /*
3188  * Capability Negotiation protocol
3189  *
3190  * We don't wait for DLPI capability operations to finish during interface
3191  * bringup or teardown. Doing so would introduce more asynchrony and the
3192  * interface up/down operations will need multiple return and restarts.
3193  * Instead the 'ipsq_current_ipif' of the ipsq is not cleared as long as
3194  * the 'ill_dlpi_deferred' chain is non-empty. This ensures that the next
3195  * exclusive operation won't start until the DLPI operations of the previous
3196  * exclusive operation complete.
3197  *
3198  * The capability state machine is shown below.
3199  *
3200  * state		next state		event, action
3201  *
3202  * IDCS_UNKNOWN 	IDCS_PROBE_SENT		ill_capability_probe
3203  * IDCS_PROBE_SENT	IDCS_OK			ill_capability_ack
3204  * IDCS_PROBE_SENT	IDCS_FAILED		ip_rput_dlpi_writer (nack)
3205  * IDCS_OK		IDCS_RENEG		Receipt of DL_NOTE_CAPAB_RENEG
3206  * IDCS_OK		IDCS_RESET_SENT		ill_capability_reset
3207  * IDCS_RESET_SENT	IDCS_UNKNOWN		ill_capability_ack_thr
3208  * IDCS_RENEG		IDCS_PROBE_SENT		ill_capability_ack_thr ->
3209  *						    ill_capability_probe.
3210  */
3211 
3212 /*
3213  * Dedicated thread started from ip_stack_init that handles capability
3214  * disable. This thread ensures the taskq dispatch does not fail by waiting
3215  * for resources using TQ_SLEEP. The taskq mechanism is used to ensure
3216  * that direct calls to DLD are done in a cv_waitable context.
3217  */
3218 void
3219 ill_taskq_dispatch(ip_stack_t *ipst)
3220 {
3221 	callb_cpr_t cprinfo;
3222 	char 	name[64];
3223 	mblk_t	*mp;
3224 
3225 	(void) snprintf(name, sizeof (name), "ill_taskq_dispatch_%d",
3226 	    ipst->ips_netstack->netstack_stackid);
3227 	CALLB_CPR_INIT(&cprinfo, &ipst->ips_capab_taskq_lock, callb_generic_cpr,
3228 	    name);
3229 	mutex_enter(&ipst->ips_capab_taskq_lock);
3230 
3231 	for (;;) {
3232 		mp = list_head(&ipst->ips_capab_taskq_list);
3233 		while (mp != NULL) {
3234 			list_remove(&ipst->ips_capab_taskq_list, mp);
3235 			mutex_exit(&ipst->ips_capab_taskq_lock);
3236 			VERIFY(taskq_dispatch(system_taskq,
3237 			    ill_capability_ack_thr, mp, TQ_SLEEP) != 0);
3238 			mutex_enter(&ipst->ips_capab_taskq_lock);
3239 			mp = list_head(&ipst->ips_capab_taskq_list);
3240 		}
3241 
3242 		if (ipst->ips_capab_taskq_quit)
3243 			break;
3244 		CALLB_CPR_SAFE_BEGIN(&cprinfo);
3245 		cv_wait(&ipst->ips_capab_taskq_cv, &ipst->ips_capab_taskq_lock);
3246 		CALLB_CPR_SAFE_END(&cprinfo, &ipst->ips_capab_taskq_lock);
3247 	}
3248 	VERIFY(list_head(&ipst->ips_capab_taskq_list) == NULL);
3249 	CALLB_CPR_EXIT(&cprinfo);
3250 	thread_exit();
3251 }
3252 
3253 /*
3254  * Consume a new-style hardware capabilities negotiation ack.
3255  * Called via taskq on receipt of DL_CAPABBILITY_ACK.
3256  */
3257 static void
3258 ill_capability_ack_thr(void *arg)
3259 {
3260 	mblk_t	*mp = arg;
3261 	dl_capability_ack_t *capp;
3262 	dl_capability_sub_t *subp, *endp;
3263 	ill_t	*ill;
3264 	boolean_t reneg;
3265 
3266 	ill = (ill_t *)mp->b_prev;
3267 	VERIFY(ipsq_enter(ill, B_FALSE, CUR_OP) == B_TRUE);
3268 
3269 	if (ill->ill_dlpi_capab_state == IDCS_RESET_SENT ||
3270 	    ill->ill_dlpi_capab_state == IDCS_RENEG) {
3271 		/*
3272 		 * We have received the ack for our DL_CAPAB reset request.
3273 		 * There isnt' anything in the message that needs processing.
3274 		 * All message based capabilities have been disabled, now
3275 		 * do the function call based capability disable.
3276 		 */
3277 		reneg = ill->ill_dlpi_capab_state == IDCS_RENEG;
3278 		ill_capability_dld_disable(ill);
3279 		ill->ill_dlpi_capab_state = IDCS_UNKNOWN;
3280 		if (reneg)
3281 			ill_capability_probe(ill);
3282 		goto done;
3283 	}
3284 
3285 	if (ill->ill_dlpi_capab_state == IDCS_PROBE_SENT)
3286 		ill->ill_dlpi_capab_state = IDCS_OK;
3287 
3288 	capp = (dl_capability_ack_t *)mp->b_rptr;
3289 
3290 	if (capp->dl_sub_length == 0) {
3291 		/* no new-style capabilities */
3292 		goto done;
3293 	}
3294 
3295 	/* make sure the driver supplied correct dl_sub_length */
3296 	if ((sizeof (*capp) + capp->dl_sub_length) > MBLKL(mp)) {
3297 		ip0dbg(("ill_capability_ack: bad DL_CAPABILITY_ACK, "
3298 		    "invalid dl_sub_length (%d)\n", capp->dl_sub_length));
3299 		goto done;
3300 	}
3301 
3302 #define	SC(base, offset) (dl_capability_sub_t *)(((uchar_t *)(base))+(offset))
3303 	/*
3304 	 * There are sub-capabilities. Process the ones we know about.
3305 	 * Loop until we don't have room for another sub-cap header..
3306 	 */
3307 	for (subp = SC(capp, capp->dl_sub_offset),
3308 	    endp = SC(subp, capp->dl_sub_length - sizeof (*subp));
3309 	    subp <= endp;
3310 	    subp = SC(subp, sizeof (dl_capability_sub_t) + subp->dl_length)) {
3311 
3312 		switch (subp->dl_cap) {
3313 		case DL_CAPAB_ID_WRAPPER:
3314 			ill_capability_id_ack(ill, mp, subp);
3315 			break;
3316 		default:
3317 			ill_capability_dispatch(ill, mp, subp, B_FALSE);
3318 			break;
3319 		}
3320 	}
3321 #undef SC
3322 done:
3323 	inet_freemsg(mp);
3324 	ill_capability_done(ill);
3325 	ipsq_exit(ill->ill_phyint->phyint_ipsq);
3326 }
3327 
3328 /*
3329  * This needs to be started in a taskq thread to provide a cv_waitable
3330  * context.
3331  */
3332 void
3333 ill_capability_ack(ill_t *ill, mblk_t *mp)
3334 {
3335 	ip_stack_t	*ipst = ill->ill_ipst;
3336 
3337 	mp->b_prev = (mblk_t *)ill;
3338 	if (taskq_dispatch(system_taskq, ill_capability_ack_thr, mp,
3339 	    TQ_NOSLEEP) != 0)
3340 		return;
3341 
3342 	/*
3343 	 * The taskq dispatch failed. Signal the ill_taskq_dispatch thread
3344 	 * which will do the dispatch using TQ_SLEEP to guarantee success.
3345 	 */
3346 	mutex_enter(&ipst->ips_capab_taskq_lock);
3347 	list_insert_tail(&ipst->ips_capab_taskq_list, mp);
3348 	cv_signal(&ipst->ips_capab_taskq_cv);
3349 	mutex_exit(&ipst->ips_capab_taskq_lock);
3350 }
3351 
3352 /*
3353  * This routine is called to scan the fragmentation reassembly table for
3354  * the specified ILL for any packets that are starting to smell.
3355  * dead_interval is the maximum time in seconds that will be tolerated.  It
3356  * will either be the value specified in ip_g_frag_timeout, or zero if the
3357  * ILL is shutting down and it is time to blow everything off.
3358  *
3359  * It returns the number of seconds (as a time_t) that the next frag timer
3360  * should be scheduled for, 0 meaning that the timer doesn't need to be
3361  * re-started.  Note that the method of calculating next_timeout isn't
3362  * entirely accurate since time will flow between the time we grab
3363  * current_time and the time we schedule the next timeout.  This isn't a
3364  * big problem since this is the timer for sending an ICMP reassembly time
3365  * exceeded messages, and it doesn't have to be exactly accurate.
3366  *
3367  * This function is
3368  * sometimes called as writer, although this is not required.
3369  */
3370 time_t
3371 ill_frag_timeout(ill_t *ill, time_t dead_interval)
3372 {
3373 	ipfb_t	*ipfb;
3374 	ipfb_t	*endp;
3375 	ipf_t	*ipf;
3376 	ipf_t	*ipfnext;
3377 	mblk_t	*mp;
3378 	time_t	current_time = gethrestime_sec();
3379 	time_t	next_timeout = 0;
3380 	uint32_t	hdr_length;
3381 	mblk_t	*send_icmp_head;
3382 	mblk_t	*send_icmp_head_v6;
3383 	zoneid_t zoneid;
3384 	ip_stack_t *ipst = ill->ill_ipst;
3385 
3386 	ipfb = ill->ill_frag_hash_tbl;
3387 	if (ipfb == NULL)
3388 		return (B_FALSE);
3389 	endp = &ipfb[ILL_FRAG_HASH_TBL_COUNT];
3390 	/* Walk the frag hash table. */
3391 	for (; ipfb < endp; ipfb++) {
3392 		send_icmp_head = NULL;
3393 		send_icmp_head_v6 = NULL;
3394 		mutex_enter(&ipfb->ipfb_lock);
3395 		while ((ipf = ipfb->ipfb_ipf) != 0) {
3396 			time_t frag_time = current_time - ipf->ipf_timestamp;
3397 			time_t frag_timeout;
3398 
3399 			if (frag_time < dead_interval) {
3400 				/*
3401 				 * There are some outstanding fragments
3402 				 * that will timeout later.  Make note of
3403 				 * the time so that we can reschedule the
3404 				 * next timeout appropriately.
3405 				 */
3406 				frag_timeout = dead_interval - frag_time;
3407 				if (next_timeout == 0 ||
3408 				    frag_timeout < next_timeout) {
3409 					next_timeout = frag_timeout;
3410 				}
3411 				break;
3412 			}
3413 			/* Time's up.  Get it out of here. */
3414 			hdr_length = ipf->ipf_nf_hdr_len;
3415 			ipfnext = ipf->ipf_hash_next;
3416 			if (ipfnext)
3417 				ipfnext->ipf_ptphn = ipf->ipf_ptphn;
3418 			*ipf->ipf_ptphn = ipfnext;
3419 			mp = ipf->ipf_mp->b_cont;
3420 			for (; mp; mp = mp->b_cont) {
3421 				/* Extra points for neatness. */
3422 				IP_REASS_SET_START(mp, 0);
3423 				IP_REASS_SET_END(mp, 0);
3424 			}
3425 			mp = ipf->ipf_mp->b_cont;
3426 			atomic_add_32(&ill->ill_frag_count, -ipf->ipf_count);
3427 			ASSERT(ipfb->ipfb_count >= ipf->ipf_count);
3428 			ipfb->ipfb_count -= ipf->ipf_count;
3429 			ASSERT(ipfb->ipfb_frag_pkts > 0);
3430 			ipfb->ipfb_frag_pkts--;
3431 			/*
3432 			 * We do not send any icmp message from here because
3433 			 * we currently are holding the ipfb_lock for this
3434 			 * hash chain. If we try and send any icmp messages
3435 			 * from here we may end up via a put back into ip
3436 			 * trying to get the same lock, causing a recursive
3437 			 * mutex panic. Instead we build a list and send all
3438 			 * the icmp messages after we have dropped the lock.
3439 			 */
3440 			if (ill->ill_isv6) {
3441 				if (hdr_length != 0) {
3442 					mp->b_next = send_icmp_head_v6;
3443 					send_icmp_head_v6 = mp;
3444 				} else {
3445 					freemsg(mp);
3446 				}
3447 			} else {
3448 				if (hdr_length != 0) {
3449 					mp->b_next = send_icmp_head;
3450 					send_icmp_head = mp;
3451 				} else {
3452 					freemsg(mp);
3453 				}
3454 			}
3455 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmFails);
3456 			freeb(ipf->ipf_mp);
3457 		}
3458 		mutex_exit(&ipfb->ipfb_lock);
3459 		/*
3460 		 * Now need to send any icmp messages that we delayed from
3461 		 * above.
3462 		 */
3463 		while (send_icmp_head_v6 != NULL) {
3464 			ip6_t *ip6h;
3465 
3466 			mp = send_icmp_head_v6;
3467 			send_icmp_head_v6 = send_icmp_head_v6->b_next;
3468 			mp->b_next = NULL;
3469 			if (mp->b_datap->db_type == M_CTL)
3470 				ip6h = (ip6_t *)mp->b_cont->b_rptr;
3471 			else
3472 				ip6h = (ip6_t *)mp->b_rptr;
3473 			zoneid = ipif_lookup_addr_zoneid_v6(&ip6h->ip6_dst,
3474 			    ill, ipst);
3475 			if (zoneid == ALL_ZONES) {
3476 				freemsg(mp);
3477 			} else {
3478 				icmp_time_exceeded_v6(ill->ill_wq, mp,
3479 				    ICMP_REASSEMBLY_TIME_EXCEEDED, B_FALSE,
3480 				    B_FALSE, zoneid, ipst);
3481 			}
3482 		}
3483 		while (send_icmp_head != NULL) {
3484 			ipaddr_t dst;
3485 
3486 			mp = send_icmp_head;
3487 			send_icmp_head = send_icmp_head->b_next;
3488 			mp->b_next = NULL;
3489 
3490 			if (mp->b_datap->db_type == M_CTL)
3491 				dst = ((ipha_t *)mp->b_cont->b_rptr)->ipha_dst;
3492 			else
3493 				dst = ((ipha_t *)mp->b_rptr)->ipha_dst;
3494 
3495 			zoneid = ipif_lookup_addr_zoneid(dst, ill, ipst);
3496 			if (zoneid == ALL_ZONES) {
3497 				freemsg(mp);
3498 			} else {
3499 				icmp_time_exceeded(ill->ill_wq, mp,
3500 				    ICMP_REASSEMBLY_TIME_EXCEEDED, zoneid,
3501 				    ipst);
3502 			}
3503 		}
3504 	}
3505 	/*
3506 	 * A non-dying ILL will use the return value to decide whether to
3507 	 * restart the frag timer, and for how long.
3508 	 */
3509 	return (next_timeout);
3510 }
3511 
3512 /*
3513  * This routine is called when the approximate count of mblk memory used
3514  * for the specified ILL has exceeded max_count.
3515  */
3516 void
3517 ill_frag_prune(ill_t *ill, uint_t max_count)
3518 {
3519 	ipfb_t	*ipfb;
3520 	ipf_t	*ipf;
3521 	size_t	count;
3522 
3523 	/*
3524 	 * If we are here within ip_min_frag_prune_time msecs remove
3525 	 * ill_frag_free_num_pkts oldest packets from each bucket and increment
3526 	 * ill_frag_free_num_pkts.
3527 	 */
3528 	mutex_enter(&ill->ill_lock);
3529 	if (TICK_TO_MSEC(lbolt - ill->ill_last_frag_clean_time) <=
3530 	    (ip_min_frag_prune_time != 0 ?
3531 	    ip_min_frag_prune_time : msec_per_tick)) {
3532 
3533 		ill->ill_frag_free_num_pkts++;
3534 
3535 	} else {
3536 		ill->ill_frag_free_num_pkts = 0;
3537 	}
3538 	ill->ill_last_frag_clean_time = lbolt;
3539 	mutex_exit(&ill->ill_lock);
3540 
3541 	/*
3542 	 * free ill_frag_free_num_pkts oldest packets from each bucket.
3543 	 */
3544 	if (ill->ill_frag_free_num_pkts != 0) {
3545 		int ix;
3546 
3547 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
3548 			ipfb = &ill->ill_frag_hash_tbl[ix];
3549 			mutex_enter(&ipfb->ipfb_lock);
3550 			if (ipfb->ipfb_ipf != NULL) {
3551 				ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf,
3552 				    ill->ill_frag_free_num_pkts);
3553 			}
3554 			mutex_exit(&ipfb->ipfb_lock);
3555 		}
3556 	}
3557 	/*
3558 	 * While the reassembly list for this ILL is too big, prune a fragment
3559 	 * queue by age, oldest first.
3560 	 */
3561 	while (ill->ill_frag_count > max_count) {
3562 		int	ix;
3563 		ipfb_t	*oipfb = NULL;
3564 		uint_t	oldest = UINT_MAX;
3565 
3566 		count = 0;
3567 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
3568 			ipfb = &ill->ill_frag_hash_tbl[ix];
3569 			mutex_enter(&ipfb->ipfb_lock);
3570 			ipf = ipfb->ipfb_ipf;
3571 			if (ipf != NULL && ipf->ipf_gen < oldest) {
3572 				oldest = ipf->ipf_gen;
3573 				oipfb = ipfb;
3574 			}
3575 			count += ipfb->ipfb_count;
3576 			mutex_exit(&ipfb->ipfb_lock);
3577 		}
3578 		if (oipfb == NULL)
3579 			break;
3580 
3581 		if (count <= max_count)
3582 			return;	/* Somebody beat us to it, nothing to do */
3583 		mutex_enter(&oipfb->ipfb_lock);
3584 		ipf = oipfb->ipfb_ipf;
3585 		if (ipf != NULL) {
3586 			ill_frag_free_pkts(ill, oipfb, ipf, 1);
3587 		}
3588 		mutex_exit(&oipfb->ipfb_lock);
3589 	}
3590 }
3591 
3592 /*
3593  * free 'free_cnt' fragmented packets starting at ipf.
3594  */
3595 void
3596 ill_frag_free_pkts(ill_t *ill, ipfb_t *ipfb, ipf_t *ipf, int free_cnt)
3597 {
3598 	size_t	count;
3599 	mblk_t	*mp;
3600 	mblk_t	*tmp;
3601 	ipf_t **ipfp = ipf->ipf_ptphn;
3602 
3603 	ASSERT(MUTEX_HELD(&ipfb->ipfb_lock));
3604 	ASSERT(ipfp != NULL);
3605 	ASSERT(ipf != NULL);
3606 
3607 	while (ipf != NULL && free_cnt-- > 0) {
3608 		count = ipf->ipf_count;
3609 		mp = ipf->ipf_mp;
3610 		ipf = ipf->ipf_hash_next;
3611 		for (tmp = mp; tmp; tmp = tmp->b_cont) {
3612 			IP_REASS_SET_START(tmp, 0);
3613 			IP_REASS_SET_END(tmp, 0);
3614 		}
3615 		atomic_add_32(&ill->ill_frag_count, -count);
3616 		ASSERT(ipfb->ipfb_count >= count);
3617 		ipfb->ipfb_count -= count;
3618 		ASSERT(ipfb->ipfb_frag_pkts > 0);
3619 		ipfb->ipfb_frag_pkts--;
3620 		freemsg(mp);
3621 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmFails);
3622 	}
3623 
3624 	if (ipf)
3625 		ipf->ipf_ptphn = ipfp;
3626 	ipfp[0] = ipf;
3627 }
3628 
3629 #define	ND_FORWARD_WARNING	"The <if>:ip*_forwarding ndd variables are " \
3630 	"obsolete and may be removed in a future release of Solaris.  Use " \
3631 	"ifconfig(1M) to manipulate the forwarding status of an interface."
3632 
3633 /*
3634  * For obsolete per-interface forwarding configuration;
3635  * called in response to ND_GET.
3636  */
3637 /* ARGSUSED */
3638 static int
3639 nd_ill_forward_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *ioc_cr)
3640 {
3641 	ill_t *ill = (ill_t *)cp;
3642 
3643 	cmn_err(CE_WARN, ND_FORWARD_WARNING);
3644 
3645 	(void) mi_mpprintf(mp, "%d", (ill->ill_flags & ILLF_ROUTER) != 0);
3646 	return (0);
3647 }
3648 
3649 /*
3650  * For obsolete per-interface forwarding configuration;
3651  * called in response to ND_SET.
3652  */
3653 /* ARGSUSED */
3654 static int
3655 nd_ill_forward_set(queue_t *q, mblk_t *mp, char *valuestr, caddr_t cp,
3656     cred_t *ioc_cr)
3657 {
3658 	long value;
3659 	int retval;
3660 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
3661 
3662 	cmn_err(CE_WARN, ND_FORWARD_WARNING);
3663 
3664 	if (ddi_strtol(valuestr, NULL, 10, &value) != 0 ||
3665 	    value < 0 || value > 1) {
3666 		return (EINVAL);
3667 	}
3668 
3669 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3670 	retval = ill_forward_set((ill_t *)cp, (value != 0));
3671 	rw_exit(&ipst->ips_ill_g_lock);
3672 	return (retval);
3673 }
3674 
3675 /*
3676  * Helper function for ill_forward_set().
3677  */
3678 static void
3679 ill_forward_set_on_ill(ill_t *ill, boolean_t enable)
3680 {
3681 	ip_stack_t	*ipst = ill->ill_ipst;
3682 
3683 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ipst->ips_ill_g_lock));
3684 
3685 	ip1dbg(("ill_forward_set: %s %s forwarding on %s",
3686 	    (enable ? "Enabling" : "Disabling"),
3687 	    (ill->ill_isv6 ? "IPv6" : "IPv4"), ill->ill_name));
3688 	mutex_enter(&ill->ill_lock);
3689 	if (enable)
3690 		ill->ill_flags |= ILLF_ROUTER;
3691 	else
3692 		ill->ill_flags &= ~ILLF_ROUTER;
3693 	mutex_exit(&ill->ill_lock);
3694 	if (ill->ill_isv6)
3695 		ill_set_nce_router_flags(ill, enable);
3696 	/* Notify routing socket listeners of this change. */
3697 	if (ill->ill_ipif != NULL)
3698 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
3699 }
3700 
3701 /*
3702  * Set an ill's ILLF_ROUTER flag appropriately.  Send up RTS_IFINFO routing
3703  * socket messages for each interface whose flags we change.
3704  */
3705 int
3706 ill_forward_set(ill_t *ill, boolean_t enable)
3707 {
3708 	ipmp_illgrp_t *illg;
3709 	ip_stack_t *ipst = ill->ill_ipst;
3710 
3711 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ipst->ips_ill_g_lock));
3712 
3713 	if ((enable && (ill->ill_flags & ILLF_ROUTER)) ||
3714 	    (!enable && !(ill->ill_flags & ILLF_ROUTER)))
3715 		return (0);
3716 
3717 	if (IS_LOOPBACK(ill))
3718 		return (EINVAL);
3719 
3720 	if (IS_IPMP(ill) || IS_UNDER_IPMP(ill)) {
3721 		/*
3722 		 * Update all of the interfaces in the group.
3723 		 */
3724 		illg = ill->ill_grp;
3725 		ill = list_head(&illg->ig_if);
3726 		for (; ill != NULL; ill = list_next(&illg->ig_if, ill))
3727 			ill_forward_set_on_ill(ill, enable);
3728 
3729 		/*
3730 		 * Update the IPMP meta-interface.
3731 		 */
3732 		ill_forward_set_on_ill(ipmp_illgrp_ipmp_ill(illg), enable);
3733 		return (0);
3734 	}
3735 
3736 	ill_forward_set_on_ill(ill, enable);
3737 	return (0);
3738 }
3739 
3740 /*
3741  * Based on the ILLF_ROUTER flag of an ill, make sure all local nce's for
3742  * addresses assigned to the ill have the NCE_F_ISROUTER flag appropriately
3743  * set or clear.
3744  */
3745 static void
3746 ill_set_nce_router_flags(ill_t *ill, boolean_t enable)
3747 {
3748 	ipif_t *ipif;
3749 	nce_t *nce;
3750 
3751 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
3752 		/*
3753 		 * NOTE: we match across the illgrp because nce's for
3754 		 * addresses on IPMP interfaces have an nce_ill that points to
3755 		 * the bound underlying ill.
3756 		 */
3757 		nce = ndp_lookup_v6(ill, B_TRUE, &ipif->ipif_v6lcl_addr,
3758 		    B_FALSE);
3759 		if (nce != NULL) {
3760 			mutex_enter(&nce->nce_lock);
3761 			if (enable)
3762 				nce->nce_flags |= NCE_F_ISROUTER;
3763 			else
3764 				nce->nce_flags &= ~NCE_F_ISROUTER;
3765 			mutex_exit(&nce->nce_lock);
3766 			NCE_REFRELE(nce);
3767 		}
3768 	}
3769 }
3770 
3771 /*
3772  * Given an ill with a _valid_ name, add the ip_forwarding ndd variable
3773  * for this ill.  Make sure the v6/v4 question has been answered about this
3774  * ill.  The creation of this ndd variable is only for backwards compatibility.
3775  * The preferred way to control per-interface IP forwarding is through the
3776  * ILLF_ROUTER interface flag.
3777  */
3778 static int
3779 ill_set_ndd_name(ill_t *ill)
3780 {
3781 	char *suffix;
3782 	ip_stack_t	*ipst = ill->ill_ipst;
3783 
3784 	ASSERT(IAM_WRITER_ILL(ill));
3785 
3786 	if (ill->ill_isv6)
3787 		suffix = ipv6_forward_suffix;
3788 	else
3789 		suffix = ipv4_forward_suffix;
3790 
3791 	ill->ill_ndd_name = ill->ill_name + ill->ill_name_length;
3792 	bcopy(ill->ill_name, ill->ill_ndd_name, ill->ill_name_length - 1);
3793 	/*
3794 	 * Copies over the '\0'.
3795 	 * Note that strlen(suffix) is always bounded.
3796 	 */
3797 	bcopy(suffix, ill->ill_ndd_name + ill->ill_name_length - 1,
3798 	    strlen(suffix) + 1);
3799 
3800 	/*
3801 	 * Use of the nd table requires holding the reader lock.
3802 	 * Modifying the nd table thru nd_load/nd_unload requires
3803 	 * the writer lock.
3804 	 */
3805 	rw_enter(&ipst->ips_ip_g_nd_lock, RW_WRITER);
3806 	if (!nd_load(&ipst->ips_ip_g_nd, ill->ill_ndd_name, nd_ill_forward_get,
3807 	    nd_ill_forward_set, (caddr_t)ill)) {
3808 		/*
3809 		 * If the nd_load failed, it only meant that it could not
3810 		 * allocate a new bunch of room for further NDD expansion.
3811 		 * Because of that, the ill_ndd_name will be set to 0, and
3812 		 * this interface is at the mercy of the global ip_forwarding
3813 		 * variable.
3814 		 */
3815 		rw_exit(&ipst->ips_ip_g_nd_lock);
3816 		ill->ill_ndd_name = NULL;
3817 		return (ENOMEM);
3818 	}
3819 	rw_exit(&ipst->ips_ip_g_nd_lock);
3820 	return (0);
3821 }
3822 
3823 /*
3824  * Intializes the context structure and returns the first ill in the list
3825  * cuurently start_list and end_list can have values:
3826  * MAX_G_HEADS		Traverse both IPV4 and IPV6 lists.
3827  * IP_V4_G_HEAD		Traverse IPV4 list only.
3828  * IP_V6_G_HEAD		Traverse IPV6 list only.
3829  */
3830 
3831 /*
3832  * We don't check for CONDEMNED ills here. Caller must do that if
3833  * necessary under the ill lock.
3834  */
3835 ill_t *
3836 ill_first(int start_list, int end_list, ill_walk_context_t *ctx,
3837     ip_stack_t *ipst)
3838 {
3839 	ill_if_t *ifp;
3840 	ill_t *ill;
3841 	avl_tree_t *avl_tree;
3842 
3843 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
3844 	ASSERT(end_list <= MAX_G_HEADS && start_list >= 0);
3845 
3846 	/*
3847 	 * setup the lists to search
3848 	 */
3849 	if (end_list != MAX_G_HEADS) {
3850 		ctx->ctx_current_list = start_list;
3851 		ctx->ctx_last_list = end_list;
3852 	} else {
3853 		ctx->ctx_last_list = MAX_G_HEADS - 1;
3854 		ctx->ctx_current_list = 0;
3855 	}
3856 
3857 	while (ctx->ctx_current_list <= ctx->ctx_last_list) {
3858 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst);
3859 		if (ifp != (ill_if_t *)
3860 		    &IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst)) {
3861 			avl_tree = &ifp->illif_avl_by_ppa;
3862 			ill = avl_first(avl_tree);
3863 			/*
3864 			 * ill is guaranteed to be non NULL or ifp should have
3865 			 * not existed.
3866 			 */
3867 			ASSERT(ill != NULL);
3868 			return (ill);
3869 		}
3870 		ctx->ctx_current_list++;
3871 	}
3872 
3873 	return (NULL);
3874 }
3875 
3876 /*
3877  * returns the next ill in the list. ill_first() must have been called
3878  * before calling ill_next() or bad things will happen.
3879  */
3880 
3881 /*
3882  * We don't check for CONDEMNED ills here. Caller must do that if
3883  * necessary under the ill lock.
3884  */
3885 ill_t *
3886 ill_next(ill_walk_context_t *ctx, ill_t *lastill)
3887 {
3888 	ill_if_t *ifp;
3889 	ill_t *ill;
3890 	ip_stack_t	*ipst = lastill->ill_ipst;
3891 
3892 	ASSERT(lastill->ill_ifptr != (ill_if_t *)
3893 	    &IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst));
3894 	if ((ill = avl_walk(&lastill->ill_ifptr->illif_avl_by_ppa, lastill,
3895 	    AVL_AFTER)) != NULL) {
3896 		return (ill);
3897 	}
3898 
3899 	/* goto next ill_ifp in the list. */
3900 	ifp = lastill->ill_ifptr->illif_next;
3901 
3902 	/* make sure not at end of circular list */
3903 	while (ifp ==
3904 	    (ill_if_t *)&IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst)) {
3905 		if (++ctx->ctx_current_list > ctx->ctx_last_list)
3906 			return (NULL);
3907 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst);
3908 	}
3909 
3910 	return (avl_first(&ifp->illif_avl_by_ppa));
3911 }
3912 
3913 /*
3914  * Check interface name for correct format: [a-zA-Z]+[a-zA-Z0-9._]*[0-9]+
3915  * The final number (PPA) must not have any leading zeros.  Upon success, a
3916  * pointer to the start of the PPA is returned; otherwise NULL is returned.
3917  */
3918 static char *
3919 ill_get_ppa_ptr(char *name)
3920 {
3921 	int namelen = strlen(name);
3922 	int end_ndx = namelen - 1;
3923 	int ppa_ndx, i;
3924 
3925 	/*
3926 	 * Check that the first character is [a-zA-Z], and that the last
3927 	 * character is [0-9].
3928 	 */
3929 	if (namelen == 0 || !isalpha(name[0]) || !isdigit(name[end_ndx]))
3930 		return (NULL);
3931 
3932 	/*
3933 	 * Set `ppa_ndx' to the PPA start, and check for leading zeroes.
3934 	 */
3935 	for (ppa_ndx = end_ndx; ppa_ndx > 0; ppa_ndx--)
3936 		if (!isdigit(name[ppa_ndx - 1]))
3937 			break;
3938 
3939 	if (name[ppa_ndx] == '0' && ppa_ndx < end_ndx)
3940 		return (NULL);
3941 
3942 	/*
3943 	 * Check that the intermediate characters are [a-z0-9.]
3944 	 */
3945 	for (i = 1; i < ppa_ndx; i++) {
3946 		if (!isalpha(name[i]) && !isdigit(name[i]) &&
3947 		    name[i] != '.' && name[i] != '_') {
3948 			return (NULL);
3949 		}
3950 	}
3951 
3952 	return (name + ppa_ndx);
3953 }
3954 
3955 /*
3956  * use avl tree to locate the ill.
3957  */
3958 static ill_t *
3959 ill_find_by_name(char *name, boolean_t isv6, queue_t *q, mblk_t *mp,
3960     ipsq_func_t func, int *error, ip_stack_t *ipst)
3961 {
3962 	char *ppa_ptr = NULL;
3963 	int len;
3964 	uint_t ppa;
3965 	ill_t *ill = NULL;
3966 	ill_if_t *ifp;
3967 	int list;
3968 	ipsq_t *ipsq;
3969 
3970 	if (error != NULL)
3971 		*error = 0;
3972 
3973 	/*
3974 	 * get ppa ptr
3975 	 */
3976 	if (isv6)
3977 		list = IP_V6_G_HEAD;
3978 	else
3979 		list = IP_V4_G_HEAD;
3980 
3981 	if ((ppa_ptr = ill_get_ppa_ptr(name)) == NULL) {
3982 		if (error != NULL)
3983 			*error = ENXIO;
3984 		return (NULL);
3985 	}
3986 
3987 	len = ppa_ptr - name + 1;
3988 
3989 	ppa = stoi(&ppa_ptr);
3990 
3991 	ifp = IP_VX_ILL_G_LIST(list, ipst);
3992 
3993 	while (ifp != (ill_if_t *)&IP_VX_ILL_G_LIST(list, ipst)) {
3994 		/*
3995 		 * match is done on len - 1 as the name is not null
3996 		 * terminated it contains ppa in addition to the interface
3997 		 * name.
3998 		 */
3999 		if ((ifp->illif_name_len == len) &&
4000 		    bcmp(ifp->illif_name, name, len - 1) == 0) {
4001 			break;
4002 		} else {
4003 			ifp = ifp->illif_next;
4004 		}
4005 	}
4006 
4007 	if (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(list, ipst)) {
4008 		/*
4009 		 * Even the interface type does not exist.
4010 		 */
4011 		if (error != NULL)
4012 			*error = ENXIO;
4013 		return (NULL);
4014 	}
4015 
4016 	ill = avl_find(&ifp->illif_avl_by_ppa, (void *) &ppa, NULL);
4017 	if (ill != NULL) {
4018 		/*
4019 		 * The block comment at the start of ipif_down
4020 		 * explains the use of the macros used below
4021 		 */
4022 		GRAB_CONN_LOCK(q);
4023 		mutex_enter(&ill->ill_lock);
4024 		if (ILL_CAN_LOOKUP(ill)) {
4025 			ill_refhold_locked(ill);
4026 			mutex_exit(&ill->ill_lock);
4027 			RELEASE_CONN_LOCK(q);
4028 			return (ill);
4029 		} else if (ILL_CAN_WAIT(ill, q)) {
4030 			ipsq = ill->ill_phyint->phyint_ipsq;
4031 			mutex_enter(&ipsq->ipsq_lock);
4032 			mutex_enter(&ipsq->ipsq_xop->ipx_lock);
4033 			mutex_exit(&ill->ill_lock);
4034 			ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
4035 			mutex_exit(&ipsq->ipsq_xop->ipx_lock);
4036 			mutex_exit(&ipsq->ipsq_lock);
4037 			RELEASE_CONN_LOCK(q);
4038 			if (error != NULL)
4039 				*error = EINPROGRESS;
4040 			return (NULL);
4041 		}
4042 		mutex_exit(&ill->ill_lock);
4043 		RELEASE_CONN_LOCK(q);
4044 	}
4045 	if (error != NULL)
4046 		*error = ENXIO;
4047 	return (NULL);
4048 }
4049 
4050 /*
4051  * comparison function for use with avl.
4052  */
4053 static int
4054 ill_compare_ppa(const void *ppa_ptr, const void *ill_ptr)
4055 {
4056 	uint_t ppa;
4057 	uint_t ill_ppa;
4058 
4059 	ASSERT(ppa_ptr != NULL && ill_ptr != NULL);
4060 
4061 	ppa = *((uint_t *)ppa_ptr);
4062 	ill_ppa = ((const ill_t *)ill_ptr)->ill_ppa;
4063 	/*
4064 	 * We want the ill with the lowest ppa to be on the
4065 	 * top.
4066 	 */
4067 	if (ill_ppa < ppa)
4068 		return (1);
4069 	if (ill_ppa > ppa)
4070 		return (-1);
4071 	return (0);
4072 }
4073 
4074 /*
4075  * remove an interface type from the global list.
4076  */
4077 static void
4078 ill_delete_interface_type(ill_if_t *interface)
4079 {
4080 	ASSERT(interface != NULL);
4081 	ASSERT(avl_numnodes(&interface->illif_avl_by_ppa) == 0);
4082 
4083 	avl_destroy(&interface->illif_avl_by_ppa);
4084 	if (interface->illif_ppa_arena != NULL)
4085 		vmem_destroy(interface->illif_ppa_arena);
4086 
4087 	remque(interface);
4088 
4089 	mi_free(interface);
4090 }
4091 
4092 /*
4093  * remove ill from the global list.
4094  */
4095 static void
4096 ill_glist_delete(ill_t *ill)
4097 {
4098 	ip_stack_t	*ipst;
4099 	phyint_t	*phyi;
4100 
4101 	if (ill == NULL)
4102 		return;
4103 	ipst = ill->ill_ipst;
4104 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
4105 
4106 	/*
4107 	 * If the ill was never inserted into the AVL tree
4108 	 * we skip the if branch.
4109 	 */
4110 	if (ill->ill_ifptr != NULL) {
4111 		/*
4112 		 * remove from AVL tree and free ppa number
4113 		 */
4114 		avl_remove(&ill->ill_ifptr->illif_avl_by_ppa, ill);
4115 
4116 		if (ill->ill_ifptr->illif_ppa_arena != NULL) {
4117 			vmem_free(ill->ill_ifptr->illif_ppa_arena,
4118 			    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
4119 		}
4120 		if (avl_numnodes(&ill->ill_ifptr->illif_avl_by_ppa) == 0) {
4121 			ill_delete_interface_type(ill->ill_ifptr);
4122 		}
4123 
4124 		/*
4125 		 * Indicate ill is no longer in the list.
4126 		 */
4127 		ill->ill_ifptr = NULL;
4128 		ill->ill_name_length = 0;
4129 		ill->ill_name[0] = '\0';
4130 		ill->ill_ppa = UINT_MAX;
4131 	}
4132 
4133 	/* Generate one last event for this ill. */
4134 	ill_nic_event_dispatch(ill, 0, NE_UNPLUMB, ill->ill_name,
4135 	    ill->ill_name_length);
4136 
4137 	ASSERT(ill->ill_phyint != NULL);
4138 	phyi = ill->ill_phyint;
4139 	ill->ill_phyint = NULL;
4140 
4141 	/*
4142 	 * ill_init allocates a phyint always to store the copy
4143 	 * of flags relevant to phyint. At that point in time, we could
4144 	 * not assign the name and hence phyint_illv4/v6 could not be
4145 	 * initialized. Later in ipif_set_values, we assign the name to
4146 	 * the ill, at which point in time we assign phyint_illv4/v6.
4147 	 * Thus we don't rely on phyint_illv6 to be initialized always.
4148 	 */
4149 	if (ill->ill_flags & ILLF_IPV6)
4150 		phyi->phyint_illv6 = NULL;
4151 	else
4152 		phyi->phyint_illv4 = NULL;
4153 
4154 	if (phyi->phyint_illv4 != NULL || phyi->phyint_illv6 != NULL) {
4155 		rw_exit(&ipst->ips_ill_g_lock);
4156 		return;
4157 	}
4158 
4159 	/*
4160 	 * There are no ills left on this phyint; pull it out of the phyint
4161 	 * avl trees, and free it.
4162 	 */
4163 	if (phyi->phyint_ifindex > 0) {
4164 		avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
4165 		    phyi);
4166 		avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
4167 		    phyi);
4168 	}
4169 	rw_exit(&ipst->ips_ill_g_lock);
4170 
4171 	phyint_free(phyi);
4172 }
4173 
4174 /*
4175  * allocate a ppa, if the number of plumbed interfaces of this type are
4176  * less than ill_no_arena do a linear search to find a unused ppa.
4177  * When the number goes beyond ill_no_arena switch to using an arena.
4178  * Note: ppa value of zero cannot be allocated from vmem_arena as it
4179  * is the return value for an error condition, so allocation starts at one
4180  * and is decremented by one.
4181  */
4182 static int
4183 ill_alloc_ppa(ill_if_t *ifp, ill_t *ill)
4184 {
4185 	ill_t *tmp_ill;
4186 	uint_t start, end;
4187 	int ppa;
4188 
4189 	if (ifp->illif_ppa_arena == NULL &&
4190 	    (avl_numnodes(&ifp->illif_avl_by_ppa) + 1 > ill_no_arena)) {
4191 		/*
4192 		 * Create an arena.
4193 		 */
4194 		ifp->illif_ppa_arena = vmem_create(ifp->illif_name,
4195 		    (void *)1, UINT_MAX - 1, 1, NULL, NULL,
4196 		    NULL, 0, VM_SLEEP | VMC_IDENTIFIER);
4197 			/* allocate what has already been assigned */
4198 		for (tmp_ill = avl_first(&ifp->illif_avl_by_ppa);
4199 		    tmp_ill != NULL; tmp_ill = avl_walk(&ifp->illif_avl_by_ppa,
4200 		    tmp_ill, AVL_AFTER)) {
4201 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
4202 			    1,		/* size */
4203 			    1,		/* align/quantum */
4204 			    0,		/* phase */
4205 			    0,		/* nocross */
4206 			    /* minaddr */
4207 			    (void *)((uintptr_t)tmp_ill->ill_ppa + 1),
4208 			    /* maxaddr */
4209 			    (void *)((uintptr_t)tmp_ill->ill_ppa + 2),
4210 			    VM_NOSLEEP|VM_FIRSTFIT);
4211 			if (ppa == 0) {
4212 				ip1dbg(("ill_alloc_ppa: ppa allocation"
4213 				    " failed while switching"));
4214 				vmem_destroy(ifp->illif_ppa_arena);
4215 				ifp->illif_ppa_arena = NULL;
4216 				break;
4217 			}
4218 		}
4219 	}
4220 
4221 	if (ifp->illif_ppa_arena != NULL) {
4222 		if (ill->ill_ppa == UINT_MAX) {
4223 			ppa = (int)(uintptr_t)vmem_alloc(ifp->illif_ppa_arena,
4224 			    1, VM_NOSLEEP|VM_FIRSTFIT);
4225 			if (ppa == 0)
4226 				return (EAGAIN);
4227 			ill->ill_ppa = --ppa;
4228 		} else {
4229 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
4230 			    1, 		/* size */
4231 			    1, 		/* align/quantum */
4232 			    0, 		/* phase */
4233 			    0, 		/* nocross */
4234 			    (void *)(uintptr_t)(ill->ill_ppa + 1), /* minaddr */
4235 			    (void *)(uintptr_t)(ill->ill_ppa + 2), /* maxaddr */
4236 			    VM_NOSLEEP|VM_FIRSTFIT);
4237 			/*
4238 			 * Most likely the allocation failed because
4239 			 * the requested ppa was in use.
4240 			 */
4241 			if (ppa == 0)
4242 				return (EEXIST);
4243 		}
4244 		return (0);
4245 	}
4246 
4247 	/*
4248 	 * No arena is in use and not enough (>ill_no_arena) interfaces have
4249 	 * been plumbed to create one. Do a linear search to get a unused ppa.
4250 	 */
4251 	if (ill->ill_ppa == UINT_MAX) {
4252 		end = UINT_MAX - 1;
4253 		start = 0;
4254 	} else {
4255 		end = start = ill->ill_ppa;
4256 	}
4257 
4258 	tmp_ill = avl_find(&ifp->illif_avl_by_ppa, (void *)&start, NULL);
4259 	while (tmp_ill != NULL && tmp_ill->ill_ppa == start) {
4260 		if (start++ >= end) {
4261 			if (ill->ill_ppa == UINT_MAX)
4262 				return (EAGAIN);
4263 			else
4264 				return (EEXIST);
4265 		}
4266 		tmp_ill = avl_walk(&ifp->illif_avl_by_ppa, tmp_ill, AVL_AFTER);
4267 	}
4268 	ill->ill_ppa = start;
4269 	return (0);
4270 }
4271 
4272 /*
4273  * Insert ill into the list of configured ill's. Once this function completes,
4274  * the ill is globally visible and is available through lookups. More precisely
4275  * this happens after the caller drops the ill_g_lock.
4276  */
4277 static int
4278 ill_glist_insert(ill_t *ill, char *name, boolean_t isv6)
4279 {
4280 	ill_if_t *ill_interface;
4281 	avl_index_t where = 0;
4282 	int error;
4283 	int name_length;
4284 	int index;
4285 	boolean_t check_length = B_FALSE;
4286 	ip_stack_t	*ipst = ill->ill_ipst;
4287 
4288 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
4289 
4290 	name_length = mi_strlen(name) + 1;
4291 
4292 	if (isv6)
4293 		index = IP_V6_G_HEAD;
4294 	else
4295 		index = IP_V4_G_HEAD;
4296 
4297 	ill_interface = IP_VX_ILL_G_LIST(index, ipst);
4298 	/*
4299 	 * Search for interface type based on name
4300 	 */
4301 	while (ill_interface != (ill_if_t *)&IP_VX_ILL_G_LIST(index, ipst)) {
4302 		if ((ill_interface->illif_name_len == name_length) &&
4303 		    (strcmp(ill_interface->illif_name, name) == 0)) {
4304 			break;
4305 		}
4306 		ill_interface = ill_interface->illif_next;
4307 	}
4308 
4309 	/*
4310 	 * Interface type not found, create one.
4311 	 */
4312 	if (ill_interface == (ill_if_t *)&IP_VX_ILL_G_LIST(index, ipst)) {
4313 		ill_g_head_t ghead;
4314 
4315 		/*
4316 		 * allocate ill_if_t structure
4317 		 */
4318 		ill_interface = (ill_if_t *)mi_zalloc(sizeof (ill_if_t));
4319 		if (ill_interface == NULL) {
4320 			return (ENOMEM);
4321 		}
4322 
4323 		(void) strcpy(ill_interface->illif_name, name);
4324 		ill_interface->illif_name_len = name_length;
4325 
4326 		avl_create(&ill_interface->illif_avl_by_ppa,
4327 		    ill_compare_ppa, sizeof (ill_t),
4328 		    offsetof(struct ill_s, ill_avl_byppa));
4329 
4330 		/*
4331 		 * link the structure in the back to maintain order
4332 		 * of configuration for ifconfig output.
4333 		 */
4334 		ghead = ipst->ips_ill_g_heads[index];
4335 		insque(ill_interface, ghead.ill_g_list_tail);
4336 	}
4337 
4338 	if (ill->ill_ppa == UINT_MAX)
4339 		check_length = B_TRUE;
4340 
4341 	error = ill_alloc_ppa(ill_interface, ill);
4342 	if (error != 0) {
4343 		if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
4344 			ill_delete_interface_type(ill->ill_ifptr);
4345 		return (error);
4346 	}
4347 
4348 	/*
4349 	 * When the ppa is choosen by the system, check that there is
4350 	 * enough space to insert ppa. if a specific ppa was passed in this
4351 	 * check is not required as the interface name passed in will have
4352 	 * the right ppa in it.
4353 	 */
4354 	if (check_length) {
4355 		/*
4356 		 * UINT_MAX - 1 should fit in 10 chars, alloc 12 chars.
4357 		 */
4358 		char buf[sizeof (uint_t) * 3];
4359 
4360 		/*
4361 		 * convert ppa to string to calculate the amount of space
4362 		 * required for it in the name.
4363 		 */
4364 		numtos(ill->ill_ppa, buf);
4365 
4366 		/* Do we have enough space to insert ppa ? */
4367 
4368 		if ((mi_strlen(name) + mi_strlen(buf) + 1) > LIFNAMSIZ) {
4369 			/* Free ppa and interface type struct */
4370 			if (ill_interface->illif_ppa_arena != NULL) {
4371 				vmem_free(ill_interface->illif_ppa_arena,
4372 				    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
4373 			}
4374 			if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
4375 				ill_delete_interface_type(ill->ill_ifptr);
4376 
4377 			return (EINVAL);
4378 		}
4379 	}
4380 
4381 	(void) sprintf(ill->ill_name, "%s%u", name, ill->ill_ppa);
4382 	ill->ill_name_length = mi_strlen(ill->ill_name) + 1;
4383 
4384 	(void) avl_find(&ill_interface->illif_avl_by_ppa, &ill->ill_ppa,
4385 	    &where);
4386 	ill->ill_ifptr = ill_interface;
4387 	avl_insert(&ill_interface->illif_avl_by_ppa, ill, where);
4388 
4389 	ill_phyint_reinit(ill);
4390 	return (0);
4391 }
4392 
4393 /* Initialize the per phyint ipsq used for serialization */
4394 static boolean_t
4395 ipsq_init(ill_t *ill, boolean_t enter)
4396 {
4397 	ipsq_t  *ipsq;
4398 	ipxop_t	*ipx;
4399 
4400 	if ((ipsq = kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP)) == NULL)
4401 		return (B_FALSE);
4402 
4403 	ill->ill_phyint->phyint_ipsq = ipsq;
4404 	ipx = ipsq->ipsq_xop = &ipsq->ipsq_ownxop;
4405 	ipx->ipx_ipsq = ipsq;
4406 	ipsq->ipsq_next = ipsq;
4407 	ipsq->ipsq_phyint = ill->ill_phyint;
4408 	mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, 0);
4409 	mutex_init(&ipx->ipx_lock, NULL, MUTEX_DEFAULT, 0);
4410 	ipsq->ipsq_ipst = ill->ill_ipst;	/* No netstack_hold */
4411 	if (enter) {
4412 		ipx->ipx_writer = curthread;
4413 		ipx->ipx_forced = B_FALSE;
4414 		ipx->ipx_reentry_cnt = 1;
4415 #ifdef DEBUG
4416 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
4417 #endif
4418 	}
4419 	return (B_TRUE);
4420 }
4421 
4422 /*
4423  * ill_init is called by ip_open when a device control stream is opened.
4424  * It does a few initializations, and shoots a DL_INFO_REQ message down
4425  * to the driver.  The response is later picked up in ip_rput_dlpi and
4426  * used to set up default mechanisms for talking to the driver.  (Always
4427  * called as writer.)
4428  *
4429  * If this function returns error, ip_open will call ip_close which in
4430  * turn will call ill_delete to clean up any memory allocated here that
4431  * is not yet freed.
4432  */
4433 int
4434 ill_init(queue_t *q, ill_t *ill)
4435 {
4436 	int	count;
4437 	dl_info_req_t	*dlir;
4438 	mblk_t	*info_mp;
4439 	uchar_t *frag_ptr;
4440 
4441 	/*
4442 	 * The ill is initialized to zero by mi_alloc*(). In addition
4443 	 * some fields already contain valid values, initialized in
4444 	 * ip_open(), before we reach here.
4445 	 */
4446 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, 0);
4447 
4448 	ill->ill_rq = q;
4449 	ill->ill_wq = WR(q);
4450 
4451 	info_mp = allocb(MAX(sizeof (dl_info_req_t), sizeof (dl_info_ack_t)),
4452 	    BPRI_HI);
4453 	if (info_mp == NULL)
4454 		return (ENOMEM);
4455 
4456 	/*
4457 	 * Allocate sufficient space to contain our fragment hash table and
4458 	 * the device name.
4459 	 */
4460 	frag_ptr = (uchar_t *)mi_zalloc(ILL_FRAG_HASH_TBL_SIZE +
4461 	    2 * LIFNAMSIZ + 5 + strlen(ipv6_forward_suffix));
4462 	if (frag_ptr == NULL) {
4463 		freemsg(info_mp);
4464 		return (ENOMEM);
4465 	}
4466 	ill->ill_frag_ptr = frag_ptr;
4467 	ill->ill_frag_free_num_pkts = 0;
4468 	ill->ill_last_frag_clean_time = 0;
4469 	ill->ill_frag_hash_tbl = (ipfb_t *)frag_ptr;
4470 	ill->ill_name = (char *)(frag_ptr + ILL_FRAG_HASH_TBL_SIZE);
4471 	for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
4472 		mutex_init(&ill->ill_frag_hash_tbl[count].ipfb_lock,
4473 		    NULL, MUTEX_DEFAULT, NULL);
4474 	}
4475 
4476 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
4477 	if (ill->ill_phyint == NULL) {
4478 		freemsg(info_mp);
4479 		mi_free(frag_ptr);
4480 		return (ENOMEM);
4481 	}
4482 
4483 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
4484 	/*
4485 	 * For now pretend this is a v4 ill. We need to set phyint_ill*
4486 	 * at this point because of the following reason. If we can't
4487 	 * enter the ipsq at some point and cv_wait, the writer that
4488 	 * wakes us up tries to locate us using the list of all phyints
4489 	 * in an ipsq and the ills from the phyint thru the phyint_ill*.
4490 	 * If we don't set it now, we risk a missed wakeup.
4491 	 */
4492 	ill->ill_phyint->phyint_illv4 = ill;
4493 	ill->ill_ppa = UINT_MAX;
4494 	ill->ill_fastpath_list = &ill->ill_fastpath_list;
4495 
4496 	if (!ipsq_init(ill, B_TRUE)) {
4497 		freemsg(info_mp);
4498 		mi_free(frag_ptr);
4499 		mi_free(ill->ill_phyint);
4500 		return (ENOMEM);
4501 	}
4502 
4503 	ill->ill_state_flags |= ILL_LL_SUBNET_PENDING;
4504 
4505 	/* Frag queue limit stuff */
4506 	ill->ill_frag_count = 0;
4507 	ill->ill_ipf_gen = 0;
4508 
4509 	ill->ill_global_timer = INFINITY;
4510 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
4511 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
4512 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
4513 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
4514 
4515 	/*
4516 	 * Initialize IPv6 configuration variables.  The IP module is always
4517 	 * opened as an IPv4 module.  Instead tracking down the cases where
4518 	 * it switches to do ipv6, we'll just initialize the IPv6 configuration
4519 	 * here for convenience, this has no effect until the ill is set to do
4520 	 * IPv6.
4521 	 */
4522 	ill->ill_reachable_time = ND_REACHABLE_TIME;
4523 	ill->ill_reachable_retrans_time = ND_RETRANS_TIMER;
4524 	ill->ill_xmit_count = ND_MAX_MULTICAST_SOLICIT;
4525 	ill->ill_max_buf = ND_MAX_Q;
4526 	ill->ill_refcnt = 0;
4527 
4528 	/* Send down the Info Request to the driver. */
4529 	info_mp->b_datap->db_type = M_PCPROTO;
4530 	dlir = (dl_info_req_t *)info_mp->b_rptr;
4531 	info_mp->b_wptr = (uchar_t *)&dlir[1];
4532 	dlir->dl_primitive = DL_INFO_REQ;
4533 
4534 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
4535 
4536 	qprocson(q);
4537 	ill_dlpi_send(ill, info_mp);
4538 
4539 	return (0);
4540 }
4541 
4542 /*
4543  * ill_dls_info
4544  * creates datalink socket info from the device.
4545  */
4546 int
4547 ill_dls_info(struct sockaddr_dl *sdl, const ipif_t *ipif)
4548 {
4549 	size_t	len;
4550 	ill_t	*ill = ipif->ipif_ill;
4551 
4552 	sdl->sdl_family = AF_LINK;
4553 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
4554 	sdl->sdl_type = ill->ill_type;
4555 	ipif_get_name(ipif, sdl->sdl_data, sizeof (sdl->sdl_data));
4556 	len = strlen(sdl->sdl_data);
4557 	ASSERT(len < 256);
4558 	sdl->sdl_nlen = (uchar_t)len;
4559 	sdl->sdl_alen = ill->ill_phys_addr_length;
4560 	sdl->sdl_slen = 0;
4561 	if (ill->ill_phys_addr_length != 0 && ill->ill_phys_addr != NULL)
4562 		bcopy(ill->ill_phys_addr, &sdl->sdl_data[len], sdl->sdl_alen);
4563 
4564 	return (sizeof (struct sockaddr_dl));
4565 }
4566 
4567 /*
4568  * ill_xarp_info
4569  * creates xarp info from the device.
4570  */
4571 static int
4572 ill_xarp_info(struct sockaddr_dl *sdl, ill_t *ill)
4573 {
4574 	sdl->sdl_family = AF_LINK;
4575 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
4576 	sdl->sdl_type = ill->ill_type;
4577 	ipif_get_name(ill->ill_ipif, sdl->sdl_data, sizeof (sdl->sdl_data));
4578 	sdl->sdl_nlen = (uchar_t)mi_strlen(sdl->sdl_data);
4579 	sdl->sdl_alen = ill->ill_phys_addr_length;
4580 	sdl->sdl_slen = 0;
4581 	return (sdl->sdl_nlen);
4582 }
4583 
4584 static int
4585 loopback_kstat_update(kstat_t *ksp, int rw)
4586 {
4587 	kstat_named_t *kn;
4588 	netstackid_t	stackid;
4589 	netstack_t	*ns;
4590 	ip_stack_t	*ipst;
4591 
4592 	if (ksp == NULL || ksp->ks_data == NULL)
4593 		return (EIO);
4594 
4595 	if (rw == KSTAT_WRITE)
4596 		return (EACCES);
4597 
4598 	kn = KSTAT_NAMED_PTR(ksp);
4599 	stackid = (zoneid_t)(uintptr_t)ksp->ks_private;
4600 
4601 	ns = netstack_find_by_stackid(stackid);
4602 	if (ns == NULL)
4603 		return (-1);
4604 
4605 	ipst = ns->netstack_ip;
4606 	if (ipst == NULL) {
4607 		netstack_rele(ns);
4608 		return (-1);
4609 	}
4610 	kn[0].value.ui32 = ipst->ips_loopback_packets;
4611 	kn[1].value.ui32 = ipst->ips_loopback_packets;
4612 	netstack_rele(ns);
4613 	return (0);
4614 }
4615 
4616 /*
4617  * Has ifindex been plumbed already?
4618  */
4619 boolean_t
4620 phyint_exists(uint_t index, ip_stack_t *ipst)
4621 {
4622 	ASSERT(index != 0);
4623 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
4624 
4625 	return (avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
4626 	    &index, NULL) != NULL);
4627 }
4628 
4629 /* Pick a unique ifindex */
4630 boolean_t
4631 ip_assign_ifindex(uint_t *indexp, ip_stack_t *ipst)
4632 {
4633 	uint_t starting_index;
4634 
4635 	if (!ipst->ips_ill_index_wrap) {
4636 		*indexp = ipst->ips_ill_index++;
4637 		if (ipst->ips_ill_index == 0) {
4638 			/* Reached the uint_t limit Next time wrap  */
4639 			ipst->ips_ill_index_wrap = B_TRUE;
4640 		}
4641 		return (B_TRUE);
4642 	}
4643 
4644 	/*
4645 	 * Start reusing unused indexes. Note that we hold the ill_g_lock
4646 	 * at this point and don't want to call any function that attempts
4647 	 * to get the lock again.
4648 	 */
4649 	starting_index = ipst->ips_ill_index++;
4650 	for (; ipst->ips_ill_index != starting_index; ipst->ips_ill_index++) {
4651 		if (ipst->ips_ill_index != 0 &&
4652 		    !phyint_exists(ipst->ips_ill_index, ipst)) {
4653 			/* found unused index - use it */
4654 			*indexp = ipst->ips_ill_index;
4655 			return (B_TRUE);
4656 		}
4657 	}
4658 
4659 	/*
4660 	 * all interface indicies are inuse.
4661 	 */
4662 	return (B_FALSE);
4663 }
4664 
4665 /*
4666  * Assign a unique interface index for the phyint.
4667  */
4668 static boolean_t
4669 phyint_assign_ifindex(phyint_t *phyi, ip_stack_t *ipst)
4670 {
4671 	ASSERT(phyi->phyint_ifindex == 0);
4672 	return (ip_assign_ifindex(&phyi->phyint_ifindex, ipst));
4673 }
4674 
4675 /*
4676  * Initialize the flags on `phyi' as per the provided mactype.
4677  */
4678 static void
4679 phyint_flags_init(phyint_t *phyi, t_uscalar_t mactype)
4680 {
4681 	uint64_t flags = 0;
4682 
4683 	/*
4684 	 * Initialize PHYI_RUNNING and PHYI_FAILED.  For non-IPMP interfaces,
4685 	 * we always presume the underlying hardware is working and set
4686 	 * PHYI_RUNNING (if it's not, the driver will subsequently send a
4687 	 * DL_NOTE_LINK_DOWN message).  For IPMP interfaces, at initialization
4688 	 * there are no active interfaces in the group so we set PHYI_FAILED.
4689 	 */
4690 	if (mactype == SUNW_DL_IPMP)
4691 		flags |= PHYI_FAILED;
4692 	else
4693 		flags |= PHYI_RUNNING;
4694 
4695 	switch (mactype) {
4696 	case SUNW_DL_VNI:
4697 		flags |= PHYI_VIRTUAL;
4698 		break;
4699 	case SUNW_DL_IPMP:
4700 		flags |= PHYI_IPMP;
4701 		break;
4702 	case DL_LOOP:
4703 		flags |= (PHYI_LOOPBACK | PHYI_VIRTUAL);
4704 		break;
4705 	}
4706 
4707 	mutex_enter(&phyi->phyint_lock);
4708 	phyi->phyint_flags |= flags;
4709 	mutex_exit(&phyi->phyint_lock);
4710 }
4711 
4712 /*
4713  * Return a pointer to the ill which matches the supplied name.  Note that
4714  * the ill name length includes the null termination character.  (May be
4715  * called as writer.)
4716  * If do_alloc and the interface is "lo0" it will be automatically created.
4717  * Cannot bump up reference on condemned ills. So dup detect can't be done
4718  * using this func.
4719  */
4720 ill_t *
4721 ill_lookup_on_name(char *name, boolean_t do_alloc, boolean_t isv6,
4722     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, boolean_t *did_alloc,
4723     ip_stack_t *ipst)
4724 {
4725 	ill_t	*ill;
4726 	ipif_t	*ipif;
4727 	ipsq_t	*ipsq;
4728 	kstat_named_t	*kn;
4729 	boolean_t isloopback;
4730 	in6_addr_t ov6addr;
4731 
4732 	isloopback = mi_strcmp(name, ipif_loopback_name) == 0;
4733 
4734 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4735 	ill = ill_find_by_name(name, isv6, q, mp, func, error, ipst);
4736 	rw_exit(&ipst->ips_ill_g_lock);
4737 	if (ill != NULL || (error != NULL && *error == EINPROGRESS))
4738 		return (ill);
4739 
4740 	/*
4741 	 * Couldn't find it.  Does this happen to be a lookup for the
4742 	 * loopback device and are we allowed to allocate it?
4743 	 */
4744 	if (!isloopback || !do_alloc)
4745 		return (NULL);
4746 
4747 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
4748 
4749 	ill = ill_find_by_name(name, isv6, q, mp, func, error, ipst);
4750 	if (ill != NULL || (error != NULL && *error == EINPROGRESS)) {
4751 		rw_exit(&ipst->ips_ill_g_lock);
4752 		return (ill);
4753 	}
4754 
4755 	/* Create the loopback device on demand */
4756 	ill = (ill_t *)(mi_alloc(sizeof (ill_t) +
4757 	    sizeof (ipif_loopback_name), BPRI_MED));
4758 	if (ill == NULL)
4759 		goto done;
4760 
4761 	*ill = ill_null;
4762 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, NULL);
4763 	ill->ill_ipst = ipst;
4764 	netstack_hold(ipst->ips_netstack);
4765 	/*
4766 	 * For exclusive stacks we set the zoneid to zero
4767 	 * to make IP operate as if in the global zone.
4768 	 */
4769 	ill->ill_zoneid = GLOBAL_ZONEID;
4770 
4771 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
4772 	if (ill->ill_phyint == NULL)
4773 		goto done;
4774 
4775 	if (isv6)
4776 		ill->ill_phyint->phyint_illv6 = ill;
4777 	else
4778 		ill->ill_phyint->phyint_illv4 = ill;
4779 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
4780 	phyint_flags_init(ill->ill_phyint, DL_LOOP);
4781 
4782 	ill->ill_max_frag = IP_LOOPBACK_MTU;
4783 	/* Add room for tcp+ip headers */
4784 	if (isv6) {
4785 		ill->ill_isv6 = B_TRUE;
4786 		ill->ill_max_frag += IPV6_HDR_LEN + 20;	/* for TCP */
4787 	} else {
4788 		ill->ill_max_frag += IP_SIMPLE_HDR_LENGTH + 20;
4789 	}
4790 	if (!ill_allocate_mibs(ill))
4791 		goto done;
4792 	ill->ill_max_mtu = ill->ill_max_frag;
4793 	/*
4794 	 * ipif_loopback_name can't be pointed at directly because its used
4795 	 * by both the ipv4 and ipv6 interfaces.  When the ill is removed
4796 	 * from the glist, ill_glist_delete() sets the first character of
4797 	 * ill_name to '\0'.
4798 	 */
4799 	ill->ill_name = (char *)ill + sizeof (*ill);
4800 	(void) strcpy(ill->ill_name, ipif_loopback_name);
4801 	ill->ill_name_length = sizeof (ipif_loopback_name);
4802 	/* Set ill_dlpi_pending for ipsq_current_finish() to work properly */
4803 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
4804 
4805 	ill->ill_global_timer = INFINITY;
4806 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
4807 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
4808 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
4809 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
4810 
4811 	/* No resolver here. */
4812 	ill->ill_net_type = IRE_LOOPBACK;
4813 
4814 	/* Initialize the ipsq */
4815 	if (!ipsq_init(ill, B_FALSE))
4816 		goto done;
4817 
4818 	ipif = ipif_allocate(ill, 0L, IRE_LOOPBACK, B_TRUE, B_TRUE);
4819 	if (ipif == NULL)
4820 		goto done;
4821 
4822 	ill->ill_flags = ILLF_MULTICAST;
4823 
4824 	ov6addr = ipif->ipif_v6lcl_addr;
4825 	/* Set up default loopback address and mask. */
4826 	if (!isv6) {
4827 		ipaddr_t inaddr_loopback = htonl(INADDR_LOOPBACK);
4828 
4829 		IN6_IPADDR_TO_V4MAPPED(inaddr_loopback, &ipif->ipif_v6lcl_addr);
4830 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
4831 		V4MASK_TO_V6(htonl(IN_CLASSA_NET), ipif->ipif_v6net_mask);
4832 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
4833 		    ipif->ipif_v6subnet);
4834 		ill->ill_flags |= ILLF_IPV4;
4835 	} else {
4836 		ipif->ipif_v6lcl_addr = ipv6_loopback;
4837 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
4838 		ipif->ipif_v6net_mask = ipv6_all_ones;
4839 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
4840 		    ipif->ipif_v6subnet);
4841 		ill->ill_flags |= ILLF_IPV6;
4842 	}
4843 
4844 	/*
4845 	 * Chain us in at the end of the ill list. hold the ill
4846 	 * before we make it globally visible. 1 for the lookup.
4847 	 */
4848 	ill->ill_refcnt = 0;
4849 	ill_refhold(ill);
4850 
4851 	ill->ill_frag_count = 0;
4852 	ill->ill_frag_free_num_pkts = 0;
4853 	ill->ill_last_frag_clean_time = 0;
4854 
4855 	ipsq = ill->ill_phyint->phyint_ipsq;
4856 
4857 	if (ill_glist_insert(ill, "lo", isv6) != 0)
4858 		cmn_err(CE_PANIC, "cannot insert loopback interface");
4859 
4860 	/* Let SCTP know so that it can add this to its list */
4861 	sctp_update_ill(ill, SCTP_ILL_INSERT);
4862 
4863 	/*
4864 	 * We have already assigned ipif_v6lcl_addr above, but we need to
4865 	 * call sctp_update_ipif_addr() after SCTP_ILL_INSERT, which
4866 	 * requires to be after ill_glist_insert() since we need the
4867 	 * ill_index set. Pass on ipv6_loopback as the old address.
4868 	 */
4869 	sctp_update_ipif_addr(ipif, ov6addr);
4870 
4871 	/*
4872 	 * ill_glist_insert() -> ill_phyint_reinit() may have merged IPSQs.
4873 	 * If so, free our original one.
4874 	 */
4875 	if (ipsq != ill->ill_phyint->phyint_ipsq)
4876 		ipsq_delete(ipsq);
4877 
4878 	if (ipst->ips_loopback_ksp == NULL) {
4879 		/* Export loopback interface statistics */
4880 		ipst->ips_loopback_ksp = kstat_create_netstack("lo", 0,
4881 		    ipif_loopback_name, "net",
4882 		    KSTAT_TYPE_NAMED, 2, 0,
4883 		    ipst->ips_netstack->netstack_stackid);
4884 		if (ipst->ips_loopback_ksp != NULL) {
4885 			ipst->ips_loopback_ksp->ks_update =
4886 			    loopback_kstat_update;
4887 			kn = KSTAT_NAMED_PTR(ipst->ips_loopback_ksp);
4888 			kstat_named_init(&kn[0], "ipackets", KSTAT_DATA_UINT32);
4889 			kstat_named_init(&kn[1], "opackets", KSTAT_DATA_UINT32);
4890 			ipst->ips_loopback_ksp->ks_private =
4891 			    (void *)(uintptr_t)ipst->ips_netstack->
4892 			    netstack_stackid;
4893 			kstat_install(ipst->ips_loopback_ksp);
4894 		}
4895 	}
4896 
4897 	if (error != NULL)
4898 		*error = 0;
4899 	*did_alloc = B_TRUE;
4900 	rw_exit(&ipst->ips_ill_g_lock);
4901 	ill_nic_event_dispatch(ill, MAP_IPIF_ID(ill->ill_ipif->ipif_id),
4902 	    NE_PLUMB, ill->ill_name, ill->ill_name_length);
4903 	return (ill);
4904 done:
4905 	if (ill != NULL) {
4906 		if (ill->ill_phyint != NULL) {
4907 			ipsq = ill->ill_phyint->phyint_ipsq;
4908 			if (ipsq != NULL) {
4909 				ipsq->ipsq_phyint = NULL;
4910 				ipsq_delete(ipsq);
4911 			}
4912 			mi_free(ill->ill_phyint);
4913 		}
4914 		ill_free_mib(ill);
4915 		if (ill->ill_ipst != NULL)
4916 			netstack_rele(ill->ill_ipst->ips_netstack);
4917 		mi_free(ill);
4918 	}
4919 	rw_exit(&ipst->ips_ill_g_lock);
4920 	if (error != NULL)
4921 		*error = ENOMEM;
4922 	return (NULL);
4923 }
4924 
4925 /*
4926  * For IPP calls - use the ip_stack_t for global stack.
4927  */
4928 ill_t *
4929 ill_lookup_on_ifindex_global_instance(uint_t index, boolean_t isv6,
4930     queue_t *q, mblk_t *mp, ipsq_func_t func, int *err)
4931 {
4932 	ip_stack_t	*ipst;
4933 	ill_t		*ill;
4934 
4935 	ipst = netstack_find_by_stackid(GLOBAL_NETSTACKID)->netstack_ip;
4936 	if (ipst == NULL) {
4937 		cmn_err(CE_WARN, "No ip_stack_t for zoneid zero!\n");
4938 		return (NULL);
4939 	}
4940 
4941 	ill = ill_lookup_on_ifindex(index, isv6, q, mp, func, err, ipst);
4942 	netstack_rele(ipst->ips_netstack);
4943 	return (ill);
4944 }
4945 
4946 /*
4947  * Return a pointer to the ill which matches the index and IP version type.
4948  */
4949 ill_t *
4950 ill_lookup_on_ifindex(uint_t index, boolean_t isv6, queue_t *q, mblk_t *mp,
4951     ipsq_func_t func, int *err, ip_stack_t *ipst)
4952 {
4953 	ill_t	*ill;
4954 	ipsq_t  *ipsq;
4955 	phyint_t *phyi;
4956 
4957 	ASSERT((q == NULL && mp == NULL && func == NULL && err == NULL) ||
4958 	    (q != NULL && mp != NULL && func != NULL && err != NULL));
4959 
4960 	if (err != NULL)
4961 		*err = 0;
4962 
4963 	/*
4964 	 * Indexes are stored in the phyint - a common structure
4965 	 * to both IPv4 and IPv6.
4966 	 */
4967 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4968 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
4969 	    (void *) &index, NULL);
4970 	if (phyi != NULL) {
4971 		ill = isv6 ? phyi->phyint_illv6: phyi->phyint_illv4;
4972 		if (ill != NULL) {
4973 			/*
4974 			 * The block comment at the start of ipif_down
4975 			 * explains the use of the macros used below
4976 			 */
4977 			GRAB_CONN_LOCK(q);
4978 			mutex_enter(&ill->ill_lock);
4979 			if (ILL_CAN_LOOKUP(ill)) {
4980 				ill_refhold_locked(ill);
4981 				mutex_exit(&ill->ill_lock);
4982 				RELEASE_CONN_LOCK(q);
4983 				rw_exit(&ipst->ips_ill_g_lock);
4984 				return (ill);
4985 			} else if (ILL_CAN_WAIT(ill, q)) {
4986 				ipsq = ill->ill_phyint->phyint_ipsq;
4987 				mutex_enter(&ipsq->ipsq_lock);
4988 				mutex_enter(&ipsq->ipsq_xop->ipx_lock);
4989 				rw_exit(&ipst->ips_ill_g_lock);
4990 				mutex_exit(&ill->ill_lock);
4991 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
4992 				mutex_exit(&ipsq->ipsq_xop->ipx_lock);
4993 				mutex_exit(&ipsq->ipsq_lock);
4994 				RELEASE_CONN_LOCK(q);
4995 				if (err != NULL)
4996 					*err = EINPROGRESS;
4997 				return (NULL);
4998 			}
4999 			RELEASE_CONN_LOCK(q);
5000 			mutex_exit(&ill->ill_lock);
5001 		}
5002 	}
5003 	rw_exit(&ipst->ips_ill_g_lock);
5004 	if (err != NULL)
5005 		*err = ENXIO;
5006 	return (NULL);
5007 }
5008 
5009 /*
5010  * Return the ifindex next in sequence after the passed in ifindex.
5011  * If there is no next ifindex for the given protocol, return 0.
5012  */
5013 uint_t
5014 ill_get_next_ifindex(uint_t index, boolean_t isv6, ip_stack_t *ipst)
5015 {
5016 	phyint_t *phyi;
5017 	phyint_t *phyi_initial;
5018 	uint_t   ifindex;
5019 
5020 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5021 
5022 	if (index == 0) {
5023 		phyi = avl_first(
5024 		    &ipst->ips_phyint_g_list->phyint_list_avl_by_index);
5025 	} else {
5026 		phyi = phyi_initial = avl_find(
5027 		    &ipst->ips_phyint_g_list->phyint_list_avl_by_index,
5028 		    (void *) &index, NULL);
5029 	}
5030 
5031 	for (; phyi != NULL;
5032 	    phyi = avl_walk(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
5033 	    phyi, AVL_AFTER)) {
5034 		/*
5035 		 * If we're not returning the first interface in the tree
5036 		 * and we still haven't moved past the phyint_t that
5037 		 * corresponds to index, avl_walk needs to be called again
5038 		 */
5039 		if (!((index != 0) && (phyi == phyi_initial))) {
5040 			if (isv6) {
5041 				if ((phyi->phyint_illv6) &&
5042 				    ILL_CAN_LOOKUP(phyi->phyint_illv6) &&
5043 				    (phyi->phyint_illv6->ill_isv6 == 1))
5044 					break;
5045 			} else {
5046 				if ((phyi->phyint_illv4) &&
5047 				    ILL_CAN_LOOKUP(phyi->phyint_illv4) &&
5048 				    (phyi->phyint_illv4->ill_isv6 == 0))
5049 					break;
5050 			}
5051 		}
5052 	}
5053 
5054 	rw_exit(&ipst->ips_ill_g_lock);
5055 
5056 	if (phyi != NULL)
5057 		ifindex = phyi->phyint_ifindex;
5058 	else
5059 		ifindex = 0;
5060 
5061 	return (ifindex);
5062 }
5063 
5064 /*
5065  * Return the ifindex for the named interface.
5066  * If there is no next ifindex for the interface, return 0.
5067  */
5068 uint_t
5069 ill_get_ifindex_by_name(char *name, ip_stack_t *ipst)
5070 {
5071 	phyint_t	*phyi;
5072 	avl_index_t	where = 0;
5073 	uint_t		ifindex;
5074 
5075 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5076 
5077 	if ((phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
5078 	    name, &where)) == NULL) {
5079 		rw_exit(&ipst->ips_ill_g_lock);
5080 		return (0);
5081 	}
5082 
5083 	ifindex = phyi->phyint_ifindex;
5084 
5085 	rw_exit(&ipst->ips_ill_g_lock);
5086 
5087 	return (ifindex);
5088 }
5089 
5090 /*
5091  * Obtain a reference to the ill. The ill_refcnt is a dynamic refcnt
5092  * that gives a running thread a reference to the ill. This reference must be
5093  * released by the thread when it is done accessing the ill and related
5094  * objects. ill_refcnt can not be used to account for static references
5095  * such as other structures pointing to an ill. Callers must generally
5096  * check whether an ill can be refheld by using ILL_CAN_LOOKUP macros
5097  * or be sure that the ill is not being deleted or changing state before
5098  * calling the refhold functions. A non-zero ill_refcnt ensures that the
5099  * ill won't change any of its critical state such as address, netmask etc.
5100  */
5101 void
5102 ill_refhold(ill_t *ill)
5103 {
5104 	mutex_enter(&ill->ill_lock);
5105 	ill->ill_refcnt++;
5106 	ILL_TRACE_REF(ill);
5107 	mutex_exit(&ill->ill_lock);
5108 }
5109 
5110 void
5111 ill_refhold_locked(ill_t *ill)
5112 {
5113 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5114 	ill->ill_refcnt++;
5115 	ILL_TRACE_REF(ill);
5116 }
5117 
5118 int
5119 ill_check_and_refhold(ill_t *ill)
5120 {
5121 	mutex_enter(&ill->ill_lock);
5122 	if (ILL_CAN_LOOKUP(ill)) {
5123 		ill_refhold_locked(ill);
5124 		mutex_exit(&ill->ill_lock);
5125 		return (0);
5126 	}
5127 	mutex_exit(&ill->ill_lock);
5128 	return (ILL_LOOKUP_FAILED);
5129 }
5130 
5131 /*
5132  * Must not be called while holding any locks. Otherwise if this is
5133  * the last reference to be released, there is a chance of recursive mutex
5134  * panic due to ill_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
5135  * to restart an ioctl.
5136  */
5137 void
5138 ill_refrele(ill_t *ill)
5139 {
5140 	mutex_enter(&ill->ill_lock);
5141 	ASSERT(ill->ill_refcnt != 0);
5142 	ill->ill_refcnt--;
5143 	ILL_UNTRACE_REF(ill);
5144 	if (ill->ill_refcnt != 0) {
5145 		/* Every ire pointing to the ill adds 1 to ill_refcnt */
5146 		mutex_exit(&ill->ill_lock);
5147 		return;
5148 	}
5149 
5150 	/* Drops the ill_lock */
5151 	ipif_ill_refrele_tail(ill);
5152 }
5153 
5154 /*
5155  * Obtain a weak reference count on the ill. This reference ensures the
5156  * ill won't be freed, but the ill may change any of its critical state
5157  * such as netmask, address etc. Returns an error if the ill has started
5158  * closing.
5159  */
5160 boolean_t
5161 ill_waiter_inc(ill_t *ill)
5162 {
5163 	mutex_enter(&ill->ill_lock);
5164 	if (ill->ill_state_flags & ILL_CONDEMNED) {
5165 		mutex_exit(&ill->ill_lock);
5166 		return (B_FALSE);
5167 	}
5168 	ill->ill_waiters++;
5169 	mutex_exit(&ill->ill_lock);
5170 	return (B_TRUE);
5171 }
5172 
5173 void
5174 ill_waiter_dcr(ill_t *ill)
5175 {
5176 	mutex_enter(&ill->ill_lock);
5177 	ill->ill_waiters--;
5178 	if (ill->ill_waiters == 0)
5179 		cv_broadcast(&ill->ill_cv);
5180 	mutex_exit(&ill->ill_lock);
5181 }
5182 
5183 /*
5184  * ip_ll_subnet_defaults is called when we get the DL_INFO_ACK back from the
5185  * driver.  We construct best guess defaults for lower level information that
5186  * we need.  If an interface is brought up without injection of any overriding
5187  * information from outside, we have to be ready to go with these defaults.
5188  * When we get the first DL_INFO_ACK (from ip_open() sending a DL_INFO_REQ)
5189  * we primarely want the dl_provider_style.
5190  * The subsequent DL_INFO_ACK is received after doing a DL_ATTACH and DL_BIND
5191  * at which point we assume the other part of the information is valid.
5192  */
5193 void
5194 ip_ll_subnet_defaults(ill_t *ill, mblk_t *mp)
5195 {
5196 	uchar_t		*brdcst_addr;
5197 	uint_t		brdcst_addr_length, phys_addr_length;
5198 	t_scalar_t	sap_length;
5199 	dl_info_ack_t	*dlia;
5200 	ip_m_t		*ipm;
5201 	dl_qos_cl_sel1_t *sel1;
5202 	int		min_mtu;
5203 
5204 	ASSERT(IAM_WRITER_ILL(ill));
5205 
5206 	/*
5207 	 * Till the ill is fully up ILL_CHANGING will be set and
5208 	 * the ill is not globally visible. So no need for a lock.
5209 	 */
5210 	dlia = (dl_info_ack_t *)mp->b_rptr;
5211 	ill->ill_mactype = dlia->dl_mac_type;
5212 
5213 	ipm = ip_m_lookup(dlia->dl_mac_type);
5214 	if (ipm == NULL) {
5215 		ipm = ip_m_lookup(DL_OTHER);
5216 		ASSERT(ipm != NULL);
5217 	}
5218 	ill->ill_media = ipm;
5219 
5220 	/*
5221 	 * When the new DLPI stuff is ready we'll pull lengths
5222 	 * from dlia.
5223 	 */
5224 	if (dlia->dl_version == DL_VERSION_2) {
5225 		brdcst_addr_length = dlia->dl_brdcst_addr_length;
5226 		brdcst_addr = mi_offset_param(mp, dlia->dl_brdcst_addr_offset,
5227 		    brdcst_addr_length);
5228 		if (brdcst_addr == NULL) {
5229 			brdcst_addr_length = 0;
5230 		}
5231 		sap_length = dlia->dl_sap_length;
5232 		phys_addr_length = dlia->dl_addr_length - ABS(sap_length);
5233 		ip1dbg(("ip: bcast_len %d, sap_len %d, phys_len %d\n",
5234 		    brdcst_addr_length, sap_length, phys_addr_length));
5235 	} else {
5236 		brdcst_addr_length = 6;
5237 		brdcst_addr = ip_six_byte_all_ones;
5238 		sap_length = -2;
5239 		phys_addr_length = brdcst_addr_length;
5240 	}
5241 
5242 	ill->ill_bcast_addr_length = brdcst_addr_length;
5243 	ill->ill_phys_addr_length = phys_addr_length;
5244 	ill->ill_sap_length = sap_length;
5245 
5246 	/*
5247 	 * Synthetic DLPI types such as SUNW_DL_IPMP specify a zero SDU,
5248 	 * but we must ensure a minimum IP MTU is used since other bits of
5249 	 * IP will fly apart otherwise.
5250 	 */
5251 	min_mtu = ill->ill_isv6 ? IPV6_MIN_MTU : IP_MIN_MTU;
5252 	ill->ill_max_frag  = MAX(min_mtu, dlia->dl_max_sdu);
5253 	ill->ill_max_mtu = ill->ill_max_frag;
5254 
5255 	ill->ill_type = ipm->ip_m_type;
5256 
5257 	if (!ill->ill_dlpi_style_set) {
5258 		if (dlia->dl_provider_style == DL_STYLE2)
5259 			ill->ill_needs_attach = 1;
5260 
5261 		phyint_flags_init(ill->ill_phyint, ill->ill_mactype);
5262 
5263 		/*
5264 		 * Allocate the first ipif on this ill.  We don't delay it
5265 		 * further as ioctl handling assumes at least one ipif exists.
5266 		 *
5267 		 * At this point we don't know whether the ill is v4 or v6.
5268 		 * We will know this whan the SIOCSLIFNAME happens and
5269 		 * the correct value for ill_isv6 will be assigned in
5270 		 * ipif_set_values(). We need to hold the ill lock and
5271 		 * clear the ILL_LL_SUBNET_PENDING flag and atomically do
5272 		 * the wakeup.
5273 		 */
5274 		(void) ipif_allocate(ill, 0, IRE_LOCAL,
5275 		    dlia->dl_provider_style != DL_STYLE2, B_TRUE);
5276 		mutex_enter(&ill->ill_lock);
5277 		ASSERT(ill->ill_dlpi_style_set == 0);
5278 		ill->ill_dlpi_style_set = 1;
5279 		ill->ill_state_flags &= ~ILL_LL_SUBNET_PENDING;
5280 		cv_broadcast(&ill->ill_cv);
5281 		mutex_exit(&ill->ill_lock);
5282 		freemsg(mp);
5283 		return;
5284 	}
5285 	ASSERT(ill->ill_ipif != NULL);
5286 	/*
5287 	 * We know whether it is IPv4 or IPv6 now, as this is the
5288 	 * second DL_INFO_ACK we are recieving in response to the
5289 	 * DL_INFO_REQ sent in ipif_set_values.
5290 	 */
5291 	if (ill->ill_isv6)
5292 		ill->ill_sap = IP6_DL_SAP;
5293 	else
5294 		ill->ill_sap = IP_DL_SAP;
5295 	/*
5296 	 * Set ipif_mtu which is used to set the IRE's
5297 	 * ire_max_frag value. The driver could have sent
5298 	 * a different mtu from what it sent last time. No
5299 	 * need to call ipif_mtu_change because IREs have
5300 	 * not yet been created.
5301 	 */
5302 	ill->ill_ipif->ipif_mtu = ill->ill_max_mtu;
5303 	/*
5304 	 * Clear all the flags that were set based on ill_bcast_addr_length
5305 	 * and ill_phys_addr_length (in ipif_set_values) as these could have
5306 	 * changed now and we need to re-evaluate.
5307 	 */
5308 	ill->ill_flags &= ~(ILLF_MULTICAST | ILLF_NONUD | ILLF_NOARP);
5309 	ill->ill_ipif->ipif_flags &= ~(IPIF_BROADCAST | IPIF_POINTOPOINT);
5310 
5311 	/*
5312 	 * Free ill_resolver_mp and ill_bcast_mp as things could have
5313 	 * changed now.
5314 	 *
5315 	 * NOTE: The IPMP meta-interface is special-cased because it starts
5316 	 * with no underlying interfaces (and thus an unknown broadcast
5317 	 * address length), but we enforce that an interface is broadcast-
5318 	 * capable as part of allowing it to join a group.
5319 	 */
5320 	if (ill->ill_bcast_addr_length == 0 && !IS_IPMP(ill)) {
5321 		if (ill->ill_resolver_mp != NULL)
5322 			freemsg(ill->ill_resolver_mp);
5323 		if (ill->ill_bcast_mp != NULL)
5324 			freemsg(ill->ill_bcast_mp);
5325 		if (ill->ill_flags & ILLF_XRESOLV)
5326 			ill->ill_net_type = IRE_IF_RESOLVER;
5327 		else
5328 			ill->ill_net_type = IRE_IF_NORESOLVER;
5329 		ill->ill_resolver_mp = ill_dlur_gen(NULL,
5330 		    ill->ill_phys_addr_length,
5331 		    ill->ill_sap,
5332 		    ill->ill_sap_length);
5333 		ill->ill_bcast_mp = copymsg(ill->ill_resolver_mp);
5334 
5335 		if (ill->ill_isv6)
5336 			/*
5337 			 * Note: xresolv interfaces will eventually need NOARP
5338 			 * set here as well, but that will require those
5339 			 * external resolvers to have some knowledge of
5340 			 * that flag and act appropriately. Not to be changed
5341 			 * at present.
5342 			 */
5343 			ill->ill_flags |= ILLF_NONUD;
5344 		else
5345 			ill->ill_flags |= ILLF_NOARP;
5346 
5347 		if (ill->ill_phys_addr_length == 0) {
5348 			if (ill->ill_media->ip_m_mac_type == SUNW_DL_VNI) {
5349 				ill->ill_ipif->ipif_flags |= IPIF_NOXMIT;
5350 			} else {
5351 				/* pt-pt supports multicast. */
5352 				ill->ill_flags |= ILLF_MULTICAST;
5353 				ill->ill_ipif->ipif_flags |= IPIF_POINTOPOINT;
5354 			}
5355 		}
5356 	} else {
5357 		ill->ill_net_type = IRE_IF_RESOLVER;
5358 		if (ill->ill_bcast_mp != NULL)
5359 			freemsg(ill->ill_bcast_mp);
5360 		ill->ill_bcast_mp = ill_dlur_gen(brdcst_addr,
5361 		    ill->ill_bcast_addr_length, ill->ill_sap,
5362 		    ill->ill_sap_length);
5363 		/*
5364 		 * Later detect lack of DLPI driver multicast
5365 		 * capability by catching DL_ENABMULTI errors in
5366 		 * ip_rput_dlpi.
5367 		 */
5368 		ill->ill_flags |= ILLF_MULTICAST;
5369 		if (!ill->ill_isv6)
5370 			ill->ill_ipif->ipif_flags |= IPIF_BROADCAST;
5371 	}
5372 
5373 	/* For IPMP, PHYI_IPMP should already be set by phyint_flags_init() */
5374 	if (ill->ill_mactype == SUNW_DL_IPMP)
5375 		ASSERT(ill->ill_phyint->phyint_flags & PHYI_IPMP);
5376 
5377 	/* By default an interface does not support any CoS marking */
5378 	ill->ill_flags &= ~ILLF_COS_ENABLED;
5379 
5380 	/*
5381 	 * If we get QoS information in DL_INFO_ACK, the device supports
5382 	 * some form of CoS marking, set ILLF_COS_ENABLED.
5383 	 */
5384 	sel1 = (dl_qos_cl_sel1_t *)mi_offset_param(mp, dlia->dl_qos_offset,
5385 	    dlia->dl_qos_length);
5386 	if ((sel1 != NULL) && (sel1->dl_qos_type == DL_QOS_CL_SEL1)) {
5387 		ill->ill_flags |= ILLF_COS_ENABLED;
5388 	}
5389 
5390 	/* Clear any previous error indication. */
5391 	ill->ill_error = 0;
5392 	freemsg(mp);
5393 }
5394 
5395 /*
5396  * Perform various checks to verify that an address would make sense as a
5397  * local, remote, or subnet interface address.
5398  */
5399 static boolean_t
5400 ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask)
5401 {
5402 	ipaddr_t	net_mask;
5403 
5404 	/*
5405 	 * Don't allow all zeroes, or all ones, but allow
5406 	 * all ones netmask.
5407 	 */
5408 	if ((net_mask = ip_net_mask(addr)) == 0)
5409 		return (B_FALSE);
5410 	/* A given netmask overrides the "guess" netmask */
5411 	if (subnet_mask != 0)
5412 		net_mask = subnet_mask;
5413 	if ((net_mask != ~(ipaddr_t)0) && ((addr == (addr & net_mask)) ||
5414 	    (addr == (addr | ~net_mask)))) {
5415 		return (B_FALSE);
5416 	}
5417 
5418 	/*
5419 	 * Even if the netmask is all ones, we do not allow address to be
5420 	 * 255.255.255.255
5421 	 */
5422 	if (addr == INADDR_BROADCAST)
5423 		return (B_FALSE);
5424 
5425 	if (CLASSD(addr))
5426 		return (B_FALSE);
5427 
5428 	return (B_TRUE);
5429 }
5430 
5431 #define	V6_IPIF_LINKLOCAL(p)	\
5432 	IN6_IS_ADDR_LINKLOCAL(&(p)->ipif_v6lcl_addr)
5433 
5434 /*
5435  * Compare two given ipifs and check if the second one is better than
5436  * the first one using the order of preference (not taking deprecated
5437  * into acount) specified in ipif_lookup_multicast().
5438  */
5439 static boolean_t
5440 ipif_comp_multi(ipif_t *old_ipif, ipif_t *new_ipif, boolean_t isv6)
5441 {
5442 	/* Check the least preferred first. */
5443 	if (IS_LOOPBACK(old_ipif->ipif_ill)) {
5444 		/* If both ipifs are the same, use the first one. */
5445 		if (IS_LOOPBACK(new_ipif->ipif_ill))
5446 			return (B_FALSE);
5447 		else
5448 			return (B_TRUE);
5449 	}
5450 
5451 	/* For IPv6, check for link local address. */
5452 	if (isv6 && V6_IPIF_LINKLOCAL(old_ipif)) {
5453 		if (IS_LOOPBACK(new_ipif->ipif_ill) ||
5454 		    V6_IPIF_LINKLOCAL(new_ipif)) {
5455 			/* The second one is equal or less preferred. */
5456 			return (B_FALSE);
5457 		} else {
5458 			return (B_TRUE);
5459 		}
5460 	}
5461 
5462 	/* Then check for point to point interface. */
5463 	if (old_ipif->ipif_flags & IPIF_POINTOPOINT) {
5464 		if (IS_LOOPBACK(new_ipif->ipif_ill) ||
5465 		    (isv6 && V6_IPIF_LINKLOCAL(new_ipif)) ||
5466 		    (new_ipif->ipif_flags & IPIF_POINTOPOINT)) {
5467 			return (B_FALSE);
5468 		} else {
5469 			return (B_TRUE);
5470 		}
5471 	}
5472 
5473 	/* old_ipif is a normal interface, so no need to use the new one. */
5474 	return (B_FALSE);
5475 }
5476 
5477 /*
5478  * Find a mulitcast-capable ipif given an IP instance and zoneid.
5479  * The ipif must be up, and its ill must multicast-capable, not
5480  * condemned, not an underlying interface in an IPMP group, and
5481  * not a VNI interface.  Order of preference:
5482  *
5483  * 	1a. normal
5484  * 	1b. normal, but deprecated
5485  * 	2a. point to point
5486  * 	2b. point to point, but deprecated
5487  * 	3a. link local
5488  * 	3b. link local, but deprecated
5489  * 	4. loopback.
5490  */
5491 ipif_t *
5492 ipif_lookup_multicast(ip_stack_t *ipst, zoneid_t zoneid, boolean_t isv6)
5493 {
5494 	ill_t			*ill;
5495 	ill_walk_context_t	ctx;
5496 	ipif_t			*ipif;
5497 	ipif_t			*saved_ipif = NULL;
5498 	ipif_t			*dep_ipif = NULL;
5499 
5500 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5501 	if (isv6)
5502 		ill = ILL_START_WALK_V6(&ctx, ipst);
5503 	else
5504 		ill = ILL_START_WALK_V4(&ctx, ipst);
5505 
5506 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5507 		mutex_enter(&ill->ill_lock);
5508 		if (IS_VNI(ill) || IS_UNDER_IPMP(ill) || !ILL_CAN_LOOKUP(ill) ||
5509 		    !(ill->ill_flags & ILLF_MULTICAST)) {
5510 			mutex_exit(&ill->ill_lock);
5511 			continue;
5512 		}
5513 		for (ipif = ill->ill_ipif; ipif != NULL;
5514 		    ipif = ipif->ipif_next) {
5515 			if (zoneid != ipif->ipif_zoneid &&
5516 			    zoneid != ALL_ZONES &&
5517 			    ipif->ipif_zoneid != ALL_ZONES) {
5518 				continue;
5519 			}
5520 			if (!(ipif->ipif_flags & IPIF_UP) ||
5521 			    !IPIF_CAN_LOOKUP(ipif)) {
5522 				continue;
5523 			}
5524 
5525 			/*
5526 			 * Found one candidate.  If it is deprecated,
5527 			 * remember it in dep_ipif.  If it is not deprecated,
5528 			 * remember it in saved_ipif.
5529 			 */
5530 			if (ipif->ipif_flags & IPIF_DEPRECATED) {
5531 				if (dep_ipif == NULL) {
5532 					dep_ipif = ipif;
5533 				} else if (ipif_comp_multi(dep_ipif, ipif,
5534 				    isv6)) {
5535 					/*
5536 					 * If the previous dep_ipif does not
5537 					 * belong to the same ill, we've done
5538 					 * a ipif_refhold() on it.  So we need
5539 					 * to release it.
5540 					 */
5541 					if (dep_ipif->ipif_ill != ill)
5542 						ipif_refrele(dep_ipif);
5543 					dep_ipif = ipif;
5544 				}
5545 				continue;
5546 			}
5547 			if (saved_ipif == NULL) {
5548 				saved_ipif = ipif;
5549 			} else {
5550 				if (ipif_comp_multi(saved_ipif, ipif, isv6)) {
5551 					if (saved_ipif->ipif_ill != ill)
5552 						ipif_refrele(saved_ipif);
5553 					saved_ipif = ipif;
5554 				}
5555 			}
5556 		}
5557 		/*
5558 		 * Before going to the next ill, do a ipif_refhold() on the
5559 		 * saved ones.
5560 		 */
5561 		if (saved_ipif != NULL && saved_ipif->ipif_ill == ill)
5562 			ipif_refhold_locked(saved_ipif);
5563 		if (dep_ipif != NULL && dep_ipif->ipif_ill == ill)
5564 			ipif_refhold_locked(dep_ipif);
5565 		mutex_exit(&ill->ill_lock);
5566 	}
5567 	rw_exit(&ipst->ips_ill_g_lock);
5568 
5569 	/*
5570 	 * If we have only the saved_ipif, return it.  But if we have both
5571 	 * saved_ipif and dep_ipif, check to see which one is better.
5572 	 */
5573 	if (saved_ipif != NULL) {
5574 		if (dep_ipif != NULL) {
5575 			if (ipif_comp_multi(saved_ipif, dep_ipif, isv6)) {
5576 				ipif_refrele(saved_ipif);
5577 				return (dep_ipif);
5578 			} else {
5579 				ipif_refrele(dep_ipif);
5580 				return (saved_ipif);
5581 			}
5582 		}
5583 		return (saved_ipif);
5584 	} else {
5585 		return (dep_ipif);
5586 	}
5587 }
5588 
5589 /*
5590  * This function is called when an application does not specify an interface
5591  * to be used for multicast traffic (joining a group/sending data).  It
5592  * calls ire_lookup_multi() to look for an interface route for the
5593  * specified multicast group.  Doing this allows the administrator to add
5594  * prefix routes for multicast to indicate which interface to be used for
5595  * multicast traffic in the above scenario.  The route could be for all
5596  * multicast (224.0/4), for a single multicast group (a /32 route) or
5597  * anything in between.  If there is no such multicast route, we just find
5598  * any multicast capable interface and return it.  The returned ipif
5599  * is refhold'ed.
5600  */
5601 ipif_t *
5602 ipif_lookup_group(ipaddr_t group, zoneid_t zoneid, ip_stack_t *ipst)
5603 {
5604 	ire_t			*ire;
5605 	ipif_t			*ipif;
5606 
5607 	ire = ire_lookup_multi(group, zoneid, ipst);
5608 	if (ire != NULL) {
5609 		ipif = ire->ire_ipif;
5610 		ipif_refhold(ipif);
5611 		ire_refrele(ire);
5612 		return (ipif);
5613 	}
5614 
5615 	return (ipif_lookup_multicast(ipst, zoneid, B_FALSE));
5616 }
5617 
5618 /*
5619  * Look for an ipif with the specified interface address and destination.
5620  * The destination address is used only for matching point-to-point interfaces.
5621  */
5622 ipif_t *
5623 ipif_lookup_interface(ipaddr_t if_addr, ipaddr_t dst, queue_t *q, mblk_t *mp,
5624     ipsq_func_t func, int *error, ip_stack_t *ipst)
5625 {
5626 	ipif_t	*ipif;
5627 	ill_t	*ill;
5628 	ill_walk_context_t ctx;
5629 	ipsq_t	*ipsq;
5630 
5631 	if (error != NULL)
5632 		*error = 0;
5633 
5634 	/*
5635 	 * First match all the point-to-point interfaces
5636 	 * before looking at non-point-to-point interfaces.
5637 	 * This is done to avoid returning non-point-to-point
5638 	 * ipif instead of unnumbered point-to-point ipif.
5639 	 */
5640 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5641 	ill = ILL_START_WALK_V4(&ctx, ipst);
5642 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5643 		GRAB_CONN_LOCK(q);
5644 		mutex_enter(&ill->ill_lock);
5645 		for (ipif = ill->ill_ipif; ipif != NULL;
5646 		    ipif = ipif->ipif_next) {
5647 			/* Allow the ipif to be down */
5648 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
5649 			    (ipif->ipif_lcl_addr == if_addr) &&
5650 			    (ipif->ipif_pp_dst_addr == dst)) {
5651 				/*
5652 				 * The block comment at the start of ipif_down
5653 				 * explains the use of the macros used below
5654 				 */
5655 				if (IPIF_CAN_LOOKUP(ipif)) {
5656 					ipif_refhold_locked(ipif);
5657 					mutex_exit(&ill->ill_lock);
5658 					RELEASE_CONN_LOCK(q);
5659 					rw_exit(&ipst->ips_ill_g_lock);
5660 					return (ipif);
5661 				} else if (IPIF_CAN_WAIT(ipif, q)) {
5662 					ipsq = ill->ill_phyint->phyint_ipsq;
5663 					mutex_enter(&ipsq->ipsq_lock);
5664 					mutex_enter(&ipsq->ipsq_xop->ipx_lock);
5665 					mutex_exit(&ill->ill_lock);
5666 					rw_exit(&ipst->ips_ill_g_lock);
5667 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
5668 					    ill);
5669 					mutex_exit(&ipsq->ipsq_xop->ipx_lock);
5670 					mutex_exit(&ipsq->ipsq_lock);
5671 					RELEASE_CONN_LOCK(q);
5672 					if (error != NULL)
5673 						*error = EINPROGRESS;
5674 					return (NULL);
5675 				}
5676 			}
5677 		}
5678 		mutex_exit(&ill->ill_lock);
5679 		RELEASE_CONN_LOCK(q);
5680 	}
5681 	rw_exit(&ipst->ips_ill_g_lock);
5682 
5683 	/* lookup the ipif based on interface address */
5684 	ipif = ipif_lookup_addr(if_addr, NULL, ALL_ZONES, q, mp, func, error,
5685 	    ipst);
5686 	ASSERT(ipif == NULL || !ipif->ipif_isv6);
5687 	return (ipif);
5688 }
5689 
5690 /*
5691  * Common function for ipif_lookup_addr() and ipif_lookup_addr_exact().
5692  */
5693 static ipif_t *
5694 ipif_lookup_addr_common(ipaddr_t addr, ill_t *match_ill, boolean_t match_illgrp,
5695     zoneid_t zoneid, queue_t *q, mblk_t *mp, ipsq_func_t func, int *error,
5696     ip_stack_t *ipst)
5697 {
5698 	ipif_t  *ipif;
5699 	ill_t   *ill;
5700 	boolean_t ptp = B_FALSE;
5701 	ipsq_t	*ipsq;
5702 	ill_walk_context_t	ctx;
5703 
5704 	if (error != NULL)
5705 		*error = 0;
5706 
5707 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5708 	/*
5709 	 * Repeat twice, first based on local addresses and
5710 	 * next time for pointopoint.
5711 	 */
5712 repeat:
5713 	ill = ILL_START_WALK_V4(&ctx, ipst);
5714 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5715 		if (match_ill != NULL && ill != match_ill &&
5716 		    (!match_illgrp || !IS_IN_SAME_ILLGRP(ill, match_ill))) {
5717 			continue;
5718 		}
5719 		GRAB_CONN_LOCK(q);
5720 		mutex_enter(&ill->ill_lock);
5721 		for (ipif = ill->ill_ipif; ipif != NULL;
5722 		    ipif = ipif->ipif_next) {
5723 			if (zoneid != ALL_ZONES &&
5724 			    zoneid != ipif->ipif_zoneid &&
5725 			    ipif->ipif_zoneid != ALL_ZONES)
5726 				continue;
5727 			/* Allow the ipif to be down */
5728 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
5729 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
5730 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
5731 			    (ipif->ipif_pp_dst_addr == addr))) {
5732 				/*
5733 				 * The block comment at the start of ipif_down
5734 				 * explains the use of the macros used below
5735 				 */
5736 				if (IPIF_CAN_LOOKUP(ipif)) {
5737 					ipif_refhold_locked(ipif);
5738 					mutex_exit(&ill->ill_lock);
5739 					RELEASE_CONN_LOCK(q);
5740 					rw_exit(&ipst->ips_ill_g_lock);
5741 					return (ipif);
5742 				} else if (IPIF_CAN_WAIT(ipif, q)) {
5743 					ipsq = ill->ill_phyint->phyint_ipsq;
5744 					mutex_enter(&ipsq->ipsq_lock);
5745 					mutex_enter(&ipsq->ipsq_xop->ipx_lock);
5746 					mutex_exit(&ill->ill_lock);
5747 					rw_exit(&ipst->ips_ill_g_lock);
5748 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
5749 					    ill);
5750 					mutex_exit(&ipsq->ipsq_xop->ipx_lock);
5751 					mutex_exit(&ipsq->ipsq_lock);
5752 					RELEASE_CONN_LOCK(q);
5753 					if (error != NULL)
5754 						*error = EINPROGRESS;
5755 					return (NULL);
5756 				}
5757 			}
5758 		}
5759 		mutex_exit(&ill->ill_lock);
5760 		RELEASE_CONN_LOCK(q);
5761 	}
5762 
5763 	/* If we already did the ptp case, then we are done */
5764 	if (ptp) {
5765 		rw_exit(&ipst->ips_ill_g_lock);
5766 		if (error != NULL)
5767 			*error = ENXIO;
5768 		return (NULL);
5769 	}
5770 	ptp = B_TRUE;
5771 	goto repeat;
5772 }
5773 
5774 /*
5775  * Check if the address exists in the system.
5776  * We don't hold the conn_lock as we will not perform defered ipsqueue
5777  * operation.
5778  */
5779 boolean_t
5780 ip_addr_exists(ipaddr_t addr, zoneid_t zoneid, ip_stack_t *ipst)
5781 {
5782 	ipif_t  *ipif;
5783 	ill_t   *ill;
5784 	ill_walk_context_t	ctx;
5785 
5786 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5787 
5788 	ill = ILL_START_WALK_V4(&ctx, ipst);
5789 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5790 		mutex_enter(&ill->ill_lock);
5791 		for (ipif = ill->ill_ipif; ipif != NULL;
5792 		    ipif = ipif->ipif_next) {
5793 			if (zoneid != ALL_ZONES &&
5794 			    zoneid != ipif->ipif_zoneid &&
5795 			    ipif->ipif_zoneid != ALL_ZONES)
5796 				continue;
5797 			/* Allow the ipif to be down */
5798 			/*
5799 			 * XXX Different from ipif_lookup_addr(), we don't do
5800 			 * twice lookups. As from bind()'s point of view, we
5801 			 * may return once we find a match.
5802 			 */
5803 			if (((ipif->ipif_lcl_addr == addr) &&
5804 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
5805 			    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
5806 			    (ipif->ipif_pp_dst_addr == addr))) {
5807 				/*
5808 				 * Allow bind() to be successful even if the
5809 				 * ipif is with IPIF_CHANGING bit set.
5810 				 */
5811 				mutex_exit(&ill->ill_lock);
5812 				rw_exit(&ipst->ips_ill_g_lock);
5813 				return (B_TRUE);
5814 			}
5815 		}
5816 		mutex_exit(&ill->ill_lock);
5817 	}
5818 
5819 	rw_exit(&ipst->ips_ill_g_lock);
5820 	return (B_FALSE);
5821 }
5822 
5823 /*
5824  * Lookup an ipif with the specified address.  For point-to-point links we
5825  * look for matches on either the destination address or the local address,
5826  * but we skip the local address check if IPIF_UNNUMBERED is set.  If the
5827  * `match_ill' argument is non-NULL, the lookup is restricted to that ill
5828  * (or illgrp if `match_ill' is in an IPMP group).
5829  */
5830 ipif_t *
5831 ipif_lookup_addr(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid, queue_t *q,
5832     mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst)
5833 {
5834 	return (ipif_lookup_addr_common(addr, match_ill, B_TRUE, zoneid, q, mp,
5835 	    func, error, ipst));
5836 }
5837 
5838 /*
5839  * Special abbreviated version of ipif_lookup_addr() that doesn't match
5840  * `match_ill' across the IPMP group.  This function is only needed in some
5841  * corner-cases; almost everything should use ipif_lookup_addr().
5842  */
5843 static ipif_t *
5844 ipif_lookup_addr_exact(ipaddr_t addr, ill_t *match_ill, ip_stack_t *ipst)
5845 {
5846 	ASSERT(match_ill != NULL);
5847 	return (ipif_lookup_addr_common(addr, match_ill, B_FALSE, ALL_ZONES,
5848 	    NULL, NULL, NULL, NULL, ipst));
5849 }
5850 
5851 /*
5852  * Look for an ipif with the specified address. For point-point links
5853  * we look for matches on either the destination address and the local
5854  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
5855  * is set.
5856  * If the `match_ill' argument is non-NULL, the lookup is restricted to that
5857  * ill (or illgrp if `match_ill' is in an IPMP group).
5858  * Return the zoneid for the ipif which matches. ALL_ZONES if no match.
5859  */
5860 zoneid_t
5861 ipif_lookup_addr_zoneid(ipaddr_t addr, ill_t *match_ill, ip_stack_t *ipst)
5862 {
5863 	zoneid_t zoneid;
5864 	ipif_t  *ipif;
5865 	ill_t   *ill;
5866 	boolean_t ptp = B_FALSE;
5867 	ill_walk_context_t	ctx;
5868 
5869 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5870 	/*
5871 	 * Repeat twice, first based on local addresses and
5872 	 * next time for pointopoint.
5873 	 */
5874 repeat:
5875 	ill = ILL_START_WALK_V4(&ctx, ipst);
5876 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5877 		if (match_ill != NULL && ill != match_ill &&
5878 		    !IS_IN_SAME_ILLGRP(ill, match_ill)) {
5879 			continue;
5880 		}
5881 		mutex_enter(&ill->ill_lock);
5882 		for (ipif = ill->ill_ipif; ipif != NULL;
5883 		    ipif = ipif->ipif_next) {
5884 			/* Allow the ipif to be down */
5885 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
5886 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
5887 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
5888 			    (ipif->ipif_pp_dst_addr == addr)) &&
5889 			    !(ipif->ipif_state_flags & IPIF_CONDEMNED)) {
5890 				zoneid = ipif->ipif_zoneid;
5891 				mutex_exit(&ill->ill_lock);
5892 				rw_exit(&ipst->ips_ill_g_lock);
5893 				/*
5894 				 * If ipif_zoneid was ALL_ZONES then we have
5895 				 * a trusted extensions shared IP address.
5896 				 * In that case GLOBAL_ZONEID works to send.
5897 				 */
5898 				if (zoneid == ALL_ZONES)
5899 					zoneid = GLOBAL_ZONEID;
5900 				return (zoneid);
5901 			}
5902 		}
5903 		mutex_exit(&ill->ill_lock);
5904 	}
5905 
5906 	/* If we already did the ptp case, then we are done */
5907 	if (ptp) {
5908 		rw_exit(&ipst->ips_ill_g_lock);
5909 		return (ALL_ZONES);
5910 	}
5911 	ptp = B_TRUE;
5912 	goto repeat;
5913 }
5914 
5915 /*
5916  * Look for an ipif that matches the specified remote address i.e. the
5917  * ipif that would receive the specified packet.
5918  * First look for directly connected interfaces and then do a recursive
5919  * IRE lookup and pick the first ipif corresponding to the source address in the
5920  * ire.
5921  * Returns: held ipif
5922  */
5923 ipif_t *
5924 ipif_lookup_remote(ill_t *ill, ipaddr_t addr, zoneid_t zoneid)
5925 {
5926 	ipif_t	*ipif;
5927 	ire_t	*ire;
5928 	ip_stack_t	*ipst = ill->ill_ipst;
5929 
5930 	ASSERT(!ill->ill_isv6);
5931 
5932 	/*
5933 	 * Someone could be changing this ipif currently or change it
5934 	 * after we return this. Thus  a few packets could use the old
5935 	 * old values. However structure updates/creates (ire, ilg, ilm etc)
5936 	 * will atomically be updated or cleaned up with the new value
5937 	 * Thus we don't need a lock to check the flags or other attrs below.
5938 	 */
5939 	mutex_enter(&ill->ill_lock);
5940 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
5941 		if (!IPIF_CAN_LOOKUP(ipif))
5942 			continue;
5943 		if (zoneid != ALL_ZONES && zoneid != ipif->ipif_zoneid &&
5944 		    ipif->ipif_zoneid != ALL_ZONES)
5945 			continue;
5946 		/* Allow the ipif to be down */
5947 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
5948 			if ((ipif->ipif_pp_dst_addr == addr) ||
5949 			    (!(ipif->ipif_flags & IPIF_UNNUMBERED) &&
5950 			    ipif->ipif_lcl_addr == addr)) {
5951 				ipif_refhold_locked(ipif);
5952 				mutex_exit(&ill->ill_lock);
5953 				return (ipif);
5954 			}
5955 		} else if (ipif->ipif_subnet == (addr & ipif->ipif_net_mask)) {
5956 			ipif_refhold_locked(ipif);
5957 			mutex_exit(&ill->ill_lock);
5958 			return (ipif);
5959 		}
5960 	}
5961 	mutex_exit(&ill->ill_lock);
5962 	ire = ire_route_lookup(addr, 0, 0, 0, NULL, NULL, zoneid,
5963 	    NULL, MATCH_IRE_RECURSIVE, ipst);
5964 	if (ire != NULL) {
5965 		/*
5966 		 * The callers of this function wants to know the
5967 		 * interface on which they have to send the replies
5968 		 * back. For IREs that have ire_stq and ire_ipif
5969 		 * derived from different ills, we really don't care
5970 		 * what we return here.
5971 		 */
5972 		ipif = ire->ire_ipif;
5973 		if (ipif != NULL) {
5974 			ipif_refhold(ipif);
5975 			ire_refrele(ire);
5976 			return (ipif);
5977 		}
5978 		ire_refrele(ire);
5979 	}
5980 	/* Pick the first interface */
5981 	ipif = ipif_get_next_ipif(NULL, ill);
5982 	return (ipif);
5983 }
5984 
5985 /*
5986  * This func does not prevent refcnt from increasing. But if
5987  * the caller has taken steps to that effect, then this func
5988  * can be used to determine whether the ill has become quiescent
5989  */
5990 static boolean_t
5991 ill_is_quiescent(ill_t *ill)
5992 {
5993 	ipif_t	*ipif;
5994 
5995 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5996 
5997 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
5998 		if (ipif->ipif_refcnt != 0 || !IPIF_DOWN_OK(ipif)) {
5999 			return (B_FALSE);
6000 		}
6001 	}
6002 	if (!ILL_DOWN_OK(ill) || ill->ill_refcnt != 0) {
6003 		return (B_FALSE);
6004 	}
6005 	return (B_TRUE);
6006 }
6007 
6008 boolean_t
6009 ill_is_freeable(ill_t *ill)
6010 {
6011 	ipif_t	*ipif;
6012 
6013 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6014 
6015 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
6016 		if (ipif->ipif_refcnt != 0 || !IPIF_FREE_OK(ipif)) {
6017 			return (B_FALSE);
6018 		}
6019 	}
6020 	if (!ILL_FREE_OK(ill) || ill->ill_refcnt != 0) {
6021 		return (B_FALSE);
6022 	}
6023 	return (B_TRUE);
6024 }
6025 
6026 /*
6027  * This func does not prevent refcnt from increasing. But if
6028  * the caller has taken steps to that effect, then this func
6029  * can be used to determine whether the ipif has become quiescent
6030  */
6031 static boolean_t
6032 ipif_is_quiescent(ipif_t *ipif)
6033 {
6034 	ill_t *ill;
6035 
6036 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6037 
6038 	if (ipif->ipif_refcnt != 0 || !IPIF_DOWN_OK(ipif)) {
6039 		return (B_FALSE);
6040 	}
6041 
6042 	ill = ipif->ipif_ill;
6043 	if (ill->ill_ipif_up_count != 0 || ill->ill_ipif_dup_count != 0 ||
6044 	    ill->ill_logical_down) {
6045 		return (B_TRUE);
6046 	}
6047 
6048 	/* This is the last ipif going down or being deleted on this ill */
6049 	if (!ILL_DOWN_OK(ill) || ill->ill_refcnt != 0) {
6050 		return (B_FALSE);
6051 	}
6052 
6053 	return (B_TRUE);
6054 }
6055 
6056 /*
6057  * return true if the ipif can be destroyed: the ipif has to be quiescent
6058  * with zero references from ire/nce/ilm to it.
6059  */
6060 static boolean_t
6061 ipif_is_freeable(ipif_t *ipif)
6062 {
6063 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6064 	ASSERT(ipif->ipif_id != 0);
6065 	return (ipif->ipif_refcnt == 0 && IPIF_FREE_OK(ipif));
6066 }
6067 
6068 /*
6069  * The ipif/ill/ire has been refreled. Do the tail processing.
6070  * Determine if the ipif or ill in question has become quiescent and if so
6071  * wakeup close and/or restart any queued pending ioctl that is waiting
6072  * for the ipif_down (or ill_down)
6073  */
6074 void
6075 ipif_ill_refrele_tail(ill_t *ill)
6076 {
6077 	mblk_t	*mp;
6078 	conn_t	*connp;
6079 	ipsq_t	*ipsq;
6080 	ipxop_t	*ipx;
6081 	ipif_t	*ipif;
6082 	dl_notify_ind_t *dlindp;
6083 
6084 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6085 
6086 	if ((ill->ill_state_flags & ILL_CONDEMNED) && ill_is_freeable(ill)) {
6087 		/* ip_modclose() may be waiting */
6088 		cv_broadcast(&ill->ill_cv);
6089 	}
6090 
6091 	ipsq = ill->ill_phyint->phyint_ipsq;
6092 	mutex_enter(&ipsq->ipsq_lock);
6093 	ipx = ipsq->ipsq_xop;
6094 	mutex_enter(&ipx->ipx_lock);
6095 	if (ipx->ipx_waitfor == 0)	/* no one's waiting; bail */
6096 		goto unlock;
6097 
6098 	ASSERT(ipx->ipx_pending_mp != NULL && ipx->ipx_pending_ipif != NULL);
6099 
6100 	ipif = ipx->ipx_pending_ipif;
6101 	if (ipif->ipif_ill != ill) 	/* wait is for another ill; bail */
6102 		goto unlock;
6103 
6104 	switch (ipx->ipx_waitfor) {
6105 	case IPIF_DOWN:
6106 		if (!ipif_is_quiescent(ipif))
6107 			goto unlock;
6108 		break;
6109 	case IPIF_FREE:
6110 		if (!ipif_is_freeable(ipif))
6111 			goto unlock;
6112 		break;
6113 	case ILL_DOWN:
6114 		if (!ill_is_quiescent(ill))
6115 			goto unlock;
6116 		break;
6117 	case ILL_FREE:
6118 		/*
6119 		 * ILL_FREE is only for loopback; normal ill teardown waits
6120 		 * synchronously in ip_modclose() without using ipx_waitfor,
6121 		 * handled by the cv_broadcast() at the top of this function.
6122 		 */
6123 		if (!ill_is_freeable(ill))
6124 			goto unlock;
6125 		break;
6126 	default:
6127 		cmn_err(CE_PANIC, "ipsq: %p unknown ipx_waitfor %d\n",
6128 		    (void *)ipsq, ipx->ipx_waitfor);
6129 	}
6130 
6131 	ill_refhold_locked(ill);	/* for qwriter_ip() call below */
6132 	mutex_exit(&ipx->ipx_lock);
6133 	mp = ipsq_pending_mp_get(ipsq, &connp);
6134 	mutex_exit(&ipsq->ipsq_lock);
6135 	mutex_exit(&ill->ill_lock);
6136 
6137 	ASSERT(mp != NULL);
6138 	/*
6139 	 * NOTE: all of the qwriter_ip() calls below use CUR_OP since
6140 	 * we can only get here when the current operation decides it
6141 	 * it needs to quiesce via ipsq_pending_mp_add().
6142 	 */
6143 	switch (mp->b_datap->db_type) {
6144 	case M_PCPROTO:
6145 	case M_PROTO:
6146 		/*
6147 		 * For now, only DL_NOTIFY_IND messages can use this facility.
6148 		 */
6149 		dlindp = (dl_notify_ind_t *)mp->b_rptr;
6150 		ASSERT(dlindp->dl_primitive == DL_NOTIFY_IND);
6151 
6152 		switch (dlindp->dl_notification) {
6153 		case DL_NOTE_PHYS_ADDR:
6154 			qwriter_ip(ill, ill->ill_rq, mp,
6155 			    ill_set_phys_addr_tail, CUR_OP, B_TRUE);
6156 			return;
6157 		case DL_NOTE_REPLUMB:
6158 			qwriter_ip(ill, ill->ill_rq, mp,
6159 			    ill_replumb_tail, CUR_OP, B_TRUE);
6160 			return;
6161 		default:
6162 			ASSERT(0);
6163 			ill_refrele(ill);
6164 		}
6165 		break;
6166 
6167 	case M_ERROR:
6168 	case M_HANGUP:
6169 		qwriter_ip(ill, ill->ill_rq, mp, ipif_all_down_tail, CUR_OP,
6170 		    B_TRUE);
6171 		return;
6172 
6173 	case M_IOCTL:
6174 	case M_IOCDATA:
6175 		qwriter_ip(ill, (connp != NULL ? CONNP_TO_WQ(connp) :
6176 		    ill->ill_wq), mp, ip_reprocess_ioctl, CUR_OP, B_TRUE);
6177 		return;
6178 
6179 	default:
6180 		cmn_err(CE_PANIC, "ipif_ill_refrele_tail mp %p "
6181 		    "db_type %d\n", (void *)mp, mp->b_datap->db_type);
6182 	}
6183 	return;
6184 unlock:
6185 	mutex_exit(&ipsq->ipsq_lock);
6186 	mutex_exit(&ipx->ipx_lock);
6187 	mutex_exit(&ill->ill_lock);
6188 }
6189 
6190 #ifdef DEBUG
6191 /* Reuse trace buffer from beginning (if reached the end) and record trace */
6192 static void
6193 th_trace_rrecord(th_trace_t *th_trace)
6194 {
6195 	tr_buf_t *tr_buf;
6196 	uint_t lastref;
6197 
6198 	lastref = th_trace->th_trace_lastref;
6199 	lastref++;
6200 	if (lastref == TR_BUF_MAX)
6201 		lastref = 0;
6202 	th_trace->th_trace_lastref = lastref;
6203 	tr_buf = &th_trace->th_trbuf[lastref];
6204 	tr_buf->tr_time = lbolt;
6205 	tr_buf->tr_depth = getpcstack(tr_buf->tr_stack, TR_STACK_DEPTH);
6206 }
6207 
6208 static void
6209 th_trace_free(void *value)
6210 {
6211 	th_trace_t *th_trace = value;
6212 
6213 	ASSERT(th_trace->th_refcnt == 0);
6214 	kmem_free(th_trace, sizeof (*th_trace));
6215 }
6216 
6217 /*
6218  * Find or create the per-thread hash table used to track object references.
6219  * The ipst argument is NULL if we shouldn't allocate.
6220  *
6221  * Accesses per-thread data, so there's no need to lock here.
6222  */
6223 static mod_hash_t *
6224 th_trace_gethash(ip_stack_t *ipst)
6225 {
6226 	th_hash_t *thh;
6227 
6228 	if ((thh = tsd_get(ip_thread_data)) == NULL && ipst != NULL) {
6229 		mod_hash_t *mh;
6230 		char name[256];
6231 		size_t objsize, rshift;
6232 		int retv;
6233 
6234 		if ((thh = kmem_alloc(sizeof (*thh), KM_NOSLEEP)) == NULL)
6235 			return (NULL);
6236 		(void) snprintf(name, sizeof (name), "th_trace_%p",
6237 		    (void *)curthread);
6238 
6239 		/*
6240 		 * We use mod_hash_create_extended here rather than the more
6241 		 * obvious mod_hash_create_ptrhash because the latter has a
6242 		 * hard-coded KM_SLEEP, and we'd prefer to fail rather than
6243 		 * block.
6244 		 */
6245 		objsize = MAX(MAX(sizeof (ill_t), sizeof (ipif_t)),
6246 		    MAX(sizeof (ire_t), sizeof (nce_t)));
6247 		rshift = highbit(objsize);
6248 		mh = mod_hash_create_extended(name, 64, mod_hash_null_keydtor,
6249 		    th_trace_free, mod_hash_byptr, (void *)rshift,
6250 		    mod_hash_ptrkey_cmp, KM_NOSLEEP);
6251 		if (mh == NULL) {
6252 			kmem_free(thh, sizeof (*thh));
6253 			return (NULL);
6254 		}
6255 		thh->thh_hash = mh;
6256 		thh->thh_ipst = ipst;
6257 		/*
6258 		 * We trace ills, ipifs, ires, and nces.  All of these are
6259 		 * per-IP-stack, so the lock on the thread list is as well.
6260 		 */
6261 		rw_enter(&ip_thread_rwlock, RW_WRITER);
6262 		list_insert_tail(&ip_thread_list, thh);
6263 		rw_exit(&ip_thread_rwlock);
6264 		retv = tsd_set(ip_thread_data, thh);
6265 		ASSERT(retv == 0);
6266 	}
6267 	return (thh != NULL ? thh->thh_hash : NULL);
6268 }
6269 
6270 boolean_t
6271 th_trace_ref(const void *obj, ip_stack_t *ipst)
6272 {
6273 	th_trace_t *th_trace;
6274 	mod_hash_t *mh;
6275 	mod_hash_val_t val;
6276 
6277 	if ((mh = th_trace_gethash(ipst)) == NULL)
6278 		return (B_FALSE);
6279 
6280 	/*
6281 	 * Attempt to locate the trace buffer for this obj and thread.
6282 	 * If it does not exist, then allocate a new trace buffer and
6283 	 * insert into the hash.
6284 	 */
6285 	if (mod_hash_find(mh, (mod_hash_key_t)obj, &val) == MH_ERR_NOTFOUND) {
6286 		th_trace = kmem_zalloc(sizeof (th_trace_t), KM_NOSLEEP);
6287 		if (th_trace == NULL)
6288 			return (B_FALSE);
6289 
6290 		th_trace->th_id = curthread;
6291 		if (mod_hash_insert(mh, (mod_hash_key_t)obj,
6292 		    (mod_hash_val_t)th_trace) != 0) {
6293 			kmem_free(th_trace, sizeof (th_trace_t));
6294 			return (B_FALSE);
6295 		}
6296 	} else {
6297 		th_trace = (th_trace_t *)val;
6298 	}
6299 
6300 	ASSERT(th_trace->th_refcnt >= 0 &&
6301 	    th_trace->th_refcnt < TR_BUF_MAX - 1);
6302 
6303 	th_trace->th_refcnt++;
6304 	th_trace_rrecord(th_trace);
6305 	return (B_TRUE);
6306 }
6307 
6308 /*
6309  * For the purpose of tracing a reference release, we assume that global
6310  * tracing is always on and that the same thread initiated the reference hold
6311  * is releasing.
6312  */
6313 void
6314 th_trace_unref(const void *obj)
6315 {
6316 	int retv;
6317 	mod_hash_t *mh;
6318 	th_trace_t *th_trace;
6319 	mod_hash_val_t val;
6320 
6321 	mh = th_trace_gethash(NULL);
6322 	retv = mod_hash_find(mh, (mod_hash_key_t)obj, &val);
6323 	ASSERT(retv == 0);
6324 	th_trace = (th_trace_t *)val;
6325 
6326 	ASSERT(th_trace->th_refcnt > 0);
6327 	th_trace->th_refcnt--;
6328 	th_trace_rrecord(th_trace);
6329 }
6330 
6331 /*
6332  * If tracing has been disabled, then we assume that the reference counts are
6333  * now useless, and we clear them out before destroying the entries.
6334  */
6335 void
6336 th_trace_cleanup(const void *obj, boolean_t trace_disable)
6337 {
6338 	th_hash_t	*thh;
6339 	mod_hash_t	*mh;
6340 	mod_hash_val_t	val;
6341 	th_trace_t	*th_trace;
6342 	int		retv;
6343 
6344 	rw_enter(&ip_thread_rwlock, RW_READER);
6345 	for (thh = list_head(&ip_thread_list); thh != NULL;
6346 	    thh = list_next(&ip_thread_list, thh)) {
6347 		if (mod_hash_find(mh = thh->thh_hash, (mod_hash_key_t)obj,
6348 		    &val) == 0) {
6349 			th_trace = (th_trace_t *)val;
6350 			if (trace_disable)
6351 				th_trace->th_refcnt = 0;
6352 			retv = mod_hash_destroy(mh, (mod_hash_key_t)obj);
6353 			ASSERT(retv == 0);
6354 		}
6355 	}
6356 	rw_exit(&ip_thread_rwlock);
6357 }
6358 
6359 void
6360 ipif_trace_ref(ipif_t *ipif)
6361 {
6362 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6363 
6364 	if (ipif->ipif_trace_disable)
6365 		return;
6366 
6367 	if (!th_trace_ref(ipif, ipif->ipif_ill->ill_ipst)) {
6368 		ipif->ipif_trace_disable = B_TRUE;
6369 		ipif_trace_cleanup(ipif);
6370 	}
6371 }
6372 
6373 void
6374 ipif_untrace_ref(ipif_t *ipif)
6375 {
6376 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6377 
6378 	if (!ipif->ipif_trace_disable)
6379 		th_trace_unref(ipif);
6380 }
6381 
6382 void
6383 ill_trace_ref(ill_t *ill)
6384 {
6385 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6386 
6387 	if (ill->ill_trace_disable)
6388 		return;
6389 
6390 	if (!th_trace_ref(ill, ill->ill_ipst)) {
6391 		ill->ill_trace_disable = B_TRUE;
6392 		ill_trace_cleanup(ill);
6393 	}
6394 }
6395 
6396 void
6397 ill_untrace_ref(ill_t *ill)
6398 {
6399 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6400 
6401 	if (!ill->ill_trace_disable)
6402 		th_trace_unref(ill);
6403 }
6404 
6405 /*
6406  * Called when ipif is unplumbed or when memory alloc fails.  Note that on
6407  * failure, ipif_trace_disable is set.
6408  */
6409 static void
6410 ipif_trace_cleanup(const ipif_t *ipif)
6411 {
6412 	th_trace_cleanup(ipif, ipif->ipif_trace_disable);
6413 }
6414 
6415 /*
6416  * Called when ill is unplumbed or when memory alloc fails.  Note that on
6417  * failure, ill_trace_disable is set.
6418  */
6419 static void
6420 ill_trace_cleanup(const ill_t *ill)
6421 {
6422 	th_trace_cleanup(ill, ill->ill_trace_disable);
6423 }
6424 #endif /* DEBUG */
6425 
6426 void
6427 ipif_refhold_locked(ipif_t *ipif)
6428 {
6429 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6430 	ipif->ipif_refcnt++;
6431 	IPIF_TRACE_REF(ipif);
6432 }
6433 
6434 void
6435 ipif_refhold(ipif_t *ipif)
6436 {
6437 	ill_t	*ill;
6438 
6439 	ill = ipif->ipif_ill;
6440 	mutex_enter(&ill->ill_lock);
6441 	ipif->ipif_refcnt++;
6442 	IPIF_TRACE_REF(ipif);
6443 	mutex_exit(&ill->ill_lock);
6444 }
6445 
6446 /*
6447  * Must not be called while holding any locks. Otherwise if this is
6448  * the last reference to be released there is a chance of recursive mutex
6449  * panic due to ipif_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
6450  * to restart an ioctl.
6451  */
6452 void
6453 ipif_refrele(ipif_t *ipif)
6454 {
6455 	ill_t	*ill;
6456 
6457 	ill = ipif->ipif_ill;
6458 
6459 	mutex_enter(&ill->ill_lock);
6460 	ASSERT(ipif->ipif_refcnt != 0);
6461 	ipif->ipif_refcnt--;
6462 	IPIF_UNTRACE_REF(ipif);
6463 	if (ipif->ipif_refcnt != 0) {
6464 		mutex_exit(&ill->ill_lock);
6465 		return;
6466 	}
6467 
6468 	/* Drops the ill_lock */
6469 	ipif_ill_refrele_tail(ill);
6470 }
6471 
6472 ipif_t *
6473 ipif_get_next_ipif(ipif_t *curr, ill_t *ill)
6474 {
6475 	ipif_t	*ipif;
6476 
6477 	mutex_enter(&ill->ill_lock);
6478 	for (ipif = (curr == NULL ? ill->ill_ipif : curr->ipif_next);
6479 	    ipif != NULL; ipif = ipif->ipif_next) {
6480 		if (!IPIF_CAN_LOOKUP(ipif))
6481 			continue;
6482 		ipif_refhold_locked(ipif);
6483 		mutex_exit(&ill->ill_lock);
6484 		return (ipif);
6485 	}
6486 	mutex_exit(&ill->ill_lock);
6487 	return (NULL);
6488 }
6489 
6490 /*
6491  * TODO: make this table extendible at run time
6492  * Return a pointer to the mac type info for 'mac_type'
6493  */
6494 static ip_m_t *
6495 ip_m_lookup(t_uscalar_t mac_type)
6496 {
6497 	ip_m_t	*ipm;
6498 
6499 	for (ipm = ip_m_tbl; ipm < A_END(ip_m_tbl); ipm++)
6500 		if (ipm->ip_m_mac_type == mac_type)
6501 			return (ipm);
6502 	return (NULL);
6503 }
6504 
6505 /*
6506  * ip_rt_add is called to add an IPv4 route to the forwarding table.
6507  * ipif_arg is passed in to associate it with the correct interface.
6508  * We may need to restart this operation if the ipif cannot be looked up
6509  * due to an exclusive operation that is currently in progress. The restart
6510  * entry point is specified by 'func'
6511  */
6512 int
6513 ip_rt_add(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
6514     ipaddr_t src_addr, int flags, ipif_t *ipif_arg, ire_t **ire_arg,
6515     boolean_t ioctl_msg, queue_t *q, mblk_t *mp, ipsq_func_t func,
6516     struct rtsa_s *sp, ip_stack_t *ipst)
6517 {
6518 	ire_t	*ire;
6519 	ire_t	*gw_ire = NULL;
6520 	ipif_t	*ipif = NULL;
6521 	boolean_t ipif_refheld = B_FALSE;
6522 	uint_t	type;
6523 	int	match_flags = MATCH_IRE_TYPE;
6524 	int	error;
6525 	tsol_gc_t *gc = NULL;
6526 	tsol_gcgrp_t *gcgrp = NULL;
6527 	boolean_t gcgrp_xtraref = B_FALSE;
6528 
6529 	ip1dbg(("ip_rt_add:"));
6530 
6531 	if (ire_arg != NULL)
6532 		*ire_arg = NULL;
6533 
6534 	/*
6535 	 * If this is the case of RTF_HOST being set, then we set the netmask
6536 	 * to all ones (regardless if one was supplied).
6537 	 */
6538 	if (flags & RTF_HOST)
6539 		mask = IP_HOST_MASK;
6540 
6541 	/*
6542 	 * Prevent routes with a zero gateway from being created (since
6543 	 * interfaces can currently be plumbed and brought up no assigned
6544 	 * address).
6545 	 */
6546 	if (gw_addr == 0)
6547 		return (ENETUNREACH);
6548 	/*
6549 	 * Get the ipif, if any, corresponding to the gw_addr
6550 	 */
6551 	ipif = ipif_lookup_interface(gw_addr, dst_addr, q, mp, func, &error,
6552 	    ipst);
6553 	if (ipif != NULL) {
6554 		if (IS_VNI(ipif->ipif_ill)) {
6555 			ipif_refrele(ipif);
6556 			return (EINVAL);
6557 		}
6558 		ipif_refheld = B_TRUE;
6559 	} else if (error == EINPROGRESS) {
6560 		ip1dbg(("ip_rt_add: null and EINPROGRESS"));
6561 		return (EINPROGRESS);
6562 	} else {
6563 		error = 0;
6564 	}
6565 
6566 	if (ipif != NULL) {
6567 		ip1dbg(("ip_rt_add: ipif_lookup_interface done ipif nonnull"));
6568 		ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6569 	} else {
6570 		ip1dbg(("ip_rt_add: ipif_lookup_interface done ipif is null"));
6571 	}
6572 
6573 	/*
6574 	 * GateD will attempt to create routes with a loopback interface
6575 	 * address as the gateway and with RTF_GATEWAY set.  We allow
6576 	 * these routes to be added, but create them as interface routes
6577 	 * since the gateway is an interface address.
6578 	 */
6579 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
6580 		flags &= ~RTF_GATEWAY;
6581 		if (gw_addr == INADDR_LOOPBACK && dst_addr == INADDR_LOOPBACK &&
6582 		    mask == IP_HOST_MASK) {
6583 			ire = ire_ctable_lookup(dst_addr, 0, IRE_LOOPBACK, ipif,
6584 			    ALL_ZONES, NULL, match_flags, ipst);
6585 			if (ire != NULL) {
6586 				ire_refrele(ire);
6587 				if (ipif_refheld)
6588 					ipif_refrele(ipif);
6589 				return (EEXIST);
6590 			}
6591 			ip1dbg(("ip_rt_add: 0x%p creating IRE 0x%x"
6592 			    "for 0x%x\n", (void *)ipif,
6593 			    ipif->ipif_ire_type,
6594 			    ntohl(ipif->ipif_lcl_addr)));
6595 			ire = ire_create(
6596 			    (uchar_t *)&dst_addr,	/* dest address */
6597 			    (uchar_t *)&mask,		/* mask */
6598 			    (uchar_t *)&ipif->ipif_src_addr,
6599 			    NULL,			/* no gateway */
6600 			    &ipif->ipif_mtu,
6601 			    NULL,
6602 			    ipif->ipif_rq,		/* recv-from queue */
6603 			    NULL,			/* no send-to queue */
6604 			    ipif->ipif_ire_type,	/* LOOPBACK */
6605 			    ipif,
6606 			    0,
6607 			    0,
6608 			    0,
6609 			    (ipif->ipif_flags & IPIF_PRIVATE) ?
6610 			    RTF_PRIVATE : 0,
6611 			    &ire_uinfo_null,
6612 			    NULL,
6613 			    NULL,
6614 			    ipst);
6615 
6616 			if (ire == NULL) {
6617 				if (ipif_refheld)
6618 					ipif_refrele(ipif);
6619 				return (ENOMEM);
6620 			}
6621 			error = ire_add(&ire, q, mp, func, B_FALSE);
6622 			if (error == 0)
6623 				goto save_ire;
6624 			if (ipif_refheld)
6625 				ipif_refrele(ipif);
6626 			return (error);
6627 
6628 		}
6629 	}
6630 
6631 	/*
6632 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
6633 	 * and the gateway address provided is one of the system's interface
6634 	 * addresses.  By using the routing socket interface and supplying an
6635 	 * RTA_IFP sockaddr with an interface index, an alternate method of
6636 	 * specifying an interface route to be created is available which uses
6637 	 * the interface index that specifies the outgoing interface rather than
6638 	 * the address of an outgoing interface (which may not be able to
6639 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
6640 	 * flag, routes can be specified which not only specify the next-hop to
6641 	 * be used when routing to a certain prefix, but also which outgoing
6642 	 * interface should be used.
6643 	 *
6644 	 * Previously, interfaces would have unique addresses assigned to them
6645 	 * and so the address assigned to a particular interface could be used
6646 	 * to identify a particular interface.  One exception to this was the
6647 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
6648 	 *
6649 	 * With the advent of IPv6 and its link-local addresses, this
6650 	 * restriction was relaxed and interfaces could share addresses between
6651 	 * themselves.  In fact, typically all of the link-local interfaces on
6652 	 * an IPv6 node or router will have the same link-local address.  In
6653 	 * order to differentiate between these interfaces, the use of an
6654 	 * interface index is necessary and this index can be carried inside a
6655 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
6656 	 * of using the interface index, however, is that all of the ipif's that
6657 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
6658 	 * cannot be used to differentiate between ipif's (or logical
6659 	 * interfaces) that belong to the same ill (physical interface).
6660 	 *
6661 	 * For example, in the following case involving IPv4 interfaces and
6662 	 * logical interfaces
6663 	 *
6664 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
6665 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0:1
6666 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0:2
6667 	 *
6668 	 * the ipif's corresponding to each of these interface routes can be
6669 	 * uniquely identified by the "gateway" (actually interface address).
6670 	 *
6671 	 * In this case involving multiple IPv6 default routes to a particular
6672 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
6673 	 * default route is of interest:
6674 	 *
6675 	 *	default		fe80::123:4567:89ab:cdef	U	if0
6676 	 *	default		fe80::123:4567:89ab:cdef	U	if1
6677 	 */
6678 
6679 	/* RTF_GATEWAY not set */
6680 	if (!(flags & RTF_GATEWAY)) {
6681 		queue_t	*stq;
6682 
6683 		if (sp != NULL) {
6684 			ip2dbg(("ip_rt_add: gateway security attributes "
6685 			    "cannot be set with interface route\n"));
6686 			if (ipif_refheld)
6687 				ipif_refrele(ipif);
6688 			return (EINVAL);
6689 		}
6690 
6691 		/*
6692 		 * As the interface index specified with the RTA_IFP sockaddr is
6693 		 * the same for all ipif's off of an ill, the matching logic
6694 		 * below uses MATCH_IRE_ILL if such an index was specified.
6695 		 * This means that routes sharing the same prefix when added
6696 		 * using a RTA_IFP sockaddr must have distinct interface
6697 		 * indices (namely, they must be on distinct ill's).
6698 		 *
6699 		 * On the other hand, since the gateway address will usually be
6700 		 * different for each ipif on the system, the matching logic
6701 		 * uses MATCH_IRE_IPIF in the case of a traditional interface
6702 		 * route.  This means that interface routes for the same prefix
6703 		 * can be created if they belong to distinct ipif's and if a
6704 		 * RTA_IFP sockaddr is not present.
6705 		 */
6706 		if (ipif_arg != NULL) {
6707 			if (ipif_refheld)  {
6708 				ipif_refrele(ipif);
6709 				ipif_refheld = B_FALSE;
6710 			}
6711 			ipif = ipif_arg;
6712 			match_flags |= MATCH_IRE_ILL;
6713 		} else {
6714 			/*
6715 			 * Check the ipif corresponding to the gw_addr
6716 			 */
6717 			if (ipif == NULL)
6718 				return (ENETUNREACH);
6719 			match_flags |= MATCH_IRE_IPIF;
6720 		}
6721 		ASSERT(ipif != NULL);
6722 
6723 		/*
6724 		 * We check for an existing entry at this point.
6725 		 *
6726 		 * Since a netmask isn't passed in via the ioctl interface
6727 		 * (SIOCADDRT), we don't check for a matching netmask in that
6728 		 * case.
6729 		 */
6730 		if (!ioctl_msg)
6731 			match_flags |= MATCH_IRE_MASK;
6732 		ire = ire_ftable_lookup(dst_addr, mask, 0, IRE_INTERFACE, ipif,
6733 		    NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
6734 		if (ire != NULL) {
6735 			ire_refrele(ire);
6736 			if (ipif_refheld)
6737 				ipif_refrele(ipif);
6738 			return (EEXIST);
6739 		}
6740 
6741 		stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
6742 		    ? ipif->ipif_rq : ipif->ipif_wq;
6743 
6744 		/*
6745 		 * Create a copy of the IRE_LOOPBACK,
6746 		 * IRE_IF_NORESOLVER or IRE_IF_RESOLVER with
6747 		 * the modified address and netmask.
6748 		 */
6749 		ire = ire_create(
6750 		    (uchar_t *)&dst_addr,
6751 		    (uint8_t *)&mask,
6752 		    (uint8_t *)&ipif->ipif_src_addr,
6753 		    NULL,
6754 		    &ipif->ipif_mtu,
6755 		    NULL,
6756 		    NULL,
6757 		    stq,
6758 		    ipif->ipif_net_type,
6759 		    ipif,
6760 		    0,
6761 		    0,
6762 		    0,
6763 		    flags,
6764 		    &ire_uinfo_null,
6765 		    NULL,
6766 		    NULL,
6767 		    ipst);
6768 		if (ire == NULL) {
6769 			if (ipif_refheld)
6770 				ipif_refrele(ipif);
6771 			return (ENOMEM);
6772 		}
6773 
6774 		/*
6775 		 * Some software (for example, GateD and Sun Cluster) attempts
6776 		 * to create (what amount to) IRE_PREFIX routes with the
6777 		 * loopback address as the gateway.  This is primarily done to
6778 		 * set up prefixes with the RTF_REJECT flag set (for example,
6779 		 * when generating aggregate routes.)
6780 		 *
6781 		 * If the IRE type (as defined by ipif->ipif_net_type) is
6782 		 * IRE_LOOPBACK, then we map the request into a
6783 		 * IRE_IF_NORESOLVER. We also OR in the RTF_BLACKHOLE flag as
6784 		 * these interface routes, by definition, can only be that.
6785 		 *
6786 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
6787 		 * routine, but rather using ire_create() directly.
6788 		 *
6789 		 */
6790 		if (ipif->ipif_net_type == IRE_LOOPBACK) {
6791 			ire->ire_type = IRE_IF_NORESOLVER;
6792 			ire->ire_flags |= RTF_BLACKHOLE;
6793 		}
6794 
6795 		error = ire_add(&ire, q, mp, func, B_FALSE);
6796 		if (error == 0)
6797 			goto save_ire;
6798 
6799 		/*
6800 		 * In the result of failure, ire_add() will have already
6801 		 * deleted the ire in question, so there is no need to
6802 		 * do that here.
6803 		 */
6804 		if (ipif_refheld)
6805 			ipif_refrele(ipif);
6806 		return (error);
6807 	}
6808 	if (ipif_refheld) {
6809 		ipif_refrele(ipif);
6810 		ipif_refheld = B_FALSE;
6811 	}
6812 
6813 	/*
6814 	 * Get an interface IRE for the specified gateway.
6815 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
6816 	 * gateway, it is currently unreachable and we fail the request
6817 	 * accordingly.
6818 	 */
6819 	ipif = ipif_arg;
6820 	if (ipif_arg != NULL)
6821 		match_flags |= MATCH_IRE_ILL;
6822 again:
6823 	gw_ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg, NULL,
6824 	    ALL_ZONES, 0, NULL, match_flags, ipst);
6825 	if (gw_ire == NULL) {
6826 		/*
6827 		 * With IPMP, we allow host routes to influence in.mpathd's
6828 		 * target selection.  However, if the test addresses are on
6829 		 * their own network, the above lookup will fail since the
6830 		 * underlying IRE_INTERFACEs are marked hidden.  So allow
6831 		 * hidden test IREs to be found and try again.
6832 		 */
6833 		if (!(match_flags & MATCH_IRE_MARK_TESTHIDDEN))  {
6834 			match_flags |= MATCH_IRE_MARK_TESTHIDDEN;
6835 			goto again;
6836 		}
6837 		return (ENETUNREACH);
6838 	}
6839 
6840 	/*
6841 	 * We create one of three types of IREs as a result of this request
6842 	 * based on the netmask.  A netmask of all ones (which is automatically
6843 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
6844 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
6845 	 * created.  Otherwise, an IRE_PREFIX route is created for the
6846 	 * destination prefix.
6847 	 */
6848 	if (mask == IP_HOST_MASK)
6849 		type = IRE_HOST;
6850 	else if (mask == 0)
6851 		type = IRE_DEFAULT;
6852 	else
6853 		type = IRE_PREFIX;
6854 
6855 	/* check for a duplicate entry */
6856 	ire = ire_ftable_lookup(dst_addr, mask, gw_addr, type, ipif_arg,
6857 	    NULL, ALL_ZONES, 0, NULL,
6858 	    match_flags | MATCH_IRE_MASK | MATCH_IRE_GW, ipst);
6859 	if (ire != NULL) {
6860 		ire_refrele(gw_ire);
6861 		ire_refrele(ire);
6862 		return (EEXIST);
6863 	}
6864 
6865 	/* Security attribute exists */
6866 	if (sp != NULL) {
6867 		tsol_gcgrp_addr_t ga;
6868 
6869 		/* find or create the gateway credentials group */
6870 		ga.ga_af = AF_INET;
6871 		IN6_IPADDR_TO_V4MAPPED(gw_addr, &ga.ga_addr);
6872 
6873 		/* we hold reference to it upon success */
6874 		gcgrp = gcgrp_lookup(&ga, B_TRUE);
6875 		if (gcgrp == NULL) {
6876 			ire_refrele(gw_ire);
6877 			return (ENOMEM);
6878 		}
6879 
6880 		/*
6881 		 * Create and add the security attribute to the group; a
6882 		 * reference to the group is made upon allocating a new
6883 		 * entry successfully.  If it finds an already-existing
6884 		 * entry for the security attribute in the group, it simply
6885 		 * returns it and no new reference is made to the group.
6886 		 */
6887 		gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
6888 		if (gc == NULL) {
6889 			/* release reference held by gcgrp_lookup */
6890 			GCGRP_REFRELE(gcgrp);
6891 			ire_refrele(gw_ire);
6892 			return (ENOMEM);
6893 		}
6894 	}
6895 
6896 	/* Create the IRE. */
6897 	ire = ire_create(
6898 	    (uchar_t *)&dst_addr,		/* dest address */
6899 	    (uchar_t *)&mask,			/* mask */
6900 	    /* src address assigned by the caller? */
6901 	    (uchar_t *)(((src_addr != INADDR_ANY) &&
6902 	    (flags & RTF_SETSRC)) ?  &src_addr : NULL),
6903 	    (uchar_t *)&gw_addr,		/* gateway address */
6904 	    &gw_ire->ire_max_frag,
6905 	    NULL,				/* no src nce */
6906 	    NULL,				/* no recv-from queue */
6907 	    NULL,				/* no send-to queue */
6908 	    (ushort_t)type,			/* IRE type */
6909 	    ipif_arg,
6910 	    0,
6911 	    0,
6912 	    0,
6913 	    flags,
6914 	    &gw_ire->ire_uinfo,			/* Inherit ULP info from gw */
6915 	    gc,					/* security attribute */
6916 	    NULL,
6917 	    ipst);
6918 
6919 	/*
6920 	 * The ire holds a reference to the 'gc' and the 'gc' holds a
6921 	 * reference to the 'gcgrp'. We can now release the extra reference
6922 	 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
6923 	 */
6924 	if (gcgrp_xtraref)
6925 		GCGRP_REFRELE(gcgrp);
6926 	if (ire == NULL) {
6927 		if (gc != NULL)
6928 			GC_REFRELE(gc);
6929 		ire_refrele(gw_ire);
6930 		return (ENOMEM);
6931 	}
6932 
6933 	/*
6934 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
6935 	 * SUN/OS socket stuff does but do we really want to allow 0.0.0.0?
6936 	 */
6937 
6938 	/* Add the new IRE. */
6939 	error = ire_add(&ire, q, mp, func, B_FALSE);
6940 	if (error != 0) {
6941 		/*
6942 		 * In the result of failure, ire_add() will have already
6943 		 * deleted the ire in question, so there is no need to
6944 		 * do that here.
6945 		 */
6946 		ire_refrele(gw_ire);
6947 		return (error);
6948 	}
6949 
6950 	if (flags & RTF_MULTIRT) {
6951 		/*
6952 		 * Invoke the CGTP (multirouting) filtering module
6953 		 * to add the dst address in the filtering database.
6954 		 * Replicated inbound packets coming from that address
6955 		 * will be filtered to discard the duplicates.
6956 		 * It is not necessary to call the CGTP filter hook
6957 		 * when the dst address is a broadcast or multicast,
6958 		 * because an IP source address cannot be a broadcast
6959 		 * or a multicast.
6960 		 */
6961 		ire_t *ire_dst = ire_ctable_lookup(ire->ire_addr, 0,
6962 		    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
6963 		if (ire_dst != NULL) {
6964 			ip_cgtp_bcast_add(ire, ire_dst, ipst);
6965 			ire_refrele(ire_dst);
6966 			goto save_ire;
6967 		}
6968 		if (ipst->ips_ip_cgtp_filter_ops != NULL &&
6969 		    !CLASSD(ire->ire_addr)) {
6970 			int res = ipst->ips_ip_cgtp_filter_ops->cfo_add_dest_v4(
6971 			    ipst->ips_netstack->netstack_stackid,
6972 			    ire->ire_addr,
6973 			    ire->ire_gateway_addr,
6974 			    ire->ire_src_addr,
6975 			    gw_ire->ire_src_addr);
6976 			if (res != 0) {
6977 				ire_refrele(gw_ire);
6978 				ire_delete(ire);
6979 				return (res);
6980 			}
6981 		}
6982 	}
6983 
6984 	/*
6985 	 * Now that the prefix IRE entry has been created, delete any
6986 	 * existing gateway IRE cache entries as well as any IRE caches
6987 	 * using the gateway, and force them to be created through
6988 	 * ip_newroute.
6989 	 */
6990 	if (gc != NULL) {
6991 		ASSERT(gcgrp != NULL);
6992 		ire_clookup_delete_cache_gw(gw_addr, ALL_ZONES, ipst);
6993 	}
6994 
6995 save_ire:
6996 	if (gw_ire != NULL) {
6997 		ire_refrele(gw_ire);
6998 	}
6999 	if (ipif != NULL) {
7000 		/*
7001 		 * Save enough information so that we can recreate the IRE if
7002 		 * the interface goes down and then up.  The metrics associated
7003 		 * with the route will be saved as well when rts_setmetrics() is
7004 		 * called after the IRE has been created.  In the case where
7005 		 * memory cannot be allocated, none of this information will be
7006 		 * saved.
7007 		 */
7008 		ipif_save_ire(ipif, ire);
7009 	}
7010 	if (ioctl_msg)
7011 		ip_rts_rtmsg(RTM_OLDADD, ire, 0, ipst);
7012 	if (ire_arg != NULL) {
7013 		/*
7014 		 * Store the ire that was successfully added into where ire_arg
7015 		 * points to so that callers don't have to look it up
7016 		 * themselves (but they are responsible for ire_refrele()ing
7017 		 * the ire when they are finished with it).
7018 		 */
7019 		*ire_arg = ire;
7020 	} else {
7021 		ire_refrele(ire);		/* Held in ire_add */
7022 	}
7023 	if (ipif_refheld)
7024 		ipif_refrele(ipif);
7025 	return (0);
7026 }
7027 
7028 /*
7029  * ip_rt_delete is called to delete an IPv4 route.
7030  * ipif_arg is passed in to associate it with the correct interface.
7031  * We may need to restart this operation if the ipif cannot be looked up
7032  * due to an exclusive operation that is currently in progress. The restart
7033  * entry point is specified by 'func'
7034  */
7035 /* ARGSUSED4 */
7036 int
7037 ip_rt_delete(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
7038     uint_t rtm_addrs, int flags, ipif_t *ipif_arg, boolean_t ioctl_msg,
7039     queue_t *q, mblk_t *mp, ipsq_func_t func, ip_stack_t *ipst)
7040 {
7041 	ire_t	*ire = NULL;
7042 	ipif_t	*ipif;
7043 	boolean_t ipif_refheld = B_FALSE;
7044 	uint_t	type;
7045 	uint_t	match_flags = MATCH_IRE_TYPE;
7046 	int	err = 0;
7047 
7048 	ip1dbg(("ip_rt_delete:"));
7049 	/*
7050 	 * If this is the case of RTF_HOST being set, then we set the netmask
7051 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
7052 	 */
7053 	if (flags & RTF_HOST) {
7054 		mask = IP_HOST_MASK;
7055 		match_flags |= MATCH_IRE_MASK;
7056 	} else if (rtm_addrs & RTA_NETMASK) {
7057 		match_flags |= MATCH_IRE_MASK;
7058 	}
7059 
7060 	/*
7061 	 * Note that RTF_GATEWAY is never set on a delete, therefore
7062 	 * we check if the gateway address is one of our interfaces first,
7063 	 * and fall back on RTF_GATEWAY routes.
7064 	 *
7065 	 * This makes it possible to delete an original
7066 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
7067 	 *
7068 	 * As the interface index specified with the RTA_IFP sockaddr is the
7069 	 * same for all ipif's off of an ill, the matching logic below uses
7070 	 * MATCH_IRE_ILL if such an index was specified.  This means a route
7071 	 * sharing the same prefix and interface index as the the route
7072 	 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr
7073 	 * is specified in the request.
7074 	 *
7075 	 * On the other hand, since the gateway address will usually be
7076 	 * different for each ipif on the system, the matching logic
7077 	 * uses MATCH_IRE_IPIF in the case of a traditional interface
7078 	 * route.  This means that interface routes for the same prefix can be
7079 	 * uniquely identified if they belong to distinct ipif's and if a
7080 	 * RTA_IFP sockaddr is not present.
7081 	 *
7082 	 * For more detail on specifying routes by gateway address and by
7083 	 * interface index, see the comments in ip_rt_add().
7084 	 */
7085 	ipif = ipif_lookup_interface(gw_addr, dst_addr, q, mp, func, &err,
7086 	    ipst);
7087 	if (ipif != NULL)
7088 		ipif_refheld = B_TRUE;
7089 	else if (err == EINPROGRESS)
7090 		return (err);
7091 	else
7092 		err = 0;
7093 	if (ipif != NULL) {
7094 		if (ipif_arg != NULL) {
7095 			if (ipif_refheld) {
7096 				ipif_refrele(ipif);
7097 				ipif_refheld = B_FALSE;
7098 			}
7099 			ipif = ipif_arg;
7100 			match_flags |= MATCH_IRE_ILL;
7101 		} else {
7102 			match_flags |= MATCH_IRE_IPIF;
7103 		}
7104 		if (ipif->ipif_ire_type == IRE_LOOPBACK) {
7105 			ire = ire_ctable_lookup(dst_addr, 0, IRE_LOOPBACK, ipif,
7106 			    ALL_ZONES, NULL, match_flags, ipst);
7107 		}
7108 		if (ire == NULL) {
7109 			ire = ire_ftable_lookup(dst_addr, mask, 0,
7110 			    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL,
7111 			    match_flags, ipst);
7112 		}
7113 	}
7114 
7115 	if (ire == NULL) {
7116 		/*
7117 		 * At this point, the gateway address is not one of our own
7118 		 * addresses or a matching interface route was not found.  We
7119 		 * set the IRE type to lookup based on whether
7120 		 * this is a host route, a default route or just a prefix.
7121 		 *
7122 		 * If an ipif_arg was passed in, then the lookup is based on an
7123 		 * interface index so MATCH_IRE_ILL is added to match_flags.
7124 		 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is
7125 		 * set as the route being looked up is not a traditional
7126 		 * interface route.
7127 		 */
7128 		match_flags &= ~MATCH_IRE_IPIF;
7129 		match_flags |= MATCH_IRE_GW;
7130 		if (ipif_arg != NULL)
7131 			match_flags |= MATCH_IRE_ILL;
7132 		if (mask == IP_HOST_MASK)
7133 			type = IRE_HOST;
7134 		else if (mask == 0)
7135 			type = IRE_DEFAULT;
7136 		else
7137 			type = IRE_PREFIX;
7138 		ire = ire_ftable_lookup(dst_addr, mask, gw_addr, type, ipif_arg,
7139 		    NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
7140 	}
7141 
7142 	if (ipif_refheld)
7143 		ipif_refrele(ipif);
7144 
7145 	/* ipif is not refheld anymore */
7146 	if (ire == NULL)
7147 		return (ESRCH);
7148 
7149 	if (ire->ire_flags & RTF_MULTIRT) {
7150 		/*
7151 		 * Invoke the CGTP (multirouting) filtering module
7152 		 * to remove the dst address from the filtering database.
7153 		 * Packets coming from that address will no longer be
7154 		 * filtered to remove duplicates.
7155 		 */
7156 		if (ipst->ips_ip_cgtp_filter_ops != NULL) {
7157 			err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v4(
7158 			    ipst->ips_netstack->netstack_stackid,
7159 			    ire->ire_addr, ire->ire_gateway_addr);
7160 		}
7161 		ip_cgtp_bcast_delete(ire, ipst);
7162 	}
7163 
7164 	ipif = ire->ire_ipif;
7165 	if (ipif != NULL)
7166 		ipif_remove_ire(ipif, ire);
7167 	if (ioctl_msg)
7168 		ip_rts_rtmsg(RTM_OLDDEL, ire, 0, ipst);
7169 	ire_delete(ire);
7170 	ire_refrele(ire);
7171 	return (err);
7172 }
7173 
7174 /*
7175  * ip_siocaddrt is called to complete processing of an SIOCADDRT IOCTL.
7176  */
7177 /* ARGSUSED */
7178 int
7179 ip_siocaddrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
7180     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
7181 {
7182 	ipaddr_t dst_addr;
7183 	ipaddr_t gw_addr;
7184 	ipaddr_t mask;
7185 	int error = 0;
7186 	mblk_t *mp1;
7187 	struct rtentry *rt;
7188 	ipif_t *ipif = NULL;
7189 	ip_stack_t	*ipst;
7190 
7191 	ASSERT(q->q_next == NULL);
7192 	ipst = CONNQ_TO_IPST(q);
7193 
7194 	ip1dbg(("ip_siocaddrt:"));
7195 	/* Existence of mp1 verified in ip_wput_nondata */
7196 	mp1 = mp->b_cont->b_cont;
7197 	rt = (struct rtentry *)mp1->b_rptr;
7198 
7199 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
7200 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
7201 
7202 	/*
7203 	 * If the RTF_HOST flag is on, this is a request to assign a gateway
7204 	 * to a particular host address.  In this case, we set the netmask to
7205 	 * all ones for the particular destination address.  Otherwise,
7206 	 * determine the netmask to be used based on dst_addr and the interfaces
7207 	 * in use.
7208 	 */
7209 	if (rt->rt_flags & RTF_HOST) {
7210 		mask = IP_HOST_MASK;
7211 	} else {
7212 		/*
7213 		 * Note that ip_subnet_mask returns a zero mask in the case of
7214 		 * default (an all-zeroes address).
7215 		 */
7216 		mask = ip_subnet_mask(dst_addr, &ipif, ipst);
7217 	}
7218 
7219 	error = ip_rt_add(dst_addr, mask, gw_addr, 0, rt->rt_flags, NULL, NULL,
7220 	    B_TRUE, q, mp, ip_process_ioctl, NULL, ipst);
7221 	if (ipif != NULL)
7222 		ipif_refrele(ipif);
7223 	return (error);
7224 }
7225 
7226 /*
7227  * ip_siocdelrt is called to complete processing of an SIOCDELRT IOCTL.
7228  */
7229 /* ARGSUSED */
7230 int
7231 ip_siocdelrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
7232     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
7233 {
7234 	ipaddr_t dst_addr;
7235 	ipaddr_t gw_addr;
7236 	ipaddr_t mask;
7237 	int error;
7238 	mblk_t *mp1;
7239 	struct rtentry *rt;
7240 	ipif_t *ipif = NULL;
7241 	ip_stack_t	*ipst;
7242 
7243 	ASSERT(q->q_next == NULL);
7244 	ipst = CONNQ_TO_IPST(q);
7245 
7246 	ip1dbg(("ip_siocdelrt:"));
7247 	/* Existence of mp1 verified in ip_wput_nondata */
7248 	mp1 = mp->b_cont->b_cont;
7249 	rt = (struct rtentry *)mp1->b_rptr;
7250 
7251 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
7252 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
7253 
7254 	/*
7255 	 * If the RTF_HOST flag is on, this is a request to delete a gateway
7256 	 * to a particular host address.  In this case, we set the netmask to
7257 	 * all ones for the particular destination address.  Otherwise,
7258 	 * determine the netmask to be used based on dst_addr and the interfaces
7259 	 * in use.
7260 	 */
7261 	if (rt->rt_flags & RTF_HOST) {
7262 		mask = IP_HOST_MASK;
7263 	} else {
7264 		/*
7265 		 * Note that ip_subnet_mask returns a zero mask in the case of
7266 		 * default (an all-zeroes address).
7267 		 */
7268 		mask = ip_subnet_mask(dst_addr, &ipif, ipst);
7269 	}
7270 
7271 	error = ip_rt_delete(dst_addr, mask, gw_addr,
7272 	    RTA_DST | RTA_GATEWAY | RTA_NETMASK, rt->rt_flags, NULL, B_TRUE, q,
7273 	    mp, ip_process_ioctl, ipst);
7274 	if (ipif != NULL)
7275 		ipif_refrele(ipif);
7276 	return (error);
7277 }
7278 
7279 /*
7280  * Enqueue the mp onto the ipsq, chained by b_next.
7281  * b_prev stores the function to be executed later, and b_queue the queue
7282  * where this mp originated.
7283  */
7284 void
7285 ipsq_enq(ipsq_t *ipsq, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
7286     ill_t *pending_ill)
7287 {
7288 	conn_t	*connp;
7289 	ipxop_t *ipx = ipsq->ipsq_xop;
7290 
7291 	ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
7292 	ASSERT(MUTEX_HELD(&ipx->ipx_lock));
7293 	ASSERT(func != NULL);
7294 
7295 	mp->b_queue = q;
7296 	mp->b_prev = (void *)func;
7297 	mp->b_next = NULL;
7298 
7299 	switch (type) {
7300 	case CUR_OP:
7301 		if (ipx->ipx_mptail != NULL) {
7302 			ASSERT(ipx->ipx_mphead != NULL);
7303 			ipx->ipx_mptail->b_next = mp;
7304 		} else {
7305 			ASSERT(ipx->ipx_mphead == NULL);
7306 			ipx->ipx_mphead = mp;
7307 		}
7308 		ipx->ipx_mptail = mp;
7309 		break;
7310 
7311 	case NEW_OP:
7312 		if (ipsq->ipsq_xopq_mptail != NULL) {
7313 			ASSERT(ipsq->ipsq_xopq_mphead != NULL);
7314 			ipsq->ipsq_xopq_mptail->b_next = mp;
7315 		} else {
7316 			ASSERT(ipsq->ipsq_xopq_mphead == NULL);
7317 			ipsq->ipsq_xopq_mphead = mp;
7318 		}
7319 		ipsq->ipsq_xopq_mptail = mp;
7320 		ipx->ipx_ipsq_queued = B_TRUE;
7321 		break;
7322 
7323 	case SWITCH_OP:
7324 		ASSERT(ipsq->ipsq_swxop != NULL);
7325 		/* only one switch operation is currently allowed */
7326 		ASSERT(ipsq->ipsq_switch_mp == NULL);
7327 		ipsq->ipsq_switch_mp = mp;
7328 		ipx->ipx_ipsq_queued = B_TRUE;
7329 		break;
7330 	default:
7331 		cmn_err(CE_PANIC, "ipsq_enq %d type \n", type);
7332 	}
7333 
7334 	if (CONN_Q(q) && pending_ill != NULL) {
7335 		connp = Q_TO_CONN(q);
7336 		ASSERT(MUTEX_HELD(&connp->conn_lock));
7337 		connp->conn_oper_pending_ill = pending_ill;
7338 	}
7339 }
7340 
7341 /*
7342  * Dequeue the next message that requested exclusive access to this IPSQ's
7343  * xop.  Specifically:
7344  *
7345  *  1. If we're still processing the current operation on `ipsq', then
7346  *     dequeue the next message for the operation (from ipx_mphead), or
7347  *     return NULL if there are no queued messages for the operation.
7348  *     These messages are queued via CUR_OP to qwriter_ip() and friends.
7349  *
7350  *  2. If the current operation on `ipsq' has completed (ipx_current_ipif is
7351  *     not set) see if the ipsq has requested an xop switch.  If so, switch
7352  *     `ipsq' to a different xop.  Xop switches only happen when joining or
7353  *     leaving IPMP groups and require a careful dance -- see the comments
7354  *     in-line below for details.  If we're leaving a group xop or if we're
7355  *     joining a group xop and become writer on it, then we proceed to (3).
7356  *     Otherwise, we return NULL and exit the xop.
7357  *
7358  *  3. For each IPSQ in the xop, return any switch operation stored on
7359  *     ipsq_switch_mp (set via SWITCH_OP); these must be processed before
7360  *     any other messages queued on the IPSQ.  Otherwise, dequeue the next
7361  *     exclusive operation (queued via NEW_OP) stored on ipsq_xopq_mphead.
7362  *     Note that if the phyint tied to `ipsq' is not using IPMP there will
7363  *     only be one IPSQ in the xop.  Otherwise, there will be one IPSQ for
7364  *     each phyint in the group, including the IPMP meta-interface phyint.
7365  */
7366 static mblk_t *
7367 ipsq_dq(ipsq_t *ipsq)
7368 {
7369 	ill_t	*illv4, *illv6;
7370 	mblk_t	*mp;
7371 	ipsq_t	*xopipsq;
7372 	ipsq_t	*leftipsq = NULL;
7373 	ipxop_t *ipx;
7374 	phyint_t *phyi = ipsq->ipsq_phyint;
7375 	ip_stack_t *ipst = ipsq->ipsq_ipst;
7376 	boolean_t emptied = B_FALSE;
7377 
7378 	/*
7379 	 * Grab all the locks we need in the defined order (ill_g_lock ->
7380 	 * ipsq_lock -> ipx_lock); ill_g_lock is needed to use ipsq_next.
7381 	 */
7382 	rw_enter(&ipst->ips_ill_g_lock,
7383 	    ipsq->ipsq_swxop != NULL ? RW_WRITER : RW_READER);
7384 	mutex_enter(&ipsq->ipsq_lock);
7385 	ipx = ipsq->ipsq_xop;
7386 	mutex_enter(&ipx->ipx_lock);
7387 
7388 	/*
7389 	 * Dequeue the next message associated with the current exclusive
7390 	 * operation, if any.
7391 	 */
7392 	if ((mp = ipx->ipx_mphead) != NULL) {
7393 		ipx->ipx_mphead = mp->b_next;
7394 		if (ipx->ipx_mphead == NULL)
7395 			ipx->ipx_mptail = NULL;
7396 		mp->b_next = (void *)ipsq;
7397 		goto out;
7398 	}
7399 
7400 	if (ipx->ipx_current_ipif != NULL)
7401 		goto empty;
7402 
7403 	if (ipsq->ipsq_swxop != NULL) {
7404 		/*
7405 		 * The exclusive operation that is now being completed has
7406 		 * requested a switch to a different xop.  This happens
7407 		 * when an interface joins or leaves an IPMP group.  Joins
7408 		 * happen through SIOCSLIFGROUPNAME (ip_sioctl_groupname()).
7409 		 * Leaves happen via SIOCSLIFGROUPNAME, interface unplumb
7410 		 * (phyint_free()), or interface plumb for an ill type
7411 		 * not in the IPMP group (ip_rput_dlpi_writer()).
7412 		 *
7413 		 * Xop switches are not allowed on the IPMP meta-interface.
7414 		 */
7415 		ASSERT(phyi == NULL || !(phyi->phyint_flags & PHYI_IPMP));
7416 		ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
7417 		DTRACE_PROBE1(ipsq__switch, (ipsq_t *), ipsq);
7418 
7419 		if (ipsq->ipsq_swxop == &ipsq->ipsq_ownxop) {
7420 			/*
7421 			 * We're switching back to our own xop, so we have two
7422 			 * xop's to drain/exit: our own, and the group xop
7423 			 * that we are leaving.
7424 			 *
7425 			 * First, pull ourselves out of the group ipsq list.
7426 			 * This is safe since we're writer on ill_g_lock.
7427 			 */
7428 			ASSERT(ipsq->ipsq_xop != &ipsq->ipsq_ownxop);
7429 
7430 			xopipsq = ipx->ipx_ipsq;
7431 			while (xopipsq->ipsq_next != ipsq)
7432 				xopipsq = xopipsq->ipsq_next;
7433 
7434 			xopipsq->ipsq_next = ipsq->ipsq_next;
7435 			ipsq->ipsq_next = ipsq;
7436 			ipsq->ipsq_xop = ipsq->ipsq_swxop;
7437 			ipsq->ipsq_swxop = NULL;
7438 
7439 			/*
7440 			 * Second, prepare to exit the group xop.  The actual
7441 			 * ipsq_exit() is done at the end of this function
7442 			 * since we cannot hold any locks across ipsq_exit().
7443 			 * Note that although we drop the group's ipx_lock, no
7444 			 * threads can proceed since we're still ipx_writer.
7445 			 */
7446 			leftipsq = xopipsq;
7447 			mutex_exit(&ipx->ipx_lock);
7448 
7449 			/*
7450 			 * Third, set ipx to point to our own xop (which was
7451 			 * inactive and therefore can be entered).
7452 			 */
7453 			ipx = ipsq->ipsq_xop;
7454 			mutex_enter(&ipx->ipx_lock);
7455 			ASSERT(ipx->ipx_writer == NULL);
7456 			ASSERT(ipx->ipx_current_ipif == NULL);
7457 		} else {
7458 			/*
7459 			 * We're switching from our own xop to a group xop.
7460 			 * The requestor of the switch must ensure that the
7461 			 * group xop cannot go away (e.g. by ensuring the
7462 			 * phyint associated with the xop cannot go away).
7463 			 *
7464 			 * If we can become writer on our new xop, then we'll
7465 			 * do the drain.  Otherwise, the current writer of our
7466 			 * new xop will do the drain when it exits.
7467 			 *
7468 			 * First, splice ourselves into the group IPSQ list.
7469 			 * This is safe since we're writer on ill_g_lock.
7470 			 */
7471 			ASSERT(ipsq->ipsq_xop == &ipsq->ipsq_ownxop);
7472 
7473 			xopipsq = ipsq->ipsq_swxop->ipx_ipsq;
7474 			while (xopipsq->ipsq_next != ipsq->ipsq_swxop->ipx_ipsq)
7475 				xopipsq = xopipsq->ipsq_next;
7476 
7477 			xopipsq->ipsq_next = ipsq;
7478 			ipsq->ipsq_next = ipsq->ipsq_swxop->ipx_ipsq;
7479 			ipsq->ipsq_xop = ipsq->ipsq_swxop;
7480 			ipsq->ipsq_swxop = NULL;
7481 
7482 			/*
7483 			 * Second, exit our own xop, since it's now unused.
7484 			 * This is safe since we've got the only reference.
7485 			 */
7486 			ASSERT(ipx->ipx_writer == curthread);
7487 			ipx->ipx_writer = NULL;
7488 			VERIFY(--ipx->ipx_reentry_cnt == 0);
7489 			ipx->ipx_ipsq_queued = B_FALSE;
7490 			mutex_exit(&ipx->ipx_lock);
7491 
7492 			/*
7493 			 * Third, set ipx to point to our new xop, and check
7494 			 * if we can become writer on it.  If we cannot, then
7495 			 * the current writer will drain the IPSQ group when
7496 			 * it exits.  Our ipsq_xop is guaranteed to be stable
7497 			 * because we're still holding ipsq_lock.
7498 			 */
7499 			ipx = ipsq->ipsq_xop;
7500 			mutex_enter(&ipx->ipx_lock);
7501 			if (ipx->ipx_writer != NULL ||
7502 			    ipx->ipx_current_ipif != NULL) {
7503 				goto out;
7504 			}
7505 		}
7506 
7507 		/*
7508 		 * Fourth, become writer on our new ipx before we continue
7509 		 * with the drain.  Note that we never dropped ipsq_lock
7510 		 * above, so no other thread could've raced with us to
7511 		 * become writer first.  Also, we're holding ipx_lock, so
7512 		 * no other thread can examine the ipx right now.
7513 		 */
7514 		ASSERT(ipx->ipx_current_ipif == NULL);
7515 		ASSERT(ipx->ipx_mphead == NULL && ipx->ipx_mptail == NULL);
7516 		VERIFY(ipx->ipx_reentry_cnt++ == 0);
7517 		ipx->ipx_writer = curthread;
7518 		ipx->ipx_forced = B_FALSE;
7519 #ifdef DEBUG
7520 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
7521 #endif
7522 	}
7523 
7524 	xopipsq = ipsq;
7525 	do {
7526 		/*
7527 		 * So that other operations operate on a consistent and
7528 		 * complete phyint, a switch message on an IPSQ must be
7529 		 * handled prior to any other operations on that IPSQ.
7530 		 */
7531 		if ((mp = xopipsq->ipsq_switch_mp) != NULL) {
7532 			xopipsq->ipsq_switch_mp = NULL;
7533 			ASSERT(mp->b_next == NULL);
7534 			mp->b_next = (void *)xopipsq;
7535 			goto out;
7536 		}
7537 
7538 		if ((mp = xopipsq->ipsq_xopq_mphead) != NULL) {
7539 			xopipsq->ipsq_xopq_mphead = mp->b_next;
7540 			if (xopipsq->ipsq_xopq_mphead == NULL)
7541 				xopipsq->ipsq_xopq_mptail = NULL;
7542 			mp->b_next = (void *)xopipsq;
7543 			goto out;
7544 		}
7545 	} while ((xopipsq = xopipsq->ipsq_next) != ipsq);
7546 empty:
7547 	/*
7548 	 * There are no messages.  Further, we are holding ipx_lock, hence no
7549 	 * new messages can end up on any IPSQ in the xop.
7550 	 */
7551 	ipx->ipx_writer = NULL;
7552 	ipx->ipx_forced = B_FALSE;
7553 	VERIFY(--ipx->ipx_reentry_cnt == 0);
7554 	ipx->ipx_ipsq_queued = B_FALSE;
7555 	emptied = B_TRUE;
7556 #ifdef	DEBUG
7557 	ipx->ipx_depth = 0;
7558 #endif
7559 out:
7560 	mutex_exit(&ipx->ipx_lock);
7561 	mutex_exit(&ipsq->ipsq_lock);
7562 
7563 	/*
7564 	 * If we completely emptied the xop, then wake up any threads waiting
7565 	 * to enter any of the IPSQ's associated with it.
7566 	 */
7567 	if (emptied) {
7568 		xopipsq = ipsq;
7569 		do {
7570 			if ((phyi = xopipsq->ipsq_phyint) == NULL)
7571 				continue;
7572 
7573 			illv4 = phyi->phyint_illv4;
7574 			illv6 = phyi->phyint_illv6;
7575 
7576 			GRAB_ILL_LOCKS(illv4, illv6);
7577 			if (illv4 != NULL)
7578 				cv_broadcast(&illv4->ill_cv);
7579 			if (illv6 != NULL)
7580 				cv_broadcast(&illv6->ill_cv);
7581 			RELEASE_ILL_LOCKS(illv4, illv6);
7582 		} while ((xopipsq = xopipsq->ipsq_next) != ipsq);
7583 	}
7584 	rw_exit(&ipst->ips_ill_g_lock);
7585 
7586 	/*
7587 	 * Now that all locks are dropped, exit the IPSQ we left.
7588 	 */
7589 	if (leftipsq != NULL)
7590 		ipsq_exit(leftipsq);
7591 
7592 	return (mp);
7593 }
7594 
7595 /*
7596  * Enter the ipsq corresponding to ill, by waiting synchronously till
7597  * we can enter the ipsq exclusively. Unless 'force' is used, the ipsq
7598  * will have to drain completely before ipsq_enter returns success.
7599  * ipx_current_ipif will be set if some exclusive op is in progress,
7600  * and the ipsq_exit logic will start the next enqueued op after
7601  * completion of the current op. If 'force' is used, we don't wait
7602  * for the enqueued ops. This is needed when a conn_close wants to
7603  * enter the ipsq and abort an ioctl that is somehow stuck. Unplumb
7604  * of an ill can also use this option. But we dont' use it currently.
7605  */
7606 #define	ENTER_SQ_WAIT_TICKS 100
7607 boolean_t
7608 ipsq_enter(ill_t *ill, boolean_t force, int type)
7609 {
7610 	ipsq_t	*ipsq;
7611 	ipxop_t *ipx;
7612 	boolean_t waited_enough = B_FALSE;
7613 
7614 	/*
7615 	 * Note that the relationship between ill and ipsq is fixed as long as
7616 	 * the ill is not ILL_CONDEMNED.  Holding ipsq_lock ensures the
7617 	 * relationship between the IPSQ and xop cannot change.  However,
7618 	 * since we cannot hold ipsq_lock across the cv_wait(), it may change
7619 	 * while we're waiting.  We wait on ill_cv and rely on ipsq_exit()
7620 	 * waking up all ills in the xop when it becomes available.
7621 	 */
7622 	mutex_enter(&ill->ill_lock);
7623 	for (;;) {
7624 		if (ill->ill_state_flags & ILL_CONDEMNED) {
7625 			mutex_exit(&ill->ill_lock);
7626 			return (B_FALSE);
7627 		}
7628 
7629 		ipsq = ill->ill_phyint->phyint_ipsq;
7630 		mutex_enter(&ipsq->ipsq_lock);
7631 		ipx = ipsq->ipsq_xop;
7632 		mutex_enter(&ipx->ipx_lock);
7633 
7634 		if (ipx->ipx_writer == NULL && (type == CUR_OP ||
7635 		    ipx->ipx_current_ipif == NULL || waited_enough))
7636 			break;
7637 
7638 		if (!force || ipx->ipx_writer != NULL) {
7639 			mutex_exit(&ipx->ipx_lock);
7640 			mutex_exit(&ipsq->ipsq_lock);
7641 			cv_wait(&ill->ill_cv, &ill->ill_lock);
7642 		} else {
7643 			mutex_exit(&ipx->ipx_lock);
7644 			mutex_exit(&ipsq->ipsq_lock);
7645 			(void) cv_timedwait(&ill->ill_cv,
7646 			    &ill->ill_lock, lbolt + ENTER_SQ_WAIT_TICKS);
7647 			waited_enough = B_TRUE;
7648 		}
7649 	}
7650 
7651 	ASSERT(ipx->ipx_mphead == NULL && ipx->ipx_mptail == NULL);
7652 	ASSERT(ipx->ipx_reentry_cnt == 0);
7653 	ipx->ipx_writer = curthread;
7654 	ipx->ipx_forced = (ipx->ipx_current_ipif != NULL);
7655 	ipx->ipx_reentry_cnt++;
7656 #ifdef DEBUG
7657 	ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
7658 #endif
7659 	mutex_exit(&ipx->ipx_lock);
7660 	mutex_exit(&ipsq->ipsq_lock);
7661 	mutex_exit(&ill->ill_lock);
7662 	return (B_TRUE);
7663 }
7664 
7665 boolean_t
7666 ill_perim_enter(ill_t *ill)
7667 {
7668 	return (ipsq_enter(ill, B_FALSE, CUR_OP));
7669 }
7670 
7671 void
7672 ill_perim_exit(ill_t *ill)
7673 {
7674 	ipsq_exit(ill->ill_phyint->phyint_ipsq);
7675 }
7676 
7677 /*
7678  * The ipsq_t (ipsq) is the synchronization data structure used to serialize
7679  * certain critical operations like plumbing (i.e. most set ioctls), multicast
7680  * joins, igmp/mld timers, etc.  There is one ipsq per phyint. The ipsq
7681  * serializes exclusive ioctls issued by applications on a per ipsq basis in
7682  * ipsq_xopq_mphead. It also protects against multiple threads executing in
7683  * the ipsq. Responses from the driver pertain to the current ioctl (say a
7684  * DL_BIND_ACK in response to a DL_BIND_REQ initiated as part of bringing
7685  * up the interface) and are enqueued in ipx_mphead.
7686  *
7687  * If a thread does not want to reenter the ipsq when it is already writer,
7688  * it must make sure that the specified reentry point to be called later
7689  * when the ipsq is empty, nor any code path starting from the specified reentry
7690  * point must never ever try to enter the ipsq again. Otherwise it can lead
7691  * to an infinite loop. The reentry point ip_rput_dlpi_writer is an example.
7692  * When the thread that is currently exclusive finishes, it (ipsq_exit)
7693  * dequeues the requests waiting to become exclusive in ipx_mphead and calls
7694  * the reentry point. When the list at ipx_mphead becomes empty ipsq_exit
7695  * proceeds to dequeue the next ioctl in ipsq_xopq_mphead and start the next
7696  * ioctl if the current ioctl has completed. If the current ioctl is still
7697  * in progress it simply returns. The current ioctl could be waiting for
7698  * a response from another module (arp or the driver or could be waiting for
7699  * the ipif/ill/ire refcnts to drop to zero. In such a case the ipx_pending_mp
7700  * and ipx_pending_ipif are set. ipx_current_ipif is set throughout the
7701  * execution of the ioctl and ipsq_exit does not start the next ioctl unless
7702  * ipx_current_ipif is NULL which happens only once the ioctl is complete and
7703  * all associated DLPI operations have completed.
7704  */
7705 
7706 /*
7707  * Try to enter the IPSQ corresponding to `ipif' or `ill' exclusively (`ipif'
7708  * and `ill' cannot both be specified).  Returns a pointer to the entered IPSQ
7709  * on success, or NULL on failure.  The caller ensures ipif/ill is valid by
7710  * refholding it as necessary.  If the IPSQ cannot be entered and `func' is
7711  * non-NULL, then `func' will be called back with `q' and `mp' once the IPSQ
7712  * can be entered.  If `func' is NULL, then `q' and `mp' are ignored.
7713  */
7714 ipsq_t *
7715 ipsq_try_enter(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
7716     ipsq_func_t func, int type, boolean_t reentry_ok)
7717 {
7718 	ipsq_t	*ipsq;
7719 	ipxop_t	*ipx;
7720 
7721 	/* Only 1 of ipif or ill can be specified */
7722 	ASSERT((ipif != NULL) ^ (ill != NULL));
7723 	if (ipif != NULL)
7724 		ill = ipif->ipif_ill;
7725 
7726 	/*
7727 	 * lock ordering: conn_lock -> ill_lock -> ipsq_lock -> ipx_lock.
7728 	 * ipx of an ipsq can't change when ipsq_lock is held.
7729 	 */
7730 	GRAB_CONN_LOCK(q);
7731 	mutex_enter(&ill->ill_lock);
7732 	ipsq = ill->ill_phyint->phyint_ipsq;
7733 	mutex_enter(&ipsq->ipsq_lock);
7734 	ipx = ipsq->ipsq_xop;
7735 	mutex_enter(&ipx->ipx_lock);
7736 
7737 	/*
7738 	 * 1. Enter the ipsq if we are already writer and reentry is ok.
7739 	 *    (Note: If the caller does not specify reentry_ok then neither
7740 	 *    'func' nor any of its callees must ever attempt to enter the ipsq
7741 	 *    again. Otherwise it can lead to an infinite loop
7742 	 * 2. Enter the ipsq if there is no current writer and this attempted
7743 	 *    entry is part of the current operation
7744 	 * 3. Enter the ipsq if there is no current writer and this is a new
7745 	 *    operation and the operation queue is empty and there is no
7746 	 *    operation currently in progress
7747 	 */
7748 	if ((ipx->ipx_writer == curthread && reentry_ok) ||
7749 	    (ipx->ipx_writer == NULL && (type == CUR_OP || (type == NEW_OP &&
7750 	    !ipx->ipx_ipsq_queued && ipx->ipx_current_ipif == NULL)))) {
7751 		/* Success. */
7752 		ipx->ipx_reentry_cnt++;
7753 		ipx->ipx_writer = curthread;
7754 		ipx->ipx_forced = B_FALSE;
7755 		mutex_exit(&ipx->ipx_lock);
7756 		mutex_exit(&ipsq->ipsq_lock);
7757 		mutex_exit(&ill->ill_lock);
7758 		RELEASE_CONN_LOCK(q);
7759 #ifdef DEBUG
7760 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
7761 #endif
7762 		return (ipsq);
7763 	}
7764 
7765 	if (func != NULL)
7766 		ipsq_enq(ipsq, q, mp, func, type, ill);
7767 
7768 	mutex_exit(&ipx->ipx_lock);
7769 	mutex_exit(&ipsq->ipsq_lock);
7770 	mutex_exit(&ill->ill_lock);
7771 	RELEASE_CONN_LOCK(q);
7772 	return (NULL);
7773 }
7774 
7775 /*
7776  * Try to enter the IPSQ corresponding to `ill' as writer.  The caller ensures
7777  * ill is valid by refholding it if necessary; we will refrele.  If the IPSQ
7778  * cannot be entered, the mp is queued for completion.
7779  */
7780 void
7781 qwriter_ip(ill_t *ill, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
7782     boolean_t reentry_ok)
7783 {
7784 	ipsq_t	*ipsq;
7785 
7786 	ipsq = ipsq_try_enter(NULL, ill, q, mp, func, type, reentry_ok);
7787 
7788 	/*
7789 	 * Drop the caller's refhold on the ill.  This is safe since we either
7790 	 * entered the IPSQ (and thus are exclusive), or failed to enter the
7791 	 * IPSQ, in which case we return without accessing ill anymore.  This
7792 	 * is needed because func needs to see the correct refcount.
7793 	 * e.g. removeif can work only then.
7794 	 */
7795 	ill_refrele(ill);
7796 	if (ipsq != NULL) {
7797 		(*func)(ipsq, q, mp, NULL);
7798 		ipsq_exit(ipsq);
7799 	}
7800 }
7801 
7802 /*
7803  * Exit the specified IPSQ.  If this is the final exit on it then drain it
7804  * prior to exiting.  Caller must be writer on the specified IPSQ.
7805  */
7806 void
7807 ipsq_exit(ipsq_t *ipsq)
7808 {
7809 	mblk_t *mp;
7810 	ipsq_t *mp_ipsq;
7811 	queue_t	*q;
7812 	phyint_t *phyi;
7813 	ipsq_func_t func;
7814 
7815 	ASSERT(IAM_WRITER_IPSQ(ipsq));
7816 
7817 	ASSERT(ipsq->ipsq_xop->ipx_reentry_cnt >= 1);
7818 	if (ipsq->ipsq_xop->ipx_reentry_cnt != 1) {
7819 		ipsq->ipsq_xop->ipx_reentry_cnt--;
7820 		return;
7821 	}
7822 
7823 	for (;;) {
7824 		phyi = ipsq->ipsq_phyint;
7825 		mp = ipsq_dq(ipsq);
7826 		mp_ipsq = (mp == NULL) ? NULL : (ipsq_t *)mp->b_next;
7827 
7828 		/*
7829 		 * If we've changed to a new IPSQ, and the phyint associated
7830 		 * with the old one has gone away, free the old IPSQ.  Note
7831 		 * that this cannot happen while the IPSQ is in a group.
7832 		 */
7833 		if (mp_ipsq != ipsq && phyi == NULL) {
7834 			ASSERT(ipsq->ipsq_next == ipsq);
7835 			ASSERT(ipsq->ipsq_xop == &ipsq->ipsq_ownxop);
7836 			ipsq_delete(ipsq);
7837 		}
7838 
7839 		if (mp == NULL)
7840 			break;
7841 
7842 		q = mp->b_queue;
7843 		func = (ipsq_func_t)mp->b_prev;
7844 		ipsq = mp_ipsq;
7845 		mp->b_next = mp->b_prev = NULL;
7846 		mp->b_queue = NULL;
7847 
7848 		/*
7849 		 * If 'q' is an conn queue, it is valid, since we did a
7850 		 * a refhold on the conn at the start of the ioctl.
7851 		 * If 'q' is an ill queue, it is valid, since close of an
7852 		 * ill will clean up its IPSQ.
7853 		 */
7854 		(*func)(ipsq, q, mp, NULL);
7855 	}
7856 }
7857 
7858 /*
7859  * Start the current exclusive operation on `ipsq'; associate it with `ipif'
7860  * and `ioccmd'.
7861  */
7862 void
7863 ipsq_current_start(ipsq_t *ipsq, ipif_t *ipif, int ioccmd)
7864 {
7865 	ill_t *ill = ipif->ipif_ill;
7866 	ipxop_t *ipx = ipsq->ipsq_xop;
7867 
7868 	ASSERT(IAM_WRITER_IPSQ(ipsq));
7869 	ASSERT(ipx->ipx_current_ipif == NULL);
7870 	ASSERT(ipx->ipx_current_ioctl == 0);
7871 
7872 	ipx->ipx_current_done = B_FALSE;
7873 	ipx->ipx_current_ioctl = ioccmd;
7874 	mutex_enter(&ipx->ipx_lock);
7875 	ipx->ipx_current_ipif = ipif;
7876 	mutex_exit(&ipx->ipx_lock);
7877 
7878 	/*
7879 	 * Set IPIF_CHANGING on one or more ipifs associated with the
7880 	 * current exclusive operation.  IPIF_CHANGING prevents any new
7881 	 * references to the ipif (so that the references will eventually
7882 	 * drop to zero) and also prevents any "get" operations (e.g.,
7883 	 * SIOCGLIFFLAGS) from being able to access the ipif until the
7884 	 * operation has completed and the ipif is again in a stable state.
7885 	 *
7886 	 * For ioctls, IPIF_CHANGING is set on the ipif associated with the
7887 	 * ioctl.  For internal operations (where ioccmd is zero), all ipifs
7888 	 * on the ill are marked with IPIF_CHANGING since it's unclear which
7889 	 * ipifs will be affected.
7890 	 *
7891 	 * Note that SIOCLIFREMOVEIF is a special case as it sets
7892 	 * IPIF_CONDEMNED internally after identifying the right ipif to
7893 	 * operate on.
7894 	 */
7895 	switch (ioccmd) {
7896 	case SIOCLIFREMOVEIF:
7897 		break;
7898 	case 0:
7899 		mutex_enter(&ill->ill_lock);
7900 		ipif = ipif->ipif_ill->ill_ipif;
7901 		for (; ipif != NULL; ipif = ipif->ipif_next)
7902 			ipif->ipif_state_flags |= IPIF_CHANGING;
7903 		mutex_exit(&ill->ill_lock);
7904 		break;
7905 	default:
7906 		mutex_enter(&ill->ill_lock);
7907 		ipif->ipif_state_flags |= IPIF_CHANGING;
7908 		mutex_exit(&ill->ill_lock);
7909 	}
7910 }
7911 
7912 /*
7913  * Finish the current exclusive operation on `ipsq'.  Usually, this will allow
7914  * the next exclusive operation to begin once we ipsq_exit().  However, if
7915  * pending DLPI operations remain, then we will wait for the queue to drain
7916  * before allowing the next exclusive operation to begin.  This ensures that
7917  * DLPI operations from one exclusive operation are never improperly processed
7918  * as part of a subsequent exclusive operation.
7919  */
7920 void
7921 ipsq_current_finish(ipsq_t *ipsq)
7922 {
7923 	ipxop_t	*ipx = ipsq->ipsq_xop;
7924 	t_uscalar_t dlpi_pending = DL_PRIM_INVAL;
7925 	ipif_t	*ipif = ipx->ipx_current_ipif;
7926 
7927 	ASSERT(IAM_WRITER_IPSQ(ipsq));
7928 
7929 	/*
7930 	 * For SIOCLIFREMOVEIF, the ipif has been already been blown away
7931 	 * (but in that case, IPIF_CHANGING will already be clear and no
7932 	 * pending DLPI messages can remain).
7933 	 */
7934 	if (ipx->ipx_current_ioctl != SIOCLIFREMOVEIF) {
7935 		ill_t *ill = ipif->ipif_ill;
7936 
7937 		mutex_enter(&ill->ill_lock);
7938 		dlpi_pending = ill->ill_dlpi_pending;
7939 		if (ipx->ipx_current_ioctl == 0) {
7940 			ipif = ill->ill_ipif;
7941 			for (; ipif != NULL; ipif = ipif->ipif_next)
7942 				ipif->ipif_state_flags &= ~IPIF_CHANGING;
7943 		} else {
7944 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
7945 		}
7946 		mutex_exit(&ill->ill_lock);
7947 	}
7948 
7949 	ASSERT(!ipx->ipx_current_done);
7950 	ipx->ipx_current_done = B_TRUE;
7951 	ipx->ipx_current_ioctl = 0;
7952 	if (dlpi_pending == DL_PRIM_INVAL) {
7953 		mutex_enter(&ipx->ipx_lock);
7954 		ipx->ipx_current_ipif = NULL;
7955 		mutex_exit(&ipx->ipx_lock);
7956 	}
7957 }
7958 
7959 /*
7960  * The ill is closing. Flush all messages on the ipsq that originated
7961  * from this ill. Usually there wont' be any messages on the ipsq_xopq_mphead
7962  * for this ill since ipsq_enter could not have entered until then.
7963  * New messages can't be queued since the CONDEMNED flag is set.
7964  */
7965 static void
7966 ipsq_flush(ill_t *ill)
7967 {
7968 	queue_t	*q;
7969 	mblk_t	*prev;
7970 	mblk_t	*mp;
7971 	mblk_t	*mp_next;
7972 	ipxop_t	*ipx = ill->ill_phyint->phyint_ipsq->ipsq_xop;
7973 
7974 	ASSERT(IAM_WRITER_ILL(ill));
7975 
7976 	/*
7977 	 * Flush any messages sent up by the driver.
7978 	 */
7979 	mutex_enter(&ipx->ipx_lock);
7980 	for (prev = NULL, mp = ipx->ipx_mphead; mp != NULL; mp = mp_next) {
7981 		mp_next = mp->b_next;
7982 		q = mp->b_queue;
7983 		if (q == ill->ill_rq || q == ill->ill_wq) {
7984 			/* dequeue mp */
7985 			if (prev == NULL)
7986 				ipx->ipx_mphead = mp->b_next;
7987 			else
7988 				prev->b_next = mp->b_next;
7989 			if (ipx->ipx_mptail == mp) {
7990 				ASSERT(mp_next == NULL);
7991 				ipx->ipx_mptail = prev;
7992 			}
7993 			inet_freemsg(mp);
7994 		} else {
7995 			prev = mp;
7996 		}
7997 	}
7998 	mutex_exit(&ipx->ipx_lock);
7999 	(void) ipsq_pending_mp_cleanup(ill, NULL);
8000 	ipsq_xopq_mp_cleanup(ill, NULL);
8001 	ill_pending_mp_cleanup(ill);
8002 }
8003 
8004 /*
8005  * Parse an iftun_req structure coming down SIOC[GS]TUNPARAM ioctls,
8006  * refhold and return the associated ipif
8007  */
8008 /* ARGSUSED */
8009 int
8010 ip_extract_tunreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
8011     cmd_info_t *ci, ipsq_func_t func)
8012 {
8013 	boolean_t exists;
8014 	struct iftun_req *ta;
8015 	ipif_t  *ipif;
8016 	ill_t   *ill;
8017 	boolean_t isv6;
8018 	mblk_t  *mp1;
8019 	int error;
8020 	conn_t  *connp;
8021 	ip_stack_t  *ipst;
8022 
8023 	/* Existence verified in ip_wput_nondata */
8024 	mp1 = mp->b_cont->b_cont;
8025 	ta = (struct iftun_req *)mp1->b_rptr;
8026 	/*
8027 	 * Null terminate the string to protect against buffer
8028 	 * overrun. String was generated by user code and may not
8029 	 * be trusted.
8030 	 */
8031 	ta->ifta_lifr_name[LIFNAMSIZ - 1] = '\0';
8032 
8033 	connp = Q_TO_CONN(q);
8034 	isv6 = connp->conn_af_isv6;
8035 	ipst = connp->conn_netstack->netstack_ip;
8036 
8037 	/* Disallows implicit create */
8038 	ipif = ipif_lookup_on_name(ta->ifta_lifr_name,
8039 	    mi_strlen(ta->ifta_lifr_name), B_FALSE, &exists, isv6,
8040 	    connp->conn_zoneid, CONNP_TO_WQ(connp), mp, func, &error, ipst);
8041 	if (ipif == NULL)
8042 		return (error);
8043 
8044 	if (ipif->ipif_id != 0) {
8045 		/*
8046 		 * We really don't want to set/get tunnel parameters
8047 		 * on virtual tunnel interfaces.  Only allow the
8048 		 * base tunnel to do these.
8049 		 */
8050 		ipif_refrele(ipif);
8051 		return (EINVAL);
8052 	}
8053 
8054 	/*
8055 	 * Send down to tunnel mod for ioctl processing.
8056 	 * Will finish ioctl in ip_rput_other().
8057 	 */
8058 	ill = ipif->ipif_ill;
8059 	if (ill->ill_net_type == IRE_LOOPBACK) {
8060 		ipif_refrele(ipif);
8061 		return (EOPNOTSUPP);
8062 	}
8063 
8064 	if (ill->ill_wq == NULL) {
8065 		ipif_refrele(ipif);
8066 		return (ENXIO);
8067 	}
8068 	/*
8069 	 * Mark the ioctl as coming from an IPv6 interface for
8070 	 * tun's convenience.
8071 	 */
8072 	if (ill->ill_isv6)
8073 		ta->ifta_flags |= 0x80000000;
8074 	ci->ci_ipif = ipif;
8075 	return (0);
8076 }
8077 
8078 /*
8079  * Parse an ifreq or lifreq struct coming down ioctls and refhold
8080  * and return the associated ipif.
8081  * Return value:
8082  *	Non zero: An error has occurred. ci may not be filled out.
8083  *	zero : ci is filled out with the ioctl cmd in ci.ci_name, and
8084  *	a held ipif in ci.ci_ipif.
8085  */
8086 int
8087 ip_extract_lifreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
8088     cmd_info_t *ci, ipsq_func_t func)
8089 {
8090 	char		*name;
8091 	struct ifreq    *ifr;
8092 	struct lifreq    *lifr;
8093 	ipif_t		*ipif = NULL;
8094 	ill_t		*ill;
8095 	conn_t		*connp;
8096 	boolean_t	isv6;
8097 	boolean_t	exists;
8098 	int		err;
8099 	mblk_t		*mp1;
8100 	zoneid_t	zoneid;
8101 	ip_stack_t	*ipst;
8102 
8103 	if (q->q_next != NULL) {
8104 		ill = (ill_t *)q->q_ptr;
8105 		isv6 = ill->ill_isv6;
8106 		connp = NULL;
8107 		zoneid = ALL_ZONES;
8108 		ipst = ill->ill_ipst;
8109 	} else {
8110 		ill = NULL;
8111 		connp = Q_TO_CONN(q);
8112 		isv6 = connp->conn_af_isv6;
8113 		zoneid = connp->conn_zoneid;
8114 		if (zoneid == GLOBAL_ZONEID) {
8115 			/* global zone can access ipifs in all zones */
8116 			zoneid = ALL_ZONES;
8117 		}
8118 		ipst = connp->conn_netstack->netstack_ip;
8119 	}
8120 
8121 	/* Has been checked in ip_wput_nondata */
8122 	mp1 = mp->b_cont->b_cont;
8123 
8124 	if (ipip->ipi_cmd_type == IF_CMD) {
8125 		/* This a old style SIOC[GS]IF* command */
8126 		ifr = (struct ifreq *)mp1->b_rptr;
8127 		/*
8128 		 * Null terminate the string to protect against buffer
8129 		 * overrun. String was generated by user code and may not
8130 		 * be trusted.
8131 		 */
8132 		ifr->ifr_name[IFNAMSIZ - 1] = '\0';
8133 		name = ifr->ifr_name;
8134 		ci->ci_sin = (sin_t *)&ifr->ifr_addr;
8135 		ci->ci_sin6 = NULL;
8136 		ci->ci_lifr = (struct lifreq *)ifr;
8137 	} else {
8138 		/* This a new style SIOC[GS]LIF* command */
8139 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
8140 		lifr = (struct lifreq *)mp1->b_rptr;
8141 		/*
8142 		 * Null terminate the string to protect against buffer
8143 		 * overrun. String was generated by user code and may not
8144 		 * be trusted.
8145 		 */
8146 		lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
8147 		name = lifr->lifr_name;
8148 		ci->ci_sin = (sin_t *)&lifr->lifr_addr;
8149 		ci->ci_sin6 = (sin6_t *)&lifr->lifr_addr;
8150 		ci->ci_lifr = lifr;
8151 	}
8152 
8153 	if (ipip->ipi_cmd == SIOCSLIFNAME) {
8154 		/*
8155 		 * The ioctl will be failed if the ioctl comes down
8156 		 * an conn stream
8157 		 */
8158 		if (ill == NULL) {
8159 			/*
8160 			 * Not an ill queue, return EINVAL same as the
8161 			 * old error code.
8162 			 */
8163 			return (ENXIO);
8164 		}
8165 		ipif = ill->ill_ipif;
8166 		ipif_refhold(ipif);
8167 	} else {
8168 		ipif = ipif_lookup_on_name(name, mi_strlen(name), B_FALSE,
8169 		    &exists, isv6, zoneid,
8170 		    (connp == NULL) ? q : CONNP_TO_WQ(connp), mp, func, &err,
8171 		    ipst);
8172 		if (ipif == NULL) {
8173 			if (err == EINPROGRESS)
8174 				return (err);
8175 			err = 0;	/* Ensure we don't use it below */
8176 		}
8177 	}
8178 
8179 	/*
8180 	 * Old style [GS]IFCMD does not admit IPv6 ipif
8181 	 */
8182 	if (ipif != NULL && ipif->ipif_isv6 && ipip->ipi_cmd_type == IF_CMD) {
8183 		ipif_refrele(ipif);
8184 		return (ENXIO);
8185 	}
8186 
8187 	if (ipif == NULL && ill != NULL && ill->ill_ipif != NULL &&
8188 	    name[0] == '\0') {
8189 		/*
8190 		 * Handle a or a SIOC?IF* with a null name
8191 		 * during plumb (on the ill queue before the I_PLINK).
8192 		 */
8193 		ipif = ill->ill_ipif;
8194 		ipif_refhold(ipif);
8195 	}
8196 
8197 	if (ipif == NULL)
8198 		return (ENXIO);
8199 
8200 	ci->ci_ipif = ipif;
8201 	return (0);
8202 }
8203 
8204 /*
8205  * Return the total number of ipifs.
8206  */
8207 static uint_t
8208 ip_get_numifs(zoneid_t zoneid, ip_stack_t *ipst)
8209 {
8210 	uint_t numifs = 0;
8211 	ill_t	*ill;
8212 	ill_walk_context_t	ctx;
8213 	ipif_t	*ipif;
8214 
8215 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
8216 	ill = ILL_START_WALK_V4(&ctx, ipst);
8217 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8218 		if (IS_UNDER_IPMP(ill))
8219 			continue;
8220 		for (ipif = ill->ill_ipif; ipif != NULL;
8221 		    ipif = ipif->ipif_next) {
8222 			if (ipif->ipif_zoneid == zoneid ||
8223 			    ipif->ipif_zoneid == ALL_ZONES)
8224 				numifs++;
8225 		}
8226 	}
8227 	rw_exit(&ipst->ips_ill_g_lock);
8228 	return (numifs);
8229 }
8230 
8231 /*
8232  * Return the total number of ipifs.
8233  */
8234 static uint_t
8235 ip_get_numlifs(int family, int lifn_flags, zoneid_t zoneid, ip_stack_t *ipst)
8236 {
8237 	uint_t numifs = 0;
8238 	ill_t	*ill;
8239 	ipif_t	*ipif;
8240 	ill_walk_context_t	ctx;
8241 
8242 	ip1dbg(("ip_get_numlifs(%d %u %d)\n", family, lifn_flags, (int)zoneid));
8243 
8244 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
8245 	if (family == AF_INET)
8246 		ill = ILL_START_WALK_V4(&ctx, ipst);
8247 	else if (family == AF_INET6)
8248 		ill = ILL_START_WALK_V6(&ctx, ipst);
8249 	else
8250 		ill = ILL_START_WALK_ALL(&ctx, ipst);
8251 
8252 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8253 		if (IS_UNDER_IPMP(ill) && !(lifn_flags & LIFC_UNDER_IPMP))
8254 			continue;
8255 
8256 		for (ipif = ill->ill_ipif; ipif != NULL;
8257 		    ipif = ipif->ipif_next) {
8258 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
8259 			    !(lifn_flags & LIFC_NOXMIT))
8260 				continue;
8261 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
8262 			    !(lifn_flags & LIFC_TEMPORARY))
8263 				continue;
8264 			if (((ipif->ipif_flags &
8265 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
8266 			    IPIF_DEPRECATED)) ||
8267 			    IS_LOOPBACK(ill) ||
8268 			    !(ipif->ipif_flags & IPIF_UP)) &&
8269 			    (lifn_flags & LIFC_EXTERNAL_SOURCE))
8270 				continue;
8271 
8272 			if (zoneid != ipif->ipif_zoneid &&
8273 			    ipif->ipif_zoneid != ALL_ZONES &&
8274 			    (zoneid != GLOBAL_ZONEID ||
8275 			    !(lifn_flags & LIFC_ALLZONES)))
8276 				continue;
8277 
8278 			numifs++;
8279 		}
8280 	}
8281 	rw_exit(&ipst->ips_ill_g_lock);
8282 	return (numifs);
8283 }
8284 
8285 uint_t
8286 ip_get_lifsrcofnum(ill_t *ill)
8287 {
8288 	uint_t numifs = 0;
8289 	ill_t	*ill_head = ill;
8290 	ip_stack_t	*ipst = ill->ill_ipst;
8291 
8292 	/*
8293 	 * ill_g_usesrc_lock protects ill_usesrc_grp_next, for example, some
8294 	 * other thread may be trying to relink the ILLs in this usesrc group
8295 	 * and adjusting the ill_usesrc_grp_next pointers
8296 	 */
8297 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
8298 	if ((ill->ill_usesrc_ifindex == 0) &&
8299 	    (ill->ill_usesrc_grp_next != NULL)) {
8300 		for (; (ill != NULL) && (ill->ill_usesrc_grp_next != ill_head);
8301 		    ill = ill->ill_usesrc_grp_next)
8302 			numifs++;
8303 	}
8304 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
8305 
8306 	return (numifs);
8307 }
8308 
8309 /* Null values are passed in for ipif, sin, and ifreq */
8310 /* ARGSUSED */
8311 int
8312 ip_sioctl_get_ifnum(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8313     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8314 {
8315 	int *nump;
8316 	conn_t *connp = Q_TO_CONN(q);
8317 
8318 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
8319 
8320 	/* Existence of b_cont->b_cont checked in ip_wput_nondata */
8321 	nump = (int *)mp->b_cont->b_cont->b_rptr;
8322 
8323 	*nump = ip_get_numifs(connp->conn_zoneid,
8324 	    connp->conn_netstack->netstack_ip);
8325 	ip1dbg(("ip_sioctl_get_ifnum numifs %d", *nump));
8326 	return (0);
8327 }
8328 
8329 /* Null values are passed in for ipif, sin, and ifreq */
8330 /* ARGSUSED */
8331 int
8332 ip_sioctl_get_lifnum(ipif_t *dummy_ipif, sin_t *dummy_sin,
8333     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8334 {
8335 	struct lifnum *lifn;
8336 	mblk_t	*mp1;
8337 	conn_t *connp = Q_TO_CONN(q);
8338 
8339 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
8340 
8341 	/* Existence checked in ip_wput_nondata */
8342 	mp1 = mp->b_cont->b_cont;
8343 
8344 	lifn = (struct lifnum *)mp1->b_rptr;
8345 	switch (lifn->lifn_family) {
8346 	case AF_UNSPEC:
8347 	case AF_INET:
8348 	case AF_INET6:
8349 		break;
8350 	default:
8351 		return (EAFNOSUPPORT);
8352 	}
8353 
8354 	lifn->lifn_count = ip_get_numlifs(lifn->lifn_family, lifn->lifn_flags,
8355 	    connp->conn_zoneid, connp->conn_netstack->netstack_ip);
8356 	ip1dbg(("ip_sioctl_get_lifnum numifs %d", lifn->lifn_count));
8357 	return (0);
8358 }
8359 
8360 /* ARGSUSED */
8361 int
8362 ip_sioctl_get_ifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8363     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8364 {
8365 	STRUCT_HANDLE(ifconf, ifc);
8366 	mblk_t *mp1;
8367 	struct iocblk *iocp;
8368 	struct ifreq *ifr;
8369 	ill_walk_context_t	ctx;
8370 	ill_t	*ill;
8371 	ipif_t	*ipif;
8372 	struct sockaddr_in *sin;
8373 	int32_t	ifclen;
8374 	zoneid_t zoneid;
8375 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
8376 
8377 	ASSERT(q->q_next == NULL); /* not valid ioctls for ip as a module */
8378 
8379 	ip1dbg(("ip_sioctl_get_ifconf"));
8380 	/* Existence verified in ip_wput_nondata */
8381 	mp1 = mp->b_cont->b_cont;
8382 	iocp = (struct iocblk *)mp->b_rptr;
8383 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8384 
8385 	/*
8386 	 * The original SIOCGIFCONF passed in a struct ifconf which specified
8387 	 * the user buffer address and length into which the list of struct
8388 	 * ifreqs was to be copied.  Since AT&T Streams does not seem to
8389 	 * allow M_COPYOUT to be used in conjunction with I_STR IOCTLS,
8390 	 * the SIOCGIFCONF operation was redefined to simply provide
8391 	 * a large output buffer into which we are supposed to jam the ifreq
8392 	 * array.  The same ioctl command code was used, despite the fact that
8393 	 * both the applications and the kernel code had to change, thus making
8394 	 * it impossible to support both interfaces.
8395 	 *
8396 	 * For reasons not good enough to try to explain, the following
8397 	 * algorithm is used for deciding what to do with one of these:
8398 	 * If the IOCTL comes in as an I_STR, it is assumed to be of the new
8399 	 * form with the output buffer coming down as the continuation message.
8400 	 * If it arrives as a TRANSPARENT IOCTL, it is assumed to be old style,
8401 	 * and we have to copy in the ifconf structure to find out how big the
8402 	 * output buffer is and where to copy out to.  Sure no problem...
8403 	 *
8404 	 */
8405 	STRUCT_SET_HANDLE(ifc, iocp->ioc_flag, NULL);
8406 	if ((mp1->b_wptr - mp1->b_rptr) == STRUCT_SIZE(ifc)) {
8407 		int numifs = 0;
8408 		size_t ifc_bufsize;
8409 
8410 		/*
8411 		 * Must be (better be!) continuation of a TRANSPARENT
8412 		 * IOCTL.  We just copied in the ifconf structure.
8413 		 */
8414 		STRUCT_SET_HANDLE(ifc, iocp->ioc_flag,
8415 		    (struct ifconf *)mp1->b_rptr);
8416 
8417 		/*
8418 		 * Allocate a buffer to hold requested information.
8419 		 *
8420 		 * If ifc_len is larger than what is needed, we only
8421 		 * allocate what we will use.
8422 		 *
8423 		 * If ifc_len is smaller than what is needed, return
8424 		 * EINVAL.
8425 		 *
8426 		 * XXX: the ill_t structure can hava 2 counters, for
8427 		 * v4 and v6 (not just ill_ipif_up_count) to store the
8428 		 * number of interfaces for a device, so we don't need
8429 		 * to count them here...
8430 		 */
8431 		numifs = ip_get_numifs(zoneid, ipst);
8432 
8433 		ifclen = STRUCT_FGET(ifc, ifc_len);
8434 		ifc_bufsize = numifs * sizeof (struct ifreq);
8435 		if (ifc_bufsize > ifclen) {
8436 			if (iocp->ioc_cmd == O_SIOCGIFCONF) {
8437 				/* old behaviour */
8438 				return (EINVAL);
8439 			} else {
8440 				ifc_bufsize = ifclen;
8441 			}
8442 		}
8443 
8444 		mp1 = mi_copyout_alloc(q, mp,
8445 		    STRUCT_FGETP(ifc, ifc_buf), ifc_bufsize, B_FALSE);
8446 		if (mp1 == NULL)
8447 			return (ENOMEM);
8448 
8449 		mp1->b_wptr = mp1->b_rptr + ifc_bufsize;
8450 	}
8451 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
8452 	/*
8453 	 * the SIOCGIFCONF ioctl only knows about
8454 	 * IPv4 addresses, so don't try to tell
8455 	 * it about interfaces with IPv6-only
8456 	 * addresses. (Last parm 'isv6' is B_FALSE)
8457 	 */
8458 
8459 	ifr = (struct ifreq *)mp1->b_rptr;
8460 
8461 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
8462 	ill = ILL_START_WALK_V4(&ctx, ipst);
8463 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8464 		if (IS_UNDER_IPMP(ill))
8465 			continue;
8466 		for (ipif = ill->ill_ipif; ipif != NULL;
8467 		    ipif = ipif->ipif_next) {
8468 			if (zoneid != ipif->ipif_zoneid &&
8469 			    ipif->ipif_zoneid != ALL_ZONES)
8470 				continue;
8471 			if ((uchar_t *)&ifr[1] > mp1->b_wptr) {
8472 				if (iocp->ioc_cmd == O_SIOCGIFCONF) {
8473 					/* old behaviour */
8474 					rw_exit(&ipst->ips_ill_g_lock);
8475 					return (EINVAL);
8476 				} else {
8477 					goto if_copydone;
8478 				}
8479 			}
8480 			ipif_get_name(ipif, ifr->ifr_name,
8481 			    sizeof (ifr->ifr_name));
8482 			sin = (sin_t *)&ifr->ifr_addr;
8483 			*sin = sin_null;
8484 			sin->sin_family = AF_INET;
8485 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
8486 			ifr++;
8487 		}
8488 	}
8489 if_copydone:
8490 	rw_exit(&ipst->ips_ill_g_lock);
8491 	mp1->b_wptr = (uchar_t *)ifr;
8492 
8493 	if (STRUCT_BUF(ifc) != NULL) {
8494 		STRUCT_FSET(ifc, ifc_len,
8495 		    (int)((uchar_t *)ifr - mp1->b_rptr));
8496 	}
8497 	return (0);
8498 }
8499 
8500 /*
8501  * Get the interfaces using the address hosted on the interface passed in,
8502  * as a source adddress
8503  */
8504 /* ARGSUSED */
8505 int
8506 ip_sioctl_get_lifsrcof(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8507     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8508 {
8509 	mblk_t *mp1;
8510 	ill_t	*ill, *ill_head;
8511 	ipif_t	*ipif, *orig_ipif;
8512 	int	numlifs = 0;
8513 	size_t	lifs_bufsize, lifsmaxlen;
8514 	struct	lifreq *lifr;
8515 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8516 	uint_t	ifindex;
8517 	zoneid_t zoneid;
8518 	int err = 0;
8519 	boolean_t isv6 = B_FALSE;
8520 	struct	sockaddr_in	*sin;
8521 	struct	sockaddr_in6	*sin6;
8522 	STRUCT_HANDLE(lifsrcof, lifs);
8523 	ip_stack_t		*ipst;
8524 
8525 	ipst = CONNQ_TO_IPST(q);
8526 
8527 	ASSERT(q->q_next == NULL);
8528 
8529 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8530 
8531 	/* Existence verified in ip_wput_nondata */
8532 	mp1 = mp->b_cont->b_cont;
8533 
8534 	/*
8535 	 * Must be (better be!) continuation of a TRANSPARENT
8536 	 * IOCTL.  We just copied in the lifsrcof structure.
8537 	 */
8538 	STRUCT_SET_HANDLE(lifs, iocp->ioc_flag,
8539 	    (struct lifsrcof *)mp1->b_rptr);
8540 
8541 	if (MBLKL(mp1) != STRUCT_SIZE(lifs))
8542 		return (EINVAL);
8543 
8544 	ifindex = STRUCT_FGET(lifs, lifs_ifindex);
8545 	isv6 = (Q_TO_CONN(q))->conn_af_isv6;
8546 	ipif = ipif_lookup_on_ifindex(ifindex, isv6, zoneid, q, mp,
8547 	    ip_process_ioctl, &err, ipst);
8548 	if (ipif == NULL) {
8549 		ip1dbg(("ip_sioctl_get_lifsrcof: no ipif for ifindex %d\n",
8550 		    ifindex));
8551 		return (err);
8552 	}
8553 
8554 	/* Allocate a buffer to hold requested information */
8555 	numlifs = ip_get_lifsrcofnum(ipif->ipif_ill);
8556 	lifs_bufsize = numlifs * sizeof (struct lifreq);
8557 	lifsmaxlen =  STRUCT_FGET(lifs, lifs_maxlen);
8558 	/* The actual size needed is always returned in lifs_len */
8559 	STRUCT_FSET(lifs, lifs_len, lifs_bufsize);
8560 
8561 	/* If the amount we need is more than what is passed in, abort */
8562 	if (lifs_bufsize > lifsmaxlen || lifs_bufsize == 0) {
8563 		ipif_refrele(ipif);
8564 		return (0);
8565 	}
8566 
8567 	mp1 = mi_copyout_alloc(q, mp,
8568 	    STRUCT_FGETP(lifs, lifs_buf), lifs_bufsize, B_FALSE);
8569 	if (mp1 == NULL) {
8570 		ipif_refrele(ipif);
8571 		return (ENOMEM);
8572 	}
8573 
8574 	mp1->b_wptr = mp1->b_rptr + lifs_bufsize;
8575 	bzero(mp1->b_rptr, lifs_bufsize);
8576 
8577 	lifr = (struct lifreq *)mp1->b_rptr;
8578 
8579 	ill = ill_head = ipif->ipif_ill;
8580 	orig_ipif = ipif;
8581 
8582 	/* ill_g_usesrc_lock protects ill_usesrc_grp_next */
8583 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
8584 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
8585 
8586 	ill = ill->ill_usesrc_grp_next; /* start from next ill */
8587 	for (; (ill != NULL) && (ill != ill_head);
8588 	    ill = ill->ill_usesrc_grp_next) {
8589 
8590 		if ((uchar_t *)&lifr[1] > mp1->b_wptr)
8591 			break;
8592 
8593 		ipif = ill->ill_ipif;
8594 		ipif_get_name(ipif, lifr->lifr_name, sizeof (lifr->lifr_name));
8595 		if (ipif->ipif_isv6) {
8596 			sin6 = (sin6_t *)&lifr->lifr_addr;
8597 			*sin6 = sin6_null;
8598 			sin6->sin6_family = AF_INET6;
8599 			sin6->sin6_addr = ipif->ipif_v6lcl_addr;
8600 			lifr->lifr_addrlen = ip_mask_to_plen_v6(
8601 			    &ipif->ipif_v6net_mask);
8602 		} else {
8603 			sin = (sin_t *)&lifr->lifr_addr;
8604 			*sin = sin_null;
8605 			sin->sin_family = AF_INET;
8606 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
8607 			lifr->lifr_addrlen = ip_mask_to_plen(
8608 			    ipif->ipif_net_mask);
8609 		}
8610 		lifr++;
8611 	}
8612 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
8613 	rw_exit(&ipst->ips_ill_g_lock);
8614 	ipif_refrele(orig_ipif);
8615 	mp1->b_wptr = (uchar_t *)lifr;
8616 	STRUCT_FSET(lifs, lifs_len, (int)((uchar_t *)lifr - mp1->b_rptr));
8617 
8618 	return (0);
8619 }
8620 
8621 /* ARGSUSED */
8622 int
8623 ip_sioctl_get_lifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8624     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8625 {
8626 	mblk_t *mp1;
8627 	int	list;
8628 	ill_t	*ill;
8629 	ipif_t	*ipif;
8630 	int	flags;
8631 	int	numlifs = 0;
8632 	size_t	lifc_bufsize;
8633 	struct	lifreq *lifr;
8634 	sa_family_t	family;
8635 	struct	sockaddr_in	*sin;
8636 	struct	sockaddr_in6	*sin6;
8637 	ill_walk_context_t	ctx;
8638 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8639 	int32_t	lifclen;
8640 	zoneid_t zoneid;
8641 	STRUCT_HANDLE(lifconf, lifc);
8642 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
8643 
8644 	ip1dbg(("ip_sioctl_get_lifconf"));
8645 
8646 	ASSERT(q->q_next == NULL);
8647 
8648 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8649 
8650 	/* Existence verified in ip_wput_nondata */
8651 	mp1 = mp->b_cont->b_cont;
8652 
8653 	/*
8654 	 * An extended version of SIOCGIFCONF that takes an
8655 	 * additional address family and flags field.
8656 	 * AF_UNSPEC retrieve both IPv4 and IPv6.
8657 	 * Unless LIFC_NOXMIT is specified the IPIF_NOXMIT
8658 	 * interfaces are omitted.
8659 	 * Similarly, IPIF_TEMPORARY interfaces are omitted
8660 	 * unless LIFC_TEMPORARY is specified.
8661 	 * If LIFC_EXTERNAL_SOURCE is specified, IPIF_NOXMIT,
8662 	 * IPIF_NOLOCAL, PHYI_LOOPBACK, IPIF_DEPRECATED and
8663 	 * not IPIF_UP interfaces are omitted. LIFC_EXTERNAL_SOURCE
8664 	 * has priority over LIFC_NOXMIT.
8665 	 */
8666 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, NULL);
8667 
8668 	if ((mp1->b_wptr - mp1->b_rptr) != STRUCT_SIZE(lifc))
8669 		return (EINVAL);
8670 
8671 	/*
8672 	 * Must be (better be!) continuation of a TRANSPARENT
8673 	 * IOCTL.  We just copied in the lifconf structure.
8674 	 */
8675 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, (struct lifconf *)mp1->b_rptr);
8676 
8677 	family = STRUCT_FGET(lifc, lifc_family);
8678 	flags = STRUCT_FGET(lifc, lifc_flags);
8679 
8680 	switch (family) {
8681 	case AF_UNSPEC:
8682 		/*
8683 		 * walk all ILL's.
8684 		 */
8685 		list = MAX_G_HEADS;
8686 		break;
8687 	case AF_INET:
8688 		/*
8689 		 * walk only IPV4 ILL's.
8690 		 */
8691 		list = IP_V4_G_HEAD;
8692 		break;
8693 	case AF_INET6:
8694 		/*
8695 		 * walk only IPV6 ILL's.
8696 		 */
8697 		list = IP_V6_G_HEAD;
8698 		break;
8699 	default:
8700 		return (EAFNOSUPPORT);
8701 	}
8702 
8703 	/*
8704 	 * Allocate a buffer to hold requested information.
8705 	 *
8706 	 * If lifc_len is larger than what is needed, we only
8707 	 * allocate what we will use.
8708 	 *
8709 	 * If lifc_len is smaller than what is needed, return
8710 	 * EINVAL.
8711 	 */
8712 	numlifs = ip_get_numlifs(family, flags, zoneid, ipst);
8713 	lifc_bufsize = numlifs * sizeof (struct lifreq);
8714 	lifclen = STRUCT_FGET(lifc, lifc_len);
8715 	if (lifc_bufsize > lifclen) {
8716 		if (iocp->ioc_cmd == O_SIOCGLIFCONF)
8717 			return (EINVAL);
8718 		else
8719 			lifc_bufsize = lifclen;
8720 	}
8721 
8722 	mp1 = mi_copyout_alloc(q, mp,
8723 	    STRUCT_FGETP(lifc, lifc_buf), lifc_bufsize, B_FALSE);
8724 	if (mp1 == NULL)
8725 		return (ENOMEM);
8726 
8727 	mp1->b_wptr = mp1->b_rptr + lifc_bufsize;
8728 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
8729 
8730 	lifr = (struct lifreq *)mp1->b_rptr;
8731 
8732 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
8733 	ill = ill_first(list, list, &ctx, ipst);
8734 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8735 		if (IS_UNDER_IPMP(ill) && !(flags & LIFC_UNDER_IPMP))
8736 			continue;
8737 
8738 		for (ipif = ill->ill_ipif; ipif != NULL;
8739 		    ipif = ipif->ipif_next) {
8740 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
8741 			    !(flags & LIFC_NOXMIT))
8742 				continue;
8743 
8744 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
8745 			    !(flags & LIFC_TEMPORARY))
8746 				continue;
8747 
8748 			if (((ipif->ipif_flags &
8749 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
8750 			    IPIF_DEPRECATED)) ||
8751 			    IS_LOOPBACK(ill) ||
8752 			    !(ipif->ipif_flags & IPIF_UP)) &&
8753 			    (flags & LIFC_EXTERNAL_SOURCE))
8754 				continue;
8755 
8756 			if (zoneid != ipif->ipif_zoneid &&
8757 			    ipif->ipif_zoneid != ALL_ZONES &&
8758 			    (zoneid != GLOBAL_ZONEID ||
8759 			    !(flags & LIFC_ALLZONES)))
8760 				continue;
8761 
8762 			if ((uchar_t *)&lifr[1] > mp1->b_wptr) {
8763 				if (iocp->ioc_cmd == O_SIOCGLIFCONF) {
8764 					rw_exit(&ipst->ips_ill_g_lock);
8765 					return (EINVAL);
8766 				} else {
8767 					goto lif_copydone;
8768 				}
8769 			}
8770 
8771 			ipif_get_name(ipif, lifr->lifr_name,
8772 			    sizeof (lifr->lifr_name));
8773 			lifr->lifr_type = ill->ill_type;
8774 			if (ipif->ipif_isv6) {
8775 				sin6 = (sin6_t *)&lifr->lifr_addr;
8776 				*sin6 = sin6_null;
8777 				sin6->sin6_family = AF_INET6;
8778 				sin6->sin6_addr =
8779 				    ipif->ipif_v6lcl_addr;
8780 				lifr->lifr_addrlen =
8781 				    ip_mask_to_plen_v6(
8782 				    &ipif->ipif_v6net_mask);
8783 			} else {
8784 				sin = (sin_t *)&lifr->lifr_addr;
8785 				*sin = sin_null;
8786 				sin->sin_family = AF_INET;
8787 				sin->sin_addr.s_addr =
8788 				    ipif->ipif_lcl_addr;
8789 				lifr->lifr_addrlen =
8790 				    ip_mask_to_plen(
8791 				    ipif->ipif_net_mask);
8792 			}
8793 			lifr++;
8794 		}
8795 	}
8796 lif_copydone:
8797 	rw_exit(&ipst->ips_ill_g_lock);
8798 
8799 	mp1->b_wptr = (uchar_t *)lifr;
8800 	if (STRUCT_BUF(lifc) != NULL) {
8801 		STRUCT_FSET(lifc, lifc_len,
8802 		    (int)((uchar_t *)lifr - mp1->b_rptr));
8803 	}
8804 	return (0);
8805 }
8806 
8807 static void
8808 ip_sioctl_ip6addrpolicy(queue_t *q, mblk_t *mp)
8809 {
8810 	ip6_asp_t *table;
8811 	size_t table_size;
8812 	mblk_t *data_mp;
8813 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8814 	ip_stack_t	*ipst;
8815 
8816 	if (q->q_next == NULL)
8817 		ipst = CONNQ_TO_IPST(q);
8818 	else
8819 		ipst = ILLQ_TO_IPST(q);
8820 
8821 	/* These two ioctls are I_STR only */
8822 	if (iocp->ioc_count == TRANSPARENT) {
8823 		miocnak(q, mp, 0, EINVAL);
8824 		return;
8825 	}
8826 
8827 	data_mp = mp->b_cont;
8828 	if (data_mp == NULL) {
8829 		/* The user passed us a NULL argument */
8830 		table = NULL;
8831 		table_size = iocp->ioc_count;
8832 	} else {
8833 		/*
8834 		 * The user provided a table.  The stream head
8835 		 * may have copied in the user data in chunks,
8836 		 * so make sure everything is pulled up
8837 		 * properly.
8838 		 */
8839 		if (MBLKL(data_mp) < iocp->ioc_count) {
8840 			mblk_t *new_data_mp;
8841 			if ((new_data_mp = msgpullup(data_mp, -1)) ==
8842 			    NULL) {
8843 				miocnak(q, mp, 0, ENOMEM);
8844 				return;
8845 			}
8846 			freemsg(data_mp);
8847 			data_mp = new_data_mp;
8848 			mp->b_cont = data_mp;
8849 		}
8850 		table = (ip6_asp_t *)data_mp->b_rptr;
8851 		table_size = iocp->ioc_count;
8852 	}
8853 
8854 	switch (iocp->ioc_cmd) {
8855 	case SIOCGIP6ADDRPOLICY:
8856 		iocp->ioc_rval = ip6_asp_get(table, table_size, ipst);
8857 		if (iocp->ioc_rval == -1)
8858 			iocp->ioc_error = EINVAL;
8859 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
8860 		else if (table != NULL &&
8861 		    (iocp->ioc_flag & IOC_MODELS) == IOC_ILP32) {
8862 			ip6_asp_t *src = table;
8863 			ip6_asp32_t *dst = (void *)table;
8864 			int count = table_size / sizeof (ip6_asp_t);
8865 			int i;
8866 
8867 			/*
8868 			 * We need to do an in-place shrink of the array
8869 			 * to match the alignment attributes of the
8870 			 * 32-bit ABI looking at it.
8871 			 */
8872 			/* LINTED: logical expression always true: op "||" */
8873 			ASSERT(sizeof (*src) > sizeof (*dst));
8874 			for (i = 1; i < count; i++)
8875 				bcopy(src + i, dst + i, sizeof (*dst));
8876 		}
8877 #endif
8878 		break;
8879 
8880 	case SIOCSIP6ADDRPOLICY:
8881 		ASSERT(mp->b_prev == NULL);
8882 		mp->b_prev = (void *)q;
8883 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
8884 		/*
8885 		 * We pass in the datamodel here so that the ip6_asp_replace()
8886 		 * routine can handle converting from 32-bit to native formats
8887 		 * where necessary.
8888 		 *
8889 		 * A better way to handle this might be to convert the inbound
8890 		 * data structure here, and hang it off a new 'mp'; thus the
8891 		 * ip6_asp_replace() logic would always be dealing with native
8892 		 * format data structures..
8893 		 *
8894 		 * (An even simpler way to handle these ioctls is to just
8895 		 * add a 32-bit trailing 'pad' field to the ip6_asp_t structure
8896 		 * and just recompile everything that depends on it.)
8897 		 */
8898 #endif
8899 		ip6_asp_replace(mp, table, table_size, B_FALSE, ipst,
8900 		    iocp->ioc_flag & IOC_MODELS);
8901 		return;
8902 	}
8903 
8904 	DB_TYPE(mp) =  (iocp->ioc_error == 0) ? M_IOCACK : M_IOCNAK;
8905 	qreply(q, mp);
8906 }
8907 
8908 static void
8909 ip_sioctl_dstinfo(queue_t *q, mblk_t *mp)
8910 {
8911 	mblk_t 		*data_mp;
8912 	struct dstinforeq	*dir;
8913 	uint8_t		*end, *cur;
8914 	in6_addr_t	*daddr, *saddr;
8915 	ipaddr_t	v4daddr;
8916 	ire_t		*ire;
8917 	char		*slabel, *dlabel;
8918 	boolean_t	isipv4;
8919 	int		match_ire;
8920 	ill_t		*dst_ill;
8921 	ipif_t		*src_ipif, *ire_ipif;
8922 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8923 	zoneid_t	zoneid;
8924 	ip_stack_t	*ipst = CONNQ_TO_IPST(q);
8925 
8926 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8927 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8928 
8929 	/*
8930 	 * This ioctl is I_STR only, and must have a
8931 	 * data mblk following the M_IOCTL mblk.
8932 	 */
8933 	data_mp = mp->b_cont;
8934 	if (iocp->ioc_count == TRANSPARENT || data_mp == NULL) {
8935 		miocnak(q, mp, 0, EINVAL);
8936 		return;
8937 	}
8938 
8939 	if (MBLKL(data_mp) < iocp->ioc_count) {
8940 		mblk_t *new_data_mp;
8941 
8942 		if ((new_data_mp = msgpullup(data_mp, -1)) == NULL) {
8943 			miocnak(q, mp, 0, ENOMEM);
8944 			return;
8945 		}
8946 		freemsg(data_mp);
8947 		data_mp = new_data_mp;
8948 		mp->b_cont = data_mp;
8949 	}
8950 	match_ire = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | MATCH_IRE_PARENT;
8951 
8952 	for (cur = data_mp->b_rptr, end = data_mp->b_wptr;
8953 	    end - cur >= sizeof (struct dstinforeq);
8954 	    cur += sizeof (struct dstinforeq)) {
8955 		dir = (struct dstinforeq *)cur;
8956 		daddr = &dir->dir_daddr;
8957 		saddr = &dir->dir_saddr;
8958 
8959 		/*
8960 		 * ip_addr_scope_v6() and ip6_asp_lookup() handle
8961 		 * v4 mapped addresses; ire_ftable_lookup[_v6]()
8962 		 * and ipif_select_source[_v6]() do not.
8963 		 */
8964 		dir->dir_dscope = ip_addr_scope_v6(daddr);
8965 		dlabel = ip6_asp_lookup(daddr, &dir->dir_precedence, ipst);
8966 
8967 		isipv4 = IN6_IS_ADDR_V4MAPPED(daddr);
8968 		if (isipv4) {
8969 			IN6_V4MAPPED_TO_IPADDR(daddr, v4daddr);
8970 			ire = ire_ftable_lookup(v4daddr, NULL, NULL,
8971 			    0, NULL, NULL, zoneid, 0, NULL, match_ire, ipst);
8972 		} else {
8973 			ire = ire_ftable_lookup_v6(daddr, NULL, NULL,
8974 			    0, NULL, NULL, zoneid, 0, NULL, match_ire, ipst);
8975 		}
8976 		if (ire == NULL) {
8977 			dir->dir_dreachable = 0;
8978 
8979 			/* move on to next dst addr */
8980 			continue;
8981 		}
8982 		dir->dir_dreachable = 1;
8983 
8984 		ire_ipif = ire->ire_ipif;
8985 		if (ire_ipif == NULL)
8986 			goto next_dst;
8987 
8988 		/*
8989 		 * We expect to get back an interface ire or a
8990 		 * gateway ire cache entry.  For both types, the
8991 		 * output interface is ire_ipif->ipif_ill.
8992 		 */
8993 		dst_ill = ire_ipif->ipif_ill;
8994 		dir->dir_dmactype = dst_ill->ill_mactype;
8995 
8996 		if (isipv4) {
8997 			src_ipif = ipif_select_source(dst_ill, v4daddr, zoneid);
8998 		} else {
8999 			src_ipif = ipif_select_source_v6(dst_ill,
9000 			    daddr, B_FALSE, IPV6_PREFER_SRC_DEFAULT, zoneid);
9001 		}
9002 		if (src_ipif == NULL)
9003 			goto next_dst;
9004 
9005 		*saddr = src_ipif->ipif_v6lcl_addr;
9006 		dir->dir_sscope = ip_addr_scope_v6(saddr);
9007 		slabel = ip6_asp_lookup(saddr, NULL, ipst);
9008 		dir->dir_labelmatch = ip6_asp_labelcmp(dlabel, slabel);
9009 		dir->dir_sdeprecated =
9010 		    (src_ipif->ipif_flags & IPIF_DEPRECATED) ? 1 : 0;
9011 		ipif_refrele(src_ipif);
9012 next_dst:
9013 		ire_refrele(ire);
9014 	}
9015 	miocack(q, mp, iocp->ioc_count, 0);
9016 }
9017 
9018 /*
9019  * Check if this is an address assigned to this machine.
9020  * Skips interfaces that are down by using ire checks.
9021  * Translates mapped addresses to v4 addresses and then
9022  * treats them as such, returning true if the v4 address
9023  * associated with this mapped address is configured.
9024  * Note: Applications will have to be careful what they do
9025  * with the response; use of mapped addresses limits
9026  * what can be done with the socket, especially with
9027  * respect to socket options and ioctls - neither IPv4
9028  * options nor IPv6 sticky options/ancillary data options
9029  * may be used.
9030  */
9031 /* ARGSUSED */
9032 int
9033 ip_sioctl_tmyaddr(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9034     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9035 {
9036 	struct sioc_addrreq *sia;
9037 	sin_t *sin;
9038 	ire_t *ire;
9039 	mblk_t *mp1;
9040 	zoneid_t zoneid;
9041 	ip_stack_t	*ipst;
9042 
9043 	ip1dbg(("ip_sioctl_tmyaddr"));
9044 
9045 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
9046 	zoneid = Q_TO_CONN(q)->conn_zoneid;
9047 	ipst = CONNQ_TO_IPST(q);
9048 
9049 	/* Existence verified in ip_wput_nondata */
9050 	mp1 = mp->b_cont->b_cont;
9051 	sia = (struct sioc_addrreq *)mp1->b_rptr;
9052 	sin = (sin_t *)&sia->sa_addr;
9053 	switch (sin->sin_family) {
9054 	case AF_INET6: {
9055 		sin6_t *sin6 = (sin6_t *)sin;
9056 
9057 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
9058 			ipaddr_t v4_addr;
9059 
9060 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
9061 			    v4_addr);
9062 			ire = ire_ctable_lookup(v4_addr, 0,
9063 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
9064 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, ipst);
9065 		} else {
9066 			in6_addr_t v6addr;
9067 
9068 			v6addr = sin6->sin6_addr;
9069 			ire = ire_ctable_lookup_v6(&v6addr, 0,
9070 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
9071 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, ipst);
9072 		}
9073 		break;
9074 	}
9075 	case AF_INET: {
9076 		ipaddr_t v4addr;
9077 
9078 		v4addr = sin->sin_addr.s_addr;
9079 		ire = ire_ctable_lookup(v4addr, 0,
9080 		    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
9081 		    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, ipst);
9082 		break;
9083 	}
9084 	default:
9085 		return (EAFNOSUPPORT);
9086 	}
9087 	if (ire != NULL) {
9088 		sia->sa_res = 1;
9089 		ire_refrele(ire);
9090 	} else {
9091 		sia->sa_res = 0;
9092 	}
9093 	return (0);
9094 }
9095 
9096 /*
9097  * Check if this is an address assigned on-link i.e. neighbor,
9098  * and makes sure it's reachable from the current zone.
9099  * Returns true for my addresses as well.
9100  * Translates mapped addresses to v4 addresses and then
9101  * treats them as such, returning true if the v4 address
9102  * associated with this mapped address is configured.
9103  * Note: Applications will have to be careful what they do
9104  * with the response; use of mapped addresses limits
9105  * what can be done with the socket, especially with
9106  * respect to socket options and ioctls - neither IPv4
9107  * options nor IPv6 sticky options/ancillary data options
9108  * may be used.
9109  */
9110 /* ARGSUSED */
9111 int
9112 ip_sioctl_tonlink(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9113     ip_ioctl_cmd_t *ipip, void *duymmy_ifreq)
9114 {
9115 	struct sioc_addrreq *sia;
9116 	sin_t *sin;
9117 	mblk_t	*mp1;
9118 	ire_t *ire = NULL;
9119 	zoneid_t zoneid;
9120 	ip_stack_t	*ipst;
9121 
9122 	ip1dbg(("ip_sioctl_tonlink"));
9123 
9124 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
9125 	zoneid = Q_TO_CONN(q)->conn_zoneid;
9126 	ipst = CONNQ_TO_IPST(q);
9127 
9128 	/* Existence verified in ip_wput_nondata */
9129 	mp1 = mp->b_cont->b_cont;
9130 	sia = (struct sioc_addrreq *)mp1->b_rptr;
9131 	sin = (sin_t *)&sia->sa_addr;
9132 
9133 	/*
9134 	 * Match addresses with a zero gateway field to avoid
9135 	 * routes going through a router.
9136 	 * Exclude broadcast and multicast addresses.
9137 	 */
9138 	switch (sin->sin_family) {
9139 	case AF_INET6: {
9140 		sin6_t *sin6 = (sin6_t *)sin;
9141 
9142 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
9143 			ipaddr_t v4_addr;
9144 
9145 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
9146 			    v4_addr);
9147 			if (!CLASSD(v4_addr)) {
9148 				ire = ire_route_lookup(v4_addr, 0, 0, 0,
9149 				    NULL, NULL, zoneid, NULL,
9150 				    MATCH_IRE_GW, ipst);
9151 			}
9152 		} else {
9153 			in6_addr_t v6addr;
9154 			in6_addr_t v6gw;
9155 
9156 			v6addr = sin6->sin6_addr;
9157 			v6gw = ipv6_all_zeros;
9158 			if (!IN6_IS_ADDR_MULTICAST(&v6addr)) {
9159 				ire = ire_route_lookup_v6(&v6addr, 0,
9160 				    &v6gw, 0, NULL, NULL, zoneid,
9161 				    NULL, MATCH_IRE_GW, ipst);
9162 			}
9163 		}
9164 		break;
9165 	}
9166 	case AF_INET: {
9167 		ipaddr_t v4addr;
9168 
9169 		v4addr = sin->sin_addr.s_addr;
9170 		if (!CLASSD(v4addr)) {
9171 			ire = ire_route_lookup(v4addr, 0, 0, 0,
9172 			    NULL, NULL, zoneid, NULL,
9173 			    MATCH_IRE_GW, ipst);
9174 		}
9175 		break;
9176 	}
9177 	default:
9178 		return (EAFNOSUPPORT);
9179 	}
9180 	sia->sa_res = 0;
9181 	if (ire != NULL) {
9182 		if (ire->ire_type & (IRE_INTERFACE|IRE_CACHE|
9183 		    IRE_LOCAL|IRE_LOOPBACK)) {
9184 			sia->sa_res = 1;
9185 		}
9186 		ire_refrele(ire);
9187 	}
9188 	return (0);
9189 }
9190 
9191 /*
9192  * TBD: implement when kernel maintaines a list of site prefixes.
9193  */
9194 /* ARGSUSED */
9195 int
9196 ip_sioctl_tmysite(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9197     ip_ioctl_cmd_t *ipip, void *ifreq)
9198 {
9199 	return (ENXIO);
9200 }
9201 
9202 /* ARGSUSED */
9203 int
9204 ip_sioctl_tunparam(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9205     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9206 {
9207 	ill_t		*ill;
9208 	mblk_t		*mp1;
9209 	conn_t		*connp;
9210 	boolean_t	success;
9211 
9212 	ip1dbg(("ip_sioctl_tunparam(%s:%u %p)\n",
9213 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9214 	/* ioctl comes down on an conn */
9215 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9216 	connp = Q_TO_CONN(q);
9217 
9218 	mp->b_datap->db_type = M_IOCTL;
9219 
9220 	/*
9221 	 * Send down a copy. (copymsg does not copy b_next/b_prev).
9222 	 * The original mp contains contaminated b_next values due to 'mi',
9223 	 * which is needed to do the mi_copy_done. Unfortunately if we
9224 	 * send down the original mblk itself and if we are popped due to an
9225 	 * an unplumb before the response comes back from tunnel,
9226 	 * the streamhead (which does a freemsg) will see this contaminated
9227 	 * message and the assertion in freemsg about non-null b_next/b_prev
9228 	 * will panic a DEBUG kernel.
9229 	 */
9230 	mp1 = copymsg(mp);
9231 	if (mp1 == NULL)
9232 		return (ENOMEM);
9233 
9234 	ill = ipif->ipif_ill;
9235 	mutex_enter(&connp->conn_lock);
9236 	mutex_enter(&ill->ill_lock);
9237 	if (ipip->ipi_cmd == SIOCSTUNPARAM || ipip->ipi_cmd == OSIOCSTUNPARAM) {
9238 		success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp),
9239 		    mp, 0);
9240 	} else {
9241 		success = ill_pending_mp_add(ill, connp, mp);
9242 	}
9243 	mutex_exit(&ill->ill_lock);
9244 	mutex_exit(&connp->conn_lock);
9245 
9246 	if (success) {
9247 		ip1dbg(("sending down tunparam request "));
9248 		putnext(ill->ill_wq, mp1);
9249 		return (EINPROGRESS);
9250 	} else {
9251 		/* The conn has started closing */
9252 		freemsg(mp1);
9253 		return (EINTR);
9254 	}
9255 }
9256 
9257 /*
9258  * ARP IOCTLs.
9259  * How does IP get in the business of fronting ARP configuration/queries?
9260  * Well it's like this, the Berkeley ARP IOCTLs (SIOCGARP, SIOCDARP, SIOCSARP)
9261  * are by tradition passed in through a datagram socket.  That lands in IP.
9262  * As it happens, this is just as well since the interface is quite crude in
9263  * that it passes in no information about protocol or hardware types, or
9264  * interface association.  After making the protocol assumption, IP is in
9265  * the position to look up the name of the ILL, which ARP will need, and
9266  * format a request that can be handled by ARP.  The request is passed up
9267  * stream to ARP, and the original IOCTL is completed by IP when ARP passes
9268  * back a response.  ARP supports its own set of more general IOCTLs, in
9269  * case anyone is interested.
9270  */
9271 /* ARGSUSED */
9272 int
9273 ip_sioctl_arp(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9274     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9275 {
9276 	mblk_t *mp1;
9277 	mblk_t *mp2;
9278 	mblk_t *pending_mp;
9279 	ipaddr_t ipaddr;
9280 	area_t *area;
9281 	struct iocblk *iocp;
9282 	conn_t *connp;
9283 	struct arpreq *ar;
9284 	struct xarpreq *xar;
9285 	int flags, alength;
9286 	uchar_t *lladdr;
9287 	ire_t *ire;
9288 	ip_stack_t *ipst;
9289 	ill_t *ill = ipif->ipif_ill;
9290 	ill_t *proxy_ill = NULL;
9291 	ipmp_arpent_t *entp = NULL;
9292 	boolean_t if_arp_ioctl = B_FALSE;
9293 	boolean_t proxyarp = B_FALSE;
9294 
9295 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9296 	connp = Q_TO_CONN(q);
9297 	ipst = connp->conn_netstack->netstack_ip;
9298 
9299 	if (ipip->ipi_cmd_type == XARP_CMD) {
9300 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->XARPREQ_MBLK */
9301 		xar = (struct xarpreq *)mp->b_cont->b_cont->b_rptr;
9302 		ar = NULL;
9303 
9304 		flags = xar->xarp_flags;
9305 		lladdr = (uchar_t *)LLADDR(&xar->xarp_ha);
9306 		if_arp_ioctl = (xar->xarp_ha.sdl_nlen != 0);
9307 		/*
9308 		 * Validate against user's link layer address length
9309 		 * input and name and addr length limits.
9310 		 */
9311 		alength = ill->ill_phys_addr_length;
9312 		if (ipip->ipi_cmd == SIOCSXARP) {
9313 			if (alength != xar->xarp_ha.sdl_alen ||
9314 			    (alength + xar->xarp_ha.sdl_nlen >
9315 			    sizeof (xar->xarp_ha.sdl_data)))
9316 				return (EINVAL);
9317 		}
9318 	} else {
9319 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->ARPREQ_MBLK */
9320 		ar = (struct arpreq *)mp->b_cont->b_cont->b_rptr;
9321 		xar = NULL;
9322 
9323 		flags = ar->arp_flags;
9324 		lladdr = (uchar_t *)ar->arp_ha.sa_data;
9325 		/*
9326 		 * Theoretically, the sa_family could tell us what link
9327 		 * layer type this operation is trying to deal with. By
9328 		 * common usage AF_UNSPEC means ethernet. We'll assume
9329 		 * any attempt to use the SIOC?ARP ioctls is for ethernet,
9330 		 * for now. Our new SIOC*XARP ioctls can be used more
9331 		 * generally.
9332 		 *
9333 		 * If the underlying media happens to have a non 6 byte
9334 		 * address, arp module will fail set/get, but the del
9335 		 * operation will succeed.
9336 		 */
9337 		alength = 6;
9338 		if ((ipip->ipi_cmd != SIOCDARP) &&
9339 		    (alength != ill->ill_phys_addr_length)) {
9340 			return (EINVAL);
9341 		}
9342 	}
9343 
9344 	ipaddr = sin->sin_addr.s_addr;
9345 
9346 	/*
9347 	 * IPMP ARP special handling:
9348 	 *
9349 	 * 1. Since ARP mappings must appear consistent across the group,
9350 	 *    prohibit changing ARP mappings on the underlying interfaces.
9351 	 *
9352 	 * 2. Since ARP mappings for IPMP data addresses are maintained by
9353 	 *    IP itself, prohibit changing them.
9354 	 *
9355 	 * 3. For proxy ARP, use a functioning hardware address in the group,
9356 	 *    provided one exists.  If one doesn't, just add the entry as-is;
9357 	 *    ipmp_illgrp_refresh_arpent() will refresh it if things change.
9358 	 */
9359 	if (IS_UNDER_IPMP(ill)) {
9360 		if (ipip->ipi_cmd != SIOCGARP && ipip->ipi_cmd != SIOCGXARP)
9361 			return (EPERM);
9362 	}
9363 	if (IS_IPMP(ill)) {
9364 		ipmp_illgrp_t *illg = ill->ill_grp;
9365 
9366 		switch (ipip->ipi_cmd) {
9367 		case SIOCSARP:
9368 		case SIOCSXARP:
9369 			proxy_ill = ipmp_illgrp_find_ill(illg, lladdr, alength);
9370 			if (proxy_ill != NULL) {
9371 				proxyarp = B_TRUE;
9372 				if (!ipmp_ill_is_active(proxy_ill))
9373 					proxy_ill = ipmp_illgrp_next_ill(illg);
9374 				if (proxy_ill != NULL)
9375 					lladdr = proxy_ill->ill_phys_addr;
9376 			}
9377 			/* FALLTHRU */
9378 		case SIOCDARP:
9379 		case SIOCDXARP:
9380 			ire = ire_ctable_lookup(ipaddr, 0, IRE_LOCAL, NULL,
9381 			    ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
9382 			if (ire != NULL) {
9383 				ire_refrele(ire);
9384 				return (EPERM);
9385 			}
9386 		}
9387 	}
9388 
9389 	/*
9390 	 * We are going to pass up to ARP a packet chain that looks
9391 	 * like:
9392 	 *
9393 	 * M_IOCTL-->ARP_op_MBLK-->ORIG_M_IOCTL-->MI_COPY_MBLK-->[X]ARPREQ_MBLK
9394 	 *
9395 	 * Get a copy of the original IOCTL mblk to head the chain,
9396 	 * to be sent up (in mp1). Also get another copy to store
9397 	 * in the ill_pending_mp list, for matching the response
9398 	 * when it comes back from ARP.
9399 	 */
9400 	mp1 = copyb(mp);
9401 	pending_mp = copymsg(mp);
9402 	if (mp1 == NULL || pending_mp == NULL) {
9403 		if (mp1 != NULL)
9404 			freeb(mp1);
9405 		if (pending_mp != NULL)
9406 			inet_freemsg(pending_mp);
9407 		return (ENOMEM);
9408 	}
9409 
9410 	mp2 = ill_arp_alloc(ill, (uchar_t *)&ip_area_template,
9411 	    (caddr_t)&ipaddr);
9412 	if (mp2 == NULL) {
9413 		freeb(mp1);
9414 		inet_freemsg(pending_mp);
9415 		return (ENOMEM);
9416 	}
9417 	/* Put together the chain. */
9418 	mp1->b_cont = mp2;
9419 	mp1->b_datap->db_type = M_IOCTL;
9420 	mp2->b_cont = mp;
9421 	mp2->b_datap->db_type = M_DATA;
9422 
9423 	iocp = (struct iocblk *)mp1->b_rptr;
9424 
9425 	/*
9426 	 * An M_IOCDATA's payload (struct copyresp) is mostly the same as an
9427 	 * M_IOCTL's payload (struct iocblk), but 'struct copyresp' has a
9428 	 * cp_private field (or cp_rval on 32-bit systems) in place of the
9429 	 * ioc_count field; set ioc_count to be correct.
9430 	 */
9431 	iocp->ioc_count = MBLKL(mp1->b_cont);
9432 
9433 	/*
9434 	 * Set the proper command in the ARP message.
9435 	 * Convert the SIOC{G|S|D}ARP calls into our
9436 	 * AR_ENTRY_xxx calls.
9437 	 */
9438 	area = (area_t *)mp2->b_rptr;
9439 	switch (iocp->ioc_cmd) {
9440 	case SIOCDARP:
9441 	case SIOCDXARP:
9442 		/*
9443 		 * We defer deleting the corresponding IRE until
9444 		 * we return from arp.
9445 		 */
9446 		area->area_cmd = AR_ENTRY_DELETE;
9447 		area->area_proto_mask_offset = 0;
9448 		break;
9449 	case SIOCGARP:
9450 	case SIOCGXARP:
9451 		area->area_cmd = AR_ENTRY_SQUERY;
9452 		area->area_proto_mask_offset = 0;
9453 		break;
9454 	case SIOCSARP:
9455 	case SIOCSXARP:
9456 		/*
9457 		 * Delete the corresponding ire to make sure IP will
9458 		 * pick up any change from arp.
9459 		 */
9460 		if (!if_arp_ioctl) {
9461 			(void) ip_ire_clookup_and_delete(ipaddr, NULL, ipst);
9462 		} else {
9463 			ipif_t *ipif = ipif_get_next_ipif(NULL, ill);
9464 			if (ipif != NULL) {
9465 				(void) ip_ire_clookup_and_delete(ipaddr, ipif,
9466 				    ipst);
9467 				ipif_refrele(ipif);
9468 			}
9469 		}
9470 		break;
9471 	}
9472 	iocp->ioc_cmd = area->area_cmd;
9473 
9474 	/*
9475 	 * Fill in the rest of the ARP operation fields.
9476 	 */
9477 	area->area_hw_addr_length = alength;
9478 	bcopy(lladdr, (char *)area + area->area_hw_addr_offset, alength);
9479 
9480 	/* Translate the flags. */
9481 	if (flags & ATF_PERM)
9482 		area->area_flags |= ACE_F_PERMANENT;
9483 	if (flags & ATF_PUBL)
9484 		area->area_flags |= ACE_F_PUBLISH;
9485 	if (flags & ATF_AUTHORITY)
9486 		area->area_flags |= ACE_F_AUTHORITY;
9487 
9488 	/*
9489 	 * If this is a permanent AR_ENTRY_ADD on the IPMP interface, track it
9490 	 * so that IP can update ARP as the active ills in the group change.
9491 	 */
9492 	if (IS_IPMP(ill) && area->area_cmd == AR_ENTRY_ADD &&
9493 	    (area->area_flags & ACE_F_PERMANENT)) {
9494 		entp = ipmp_illgrp_create_arpent(ill->ill_grp, mp2, proxyarp);
9495 
9496 		/*
9497 		 * The second part of the conditional below handles a corner
9498 		 * case: if this is proxy ARP and the IPMP group has no active
9499 		 * interfaces, we can't send the request to ARP now since it
9500 		 * won't be able to build an ACE.  So we return success and
9501 		 * notify ARP about the proxy ARP entry once an interface
9502 		 * becomes active.
9503 		 */
9504 		if (entp == NULL || (proxyarp && proxy_ill == NULL)) {
9505 			mp2->b_cont = NULL;
9506 			inet_freemsg(mp1);
9507 			inet_freemsg(pending_mp);
9508 			return (entp == NULL ? ENOMEM : 0);
9509 		}
9510 	}
9511 
9512 	/*
9513 	 * Before sending 'mp' to ARP, we have to clear the b_next
9514 	 * and b_prev. Otherwise if STREAMS encounters such a message
9515 	 * in freemsg(), (because ARP can close any time) it can cause
9516 	 * a panic. But mi code needs the b_next and b_prev values of
9517 	 * mp->b_cont, to complete the ioctl. So we store it here
9518 	 * in pending_mp->bcont, and restore it in ip_sioctl_iocack()
9519 	 * when the response comes down from ARP.
9520 	 */
9521 	pending_mp->b_cont->b_next = mp->b_cont->b_next;
9522 	pending_mp->b_cont->b_prev = mp->b_cont->b_prev;
9523 	mp->b_cont->b_next = NULL;
9524 	mp->b_cont->b_prev = NULL;
9525 
9526 	mutex_enter(&connp->conn_lock);
9527 	mutex_enter(&ill->ill_lock);
9528 	/* conn has not yet started closing, hence this can't fail */
9529 	if (ipip->ipi_flags & IPI_WR) {
9530 		VERIFY(ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp),
9531 		    pending_mp, 0) != 0);
9532 	} else {
9533 		VERIFY(ill_pending_mp_add(ill, connp, pending_mp) != 0);
9534 	}
9535 	mutex_exit(&ill->ill_lock);
9536 	mutex_exit(&connp->conn_lock);
9537 
9538 	/*
9539 	 * Up to ARP it goes.  The response will come back in ip_wput() as an
9540 	 * M_IOCACK, and will be handed to ip_sioctl_iocack() for completion.
9541 	 */
9542 	putnext(ill->ill_rq, mp1);
9543 
9544 	/*
9545 	 * If we created an IPMP ARP entry, mark that we've notified ARP.
9546 	 */
9547 	if (entp != NULL)
9548 		ipmp_illgrp_mark_arpent(ill->ill_grp, entp);
9549 
9550 	return (EINPROGRESS);
9551 }
9552 
9553 /*
9554  * Parse an [x]arpreq structure coming down SIOC[GSD][X]ARP ioctls, identify
9555  * the associated sin and refhold and return the associated ipif via `ci'.
9556  */
9557 int
9558 ip_extract_arpreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
9559     cmd_info_t *ci, ipsq_func_t func)
9560 {
9561 	mblk_t	*mp1;
9562 	int	err;
9563 	sin_t	*sin;
9564 	conn_t	*connp;
9565 	ipif_t	*ipif;
9566 	ire_t	*ire = NULL;
9567 	ill_t	*ill = NULL;
9568 	boolean_t exists;
9569 	ip_stack_t *ipst;
9570 	struct arpreq *ar;
9571 	struct xarpreq *xar;
9572 	struct sockaddr_dl *sdl;
9573 
9574 	/* ioctl comes down on a conn */
9575 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9576 	connp = Q_TO_CONN(q);
9577 	if (connp->conn_af_isv6)
9578 		return (ENXIO);
9579 
9580 	ipst = connp->conn_netstack->netstack_ip;
9581 
9582 	/* Verified in ip_wput_nondata */
9583 	mp1 = mp->b_cont->b_cont;
9584 
9585 	if (ipip->ipi_cmd_type == XARP_CMD) {
9586 		ASSERT(MBLKL(mp1) >= sizeof (struct xarpreq));
9587 		xar = (struct xarpreq *)mp1->b_rptr;
9588 		sin = (sin_t *)&xar->xarp_pa;
9589 		sdl = &xar->xarp_ha;
9590 
9591 		if (sdl->sdl_family != AF_LINK || sin->sin_family != AF_INET)
9592 			return (ENXIO);
9593 		if (sdl->sdl_nlen >= LIFNAMSIZ)
9594 			return (EINVAL);
9595 	} else {
9596 		ASSERT(ipip->ipi_cmd_type == ARP_CMD);
9597 		ASSERT(MBLKL(mp1) >= sizeof (struct arpreq));
9598 		ar = (struct arpreq *)mp1->b_rptr;
9599 		sin = (sin_t *)&ar->arp_pa;
9600 	}
9601 
9602 	if (ipip->ipi_cmd_type == XARP_CMD && sdl->sdl_nlen != 0) {
9603 		ipif = ipif_lookup_on_name(sdl->sdl_data, sdl->sdl_nlen,
9604 		    B_FALSE, &exists, B_FALSE, ALL_ZONES, CONNP_TO_WQ(connp),
9605 		    mp, func, &err, ipst);
9606 		if (ipif == NULL)
9607 			return (err);
9608 		if (ipif->ipif_id != 0) {
9609 			ipif_refrele(ipif);
9610 			return (ENXIO);
9611 		}
9612 	} else {
9613 		/*
9614 		 * Either an SIOC[DGS]ARP or an SIOC[DGS]XARP with an sdl_nlen
9615 		 * of 0: use the IP address to find the ipif.  If the IP
9616 		 * address is an IPMP test address, ire_ftable_lookup() will
9617 		 * find the wrong ill, so we first do an ipif_lookup_addr().
9618 		 */
9619 		ipif = ipif_lookup_addr(sin->sin_addr.s_addr, NULL, ALL_ZONES,
9620 		    CONNP_TO_WQ(connp), mp, func, &err, ipst);
9621 		if (ipif == NULL) {
9622 			ire = ire_ftable_lookup(sin->sin_addr.s_addr, 0, 0,
9623 			    IRE_IF_RESOLVER, NULL, NULL, ALL_ZONES, 0, NULL,
9624 			    MATCH_IRE_TYPE, ipst);
9625 			if (ire == NULL || ((ill = ire_to_ill(ire)) == NULL)) {
9626 				if (ire != NULL)
9627 					ire_refrele(ire);
9628 				return (ENXIO);
9629 			}
9630 			ipif = ill->ill_ipif;
9631 			ipif_refhold(ipif);
9632 			ire_refrele(ire);
9633 		}
9634 	}
9635 
9636 	if (ipif->ipif_net_type != IRE_IF_RESOLVER) {
9637 		ipif_refrele(ipif);
9638 		return (ENXIO);
9639 	}
9640 
9641 	ci->ci_sin = sin;
9642 	ci->ci_ipif = ipif;
9643 	return (0);
9644 }
9645 
9646 /*
9647  * Link or unlink the illgrp on IPMP meta-interface `ill' depending on the
9648  * value of `ioccmd'.  While an illgrp is linked to an ipmp_grp_t, it is
9649  * accessible from that ipmp_grp_t, which means SIOCSLIFGROUPNAME can look it
9650  * up and thus an ill can join that illgrp.
9651  *
9652  * We use I_PLINK/I_PUNLINK to do the link/unlink operations rather than
9653  * open()/close() primarily because close() is not allowed to fail or block
9654  * forever.  On the other hand, I_PUNLINK *can* fail, and there's no reason
9655  * why anyone should ever need to I_PUNLINK an in-use IPMP stream.  To ensure
9656  * symmetric behavior (e.g., doing an I_PLINK after and I_PUNLINK undoes the
9657  * I_PUNLINK) we defer linking to I_PLINK.  Separately, we also fail attempts
9658  * to I_LINK since I_UNLINK is optional and we'd end up in an inconsistent
9659  * state if I_UNLINK didn't occur.
9660  *
9661  * Note that for each plumb/unplumb operation, we may end up here more than
9662  * once because of the way ifconfig works.  However, it's OK to link the same
9663  * illgrp more than once, or unlink an illgrp that's already unlinked.
9664  */
9665 static int
9666 ip_sioctl_plink_ipmp(ill_t *ill, int ioccmd)
9667 {
9668 	int err;
9669 	ip_stack_t *ipst = ill->ill_ipst;
9670 
9671 	ASSERT(IS_IPMP(ill));
9672 	ASSERT(IAM_WRITER_ILL(ill));
9673 
9674 	switch (ioccmd) {
9675 	case I_LINK:
9676 		return (ENOTSUP);
9677 
9678 	case I_PLINK:
9679 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
9680 		ipmp_illgrp_link_grp(ill->ill_grp, ill->ill_phyint->phyint_grp);
9681 		rw_exit(&ipst->ips_ipmp_lock);
9682 		break;
9683 
9684 	case I_PUNLINK:
9685 		/*
9686 		 * Require all UP ipifs be brought down prior to unlinking the
9687 		 * illgrp so any associated IREs (and other state) is torched.
9688 		 */
9689 		if (ill->ill_ipif_up_count + ill->ill_ipif_dup_count > 0)
9690 			return (EBUSY);
9691 
9692 		/*
9693 		 * NOTE: We hold ipmp_lock across the unlink to prevent a race
9694 		 * with an SIOCSLIFGROUPNAME request from an ill trying to
9695 		 * join this group.  Specifically: ills trying to join grab
9696 		 * ipmp_lock and bump a "pending join" counter checked by
9697 		 * ipmp_illgrp_unlink_grp().  During the unlink no new pending
9698 		 * joins can occur (since we have ipmp_lock).  Once we drop
9699 		 * ipmp_lock, subsequent SIOCSLIFGROUPNAME requests will not
9700 		 * find the illgrp (since we unlinked it) and will return
9701 		 * EAFNOSUPPORT.  This will then take them back through the
9702 		 * IPMP meta-interface plumbing logic in ifconfig, and thus
9703 		 * back through I_PLINK above.
9704 		 */
9705 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
9706 		err = ipmp_illgrp_unlink_grp(ill->ill_grp);
9707 		rw_exit(&ipst->ips_ipmp_lock);
9708 		return (err);
9709 	default:
9710 		break;
9711 	}
9712 	return (0);
9713 }
9714 
9715 /*
9716  * Do I_PLINK/I_LINK or I_PUNLINK/I_UNLINK with consistency checks and also
9717  * atomically set/clear the muxids. Also complete the ioctl by acking or
9718  * naking it.  Note that the code is structured such that the link type,
9719  * whether it's persistent or not, is treated equally.  ifconfig(1M) and
9720  * its clones use the persistent link, while pppd(1M) and perhaps many
9721  * other daemons may use non-persistent link.  When combined with some
9722  * ill_t states, linking and unlinking lower streams may be used as
9723  * indicators of dynamic re-plumbing events [see PSARC/1999/348].
9724  */
9725 /* ARGSUSED */
9726 void
9727 ip_sioctl_plink(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
9728 {
9729 	mblk_t		*mp1, *mp2;
9730 	struct linkblk	*li;
9731 	struct ipmx_s	*ipmxp;
9732 	ill_t		*ill;
9733 	int		ioccmd = ((struct iocblk *)mp->b_rptr)->ioc_cmd;
9734 	int		err = 0;
9735 	boolean_t	entered_ipsq = B_FALSE;
9736 	boolean_t	islink;
9737 	ip_stack_t	*ipst;
9738 
9739 	if (CONN_Q(q))
9740 		ipst = CONNQ_TO_IPST(q);
9741 	else
9742 		ipst = ILLQ_TO_IPST(q);
9743 
9744 	ASSERT(ioccmd == I_PLINK || ioccmd == I_PUNLINK ||
9745 	    ioccmd == I_LINK || ioccmd == I_UNLINK);
9746 
9747 	islink = (ioccmd == I_PLINK || ioccmd == I_LINK);
9748 
9749 	mp1 = mp->b_cont;	/* This is the linkblk info */
9750 	li = (struct linkblk *)mp1->b_rptr;
9751 
9752 	/*
9753 	 * ARP has added this special mblk, and the utility is asking us
9754 	 * to perform consistency checks, and also atomically set the
9755 	 * muxid. Ifconfig is an example.  It achieves this by using
9756 	 * /dev/arp as the mux to plink the arp stream, and pushes arp on
9757 	 * to /dev/udp[6] stream for use as the mux when plinking the IP
9758 	 * stream. SIOCSLIFMUXID is not required.  See ifconfig.c, arp.c
9759 	 * and other comments in this routine for more details.
9760 	 */
9761 	mp2 = mp1->b_cont;	/* This is added by ARP */
9762 
9763 	/*
9764 	 * If I_{P}LINK/I_{P}UNLINK is issued by a utility other than
9765 	 * ifconfig which didn't push ARP on top of the dummy mux, we won't
9766 	 * get the special mblk above.  For backward compatibility, we
9767 	 * request ip_sioctl_plink_ipmod() to skip the consistency checks.
9768 	 * The utility will use SIOCSLIFMUXID to store the muxids.  This is
9769 	 * not atomic, and can leave the streams unplumbable if the utility
9770 	 * is interrupted before it does the SIOCSLIFMUXID.
9771 	 */
9772 	if (mp2 == NULL) {
9773 		err = ip_sioctl_plink_ipmod(ipsq, q, mp, ioccmd, li, B_FALSE);
9774 		if (err == EINPROGRESS)
9775 			return;
9776 		goto done;
9777 	}
9778 
9779 	/*
9780 	 * This is an I_{P}LINK sent down by ifconfig through the ARP module;
9781 	 * ARP has appended this last mblk to tell us whether the lower stream
9782 	 * is an arp-dev stream or an IP module stream.
9783 	 */
9784 	ipmxp = (struct ipmx_s *)mp2->b_rptr;
9785 	if (ipmxp->ipmx_arpdev_stream) {
9786 		/*
9787 		 * The lower stream is the arp-dev stream.
9788 		 */
9789 		ill = ill_lookup_on_name(ipmxp->ipmx_name, B_FALSE, B_FALSE,
9790 		    q, mp, ip_sioctl_plink, &err, NULL, ipst);
9791 		if (ill == NULL) {
9792 			if (err == EINPROGRESS)
9793 				return;
9794 			err = EINVAL;
9795 			goto done;
9796 		}
9797 
9798 		if (ipsq == NULL) {
9799 			ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_sioctl_plink,
9800 			    NEW_OP, B_FALSE);
9801 			if (ipsq == NULL) {
9802 				ill_refrele(ill);
9803 				return;
9804 			}
9805 			entered_ipsq = B_TRUE;
9806 		}
9807 		ASSERT(IAM_WRITER_ILL(ill));
9808 		ill_refrele(ill);
9809 
9810 		/*
9811 		 * To ensure consistency between IP and ARP, the following
9812 		 * LIFO scheme is used in plink/punlink. (IP first, ARP last).
9813 		 * This is because the muxid's are stored in the IP stream on
9814 		 * the ill.
9815 		 *
9816 		 * I_{P}LINK: ifconfig plinks the IP stream before plinking
9817 		 * the ARP stream. On an arp-dev stream, IP checks that it is
9818 		 * not yet plinked, and it also checks that the corresponding
9819 		 * IP stream is already plinked.
9820 		 *
9821 		 * I_{P}UNLINK: ifconfig punlinks the ARP stream before
9822 		 * punlinking the IP stream. IP does not allow punlink of the
9823 		 * IP stream unless the arp stream has been punlinked.
9824 		 */
9825 		if ((islink &&
9826 		    (ill->ill_arp_muxid != 0 || ill->ill_ip_muxid == 0)) ||
9827 		    (!islink && ill->ill_arp_muxid != li->l_index)) {
9828 			err = EINVAL;
9829 			goto done;
9830 		}
9831 
9832 		if (IS_IPMP(ill) &&
9833 		    (err = ip_sioctl_plink_ipmp(ill, ioccmd)) != 0)
9834 			goto done;
9835 
9836 		ill->ill_arp_muxid = islink ? li->l_index : 0;
9837 	} else {
9838 		/*
9839 		 * The lower stream is probably an IP module stream.  Do
9840 		 * consistency checking.
9841 		 */
9842 		err = ip_sioctl_plink_ipmod(ipsq, q, mp, ioccmd, li, B_TRUE);
9843 		if (err == EINPROGRESS)
9844 			return;
9845 	}
9846 done:
9847 	if (err == 0)
9848 		miocack(q, mp, 0, 0);
9849 	else
9850 		miocnak(q, mp, 0, err);
9851 
9852 	/* Conn was refheld in ip_sioctl_copyin_setup */
9853 	if (CONN_Q(q))
9854 		CONN_OPER_PENDING_DONE(Q_TO_CONN(q));
9855 	if (entered_ipsq)
9856 		ipsq_exit(ipsq);
9857 }
9858 
9859 /*
9860  * Process I_{P}LINK and I_{P}UNLINK requests named by `ioccmd' and pointed to
9861  * by `mp' and `li' for the IP module stream (if li->q_bot is in fact an IP
9862  * module stream).  If `doconsist' is set, then do the extended consistency
9863  * checks requested by ifconfig(1M) and (atomically) set ill_ip_muxid here.
9864  * Returns zero on success, EINPROGRESS if the operation is still pending, or
9865  * an error code on failure.
9866  */
9867 static int
9868 ip_sioctl_plink_ipmod(ipsq_t *ipsq, queue_t *q, mblk_t *mp, int ioccmd,
9869     struct linkblk *li, boolean_t doconsist)
9870 {
9871 	int		err = 0;
9872 	ill_t  		*ill;
9873 	queue_t		*ipwq, *dwq;
9874 	const char	*name;
9875 	struct qinit	*qinfo;
9876 	boolean_t	islink = (ioccmd == I_PLINK || ioccmd == I_LINK);
9877 	boolean_t	entered_ipsq = B_FALSE;
9878 
9879 	/*
9880 	 * Walk the lower stream to verify it's the IP module stream.
9881 	 * The IP module is identified by its name, wput function,
9882 	 * and non-NULL q_next.  STREAMS ensures that the lower stream
9883 	 * (li->l_qbot) will not vanish until this ioctl completes.
9884 	 */
9885 	for (ipwq = li->l_qbot; ipwq != NULL; ipwq = ipwq->q_next) {
9886 		qinfo = ipwq->q_qinfo;
9887 		name = qinfo->qi_minfo->mi_idname;
9888 		if (name != NULL && strcmp(name, ip_mod_info.mi_idname) == 0 &&
9889 		    qinfo->qi_putp != (pfi_t)ip_lwput && ipwq->q_next != NULL) {
9890 			break;
9891 		}
9892 	}
9893 
9894 	/*
9895 	 * If this isn't an IP module stream, bail.
9896 	 */
9897 	if (ipwq == NULL)
9898 		return (0);
9899 
9900 	ill = ipwq->q_ptr;
9901 	ASSERT(ill != NULL);
9902 
9903 	if (ipsq == NULL) {
9904 		ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_sioctl_plink,
9905 		    NEW_OP, B_FALSE);
9906 		if (ipsq == NULL)
9907 			return (EINPROGRESS);
9908 		entered_ipsq = B_TRUE;
9909 	}
9910 	ASSERT(IAM_WRITER_ILL(ill));
9911 
9912 	if (doconsist) {
9913 		/*
9914 		 * Consistency checking requires that I_{P}LINK occurs
9915 		 * prior to setting ill_ip_muxid, and that I_{P}UNLINK
9916 		 * occurs prior to clearing ill_arp_muxid.
9917 		 */
9918 		if ((islink && ill->ill_ip_muxid != 0) ||
9919 		    (!islink && ill->ill_arp_muxid != 0)) {
9920 			err = EINVAL;
9921 			goto done;
9922 		}
9923 	}
9924 
9925 	if (IS_IPMP(ill) && (err = ip_sioctl_plink_ipmp(ill, ioccmd)) != 0)
9926 		goto done;
9927 
9928 	/*
9929 	 * As part of I_{P}LINKing, stash the number of downstream modules and
9930 	 * the read queue of the module immediately below IP in the ill.
9931 	 * These are used during the capability negotiation below.
9932 	 */
9933 	ill->ill_lmod_rq = NULL;
9934 	ill->ill_lmod_cnt = 0;
9935 	if (islink && ((dwq = ipwq->q_next) != NULL)) {
9936 		ill->ill_lmod_rq = RD(dwq);
9937 		for (; dwq != NULL; dwq = dwq->q_next)
9938 			ill->ill_lmod_cnt++;
9939 	}
9940 
9941 	if (doconsist)
9942 		ill->ill_ip_muxid = islink ? li->l_index : 0;
9943 
9944 	/*
9945 	 * Mark the ipsq busy until the capability operations initiated below
9946 	 * complete. The PLINK/UNLINK ioctl itself completes when our caller
9947 	 * returns, but the capability operation may complete asynchronously
9948 	 * much later.
9949 	 */
9950 	ipsq_current_start(ipsq, ill->ill_ipif, ioccmd);
9951 	/*
9952 	 * If there's at least one up ipif on this ill, then we're bound to
9953 	 * the underlying driver via DLPI.  In that case, renegotiate
9954 	 * capabilities to account for any possible change in modules
9955 	 * interposed between IP and the driver.
9956 	 */
9957 	if (ill->ill_ipif_up_count > 0) {
9958 		if (islink)
9959 			ill_capability_probe(ill);
9960 		else
9961 			ill_capability_reset(ill, B_FALSE);
9962 	}
9963 	ipsq_current_finish(ipsq);
9964 done:
9965 	if (entered_ipsq)
9966 		ipsq_exit(ipsq);
9967 
9968 	return (err);
9969 }
9970 
9971 /*
9972  * Search the ioctl command in the ioctl tables and return a pointer
9973  * to the ioctl command information. The ioctl command tables are
9974  * static and fully populated at compile time.
9975  */
9976 ip_ioctl_cmd_t *
9977 ip_sioctl_lookup(int ioc_cmd)
9978 {
9979 	int index;
9980 	ip_ioctl_cmd_t *ipip;
9981 	ip_ioctl_cmd_t *ipip_end;
9982 
9983 	if (ioc_cmd == IPI_DONTCARE)
9984 		return (NULL);
9985 
9986 	/*
9987 	 * Do a 2 step search. First search the indexed table
9988 	 * based on the least significant byte of the ioctl cmd.
9989 	 * If we don't find a match, then search the misc table
9990 	 * serially.
9991 	 */
9992 	index = ioc_cmd & 0xFF;
9993 	if (index < ip_ndx_ioctl_count) {
9994 		ipip = &ip_ndx_ioctl_table[index];
9995 		if (ipip->ipi_cmd == ioc_cmd) {
9996 			/* Found a match in the ndx table */
9997 			return (ipip);
9998 		}
9999 	}
10000 
10001 	/* Search the misc table */
10002 	ipip_end = &ip_misc_ioctl_table[ip_misc_ioctl_count];
10003 	for (ipip = ip_misc_ioctl_table; ipip < ipip_end; ipip++) {
10004 		if (ipip->ipi_cmd == ioc_cmd)
10005 			/* Found a match in the misc table */
10006 			return (ipip);
10007 	}
10008 
10009 	return (NULL);
10010 }
10011 
10012 /*
10013  * Wrapper function for resuming deferred ioctl processing
10014  * Used for SIOCGDSTINFO, SIOCGIP6ADDRPOLICY, SIOCGMSFILTER,
10015  * SIOCSMSFILTER, SIOCGIPMSFILTER, and SIOCSIPMSFILTER currently.
10016  */
10017 /* ARGSUSED */
10018 void
10019 ip_sioctl_copyin_resume(ipsq_t *dummy_ipsq, queue_t *q, mblk_t *mp,
10020     void *dummy_arg)
10021 {
10022 	ip_sioctl_copyin_setup(q, mp);
10023 }
10024 
10025 /*
10026  * ip_sioctl_copyin_setup is called by ip_wput with any M_IOCTL message
10027  * that arrives.  Most of the IOCTLs are "socket" IOCTLs which we handle
10028  * in either I_STR or TRANSPARENT form, using the mi_copy facility.
10029  * We establish here the size of the block to be copied in.  mi_copyin
10030  * arranges for this to happen, an processing continues in ip_wput with
10031  * an M_IOCDATA message.
10032  */
10033 void
10034 ip_sioctl_copyin_setup(queue_t *q, mblk_t *mp)
10035 {
10036 	int	copyin_size;
10037 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
10038 	ip_ioctl_cmd_t *ipip;
10039 	cred_t *cr;
10040 	ip_stack_t	*ipst;
10041 
10042 	if (CONN_Q(q))
10043 		ipst = CONNQ_TO_IPST(q);
10044 	else
10045 		ipst = ILLQ_TO_IPST(q);
10046 
10047 	ipip = ip_sioctl_lookup(iocp->ioc_cmd);
10048 	if (ipip == NULL) {
10049 		/*
10050 		 * The ioctl is not one we understand or own.
10051 		 * Pass it along to be processed down stream,
10052 		 * if this is a module instance of IP, else nak
10053 		 * the ioctl.
10054 		 */
10055 		if (q->q_next == NULL) {
10056 			goto nak;
10057 		} else {
10058 			putnext(q, mp);
10059 			return;
10060 		}
10061 	}
10062 
10063 	/*
10064 	 * If this is deferred, then we will do all the checks when we
10065 	 * come back.
10066 	 */
10067 	if ((iocp->ioc_cmd == SIOCGDSTINFO ||
10068 	    iocp->ioc_cmd == SIOCGIP6ADDRPOLICY) && !ip6_asp_can_lookup(ipst)) {
10069 		ip6_asp_pending_op(q, mp, ip_sioctl_copyin_resume);
10070 		return;
10071 	}
10072 
10073 	/*
10074 	 * Only allow a very small subset of IP ioctls on this stream if
10075 	 * IP is a module and not a driver. Allowing ioctls to be processed
10076 	 * in this case may cause assert failures or data corruption.
10077 	 * Typically G[L]IFFLAGS, SLIFNAME/IF_UNITSEL are the only few
10078 	 * ioctls allowed on an IP module stream, after which this stream
10079 	 * normally becomes a multiplexor (at which time the stream head
10080 	 * will fail all ioctls).
10081 	 */
10082 	if ((q->q_next != NULL) && !(ipip->ipi_flags & IPI_MODOK)) {
10083 		if (ipip->ipi_flags & IPI_PASS_DOWN) {
10084 			/*
10085 			 * Pass common Streams ioctls which the IP
10086 			 * module does not own or consume along to
10087 			 * be processed down stream.
10088 			 */
10089 			putnext(q, mp);
10090 			return;
10091 		} else {
10092 			goto nak;
10093 		}
10094 	}
10095 
10096 	/* Make sure we have ioctl data to process. */
10097 	if (mp->b_cont == NULL && !(ipip->ipi_flags & IPI_NULL_BCONT))
10098 		goto nak;
10099 
10100 	/*
10101 	 * Prefer dblk credential over ioctl credential; some synthesized
10102 	 * ioctls have kcred set because there's no way to crhold()
10103 	 * a credential in some contexts.  (ioc_cr is not crfree() by
10104 	 * the framework; the caller of ioctl needs to hold the reference
10105 	 * for the duration of the call).
10106 	 */
10107 	cr = msg_getcred(mp, NULL);
10108 	if (cr == NULL)
10109 		cr = iocp->ioc_cr;
10110 
10111 	/* Make sure normal users don't send down privileged ioctls */
10112 	if ((ipip->ipi_flags & IPI_PRIV) &&
10113 	    (cr != NULL) && secpolicy_ip_config(cr, B_TRUE) != 0) {
10114 		/* We checked the privilege earlier but log it here */
10115 		miocnak(q, mp, 0, secpolicy_ip_config(cr, B_FALSE));
10116 		return;
10117 	}
10118 
10119 	/*
10120 	 * The ioctl command tables can only encode fixed length
10121 	 * ioctl data. If the length is variable, the table will
10122 	 * encode the length as zero. Such special cases are handled
10123 	 * below in the switch.
10124 	 */
10125 	if (ipip->ipi_copyin_size != 0) {
10126 		mi_copyin(q, mp, NULL, ipip->ipi_copyin_size);
10127 		return;
10128 	}
10129 
10130 	switch (iocp->ioc_cmd) {
10131 	case O_SIOCGIFCONF:
10132 	case SIOCGIFCONF:
10133 		/*
10134 		 * This IOCTL is hilarious.  See comments in
10135 		 * ip_sioctl_get_ifconf for the story.
10136 		 */
10137 		if (iocp->ioc_count == TRANSPARENT)
10138 			copyin_size = SIZEOF_STRUCT(ifconf,
10139 			    iocp->ioc_flag);
10140 		else
10141 			copyin_size = iocp->ioc_count;
10142 		mi_copyin(q, mp, NULL, copyin_size);
10143 		return;
10144 
10145 	case O_SIOCGLIFCONF:
10146 	case SIOCGLIFCONF:
10147 		copyin_size = SIZEOF_STRUCT(lifconf, iocp->ioc_flag);
10148 		mi_copyin(q, mp, NULL, copyin_size);
10149 		return;
10150 
10151 	case SIOCGLIFSRCOF:
10152 		copyin_size = SIZEOF_STRUCT(lifsrcof, iocp->ioc_flag);
10153 		mi_copyin(q, mp, NULL, copyin_size);
10154 		return;
10155 	case SIOCGIP6ADDRPOLICY:
10156 		ip_sioctl_ip6addrpolicy(q, mp);
10157 		ip6_asp_table_refrele(ipst);
10158 		return;
10159 
10160 	case SIOCSIP6ADDRPOLICY:
10161 		ip_sioctl_ip6addrpolicy(q, mp);
10162 		return;
10163 
10164 	case SIOCGDSTINFO:
10165 		ip_sioctl_dstinfo(q, mp);
10166 		ip6_asp_table_refrele(ipst);
10167 		return;
10168 
10169 	case I_PLINK:
10170 	case I_PUNLINK:
10171 	case I_LINK:
10172 	case I_UNLINK:
10173 		/*
10174 		 * We treat non-persistent link similarly as the persistent
10175 		 * link case, in terms of plumbing/unplumbing, as well as
10176 		 * dynamic re-plumbing events indicator.  See comments
10177 		 * in ip_sioctl_plink() for more.
10178 		 *
10179 		 * Request can be enqueued in the 'ipsq' while waiting
10180 		 * to become exclusive. So bump up the conn ref.
10181 		 */
10182 		if (CONN_Q(q))
10183 			CONN_INC_REF(Q_TO_CONN(q));
10184 		ip_sioctl_plink(NULL, q, mp, NULL);
10185 		return;
10186 
10187 	case ND_GET:
10188 	case ND_SET:
10189 		/*
10190 		 * Use of the nd table requires holding the reader lock.
10191 		 * Modifying the nd table thru nd_load/nd_unload requires
10192 		 * the writer lock.
10193 		 */
10194 		rw_enter(&ipst->ips_ip_g_nd_lock, RW_READER);
10195 		if (nd_getset(q, ipst->ips_ip_g_nd, mp)) {
10196 			rw_exit(&ipst->ips_ip_g_nd_lock);
10197 
10198 			if (iocp->ioc_error)
10199 				iocp->ioc_count = 0;
10200 			mp->b_datap->db_type = M_IOCACK;
10201 			qreply(q, mp);
10202 			return;
10203 		}
10204 		rw_exit(&ipst->ips_ip_g_nd_lock);
10205 		/*
10206 		 * We don't understand this subioctl of ND_GET / ND_SET.
10207 		 * Maybe intended for some driver / module below us
10208 		 */
10209 		if (q->q_next) {
10210 			putnext(q, mp);
10211 		} else {
10212 			iocp->ioc_error = ENOENT;
10213 			mp->b_datap->db_type = M_IOCNAK;
10214 			iocp->ioc_count = 0;
10215 			qreply(q, mp);
10216 		}
10217 		return;
10218 
10219 	case IP_IOCTL:
10220 		ip_wput_ioctl(q, mp);
10221 		return;
10222 	default:
10223 		cmn_err(CE_PANIC, "should not happen ");
10224 	}
10225 nak:
10226 	if (mp->b_cont != NULL) {
10227 		freemsg(mp->b_cont);
10228 		mp->b_cont = NULL;
10229 	}
10230 	iocp->ioc_error = EINVAL;
10231 	mp->b_datap->db_type = M_IOCNAK;
10232 	iocp->ioc_count = 0;
10233 	qreply(q, mp);
10234 }
10235 
10236 /* ip_wput hands off ARP IOCTL responses to us */
10237 /* ARGSUSED3 */
10238 void
10239 ip_sioctl_iocack(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
10240 {
10241 	struct arpreq *ar;
10242 	struct xarpreq *xar;
10243 	area_t	*area;
10244 	mblk_t	*area_mp;
10245 	struct iocblk *iocp;
10246 	mblk_t	*orig_ioc_mp, *tmp;
10247 	struct iocblk	*orig_iocp;
10248 	ill_t *ill;
10249 	conn_t *connp = NULL;
10250 	mblk_t *pending_mp;
10251 	int x_arp_ioctl = B_FALSE, ifx_arp_ioctl = B_FALSE;
10252 	int *flagsp;
10253 	char *storage = NULL;
10254 	sin_t *sin;
10255 	ipaddr_t addr;
10256 	int err;
10257 	ip_stack_t *ipst;
10258 
10259 	ASSERT(ipsq == NULL || IAM_WRITER_IPSQ(ipsq));
10260 	ill = q->q_ptr;
10261 	ASSERT(ill != NULL);
10262 	ipst = ill->ill_ipst;
10263 
10264 	/*
10265 	 * We should get back from ARP a packet chain that looks like:
10266 	 * M_IOCACK-->ARP_op_MBLK-->ORIG_M_IOCTL-->MI_COPY_MBLK-->[X]ARPREQ_MBLK
10267 	 */
10268 	if (!(area_mp = mp->b_cont) ||
10269 	    (area_mp->b_wptr - area_mp->b_rptr) < sizeof (ip_sock_ar_t) ||
10270 	    !(orig_ioc_mp = area_mp->b_cont) ||
10271 	    !orig_ioc_mp->b_cont || !orig_ioc_mp->b_cont->b_cont) {
10272 		freemsg(mp);
10273 		return;
10274 	}
10275 
10276 	orig_iocp = (struct iocblk *)orig_ioc_mp->b_rptr;
10277 
10278 	tmp = (orig_ioc_mp->b_cont)->b_cont;
10279 	if ((orig_iocp->ioc_cmd == SIOCGXARP) ||
10280 	    (orig_iocp->ioc_cmd == SIOCSXARP) ||
10281 	    (orig_iocp->ioc_cmd == SIOCDXARP)) {
10282 		x_arp_ioctl = B_TRUE;
10283 		xar = (struct xarpreq *)tmp->b_rptr;
10284 		sin = (sin_t *)&xar->xarp_pa;
10285 		flagsp = &xar->xarp_flags;
10286 		storage = xar->xarp_ha.sdl_data;
10287 		if (xar->xarp_ha.sdl_nlen != 0)
10288 			ifx_arp_ioctl = B_TRUE;
10289 	} else {
10290 		ar = (struct arpreq *)tmp->b_rptr;
10291 		sin = (sin_t *)&ar->arp_pa;
10292 		flagsp = &ar->arp_flags;
10293 		storage = ar->arp_ha.sa_data;
10294 	}
10295 
10296 	iocp = (struct iocblk *)mp->b_rptr;
10297 
10298 	/*
10299 	 * Find the pending message; if we're exclusive, it'll be on our IPSQ.
10300 	 * Otherwise, we can find it from our ioc_id.
10301 	 */
10302 	if (ipsq != NULL)
10303 		pending_mp = ipsq_pending_mp_get(ipsq, &connp);
10304 	else
10305 		pending_mp = ill_pending_mp_get(ill, &connp, iocp->ioc_id);
10306 
10307 	if (pending_mp == NULL) {
10308 		ASSERT(connp == NULL);
10309 		inet_freemsg(mp);
10310 		return;
10311 	}
10312 	ASSERT(connp != NULL);
10313 	q = CONNP_TO_WQ(connp);
10314 
10315 	/* Uncouple the internally generated IOCTL from the original one */
10316 	area = (area_t *)area_mp->b_rptr;
10317 	area_mp->b_cont = NULL;
10318 
10319 	/*
10320 	 * Restore the b_next and b_prev used by mi code. This is needed
10321 	 * to complete the ioctl using mi* functions. We stored them in
10322 	 * the pending mp prior to sending the request to ARP.
10323 	 */
10324 	orig_ioc_mp->b_cont->b_next = pending_mp->b_cont->b_next;
10325 	orig_ioc_mp->b_cont->b_prev = pending_mp->b_cont->b_prev;
10326 	inet_freemsg(pending_mp);
10327 
10328 	/*
10329 	 * We're done if there was an error or if this is not an SIOCG{X}ARP
10330 	 * Catch the case where there is an IRE_CACHE by no entry in the
10331 	 * arp table.
10332 	 */
10333 	addr = sin->sin_addr.s_addr;
10334 	if (iocp->ioc_error && iocp->ioc_cmd == AR_ENTRY_SQUERY) {
10335 		ire_t			*ire;
10336 		dl_unitdata_req_t	*dlup;
10337 		mblk_t			*llmp;
10338 		int			addr_len;
10339 		ill_t			*ipsqill = NULL;
10340 
10341 		if (ifx_arp_ioctl) {
10342 			/*
10343 			 * There's no need to lookup the ill, since
10344 			 * we've already done that when we started
10345 			 * processing the ioctl and sent the message
10346 			 * to ARP on that ill.  So use the ill that
10347 			 * is stored in q->q_ptr.
10348 			 */
10349 			ipsqill = ill;
10350 			ire = ire_ctable_lookup(addr, 0, IRE_CACHE,
10351 			    ipsqill->ill_ipif, ALL_ZONES,
10352 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ILL, ipst);
10353 		} else {
10354 			ire = ire_ctable_lookup(addr, 0, IRE_CACHE,
10355 			    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
10356 			if (ire != NULL)
10357 				ipsqill = ire_to_ill(ire);
10358 		}
10359 
10360 		if ((x_arp_ioctl) && (ipsqill != NULL))
10361 			storage += ill_xarp_info(&xar->xarp_ha, ipsqill);
10362 
10363 		if (ire != NULL) {
10364 			/*
10365 			 * Since the ire obtained from cachetable is used for
10366 			 * mac addr copying below, treat an incomplete ire as if
10367 			 * as if we never found it.
10368 			 */
10369 			if (ire->ire_nce != NULL &&
10370 			    ire->ire_nce->nce_state != ND_REACHABLE) {
10371 				ire_refrele(ire);
10372 				ire = NULL;
10373 				ipsqill = NULL;
10374 				goto errack;
10375 			}
10376 			*flagsp = ATF_INUSE;
10377 			llmp = (ire->ire_nce != NULL ?
10378 			    ire->ire_nce->nce_res_mp : NULL);
10379 			if (llmp != NULL && ipsqill != NULL) {
10380 				uchar_t *macaddr;
10381 
10382 				addr_len = ipsqill->ill_phys_addr_length;
10383 				if (x_arp_ioctl && ((addr_len +
10384 				    ipsqill->ill_name_length) >
10385 				    sizeof (xar->xarp_ha.sdl_data))) {
10386 					ire_refrele(ire);
10387 					freemsg(mp);
10388 					ip_ioctl_finish(q, orig_ioc_mp,
10389 					    EINVAL, NO_COPYOUT, ipsq);
10390 					return;
10391 				}
10392 				*flagsp |= ATF_COM;
10393 				dlup = (dl_unitdata_req_t *)llmp->b_rptr;
10394 				if (ipsqill->ill_sap_length < 0)
10395 					macaddr = llmp->b_rptr +
10396 					    dlup->dl_dest_addr_offset;
10397 				else
10398 					macaddr = llmp->b_rptr +
10399 					    dlup->dl_dest_addr_offset +
10400 					    ipsqill->ill_sap_length;
10401 				/*
10402 				 * For SIOCGARP, MAC address length
10403 				 * validation has already been done
10404 				 * before the ioctl was issued to ARP to
10405 				 * allow it to progress only on 6 byte
10406 				 * addressable (ethernet like) media. Thus
10407 				 * the mac address copying can not overwrite
10408 				 * the sa_data area below.
10409 				 */
10410 				bcopy(macaddr, storage, addr_len);
10411 			}
10412 			/* Ditch the internal IOCTL. */
10413 			freemsg(mp);
10414 			ire_refrele(ire);
10415 			ip_ioctl_finish(q, orig_ioc_mp, 0, COPYOUT, ipsq);
10416 			return;
10417 		}
10418 	}
10419 
10420 	/*
10421 	 * If this was a failed AR_ENTRY_ADD or a successful AR_ENTRY_DELETE
10422 	 * on the IPMP meta-interface, ensure any ARP entries added in
10423 	 * ip_sioctl_arp() are deleted.
10424 	 */
10425 	if (IS_IPMP(ill) &&
10426 	    ((iocp->ioc_error != 0 && iocp->ioc_cmd == AR_ENTRY_ADD) ||
10427 	    ((iocp->ioc_error == 0 && iocp->ioc_cmd == AR_ENTRY_DELETE)))) {
10428 		ipmp_illgrp_t *illg = ill->ill_grp;
10429 		ipmp_arpent_t *entp;
10430 
10431 		if ((entp = ipmp_illgrp_lookup_arpent(illg, &addr)) != NULL)
10432 			ipmp_illgrp_destroy_arpent(illg, entp);
10433 	}
10434 
10435 	/*
10436 	 * Delete the coresponding IRE_CACHE if any.
10437 	 * Reset the error if there was one (in case there was no entry
10438 	 * in arp.)
10439 	 */
10440 	if (iocp->ioc_cmd == AR_ENTRY_DELETE) {
10441 		ipif_t *ipintf = NULL;
10442 
10443 		if (ifx_arp_ioctl) {
10444 			/*
10445 			 * There's no need to lookup the ill, since
10446 			 * we've already done that when we started
10447 			 * processing the ioctl and sent the message
10448 			 * to ARP on that ill.  So use the ill that
10449 			 * is stored in q->q_ptr.
10450 			 */
10451 			ipintf = ill->ill_ipif;
10452 		}
10453 		if (ip_ire_clookup_and_delete(addr, ipintf, ipst)) {
10454 			/*
10455 			 * The address in "addr" may be an entry for a
10456 			 * router. If that's true, then any off-net
10457 			 * IRE_CACHE entries that go through the router
10458 			 * with address "addr" must be clobbered. Use
10459 			 * ire_walk to achieve this goal.
10460 			 */
10461 			if (ifx_arp_ioctl)
10462 				ire_walk_ill_v4(MATCH_IRE_ILL, 0,
10463 				    ire_delete_cache_gw, (char *)&addr, ill);
10464 			else
10465 				ire_walk_v4(ire_delete_cache_gw, (char *)&addr,
10466 				    ALL_ZONES, ipst);
10467 			iocp->ioc_error = 0;
10468 		}
10469 	}
10470 errack:
10471 	if (iocp->ioc_error || iocp->ioc_cmd != AR_ENTRY_SQUERY) {
10472 		err = iocp->ioc_error;
10473 		freemsg(mp);
10474 		ip_ioctl_finish(q, orig_ioc_mp, err, NO_COPYOUT, ipsq);
10475 		return;
10476 	}
10477 
10478 	/*
10479 	 * Completion of an SIOCG{X}ARP.  Translate the information from
10480 	 * the area_t into the struct {x}arpreq.
10481 	 */
10482 	if (x_arp_ioctl) {
10483 		storage += ill_xarp_info(&xar->xarp_ha, ill);
10484 		if ((ill->ill_phys_addr_length + ill->ill_name_length) >
10485 		    sizeof (xar->xarp_ha.sdl_data)) {
10486 			freemsg(mp);
10487 			ip_ioctl_finish(q, orig_ioc_mp, EINVAL, NO_COPYOUT,
10488 			    ipsq);
10489 			return;
10490 		}
10491 	}
10492 	*flagsp = ATF_INUSE;
10493 	if (area->area_flags & ACE_F_PERMANENT)
10494 		*flagsp |= ATF_PERM;
10495 	if (area->area_flags & ACE_F_PUBLISH)
10496 		*flagsp |= ATF_PUBL;
10497 	if (area->area_flags & ACE_F_AUTHORITY)
10498 		*flagsp |= ATF_AUTHORITY;
10499 	if (area->area_hw_addr_length != 0) {
10500 		*flagsp |= ATF_COM;
10501 		/*
10502 		 * For SIOCGARP, MAC address length validation has
10503 		 * already been done before the ioctl was issued to ARP
10504 		 * to allow it to progress only on 6 byte addressable
10505 		 * (ethernet like) media. Thus the mac address copying
10506 		 * can not overwrite the sa_data area below.
10507 		 */
10508 		bcopy((char *)area + area->area_hw_addr_offset,
10509 		    storage, area->area_hw_addr_length);
10510 	}
10511 
10512 	/* Ditch the internal IOCTL. */
10513 	freemsg(mp);
10514 	/* Complete the original. */
10515 	ip_ioctl_finish(q, orig_ioc_mp, 0, COPYOUT, ipsq);
10516 }
10517 
10518 /*
10519  * Create a new logical interface. If ipif_id is zero (i.e. not a logical
10520  * interface) create the next available logical interface for this
10521  * physical interface.
10522  * If ipif is NULL (i.e. the lookup didn't find one) attempt to create an
10523  * ipif with the specified name.
10524  *
10525  * If the address family is not AF_UNSPEC then set the address as well.
10526  *
10527  * If ip_sioctl_addr returns EINPROGRESS then the ioctl (the copyout)
10528  * is completed when the DL_BIND_ACK arrive in ip_rput_dlpi_writer.
10529  *
10530  * Executed as a writer on the ill.
10531  * So no lock is needed to traverse the ipif chain, or examine the
10532  * phyint flags.
10533  */
10534 /* ARGSUSED */
10535 int
10536 ip_sioctl_addif(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
10537     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
10538 {
10539 	mblk_t	*mp1;
10540 	struct lifreq *lifr;
10541 	boolean_t	isv6;
10542 	boolean_t	exists;
10543 	char 	*name;
10544 	char	*endp;
10545 	char	*cp;
10546 	int	namelen;
10547 	ipif_t	*ipif;
10548 	long	id;
10549 	ipsq_t	*ipsq;
10550 	ill_t	*ill;
10551 	sin_t	*sin;
10552 	int	err = 0;
10553 	boolean_t found_sep = B_FALSE;
10554 	conn_t	*connp;
10555 	zoneid_t zoneid;
10556 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
10557 
10558 	ASSERT(q->q_next == NULL);
10559 	ip1dbg(("ip_sioctl_addif\n"));
10560 	/* Existence of mp1 has been checked in ip_wput_nondata */
10561 	mp1 = mp->b_cont->b_cont;
10562 	/*
10563 	 * Null terminate the string to protect against buffer
10564 	 * overrun. String was generated by user code and may not
10565 	 * be trusted.
10566 	 */
10567 	lifr = (struct lifreq *)mp1->b_rptr;
10568 	lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
10569 	name = lifr->lifr_name;
10570 	ASSERT(CONN_Q(q));
10571 	connp = Q_TO_CONN(q);
10572 	isv6 = connp->conn_af_isv6;
10573 	zoneid = connp->conn_zoneid;
10574 	namelen = mi_strlen(name);
10575 	if (namelen == 0)
10576 		return (EINVAL);
10577 
10578 	exists = B_FALSE;
10579 	if ((namelen + 1 == sizeof (ipif_loopback_name)) &&
10580 	    (mi_strcmp(name, ipif_loopback_name) == 0)) {
10581 		/*
10582 		 * Allow creating lo0 using SIOCLIFADDIF.
10583 		 * can't be any other writer thread. So can pass null below
10584 		 * for the last 4 args to ipif_lookup_name.
10585 		 */
10586 		ipif = ipif_lookup_on_name(lifr->lifr_name, namelen, B_TRUE,
10587 		    &exists, isv6, zoneid, NULL, NULL, NULL, NULL, ipst);
10588 		/* Prevent any further action */
10589 		if (ipif == NULL) {
10590 			return (ENOBUFS);
10591 		} else if (!exists) {
10592 			/* We created the ipif now and as writer */
10593 			ipif_refrele(ipif);
10594 			return (0);
10595 		} else {
10596 			ill = ipif->ipif_ill;
10597 			ill_refhold(ill);
10598 			ipif_refrele(ipif);
10599 		}
10600 	} else {
10601 		/* Look for a colon in the name. */
10602 		endp = &name[namelen];
10603 		for (cp = endp; --cp > name; ) {
10604 			if (*cp == IPIF_SEPARATOR_CHAR) {
10605 				found_sep = B_TRUE;
10606 				/*
10607 				 * Reject any non-decimal aliases for plumbing
10608 				 * of logical interfaces. Aliases with leading
10609 				 * zeroes are also rejected as they introduce
10610 				 * ambiguity in the naming of the interfaces.
10611 				 * Comparing with "0" takes care of all such
10612 				 * cases.
10613 				 */
10614 				if ((strncmp("0", cp+1, 1)) == 0)
10615 					return (EINVAL);
10616 
10617 				if (ddi_strtol(cp+1, &endp, 10, &id) != 0 ||
10618 				    id <= 0 || *endp != '\0') {
10619 					return (EINVAL);
10620 				}
10621 				*cp = '\0';
10622 				break;
10623 			}
10624 		}
10625 		ill = ill_lookup_on_name(name, B_FALSE, isv6,
10626 		    CONNP_TO_WQ(connp), mp, ip_process_ioctl, &err, NULL, ipst);
10627 		if (found_sep)
10628 			*cp = IPIF_SEPARATOR_CHAR;
10629 		if (ill == NULL)
10630 			return (err);
10631 	}
10632 
10633 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_process_ioctl, NEW_OP,
10634 	    B_TRUE);
10635 
10636 	/*
10637 	 * Release the refhold due to the lookup, now that we are excl
10638 	 * or we are just returning
10639 	 */
10640 	ill_refrele(ill);
10641 
10642 	if (ipsq == NULL)
10643 		return (EINPROGRESS);
10644 
10645 	/* We are now exclusive on the IPSQ */
10646 	ASSERT(IAM_WRITER_ILL(ill));
10647 
10648 	if (found_sep) {
10649 		/* Now see if there is an IPIF with this unit number. */
10650 		for (ipif = ill->ill_ipif; ipif != NULL;
10651 		    ipif = ipif->ipif_next) {
10652 			if (ipif->ipif_id == id) {
10653 				err = EEXIST;
10654 				goto done;
10655 			}
10656 		}
10657 	}
10658 
10659 	/*
10660 	 * We use IRE_LOCAL for lo0:1 etc. for "receive only" use
10661 	 * of lo0.  Plumbing for lo0:0 happens in ipif_lookup_on_name()
10662 	 * instead.
10663 	 */
10664 	if ((ipif = ipif_allocate(ill, found_sep ? id : -1, IRE_LOCAL,
10665 	    B_TRUE, B_TRUE)) == NULL) {
10666 		err = ENOBUFS;
10667 		goto done;
10668 	}
10669 
10670 	/* Return created name with ioctl */
10671 	(void) sprintf(lifr->lifr_name, "%s%c%d", ill->ill_name,
10672 	    IPIF_SEPARATOR_CHAR, ipif->ipif_id);
10673 	ip1dbg(("created %s\n", lifr->lifr_name));
10674 
10675 	/* Set address */
10676 	sin = (sin_t *)&lifr->lifr_addr;
10677 	if (sin->sin_family != AF_UNSPEC) {
10678 		err = ip_sioctl_addr(ipif, sin, q, mp,
10679 		    &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], lifr);
10680 	}
10681 
10682 done:
10683 	ipsq_exit(ipsq);
10684 	return (err);
10685 }
10686 
10687 /*
10688  * Remove an existing logical interface. If ipif_id is zero (i.e. not a logical
10689  * interface) delete it based on the IP address (on this physical interface).
10690  * Otherwise delete it based on the ipif_id.
10691  * Also, special handling to allow a removeif of lo0.
10692  */
10693 /* ARGSUSED */
10694 int
10695 ip_sioctl_removeif(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10696     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
10697 {
10698 	conn_t		*connp;
10699 	ill_t		*ill = ipif->ipif_ill;
10700 	boolean_t	 success;
10701 	ip_stack_t	*ipst;
10702 
10703 	ipst = CONNQ_TO_IPST(q);
10704 
10705 	ASSERT(q->q_next == NULL);
10706 	ip1dbg(("ip_sioctl_remove_if(%s:%u %p)\n",
10707 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10708 	ASSERT(IAM_WRITER_IPIF(ipif));
10709 
10710 	connp = Q_TO_CONN(q);
10711 	/*
10712 	 * Special case for unplumbing lo0 (the loopback physical interface).
10713 	 * If unplumbing lo0, the incoming address structure has been
10714 	 * initialized to all zeros. When unplumbing lo0, all its logical
10715 	 * interfaces must be removed too.
10716 	 *
10717 	 * Note that this interface may be called to remove a specific
10718 	 * loopback logical interface (eg, lo0:1). But in that case
10719 	 * ipif->ipif_id != 0 so that the code path for that case is the
10720 	 * same as any other interface (meaning it skips the code directly
10721 	 * below).
10722 	 */
10723 	if (ipif->ipif_id == 0 && ipif->ipif_net_type == IRE_LOOPBACK) {
10724 		if (sin->sin_family == AF_UNSPEC &&
10725 		    (IN6_IS_ADDR_UNSPECIFIED(&((sin6_t *)sin)->sin6_addr))) {
10726 			/*
10727 			 * Mark it condemned. No new ref. will be made to ill.
10728 			 */
10729 			mutex_enter(&ill->ill_lock);
10730 			ill->ill_state_flags |= ILL_CONDEMNED;
10731 			for (ipif = ill->ill_ipif; ipif != NULL;
10732 			    ipif = ipif->ipif_next) {
10733 				ipif->ipif_state_flags |= IPIF_CONDEMNED;
10734 			}
10735 			mutex_exit(&ill->ill_lock);
10736 
10737 			ipif = ill->ill_ipif;
10738 			/* unplumb the loopback interface */
10739 			ill_delete(ill);
10740 			mutex_enter(&connp->conn_lock);
10741 			mutex_enter(&ill->ill_lock);
10742 
10743 			/* Are any references to this ill active */
10744 			if (ill_is_freeable(ill)) {
10745 				mutex_exit(&ill->ill_lock);
10746 				mutex_exit(&connp->conn_lock);
10747 				ill_delete_tail(ill);
10748 				mi_free(ill);
10749 				return (0);
10750 			}
10751 			success = ipsq_pending_mp_add(connp, ipif,
10752 			    CONNP_TO_WQ(connp), mp, ILL_FREE);
10753 			mutex_exit(&connp->conn_lock);
10754 			mutex_exit(&ill->ill_lock);
10755 			if (success)
10756 				return (EINPROGRESS);
10757 			else
10758 				return (EINTR);
10759 		}
10760 	}
10761 
10762 	if (ipif->ipif_id == 0) {
10763 		ipsq_t *ipsq;
10764 
10765 		/* Find based on address */
10766 		if (ipif->ipif_isv6) {
10767 			sin6_t *sin6;
10768 
10769 			if (sin->sin_family != AF_INET6)
10770 				return (EAFNOSUPPORT);
10771 
10772 			sin6 = (sin6_t *)sin;
10773 			/* We are a writer, so we should be able to lookup */
10774 			ipif = ipif_lookup_addr_exact_v6(&sin6->sin6_addr, ill,
10775 			    ipst);
10776 		} else {
10777 			if (sin->sin_family != AF_INET)
10778 				return (EAFNOSUPPORT);
10779 
10780 			/* We are a writer, so we should be able to lookup */
10781 			ipif = ipif_lookup_addr_exact(sin->sin_addr.s_addr, ill,
10782 			    ipst);
10783 		}
10784 		if (ipif == NULL) {
10785 			return (EADDRNOTAVAIL);
10786 		}
10787 
10788 		/*
10789 		 * It is possible for a user to send an SIOCLIFREMOVEIF with
10790 		 * lifr_name of the physical interface but with an ip address
10791 		 * lifr_addr of a logical interface plumbed over it.
10792 		 * So update ipx_current_ipif now that ipif points to the
10793 		 * correct one.
10794 		 */
10795 		ipsq = ipif->ipif_ill->ill_phyint->phyint_ipsq;
10796 		ipsq->ipsq_xop->ipx_current_ipif = ipif;
10797 
10798 		/* This is a writer */
10799 		ipif_refrele(ipif);
10800 	}
10801 
10802 	/*
10803 	 * Can not delete instance zero since it is tied to the ill.
10804 	 */
10805 	if (ipif->ipif_id == 0)
10806 		return (EBUSY);
10807 
10808 	mutex_enter(&ill->ill_lock);
10809 	ipif->ipif_state_flags |= IPIF_CONDEMNED;
10810 	mutex_exit(&ill->ill_lock);
10811 
10812 	ipif_free(ipif);
10813 
10814 	mutex_enter(&connp->conn_lock);
10815 	mutex_enter(&ill->ill_lock);
10816 
10817 	/* Are any references to this ipif active */
10818 	if (ipif_is_freeable(ipif)) {
10819 		mutex_exit(&ill->ill_lock);
10820 		mutex_exit(&connp->conn_lock);
10821 		ipif_non_duplicate(ipif);
10822 		ipif_down_tail(ipif);
10823 		ipif_free_tail(ipif); /* frees ipif */
10824 		return (0);
10825 	}
10826 	success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp), mp,
10827 	    IPIF_FREE);
10828 	mutex_exit(&ill->ill_lock);
10829 	mutex_exit(&connp->conn_lock);
10830 	if (success)
10831 		return (EINPROGRESS);
10832 	else
10833 		return (EINTR);
10834 }
10835 
10836 /*
10837  * Restart the removeif ioctl. The refcnt has gone down to 0.
10838  * The ipif is already condemned. So can't find it thru lookups.
10839  */
10840 /* ARGSUSED */
10841 int
10842 ip_sioctl_removeif_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
10843     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_if_req)
10844 {
10845 	ill_t *ill = ipif->ipif_ill;
10846 
10847 	ASSERT(IAM_WRITER_IPIF(ipif));
10848 	ASSERT(ipif->ipif_state_flags & IPIF_CONDEMNED);
10849 
10850 	ip1dbg(("ip_sioctl_removeif_restart(%s:%u %p)\n",
10851 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
10852 
10853 	if (ipif->ipif_id == 0 && ipif->ipif_net_type == IRE_LOOPBACK) {
10854 		ASSERT(ill->ill_state_flags & ILL_CONDEMNED);
10855 		ill_delete_tail(ill);
10856 		mi_free(ill);
10857 		return (0);
10858 	}
10859 
10860 	ipif_non_duplicate(ipif);
10861 	ipif_down_tail(ipif);
10862 	ipif_free_tail(ipif);
10863 
10864 	ILL_UNMARK_CHANGING(ill);
10865 	return (0);
10866 }
10867 
10868 /*
10869  * Set the local interface address.
10870  * Allow an address of all zero when the interface is down.
10871  */
10872 /* ARGSUSED */
10873 int
10874 ip_sioctl_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10875     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
10876 {
10877 	int err = 0;
10878 	in6_addr_t v6addr;
10879 	boolean_t need_up = B_FALSE;
10880 
10881 	ip1dbg(("ip_sioctl_addr(%s:%u %p)\n",
10882 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10883 
10884 	ASSERT(IAM_WRITER_IPIF(ipif));
10885 
10886 	if (ipif->ipif_isv6) {
10887 		sin6_t *sin6;
10888 		ill_t *ill;
10889 		phyint_t *phyi;
10890 
10891 		if (sin->sin_family != AF_INET6)
10892 			return (EAFNOSUPPORT);
10893 
10894 		sin6 = (sin6_t *)sin;
10895 		v6addr = sin6->sin6_addr;
10896 		ill = ipif->ipif_ill;
10897 		phyi = ill->ill_phyint;
10898 
10899 		/*
10900 		 * Enforce that true multicast interfaces have a link-local
10901 		 * address for logical unit 0.
10902 		 */
10903 		if (ipif->ipif_id == 0 &&
10904 		    (ill->ill_flags & ILLF_MULTICAST) &&
10905 		    !(ipif->ipif_flags & (IPIF_POINTOPOINT)) &&
10906 		    !(phyi->phyint_flags & (PHYI_LOOPBACK)) &&
10907 		    !IN6_IS_ADDR_LINKLOCAL(&v6addr)) {
10908 			return (EADDRNOTAVAIL);
10909 		}
10910 
10911 		/*
10912 		 * up interfaces shouldn't have the unspecified address
10913 		 * unless they also have the IPIF_NOLOCAL flags set and
10914 		 * have a subnet assigned.
10915 		 */
10916 		if ((ipif->ipif_flags & IPIF_UP) &&
10917 		    IN6_IS_ADDR_UNSPECIFIED(&v6addr) &&
10918 		    (!(ipif->ipif_flags & IPIF_NOLOCAL) ||
10919 		    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) {
10920 			return (EADDRNOTAVAIL);
10921 		}
10922 
10923 		if (!ip_local_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
10924 			return (EADDRNOTAVAIL);
10925 	} else {
10926 		ipaddr_t addr;
10927 
10928 		if (sin->sin_family != AF_INET)
10929 			return (EAFNOSUPPORT);
10930 
10931 		addr = sin->sin_addr.s_addr;
10932 
10933 		/* Allow 0 as the local address. */
10934 		if (addr != 0 && !ip_addr_ok_v4(addr, ipif->ipif_net_mask))
10935 			return (EADDRNOTAVAIL);
10936 
10937 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10938 	}
10939 
10940 	/*
10941 	 * Even if there is no change we redo things just to rerun
10942 	 * ipif_set_default.
10943 	 */
10944 	if (ipif->ipif_flags & IPIF_UP) {
10945 		/*
10946 		 * Setting a new local address, make sure
10947 		 * we have net and subnet bcast ire's for
10948 		 * the old address if we need them.
10949 		 */
10950 		if (!ipif->ipif_isv6)
10951 			ipif_check_bcast_ires(ipif);
10952 		/*
10953 		 * If the interface is already marked up,
10954 		 * we call ipif_down which will take care
10955 		 * of ditching any IREs that have been set
10956 		 * up based on the old interface address.
10957 		 */
10958 		err = ipif_logical_down(ipif, q, mp);
10959 		if (err == EINPROGRESS)
10960 			return (err);
10961 		ipif_down_tail(ipif);
10962 		need_up = 1;
10963 	}
10964 
10965 	err = ip_sioctl_addr_tail(ipif, sin, q, mp, need_up);
10966 	return (err);
10967 }
10968 
10969 int
10970 ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10971     boolean_t need_up)
10972 {
10973 	in6_addr_t v6addr;
10974 	in6_addr_t ov6addr;
10975 	ipaddr_t addr;
10976 	sin6_t	*sin6;
10977 	int	sinlen;
10978 	int	err = 0;
10979 	ill_t	*ill = ipif->ipif_ill;
10980 	boolean_t need_dl_down;
10981 	boolean_t need_arp_down;
10982 	struct iocblk *iocp;
10983 
10984 	iocp = (mp != NULL) ? (struct iocblk *)mp->b_rptr : NULL;
10985 
10986 	ip1dbg(("ip_sioctl_addr_tail(%s:%u %p)\n",
10987 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
10988 	ASSERT(IAM_WRITER_IPIF(ipif));
10989 
10990 	/* Must cancel any pending timer before taking the ill_lock */
10991 	if (ipif->ipif_recovery_id != 0)
10992 		(void) untimeout(ipif->ipif_recovery_id);
10993 	ipif->ipif_recovery_id = 0;
10994 
10995 	if (ipif->ipif_isv6) {
10996 		sin6 = (sin6_t *)sin;
10997 		v6addr = sin6->sin6_addr;
10998 		sinlen = sizeof (struct sockaddr_in6);
10999 	} else {
11000 		addr = sin->sin_addr.s_addr;
11001 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11002 		sinlen = sizeof (struct sockaddr_in);
11003 	}
11004 	mutex_enter(&ill->ill_lock);
11005 	ov6addr = ipif->ipif_v6lcl_addr;
11006 	ipif->ipif_v6lcl_addr = v6addr;
11007 	sctp_update_ipif_addr(ipif, ov6addr);
11008 	if (ipif->ipif_flags & (IPIF_ANYCAST | IPIF_NOLOCAL)) {
11009 		ipif->ipif_v6src_addr = ipv6_all_zeros;
11010 	} else {
11011 		ipif->ipif_v6src_addr = v6addr;
11012 	}
11013 	ipif->ipif_addr_ready = 0;
11014 
11015 	/*
11016 	 * If the interface was previously marked as a duplicate, then since
11017 	 * we've now got a "new" address, it should no longer be considered a
11018 	 * duplicate -- even if the "new" address is the same as the old one.
11019 	 * Note that if all ipifs are down, we may have a pending ARP down
11020 	 * event to handle.  This is because we want to recover from duplicates
11021 	 * and thus delay tearing down ARP until the duplicates have been
11022 	 * removed or disabled.
11023 	 */
11024 	need_dl_down = need_arp_down = B_FALSE;
11025 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
11026 		need_arp_down = !need_up;
11027 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
11028 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
11029 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
11030 			need_dl_down = B_TRUE;
11031 		}
11032 	}
11033 
11034 	if (ipif->ipif_isv6 && IN6_IS_ADDR_6TO4(&v6addr) &&
11035 	    !ill->ill_is_6to4tun) {
11036 		queue_t *wqp = ill->ill_wq;
11037 
11038 		/*
11039 		 * The local address of this interface is a 6to4 address,
11040 		 * check if this interface is in fact a 6to4 tunnel or just
11041 		 * an interface configured with a 6to4 address.  We are only
11042 		 * interested in the former.
11043 		 */
11044 		if (wqp != NULL) {
11045 			while ((wqp->q_next != NULL) &&
11046 			    (wqp->q_next->q_qinfo != NULL) &&
11047 			    (wqp->q_next->q_qinfo->qi_minfo != NULL)) {
11048 
11049 				if (wqp->q_next->q_qinfo->qi_minfo->mi_idnum
11050 				    == TUN6TO4_MODID) {
11051 					/* set for use in IP */
11052 					ill->ill_is_6to4tun = 1;
11053 					break;
11054 				}
11055 				wqp = wqp->q_next;
11056 			}
11057 		}
11058 	}
11059 
11060 	ipif_set_default(ipif);
11061 
11062 	/*
11063 	 * When publishing an interface address change event, we only notify
11064 	 * the event listeners of the new address.  It is assumed that if they
11065 	 * actively care about the addresses assigned that they will have
11066 	 * already discovered the previous address assigned (if there was one.)
11067 	 *
11068 	 * Don't attach nic event message for SIOCLIFADDIF ioctl.
11069 	 */
11070 	if (iocp != NULL && iocp->ioc_cmd != SIOCLIFADDIF) {
11071 		ill_nic_event_dispatch(ill, MAP_IPIF_ID(ipif->ipif_id),
11072 		    NE_ADDRESS_CHANGE, sin, sinlen);
11073 	}
11074 
11075 	mutex_exit(&ill->ill_lock);
11076 
11077 	if (need_up) {
11078 		/*
11079 		 * Now bring the interface back up.  If this
11080 		 * is the only IPIF for the ILL, ipif_up
11081 		 * will have to re-bind to the device, so
11082 		 * we may get back EINPROGRESS, in which
11083 		 * case, this IOCTL will get completed in
11084 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11085 		 */
11086 		err = ipif_up(ipif, q, mp);
11087 	}
11088 
11089 	if (need_dl_down)
11090 		ill_dl_down(ill);
11091 	if (need_arp_down)
11092 		ipif_resolver_down(ipif);
11093 
11094 	return (err);
11095 }
11096 
11097 /*
11098  * Restart entry point to restart the address set operation after the
11099  * refcounts have dropped to zero.
11100  */
11101 /* ARGSUSED */
11102 int
11103 ip_sioctl_addr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11104     ip_ioctl_cmd_t *ipip, void *ifreq)
11105 {
11106 	ip1dbg(("ip_sioctl_addr_restart(%s:%u %p)\n",
11107 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11108 	ASSERT(IAM_WRITER_IPIF(ipif));
11109 	ipif_down_tail(ipif);
11110 	return (ip_sioctl_addr_tail(ipif, sin, q, mp, B_TRUE));
11111 }
11112 
11113 /* ARGSUSED */
11114 int
11115 ip_sioctl_get_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11116     ip_ioctl_cmd_t *ipip, void *if_req)
11117 {
11118 	sin6_t *sin6 = (struct sockaddr_in6 *)sin;
11119 	struct lifreq *lifr = (struct lifreq *)if_req;
11120 
11121 	ip1dbg(("ip_sioctl_get_addr(%s:%u %p)\n",
11122 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11123 	/*
11124 	 * The net mask and address can't change since we have a
11125 	 * reference to the ipif. So no lock is necessary.
11126 	 */
11127 	if (ipif->ipif_isv6) {
11128 		*sin6 = sin6_null;
11129 		sin6->sin6_family = AF_INET6;
11130 		sin6->sin6_addr = ipif->ipif_v6lcl_addr;
11131 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11132 		lifr->lifr_addrlen =
11133 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
11134 	} else {
11135 		*sin = sin_null;
11136 		sin->sin_family = AF_INET;
11137 		sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
11138 		if (ipip->ipi_cmd_type == LIF_CMD) {
11139 			lifr->lifr_addrlen =
11140 			    ip_mask_to_plen(ipif->ipif_net_mask);
11141 		}
11142 	}
11143 	return (0);
11144 }
11145 
11146 /*
11147  * Set the destination address for a pt-pt interface.
11148  */
11149 /* ARGSUSED */
11150 int
11151 ip_sioctl_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11152     ip_ioctl_cmd_t *ipip, void *if_req)
11153 {
11154 	int err = 0;
11155 	in6_addr_t v6addr;
11156 	boolean_t need_up = B_FALSE;
11157 
11158 	ip1dbg(("ip_sioctl_dstaddr(%s:%u %p)\n",
11159 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11160 	ASSERT(IAM_WRITER_IPIF(ipif));
11161 
11162 	if (ipif->ipif_isv6) {
11163 		sin6_t *sin6;
11164 
11165 		if (sin->sin_family != AF_INET6)
11166 			return (EAFNOSUPPORT);
11167 
11168 		sin6 = (sin6_t *)sin;
11169 		v6addr = sin6->sin6_addr;
11170 
11171 		if (!ip_remote_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
11172 			return (EADDRNOTAVAIL);
11173 	} else {
11174 		ipaddr_t addr;
11175 
11176 		if (sin->sin_family != AF_INET)
11177 			return (EAFNOSUPPORT);
11178 
11179 		addr = sin->sin_addr.s_addr;
11180 		if (!ip_addr_ok_v4(addr, ipif->ipif_net_mask))
11181 			return (EADDRNOTAVAIL);
11182 
11183 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11184 	}
11185 
11186 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, &v6addr))
11187 		return (0);	/* No change */
11188 
11189 	if (ipif->ipif_flags & IPIF_UP) {
11190 		/*
11191 		 * If the interface is already marked up,
11192 		 * we call ipif_down which will take care
11193 		 * of ditching any IREs that have been set
11194 		 * up based on the old pp dst address.
11195 		 */
11196 		err = ipif_logical_down(ipif, q, mp);
11197 		if (err == EINPROGRESS)
11198 			return (err);
11199 		ipif_down_tail(ipif);
11200 		need_up = B_TRUE;
11201 	}
11202 	/*
11203 	 * could return EINPROGRESS. If so ioctl will complete in
11204 	 * ip_rput_dlpi_writer
11205 	 */
11206 	err = ip_sioctl_dstaddr_tail(ipif, sin, q, mp, need_up);
11207 	return (err);
11208 }
11209 
11210 static int
11211 ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11212     boolean_t need_up)
11213 {
11214 	in6_addr_t v6addr;
11215 	ill_t	*ill = ipif->ipif_ill;
11216 	int	err = 0;
11217 	boolean_t need_dl_down;
11218 	boolean_t need_arp_down;
11219 
11220 	ip1dbg(("ip_sioctl_dstaddr_tail(%s:%u %p)\n", ill->ill_name,
11221 	    ipif->ipif_id, (void *)ipif));
11222 
11223 	/* Must cancel any pending timer before taking the ill_lock */
11224 	if (ipif->ipif_recovery_id != 0)
11225 		(void) untimeout(ipif->ipif_recovery_id);
11226 	ipif->ipif_recovery_id = 0;
11227 
11228 	if (ipif->ipif_isv6) {
11229 		sin6_t *sin6;
11230 
11231 		sin6 = (sin6_t *)sin;
11232 		v6addr = sin6->sin6_addr;
11233 	} else {
11234 		ipaddr_t addr;
11235 
11236 		addr = sin->sin_addr.s_addr;
11237 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11238 	}
11239 	mutex_enter(&ill->ill_lock);
11240 	/* Set point to point destination address. */
11241 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11242 		/*
11243 		 * Allow this as a means of creating logical
11244 		 * pt-pt interfaces on top of e.g. an Ethernet.
11245 		 * XXX Undocumented HACK for testing.
11246 		 * pt-pt interfaces are created with NUD disabled.
11247 		 */
11248 		ipif->ipif_flags |= IPIF_POINTOPOINT;
11249 		ipif->ipif_flags &= ~IPIF_BROADCAST;
11250 		if (ipif->ipif_isv6)
11251 			ill->ill_flags |= ILLF_NONUD;
11252 	}
11253 
11254 	/*
11255 	 * If the interface was previously marked as a duplicate, then since
11256 	 * we've now got a "new" address, it should no longer be considered a
11257 	 * duplicate -- even if the "new" address is the same as the old one.
11258 	 * Note that if all ipifs are down, we may have a pending ARP down
11259 	 * event to handle.
11260 	 */
11261 	need_dl_down = need_arp_down = B_FALSE;
11262 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
11263 		need_arp_down = !need_up;
11264 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
11265 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
11266 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
11267 			need_dl_down = B_TRUE;
11268 		}
11269 	}
11270 
11271 	/* Set the new address. */
11272 	ipif->ipif_v6pp_dst_addr = v6addr;
11273 	/* Make sure subnet tracks pp_dst */
11274 	ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
11275 	mutex_exit(&ill->ill_lock);
11276 
11277 	if (need_up) {
11278 		/*
11279 		 * Now bring the interface back up.  If this
11280 		 * is the only IPIF for the ILL, ipif_up
11281 		 * will have to re-bind to the device, so
11282 		 * we may get back EINPROGRESS, in which
11283 		 * case, this IOCTL will get completed in
11284 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11285 		 */
11286 		err = ipif_up(ipif, q, mp);
11287 	}
11288 
11289 	if (need_dl_down)
11290 		ill_dl_down(ill);
11291 	if (need_arp_down)
11292 		ipif_resolver_down(ipif);
11293 
11294 	return (err);
11295 }
11296 
11297 /*
11298  * Restart entry point to restart the dstaddress set operation after the
11299  * refcounts have dropped to zero.
11300  */
11301 /* ARGSUSED */
11302 int
11303 ip_sioctl_dstaddr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11304     ip_ioctl_cmd_t *ipip, void *ifreq)
11305 {
11306 	ip1dbg(("ip_sioctl_dstaddr_restart(%s:%u %p)\n",
11307 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11308 	ipif_down_tail(ipif);
11309 	return (ip_sioctl_dstaddr_tail(ipif, sin, q, mp, B_TRUE));
11310 }
11311 
11312 /* ARGSUSED */
11313 int
11314 ip_sioctl_get_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11315     ip_ioctl_cmd_t *ipip, void *if_req)
11316 {
11317 	sin6_t	*sin6 = (struct sockaddr_in6 *)sin;
11318 
11319 	ip1dbg(("ip_sioctl_get_dstaddr(%s:%u %p)\n",
11320 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11321 	/*
11322 	 * Get point to point destination address. The addresses can't
11323 	 * change since we hold a reference to the ipif.
11324 	 */
11325 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0)
11326 		return (EADDRNOTAVAIL);
11327 
11328 	if (ipif->ipif_isv6) {
11329 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11330 		*sin6 = sin6_null;
11331 		sin6->sin6_family = AF_INET6;
11332 		sin6->sin6_addr = ipif->ipif_v6pp_dst_addr;
11333 	} else {
11334 		*sin = sin_null;
11335 		sin->sin_family = AF_INET;
11336 		sin->sin_addr.s_addr = ipif->ipif_pp_dst_addr;
11337 	}
11338 	return (0);
11339 }
11340 
11341 /*
11342  * Set interface flags.  Many flags require special handling (e.g.,
11343  * bringing the interface down); see below for details.
11344  *
11345  * NOTE : We really don't enforce that ipif_id zero should be used
11346  *	  for setting any flags other than IFF_LOGINT_FLAGS. This
11347  *	  is because applications generally does SICGLIFFLAGS and
11348  *	  ORs in the new flags (that affects the logical) and does a
11349  *	  SIOCSLIFFLAGS. Thus, "flags" below could contain bits other
11350  *	  than IFF_LOGINT_FLAGS. One could check whether "turn_on" - the
11351  *	  flags that will be turned on is correct with respect to
11352  *	  ipif_id 0. For backward compatibility reasons, it is not done.
11353  */
11354 /* ARGSUSED */
11355 int
11356 ip_sioctl_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11357     ip_ioctl_cmd_t *ipip, void *if_req)
11358 {
11359 	uint64_t turn_on;
11360 	uint64_t turn_off;
11361 	int	err = 0;
11362 	phyint_t *phyi;
11363 	ill_t *ill;
11364 	uint64_t intf_flags, cantchange_flags;
11365 	boolean_t phyint_flags_modified = B_FALSE;
11366 	uint64_t flags;
11367 	struct ifreq *ifr;
11368 	struct lifreq *lifr;
11369 	boolean_t set_linklocal = B_FALSE;
11370 	boolean_t zero_source = B_FALSE;
11371 
11372 	ip1dbg(("ip_sioctl_flags(%s:%u %p)\n",
11373 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11374 
11375 	ASSERT(IAM_WRITER_IPIF(ipif));
11376 
11377 	ill = ipif->ipif_ill;
11378 	phyi = ill->ill_phyint;
11379 
11380 	if (ipip->ipi_cmd_type == IF_CMD) {
11381 		ifr = (struct ifreq *)if_req;
11382 		flags = (uint64_t)(ifr->ifr_flags & 0x0000ffff);
11383 	} else {
11384 		lifr = (struct lifreq *)if_req;
11385 		flags = lifr->lifr_flags;
11386 	}
11387 
11388 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
11389 
11390 	/*
11391 	 * Have the flags been set correctly until now?
11392 	 */
11393 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
11394 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
11395 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
11396 	/*
11397 	 * Compare the new flags to the old, and partition
11398 	 * into those coming on and those going off.
11399 	 * For the 16 bit command keep the bits above bit 16 unchanged.
11400 	 */
11401 	if (ipip->ipi_cmd == SIOCSIFFLAGS)
11402 		flags |= intf_flags & ~0xFFFF;
11403 
11404 	/*
11405 	 * Explicitly fail attempts to change flags that are always invalid on
11406 	 * an IPMP meta-interface.
11407 	 */
11408 	if (IS_IPMP(ill) && ((flags ^ intf_flags) & IFF_IPMP_INVALID))
11409 		return (EINVAL);
11410 
11411 	/*
11412 	 * Check which flags will change; silently ignore flags which userland
11413 	 * is not allowed to control.  (Because these flags may change between
11414 	 * SIOCGLIFFLAGS and SIOCSLIFFLAGS, and that's outside of userland's
11415 	 * control, we need to silently ignore them rather than fail.)
11416 	 */
11417 	cantchange_flags = IFF_CANTCHANGE;
11418 	if (IS_IPMP(ill))
11419 		cantchange_flags |= IFF_IPMP_CANTCHANGE;
11420 
11421 	turn_on = (flags ^ intf_flags) & ~cantchange_flags;
11422 	if (turn_on == 0)
11423 		return (0);	/* No change */
11424 
11425 	turn_off = intf_flags & turn_on;
11426 	turn_on ^= turn_off;
11427 
11428 	/*
11429 	 * All test addresses must be IFF_DEPRECATED (to ensure source address
11430 	 * selection avoids them) -- so force IFF_DEPRECATED on, and do not
11431 	 * allow it to be turned off.
11432 	 */
11433 	if ((turn_off & (IFF_DEPRECATED|IFF_NOFAILOVER)) == IFF_DEPRECATED &&
11434 	    (turn_on|intf_flags) & IFF_NOFAILOVER)
11435 		return (EINVAL);
11436 
11437 	if (turn_on & IFF_NOFAILOVER) {
11438 		turn_on |= IFF_DEPRECATED;
11439 		flags |= IFF_DEPRECATED;
11440 	}
11441 
11442 	/*
11443 	 * On underlying interfaces, only allow applications to manage test
11444 	 * addresses -- otherwise, they may get confused when the address
11445 	 * moves as part of being brought up.  Likewise, prevent an
11446 	 * application-managed test address from being converted to a data
11447 	 * address.  To prevent migration of administratively up addresses in
11448 	 * the kernel, we don't allow them to be converted either.
11449 	 */
11450 	if (IS_UNDER_IPMP(ill)) {
11451 		const uint64_t appflags = IFF_DHCPRUNNING | IFF_ADDRCONF;
11452 
11453 		if ((turn_on & appflags) && !(flags & IFF_NOFAILOVER))
11454 			return (EINVAL);
11455 
11456 		if ((turn_off & IFF_NOFAILOVER) &&
11457 		    (flags & (appflags | IFF_UP | IFF_DUPLICATE)))
11458 			return (EINVAL);
11459 	}
11460 
11461 	/*
11462 	 * Only allow the IFF_XRESOLV and IFF_TEMPORARY flags to be set on
11463 	 * IPv6 interfaces.
11464 	 */
11465 	if ((turn_on & (IFF_XRESOLV|IFF_TEMPORARY)) && !(ipif->ipif_isv6))
11466 		return (EINVAL);
11467 
11468 	/*
11469 	 * cannot turn off IFF_NOXMIT on  VNI interfaces.
11470 	 */
11471 	if ((turn_off & IFF_NOXMIT) && IS_VNI(ipif->ipif_ill))
11472 		return (EINVAL);
11473 
11474 	/*
11475 	 * Don't allow the IFF_ROUTER flag to be turned on on loopback
11476 	 * interfaces.  It makes no sense in that context.
11477 	 */
11478 	if ((turn_on & IFF_ROUTER) && (phyi->phyint_flags & PHYI_LOOPBACK))
11479 		return (EINVAL);
11480 
11481 	if (flags & (IFF_NOLOCAL|IFF_ANYCAST))
11482 		zero_source = B_TRUE;
11483 
11484 	/*
11485 	 * For IPv6 ipif_id 0, don't allow the interface to be up without
11486 	 * a link local address if IFF_NOLOCAL or IFF_ANYCAST are not set.
11487 	 * If the link local address isn't set, and can be set, it will get
11488 	 * set later on in this function.
11489 	 */
11490 	if (ipif->ipif_id == 0 && ipif->ipif_isv6 &&
11491 	    (flags & IFF_UP) && !zero_source &&
11492 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
11493 		if (ipif_cant_setlinklocal(ipif))
11494 			return (EINVAL);
11495 		set_linklocal = B_TRUE;
11496 	}
11497 
11498 	/*
11499 	 * If we modify physical interface flags, we'll potentially need to
11500 	 * send up two routing socket messages for the changes (one for the
11501 	 * IPv4 ill, and another for the IPv6 ill).  Note that here.
11502 	 */
11503 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
11504 		phyint_flags_modified = B_TRUE;
11505 
11506 	/*
11507 	 * All functioning PHYI_STANDBY interfaces start life PHYI_INACTIVE
11508 	 * (otherwise, we'd immediately use them, defeating standby).  Also,
11509 	 * since PHYI_INACTIVE has a separate meaning when PHYI_STANDBY is not
11510 	 * set, don't allow PHYI_STANDBY to be set if PHYI_INACTIVE is already
11511 	 * set, and clear PHYI_INACTIVE if PHYI_STANDBY is being cleared.  We
11512 	 * also don't allow PHYI_STANDBY if VNI is enabled since its semantics
11513 	 * will not be honored.
11514 	 */
11515 	if (turn_on & PHYI_STANDBY) {
11516 		/*
11517 		 * No need to grab ill_g_usesrc_lock here; see the
11518 		 * synchronization notes in ip.c.
11519 		 */
11520 		if (ill->ill_usesrc_grp_next != NULL ||
11521 		    intf_flags & PHYI_INACTIVE)
11522 			return (EINVAL);
11523 		if (!(flags & PHYI_FAILED)) {
11524 			flags |= PHYI_INACTIVE;
11525 			turn_on |= PHYI_INACTIVE;
11526 		}
11527 	}
11528 
11529 	if (turn_off & PHYI_STANDBY) {
11530 		flags &= ~PHYI_INACTIVE;
11531 		turn_off |= PHYI_INACTIVE;
11532 	}
11533 
11534 	/*
11535 	 * PHYI_FAILED and PHYI_INACTIVE are mutually exclusive; fail if both
11536 	 * would end up on.
11537 	 */
11538 	if ((flags & (PHYI_FAILED | PHYI_INACTIVE)) ==
11539 	    (PHYI_FAILED | PHYI_INACTIVE))
11540 		return (EINVAL);
11541 
11542 	/*
11543 	 * If ILLF_ROUTER changes, we need to change the ip forwarding
11544 	 * status of the interface.
11545 	 */
11546 	if ((turn_on | turn_off) & ILLF_ROUTER)
11547 		(void) ill_forward_set(ill, ((turn_on & ILLF_ROUTER) != 0));
11548 
11549 	/*
11550 	 * If the interface is not UP and we are not going to
11551 	 * bring it UP, record the flags and return. When the
11552 	 * interface comes UP later, the right actions will be
11553 	 * taken.
11554 	 */
11555 	if (!(ipif->ipif_flags & IPIF_UP) &&
11556 	    !(turn_on & IPIF_UP)) {
11557 		/* Record new flags in their respective places. */
11558 		mutex_enter(&ill->ill_lock);
11559 		mutex_enter(&ill->ill_phyint->phyint_lock);
11560 		ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
11561 		ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
11562 		ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
11563 		ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
11564 		phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
11565 		phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
11566 		mutex_exit(&ill->ill_lock);
11567 		mutex_exit(&ill->ill_phyint->phyint_lock);
11568 
11569 		/*
11570 		 * PHYI_FAILED, PHYI_INACTIVE, and PHYI_OFFLINE are all the
11571 		 * same to the kernel: if any of them has been set by
11572 		 * userland, the interface cannot be used for data traffic.
11573 		 */
11574 		if ((turn_on|turn_off) &
11575 		    (PHYI_FAILED | PHYI_INACTIVE | PHYI_OFFLINE)) {
11576 			ASSERT(!IS_IPMP(ill));
11577 			/*
11578 			 * It's possible the ill is part of an "anonymous"
11579 			 * IPMP group rather than a real group.  In that case,
11580 			 * there are no other interfaces in the group and thus
11581 			 * no need to call ipmp_phyint_refresh_active().
11582 			 */
11583 			if (IS_UNDER_IPMP(ill))
11584 				ipmp_phyint_refresh_active(phyi);
11585 		}
11586 
11587 		if (phyint_flags_modified) {
11588 			if (phyi->phyint_illv4 != NULL) {
11589 				ip_rts_ifmsg(phyi->phyint_illv4->
11590 				    ill_ipif, RTSQ_DEFAULT);
11591 			}
11592 			if (phyi->phyint_illv6 != NULL) {
11593 				ip_rts_ifmsg(phyi->phyint_illv6->
11594 				    ill_ipif, RTSQ_DEFAULT);
11595 			}
11596 		}
11597 		return (0);
11598 	} else if (set_linklocal || zero_source) {
11599 		mutex_enter(&ill->ill_lock);
11600 		if (set_linklocal)
11601 			ipif->ipif_state_flags |= IPIF_SET_LINKLOCAL;
11602 		if (zero_source)
11603 			ipif->ipif_state_flags |= IPIF_ZERO_SOURCE;
11604 		mutex_exit(&ill->ill_lock);
11605 	}
11606 
11607 	/*
11608 	 * Disallow IPv6 interfaces coming up that have the unspecified address,
11609 	 * or point-to-point interfaces with an unspecified destination. We do
11610 	 * allow the address to be unspecified for IPIF_NOLOCAL interfaces that
11611 	 * have a subnet assigned, which is how in.ndpd currently manages its
11612 	 * onlink prefix list when no addresses are configured with those
11613 	 * prefixes.
11614 	 */
11615 	if (ipif->ipif_isv6 &&
11616 	    ((IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
11617 	    (!(ipif->ipif_flags & IPIF_NOLOCAL) && !(turn_on & IPIF_NOLOCAL) ||
11618 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) ||
11619 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
11620 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)))) {
11621 		return (EINVAL);
11622 	}
11623 
11624 	/*
11625 	 * Prevent IPv4 point-to-point interfaces with a 0.0.0.0 destination
11626 	 * from being brought up.
11627 	 */
11628 	if (!ipif->ipif_isv6 &&
11629 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
11630 	    ipif->ipif_pp_dst_addr == INADDR_ANY)) {
11631 		return (EINVAL);
11632 	}
11633 
11634 	/*
11635 	 * The only flag changes that we currently take specific action on are
11636 	 * IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT, IPIF_NOLOCAL, ILLF_NOARP,
11637 	 * ILLF_NONUD, IPIF_PRIVATE, IPIF_ANYCAST, IPIF_PREFERRED, and
11638 	 * IPIF_NOFAILOVER.  This is done by bring the ipif down, changing the
11639 	 * flags and bringing it back up again.  For IPIF_NOFAILOVER, the act
11640 	 * of bringing it back up will trigger the address to be moved.
11641 	 */
11642 	if ((turn_on|turn_off) &
11643 	    (IPIF_UP|IPIF_DEPRECATED|IPIF_NOXMIT|IPIF_NOLOCAL|ILLF_NOARP|
11644 	    ILLF_NONUD|IPIF_PRIVATE|IPIF_ANYCAST|IPIF_PREFERRED|
11645 	    IPIF_NOFAILOVER)) {
11646 		/*
11647 		 * Taking this ipif down, make sure we have
11648 		 * valid net and subnet bcast ire's for other
11649 		 * logical interfaces, if we need them.
11650 		 */
11651 		if (!ipif->ipif_isv6)
11652 			ipif_check_bcast_ires(ipif);
11653 
11654 		if (((ipif->ipif_flags | turn_on) & IPIF_UP) &&
11655 		    !(turn_off & IPIF_UP)) {
11656 			if (ipif->ipif_flags & IPIF_UP)
11657 				ill->ill_logical_down = 1;
11658 			turn_on &= ~IPIF_UP;
11659 		}
11660 		err = ipif_down(ipif, q, mp);
11661 		ip1dbg(("ipif_down returns %d err ", err));
11662 		if (err == EINPROGRESS)
11663 			return (err);
11664 		ipif_down_tail(ipif);
11665 	}
11666 	return (ip_sioctl_flags_tail(ipif, flags, q, mp));
11667 }
11668 
11669 static int
11670 ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q, mblk_t *mp)
11671 {
11672 	ill_t	*ill;
11673 	phyint_t *phyi;
11674 	uint64_t turn_on, turn_off;
11675 	uint64_t intf_flags, cantchange_flags;
11676 	boolean_t phyint_flags_modified = B_FALSE;
11677 	int	err = 0;
11678 	boolean_t set_linklocal = B_FALSE;
11679 	boolean_t zero_source = B_FALSE;
11680 
11681 	ip1dbg(("ip_sioctl_flags_tail(%s:%u)\n",
11682 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
11683 
11684 	ASSERT(IAM_WRITER_IPIF(ipif));
11685 
11686 	ill = ipif->ipif_ill;
11687 	phyi = ill->ill_phyint;
11688 
11689 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
11690 	cantchange_flags = IFF_CANTCHANGE | IFF_UP;
11691 	if (IS_IPMP(ill))
11692 		cantchange_flags |= IFF_IPMP_CANTCHANGE;
11693 
11694 	turn_on = (flags ^ intf_flags) & ~cantchange_flags;
11695 	turn_off = intf_flags & turn_on;
11696 	turn_on ^= turn_off;
11697 
11698 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
11699 		phyint_flags_modified = B_TRUE;
11700 
11701 	/*
11702 	 * Now we change the flags. Track current value of
11703 	 * other flags in their respective places.
11704 	 */
11705 	mutex_enter(&ill->ill_lock);
11706 	mutex_enter(&phyi->phyint_lock);
11707 	ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
11708 	ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
11709 	ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
11710 	ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
11711 	phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
11712 	phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
11713 	if (ipif->ipif_state_flags & IPIF_SET_LINKLOCAL) {
11714 		set_linklocal = B_TRUE;
11715 		ipif->ipif_state_flags &= ~IPIF_SET_LINKLOCAL;
11716 	}
11717 	if (ipif->ipif_state_flags & IPIF_ZERO_SOURCE) {
11718 		zero_source = B_TRUE;
11719 		ipif->ipif_state_flags &= ~IPIF_ZERO_SOURCE;
11720 	}
11721 	mutex_exit(&ill->ill_lock);
11722 	mutex_exit(&phyi->phyint_lock);
11723 
11724 	if (set_linklocal)
11725 		(void) ipif_setlinklocal(ipif);
11726 
11727 	if (zero_source)
11728 		ipif->ipif_v6src_addr = ipv6_all_zeros;
11729 	else
11730 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
11731 
11732 	/*
11733 	 * PHYI_FAILED, PHYI_INACTIVE, and PHYI_OFFLINE are all the same to
11734 	 * the kernel: if any of them has been set by userland, the interface
11735 	 * cannot be used for data traffic.
11736 	 */
11737 	if ((turn_on|turn_off) & (PHYI_FAILED | PHYI_INACTIVE | PHYI_OFFLINE)) {
11738 		ASSERT(!IS_IPMP(ill));
11739 		/*
11740 		 * It's possible the ill is part of an "anonymous" IPMP group
11741 		 * rather than a real group.  In that case, there are no other
11742 		 * interfaces in the group and thus no need for us to call
11743 		 * ipmp_phyint_refresh_active().
11744 		 */
11745 		if (IS_UNDER_IPMP(ill))
11746 			ipmp_phyint_refresh_active(phyi);
11747 	}
11748 
11749 	if ((flags & IFF_UP) && !(ipif->ipif_flags & IPIF_UP)) {
11750 		/*
11751 		 * XXX ipif_up really does not know whether a phyint flags
11752 		 * was modified or not. So, it sends up information on
11753 		 * only one routing sockets message. As we don't bring up
11754 		 * the interface and also set PHYI_ flags simultaneously
11755 		 * it should be okay.
11756 		 */
11757 		err = ipif_up(ipif, q, mp);
11758 	} else {
11759 		/*
11760 		 * Make sure routing socket sees all changes to the flags.
11761 		 * ipif_up_done* handles this when we use ipif_up.
11762 		 */
11763 		if (phyint_flags_modified) {
11764 			if (phyi->phyint_illv4 != NULL) {
11765 				ip_rts_ifmsg(phyi->phyint_illv4->
11766 				    ill_ipif, RTSQ_DEFAULT);
11767 			}
11768 			if (phyi->phyint_illv6 != NULL) {
11769 				ip_rts_ifmsg(phyi->phyint_illv6->
11770 				    ill_ipif, RTSQ_DEFAULT);
11771 			}
11772 		} else {
11773 			ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
11774 		}
11775 		/*
11776 		 * Update the flags in SCTP's IPIF list, ipif_up() will do
11777 		 * this in need_up case.
11778 		 */
11779 		sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
11780 	}
11781 	return (err);
11782 }
11783 
11784 /*
11785  * Restart the flags operation now that the refcounts have dropped to zero.
11786  */
11787 /* ARGSUSED */
11788 int
11789 ip_sioctl_flags_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11790     ip_ioctl_cmd_t *ipip, void *if_req)
11791 {
11792 	uint64_t flags;
11793 	struct ifreq *ifr = if_req;
11794 	struct lifreq *lifr = if_req;
11795 
11796 	ip1dbg(("ip_sioctl_flags_restart(%s:%u %p)\n",
11797 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11798 
11799 	ipif_down_tail(ipif);
11800 	if (ipip->ipi_cmd_type == IF_CMD) {
11801 		/* cast to uint16_t prevents unwanted sign extension */
11802 		flags = (uint16_t)ifr->ifr_flags;
11803 	} else {
11804 		flags = lifr->lifr_flags;
11805 	}
11806 	return (ip_sioctl_flags_tail(ipif, flags, q, mp));
11807 }
11808 
11809 /*
11810  * Can operate on either a module or a driver queue.
11811  */
11812 /* ARGSUSED */
11813 int
11814 ip_sioctl_get_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11815     ip_ioctl_cmd_t *ipip, void *if_req)
11816 {
11817 	/*
11818 	 * Has the flags been set correctly till now ?
11819 	 */
11820 	ill_t *ill = ipif->ipif_ill;
11821 	phyint_t *phyi = ill->ill_phyint;
11822 
11823 	ip1dbg(("ip_sioctl_get_flags(%s:%u %p)\n",
11824 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11825 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
11826 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
11827 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
11828 
11829 	/*
11830 	 * Need a lock since some flags can be set even when there are
11831 	 * references to the ipif.
11832 	 */
11833 	mutex_enter(&ill->ill_lock);
11834 	if (ipip->ipi_cmd_type == IF_CMD) {
11835 		struct ifreq *ifr = (struct ifreq *)if_req;
11836 
11837 		/* Get interface flags (low 16 only). */
11838 		ifr->ifr_flags = ((ipif->ipif_flags |
11839 		    ill->ill_flags | phyi->phyint_flags) & 0xffff);
11840 	} else {
11841 		struct lifreq *lifr = (struct lifreq *)if_req;
11842 
11843 		/* Get interface flags. */
11844 		lifr->lifr_flags = ipif->ipif_flags |
11845 		    ill->ill_flags | phyi->phyint_flags;
11846 	}
11847 	mutex_exit(&ill->ill_lock);
11848 	return (0);
11849 }
11850 
11851 /* ARGSUSED */
11852 int
11853 ip_sioctl_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11854     ip_ioctl_cmd_t *ipip, void *if_req)
11855 {
11856 	int mtu;
11857 	int ip_min_mtu;
11858 	struct ifreq	*ifr;
11859 	struct lifreq *lifr;
11860 	ire_t	*ire;
11861 	ip_stack_t *ipst;
11862 
11863 	ip1dbg(("ip_sioctl_mtu(%s:%u %p)\n", ipif->ipif_ill->ill_name,
11864 	    ipif->ipif_id, (void *)ipif));
11865 	if (ipip->ipi_cmd_type == IF_CMD) {
11866 		ifr = (struct ifreq *)if_req;
11867 		mtu = ifr->ifr_metric;
11868 	} else {
11869 		lifr = (struct lifreq *)if_req;
11870 		mtu = lifr->lifr_mtu;
11871 	}
11872 
11873 	if (ipif->ipif_isv6)
11874 		ip_min_mtu = IPV6_MIN_MTU;
11875 	else
11876 		ip_min_mtu = IP_MIN_MTU;
11877 
11878 	if (mtu > ipif->ipif_ill->ill_max_frag || mtu < ip_min_mtu)
11879 		return (EINVAL);
11880 
11881 	/*
11882 	 * Change the MTU size in all relevant ire's.
11883 	 * Mtu change Vs. new ire creation - protocol below.
11884 	 * First change ipif_mtu and the ire_max_frag of the
11885 	 * interface ire. Then do an ire walk and change the
11886 	 * ire_max_frag of all affected ires. During ire_add
11887 	 * under the bucket lock, set the ire_max_frag of the
11888 	 * new ire being created from the ipif/ire from which
11889 	 * it is being derived. If an mtu change happens after
11890 	 * the ire is added, the new ire will be cleaned up.
11891 	 * Conversely if the mtu change happens before the ire
11892 	 * is added, ire_add will see the new value of the mtu.
11893 	 */
11894 	ipif->ipif_mtu = mtu;
11895 	ipif->ipif_flags |= IPIF_FIXEDMTU;
11896 
11897 	if (ipif->ipif_isv6)
11898 		ire = ipif_to_ire_v6(ipif);
11899 	else
11900 		ire = ipif_to_ire(ipif);
11901 	if (ire != NULL) {
11902 		ire->ire_max_frag = ipif->ipif_mtu;
11903 		ire_refrele(ire);
11904 	}
11905 	ipst = ipif->ipif_ill->ill_ipst;
11906 	if (ipif->ipif_flags & IPIF_UP) {
11907 		if (ipif->ipif_isv6)
11908 			ire_walk_v6(ipif_mtu_change, (char *)ipif, ALL_ZONES,
11909 			    ipst);
11910 		else
11911 			ire_walk_v4(ipif_mtu_change, (char *)ipif, ALL_ZONES,
11912 			    ipst);
11913 	}
11914 	/* Update the MTU in SCTP's list */
11915 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
11916 	return (0);
11917 }
11918 
11919 /* Get interface MTU. */
11920 /* ARGSUSED */
11921 int
11922 ip_sioctl_get_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11923 	ip_ioctl_cmd_t *ipip, void *if_req)
11924 {
11925 	struct ifreq	*ifr;
11926 	struct lifreq	*lifr;
11927 
11928 	ip1dbg(("ip_sioctl_get_mtu(%s:%u %p)\n",
11929 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11930 	if (ipip->ipi_cmd_type == IF_CMD) {
11931 		ifr = (struct ifreq *)if_req;
11932 		ifr->ifr_metric = ipif->ipif_mtu;
11933 	} else {
11934 		lifr = (struct lifreq *)if_req;
11935 		lifr->lifr_mtu = ipif->ipif_mtu;
11936 	}
11937 	return (0);
11938 }
11939 
11940 /* Set interface broadcast address. */
11941 /* ARGSUSED2 */
11942 int
11943 ip_sioctl_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11944 	ip_ioctl_cmd_t *ipip, void *if_req)
11945 {
11946 	ipaddr_t addr;
11947 	ire_t	*ire;
11948 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
11949 
11950 	ip1dbg(("ip_sioctl_brdaddr(%s:%u)\n", ipif->ipif_ill->ill_name,
11951 	    ipif->ipif_id));
11952 
11953 	ASSERT(IAM_WRITER_IPIF(ipif));
11954 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
11955 		return (EADDRNOTAVAIL);
11956 
11957 	ASSERT(!(ipif->ipif_isv6));	/* No IPv6 broadcast */
11958 
11959 	if (sin->sin_family != AF_INET)
11960 		return (EAFNOSUPPORT);
11961 
11962 	addr = sin->sin_addr.s_addr;
11963 	if (ipif->ipif_flags & IPIF_UP) {
11964 		/*
11965 		 * If we are already up, make sure the new
11966 		 * broadcast address makes sense.  If it does,
11967 		 * there should be an IRE for it already.
11968 		 * Don't match on ipif, only on the ill
11969 		 * since we are sharing these now.
11970 		 */
11971 		ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST,
11972 		    ipif, ALL_ZONES, NULL,
11973 		    (MATCH_IRE_ILL | MATCH_IRE_TYPE), ipst);
11974 		if (ire == NULL) {
11975 			return (EINVAL);
11976 		} else {
11977 			ire_refrele(ire);
11978 		}
11979 	}
11980 	/*
11981 	 * Changing the broadcast addr for this ipif.
11982 	 * Make sure we have valid net and subnet bcast
11983 	 * ire's for other logical interfaces, if needed.
11984 	 */
11985 	if (addr != ipif->ipif_brd_addr)
11986 		ipif_check_bcast_ires(ipif);
11987 	IN6_IPADDR_TO_V4MAPPED(addr, &ipif->ipif_v6brd_addr);
11988 	return (0);
11989 }
11990 
11991 /* Get interface broadcast address. */
11992 /* ARGSUSED */
11993 int
11994 ip_sioctl_get_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11995     ip_ioctl_cmd_t *ipip, void *if_req)
11996 {
11997 	ip1dbg(("ip_sioctl_get_brdaddr(%s:%u %p)\n",
11998 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11999 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
12000 		return (EADDRNOTAVAIL);
12001 
12002 	/* IPIF_BROADCAST not possible with IPv6 */
12003 	ASSERT(!ipif->ipif_isv6);
12004 	*sin = sin_null;
12005 	sin->sin_family = AF_INET;
12006 	sin->sin_addr.s_addr = ipif->ipif_brd_addr;
12007 	return (0);
12008 }
12009 
12010 /*
12011  * This routine is called to handle the SIOCS*IFNETMASK IOCTL.
12012  */
12013 /* ARGSUSED */
12014 int
12015 ip_sioctl_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12016     ip_ioctl_cmd_t *ipip, void *if_req)
12017 {
12018 	int err = 0;
12019 	in6_addr_t v6mask;
12020 
12021 	ip1dbg(("ip_sioctl_netmask(%s:%u %p)\n",
12022 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12023 
12024 	ASSERT(IAM_WRITER_IPIF(ipif));
12025 
12026 	if (ipif->ipif_isv6) {
12027 		sin6_t *sin6;
12028 
12029 		if (sin->sin_family != AF_INET6)
12030 			return (EAFNOSUPPORT);
12031 
12032 		sin6 = (sin6_t *)sin;
12033 		v6mask = sin6->sin6_addr;
12034 	} else {
12035 		ipaddr_t mask;
12036 
12037 		if (sin->sin_family != AF_INET)
12038 			return (EAFNOSUPPORT);
12039 
12040 		mask = sin->sin_addr.s_addr;
12041 		V4MASK_TO_V6(mask, v6mask);
12042 	}
12043 
12044 	/*
12045 	 * No big deal if the interface isn't already up, or the mask
12046 	 * isn't really changing, or this is pt-pt.
12047 	 */
12048 	if (!(ipif->ipif_flags & IPIF_UP) ||
12049 	    IN6_ARE_ADDR_EQUAL(&v6mask, &ipif->ipif_v6net_mask) ||
12050 	    (ipif->ipif_flags & IPIF_POINTOPOINT)) {
12051 		ipif->ipif_v6net_mask = v6mask;
12052 		if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
12053 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
12054 			    ipif->ipif_v6net_mask,
12055 			    ipif->ipif_v6subnet);
12056 		}
12057 		return (0);
12058 	}
12059 	/*
12060 	 * Make sure we have valid net and subnet broadcast ire's
12061 	 * for the old netmask, if needed by other logical interfaces.
12062 	 */
12063 	if (!ipif->ipif_isv6)
12064 		ipif_check_bcast_ires(ipif);
12065 
12066 	err = ipif_logical_down(ipif, q, mp);
12067 	if (err == EINPROGRESS)
12068 		return (err);
12069 	ipif_down_tail(ipif);
12070 	err = ip_sioctl_netmask_tail(ipif, sin, q, mp);
12071 	return (err);
12072 }
12073 
12074 static int
12075 ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp)
12076 {
12077 	in6_addr_t v6mask;
12078 	int err = 0;
12079 
12080 	ip1dbg(("ip_sioctl_netmask_tail(%s:%u %p)\n",
12081 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12082 
12083 	if (ipif->ipif_isv6) {
12084 		sin6_t *sin6;
12085 
12086 		sin6 = (sin6_t *)sin;
12087 		v6mask = sin6->sin6_addr;
12088 	} else {
12089 		ipaddr_t mask;
12090 
12091 		mask = sin->sin_addr.s_addr;
12092 		V4MASK_TO_V6(mask, v6mask);
12093 	}
12094 
12095 	ipif->ipif_v6net_mask = v6mask;
12096 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
12097 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
12098 		    ipif->ipif_v6subnet);
12099 	}
12100 	err = ipif_up(ipif, q, mp);
12101 
12102 	if (err == 0 || err == EINPROGRESS) {
12103 		/*
12104 		 * The interface must be DL_BOUND if this packet has to
12105 		 * go out on the wire. Since we only go through a logical
12106 		 * down and are bound with the driver during an internal
12107 		 * down/up that is satisfied.
12108 		 */
12109 		if (!ipif->ipif_isv6 && ipif->ipif_ill->ill_wq != NULL) {
12110 			/* Potentially broadcast an address mask reply. */
12111 			ipif_mask_reply(ipif);
12112 		}
12113 	}
12114 	return (err);
12115 }
12116 
12117 /* ARGSUSED */
12118 int
12119 ip_sioctl_netmask_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12120     ip_ioctl_cmd_t *ipip, void *if_req)
12121 {
12122 	ip1dbg(("ip_sioctl_netmask_restart(%s:%u %p)\n",
12123 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12124 	ipif_down_tail(ipif);
12125 	return (ip_sioctl_netmask_tail(ipif, sin, q, mp));
12126 }
12127 
12128 /* Get interface net mask. */
12129 /* ARGSUSED */
12130 int
12131 ip_sioctl_get_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12132     ip_ioctl_cmd_t *ipip, void *if_req)
12133 {
12134 	struct lifreq *lifr = (struct lifreq *)if_req;
12135 	struct sockaddr_in6 *sin6 = (sin6_t *)sin;
12136 
12137 	ip1dbg(("ip_sioctl_get_netmask(%s:%u %p)\n",
12138 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12139 
12140 	/*
12141 	 * net mask can't change since we have a reference to the ipif.
12142 	 */
12143 	if (ipif->ipif_isv6) {
12144 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
12145 		*sin6 = sin6_null;
12146 		sin6->sin6_family = AF_INET6;
12147 		sin6->sin6_addr = ipif->ipif_v6net_mask;
12148 		lifr->lifr_addrlen =
12149 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
12150 	} else {
12151 		*sin = sin_null;
12152 		sin->sin_family = AF_INET;
12153 		sin->sin_addr.s_addr = ipif->ipif_net_mask;
12154 		if (ipip->ipi_cmd_type == LIF_CMD) {
12155 			lifr->lifr_addrlen =
12156 			    ip_mask_to_plen(ipif->ipif_net_mask);
12157 		}
12158 	}
12159 	return (0);
12160 }
12161 
12162 /* ARGSUSED */
12163 int
12164 ip_sioctl_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12165     ip_ioctl_cmd_t *ipip, void *if_req)
12166 {
12167 	ip1dbg(("ip_sioctl_metric(%s:%u %p)\n",
12168 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12169 
12170 	/*
12171 	 * Since no applications should ever be setting metrics on underlying
12172 	 * interfaces, we explicitly fail to smoke 'em out.
12173 	 */
12174 	if (IS_UNDER_IPMP(ipif->ipif_ill))
12175 		return (EINVAL);
12176 
12177 	/*
12178 	 * Set interface metric.  We don't use this for
12179 	 * anything but we keep track of it in case it is
12180 	 * important to routing applications or such.
12181 	 */
12182 	if (ipip->ipi_cmd_type == IF_CMD) {
12183 		struct ifreq    *ifr;
12184 
12185 		ifr = (struct ifreq *)if_req;
12186 		ipif->ipif_metric = ifr->ifr_metric;
12187 	} else {
12188 		struct lifreq   *lifr;
12189 
12190 		lifr = (struct lifreq *)if_req;
12191 		ipif->ipif_metric = lifr->lifr_metric;
12192 	}
12193 	return (0);
12194 }
12195 
12196 /* ARGSUSED */
12197 int
12198 ip_sioctl_get_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12199     ip_ioctl_cmd_t *ipip, void *if_req)
12200 {
12201 	/* Get interface metric. */
12202 	ip1dbg(("ip_sioctl_get_metric(%s:%u %p)\n",
12203 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12204 
12205 	if (ipip->ipi_cmd_type == IF_CMD) {
12206 		struct ifreq    *ifr;
12207 
12208 		ifr = (struct ifreq *)if_req;
12209 		ifr->ifr_metric = ipif->ipif_metric;
12210 	} else {
12211 		struct lifreq   *lifr;
12212 
12213 		lifr = (struct lifreq *)if_req;
12214 		lifr->lifr_metric = ipif->ipif_metric;
12215 	}
12216 
12217 	return (0);
12218 }
12219 
12220 /* ARGSUSED */
12221 int
12222 ip_sioctl_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12223     ip_ioctl_cmd_t *ipip, void *if_req)
12224 {
12225 
12226 	ip1dbg(("ip_sioctl_muxid(%s:%u %p)\n",
12227 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12228 	/*
12229 	 * Set the muxid returned from I_PLINK.
12230 	 */
12231 	if (ipip->ipi_cmd_type == IF_CMD) {
12232 		struct ifreq *ifr = (struct ifreq *)if_req;
12233 
12234 		ipif->ipif_ill->ill_ip_muxid = ifr->ifr_ip_muxid;
12235 		ipif->ipif_ill->ill_arp_muxid = ifr->ifr_arp_muxid;
12236 	} else {
12237 		struct lifreq *lifr = (struct lifreq *)if_req;
12238 
12239 		ipif->ipif_ill->ill_ip_muxid = lifr->lifr_ip_muxid;
12240 		ipif->ipif_ill->ill_arp_muxid = lifr->lifr_arp_muxid;
12241 	}
12242 	return (0);
12243 }
12244 
12245 /* ARGSUSED */
12246 int
12247 ip_sioctl_get_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12248     ip_ioctl_cmd_t *ipip, void *if_req)
12249 {
12250 
12251 	ip1dbg(("ip_sioctl_get_muxid(%s:%u %p)\n",
12252 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12253 	/*
12254 	 * Get the muxid saved in ill for I_PUNLINK.
12255 	 */
12256 	if (ipip->ipi_cmd_type == IF_CMD) {
12257 		struct ifreq *ifr = (struct ifreq *)if_req;
12258 
12259 		ifr->ifr_ip_muxid = ipif->ipif_ill->ill_ip_muxid;
12260 		ifr->ifr_arp_muxid = ipif->ipif_ill->ill_arp_muxid;
12261 	} else {
12262 		struct lifreq *lifr = (struct lifreq *)if_req;
12263 
12264 		lifr->lifr_ip_muxid = ipif->ipif_ill->ill_ip_muxid;
12265 		lifr->lifr_arp_muxid = ipif->ipif_ill->ill_arp_muxid;
12266 	}
12267 	return (0);
12268 }
12269 
12270 /*
12271  * Set the subnet prefix. Does not modify the broadcast address.
12272  */
12273 /* ARGSUSED */
12274 int
12275 ip_sioctl_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12276     ip_ioctl_cmd_t *ipip, void *if_req)
12277 {
12278 	int err = 0;
12279 	in6_addr_t v6addr;
12280 	in6_addr_t v6mask;
12281 	boolean_t need_up = B_FALSE;
12282 	int addrlen;
12283 
12284 	ip1dbg(("ip_sioctl_subnet(%s:%u %p)\n",
12285 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12286 
12287 	ASSERT(IAM_WRITER_IPIF(ipif));
12288 	addrlen = ((struct lifreq *)if_req)->lifr_addrlen;
12289 
12290 	if (ipif->ipif_isv6) {
12291 		sin6_t *sin6;
12292 
12293 		if (sin->sin_family != AF_INET6)
12294 			return (EAFNOSUPPORT);
12295 
12296 		sin6 = (sin6_t *)sin;
12297 		v6addr = sin6->sin6_addr;
12298 		if (!ip_remote_addr_ok_v6(&v6addr, &ipv6_all_ones))
12299 			return (EADDRNOTAVAIL);
12300 	} else {
12301 		ipaddr_t addr;
12302 
12303 		if (sin->sin_family != AF_INET)
12304 			return (EAFNOSUPPORT);
12305 
12306 		addr = sin->sin_addr.s_addr;
12307 		if (!ip_addr_ok_v4(addr, 0xFFFFFFFF))
12308 			return (EADDRNOTAVAIL);
12309 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
12310 		/* Add 96 bits */
12311 		addrlen += IPV6_ABITS - IP_ABITS;
12312 	}
12313 
12314 	if (ip_plen_to_mask_v6(addrlen, &v6mask) == NULL)
12315 		return (EINVAL);
12316 
12317 	/* Check if bits in the address is set past the mask */
12318 	if (!V6_MASK_EQ(v6addr, v6mask, v6addr))
12319 		return (EINVAL);
12320 
12321 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6subnet, &v6addr) &&
12322 	    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6net_mask, &v6mask))
12323 		return (0);	/* No change */
12324 
12325 	if (ipif->ipif_flags & IPIF_UP) {
12326 		/*
12327 		 * If the interface is already marked up,
12328 		 * we call ipif_down which will take care
12329 		 * of ditching any IREs that have been set
12330 		 * up based on the old interface address.
12331 		 */
12332 		err = ipif_logical_down(ipif, q, mp);
12333 		if (err == EINPROGRESS)
12334 			return (err);
12335 		ipif_down_tail(ipif);
12336 		need_up = B_TRUE;
12337 	}
12338 
12339 	err = ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, need_up);
12340 	return (err);
12341 }
12342 
12343 static int
12344 ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t v6addr, in6_addr_t v6mask,
12345     queue_t *q, mblk_t *mp, boolean_t need_up)
12346 {
12347 	ill_t	*ill = ipif->ipif_ill;
12348 	int	err = 0;
12349 
12350 	ip1dbg(("ip_sioctl_subnet_tail(%s:%u %p)\n",
12351 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12352 
12353 	/* Set the new address. */
12354 	mutex_enter(&ill->ill_lock);
12355 	ipif->ipif_v6net_mask = v6mask;
12356 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
12357 		V6_MASK_COPY(v6addr, ipif->ipif_v6net_mask,
12358 		    ipif->ipif_v6subnet);
12359 	}
12360 	mutex_exit(&ill->ill_lock);
12361 
12362 	if (need_up) {
12363 		/*
12364 		 * Now bring the interface back up.  If this
12365 		 * is the only IPIF for the ILL, ipif_up
12366 		 * will have to re-bind to the device, so
12367 		 * we may get back EINPROGRESS, in which
12368 		 * case, this IOCTL will get completed in
12369 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
12370 		 */
12371 		err = ipif_up(ipif, q, mp);
12372 		if (err == EINPROGRESS)
12373 			return (err);
12374 	}
12375 	return (err);
12376 }
12377 
12378 /* ARGSUSED */
12379 int
12380 ip_sioctl_subnet_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12381     ip_ioctl_cmd_t *ipip, void *if_req)
12382 {
12383 	int	addrlen;
12384 	in6_addr_t v6addr;
12385 	in6_addr_t v6mask;
12386 	struct lifreq *lifr = (struct lifreq *)if_req;
12387 
12388 	ip1dbg(("ip_sioctl_subnet_restart(%s:%u %p)\n",
12389 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12390 	ipif_down_tail(ipif);
12391 
12392 	addrlen = lifr->lifr_addrlen;
12393 	if (ipif->ipif_isv6) {
12394 		sin6_t *sin6;
12395 
12396 		sin6 = (sin6_t *)sin;
12397 		v6addr = sin6->sin6_addr;
12398 	} else {
12399 		ipaddr_t addr;
12400 
12401 		addr = sin->sin_addr.s_addr;
12402 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
12403 		addrlen += IPV6_ABITS - IP_ABITS;
12404 	}
12405 	(void) ip_plen_to_mask_v6(addrlen, &v6mask);
12406 
12407 	return (ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, B_TRUE));
12408 }
12409 
12410 /* ARGSUSED */
12411 int
12412 ip_sioctl_get_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12413     ip_ioctl_cmd_t *ipip, void *if_req)
12414 {
12415 	struct lifreq *lifr = (struct lifreq *)if_req;
12416 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sin;
12417 
12418 	ip1dbg(("ip_sioctl_get_subnet(%s:%u %p)\n",
12419 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12420 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
12421 
12422 	if (ipif->ipif_isv6) {
12423 		*sin6 = sin6_null;
12424 		sin6->sin6_family = AF_INET6;
12425 		sin6->sin6_addr = ipif->ipif_v6subnet;
12426 		lifr->lifr_addrlen =
12427 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
12428 	} else {
12429 		*sin = sin_null;
12430 		sin->sin_family = AF_INET;
12431 		sin->sin_addr.s_addr = ipif->ipif_subnet;
12432 		lifr->lifr_addrlen = ip_mask_to_plen(ipif->ipif_net_mask);
12433 	}
12434 	return (0);
12435 }
12436 
12437 /*
12438  * Set the IPv6 address token.
12439  */
12440 /* ARGSUSED */
12441 int
12442 ip_sioctl_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12443     ip_ioctl_cmd_t *ipi, void *if_req)
12444 {
12445 	ill_t *ill = ipif->ipif_ill;
12446 	int err;
12447 	in6_addr_t v6addr;
12448 	in6_addr_t v6mask;
12449 	boolean_t need_up = B_FALSE;
12450 	int i;
12451 	sin6_t *sin6 = (sin6_t *)sin;
12452 	struct lifreq *lifr = (struct lifreq *)if_req;
12453 	int addrlen;
12454 
12455 	ip1dbg(("ip_sioctl_token(%s:%u %p)\n",
12456 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12457 	ASSERT(IAM_WRITER_IPIF(ipif));
12458 
12459 	addrlen = lifr->lifr_addrlen;
12460 	/* Only allow for logical unit zero i.e. not on "le0:17" */
12461 	if (ipif->ipif_id != 0)
12462 		return (EINVAL);
12463 
12464 	if (!ipif->ipif_isv6)
12465 		return (EINVAL);
12466 
12467 	if (addrlen > IPV6_ABITS)
12468 		return (EINVAL);
12469 
12470 	v6addr = sin6->sin6_addr;
12471 
12472 	/*
12473 	 * The length of the token is the length from the end.  To get
12474 	 * the proper mask for this, compute the mask of the bits not
12475 	 * in the token; ie. the prefix, and then xor to get the mask.
12476 	 */
12477 	if (ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask) == NULL)
12478 		return (EINVAL);
12479 	for (i = 0; i < 4; i++) {
12480 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
12481 	}
12482 
12483 	if (V6_MASK_EQ(v6addr, v6mask, ill->ill_token) &&
12484 	    ill->ill_token_length == addrlen)
12485 		return (0);	/* No change */
12486 
12487 	if (ipif->ipif_flags & IPIF_UP) {
12488 		err = ipif_logical_down(ipif, q, mp);
12489 		if (err == EINPROGRESS)
12490 			return (err);
12491 		ipif_down_tail(ipif);
12492 		need_up = B_TRUE;
12493 	}
12494 	err = ip_sioctl_token_tail(ipif, sin6, addrlen, q, mp, need_up);
12495 	return (err);
12496 }
12497 
12498 static int
12499 ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen, queue_t *q,
12500     mblk_t *mp, boolean_t need_up)
12501 {
12502 	in6_addr_t v6addr;
12503 	in6_addr_t v6mask;
12504 	ill_t	*ill = ipif->ipif_ill;
12505 	int	i;
12506 	int	err = 0;
12507 
12508 	ip1dbg(("ip_sioctl_token_tail(%s:%u %p)\n",
12509 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12510 	v6addr = sin6->sin6_addr;
12511 	/*
12512 	 * The length of the token is the length from the end.  To get
12513 	 * the proper mask for this, compute the mask of the bits not
12514 	 * in the token; ie. the prefix, and then xor to get the mask.
12515 	 */
12516 	(void) ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask);
12517 	for (i = 0; i < 4; i++)
12518 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
12519 
12520 	mutex_enter(&ill->ill_lock);
12521 	V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
12522 	ill->ill_token_length = addrlen;
12523 	mutex_exit(&ill->ill_lock);
12524 
12525 	if (need_up) {
12526 		/*
12527 		 * Now bring the interface back up.  If this
12528 		 * is the only IPIF for the ILL, ipif_up
12529 		 * will have to re-bind to the device, so
12530 		 * we may get back EINPROGRESS, in which
12531 		 * case, this IOCTL will get completed in
12532 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
12533 		 */
12534 		err = ipif_up(ipif, q, mp);
12535 		if (err == EINPROGRESS)
12536 			return (err);
12537 	}
12538 	return (err);
12539 }
12540 
12541 /* ARGSUSED */
12542 int
12543 ip_sioctl_get_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12544     ip_ioctl_cmd_t *ipi, void *if_req)
12545 {
12546 	ill_t *ill;
12547 	sin6_t *sin6 = (sin6_t *)sin;
12548 	struct lifreq *lifr = (struct lifreq *)if_req;
12549 
12550 	ip1dbg(("ip_sioctl_get_token(%s:%u %p)\n",
12551 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12552 	if (ipif->ipif_id != 0)
12553 		return (EINVAL);
12554 
12555 	ill = ipif->ipif_ill;
12556 	if (!ill->ill_isv6)
12557 		return (ENXIO);
12558 
12559 	*sin6 = sin6_null;
12560 	sin6->sin6_family = AF_INET6;
12561 	ASSERT(!IN6_IS_ADDR_V4MAPPED(&ill->ill_token));
12562 	sin6->sin6_addr = ill->ill_token;
12563 	lifr->lifr_addrlen = ill->ill_token_length;
12564 	return (0);
12565 }
12566 
12567 /*
12568  * Set (hardware) link specific information that might override
12569  * what was acquired through the DL_INFO_ACK.
12570  * The logic is as follows.
12571  *
12572  * become exclusive
12573  * set CHANGING flag
12574  * change mtu on affected IREs
12575  * clear CHANGING flag
12576  *
12577  * An ire add that occurs before the CHANGING flag is set will have its mtu
12578  * changed by the ip_sioctl_lnkinfo.
12579  *
12580  * During the time the CHANGING flag is set, no new ires will be added to the
12581  * bucket, and ire add will fail (due the CHANGING flag).
12582  *
12583  * An ire add that occurs after the CHANGING flag is set will have the right mtu
12584  * before it is added to the bucket.
12585  *
12586  * Obviously only 1 thread can set the CHANGING flag and we need to become
12587  * exclusive to set the flag.
12588  */
12589 /* ARGSUSED */
12590 int
12591 ip_sioctl_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12592     ip_ioctl_cmd_t *ipi, void *if_req)
12593 {
12594 	ill_t		*ill = ipif->ipif_ill;
12595 	ipif_t		*nipif;
12596 	int		ip_min_mtu;
12597 	boolean_t	mtu_walk = B_FALSE;
12598 	struct lifreq	*lifr = (struct lifreq *)if_req;
12599 	lif_ifinfo_req_t *lir;
12600 	ire_t		*ire;
12601 
12602 	ip1dbg(("ip_sioctl_lnkinfo(%s:%u %p)\n",
12603 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12604 	lir = &lifr->lifr_ifinfo;
12605 	ASSERT(IAM_WRITER_IPIF(ipif));
12606 
12607 	/* Only allow for logical unit zero i.e. not on "le0:17" */
12608 	if (ipif->ipif_id != 0)
12609 		return (EINVAL);
12610 
12611 	/* Set interface MTU. */
12612 	if (ipif->ipif_isv6)
12613 		ip_min_mtu = IPV6_MIN_MTU;
12614 	else
12615 		ip_min_mtu = IP_MIN_MTU;
12616 
12617 	/*
12618 	 * Verify values before we set anything. Allow zero to
12619 	 * mean unspecified.
12620 	 */
12621 	if (lir->lir_maxmtu != 0 &&
12622 	    (lir->lir_maxmtu > ill->ill_max_frag ||
12623 	    lir->lir_maxmtu < ip_min_mtu))
12624 		return (EINVAL);
12625 	if (lir->lir_reachtime != 0 &&
12626 	    lir->lir_reachtime > ND_MAX_REACHTIME)
12627 		return (EINVAL);
12628 	if (lir->lir_reachretrans != 0 &&
12629 	    lir->lir_reachretrans > ND_MAX_REACHRETRANSTIME)
12630 		return (EINVAL);
12631 
12632 	mutex_enter(&ill->ill_lock);
12633 	ill->ill_state_flags |= ILL_CHANGING;
12634 	for (nipif = ill->ill_ipif; nipif != NULL;
12635 	    nipif = nipif->ipif_next) {
12636 		nipif->ipif_state_flags |= IPIF_CHANGING;
12637 	}
12638 
12639 	if (lir->lir_maxmtu != 0) {
12640 		ill->ill_max_mtu = lir->lir_maxmtu;
12641 		ill->ill_user_mtu = lir->lir_maxmtu;
12642 		mtu_walk = B_TRUE;
12643 	}
12644 	mutex_exit(&ill->ill_lock);
12645 
12646 	if (lir->lir_reachtime != 0)
12647 		ill->ill_reachable_time = lir->lir_reachtime;
12648 
12649 	if (lir->lir_reachretrans != 0)
12650 		ill->ill_reachable_retrans_time = lir->lir_reachretrans;
12651 
12652 	ill->ill_max_hops = lir->lir_maxhops;
12653 
12654 	ill->ill_max_buf = ND_MAX_Q;
12655 
12656 	if (mtu_walk) {
12657 		/*
12658 		 * Set the MTU on all ipifs associated with this ill except
12659 		 * for those whose MTU was fixed via SIOCSLIFMTU.
12660 		 */
12661 		for (nipif = ill->ill_ipif; nipif != NULL;
12662 		    nipif = nipif->ipif_next) {
12663 			if (nipif->ipif_flags & IPIF_FIXEDMTU)
12664 				continue;
12665 
12666 			nipif->ipif_mtu = ill->ill_max_mtu;
12667 
12668 			if (!(nipif->ipif_flags & IPIF_UP))
12669 				continue;
12670 
12671 			if (nipif->ipif_isv6)
12672 				ire = ipif_to_ire_v6(nipif);
12673 			else
12674 				ire = ipif_to_ire(nipif);
12675 			if (ire != NULL) {
12676 				ire->ire_max_frag = ipif->ipif_mtu;
12677 				ire_refrele(ire);
12678 			}
12679 
12680 			ire_walk_ill(MATCH_IRE_ILL, 0, ipif_mtu_change,
12681 			    nipif, ill);
12682 		}
12683 	}
12684 
12685 	mutex_enter(&ill->ill_lock);
12686 	for (nipif = ill->ill_ipif; nipif != NULL;
12687 	    nipif = nipif->ipif_next) {
12688 		nipif->ipif_state_flags &= ~IPIF_CHANGING;
12689 	}
12690 	ILL_UNMARK_CHANGING(ill);
12691 	mutex_exit(&ill->ill_lock);
12692 
12693 	/*
12694 	 * Refresh IPMP meta-interface MTU if necessary.
12695 	 */
12696 	if (IS_UNDER_IPMP(ill))
12697 		ipmp_illgrp_refresh_mtu(ill->ill_grp);
12698 
12699 	return (0);
12700 }
12701 
12702 /* ARGSUSED */
12703 int
12704 ip_sioctl_get_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12705     ip_ioctl_cmd_t *ipi, void *if_req)
12706 {
12707 	struct lif_ifinfo_req *lir;
12708 	ill_t *ill = ipif->ipif_ill;
12709 
12710 	ip1dbg(("ip_sioctl_get_lnkinfo(%s:%u %p)\n",
12711 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12712 	if (ipif->ipif_id != 0)
12713 		return (EINVAL);
12714 
12715 	lir = &((struct lifreq *)if_req)->lifr_ifinfo;
12716 	lir->lir_maxhops = ill->ill_max_hops;
12717 	lir->lir_reachtime = ill->ill_reachable_time;
12718 	lir->lir_reachretrans = ill->ill_reachable_retrans_time;
12719 	lir->lir_maxmtu = ill->ill_max_mtu;
12720 
12721 	return (0);
12722 }
12723 
12724 /*
12725  * Return best guess as to the subnet mask for the specified address.
12726  * Based on the subnet masks for all the configured interfaces.
12727  *
12728  * We end up returning a zero mask in the case of default, multicast or
12729  * experimental.
12730  */
12731 static ipaddr_t
12732 ip_subnet_mask(ipaddr_t addr, ipif_t **ipifp, ip_stack_t *ipst)
12733 {
12734 	ipaddr_t net_mask;
12735 	ill_t	*ill;
12736 	ipif_t	*ipif;
12737 	ill_walk_context_t ctx;
12738 	ipif_t	*fallback_ipif = NULL;
12739 
12740 	net_mask = ip_net_mask(addr);
12741 	if (net_mask == 0) {
12742 		*ipifp = NULL;
12743 		return (0);
12744 	}
12745 
12746 	/* Let's check to see if this is maybe a local subnet route. */
12747 	/* this function only applies to IPv4 interfaces */
12748 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
12749 	ill = ILL_START_WALK_V4(&ctx, ipst);
12750 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
12751 		mutex_enter(&ill->ill_lock);
12752 		for (ipif = ill->ill_ipif; ipif != NULL;
12753 		    ipif = ipif->ipif_next) {
12754 			if (!IPIF_CAN_LOOKUP(ipif))
12755 				continue;
12756 			if (!(ipif->ipif_flags & IPIF_UP))
12757 				continue;
12758 			if ((ipif->ipif_subnet & net_mask) ==
12759 			    (addr & net_mask)) {
12760 				/*
12761 				 * Don't trust pt-pt interfaces if there are
12762 				 * other interfaces.
12763 				 */
12764 				if (ipif->ipif_flags & IPIF_POINTOPOINT) {
12765 					if (fallback_ipif == NULL) {
12766 						ipif_refhold_locked(ipif);
12767 						fallback_ipif = ipif;
12768 					}
12769 					continue;
12770 				}
12771 
12772 				/*
12773 				 * Fine. Just assume the same net mask as the
12774 				 * directly attached subnet interface is using.
12775 				 */
12776 				ipif_refhold_locked(ipif);
12777 				mutex_exit(&ill->ill_lock);
12778 				rw_exit(&ipst->ips_ill_g_lock);
12779 				if (fallback_ipif != NULL)
12780 					ipif_refrele(fallback_ipif);
12781 				*ipifp = ipif;
12782 				return (ipif->ipif_net_mask);
12783 			}
12784 		}
12785 		mutex_exit(&ill->ill_lock);
12786 	}
12787 	rw_exit(&ipst->ips_ill_g_lock);
12788 
12789 	*ipifp = fallback_ipif;
12790 	return ((fallback_ipif != NULL) ?
12791 	    fallback_ipif->ipif_net_mask : net_mask);
12792 }
12793 
12794 /*
12795  * ip_sioctl_copyin_setup calls ip_wput_ioctl to process the IP_IOCTL ioctl.
12796  */
12797 static void
12798 ip_wput_ioctl(queue_t *q, mblk_t *mp)
12799 {
12800 	IOCP	iocp;
12801 	ipft_t	*ipft;
12802 	ipllc_t	*ipllc;
12803 	mblk_t	*mp1;
12804 	cred_t	*cr;
12805 	int	error = 0;
12806 	conn_t	*connp;
12807 
12808 	ip1dbg(("ip_wput_ioctl"));
12809 	iocp = (IOCP)mp->b_rptr;
12810 	mp1 = mp->b_cont;
12811 	if (mp1 == NULL) {
12812 		iocp->ioc_error = EINVAL;
12813 		mp->b_datap->db_type = M_IOCNAK;
12814 		iocp->ioc_count = 0;
12815 		qreply(q, mp);
12816 		return;
12817 	}
12818 
12819 	/*
12820 	 * These IOCTLs provide various control capabilities to
12821 	 * upstream agents such as ULPs and processes.	There
12822 	 * are currently two such IOCTLs implemented.  They
12823 	 * are used by TCP to provide update information for
12824 	 * existing IREs and to forcibly delete an IRE for a
12825 	 * host that is not responding, thereby forcing an
12826 	 * attempt at a new route.
12827 	 */
12828 	iocp->ioc_error = EINVAL;
12829 	if (!pullupmsg(mp1, sizeof (ipllc->ipllc_cmd)))
12830 		goto done;
12831 
12832 	ipllc = (ipllc_t *)mp1->b_rptr;
12833 	for (ipft = ip_ioctl_ftbl; ipft->ipft_pfi; ipft++) {
12834 		if (ipllc->ipllc_cmd == ipft->ipft_cmd)
12835 			break;
12836 	}
12837 	/*
12838 	 * prefer credential from mblk over ioctl;
12839 	 * see ip_sioctl_copyin_setup
12840 	 */
12841 	cr = msg_getcred(mp, NULL);
12842 	if (cr == NULL)
12843 		cr = iocp->ioc_cr;
12844 
12845 	/*
12846 	 * Refhold the conn in case the request gets queued up in some lookup
12847 	 */
12848 	ASSERT(CONN_Q(q));
12849 	connp = Q_TO_CONN(q);
12850 	CONN_INC_REF(connp);
12851 	if (ipft->ipft_pfi &&
12852 	    ((mp1->b_wptr - mp1->b_rptr) >= ipft->ipft_min_size ||
12853 	    pullupmsg(mp1, ipft->ipft_min_size))) {
12854 		error = (*ipft->ipft_pfi)(q,
12855 		    (ipft->ipft_flags & IPFT_F_SELF_REPLY) ? mp : mp1, cr);
12856 	}
12857 	if (ipft->ipft_flags & IPFT_F_SELF_REPLY) {
12858 		/*
12859 		 * CONN_OPER_PENDING_DONE happens in the function called
12860 		 * through ipft_pfi above.
12861 		 */
12862 		return;
12863 	}
12864 
12865 	CONN_OPER_PENDING_DONE(connp);
12866 	if (ipft->ipft_flags & IPFT_F_NO_REPLY) {
12867 		freemsg(mp);
12868 		return;
12869 	}
12870 	iocp->ioc_error = error;
12871 
12872 done:
12873 	mp->b_datap->db_type = M_IOCACK;
12874 	if (iocp->ioc_error)
12875 		iocp->ioc_count = 0;
12876 	qreply(q, mp);
12877 }
12878 
12879 /*
12880  * Lookup an ipif using the sequence id (ipif_seqid)
12881  */
12882 ipif_t *
12883 ipif_lookup_seqid(ill_t *ill, uint_t seqid)
12884 {
12885 	ipif_t *ipif;
12886 
12887 	ASSERT(MUTEX_HELD(&ill->ill_lock));
12888 
12889 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12890 		if (ipif->ipif_seqid == seqid && IPIF_CAN_LOOKUP(ipif))
12891 			return (ipif);
12892 	}
12893 	return (NULL);
12894 }
12895 
12896 /*
12897  * Assign a unique id for the ipif. This is used later when we send
12898  * IRES to ARP for resolution where we initialize ire_ipif_seqid
12899  * to the value pointed by ire_ipif->ipif_seqid. Later when the
12900  * IRE is added, we verify that ipif has not disappeared.
12901  */
12902 
12903 static void
12904 ipif_assign_seqid(ipif_t *ipif)
12905 {
12906 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
12907 
12908 	ipif->ipif_seqid = atomic_add_64_nv(&ipst->ips_ipif_g_seqid, 1);
12909 }
12910 
12911 /*
12912  * Clone the contents of `sipif' to `dipif'.  Requires that both ipifs are
12913  * administratively down (i.e., no DAD), of the same type, and locked.  Note
12914  * that the clone is complete -- including the seqid -- and the expectation is
12915  * that the caller will either free or overwrite `sipif' before it's unlocked.
12916  */
12917 static void
12918 ipif_clone(const ipif_t *sipif, ipif_t *dipif)
12919 {
12920 	ASSERT(MUTEX_HELD(&sipif->ipif_ill->ill_lock));
12921 	ASSERT(MUTEX_HELD(&dipif->ipif_ill->ill_lock));
12922 	ASSERT(!(sipif->ipif_flags & (IPIF_UP|IPIF_DUPLICATE)));
12923 	ASSERT(!(dipif->ipif_flags & (IPIF_UP|IPIF_DUPLICATE)));
12924 	ASSERT(sipif->ipif_ire_type == dipif->ipif_ire_type);
12925 	ASSERT(sipif->ipif_arp_del_mp == NULL);
12926 	ASSERT(dipif->ipif_arp_del_mp == NULL);
12927 	ASSERT(sipif->ipif_igmp_rpt == NULL);
12928 	ASSERT(dipif->ipif_igmp_rpt == NULL);
12929 	ASSERT(sipif->ipif_multicast_up == 0);
12930 	ASSERT(dipif->ipif_multicast_up == 0);
12931 	ASSERT(sipif->ipif_joined_allhosts == 0);
12932 	ASSERT(dipif->ipif_joined_allhosts == 0);
12933 
12934 	dipif->ipif_mtu = sipif->ipif_mtu;
12935 	dipif->ipif_flags = sipif->ipif_flags;
12936 	dipif->ipif_metric = sipif->ipif_metric;
12937 	dipif->ipif_zoneid = sipif->ipif_zoneid;
12938 	dipif->ipif_v6subnet = sipif->ipif_v6subnet;
12939 	dipif->ipif_v6lcl_addr = sipif->ipif_v6lcl_addr;
12940 	dipif->ipif_v6src_addr = sipif->ipif_v6src_addr;
12941 	dipif->ipif_v6net_mask = sipif->ipif_v6net_mask;
12942 	dipif->ipif_v6brd_addr = sipif->ipif_v6brd_addr;
12943 	dipif->ipif_v6pp_dst_addr = sipif->ipif_v6pp_dst_addr;
12944 
12945 	/*
12946 	 * While dipif is down right now, it might've been up before.  Since
12947 	 * it's changing identity, its packet counters need to be reset.
12948 	 */
12949 	dipif->ipif_ib_pkt_count = 0;
12950 	dipif->ipif_ob_pkt_count = 0;
12951 	dipif->ipif_fo_pkt_count = 0;
12952 
12953 	/*
12954 	 * As per the comment atop the function, we assume that these sipif
12955 	 * fields will be changed before sipif is unlocked.
12956 	 */
12957 	dipif->ipif_seqid = sipif->ipif_seqid;
12958 	dipif->ipif_saved_ire_mp = sipif->ipif_saved_ire_mp;
12959 	dipif->ipif_saved_ire_cnt = sipif->ipif_saved_ire_cnt;
12960 	dipif->ipif_state_flags = sipif->ipif_state_flags;
12961 }
12962 
12963 /*
12964  * Transfer the contents of `sipif' to `dipif', and then free (if `virgipif'
12965  * is NULL) or overwrite `sipif' with `virgipif', which must be a virgin
12966  * (unreferenced) ipif.  Also, if `sipif' is used by the current xop, then
12967  * transfer the xop to `dipif'.  Requires that all ipifs are administratively
12968  * down (i.e., no DAD), of the same type, and unlocked.
12969  */
12970 static void
12971 ipif_transfer(ipif_t *sipif, ipif_t *dipif, ipif_t *virgipif)
12972 {
12973 	ipsq_t *ipsq = sipif->ipif_ill->ill_phyint->phyint_ipsq;
12974 	ipxop_t *ipx = ipsq->ipsq_xop;
12975 
12976 	ASSERT(sipif != dipif);
12977 	ASSERT(sipif != virgipif);
12978 
12979 	/*
12980 	 * Grab all of the locks that protect the ipif in a defined order.
12981 	 */
12982 	GRAB_ILL_LOCKS(sipif->ipif_ill, dipif->ipif_ill);
12983 	if (sipif > dipif) {
12984 		mutex_enter(&sipif->ipif_saved_ire_lock);
12985 		mutex_enter(&dipif->ipif_saved_ire_lock);
12986 	} else {
12987 		mutex_enter(&dipif->ipif_saved_ire_lock);
12988 		mutex_enter(&sipif->ipif_saved_ire_lock);
12989 	}
12990 
12991 	ipif_clone(sipif, dipif);
12992 	if (virgipif != NULL) {
12993 		ipif_clone(virgipif, sipif);
12994 		mi_free(virgipif);
12995 	}
12996 
12997 	mutex_exit(&sipif->ipif_saved_ire_lock);
12998 	mutex_exit(&dipif->ipif_saved_ire_lock);
12999 	RELEASE_ILL_LOCKS(sipif->ipif_ill, dipif->ipif_ill);
13000 
13001 	/*
13002 	 * Transfer ownership of the current xop, if necessary.
13003 	 */
13004 	if (ipx->ipx_current_ipif == sipif) {
13005 		ASSERT(ipx->ipx_pending_ipif == NULL);
13006 		mutex_enter(&ipx->ipx_lock);
13007 		ipx->ipx_current_ipif = dipif;
13008 		mutex_exit(&ipx->ipx_lock);
13009 	}
13010 
13011 	if (virgipif == NULL)
13012 		mi_free(sipif);
13013 }
13014 
13015 /*
13016  * Insert the ipif, so that the list of ipifs on the ill will be sorted
13017  * with respect to ipif_id. Note that an ipif with an ipif_id of -1 will
13018  * be inserted into the first space available in the list. The value of
13019  * ipif_id will then be set to the appropriate value for its position.
13020  */
13021 static int
13022 ipif_insert(ipif_t *ipif, boolean_t acquire_g_lock)
13023 {
13024 	ill_t *ill;
13025 	ipif_t *tipif;
13026 	ipif_t **tipifp;
13027 	int id;
13028 	ip_stack_t	*ipst;
13029 
13030 	ASSERT(ipif->ipif_ill->ill_net_type == IRE_LOOPBACK ||
13031 	    IAM_WRITER_IPIF(ipif));
13032 
13033 	ill = ipif->ipif_ill;
13034 	ASSERT(ill != NULL);
13035 	ipst = ill->ill_ipst;
13036 
13037 	/*
13038 	 * In the case of lo0:0 we already hold the ill_g_lock.
13039 	 * ill_lookup_on_name (acquires ill_g_lock) -> ipif_allocate ->
13040 	 * ipif_insert.
13041 	 */
13042 	if (acquire_g_lock)
13043 		rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
13044 	mutex_enter(&ill->ill_lock);
13045 	id = ipif->ipif_id;
13046 	tipifp = &(ill->ill_ipif);
13047 	if (id == -1) {	/* need to find a real id */
13048 		id = 0;
13049 		while ((tipif = *tipifp) != NULL) {
13050 			ASSERT(tipif->ipif_id >= id);
13051 			if (tipif->ipif_id != id)
13052 				break; /* non-consecutive id */
13053 			id++;
13054 			tipifp = &(tipif->ipif_next);
13055 		}
13056 		/* limit number of logical interfaces */
13057 		if (id >= ipst->ips_ip_addrs_per_if) {
13058 			mutex_exit(&ill->ill_lock);
13059 			if (acquire_g_lock)
13060 				rw_exit(&ipst->ips_ill_g_lock);
13061 			return (-1);
13062 		}
13063 		ipif->ipif_id = id; /* assign new id */
13064 	} else if (id < ipst->ips_ip_addrs_per_if) {
13065 		/* we have a real id; insert ipif in the right place */
13066 		while ((tipif = *tipifp) != NULL) {
13067 			ASSERT(tipif->ipif_id != id);
13068 			if (tipif->ipif_id > id)
13069 				break; /* found correct location */
13070 			tipifp = &(tipif->ipif_next);
13071 		}
13072 	} else {
13073 		mutex_exit(&ill->ill_lock);
13074 		if (acquire_g_lock)
13075 			rw_exit(&ipst->ips_ill_g_lock);
13076 		return (-1);
13077 	}
13078 
13079 	ASSERT(tipifp != &(ill->ill_ipif) || id == 0);
13080 
13081 	ipif->ipif_next = tipif;
13082 	*tipifp = ipif;
13083 	mutex_exit(&ill->ill_lock);
13084 	if (acquire_g_lock)
13085 		rw_exit(&ipst->ips_ill_g_lock);
13086 
13087 	return (0);
13088 }
13089 
13090 static void
13091 ipif_remove(ipif_t *ipif)
13092 {
13093 	ipif_t	**ipifp;
13094 	ill_t	*ill = ipif->ipif_ill;
13095 
13096 	ASSERT(RW_WRITE_HELD(&ill->ill_ipst->ips_ill_g_lock));
13097 
13098 	mutex_enter(&ill->ill_lock);
13099 	ipifp = &ill->ill_ipif;
13100 	for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
13101 		if (*ipifp == ipif) {
13102 			*ipifp = ipif->ipif_next;
13103 			break;
13104 		}
13105 	}
13106 	mutex_exit(&ill->ill_lock);
13107 }
13108 
13109 /*
13110  * Allocate and initialize a new interface control structure.  (Always
13111  * called as writer.)
13112  * When ipif_allocate() is called from ip_ll_subnet_defaults, the ill
13113  * is not part of the global linked list of ills. ipif_seqid is unique
13114  * in the system and to preserve the uniqueness, it is assigned only
13115  * when ill becomes part of the global list. At that point ill will
13116  * have a name. If it doesn't get assigned here, it will get assigned
13117  * in ipif_set_values() as part of SIOCSLIFNAME processing.
13118  * Aditionally, if we come here from ip_ll_subnet_defaults, we don't set
13119  * the interface flags or any other information from the DL_INFO_ACK for
13120  * DL_STYLE2 drivers (initialize == B_FALSE), since we won't have them at
13121  * this point. The flags etc. will be set in ip_ll_subnet_defaults when the
13122  * second DL_INFO_ACK comes in from the driver.
13123  */
13124 static ipif_t *
13125 ipif_allocate(ill_t *ill, int id, uint_t ire_type, boolean_t initialize,
13126     boolean_t insert)
13127 {
13128 	ipif_t	*ipif;
13129 	ip_stack_t *ipst = ill->ill_ipst;
13130 
13131 	ip1dbg(("ipif_allocate(%s:%d ill %p)\n",
13132 	    ill->ill_name, id, (void *)ill));
13133 	ASSERT(ire_type == IRE_LOOPBACK || IAM_WRITER_ILL(ill));
13134 
13135 	if ((ipif = (ipif_t *)mi_alloc(sizeof (ipif_t), BPRI_MED)) == NULL)
13136 		return (NULL);
13137 	*ipif = ipif_zero;	/* start clean */
13138 
13139 	ipif->ipif_ill = ill;
13140 	ipif->ipif_id = id;	/* could be -1 */
13141 	/*
13142 	 * Inherit the zoneid from the ill; for the shared stack instance
13143 	 * this is always the global zone
13144 	 */
13145 	ipif->ipif_zoneid = ill->ill_zoneid;
13146 
13147 	mutex_init(&ipif->ipif_saved_ire_lock, NULL, MUTEX_DEFAULT, NULL);
13148 
13149 	ipif->ipif_refcnt = 0;
13150 	ipif->ipif_saved_ire_cnt = 0;
13151 
13152 	if (insert) {
13153 		if (ipif_insert(ipif, ire_type != IRE_LOOPBACK) != 0) {
13154 			mi_free(ipif);
13155 			return (NULL);
13156 		}
13157 		/* -1 id should have been replaced by real id */
13158 		id = ipif->ipif_id;
13159 		ASSERT(id >= 0);
13160 	}
13161 
13162 	if (ill->ill_name[0] != '\0')
13163 		ipif_assign_seqid(ipif);
13164 
13165 	/*
13166 	 * If this is the zeroth ipif on the IPMP ill, create the illgrp
13167 	 * (which must not exist yet because the zeroth ipif is created once
13168 	 * per ill).  However, do not not link it to the ipmp_grp_t until
13169 	 * I_PLINK is called; see ip_sioctl_plink_ipmp() for details.
13170 	 */
13171 	if (id == 0 && IS_IPMP(ill)) {
13172 		if (ipmp_illgrp_create(ill) == NULL) {
13173 			if (insert) {
13174 				rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
13175 				ipif_remove(ipif);
13176 				rw_exit(&ipst->ips_ill_g_lock);
13177 			}
13178 			mi_free(ipif);
13179 			return (NULL);
13180 		}
13181 	}
13182 
13183 	/*
13184 	 * We grab ill_lock to protect the flag changes.  The ipif is still
13185 	 * not up and can't be looked up until the ioctl completes and the
13186 	 * IPIF_CHANGING flag is cleared.
13187 	 */
13188 	mutex_enter(&ill->ill_lock);
13189 
13190 	ipif->ipif_ire_type = ire_type;
13191 
13192 	if (ipif->ipif_isv6) {
13193 		ill->ill_flags |= ILLF_IPV6;
13194 	} else {
13195 		ipaddr_t inaddr_any = INADDR_ANY;
13196 
13197 		ill->ill_flags |= ILLF_IPV4;
13198 
13199 		/* Keep the IN6_IS_ADDR_V4MAPPED assertions happy */
13200 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13201 		    &ipif->ipif_v6lcl_addr);
13202 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13203 		    &ipif->ipif_v6src_addr);
13204 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13205 		    &ipif->ipif_v6subnet);
13206 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13207 		    &ipif->ipif_v6net_mask);
13208 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13209 		    &ipif->ipif_v6brd_addr);
13210 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13211 		    &ipif->ipif_v6pp_dst_addr);
13212 	}
13213 
13214 	/*
13215 	 * Don't set the interface flags etc. now, will do it in
13216 	 * ip_ll_subnet_defaults.
13217 	 */
13218 	if (!initialize)
13219 		goto out;
13220 
13221 	ipif->ipif_mtu = ill->ill_max_mtu;
13222 
13223 	/*
13224 	 * NOTE: The IPMP meta-interface is special-cased because it starts
13225 	 * with no underlying interfaces (and thus an unknown broadcast
13226 	 * address length), but all interfaces that can be placed into an IPMP
13227 	 * group are required to be broadcast-capable.
13228 	 */
13229 	if (ill->ill_bcast_addr_length != 0 || IS_IPMP(ill)) {
13230 		/*
13231 		 * Later detect lack of DLPI driver multicast capability by
13232 		 * catching DL_ENABMULTI_REQ errors in ip_rput_dlpi().
13233 		 */
13234 		ill->ill_flags |= ILLF_MULTICAST;
13235 		if (!ipif->ipif_isv6)
13236 			ipif->ipif_flags |= IPIF_BROADCAST;
13237 	} else {
13238 		if (ill->ill_net_type != IRE_LOOPBACK) {
13239 			if (ipif->ipif_isv6)
13240 				/*
13241 				 * Note: xresolv interfaces will eventually need
13242 				 * NOARP set here as well, but that will require
13243 				 * those external resolvers to have some
13244 				 * knowledge of that flag and act appropriately.
13245 				 * Not to be changed at present.
13246 				 */
13247 				ill->ill_flags |= ILLF_NONUD;
13248 			else
13249 				ill->ill_flags |= ILLF_NOARP;
13250 		}
13251 		if (ill->ill_phys_addr_length == 0) {
13252 			if (IS_VNI(ill)) {
13253 				ipif->ipif_flags |= IPIF_NOXMIT;
13254 			} else {
13255 				/* pt-pt supports multicast. */
13256 				ill->ill_flags |= ILLF_MULTICAST;
13257 				if (ill->ill_net_type != IRE_LOOPBACK)
13258 					ipif->ipif_flags |= IPIF_POINTOPOINT;
13259 			}
13260 		}
13261 	}
13262 out:
13263 	mutex_exit(&ill->ill_lock);
13264 	return (ipif);
13265 }
13266 
13267 /*
13268  * If appropriate, send a message up to the resolver delete the entry
13269  * for the address of this interface which is going out of business.
13270  * (Always called as writer).
13271  *
13272  * NOTE : We need to check for NULL mps as some of the fields are
13273  *	  initialized only for some interface types. See ipif_resolver_up()
13274  *	  for details.
13275  */
13276 void
13277 ipif_resolver_down(ipif_t *ipif)
13278 {
13279 	mblk_t	*mp;
13280 	ill_t	*ill = ipif->ipif_ill;
13281 
13282 	ip1dbg(("ipif_resolver_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
13283 	ASSERT(IAM_WRITER_IPIF(ipif));
13284 
13285 	if (ill->ill_isv6 && !(ill->ill_flags & ILLF_XRESOLV))
13286 		return;
13287 
13288 	/* Delete the mapping for the local address */
13289 	mp = ipif->ipif_arp_del_mp;
13290 	if (mp != NULL) {
13291 		ip1dbg(("ipif_resolver_down: arp cmd %x for %s:%u\n",
13292 		    *(unsigned *)mp->b_rptr, ill->ill_name, ipif->ipif_id));
13293 		putnext(ill->ill_rq, mp);
13294 		ipif->ipif_arp_del_mp = NULL;
13295 	}
13296 
13297 	/*
13298 	 * Make IPMP aware of the deleted data address.
13299 	 */
13300 	if (IS_IPMP(ill))
13301 		ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
13302 
13303 	/*
13304 	 * If this is the last ipif that is going down and there are no
13305 	 * duplicate addresses we may yet attempt to re-probe, then we need to
13306 	 * clean up ARP completely.
13307 	 */
13308 	if (ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0) {
13309 		/*
13310 		 * If this was the last ipif on an IPMP interface, purge any
13311 		 * IPMP ARP entries associated with it.
13312 		 */
13313 		if (IS_IPMP(ill))
13314 			ipmp_illgrp_refresh_arpent(ill->ill_grp);
13315 
13316 		/* Send up AR_INTERFACE_DOWN message */
13317 		mp = ill->ill_arp_down_mp;
13318 		if (mp != NULL) {
13319 			ip1dbg(("ipif_resolver_down: arp cmd %x for %s:%u\n",
13320 			    *(unsigned *)mp->b_rptr, ill->ill_name,
13321 			    ipif->ipif_id));
13322 			putnext(ill->ill_rq, mp);
13323 			ill->ill_arp_down_mp = NULL;
13324 		}
13325 
13326 		/* Tell ARP to delete the multicast mappings */
13327 		mp = ill->ill_arp_del_mapping_mp;
13328 		if (mp != NULL) {
13329 			ip1dbg(("ipif_resolver_down: arp cmd %x for %s:%u\n",
13330 			    *(unsigned *)mp->b_rptr, ill->ill_name,
13331 			    ipif->ipif_id));
13332 			putnext(ill->ill_rq, mp);
13333 			ill->ill_arp_del_mapping_mp = NULL;
13334 		}
13335 	}
13336 }
13337 
13338 /*
13339  * Set up the multicast mappings for `ipif' in ARP.  If `arp_add_mapping_mp'
13340  * is non-NULL, then upon success it will contain an mblk that can be passed
13341  * to ARP to create the mapping.  Otherwise, if it's NULL, upon success ARP
13342  * will have already been notified to create the mapping.  Returns zero on
13343  * success, -1 upon failure.
13344  */
13345 int
13346 ipif_arp_setup_multicast(ipif_t *ipif, mblk_t **arp_add_mapping_mp)
13347 {
13348 	mblk_t	*del_mp = NULL;
13349 	mblk_t *add_mp = NULL;
13350 	mblk_t *mp;
13351 	ill_t	*ill = ipif->ipif_ill;
13352 	phyint_t *phyi = ill->ill_phyint;
13353 	ipaddr_t addr, mask, extract_mask = 0;
13354 	arma_t	*arma;
13355 	uint8_t *maddr, *bphys_addr;
13356 	uint32_t hw_start;
13357 	dl_unitdata_req_t *dlur;
13358 
13359 	ASSERT(IAM_WRITER_IPIF(ipif));
13360 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
13361 		return (0);
13362 
13363 	/*
13364 	 * IPMP meta-interfaces don't have any inherent multicast mappings,
13365 	 * and instead use the ones on the underlying interfaces.
13366 	 */
13367 	if (IS_IPMP(ill))
13368 		return (0);
13369 
13370 	/*
13371 	 * Delete the existing mapping from ARP.  Normally, ipif_down() ->
13372 	 * ipif_resolver_down() will send this up to ARP, but it may be that
13373 	 * we are enabling PHYI_MULTI_BCAST via ip_rput_dlpi_writer().
13374 	 */
13375 	mp = ill->ill_arp_del_mapping_mp;
13376 	if (mp != NULL) {
13377 		ip1dbg(("ipif_arp_setup_multicast: arp cmd %x for %s:%u\n",
13378 		    *(unsigned *)mp->b_rptr, ill->ill_name, ipif->ipif_id));
13379 		putnext(ill->ill_rq, mp);
13380 		ill->ill_arp_del_mapping_mp = NULL;
13381 	}
13382 
13383 	if (arp_add_mapping_mp != NULL)
13384 		*arp_add_mapping_mp = NULL;
13385 
13386 	/*
13387 	 * Check that the address is not to long for the constant
13388 	 * length reserved in the template arma_t.
13389 	 */
13390 	if (ill->ill_phys_addr_length > IP_MAX_HW_LEN)
13391 		return (-1);
13392 
13393 	/* Add mapping mblk */
13394 	addr = (ipaddr_t)htonl(INADDR_UNSPEC_GROUP);
13395 	mask = (ipaddr_t)htonl(IN_CLASSD_NET);
13396 	add_mp = ill_arp_alloc(ill, (uchar_t *)&ip_arma_multi_template,
13397 	    (caddr_t)&addr);
13398 	if (add_mp == NULL)
13399 		return (-1);
13400 	arma = (arma_t *)add_mp->b_rptr;
13401 	maddr = (uint8_t *)arma + arma->arma_hw_addr_offset;
13402 	bcopy(&mask, (char *)arma + arma->arma_proto_mask_offset, IP_ADDR_LEN);
13403 	arma->arma_hw_addr_length = ill->ill_phys_addr_length;
13404 
13405 	/*
13406 	 * Determine the broadcast address.
13407 	 */
13408 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
13409 	if (ill->ill_sap_length < 0)
13410 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
13411 	else
13412 		bphys_addr = (uchar_t *)dlur +
13413 		    dlur->dl_dest_addr_offset + ill->ill_sap_length;
13414 	/*
13415 	 * Check PHYI_MULTI_BCAST and length of physical
13416 	 * address to determine if we use the mapping or the
13417 	 * broadcast address.
13418 	 */
13419 	if (!(phyi->phyint_flags & PHYI_MULTI_BCAST))
13420 		if (!MEDIA_V4MINFO(ill->ill_media, ill->ill_phys_addr_length,
13421 		    bphys_addr, maddr, &hw_start, &extract_mask))
13422 			phyi->phyint_flags |= PHYI_MULTI_BCAST;
13423 
13424 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) ||
13425 	    (ill->ill_flags & ILLF_MULTICAST)) {
13426 		/* Make sure this will not match the "exact" entry. */
13427 		addr = (ipaddr_t)htonl(INADDR_ALLHOSTS_GROUP);
13428 		del_mp = ill_arp_alloc(ill, (uchar_t *)&ip_ared_template,
13429 		    (caddr_t)&addr);
13430 		if (del_mp == NULL) {
13431 			freemsg(add_mp);
13432 			return (-1);
13433 		}
13434 		bcopy(&extract_mask, (char *)arma +
13435 		    arma->arma_proto_extract_mask_offset, IP_ADDR_LEN);
13436 		if (phyi->phyint_flags & PHYI_MULTI_BCAST) {
13437 			/* Use link-layer broadcast address for MULTI_BCAST */
13438 			bcopy(bphys_addr, maddr, ill->ill_phys_addr_length);
13439 			ip2dbg(("ipif_arp_setup_multicast: adding"
13440 			    " MULTI_BCAST ARP setup for %s\n", ill->ill_name));
13441 		} else {
13442 			arma->arma_hw_mapping_start = hw_start;
13443 			ip2dbg(("ipif_arp_setup_multicast: adding multicast"
13444 			    " ARP setup for %s\n", ill->ill_name));
13445 		}
13446 	} else {
13447 		freemsg(add_mp);
13448 		ASSERT(del_mp == NULL);
13449 		/* It is neither MULTICAST nor MULTI_BCAST */
13450 		return (0);
13451 	}
13452 	ASSERT(add_mp != NULL && del_mp != NULL);
13453 	ASSERT(ill->ill_arp_del_mapping_mp == NULL);
13454 	ill->ill_arp_del_mapping_mp = del_mp;
13455 	if (arp_add_mapping_mp != NULL) {
13456 		/* The caller just wants the mblks allocated */
13457 		*arp_add_mapping_mp = add_mp;
13458 	} else {
13459 		/* The caller wants us to send it to arp */
13460 		putnext(ill->ill_rq, add_mp);
13461 	}
13462 	return (0);
13463 }
13464 
13465 /*
13466  * Get the resolver set up for a new IP address.  (Always called as writer.)
13467  * Called both for IPv4 and IPv6 interfaces, though it only sets up the
13468  * resolver for v6 if it's an ILLF_XRESOLV interface.  Honors ILLF_NOARP.
13469  *
13470  * The enumerated value res_act tunes the behavior:
13471  * 	* Res_act_initial: set up all the resolver structures for a new
13472  *	  IP address.
13473  *	* Res_act_defend: tell ARP that it needs to send a single gratuitous
13474  *	  ARP message in defense of the address.
13475  *	* Res_act_rebind: tell ARP to change the hardware address for an IP
13476  *	  address (and issue gratuitous ARPs).  Used by ipmp_ill_bind_ipif().
13477  *
13478  * Returns zero on success, or an errno upon failure.
13479  */
13480 int
13481 ipif_resolver_up(ipif_t *ipif, enum ip_resolver_action res_act)
13482 {
13483 	mblk_t	*arp_up_mp = NULL;
13484 	mblk_t	*arp_down_mp = NULL;
13485 	mblk_t	*arp_add_mp = NULL;
13486 	mblk_t	*arp_del_mp = NULL;
13487 	mblk_t	*arp_add_mapping_mp = NULL;
13488 	mblk_t	*arp_del_mapping_mp = NULL;
13489 	ill_t	*ill = ipif->ipif_ill;
13490 	int	err = ENOMEM;
13491 	boolean_t added_ipif = B_FALSE;
13492 	boolean_t publish;
13493 	boolean_t was_dup;
13494 
13495 	ip1dbg(("ipif_resolver_up(%s:%u) flags 0x%x\n",
13496 	    ill->ill_name, ipif->ipif_id, (uint_t)ipif->ipif_flags));
13497 	ASSERT(IAM_WRITER_IPIF(ipif));
13498 
13499 	was_dup = B_FALSE;
13500 	if (res_act == Res_act_initial) {
13501 		ipif->ipif_addr_ready = 0;
13502 		/*
13503 		 * We're bringing an interface up here.  There's no way that we
13504 		 * should need to shut down ARP now.
13505 		 */
13506 		mutex_enter(&ill->ill_lock);
13507 		if (ipif->ipif_flags & IPIF_DUPLICATE) {
13508 			ipif->ipif_flags &= ~IPIF_DUPLICATE;
13509 			ill->ill_ipif_dup_count--;
13510 			was_dup = B_TRUE;
13511 		}
13512 		mutex_exit(&ill->ill_lock);
13513 	}
13514 	if (ipif->ipif_recovery_id != 0)
13515 		(void) untimeout(ipif->ipif_recovery_id);
13516 	ipif->ipif_recovery_id = 0;
13517 	if (ill->ill_net_type != IRE_IF_RESOLVER) {
13518 		ipif->ipif_addr_ready = 1;
13519 		return (0);
13520 	}
13521 	/* NDP will set the ipif_addr_ready flag when it's ready */
13522 	if (ill->ill_isv6 && !(ill->ill_flags & ILLF_XRESOLV))
13523 		return (0);
13524 
13525 	if (ill->ill_isv6) {
13526 		/*
13527 		 * External resolver for IPv6
13528 		 */
13529 		ASSERT(res_act == Res_act_initial);
13530 		publish = !IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr);
13531 	} else {
13532 		/*
13533 		 * IPv4 arp case. If the ARP stream has already started
13534 		 * closing, fail this request for ARP bringup. Else
13535 		 * record the fact that an ARP bringup is pending.
13536 		 */
13537 		mutex_enter(&ill->ill_lock);
13538 		if (ill->ill_arp_closing) {
13539 			mutex_exit(&ill->ill_lock);
13540 			err = EINVAL;
13541 			goto failed;
13542 		} else {
13543 			if (ill->ill_ipif_up_count == 0 &&
13544 			    ill->ill_ipif_dup_count == 0 && !was_dup)
13545 				ill->ill_arp_bringup_pending = 1;
13546 			mutex_exit(&ill->ill_lock);
13547 		}
13548 		publish = (ipif->ipif_lcl_addr != INADDR_ANY);
13549 	}
13550 
13551 	if (IS_IPMP(ill) && publish) {
13552 		/*
13553 		 * If we're here via ipif_up(), then the ipif won't be bound
13554 		 * yet -- add it to the group, which will bind it if possible.
13555 		 * (We would add it in ipif_up(), but deleting on failure
13556 		 * there is gruesome.)  If we're here via ipmp_ill_bind_ipif(),
13557 		 * then the ipif has already been added to the group and we
13558 		 * just need to use the binding.
13559 		 */
13560 		if (ipmp_ipif_bound_ill(ipif) == NULL) {
13561 			if (ipmp_illgrp_add_ipif(ill->ill_grp, ipif) == NULL) {
13562 				/*
13563 				 * We couldn't bind the ipif to an ill yet,
13564 				 * so we have nothing to publish.
13565 				 */
13566 				publish = B_FALSE;
13567 			}
13568 			added_ipif = B_TRUE;
13569 		}
13570 	}
13571 
13572 	/*
13573 	 * Add an entry for the local address in ARP only if it
13574 	 * is not UNNUMBERED and it is suitable for publishing.
13575 	 */
13576 	if (!(ipif->ipif_flags & IPIF_UNNUMBERED) && publish) {
13577 		if (res_act == Res_act_defend) {
13578 			arp_add_mp = ipif_area_alloc(ipif, ACE_F_DEFEND);
13579 			if (arp_add_mp == NULL)
13580 				goto failed;
13581 			/*
13582 			 * If we're just defending our address now, then
13583 			 * there's no need to set up ARP multicast mappings.
13584 			 * The publish command is enough.
13585 			 */
13586 			goto done;
13587 		}
13588 
13589 		/*
13590 		 * Allocate an ARP add message and an ARP delete message (the
13591 		 * latter is saved for use when the address goes down).
13592 		 */
13593 		if ((arp_add_mp = ipif_area_alloc(ipif, 0)) == NULL)
13594 			goto failed;
13595 
13596 		if ((arp_del_mp = ipif_ared_alloc(ipif)) == NULL)
13597 			goto failed;
13598 
13599 		if (res_act != Res_act_initial)
13600 			goto arp_setup_multicast;
13601 	} else {
13602 		if (res_act != Res_act_initial)
13603 			goto done;
13604 	}
13605 	/*
13606 	 * Need to bring up ARP or setup multicast mapping only
13607 	 * when the first interface is coming UP.
13608 	 */
13609 	if (ill->ill_ipif_up_count + ill->ill_ipif_dup_count > 0 || was_dup)
13610 		goto done;
13611 
13612 	/*
13613 	 * Allocate an ARP down message (to be saved) and an ARP up message.
13614 	 */
13615 	arp_down_mp = ill_arp_alloc(ill, (uchar_t *)&ip_ard_template, 0);
13616 	if (arp_down_mp == NULL)
13617 		goto failed;
13618 
13619 	arp_up_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aru_template, 0);
13620 	if (arp_up_mp == NULL)
13621 		goto failed;
13622 
13623 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
13624 		goto done;
13625 
13626 arp_setup_multicast:
13627 	/*
13628 	 * Setup the multicast mappings. This function initializes
13629 	 * ill_arp_del_mapping_mp also. This does not need to be done for
13630 	 * IPv6, or for the IPMP interface (since it has no link-layer).
13631 	 */
13632 	if (!ill->ill_isv6 && !IS_IPMP(ill)) {
13633 		err = ipif_arp_setup_multicast(ipif, &arp_add_mapping_mp);
13634 		if (err != 0)
13635 			goto failed;
13636 		ASSERT(ill->ill_arp_del_mapping_mp != NULL);
13637 		ASSERT(arp_add_mapping_mp != NULL);
13638 	}
13639 done:
13640 	if (arp_up_mp != NULL) {
13641 		ip1dbg(("ipif_resolver_up: ARP_UP for %s:%u\n",
13642 		    ill->ill_name, ipif->ipif_id));
13643 		putnext(ill->ill_rq, arp_up_mp);
13644 		arp_up_mp = NULL;
13645 	}
13646 	if (arp_add_mp != NULL) {
13647 		ip1dbg(("ipif_resolver_up: ARP_ADD for %s:%u\n",
13648 		    ill->ill_name, ipif->ipif_id));
13649 		/*
13650 		 * If it's an extended ARP implementation, then we'll wait to
13651 		 * hear that DAD has finished before using the interface.
13652 		 */
13653 		if (!ill->ill_arp_extend)
13654 			ipif->ipif_addr_ready = 1;
13655 		putnext(ill->ill_rq, arp_add_mp);
13656 		arp_add_mp = NULL;
13657 	} else {
13658 		ipif->ipif_addr_ready = 1;
13659 	}
13660 	if (arp_add_mapping_mp != NULL) {
13661 		ip1dbg(("ipif_resolver_up: MAPPING_ADD for %s:%u\n",
13662 		    ill->ill_name, ipif->ipif_id));
13663 		putnext(ill->ill_rq, arp_add_mapping_mp);
13664 		arp_add_mapping_mp = NULL;
13665 	}
13666 
13667 	if (res_act == Res_act_initial) {
13668 		if (ill->ill_flags & ILLF_NOARP)
13669 			err = ill_arp_off(ill);
13670 		else
13671 			err = ill_arp_on(ill);
13672 		if (err != 0) {
13673 			ip0dbg(("ipif_resolver_up: arp_on/off failed %d\n",
13674 			    err));
13675 			goto failed;
13676 		}
13677 	}
13678 
13679 	if (arp_del_mp != NULL) {
13680 		ASSERT(ipif->ipif_arp_del_mp == NULL);
13681 		ipif->ipif_arp_del_mp = arp_del_mp;
13682 	}
13683 	if (arp_down_mp != NULL) {
13684 		ASSERT(ill->ill_arp_down_mp == NULL);
13685 		ill->ill_arp_down_mp = arp_down_mp;
13686 	}
13687 	if (arp_del_mapping_mp != NULL) {
13688 		ASSERT(ill->ill_arp_del_mapping_mp == NULL);
13689 		ill->ill_arp_del_mapping_mp = arp_del_mapping_mp;
13690 	}
13691 
13692 	return ((ill->ill_ipif_up_count != 0 || was_dup ||
13693 	    ill->ill_ipif_dup_count != 0) ? 0 : EINPROGRESS);
13694 failed:
13695 	ip1dbg(("ipif_resolver_up: FAILED\n"));
13696 	if (added_ipif)
13697 		ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
13698 	freemsg(arp_add_mp);
13699 	freemsg(arp_del_mp);
13700 	freemsg(arp_add_mapping_mp);
13701 	freemsg(arp_up_mp);
13702 	freemsg(arp_down_mp);
13703 	ill->ill_arp_bringup_pending = 0;
13704 	return (err);
13705 }
13706 
13707 /*
13708  * This routine restarts IPv4 duplicate address detection (DAD) when a link has
13709  * just gone back up.
13710  */
13711 static void
13712 ipif_arp_start_dad(ipif_t *ipif)
13713 {
13714 	ill_t *ill = ipif->ipif_ill;
13715 	mblk_t *arp_add_mp;
13716 
13717 	/* ACE_F_UNVERIFIED restarts DAD */
13718 	if (ill->ill_net_type != IRE_IF_RESOLVER || ill->ill_arp_closing ||
13719 	    (ipif->ipif_flags & IPIF_UNNUMBERED) ||
13720 	    ipif->ipif_lcl_addr == INADDR_ANY ||
13721 	    (arp_add_mp = ipif_area_alloc(ipif, ACE_F_UNVERIFIED)) == NULL) {
13722 		/*
13723 		 * If we can't contact ARP for some reason, that's not really a
13724 		 * problem.  Just send out the routing socket notification that
13725 		 * DAD completion would have done, and continue.
13726 		 */
13727 		ipif_mask_reply(ipif);
13728 		ipif_up_notify(ipif);
13729 		ipif->ipif_addr_ready = 1;
13730 		return;
13731 	}
13732 
13733 	putnext(ill->ill_rq, arp_add_mp);
13734 }
13735 
13736 static void
13737 ipif_ndp_start_dad(ipif_t *ipif)
13738 {
13739 	nce_t *nce;
13740 
13741 	nce = ndp_lookup_v6(ipif->ipif_ill, B_TRUE, &ipif->ipif_v6lcl_addr,
13742 	    B_FALSE);
13743 	if (nce == NULL)
13744 		return;
13745 
13746 	if (!ndp_restart_dad(nce)) {
13747 		/*
13748 		 * If we can't restart DAD for some reason, that's not really a
13749 		 * problem.  Just send out the routing socket notification that
13750 		 * DAD completion would have done, and continue.
13751 		 */
13752 		ipif_up_notify(ipif);
13753 		ipif->ipif_addr_ready = 1;
13754 	}
13755 	NCE_REFRELE(nce);
13756 }
13757 
13758 /*
13759  * Restart duplicate address detection on all interfaces on the given ill.
13760  *
13761  * This is called when an interface transitions from down to up
13762  * (DL_NOTE_LINK_UP) or up to down (DL_NOTE_LINK_DOWN).
13763  *
13764  * Note that since the underlying physical link has transitioned, we must cause
13765  * at least one routing socket message to be sent here, either via DAD
13766  * completion or just by default on the first ipif.  (If we don't do this, then
13767  * in.mpathd will see long delays when doing link-based failure recovery.)
13768  */
13769 void
13770 ill_restart_dad(ill_t *ill, boolean_t went_up)
13771 {
13772 	ipif_t *ipif;
13773 
13774 	if (ill == NULL)
13775 		return;
13776 
13777 	/*
13778 	 * If layer two doesn't support duplicate address detection, then just
13779 	 * send the routing socket message now and be done with it.
13780 	 */
13781 	if ((ill->ill_isv6 && (ill->ill_flags & ILLF_XRESOLV)) ||
13782 	    (!ill->ill_isv6 && !ill->ill_arp_extend)) {
13783 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
13784 		return;
13785 	}
13786 
13787 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13788 		if (went_up) {
13789 			if (ipif->ipif_flags & IPIF_UP) {
13790 				if (ill->ill_isv6)
13791 					ipif_ndp_start_dad(ipif);
13792 				else
13793 					ipif_arp_start_dad(ipif);
13794 			} else if (ill->ill_isv6 &&
13795 			    (ipif->ipif_flags & IPIF_DUPLICATE)) {
13796 				/*
13797 				 * For IPv4, the ARP module itself will
13798 				 * automatically start the DAD process when it
13799 				 * sees DL_NOTE_LINK_UP.  We respond to the
13800 				 * AR_CN_READY at the completion of that task.
13801 				 * For IPv6, we must kick off the bring-up
13802 				 * process now.
13803 				 */
13804 				ndp_do_recovery(ipif);
13805 			} else {
13806 				/*
13807 				 * Unfortunately, the first ipif is "special"
13808 				 * and represents the underlying ill in the
13809 				 * routing socket messages.  Thus, when this
13810 				 * one ipif is down, we must still notify so
13811 				 * that the user knows the IFF_RUNNING status
13812 				 * change.  (If the first ipif is up, then
13813 				 * we'll handle eventual routing socket
13814 				 * notification via DAD completion.)
13815 				 */
13816 				if (ipif == ill->ill_ipif) {
13817 					ip_rts_ifmsg(ill->ill_ipif,
13818 					    RTSQ_DEFAULT);
13819 				}
13820 			}
13821 		} else {
13822 			/*
13823 			 * After link down, we'll need to send a new routing
13824 			 * message when the link comes back, so clear
13825 			 * ipif_addr_ready.
13826 			 */
13827 			ipif->ipif_addr_ready = 0;
13828 		}
13829 	}
13830 
13831 	/*
13832 	 * If we've torn down links, then notify the user right away.
13833 	 */
13834 	if (!went_up)
13835 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
13836 }
13837 
13838 static void
13839 ipsq_delete(ipsq_t *ipsq)
13840 {
13841 	ipxop_t *ipx = ipsq->ipsq_xop;
13842 
13843 	ipsq->ipsq_ipst = NULL;
13844 	ASSERT(ipsq->ipsq_phyint == NULL);
13845 	ASSERT(ipsq->ipsq_xop != NULL);
13846 	ASSERT(ipsq->ipsq_xopq_mphead == NULL && ipx->ipx_mphead == NULL);
13847 	ASSERT(ipx->ipx_pending_mp == NULL);
13848 	kmem_free(ipsq, sizeof (ipsq_t));
13849 }
13850 
13851 static int
13852 ill_up_ipifs_on_ill(ill_t *ill, queue_t *q, mblk_t *mp)
13853 {
13854 	int err;
13855 	ipif_t *ipif;
13856 
13857 	if (ill == NULL)
13858 		return (0);
13859 
13860 	ASSERT(IAM_WRITER_ILL(ill));
13861 	ill->ill_up_ipifs = B_TRUE;
13862 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13863 		if (ipif->ipif_was_up) {
13864 			if (!(ipif->ipif_flags & IPIF_UP))
13865 				err = ipif_up(ipif, q, mp);
13866 			ipif->ipif_was_up = B_FALSE;
13867 			if (err != 0) {
13868 				ASSERT(err == EINPROGRESS);
13869 				return (err);
13870 			}
13871 		}
13872 	}
13873 	mutex_enter(&ill->ill_lock);
13874 	ill->ill_state_flags &= ~ILL_CHANGING;
13875 	mutex_exit(&ill->ill_lock);
13876 	ill->ill_up_ipifs = B_FALSE;
13877 	return (0);
13878 }
13879 
13880 /*
13881  * This function is called to bring up all the ipifs that were up before
13882  * bringing the ill down via ill_down_ipifs().
13883  */
13884 int
13885 ill_up_ipifs(ill_t *ill, queue_t *q, mblk_t *mp)
13886 {
13887 	int err;
13888 
13889 	ASSERT(IAM_WRITER_ILL(ill));
13890 
13891 	err = ill_up_ipifs_on_ill(ill->ill_phyint->phyint_illv4, q, mp);
13892 	if (err != 0)
13893 		return (err);
13894 
13895 	return (ill_up_ipifs_on_ill(ill->ill_phyint->phyint_illv6, q, mp));
13896 }
13897 
13898 /*
13899  * Bring down any IPIF_UP ipifs on ill. If "logical" is B_TRUE, we bring
13900  * down the ipifs without sending DL_UNBIND_REQ to the driver.
13901  */
13902 static void
13903 ill_down_ipifs(ill_t *ill, boolean_t logical)
13904 {
13905 	ipif_t *ipif;
13906 
13907 	ASSERT(IAM_WRITER_ILL(ill));
13908 
13909 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13910 		/*
13911 		 * We go through the ipif_down logic even if the ipif
13912 		 * is already down, since routes can be added based
13913 		 * on down ipifs. Going through ipif_down once again
13914 		 * will delete any IREs created based on these routes.
13915 		 */
13916 		if (ipif->ipif_flags & IPIF_UP)
13917 			ipif->ipif_was_up = B_TRUE;
13918 
13919 		/*
13920 		 * Need to re-create net/subnet bcast ires if
13921 		 * they are dependent on ipif.
13922 		 */
13923 		if (!ipif->ipif_isv6)
13924 			ipif_check_bcast_ires(ipif);
13925 		if (logical) {
13926 			(void) ipif_logical_down(ipif, NULL, NULL);
13927 			ipif_non_duplicate(ipif);
13928 			ipif_down_tail(ipif);
13929 		} else {
13930 			(void) ipif_down(ipif, NULL, NULL);
13931 		}
13932 	}
13933 }
13934 
13935 /*
13936  * Redo source address selection.  This is called when a
13937  * non-NOLOCAL/DEPRECATED/ANYCAST ipif comes up.
13938  */
13939 void
13940 ill_update_source_selection(ill_t *ill)
13941 {
13942 	ipif_t *ipif;
13943 
13944 	ASSERT(IAM_WRITER_ILL(ill));
13945 
13946 	/*
13947 	 * Underlying interfaces are only used for test traffic and thus
13948 	 * should always send with their (deprecated) source addresses.
13949 	 */
13950 	if (IS_UNDER_IPMP(ill))
13951 		return;
13952 
13953 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13954 		if (ill->ill_isv6)
13955 			ipif_recreate_interface_routes_v6(NULL, ipif);
13956 		else
13957 			ipif_recreate_interface_routes(NULL, ipif);
13958 	}
13959 }
13960 
13961 /*
13962  * Finish the group join started in ip_sioctl_groupname().
13963  */
13964 /* ARGSUSED */
13965 static void
13966 ip_join_illgrps(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy)
13967 {
13968 	ill_t		*ill = q->q_ptr;
13969 	phyint_t	*phyi = ill->ill_phyint;
13970 	ipmp_grp_t	*grp = phyi->phyint_grp;
13971 	ip_stack_t	*ipst = ill->ill_ipst;
13972 
13973 	/* IS_UNDER_IPMP() won't work until ipmp_ill_join_illgrp() is called */
13974 	ASSERT(!IS_IPMP(ill) && grp != NULL);
13975 	ASSERT(IAM_WRITER_IPSQ(ipsq));
13976 
13977 	if (phyi->phyint_illv4 != NULL) {
13978 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
13979 		VERIFY(grp->gr_pendv4-- > 0);
13980 		rw_exit(&ipst->ips_ipmp_lock);
13981 		ipmp_ill_join_illgrp(phyi->phyint_illv4, grp->gr_v4);
13982 	}
13983 	if (phyi->phyint_illv6 != NULL) {
13984 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
13985 		VERIFY(grp->gr_pendv6-- > 0);
13986 		rw_exit(&ipst->ips_ipmp_lock);
13987 		ipmp_ill_join_illgrp(phyi->phyint_illv6, grp->gr_v6);
13988 	}
13989 	freemsg(mp);
13990 }
13991 
13992 /*
13993  * Process an SIOCSLIFGROUPNAME request.
13994  */
13995 /* ARGSUSED */
13996 int
13997 ip_sioctl_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
13998     ip_ioctl_cmd_t *ipip, void *ifreq)
13999 {
14000 	struct lifreq	*lifr = ifreq;
14001 	ill_t		*ill = ipif->ipif_ill;
14002 	ip_stack_t	*ipst = ill->ill_ipst;
14003 	phyint_t	*phyi = ill->ill_phyint;
14004 	ipmp_grp_t	*grp = phyi->phyint_grp;
14005 	mblk_t		*ipsq_mp;
14006 	int		err = 0;
14007 
14008 	/*
14009 	 * Note that phyint_grp can only change here, where we're exclusive.
14010 	 */
14011 	ASSERT(IAM_WRITER_ILL(ill));
14012 
14013 	if (ipif->ipif_id != 0 || ill->ill_usesrc_grp_next != NULL ||
14014 	    (phyi->phyint_flags & PHYI_VIRTUAL))
14015 		return (EINVAL);
14016 
14017 	lifr->lifr_groupname[LIFGRNAMSIZ - 1] = '\0';
14018 
14019 	rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
14020 
14021 	/*
14022 	 * If the name hasn't changed, there's nothing to do.
14023 	 */
14024 	if (grp != NULL && strcmp(grp->gr_name, lifr->lifr_groupname) == 0)
14025 		goto unlock;
14026 
14027 	/*
14028 	 * Handle requests to rename an IPMP meta-interface.
14029 	 *
14030 	 * Note that creation of the IPMP meta-interface is handled in
14031 	 * userland through the standard plumbing sequence.  As part of the
14032 	 * plumbing the IPMP meta-interface, its initial groupname is set to
14033 	 * the name of the interface (see ipif_set_values_tail()).
14034 	 */
14035 	if (IS_IPMP(ill)) {
14036 		err = ipmp_grp_rename(grp, lifr->lifr_groupname);
14037 		goto unlock;
14038 	}
14039 
14040 	/*
14041 	 * Handle requests to add or remove an IP interface from a group.
14042 	 */
14043 	if (lifr->lifr_groupname[0] != '\0') {			/* add */
14044 		/*
14045 		 * Moves are handled by first removing the interface from
14046 		 * its existing group, and then adding it to another group.
14047 		 * So, fail if it's already in a group.
14048 		 */
14049 		if (IS_UNDER_IPMP(ill)) {
14050 			err = EALREADY;
14051 			goto unlock;
14052 		}
14053 
14054 		grp = ipmp_grp_lookup(lifr->lifr_groupname, ipst);
14055 		if (grp == NULL) {
14056 			err = ENOENT;
14057 			goto unlock;
14058 		}
14059 
14060 		/*
14061 		 * Check if the phyint and its ills are suitable for
14062 		 * inclusion into the group.
14063 		 */
14064 		if ((err = ipmp_grp_vet_phyint(grp, phyi)) != 0)
14065 			goto unlock;
14066 
14067 		/*
14068 		 * Checks pass; join the group, and enqueue the remaining
14069 		 * illgrp joins for when we've become part of the group xop
14070 		 * and are exclusive across its IPSQs.  Since qwriter_ip()
14071 		 * requires an mblk_t to scribble on, and since `mp' will be
14072 		 * freed as part of completing the ioctl, allocate another.
14073 		 */
14074 		if ((ipsq_mp = allocb(0, BPRI_MED)) == NULL) {
14075 			err = ENOMEM;
14076 			goto unlock;
14077 		}
14078 
14079 		/*
14080 		 * Before we drop ipmp_lock, bump gr_pend* to ensure that the
14081 		 * IPMP meta-interface ills needed by `phyi' cannot go away
14082 		 * before ip_join_illgrps() is called back.  See the comments
14083 		 * in ip_sioctl_plink_ipmp() for more.
14084 		 */
14085 		if (phyi->phyint_illv4 != NULL)
14086 			grp->gr_pendv4++;
14087 		if (phyi->phyint_illv6 != NULL)
14088 			grp->gr_pendv6++;
14089 
14090 		rw_exit(&ipst->ips_ipmp_lock);
14091 
14092 		ipmp_phyint_join_grp(phyi, grp);
14093 		ill_refhold(ill);
14094 		qwriter_ip(ill, ill->ill_rq, ipsq_mp, ip_join_illgrps,
14095 		    SWITCH_OP, B_FALSE);
14096 		return (0);
14097 	} else {
14098 		/*
14099 		 * Request to remove the interface from a group.  If the
14100 		 * interface is not in a group, this trivially succeeds.
14101 		 */
14102 		rw_exit(&ipst->ips_ipmp_lock);
14103 		if (IS_UNDER_IPMP(ill))
14104 			ipmp_phyint_leave_grp(phyi);
14105 		return (0);
14106 	}
14107 unlock:
14108 	rw_exit(&ipst->ips_ipmp_lock);
14109 	return (err);
14110 }
14111 
14112 /*
14113  * Process an SIOCGLIFBINDING request.
14114  */
14115 /* ARGSUSED */
14116 int
14117 ip_sioctl_get_binding(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
14118     ip_ioctl_cmd_t *ipip, void *ifreq)
14119 {
14120 	ill_t		*ill;
14121 	struct lifreq	*lifr = ifreq;
14122 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
14123 
14124 	if (!IS_IPMP(ipif->ipif_ill))
14125 		return (EINVAL);
14126 
14127 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
14128 	if ((ill = ipif->ipif_bound_ill) == NULL)
14129 		lifr->lifr_binding[0] = '\0';
14130 	else
14131 		(void) strlcpy(lifr->lifr_binding, ill->ill_name, LIFNAMSIZ);
14132 	rw_exit(&ipst->ips_ipmp_lock);
14133 	return (0);
14134 }
14135 
14136 /*
14137  * Process an SIOCGLIFGROUPNAME request.
14138  */
14139 /* ARGSUSED */
14140 int
14141 ip_sioctl_get_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
14142     ip_ioctl_cmd_t *ipip, void *ifreq)
14143 {
14144 	ipmp_grp_t	*grp;
14145 	struct lifreq	*lifr = ifreq;
14146 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
14147 
14148 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
14149 	if ((grp = ipif->ipif_ill->ill_phyint->phyint_grp) == NULL)
14150 		lifr->lifr_groupname[0] = '\0';
14151 	else
14152 		(void) strlcpy(lifr->lifr_groupname, grp->gr_name, LIFGRNAMSIZ);
14153 	rw_exit(&ipst->ips_ipmp_lock);
14154 	return (0);
14155 }
14156 
14157 /*
14158  * Process an SIOCGLIFGROUPINFO request.
14159  */
14160 /* ARGSUSED */
14161 int
14162 ip_sioctl_groupinfo(ipif_t *dummy_ipif, sin_t *sin, queue_t *q, mblk_t *mp,
14163     ip_ioctl_cmd_t *ipip, void *dummy)
14164 {
14165 	ipmp_grp_t	*grp;
14166 	lifgroupinfo_t	*lifgr;
14167 	ip_stack_t	*ipst = CONNQ_TO_IPST(q);
14168 
14169 	/* ip_wput_nondata() verified mp->b_cont->b_cont */
14170 	lifgr = (lifgroupinfo_t *)mp->b_cont->b_cont->b_rptr;
14171 	lifgr->gi_grname[LIFGRNAMSIZ - 1] = '\0';
14172 
14173 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
14174 	if ((grp = ipmp_grp_lookup(lifgr->gi_grname, ipst)) == NULL) {
14175 		rw_exit(&ipst->ips_ipmp_lock);
14176 		return (ENOENT);
14177 	}
14178 	ipmp_grp_info(grp, lifgr);
14179 	rw_exit(&ipst->ips_ipmp_lock);
14180 	return (0);
14181 }
14182 
14183 static void
14184 ill_dl_down(ill_t *ill)
14185 {
14186 	/*
14187 	 * The ill is down; unbind but stay attached since we're still
14188 	 * associated with a PPA. If we have negotiated DLPI capabilites
14189 	 * with the data link service provider (IDS_OK) then reset them.
14190 	 * The interval between unbinding and rebinding is potentially
14191 	 * unbounded hence we cannot assume things will be the same.
14192 	 * The DLPI capabilities will be probed again when the data link
14193 	 * is brought up.
14194 	 */
14195 	mblk_t	*mp = ill->ill_unbind_mp;
14196 
14197 	ip1dbg(("ill_dl_down(%s)\n", ill->ill_name));
14198 
14199 	ill->ill_unbind_mp = NULL;
14200 	if (mp != NULL) {
14201 		ip1dbg(("ill_dl_down: %s (%u) for %s\n",
14202 		    dl_primstr(*(int *)mp->b_rptr), *(int *)mp->b_rptr,
14203 		    ill->ill_name));
14204 		mutex_enter(&ill->ill_lock);
14205 		ill->ill_state_flags |= ILL_DL_UNBIND_IN_PROGRESS;
14206 		mutex_exit(&ill->ill_lock);
14207 		/*
14208 		 * ip_rput does not pass up normal (M_PROTO) DLPI messages
14209 		 * after ILL_CONDEMNED is set. So in the unplumb case, we call
14210 		 * ill_capability_dld_disable disable rightaway. If this is not
14211 		 * an unplumb operation then the disable happens on receipt of
14212 		 * the capab ack via ip_rput_dlpi_writer ->
14213 		 * ill_capability_ack_thr. In both cases the order of
14214 		 * the operations seen by DLD is capability disable followed
14215 		 * by DL_UNBIND. Also the DLD capability disable needs a
14216 		 * cv_wait'able context.
14217 		 */
14218 		if (ill->ill_state_flags & ILL_CONDEMNED)
14219 			ill_capability_dld_disable(ill);
14220 		ill_capability_reset(ill, B_FALSE);
14221 		ill_dlpi_send(ill, mp);
14222 	}
14223 
14224 	/*
14225 	 * Toss all of our multicast memberships.  We could keep them, but
14226 	 * then we'd have to do bookkeeping of any joins and leaves performed
14227 	 * by the application while the the interface is down (we can't just
14228 	 * issue them because arp cannot currently process AR_ENTRY_SQUERY's
14229 	 * on a downed interface).
14230 	 */
14231 	ill_leave_multicast(ill);
14232 
14233 	mutex_enter(&ill->ill_lock);
14234 	ill->ill_dl_up = 0;
14235 	ill_nic_event_dispatch(ill, 0, NE_DOWN, NULL, 0);
14236 	mutex_exit(&ill->ill_lock);
14237 }
14238 
14239 static void
14240 ill_dlpi_dispatch(ill_t *ill, mblk_t *mp)
14241 {
14242 	union DL_primitives *dlp;
14243 	t_uscalar_t prim;
14244 	boolean_t waitack = B_FALSE;
14245 
14246 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
14247 
14248 	dlp = (union DL_primitives *)mp->b_rptr;
14249 	prim = dlp->dl_primitive;
14250 
14251 	ip1dbg(("ill_dlpi_dispatch: sending %s (%u) to %s\n",
14252 	    dl_primstr(prim), prim, ill->ill_name));
14253 
14254 	switch (prim) {
14255 	case DL_PHYS_ADDR_REQ:
14256 	{
14257 		dl_phys_addr_req_t *dlpap = (dl_phys_addr_req_t *)mp->b_rptr;
14258 		ill->ill_phys_addr_pend = dlpap->dl_addr_type;
14259 		break;
14260 	}
14261 	case DL_BIND_REQ:
14262 		mutex_enter(&ill->ill_lock);
14263 		ill->ill_state_flags &= ~ILL_DL_UNBIND_IN_PROGRESS;
14264 		mutex_exit(&ill->ill_lock);
14265 		break;
14266 	}
14267 
14268 	/*
14269 	 * Except for the ACKs for the M_PCPROTO messages, all other ACKs
14270 	 * are dropped by ip_rput() if ILL_CONDEMNED is set. Therefore
14271 	 * we only wait for the ACK of the DL_UNBIND_REQ.
14272 	 */
14273 	mutex_enter(&ill->ill_lock);
14274 	if (!(ill->ill_state_flags & ILL_CONDEMNED) ||
14275 	    (prim == DL_UNBIND_REQ)) {
14276 		ill->ill_dlpi_pending = prim;
14277 		waitack = B_TRUE;
14278 	}
14279 
14280 	mutex_exit(&ill->ill_lock);
14281 	putnext(ill->ill_wq, mp);
14282 
14283 	/*
14284 	 * There is no ack for DL_NOTIFY_CONF messages
14285 	 */
14286 	if (waitack && prim == DL_NOTIFY_CONF)
14287 		ill_dlpi_done(ill, prim);
14288 }
14289 
14290 /*
14291  * Helper function for ill_dlpi_send().
14292  */
14293 /* ARGSUSED */
14294 static void
14295 ill_dlpi_send_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
14296 {
14297 	ill_dlpi_send(q->q_ptr, mp);
14298 }
14299 
14300 /*
14301  * Send a DLPI control message to the driver but make sure there
14302  * is only one outstanding message. Uses ill_dlpi_pending to tell
14303  * when it must queue. ip_rput_dlpi_writer calls ill_dlpi_done()
14304  * when an ACK or a NAK is received to process the next queued message.
14305  */
14306 void
14307 ill_dlpi_send(ill_t *ill, mblk_t *mp)
14308 {
14309 	mblk_t **mpp;
14310 
14311 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
14312 
14313 	/*
14314 	 * To ensure that any DLPI requests for current exclusive operation
14315 	 * are always completely sent before any DLPI messages for other
14316 	 * operations, require writer access before enqueuing.
14317 	 */
14318 	if (!IAM_WRITER_ILL(ill)) {
14319 		ill_refhold(ill);
14320 		/* qwriter_ip() does the ill_refrele() */
14321 		qwriter_ip(ill, ill->ill_wq, mp, ill_dlpi_send_writer,
14322 		    NEW_OP, B_TRUE);
14323 		return;
14324 	}
14325 
14326 	mutex_enter(&ill->ill_lock);
14327 	if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
14328 		/* Must queue message. Tail insertion */
14329 		mpp = &ill->ill_dlpi_deferred;
14330 		while (*mpp != NULL)
14331 			mpp = &((*mpp)->b_next);
14332 
14333 		ip1dbg(("ill_dlpi_send: deferring request for %s\n",
14334 		    ill->ill_name));
14335 
14336 		*mpp = mp;
14337 		mutex_exit(&ill->ill_lock);
14338 		return;
14339 	}
14340 	mutex_exit(&ill->ill_lock);
14341 	ill_dlpi_dispatch(ill, mp);
14342 }
14343 
14344 static void
14345 ill_capability_send(ill_t *ill, mblk_t *mp)
14346 {
14347 	ill->ill_capab_pending_cnt++;
14348 	ill_dlpi_send(ill, mp);
14349 }
14350 
14351 void
14352 ill_capability_done(ill_t *ill)
14353 {
14354 	ASSERT(ill->ill_capab_pending_cnt != 0);
14355 
14356 	ill_dlpi_done(ill, DL_CAPABILITY_REQ);
14357 
14358 	ill->ill_capab_pending_cnt--;
14359 	if (ill->ill_capab_pending_cnt == 0 &&
14360 	    ill->ill_dlpi_capab_state == IDCS_OK)
14361 		ill_capability_reset_alloc(ill);
14362 }
14363 
14364 /*
14365  * Send all deferred DLPI messages without waiting for their ACKs.
14366  */
14367 void
14368 ill_dlpi_send_deferred(ill_t *ill)
14369 {
14370 	mblk_t *mp, *nextmp;
14371 
14372 	/*
14373 	 * Clear ill_dlpi_pending so that the message is not queued in
14374 	 * ill_dlpi_send().
14375 	 */
14376 	mutex_enter(&ill->ill_lock);
14377 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
14378 	mp = ill->ill_dlpi_deferred;
14379 	ill->ill_dlpi_deferred = NULL;
14380 	mutex_exit(&ill->ill_lock);
14381 
14382 	for (; mp != NULL; mp = nextmp) {
14383 		nextmp = mp->b_next;
14384 		mp->b_next = NULL;
14385 		ill_dlpi_send(ill, mp);
14386 	}
14387 }
14388 
14389 /*
14390  * Check if the DLPI primitive `prim' is pending; print a warning if not.
14391  */
14392 boolean_t
14393 ill_dlpi_pending(ill_t *ill, t_uscalar_t prim)
14394 {
14395 	t_uscalar_t pending;
14396 
14397 	mutex_enter(&ill->ill_lock);
14398 	if (ill->ill_dlpi_pending == prim) {
14399 		mutex_exit(&ill->ill_lock);
14400 		return (B_TRUE);
14401 	}
14402 
14403 	/*
14404 	 * During teardown, ill_dlpi_dispatch() will send DLPI requests
14405 	 * without waiting, so don't print any warnings in that case.
14406 	 */
14407 	if (ill->ill_state_flags & ILL_CONDEMNED) {
14408 		mutex_exit(&ill->ill_lock);
14409 		return (B_FALSE);
14410 	}
14411 	pending = ill->ill_dlpi_pending;
14412 	mutex_exit(&ill->ill_lock);
14413 
14414 	if (pending == DL_PRIM_INVAL) {
14415 		(void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
14416 		    "received unsolicited ack for %s on %s\n",
14417 		    dl_primstr(prim), ill->ill_name);
14418 	} else {
14419 		(void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
14420 		    "received unexpected ack for %s on %s (expecting %s)\n",
14421 		    dl_primstr(prim), ill->ill_name, dl_primstr(pending));
14422 	}
14423 	return (B_FALSE);
14424 }
14425 
14426 /*
14427  * Complete the current DLPI operation associated with `prim' on `ill' and
14428  * start the next queued DLPI operation (if any).  If there are no queued DLPI
14429  * operations and the ill's current exclusive IPSQ operation has finished
14430  * (i.e., ipsq_current_finish() was called), then clear ipsq_current_ipif to
14431  * allow the next exclusive IPSQ operation to begin upon ipsq_exit().  See
14432  * the comments above ipsq_current_finish() for details.
14433  */
14434 void
14435 ill_dlpi_done(ill_t *ill, t_uscalar_t prim)
14436 {
14437 	mblk_t *mp;
14438 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
14439 	ipxop_t *ipx = ipsq->ipsq_xop;
14440 
14441 	ASSERT(IAM_WRITER_IPSQ(ipsq));
14442 	mutex_enter(&ill->ill_lock);
14443 
14444 	ASSERT(prim != DL_PRIM_INVAL);
14445 	ASSERT(ill->ill_dlpi_pending == prim);
14446 
14447 	ip1dbg(("ill_dlpi_done: %s has completed %s (%u)\n", ill->ill_name,
14448 	    dl_primstr(ill->ill_dlpi_pending), ill->ill_dlpi_pending));
14449 
14450 	if ((mp = ill->ill_dlpi_deferred) == NULL) {
14451 		ill->ill_dlpi_pending = DL_PRIM_INVAL;
14452 		if (ipx->ipx_current_done) {
14453 			mutex_enter(&ipx->ipx_lock);
14454 			ipx->ipx_current_ipif = NULL;
14455 			mutex_exit(&ipx->ipx_lock);
14456 		}
14457 		cv_signal(&ill->ill_cv);
14458 		mutex_exit(&ill->ill_lock);
14459 		return;
14460 	}
14461 
14462 	ill->ill_dlpi_deferred = mp->b_next;
14463 	mp->b_next = NULL;
14464 	mutex_exit(&ill->ill_lock);
14465 
14466 	ill_dlpi_dispatch(ill, mp);
14467 }
14468 
14469 void
14470 conn_delete_ire(conn_t *connp, caddr_t arg)
14471 {
14472 	ipif_t	*ipif = (ipif_t *)arg;
14473 	ire_t	*ire;
14474 
14475 	/*
14476 	 * Look at the cached ires on conns which has pointers to ipifs.
14477 	 * We just call ire_refrele which clears up the reference
14478 	 * to ire. Called when a conn closes. Also called from ipif_free
14479 	 * to cleanup indirect references to the stale ipif via the cached ire.
14480 	 */
14481 	mutex_enter(&connp->conn_lock);
14482 	ire = connp->conn_ire_cache;
14483 	if (ire != NULL && (ipif == NULL || ire->ire_ipif == ipif)) {
14484 		connp->conn_ire_cache = NULL;
14485 		mutex_exit(&connp->conn_lock);
14486 		IRE_REFRELE_NOTR(ire);
14487 		return;
14488 	}
14489 	mutex_exit(&connp->conn_lock);
14490 
14491 }
14492 
14493 /*
14494  * Some operations (e.g., ipif_down()) conditionally delete a number
14495  * of IREs. Those IREs may have been previously cached in the conn structure.
14496  * This ipcl_walk() walker function releases all references to such IREs based
14497  * on the condemned flag.
14498  */
14499 /* ARGSUSED */
14500 void
14501 conn_cleanup_stale_ire(conn_t *connp, caddr_t arg)
14502 {
14503 	ire_t	*ire;
14504 
14505 	mutex_enter(&connp->conn_lock);
14506 	ire = connp->conn_ire_cache;
14507 	if (ire != NULL && (ire->ire_marks & IRE_MARK_CONDEMNED)) {
14508 		connp->conn_ire_cache = NULL;
14509 		mutex_exit(&connp->conn_lock);
14510 		IRE_REFRELE_NOTR(ire);
14511 		return;
14512 	}
14513 	mutex_exit(&connp->conn_lock);
14514 }
14515 
14516 /*
14517  * Take down a specific interface, but don't lose any information about it.
14518  * (Always called as writer.)
14519  * This function goes through the down sequence even if the interface is
14520  * already down. There are 2 reasons.
14521  * a. Currently we permit interface routes that depend on down interfaces
14522  *    to be added. This behaviour itself is questionable. However it appears
14523  *    that both Solaris and 4.3 BSD have exhibited this behaviour for a long
14524  *    time. We go thru the cleanup in order to remove these routes.
14525  * b. The bringup of the interface could fail in ill_dl_up i.e. we get
14526  *    DL_ERROR_ACK in response to the the DL_BIND request. The interface is
14527  *    down, but we need to cleanup i.e. do ill_dl_down and
14528  *    ip_rput_dlpi_writer (DL_ERROR_ACK) -> ipif_down.
14529  *
14530  * IP-MT notes:
14531  *
14532  * Model of reference to interfaces.
14533  *
14534  * The following members in ipif_t track references to the ipif.
14535  *	int     ipif_refcnt;    Active reference count
14536  *	uint_t  ipif_ire_cnt;   Number of ire's referencing this ipif
14537  *	uint_t  ipif_ilm_cnt;   Number of ilms's references this ipif.
14538  *
14539  * The following members in ill_t track references to the ill.
14540  *	int             ill_refcnt;     active refcnt
14541  *	uint_t          ill_ire_cnt;	Number of ires referencing ill
14542  *	uint_t          ill_nce_cnt;	Number of nces referencing ill
14543  *	uint_t          ill_ilm_cnt;	Number of ilms referencing ill
14544  *
14545  * Reference to an ipif or ill can be obtained in any of the following ways.
14546  *
14547  * Through the lookup functions ipif_lookup_* / ill_lookup_* functions
14548  * Pointers to ipif / ill from other data structures viz ire and conn.
14549  * Implicit reference to the ipif / ill by holding a reference to the ire.
14550  *
14551  * The ipif/ill lookup functions return a reference held ipif / ill.
14552  * ipif_refcnt and ill_refcnt track the reference counts respectively.
14553  * This is a purely dynamic reference count associated with threads holding
14554  * references to the ipif / ill. Pointers from other structures do not
14555  * count towards this reference count.
14556  *
14557  * ipif_ire_cnt/ill_ire_cnt is the number of ire's
14558  * associated with the ipif/ill. This is incremented whenever a new
14559  * ire is created referencing the ipif/ill. This is done atomically inside
14560  * ire_add_v[46] where the ire is actually added to the ire hash table.
14561  * The count is decremented in ire_inactive where the ire is destroyed.
14562  *
14563  * nce's reference ill's thru nce_ill and the count of nce's associated with
14564  * an ill is recorded in ill_nce_cnt. This is incremented atomically in
14565  * ndp_add_v4()/ndp_add_v6() where the nce is actually added to the
14566  * table. Similarly it is decremented in ndp_inactive() where the nce
14567  * is destroyed.
14568  *
14569  * ilm's reference to the ipif (for IPv4 ilm's) or the ill (for IPv6 ilm's)
14570  * is incremented in ilm_add_v6() and decremented before the ilm is freed
14571  * in ilm_walker_cleanup() or ilm_delete().
14572  *
14573  * Flow of ioctls involving interface down/up
14574  *
14575  * The following is the sequence of an attempt to set some critical flags on an
14576  * up interface.
14577  * ip_sioctl_flags
14578  * ipif_down
14579  * wait for ipif to be quiescent
14580  * ipif_down_tail
14581  * ip_sioctl_flags_tail
14582  *
14583  * All set ioctls that involve down/up sequence would have a skeleton similar
14584  * to the above. All the *tail functions are called after the refcounts have
14585  * dropped to the appropriate values.
14586  *
14587  * The mechanism to quiesce an ipif is as follows.
14588  *
14589  * Mark the ipif as IPIF_CHANGING. No more lookups will be allowed
14590  * on the ipif. Callers either pass a flag requesting wait or the lookup
14591  *  functions will return NULL.
14592  *
14593  * Delete all ires referencing this ipif
14594  *
14595  * Any thread attempting to do an ipif_refhold on an ipif that has been
14596  * obtained thru a cached pointer will first make sure that
14597  * the ipif can be refheld using the macro IPIF_CAN_LOOKUP and only then
14598  * increment the refcount.
14599  *
14600  * The above guarantees that the ipif refcount will eventually come down to
14601  * zero and the ipif will quiesce, once all threads that currently hold a
14602  * reference to the ipif refrelease the ipif. The ipif is quiescent after the
14603  * ipif_refcount has dropped to zero and all ire's associated with this ipif
14604  * have also been ire_inactive'd. i.e. when ipif_{ire, ill}_cnt and
14605  * ipif_refcnt both drop to zero. See also: comments above IPIF_DOWN_OK()
14606  * in ip.h
14607  *
14608  * Lookups during the IPIF_CHANGING/ILL_CHANGING interval.
14609  *
14610  * Threads trying to lookup an ipif or ill can pass a flag requesting
14611  * wait and restart if the ipif / ill cannot be looked up currently.
14612  * For eg. bind, and route operations (Eg. route add / delete) cannot return
14613  * failure if the ipif is currently undergoing an exclusive operation, and
14614  * hence pass the flag. The mblk is then enqueued in the ipsq and the operation
14615  * is restarted by ipsq_exit() when the current exclusive operation completes.
14616  * The lookup and enqueue is atomic using the ill_lock and ipsq_lock. The
14617  * lookup is done holding the ill_lock. Hence the ill/ipif state flags can't
14618  * change while the ill_lock is held. Before dropping the ill_lock we acquire
14619  * the ipsq_lock and call ipsq_enq. This ensures that ipsq_exit can't finish
14620  * until we release the ipsq_lock, even though the the ill/ipif state flags
14621  * can change after we drop the ill_lock.
14622  *
14623  * An attempt to send out a packet using an ipif that is currently
14624  * IPIF_CHANGING will fail. No attempt is made in this case to enqueue this
14625  * operation and restart it later when the exclusive condition on the ipif ends.
14626  * This is an example of not passing the wait flag to the lookup functions. For
14627  * example an attempt to refhold and use conn->conn_multicast_ipif and send
14628  * out a multicast packet on that ipif will fail while the ipif is
14629  * IPIF_CHANGING. An attempt to create an IRE_CACHE using an ipif that is
14630  * currently IPIF_CHANGING will also fail.
14631  */
14632 int
14633 ipif_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
14634 {
14635 	ill_t		*ill = ipif->ipif_ill;
14636 	conn_t		*connp;
14637 	boolean_t	success;
14638 	boolean_t	ipif_was_up = B_FALSE;
14639 	ip_stack_t	*ipst = ill->ill_ipst;
14640 
14641 	ASSERT(IAM_WRITER_IPIF(ipif));
14642 
14643 	ip1dbg(("ipif_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
14644 
14645 	if (ipif->ipif_flags & IPIF_UP) {
14646 		mutex_enter(&ill->ill_lock);
14647 		ipif->ipif_flags &= ~IPIF_UP;
14648 		ASSERT(ill->ill_ipif_up_count > 0);
14649 		--ill->ill_ipif_up_count;
14650 		mutex_exit(&ill->ill_lock);
14651 		ipif_was_up = B_TRUE;
14652 		/* Update status in SCTP's list */
14653 		sctp_update_ipif(ipif, SCTP_IPIF_DOWN);
14654 		ill_nic_event_dispatch(ipif->ipif_ill,
14655 		    MAP_IPIF_ID(ipif->ipif_id), NE_LIF_DOWN, NULL, 0);
14656 	}
14657 
14658 	/*
14659 	 * Blow away memberships we established in ipif_multicast_up().
14660 	 */
14661 	ipif_multicast_down(ipif);
14662 
14663 	/*
14664 	 * Remove from the mapping for __sin6_src_id. We insert only
14665 	 * when the address is not INADDR_ANY. As IPv4 addresses are
14666 	 * stored as mapped addresses, we need to check for mapped
14667 	 * INADDR_ANY also.
14668 	 */
14669 	if (ipif_was_up && !IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
14670 	    !IN6_IS_ADDR_V4MAPPED_ANY(&ipif->ipif_v6lcl_addr) &&
14671 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14672 		int err;
14673 
14674 		err = ip_srcid_remove(&ipif->ipif_v6lcl_addr,
14675 		    ipif->ipif_zoneid, ipst);
14676 		if (err != 0) {
14677 			ip0dbg(("ipif_down: srcid_remove %d\n", err));
14678 		}
14679 	}
14680 
14681 	/*
14682 	 * Delete all IRE's pointing at this ipif or its source address.
14683 	 */
14684 	if (ipif->ipif_isv6) {
14685 		ire_walk_v6(ipif_down_delete_ire, (char *)ipif, ALL_ZONES,
14686 		    ipst);
14687 	} else {
14688 		ire_walk_v4(ipif_down_delete_ire, (char *)ipif, ALL_ZONES,
14689 		    ipst);
14690 	}
14691 
14692 	if (ipif_was_up && ill->ill_ipif_up_count == 0) {
14693 		/*
14694 		 * Since the interface is now down, it may have just become
14695 		 * inactive.  Note that this needs to be done even for a
14696 		 * lll_logical_down(), or ARP entries will not get correctly
14697 		 * restored when the interface comes back up.
14698 		 */
14699 		if (IS_UNDER_IPMP(ill))
14700 			ipmp_ill_refresh_active(ill);
14701 	}
14702 
14703 	/*
14704 	 * Cleaning up the conn_ire_cache or conns must be done only after the
14705 	 * ires have been deleted above. Otherwise a thread could end up
14706 	 * caching an ire in a conn after we have finished the cleanup of the
14707 	 * conn. The caching is done after making sure that the ire is not yet
14708 	 * condemned. Also documented in the block comment above ip_output
14709 	 */
14710 	ipcl_walk(conn_cleanup_stale_ire, NULL, ipst);
14711 	/* Also, delete the ires cached in SCTP */
14712 	sctp_ire_cache_flush(ipif);
14713 
14714 	/*
14715 	 * Update any other ipifs which have used "our" local address as
14716 	 * a source address. This entails removing and recreating IRE_INTERFACE
14717 	 * entries for such ipifs.
14718 	 */
14719 	if (ipif->ipif_isv6)
14720 		ipif_update_other_ipifs_v6(ipif);
14721 	else
14722 		ipif_update_other_ipifs(ipif);
14723 
14724 	/*
14725 	 * neighbor-discovery or arp entries for this interface.
14726 	 */
14727 	ipif_ndp_down(ipif);
14728 
14729 	/*
14730 	 * If mp is NULL the caller will wait for the appropriate refcnt.
14731 	 * Eg. ip_sioctl_removeif -> ipif_free  -> ipif_down
14732 	 * and ill_delete -> ipif_free -> ipif_down
14733 	 */
14734 	if (mp == NULL) {
14735 		ASSERT(q == NULL);
14736 		return (0);
14737 	}
14738 
14739 	if (CONN_Q(q)) {
14740 		connp = Q_TO_CONN(q);
14741 		mutex_enter(&connp->conn_lock);
14742 	} else {
14743 		connp = NULL;
14744 	}
14745 	mutex_enter(&ill->ill_lock);
14746 	/*
14747 	 * Are there any ire's pointing to this ipif that are still active ?
14748 	 * If this is the last ipif going down, are there any ire's pointing
14749 	 * to this ill that are still active ?
14750 	 */
14751 	if (ipif_is_quiescent(ipif)) {
14752 		mutex_exit(&ill->ill_lock);
14753 		if (connp != NULL)
14754 			mutex_exit(&connp->conn_lock);
14755 		return (0);
14756 	}
14757 
14758 	ip1dbg(("ipif_down: need to wait, adding pending mp %s ill %p",
14759 	    ill->ill_name, (void *)ill));
14760 	/*
14761 	 * Enqueue the mp atomically in ipsq_pending_mp. When the refcount
14762 	 * drops down, the operation will be restarted by ipif_ill_refrele_tail
14763 	 * which in turn is called by the last refrele on the ipif/ill/ire.
14764 	 */
14765 	success = ipsq_pending_mp_add(connp, ipif, q, mp, IPIF_DOWN);
14766 	if (!success) {
14767 		/* The conn is closing. So just return */
14768 		ASSERT(connp != NULL);
14769 		mutex_exit(&ill->ill_lock);
14770 		mutex_exit(&connp->conn_lock);
14771 		return (EINTR);
14772 	}
14773 
14774 	mutex_exit(&ill->ill_lock);
14775 	if (connp != NULL)
14776 		mutex_exit(&connp->conn_lock);
14777 	return (EINPROGRESS);
14778 }
14779 
14780 void
14781 ipif_down_tail(ipif_t *ipif)
14782 {
14783 	ill_t	*ill = ipif->ipif_ill;
14784 
14785 	/*
14786 	 * Skip any loopback interface (null wq).
14787 	 * If this is the last logical interface on the ill
14788 	 * have ill_dl_down tell the driver we are gone (unbind)
14789 	 * Note that lun 0 can ipif_down even though
14790 	 * there are other logical units that are up.
14791 	 * This occurs e.g. when we change a "significant" IFF_ flag.
14792 	 */
14793 	if (ill->ill_wq != NULL && !ill->ill_logical_down &&
14794 	    ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
14795 	    ill->ill_dl_up) {
14796 		ill_dl_down(ill);
14797 	}
14798 	ill->ill_logical_down = 0;
14799 
14800 	/*
14801 	 * Has to be after removing the routes in ipif_down_delete_ire.
14802 	 */
14803 	ipif_resolver_down(ipif);
14804 
14805 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
14806 	ip_rts_newaddrmsg(RTM_DELETE, 0, ipif, RTSQ_DEFAULT);
14807 }
14808 
14809 /*
14810  * Bring interface logically down without bringing the physical interface
14811  * down e.g. when the netmask is changed. This avoids long lasting link
14812  * negotiations between an ethernet interface and a certain switches.
14813  */
14814 static int
14815 ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
14816 {
14817 	/*
14818 	 * The ill_logical_down flag is a transient flag. It is set here
14819 	 * and is cleared once the down has completed in ipif_down_tail.
14820 	 * This flag does not indicate whether the ill stream is in the
14821 	 * DL_BOUND state with the driver. Instead this flag is used by
14822 	 * ipif_down_tail to determine whether to DL_UNBIND the stream with
14823 	 * the driver. The state of the ill stream i.e. whether it is
14824 	 * DL_BOUND with the driver or not is indicated by the ill_dl_up flag.
14825 	 */
14826 	ipif->ipif_ill->ill_logical_down = 1;
14827 	return (ipif_down(ipif, q, mp));
14828 }
14829 
14830 /*
14831  * This is called when the SIOCSLIFUSESRC ioctl is processed in IP.
14832  * If the usesrc client ILL is already part of a usesrc group or not,
14833  * in either case a ire_stq with the matching usesrc client ILL will
14834  * locate the IRE's that need to be deleted. We want IREs to be created
14835  * with the new source address.
14836  */
14837 static void
14838 ipif_delete_cache_ire(ire_t *ire, char *ill_arg)
14839 {
14840 	ill_t	*ucill = (ill_t *)ill_arg;
14841 
14842 	ASSERT(IAM_WRITER_ILL(ucill));
14843 
14844 	if (ire->ire_stq == NULL)
14845 		return;
14846 
14847 	if ((ire->ire_type == IRE_CACHE) &&
14848 	    ((ill_t *)ire->ire_stq->q_ptr == ucill))
14849 		ire_delete(ire);
14850 }
14851 
14852 /*
14853  * ire_walk routine to delete every IRE dependent on the interface
14854  * address that is going down.	(Always called as writer.)
14855  * Works for both v4 and v6.
14856  * In addition for checking for ire_ipif matches it also checks for
14857  * IRE_CACHE entries which have the same source address as the
14858  * disappearing ipif since ipif_select_source might have picked
14859  * that source. Note that ipif_down/ipif_update_other_ipifs takes
14860  * care of any IRE_INTERFACE with the disappearing source address.
14861  */
14862 static void
14863 ipif_down_delete_ire(ire_t *ire, char *ipif_arg)
14864 {
14865 	ipif_t	*ipif = (ipif_t *)ipif_arg;
14866 
14867 	ASSERT(IAM_WRITER_IPIF(ipif));
14868 	if (ire->ire_ipif == NULL)
14869 		return;
14870 
14871 	if (ire->ire_ipif != ipif) {
14872 		/*
14873 		 * Look for a matching source address.
14874 		 */
14875 		if (ire->ire_type != IRE_CACHE)
14876 			return;
14877 		if (ipif->ipif_flags & IPIF_NOLOCAL)
14878 			return;
14879 
14880 		if (ire->ire_ipversion == IPV4_VERSION) {
14881 			if (ire->ire_src_addr != ipif->ipif_src_addr)
14882 				return;
14883 		} else {
14884 			if (!IN6_ARE_ADDR_EQUAL(&ire->ire_src_addr_v6,
14885 			    &ipif->ipif_v6lcl_addr))
14886 				return;
14887 		}
14888 		ire_delete(ire);
14889 		return;
14890 	}
14891 	/*
14892 	 * ire_delete() will do an ire_flush_cache which will delete
14893 	 * all ire_ipif matches
14894 	 */
14895 	ire_delete(ire);
14896 }
14897 
14898 /*
14899  * ire_walk_ill function for deleting all IRE_CACHE entries for an ill when
14900  * 1) an ipif (on that ill) changes the IPIF_DEPRECATED flags, or
14901  * 2) when an interface is brought up or down (on that ill).
14902  * This ensures that the IRE_CACHE entries don't retain stale source
14903  * address selection results.
14904  */
14905 void
14906 ill_ipif_cache_delete(ire_t *ire, char *ill_arg)
14907 {
14908 	ill_t	*ill = (ill_t *)ill_arg;
14909 
14910 	ASSERT(IAM_WRITER_ILL(ill));
14911 	ASSERT(ire->ire_type == IRE_CACHE);
14912 
14913 	/*
14914 	 * We are called for IRE_CACHEs whose ire_stq or ire_ipif matches
14915 	 * ill, but we only want to delete the IRE if ire_ipif matches.
14916 	 */
14917 	ASSERT(ire->ire_ipif != NULL);
14918 	if (ill == ire->ire_ipif->ipif_ill)
14919 		ire_delete(ire);
14920 }
14921 
14922 /*
14923  * Delete all the IREs whose ire_stq's reference `ill_arg'.  IPMP uses this
14924  * instead of ill_ipif_cache_delete() because ire_ipif->ipif_ill references
14925  * the IPMP ill.
14926  */
14927 void
14928 ill_stq_cache_delete(ire_t *ire, char *ill_arg)
14929 {
14930 	ill_t	*ill = (ill_t *)ill_arg;
14931 
14932 	ASSERT(IAM_WRITER_ILL(ill));
14933 	ASSERT(ire->ire_type == IRE_CACHE);
14934 
14935 	/*
14936 	 * We are called for IRE_CACHEs whose ire_stq or ire_ipif matches
14937 	 * ill, but we only want to delete the IRE if ire_stq matches.
14938 	 */
14939 	if (ire->ire_stq->q_ptr == ill_arg)
14940 		ire_delete(ire);
14941 }
14942 
14943 /*
14944  * Delete all the IREs whose ire_stq's reference any ill in the same IPMP
14945  * group as `ill_arg'.  Used by ipmp_ill_deactivate() to flush all IRE_CACHE
14946  * entries for the illgrp.
14947  */
14948 void
14949 ill_grp_cache_delete(ire_t *ire, char *ill_arg)
14950 {
14951 	ill_t	*ill = (ill_t *)ill_arg;
14952 
14953 	ASSERT(IAM_WRITER_ILL(ill));
14954 
14955 	if (ire->ire_type == IRE_CACHE &&
14956 	    IS_IN_SAME_ILLGRP((ill_t *)ire->ire_stq->q_ptr, ill)) {
14957 		ire_delete(ire);
14958 	}
14959 }
14960 
14961 /*
14962  * Delete all broadcast IREs with a source address on `ill_arg'.
14963  */
14964 static void
14965 ill_broadcast_delete(ire_t *ire, char *ill_arg)
14966 {
14967 	ill_t *ill = (ill_t *)ill_arg;
14968 
14969 	ASSERT(IAM_WRITER_ILL(ill));
14970 	ASSERT(ire->ire_type == IRE_BROADCAST);
14971 
14972 	if (ire->ire_ipif->ipif_ill == ill)
14973 		ire_delete(ire);
14974 }
14975 
14976 /*
14977  * Initiate deallocate of an IPIF. Always called as writer. Called by
14978  * ill_delete or ip_sioctl_removeif.
14979  */
14980 static void
14981 ipif_free(ipif_t *ipif)
14982 {
14983 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
14984 
14985 	ASSERT(IAM_WRITER_IPIF(ipif));
14986 
14987 	if (ipif->ipif_recovery_id != 0)
14988 		(void) untimeout(ipif->ipif_recovery_id);
14989 	ipif->ipif_recovery_id = 0;
14990 
14991 	/* Remove conn references */
14992 	reset_conn_ipif(ipif);
14993 
14994 	/*
14995 	 * Make sure we have valid net and subnet broadcast ire's for the
14996 	 * other ipif's which share them with this ipif.
14997 	 */
14998 	if (!ipif->ipif_isv6)
14999 		ipif_check_bcast_ires(ipif);
15000 
15001 	/*
15002 	 * Take down the interface. We can be called either from ill_delete
15003 	 * or from ip_sioctl_removeif.
15004 	 */
15005 	(void) ipif_down(ipif, NULL, NULL);
15006 
15007 	/*
15008 	 * Now that the interface is down, there's no chance it can still
15009 	 * become a duplicate.  Cancel any timer that may have been set while
15010 	 * tearing down.
15011 	 */
15012 	if (ipif->ipif_recovery_id != 0)
15013 		(void) untimeout(ipif->ipif_recovery_id);
15014 	ipif->ipif_recovery_id = 0;
15015 
15016 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15017 	/* Remove pointers to this ill in the multicast routing tables */
15018 	reset_mrt_vif_ipif(ipif);
15019 	/* If necessary, clear the cached source ipif rotor. */
15020 	if (ipif->ipif_ill->ill_src_ipif == ipif)
15021 		ipif->ipif_ill->ill_src_ipif = NULL;
15022 	rw_exit(&ipst->ips_ill_g_lock);
15023 }
15024 
15025 static void
15026 ipif_free_tail(ipif_t *ipif)
15027 {
15028 	mblk_t	*mp;
15029 	ip_stack_t *ipst = ipif->ipif_ill->ill_ipst;
15030 
15031 	/*
15032 	 * Free state for addition IRE_IF_[NO]RESOLVER ire's.
15033 	 */
15034 	mutex_enter(&ipif->ipif_saved_ire_lock);
15035 	mp = ipif->ipif_saved_ire_mp;
15036 	ipif->ipif_saved_ire_mp = NULL;
15037 	mutex_exit(&ipif->ipif_saved_ire_lock);
15038 	freemsg(mp);
15039 
15040 	/*
15041 	 * Need to hold both ill_g_lock and ill_lock while
15042 	 * inserting or removing an ipif from the linked list
15043 	 * of ipifs hanging off the ill.
15044 	 */
15045 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15046 
15047 	ASSERT(ilm_walk_ipif(ipif) == 0);
15048 
15049 #ifdef DEBUG
15050 	ipif_trace_cleanup(ipif);
15051 #endif
15052 
15053 	/* Ask SCTP to take it out of it list */
15054 	sctp_update_ipif(ipif, SCTP_IPIF_REMOVE);
15055 
15056 	/* Get it out of the ILL interface list. */
15057 	ipif_remove(ipif);
15058 	rw_exit(&ipst->ips_ill_g_lock);
15059 
15060 	mutex_destroy(&ipif->ipif_saved_ire_lock);
15061 
15062 	ASSERT(!(ipif->ipif_flags & (IPIF_UP | IPIF_DUPLICATE)));
15063 	ASSERT(ipif->ipif_recovery_id == 0);
15064 
15065 	/* Free the memory. */
15066 	mi_free(ipif);
15067 }
15068 
15069 /*
15070  * Sets `buf' to an ipif name of the form "ill_name:id", or "ill_name" if "id"
15071  * is zero.
15072  */
15073 void
15074 ipif_get_name(const ipif_t *ipif, char *buf, int len)
15075 {
15076 	char	lbuf[LIFNAMSIZ];
15077 	char	*name;
15078 	size_t	name_len;
15079 
15080 	buf[0] = '\0';
15081 	name = ipif->ipif_ill->ill_name;
15082 	name_len = ipif->ipif_ill->ill_name_length;
15083 	if (ipif->ipif_id != 0) {
15084 		(void) sprintf(lbuf, "%s%c%d", name, IPIF_SEPARATOR_CHAR,
15085 		    ipif->ipif_id);
15086 		name = lbuf;
15087 		name_len = mi_strlen(name) + 1;
15088 	}
15089 	len -= 1;
15090 	buf[len] = '\0';
15091 	len = MIN(len, name_len);
15092 	bcopy(name, buf, len);
15093 }
15094 
15095 /*
15096  * Find an IPIF based on the name passed in.  Names can be of the
15097  * form <phys> (e.g., le0), <phys>:<#> (e.g., le0:1),
15098  * The <phys> string can have forms like <dev><#> (e.g., le0),
15099  * <dev><#>.<module> (e.g. le0.foo), or <dev>.<module><#> (e.g. ip.tun3).
15100  * When there is no colon, the implied unit id is zero. <phys> must
15101  * correspond to the name of an ILL.  (May be called as writer.)
15102  */
15103 static ipif_t *
15104 ipif_lookup_on_name(char *name, size_t namelen, boolean_t do_alloc,
15105     boolean_t *exists, boolean_t isv6, zoneid_t zoneid, queue_t *q,
15106     mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst)
15107 {
15108 	char	*cp;
15109 	char	*endp;
15110 	long	id;
15111 	ill_t	*ill;
15112 	ipif_t	*ipif;
15113 	uint_t	ire_type;
15114 	boolean_t did_alloc = B_FALSE;
15115 	ipsq_t	*ipsq;
15116 
15117 	if (error != NULL)
15118 		*error = 0;
15119 
15120 	/*
15121 	 * If the caller wants to us to create the ipif, make sure we have a
15122 	 * valid zoneid
15123 	 */
15124 	ASSERT(!do_alloc || zoneid != ALL_ZONES);
15125 
15126 	if (namelen == 0) {
15127 		if (error != NULL)
15128 			*error = ENXIO;
15129 		return (NULL);
15130 	}
15131 
15132 	*exists = B_FALSE;
15133 	/* Look for a colon in the name. */
15134 	endp = &name[namelen];
15135 	for (cp = endp; --cp > name; ) {
15136 		if (*cp == IPIF_SEPARATOR_CHAR)
15137 			break;
15138 	}
15139 
15140 	if (*cp == IPIF_SEPARATOR_CHAR) {
15141 		/*
15142 		 * Reject any non-decimal aliases for logical
15143 		 * interfaces. Aliases with leading zeroes
15144 		 * are also rejected as they introduce ambiguity
15145 		 * in the naming of the interfaces.
15146 		 * In order to confirm with existing semantics,
15147 		 * and to not break any programs/script relying
15148 		 * on that behaviour, if<0>:0 is considered to be
15149 		 * a valid interface.
15150 		 *
15151 		 * If alias has two or more digits and the first
15152 		 * is zero, fail.
15153 		 */
15154 		if (&cp[2] < endp && cp[1] == '0') {
15155 			if (error != NULL)
15156 				*error = EINVAL;
15157 			return (NULL);
15158 		}
15159 	}
15160 
15161 	if (cp <= name) {
15162 		cp = endp;
15163 	} else {
15164 		*cp = '\0';
15165 	}
15166 
15167 	/*
15168 	 * Look up the ILL, based on the portion of the name
15169 	 * before the slash. ill_lookup_on_name returns a held ill.
15170 	 * Temporary to check whether ill exists already. If so
15171 	 * ill_lookup_on_name will clear it.
15172 	 */
15173 	ill = ill_lookup_on_name(name, do_alloc, isv6,
15174 	    q, mp, func, error, &did_alloc, ipst);
15175 	if (cp != endp)
15176 		*cp = IPIF_SEPARATOR_CHAR;
15177 	if (ill == NULL)
15178 		return (NULL);
15179 
15180 	/* Establish the unit number in the name. */
15181 	id = 0;
15182 	if (cp < endp && *endp == '\0') {
15183 		/* If there was a colon, the unit number follows. */
15184 		cp++;
15185 		if (ddi_strtol(cp, NULL, 0, &id) != 0) {
15186 			ill_refrele(ill);
15187 			if (error != NULL)
15188 				*error = ENXIO;
15189 			return (NULL);
15190 		}
15191 	}
15192 
15193 	GRAB_CONN_LOCK(q);
15194 	mutex_enter(&ill->ill_lock);
15195 	/* Now see if there is an IPIF with this unit number. */
15196 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
15197 		if (ipif->ipif_id == id) {
15198 			if (zoneid != ALL_ZONES &&
15199 			    zoneid != ipif->ipif_zoneid &&
15200 			    ipif->ipif_zoneid != ALL_ZONES) {
15201 				mutex_exit(&ill->ill_lock);
15202 				RELEASE_CONN_LOCK(q);
15203 				ill_refrele(ill);
15204 				if (error != NULL)
15205 					*error = ENXIO;
15206 				return (NULL);
15207 			}
15208 			/*
15209 			 * The block comment at the start of ipif_down
15210 			 * explains the use of the macros used below
15211 			 */
15212 			if (IPIF_CAN_LOOKUP(ipif)) {
15213 				ipif_refhold_locked(ipif);
15214 				mutex_exit(&ill->ill_lock);
15215 				if (!did_alloc)
15216 					*exists = B_TRUE;
15217 				/*
15218 				 * Drop locks before calling ill_refrele
15219 				 * since it can potentially call into
15220 				 * ipif_ill_refrele_tail which can end up
15221 				 * in trying to acquire any lock.
15222 				 */
15223 				RELEASE_CONN_LOCK(q);
15224 				ill_refrele(ill);
15225 				return (ipif);
15226 			} else if (IPIF_CAN_WAIT(ipif, q)) {
15227 				ipsq = ill->ill_phyint->phyint_ipsq;
15228 				mutex_enter(&ipsq->ipsq_lock);
15229 				mutex_enter(&ipsq->ipsq_xop->ipx_lock);
15230 				mutex_exit(&ill->ill_lock);
15231 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
15232 				mutex_exit(&ipsq->ipsq_xop->ipx_lock);
15233 				mutex_exit(&ipsq->ipsq_lock);
15234 				RELEASE_CONN_LOCK(q);
15235 				ill_refrele(ill);
15236 				if (error != NULL)
15237 					*error = EINPROGRESS;
15238 				return (NULL);
15239 			}
15240 		}
15241 	}
15242 	RELEASE_CONN_LOCK(q);
15243 
15244 	if (!do_alloc) {
15245 		mutex_exit(&ill->ill_lock);
15246 		ill_refrele(ill);
15247 		if (error != NULL)
15248 			*error = ENXIO;
15249 		return (NULL);
15250 	}
15251 
15252 	/*
15253 	 * If none found, atomically allocate and return a new one.
15254 	 * Historically, we used IRE_LOOPBACK only for lun 0, and IRE_LOCAL
15255 	 * to support "receive only" use of lo0:1 etc. as is still done
15256 	 * below as an initial guess.
15257 	 * However, this is now likely to be overriden later in ipif_up_done()
15258 	 * when we know for sure what address has been configured on the
15259 	 * interface, since we might have more than one loopback interface
15260 	 * with a loopback address, e.g. in the case of zones, and all the
15261 	 * interfaces with loopback addresses need to be marked IRE_LOOPBACK.
15262 	 */
15263 	if (ill->ill_net_type == IRE_LOOPBACK && id == 0)
15264 		ire_type = IRE_LOOPBACK;
15265 	else
15266 		ire_type = IRE_LOCAL;
15267 	ipif = ipif_allocate(ill, id, ire_type, B_TRUE, B_TRUE);
15268 	if (ipif != NULL)
15269 		ipif_refhold_locked(ipif);
15270 	else if (error != NULL)
15271 		*error = ENOMEM;
15272 	mutex_exit(&ill->ill_lock);
15273 	ill_refrele(ill);
15274 	return (ipif);
15275 }
15276 
15277 /*
15278  * This routine is called whenever a new address comes up on an ipif.  If
15279  * we are configured to respond to address mask requests, then we are supposed
15280  * to broadcast an address mask reply at this time.  This routine is also
15281  * called if we are already up, but a netmask change is made.  This is legal
15282  * but might not make the system manager very popular.	(May be called
15283  * as writer.)
15284  */
15285 void
15286 ipif_mask_reply(ipif_t *ipif)
15287 {
15288 	icmph_t	*icmph;
15289 	ipha_t	*ipha;
15290 	mblk_t	*mp;
15291 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
15292 
15293 #define	REPLY_LEN	(sizeof (icmp_ipha) + sizeof (icmph_t) + IP_ADDR_LEN)
15294 
15295 	if (!ipst->ips_ip_respond_to_address_mask_broadcast)
15296 		return;
15297 
15298 	/* ICMP mask reply is IPv4 only */
15299 	ASSERT(!ipif->ipif_isv6);
15300 	/* ICMP mask reply is not for a loopback interface */
15301 	ASSERT(ipif->ipif_ill->ill_wq != NULL);
15302 
15303 	mp = allocb(REPLY_LEN, BPRI_HI);
15304 	if (mp == NULL)
15305 		return;
15306 	mp->b_wptr = mp->b_rptr + REPLY_LEN;
15307 
15308 	ipha = (ipha_t *)mp->b_rptr;
15309 	bzero(ipha, REPLY_LEN);
15310 	*ipha = icmp_ipha;
15311 	ipha->ipha_ttl = ipst->ips_ip_broadcast_ttl;
15312 	ipha->ipha_src = ipif->ipif_src_addr;
15313 	ipha->ipha_dst = ipif->ipif_brd_addr;
15314 	ipha->ipha_length = htons(REPLY_LEN);
15315 	ipha->ipha_ident = 0;
15316 
15317 	icmph = (icmph_t *)&ipha[1];
15318 	icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY;
15319 	bcopy(&ipif->ipif_net_mask, &icmph[1], IP_ADDR_LEN);
15320 	icmph->icmph_checksum = IP_CSUM(mp, sizeof (ipha_t), 0);
15321 
15322 	put(ipif->ipif_wq, mp);
15323 
15324 #undef	REPLY_LEN
15325 }
15326 
15327 /*
15328  * When the mtu in the ipif changes, we call this routine through ire_walk
15329  * to update all the relevant IREs.
15330  * Skip IRE_LOCAL and "loopback" IRE_BROADCAST by checking ire_stq.
15331  */
15332 static void
15333 ipif_mtu_change(ire_t *ire, char *ipif_arg)
15334 {
15335 	ipif_t *ipif = (ipif_t *)ipif_arg;
15336 
15337 	if (ire->ire_stq == NULL || ire->ire_ipif != ipif)
15338 		return;
15339 
15340 	mutex_enter(&ire->ire_lock);
15341 	if (ire->ire_marks & IRE_MARK_PMTU) {
15342 		/* Avoid increasing the PMTU */
15343 		ire->ire_max_frag = MIN(ipif->ipif_mtu, ire->ire_max_frag);
15344 		if (ire->ire_max_frag == ipif->ipif_mtu)
15345 			ire->ire_marks &= ~IRE_MARK_PMTU;
15346 	} else {
15347 		ire->ire_max_frag = MIN(ipif->ipif_mtu, IP_MAXPACKET);
15348 	}
15349 	mutex_exit(&ire->ire_lock);
15350 }
15351 
15352 /*
15353  * When the mtu in the ill changes, we call this routine through ire_walk
15354  * to update all the relevant IREs.
15355  * Skip IRE_LOCAL and "loopback" IRE_BROADCAST by checking ire_stq.
15356  */
15357 void
15358 ill_mtu_change(ire_t *ire, char *ill_arg)
15359 {
15360 	ill_t	*ill = (ill_t *)ill_arg;
15361 
15362 	if (ire->ire_stq == NULL || ire->ire_ipif->ipif_ill != ill)
15363 		return;
15364 
15365 	mutex_enter(&ire->ire_lock);
15366 	if (ire->ire_marks & IRE_MARK_PMTU) {
15367 		/* Avoid increasing the PMTU */
15368 		ire->ire_max_frag = MIN(ire->ire_ipif->ipif_mtu,
15369 		    ire->ire_max_frag);
15370 		if (ire->ire_max_frag == ire->ire_ipif->ipif_mtu) {
15371 			ire->ire_marks &= ~IRE_MARK_PMTU;
15372 		}
15373 	} else {
15374 		ire->ire_max_frag = MIN(ire->ire_ipif->ipif_mtu, IP_MAXPACKET);
15375 	}
15376 	mutex_exit(&ire->ire_lock);
15377 }
15378 
15379 /*
15380  * Join the ipif specific multicast groups.
15381  * Must be called after a mapping has been set up in the resolver.  (Always
15382  * called as writer.)
15383  */
15384 void
15385 ipif_multicast_up(ipif_t *ipif)
15386 {
15387 	int err;
15388 	ill_t *ill;
15389 
15390 	ASSERT(IAM_WRITER_IPIF(ipif));
15391 
15392 	ill = ipif->ipif_ill;
15393 
15394 	ip1dbg(("ipif_multicast_up\n"));
15395 	if (!(ill->ill_flags & ILLF_MULTICAST) || ipif->ipif_multicast_up)
15396 		return;
15397 
15398 	if (ipif->ipif_isv6) {
15399 		in6_addr_t v6allmc = ipv6_all_hosts_mcast;
15400 		in6_addr_t v6solmc = ipv6_solicited_node_mcast;
15401 
15402 		v6solmc.s6_addr32[3] |= ipif->ipif_v6lcl_addr.s6_addr32[3];
15403 
15404 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
15405 			return;
15406 
15407 		ip1dbg(("ipif_multicast_up - addmulti\n"));
15408 
15409 		/*
15410 		 * Join the all hosts multicast address.  We skip this for
15411 		 * underlying IPMP interfaces since they should be invisible.
15412 		 */
15413 		if (!IS_UNDER_IPMP(ill)) {
15414 			err = ip_addmulti_v6(&v6allmc, ill, ipif->ipif_zoneid,
15415 			    ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
15416 			if (err != 0) {
15417 				ip0dbg(("ipif_multicast_up: "
15418 				    "all_hosts_mcast failed %d\n", err));
15419 				return;
15420 			}
15421 			ipif->ipif_joined_allhosts = 1;
15422 		}
15423 
15424 		/*
15425 		 * Enable multicast for the solicited node multicast address
15426 		 */
15427 		if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
15428 			err = ip_addmulti_v6(&v6solmc, ill, ipif->ipif_zoneid,
15429 			    ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
15430 			if (err != 0) {
15431 				ip0dbg(("ipif_multicast_up: solicited MC"
15432 				    " failed %d\n", err));
15433 				if (ipif->ipif_joined_allhosts) {
15434 					(void) ip_delmulti_v6(&v6allmc, ill,
15435 					    ipif->ipif_zoneid, B_TRUE, B_TRUE);
15436 					ipif->ipif_joined_allhosts = 0;
15437 				}
15438 				return;
15439 			}
15440 		}
15441 	} else {
15442 		if (ipif->ipif_lcl_addr == INADDR_ANY || IS_UNDER_IPMP(ill))
15443 			return;
15444 
15445 		/* Join the all hosts multicast address */
15446 		ip1dbg(("ipif_multicast_up - addmulti\n"));
15447 		err = ip_addmulti(htonl(INADDR_ALLHOSTS_GROUP), ipif,
15448 		    ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
15449 		if (err) {
15450 			ip0dbg(("ipif_multicast_up: failed %d\n", err));
15451 			return;
15452 		}
15453 	}
15454 	ipif->ipif_multicast_up = 1;
15455 }
15456 
15457 /*
15458  * Blow away any multicast groups that we joined in ipif_multicast_up().
15459  * (Explicit memberships are blown away in ill_leave_multicast() when the
15460  * ill is brought down.)
15461  */
15462 void
15463 ipif_multicast_down(ipif_t *ipif)
15464 {
15465 	int err;
15466 
15467 	ASSERT(IAM_WRITER_IPIF(ipif));
15468 
15469 	ip1dbg(("ipif_multicast_down\n"));
15470 	if (!ipif->ipif_multicast_up)
15471 		return;
15472 
15473 	ip1dbg(("ipif_multicast_down - delmulti\n"));
15474 
15475 	if (!ipif->ipif_isv6) {
15476 		err = ip_delmulti(htonl(INADDR_ALLHOSTS_GROUP), ipif, B_TRUE,
15477 		    B_TRUE);
15478 		if (err != 0)
15479 			ip0dbg(("ipif_multicast_down: failed %d\n", err));
15480 
15481 		ipif->ipif_multicast_up = 0;
15482 		return;
15483 	}
15484 
15485 	/*
15486 	 * Leave the all-hosts multicast address.
15487 	 */
15488 	if (ipif->ipif_joined_allhosts) {
15489 		err = ip_delmulti_v6(&ipv6_all_hosts_mcast, ipif->ipif_ill,
15490 		    ipif->ipif_zoneid, B_TRUE, B_TRUE);
15491 		if (err != 0) {
15492 			ip0dbg(("ipif_multicast_down: all_hosts_mcast "
15493 			    "failed %d\n", err));
15494 		}
15495 		ipif->ipif_joined_allhosts = 0;
15496 	}
15497 
15498 	/*
15499 	 * Disable multicast for the solicited node multicast address
15500 	 */
15501 	if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
15502 		in6_addr_t ipv6_multi = ipv6_solicited_node_mcast;
15503 
15504 		ipv6_multi.s6_addr32[3] |=
15505 		    ipif->ipif_v6lcl_addr.s6_addr32[3];
15506 
15507 		err = ip_delmulti_v6(&ipv6_multi, ipif->ipif_ill,
15508 		    ipif->ipif_zoneid, B_TRUE, B_TRUE);
15509 		if (err != 0) {
15510 			ip0dbg(("ipif_multicast_down: sol MC failed %d\n",
15511 			    err));
15512 		}
15513 	}
15514 
15515 	ipif->ipif_multicast_up = 0;
15516 }
15517 
15518 /*
15519  * Used when an interface comes up to recreate any extra routes on this
15520  * interface.
15521  */
15522 static ire_t **
15523 ipif_recover_ire(ipif_t *ipif)
15524 {
15525 	mblk_t	*mp;
15526 	ire_t	**ipif_saved_irep;
15527 	ire_t	**irep;
15528 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
15529 
15530 	ip1dbg(("ipif_recover_ire(%s:%u)", ipif->ipif_ill->ill_name,
15531 	    ipif->ipif_id));
15532 
15533 	mutex_enter(&ipif->ipif_saved_ire_lock);
15534 	ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) *
15535 	    ipif->ipif_saved_ire_cnt, KM_NOSLEEP);
15536 	if (ipif_saved_irep == NULL) {
15537 		mutex_exit(&ipif->ipif_saved_ire_lock);
15538 		return (NULL);
15539 	}
15540 
15541 	irep = ipif_saved_irep;
15542 	for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
15543 		ire_t		*ire;
15544 		queue_t		*rfq;
15545 		queue_t		*stq;
15546 		ifrt_t		*ifrt;
15547 		uchar_t		*src_addr;
15548 		uchar_t		*gateway_addr;
15549 		ushort_t	type;
15550 
15551 		/*
15552 		 * When the ire was initially created and then added in
15553 		 * ip_rt_add(), it was created either using ipif->ipif_net_type
15554 		 * in the case of a traditional interface route, or as one of
15555 		 * the IRE_OFFSUBNET types (with the exception of
15556 		 * IRE_HOST types ire which is created by icmp_redirect() and
15557 		 * which we don't need to save or recover).  In the case where
15558 		 * ipif->ipif_net_type was IRE_LOOPBACK, ip_rt_add() will update
15559 		 * the ire_type to IRE_IF_NORESOLVER before calling ire_add()
15560 		 * to satisfy software like GateD and Sun Cluster which creates
15561 		 * routes using the the loopback interface's address as a
15562 		 * gateway.
15563 		 *
15564 		 * As ifrt->ifrt_type reflects the already updated ire_type,
15565 		 * ire_create() will be called in the same way here as
15566 		 * in ip_rt_add(), namely using ipif->ipif_net_type when
15567 		 * the route looks like a traditional interface route (where
15568 		 * ifrt->ifrt_type & IRE_INTERFACE is true) and otherwise using
15569 		 * the saved ifrt->ifrt_type.  This means that in the case where
15570 		 * ipif->ipif_net_type is IRE_LOOPBACK, the ire created by
15571 		 * ire_create() will be an IRE_LOOPBACK, it will then be turned
15572 		 * into an IRE_IF_NORESOLVER and then added by ire_add().
15573 		 */
15574 		ifrt = (ifrt_t *)mp->b_rptr;
15575 		ASSERT(ifrt->ifrt_type != IRE_CACHE);
15576 		if (ifrt->ifrt_type & IRE_INTERFACE) {
15577 			rfq = NULL;
15578 			stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
15579 			    ? ipif->ipif_rq : ipif->ipif_wq;
15580 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
15581 			    ? (uint8_t *)&ifrt->ifrt_src_addr
15582 			    : (uint8_t *)&ipif->ipif_src_addr;
15583 			gateway_addr = NULL;
15584 			type = ipif->ipif_net_type;
15585 		} else if (ifrt->ifrt_type & IRE_BROADCAST) {
15586 			/* Recover multiroute broadcast IRE. */
15587 			rfq = ipif->ipif_rq;
15588 			stq = ipif->ipif_wq;
15589 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
15590 			    ? (uint8_t *)&ifrt->ifrt_src_addr
15591 			    : (uint8_t *)&ipif->ipif_src_addr;
15592 			gateway_addr = (uint8_t *)&ifrt->ifrt_gateway_addr;
15593 			type = ifrt->ifrt_type;
15594 		} else {
15595 			rfq = NULL;
15596 			stq = NULL;
15597 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
15598 			    ? (uint8_t *)&ifrt->ifrt_src_addr : NULL;
15599 			gateway_addr = (uint8_t *)&ifrt->ifrt_gateway_addr;
15600 			type = ifrt->ifrt_type;
15601 		}
15602 
15603 		/*
15604 		 * Create a copy of the IRE with the saved address and netmask.
15605 		 */
15606 		ip1dbg(("ipif_recover_ire: creating IRE %s (%d) for "
15607 		    "0x%x/0x%x\n",
15608 		    ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type,
15609 		    ntohl(ifrt->ifrt_addr),
15610 		    ntohl(ifrt->ifrt_mask)));
15611 		ire = ire_create(
15612 		    (uint8_t *)&ifrt->ifrt_addr,
15613 		    (uint8_t *)&ifrt->ifrt_mask,
15614 		    src_addr,
15615 		    gateway_addr,
15616 		    &ifrt->ifrt_max_frag,
15617 		    NULL,
15618 		    rfq,
15619 		    stq,
15620 		    type,
15621 		    ipif,
15622 		    0,
15623 		    0,
15624 		    0,
15625 		    ifrt->ifrt_flags,
15626 		    &ifrt->ifrt_iulp_info,
15627 		    NULL,
15628 		    NULL,
15629 		    ipst);
15630 
15631 		if (ire == NULL) {
15632 			mutex_exit(&ipif->ipif_saved_ire_lock);
15633 			kmem_free(ipif_saved_irep,
15634 			    ipif->ipif_saved_ire_cnt * sizeof (ire_t *));
15635 			return (NULL);
15636 		}
15637 
15638 		/*
15639 		 * Some software (for example, GateD and Sun Cluster) attempts
15640 		 * to create (what amount to) IRE_PREFIX routes with the
15641 		 * loopback address as the gateway.  This is primarily done to
15642 		 * set up prefixes with the RTF_REJECT flag set (for example,
15643 		 * when generating aggregate routes.)
15644 		 *
15645 		 * If the IRE type (as defined by ipif->ipif_net_type) is
15646 		 * IRE_LOOPBACK, then we map the request into a
15647 		 * IRE_IF_NORESOLVER.
15648 		 */
15649 		if (ipif->ipif_net_type == IRE_LOOPBACK)
15650 			ire->ire_type = IRE_IF_NORESOLVER;
15651 		/*
15652 		 * ire held by ire_add, will be refreled' towards the
15653 		 * the end of ipif_up_done
15654 		 */
15655 		(void) ire_add(&ire, NULL, NULL, NULL, B_FALSE);
15656 		*irep = ire;
15657 		irep++;
15658 		ip1dbg(("ipif_recover_ire: added ire %p\n", (void *)ire));
15659 	}
15660 	mutex_exit(&ipif->ipif_saved_ire_lock);
15661 	return (ipif_saved_irep);
15662 }
15663 
15664 /*
15665  * Used to set the netmask and broadcast address to default values when the
15666  * interface is brought up.  (Always called as writer.)
15667  */
15668 static void
15669 ipif_set_default(ipif_t *ipif)
15670 {
15671 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
15672 
15673 	if (!ipif->ipif_isv6) {
15674 		/*
15675 		 * Interface holds an IPv4 address. Default
15676 		 * mask is the natural netmask.
15677 		 */
15678 		if (!ipif->ipif_net_mask) {
15679 			ipaddr_t	v4mask;
15680 
15681 			v4mask = ip_net_mask(ipif->ipif_lcl_addr);
15682 			V4MASK_TO_V6(v4mask, ipif->ipif_v6net_mask);
15683 		}
15684 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
15685 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
15686 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
15687 		} else {
15688 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
15689 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
15690 		}
15691 		/*
15692 		 * NOTE: SunOS 4.X does this even if the broadcast address
15693 		 * has been already set thus we do the same here.
15694 		 */
15695 		if (ipif->ipif_flags & IPIF_BROADCAST) {
15696 			ipaddr_t	v4addr;
15697 
15698 			v4addr = ipif->ipif_subnet | ~ipif->ipif_net_mask;
15699 			IN6_IPADDR_TO_V4MAPPED(v4addr, &ipif->ipif_v6brd_addr);
15700 		}
15701 	} else {
15702 		/*
15703 		 * Interface holds an IPv6-only address.  Default
15704 		 * mask is all-ones.
15705 		 */
15706 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
15707 			ipif->ipif_v6net_mask = ipv6_all_ones;
15708 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
15709 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
15710 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
15711 		} else {
15712 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
15713 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
15714 		}
15715 	}
15716 }
15717 
15718 /*
15719  * Return 0 if this address can be used as local address without causing
15720  * duplicate address problems. Otherwise, return EADDRNOTAVAIL if the address
15721  * is already up on a different ill, and EADDRINUSE if it's up on the same ill.
15722  * Note that the same IPv6 link-local address is allowed as long as the ills
15723  * are not on the same link.
15724  */
15725 int
15726 ip_addr_availability_check(ipif_t *new_ipif)
15727 {
15728 	in6_addr_t our_v6addr;
15729 	ill_t *ill;
15730 	ipif_t *ipif;
15731 	ill_walk_context_t ctx;
15732 	ip_stack_t	*ipst = new_ipif->ipif_ill->ill_ipst;
15733 
15734 	ASSERT(IAM_WRITER_IPIF(new_ipif));
15735 	ASSERT(MUTEX_HELD(&ipst->ips_ip_addr_avail_lock));
15736 	ASSERT(RW_READ_HELD(&ipst->ips_ill_g_lock));
15737 
15738 	new_ipif->ipif_flags &= ~IPIF_UNNUMBERED;
15739 	if (IN6_IS_ADDR_UNSPECIFIED(&new_ipif->ipif_v6lcl_addr) ||
15740 	    IN6_IS_ADDR_V4MAPPED_ANY(&new_ipif->ipif_v6lcl_addr))
15741 		return (0);
15742 
15743 	our_v6addr = new_ipif->ipif_v6lcl_addr;
15744 
15745 	if (new_ipif->ipif_isv6)
15746 		ill = ILL_START_WALK_V6(&ctx, ipst);
15747 	else
15748 		ill = ILL_START_WALK_V4(&ctx, ipst);
15749 
15750 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
15751 		for (ipif = ill->ill_ipif; ipif != NULL;
15752 		    ipif = ipif->ipif_next) {
15753 			if ((ipif == new_ipif) ||
15754 			    !(ipif->ipif_flags & IPIF_UP) ||
15755 			    (ipif->ipif_flags & IPIF_UNNUMBERED) ||
15756 			    !IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
15757 			    &our_v6addr))
15758 				continue;
15759 
15760 			if (new_ipif->ipif_flags & IPIF_POINTOPOINT)
15761 				new_ipif->ipif_flags |= IPIF_UNNUMBERED;
15762 			else if (ipif->ipif_flags & IPIF_POINTOPOINT)
15763 				ipif->ipif_flags |= IPIF_UNNUMBERED;
15764 			else if ((IN6_IS_ADDR_LINKLOCAL(&our_v6addr) ||
15765 			    IN6_IS_ADDR_SITELOCAL(&our_v6addr)) &&
15766 			    !IS_ON_SAME_LAN(ill, new_ipif->ipif_ill))
15767 				continue;
15768 			else if (new_ipif->ipif_zoneid != ipif->ipif_zoneid &&
15769 			    ipif->ipif_zoneid != ALL_ZONES && IS_LOOPBACK(ill))
15770 				continue;
15771 			else if (new_ipif->ipif_ill == ill)
15772 				return (EADDRINUSE);
15773 			else
15774 				return (EADDRNOTAVAIL);
15775 		}
15776 	}
15777 
15778 	return (0);
15779 }
15780 
15781 /*
15782  * Bring up an ipif: bring up arp/ndp, bring up the DLPI stream, and add
15783  * IREs for the ipif.
15784  * When the routine returns EINPROGRESS then mp has been consumed and
15785  * the ioctl will be acked from ip_rput_dlpi.
15786  */
15787 int
15788 ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp)
15789 {
15790 	ill_t		*ill = ipif->ipif_ill;
15791 	boolean_t 	isv6 = ipif->ipif_isv6;
15792 	int		err = 0;
15793 	boolean_t	success;
15794 	uint_t		ipif_orig_id;
15795 	ip_stack_t	*ipst = ill->ill_ipst;
15796 
15797 	ASSERT(IAM_WRITER_IPIF(ipif));
15798 
15799 	ip1dbg(("ipif_up(%s:%u)\n", ill->ill_name, ipif->ipif_id));
15800 
15801 	/* Shouldn't get here if it is already up. */
15802 	if (ipif->ipif_flags & IPIF_UP)
15803 		return (EALREADY);
15804 
15805 	/*
15806 	 * If this is a request to bring up a data address on an interface
15807 	 * under IPMP, then move the address to its IPMP meta-interface and
15808 	 * try to bring it up.  One complication is that the zeroth ipif for
15809 	 * an ill is special, in that every ill always has one, and that code
15810 	 * throughout IP deferences ill->ill_ipif without holding any locks.
15811 	 */
15812 	if (IS_UNDER_IPMP(ill) && ipmp_ipif_is_dataaddr(ipif) &&
15813 	    (!ipif->ipif_isv6 || !V6_IPIF_LINKLOCAL(ipif))) {
15814 		ipif_t	*stubipif = NULL, *moveipif = NULL;
15815 		ill_t	*ipmp_ill = ipmp_illgrp_ipmp_ill(ill->ill_grp);
15816 
15817 		/*
15818 		 * The ipif being brought up should be quiesced.  If it's not,
15819 		 * something has gone amiss and we need to bail out.  (If it's
15820 		 * quiesced, we know it will remain so via IPIF_CHANGING.)
15821 		 */
15822 		mutex_enter(&ill->ill_lock);
15823 		if (!ipif_is_quiescent(ipif)) {
15824 			mutex_exit(&ill->ill_lock);
15825 			return (EINVAL);
15826 		}
15827 		mutex_exit(&ill->ill_lock);
15828 
15829 		/*
15830 		 * If we're going to need to allocate ipifs, do it prior
15831 		 * to starting the move (and grabbing locks).
15832 		 */
15833 		if (ipif->ipif_id == 0) {
15834 			moveipif = ipif_allocate(ill, 0, IRE_LOCAL, B_TRUE,
15835 			    B_FALSE);
15836 			stubipif = ipif_allocate(ill, 0, IRE_LOCAL, B_TRUE,
15837 			    B_FALSE);
15838 			if (moveipif == NULL || stubipif == NULL) {
15839 				mi_free(moveipif);
15840 				mi_free(stubipif);
15841 				return (ENOMEM);
15842 			}
15843 		}
15844 
15845 		/*
15846 		 * Grab or transfer the ipif to move.  During the move, keep
15847 		 * ill_g_lock held to prevent any ill walker threads from
15848 		 * seeing things in an inconsistent state.
15849 		 */
15850 		rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15851 		if (ipif->ipif_id != 0) {
15852 			ipif_remove(ipif);
15853 		} else {
15854 			ipif_transfer(ipif, moveipif, stubipif);
15855 			ipif = moveipif;
15856 		}
15857 
15858 		/*
15859 		 * Place the ipif on the IPMP ill.  If the zeroth ipif on
15860 		 * the IPMP ill is a stub (0.0.0.0 down address) then we
15861 		 * replace that one.  Otherwise, pick the next available slot.
15862 		 */
15863 		ipif->ipif_ill = ipmp_ill;
15864 		ipif_orig_id = ipif->ipif_id;
15865 
15866 		if (ipmp_ipif_is_stubaddr(ipmp_ill->ill_ipif)) {
15867 			ipif_transfer(ipif, ipmp_ill->ill_ipif, NULL);
15868 			ipif = ipmp_ill->ill_ipif;
15869 		} else {
15870 			ipif->ipif_id = -1;
15871 			if (ipif_insert(ipif, B_FALSE) != 0) {
15872 				/*
15873 				 * No more available ipif_id's -- put it back
15874 				 * on the original ill and fail the operation.
15875 				 * Since we're writer on the ill, we can be
15876 				 * sure our old slot is still available.
15877 				 */
15878 				ipif->ipif_id = ipif_orig_id;
15879 				ipif->ipif_ill = ill;
15880 				if (ipif_orig_id == 0) {
15881 					ipif_transfer(ipif, ill->ill_ipif,
15882 					    NULL);
15883 				} else {
15884 					VERIFY(ipif_insert(ipif, B_FALSE) == 0);
15885 				}
15886 				rw_exit(&ipst->ips_ill_g_lock);
15887 				return (ENOMEM);
15888 			}
15889 		}
15890 		rw_exit(&ipst->ips_ill_g_lock);
15891 
15892 		/*
15893 		 * Tell SCTP that the ipif has moved.  Note that even if we
15894 		 * had to allocate a new ipif, the original sequence id was
15895 		 * preserved and therefore SCTP won't know.
15896 		 */
15897 		sctp_move_ipif(ipif, ill, ipmp_ill);
15898 
15899 		/*
15900 		 * If the ipif being brought up was on slot zero, then we
15901 		 * first need to bring up the placeholder we stuck there.  In
15902 		 * ip_rput_dlpi_writer(), ip_arp_done(), or the recursive call
15903 		 * to ipif_up() itself, if we successfully bring up the
15904 		 * placeholder, we'll check ill_move_ipif and bring it up too.
15905 		 */
15906 		if (ipif_orig_id == 0) {
15907 			ASSERT(ill->ill_move_ipif == NULL);
15908 			ill->ill_move_ipif = ipif;
15909 			if ((err = ipif_up(ill->ill_ipif, q, mp)) == 0)
15910 				ASSERT(ill->ill_move_ipif == NULL);
15911 			if (err != EINPROGRESS)
15912 				ill->ill_move_ipif = NULL;
15913 			return (err);
15914 		}
15915 
15916 		/*
15917 		 * Bring it up on the IPMP ill.
15918 		 */
15919 		return (ipif_up(ipif, q, mp));
15920 	}
15921 
15922 	/* Skip arp/ndp for any loopback interface. */
15923 	if (ill->ill_wq != NULL) {
15924 		conn_t *connp = CONN_Q(q) ? Q_TO_CONN(q) : NULL;
15925 		ipsq_t	*ipsq = ill->ill_phyint->phyint_ipsq;
15926 
15927 		if (!ill->ill_dl_up) {
15928 			/*
15929 			 * ill_dl_up is not yet set. i.e. we are yet to
15930 			 * DL_BIND with the driver and this is the first
15931 			 * logical interface on the ill to become "up".
15932 			 * Tell the driver to get going (via DL_BIND_REQ).
15933 			 * Note that changing "significant" IFF_ flags
15934 			 * address/netmask etc cause a down/up dance, but
15935 			 * does not cause an unbind (DL_UNBIND) with the driver
15936 			 */
15937 			return (ill_dl_up(ill, ipif, mp, q));
15938 		}
15939 
15940 		/*
15941 		 * ipif_resolver_up may end up sending an
15942 		 * AR_INTERFACE_UP message to ARP, which would, in
15943 		 * turn send a DLPI message to the driver. ioctls are
15944 		 * serialized and so we cannot send more than one
15945 		 * interface up message at a time. If ipif_resolver_up
15946 		 * does send an interface up message to ARP, we get
15947 		 * EINPROGRESS and we will complete in ip_arp_done.
15948 		 */
15949 
15950 		ASSERT(connp != NULL || !CONN_Q(q));
15951 		if (connp != NULL)
15952 			mutex_enter(&connp->conn_lock);
15953 		mutex_enter(&ill->ill_lock);
15954 		success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
15955 		mutex_exit(&ill->ill_lock);
15956 		if (connp != NULL)
15957 			mutex_exit(&connp->conn_lock);
15958 		if (!success)
15959 			return (EINTR);
15960 
15961 		/*
15962 		 * Crank up the resolver.  For IPv6, this cranks up the
15963 		 * external resolver if one is configured, but even if an
15964 		 * external resolver isn't configured, it must be called to
15965 		 * reset DAD state.  For IPv6, if an external resolver is not
15966 		 * being used, ipif_resolver_up() will never return
15967 		 * EINPROGRESS, so we can always call ipif_ndp_up() here.
15968 		 * Note that if an external resolver is being used, there's no
15969 		 * need to call ipif_ndp_up() since it will do nothing.
15970 		 */
15971 		err = ipif_resolver_up(ipif, Res_act_initial);
15972 		if (err == EINPROGRESS) {
15973 			/* We will complete it in ip_arp_done() */
15974 			return (err);
15975 		}
15976 
15977 		if (isv6 && err == 0)
15978 			err = ipif_ndp_up(ipif, B_TRUE);
15979 
15980 		ASSERT(err != EINPROGRESS);
15981 		mp = ipsq_pending_mp_get(ipsq, &connp);
15982 		ASSERT(mp != NULL);
15983 		if (err != 0)
15984 			return (err);
15985 	} else {
15986 		/*
15987 		 * Interfaces without underlying hardware don't do duplicate
15988 		 * address detection.
15989 		 */
15990 		ASSERT(!(ipif->ipif_flags & IPIF_DUPLICATE));
15991 		ipif->ipif_addr_ready = 1;
15992 	}
15993 
15994 	err = isv6 ? ipif_up_done_v6(ipif) : ipif_up_done(ipif);
15995 	if (err == 0 && ill->ill_move_ipif != NULL) {
15996 		ipif = ill->ill_move_ipif;
15997 		ill->ill_move_ipif = NULL;
15998 		return (ipif_up(ipif, q, mp));
15999 	}
16000 	return (err);
16001 }
16002 
16003 /*
16004  * Perform a bind for the physical device.
16005  * When the routine returns EINPROGRESS then mp has been consumed and
16006  * the ioctl will be acked from ip_rput_dlpi.
16007  * Allocate an unbind message and save it until ipif_down.
16008  */
16009 static int
16010 ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
16011 {
16012 	areq_t	*areq;
16013 	mblk_t	*areq_mp = NULL;
16014 	mblk_t	*bind_mp = NULL;
16015 	mblk_t	*unbind_mp = NULL;
16016 	conn_t	*connp;
16017 	boolean_t success;
16018 	uint16_t sap_addr;
16019 
16020 	ip1dbg(("ill_dl_up(%s)\n", ill->ill_name));
16021 	ASSERT(IAM_WRITER_ILL(ill));
16022 	ASSERT(mp != NULL);
16023 
16024 	/* Create a resolver cookie for ARP */
16025 	if (!ill->ill_isv6 && ill->ill_net_type == IRE_IF_RESOLVER) {
16026 		areq_mp = ill_arp_alloc(ill, (uchar_t *)&ip_areq_template, 0);
16027 		if (areq_mp == NULL)
16028 			return (ENOMEM);
16029 
16030 		freemsg(ill->ill_resolver_mp);
16031 		ill->ill_resolver_mp = areq_mp;
16032 		areq = (areq_t *)areq_mp->b_rptr;
16033 		sap_addr = ill->ill_sap;
16034 		bcopy(&sap_addr, areq->areq_sap, sizeof (sap_addr));
16035 	}
16036 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
16037 	    DL_BIND_REQ);
16038 	if (bind_mp == NULL)
16039 		goto bad;
16040 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
16041 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
16042 
16043 	unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ);
16044 	if (unbind_mp == NULL)
16045 		goto bad;
16046 
16047 	/*
16048 	 * Record state needed to complete this operation when the
16049 	 * DL_BIND_ACK shows up.  Also remember the pre-allocated mblks.
16050 	 */
16051 	connp = CONN_Q(q) ? Q_TO_CONN(q) : NULL;
16052 	ASSERT(connp != NULL || !CONN_Q(q));
16053 	GRAB_CONN_LOCK(q);
16054 	mutex_enter(&ipif->ipif_ill->ill_lock);
16055 	success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
16056 	mutex_exit(&ipif->ipif_ill->ill_lock);
16057 	RELEASE_CONN_LOCK(q);
16058 	if (!success)
16059 		goto bad;
16060 
16061 	/*
16062 	 * Save the unbind message for ill_dl_down(); it will be consumed when
16063 	 * the interface goes down.
16064 	 */
16065 	ASSERT(ill->ill_unbind_mp == NULL);
16066 	ill->ill_unbind_mp = unbind_mp;
16067 
16068 	ill_dlpi_send(ill, bind_mp);
16069 	/* Send down link-layer capabilities probe if not already done. */
16070 	ill_capability_probe(ill);
16071 
16072 	/*
16073 	 * Sysid used to rely on the fact that netboots set domainname
16074 	 * and the like. Now that miniroot boots aren't strictly netboots
16075 	 * and miniroot network configuration is driven from userland
16076 	 * these things still need to be set. This situation can be detected
16077 	 * by comparing the interface being configured here to the one
16078 	 * dhcifname was set to reference by the boot loader. Once sysid is
16079 	 * converted to use dhcp_ipc_getinfo() this call can go away.
16080 	 */
16081 	if ((ipif->ipif_flags & IPIF_DHCPRUNNING) &&
16082 	    (strcmp(ill->ill_name, dhcifname) == 0) &&
16083 	    (strlen(srpc_domain) == 0)) {
16084 		if (dhcpinit() != 0)
16085 			cmn_err(CE_WARN, "no cached dhcp response");
16086 	}
16087 
16088 	/*
16089 	 * This operation will complete in ip_rput_dlpi with either
16090 	 * a DL_BIND_ACK or DL_ERROR_ACK.
16091 	 */
16092 	return (EINPROGRESS);
16093 bad:
16094 	ip1dbg(("ill_dl_up(%s) FAILED\n", ill->ill_name));
16095 
16096 	freemsg(bind_mp);
16097 	freemsg(unbind_mp);
16098 	return (ENOMEM);
16099 }
16100 
16101 uint_t ip_loopback_mtuplus = IP_LOOPBACK_MTU + IP_SIMPLE_HDR_LENGTH + 20;
16102 
16103 /*
16104  * DLPI and ARP is up.
16105  * Create all the IREs associated with an interface bring up multicast.
16106  * Set the interface flag and finish other initialization
16107  * that potentially had to be differed to after DL_BIND_ACK.
16108  */
16109 int
16110 ipif_up_done(ipif_t *ipif)
16111 {
16112 	ire_t	*ire_array[20];
16113 	ire_t	**irep = ire_array;
16114 	ire_t	**irep1;
16115 	ipaddr_t net_mask = 0;
16116 	ipaddr_t subnet_mask, route_mask;
16117 	ill_t	*ill = ipif->ipif_ill;
16118 	queue_t	*stq;
16119 	ipif_t	 *src_ipif;
16120 	ipif_t   *tmp_ipif;
16121 	boolean_t	flush_ire_cache = B_TRUE;
16122 	int	err = 0;
16123 	ire_t	**ipif_saved_irep = NULL;
16124 	int ipif_saved_ire_cnt;
16125 	int	cnt;
16126 	boolean_t	src_ipif_held = B_FALSE;
16127 	boolean_t	loopback = B_FALSE;
16128 	ip_stack_t	*ipst = ill->ill_ipst;
16129 
16130 	ip1dbg(("ipif_up_done(%s:%u)\n",
16131 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
16132 	/* Check if this is a loopback interface */
16133 	if (ipif->ipif_ill->ill_wq == NULL)
16134 		loopback = B_TRUE;
16135 
16136 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
16137 	/*
16138 	 * If all other interfaces for this ill are down or DEPRECATED,
16139 	 * or otherwise unsuitable for source address selection, remove
16140 	 * any IRE_CACHE entries for this ill to make sure source
16141 	 * address selection gets to take this new ipif into account.
16142 	 * No need to hold ill_lock while traversing the ipif list since
16143 	 * we are writer
16144 	 */
16145 	for (tmp_ipif = ill->ill_ipif; tmp_ipif;
16146 	    tmp_ipif = tmp_ipif->ipif_next) {
16147 		if (((tmp_ipif->ipif_flags &
16148 		    (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
16149 		    !(tmp_ipif->ipif_flags & IPIF_UP)) ||
16150 		    (tmp_ipif == ipif))
16151 			continue;
16152 		/* first useable pre-existing interface */
16153 		flush_ire_cache = B_FALSE;
16154 		break;
16155 	}
16156 	if (flush_ire_cache)
16157 		ire_walk_ill_v4(MATCH_IRE_ILL | MATCH_IRE_TYPE,
16158 		    IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill);
16159 
16160 	/*
16161 	 * Figure out which way the send-to queue should go.  Only
16162 	 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER or IRE_LOOPBACK
16163 	 * should show up here.
16164 	 */
16165 	switch (ill->ill_net_type) {
16166 	case IRE_IF_RESOLVER:
16167 		stq = ill->ill_rq;
16168 		break;
16169 	case IRE_IF_NORESOLVER:
16170 	case IRE_LOOPBACK:
16171 		stq = ill->ill_wq;
16172 		break;
16173 	default:
16174 		return (EINVAL);
16175 	}
16176 
16177 	if (IS_LOOPBACK(ill)) {
16178 		/*
16179 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
16180 		 * ipif_lookup_on_name(), but in the case of zones we can have
16181 		 * several loopback addresses on lo0. So all the interfaces with
16182 		 * loopback addresses need to be marked IRE_LOOPBACK.
16183 		 */
16184 		if (V4_PART_OF_V6(ipif->ipif_v6lcl_addr) ==
16185 		    htonl(INADDR_LOOPBACK))
16186 			ipif->ipif_ire_type = IRE_LOOPBACK;
16187 		else
16188 			ipif->ipif_ire_type = IRE_LOCAL;
16189 	}
16190 
16191 	if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST) ||
16192 	    ((ipif->ipif_flags & IPIF_DEPRECATED) &&
16193 	    !(ipif->ipif_flags & IPIF_NOFAILOVER))) {
16194 		/*
16195 		 * Can't use our source address. Select a different
16196 		 * source address for the IRE_INTERFACE and IRE_LOCAL
16197 		 */
16198 		src_ipif = ipif_select_source(ipif->ipif_ill,
16199 		    ipif->ipif_subnet, ipif->ipif_zoneid);
16200 		if (src_ipif == NULL)
16201 			src_ipif = ipif;	/* Last resort */
16202 		else
16203 			src_ipif_held = B_TRUE;
16204 	} else {
16205 		src_ipif = ipif;
16206 	}
16207 
16208 	/* Create all the IREs associated with this interface */
16209 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
16210 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
16211 
16212 		/*
16213 		 * If we're on a labeled system then make sure that zone-
16214 		 * private addresses have proper remote host database entries.
16215 		 */
16216 		if (is_system_labeled() &&
16217 		    ipif->ipif_ire_type != IRE_LOOPBACK &&
16218 		    !tsol_check_interface_address(ipif))
16219 			return (EINVAL);
16220 
16221 		/* Register the source address for __sin6_src_id */
16222 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
16223 		    ipif->ipif_zoneid, ipst);
16224 		if (err != 0) {
16225 			ip0dbg(("ipif_up_done: srcid_insert %d\n", err));
16226 			return (err);
16227 		}
16228 
16229 		/* If the interface address is set, create the local IRE. */
16230 		ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x for 0x%x\n",
16231 		    (void *)ipif,
16232 		    ipif->ipif_ire_type,
16233 		    ntohl(ipif->ipif_lcl_addr)));
16234 		*irep++ = ire_create(
16235 		    (uchar_t *)&ipif->ipif_lcl_addr,	/* dest address */
16236 		    (uchar_t *)&ip_g_all_ones,		/* mask */
16237 		    (uchar_t *)&src_ipif->ipif_src_addr, /* source address */
16238 		    NULL,				/* no gateway */
16239 		    &ip_loopback_mtuplus,		/* max frag size */
16240 		    NULL,
16241 		    ipif->ipif_rq,			/* recv-from queue */
16242 		    NULL,				/* no send-to queue */
16243 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
16244 		    ipif,
16245 		    0,
16246 		    0,
16247 		    0,
16248 		    (ipif->ipif_flags & IPIF_PRIVATE) ?
16249 		    RTF_PRIVATE : 0,
16250 		    &ire_uinfo_null,
16251 		    NULL,
16252 		    NULL,
16253 		    ipst);
16254 	} else {
16255 		ip1dbg((
16256 		    "ipif_up_done: not creating IRE %d for 0x%x: flags 0x%x\n",
16257 		    ipif->ipif_ire_type,
16258 		    ntohl(ipif->ipif_lcl_addr),
16259 		    (uint_t)ipif->ipif_flags));
16260 	}
16261 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
16262 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
16263 		net_mask = ip_net_mask(ipif->ipif_lcl_addr);
16264 	} else {
16265 		net_mask = htonl(IN_CLASSA_NET);	/* fallback */
16266 	}
16267 
16268 	subnet_mask = ipif->ipif_net_mask;
16269 
16270 	/*
16271 	 * If mask was not specified, use natural netmask of
16272 	 * interface address. Also, store this mask back into the
16273 	 * ipif struct.
16274 	 */
16275 	if (subnet_mask == 0) {
16276 		subnet_mask = net_mask;
16277 		V4MASK_TO_V6(subnet_mask, ipif->ipif_v6net_mask);
16278 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
16279 		    ipif->ipif_v6subnet);
16280 	}
16281 
16282 	/* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */
16283 	if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) &&
16284 	    ipif->ipif_subnet != INADDR_ANY) {
16285 		/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
16286 
16287 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
16288 			route_mask = IP_HOST_MASK;
16289 		} else {
16290 			route_mask = subnet_mask;
16291 		}
16292 
16293 		ip1dbg(("ipif_up_done: ipif 0x%p ill 0x%p "
16294 		    "creating if IRE ill_net_type 0x%x for 0x%x\n",
16295 		    (void *)ipif, (void *)ill,
16296 		    ill->ill_net_type,
16297 		    ntohl(ipif->ipif_subnet)));
16298 		*irep++ = ire_create(
16299 		    (uchar_t *)&ipif->ipif_subnet,	/* dest address */
16300 		    (uchar_t *)&route_mask,		/* mask */
16301 		    (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */
16302 		    NULL,				/* no gateway */
16303 		    &ipif->ipif_mtu,			/* max frag */
16304 		    NULL,
16305 		    NULL,				/* no recv queue */
16306 		    stq,				/* send-to queue */
16307 		    ill->ill_net_type,			/* IF_[NO]RESOLVER */
16308 		    ipif,
16309 		    0,
16310 		    0,
16311 		    0,
16312 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE: 0,
16313 		    &ire_uinfo_null,
16314 		    NULL,
16315 		    NULL,
16316 		    ipst);
16317 	}
16318 
16319 	/*
16320 	 * Create any necessary broadcast IREs.
16321 	 */
16322 	if (ipif->ipif_flags & IPIF_BROADCAST)
16323 		irep = ipif_create_bcast_ires(ipif, irep);
16324 
16325 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
16326 
16327 	/* If an earlier ire_create failed, get out now */
16328 	for (irep1 = irep; irep1 > ire_array; ) {
16329 		irep1--;
16330 		if (*irep1 == NULL) {
16331 			ip1dbg(("ipif_up_done: NULL ire found in ire_array\n"));
16332 			err = ENOMEM;
16333 			goto bad;
16334 		}
16335 	}
16336 
16337 	/*
16338 	 * Need to atomically check for IP address availability under
16339 	 * ip_addr_avail_lock.  ill_g_lock is held as reader to ensure no new
16340 	 * ills or new ipifs can be added while we are checking availability.
16341 	 */
16342 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
16343 	mutex_enter(&ipst->ips_ip_addr_avail_lock);
16344 	/* Mark it up, and increment counters. */
16345 	ipif->ipif_flags |= IPIF_UP;
16346 	ill->ill_ipif_up_count++;
16347 	err = ip_addr_availability_check(ipif);
16348 	mutex_exit(&ipst->ips_ip_addr_avail_lock);
16349 	rw_exit(&ipst->ips_ill_g_lock);
16350 
16351 	if (err != 0) {
16352 		/*
16353 		 * Our address may already be up on the same ill. In this case,
16354 		 * the ARP entry for our ipif replaced the one for the other
16355 		 * ipif. So we don't want to delete it (otherwise the other ipif
16356 		 * would be unable to send packets).
16357 		 * ip_addr_availability_check() identifies this case for us and
16358 		 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL
16359 		 * which is the expected error code.
16360 		 */
16361 		if (err == EADDRINUSE) {
16362 			freemsg(ipif->ipif_arp_del_mp);
16363 			ipif->ipif_arp_del_mp = NULL;
16364 			err = EADDRNOTAVAIL;
16365 		}
16366 		ill->ill_ipif_up_count--;
16367 		ipif->ipif_flags &= ~IPIF_UP;
16368 		goto bad;
16369 	}
16370 
16371 	/*
16372 	 * Add in all newly created IREs.  ire_create_bcast() has
16373 	 * already checked for duplicates of the IRE_BROADCAST type.
16374 	 */
16375 	for (irep1 = irep; irep1 > ire_array; ) {
16376 		irep1--;
16377 		ASSERT(!MUTEX_HELD(&((*irep1)->ire_ipif->ipif_ill->ill_lock)));
16378 		/*
16379 		 * refheld by ire_add. refele towards the end of the func
16380 		 */
16381 		(void) ire_add(irep1, NULL, NULL, NULL, B_FALSE);
16382 	}
16383 
16384 	/* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */
16385 	ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt;
16386 	ipif_saved_irep = ipif_recover_ire(ipif);
16387 
16388 	if (!loopback) {
16389 		/*
16390 		 * If the broadcast address has been set, make sure it makes
16391 		 * sense based on the interface address.
16392 		 * Only match on ill since we are sharing broadcast addresses.
16393 		 */
16394 		if ((ipif->ipif_brd_addr != INADDR_ANY) &&
16395 		    (ipif->ipif_flags & IPIF_BROADCAST)) {
16396 			ire_t	*ire;
16397 
16398 			ire = ire_ctable_lookup(ipif->ipif_brd_addr, 0,
16399 			    IRE_BROADCAST, ipif, ALL_ZONES,
16400 			    NULL, (MATCH_IRE_TYPE | MATCH_IRE_ILL), ipst);
16401 
16402 			if (ire == NULL) {
16403 				/*
16404 				 * If there isn't a matching broadcast IRE,
16405 				 * revert to the default for this netmask.
16406 				 */
16407 				ipif->ipif_v6brd_addr = ipv6_all_zeros;
16408 				mutex_enter(&ipif->ipif_ill->ill_lock);
16409 				ipif_set_default(ipif);
16410 				mutex_exit(&ipif->ipif_ill->ill_lock);
16411 			} else {
16412 				ire_refrele(ire);
16413 			}
16414 		}
16415 
16416 	}
16417 
16418 	if (ill->ill_need_recover_multicast) {
16419 		/*
16420 		 * Need to recover all multicast memberships in the driver.
16421 		 * This had to be deferred until we had attached.  The same
16422 		 * code exists in ipif_up_done_v6() to recover IPv6
16423 		 * memberships.
16424 		 *
16425 		 * Note that it would be preferable to unconditionally do the
16426 		 * ill_recover_multicast() in ill_dl_up(), but we cannot do
16427 		 * that since ill_join_allmulti() depends on ill_dl_up being
16428 		 * set, and it is not set until we receive a DL_BIND_ACK after
16429 		 * having called ill_dl_up().
16430 		 */
16431 		ill_recover_multicast(ill);
16432 	}
16433 
16434 	if (ill->ill_ipif_up_count == 1) {
16435 		/*
16436 		 * Since the interface is now up, it may now be active.
16437 		 */
16438 		if (IS_UNDER_IPMP(ill))
16439 			ipmp_ill_refresh_active(ill);
16440 
16441 		/*
16442 		 * If this is an IPMP interface, we may now be able to
16443 		 * establish ARP entries.
16444 		 */
16445 		if (IS_IPMP(ill))
16446 			ipmp_illgrp_refresh_arpent(ill->ill_grp);
16447 	}
16448 
16449 	/* Join the allhosts multicast address */
16450 	ipif_multicast_up(ipif);
16451 
16452 	/*
16453 	 * See if anybody else would benefit from our new ipif.
16454 	 */
16455 	if (!loopback &&
16456 	    !(ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) {
16457 		ill_update_source_selection(ill);
16458 	}
16459 
16460 	for (irep1 = irep; irep1 > ire_array; ) {
16461 		irep1--;
16462 		if (*irep1 != NULL) {
16463 			/* was held in ire_add */
16464 			ire_refrele(*irep1);
16465 		}
16466 	}
16467 
16468 	cnt = ipif_saved_ire_cnt;
16469 	for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) {
16470 		if (*irep1 != NULL) {
16471 			/* was held in ire_add */
16472 			ire_refrele(*irep1);
16473 		}
16474 	}
16475 
16476 	if (!loopback && ipif->ipif_addr_ready) {
16477 		/* Broadcast an address mask reply. */
16478 		ipif_mask_reply(ipif);
16479 	}
16480 	if (ipif_saved_irep != NULL) {
16481 		kmem_free(ipif_saved_irep,
16482 		    ipif_saved_ire_cnt * sizeof (ire_t *));
16483 	}
16484 	if (src_ipif_held)
16485 		ipif_refrele(src_ipif);
16486 
16487 	/*
16488 	 * This had to be deferred until we had bound.  Tell routing sockets and
16489 	 * others that this interface is up if it looks like the address has
16490 	 * been validated.  Otherwise, if it isn't ready yet, wait for
16491 	 * duplicate address detection to do its thing.
16492 	 */
16493 	if (ipif->ipif_addr_ready)
16494 		ipif_up_notify(ipif);
16495 	return (0);
16496 
16497 bad:
16498 	ip1dbg(("ipif_up_done: FAILED \n"));
16499 
16500 	while (irep > ire_array) {
16501 		irep--;
16502 		if (*irep != NULL)
16503 			ire_delete(*irep);
16504 	}
16505 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst);
16506 
16507 	if (ipif_saved_irep != NULL) {
16508 		kmem_free(ipif_saved_irep,
16509 		    ipif_saved_ire_cnt * sizeof (ire_t *));
16510 	}
16511 	if (src_ipif_held)
16512 		ipif_refrele(src_ipif);
16513 
16514 	ipif_resolver_down(ipif);
16515 	return (err);
16516 }
16517 
16518 /*
16519  * Turn off the ARP with the ILLF_NOARP flag.
16520  */
16521 static int
16522 ill_arp_off(ill_t *ill)
16523 {
16524 	mblk_t	*arp_off_mp = NULL;
16525 	mblk_t	*arp_on_mp = NULL;
16526 
16527 	ip1dbg(("ill_arp_off(%s)\n", ill->ill_name));
16528 
16529 	ASSERT(IAM_WRITER_ILL(ill));
16530 	ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
16531 
16532 	/*
16533 	 * If the on message is still around we've already done
16534 	 * an arp_off without doing an arp_on thus there is no
16535 	 * work needed.
16536 	 */
16537 	if (ill->ill_arp_on_mp != NULL)
16538 		return (0);
16539 
16540 	/*
16541 	 * Allocate an ARP on message (to be saved) and an ARP off message
16542 	 */
16543 	arp_off_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aroff_template, 0);
16544 	if (!arp_off_mp)
16545 		return (ENOMEM);
16546 
16547 	arp_on_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aron_template, 0);
16548 	if (!arp_on_mp)
16549 		goto failed;
16550 
16551 	ASSERT(ill->ill_arp_on_mp == NULL);
16552 	ill->ill_arp_on_mp = arp_on_mp;
16553 
16554 	/* Send an AR_INTERFACE_OFF request */
16555 	putnext(ill->ill_rq, arp_off_mp);
16556 	return (0);
16557 failed:
16558 
16559 	if (arp_off_mp)
16560 		freemsg(arp_off_mp);
16561 	return (ENOMEM);
16562 }
16563 
16564 /*
16565  * Turn on ARP by turning off the ILLF_NOARP flag.
16566  */
16567 static int
16568 ill_arp_on(ill_t *ill)
16569 {
16570 	mblk_t	*mp;
16571 
16572 	ip1dbg(("ipif_arp_on(%s)\n", ill->ill_name));
16573 
16574 	ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
16575 
16576 	ASSERT(IAM_WRITER_ILL(ill));
16577 	/*
16578 	 * Send an AR_INTERFACE_ON request if we have already done
16579 	 * an arp_off (which allocated the message).
16580 	 */
16581 	if (ill->ill_arp_on_mp != NULL) {
16582 		mp = ill->ill_arp_on_mp;
16583 		ill->ill_arp_on_mp = NULL;
16584 		putnext(ill->ill_rq, mp);
16585 	}
16586 	return (0);
16587 }
16588 
16589 /*
16590  * Checks for availbility of a usable source address (if there is one) when the
16591  * destination ILL has the ill_usesrc_ifindex pointing to another ILL. Note
16592  * this selection is done regardless of the destination.
16593  */
16594 boolean_t
16595 ipif_usesrc_avail(ill_t *ill, zoneid_t zoneid)
16596 {
16597 	uint_t	ifindex;
16598 	ipif_t	*ipif = NULL;
16599 	ill_t	*uill;
16600 	boolean_t isv6;
16601 	ip_stack_t	*ipst = ill->ill_ipst;
16602 
16603 	ASSERT(ill != NULL);
16604 
16605 	isv6 = ill->ill_isv6;
16606 	ifindex = ill->ill_usesrc_ifindex;
16607 	if (ifindex != 0) {
16608 		uill = ill_lookup_on_ifindex(ifindex, isv6, NULL, NULL, NULL,
16609 		    NULL, ipst);
16610 		if (uill == NULL)
16611 			return (NULL);
16612 		mutex_enter(&uill->ill_lock);
16613 		for (ipif = uill->ill_ipif; ipif != NULL;
16614 		    ipif = ipif->ipif_next) {
16615 			if (!IPIF_CAN_LOOKUP(ipif))
16616 				continue;
16617 			if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
16618 				continue;
16619 			if (!(ipif->ipif_flags & IPIF_UP))
16620 				continue;
16621 			if (ipif->ipif_zoneid != zoneid)
16622 				continue;
16623 			if ((isv6 &&
16624 			    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) ||
16625 			    (ipif->ipif_lcl_addr == INADDR_ANY))
16626 				continue;
16627 			mutex_exit(&uill->ill_lock);
16628 			ill_refrele(uill);
16629 			return (B_TRUE);
16630 		}
16631 		mutex_exit(&uill->ill_lock);
16632 		ill_refrele(uill);
16633 	}
16634 	return (B_FALSE);
16635 }
16636 
16637 /*
16638  * IP source address type, sorted from worst to best.  For a given type,
16639  * always prefer IP addresses on the same subnet.  All-zones addresses are
16640  * suboptimal because they pose problems with unlabeled destinations.
16641  */
16642 typedef enum {
16643 	IPIF_NONE,
16644 	IPIF_DIFFNET_DEPRECATED, 	/* deprecated and different subnet */
16645 	IPIF_SAMENET_DEPRECATED, 	/* deprecated and same subnet */
16646 	IPIF_DIFFNET_ALLZONES,		/* allzones and different subnet */
16647 	IPIF_SAMENET_ALLZONES,		/* allzones and same subnet */
16648 	IPIF_DIFFNET,			/* normal and different subnet */
16649 	IPIF_SAMENET			/* normal and same subnet */
16650 } ipif_type_t;
16651 
16652 /*
16653  * Pick the optimal ipif on `ill' for sending to destination `dst' from zone
16654  * `zoneid'.  We rate usable ipifs from low -> high as per the ipif_type_t
16655  * enumeration, and return the highest-rated ipif.  If there's a tie, we pick
16656  * the first one, unless IPMP is used in which case we round-robin among them;
16657  * see below for more.
16658  *
16659  * Returns NULL if there is no suitable source address for the ill.
16660  * This only occurs when there is no valid source address for the ill.
16661  */
16662 ipif_t *
16663 ipif_select_source(ill_t *ill, ipaddr_t dst, zoneid_t zoneid)
16664 {
16665 	ill_t	*usill = NULL;
16666 	ill_t	*ipmp_ill = NULL;
16667 	ipif_t	*start_ipif, *next_ipif, *ipif, *best_ipif;
16668 	ipif_type_t type, best_type;
16669 	tsol_tpc_t *src_rhtp, *dst_rhtp;
16670 	ip_stack_t *ipst = ill->ill_ipst;
16671 	boolean_t samenet;
16672 
16673 	if (ill->ill_usesrc_ifindex != 0) {
16674 		usill = ill_lookup_on_ifindex(ill->ill_usesrc_ifindex,
16675 		    B_FALSE, NULL, NULL, NULL, NULL, ipst);
16676 		if (usill != NULL)
16677 			ill = usill;	/* Select source from usesrc ILL */
16678 		else
16679 			return (NULL);
16680 	}
16681 
16682 	/*
16683 	 * Test addresses should never be used for source address selection,
16684 	 * so if we were passed one, switch to the IPMP meta-interface.
16685 	 */
16686 	if (IS_UNDER_IPMP(ill)) {
16687 		if ((ipmp_ill = ipmp_ill_hold_ipmp_ill(ill)) != NULL)
16688 			ill = ipmp_ill;	/* Select source from IPMP ill */
16689 		else
16690 			return (NULL);
16691 	}
16692 
16693 	/*
16694 	 * If we're dealing with an unlabeled destination on a labeled system,
16695 	 * make sure that we ignore source addresses that are incompatible with
16696 	 * the destination's default label.  That destination's default label
16697 	 * must dominate the minimum label on the source address.
16698 	 */
16699 	dst_rhtp = NULL;
16700 	if (is_system_labeled()) {
16701 		dst_rhtp = find_tpc(&dst, IPV4_VERSION, B_FALSE);
16702 		if (dst_rhtp == NULL)
16703 			return (NULL);
16704 		if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
16705 			TPC_RELE(dst_rhtp);
16706 			dst_rhtp = NULL;
16707 		}
16708 	}
16709 
16710 	/*
16711 	 * Hold the ill_g_lock as reader. This makes sure that no ipif/ill
16712 	 * can be deleted. But an ipif/ill can get CONDEMNED any time.
16713 	 * After selecting the right ipif, under ill_lock make sure ipif is
16714 	 * not condemned, and increment refcnt. If ipif is CONDEMNED,
16715 	 * we retry. Inside the loop we still need to check for CONDEMNED,
16716 	 * but not under a lock.
16717 	 */
16718 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
16719 retry:
16720 	/*
16721 	 * For source address selection, we treat the ipif list as circular
16722 	 * and continue until we get back to where we started.  This allows
16723 	 * IPMP to vary source address selection (which improves inbound load
16724 	 * spreading) by caching its last ending point and starting from
16725 	 * there.  NOTE: we don't have to worry about ill_src_ipif changing
16726 	 * ills since that can't happen on the IPMP ill.
16727 	 */
16728 	start_ipif = ill->ill_ipif;
16729 	if (IS_IPMP(ill) && ill->ill_src_ipif != NULL)
16730 		start_ipif = ill->ill_src_ipif;
16731 
16732 	ipif = start_ipif;
16733 	best_ipif = NULL;
16734 	best_type = IPIF_NONE;
16735 	do {
16736 		if ((next_ipif = ipif->ipif_next) == NULL)
16737 			next_ipif = ill->ill_ipif;
16738 
16739 		if (!IPIF_CAN_LOOKUP(ipif))
16740 			continue;
16741 		/* Always skip NOLOCAL and ANYCAST interfaces */
16742 		if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
16743 			continue;
16744 		if (!(ipif->ipif_flags & IPIF_UP) || !ipif->ipif_addr_ready)
16745 			continue;
16746 		if (ipif->ipif_zoneid != zoneid &&
16747 		    ipif->ipif_zoneid != ALL_ZONES)
16748 			continue;
16749 
16750 		/*
16751 		 * Interfaces with 0.0.0.0 address are allowed to be UP, but
16752 		 * are not valid as source addresses.
16753 		 */
16754 		if (ipif->ipif_lcl_addr == INADDR_ANY)
16755 			continue;
16756 
16757 		/*
16758 		 * Check compatibility of local address for destination's
16759 		 * default label if we're on a labeled system.	Incompatible
16760 		 * addresses can't be used at all.
16761 		 */
16762 		if (dst_rhtp != NULL) {
16763 			boolean_t incompat;
16764 
16765 			src_rhtp = find_tpc(&ipif->ipif_lcl_addr,
16766 			    IPV4_VERSION, B_FALSE);
16767 			if (src_rhtp == NULL)
16768 				continue;
16769 			incompat = src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
16770 			    src_rhtp->tpc_tp.tp_doi !=
16771 			    dst_rhtp->tpc_tp.tp_doi ||
16772 			    (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
16773 			    &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
16774 			    !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
16775 			    src_rhtp->tpc_tp.tp_sl_set_cipso));
16776 			TPC_RELE(src_rhtp);
16777 			if (incompat)
16778 				continue;
16779 		}
16780 
16781 		samenet = ((ipif->ipif_net_mask & dst) == ipif->ipif_subnet);
16782 
16783 		if (ipif->ipif_flags & IPIF_DEPRECATED) {
16784 			type = samenet ? IPIF_SAMENET_DEPRECATED :
16785 			    IPIF_DIFFNET_DEPRECATED;
16786 		} else if (ipif->ipif_zoneid == ALL_ZONES) {
16787 			type = samenet ? IPIF_SAMENET_ALLZONES :
16788 			    IPIF_DIFFNET_ALLZONES;
16789 		} else {
16790 			type = samenet ? IPIF_SAMENET : IPIF_DIFFNET;
16791 		}
16792 
16793 		if (type > best_type) {
16794 			best_type = type;
16795 			best_ipif = ipif;
16796 			if (best_type == IPIF_SAMENET)
16797 				break; /* can't get better */
16798 		}
16799 	} while ((ipif = next_ipif) != start_ipif);
16800 
16801 	if ((ipif = best_ipif) != NULL) {
16802 		mutex_enter(&ipif->ipif_ill->ill_lock);
16803 		if (!IPIF_CAN_LOOKUP(ipif)) {
16804 			mutex_exit(&ipif->ipif_ill->ill_lock);
16805 			goto retry;
16806 		}
16807 		ipif_refhold_locked(ipif);
16808 
16809 		/*
16810 		 * For IPMP, update the source ipif rotor to the next ipif,
16811 		 * provided we can look it up.  (We must not use it if it's
16812 		 * IPIF_CONDEMNED since we may have grabbed ill_g_lock after
16813 		 * ipif_free() checked ill_src_ipif.)
16814 		 */
16815 		if (IS_IPMP(ill) && ipif != NULL) {
16816 			next_ipif = ipif->ipif_next;
16817 			if (next_ipif != NULL && IPIF_CAN_LOOKUP(next_ipif))
16818 				ill->ill_src_ipif = next_ipif;
16819 			else
16820 				ill->ill_src_ipif = NULL;
16821 		}
16822 		mutex_exit(&ipif->ipif_ill->ill_lock);
16823 	}
16824 
16825 	rw_exit(&ipst->ips_ill_g_lock);
16826 	if (usill != NULL)
16827 		ill_refrele(usill);
16828 	if (ipmp_ill != NULL)
16829 		ill_refrele(ipmp_ill);
16830 	if (dst_rhtp != NULL)
16831 		TPC_RELE(dst_rhtp);
16832 
16833 #ifdef DEBUG
16834 	if (ipif == NULL) {
16835 		char buf1[INET6_ADDRSTRLEN];
16836 
16837 		ip1dbg(("ipif_select_source(%s, %s) -> NULL\n",
16838 		    ill->ill_name,
16839 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1))));
16840 	} else {
16841 		char buf1[INET6_ADDRSTRLEN];
16842 		char buf2[INET6_ADDRSTRLEN];
16843 
16844 		ip1dbg(("ipif_select_source(%s, %s) -> %s\n",
16845 		    ipif->ipif_ill->ill_name,
16846 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1)),
16847 		    inet_ntop(AF_INET, &ipif->ipif_lcl_addr,
16848 		    buf2, sizeof (buf2))));
16849 	}
16850 #endif /* DEBUG */
16851 	return (ipif);
16852 }
16853 
16854 /*
16855  * If old_ipif is not NULL, see if ipif was derived from old
16856  * ipif and if so, recreate the interface route by re-doing
16857  * source address selection. This happens when ipif_down ->
16858  * ipif_update_other_ipifs calls us.
16859  *
16860  * If old_ipif is NULL, just redo the source address selection
16861  * if needed. This happens when ipif_up_done calls us.
16862  */
16863 static void
16864 ipif_recreate_interface_routes(ipif_t *old_ipif, ipif_t *ipif)
16865 {
16866 	ire_t *ire;
16867 	ire_t *ipif_ire;
16868 	queue_t *stq;
16869 	ipif_t *nipif;
16870 	ill_t *ill;
16871 	boolean_t need_rele = B_FALSE;
16872 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
16873 
16874 	ASSERT(old_ipif == NULL || IAM_WRITER_IPIF(old_ipif));
16875 	ASSERT(IAM_WRITER_IPIF(ipif));
16876 
16877 	ill = ipif->ipif_ill;
16878 	if (!(ipif->ipif_flags &
16879 	    (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) {
16880 		/*
16881 		 * Can't possibly have borrowed the source
16882 		 * from old_ipif.
16883 		 */
16884 		return;
16885 	}
16886 
16887 	/*
16888 	 * Is there any work to be done? No work if the address
16889 	 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST (
16890 	 * ipif_select_source() does not borrow addresses from
16891 	 * NOLOCAL and ANYCAST interfaces).
16892 	 */
16893 	if ((old_ipif != NULL) &&
16894 	    ((old_ipif->ipif_lcl_addr == INADDR_ANY) ||
16895 	    (old_ipif->ipif_ill->ill_wq == NULL) ||
16896 	    (old_ipif->ipif_flags &
16897 	    (IPIF_NOLOCAL|IPIF_ANYCAST)))) {
16898 		return;
16899 	}
16900 
16901 	/*
16902 	 * Perform the same checks as when creating the
16903 	 * IRE_INTERFACE in ipif_up_done.
16904 	 */
16905 	if (!(ipif->ipif_flags & IPIF_UP))
16906 		return;
16907 
16908 	if ((ipif->ipif_flags & IPIF_NOXMIT) ||
16909 	    (ipif->ipif_subnet == INADDR_ANY))
16910 		return;
16911 
16912 	ipif_ire = ipif_to_ire(ipif);
16913 	if (ipif_ire == NULL)
16914 		return;
16915 
16916 	/*
16917 	 * We know that ipif uses some other source for its
16918 	 * IRE_INTERFACE. Is it using the source of this
16919 	 * old_ipif?
16920 	 */
16921 	if (old_ipif != NULL &&
16922 	    old_ipif->ipif_lcl_addr != ipif_ire->ire_src_addr) {
16923 		ire_refrele(ipif_ire);
16924 		return;
16925 	}
16926 	if (ip_debug > 2) {
16927 		/* ip1dbg */
16928 		pr_addr_dbg("ipif_recreate_interface_routes: deleting IRE for"
16929 		    " src %s\n", AF_INET, &ipif_ire->ire_src_addr);
16930 	}
16931 
16932 	stq = ipif_ire->ire_stq;
16933 
16934 	/*
16935 	 * Can't use our source address. Select a different
16936 	 * source address for the IRE_INTERFACE.
16937 	 */
16938 	nipif = ipif_select_source(ill, ipif->ipif_subnet, ipif->ipif_zoneid);
16939 	if (nipif == NULL) {
16940 		/* Last resort - all ipif's have IPIF_NOLOCAL */
16941 		nipif = ipif;
16942 	} else {
16943 		need_rele = B_TRUE;
16944 	}
16945 
16946 	ire = ire_create(
16947 	    (uchar_t *)&ipif->ipif_subnet,	/* dest pref */
16948 	    (uchar_t *)&ipif->ipif_net_mask,	/* mask */
16949 	    (uchar_t *)&nipif->ipif_src_addr,	/* src addr */
16950 	    NULL,				/* no gateway */
16951 	    &ipif->ipif_mtu,			/* max frag */
16952 	    NULL,				/* no src nce */
16953 	    NULL,				/* no recv from queue */
16954 	    stq,				/* send-to queue */
16955 	    ill->ill_net_type,			/* IF_[NO]RESOLVER */
16956 	    ipif,
16957 	    0,
16958 	    0,
16959 	    0,
16960 	    0,
16961 	    &ire_uinfo_null,
16962 	    NULL,
16963 	    NULL,
16964 	    ipst);
16965 
16966 	if (ire != NULL) {
16967 		ire_t *ret_ire;
16968 		int error;
16969 
16970 		/*
16971 		 * We don't need ipif_ire anymore. We need to delete
16972 		 * before we add so that ire_add does not detect
16973 		 * duplicates.
16974 		 */
16975 		ire_delete(ipif_ire);
16976 		ret_ire = ire;
16977 		error = ire_add(&ret_ire, NULL, NULL, NULL, B_FALSE);
16978 		ASSERT(error == 0);
16979 		ASSERT(ire == ret_ire);
16980 		/* Held in ire_add */
16981 		ire_refrele(ret_ire);
16982 	}
16983 	/*
16984 	 * Either we are falling through from above or could not
16985 	 * allocate a replacement.
16986 	 */
16987 	ire_refrele(ipif_ire);
16988 	if (need_rele)
16989 		ipif_refrele(nipif);
16990 }
16991 
16992 /*
16993  * This old_ipif is going away.
16994  *
16995  * Determine if any other ipif's are using our address as
16996  * ipif_lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or
16997  * IPIF_DEPRECATED).
16998  * Find the IRE_INTERFACE for such ipifs and recreate them
16999  * to use an different source address following the rules in
17000  * ipif_up_done.
17001  */
17002 static void
17003 ipif_update_other_ipifs(ipif_t *old_ipif)
17004 {
17005 	ipif_t	*ipif;
17006 	ill_t	*ill;
17007 	char	buf[INET6_ADDRSTRLEN];
17008 
17009 	ASSERT(IAM_WRITER_IPIF(old_ipif));
17010 
17011 	ill = old_ipif->ipif_ill;
17012 
17013 	ip1dbg(("ipif_update_other_ipifs(%s, %s)\n", ill->ill_name,
17014 	    inet_ntop(AF_INET, &old_ipif->ipif_lcl_addr, buf, sizeof (buf))));
17015 
17016 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17017 		if (ipif == old_ipif)
17018 			continue;
17019 		ipif_recreate_interface_routes(old_ipif, ipif);
17020 	}
17021 }
17022 
17023 /* ARGSUSED */
17024 int
17025 if_unitsel_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
17026 	ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
17027 {
17028 	/*
17029 	 * ill_phyint_reinit merged the v4 and v6 into a single
17030 	 * ipsq.  We might not have been able to complete the
17031 	 * operation in ipif_set_values, if we could not become
17032 	 * exclusive.  If so restart it here.
17033 	 */
17034 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
17035 }
17036 
17037 /*
17038  * Can operate on either a module or a driver queue.
17039  * Returns an error if not a module queue.
17040  */
17041 /* ARGSUSED */
17042 int
17043 if_unitsel(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
17044     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
17045 {
17046 	queue_t		*q1 = q;
17047 	char 		*cp;
17048 	char		interf_name[LIFNAMSIZ];
17049 	uint_t		ppa = *(uint_t *)mp->b_cont->b_cont->b_rptr;
17050 
17051 	if (q->q_next == NULL) {
17052 		ip1dbg((
17053 		    "if_unitsel: IF_UNITSEL: no q_next\n"));
17054 		return (EINVAL);
17055 	}
17056 
17057 	if (((ill_t *)(q->q_ptr))->ill_name[0] != '\0')
17058 		return (EALREADY);
17059 
17060 	do {
17061 		q1 = q1->q_next;
17062 	} while (q1->q_next);
17063 	cp = q1->q_qinfo->qi_minfo->mi_idname;
17064 	(void) sprintf(interf_name, "%s%d", cp, ppa);
17065 
17066 	/*
17067 	 * Here we are not going to delay the ioack until after
17068 	 * ACKs from DL_ATTACH_REQ/DL_BIND_REQ. So no need to save the
17069 	 * original ioctl message before sending the requests.
17070 	 */
17071 	return (ipif_set_values(q, mp, interf_name, &ppa));
17072 }
17073 
17074 /* ARGSUSED */
17075 int
17076 ip_sioctl_sifname(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
17077     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
17078 {
17079 	return (ENXIO);
17080 }
17081 
17082 /*
17083  * Refresh all IRE_BROADCAST entries associated with `ill' to ensure the
17084  * minimum (but complete) set exist.  This is necessary when adding or
17085  * removing an interface to/from an IPMP group, since interfaces in an
17086  * IPMP group use the IRE_BROADCAST entries for the IPMP group (whenever
17087  * its test address subnets overlap with IPMP data addresses).	It's also
17088  * used to refresh the IRE_BROADCAST entries associated with the IPMP
17089  * interface when the nominated broadcast interface changes.
17090  */
17091 void
17092 ill_refresh_bcast(ill_t *ill)
17093 {
17094 	ire_t *ire_array[12];	/* max ipif_create_bcast_ires() can create */
17095 	ire_t **irep;
17096 	ipif_t *ipif;
17097 
17098 	ASSERT(!ill->ill_isv6);
17099 	ASSERT(IAM_WRITER_ILL(ill));
17100 
17101 	/*
17102 	 * Remove any old broadcast IREs.
17103 	 */
17104 	ire_walk_ill_v4(MATCH_IRE_ILL | MATCH_IRE_TYPE, IRE_BROADCAST,
17105 	    ill_broadcast_delete, ill, ill);
17106 
17107 	/*
17108 	 * Create new ones for any ipifs that are up and broadcast-capable.
17109 	 */
17110 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17111 		if ((ipif->ipif_flags & (IPIF_UP|IPIF_BROADCAST)) !=
17112 		    (IPIF_UP|IPIF_BROADCAST))
17113 			continue;
17114 
17115 		irep = ipif_create_bcast_ires(ipif, ire_array);
17116 		while (irep-- > ire_array) {
17117 			(void) ire_add(irep, NULL, NULL, NULL, B_FALSE);
17118 			if (*irep != NULL)
17119 				ire_refrele(*irep);
17120 		}
17121 	}
17122 }
17123 
17124 /*
17125  * Create any IRE_BROADCAST entries for `ipif', and store those entries in
17126  * `irep'.  Returns a pointer to the next free `irep' entry (just like
17127  * ire_check_and_create_bcast()).
17128  */
17129 static ire_t **
17130 ipif_create_bcast_ires(ipif_t *ipif, ire_t **irep)
17131 {
17132 	ipaddr_t addr;
17133 	ipaddr_t netmask = ip_net_mask(ipif->ipif_lcl_addr);
17134 	ipaddr_t subnetmask = ipif->ipif_net_mask;
17135 	int flags = MATCH_IRE_TYPE | MATCH_IRE_ILL;
17136 
17137 	ip1dbg(("ipif_create_bcast_ires: creating broadcast IREs\n"));
17138 
17139 	ASSERT(ipif->ipif_flags & IPIF_BROADCAST);
17140 
17141 	if (ipif->ipif_lcl_addr == INADDR_ANY ||
17142 	    (ipif->ipif_flags & IPIF_NOLOCAL))
17143 		netmask = htonl(IN_CLASSA_NET);		/* fallback */
17144 
17145 	irep = ire_check_and_create_bcast(ipif, 0, irep, flags);
17146 	irep = ire_check_and_create_bcast(ipif, INADDR_BROADCAST, irep, flags);
17147 
17148 	/*
17149 	 * For backward compatibility, we create net broadcast IREs based on
17150 	 * the old "IP address class system", since some old machines only
17151 	 * respond to these class derived net broadcast.  However, we must not
17152 	 * create these net broadcast IREs if the subnetmask is shorter than
17153 	 * the IP address class based derived netmask.  Otherwise, we may
17154 	 * create a net broadcast address which is the same as an IP address
17155 	 * on the subnet -- and then TCP will refuse to talk to that address.
17156 	 */
17157 	if (netmask < subnetmask) {
17158 		addr = netmask & ipif->ipif_subnet;
17159 		irep = ire_check_and_create_bcast(ipif, addr, irep, flags);
17160 		irep = ire_check_and_create_bcast(ipif, ~netmask | addr, irep,
17161 		    flags);
17162 	}
17163 
17164 	/*
17165 	 * Don't create IRE_BROADCAST IREs for the interface if the subnetmask
17166 	 * is 0xFFFFFFFF, as an IRE_LOCAL for that interface is already
17167 	 * created.  Creating these broadcast IREs will only create confusion
17168 	 * as `addr' will be the same as the IP address.
17169 	 */
17170 	if (subnetmask != 0xFFFFFFFF) {
17171 		addr = ipif->ipif_subnet;
17172 		irep = ire_check_and_create_bcast(ipif, addr, irep, flags);
17173 		irep = ire_check_and_create_bcast(ipif, ~subnetmask | addr,
17174 		    irep, flags);
17175 	}
17176 
17177 	return (irep);
17178 }
17179 
17180 /*
17181  * Broadcast IRE info structure used in the functions below.  Since we
17182  * allocate BCAST_COUNT of them on the stack, keep the bit layout compact.
17183  */
17184 typedef struct bcast_ireinfo {
17185 	uchar_t		bi_type;	/* BCAST_* value from below */
17186 	uchar_t		bi_willdie:1, 	/* will this IRE be going away? */
17187 			bi_needrep:1,	/* do we need to replace it? */
17188 			bi_haverep:1,	/* have we replaced it? */
17189 			bi_pad:5;
17190 	ipaddr_t	bi_addr;	/* IRE address */
17191 	ipif_t		*bi_backup;	/* last-ditch ipif to replace it on */
17192 } bcast_ireinfo_t;
17193 
17194 enum { BCAST_ALLONES, BCAST_ALLZEROES, BCAST_NET, BCAST_SUBNET, BCAST_COUNT };
17195 
17196 /*
17197  * Check if `ipif' needs the dying broadcast IRE described by `bireinfop', and
17198  * return B_TRUE if it should immediately be used to recreate the IRE.
17199  */
17200 static boolean_t
17201 ipif_consider_bcast(ipif_t *ipif, bcast_ireinfo_t *bireinfop)
17202 {
17203 	ipaddr_t addr;
17204 
17205 	ASSERT(!bireinfop->bi_haverep && bireinfop->bi_willdie);
17206 
17207 	switch (bireinfop->bi_type) {
17208 	case BCAST_NET:
17209 		addr = ipif->ipif_subnet & ip_net_mask(ipif->ipif_subnet);
17210 		if (addr != bireinfop->bi_addr)
17211 			return (B_FALSE);
17212 		break;
17213 	case BCAST_SUBNET:
17214 		if (ipif->ipif_subnet != bireinfop->bi_addr)
17215 			return (B_FALSE);
17216 		break;
17217 	}
17218 
17219 	bireinfop->bi_needrep = 1;
17220 	if (ipif->ipif_flags & (IPIF_DEPRECATED|IPIF_NOLOCAL|IPIF_ANYCAST)) {
17221 		if (bireinfop->bi_backup == NULL)
17222 			bireinfop->bi_backup = ipif;
17223 		return (B_FALSE);
17224 	}
17225 	return (B_TRUE);
17226 }
17227 
17228 /*
17229  * Create the broadcast IREs described by `bireinfop' on `ipif', and return
17230  * them ala ire_check_and_create_bcast().
17231  */
17232 static ire_t **
17233 ipif_create_bcast(ipif_t *ipif, bcast_ireinfo_t *bireinfop, ire_t **irep)
17234 {
17235 	ipaddr_t mask, addr;
17236 
17237 	ASSERT(!bireinfop->bi_haverep && bireinfop->bi_needrep);
17238 
17239 	addr = bireinfop->bi_addr;
17240 	irep = ire_create_bcast(ipif, addr, irep);
17241 
17242 	switch (bireinfop->bi_type) {
17243 	case BCAST_NET:
17244 		mask = ip_net_mask(ipif->ipif_subnet);
17245 		irep = ire_create_bcast(ipif, addr | ~mask, irep);
17246 		break;
17247 	case BCAST_SUBNET:
17248 		mask = ipif->ipif_net_mask;
17249 		irep = ire_create_bcast(ipif, addr | ~mask, irep);
17250 		break;
17251 	}
17252 
17253 	bireinfop->bi_haverep = 1;
17254 	return (irep);
17255 }
17256 
17257 /*
17258  * Walk through all of the ipifs on `ill' that will be affected by `test_ipif'
17259  * going away, and determine if any of the broadcast IREs (named by `bireinfop')
17260  * that are going away are still needed.  If so, have ipif_create_bcast()
17261  * recreate them (except for the deprecated case, as explained below).
17262  */
17263 static ire_t **
17264 ill_create_bcast(ill_t *ill, ipif_t *test_ipif, bcast_ireinfo_t *bireinfo,
17265     ire_t **irep)
17266 {
17267 	int i;
17268 	ipif_t *ipif;
17269 
17270 	ASSERT(!ill->ill_isv6);
17271 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17272 		/*
17273 		 * Skip this ipif if it's (a) the one being taken down, (b)
17274 		 * not in the same zone, or (c) has no valid local address.
17275 		 */
17276 		if (ipif == test_ipif ||
17277 		    ipif->ipif_zoneid != test_ipif->ipif_zoneid ||
17278 		    ipif->ipif_subnet == 0 ||
17279 		    (ipif->ipif_flags & (IPIF_UP|IPIF_BROADCAST|IPIF_NOXMIT)) !=
17280 		    (IPIF_UP|IPIF_BROADCAST))
17281 			continue;
17282 
17283 		/*
17284 		 * For each dying IRE that hasn't yet been replaced, see if
17285 		 * `ipif' needs it and whether the IRE should be recreated on
17286 		 * `ipif'.  If `ipif' is deprecated, ipif_consider_bcast()
17287 		 * will return B_FALSE even if `ipif' needs the IRE on the
17288 		 * hopes that we'll later find a needy non-deprecated ipif.
17289 		 * However, the ipif is recorded in bi_backup for possible
17290 		 * subsequent use by ipif_check_bcast_ires().
17291 		 */
17292 		for (i = 0; i < BCAST_COUNT; i++) {
17293 			if (!bireinfo[i].bi_willdie || bireinfo[i].bi_haverep)
17294 				continue;
17295 			if (!ipif_consider_bcast(ipif, &bireinfo[i]))
17296 				continue;
17297 			irep = ipif_create_bcast(ipif, &bireinfo[i], irep);
17298 		}
17299 
17300 		/*
17301 		 * If we've replaced all of the broadcast IREs that are going
17302 		 * to be taken down, we know we're done.
17303 		 */
17304 		for (i = 0; i < BCAST_COUNT; i++) {
17305 			if (bireinfo[i].bi_willdie && !bireinfo[i].bi_haverep)
17306 				break;
17307 		}
17308 		if (i == BCAST_COUNT)
17309 			break;
17310 	}
17311 	return (irep);
17312 }
17313 
17314 /*
17315  * Check if `test_ipif' (which is going away) is associated with any existing
17316  * broadcast IREs, and whether any other ipifs (e.g., on the same ill) were
17317  * using those broadcast IREs.  If so, recreate the broadcast IREs on one or
17318  * more of those other ipifs.  (The old IREs will be deleted in ipif_down().)
17319  *
17320  * This is necessary because broadcast IREs are shared.  In particular, a
17321  * given ill has one set of all-zeroes and all-ones broadcast IREs (for every
17322  * zone), plus one set of all-subnet-ones, all-subnet-zeroes, all-net-ones,
17323  * and all-net-zeroes for every net/subnet (and every zone) it has IPIF_UP
17324  * ipifs on.  Thus, if there are two IPIF_UP ipifs on the same subnet with the
17325  * same zone, they will share the same set of broadcast IREs.
17326  *
17327  * Note: the upper bound of 12 IREs comes from the worst case of replacing all
17328  * six pairs (loopback and non-loopback) of broadcast IREs (all-zeroes,
17329  * all-ones, subnet-zeroes, subnet-ones, net-zeroes, and net-ones).
17330  */
17331 static void
17332 ipif_check_bcast_ires(ipif_t *test_ipif)
17333 {
17334 	ill_t		*ill = test_ipif->ipif_ill;
17335 	ire_t		*ire, *ire_array[12]; 		/* see note above */
17336 	ire_t		**irep1, **irep = &ire_array[0];
17337 	uint_t 		i, willdie;
17338 	ipaddr_t	mask = ip_net_mask(test_ipif->ipif_subnet);
17339 	bcast_ireinfo_t	bireinfo[BCAST_COUNT];
17340 
17341 	ASSERT(!test_ipif->ipif_isv6);
17342 	ASSERT(IAM_WRITER_IPIF(test_ipif));
17343 
17344 	/*
17345 	 * No broadcast IREs for the LOOPBACK interface
17346 	 * or others such as point to point and IPIF_NOXMIT.
17347 	 */
17348 	if (!(test_ipif->ipif_flags & IPIF_BROADCAST) ||
17349 	    (test_ipif->ipif_flags & IPIF_NOXMIT))
17350 		return;
17351 
17352 	bzero(bireinfo, sizeof (bireinfo));
17353 	bireinfo[0].bi_type = BCAST_ALLZEROES;
17354 	bireinfo[0].bi_addr = 0;
17355 
17356 	bireinfo[1].bi_type = BCAST_ALLONES;
17357 	bireinfo[1].bi_addr = INADDR_BROADCAST;
17358 
17359 	bireinfo[2].bi_type = BCAST_NET;
17360 	bireinfo[2].bi_addr = test_ipif->ipif_subnet & mask;
17361 
17362 	if (test_ipif->ipif_net_mask != 0)
17363 		mask = test_ipif->ipif_net_mask;
17364 	bireinfo[3].bi_type = BCAST_SUBNET;
17365 	bireinfo[3].bi_addr = test_ipif->ipif_subnet & mask;
17366 
17367 	/*
17368 	 * Figure out what (if any) broadcast IREs will die as a result of
17369 	 * `test_ipif' going away.  If none will die, we're done.
17370 	 */
17371 	for (i = 0, willdie = 0; i < BCAST_COUNT; i++) {
17372 		ire = ire_ctable_lookup(bireinfo[i].bi_addr, 0, IRE_BROADCAST,
17373 		    test_ipif, ALL_ZONES, NULL,
17374 		    (MATCH_IRE_TYPE | MATCH_IRE_IPIF), ill->ill_ipst);
17375 		if (ire != NULL) {
17376 			willdie++;
17377 			bireinfo[i].bi_willdie = 1;
17378 			ire_refrele(ire);
17379 		}
17380 	}
17381 
17382 	if (willdie == 0)
17383 		return;
17384 
17385 	/*
17386 	 * Walk through all the ipifs that will be affected by the dying IREs,
17387 	 * and recreate the IREs as necessary. Note that all interfaces in an
17388 	 * IPMP illgrp share the same broadcast IREs, and thus the entire
17389 	 * illgrp must be walked, starting with the IPMP meta-interface (so
17390 	 * that broadcast IREs end up on it whenever possible).
17391 	 */
17392 	if (IS_UNDER_IPMP(ill))
17393 		ill = ipmp_illgrp_ipmp_ill(ill->ill_grp);
17394 
17395 	irep = ill_create_bcast(ill, test_ipif, bireinfo, irep);
17396 
17397 	if (IS_IPMP(ill) || IS_UNDER_IPMP(ill)) {
17398 		ipmp_illgrp_t *illg = ill->ill_grp;
17399 
17400 		ill = list_head(&illg->ig_if);
17401 		for (; ill != NULL; ill = list_next(&illg->ig_if, ill)) {
17402 			for (i = 0; i < BCAST_COUNT; i++) {
17403 				if (bireinfo[i].bi_willdie &&
17404 				    !bireinfo[i].bi_haverep)
17405 					break;
17406 			}
17407 			if (i == BCAST_COUNT)
17408 				break;
17409 
17410 			irep = ill_create_bcast(ill, test_ipif, bireinfo, irep);
17411 		}
17412 	}
17413 
17414 	/*
17415 	 * Scan through the set of broadcast IREs and see if there are any
17416 	 * that we need to replace that have not yet been replaced.  If so,
17417 	 * replace them using the appropriate backup ipif.
17418 	 */
17419 	for (i = 0; i < BCAST_COUNT; i++) {
17420 		if (bireinfo[i].bi_needrep && !bireinfo[i].bi_haverep)
17421 			irep = ipif_create_bcast(bireinfo[i].bi_backup,
17422 			    &bireinfo[i], irep);
17423 	}
17424 
17425 	/*
17426 	 * If we can't create all of them, don't add any of them.  (Code in
17427 	 * ip_wput_ire() and ire_to_ill() assumes that we always have a
17428 	 * non-loopback copy and loopback copy for a given address.)
17429 	 */
17430 	for (irep1 = irep; irep1 > ire_array; ) {
17431 		irep1--;
17432 		if (*irep1 == NULL) {
17433 			ip0dbg(("ipif_check_bcast_ires: can't create "
17434 			    "IRE_BROADCAST, memory allocation failure\n"));
17435 			while (irep > ire_array) {
17436 				irep--;
17437 				if (*irep != NULL)
17438 					ire_delete(*irep);
17439 			}
17440 			return;
17441 		}
17442 	}
17443 
17444 	for (irep1 = irep; irep1 > ire_array; ) {
17445 		irep1--;
17446 		if (ire_add(irep1, NULL, NULL, NULL, B_FALSE) == 0)
17447 			ire_refrele(*irep1);		/* Held in ire_add */
17448 	}
17449 }
17450 
17451 /*
17452  * Extract both the flags (including IFF_CANTCHANGE) such as IFF_IPV*
17453  * from lifr_flags and the name from lifr_name.
17454  * Set IFF_IPV* and ill_isv6 prior to doing the lookup
17455  * since ipif_lookup_on_name uses the _isv6 flags when matching.
17456  * Returns EINPROGRESS when mp has been consumed by queueing it on
17457  * ill_pending_mp and the ioctl will complete in ip_rput.
17458  *
17459  * Can operate on either a module or a driver queue.
17460  * Returns an error if not a module queue.
17461  */
17462 /* ARGSUSED */
17463 int
17464 ip_sioctl_slifname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17465     ip_ioctl_cmd_t *ipip, void *if_req)
17466 {
17467 	ill_t	*ill = q->q_ptr;
17468 	phyint_t *phyi;
17469 	ip_stack_t *ipst;
17470 	struct lifreq *lifr = if_req;
17471 	uint64_t new_flags;
17472 
17473 	ASSERT(ipif != NULL);
17474 	ip1dbg(("ip_sioctl_slifname %s\n", lifr->lifr_name));
17475 
17476 	if (q->q_next == NULL) {
17477 		ip1dbg(("if_sioctl_slifname: SIOCSLIFNAME: no q_next\n"));
17478 		return (EINVAL);
17479 	}
17480 
17481 	/*
17482 	 * If we are not writer on 'q' then this interface exists already
17483 	 * and previous lookups (ip_extract_lifreq()) found this ipif --
17484 	 * so return EALREADY.
17485 	 */
17486 	if (ill != ipif->ipif_ill)
17487 		return (EALREADY);
17488 
17489 	if (ill->ill_name[0] != '\0')
17490 		return (EALREADY);
17491 
17492 	/*
17493 	 * If there's another ill already with the requested name, ensure
17494 	 * that it's of the same type.  Otherwise, ill_phyint_reinit() will
17495 	 * fuse together two unrelated ills, which will cause chaos.
17496 	 */
17497 	ipst = ill->ill_ipst;
17498 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
17499 	    lifr->lifr_name, NULL);
17500 	if (phyi != NULL) {
17501 		ill_t *ill_mate = phyi->phyint_illv4;
17502 
17503 		if (ill_mate == NULL)
17504 			ill_mate = phyi->phyint_illv6;
17505 		ASSERT(ill_mate != NULL);
17506 
17507 		if (ill_mate->ill_media->ip_m_mac_type !=
17508 		    ill->ill_media->ip_m_mac_type) {
17509 			ip1dbg(("if_sioctl_slifname: SIOCSLIFNAME: attempt to "
17510 			    "use the same ill name on differing media\n"));
17511 			return (EINVAL);
17512 		}
17513 	}
17514 
17515 	/*
17516 	 * We start off as IFF_IPV4 in ipif_allocate and become
17517 	 * IFF_IPV4 or IFF_IPV6 here depending  on lifr_flags value.
17518 	 * The only flags that we read from user space are IFF_IPV4,
17519 	 * IFF_IPV6, IFF_XRESOLV and IFF_BROADCAST.
17520 	 *
17521 	 * This ill has not been inserted into the global list.
17522 	 * So we are still single threaded and don't need any lock
17523 	 *
17524 	 * Saniy check the flags.
17525 	 */
17526 
17527 	if ((lifr->lifr_flags & IFF_BROADCAST) &&
17528 	    ((lifr->lifr_flags & IFF_IPV6) ||
17529 	    (!ill->ill_needs_attach && ill->ill_bcast_addr_length == 0))) {
17530 		ip1dbg(("ip_sioctl_slifname: link not broadcast capable "
17531 		    "or IPv6 i.e., no broadcast \n"));
17532 		return (EINVAL);
17533 	}
17534 
17535 	new_flags =
17536 	    lifr->lifr_flags & (IFF_IPV6|IFF_IPV4|IFF_XRESOLV|IFF_BROADCAST);
17537 
17538 	if ((new_flags ^ (IFF_IPV6|IFF_IPV4)) == 0) {
17539 		ip1dbg(("ip_sioctl_slifname: flags must be exactly one of "
17540 		    "IFF_IPV4 or IFF_IPV6\n"));
17541 		return (EINVAL);
17542 	}
17543 	/*
17544 	 * Only allow the IFF_XRESOLV flag to be set on IPv6 interfaces.
17545 	 */
17546 	if ((new_flags & IFF_XRESOLV) && !(new_flags & IFF_IPV6) &&
17547 	    !(ipif->ipif_isv6)) {
17548 		ip1dbg(("ip_sioctl_slifname: XRESOLV only allowed on "
17549 		    "IPv6 interface\n"));
17550 		return (EINVAL);
17551 	}
17552 
17553 	/*
17554 	 * We always start off as IPv4, so only need to check for IPv6.
17555 	 */
17556 	if ((new_flags & IFF_IPV6) != 0) {
17557 		ill->ill_flags |= ILLF_IPV6;
17558 		ill->ill_flags &= ~ILLF_IPV4;
17559 	}
17560 
17561 	if ((new_flags & IFF_BROADCAST) != 0)
17562 		ipif->ipif_flags |= IPIF_BROADCAST;
17563 	else
17564 		ipif->ipif_flags &= ~IPIF_BROADCAST;
17565 
17566 	if ((new_flags & IFF_XRESOLV) != 0)
17567 		ill->ill_flags |= ILLF_XRESOLV;
17568 	else
17569 		ill->ill_flags &= ~ILLF_XRESOLV;
17570 
17571 	/* We started off as V4. */
17572 	if (ill->ill_flags & ILLF_IPV6) {
17573 		ill->ill_phyint->phyint_illv6 = ill;
17574 		ill->ill_phyint->phyint_illv4 = NULL;
17575 	}
17576 
17577 	return (ipif_set_values(q, mp, lifr->lifr_name, &lifr->lifr_ppa));
17578 }
17579 
17580 /* ARGSUSED */
17581 int
17582 ip_sioctl_slifname_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17583     ip_ioctl_cmd_t *ipip, void *if_req)
17584 {
17585 	/*
17586 	 * ill_phyint_reinit merged the v4 and v6 into a single
17587 	 * ipsq.  We might not have been able to complete the
17588 	 * slifname in ipif_set_values, if we could not become
17589 	 * exclusive.  If so restart it here
17590 	 */
17591 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
17592 }
17593 
17594 /*
17595  * Return a pointer to the ipif which matches the index, IP version type and
17596  * zoneid.
17597  */
17598 ipif_t *
17599 ipif_lookup_on_ifindex(uint_t index, boolean_t isv6, zoneid_t zoneid,
17600     queue_t *q, mblk_t *mp, ipsq_func_t func, int *err, ip_stack_t *ipst)
17601 {
17602 	ill_t	*ill;
17603 	ipif_t	*ipif = NULL;
17604 
17605 	ASSERT((q == NULL && mp == NULL && func == NULL && err == NULL) ||
17606 	    (q != NULL && mp != NULL && func != NULL && err != NULL));
17607 
17608 	if (err != NULL)
17609 		*err = 0;
17610 
17611 	ill = ill_lookup_on_ifindex(index, isv6, q, mp, func, err, ipst);
17612 	if (ill != NULL) {
17613 		mutex_enter(&ill->ill_lock);
17614 		for (ipif = ill->ill_ipif; ipif != NULL;
17615 		    ipif = ipif->ipif_next) {
17616 			if (IPIF_CAN_LOOKUP(ipif) && (zoneid == ALL_ZONES ||
17617 			    zoneid == ipif->ipif_zoneid ||
17618 			    ipif->ipif_zoneid == ALL_ZONES)) {
17619 				ipif_refhold_locked(ipif);
17620 				break;
17621 			}
17622 		}
17623 		mutex_exit(&ill->ill_lock);
17624 		ill_refrele(ill);
17625 		if (ipif == NULL && err != NULL)
17626 			*err = ENXIO;
17627 	}
17628 	return (ipif);
17629 }
17630 
17631 /*
17632  * Change an existing physical interface's index. If the new index
17633  * is acceptable we update the index and the phyint_list_avl_by_index tree.
17634  * Finally, we update other systems which may have a dependence on the
17635  * index value.
17636  */
17637 /* ARGSUSED */
17638 int
17639 ip_sioctl_slifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17640     ip_ioctl_cmd_t *ipip, void *ifreq)
17641 {
17642 	ill_t		*ill;
17643 	phyint_t	*phyi;
17644 	struct ifreq	*ifr = (struct ifreq *)ifreq;
17645 	struct lifreq	*lifr = (struct lifreq *)ifreq;
17646 	uint_t	old_index, index;
17647 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
17648 	avl_index_t	where;
17649 
17650 	if (ipip->ipi_cmd_type == IF_CMD)
17651 		index = ifr->ifr_index;
17652 	else
17653 		index = lifr->lifr_index;
17654 
17655 	/*
17656 	 * Only allow on physical interface. Also, index zero is illegal.
17657 	 */
17658 	ill = ipif->ipif_ill;
17659 	phyi = ill->ill_phyint;
17660 	if (ipif->ipif_id != 0 || index == 0) {
17661 		return (EINVAL);
17662 	}
17663 
17664 	/* If the index is not changing, no work to do */
17665 	if (phyi->phyint_ifindex == index)
17666 		return (0);
17667 
17668 	/*
17669 	 * Use phyint_exists() to determine if the new interface index
17670 	 * is already in use. If the index is unused then we need to
17671 	 * change the phyint's position in the phyint_list_avl_by_index
17672 	 * tree. If we do not do this, subsequent lookups (using the new
17673 	 * index value) will not find the phyint.
17674 	 */
17675 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
17676 	if (phyint_exists(index, ipst)) {
17677 		rw_exit(&ipst->ips_ill_g_lock);
17678 		return (EEXIST);
17679 	}
17680 
17681 	/* The new index is unused. Set it in the phyint. */
17682 	old_index = phyi->phyint_ifindex;
17683 	phyi->phyint_ifindex = index;
17684 
17685 	avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_index, phyi);
17686 	(void) avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
17687 	    &index, &where);
17688 	avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
17689 	    phyi, where);
17690 	rw_exit(&ipst->ips_ill_g_lock);
17691 
17692 	/* Update SCTP's ILL list */
17693 	sctp_ill_reindex(ill, old_index);
17694 
17695 	/* Send the routing sockets message */
17696 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
17697 	if (ILL_OTHER(ill))
17698 		ip_rts_ifmsg(ILL_OTHER(ill)->ill_ipif, RTSQ_DEFAULT);
17699 
17700 	return (0);
17701 }
17702 
17703 /* ARGSUSED */
17704 int
17705 ip_sioctl_get_lifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17706     ip_ioctl_cmd_t *ipip, void *ifreq)
17707 {
17708 	struct ifreq	*ifr = (struct ifreq *)ifreq;
17709 	struct lifreq	*lifr = (struct lifreq *)ifreq;
17710 
17711 	ip1dbg(("ip_sioctl_get_lifindex(%s:%u %p)\n",
17712 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
17713 	/* Get the interface index */
17714 	if (ipip->ipi_cmd_type == IF_CMD) {
17715 		ifr->ifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
17716 	} else {
17717 		lifr->lifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
17718 	}
17719 	return (0);
17720 }
17721 
17722 /* ARGSUSED */
17723 int
17724 ip_sioctl_get_lifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17725     ip_ioctl_cmd_t *ipip, void *ifreq)
17726 {
17727 	struct lifreq	*lifr = (struct lifreq *)ifreq;
17728 
17729 	ip1dbg(("ip_sioctl_get_lifzone(%s:%u %p)\n",
17730 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
17731 	/* Get the interface zone */
17732 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
17733 	lifr->lifr_zoneid = ipif->ipif_zoneid;
17734 	return (0);
17735 }
17736 
17737 /*
17738  * Set the zoneid of an interface.
17739  */
17740 /* ARGSUSED */
17741 int
17742 ip_sioctl_slifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17743     ip_ioctl_cmd_t *ipip, void *ifreq)
17744 {
17745 	struct lifreq	*lifr = (struct lifreq *)ifreq;
17746 	int err = 0;
17747 	boolean_t need_up = B_FALSE;
17748 	zone_t *zptr;
17749 	zone_status_t status;
17750 	zoneid_t zoneid;
17751 
17752 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
17753 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES) {
17754 		if (!is_system_labeled())
17755 			return (ENOTSUP);
17756 		zoneid = GLOBAL_ZONEID;
17757 	}
17758 
17759 	/* cannot assign instance zero to a non-global zone */
17760 	if (ipif->ipif_id == 0 && zoneid != GLOBAL_ZONEID)
17761 		return (ENOTSUP);
17762 
17763 	/*
17764 	 * Cannot assign to a zone that doesn't exist or is shutting down.  In
17765 	 * the event of a race with the zone shutdown processing, since IP
17766 	 * serializes this ioctl and SIOCGLIFCONF/SIOCLIFREMOVEIF, we know the
17767 	 * interface will be cleaned up even if the zone is shut down
17768 	 * immediately after the status check. If the interface can't be brought
17769 	 * down right away, and the zone is shut down before the restart
17770 	 * function is called, we resolve the possible races by rechecking the
17771 	 * zone status in the restart function.
17772 	 */
17773 	if ((zptr = zone_find_by_id(zoneid)) == NULL)
17774 		return (EINVAL);
17775 	status = zone_status_get(zptr);
17776 	zone_rele(zptr);
17777 
17778 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING)
17779 		return (EINVAL);
17780 
17781 	if (ipif->ipif_flags & IPIF_UP) {
17782 		/*
17783 		 * If the interface is already marked up,
17784 		 * we call ipif_down which will take care
17785 		 * of ditching any IREs that have been set
17786 		 * up based on the old interface address.
17787 		 */
17788 		err = ipif_logical_down(ipif, q, mp);
17789 		if (err == EINPROGRESS)
17790 			return (err);
17791 		ipif_down_tail(ipif);
17792 		need_up = B_TRUE;
17793 	}
17794 
17795 	err = ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp, need_up);
17796 	return (err);
17797 }
17798 
17799 static int
17800 ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
17801     queue_t *q, mblk_t *mp, boolean_t need_up)
17802 {
17803 	int	err = 0;
17804 	ip_stack_t	*ipst;
17805 
17806 	ip1dbg(("ip_sioctl_zoneid_tail(%s:%u %p)\n",
17807 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
17808 
17809 	if (CONN_Q(q))
17810 		ipst = CONNQ_TO_IPST(q);
17811 	else
17812 		ipst = ILLQ_TO_IPST(q);
17813 
17814 	/*
17815 	 * For exclusive stacks we don't allow a different zoneid than
17816 	 * global.
17817 	 */
17818 	if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID &&
17819 	    zoneid != GLOBAL_ZONEID)
17820 		return (EINVAL);
17821 
17822 	/* Set the new zone id. */
17823 	ipif->ipif_zoneid = zoneid;
17824 
17825 	/* Update sctp list */
17826 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
17827 
17828 	if (need_up) {
17829 		/*
17830 		 * Now bring the interface back up.  If this
17831 		 * is the only IPIF for the ILL, ipif_up
17832 		 * will have to re-bind to the device, so
17833 		 * we may get back EINPROGRESS, in which
17834 		 * case, this IOCTL will get completed in
17835 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
17836 		 */
17837 		err = ipif_up(ipif, q, mp);
17838 	}
17839 	return (err);
17840 }
17841 
17842 /* ARGSUSED */
17843 int
17844 ip_sioctl_slifzone_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17845     ip_ioctl_cmd_t *ipip, void *if_req)
17846 {
17847 	struct lifreq *lifr = (struct lifreq *)if_req;
17848 	zoneid_t zoneid;
17849 	zone_t *zptr;
17850 	zone_status_t status;
17851 
17852 	ASSERT(ipif->ipif_id != 0);
17853 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
17854 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES)
17855 		zoneid = GLOBAL_ZONEID;
17856 
17857 	ip1dbg(("ip_sioctl_slifzone_restart(%s:%u %p)\n",
17858 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
17859 
17860 	/*
17861 	 * We recheck the zone status to resolve the following race condition:
17862 	 * 1) process sends SIOCSLIFZONE to put hme0:1 in zone "myzone";
17863 	 * 2) hme0:1 is up and can't be brought down right away;
17864 	 * ip_sioctl_slifzone() returns EINPROGRESS and the request is queued;
17865 	 * 3) zone "myzone" is halted; the zone status switches to
17866 	 * 'shutting_down' and the zones framework sends SIOCGLIFCONF to list
17867 	 * the interfaces to remove - hme0:1 is not returned because it's not
17868 	 * yet in "myzone", so it won't be removed;
17869 	 * 4) the restart function for SIOCSLIFZONE is called; without the
17870 	 * status check here, we would have hme0:1 in "myzone" after it's been
17871 	 * destroyed.
17872 	 * Note that if the status check fails, we need to bring the interface
17873 	 * back to its state prior to ip_sioctl_slifzone(), hence the call to
17874 	 * ipif_up_done[_v6]().
17875 	 */
17876 	status = ZONE_IS_UNINITIALIZED;
17877 	if ((zptr = zone_find_by_id(zoneid)) != NULL) {
17878 		status = zone_status_get(zptr);
17879 		zone_rele(zptr);
17880 	}
17881 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING) {
17882 		if (ipif->ipif_isv6) {
17883 			(void) ipif_up_done_v6(ipif);
17884 		} else {
17885 			(void) ipif_up_done(ipif);
17886 		}
17887 		return (EINVAL);
17888 	}
17889 
17890 	ipif_down_tail(ipif);
17891 
17892 	return (ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp,
17893 	    B_TRUE));
17894 }
17895 
17896 /*
17897  * Return the number of addresses on `ill' with one or more of the values
17898  * in `set' set and all of the values in `clear' clear.
17899  */
17900 static uint_t
17901 ill_flagaddr_cnt(const ill_t *ill, uint64_t set, uint64_t clear)
17902 {
17903 	ipif_t	*ipif;
17904 	uint_t	cnt = 0;
17905 
17906 	ASSERT(IAM_WRITER_ILL(ill));
17907 
17908 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
17909 		if ((ipif->ipif_flags & set) && !(ipif->ipif_flags & clear))
17910 			cnt++;
17911 
17912 	return (cnt);
17913 }
17914 
17915 /*
17916  * Return the number of migratable addresses on `ill' that are under
17917  * application control.
17918  */
17919 uint_t
17920 ill_appaddr_cnt(const ill_t *ill)
17921 {
17922 	return (ill_flagaddr_cnt(ill, IPIF_DHCPRUNNING | IPIF_ADDRCONF,
17923 	    IPIF_NOFAILOVER));
17924 }
17925 
17926 /*
17927  * Return the number of point-to-point addresses on `ill'.
17928  */
17929 uint_t
17930 ill_ptpaddr_cnt(const ill_t *ill)
17931 {
17932 	return (ill_flagaddr_cnt(ill, IPIF_POINTOPOINT, 0));
17933 }
17934 
17935 /* ARGSUSED */
17936 int
17937 ip_sioctl_get_lifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17938 	ip_ioctl_cmd_t *ipip, void *ifreq)
17939 {
17940 	struct lifreq	*lifr = ifreq;
17941 
17942 	ASSERT(q->q_next == NULL);
17943 	ASSERT(CONN_Q(q));
17944 
17945 	ip1dbg(("ip_sioctl_get_lifusesrc(%s:%u %p)\n",
17946 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
17947 	lifr->lifr_index = ipif->ipif_ill->ill_usesrc_ifindex;
17948 	ip1dbg(("ip_sioctl_get_lifusesrc:lifr_index = %d\n", lifr->lifr_index));
17949 
17950 	return (0);
17951 }
17952 
17953 /* Find the previous ILL in this usesrc group */
17954 static ill_t *
17955 ill_prev_usesrc(ill_t *uill)
17956 {
17957 	ill_t *ill;
17958 
17959 	for (ill = uill->ill_usesrc_grp_next;
17960 	    ASSERT(ill), ill->ill_usesrc_grp_next != uill;
17961 	    ill = ill->ill_usesrc_grp_next)
17962 		/* do nothing */;
17963 	return (ill);
17964 }
17965 
17966 /*
17967  * Release all members of the usesrc group. This routine is called
17968  * from ill_delete when the interface being unplumbed is the
17969  * group head.
17970  */
17971 static void
17972 ill_disband_usesrc_group(ill_t *uill)
17973 {
17974 	ill_t *next_ill, *tmp_ill;
17975 	ip_stack_t	*ipst = uill->ill_ipst;
17976 
17977 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_usesrc_lock));
17978 	next_ill = uill->ill_usesrc_grp_next;
17979 
17980 	do {
17981 		ASSERT(next_ill != NULL);
17982 		tmp_ill = next_ill->ill_usesrc_grp_next;
17983 		ASSERT(tmp_ill != NULL);
17984 		next_ill->ill_usesrc_grp_next = NULL;
17985 		next_ill->ill_usesrc_ifindex = 0;
17986 		next_ill = tmp_ill;
17987 	} while (next_ill->ill_usesrc_ifindex != 0);
17988 	uill->ill_usesrc_grp_next = NULL;
17989 }
17990 
17991 /*
17992  * Remove the client usesrc ILL from the list and relink to a new list
17993  */
17994 int
17995 ill_relink_usesrc_ills(ill_t *ucill, ill_t *uill, uint_t ifindex)
17996 {
17997 	ill_t *ill, *tmp_ill;
17998 	ip_stack_t	*ipst = ucill->ill_ipst;
17999 
18000 	ASSERT((ucill != NULL) && (ucill->ill_usesrc_grp_next != NULL) &&
18001 	    (uill != NULL) && RW_WRITE_HELD(&ipst->ips_ill_g_usesrc_lock));
18002 
18003 	/*
18004 	 * Check if the usesrc client ILL passed in is not already
18005 	 * in use as a usesrc ILL i.e one whose source address is
18006 	 * in use OR a usesrc ILL is not already in use as a usesrc
18007 	 * client ILL
18008 	 */
18009 	if ((ucill->ill_usesrc_ifindex == 0) ||
18010 	    (uill->ill_usesrc_ifindex != 0)) {
18011 		return (-1);
18012 	}
18013 
18014 	ill = ill_prev_usesrc(ucill);
18015 	ASSERT(ill->ill_usesrc_grp_next != NULL);
18016 
18017 	/* Remove from the current list */
18018 	if (ill->ill_usesrc_grp_next->ill_usesrc_grp_next == ill) {
18019 		/* Only two elements in the list */
18020 		ASSERT(ill->ill_usesrc_ifindex == 0);
18021 		ill->ill_usesrc_grp_next = NULL;
18022 	} else {
18023 		ill->ill_usesrc_grp_next = ucill->ill_usesrc_grp_next;
18024 	}
18025 
18026 	if (ifindex == 0) {
18027 		ucill->ill_usesrc_ifindex = 0;
18028 		ucill->ill_usesrc_grp_next = NULL;
18029 		return (0);
18030 	}
18031 
18032 	ucill->ill_usesrc_ifindex = ifindex;
18033 	tmp_ill = uill->ill_usesrc_grp_next;
18034 	uill->ill_usesrc_grp_next = ucill;
18035 	ucill->ill_usesrc_grp_next =
18036 	    (tmp_ill != NULL) ? tmp_ill : uill;
18037 	return (0);
18038 }
18039 
18040 /*
18041  * Set the ill_usesrc and ill_usesrc_head fields. See synchronization notes in
18042  * ip.c for locking details.
18043  */
18044 /* ARGSUSED */
18045 int
18046 ip_sioctl_slifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
18047     ip_ioctl_cmd_t *ipip, void *ifreq)
18048 {
18049 	struct lifreq *lifr = (struct lifreq *)ifreq;
18050 	boolean_t isv6 = B_FALSE, reset_flg = B_FALSE,
18051 	    ill_flag_changed = B_FALSE;
18052 	ill_t *usesrc_ill, *usesrc_cli_ill = ipif->ipif_ill;
18053 	int err = 0, ret;
18054 	uint_t ifindex;
18055 	ipsq_t *ipsq = NULL;
18056 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
18057 
18058 	ASSERT(IAM_WRITER_IPIF(ipif));
18059 	ASSERT(q->q_next == NULL);
18060 	ASSERT(CONN_Q(q));
18061 
18062 	isv6 = (Q_TO_CONN(q))->conn_af_isv6;
18063 
18064 	ifindex = lifr->lifr_index;
18065 	if (ifindex == 0) {
18066 		if (usesrc_cli_ill->ill_usesrc_grp_next == NULL) {
18067 			/* non usesrc group interface, nothing to reset */
18068 			return (0);
18069 		}
18070 		ifindex = usesrc_cli_ill->ill_usesrc_ifindex;
18071 		/* valid reset request */
18072 		reset_flg = B_TRUE;
18073 	}
18074 
18075 	usesrc_ill = ill_lookup_on_ifindex(ifindex, isv6, q, mp,
18076 	    ip_process_ioctl, &err, ipst);
18077 	if (usesrc_ill == NULL) {
18078 		return (err);
18079 	}
18080 
18081 	ipsq = ipsq_try_enter(NULL, usesrc_ill, q, mp, ip_process_ioctl,
18082 	    NEW_OP, B_TRUE);
18083 	if (ipsq == NULL) {
18084 		err = EINPROGRESS;
18085 		/* Operation enqueued on the ipsq of the usesrc ILL */
18086 		goto done;
18087 	}
18088 
18089 	/* USESRC isn't currently supported with IPMP */
18090 	if (IS_IPMP(usesrc_ill) || IS_UNDER_IPMP(usesrc_ill)) {
18091 		err = ENOTSUP;
18092 		goto done;
18093 	}
18094 
18095 	/*
18096 	 * USESRC isn't compatible with the STANDBY flag.  (STANDBY is only
18097 	 * used by IPMP underlying interfaces, but someone might think it's
18098 	 * more general and try to use it independently with VNI.)
18099 	 */
18100 	if (usesrc_ill->ill_phyint->phyint_flags & PHYI_STANDBY) {
18101 		err = ENOTSUP;
18102 		goto done;
18103 	}
18104 
18105 	/*
18106 	 * If the client is already in use as a usesrc_ill or a usesrc_ill is
18107 	 * already a client then return EINVAL
18108 	 */
18109 	if (IS_USESRC_ILL(usesrc_cli_ill) || IS_USESRC_CLI_ILL(usesrc_ill)) {
18110 		err = EINVAL;
18111 		goto done;
18112 	}
18113 
18114 	/*
18115 	 * If the ill_usesrc_ifindex field is already set to what it needs to
18116 	 * be then this is a duplicate operation.
18117 	 */
18118 	if (!reset_flg && usesrc_cli_ill->ill_usesrc_ifindex == ifindex) {
18119 		err = 0;
18120 		goto done;
18121 	}
18122 
18123 	ip1dbg(("ip_sioctl_slifusesrc: usesrc_cli_ill %s, usesrc_ill %s,"
18124 	    " v6 = %d", usesrc_cli_ill->ill_name, usesrc_ill->ill_name,
18125 	    usesrc_ill->ill_isv6));
18126 
18127 	/*
18128 	 * The next step ensures that no new ires will be created referencing
18129 	 * the client ill, until the ILL_CHANGING flag is cleared. Then
18130 	 * we go through an ire walk deleting all ire caches that reference
18131 	 * the client ill. New ires referencing the client ill that are added
18132 	 * to the ire table before the ILL_CHANGING flag is set, will be
18133 	 * cleaned up by the ire walk below. Attempt to add new ires referencing
18134 	 * the client ill while the ILL_CHANGING flag is set will be failed
18135 	 * during the ire_add in ire_atomic_start. ire_atomic_start atomically
18136 	 * checks (under the ill_g_usesrc_lock) that the ire being added
18137 	 * is not stale, i.e the ire_stq and ire_ipif are consistent and
18138 	 * belong to the same usesrc group.
18139 	 */
18140 	mutex_enter(&usesrc_cli_ill->ill_lock);
18141 	usesrc_cli_ill->ill_state_flags |= ILL_CHANGING;
18142 	mutex_exit(&usesrc_cli_ill->ill_lock);
18143 	ill_flag_changed = B_TRUE;
18144 
18145 	if (ipif->ipif_isv6)
18146 		ire_walk_v6(ipif_delete_cache_ire, (char *)usesrc_cli_ill,
18147 		    ALL_ZONES, ipst);
18148 	else
18149 		ire_walk_v4(ipif_delete_cache_ire, (char *)usesrc_cli_ill,
18150 		    ALL_ZONES, ipst);
18151 
18152 	/*
18153 	 * ill_g_usesrc_lock global lock protects the ill_usesrc_grp_next
18154 	 * and the ill_usesrc_ifindex fields
18155 	 */
18156 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
18157 
18158 	if (reset_flg) {
18159 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill, 0);
18160 		if (ret != 0) {
18161 			err = EINVAL;
18162 		}
18163 		rw_exit(&ipst->ips_ill_g_usesrc_lock);
18164 		goto done;
18165 	}
18166 
18167 	/*
18168 	 * Four possibilities to consider:
18169 	 * 1. Both usesrc_ill and usesrc_cli_ill are not part of any usesrc grp
18170 	 * 2. usesrc_ill is part of a group but usesrc_cli_ill isn't
18171 	 * 3. usesrc_cli_ill is part of a group but usesrc_ill isn't
18172 	 * 4. Both are part of their respective usesrc groups
18173 	 */
18174 	if ((usesrc_ill->ill_usesrc_grp_next == NULL) &&
18175 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
18176 		ASSERT(usesrc_ill->ill_usesrc_ifindex == 0);
18177 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
18178 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
18179 		usesrc_cli_ill->ill_usesrc_grp_next = usesrc_ill;
18180 	} else if ((usesrc_ill->ill_usesrc_grp_next != NULL) &&
18181 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
18182 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
18183 		/* Insert at head of list */
18184 		usesrc_cli_ill->ill_usesrc_grp_next =
18185 		    usesrc_ill->ill_usesrc_grp_next;
18186 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
18187 	} else {
18188 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill,
18189 		    ifindex);
18190 		if (ret != 0)
18191 			err = EINVAL;
18192 	}
18193 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
18194 
18195 done:
18196 	if (ill_flag_changed) {
18197 		mutex_enter(&usesrc_cli_ill->ill_lock);
18198 		usesrc_cli_ill->ill_state_flags &= ~ILL_CHANGING;
18199 		mutex_exit(&usesrc_cli_ill->ill_lock);
18200 	}
18201 	if (ipsq != NULL)
18202 		ipsq_exit(ipsq);
18203 	/* The refrele on the lifr_name ipif is done by ip_process_ioctl */
18204 	ill_refrele(usesrc_ill);
18205 	return (err);
18206 }
18207 
18208 /*
18209  * comparison function used by avl.
18210  */
18211 static int
18212 ill_phyint_compare_index(const void *index_ptr, const void *phyip)
18213 {
18214 
18215 	uint_t index;
18216 
18217 	ASSERT(phyip != NULL && index_ptr != NULL);
18218 
18219 	index = *((uint_t *)index_ptr);
18220 	/*
18221 	 * let the phyint with the lowest index be on top.
18222 	 */
18223 	if (((phyint_t *)phyip)->phyint_ifindex < index)
18224 		return (1);
18225 	if (((phyint_t *)phyip)->phyint_ifindex > index)
18226 		return (-1);
18227 	return (0);
18228 }
18229 
18230 /*
18231  * comparison function used by avl.
18232  */
18233 static int
18234 ill_phyint_compare_name(const void *name_ptr, const void *phyip)
18235 {
18236 	ill_t *ill;
18237 	int res = 0;
18238 
18239 	ASSERT(phyip != NULL && name_ptr != NULL);
18240 
18241 	if (((phyint_t *)phyip)->phyint_illv4)
18242 		ill = ((phyint_t *)phyip)->phyint_illv4;
18243 	else
18244 		ill = ((phyint_t *)phyip)->phyint_illv6;
18245 	ASSERT(ill != NULL);
18246 
18247 	res = strcmp(ill->ill_name, (char *)name_ptr);
18248 	if (res > 0)
18249 		return (1);
18250 	else if (res < 0)
18251 		return (-1);
18252 	return (0);
18253 }
18254 
18255 /*
18256  * This function is called on the unplumb path via ill_glist_delete() when
18257  * there are no ills left on the phyint and thus the phyint can be freed.
18258  */
18259 static void
18260 phyint_free(phyint_t *phyi)
18261 {
18262 	ip_stack_t *ipst = PHYINT_TO_IPST(phyi);
18263 
18264 	ASSERT(phyi->phyint_illv4 == NULL && phyi->phyint_illv6 == NULL);
18265 
18266 	/*
18267 	 * If this phyint was an IPMP meta-interface, blow away the group.
18268 	 * This is safe to do because all of the illgrps have already been
18269 	 * removed by I_PUNLINK, and thus SIOCSLIFGROUPNAME cannot find us.
18270 	 * If we're cleaning up as a result of failed initialization,
18271 	 * phyint_grp may be NULL.
18272 	 */
18273 	if ((phyi->phyint_flags & PHYI_IPMP) && (phyi->phyint_grp != NULL)) {
18274 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
18275 		ipmp_grp_destroy(phyi->phyint_grp);
18276 		phyi->phyint_grp = NULL;
18277 		rw_exit(&ipst->ips_ipmp_lock);
18278 	}
18279 
18280 	/*
18281 	 * If this interface was under IPMP, take it out of the group.
18282 	 */
18283 	if (phyi->phyint_grp != NULL)
18284 		ipmp_phyint_leave_grp(phyi);
18285 
18286 	/*
18287 	 * Delete the phyint and disassociate its ipsq.  The ipsq itself
18288 	 * will be freed in ipsq_exit().
18289 	 */
18290 	phyi->phyint_ipsq->ipsq_phyint = NULL;
18291 	phyi->phyint_name[0] = '\0';
18292 
18293 	mi_free(phyi);
18294 }
18295 
18296 /*
18297  * Attach the ill to the phyint structure which can be shared by both
18298  * IPv4 and IPv6 ill. ill_init allocates a phyint to just hold flags. This
18299  * function is called from ipif_set_values and ill_lookup_on_name (for
18300  * loopback) where we know the name of the ill. We lookup the ill and if
18301  * there is one present already with the name use that phyint. Otherwise
18302  * reuse the one allocated by ill_init.
18303  */
18304 static void
18305 ill_phyint_reinit(ill_t *ill)
18306 {
18307 	boolean_t isv6 = ill->ill_isv6;
18308 	phyint_t *phyi_old;
18309 	phyint_t *phyi;
18310 	avl_index_t where = 0;
18311 	ill_t	*ill_other = NULL;
18312 	ip_stack_t	*ipst = ill->ill_ipst;
18313 
18314 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
18315 
18316 	phyi_old = ill->ill_phyint;
18317 	ASSERT(isv6 || (phyi_old->phyint_illv4 == ill &&
18318 	    phyi_old->phyint_illv6 == NULL));
18319 	ASSERT(!isv6 || (phyi_old->phyint_illv6 == ill &&
18320 	    phyi_old->phyint_illv4 == NULL));
18321 	ASSERT(phyi_old->phyint_ifindex == 0);
18322 
18323 	/*
18324 	 * Now that our ill has a name, set it in the phyint.
18325 	 */
18326 	(void) strlcpy(ill->ill_phyint->phyint_name, ill->ill_name, LIFNAMSIZ);
18327 
18328 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
18329 	    ill->ill_name, &where);
18330 
18331 	/*
18332 	 * 1. We grabbed the ill_g_lock before inserting this ill into
18333 	 *    the global list of ills. So no other thread could have located
18334 	 *    this ill and hence the ipsq of this ill is guaranteed to be empty.
18335 	 * 2. Now locate the other protocol instance of this ill.
18336 	 * 3. Now grab both ill locks in the right order, and the phyint lock of
18337 	 *    the new ipsq. Holding ill locks + ill_g_lock ensures that the ipsq
18338 	 *    of neither ill can change.
18339 	 * 4. Merge the phyint and thus the ipsq as well of this ill onto the
18340 	 *    other ill.
18341 	 * 5. Release all locks.
18342 	 */
18343 
18344 	/*
18345 	 * Look for IPv4 if we are initializing IPv6 or look for IPv6 if
18346 	 * we are initializing IPv4.
18347 	 */
18348 	if (phyi != NULL) {
18349 		ill_other = (isv6) ? phyi->phyint_illv4 : phyi->phyint_illv6;
18350 		ASSERT(ill_other->ill_phyint != NULL);
18351 		ASSERT((isv6 && !ill_other->ill_isv6) ||
18352 		    (!isv6 && ill_other->ill_isv6));
18353 		GRAB_ILL_LOCKS(ill, ill_other);
18354 		/*
18355 		 * We are potentially throwing away phyint_flags which
18356 		 * could be different from the one that we obtain from
18357 		 * ill_other->ill_phyint. But it is okay as we are assuming
18358 		 * that the state maintained within IP is correct.
18359 		 */
18360 		mutex_enter(&phyi->phyint_lock);
18361 		if (isv6) {
18362 			ASSERT(phyi->phyint_illv6 == NULL);
18363 			phyi->phyint_illv6 = ill;
18364 		} else {
18365 			ASSERT(phyi->phyint_illv4 == NULL);
18366 			phyi->phyint_illv4 = ill;
18367 		}
18368 
18369 		/*
18370 		 * Delete the old phyint and make its ipsq eligible
18371 		 * to be freed in ipsq_exit().
18372 		 */
18373 		phyi_old->phyint_illv4 = NULL;
18374 		phyi_old->phyint_illv6 = NULL;
18375 		phyi_old->phyint_ipsq->ipsq_phyint = NULL;
18376 		phyi_old->phyint_name[0] = '\0';
18377 		mi_free(phyi_old);
18378 	} else {
18379 		mutex_enter(&ill->ill_lock);
18380 		/*
18381 		 * We don't need to acquire any lock, since
18382 		 * the ill is not yet visible globally  and we
18383 		 * have not yet released the ill_g_lock.
18384 		 */
18385 		phyi = phyi_old;
18386 		mutex_enter(&phyi->phyint_lock);
18387 		/* XXX We need a recovery strategy here. */
18388 		if (!phyint_assign_ifindex(phyi, ipst))
18389 			cmn_err(CE_PANIC, "phyint_assign_ifindex() failed");
18390 
18391 		avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
18392 		    (void *)phyi, where);
18393 
18394 		(void) avl_find(&ipst->ips_phyint_g_list->
18395 		    phyint_list_avl_by_index,
18396 		    &phyi->phyint_ifindex, &where);
18397 		avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
18398 		    (void *)phyi, where);
18399 	}
18400 
18401 	/*
18402 	 * Reassigning ill_phyint automatically reassigns the ipsq also.
18403 	 * pending mp is not affected because that is per ill basis.
18404 	 */
18405 	ill->ill_phyint = phyi;
18406 
18407 	/*
18408 	 * Now that the phyint's ifindex has been assigned, complete the
18409 	 * remaining
18410 	 */
18411 
18412 	ill->ill_ip_mib->ipIfStatsIfIndex = ill->ill_phyint->phyint_ifindex;
18413 	if (ill->ill_isv6) {
18414 		ill->ill_icmp6_mib->ipv6IfIcmpIfIndex =
18415 		    ill->ill_phyint->phyint_ifindex;
18416 		ill->ill_mcast_type = ipst->ips_mld_max_version;
18417 	} else {
18418 		ill->ill_mcast_type = ipst->ips_igmp_max_version;
18419 	}
18420 
18421 	/*
18422 	 * Generate an event within the hooks framework to indicate that
18423 	 * a new interface has just been added to IP.  For this event to
18424 	 * be generated, the network interface must, at least, have an
18425 	 * ifindex assigned to it.  (We don't generate the event for
18426 	 * loopback since ill_lookup_on_name() has its own NE_PLUMB event.)
18427 	 *
18428 	 * This needs to be run inside the ill_g_lock perimeter to ensure
18429 	 * that the ordering of delivered events to listeners matches the
18430 	 * order of them in the kernel.
18431 	 */
18432 	if (!IS_LOOPBACK(ill)) {
18433 		ill_nic_event_dispatch(ill, 0, NE_PLUMB, ill->ill_name,
18434 		    ill->ill_name_length);
18435 	}
18436 	RELEASE_ILL_LOCKS(ill, ill_other);
18437 	mutex_exit(&phyi->phyint_lock);
18438 }
18439 
18440 /*
18441  * Notify any downstream modules of the name of this interface.
18442  * An M_IOCTL is used even though we don't expect a successful reply.
18443  * Any reply message from the driver (presumably an M_IOCNAK) will
18444  * eventually get discarded somewhere upstream.  The message format is
18445  * simply an SIOCSLIFNAME ioctl just as might be sent from ifconfig
18446  * to IP.
18447  */
18448 static void
18449 ip_ifname_notify(ill_t *ill, queue_t *q)
18450 {
18451 	mblk_t *mp1, *mp2;
18452 	struct iocblk *iocp;
18453 	struct lifreq *lifr;
18454 
18455 	mp1 = mkiocb(SIOCSLIFNAME);
18456 	if (mp1 == NULL)
18457 		return;
18458 	mp2 = allocb(sizeof (struct lifreq), BPRI_HI);
18459 	if (mp2 == NULL) {
18460 		freeb(mp1);
18461 		return;
18462 	}
18463 
18464 	mp1->b_cont = mp2;
18465 	iocp = (struct iocblk *)mp1->b_rptr;
18466 	iocp->ioc_count = sizeof (struct lifreq);
18467 
18468 	lifr = (struct lifreq *)mp2->b_rptr;
18469 	mp2->b_wptr += sizeof (struct lifreq);
18470 	bzero(lifr, sizeof (struct lifreq));
18471 
18472 	(void) strncpy(lifr->lifr_name, ill->ill_name, LIFNAMSIZ);
18473 	lifr->lifr_ppa = ill->ill_ppa;
18474 	lifr->lifr_flags = (ill->ill_flags & (ILLF_IPV4|ILLF_IPV6));
18475 
18476 	putnext(q, mp1);
18477 }
18478 
18479 static int
18480 ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
18481 {
18482 	int		err;
18483 	ip_stack_t	*ipst = ill->ill_ipst;
18484 	phyint_t	*phyi = ill->ill_phyint;
18485 
18486 	/* Set the obsolete NDD per-interface forwarding name. */
18487 	err = ill_set_ndd_name(ill);
18488 	if (err != 0) {
18489 		cmn_err(CE_WARN, "ipif_set_values: ill_set_ndd_name (%d)\n",
18490 		    err);
18491 	}
18492 
18493 	/*
18494 	 * Now that ill_name is set, the configuration for the IPMP
18495 	 * meta-interface can be performed.
18496 	 */
18497 	if (IS_IPMP(ill)) {
18498 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
18499 		/*
18500 		 * If phyi->phyint_grp is NULL, then this is the first IPMP
18501 		 * meta-interface and we need to create the IPMP group.
18502 		 */
18503 		if (phyi->phyint_grp == NULL) {
18504 			/*
18505 			 * If someone has renamed another IPMP group to have
18506 			 * the same name as our interface, bail.
18507 			 */
18508 			if (ipmp_grp_lookup(ill->ill_name, ipst) != NULL) {
18509 				rw_exit(&ipst->ips_ipmp_lock);
18510 				return (EEXIST);
18511 			}
18512 			phyi->phyint_grp = ipmp_grp_create(ill->ill_name, phyi);
18513 			if (phyi->phyint_grp == NULL) {
18514 				rw_exit(&ipst->ips_ipmp_lock);
18515 				return (ENOMEM);
18516 			}
18517 		}
18518 		rw_exit(&ipst->ips_ipmp_lock);
18519 	}
18520 
18521 	/* Tell downstream modules where they are. */
18522 	ip_ifname_notify(ill, q);
18523 
18524 	/*
18525 	 * ill_dl_phys returns EINPROGRESS in the usual case.
18526 	 * Error cases are ENOMEM ...
18527 	 */
18528 	err = ill_dl_phys(ill, ipif, mp, q);
18529 
18530 	/*
18531 	 * If there is no IRE expiration timer running, get one started.
18532 	 * igmp and mld timers will be triggered by the first multicast
18533 	 */
18534 	if (ipst->ips_ip_ire_expire_id == 0) {
18535 		/*
18536 		 * acquire the lock and check again.
18537 		 */
18538 		mutex_enter(&ipst->ips_ip_trash_timer_lock);
18539 		if (ipst->ips_ip_ire_expire_id == 0) {
18540 			ipst->ips_ip_ire_expire_id = timeout(
18541 			    ip_trash_timer_expire, ipst,
18542 			    MSEC_TO_TICK(ipst->ips_ip_timer_interval));
18543 		}
18544 		mutex_exit(&ipst->ips_ip_trash_timer_lock);
18545 	}
18546 
18547 	if (ill->ill_isv6) {
18548 		mutex_enter(&ipst->ips_mld_slowtimeout_lock);
18549 		if (ipst->ips_mld_slowtimeout_id == 0) {
18550 			ipst->ips_mld_slowtimeout_id = timeout(mld_slowtimo,
18551 			    (void *)ipst,
18552 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
18553 		}
18554 		mutex_exit(&ipst->ips_mld_slowtimeout_lock);
18555 	} else {
18556 		mutex_enter(&ipst->ips_igmp_slowtimeout_lock);
18557 		if (ipst->ips_igmp_slowtimeout_id == 0) {
18558 			ipst->ips_igmp_slowtimeout_id = timeout(igmp_slowtimo,
18559 			    (void *)ipst,
18560 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
18561 		}
18562 		mutex_exit(&ipst->ips_igmp_slowtimeout_lock);
18563 	}
18564 
18565 	return (err);
18566 }
18567 
18568 /*
18569  * Common routine for ppa and ifname setting. Should be called exclusive.
18570  *
18571  * Returns EINPROGRESS when mp has been consumed by queueing it on
18572  * ill_pending_mp and the ioctl will complete in ip_rput.
18573  *
18574  * NOTE : If ppa is UNIT_MAX, we assign the next valid ppa and return
18575  * the new name and new ppa in lifr_name and lifr_ppa respectively.
18576  * For SLIFNAME, we pass these values back to the userland.
18577  */
18578 static int
18579 ipif_set_values(queue_t *q, mblk_t *mp, char *interf_name, uint_t *new_ppa_ptr)
18580 {
18581 	ill_t	*ill;
18582 	ipif_t	*ipif;
18583 	ipsq_t	*ipsq;
18584 	char	*ppa_ptr;
18585 	char	*old_ptr;
18586 	char	old_char;
18587 	int	error;
18588 	ip_stack_t	*ipst;
18589 
18590 	ip1dbg(("ipif_set_values: interface %s\n", interf_name));
18591 	ASSERT(q->q_next != NULL);
18592 	ASSERT(interf_name != NULL);
18593 
18594 	ill = (ill_t *)q->q_ptr;
18595 	ipst = ill->ill_ipst;
18596 
18597 	ASSERT(ill->ill_ipst != NULL);
18598 	ASSERT(ill->ill_name[0] == '\0');
18599 	ASSERT(IAM_WRITER_ILL(ill));
18600 	ASSERT((mi_strlen(interf_name) + 1) <= LIFNAMSIZ);
18601 	ASSERT(ill->ill_ppa == UINT_MAX);
18602 
18603 	/* The ppa is sent down by ifconfig or is chosen */
18604 	if ((ppa_ptr = ill_get_ppa_ptr(interf_name)) == NULL) {
18605 		return (EINVAL);
18606 	}
18607 
18608 	/*
18609 	 * make sure ppa passed in is same as ppa in the name.
18610 	 * This check is not made when ppa == UINT_MAX in that case ppa
18611 	 * in the name could be anything. System will choose a ppa and
18612 	 * update new_ppa_ptr and inter_name to contain the choosen ppa.
18613 	 */
18614 	if (*new_ppa_ptr != UINT_MAX) {
18615 		/* stoi changes the pointer */
18616 		old_ptr = ppa_ptr;
18617 		/*
18618 		 * ifconfig passed in 0 for the ppa for DLPI 1 style devices
18619 		 * (they don't have an externally visible ppa).  We assign one
18620 		 * here so that we can manage the interface.  Note that in
18621 		 * the past this value was always 0 for DLPI 1 drivers.
18622 		 */
18623 		if (*new_ppa_ptr == 0)
18624 			*new_ppa_ptr = stoi(&old_ptr);
18625 		else if (*new_ppa_ptr != (uint_t)stoi(&old_ptr))
18626 			return (EINVAL);
18627 	}
18628 	/*
18629 	 * terminate string before ppa
18630 	 * save char at that location.
18631 	 */
18632 	old_char = ppa_ptr[0];
18633 	ppa_ptr[0] = '\0';
18634 
18635 	ill->ill_ppa = *new_ppa_ptr;
18636 	/*
18637 	 * Finish as much work now as possible before calling ill_glist_insert
18638 	 * which makes the ill globally visible and also merges it with the
18639 	 * other protocol instance of this phyint. The remaining work is
18640 	 * done after entering the ipsq which may happen sometime later.
18641 	 * ill_set_ndd_name occurs after the ill has been made globally visible.
18642 	 */
18643 	ipif = ill->ill_ipif;
18644 
18645 	/* We didn't do this when we allocated ipif in ip_ll_subnet_defaults */
18646 	ipif_assign_seqid(ipif);
18647 
18648 	if (!(ill->ill_flags & (ILLF_IPV4|ILLF_IPV6)))
18649 		ill->ill_flags |= ILLF_IPV4;
18650 
18651 	ASSERT(ipif->ipif_next == NULL);	/* Only one ipif on ill */
18652 	ASSERT((ipif->ipif_flags & IPIF_UP) == 0);
18653 
18654 	if (ill->ill_flags & ILLF_IPV6) {
18655 
18656 		ill->ill_isv6 = B_TRUE;
18657 		if (ill->ill_rq != NULL) {
18658 			ill->ill_rq->q_qinfo = &iprinitv6;
18659 			ill->ill_wq->q_qinfo = &ipwinitv6;
18660 		}
18661 
18662 		/* Keep the !IN6_IS_ADDR_V4MAPPED assertions happy */
18663 		ipif->ipif_v6lcl_addr = ipv6_all_zeros;
18664 		ipif->ipif_v6src_addr = ipv6_all_zeros;
18665 		ipif->ipif_v6subnet = ipv6_all_zeros;
18666 		ipif->ipif_v6net_mask = ipv6_all_zeros;
18667 		ipif->ipif_v6brd_addr = ipv6_all_zeros;
18668 		ipif->ipif_v6pp_dst_addr = ipv6_all_zeros;
18669 		/*
18670 		 * point-to-point or Non-mulicast capable
18671 		 * interfaces won't do NUD unless explicitly
18672 		 * configured to do so.
18673 		 */
18674 		if (ipif->ipif_flags & IPIF_POINTOPOINT ||
18675 		    !(ill->ill_flags & ILLF_MULTICAST)) {
18676 			ill->ill_flags |= ILLF_NONUD;
18677 		}
18678 		/* Make sure IPv4 specific flag is not set on IPv6 if */
18679 		if (ill->ill_flags & ILLF_NOARP) {
18680 			/*
18681 			 * Note: xresolv interfaces will eventually need
18682 			 * NOARP set here as well, but that will require
18683 			 * those external resolvers to have some
18684 			 * knowledge of that flag and act appropriately.
18685 			 * Not to be changed at present.
18686 			 */
18687 			ill->ill_flags &= ~ILLF_NOARP;
18688 		}
18689 		/*
18690 		 * Set the ILLF_ROUTER flag according to the global
18691 		 * IPv6 forwarding policy.
18692 		 */
18693 		if (ipst->ips_ipv6_forward != 0)
18694 			ill->ill_flags |= ILLF_ROUTER;
18695 	} else if (ill->ill_flags & ILLF_IPV4) {
18696 		ill->ill_isv6 = B_FALSE;
18697 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6lcl_addr);
18698 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6src_addr);
18699 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6subnet);
18700 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6net_mask);
18701 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6brd_addr);
18702 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6pp_dst_addr);
18703 		/*
18704 		 * Set the ILLF_ROUTER flag according to the global
18705 		 * IPv4 forwarding policy.
18706 		 */
18707 		if (ipst->ips_ip_g_forward != 0)
18708 			ill->ill_flags |= ILLF_ROUTER;
18709 	}
18710 
18711 	ASSERT(ill->ill_phyint != NULL);
18712 
18713 	/*
18714 	 * The ipIfStatsIfindex and ipv6IfIcmpIfIndex assignments will
18715 	 * be completed in ill_glist_insert -> ill_phyint_reinit
18716 	 */
18717 	if (!ill_allocate_mibs(ill))
18718 		return (ENOMEM);
18719 
18720 	/*
18721 	 * Pick a default sap until we get the DL_INFO_ACK back from
18722 	 * the driver.
18723 	 */
18724 	if (ill->ill_sap == 0) {
18725 		if (ill->ill_isv6)
18726 			ill->ill_sap = IP6_DL_SAP;
18727 		else
18728 			ill->ill_sap = IP_DL_SAP;
18729 	}
18730 
18731 	ill->ill_ifname_pending = 1;
18732 	ill->ill_ifname_pending_err = 0;
18733 
18734 	/*
18735 	 * When the first ipif comes up in ipif_up_done(), multicast groups
18736 	 * that were joined while this ill was not bound to the DLPI link need
18737 	 * to be recovered by ill_recover_multicast().
18738 	 */
18739 	ill->ill_need_recover_multicast = 1;
18740 
18741 	ill_refhold(ill);
18742 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
18743 	if ((error = ill_glist_insert(ill, interf_name,
18744 	    (ill->ill_flags & ILLF_IPV6) == ILLF_IPV6)) > 0) {
18745 		ill->ill_ppa = UINT_MAX;
18746 		ill->ill_name[0] = '\0';
18747 		/*
18748 		 * undo null termination done above.
18749 		 */
18750 		ppa_ptr[0] = old_char;
18751 		rw_exit(&ipst->ips_ill_g_lock);
18752 		ill_refrele(ill);
18753 		return (error);
18754 	}
18755 
18756 	ASSERT(ill->ill_name_length <= LIFNAMSIZ);
18757 
18758 	/*
18759 	 * When we return the buffer pointed to by interf_name should contain
18760 	 * the same name as in ill_name.
18761 	 * If a ppa was choosen by the system (ppa passed in was UINT_MAX)
18762 	 * the buffer pointed to by new_ppa_ptr would not contain the right ppa
18763 	 * so copy full name and update the ppa ptr.
18764 	 * When ppa passed in != UINT_MAX all values are correct just undo
18765 	 * null termination, this saves a bcopy.
18766 	 */
18767 	if (*new_ppa_ptr == UINT_MAX) {
18768 		bcopy(ill->ill_name, interf_name, ill->ill_name_length);
18769 		*new_ppa_ptr = ill->ill_ppa;
18770 	} else {
18771 		/*
18772 		 * undo null termination done above.
18773 		 */
18774 		ppa_ptr[0] = old_char;
18775 	}
18776 
18777 	/* Let SCTP know about this ILL */
18778 	sctp_update_ill(ill, SCTP_ILL_INSERT);
18779 
18780 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_reprocess_ioctl, NEW_OP,
18781 	    B_TRUE);
18782 
18783 	rw_exit(&ipst->ips_ill_g_lock);
18784 	ill_refrele(ill);
18785 	if (ipsq == NULL)
18786 		return (EINPROGRESS);
18787 
18788 	/*
18789 	 * If ill_phyint_reinit() changed our ipsq, then start on the new ipsq.
18790 	 */
18791 	if (ipsq->ipsq_xop->ipx_current_ipif == NULL)
18792 		ipsq_current_start(ipsq, ipif, SIOCSLIFNAME);
18793 	else
18794 		ASSERT(ipsq->ipsq_xop->ipx_current_ipif == ipif);
18795 
18796 	error = ipif_set_values_tail(ill, ipif, mp, q);
18797 	ipsq_exit(ipsq);
18798 	if (error != 0 && error != EINPROGRESS) {
18799 		/*
18800 		 * restore previous values
18801 		 */
18802 		ill->ill_isv6 = B_FALSE;
18803 	}
18804 	return (error);
18805 }
18806 
18807 void
18808 ipif_init(ip_stack_t *ipst)
18809 {
18810 	int i;
18811 
18812 	for (i = 0; i < MAX_G_HEADS; i++) {
18813 		ipst->ips_ill_g_heads[i].ill_g_list_head =
18814 		    (ill_if_t *)&ipst->ips_ill_g_heads[i];
18815 		ipst->ips_ill_g_heads[i].ill_g_list_tail =
18816 		    (ill_if_t *)&ipst->ips_ill_g_heads[i];
18817 	}
18818 
18819 	avl_create(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
18820 	    ill_phyint_compare_index,
18821 	    sizeof (phyint_t),
18822 	    offsetof(struct phyint, phyint_avl_by_index));
18823 	avl_create(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
18824 	    ill_phyint_compare_name,
18825 	    sizeof (phyint_t),
18826 	    offsetof(struct phyint, phyint_avl_by_name));
18827 }
18828 
18829 /*
18830  * Lookup the ipif corresponding to the onlink destination address. For
18831  * point-to-point interfaces, it matches with remote endpoint destination
18832  * address. For point-to-multipoint interfaces it only tries to match the
18833  * destination with the interface's subnet address. The longest, most specific
18834  * match is found to take care of such rare network configurations like -
18835  * le0: 129.146.1.1/16
18836  * le1: 129.146.2.2/24
18837  *
18838  * This is used by SO_DONTROUTE and IP_NEXTHOP.  Since neither of those are
18839  * supported on underlying interfaces in an IPMP group, underlying interfaces
18840  * are ignored when looking up a match.  (If we didn't ignore them, we'd
18841  * risk using a test address as a source for outgoing traffic.)
18842  */
18843 ipif_t *
18844 ipif_lookup_onlink_addr(ipaddr_t addr, zoneid_t zoneid, ip_stack_t *ipst)
18845 {
18846 	ipif_t	*ipif, *best_ipif;
18847 	ill_t	*ill;
18848 	ill_walk_context_t ctx;
18849 
18850 	ASSERT(zoneid != ALL_ZONES);
18851 	best_ipif = NULL;
18852 
18853 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
18854 	ill = ILL_START_WALK_V4(&ctx, ipst);
18855 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
18856 		if (IS_UNDER_IPMP(ill))
18857 			continue;
18858 		mutex_enter(&ill->ill_lock);
18859 		for (ipif = ill->ill_ipif; ipif != NULL;
18860 		    ipif = ipif->ipif_next) {
18861 			if (!IPIF_CAN_LOOKUP(ipif))
18862 				continue;
18863 			if (ipif->ipif_zoneid != zoneid &&
18864 			    ipif->ipif_zoneid != ALL_ZONES)
18865 				continue;
18866 			/*
18867 			 * Point-to-point case. Look for exact match with
18868 			 * destination address.
18869 			 */
18870 			if (ipif->ipif_flags & IPIF_POINTOPOINT) {
18871 				if (ipif->ipif_pp_dst_addr == addr) {
18872 					ipif_refhold_locked(ipif);
18873 					mutex_exit(&ill->ill_lock);
18874 					rw_exit(&ipst->ips_ill_g_lock);
18875 					if (best_ipif != NULL)
18876 						ipif_refrele(best_ipif);
18877 					return (ipif);
18878 				}
18879 			} else if (ipif->ipif_subnet == (addr &
18880 			    ipif->ipif_net_mask)) {
18881 				/*
18882 				 * Point-to-multipoint case. Looping through to
18883 				 * find the most specific match. If there are
18884 				 * multiple best match ipif's then prefer ipif's
18885 				 * that are UP. If there is only one best match
18886 				 * ipif and it is DOWN we must still return it.
18887 				 */
18888 				if ((best_ipif == NULL) ||
18889 				    (ipif->ipif_net_mask >
18890 				    best_ipif->ipif_net_mask) ||
18891 				    ((ipif->ipif_net_mask ==
18892 				    best_ipif->ipif_net_mask) &&
18893 				    ((ipif->ipif_flags & IPIF_UP) &&
18894 				    (!(best_ipif->ipif_flags & IPIF_UP))))) {
18895 					ipif_refhold_locked(ipif);
18896 					mutex_exit(&ill->ill_lock);
18897 					rw_exit(&ipst->ips_ill_g_lock);
18898 					if (best_ipif != NULL)
18899 						ipif_refrele(best_ipif);
18900 					best_ipif = ipif;
18901 					rw_enter(&ipst->ips_ill_g_lock,
18902 					    RW_READER);
18903 					mutex_enter(&ill->ill_lock);
18904 				}
18905 			}
18906 		}
18907 		mutex_exit(&ill->ill_lock);
18908 	}
18909 	rw_exit(&ipst->ips_ill_g_lock);
18910 	return (best_ipif);
18911 }
18912 
18913 /*
18914  * Save enough information so that we can recreate the IRE if
18915  * the interface goes down and then up.
18916  */
18917 static void
18918 ipif_save_ire(ipif_t *ipif, ire_t *ire)
18919 {
18920 	mblk_t	*save_mp;
18921 
18922 	save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
18923 	if (save_mp != NULL) {
18924 		ifrt_t	*ifrt;
18925 
18926 		save_mp->b_wptr += sizeof (ifrt_t);
18927 		ifrt = (ifrt_t *)save_mp->b_rptr;
18928 		bzero(ifrt, sizeof (ifrt_t));
18929 		ifrt->ifrt_type = ire->ire_type;
18930 		ifrt->ifrt_addr = ire->ire_addr;
18931 		ifrt->ifrt_gateway_addr = ire->ire_gateway_addr;
18932 		ifrt->ifrt_src_addr = ire->ire_src_addr;
18933 		ifrt->ifrt_mask = ire->ire_mask;
18934 		ifrt->ifrt_flags = ire->ire_flags;
18935 		ifrt->ifrt_max_frag = ire->ire_max_frag;
18936 		mutex_enter(&ipif->ipif_saved_ire_lock);
18937 		save_mp->b_cont = ipif->ipif_saved_ire_mp;
18938 		ipif->ipif_saved_ire_mp = save_mp;
18939 		ipif->ipif_saved_ire_cnt++;
18940 		mutex_exit(&ipif->ipif_saved_ire_lock);
18941 	}
18942 }
18943 
18944 static void
18945 ipif_remove_ire(ipif_t *ipif, ire_t *ire)
18946 {
18947 	mblk_t	**mpp;
18948 	mblk_t	*mp;
18949 	ifrt_t	*ifrt;
18950 
18951 	/* Remove from ipif_saved_ire_mp list if it is there */
18952 	mutex_enter(&ipif->ipif_saved_ire_lock);
18953 	for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL;
18954 	    mpp = &(*mpp)->b_cont) {
18955 		/*
18956 		 * On a given ipif, the triple of address, gateway and
18957 		 * mask is unique for each saved IRE (in the case of
18958 		 * ordinary interface routes, the gateway address is
18959 		 * all-zeroes).
18960 		 */
18961 		mp = *mpp;
18962 		ifrt = (ifrt_t *)mp->b_rptr;
18963 		if (ifrt->ifrt_addr == ire->ire_addr &&
18964 		    ifrt->ifrt_gateway_addr == ire->ire_gateway_addr &&
18965 		    ifrt->ifrt_mask == ire->ire_mask) {
18966 			*mpp = mp->b_cont;
18967 			ipif->ipif_saved_ire_cnt--;
18968 			freeb(mp);
18969 			break;
18970 		}
18971 	}
18972 	mutex_exit(&ipif->ipif_saved_ire_lock);
18973 }
18974 
18975 /*
18976  * IP multirouting broadcast routes handling
18977  * Append CGTP broadcast IREs to regular ones created
18978  * at ifconfig time.
18979  */
18980 static void
18981 ip_cgtp_bcast_add(ire_t *ire, ire_t *ire_dst, ip_stack_t *ipst)
18982 {
18983 	ire_t *ire_prim;
18984 
18985 	ASSERT(ire != NULL);
18986 	ASSERT(ire_dst != NULL);
18987 
18988 	ire_prim = ire_ctable_lookup(ire->ire_gateway_addr, 0,
18989 	    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
18990 	if (ire_prim != NULL) {
18991 		/*
18992 		 * We are in the special case of broadcasts for
18993 		 * CGTP. We add an IRE_BROADCAST that holds
18994 		 * the RTF_MULTIRT flag, the destination
18995 		 * address of ire_dst and the low level
18996 		 * info of ire_prim. In other words, CGTP
18997 		 * broadcast is added to the redundant ipif.
18998 		 */
18999 		ipif_t *ipif_prim;
19000 		ire_t  *bcast_ire;
19001 
19002 		ipif_prim = ire_prim->ire_ipif;
19003 
19004 		ip2dbg(("ip_cgtp_filter_bcast_add: "
19005 		    "ire_dst %p, ire_prim %p, ipif_prim %p\n",
19006 		    (void *)ire_dst, (void *)ire_prim,
19007 		    (void *)ipif_prim));
19008 
19009 		bcast_ire = ire_create(
19010 		    (uchar_t *)&ire->ire_addr,
19011 		    (uchar_t *)&ip_g_all_ones,
19012 		    (uchar_t *)&ire_dst->ire_src_addr,
19013 		    (uchar_t *)&ire->ire_gateway_addr,
19014 		    &ipif_prim->ipif_mtu,
19015 		    NULL,
19016 		    ipif_prim->ipif_rq,
19017 		    ipif_prim->ipif_wq,
19018 		    IRE_BROADCAST,
19019 		    ipif_prim,
19020 		    0,
19021 		    0,
19022 		    0,
19023 		    ire->ire_flags,
19024 		    &ire_uinfo_null,
19025 		    NULL,
19026 		    NULL,
19027 		    ipst);
19028 
19029 		if (bcast_ire != NULL) {
19030 
19031 			if (ire_add(&bcast_ire, NULL, NULL, NULL,
19032 			    B_FALSE) == 0) {
19033 				ip2dbg(("ip_cgtp_filter_bcast_add: "
19034 				    "added bcast_ire %p\n",
19035 				    (void *)bcast_ire));
19036 
19037 				ipif_save_ire(bcast_ire->ire_ipif,
19038 				    bcast_ire);
19039 				ire_refrele(bcast_ire);
19040 			}
19041 		}
19042 		ire_refrele(ire_prim);
19043 	}
19044 }
19045 
19046 /*
19047  * IP multirouting broadcast routes handling
19048  * Remove the broadcast ire
19049  */
19050 static void
19051 ip_cgtp_bcast_delete(ire_t *ire, ip_stack_t *ipst)
19052 {
19053 	ire_t *ire_dst;
19054 
19055 	ASSERT(ire != NULL);
19056 	ire_dst = ire_ctable_lookup(ire->ire_addr, 0, IRE_BROADCAST,
19057 	    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
19058 	if (ire_dst != NULL) {
19059 		ire_t *ire_prim;
19060 
19061 		ire_prim = ire_ctable_lookup(ire->ire_gateway_addr, 0,
19062 		    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
19063 		if (ire_prim != NULL) {
19064 			ipif_t *ipif_prim;
19065 			ire_t  *bcast_ire;
19066 
19067 			ipif_prim = ire_prim->ire_ipif;
19068 
19069 			ip2dbg(("ip_cgtp_filter_bcast_delete: "
19070 			    "ire_dst %p, ire_prim %p, ipif_prim %p\n",
19071 			    (void *)ire_dst, (void *)ire_prim,
19072 			    (void *)ipif_prim));
19073 
19074 			bcast_ire = ire_ctable_lookup(ire->ire_addr,
19075 			    ire->ire_gateway_addr,
19076 			    IRE_BROADCAST,
19077 			    ipif_prim, ALL_ZONES,
19078 			    NULL,
19079 			    MATCH_IRE_TYPE | MATCH_IRE_GW | MATCH_IRE_IPIF |
19080 			    MATCH_IRE_MASK, ipst);
19081 
19082 			if (bcast_ire != NULL) {
19083 				ip2dbg(("ip_cgtp_filter_bcast_delete: "
19084 				    "looked up bcast_ire %p\n",
19085 				    (void *)bcast_ire));
19086 				ipif_remove_ire(bcast_ire->ire_ipif,
19087 				    bcast_ire);
19088 				ire_delete(bcast_ire);
19089 				ire_refrele(bcast_ire);
19090 			}
19091 			ire_refrele(ire_prim);
19092 		}
19093 		ire_refrele(ire_dst);
19094 	}
19095 }
19096 
19097 /*
19098  * IPsec hardware acceleration capabilities related functions.
19099  */
19100 
19101 /*
19102  * Free a per-ill IPsec capabilities structure.
19103  */
19104 static void
19105 ill_ipsec_capab_free(ill_ipsec_capab_t *capab)
19106 {
19107 	if (capab->auth_hw_algs != NULL)
19108 		kmem_free(capab->auth_hw_algs, capab->algs_size);
19109 	if (capab->encr_hw_algs != NULL)
19110 		kmem_free(capab->encr_hw_algs, capab->algs_size);
19111 	if (capab->encr_algparm != NULL)
19112 		kmem_free(capab->encr_algparm, capab->encr_algparm_size);
19113 	kmem_free(capab, sizeof (ill_ipsec_capab_t));
19114 }
19115 
19116 /*
19117  * Allocate a new per-ill IPsec capabilities structure. This structure
19118  * is specific to an IPsec protocol (AH or ESP). It is implemented as
19119  * an array which specifies, for each algorithm, whether this algorithm
19120  * is supported by the ill or not.
19121  */
19122 static ill_ipsec_capab_t *
19123 ill_ipsec_capab_alloc(void)
19124 {
19125 	ill_ipsec_capab_t *capab;
19126 	uint_t nelems;
19127 
19128 	capab = kmem_zalloc(sizeof (ill_ipsec_capab_t), KM_NOSLEEP);
19129 	if (capab == NULL)
19130 		return (NULL);
19131 
19132 	/* we need one bit per algorithm */
19133 	nelems = MAX_IPSEC_ALGS / BITS(ipsec_capab_elem_t);
19134 	capab->algs_size = nelems * sizeof (ipsec_capab_elem_t);
19135 
19136 	/* allocate memory to store algorithm flags */
19137 	capab->encr_hw_algs = kmem_zalloc(capab->algs_size, KM_NOSLEEP);
19138 	if (capab->encr_hw_algs == NULL)
19139 		goto nomem;
19140 	capab->auth_hw_algs = kmem_zalloc(capab->algs_size, KM_NOSLEEP);
19141 	if (capab->auth_hw_algs == NULL)
19142 		goto nomem;
19143 	/*
19144 	 * Leave encr_algparm NULL for now since we won't need it half
19145 	 * the time
19146 	 */
19147 	return (capab);
19148 
19149 nomem:
19150 	ill_ipsec_capab_free(capab);
19151 	return (NULL);
19152 }
19153 
19154 /*
19155  * Resize capability array.  Since we're exclusive, this is OK.
19156  */
19157 static boolean_t
19158 ill_ipsec_capab_resize_algparm(ill_ipsec_capab_t *capab, int algid)
19159 {
19160 	ipsec_capab_algparm_t *nalp, *oalp;
19161 	uint32_t olen, nlen;
19162 
19163 	oalp = capab->encr_algparm;
19164 	olen = capab->encr_algparm_size;
19165 
19166 	if (oalp != NULL) {
19167 		if (algid < capab->encr_algparm_end)
19168 			return (B_TRUE);
19169 	}
19170 
19171 	nlen = (algid + 1) * sizeof (*nalp);
19172 	nalp = kmem_zalloc(nlen, KM_NOSLEEP);
19173 	if (nalp == NULL)
19174 		return (B_FALSE);
19175 
19176 	if (oalp != NULL) {
19177 		bcopy(oalp, nalp, olen);
19178 		kmem_free(oalp, olen);
19179 	}
19180 	capab->encr_algparm = nalp;
19181 	capab->encr_algparm_size = nlen;
19182 	capab->encr_algparm_end = algid + 1;
19183 
19184 	return (B_TRUE);
19185 }
19186 
19187 /*
19188  * Compare the capabilities of the specified ill with the protocol
19189  * and algorithms specified by the SA passed as argument.
19190  * If they match, returns B_TRUE, B_FALSE if they do not match.
19191  *
19192  * The ill can be passed as a pointer to it, or by specifying its index
19193  * and whether it is an IPv6 ill (ill_index and ill_isv6 arguments).
19194  *
19195  * Called by ipsec_out_is_accelerated() do decide whether an outbound
19196  * packet is eligible for hardware acceleration, and by
19197  * ill_ipsec_capab_send_all() to decide whether a SA must be sent down
19198  * to a particular ill.
19199  */
19200 boolean_t
19201 ipsec_capab_match(ill_t *ill, uint_t ill_index, boolean_t ill_isv6,
19202     ipsa_t *sa, netstack_t *ns)
19203 {
19204 	boolean_t sa_isv6;
19205 	uint_t algid;
19206 	struct ill_ipsec_capab_s *cpp;
19207 	boolean_t need_refrele = B_FALSE;
19208 	ip_stack_t	*ipst = ns->netstack_ip;
19209 
19210 	if (ill == NULL) {
19211 		ill = ill_lookup_on_ifindex(ill_index, ill_isv6, NULL,
19212 		    NULL, NULL, NULL, ipst);
19213 		if (ill == NULL) {
19214 			ip0dbg(("ipsec_capab_match: ill doesn't exist\n"));
19215 			return (B_FALSE);
19216 		}
19217 		need_refrele = B_TRUE;
19218 	}
19219 
19220 	/*
19221 	 * Use the address length specified by the SA to determine
19222 	 * if it corresponds to a IPv6 address, and fail the matching
19223 	 * if the isv6 flag passed as argument does not match.
19224 	 * Note: this check is used for SADB capability checking before
19225 	 * sending SA information to an ill.
19226 	 */
19227 	sa_isv6 = (sa->ipsa_addrfam == AF_INET6);
19228 	if (sa_isv6 != ill_isv6)
19229 		/* protocol mismatch */
19230 		goto done;
19231 
19232 	/*
19233 	 * Check if the ill supports the protocol, algorithm(s) and
19234 	 * key size(s) specified by the SA, and get the pointers to
19235 	 * the algorithms supported by the ill.
19236 	 */
19237 	switch (sa->ipsa_type) {
19238 
19239 	case SADB_SATYPE_ESP:
19240 		if (!(ill->ill_capabilities & ILL_CAPAB_ESP))
19241 			/* ill does not support ESP acceleration */
19242 			goto done;
19243 		cpp = ill->ill_ipsec_capab_esp;
19244 		algid = sa->ipsa_auth_alg;
19245 		if (!IPSEC_ALG_IS_ENABLED(algid, cpp->auth_hw_algs))
19246 			goto done;
19247 		algid = sa->ipsa_encr_alg;
19248 		if (!IPSEC_ALG_IS_ENABLED(algid, cpp->encr_hw_algs))
19249 			goto done;
19250 		if (algid < cpp->encr_algparm_end) {
19251 			ipsec_capab_algparm_t *alp = &cpp->encr_algparm[algid];
19252 			if (sa->ipsa_encrkeybits < alp->minkeylen)
19253 				goto done;
19254 			if (sa->ipsa_encrkeybits > alp->maxkeylen)
19255 				goto done;
19256 		}
19257 		break;
19258 
19259 	case SADB_SATYPE_AH:
19260 		if (!(ill->ill_capabilities & ILL_CAPAB_AH))
19261 			/* ill does not support AH acceleration */
19262 			goto done;
19263 		if (!IPSEC_ALG_IS_ENABLED(sa->ipsa_auth_alg,
19264 		    ill->ill_ipsec_capab_ah->auth_hw_algs))
19265 			goto done;
19266 		break;
19267 	}
19268 
19269 	if (need_refrele)
19270 		ill_refrele(ill);
19271 	return (B_TRUE);
19272 done:
19273 	if (need_refrele)
19274 		ill_refrele(ill);
19275 	return (B_FALSE);
19276 }
19277 
19278 /*
19279  * Add a new ill to the list of IPsec capable ills.
19280  * Called from ill_capability_ipsec_ack() when an ACK was received
19281  * indicating that IPsec hardware processing was enabled for an ill.
19282  *
19283  * ill must point to the ill for which acceleration was enabled.
19284  * dl_cap must be set to DL_CAPAB_IPSEC_AH or DL_CAPAB_IPSEC_ESP.
19285  */
19286 static void
19287 ill_ipsec_capab_add(ill_t *ill, uint_t dl_cap, boolean_t sadb_resync)
19288 {
19289 	ipsec_capab_ill_t **ills, *cur_ill, *new_ill;
19290 	uint_t sa_type;
19291 	uint_t ipproto;
19292 	ip_stack_t	*ipst = ill->ill_ipst;
19293 
19294 	ASSERT((dl_cap == DL_CAPAB_IPSEC_AH) ||
19295 	    (dl_cap == DL_CAPAB_IPSEC_ESP));
19296 
19297 	switch (dl_cap) {
19298 	case DL_CAPAB_IPSEC_AH:
19299 		sa_type = SADB_SATYPE_AH;
19300 		ills = &ipst->ips_ipsec_capab_ills_ah;
19301 		ipproto = IPPROTO_AH;
19302 		break;
19303 	case DL_CAPAB_IPSEC_ESP:
19304 		sa_type = SADB_SATYPE_ESP;
19305 		ills = &ipst->ips_ipsec_capab_ills_esp;
19306 		ipproto = IPPROTO_ESP;
19307 		break;
19308 	}
19309 
19310 	rw_enter(&ipst->ips_ipsec_capab_ills_lock, RW_WRITER);
19311 
19312 	/*
19313 	 * Add ill index to list of hardware accelerators. If
19314 	 * already in list, do nothing.
19315 	 */
19316 	for (cur_ill = *ills; cur_ill != NULL &&
19317 	    (cur_ill->ill_index != ill->ill_phyint->phyint_ifindex ||
19318 	    cur_ill->ill_isv6 != ill->ill_isv6); cur_ill = cur_ill->next)
19319 		;
19320 
19321 	if (cur_ill == NULL) {
19322 		/* if this is a new entry for this ill */
19323 		new_ill = kmem_zalloc(sizeof (ipsec_capab_ill_t), KM_NOSLEEP);
19324 		if (new_ill == NULL) {
19325 			rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19326 			return;
19327 		}
19328 
19329 		new_ill->ill_index = ill->ill_phyint->phyint_ifindex;
19330 		new_ill->ill_isv6 = ill->ill_isv6;
19331 		new_ill->next = *ills;
19332 		*ills = new_ill;
19333 	} else if (!sadb_resync) {
19334 		/* not resync'ing SADB and an entry exists for this ill */
19335 		rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19336 		return;
19337 	}
19338 
19339 	rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19340 
19341 	if (ipst->ips_ipcl_proto_fanout_v6[ipproto].connf_head != NULL)
19342 		/*
19343 		 * IPsec module for protocol loaded, initiate dump
19344 		 * of the SADB to this ill.
19345 		 */
19346 		sadb_ill_download(ill, sa_type);
19347 }
19348 
19349 /*
19350  * Remove an ill from the list of IPsec capable ills.
19351  */
19352 static void
19353 ill_ipsec_capab_delete(ill_t *ill, uint_t dl_cap)
19354 {
19355 	ipsec_capab_ill_t **ills, *cur_ill, *prev_ill;
19356 	ip_stack_t	*ipst = ill->ill_ipst;
19357 
19358 	ASSERT(dl_cap == DL_CAPAB_IPSEC_AH ||
19359 	    dl_cap == DL_CAPAB_IPSEC_ESP);
19360 
19361 	ills = (dl_cap == DL_CAPAB_IPSEC_AH) ? &ipst->ips_ipsec_capab_ills_ah :
19362 	    &ipst->ips_ipsec_capab_ills_esp;
19363 
19364 	rw_enter(&ipst->ips_ipsec_capab_ills_lock, RW_WRITER);
19365 
19366 	prev_ill = NULL;
19367 	for (cur_ill = *ills; cur_ill != NULL && (cur_ill->ill_index !=
19368 	    ill->ill_phyint->phyint_ifindex || cur_ill->ill_isv6 !=
19369 	    ill->ill_isv6); prev_ill = cur_ill, cur_ill = cur_ill->next)
19370 		;
19371 	if (cur_ill == NULL) {
19372 		/* entry not found */
19373 		rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19374 		return;
19375 	}
19376 	if (prev_ill == NULL) {
19377 		/* entry at front of list */
19378 		*ills = NULL;
19379 	} else {
19380 		prev_ill->next = cur_ill->next;
19381 	}
19382 	kmem_free(cur_ill, sizeof (ipsec_capab_ill_t));
19383 	rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19384 }
19385 
19386 /*
19387  * Called by SADB to send a DL_CONTROL_REQ message to every ill
19388  * supporting the specified IPsec protocol acceleration.
19389  * sa_type must be SADB_SATYPE_AH or SADB_SATYPE_ESP.
19390  * We free the mblk and, if sa is non-null, release the held referece.
19391  */
19392 void
19393 ill_ipsec_capab_send_all(uint_t sa_type, mblk_t *mp, ipsa_t *sa,
19394     netstack_t *ns)
19395 {
19396 	ipsec_capab_ill_t *ici, *cur_ici;
19397 	ill_t *ill;
19398 	mblk_t *nmp, *mp_ship_list = NULL, *next_mp;
19399 	ip_stack_t	*ipst = ns->netstack_ip;
19400 
19401 	ici = (sa_type == SADB_SATYPE_AH) ? ipst->ips_ipsec_capab_ills_ah :
19402 	    ipst->ips_ipsec_capab_ills_esp;
19403 
19404 	rw_enter(&ipst->ips_ipsec_capab_ills_lock, RW_READER);
19405 
19406 	for (cur_ici = ici; cur_ici != NULL; cur_ici = cur_ici->next) {
19407 		ill = ill_lookup_on_ifindex(cur_ici->ill_index,
19408 		    cur_ici->ill_isv6, NULL, NULL, NULL, NULL, ipst);
19409 
19410 		/*
19411 		 * Handle the case where the ill goes away while the SADB is
19412 		 * attempting to send messages.  If it's going away, it's
19413 		 * nuking its shadow SADB, so we don't care..
19414 		 */
19415 
19416 		if (ill == NULL)
19417 			continue;
19418 
19419 		if (sa != NULL) {
19420 			/*
19421 			 * Make sure capabilities match before
19422 			 * sending SA to ill.
19423 			 */
19424 			if (!ipsec_capab_match(ill, cur_ici->ill_index,
19425 			    cur_ici->ill_isv6, sa, ipst->ips_netstack)) {
19426 				ill_refrele(ill);
19427 				continue;
19428 			}
19429 
19430 			mutex_enter(&sa->ipsa_lock);
19431 			sa->ipsa_flags |= IPSA_F_HW;
19432 			mutex_exit(&sa->ipsa_lock);
19433 		}
19434 
19435 		/*
19436 		 * Copy template message, and add it to the front
19437 		 * of the mblk ship list. We want to avoid holding
19438 		 * the ipsec_capab_ills_lock while sending the
19439 		 * message to the ills.
19440 		 *
19441 		 * The b_next and b_prev are temporarily used
19442 		 * to build a list of mblks to be sent down, and to
19443 		 * save the ill to which they must be sent.
19444 		 */
19445 		nmp = copymsg(mp);
19446 		if (nmp == NULL) {
19447 			ill_refrele(ill);
19448 			continue;
19449 		}
19450 		ASSERT(nmp->b_next == NULL && nmp->b_prev == NULL);
19451 		nmp->b_next = mp_ship_list;
19452 		mp_ship_list = nmp;
19453 		nmp->b_prev = (mblk_t *)ill;
19454 	}
19455 
19456 	rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19457 
19458 	for (nmp = mp_ship_list; nmp != NULL; nmp = next_mp) {
19459 		/* restore the mblk to a sane state */
19460 		next_mp = nmp->b_next;
19461 		nmp->b_next = NULL;
19462 		ill = (ill_t *)nmp->b_prev;
19463 		nmp->b_prev = NULL;
19464 
19465 		ill_dlpi_send(ill, nmp);
19466 		ill_refrele(ill);
19467 	}
19468 
19469 	if (sa != NULL)
19470 		IPSA_REFRELE(sa);
19471 	freemsg(mp);
19472 }
19473 
19474 /*
19475  * Derive an interface id from the link layer address.
19476  * Knows about IEEE 802 and IEEE EUI-64 mappings.
19477  */
19478 static boolean_t
19479 ip_ether_v6intfid(ill_t *ill, in6_addr_t *v6addr)
19480 {
19481 	char		*addr;
19482 
19483 	if (ill->ill_phys_addr_length != ETHERADDRL)
19484 		return (B_FALSE);
19485 
19486 	/* Form EUI-64 like address */
19487 	addr = (char *)&v6addr->s6_addr32[2];
19488 	bcopy(ill->ill_phys_addr, addr, 3);
19489 	addr[0] ^= 0x2;		/* Toggle Universal/Local bit */
19490 	addr[3] = (char)0xff;
19491 	addr[4] = (char)0xfe;
19492 	bcopy(ill->ill_phys_addr + 3, addr + 5, 3);
19493 	return (B_TRUE);
19494 }
19495 
19496 /* ARGSUSED */
19497 static boolean_t
19498 ip_nodef_v6intfid(ill_t *ill, in6_addr_t *v6addr)
19499 {
19500 	return (B_FALSE);
19501 }
19502 
19503 typedef struct ipmp_ifcookie {
19504 	uint32_t	ic_hostid;
19505 	char		ic_ifname[LIFNAMSIZ];
19506 	char		ic_zonename[ZONENAME_MAX];
19507 } ipmp_ifcookie_t;
19508 
19509 /*
19510  * Construct a pseudo-random interface ID for the IPMP interface that's both
19511  * predictable and (almost) guaranteed to be unique.
19512  */
19513 static boolean_t
19514 ip_ipmp_v6intfid(ill_t *ill, in6_addr_t *v6addr)
19515 {
19516 	zone_t		*zp;
19517 	uint8_t		*addr;
19518 	uchar_t		hash[16];
19519 	ulong_t 	hostid;
19520 	MD5_CTX		ctx;
19521 	ipmp_ifcookie_t	ic = { 0 };
19522 
19523 	ASSERT(IS_IPMP(ill));
19524 
19525 	(void) ddi_strtoul(hw_serial, NULL, 10, &hostid);
19526 	ic.ic_hostid = htonl((uint32_t)hostid);
19527 
19528 	(void) strlcpy(ic.ic_ifname, ill->ill_name, LIFNAMSIZ);
19529 
19530 	if ((zp = zone_find_by_id(ill->ill_zoneid)) != NULL) {
19531 		(void) strlcpy(ic.ic_zonename, zp->zone_name, ZONENAME_MAX);
19532 		zone_rele(zp);
19533 	}
19534 
19535 	MD5Init(&ctx);
19536 	MD5Update(&ctx, &ic, sizeof (ic));
19537 	MD5Final(hash, &ctx);
19538 
19539 	/*
19540 	 * Map the hash to an interface ID per the basic approach in RFC3041.
19541 	 */
19542 	addr = &v6addr->s6_addr8[8];
19543 	bcopy(hash + 8, addr, sizeof (uint64_t));
19544 	addr[0] &= ~0x2;				/* set local bit */
19545 
19546 	return (B_TRUE);
19547 }
19548 
19549 /* ARGSUSED */
19550 static boolean_t
19551 ip_ether_v6mapinfo(uint_t lla_length, uint8_t *bphys_addr, uint8_t *maddr,
19552     uint32_t *hw_start, in6_addr_t *v6_extract_mask)
19553 {
19554 	/*
19555 	 * Multicast address mappings used over Ethernet/802.X.
19556 	 * This address is used as a base for mappings.
19557 	 */
19558 	static uint8_t ipv6_g_phys_multi_addr[] = {0x33, 0x33, 0x00,
19559 	    0x00, 0x00, 0x00};
19560 
19561 	/*
19562 	 * Extract low order 32 bits from IPv6 multicast address.
19563 	 * Or that into the link layer address, starting from the
19564 	 * second byte.
19565 	 */
19566 	*hw_start = 2;
19567 	v6_extract_mask->s6_addr32[0] = 0;
19568 	v6_extract_mask->s6_addr32[1] = 0;
19569 	v6_extract_mask->s6_addr32[2] = 0;
19570 	v6_extract_mask->s6_addr32[3] = 0xffffffffU;
19571 	bcopy(ipv6_g_phys_multi_addr, maddr, lla_length);
19572 	return (B_TRUE);
19573 }
19574 
19575 /*
19576  * Indicate by return value whether multicast is supported. If not,
19577  * this code should not touch/change any parameters.
19578  */
19579 /* ARGSUSED */
19580 static boolean_t
19581 ip_ether_v4mapinfo(uint_t phys_length, uint8_t *bphys_addr, uint8_t *maddr,
19582     uint32_t *hw_start, ipaddr_t *extract_mask)
19583 {
19584 	/*
19585 	 * Multicast address mappings used over Ethernet/802.X.
19586 	 * This address is used as a base for mappings.
19587 	 */
19588 	static uint8_t ip_g_phys_multi_addr[] = { 0x01, 0x00, 0x5e,
19589 	    0x00, 0x00, 0x00 };
19590 
19591 	if (phys_length != ETHERADDRL)
19592 		return (B_FALSE);
19593 
19594 	*extract_mask = htonl(0x007fffff);
19595 	*hw_start = 2;
19596 	bcopy(ip_g_phys_multi_addr, maddr, ETHERADDRL);
19597 	return (B_TRUE);
19598 }
19599 
19600 /*
19601  * Derive IPoIB interface id from the link layer address.
19602  */
19603 static boolean_t
19604 ip_ib_v6intfid(ill_t *ill, in6_addr_t *v6addr)
19605 {
19606 	char		*addr;
19607 
19608 	if (ill->ill_phys_addr_length != 20)
19609 		return (B_FALSE);
19610 	addr = (char *)&v6addr->s6_addr32[2];
19611 	bcopy(ill->ill_phys_addr + 12, addr, 8);
19612 	/*
19613 	 * In IBA 1.1 timeframe, some vendors erroneously set the u/l bit
19614 	 * in the globally assigned EUI-64 GUID to 1, in violation of IEEE
19615 	 * rules. In these cases, the IBA considers these GUIDs to be in
19616 	 * "Modified EUI-64" format, and thus toggling the u/l bit is not
19617 	 * required; vendors are required not to assign global EUI-64's
19618 	 * that differ only in u/l bit values, thus guaranteeing uniqueness
19619 	 * of the interface identifier. Whether the GUID is in modified
19620 	 * or proper EUI-64 format, the ipv6 identifier must have the u/l
19621 	 * bit set to 1.
19622 	 */
19623 	addr[0] |= 2;			/* Set Universal/Local bit to 1 */
19624 	return (B_TRUE);
19625 }
19626 
19627 /*
19628  * Note on mapping from multicast IP addresses to IPoIB multicast link
19629  * addresses. IPoIB multicast link addresses are based on IBA link addresses.
19630  * The format of an IPoIB multicast address is:
19631  *
19632  *  4 byte QPN      Scope Sign.  Pkey
19633  * +--------------------------------------------+
19634  * | 00FFFFFF | FF | 1X | X01B | Pkey | GroupID |
19635  * +--------------------------------------------+
19636  *
19637  * The Scope and Pkey components are properties of the IBA port and
19638  * network interface. They can be ascertained from the broadcast address.
19639  * The Sign. part is the signature, and is 401B for IPv4 and 601B for IPv6.
19640  */
19641 
19642 static boolean_t
19643 ip_ib_v6mapinfo(uint_t lla_length, uint8_t *bphys_addr, uint8_t *maddr,
19644     uint32_t *hw_start, in6_addr_t *v6_extract_mask)
19645 {
19646 	/*
19647 	 * Base IPoIB IPv6 multicast address used for mappings.
19648 	 * Does not contain the IBA scope/Pkey values.
19649 	 */
19650 	static uint8_t ipv6_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
19651 	    0xff, 0x10, 0x60, 0x1b, 0x00, 0x00, 0x00, 0x00,
19652 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
19653 
19654 	/*
19655 	 * Extract low order 80 bits from IPv6 multicast address.
19656 	 * Or that into the link layer address, starting from the
19657 	 * sixth byte.
19658 	 */
19659 	*hw_start = 6;
19660 	bcopy(ipv6_g_phys_ibmulti_addr, maddr, lla_length);
19661 
19662 	/*
19663 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
19664 	 */
19665 	*(maddr + 5) = *(bphys_addr + 5);
19666 	*(maddr + 8) = *(bphys_addr + 8);
19667 	*(maddr + 9) = *(bphys_addr + 9);
19668 
19669 	v6_extract_mask->s6_addr32[0] = 0;
19670 	v6_extract_mask->s6_addr32[1] = htonl(0x0000ffff);
19671 	v6_extract_mask->s6_addr32[2] = 0xffffffffU;
19672 	v6_extract_mask->s6_addr32[3] = 0xffffffffU;
19673 	return (B_TRUE);
19674 }
19675 
19676 static boolean_t
19677 ip_ib_v4mapinfo(uint_t phys_length, uint8_t *bphys_addr, uint8_t *maddr,
19678     uint32_t *hw_start, ipaddr_t *extract_mask)
19679 {
19680 	/*
19681 	 * Base IPoIB IPv4 multicast address used for mappings.
19682 	 * Does not contain the IBA scope/Pkey values.
19683 	 */
19684 	static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
19685 	    0xff, 0x10, 0x40, 0x1b, 0x00, 0x00, 0x00, 0x00,
19686 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
19687 
19688 	if (phys_length != sizeof (ipv4_g_phys_ibmulti_addr))
19689 		return (B_FALSE);
19690 
19691 	/*
19692 	 * Extract low order 28 bits from IPv4 multicast address.
19693 	 * Or that into the link layer address, starting from the
19694 	 * sixteenth byte.
19695 	 */
19696 	*extract_mask = htonl(0x0fffffff);
19697 	*hw_start = 16;
19698 	bcopy(ipv4_g_phys_ibmulti_addr, maddr, phys_length);
19699 
19700 	/*
19701 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
19702 	 */
19703 	*(maddr + 5) = *(bphys_addr + 5);
19704 	*(maddr + 8) = *(bphys_addr + 8);
19705 	*(maddr + 9) = *(bphys_addr + 9);
19706 	return (B_TRUE);
19707 }
19708 
19709 /*
19710  * Returns B_TRUE if an ipif is present in the given zone, matching some flags
19711  * (typically IPIF_UP). If ipifp is non-null, the held ipif is returned there.
19712  * This works for both IPv4 and IPv6; if the passed-in ill is v6, the ipif with
19713  * the link-local address is preferred.
19714  */
19715 boolean_t
19716 ipif_lookup_zoneid(ill_t *ill, zoneid_t zoneid, int flags, ipif_t **ipifp)
19717 {
19718 	ipif_t	*ipif;
19719 	ipif_t	*maybe_ipif = NULL;
19720 
19721 	mutex_enter(&ill->ill_lock);
19722 	if (ill->ill_state_flags & ILL_CONDEMNED) {
19723 		mutex_exit(&ill->ill_lock);
19724 		if (ipifp != NULL)
19725 			*ipifp = NULL;
19726 		return (B_FALSE);
19727 	}
19728 
19729 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
19730 		if (!IPIF_CAN_LOOKUP(ipif))
19731 			continue;
19732 		if (zoneid != ALL_ZONES && ipif->ipif_zoneid != zoneid &&
19733 		    ipif->ipif_zoneid != ALL_ZONES)
19734 			continue;
19735 		if ((ipif->ipif_flags & flags) != flags)
19736 			continue;
19737 
19738 		if (ipifp == NULL) {
19739 			mutex_exit(&ill->ill_lock);
19740 			ASSERT(maybe_ipif == NULL);
19741 			return (B_TRUE);
19742 		}
19743 		if (!ill->ill_isv6 ||
19744 		    IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6src_addr)) {
19745 			ipif_refhold_locked(ipif);
19746 			mutex_exit(&ill->ill_lock);
19747 			*ipifp = ipif;
19748 			return (B_TRUE);
19749 		}
19750 		if (maybe_ipif == NULL)
19751 			maybe_ipif = ipif;
19752 	}
19753 	if (ipifp != NULL) {
19754 		if (maybe_ipif != NULL)
19755 			ipif_refhold_locked(maybe_ipif);
19756 		*ipifp = maybe_ipif;
19757 	}
19758 	mutex_exit(&ill->ill_lock);
19759 	return (maybe_ipif != NULL);
19760 }
19761 
19762 /*
19763  * Return a pointer to an ipif_t given a combination of (ill_idx,ipif_id)
19764  * If a pointer to an ipif_t is returned then the caller will need to do
19765  * an ill_refrele().
19766  */
19767 ipif_t *
19768 ipif_getby_indexes(uint_t ifindex, uint_t lifidx, boolean_t isv6,
19769     ip_stack_t *ipst)
19770 {
19771 	ipif_t *ipif;
19772 	ill_t *ill;
19773 
19774 	ill = ill_lookup_on_ifindex(ifindex, isv6, NULL, NULL, NULL, NULL,
19775 	    ipst);
19776 	if (ill == NULL)
19777 		return (NULL);
19778 
19779 	mutex_enter(&ill->ill_lock);
19780 	if (ill->ill_state_flags & ILL_CONDEMNED) {
19781 		mutex_exit(&ill->ill_lock);
19782 		ill_refrele(ill);
19783 		return (NULL);
19784 	}
19785 
19786 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
19787 		if (!IPIF_CAN_LOOKUP(ipif))
19788 			continue;
19789 		if (lifidx == ipif->ipif_id) {
19790 			ipif_refhold_locked(ipif);
19791 			break;
19792 		}
19793 	}
19794 
19795 	mutex_exit(&ill->ill_lock);
19796 	ill_refrele(ill);
19797 	return (ipif);
19798 }
19799 
19800 /*
19801  * Flush the fastpath by deleting any nce's that are waiting for the fastpath,
19802  * There is one exceptions IRE_BROADCAST are difficult to recreate,
19803  * so instead we just nuke their nce_fp_mp's; see ndp_fastpath_flush()
19804  * for details.
19805  */
19806 void
19807 ill_fastpath_flush(ill_t *ill)
19808 {
19809 	ip_stack_t *ipst = ill->ill_ipst;
19810 
19811 	nce_fastpath_list_dispatch(ill, NULL, NULL);
19812 	ndp_walk_common((ill->ill_isv6 ? ipst->ips_ndp6 : ipst->ips_ndp4),
19813 	    ill, (pfi_t)ndp_fastpath_flush, NULL, B_TRUE);
19814 }
19815 
19816 /*
19817  * Set the physical address information for `ill' to the contents of the
19818  * dl_notify_ind_t pointed to by `mp'.  Must be called as writer, and will be
19819  * asynchronous if `ill' cannot immediately be quiesced -- in which case
19820  * EINPROGRESS will be returned.
19821  */
19822 int
19823 ill_set_phys_addr(ill_t *ill, mblk_t *mp)
19824 {
19825 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
19826 	dl_notify_ind_t	*dlindp = (dl_notify_ind_t *)mp->b_rptr;
19827 
19828 	ASSERT(IAM_WRITER_IPSQ(ipsq));
19829 
19830 	if (dlindp->dl_data != DL_IPV6_LINK_LAYER_ADDR &&
19831 	    dlindp->dl_data != DL_CURR_PHYS_ADDR) {
19832 		/* Changing DL_IPV6_TOKEN is not yet supported */
19833 		return (0);
19834 	}
19835 
19836 	/*
19837 	 * We need to store up to two copies of `mp' in `ill'.  Due to the
19838 	 * design of ipsq_pending_mp_add(), we can't pass them as separate
19839 	 * arguments to ill_set_phys_addr_tail().  Instead, chain them
19840 	 * together here, then pull 'em apart in ill_set_phys_addr_tail().
19841 	 */
19842 	if ((mp = copyb(mp)) == NULL || (mp->b_cont = copyb(mp)) == NULL) {
19843 		freemsg(mp);
19844 		return (ENOMEM);
19845 	}
19846 
19847 	ipsq_current_start(ipsq, ill->ill_ipif, 0);
19848 
19849 	/*
19850 	 * If we can quiesce the ill, then set the address.  If not, then
19851 	 * ill_set_phys_addr_tail() will be called from ipif_ill_refrele_tail().
19852 	 */
19853 	ill_down_ipifs(ill, B_TRUE);
19854 	mutex_enter(&ill->ill_lock);
19855 	if (!ill_is_quiescent(ill)) {
19856 		/* call cannot fail since `conn_t *' argument is NULL */
19857 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
19858 		    mp, ILL_DOWN);
19859 		mutex_exit(&ill->ill_lock);
19860 		return (EINPROGRESS);
19861 	}
19862 	mutex_exit(&ill->ill_lock);
19863 
19864 	ill_set_phys_addr_tail(ipsq, ill->ill_rq, mp, NULL);
19865 	return (0);
19866 }
19867 
19868 /*
19869  * Once the ill associated with `q' has quiesced, set its physical address
19870  * information to the values in `addrmp'.  Note that two copies of `addrmp'
19871  * are passed (linked by b_cont), since we sometimes need to save two distinct
19872  * copies in the ill_t, and our context doesn't permit sleeping or allocation
19873  * failure (we'll free the other copy if it's not needed).  Since the ill_t
19874  * is quiesced, we know any stale IREs with the old address information have
19875  * already been removed, so we don't need to call ill_fastpath_flush().
19876  */
19877 /* ARGSUSED */
19878 static void
19879 ill_set_phys_addr_tail(ipsq_t *ipsq, queue_t *q, mblk_t *addrmp, void *dummy)
19880 {
19881 	ill_t		*ill = q->q_ptr;
19882 	mblk_t		*addrmp2 = unlinkb(addrmp);
19883 	dl_notify_ind_t	*dlindp = (dl_notify_ind_t *)addrmp->b_rptr;
19884 	uint_t		addrlen, addroff;
19885 
19886 	ASSERT(IAM_WRITER_IPSQ(ipsq));
19887 
19888 	addroff	= dlindp->dl_addr_offset;
19889 	addrlen = dlindp->dl_addr_length - ABS(ill->ill_sap_length);
19890 
19891 	switch (dlindp->dl_data) {
19892 	case DL_IPV6_LINK_LAYER_ADDR:
19893 		ill_set_ndmp(ill, addrmp, addroff, addrlen);
19894 		freemsg(addrmp2);
19895 		break;
19896 
19897 	case DL_CURR_PHYS_ADDR:
19898 		freemsg(ill->ill_phys_addr_mp);
19899 		ill->ill_phys_addr = addrmp->b_rptr + addroff;
19900 		ill->ill_phys_addr_mp = addrmp;
19901 		ill->ill_phys_addr_length = addrlen;
19902 
19903 		if (ill->ill_isv6 && !(ill->ill_flags & ILLF_XRESOLV))
19904 			ill_set_ndmp(ill, addrmp2, addroff, addrlen);
19905 		else
19906 			freemsg(addrmp2);
19907 		break;
19908 	default:
19909 		ASSERT(0);
19910 	}
19911 
19912 	/*
19913 	 * If there are ipifs to bring up, ill_up_ipifs() will return
19914 	 * EINPROGRESS, and ipsq_current_finish() will be called by
19915 	 * ip_rput_dlpi_writer() or ip_arp_done() when the last ipif is
19916 	 * brought up.
19917 	 */
19918 	if (ill_up_ipifs(ill, q, addrmp) != EINPROGRESS)
19919 		ipsq_current_finish(ipsq);
19920 }
19921 
19922 /*
19923  * Helper routine for setting the ill_nd_lla fields.
19924  */
19925 void
19926 ill_set_ndmp(ill_t *ill, mblk_t *ndmp, uint_t addroff, uint_t addrlen)
19927 {
19928 	freemsg(ill->ill_nd_lla_mp);
19929 	ill->ill_nd_lla = ndmp->b_rptr + addroff;
19930 	ill->ill_nd_lla_mp = ndmp;
19931 	ill->ill_nd_lla_len = addrlen;
19932 }
19933 
19934 /*
19935  * Replumb the ill.
19936  */
19937 int
19938 ill_replumb(ill_t *ill, mblk_t *mp)
19939 {
19940 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
19941 
19942 	ASSERT(IAM_WRITER_IPSQ(ipsq));
19943 
19944 	ipsq_current_start(ipsq, ill->ill_ipif, 0);
19945 
19946 	/*
19947 	 * If we can quiesce the ill, then continue.  If not, then
19948 	 * ill_replumb_tail() will be called from ipif_ill_refrele_tail().
19949 	 */
19950 	ill_down_ipifs(ill, B_FALSE);
19951 
19952 	mutex_enter(&ill->ill_lock);
19953 	if (!ill_is_quiescent(ill)) {
19954 		/* call cannot fail since `conn_t *' argument is NULL */
19955 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
19956 		    mp, ILL_DOWN);
19957 		mutex_exit(&ill->ill_lock);
19958 		return (EINPROGRESS);
19959 	}
19960 	mutex_exit(&ill->ill_lock);
19961 
19962 	ill_replumb_tail(ipsq, ill->ill_rq, mp, NULL);
19963 	return (0);
19964 }
19965 
19966 /* ARGSUSED */
19967 static void
19968 ill_replumb_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy)
19969 {
19970 	ill_t *ill = q->q_ptr;
19971 
19972 	ASSERT(IAM_WRITER_IPSQ(ipsq));
19973 
19974 	ill_down_ipifs_tail(ill);
19975 
19976 	freemsg(ill->ill_replumb_mp);
19977 	ill->ill_replumb_mp = copyb(mp);
19978 
19979 	/*
19980 	 * Successfully quiesced and brought down the interface, now we send
19981 	 * the DL_NOTE_REPLUMB_DONE message down to the driver. Reuse the
19982 	 * DL_NOTE_REPLUMB message.
19983 	 */
19984 	mp = mexchange(NULL, mp, sizeof (dl_notify_conf_t), M_PROTO,
19985 	    DL_NOTIFY_CONF);
19986 	ASSERT(mp != NULL);
19987 	((dl_notify_conf_t *)mp->b_rptr)->dl_notification =
19988 	    DL_NOTE_REPLUMB_DONE;
19989 	ill_dlpi_send(ill, mp);
19990 
19991 	/*
19992 	 * If there are ipifs to bring up, ill_up_ipifs() will return
19993 	 * EINPROGRESS, and ipsq_current_finish() will be called by
19994 	 * ip_rput_dlpi_writer() or ip_arp_done() when the last ipif is
19995 	 * brought up.
19996 	 */
19997 	if (ill->ill_replumb_mp == NULL ||
19998 	    ill_up_ipifs(ill, q, ill->ill_replumb_mp) != EINPROGRESS) {
19999 		ipsq_current_finish(ipsq);
20000 	}
20001 }
20002 
20003 major_t IP_MAJ;
20004 #define	IP	"ip"
20005 
20006 #define	UDP6DEV		"/devices/pseudo/udp6@0:udp6"
20007 #define	UDPDEV		"/devices/pseudo/udp@0:udp"
20008 
20009 /*
20010  * Issue REMOVEIF ioctls to have the loopback interfaces
20011  * go away.  Other interfaces are either I_LINKed or I_PLINKed;
20012  * the former going away when the user-level processes in the zone
20013  * are killed  * and the latter are cleaned up by the stream head
20014  * str_stack_shutdown callback that undoes all I_PLINKs.
20015  */
20016 void
20017 ip_loopback_cleanup(ip_stack_t *ipst)
20018 {
20019 	int error;
20020 	ldi_handle_t	lh = NULL;
20021 	ldi_ident_t	li = NULL;
20022 	int		rval;
20023 	cred_t		*cr;
20024 	struct strioctl iocb;
20025 	struct lifreq	lifreq;
20026 
20027 	IP_MAJ = ddi_name_to_major(IP);
20028 
20029 #ifdef NS_DEBUG
20030 	(void) printf("ip_loopback_cleanup() stackid %d\n",
20031 	    ipst->ips_netstack->netstack_stackid);
20032 #endif
20033 
20034 	bzero(&lifreq, sizeof (lifreq));
20035 	(void) strcpy(lifreq.lifr_name, ipif_loopback_name);
20036 
20037 	error = ldi_ident_from_major(IP_MAJ, &li);
20038 	if (error) {
20039 #ifdef DEBUG
20040 		printf("ip_loopback_cleanup: lyr ident get failed error %d\n",
20041 		    error);
20042 #endif
20043 		return;
20044 	}
20045 
20046 	cr = zone_get_kcred(netstackid_to_zoneid(
20047 	    ipst->ips_netstack->netstack_stackid));
20048 	ASSERT(cr != NULL);
20049 	error = ldi_open_by_name(UDP6DEV, FREAD|FWRITE, cr, &lh, li);
20050 	if (error) {
20051 #ifdef DEBUG
20052 		printf("ip_loopback_cleanup: open of UDP6DEV failed error %d\n",
20053 		    error);
20054 #endif
20055 		goto out;
20056 	}
20057 	iocb.ic_cmd = SIOCLIFREMOVEIF;
20058 	iocb.ic_timout = 15;
20059 	iocb.ic_len = sizeof (lifreq);
20060 	iocb.ic_dp = (char *)&lifreq;
20061 
20062 	error = ldi_ioctl(lh, I_STR, (intptr_t)&iocb, FKIOCTL, cr, &rval);
20063 	/* LINTED - statement has no consequent */
20064 	if (error) {
20065 #ifdef NS_DEBUG
20066 		printf("ip_loopback_cleanup: ioctl SIOCLIFREMOVEIF failed on "
20067 		    "UDP6 error %d\n", error);
20068 #endif
20069 	}
20070 	(void) ldi_close(lh, FREAD|FWRITE, cr);
20071 	lh = NULL;
20072 
20073 	error = ldi_open_by_name(UDPDEV, FREAD|FWRITE, cr, &lh, li);
20074 	if (error) {
20075 #ifdef NS_DEBUG
20076 		printf("ip_loopback_cleanup: open of UDPDEV failed error %d\n",
20077 		    error);
20078 #endif
20079 		goto out;
20080 	}
20081 
20082 	iocb.ic_cmd = SIOCLIFREMOVEIF;
20083 	iocb.ic_timout = 15;
20084 	iocb.ic_len = sizeof (lifreq);
20085 	iocb.ic_dp = (char *)&lifreq;
20086 
20087 	error = ldi_ioctl(lh, I_STR, (intptr_t)&iocb, FKIOCTL, cr, &rval);
20088 	/* LINTED - statement has no consequent */
20089 	if (error) {
20090 #ifdef NS_DEBUG
20091 		printf("ip_loopback_cleanup: ioctl SIOCLIFREMOVEIF failed on "
20092 		    "UDP error %d\n", error);
20093 #endif
20094 	}
20095 	(void) ldi_close(lh, FREAD|FWRITE, cr);
20096 	lh = NULL;
20097 
20098 out:
20099 	/* Close layered handles */
20100 	if (lh)
20101 		(void) ldi_close(lh, FREAD|FWRITE, cr);
20102 	if (li)
20103 		ldi_ident_release(li);
20104 
20105 	crfree(cr);
20106 }
20107 
20108 /*
20109  * This needs to be in-sync with nic_event_t definition
20110  */
20111 static const char *
20112 ill_hook_event2str(nic_event_t event)
20113 {
20114 	switch (event) {
20115 	case NE_PLUMB:
20116 		return ("PLUMB");
20117 	case NE_UNPLUMB:
20118 		return ("UNPLUMB");
20119 	case NE_UP:
20120 		return ("UP");
20121 	case NE_DOWN:
20122 		return ("DOWN");
20123 	case NE_ADDRESS_CHANGE:
20124 		return ("ADDRESS_CHANGE");
20125 	case NE_LIF_UP:
20126 		return ("LIF_UP");
20127 	case NE_LIF_DOWN:
20128 		return ("LIF_DOWN");
20129 	default:
20130 		return ("UNKNOWN");
20131 	}
20132 }
20133 
20134 void
20135 ill_nic_event_dispatch(ill_t *ill, lif_if_t lif, nic_event_t event,
20136     nic_event_data_t data, size_t datalen)
20137 {
20138 	ip_stack_t		*ipst = ill->ill_ipst;
20139 	hook_nic_event_int_t	*info;
20140 	const char		*str = NULL;
20141 
20142 	/* create a new nic event info */
20143 	if ((info = kmem_alloc(sizeof (*info), KM_NOSLEEP)) == NULL)
20144 		goto fail;
20145 
20146 	info->hnei_event.hne_nic = ill->ill_phyint->phyint_ifindex;
20147 	info->hnei_event.hne_lif = lif;
20148 	info->hnei_event.hne_event = event;
20149 	info->hnei_event.hne_protocol = ill->ill_isv6 ?
20150 	    ipst->ips_ipv6_net_data : ipst->ips_ipv4_net_data;
20151 	info->hnei_event.hne_data = NULL;
20152 	info->hnei_event.hne_datalen = 0;
20153 	info->hnei_stackid = ipst->ips_netstack->netstack_stackid;
20154 
20155 	if (data != NULL && datalen != 0) {
20156 		info->hnei_event.hne_data = kmem_alloc(datalen, KM_NOSLEEP);
20157 		if (info->hnei_event.hne_data == NULL)
20158 			goto fail;
20159 		bcopy(data, info->hnei_event.hne_data, datalen);
20160 		info->hnei_event.hne_datalen = datalen;
20161 	}
20162 
20163 	if (ddi_taskq_dispatch(eventq_queue_nic, ip_ne_queue_func, info,
20164 	    DDI_NOSLEEP) == DDI_SUCCESS)
20165 		return;
20166 
20167 fail:
20168 	if (info != NULL) {
20169 		if (info->hnei_event.hne_data != NULL) {
20170 			kmem_free(info->hnei_event.hne_data,
20171 			    info->hnei_event.hne_datalen);
20172 		}
20173 		kmem_free(info, sizeof (hook_nic_event_t));
20174 	}
20175 	str = ill_hook_event2str(event);
20176 	ip2dbg(("ill_nic_event_dispatch: could not dispatch %s nic event "
20177 	    "information for %s (ENOMEM)\n", str, ill->ill_name));
20178 }
20179 
20180 void
20181 ipif_up_notify(ipif_t *ipif)
20182 {
20183 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
20184 	ip_rts_newaddrmsg(RTM_ADD, 0, ipif, RTSQ_DEFAULT);
20185 	sctp_update_ipif(ipif, SCTP_IPIF_UP);
20186 	ill_nic_event_dispatch(ipif->ipif_ill, MAP_IPIF_ID(ipif->ipif_id),
20187 	    NE_LIF_UP, NULL, 0);
20188 }
20189