xref: /illumos-gate/usr/src/uts/common/inet/ip/ip_multi.c (revision 10e6dadfe63181edabc58c8f42e3c56a1cd9ec95)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /* Copyright (c) 1990 Mentat Inc. */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include <sys/types.h>
30 #include <sys/stream.h>
31 #include <sys/dlpi.h>
32 #include <sys/stropts.h>
33 #include <sys/strsun.h>
34 #include <sys/ddi.h>
35 #include <sys/cmn_err.h>
36 #include <sys/sdt.h>
37 #include <sys/zone.h>
38 
39 #include <sys/param.h>
40 #include <sys/socket.h>
41 #include <sys/sockio.h>
42 #include <net/if.h>
43 #include <sys/systm.h>
44 #include <sys/strsubr.h>
45 #include <net/route.h>
46 #include <netinet/in.h>
47 #include <net/if_dl.h>
48 #include <netinet/ip6.h>
49 #include <netinet/icmp6.h>
50 
51 #include <inet/common.h>
52 #include <inet/mi.h>
53 #include <inet/nd.h>
54 #include <inet/arp.h>
55 #include <inet/ip.h>
56 #include <inet/ip6.h>
57 #include <inet/ip_if.h>
58 #include <inet/ip_ndp.h>
59 #include <inet/ip_multi.h>
60 #include <inet/ipclassifier.h>
61 #include <inet/ipsec_impl.h>
62 #include <inet/sctp_ip.h>
63 #include <inet/ip_listutils.h>
64 #include <inet/udp_impl.h>
65 
66 /* igmpv3/mldv2 source filter manipulation */
67 static void	ilm_bld_flists(conn_t *conn, void *arg);
68 static void	ilm_gen_filter(ilm_t *ilm, mcast_record_t *fmode,
69     slist_t *flist);
70 
71 static ilm_t	*ilm_add_v6(ipif_t *ipif, const in6_addr_t *group,
72     ilg_stat_t ilgstat, mcast_record_t ilg_fmode, slist_t *ilg_flist,
73     int orig_ifindex, zoneid_t zoneid);
74 static void	ilm_delete(ilm_t *ilm);
75 static int	ip_ll_addmulti_v6(ipif_t *ipif, const in6_addr_t *group);
76 static int	ip_ll_delmulti_v6(ipif_t *ipif, const in6_addr_t *group);
77 static ilg_t	*ilg_lookup_ill_index_v6(conn_t *connp,
78     const in6_addr_t *v6group, int index);
79 static ilg_t	*ilg_lookup_ipif(conn_t *connp, ipaddr_t group,
80     ipif_t *ipif);
81 static int	ilg_add(conn_t *connp, ipaddr_t group, ipif_t *ipif,
82     mcast_record_t fmode, ipaddr_t src);
83 static int	ilg_add_v6(conn_t *connp, const in6_addr_t *group, ill_t *ill,
84     mcast_record_t fmode, const in6_addr_t *v6src);
85 static void	ilg_delete(conn_t *connp, ilg_t *ilg, const in6_addr_t *src);
86 static mblk_t	*ill_create_dl(ill_t *ill, uint32_t dl_primitive,
87     uint32_t length, uint32_t *addr_lenp, uint32_t *addr_offp);
88 static mblk_t	*ill_create_squery(ill_t *ill, ipaddr_t ipaddr,
89     uint32_t addrlen, uint32_t addroff, mblk_t *mp_tail);
90 static void	conn_ilg_reap(conn_t *connp);
91 static int	ip_opt_delete_group_excl(conn_t *connp, ipaddr_t group,
92     ipif_t *ipif, mcast_record_t fmode, ipaddr_t src);
93 static int	ip_opt_delete_group_excl_v6(conn_t *connp,
94     const in6_addr_t *v6group, ill_t *ill, mcast_record_t fmode,
95     const in6_addr_t *v6src);
96 
97 /*
98  * MT notes:
99  *
100  * Multicast joins operate on both the ilg and ilm structures. Multiple
101  * threads operating on an conn (socket) trying to do multicast joins
102  * need to synchronize  when operating on the ilg. Multiple threads
103  * potentially operating on different conn (socket endpoints) trying to
104  * do multicast joins could eventually end up trying to manipulate the
105  * ilm simulatenously and need to synchronize on the access to the ilm.
106  * Both are amenable to standard Solaris MT techniques, but it would be
107  * complex to handle a failover or failback which needs to manipulate
108  * ilg/ilms if an applications can also simultaenously join/leave
109  * multicast groups. Hence multicast join/leave also go through the ipsq_t
110  * serialization.
111  *
112  * Multicast joins and leaves are single-threaded per phyint/IPMP group
113  * using the ipsq serialization mechanism.
114  *
115  * An ilm is an IP data structure used to track multicast join/leave.
116  * An ilm is associated with a <multicast group, ipif> tuple in IPv4 and
117  * with just <multicast group> in IPv6. ilm_refcnt is the number of ilg's
118  * referencing the ilm. ilms are created / destroyed only as writer. ilms
119  * are not passed around, instead they are looked up and used under the
120  * ill_lock or as writer. So we don't need a dynamic refcount of the number
121  * of threads holding reference to an ilm.
122  *
123  * Multicast Join operation:
124  *
125  * The first step is to determine the ipif (v4) or ill (v6) on which
126  * the join operation is to be done. The join is done after becoming
127  * exclusive on the ipsq associated with the ipif or ill. The conn->conn_ilg
128  * and ill->ill_ilm are thus accessed and modified exclusively per ill.
129  * Multiple threads can attempt to join simultaneously on different ipif/ill
130  * on the same conn. In this case the ipsq serialization does not help in
131  * protecting the ilg. It is the conn_lock that is used to protect the ilg.
132  * The conn_lock also protects all the ilg_t members.
133  *
134  * Leave operation.
135  *
136  * Similar to the join operation, the first step is to determine the ipif
137  * or ill (v6) on which the leave operation is to be done. The leave operation
138  * is done after becoming exclusive on the ipsq associated with the ipif or ill.
139  * As with join ilg modification is done under the protection of the conn lock.
140  */
141 
142 #define	IPSQ_ENTER_IPIF(ipif, connp, first_mp, func, ipsq, type)	\
143 	ASSERT(connp != NULL);					\
144 	(ipsq) = ipsq_try_enter((ipif), NULL, CONNP_TO_WQ(connp),	\
145 	    (first_mp), (func), (type), B_TRUE);		\
146 	if ((ipsq) == NULL) {					\
147 		ipif_refrele(ipif);				\
148 		return (EINPROGRESS);				\
149 	}
150 
151 #define	IPSQ_ENTER_ILL(ill, connp, first_mp, func, ipsq, type)	\
152 	ASSERT(connp != NULL);					\
153 	(ipsq) = ipsq_try_enter(NULL, ill, CONNP_TO_WQ(connp),	\
154 	    (first_mp),	(func), (type), B_TRUE);		\
155 	if ((ipsq) == NULL) {					\
156 		ill_refrele(ill);				\
157 		return (EINPROGRESS);				\
158 	}
159 
160 #define	IPSQ_EXIT(ipsq)	\
161 	if (ipsq != NULL)	\
162 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
163 
164 #define	ILG_WALKER_HOLD(connp)	(connp)->conn_ilg_walker_cnt++
165 
166 #define	ILG_WALKER_RELE(connp)				\
167 	{						\
168 		(connp)->conn_ilg_walker_cnt--;		\
169 		if ((connp)->conn_ilg_walker_cnt == 0)	\
170 			conn_ilg_reap(connp);		\
171 	}
172 
173 static void
174 conn_ilg_reap(conn_t *connp)
175 {
176 	int	to;
177 	int	from;
178 	ilg_t	*ilg;
179 
180 	ASSERT(MUTEX_HELD(&connp->conn_lock));
181 
182 	to = 0;
183 	from = 0;
184 	while (from < connp->conn_ilg_inuse) {
185 		if (connp->conn_ilg[from].ilg_flags & ILG_DELETED) {
186 			ilg = &connp->conn_ilg[from];
187 			FREE_SLIST(ilg->ilg_filter);
188 			ilg->ilg_flags &= ~ILG_DELETED;
189 			from++;
190 			continue;
191 		}
192 		if (to != from)
193 			connp->conn_ilg[to] = connp->conn_ilg[from];
194 		to++;
195 		from++;
196 	}
197 
198 	connp->conn_ilg_inuse = to;
199 
200 	if (connp->conn_ilg_inuse == 0) {
201 		mi_free((char *)connp->conn_ilg);
202 		connp->conn_ilg = NULL;
203 		cv_broadcast(&connp->conn_refcv);
204 	}
205 }
206 
207 #define	GETSTRUCT(structure, number)	\
208 	((structure *)mi_zalloc(sizeof (structure) * (number)))
209 
210 #define	ILG_ALLOC_CHUNK	16
211 
212 /*
213  * Returns a pointer to the next available ilg in conn_ilg.  Allocs more
214  * buffers in size of ILG_ALLOC_CHUNK ilgs when needed, and updates conn's
215  * ilg tracking fields appropriately (conn_ilg_inuse reflects usage of the
216  * returned ilg).  Returns NULL on failure (ENOMEM).
217  *
218  * Assumes connp->conn_lock is held.
219  */
220 static ilg_t *
221 conn_ilg_alloc(conn_t *connp)
222 {
223 	ilg_t *new, *ret;
224 	int curcnt;
225 
226 	ASSERT(MUTEX_HELD(&connp->conn_lock));
227 	ASSERT(connp->conn_ilg_inuse <= connp->conn_ilg_allocated);
228 
229 	if (connp->conn_ilg == NULL) {
230 		connp->conn_ilg = GETSTRUCT(ilg_t, ILG_ALLOC_CHUNK);
231 		if (connp->conn_ilg == NULL)
232 			return (NULL);
233 		connp->conn_ilg_allocated = ILG_ALLOC_CHUNK;
234 		connp->conn_ilg_inuse = 0;
235 	}
236 	if (connp->conn_ilg_inuse == connp->conn_ilg_allocated) {
237 		if (connp->conn_ilg_walker_cnt != 0) {
238 			/*
239 			 * XXX We cannot grow the array at this point
240 			 * because a list walker could be in progress, and
241 			 * we cannot wipe out the existing array until the
242 			 * walker is done. Just return NULL for now.
243 			 * ilg_delete_all() will have to be changed when
244 			 * this logic is changed.
245 			 */
246 			return (NULL);
247 		}
248 		curcnt = connp->conn_ilg_allocated;
249 		new = GETSTRUCT(ilg_t, curcnt + ILG_ALLOC_CHUNK);
250 		if (new == NULL)
251 			return (NULL);
252 		bcopy(connp->conn_ilg, new, sizeof (ilg_t) * curcnt);
253 		mi_free((char *)connp->conn_ilg);
254 		connp->conn_ilg = new;
255 		connp->conn_ilg_allocated += ILG_ALLOC_CHUNK;
256 	}
257 
258 	ret = &connp->conn_ilg[connp->conn_ilg_inuse++];
259 	ASSERT((ret->ilg_flags & ILG_DELETED) == 0);
260 	bzero(ret, sizeof (*ret));
261 	return (ret);
262 }
263 
264 typedef struct ilm_fbld_s {
265 	ilm_t		*fbld_ilm;
266 	int		fbld_in_cnt;
267 	int		fbld_ex_cnt;
268 	slist_t		fbld_in;
269 	slist_t		fbld_ex;
270 	boolean_t	fbld_in_overflow;
271 } ilm_fbld_t;
272 
273 static void
274 ilm_bld_flists(conn_t *conn, void *arg)
275 {
276 	int i;
277 	ilm_fbld_t *fbld = (ilm_fbld_t *)(arg);
278 	ilm_t *ilm = fbld->fbld_ilm;
279 	in6_addr_t *v6group = &ilm->ilm_v6addr;
280 
281 	if (conn->conn_ilg_inuse == 0)
282 		return;
283 
284 	/*
285 	 * Since we can't break out of the ipcl_walk once started, we still
286 	 * have to look at every conn.  But if we've already found one
287 	 * (EXCLUDE, NULL) list, there's no need to keep checking individual
288 	 * ilgs--that will be our state.
289 	 */
290 	if (fbld->fbld_ex_cnt > 0 && fbld->fbld_ex.sl_numsrc == 0)
291 		return;
292 
293 	/*
294 	 * Check this conn's ilgs to see if any are interested in our
295 	 * ilm (group, interface match).  If so, update the master
296 	 * include and exclude lists we're building in the fbld struct
297 	 * with this ilg's filter info.
298 	 */
299 	mutex_enter(&conn->conn_lock);
300 	for (i = 0; i < conn->conn_ilg_inuse; i++) {
301 		ilg_t *ilg = &conn->conn_ilg[i];
302 		if ((ilg->ilg_ill == ilm->ilm_ill) &&
303 		    (ilg->ilg_ipif == ilm->ilm_ipif) &&
304 		    IN6_ARE_ADDR_EQUAL(&ilg->ilg_v6group, v6group)) {
305 			if (ilg->ilg_fmode == MODE_IS_INCLUDE) {
306 				fbld->fbld_in_cnt++;
307 				if (!fbld->fbld_in_overflow)
308 					l_union_in_a(&fbld->fbld_in,
309 					    ilg->ilg_filter,
310 					    &fbld->fbld_in_overflow);
311 			} else {
312 				fbld->fbld_ex_cnt++;
313 				/*
314 				 * On the first exclude list, don't try to do
315 				 * an intersection, as the master exclude list
316 				 * is intentionally empty.  If the master list
317 				 * is still empty on later iterations, that
318 				 * means we have at least one ilg with an empty
319 				 * exclude list, so that should be reflected
320 				 * when we take the intersection.
321 				 */
322 				if (fbld->fbld_ex_cnt == 1) {
323 					if (ilg->ilg_filter != NULL)
324 						l_copy(ilg->ilg_filter,
325 						    &fbld->fbld_ex);
326 				} else {
327 					l_intersection_in_a(&fbld->fbld_ex,
328 					    ilg->ilg_filter);
329 				}
330 			}
331 			/* there will only be one match, so break now. */
332 			break;
333 		}
334 	}
335 	mutex_exit(&conn->conn_lock);
336 }
337 
338 static void
339 ilm_gen_filter(ilm_t *ilm, mcast_record_t *fmode, slist_t *flist)
340 {
341 	ilm_fbld_t fbld;
342 	ip_stack_t *ipst = ilm->ilm_ipst;
343 
344 	fbld.fbld_ilm = ilm;
345 	fbld.fbld_in_cnt = fbld.fbld_ex_cnt = 0;
346 	fbld.fbld_in.sl_numsrc = fbld.fbld_ex.sl_numsrc = 0;
347 	fbld.fbld_in_overflow = B_FALSE;
348 
349 	/* first, construct our master include and exclude lists */
350 	ipcl_walk(ilm_bld_flists, (caddr_t)&fbld, ipst);
351 
352 	/* now use those master lists to generate the interface filter */
353 
354 	/* if include list overflowed, filter is (EXCLUDE, NULL) */
355 	if (fbld.fbld_in_overflow) {
356 		*fmode = MODE_IS_EXCLUDE;
357 		flist->sl_numsrc = 0;
358 		return;
359 	}
360 
361 	/* if nobody interested, interface filter is (INCLUDE, NULL) */
362 	if (fbld.fbld_in_cnt == 0 && fbld.fbld_ex_cnt == 0) {
363 		*fmode = MODE_IS_INCLUDE;
364 		flist->sl_numsrc = 0;
365 		return;
366 	}
367 
368 	/*
369 	 * If there are no exclude lists, then the interface filter
370 	 * is INCLUDE, with its filter list equal to fbld_in.  A single
371 	 * exclude list makes the interface filter EXCLUDE, with its
372 	 * filter list equal to (fbld_ex - fbld_in).
373 	 */
374 	if (fbld.fbld_ex_cnt == 0) {
375 		*fmode = MODE_IS_INCLUDE;
376 		l_copy(&fbld.fbld_in, flist);
377 	} else {
378 		*fmode = MODE_IS_EXCLUDE;
379 		l_difference(&fbld.fbld_ex, &fbld.fbld_in, flist);
380 	}
381 }
382 
383 /*
384  * If the given interface has failed, choose a new one to join on so
385  * that we continue to receive packets.  ilg_orig_ifindex remembers
386  * what the application used to join on so that we know the ilg to
387  * delete even though we change the ill here.  Callers will store the
388  * ilg returned from this function in ilg_ill.  Thus when we receive
389  * a packet on ilg_ill, conn_wantpacket_v6 will deliver the packets.
390  *
391  * This function must be called as writer so we can walk the group
392  * list and examine flags without holding a lock.
393  */
394 ill_t *
395 ip_choose_multi_ill(ill_t *ill, const in6_addr_t *grp)
396 {
397 	ill_t	*till;
398 	ill_group_t *illgrp = ill->ill_group;
399 
400 	ASSERT(IAM_WRITER_ILL(ill));
401 
402 	if (IN6_IS_ADDR_UNSPECIFIED(grp) || illgrp == NULL)
403 		return (ill);
404 
405 	if ((ill->ill_phyint->phyint_flags & (PHYI_FAILED|PHYI_INACTIVE)) == 0)
406 		return (ill);
407 
408 	till = illgrp->illgrp_ill;
409 	while (till != NULL &&
410 	    (till->ill_phyint->phyint_flags & (PHYI_FAILED|PHYI_INACTIVE))) {
411 		till = till->ill_group_next;
412 	}
413 	if (till != NULL)
414 		return (till);
415 
416 	return (ill);
417 }
418 
419 static int
420 ilm_update_add(ilm_t *ilm, ilg_stat_t ilgstat, slist_t *ilg_flist,
421     boolean_t isv6)
422 {
423 	mcast_record_t fmode;
424 	slist_t *flist;
425 	boolean_t fdefault;
426 	char buf[INET6_ADDRSTRLEN];
427 	ill_t *ill = isv6 ? ilm->ilm_ill : ilm->ilm_ipif->ipif_ill;
428 
429 	/*
430 	 * There are several cases where the ilm's filter state
431 	 * defaults to (EXCLUDE, NULL):
432 	 *	- we've had previous joins without associated ilgs
433 	 *	- this join has no associated ilg
434 	 *	- the ilg's filter state is (EXCLUDE, NULL)
435 	 */
436 	fdefault = (ilm->ilm_no_ilg_cnt > 0) ||
437 	    (ilgstat == ILGSTAT_NONE) || SLIST_IS_EMPTY(ilg_flist);
438 
439 	/* attempt mallocs (if needed) before doing anything else */
440 	if ((flist = l_alloc()) == NULL)
441 		return (ENOMEM);
442 	if (!fdefault && ilm->ilm_filter == NULL) {
443 		ilm->ilm_filter = l_alloc();
444 		if (ilm->ilm_filter == NULL) {
445 			l_free(flist);
446 			return (ENOMEM);
447 		}
448 	}
449 
450 	if (ilgstat != ILGSTAT_CHANGE)
451 		ilm->ilm_refcnt++;
452 
453 	if (ilgstat == ILGSTAT_NONE)
454 		ilm->ilm_no_ilg_cnt++;
455 
456 	/*
457 	 * Determine new filter state.  If it's not the default
458 	 * (EXCLUDE, NULL), we must walk the conn list to find
459 	 * any ilgs interested in this group, and re-build the
460 	 * ilm filter.
461 	 */
462 	if (fdefault) {
463 		fmode = MODE_IS_EXCLUDE;
464 		flist->sl_numsrc = 0;
465 	} else {
466 		ilm_gen_filter(ilm, &fmode, flist);
467 	}
468 
469 	/* make sure state actually changed; nothing to do if not. */
470 	if ((ilm->ilm_fmode == fmode) &&
471 	    !lists_are_different(ilm->ilm_filter, flist)) {
472 		l_free(flist);
473 		return (0);
474 	}
475 
476 	/* send the state change report */
477 	if (!IS_LOOPBACK(ill)) {
478 		if (isv6)
479 			mld_statechange(ilm, fmode, flist);
480 		else
481 			igmp_statechange(ilm, fmode, flist);
482 	}
483 
484 	/* update the ilm state */
485 	ilm->ilm_fmode = fmode;
486 	if (flist->sl_numsrc > 0)
487 		l_copy(flist, ilm->ilm_filter);
488 	else
489 		CLEAR_SLIST(ilm->ilm_filter);
490 
491 	ip1dbg(("ilm_update: new if filter mode %d, group %s\n", ilm->ilm_fmode,
492 	    inet_ntop(AF_INET6, &ilm->ilm_v6addr, buf, sizeof (buf))));
493 
494 	l_free(flist);
495 	return (0);
496 }
497 
498 static int
499 ilm_update_del(ilm_t *ilm, boolean_t isv6)
500 {
501 	mcast_record_t fmode;
502 	slist_t *flist;
503 	ill_t *ill = isv6 ? ilm->ilm_ill : ilm->ilm_ipif->ipif_ill;
504 
505 	ip1dbg(("ilm_update_del: still %d left; updating state\n",
506 	    ilm->ilm_refcnt));
507 
508 	if ((flist = l_alloc()) == NULL)
509 		return (ENOMEM);
510 
511 	/*
512 	 * If present, the ilg in question has already either been
513 	 * updated or removed from our list; so all we need to do
514 	 * now is walk the list to update the ilm filter state.
515 	 *
516 	 * Skip the list walk if we have any no-ilg joins, which
517 	 * cause the filter state to revert to (EXCLUDE, NULL).
518 	 */
519 	if (ilm->ilm_no_ilg_cnt != 0) {
520 		fmode = MODE_IS_EXCLUDE;
521 		flist->sl_numsrc = 0;
522 	} else {
523 		ilm_gen_filter(ilm, &fmode, flist);
524 	}
525 
526 	/* check to see if state needs to be updated */
527 	if ((ilm->ilm_fmode == fmode) &&
528 	    (!lists_are_different(ilm->ilm_filter, flist))) {
529 		l_free(flist);
530 		return (0);
531 	}
532 
533 	if (!IS_LOOPBACK(ill)) {
534 		if (isv6)
535 			mld_statechange(ilm, fmode, flist);
536 		else
537 			igmp_statechange(ilm, fmode, flist);
538 	}
539 
540 	ilm->ilm_fmode = fmode;
541 	if (flist->sl_numsrc > 0) {
542 		if (ilm->ilm_filter == NULL) {
543 			ilm->ilm_filter = l_alloc();
544 			if (ilm->ilm_filter == NULL) {
545 				char buf[INET6_ADDRSTRLEN];
546 				ip1dbg(("ilm_update_del: failed to alloc ilm "
547 				    "filter; no source filtering for %s on %s",
548 				    inet_ntop(AF_INET6, &ilm->ilm_v6addr,
549 				    buf, sizeof (buf)), ill->ill_name));
550 				ilm->ilm_fmode = MODE_IS_EXCLUDE;
551 				l_free(flist);
552 				return (0);
553 			}
554 		}
555 		l_copy(flist, ilm->ilm_filter);
556 	} else {
557 		CLEAR_SLIST(ilm->ilm_filter);
558 	}
559 
560 	l_free(flist);
561 	return (0);
562 }
563 
564 /*
565  * INADDR_ANY means all multicast addresses. This is only used
566  * by the multicast router.
567  * INADDR_ANY is stored as IPv6 unspecified addr.
568  */
569 int
570 ip_addmulti(ipaddr_t group, ipif_t *ipif, ilg_stat_t ilgstat,
571     mcast_record_t ilg_fmode, slist_t *ilg_flist)
572 {
573 	ill_t	*ill = ipif->ipif_ill;
574 	ilm_t 	*ilm;
575 	in6_addr_t v6group;
576 	int	ret;
577 
578 	ASSERT(IAM_WRITER_IPIF(ipif));
579 
580 	if (!CLASSD(group) && group != INADDR_ANY)
581 		return (EINVAL);
582 
583 	/*
584 	 * INADDR_ANY is represented as the IPv6 unspecifed addr.
585 	 */
586 	if (group == INADDR_ANY)
587 		v6group = ipv6_all_zeros;
588 	else
589 		IN6_IPADDR_TO_V4MAPPED(group, &v6group);
590 
591 	mutex_enter(&ill->ill_lock);
592 	ilm = ilm_lookup_ipif(ipif, group);
593 	mutex_exit(&ill->ill_lock);
594 	/*
595 	 * Since we are writer, we know the ilm_flags itself cannot
596 	 * change at this point, and ilm_lookup_ipif would not have
597 	 * returned a DELETED ilm. However, the data path can free
598 	 * ilm->next via ilm_walker_cleanup() so we can safely
599 	 * access anything in ilm except ilm_next (for safe access to
600 	 * ilm_next we'd have  to take the ill_lock).
601 	 */
602 	if (ilm != NULL)
603 		return (ilm_update_add(ilm, ilgstat, ilg_flist, B_FALSE));
604 
605 	/*
606 	 * ilms are associated with ipifs in IPv4. It moves with the
607 	 * ipif if the ipif moves to a new ill when the interface
608 	 * fails. Thus we really don't check whether the ipif_ill
609 	 * has failed like in IPv6. If it has FAILED the ipif
610 	 * will move (daemon will move it) and hence the ilm, if the
611 	 * ipif is not IPIF_NOFAILOVER. For the IPIF_NOFAILOVER ipifs,
612 	 * we continue to receive in the same place even if the
613 	 * interface fails.
614 	 */
615 	ilm = ilm_add_v6(ipif, &v6group, ilgstat, ilg_fmode, ilg_flist,
616 	    ill->ill_phyint->phyint_ifindex, ipif->ipif_zoneid);
617 	if (ilm == NULL)
618 		return (ENOMEM);
619 
620 	if (group == INADDR_ANY) {
621 		/*
622 		 * Check how many ipif's have members in this group -
623 		 * if more then one we should not tell the driver to join
624 		 * this time
625 		 */
626 		if (ilm_numentries_v6(ill, &v6group) > 1)
627 			return (0);
628 		if (ill->ill_group == NULL)
629 			ret = ip_join_allmulti(ipif);
630 		else
631 			ret = ill_nominate_mcast_rcv(ill->ill_group);
632 		if (ret != 0)
633 			ilm_delete(ilm);
634 		return (ret);
635 	}
636 
637 	if (!IS_LOOPBACK(ill))
638 		igmp_joingroup(ilm);
639 
640 	if (ilm_numentries_v6(ill, &v6group) > 1)
641 		return (0);
642 
643 	ret = ip_ll_addmulti_v6(ipif, &v6group);
644 	if (ret != 0)
645 		ilm_delete(ilm);
646 	return (ret);
647 }
648 
649 /*
650  * The unspecified address means all multicast addresses.
651  * This is only used by the multicast router.
652  *
653  * ill identifies the interface to join on; it may not match the
654  * interface requested by the application of a failover has taken
655  * place.  orig_ifindex always identifies the interface requested
656  * by the app.
657  *
658  * ilgstat tells us if there's an ilg associated with this join,
659  * and if so, if it's a new ilg or a change to an existing one.
660  * ilg_fmode and ilg_flist give us the current filter state of
661  * the ilg (and will be EXCLUDE {NULL} in the case of no ilg).
662  */
663 int
664 ip_addmulti_v6(const in6_addr_t *v6group, ill_t *ill, int orig_ifindex,
665     zoneid_t zoneid, ilg_stat_t ilgstat, mcast_record_t ilg_fmode,
666     slist_t *ilg_flist)
667 {
668 	ilm_t	*ilm;
669 	int	ret;
670 
671 	ASSERT(IAM_WRITER_ILL(ill));
672 
673 	if (!IN6_IS_ADDR_MULTICAST(v6group) &&
674 	    !IN6_IS_ADDR_UNSPECIFIED(v6group)) {
675 		return (EINVAL);
676 	}
677 
678 	/*
679 	 * An ilm is uniquely identified by the tuple of (group, ill,
680 	 * orig_ill).  group is the multicast group address, ill is
681 	 * the interface on which it is currently joined, and orig_ill
682 	 * is the interface on which the application requested the
683 	 * join.  orig_ill and ill are the same unless orig_ill has
684 	 * failed over.
685 	 *
686 	 * Both orig_ill and ill are required, which means we may have
687 	 * 2 ilms on an ill for the same group, but with different
688 	 * orig_ills.  These must be kept separate, so that when failback
689 	 * occurs, the appropriate ilms are moved back to their orig_ill
690 	 * without disrupting memberships on the ill to which they had
691 	 * been moved.
692 	 *
693 	 * In order to track orig_ill, we store orig_ifindex in the
694 	 * ilm and ilg.
695 	 */
696 	mutex_enter(&ill->ill_lock);
697 	ilm = ilm_lookup_ill_index_v6(ill, v6group, orig_ifindex, zoneid);
698 	mutex_exit(&ill->ill_lock);
699 	if (ilm != NULL)
700 		return (ilm_update_add(ilm, ilgstat, ilg_flist, B_TRUE));
701 
702 	/*
703 	 * We need to remember where the application really wanted
704 	 * to join. This will be used later if we want to failback
705 	 * to the original interface.
706 	 */
707 	ilm = ilm_add_v6(ill->ill_ipif, v6group, ilgstat, ilg_fmode,
708 	    ilg_flist, orig_ifindex, zoneid);
709 	if (ilm == NULL)
710 		return (ENOMEM);
711 
712 	if (IN6_IS_ADDR_UNSPECIFIED(v6group)) {
713 		/*
714 		 * Check how many ipif's that have members in this group -
715 		 * if more then one we should not tell the driver to join
716 		 * this time
717 		 */
718 		if (ilm_numentries_v6(ill, v6group) > 1)
719 			return (0);
720 		if (ill->ill_group == NULL)
721 			ret = ip_join_allmulti(ill->ill_ipif);
722 		else
723 			ret = ill_nominate_mcast_rcv(ill->ill_group);
724 
725 		if (ret != 0)
726 			ilm_delete(ilm);
727 		return (ret);
728 	}
729 
730 	if (!IS_LOOPBACK(ill))
731 		mld_joingroup(ilm);
732 
733 	/*
734 	 * If we have more then one we should not tell the driver
735 	 * to join this time.
736 	 */
737 	if (ilm_numentries_v6(ill, v6group) > 1)
738 		return (0);
739 
740 	ret = ip_ll_addmulti_v6(ill->ill_ipif, v6group);
741 	if (ret != 0)
742 		ilm_delete(ilm);
743 	return (ret);
744 }
745 
746 /*
747  * Send a multicast request to the driver for enabling multicast reception
748  * for v6groupp address. The caller has already checked whether it is
749  * appropriate to send one or not.
750  */
751 int
752 ip_ll_send_enabmulti_req(ill_t *ill, const in6_addr_t *v6groupp)
753 {
754 	mblk_t	*mp;
755 	uint32_t addrlen, addroff;
756 	char	group_buf[INET6_ADDRSTRLEN];
757 
758 	ASSERT(IAM_WRITER_ILL(ill));
759 
760 	/*
761 	 * Create a AR_ENTRY_SQUERY message with a dl_enabmulti_req tacked
762 	 * on.
763 	 */
764 	mp = ill_create_dl(ill, DL_ENABMULTI_REQ, sizeof (dl_enabmulti_req_t),
765 	    &addrlen, &addroff);
766 	if (!mp)
767 		return (ENOMEM);
768 	if (IN6_IS_ADDR_V4MAPPED(v6groupp)) {
769 		ipaddr_t v4group;
770 
771 		IN6_V4MAPPED_TO_IPADDR(v6groupp, v4group);
772 		/*
773 		 * NOTE!!!
774 		 * The "addroff" passed in here was calculated by
775 		 * ill_create_dl(), and will be used by ill_create_squery()
776 		 * to perform some twisted coding magic. It is the offset
777 		 * into the dl_xxx_req of the hw addr. Here, it will be
778 		 * added to b_wptr - b_rptr to create a magic number that
779 		 * is not an offset into this squery mblk.
780 		 * The actual hardware address will be accessed only in the
781 		 * dl_xxx_req, not in the squery. More importantly,
782 		 * that hardware address can *only* be accessed in this
783 		 * mblk chain by calling mi_offset_param_c(), which uses
784 		 * the magic number in the squery hw offset field to go
785 		 * to the *next* mblk (the dl_xxx_req), subtract the
786 		 * (b_wptr - b_rptr), and find the actual offset into
787 		 * the dl_xxx_req.
788 		 * Any method that depends on using the
789 		 * offset field in the dl_disabmulti_req or squery
790 		 * to find either hardware address will similarly fail.
791 		 *
792 		 * Look in ar_entry_squery() in arp.c to see how this offset
793 		 * is used.
794 		 */
795 		mp = ill_create_squery(ill, v4group, addrlen, addroff, mp);
796 		if (!mp)
797 			return (ENOMEM);
798 		ip1dbg(("ip_ll_send_enabmulti_req: IPv4 putnext %s on %s\n",
799 		    inet_ntop(AF_INET6, v6groupp, group_buf,
800 		    sizeof (group_buf)),
801 		    ill->ill_name));
802 		putnext(ill->ill_rq, mp);
803 	} else {
804 		ip1dbg(("ip_ll_send_enabmulti_req: IPv6 ndp_mcastreq %s on"
805 		    " %s\n",
806 		    inet_ntop(AF_INET6, v6groupp, group_buf,
807 		    sizeof (group_buf)),
808 		    ill->ill_name));
809 		return (ndp_mcastreq(ill, v6groupp, addrlen, addroff, mp));
810 	}
811 	return (0);
812 }
813 
814 /*
815  * Send a multicast request to the driver for enabling multicast
816  * membership for v6group if appropriate.
817  */
818 static int
819 ip_ll_addmulti_v6(ipif_t *ipif, const in6_addr_t *v6groupp)
820 {
821 	ill_t	*ill = ipif->ipif_ill;
822 
823 	ASSERT(IAM_WRITER_IPIF(ipif));
824 
825 	if (ill->ill_net_type != IRE_IF_RESOLVER ||
826 	    ipif->ipif_flags & IPIF_POINTOPOINT) {
827 		ip1dbg(("ip_ll_addmulti_v6: not resolver\n"));
828 		return (0);	/* Must be IRE_IF_NORESOLVER */
829 	}
830 
831 	if (ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST) {
832 		ip1dbg(("ip_ll_addmulti_v6: MULTI_BCAST\n"));
833 		return (0);
834 	}
835 	if (!ill->ill_dl_up) {
836 		/*
837 		 * Nobody there. All multicast addresses will be re-joined
838 		 * when we get the DL_BIND_ACK bringing the interface up.
839 		 */
840 		ip1dbg(("ip_ll_addmulti_v6: nobody up\n"));
841 		return (0);
842 	}
843 	return (ip_ll_send_enabmulti_req(ill, v6groupp));
844 }
845 
846 /*
847  * INADDR_ANY means all multicast addresses. This is only used
848  * by the multicast router.
849  * INADDR_ANY is stored as the IPv6 unspecifed addr.
850  */
851 int
852 ip_delmulti(ipaddr_t group, ipif_t *ipif, boolean_t no_ilg, boolean_t leaving)
853 {
854 	ill_t	*ill = ipif->ipif_ill;
855 	ilm_t *ilm;
856 	in6_addr_t v6group;
857 	int	ret;
858 
859 	ASSERT(IAM_WRITER_IPIF(ipif));
860 
861 	if (!CLASSD(group) && group != INADDR_ANY)
862 		return (EINVAL);
863 
864 	/*
865 	 * INADDR_ANY is represented as the IPv6 unspecifed addr.
866 	 */
867 	if (group == INADDR_ANY)
868 		v6group = ipv6_all_zeros;
869 	else
870 		IN6_IPADDR_TO_V4MAPPED(group, &v6group);
871 
872 	/*
873 	 * Look for a match on the ipif.
874 	 * (IP_DROP_MEMBERSHIP specifies an ipif using an IP address).
875 	 */
876 	mutex_enter(&ill->ill_lock);
877 	ilm = ilm_lookup_ipif(ipif, group);
878 	mutex_exit(&ill->ill_lock);
879 	if (ilm == NULL)
880 		return (ENOENT);
881 
882 	/* Update counters */
883 	if (no_ilg)
884 		ilm->ilm_no_ilg_cnt--;
885 
886 	if (leaving)
887 		ilm->ilm_refcnt--;
888 
889 	if (ilm->ilm_refcnt > 0)
890 		return (ilm_update_del(ilm, B_FALSE));
891 
892 	if (group == INADDR_ANY) {
893 		ilm_delete(ilm);
894 		/*
895 		 * Check how many ipif's that have members in this group -
896 		 * if there are still some left then don't tell the driver
897 		 * to drop it.
898 		 */
899 		if (ilm_numentries_v6(ill, &v6group) != 0)
900 			return (0);
901 
902 		/*
903 		 * If we never joined, then don't leave.  This can happen
904 		 * if we're in an IPMP group, since only one ill per IPMP
905 		 * group receives all multicast packets.
906 		 */
907 		if (!ill->ill_join_allmulti) {
908 			ASSERT(ill->ill_group != NULL);
909 			return (0);
910 		}
911 
912 		ret = ip_leave_allmulti(ipif);
913 		if (ill->ill_group != NULL)
914 			(void) ill_nominate_mcast_rcv(ill->ill_group);
915 		return (ret);
916 	}
917 
918 	if (!IS_LOOPBACK(ill))
919 		igmp_leavegroup(ilm);
920 
921 	ilm_delete(ilm);
922 	/*
923 	 * Check how many ipif's that have members in this group -
924 	 * if there are still some left then don't tell the driver
925 	 * to drop it.
926 	 */
927 	if (ilm_numentries_v6(ill, &v6group) != 0)
928 		return (0);
929 	return (ip_ll_delmulti_v6(ipif, &v6group));
930 }
931 
932 /*
933  * The unspecified address means all multicast addresses.
934  * This is only used by the multicast router.
935  */
936 int
937 ip_delmulti_v6(const in6_addr_t *v6group, ill_t *ill, int orig_ifindex,
938     zoneid_t zoneid, boolean_t no_ilg, boolean_t leaving)
939 {
940 	ipif_t	*ipif;
941 	ilm_t *ilm;
942 	int	ret;
943 
944 	ASSERT(IAM_WRITER_ILL(ill));
945 
946 	if (!IN6_IS_ADDR_MULTICAST(v6group) &&
947 	    !IN6_IS_ADDR_UNSPECIFIED(v6group))
948 		return (EINVAL);
949 
950 	/*
951 	 * Look for a match on the ill.
952 	 * (IPV6_LEAVE_GROUP specifies an ill using an ifindex).
953 	 *
954 	 * Similar to ip_addmulti_v6, we should always look using
955 	 * the orig_ifindex.
956 	 *
957 	 * 1) If orig_ifindex is different from ill's ifindex
958 	 *    we should have an ilm with orig_ifindex created in
959 	 *    ip_addmulti_v6. We should delete that here.
960 	 *
961 	 * 2) If orig_ifindex is same as ill's ifindex, we should
962 	 *    not delete the ilm that is temporarily here because of
963 	 *    a FAILOVER. Those ilms will have a ilm_orig_ifindex
964 	 *    different from ill's ifindex.
965 	 *
966 	 * Thus, always lookup using orig_ifindex.
967 	 */
968 	mutex_enter(&ill->ill_lock);
969 	ilm = ilm_lookup_ill_index_v6(ill, v6group, orig_ifindex, zoneid);
970 	mutex_exit(&ill->ill_lock);
971 	if (ilm == NULL)
972 		return (ENOENT);
973 
974 	ASSERT(ilm->ilm_ill == ill);
975 
976 	ipif = ill->ill_ipif;
977 
978 	/* Update counters */
979 	if (no_ilg)
980 		ilm->ilm_no_ilg_cnt--;
981 
982 	if (leaving)
983 		ilm->ilm_refcnt--;
984 
985 	if (ilm->ilm_refcnt > 0)
986 		return (ilm_update_del(ilm, B_TRUE));
987 
988 	if (IN6_IS_ADDR_UNSPECIFIED(v6group)) {
989 		ilm_delete(ilm);
990 		/*
991 		 * Check how many ipif's that have members in this group -
992 		 * if there are still some left then don't tell the driver
993 		 * to drop it.
994 		 */
995 		if (ilm_numentries_v6(ill, v6group) != 0)
996 			return (0);
997 
998 		/*
999 		 * If we never joined, then don't leave.  This can happen
1000 		 * if we're in an IPMP group, since only one ill per IPMP
1001 		 * group receives all multicast packets.
1002 		 */
1003 		if (!ill->ill_join_allmulti) {
1004 			ASSERT(ill->ill_group != NULL);
1005 			return (0);
1006 		}
1007 
1008 		ret = ip_leave_allmulti(ipif);
1009 		if (ill->ill_group != NULL)
1010 			(void) ill_nominate_mcast_rcv(ill->ill_group);
1011 		return (ret);
1012 	}
1013 
1014 	if (!IS_LOOPBACK(ill))
1015 		mld_leavegroup(ilm);
1016 
1017 	ilm_delete(ilm);
1018 	/*
1019 	 * Check how many ipif's that have members in this group -
1020 	 * if there are still some left then don't tell the driver
1021 	 * to drop it.
1022 	 */
1023 	if (ilm_numentries_v6(ill, v6group) != 0)
1024 		return (0);
1025 	return (ip_ll_delmulti_v6(ipif, v6group));
1026 }
1027 
1028 /*
1029  * Send a multicast request to the driver for disabling multicast reception
1030  * for v6groupp address. The caller has already checked whether it is
1031  * appropriate to send one or not.
1032  */
1033 int
1034 ip_ll_send_disabmulti_req(ill_t *ill, const in6_addr_t *v6groupp)
1035 {
1036 	mblk_t	*mp;
1037 	char	group_buf[INET6_ADDRSTRLEN];
1038 	uint32_t	addrlen, addroff;
1039 
1040 	ASSERT(IAM_WRITER_ILL(ill));
1041 	/*
1042 	 * Create a AR_ENTRY_SQUERY message with a dl_disabmulti_req tacked
1043 	 * on.
1044 	 */
1045 	mp = ill_create_dl(ill, DL_DISABMULTI_REQ,
1046 	    sizeof (dl_disabmulti_req_t), &addrlen, &addroff);
1047 
1048 	if (!mp)
1049 		return (ENOMEM);
1050 
1051 	if (IN6_IS_ADDR_V4MAPPED(v6groupp)) {
1052 		ipaddr_t v4group;
1053 
1054 		IN6_V4MAPPED_TO_IPADDR(v6groupp, v4group);
1055 		/*
1056 		 * NOTE!!!
1057 		 * The "addroff" passed in here was calculated by
1058 		 * ill_create_dl(), and will be used by ill_create_squery()
1059 		 * to perform some twisted coding magic. It is the offset
1060 		 * into the dl_xxx_req of the hw addr. Here, it will be
1061 		 * added to b_wptr - b_rptr to create a magic number that
1062 		 * is not an offset into this mblk.
1063 		 *
1064 		 * Please see the comment in ip_ll_send)enabmulti_req()
1065 		 * for a complete explanation.
1066 		 *
1067 		 * Look in ar_entry_squery() in arp.c to see how this offset
1068 		 * is used.
1069 		 */
1070 		mp = ill_create_squery(ill, v4group, addrlen, addroff, mp);
1071 		if (!mp)
1072 			return (ENOMEM);
1073 		ip1dbg(("ip_ll_send_disabmulti_req: IPv4 putnext %s on %s\n",
1074 		    inet_ntop(AF_INET6, v6groupp, group_buf,
1075 		    sizeof (group_buf)),
1076 		    ill->ill_name));
1077 		putnext(ill->ill_rq, mp);
1078 	} else {
1079 		ip1dbg(("ip_ll_send_disabmulti_req: IPv6 ndp_mcastreq %s on"
1080 		    " %s\n",
1081 		    inet_ntop(AF_INET6, v6groupp, group_buf,
1082 		    sizeof (group_buf)),
1083 		    ill->ill_name));
1084 		return (ndp_mcastreq(ill, v6groupp, addrlen, addroff, mp));
1085 	}
1086 	return (0);
1087 }
1088 
1089 /*
1090  * Send a multicast request to the driver for disabling multicast
1091  * membership for v6group if appropriate.
1092  */
1093 static int
1094 ip_ll_delmulti_v6(ipif_t *ipif, const in6_addr_t *v6group)
1095 {
1096 	ill_t	*ill = ipif->ipif_ill;
1097 
1098 	ASSERT(IAM_WRITER_IPIF(ipif));
1099 
1100 	if (ill->ill_net_type != IRE_IF_RESOLVER ||
1101 	    ipif->ipif_flags & IPIF_POINTOPOINT) {
1102 		return (0);	/* Must be IRE_IF_NORESOLVER */
1103 	}
1104 	if (ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST) {
1105 		ip1dbg(("ip_ll_delmulti_v6: MULTI_BCAST\n"));
1106 		return (0);
1107 	}
1108 	if (!ill->ill_dl_up) {
1109 		/*
1110 		 * Nobody there. All multicast addresses will be re-joined
1111 		 * when we get the DL_BIND_ACK bringing the interface up.
1112 		 */
1113 		ip1dbg(("ip_ll_delmulti_v6: nobody up\n"));
1114 		return (0);
1115 	}
1116 	return (ip_ll_send_disabmulti_req(ill, v6group));
1117 }
1118 
1119 /*
1120  * Make the driver pass up all multicast packets
1121  *
1122  * With ill groups, the caller makes sure that there is only
1123  * one ill joining the allmulti group.
1124  */
1125 int
1126 ip_join_allmulti(ipif_t *ipif)
1127 {
1128 	ill_t	*ill = ipif->ipif_ill;
1129 	mblk_t	*mp;
1130 	uint32_t	addrlen, addroff;
1131 
1132 	ASSERT(IAM_WRITER_IPIF(ipif));
1133 
1134 	if (!ill->ill_dl_up) {
1135 		/*
1136 		 * Nobody there. All multicast addresses will be re-joined
1137 		 * when we get the DL_BIND_ACK bringing the interface up.
1138 		 */
1139 		return (0);
1140 	}
1141 
1142 	ASSERT(!ill->ill_join_allmulti);
1143 
1144 	/*
1145 	 * Create a DL_PROMISCON_REQ message and send it directly to
1146 	 * the DLPI provider.  We don't need to do this for certain
1147 	 * media types for which we never need to turn promiscuous
1148 	 * mode on.
1149 	 */
1150 	if ((ill->ill_net_type == IRE_IF_RESOLVER) &&
1151 	    !(ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST)) {
1152 		mp = ill_create_dl(ill, DL_PROMISCON_REQ,
1153 		    sizeof (dl_promiscon_req_t), &addrlen, &addroff);
1154 		if (mp == NULL)
1155 			return (ENOMEM);
1156 		ill_dlpi_send(ill, mp);
1157 	}
1158 
1159 	ill->ill_join_allmulti = B_TRUE;
1160 	return (0);
1161 }
1162 
1163 /*
1164  * Make the driver stop passing up all multicast packets
1165  *
1166  * With ill groups, we need to nominate some other ill as
1167  * this ipif->ipif_ill is leaving the group.
1168  */
1169 int
1170 ip_leave_allmulti(ipif_t *ipif)
1171 {
1172 	ill_t	*ill = ipif->ipif_ill;
1173 	mblk_t	*mp;
1174 	uint32_t	addrlen, addroff;
1175 
1176 	ASSERT(IAM_WRITER_IPIF(ipif));
1177 
1178 	if (!ill->ill_dl_up) {
1179 		/*
1180 		 * Nobody there. All multicast addresses will be re-joined
1181 		 * when we get the DL_BIND_ACK bringing the interface up.
1182 		 */
1183 		return (0);
1184 	}
1185 
1186 	ASSERT(ill->ill_join_allmulti);
1187 
1188 	/*
1189 	 * Create a DL_PROMISCOFF_REQ message and send it directly to
1190 	 * the DLPI provider.  We don't need to do this for certain
1191 	 * media types for which we never need to turn promiscuous
1192 	 * mode on.
1193 	 */
1194 	if ((ill->ill_net_type == IRE_IF_RESOLVER) &&
1195 	    !(ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST)) {
1196 		mp = ill_create_dl(ill, DL_PROMISCOFF_REQ,
1197 		    sizeof (dl_promiscoff_req_t), &addrlen, &addroff);
1198 		if (mp == NULL)
1199 			return (ENOMEM);
1200 		ill_dlpi_send(ill, mp);
1201 	}
1202 
1203 	ill->ill_join_allmulti = B_FALSE;
1204 	return (0);
1205 }
1206 
1207 /*
1208  * Copy mp_orig and pass it in as a local message.
1209  */
1210 void
1211 ip_multicast_loopback(queue_t *q, ill_t *ill, mblk_t *mp_orig, int fanout_flags,
1212     zoneid_t zoneid)
1213 {
1214 	mblk_t	*mp;
1215 	mblk_t	*ipsec_mp;
1216 	ipha_t	*iph;
1217 	ip_stack_t *ipst = ill->ill_ipst;
1218 
1219 	if (DB_TYPE(mp_orig) == M_DATA &&
1220 	    ((ipha_t *)mp_orig->b_rptr)->ipha_protocol == IPPROTO_UDP) {
1221 		uint_t hdrsz;
1222 
1223 		hdrsz = IPH_HDR_LENGTH((ipha_t *)mp_orig->b_rptr) +
1224 		    sizeof (udpha_t);
1225 		ASSERT(MBLKL(mp_orig) >= hdrsz);
1226 
1227 		if (((mp = allocb(hdrsz, BPRI_MED)) != NULL) &&
1228 		    (mp_orig = dupmsg(mp_orig)) != NULL) {
1229 			bcopy(mp_orig->b_rptr, mp->b_rptr, hdrsz);
1230 			mp->b_wptr += hdrsz;
1231 			mp->b_cont = mp_orig;
1232 			mp_orig->b_rptr += hdrsz;
1233 			if (is_system_labeled() && DB_CRED(mp_orig) != NULL)
1234 				mblk_setcred(mp, DB_CRED(mp_orig));
1235 			if (MBLKL(mp_orig) == 0) {
1236 				mp->b_cont = mp_orig->b_cont;
1237 				mp_orig->b_cont = NULL;
1238 				freeb(mp_orig);
1239 			}
1240 		} else if (mp != NULL) {
1241 			freeb(mp);
1242 			mp = NULL;
1243 		}
1244 	} else {
1245 		mp = ip_copymsg(mp_orig); /* No refcnt on ipsec_out netstack */
1246 	}
1247 
1248 	if (mp == NULL)
1249 		return;
1250 	if (DB_TYPE(mp) == M_CTL) {
1251 		ipsec_mp = mp;
1252 		mp = mp->b_cont;
1253 	} else {
1254 		ipsec_mp = mp;
1255 	}
1256 
1257 	iph = (ipha_t *)mp->b_rptr;
1258 
1259 	/*
1260 	 * DTrace this as ip:::send.  A blocked packet will fire the send
1261 	 * probe, but not the receive probe.
1262 	 */
1263 	DTRACE_IP7(send, mblk_t *, ipsec_mp, conn_t *, NULL, void_ip_t *, iph,
1264 	    __dtrace_ipsr_ill_t *, ill, ipha_t *, iph, ip6_t *, NULL, int, 1);
1265 
1266 	DTRACE_PROBE4(ip4__loopback__out__start,
1267 	    ill_t *, NULL, ill_t *, ill,
1268 	    ipha_t *, iph, mblk_t *, ipsec_mp);
1269 
1270 	FW_HOOKS(ipst->ips_ip4_loopback_out_event,
1271 	    ipst->ips_ipv4firewall_loopback_out,
1272 	    NULL, ill, iph, ipsec_mp, mp, HPE_MULTICAST, ipst);
1273 
1274 	DTRACE_PROBE1(ip4__loopback__out__end, mblk_t *, ipsec_mp);
1275 
1276 	if (ipsec_mp != NULL)
1277 		ip_wput_local(q, ill, iph, ipsec_mp, NULL,
1278 		    fanout_flags, zoneid);
1279 }
1280 
1281 static area_t	ip_aresq_template = {
1282 	AR_ENTRY_SQUERY,		/* cmd */
1283 	sizeof (area_t)+IP_ADDR_LEN,	/* name offset */
1284 	sizeof (area_t),	/* name len (filled by ill_arp_alloc) */
1285 	IP_ARP_PROTO_TYPE,		/* protocol, from arps perspective */
1286 	sizeof (area_t),			/* proto addr offset */
1287 	IP_ADDR_LEN,			/* proto addr_length */
1288 	0,				/* proto mask offset */
1289 	/* Rest is initialized when used */
1290 	0,				/* flags */
1291 	0,				/* hw addr offset */
1292 	0,				/* hw addr length */
1293 };
1294 
1295 static mblk_t *
1296 ill_create_squery(ill_t *ill, ipaddr_t ipaddr, uint32_t addrlen,
1297     uint32_t addroff, mblk_t *mp_tail)
1298 {
1299 	mblk_t	*mp;
1300 	area_t	*area;
1301 
1302 	mp = ill_arp_alloc(ill, (uchar_t *)&ip_aresq_template,
1303 	    (caddr_t)&ipaddr);
1304 	if (!mp) {
1305 		freemsg(mp_tail);
1306 		return (NULL);
1307 	}
1308 	area = (area_t *)mp->b_rptr;
1309 	area->area_hw_addr_length = addrlen;
1310 	area->area_hw_addr_offset = mp->b_wptr - mp->b_rptr + addroff;
1311 	/*
1312 	 * NOTE!
1313 	 *
1314 	 * The area_hw_addr_offset, as can be seen, does not hold the
1315 	 * actual hardware address offset. Rather, it holds the offset
1316 	 * to the hw addr in the dl_xxx_req in mp_tail, modified by
1317 	 * adding (mp->b_wptr - mp->b_rptr). This allows the function
1318 	 * mi_offset_paramc() to find the hardware address in the
1319 	 * *second* mblk (dl_xxx_req), not this mblk.
1320 	 *
1321 	 * Using mi_offset_paramc() is thus the *only* way to access
1322 	 * the dl_xxx_hw address.
1323 	 *
1324 	 * The squery hw address should *not* be accessed.
1325 	 *
1326 	 * See ar_entry_squery() in arp.c for an example of how all this works.
1327 	 */
1328 
1329 	mp->b_cont = mp_tail;
1330 	return (mp);
1331 }
1332 
1333 /*
1334  * Create a dlpi message with room for phys+sap. When we come back in
1335  * ip_wput_ctl() we will strip the sap for those primitives which
1336  * only need a physical address.
1337  */
1338 static mblk_t *
1339 ill_create_dl(ill_t *ill, uint32_t dl_primitive, uint32_t length,
1340     uint32_t *addr_lenp, uint32_t *addr_offp)
1341 {
1342 	mblk_t	*mp;
1343 	uint32_t	hw_addr_length;
1344 	char		*cp;
1345 	uint32_t	offset;
1346 	uint32_t 	size;
1347 
1348 	*addr_lenp = *addr_offp = 0;
1349 
1350 	hw_addr_length = ill->ill_phys_addr_length;
1351 	if (!hw_addr_length) {
1352 		ip0dbg(("ip_create_dl: hw addr length = 0\n"));
1353 		return (NULL);
1354 	}
1355 
1356 	size = length;
1357 	switch (dl_primitive) {
1358 	case DL_ENABMULTI_REQ:
1359 	case DL_DISABMULTI_REQ:
1360 		size += hw_addr_length;
1361 		break;
1362 	case DL_PROMISCON_REQ:
1363 	case DL_PROMISCOFF_REQ:
1364 		break;
1365 	default:
1366 		return (NULL);
1367 	}
1368 	mp = allocb(size, BPRI_HI);
1369 	if (!mp)
1370 		return (NULL);
1371 	mp->b_wptr += size;
1372 	mp->b_datap->db_type = M_PROTO;
1373 
1374 	cp = (char *)mp->b_rptr;
1375 	offset = length;
1376 
1377 	switch (dl_primitive) {
1378 	case DL_ENABMULTI_REQ: {
1379 		dl_enabmulti_req_t *dl = (dl_enabmulti_req_t *)cp;
1380 
1381 		dl->dl_primitive = dl_primitive;
1382 		dl->dl_addr_offset = offset;
1383 		*addr_lenp = dl->dl_addr_length = hw_addr_length;
1384 		*addr_offp = offset;
1385 		break;
1386 	}
1387 	case DL_DISABMULTI_REQ: {
1388 		dl_disabmulti_req_t *dl = (dl_disabmulti_req_t *)cp;
1389 
1390 		dl->dl_primitive = dl_primitive;
1391 		dl->dl_addr_offset = offset;
1392 		*addr_lenp = dl->dl_addr_length = hw_addr_length;
1393 		*addr_offp = offset;
1394 		break;
1395 	}
1396 	case DL_PROMISCON_REQ:
1397 	case DL_PROMISCOFF_REQ: {
1398 		dl_promiscon_req_t *dl = (dl_promiscon_req_t *)cp;
1399 
1400 		dl->dl_primitive = dl_primitive;
1401 		dl->dl_level = DL_PROMISC_MULTI;
1402 		break;
1403 	}
1404 	}
1405 	ip1dbg(("ill_create_dl: addr_len %d, addr_off %d\n",
1406 	    *addr_lenp, *addr_offp));
1407 	return (mp);
1408 }
1409 
1410 void
1411 ip_wput_ctl(queue_t *q, mblk_t *mp_orig)
1412 {
1413 	ill_t	*ill = (ill_t *)q->q_ptr;
1414 	mblk_t	*mp = mp_orig;
1415 	area_t	*area = (area_t *)mp->b_rptr;
1416 
1417 	/* Check that we have a AR_ENTRY_SQUERY with a tacked on mblk */
1418 	if (MBLKL(mp) < sizeof (area_t) || mp->b_cont == NULL ||
1419 	    area->area_cmd != AR_ENTRY_SQUERY) {
1420 		putnext(q, mp);
1421 		return;
1422 	}
1423 	mp = mp->b_cont;
1424 
1425 	/*
1426 	 * Update dl_addr_length and dl_addr_offset for primitives that
1427 	 * have physical addresses as opposed to full saps
1428 	 */
1429 	switch (((union DL_primitives *)mp->b_rptr)->dl_primitive) {
1430 	case DL_ENABMULTI_REQ:
1431 		/* Track the state if this is the first enabmulti */
1432 		if (ill->ill_dlpi_multicast_state == IDS_UNKNOWN)
1433 			ill->ill_dlpi_multicast_state = IDS_INPROGRESS;
1434 		ip1dbg(("ip_wput_ctl: ENABMULTI\n"));
1435 		break;
1436 	case DL_DISABMULTI_REQ:
1437 		ip1dbg(("ip_wput_ctl: DISABMULTI\n"));
1438 		break;
1439 	default:
1440 		ip1dbg(("ip_wput_ctl: default\n"));
1441 		break;
1442 	}
1443 	freeb(mp_orig);
1444 	ill_dlpi_send(ill, mp);
1445 }
1446 
1447 /*
1448  * Rejoin any groups which have been explicitly joined by the application (we
1449  * left all explicitly joined groups as part of ill_leave_multicast() prior to
1450  * bringing the interface down).  Note that because groups can be joined and
1451  * left while an interface is down, this may not be the same set of groups
1452  * that we left in ill_leave_multicast().
1453  */
1454 void
1455 ill_recover_multicast(ill_t *ill)
1456 {
1457 	ilm_t	*ilm;
1458 	char    addrbuf[INET6_ADDRSTRLEN];
1459 
1460 	ASSERT(IAM_WRITER_ILL(ill));
1461 	ILM_WALKER_HOLD(ill);
1462 	for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
1463 		/*
1464 		 * Check how many ipif's that have members in this group -
1465 		 * if more then one we make sure that this entry is first
1466 		 * in the list.
1467 		 */
1468 		if (ilm_numentries_v6(ill, &ilm->ilm_v6addr) > 1 &&
1469 		    ilm_lookup_ill_v6(ill, &ilm->ilm_v6addr, ALL_ZONES) != ilm)
1470 			continue;
1471 		ip1dbg(("ill_recover_multicast: %s\n",
1472 		    inet_ntop(AF_INET6, &ilm->ilm_v6addr, addrbuf,
1473 		    sizeof (addrbuf))));
1474 		if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
1475 			if (ill->ill_group == NULL) {
1476 				(void) ip_join_allmulti(ill->ill_ipif);
1477 			} else {
1478 				/*
1479 				 * We don't want to join on this ill,
1480 				 * if somebody else in the group has
1481 				 * already been nominated.
1482 				 */
1483 				(void) ill_nominate_mcast_rcv(ill->ill_group);
1484 			}
1485 		} else {
1486 			(void) ip_ll_addmulti_v6(ill->ill_ipif,
1487 			    &ilm->ilm_v6addr);
1488 		}
1489 	}
1490 	ILM_WALKER_RELE(ill);
1491 }
1492 
1493 /*
1494  * The opposite of ill_recover_multicast() -- leaves all multicast groups
1495  * that were explicitly joined.  Note that both these functions could be
1496  * disposed of if we enhanced ARP to allow us to handle DL_DISABMULTI_REQ
1497  * and DL_ENABMULTI_REQ messages when an interface is down.
1498  */
1499 void
1500 ill_leave_multicast(ill_t *ill)
1501 {
1502 	ilm_t	*ilm;
1503 	char    addrbuf[INET6_ADDRSTRLEN];
1504 
1505 	ASSERT(IAM_WRITER_ILL(ill));
1506 	ILM_WALKER_HOLD(ill);
1507 	for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
1508 		/*
1509 		 * Check how many ipif's that have members in this group -
1510 		 * if more then one we make sure that this entry is first
1511 		 * in the list.
1512 		 */
1513 		if (ilm_numentries_v6(ill, &ilm->ilm_v6addr) > 1 &&
1514 		    ilm_lookup_ill_v6(ill, &ilm->ilm_v6addr, ALL_ZONES) != ilm)
1515 			continue;
1516 		ip1dbg(("ill_leave_multicast: %s\n",
1517 		    inet_ntop(AF_INET6, &ilm->ilm_v6addr, addrbuf,
1518 		    sizeof (addrbuf))));
1519 		if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
1520 			(void) ip_leave_allmulti(ill->ill_ipif);
1521 			/*
1522 			 * If we were part of an IPMP group, then
1523 			 * ill_handoff_responsibility() has already
1524 			 * nominated a new member (so we don't).
1525 			 */
1526 			ASSERT(ill->ill_group == NULL);
1527 		} else {
1528 			(void) ip_ll_delmulti_v6(ill->ill_ipif,
1529 			    &ilm->ilm_v6addr);
1530 		}
1531 	}
1532 	ILM_WALKER_RELE(ill);
1533 }
1534 
1535 /* Find an ilm for matching the ill */
1536 ilm_t *
1537 ilm_lookup_ill(ill_t *ill, ipaddr_t group, zoneid_t zoneid)
1538 {
1539 	in6_addr_t	v6group;
1540 
1541 	ASSERT(ill->ill_ilm_walker_cnt != 0 || MUTEX_HELD(&ill->ill_lock));
1542 	/*
1543 	 * INADDR_ANY is represented as the IPv6 unspecifed addr.
1544 	 */
1545 	if (group == INADDR_ANY)
1546 		v6group = ipv6_all_zeros;
1547 	else
1548 		IN6_IPADDR_TO_V4MAPPED(group, &v6group);
1549 
1550 	return (ilm_lookup_ill_v6(ill, &v6group, zoneid));
1551 }
1552 
1553 /*
1554  * Find an ilm for matching the ill. All the ilm lookup functions
1555  * ignore ILM_DELETED ilms. These have been logically deleted, and
1556  * igmp and linklayer disable multicast have been done. Only mi_free
1557  * yet to be done. Still there in the list due to ilm_walkers. The
1558  * last walker will release it.
1559  */
1560 ilm_t *
1561 ilm_lookup_ill_v6(ill_t *ill, const in6_addr_t *v6group, zoneid_t zoneid)
1562 {
1563 	ilm_t	*ilm;
1564 
1565 	ASSERT(ill->ill_ilm_walker_cnt != 0 || MUTEX_HELD(&ill->ill_lock));
1566 
1567 	for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
1568 		if (ilm->ilm_flags & ILM_DELETED)
1569 			continue;
1570 		if (IN6_ARE_ADDR_EQUAL(&ilm->ilm_v6addr, v6group) &&
1571 		    (zoneid == ALL_ZONES || zoneid == ilm->ilm_zoneid))
1572 			return (ilm);
1573 	}
1574 	return (NULL);
1575 }
1576 
1577 ilm_t *
1578 ilm_lookup_ill_index_v6(ill_t *ill, const in6_addr_t *v6group, int index,
1579     zoneid_t zoneid)
1580 {
1581 	ilm_t *ilm;
1582 
1583 	ASSERT(ill->ill_ilm_walker_cnt != 0 || MUTEX_HELD(&ill->ill_lock));
1584 
1585 	for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
1586 		if (ilm->ilm_flags & ILM_DELETED)
1587 			continue;
1588 		if (IN6_ARE_ADDR_EQUAL(&ilm->ilm_v6addr, v6group) &&
1589 		    (zoneid == ALL_ZONES || zoneid == ilm->ilm_zoneid) &&
1590 		    ilm->ilm_orig_ifindex == index) {
1591 			return (ilm);
1592 		}
1593 	}
1594 	return (NULL);
1595 }
1596 
1597 
1598 /*
1599  * Found an ilm for the ipif. Only needed for IPv4 which does
1600  * ipif specific socket options.
1601  */
1602 ilm_t *
1603 ilm_lookup_ipif(ipif_t *ipif, ipaddr_t group)
1604 {
1605 	ill_t	*ill = ipif->ipif_ill;
1606 	ilm_t	*ilm;
1607 	in6_addr_t	v6group;
1608 
1609 	ASSERT(ill->ill_ilm_walker_cnt != 0 || MUTEX_HELD(&ill->ill_lock));
1610 	/*
1611 	 * INADDR_ANY is represented as the IPv6 unspecifed addr.
1612 	 */
1613 	if (group == INADDR_ANY)
1614 		v6group = ipv6_all_zeros;
1615 	else
1616 		IN6_IPADDR_TO_V4MAPPED(group, &v6group);
1617 
1618 	for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
1619 		if (ilm->ilm_flags & ILM_DELETED)
1620 			continue;
1621 		if (ilm->ilm_ipif == ipif &&
1622 		    IN6_ARE_ADDR_EQUAL(&ilm->ilm_v6addr, &v6group))
1623 			return (ilm);
1624 	}
1625 	return (NULL);
1626 }
1627 
1628 /*
1629  * How many members on this ill?
1630  */
1631 int
1632 ilm_numentries_v6(ill_t *ill, const in6_addr_t *v6group)
1633 {
1634 	ilm_t	*ilm;
1635 	int i = 0;
1636 
1637 	mutex_enter(&ill->ill_lock);
1638 	for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
1639 		if (ilm->ilm_flags & ILM_DELETED)
1640 			continue;
1641 		if (IN6_ARE_ADDR_EQUAL(&ilm->ilm_v6addr, v6group)) {
1642 			i++;
1643 		}
1644 	}
1645 	mutex_exit(&ill->ill_lock);
1646 	return (i);
1647 }
1648 
1649 /* Caller guarantees that the group is not already on the list */
1650 static ilm_t *
1651 ilm_add_v6(ipif_t *ipif, const in6_addr_t *v6group, ilg_stat_t ilgstat,
1652     mcast_record_t ilg_fmode, slist_t *ilg_flist, int orig_ifindex,
1653     zoneid_t zoneid)
1654 {
1655 	ill_t	*ill = ipif->ipif_ill;
1656 	ilm_t	*ilm;
1657 	ilm_t	*ilm_cur;
1658 	ilm_t	**ilm_ptpn;
1659 
1660 	ASSERT(IAM_WRITER_IPIF(ipif));
1661 
1662 	ilm = GETSTRUCT(ilm_t, 1);
1663 	if (ilm == NULL)
1664 		return (NULL);
1665 	if (ilgstat != ILGSTAT_NONE && !SLIST_IS_EMPTY(ilg_flist)) {
1666 		ilm->ilm_filter = l_alloc();
1667 		if (ilm->ilm_filter == NULL) {
1668 			mi_free(ilm);
1669 			return (NULL);
1670 		}
1671 	}
1672 	ilm->ilm_v6addr = *v6group;
1673 	ilm->ilm_refcnt = 1;
1674 	ilm->ilm_zoneid = zoneid;
1675 	ilm->ilm_timer = INFINITY;
1676 	ilm->ilm_rtx.rtx_timer = INFINITY;
1677 
1678 	/*
1679 	 * IPv4 Multicast groups are joined using ipif.
1680 	 * IPv6 Multicast groups are joined using ill.
1681 	 */
1682 	if (ill->ill_isv6) {
1683 		ilm->ilm_ill = ill;
1684 		ilm->ilm_ipif = NULL;
1685 		DTRACE_PROBE3(ill__incr__cnt, (ill_t *), ill,
1686 		    (char *), "ilm", (void *), ilm);
1687 		ill->ill_ilm_cnt++;
1688 	} else {
1689 		ASSERT(ilm->ilm_zoneid == ipif->ipif_zoneid);
1690 		ilm->ilm_ipif = ipif;
1691 		ilm->ilm_ill = NULL;
1692 		DTRACE_PROBE3(ipif__incr__cnt, (ipif_t *), ipif,
1693 		    (char *), "ilm", (void *), ilm);
1694 		ipif->ipif_ilm_cnt++;
1695 	}
1696 	ASSERT(ill->ill_ipst);
1697 	ilm->ilm_ipst = ill->ill_ipst;	/* No netstack_hold */
1698 
1699 	/*
1700 	 * After this if ilm moves to a new ill, we don't change
1701 	 * the ilm_orig_ifindex. Thus, if ill_index != ilm_orig_ifindex,
1702 	 * it has been moved. Indexes don't match even when the application
1703 	 * wants to join on a FAILED/INACTIVE interface because we choose
1704 	 * a new interface to join in. This is considered as an implicit
1705 	 * move.
1706 	 */
1707 	ilm->ilm_orig_ifindex = orig_ifindex;
1708 
1709 	ASSERT(!(ipif->ipif_state_flags & IPIF_CONDEMNED));
1710 	ASSERT(!(ill->ill_state_flags & ILL_CONDEMNED));
1711 
1712 	/*
1713 	 * Grab lock to give consistent view to readers
1714 	 */
1715 	mutex_enter(&ill->ill_lock);
1716 	/*
1717 	 * All ilms in the same zone are contiguous in the ill_ilm list.
1718 	 * The loops in ip_proto_input() and ip_wput_local() use this to avoid
1719 	 * sending duplicates up when two applications in the same zone join the
1720 	 * same group on different logical interfaces.
1721 	 */
1722 	ilm_cur = ill->ill_ilm;
1723 	ilm_ptpn = &ill->ill_ilm;
1724 	while (ilm_cur != NULL && ilm_cur->ilm_zoneid != ilm->ilm_zoneid) {
1725 		ilm_ptpn = &ilm_cur->ilm_next;
1726 		ilm_cur = ilm_cur->ilm_next;
1727 	}
1728 	ilm->ilm_next = ilm_cur;
1729 	*ilm_ptpn = ilm;
1730 
1731 	/*
1732 	 * If we have an associated ilg, use its filter state; if not,
1733 	 * default to (EXCLUDE, NULL) and set no_ilg_cnt to track this.
1734 	 */
1735 	if (ilgstat != ILGSTAT_NONE) {
1736 		if (!SLIST_IS_EMPTY(ilg_flist))
1737 			l_copy(ilg_flist, ilm->ilm_filter);
1738 		ilm->ilm_fmode = ilg_fmode;
1739 	} else {
1740 		ilm->ilm_no_ilg_cnt = 1;
1741 		ilm->ilm_fmode = MODE_IS_EXCLUDE;
1742 	}
1743 
1744 	mutex_exit(&ill->ill_lock);
1745 	return (ilm);
1746 }
1747 
1748 void
1749 ilm_inactive(ilm_t *ilm)
1750 {
1751 	FREE_SLIST(ilm->ilm_filter);
1752 	FREE_SLIST(ilm->ilm_pendsrcs);
1753 	FREE_SLIST(ilm->ilm_rtx.rtx_allow);
1754 	FREE_SLIST(ilm->ilm_rtx.rtx_block);
1755 	ilm->ilm_ipst = NULL;
1756 	mi_free((char *)ilm);
1757 }
1758 
1759 void
1760 ilm_walker_cleanup(ill_t *ill)
1761 {
1762 	ilm_t	**ilmp;
1763 	ilm_t	*ilm;
1764 	boolean_t need_wakeup = B_FALSE;
1765 
1766 	ASSERT(MUTEX_HELD(&ill->ill_lock));
1767 	ASSERT(ill->ill_ilm_walker_cnt == 0);
1768 
1769 	ilmp = &ill->ill_ilm;
1770 	while (*ilmp != NULL) {
1771 		if ((*ilmp)->ilm_flags & ILM_DELETED) {
1772 			ilm = *ilmp;
1773 			*ilmp = ilm->ilm_next;
1774 			/*
1775 			 * check if there are any pending FREE or unplumb
1776 			 * operations that need to be restarted.
1777 			 */
1778 			if (ilm->ilm_ipif != NULL) {
1779 				/*
1780 				 * IPv4 ilms hold a ref on the ipif.
1781 				 */
1782 				DTRACE_PROBE3(ipif__decr__cnt,
1783 				    (ipif_t *), ilm->ilm_ipif,
1784 				    (char *), "ilm", (void *), ilm);
1785 				ilm->ilm_ipif->ipif_ilm_cnt--;
1786 				if (IPIF_FREE_OK(ilm->ilm_ipif))
1787 					need_wakeup = B_TRUE;
1788 			} else {
1789 				/*
1790 				 * IPv6 ilms hold a ref on the ill.
1791 				 */
1792 				ASSERT(ilm->ilm_ill == ill);
1793 				DTRACE_PROBE3(ill__decr__cnt,
1794 				    (ill_t *), ill,
1795 				    (char *), "ilm", (void *), ilm);
1796 				ASSERT(ill->ill_ilm_cnt > 0);
1797 				ill->ill_ilm_cnt--;
1798 				if (ILL_FREE_OK(ill))
1799 					need_wakeup = B_TRUE;
1800 			}
1801 			ilm_inactive(ilm); /* frees ilm */
1802 		} else {
1803 			ilmp = &(*ilmp)->ilm_next;
1804 		}
1805 	}
1806 	ill->ill_ilm_cleanup_reqd = 0;
1807 	if (need_wakeup)
1808 		ipif_ill_refrele_tail(ill);
1809 	else
1810 		mutex_exit(&ill->ill_lock);
1811 }
1812 
1813 /*
1814  * Unlink ilm and free it.
1815  */
1816 static void
1817 ilm_delete(ilm_t *ilm)
1818 {
1819 	ill_t		*ill;
1820 	ilm_t		**ilmp;
1821 	boolean_t	need_wakeup;
1822 
1823 
1824 	if (ilm->ilm_ipif != NULL) {
1825 		ASSERT(IAM_WRITER_IPIF(ilm->ilm_ipif));
1826 		ASSERT(ilm->ilm_ill == NULL);
1827 		ill = ilm->ilm_ipif->ipif_ill;
1828 		ASSERT(!ill->ill_isv6);
1829 	} else {
1830 		ASSERT(IAM_WRITER_ILL(ilm->ilm_ill));
1831 		ASSERT(ilm->ilm_ipif == NULL);
1832 		ill = ilm->ilm_ill;
1833 		ASSERT(ill->ill_isv6);
1834 	}
1835 	/*
1836 	 * Delete under lock protection so that readers don't stumble
1837 	 * on bad ilm_next
1838 	 */
1839 	mutex_enter(&ill->ill_lock);
1840 	if (ill->ill_ilm_walker_cnt != 0) {
1841 		ilm->ilm_flags |= ILM_DELETED;
1842 		ill->ill_ilm_cleanup_reqd = 1;
1843 		mutex_exit(&ill->ill_lock);
1844 		return;
1845 	}
1846 
1847 	for (ilmp = &ill->ill_ilm; *ilmp != ilm; ilmp = &(*ilmp)->ilm_next)
1848 				;
1849 	*ilmp = ilm->ilm_next;
1850 
1851 	/*
1852 	 * if we are the last reference to the ipif (for IPv4 ilms)
1853 	 * or the ill (for IPv6 ilms), we may need to wakeup any
1854 	 * pending FREE or unplumb operations.
1855 	 */
1856 	need_wakeup = B_FALSE;
1857 	if (ilm->ilm_ipif != NULL) {
1858 		DTRACE_PROBE3(ipif__decr__cnt, (ipif_t *), ilm->ilm_ipif,
1859 		    (char *), "ilm", (void *), ilm);
1860 		ilm->ilm_ipif->ipif_ilm_cnt--;
1861 		if (IPIF_FREE_OK(ilm->ilm_ipif))
1862 			need_wakeup = B_TRUE;
1863 	} else {
1864 		DTRACE_PROBE3(ill__decr__cnt, (ill_t *), ill,
1865 		    (char *), "ilm", (void *), ilm);
1866 		ASSERT(ill->ill_ilm_cnt > 0);
1867 		ill->ill_ilm_cnt--;
1868 		if (ILL_FREE_OK(ill))
1869 			need_wakeup = B_TRUE;
1870 	}
1871 
1872 	ilm_inactive(ilm); /* frees this ilm */
1873 
1874 	if (need_wakeup) {
1875 		/* drops ill lock */
1876 		ipif_ill_refrele_tail(ill);
1877 	} else {
1878 		mutex_exit(&ill->ill_lock);
1879 	}
1880 }
1881 
1882 
1883 /*
1884  * Looks up the appropriate ipif given a v4 multicast group and interface
1885  * address.  On success, returns 0, with *ipifpp pointing to the found
1886  * struct.  On failure, returns an errno and *ipifpp is NULL.
1887  */
1888 int
1889 ip_opt_check(conn_t *connp, ipaddr_t group, ipaddr_t src, ipaddr_t ifaddr,
1890     uint_t *ifindexp, mblk_t *first_mp, ipsq_func_t func, ipif_t **ipifpp)
1891 {
1892 	ipif_t *ipif;
1893 	int err = 0;
1894 	zoneid_t zoneid;
1895 	ip_stack_t	*ipst =  connp->conn_netstack->netstack_ip;
1896 
1897 	if (!CLASSD(group) || CLASSD(src)) {
1898 		return (EINVAL);
1899 	}
1900 	*ipifpp = NULL;
1901 
1902 	zoneid = IPCL_ZONEID(connp);
1903 
1904 	ASSERT(!(ifaddr != INADDR_ANY && ifindexp != NULL && *ifindexp != 0));
1905 	if (ifaddr != INADDR_ANY) {
1906 		ipif = ipif_lookup_addr(ifaddr, NULL, zoneid,
1907 		    CONNP_TO_WQ(connp), first_mp, func, &err, ipst);
1908 		if (err != 0 && err != EINPROGRESS)
1909 			err = EADDRNOTAVAIL;
1910 	} else if (ifindexp != NULL && *ifindexp != 0) {
1911 		ipif = ipif_lookup_on_ifindex(*ifindexp, B_FALSE, zoneid,
1912 		    CONNP_TO_WQ(connp), first_mp, func, &err, ipst);
1913 	} else {
1914 		ipif = ipif_lookup_group(group, zoneid, ipst);
1915 		if (ipif == NULL)
1916 			return (EADDRNOTAVAIL);
1917 	}
1918 	if (ipif == NULL)
1919 		return (err);
1920 
1921 	*ipifpp = ipif;
1922 	return (0);
1923 }
1924 
1925 /*
1926  * Looks up the appropriate ill (or ipif if v4mapped) given an interface
1927  * index and IPv6 multicast group.  On success, returns 0, with *illpp (or
1928  * *ipifpp if v4mapped) pointing to the found struct.  On failure, returns
1929  * an errno and *illpp and *ipifpp are undefined.
1930  */
1931 int
1932 ip_opt_check_v6(conn_t *connp, const in6_addr_t *v6group, ipaddr_t *v4group,
1933     const in6_addr_t *v6src, ipaddr_t *v4src, boolean_t *isv6, int ifindex,
1934     mblk_t *first_mp, ipsq_func_t func, ill_t **illpp, ipif_t **ipifpp)
1935 {
1936 	boolean_t src_unspec;
1937 	ill_t *ill = NULL;
1938 	ipif_t *ipif = NULL;
1939 	int err;
1940 	zoneid_t zoneid = connp->conn_zoneid;
1941 	queue_t *wq = CONNP_TO_WQ(connp);
1942 	ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
1943 
1944 	src_unspec = IN6_IS_ADDR_UNSPECIFIED(v6src);
1945 
1946 	if (IN6_IS_ADDR_V4MAPPED(v6group)) {
1947 		if (!IN6_IS_ADDR_V4MAPPED(v6src) && !src_unspec)
1948 			return (EINVAL);
1949 		IN6_V4MAPPED_TO_IPADDR(v6group, *v4group);
1950 		if (src_unspec) {
1951 			*v4src = INADDR_ANY;
1952 		} else {
1953 			IN6_V4MAPPED_TO_IPADDR(v6src, *v4src);
1954 		}
1955 		if (!CLASSD(*v4group) || CLASSD(*v4src))
1956 			return (EINVAL);
1957 		*ipifpp = NULL;
1958 		*isv6 = B_FALSE;
1959 	} else {
1960 		if (IN6_IS_ADDR_V4MAPPED(v6src) && !src_unspec)
1961 			return (EINVAL);
1962 		if (!IN6_IS_ADDR_MULTICAST(v6group) ||
1963 		    IN6_IS_ADDR_MULTICAST(v6src)) {
1964 			return (EINVAL);
1965 		}
1966 		*illpp = NULL;
1967 		*isv6 = B_TRUE;
1968 	}
1969 
1970 	if (ifindex == 0) {
1971 		if (*isv6)
1972 			ill = ill_lookup_group_v6(v6group, zoneid, ipst);
1973 		else
1974 			ipif = ipif_lookup_group(*v4group, zoneid, ipst);
1975 		if (ill == NULL && ipif == NULL)
1976 			return (EADDRNOTAVAIL);
1977 	} else {
1978 		if (*isv6) {
1979 			ill = ill_lookup_on_ifindex(ifindex, B_TRUE,
1980 			    wq, first_mp, func, &err, ipst);
1981 			if (ill != NULL &&
1982 			    !ipif_lookup_zoneid(ill, zoneid, 0, NULL)) {
1983 				ill_refrele(ill);
1984 				ill = NULL;
1985 				err = EADDRNOTAVAIL;
1986 			}
1987 		} else {
1988 			ipif = ipif_lookup_on_ifindex(ifindex, B_FALSE,
1989 			    zoneid, wq, first_mp, func, &err, ipst);
1990 		}
1991 		if (ill == NULL && ipif == NULL)
1992 			return (err);
1993 	}
1994 
1995 	*ipifpp = ipif;
1996 	*illpp = ill;
1997 	return (0);
1998 }
1999 
2000 static int
2001 ip_get_srcfilter(conn_t *connp, struct group_filter *gf,
2002     struct ip_msfilter *imsf, ipaddr_t grp, ipif_t *ipif, boolean_t isv4mapped)
2003 {
2004 	ilg_t *ilg;
2005 	int i, numsrc, fmode, outsrcs;
2006 	struct sockaddr_in *sin;
2007 	struct sockaddr_in6 *sin6;
2008 	struct in_addr *addrp;
2009 	slist_t *fp;
2010 	boolean_t is_v4only_api;
2011 
2012 	mutex_enter(&connp->conn_lock);
2013 
2014 	ilg = ilg_lookup_ipif(connp, grp, ipif);
2015 	if (ilg == NULL) {
2016 		mutex_exit(&connp->conn_lock);
2017 		return (EADDRNOTAVAIL);
2018 	}
2019 
2020 	if (gf == NULL) {
2021 		ASSERT(imsf != NULL);
2022 		ASSERT(!isv4mapped);
2023 		is_v4only_api = B_TRUE;
2024 		outsrcs = imsf->imsf_numsrc;
2025 	} else {
2026 		ASSERT(imsf == NULL);
2027 		is_v4only_api = B_FALSE;
2028 		outsrcs = gf->gf_numsrc;
2029 	}
2030 
2031 	/*
2032 	 * In the kernel, we use the state definitions MODE_IS_[IN|EX]CLUDE
2033 	 * to identify the filter mode; but the API uses MCAST_[IN|EX]CLUDE.
2034 	 * So we need to translate here.
2035 	 */
2036 	fmode = (ilg->ilg_fmode == MODE_IS_INCLUDE) ?
2037 	    MCAST_INCLUDE : MCAST_EXCLUDE;
2038 	if ((fp = ilg->ilg_filter) == NULL) {
2039 		numsrc = 0;
2040 	} else {
2041 		for (i = 0; i < outsrcs; i++) {
2042 			if (i == fp->sl_numsrc)
2043 				break;
2044 			if (isv4mapped) {
2045 				sin6 = (struct sockaddr_in6 *)&gf->gf_slist[i];
2046 				sin6->sin6_family = AF_INET6;
2047 				sin6->sin6_addr = fp->sl_addr[i];
2048 			} else {
2049 				if (is_v4only_api) {
2050 					addrp = &imsf->imsf_slist[i];
2051 				} else {
2052 					sin = (struct sockaddr_in *)
2053 					    &gf->gf_slist[i];
2054 					sin->sin_family = AF_INET;
2055 					addrp = &sin->sin_addr;
2056 				}
2057 				IN6_V4MAPPED_TO_INADDR(&fp->sl_addr[i], addrp);
2058 			}
2059 		}
2060 		numsrc = fp->sl_numsrc;
2061 	}
2062 
2063 	if (is_v4only_api) {
2064 		imsf->imsf_numsrc = numsrc;
2065 		imsf->imsf_fmode = fmode;
2066 	} else {
2067 		gf->gf_numsrc = numsrc;
2068 		gf->gf_fmode = fmode;
2069 	}
2070 
2071 	mutex_exit(&connp->conn_lock);
2072 
2073 	return (0);
2074 }
2075 
2076 static int
2077 ip_get_srcfilter_v6(conn_t *connp, struct group_filter *gf,
2078     const struct in6_addr *grp, ill_t *ill)
2079 {
2080 	ilg_t *ilg;
2081 	int i;
2082 	struct sockaddr_storage *sl;
2083 	struct sockaddr_in6 *sin6;
2084 	slist_t *fp;
2085 
2086 	mutex_enter(&connp->conn_lock);
2087 
2088 	ilg = ilg_lookup_ill_v6(connp, grp, ill);
2089 	if (ilg == NULL) {
2090 		mutex_exit(&connp->conn_lock);
2091 		return (EADDRNOTAVAIL);
2092 	}
2093 
2094 	/*
2095 	 * In the kernel, we use the state definitions MODE_IS_[IN|EX]CLUDE
2096 	 * to identify the filter mode; but the API uses MCAST_[IN|EX]CLUDE.
2097 	 * So we need to translate here.
2098 	 */
2099 	gf->gf_fmode = (ilg->ilg_fmode == MODE_IS_INCLUDE) ?
2100 	    MCAST_INCLUDE : MCAST_EXCLUDE;
2101 	if ((fp = ilg->ilg_filter) == NULL) {
2102 		gf->gf_numsrc = 0;
2103 	} else {
2104 		for (i = 0, sl = gf->gf_slist; i < gf->gf_numsrc; i++, sl++) {
2105 			if (i == fp->sl_numsrc)
2106 				break;
2107 			sin6 = (struct sockaddr_in6 *)sl;
2108 			sin6->sin6_family = AF_INET6;
2109 			sin6->sin6_addr = fp->sl_addr[i];
2110 		}
2111 		gf->gf_numsrc = fp->sl_numsrc;
2112 	}
2113 
2114 	mutex_exit(&connp->conn_lock);
2115 
2116 	return (0);
2117 }
2118 
2119 static int
2120 ip_set_srcfilter(conn_t *connp, struct group_filter *gf,
2121     struct ip_msfilter *imsf, ipaddr_t grp, ipif_t *ipif, boolean_t isv4mapped)
2122 {
2123 	ilg_t *ilg;
2124 	int i, err, infmode, new_fmode;
2125 	uint_t insrcs;
2126 	struct sockaddr_in *sin;
2127 	struct sockaddr_in6 *sin6;
2128 	struct in_addr *addrp;
2129 	slist_t *orig_filter = NULL;
2130 	slist_t *new_filter = NULL;
2131 	mcast_record_t orig_fmode;
2132 	boolean_t leave_grp, is_v4only_api;
2133 	ilg_stat_t ilgstat;
2134 
2135 	if (gf == NULL) {
2136 		ASSERT(imsf != NULL);
2137 		ASSERT(!isv4mapped);
2138 		is_v4only_api = B_TRUE;
2139 		insrcs = imsf->imsf_numsrc;
2140 		infmode = imsf->imsf_fmode;
2141 	} else {
2142 		ASSERT(imsf == NULL);
2143 		is_v4only_api = B_FALSE;
2144 		insrcs = gf->gf_numsrc;
2145 		infmode = gf->gf_fmode;
2146 	}
2147 
2148 	/* Make sure we can handle the source list */
2149 	if (insrcs > MAX_FILTER_SIZE)
2150 		return (ENOBUFS);
2151 
2152 	/*
2153 	 * setting the filter to (INCLUDE, NULL) is treated
2154 	 * as a request to leave the group.
2155 	 */
2156 	leave_grp = (infmode == MCAST_INCLUDE && insrcs == 0);
2157 
2158 	ASSERT(IAM_WRITER_IPIF(ipif));
2159 
2160 	mutex_enter(&connp->conn_lock);
2161 
2162 	ilg = ilg_lookup_ipif(connp, grp, ipif);
2163 	if (ilg == NULL) {
2164 		/*
2165 		 * if the request was actually to leave, and we
2166 		 * didn't find an ilg, there's nothing to do.
2167 		 */
2168 		if (!leave_grp)
2169 			ilg = conn_ilg_alloc(connp);
2170 		if (leave_grp || ilg == NULL) {
2171 			mutex_exit(&connp->conn_lock);
2172 			return (leave_grp ? 0 : ENOMEM);
2173 		}
2174 		ilgstat = ILGSTAT_NEW;
2175 		IN6_IPADDR_TO_V4MAPPED(grp, &ilg->ilg_v6group);
2176 		ilg->ilg_ipif = ipif;
2177 		ilg->ilg_ill = NULL;
2178 		ilg->ilg_orig_ifindex = 0;
2179 	} else if (leave_grp) {
2180 		ilg_delete(connp, ilg, NULL);
2181 		mutex_exit(&connp->conn_lock);
2182 		(void) ip_delmulti(grp, ipif, B_FALSE, B_TRUE);
2183 		return (0);
2184 	} else {
2185 		ilgstat = ILGSTAT_CHANGE;
2186 		/* Preserve existing state in case ip_addmulti() fails */
2187 		orig_fmode = ilg->ilg_fmode;
2188 		if (ilg->ilg_filter == NULL) {
2189 			orig_filter = NULL;
2190 		} else {
2191 			orig_filter = l_alloc_copy(ilg->ilg_filter);
2192 			if (orig_filter == NULL) {
2193 				mutex_exit(&connp->conn_lock);
2194 				return (ENOMEM);
2195 			}
2196 		}
2197 	}
2198 
2199 	/*
2200 	 * Alloc buffer to copy new state into (see below) before
2201 	 * we make any changes, so we can bail if it fails.
2202 	 */
2203 	if ((new_filter = l_alloc()) == NULL) {
2204 		mutex_exit(&connp->conn_lock);
2205 		err = ENOMEM;
2206 		goto free_and_exit;
2207 	}
2208 
2209 	if (insrcs == 0) {
2210 		CLEAR_SLIST(ilg->ilg_filter);
2211 	} else {
2212 		slist_t *fp;
2213 		if (ilg->ilg_filter == NULL) {
2214 			fp = l_alloc();
2215 			if (fp == NULL) {
2216 				if (ilgstat == ILGSTAT_NEW)
2217 					ilg_delete(connp, ilg, NULL);
2218 				mutex_exit(&connp->conn_lock);
2219 				err = ENOMEM;
2220 				goto free_and_exit;
2221 			}
2222 		} else {
2223 			fp = ilg->ilg_filter;
2224 		}
2225 		for (i = 0; i < insrcs; i++) {
2226 			if (isv4mapped) {
2227 				sin6 = (struct sockaddr_in6 *)&gf->gf_slist[i];
2228 				fp->sl_addr[i] = sin6->sin6_addr;
2229 			} else {
2230 				if (is_v4only_api) {
2231 					addrp = &imsf->imsf_slist[i];
2232 				} else {
2233 					sin = (struct sockaddr_in *)
2234 					    &gf->gf_slist[i];
2235 					addrp = &sin->sin_addr;
2236 				}
2237 				IN6_INADDR_TO_V4MAPPED(addrp, &fp->sl_addr[i]);
2238 			}
2239 		}
2240 		fp->sl_numsrc = insrcs;
2241 		ilg->ilg_filter = fp;
2242 	}
2243 	/*
2244 	 * In the kernel, we use the state definitions MODE_IS_[IN|EX]CLUDE
2245 	 * to identify the filter mode; but the API uses MCAST_[IN|EX]CLUDE.
2246 	 * So we need to translate here.
2247 	 */
2248 	ilg->ilg_fmode = (infmode == MCAST_INCLUDE) ?
2249 	    MODE_IS_INCLUDE : MODE_IS_EXCLUDE;
2250 
2251 	/*
2252 	 * Save copy of ilg's filter state to pass to other functions,
2253 	 * so we can release conn_lock now.
2254 	 */
2255 	new_fmode = ilg->ilg_fmode;
2256 	l_copy(ilg->ilg_filter, new_filter);
2257 
2258 	mutex_exit(&connp->conn_lock);
2259 
2260 	err = ip_addmulti(grp, ipif, ilgstat, new_fmode, new_filter);
2261 	if (err != 0) {
2262 		/*
2263 		 * Restore the original filter state, or delete the
2264 		 * newly-created ilg.  We need to look up the ilg
2265 		 * again, though, since we've not been holding the
2266 		 * conn_lock.
2267 		 */
2268 		mutex_enter(&connp->conn_lock);
2269 		ilg = ilg_lookup_ipif(connp, grp, ipif);
2270 		ASSERT(ilg != NULL);
2271 		if (ilgstat == ILGSTAT_NEW) {
2272 			ilg_delete(connp, ilg, NULL);
2273 		} else {
2274 			ilg->ilg_fmode = orig_fmode;
2275 			if (SLIST_IS_EMPTY(orig_filter)) {
2276 				CLEAR_SLIST(ilg->ilg_filter);
2277 			} else {
2278 				/*
2279 				 * We didn't free the filter, even if we
2280 				 * were trying to make the source list empty;
2281 				 * so if orig_filter isn't empty, the ilg
2282 				 * must still have a filter alloc'd.
2283 				 */
2284 				l_copy(orig_filter, ilg->ilg_filter);
2285 			}
2286 		}
2287 		mutex_exit(&connp->conn_lock);
2288 	}
2289 
2290 free_and_exit:
2291 	l_free(orig_filter);
2292 	l_free(new_filter);
2293 
2294 	return (err);
2295 }
2296 
2297 static int
2298 ip_set_srcfilter_v6(conn_t *connp, struct group_filter *gf,
2299     const struct in6_addr *grp, ill_t *ill)
2300 {
2301 	ilg_t *ilg;
2302 	int i, orig_ifindex, orig_fmode, new_fmode, err;
2303 	slist_t *orig_filter = NULL;
2304 	slist_t *new_filter = NULL;
2305 	struct sockaddr_storage *sl;
2306 	struct sockaddr_in6 *sin6;
2307 	boolean_t leave_grp;
2308 	ilg_stat_t ilgstat;
2309 
2310 	/* Make sure we can handle the source list */
2311 	if (gf->gf_numsrc > MAX_FILTER_SIZE)
2312 		return (ENOBUFS);
2313 
2314 	/*
2315 	 * setting the filter to (INCLUDE, NULL) is treated
2316 	 * as a request to leave the group.
2317 	 */
2318 	leave_grp = (gf->gf_fmode == MCAST_INCLUDE && gf->gf_numsrc == 0);
2319 
2320 	ASSERT(IAM_WRITER_ILL(ill));
2321 
2322 	/*
2323 	 * Use the ifindex to do the lookup.  We can't use the ill
2324 	 * directly because ilg_ill could point to a different ill
2325 	 * if things have moved.
2326 	 */
2327 	orig_ifindex = ill->ill_phyint->phyint_ifindex;
2328 
2329 	mutex_enter(&connp->conn_lock);
2330 	ilg = ilg_lookup_ill_index_v6(connp, grp, orig_ifindex);
2331 	if (ilg == NULL) {
2332 		/*
2333 		 * if the request was actually to leave, and we
2334 		 * didn't find an ilg, there's nothing to do.
2335 		 */
2336 		if (!leave_grp)
2337 			ilg = conn_ilg_alloc(connp);
2338 		if (leave_grp || ilg == NULL) {
2339 			mutex_exit(&connp->conn_lock);
2340 			return (leave_grp ? 0 : ENOMEM);
2341 		}
2342 		ilgstat = ILGSTAT_NEW;
2343 		ilg->ilg_v6group = *grp;
2344 		ilg->ilg_ipif = NULL;
2345 		/*
2346 		 * Choose our target ill to join on. This might be
2347 		 * different from the ill we've been given if it's
2348 		 * currently down and part of a group.
2349 		 *
2350 		 * new ill is not refheld; we are writer.
2351 		 */
2352 		ill = ip_choose_multi_ill(ill, grp);
2353 		ASSERT(!(ill->ill_state_flags & ILL_CONDEMNED));
2354 		ilg->ilg_ill = ill;
2355 		/*
2356 		 * Remember the index that we joined on, so that we can
2357 		 * successfully delete them later on and also search for
2358 		 * duplicates if the application wants to join again.
2359 		 */
2360 		ilg->ilg_orig_ifindex = orig_ifindex;
2361 	} else if (leave_grp) {
2362 		/*
2363 		 * Use the ilg's current ill for the deletion,
2364 		 * we might have failed over.
2365 		 */
2366 		ill = ilg->ilg_ill;
2367 		ilg_delete(connp, ilg, NULL);
2368 		mutex_exit(&connp->conn_lock);
2369 		(void) ip_delmulti_v6(grp, ill, orig_ifindex,
2370 		    connp->conn_zoneid, B_FALSE, B_TRUE);
2371 		return (0);
2372 	} else {
2373 		ilgstat = ILGSTAT_CHANGE;
2374 		/*
2375 		 * The current ill might be different from the one we were
2376 		 * asked to join on (if failover has occurred); we should
2377 		 * join on the ill stored in the ilg.  The original ill
2378 		 * is noted in ilg_orig_ifindex, which matched our request.
2379 		 */
2380 		ill = ilg->ilg_ill;
2381 		/* preserve existing state in case ip_addmulti() fails */
2382 		orig_fmode = ilg->ilg_fmode;
2383 		if (ilg->ilg_filter == NULL) {
2384 			orig_filter = NULL;
2385 		} else {
2386 			orig_filter = l_alloc_copy(ilg->ilg_filter);
2387 			if (orig_filter == NULL) {
2388 				mutex_exit(&connp->conn_lock);
2389 				return (ENOMEM);
2390 			}
2391 		}
2392 	}
2393 
2394 	/*
2395 	 * Alloc buffer to copy new state into (see below) before
2396 	 * we make any changes, so we can bail if it fails.
2397 	 */
2398 	if ((new_filter = l_alloc()) == NULL) {
2399 		mutex_exit(&connp->conn_lock);
2400 		err = ENOMEM;
2401 		goto free_and_exit;
2402 	}
2403 
2404 	if (gf->gf_numsrc == 0) {
2405 		CLEAR_SLIST(ilg->ilg_filter);
2406 	} else {
2407 		slist_t *fp;
2408 		if (ilg->ilg_filter == NULL) {
2409 			fp = l_alloc();
2410 			if (fp == NULL) {
2411 				if (ilgstat == ILGSTAT_NEW)
2412 					ilg_delete(connp, ilg, NULL);
2413 				mutex_exit(&connp->conn_lock);
2414 				err = ENOMEM;
2415 				goto free_and_exit;
2416 			}
2417 		} else {
2418 			fp = ilg->ilg_filter;
2419 		}
2420 		for (i = 0, sl = gf->gf_slist; i < gf->gf_numsrc; i++, sl++) {
2421 			sin6 = (struct sockaddr_in6 *)sl;
2422 			fp->sl_addr[i] = sin6->sin6_addr;
2423 		}
2424 		fp->sl_numsrc = gf->gf_numsrc;
2425 		ilg->ilg_filter = fp;
2426 	}
2427 	/*
2428 	 * In the kernel, we use the state definitions MODE_IS_[IN|EX]CLUDE
2429 	 * to identify the filter mode; but the API uses MCAST_[IN|EX]CLUDE.
2430 	 * So we need to translate here.
2431 	 */
2432 	ilg->ilg_fmode = (gf->gf_fmode == MCAST_INCLUDE) ?
2433 	    MODE_IS_INCLUDE : MODE_IS_EXCLUDE;
2434 
2435 	/*
2436 	 * Save copy of ilg's filter state to pass to other functions,
2437 	 * so we can release conn_lock now.
2438 	 */
2439 	new_fmode = ilg->ilg_fmode;
2440 	l_copy(ilg->ilg_filter, new_filter);
2441 
2442 	mutex_exit(&connp->conn_lock);
2443 
2444 	err = ip_addmulti_v6(grp, ill, orig_ifindex, connp->conn_zoneid,
2445 	    ilgstat, new_fmode, new_filter);
2446 	if (err != 0) {
2447 		/*
2448 		 * Restore the original filter state, or delete the
2449 		 * newly-created ilg.  We need to look up the ilg
2450 		 * again, though, since we've not been holding the
2451 		 * conn_lock.
2452 		 */
2453 		mutex_enter(&connp->conn_lock);
2454 		ilg = ilg_lookup_ill_index_v6(connp, grp, orig_ifindex);
2455 		ASSERT(ilg != NULL);
2456 		if (ilgstat == ILGSTAT_NEW) {
2457 			ilg_delete(connp, ilg, NULL);
2458 		} else {
2459 			ilg->ilg_fmode = orig_fmode;
2460 			if (SLIST_IS_EMPTY(orig_filter)) {
2461 				CLEAR_SLIST(ilg->ilg_filter);
2462 			} else {
2463 				/*
2464 				 * We didn't free the filter, even if we
2465 				 * were trying to make the source list empty;
2466 				 * so if orig_filter isn't empty, the ilg
2467 				 * must still have a filter alloc'd.
2468 				 */
2469 				l_copy(orig_filter, ilg->ilg_filter);
2470 			}
2471 		}
2472 		mutex_exit(&connp->conn_lock);
2473 	}
2474 
2475 free_and_exit:
2476 	l_free(orig_filter);
2477 	l_free(new_filter);
2478 
2479 	return (err);
2480 }
2481 
2482 /*
2483  * Process the SIOC[GS]MSFILTER and SIOC[GS]IPMSFILTER ioctls.
2484  */
2485 /* ARGSUSED */
2486 int
2487 ip_sioctl_msfilter(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
2488     ip_ioctl_cmd_t *ipip, void *ifreq)
2489 {
2490 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
2491 	/* existence verified in ip_wput_nondata() */
2492 	mblk_t *data_mp = mp->b_cont->b_cont;
2493 	int datalen, err, cmd, minsize;
2494 	uint_t expsize = 0;
2495 	conn_t *connp;
2496 	boolean_t isv6, is_v4only_api, getcmd;
2497 	struct sockaddr_in *gsin;
2498 	struct sockaddr_in6 *gsin6;
2499 	ipaddr_t v4grp;
2500 	in6_addr_t v6grp;
2501 	struct group_filter *gf = NULL;
2502 	struct ip_msfilter *imsf = NULL;
2503 	mblk_t *ndp;
2504 
2505 	if (data_mp->b_cont != NULL) {
2506 		if ((ndp = msgpullup(data_mp, -1)) == NULL)
2507 			return (ENOMEM);
2508 		freemsg(data_mp);
2509 		data_mp = ndp;
2510 		mp->b_cont->b_cont = data_mp;
2511 	}
2512 
2513 	cmd = iocp->ioc_cmd;
2514 	getcmd = (cmd == SIOCGIPMSFILTER || cmd == SIOCGMSFILTER);
2515 	is_v4only_api = (cmd == SIOCGIPMSFILTER || cmd == SIOCSIPMSFILTER);
2516 	minsize = (is_v4only_api) ? IP_MSFILTER_SIZE(0) : GROUP_FILTER_SIZE(0);
2517 	datalen = MBLKL(data_mp);
2518 
2519 	if (datalen < minsize)
2520 		return (EINVAL);
2521 
2522 	/*
2523 	 * now we know we have at least have the initial structure,
2524 	 * but need to check for the source list array.
2525 	 */
2526 	if (is_v4only_api) {
2527 		imsf = (struct ip_msfilter *)data_mp->b_rptr;
2528 		isv6 = B_FALSE;
2529 		expsize = IP_MSFILTER_SIZE(imsf->imsf_numsrc);
2530 	} else {
2531 		gf = (struct group_filter *)data_mp->b_rptr;
2532 		if (gf->gf_group.ss_family == AF_INET6) {
2533 			gsin6 = (struct sockaddr_in6 *)&gf->gf_group;
2534 			isv6 = !(IN6_IS_ADDR_V4MAPPED(&gsin6->sin6_addr));
2535 		} else {
2536 			isv6 = B_FALSE;
2537 		}
2538 		expsize = GROUP_FILTER_SIZE(gf->gf_numsrc);
2539 	}
2540 	if (datalen < expsize)
2541 		return (EINVAL);
2542 
2543 	connp = Q_TO_CONN(q);
2544 
2545 	/* operation not supported on the virtual network interface */
2546 	if (IS_VNI(ipif->ipif_ill))
2547 		return (EINVAL);
2548 
2549 	if (isv6) {
2550 		ill_t *ill = ipif->ipif_ill;
2551 		ill_refhold(ill);
2552 
2553 		gsin6 = (struct sockaddr_in6 *)&gf->gf_group;
2554 		v6grp = gsin6->sin6_addr;
2555 		if (getcmd)
2556 			err = ip_get_srcfilter_v6(connp, gf, &v6grp, ill);
2557 		else
2558 			err = ip_set_srcfilter_v6(connp, gf, &v6grp, ill);
2559 
2560 		ill_refrele(ill);
2561 	} else {
2562 		boolean_t isv4mapped = B_FALSE;
2563 		if (is_v4only_api) {
2564 			v4grp = (ipaddr_t)imsf->imsf_multiaddr.s_addr;
2565 		} else {
2566 			if (gf->gf_group.ss_family == AF_INET) {
2567 				gsin = (struct sockaddr_in *)&gf->gf_group;
2568 				v4grp = (ipaddr_t)gsin->sin_addr.s_addr;
2569 			} else {
2570 				gsin6 = (struct sockaddr_in6 *)&gf->gf_group;
2571 				IN6_V4MAPPED_TO_IPADDR(&gsin6->sin6_addr,
2572 				    v4grp);
2573 				isv4mapped = B_TRUE;
2574 			}
2575 		}
2576 		if (getcmd)
2577 			err = ip_get_srcfilter(connp, gf, imsf, v4grp, ipif,
2578 			    isv4mapped);
2579 		else
2580 			err = ip_set_srcfilter(connp, gf, imsf, v4grp, ipif,
2581 			    isv4mapped);
2582 	}
2583 
2584 	return (err);
2585 }
2586 
2587 /*
2588  * Finds the ipif based on information in the ioctl headers.  Needed to make
2589  * ip_process_ioctl() happy (it needs to know the ipif for IPI_WR-flagged
2590  * ioctls prior to calling the ioctl's handler function).
2591  */
2592 int
2593 ip_extract_msfilter(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
2594     cmd_info_t *ci, ipsq_func_t func)
2595 {
2596 	int cmd = ipip->ipi_cmd;
2597 	int err = 0;
2598 	conn_t *connp;
2599 	ipif_t *ipif;
2600 	/* caller has verified this mblk exists */
2601 	char *dbuf = (char *)mp->b_cont->b_cont->b_rptr;
2602 	struct ip_msfilter *imsf;
2603 	struct group_filter *gf;
2604 	ipaddr_t v4addr, v4grp;
2605 	in6_addr_t v6grp;
2606 	uint32_t index;
2607 	zoneid_t zoneid;
2608 	ip_stack_t *ipst;
2609 
2610 	connp = Q_TO_CONN(q);
2611 	zoneid = connp->conn_zoneid;
2612 	ipst = connp->conn_netstack->netstack_ip;
2613 
2614 	/* don't allow multicast operations on a tcp conn */
2615 	if (IPCL_IS_TCP(connp))
2616 		return (ENOPROTOOPT);
2617 
2618 	if (cmd == SIOCSIPMSFILTER || cmd == SIOCGIPMSFILTER) {
2619 		/* don't allow v4-specific ioctls on v6 socket */
2620 		if (connp->conn_af_isv6)
2621 			return (EAFNOSUPPORT);
2622 
2623 		imsf = (struct ip_msfilter *)dbuf;
2624 		v4addr = imsf->imsf_interface.s_addr;
2625 		v4grp = imsf->imsf_multiaddr.s_addr;
2626 		if (v4addr == INADDR_ANY) {
2627 			ipif = ipif_lookup_group(v4grp, zoneid, ipst);
2628 			if (ipif == NULL)
2629 				err = EADDRNOTAVAIL;
2630 		} else {
2631 			ipif = ipif_lookup_addr(v4addr, NULL, zoneid, q, mp,
2632 			    func, &err, ipst);
2633 		}
2634 	} else {
2635 		boolean_t isv6 = B_FALSE;
2636 		gf = (struct group_filter *)dbuf;
2637 		index = gf->gf_interface;
2638 		if (gf->gf_group.ss_family == AF_INET6) {
2639 			struct sockaddr_in6 *sin6;
2640 			sin6 = (struct sockaddr_in6 *)&gf->gf_group;
2641 			v6grp = sin6->sin6_addr;
2642 			if (IN6_IS_ADDR_V4MAPPED(&v6grp))
2643 				IN6_V4MAPPED_TO_IPADDR(&v6grp, v4grp);
2644 			else
2645 				isv6 = B_TRUE;
2646 		} else if (gf->gf_group.ss_family == AF_INET) {
2647 			struct sockaddr_in *sin;
2648 			sin = (struct sockaddr_in *)&gf->gf_group;
2649 			v4grp = sin->sin_addr.s_addr;
2650 		} else {
2651 			return (EAFNOSUPPORT);
2652 		}
2653 		if (index == 0) {
2654 			if (isv6) {
2655 				ipif = ipif_lookup_group_v6(&v6grp, zoneid,
2656 				    ipst);
2657 			} else {
2658 				ipif = ipif_lookup_group(v4grp, zoneid, ipst);
2659 			}
2660 			if (ipif == NULL)
2661 				err = EADDRNOTAVAIL;
2662 		} else {
2663 			ipif = ipif_lookup_on_ifindex(index, isv6, zoneid,
2664 			    q, mp, func, &err, ipst);
2665 		}
2666 	}
2667 
2668 	ci->ci_ipif = ipif;
2669 	return (err);
2670 }
2671 
2672 /*
2673  * The structures used for the SIOC*MSFILTER ioctls usually must be copied
2674  * in in two stages, as the first copyin tells us the size of the attached
2675  * source buffer.  This function is called by ip_wput_nondata() after the
2676  * first copyin has completed; it figures out how big the second stage
2677  * needs to be, and kicks it off.
2678  *
2679  * In some cases (numsrc < 2), the second copyin is not needed as the
2680  * first one gets a complete structure containing 1 source addr.
2681  *
2682  * The function returns 0 if a second copyin has been started (i.e. there's
2683  * no more work to be done right now), or 1 if the second copyin is not
2684  * needed and ip_wput_nondata() can continue its processing.
2685  */
2686 int
2687 ip_copyin_msfilter(queue_t *q, mblk_t *mp)
2688 {
2689 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
2690 	int cmd = iocp->ioc_cmd;
2691 	/* validity of this checked in ip_wput_nondata() */
2692 	mblk_t *mp1 = mp->b_cont->b_cont;
2693 	int copysize = 0;
2694 	int offset;
2695 
2696 	if (cmd == SIOCSMSFILTER || cmd == SIOCGMSFILTER) {
2697 		struct group_filter *gf = (struct group_filter *)mp1->b_rptr;
2698 		if (gf->gf_numsrc >= 2) {
2699 			offset = sizeof (struct group_filter);
2700 			copysize = GROUP_FILTER_SIZE(gf->gf_numsrc) - offset;
2701 		}
2702 	} else {
2703 		struct ip_msfilter *imsf = (struct ip_msfilter *)mp1->b_rptr;
2704 		if (imsf->imsf_numsrc >= 2) {
2705 			offset = sizeof (struct ip_msfilter);
2706 			copysize = IP_MSFILTER_SIZE(imsf->imsf_numsrc) - offset;
2707 		}
2708 	}
2709 	if (copysize > 0) {
2710 		mi_copyin_n(q, mp, offset, copysize);
2711 		return (0);
2712 	}
2713 	return (1);
2714 }
2715 
2716 /*
2717  * Handle the following optmgmt:
2718  *	IP_ADD_MEMBERSHIP		must not have joined already
2719  *	MCAST_JOIN_GROUP		must not have joined already
2720  *	IP_BLOCK_SOURCE			must have joined already
2721  *	MCAST_BLOCK_SOURCE		must have joined already
2722  *	IP_JOIN_SOURCE_GROUP		may have joined already
2723  *	MCAST_JOIN_SOURCE_GROUP		may have joined already
2724  *
2725  * fmode and src parameters may be used to determine which option is
2726  * being set, as follows (the IP_* and MCAST_* versions of each option
2727  * are functionally equivalent):
2728  *	opt			fmode			src
2729  *	IP_ADD_MEMBERSHIP	MODE_IS_EXCLUDE		INADDR_ANY
2730  *	MCAST_JOIN_GROUP	MODE_IS_EXCLUDE		INADDR_ANY
2731  *	IP_BLOCK_SOURCE		MODE_IS_EXCLUDE		v4 addr
2732  *	MCAST_BLOCK_SOURCE	MODE_IS_EXCLUDE		v4 addr
2733  *	IP_JOIN_SOURCE_GROUP	MODE_IS_INCLUDE		v4 addr
2734  *	MCAST_JOIN_SOURCE_GROUP	MODE_IS_INCLUDE		v4 addr
2735  *
2736  * Changing the filter mode is not allowed; if a matching ilg already
2737  * exists and fmode != ilg->ilg_fmode, EINVAL is returned.
2738  *
2739  * Verifies that there is a source address of appropriate scope for
2740  * the group; if not, EADDRNOTAVAIL is returned.
2741  *
2742  * The interface to be used may be identified by an address or by an
2743  * index.  A pointer to the index is passed; if it is NULL, use the
2744  * address, otherwise, use the index.
2745  */
2746 int
2747 ip_opt_add_group(conn_t *connp, boolean_t checkonly, ipaddr_t group,
2748     ipaddr_t ifaddr, uint_t *ifindexp, mcast_record_t fmode, ipaddr_t src,
2749     mblk_t *first_mp)
2750 {
2751 	ipif_t	*ipif;
2752 	ipsq_t	*ipsq;
2753 	int err = 0;
2754 	ill_t	*ill;
2755 
2756 	err = ip_opt_check(connp, group, src, ifaddr, ifindexp, first_mp,
2757 	    ip_restart_optmgmt, &ipif);
2758 	if (err != 0) {
2759 		if (err != EINPROGRESS) {
2760 			ip1dbg(("ip_opt_add_group: no ipif for group 0x%x, "
2761 			    "ifaddr 0x%x, ifindex %d\n", ntohl(group),
2762 			    ntohl(ifaddr), (ifindexp == NULL) ? 0 : *ifindexp));
2763 		}
2764 		return (err);
2765 	}
2766 	ASSERT(ipif != NULL);
2767 
2768 	ill = ipif->ipif_ill;
2769 	/* Operation not supported on a virtual network interface */
2770 	if (IS_VNI(ill)) {
2771 		ipif_refrele(ipif);
2772 		return (EINVAL);
2773 	}
2774 
2775 	if (checkonly) {
2776 		/*
2777 		 * do not do operation, just pretend to - new T_CHECK
2778 		 * semantics. The error return case above if encountered
2779 		 * considered a good enough "check" here.
2780 		 */
2781 		ipif_refrele(ipif);
2782 		return (0);
2783 	}
2784 
2785 	IPSQ_ENTER_IPIF(ipif, connp, first_mp, ip_restart_optmgmt, ipsq,
2786 	    NEW_OP);
2787 
2788 	/* unspecified source addr => no source filtering */
2789 	err = ilg_add(connp, group, ipif, fmode, src);
2790 
2791 	IPSQ_EXIT(ipsq);
2792 
2793 	ipif_refrele(ipif);
2794 	return (err);
2795 }
2796 
2797 /*
2798  * Handle the following optmgmt:
2799  *	IPV6_JOIN_GROUP			must not have joined already
2800  *	MCAST_JOIN_GROUP		must not have joined already
2801  *	MCAST_BLOCK_SOURCE		must have joined already
2802  *	MCAST_JOIN_SOURCE_GROUP		may have joined already
2803  *
2804  * fmode and src parameters may be used to determine which option is
2805  * being set, as follows (IPV6_JOIN_GROUP and MCAST_JOIN_GROUP options
2806  * are functionally equivalent):
2807  *	opt			fmode			v6src
2808  *	IPV6_JOIN_GROUP		MODE_IS_EXCLUDE		unspecified
2809  *	MCAST_JOIN_GROUP	MODE_IS_EXCLUDE		unspecified
2810  *	MCAST_BLOCK_SOURCE	MODE_IS_EXCLUDE		v6 addr
2811  *	MCAST_JOIN_SOURCE_GROUP	MODE_IS_INCLUDE		v6 addr
2812  *
2813  * Changing the filter mode is not allowed; if a matching ilg already
2814  * exists and fmode != ilg->ilg_fmode, EINVAL is returned.
2815  *
2816  * Verifies that there is a source address of appropriate scope for
2817  * the group; if not, EADDRNOTAVAIL is returned.
2818  *
2819  * Handles IPv4-mapped IPv6 multicast addresses by associating them
2820  * with the link-local ipif.  Assumes that if v6group is v4-mapped,
2821  * v6src is also v4-mapped.
2822  */
2823 int
2824 ip_opt_add_group_v6(conn_t *connp, boolean_t checkonly,
2825     const in6_addr_t *v6group, int ifindex, mcast_record_t fmode,
2826     const in6_addr_t *v6src, mblk_t *first_mp)
2827 {
2828 	ill_t *ill;
2829 	ipif_t	*ipif;
2830 	char buf[INET6_ADDRSTRLEN];
2831 	ipaddr_t v4group, v4src;
2832 	boolean_t isv6;
2833 	ipsq_t	*ipsq;
2834 	int	err;
2835 
2836 	err = ip_opt_check_v6(connp, v6group, &v4group, v6src, &v4src, &isv6,
2837 	    ifindex, first_mp, ip_restart_optmgmt, &ill, &ipif);
2838 	if (err != 0) {
2839 		if (err != EINPROGRESS) {
2840 			ip1dbg(("ip_opt_add_group_v6: no ill for group %s/"
2841 			    "index %d\n", inet_ntop(AF_INET6, v6group, buf,
2842 			    sizeof (buf)), ifindex));
2843 		}
2844 		return (err);
2845 	}
2846 	ASSERT((!isv6 && ipif != NULL) || (isv6 && ill != NULL));
2847 
2848 	/* operation is not supported on the virtual network interface */
2849 	if (isv6) {
2850 		if (IS_VNI(ill)) {
2851 			ill_refrele(ill);
2852 			return (EINVAL);
2853 		}
2854 	} else {
2855 		if (IS_VNI(ipif->ipif_ill)) {
2856 			ipif_refrele(ipif);
2857 			return (EINVAL);
2858 		}
2859 	}
2860 
2861 	if (checkonly) {
2862 		/*
2863 		 * do not do operation, just pretend to - new T_CHECK
2864 		 * semantics. The error return case above if encountered
2865 		 * considered a good enough "check" here.
2866 		 */
2867 		if (isv6)
2868 			ill_refrele(ill);
2869 		else
2870 			ipif_refrele(ipif);
2871 		return (0);
2872 	}
2873 
2874 	if (!isv6) {
2875 		IPSQ_ENTER_IPIF(ipif, connp, first_mp, ip_restart_optmgmt,
2876 		    ipsq, NEW_OP);
2877 		err = ilg_add(connp, v4group, ipif, fmode, v4src);
2878 		IPSQ_EXIT(ipsq);
2879 		ipif_refrele(ipif);
2880 	} else {
2881 		IPSQ_ENTER_ILL(ill, connp, first_mp, ip_restart_optmgmt,
2882 		    ipsq, NEW_OP);
2883 		err = ilg_add_v6(connp, v6group, ill, fmode, v6src);
2884 		IPSQ_EXIT(ipsq);
2885 		ill_refrele(ill);
2886 	}
2887 
2888 	return (err);
2889 }
2890 
2891 static int
2892 ip_opt_delete_group_excl(conn_t *connp, ipaddr_t group, ipif_t *ipif,
2893     mcast_record_t fmode, ipaddr_t src)
2894 {
2895 	ilg_t	*ilg;
2896 	in6_addr_t v6src;
2897 	boolean_t leaving = B_FALSE;
2898 
2899 	ASSERT(IAM_WRITER_IPIF(ipif));
2900 
2901 	/*
2902 	 * The ilg is valid only while we hold the conn lock. Once we drop
2903 	 * the lock, another thread can locate another ilg on this connp,
2904 	 * but on a different ipif, and delete it, and cause the ilg array
2905 	 * to be reallocated and copied. Hence do the ilg_delete before
2906 	 * dropping the lock.
2907 	 */
2908 	mutex_enter(&connp->conn_lock);
2909 	ilg = ilg_lookup_ipif(connp, group, ipif);
2910 	if ((ilg == NULL) || (ilg->ilg_flags & ILG_DELETED)) {
2911 		mutex_exit(&connp->conn_lock);
2912 		return (EADDRNOTAVAIL);
2913 	}
2914 
2915 	/*
2916 	 * Decide if we're actually deleting the ilg or just removing a
2917 	 * source filter address; if just removing an addr, make sure we
2918 	 * aren't trying to change the filter mode, and that the addr is
2919 	 * actually in our filter list already.  If we're removing the
2920 	 * last src in an include list, just delete the ilg.
2921 	 */
2922 	if (src == INADDR_ANY) {
2923 		v6src = ipv6_all_zeros;
2924 		leaving = B_TRUE;
2925 	} else {
2926 		int err = 0;
2927 		IN6_IPADDR_TO_V4MAPPED(src, &v6src);
2928 		if (fmode != ilg->ilg_fmode)
2929 			err = EINVAL;
2930 		else if (ilg->ilg_filter == NULL ||
2931 		    !list_has_addr(ilg->ilg_filter, &v6src))
2932 			err = EADDRNOTAVAIL;
2933 		if (err != 0) {
2934 			mutex_exit(&connp->conn_lock);
2935 			return (err);
2936 		}
2937 		if (fmode == MODE_IS_INCLUDE &&
2938 		    ilg->ilg_filter->sl_numsrc == 1) {
2939 			v6src = ipv6_all_zeros;
2940 			leaving = B_TRUE;
2941 		}
2942 	}
2943 
2944 	ilg_delete(connp, ilg, &v6src);
2945 	mutex_exit(&connp->conn_lock);
2946 
2947 	(void) ip_delmulti(group, ipif, B_FALSE, leaving);
2948 	return (0);
2949 }
2950 
2951 static int
2952 ip_opt_delete_group_excl_v6(conn_t *connp, const in6_addr_t *v6group,
2953     ill_t *ill, mcast_record_t fmode, const in6_addr_t *v6src)
2954 {
2955 	ilg_t	*ilg;
2956 	ill_t	*ilg_ill;
2957 	uint_t	ilg_orig_ifindex;
2958 	boolean_t leaving = B_TRUE;
2959 
2960 	ASSERT(IAM_WRITER_ILL(ill));
2961 
2962 	/*
2963 	 * Use the index that we originally used to join. We can't
2964 	 * use the ill directly because ilg_ill could point to
2965 	 * a new ill if things have moved.
2966 	 */
2967 	mutex_enter(&connp->conn_lock);
2968 	ilg = ilg_lookup_ill_index_v6(connp, v6group,
2969 	    ill->ill_phyint->phyint_ifindex);
2970 	if ((ilg == NULL) || (ilg->ilg_flags & ILG_DELETED)) {
2971 		mutex_exit(&connp->conn_lock);
2972 		return (EADDRNOTAVAIL);
2973 	}
2974 
2975 	/*
2976 	 * Decide if we're actually deleting the ilg or just removing a
2977 	 * source filter address; if just removing an addr, make sure we
2978 	 * aren't trying to change the filter mode, and that the addr is
2979 	 * actually in our filter list already.  If we're removing the
2980 	 * last src in an include list, just delete the ilg.
2981 	 */
2982 	if (!IN6_IS_ADDR_UNSPECIFIED(v6src)) {
2983 		int err = 0;
2984 		if (fmode != ilg->ilg_fmode)
2985 			err = EINVAL;
2986 		else if (ilg->ilg_filter == NULL ||
2987 		    !list_has_addr(ilg->ilg_filter, v6src))
2988 			err = EADDRNOTAVAIL;
2989 		if (err != 0) {
2990 			mutex_exit(&connp->conn_lock);
2991 			return (err);
2992 		}
2993 		if (fmode == MODE_IS_INCLUDE &&
2994 		    ilg->ilg_filter->sl_numsrc == 1)
2995 			v6src = NULL;
2996 		else
2997 			leaving = B_FALSE;
2998 	}
2999 
3000 	ilg_ill = ilg->ilg_ill;
3001 	ilg_orig_ifindex = ilg->ilg_orig_ifindex;
3002 	ilg_delete(connp, ilg, v6src);
3003 	mutex_exit(&connp->conn_lock);
3004 	(void) ip_delmulti_v6(v6group, ilg_ill, ilg_orig_ifindex,
3005 	    connp->conn_zoneid, B_FALSE, leaving);
3006 
3007 	return (0);
3008 }
3009 
3010 /*
3011  * Handle the following optmgmt:
3012  *	IP_DROP_MEMBERSHIP		will leave
3013  *	MCAST_LEAVE_GROUP		will leave
3014  *	IP_UNBLOCK_SOURCE		will not leave
3015  *	MCAST_UNBLOCK_SOURCE		will not leave
3016  *	IP_LEAVE_SOURCE_GROUP		may leave (if leaving last source)
3017  *	MCAST_LEAVE_SOURCE_GROUP	may leave (if leaving last source)
3018  *
3019  * fmode and src parameters may be used to determine which option is
3020  * being set, as follows (the IP_* and MCAST_* versions of each option
3021  * are functionally equivalent):
3022  *	opt			 fmode			src
3023  *	IP_DROP_MEMBERSHIP	 MODE_IS_INCLUDE	INADDR_ANY
3024  *	MCAST_LEAVE_GROUP	 MODE_IS_INCLUDE	INADDR_ANY
3025  *	IP_UNBLOCK_SOURCE	 MODE_IS_EXCLUDE	v4 addr
3026  *	MCAST_UNBLOCK_SOURCE	 MODE_IS_EXCLUDE	v4 addr
3027  *	IP_LEAVE_SOURCE_GROUP	 MODE_IS_INCLUDE	v4 addr
3028  *	MCAST_LEAVE_SOURCE_GROUP MODE_IS_INCLUDE	v4 addr
3029  *
3030  * Changing the filter mode is not allowed; if a matching ilg already
3031  * exists and fmode != ilg->ilg_fmode, EINVAL is returned.
3032  *
3033  * The interface to be used may be identified by an address or by an
3034  * index.  A pointer to the index is passed; if it is NULL, use the
3035  * address, otherwise, use the index.
3036  */
3037 int
3038 ip_opt_delete_group(conn_t *connp, boolean_t checkonly, ipaddr_t group,
3039     ipaddr_t ifaddr, uint_t *ifindexp, mcast_record_t fmode, ipaddr_t src,
3040     mblk_t *first_mp)
3041 {
3042 	ipif_t	*ipif;
3043 	ipsq_t	*ipsq;
3044 	int	err;
3045 	ill_t	*ill;
3046 
3047 	err = ip_opt_check(connp, group, src, ifaddr, ifindexp, first_mp,
3048 	    ip_restart_optmgmt, &ipif);
3049 	if (err != 0) {
3050 		if (err != EINPROGRESS) {
3051 			ip1dbg(("ip_opt_delete_group: no ipif for group "
3052 			    "0x%x, ifaddr 0x%x\n",
3053 			    (int)ntohl(group), (int)ntohl(ifaddr)));
3054 		}
3055 		return (err);
3056 	}
3057 	ASSERT(ipif != NULL);
3058 
3059 	ill = ipif->ipif_ill;
3060 	/* Operation not supported on a virtual network interface */
3061 	if (IS_VNI(ill)) {
3062 		ipif_refrele(ipif);
3063 		return (EINVAL);
3064 	}
3065 
3066 	if (checkonly) {
3067 		/*
3068 		 * do not do operation, just pretend to - new T_CHECK
3069 		 * semantics. The error return case above if encountered
3070 		 * considered a good enough "check" here.
3071 		 */
3072 		ipif_refrele(ipif);
3073 		return (0);
3074 	}
3075 
3076 	IPSQ_ENTER_IPIF(ipif, connp, first_mp, ip_restart_optmgmt, ipsq,
3077 	    NEW_OP);
3078 	err = ip_opt_delete_group_excl(connp, group, ipif, fmode, src);
3079 	IPSQ_EXIT(ipsq);
3080 
3081 	ipif_refrele(ipif);
3082 	return (err);
3083 }
3084 
3085 /*
3086  * Handle the following optmgmt:
3087  *	IPV6_LEAVE_GROUP		will leave
3088  *	MCAST_LEAVE_GROUP		will leave
3089  *	MCAST_UNBLOCK_SOURCE		will not leave
3090  *	MCAST_LEAVE_SOURCE_GROUP	may leave (if leaving last source)
3091  *
3092  * fmode and src parameters may be used to determine which option is
3093  * being set, as follows (IPV6_LEAVE_GROUP and MCAST_LEAVE_GROUP options
3094  * are functionally equivalent):
3095  *	opt			 fmode			v6src
3096  *	IPV6_LEAVE_GROUP	 MODE_IS_INCLUDE	unspecified
3097  *	MCAST_LEAVE_GROUP	 MODE_IS_INCLUDE	unspecified
3098  *	MCAST_UNBLOCK_SOURCE	 MODE_IS_EXCLUDE	v6 addr
3099  *	MCAST_LEAVE_SOURCE_GROUP MODE_IS_INCLUDE	v6 addr
3100  *
3101  * Changing the filter mode is not allowed; if a matching ilg already
3102  * exists and fmode != ilg->ilg_fmode, EINVAL is returned.
3103  *
3104  * Handles IPv4-mapped IPv6 multicast addresses by associating them
3105  * with the link-local ipif.  Assumes that if v6group is v4-mapped,
3106  * v6src is also v4-mapped.
3107  */
3108 int
3109 ip_opt_delete_group_v6(conn_t *connp, boolean_t checkonly,
3110     const in6_addr_t *v6group, int ifindex, mcast_record_t fmode,
3111     const in6_addr_t *v6src, mblk_t *first_mp)
3112 {
3113 	ill_t *ill;
3114 	ipif_t	*ipif;
3115 	char	buf[INET6_ADDRSTRLEN];
3116 	ipaddr_t v4group, v4src;
3117 	boolean_t isv6;
3118 	ipsq_t	*ipsq;
3119 	int	err;
3120 
3121 	err = ip_opt_check_v6(connp, v6group, &v4group, v6src, &v4src, &isv6,
3122 	    ifindex, first_mp, ip_restart_optmgmt, &ill, &ipif);
3123 	if (err != 0) {
3124 		if (err != EINPROGRESS) {
3125 			ip1dbg(("ip_opt_delete_group_v6: no ill for group %s/"
3126 			    "index %d\n", inet_ntop(AF_INET6, v6group, buf,
3127 			    sizeof (buf)), ifindex));
3128 		}
3129 		return (err);
3130 	}
3131 	ASSERT((isv6 && ill != NULL) || (!isv6 && ipif != NULL));
3132 
3133 	/* operation is not supported on the virtual network interface */
3134 	if (isv6) {
3135 		if (IS_VNI(ill)) {
3136 			ill_refrele(ill);
3137 			return (EINVAL);
3138 		}
3139 	} else {
3140 		if (IS_VNI(ipif->ipif_ill)) {
3141 			ipif_refrele(ipif);
3142 			return (EINVAL);
3143 		}
3144 	}
3145 
3146 	if (checkonly) {
3147 		/*
3148 		 * do not do operation, just pretend to - new T_CHECK
3149 		 * semantics. The error return case above if encountered
3150 		 * considered a good enough "check" here.
3151 		 */
3152 		if (isv6)
3153 			ill_refrele(ill);
3154 		else
3155 			ipif_refrele(ipif);
3156 		return (0);
3157 	}
3158 
3159 	if (!isv6) {
3160 		IPSQ_ENTER_IPIF(ipif, connp, first_mp, ip_restart_optmgmt,
3161 		    ipsq, NEW_OP);
3162 		err = ip_opt_delete_group_excl(connp, v4group, ipif, fmode,
3163 		    v4src);
3164 		IPSQ_EXIT(ipsq);
3165 		ipif_refrele(ipif);
3166 	} else {
3167 		IPSQ_ENTER_ILL(ill, connp, first_mp, ip_restart_optmgmt,
3168 		    ipsq, NEW_OP);
3169 		err = ip_opt_delete_group_excl_v6(connp, v6group, ill, fmode,
3170 		    v6src);
3171 		IPSQ_EXIT(ipsq);
3172 		ill_refrele(ill);
3173 	}
3174 
3175 	return (err);
3176 }
3177 
3178 /*
3179  * Group mgmt for upper conn that passes things down
3180  * to the interface multicast list (and DLPI)
3181  * These routines can handle new style options that specify an interface name
3182  * as opposed to an interface address (needed for general handling of
3183  * unnumbered interfaces.)
3184  */
3185 
3186 /*
3187  * Add a group to an upper conn group data structure and pass things down
3188  * to the interface multicast list (and DLPI)
3189  */
3190 static int
3191 ilg_add(conn_t *connp, ipaddr_t group, ipif_t *ipif, mcast_record_t fmode,
3192     ipaddr_t src)
3193 {
3194 	int	error = 0;
3195 	ill_t	*ill;
3196 	ilg_t	*ilg;
3197 	ilg_stat_t ilgstat;
3198 	slist_t	*new_filter = NULL;
3199 	int	new_fmode;
3200 
3201 	ASSERT(IAM_WRITER_IPIF(ipif));
3202 
3203 	ill = ipif->ipif_ill;
3204 
3205 	if (!(ill->ill_flags & ILLF_MULTICAST))
3206 		return (EADDRNOTAVAIL);
3207 
3208 	/*
3209 	 * conn_ilg[] is protected by conn_lock. Need to hold the conn_lock
3210 	 * to walk the conn_ilg[] list in ilg_lookup_ipif(); also needed to
3211 	 * serialize 2 threads doing join (sock, group1, hme0:0) and
3212 	 * (sock, group2, hme1:0) where hme0 and hme1 map to different ipsqs,
3213 	 * but both operations happen on the same conn.
3214 	 */
3215 	mutex_enter(&connp->conn_lock);
3216 	ilg = ilg_lookup_ipif(connp, group, ipif);
3217 
3218 	/*
3219 	 * Depending on the option we're handling, may or may not be okay
3220 	 * if group has already been added.  Figure out our rules based
3221 	 * on fmode and src params.  Also make sure there's enough room
3222 	 * in the filter if we're adding a source to an existing filter.
3223 	 */
3224 	if (src == INADDR_ANY) {
3225 		/* we're joining for all sources, must not have joined */
3226 		if (ilg != NULL)
3227 			error = EADDRINUSE;
3228 	} else {
3229 		if (fmode == MODE_IS_EXCLUDE) {
3230 			/* (excl {addr}) => block source, must have joined */
3231 			if (ilg == NULL)
3232 				error = EADDRNOTAVAIL;
3233 		}
3234 		/* (incl {addr}) => join source, may have joined */
3235 
3236 		if (ilg != NULL &&
3237 		    SLIST_CNT(ilg->ilg_filter) == MAX_FILTER_SIZE)
3238 			error = ENOBUFS;
3239 	}
3240 	if (error != 0) {
3241 		mutex_exit(&connp->conn_lock);
3242 		return (error);
3243 	}
3244 
3245 	ASSERT(!(ipif->ipif_state_flags & IPIF_CONDEMNED));
3246 
3247 	/*
3248 	 * Alloc buffer to copy new state into (see below) before
3249 	 * we make any changes, so we can bail if it fails.
3250 	 */
3251 	if ((new_filter = l_alloc()) == NULL) {
3252 		mutex_exit(&connp->conn_lock);
3253 		return (ENOMEM);
3254 	}
3255 
3256 	if (ilg == NULL) {
3257 		ilgstat = ILGSTAT_NEW;
3258 		if ((ilg = conn_ilg_alloc(connp)) == NULL) {
3259 			mutex_exit(&connp->conn_lock);
3260 			l_free(new_filter);
3261 			return (ENOMEM);
3262 		}
3263 		if (src != INADDR_ANY) {
3264 			ilg->ilg_filter = l_alloc();
3265 			if (ilg->ilg_filter == NULL) {
3266 				ilg_delete(connp, ilg, NULL);
3267 				mutex_exit(&connp->conn_lock);
3268 				l_free(new_filter);
3269 				return (ENOMEM);
3270 			}
3271 			ilg->ilg_filter->sl_numsrc = 1;
3272 			IN6_IPADDR_TO_V4MAPPED(src,
3273 			    &ilg->ilg_filter->sl_addr[0]);
3274 		}
3275 		if (group == INADDR_ANY) {
3276 			ilg->ilg_v6group = ipv6_all_zeros;
3277 		} else {
3278 			IN6_IPADDR_TO_V4MAPPED(group, &ilg->ilg_v6group);
3279 		}
3280 		ilg->ilg_ipif = ipif;
3281 		ilg->ilg_ill = NULL;
3282 		ilg->ilg_orig_ifindex = 0;
3283 		ilg->ilg_fmode = fmode;
3284 	} else {
3285 		int index;
3286 		in6_addr_t v6src;
3287 		ilgstat = ILGSTAT_CHANGE;
3288 		if (ilg->ilg_fmode != fmode || src == INADDR_ANY) {
3289 			mutex_exit(&connp->conn_lock);
3290 			l_free(new_filter);
3291 			return (EINVAL);
3292 		}
3293 		if (ilg->ilg_filter == NULL) {
3294 			ilg->ilg_filter = l_alloc();
3295 			if (ilg->ilg_filter == NULL) {
3296 				mutex_exit(&connp->conn_lock);
3297 				l_free(new_filter);
3298 				return (ENOMEM);
3299 			}
3300 		}
3301 		IN6_IPADDR_TO_V4MAPPED(src, &v6src);
3302 		if (list_has_addr(ilg->ilg_filter, &v6src)) {
3303 			mutex_exit(&connp->conn_lock);
3304 			l_free(new_filter);
3305 			return (EADDRNOTAVAIL);
3306 		}
3307 		index = ilg->ilg_filter->sl_numsrc++;
3308 		ilg->ilg_filter->sl_addr[index] = v6src;
3309 	}
3310 
3311 	/*
3312 	 * Save copy of ilg's filter state to pass to other functions,
3313 	 * so we can release conn_lock now.
3314 	 */
3315 	new_fmode = ilg->ilg_fmode;
3316 	l_copy(ilg->ilg_filter, new_filter);
3317 
3318 	mutex_exit(&connp->conn_lock);
3319 
3320 	error = ip_addmulti(group, ipif, ilgstat, new_fmode, new_filter);
3321 	if (error != 0) {
3322 		/*
3323 		 * Need to undo what we did before calling ip_addmulti()!
3324 		 * Must look up the ilg again since we've not been holding
3325 		 * conn_lock.
3326 		 */
3327 		in6_addr_t v6src;
3328 		if (ilgstat == ILGSTAT_NEW)
3329 			v6src = ipv6_all_zeros;
3330 		else
3331 			IN6_IPADDR_TO_V4MAPPED(src, &v6src);
3332 		mutex_enter(&connp->conn_lock);
3333 		ilg = ilg_lookup_ipif(connp, group, ipif);
3334 		ASSERT(ilg != NULL);
3335 		ilg_delete(connp, ilg, &v6src);
3336 		mutex_exit(&connp->conn_lock);
3337 		l_free(new_filter);
3338 		return (error);
3339 	}
3340 
3341 	l_free(new_filter);
3342 	return (0);
3343 }
3344 
3345 static int
3346 ilg_add_v6(conn_t *connp, const in6_addr_t *v6group, ill_t *ill,
3347     mcast_record_t fmode, const in6_addr_t *v6src)
3348 {
3349 	int	error = 0;
3350 	int	orig_ifindex;
3351 	ilg_t	*ilg;
3352 	ilg_stat_t ilgstat;
3353 	slist_t	*new_filter = NULL;
3354 	int	new_fmode;
3355 
3356 	ASSERT(IAM_WRITER_ILL(ill));
3357 
3358 	if (!(ill->ill_flags & ILLF_MULTICAST))
3359 		return (EADDRNOTAVAIL);
3360 
3361 	/*
3362 	 * conn_lock protects the ilg list.  Serializes 2 threads doing
3363 	 * join (sock, group1, hme0) and (sock, group2, hme1) where hme0
3364 	 * and hme1 map to different ipsq's, but both operations happen
3365 	 * on the same conn.
3366 	 */
3367 	mutex_enter(&connp->conn_lock);
3368 
3369 	/*
3370 	 * Use the ifindex to do the lookup. We can't use the ill
3371 	 * directly because ilg_ill could point to a different ill if
3372 	 * things have moved.
3373 	 */
3374 	orig_ifindex = ill->ill_phyint->phyint_ifindex;
3375 	ilg = ilg_lookup_ill_index_v6(connp, v6group, orig_ifindex);
3376 
3377 	/*
3378 	 * Depending on the option we're handling, may or may not be okay
3379 	 * if group has already been added.  Figure out our rules based
3380 	 * on fmode and src params.  Also make sure there's enough room
3381 	 * in the filter if we're adding a source to an existing filter.
3382 	 */
3383 	if (IN6_IS_ADDR_UNSPECIFIED(v6src)) {
3384 		/* we're joining for all sources, must not have joined */
3385 		if (ilg != NULL)
3386 			error = EADDRINUSE;
3387 	} else {
3388 		if (fmode == MODE_IS_EXCLUDE) {
3389 			/* (excl {addr}) => block source, must have joined */
3390 			if (ilg == NULL)
3391 				error = EADDRNOTAVAIL;
3392 		}
3393 		/* (incl {addr}) => join source, may have joined */
3394 
3395 		if (ilg != NULL &&
3396 		    SLIST_CNT(ilg->ilg_filter) == MAX_FILTER_SIZE)
3397 			error = ENOBUFS;
3398 	}
3399 	if (error != 0) {
3400 		mutex_exit(&connp->conn_lock);
3401 		return (error);
3402 	}
3403 
3404 	/*
3405 	 * Alloc buffer to copy new state into (see below) before
3406 	 * we make any changes, so we can bail if it fails.
3407 	 */
3408 	if ((new_filter = l_alloc()) == NULL) {
3409 		mutex_exit(&connp->conn_lock);
3410 		return (ENOMEM);
3411 	}
3412 
3413 	if (ilg == NULL) {
3414 		if ((ilg = conn_ilg_alloc(connp)) == NULL) {
3415 			mutex_exit(&connp->conn_lock);
3416 			l_free(new_filter);
3417 			return (ENOMEM);
3418 		}
3419 		if (!IN6_IS_ADDR_UNSPECIFIED(v6src)) {
3420 			ilg->ilg_filter = l_alloc();
3421 			if (ilg->ilg_filter == NULL) {
3422 				ilg_delete(connp, ilg, NULL);
3423 				mutex_exit(&connp->conn_lock);
3424 				l_free(new_filter);
3425 				return (ENOMEM);
3426 			}
3427 			ilg->ilg_filter->sl_numsrc = 1;
3428 			ilg->ilg_filter->sl_addr[0] = *v6src;
3429 		}
3430 		ilgstat = ILGSTAT_NEW;
3431 		ilg->ilg_v6group = *v6group;
3432 		ilg->ilg_fmode = fmode;
3433 		ilg->ilg_ipif = NULL;
3434 		/*
3435 		 * Choose our target ill to join on. This might be different
3436 		 * from the ill we've been given if it's currently down and
3437 		 * part of a group.
3438 		 *
3439 		 * new ill is not refheld; we are writer.
3440 		 */
3441 		ill = ip_choose_multi_ill(ill, v6group);
3442 		ASSERT(!(ill->ill_state_flags & ILL_CONDEMNED));
3443 		ilg->ilg_ill = ill;
3444 		/*
3445 		 * Remember the orig_ifindex that we joined on, so that we
3446 		 * can successfully delete them later on and also search
3447 		 * for duplicates if the application wants to join again.
3448 		 */
3449 		ilg->ilg_orig_ifindex = orig_ifindex;
3450 	} else {
3451 		int index;
3452 		if (ilg->ilg_fmode != fmode || IN6_IS_ADDR_UNSPECIFIED(v6src)) {
3453 			mutex_exit(&connp->conn_lock);
3454 			l_free(new_filter);
3455 			return (EINVAL);
3456 		}
3457 		if (ilg->ilg_filter == NULL) {
3458 			ilg->ilg_filter = l_alloc();
3459 			if (ilg->ilg_filter == NULL) {
3460 				mutex_exit(&connp->conn_lock);
3461 				l_free(new_filter);
3462 				return (ENOMEM);
3463 			}
3464 		}
3465 		if (list_has_addr(ilg->ilg_filter, v6src)) {
3466 			mutex_exit(&connp->conn_lock);
3467 			l_free(new_filter);
3468 			return (EADDRNOTAVAIL);
3469 		}
3470 		ilgstat = ILGSTAT_CHANGE;
3471 		index = ilg->ilg_filter->sl_numsrc++;
3472 		ilg->ilg_filter->sl_addr[index] = *v6src;
3473 		/*
3474 		 * The current ill might be different from the one we were
3475 		 * asked to join on (if failover has occurred); we should
3476 		 * join on the ill stored in the ilg.  The original ill
3477 		 * is noted in ilg_orig_ifindex, which matched our request.
3478 		 */
3479 		ill = ilg->ilg_ill;
3480 	}
3481 
3482 	/*
3483 	 * Save copy of ilg's filter state to pass to other functions,
3484 	 * so we can release conn_lock now.
3485 	 */
3486 	new_fmode = ilg->ilg_fmode;
3487 	l_copy(ilg->ilg_filter, new_filter);
3488 
3489 	mutex_exit(&connp->conn_lock);
3490 
3491 	/*
3492 	 * Now update the ill. We wait to do this until after the ilg
3493 	 * has been updated because we need to update the src filter
3494 	 * info for the ill, which involves looking at the status of
3495 	 * all the ilgs associated with this group/interface pair.
3496 	 */
3497 	error = ip_addmulti_v6(v6group, ill, orig_ifindex, connp->conn_zoneid,
3498 	    ilgstat, new_fmode, new_filter);
3499 	if (error != 0) {
3500 		/*
3501 		 * But because we waited, we have to undo the ilg update
3502 		 * if ip_addmulti_v6() fails.  We also must lookup ilg
3503 		 * again, since we've not been holding conn_lock.
3504 		 */
3505 		in6_addr_t delsrc =
3506 		    (ilgstat == ILGSTAT_NEW) ? ipv6_all_zeros : *v6src;
3507 		mutex_enter(&connp->conn_lock);
3508 		ilg = ilg_lookup_ill_index_v6(connp, v6group, orig_ifindex);
3509 		ASSERT(ilg != NULL);
3510 		ilg_delete(connp, ilg, &delsrc);
3511 		mutex_exit(&connp->conn_lock);
3512 		l_free(new_filter);
3513 		return (error);
3514 	}
3515 
3516 	l_free(new_filter);
3517 
3518 	return (0);
3519 }
3520 
3521 /*
3522  * Find an IPv4 ilg matching group, ill and source
3523  */
3524 ilg_t *
3525 ilg_lookup_ill_withsrc(conn_t *connp, ipaddr_t group, ipaddr_t src, ill_t *ill)
3526 {
3527 	in6_addr_t v6group, v6src;
3528 	int i;
3529 	boolean_t isinlist;
3530 	ilg_t *ilg;
3531 	ipif_t *ipif;
3532 	ill_t *ilg_ill;
3533 
3534 	ASSERT(MUTEX_HELD(&connp->conn_lock));
3535 
3536 	/*
3537 	 * INADDR_ANY is represented as the IPv6 unspecified addr.
3538 	 */
3539 	if (group == INADDR_ANY)
3540 		v6group = ipv6_all_zeros;
3541 	else
3542 		IN6_IPADDR_TO_V4MAPPED(group, &v6group);
3543 
3544 	for (i = 0; i < connp->conn_ilg_inuse; i++) {
3545 		ilg = &connp->conn_ilg[i];
3546 		if ((ipif = ilg->ilg_ipif) == NULL ||
3547 		    (ilg->ilg_flags & ILG_DELETED) != 0)
3548 			continue;
3549 		ASSERT(ilg->ilg_ill == NULL);
3550 		ilg_ill = ipif->ipif_ill;
3551 		ASSERT(!ilg_ill->ill_isv6);
3552 		if (ilg_ill == ill &&
3553 		    IN6_ARE_ADDR_EQUAL(&ilg->ilg_v6group, &v6group)) {
3554 			if (SLIST_IS_EMPTY(ilg->ilg_filter)) {
3555 				/* no source filter, so this is a match */
3556 				return (ilg);
3557 			}
3558 			break;
3559 		}
3560 	}
3561 	if (i == connp->conn_ilg_inuse)
3562 		return (NULL);
3563 
3564 	/*
3565 	 * we have an ilg with matching ill and group; but
3566 	 * the ilg has a source list that we must check.
3567 	 */
3568 	IN6_IPADDR_TO_V4MAPPED(src, &v6src);
3569 	isinlist = B_FALSE;
3570 	for (i = 0; i < ilg->ilg_filter->sl_numsrc; i++) {
3571 		if (IN6_ARE_ADDR_EQUAL(&v6src, &ilg->ilg_filter->sl_addr[i])) {
3572 			isinlist = B_TRUE;
3573 			break;
3574 		}
3575 	}
3576 
3577 	if ((isinlist && ilg->ilg_fmode == MODE_IS_INCLUDE) ||
3578 	    (!isinlist && ilg->ilg_fmode == MODE_IS_EXCLUDE))
3579 		return (ilg);
3580 
3581 	return (NULL);
3582 }
3583 
3584 /*
3585  * Find an IPv6 ilg matching group, ill, and source
3586  */
3587 ilg_t *
3588 ilg_lookup_ill_withsrc_v6(conn_t *connp, const in6_addr_t *v6group,
3589     const in6_addr_t *v6src, ill_t *ill)
3590 {
3591 	int i;
3592 	boolean_t isinlist;
3593 	ilg_t *ilg;
3594 	ill_t *ilg_ill;
3595 
3596 	ASSERT(MUTEX_HELD(&connp->conn_lock));
3597 
3598 	for (i = 0; i < connp->conn_ilg_inuse; i++) {
3599 		ilg = &connp->conn_ilg[i];
3600 		if ((ilg_ill = ilg->ilg_ill) == NULL ||
3601 		    (ilg->ilg_flags & ILG_DELETED) != 0)
3602 			continue;
3603 		ASSERT(ilg->ilg_ipif == NULL);
3604 		ASSERT(ilg_ill->ill_isv6);
3605 		if (ilg_ill == ill &&
3606 		    IN6_ARE_ADDR_EQUAL(&ilg->ilg_v6group, v6group)) {
3607 			if (SLIST_IS_EMPTY(ilg->ilg_filter)) {
3608 				/* no source filter, so this is a match */
3609 				return (ilg);
3610 			}
3611 			break;
3612 		}
3613 	}
3614 	if (i == connp->conn_ilg_inuse)
3615 		return (NULL);
3616 
3617 	/*
3618 	 * we have an ilg with matching ill and group; but
3619 	 * the ilg has a source list that we must check.
3620 	 */
3621 	isinlist = B_FALSE;
3622 	for (i = 0; i < ilg->ilg_filter->sl_numsrc; i++) {
3623 		if (IN6_ARE_ADDR_EQUAL(v6src, &ilg->ilg_filter->sl_addr[i])) {
3624 			isinlist = B_TRUE;
3625 			break;
3626 		}
3627 	}
3628 
3629 	if ((isinlist && ilg->ilg_fmode == MODE_IS_INCLUDE) ||
3630 	    (!isinlist && ilg->ilg_fmode == MODE_IS_EXCLUDE))
3631 		return (ilg);
3632 
3633 	return (NULL);
3634 }
3635 
3636 /*
3637  * Get the ilg whose ilg_orig_ifindex is associated with ifindex.
3638  * This is useful when the interface fails and we have moved
3639  * to a new ill, but still would like to locate using the index
3640  * that we originally used to join. Used only for IPv6 currently.
3641  */
3642 static ilg_t *
3643 ilg_lookup_ill_index_v6(conn_t *connp, const in6_addr_t *v6group, int ifindex)
3644 {
3645 	ilg_t	*ilg;
3646 	int	i;
3647 
3648 	ASSERT(MUTEX_HELD(&connp->conn_lock));
3649 	for (i = 0; i < connp->conn_ilg_inuse; i++) {
3650 		ilg = &connp->conn_ilg[i];
3651 		if (ilg->ilg_ill == NULL ||
3652 		    (ilg->ilg_flags & ILG_DELETED) != 0)
3653 			continue;
3654 		/* ilg_ipif is NULL for V6 */
3655 		ASSERT(ilg->ilg_ipif == NULL);
3656 		ASSERT(ilg->ilg_orig_ifindex != 0);
3657 		if (IN6_ARE_ADDR_EQUAL(&ilg->ilg_v6group, v6group) &&
3658 		    ilg->ilg_orig_ifindex == ifindex) {
3659 			return (ilg);
3660 		}
3661 	}
3662 	return (NULL);
3663 }
3664 
3665 /*
3666  * Find an IPv6 ilg matching group and ill
3667  */
3668 ilg_t *
3669 ilg_lookup_ill_v6(conn_t *connp, const in6_addr_t *v6group, ill_t *ill)
3670 {
3671 	ilg_t	*ilg;
3672 	int	i;
3673 	ill_t 	*mem_ill;
3674 
3675 	ASSERT(MUTEX_HELD(&connp->conn_lock));
3676 
3677 	for (i = 0; i < connp->conn_ilg_inuse; i++) {
3678 		ilg = &connp->conn_ilg[i];
3679 		if ((mem_ill = ilg->ilg_ill) == NULL ||
3680 		    (ilg->ilg_flags & ILG_DELETED) != 0)
3681 			continue;
3682 		ASSERT(ilg->ilg_ipif == NULL);
3683 		ASSERT(mem_ill->ill_isv6);
3684 		if (mem_ill == ill &&
3685 		    IN6_ARE_ADDR_EQUAL(&ilg->ilg_v6group, v6group))
3686 			return (ilg);
3687 	}
3688 	return (NULL);
3689 }
3690 
3691 /*
3692  * Find an IPv4 ilg matching group and ipif
3693  */
3694 static ilg_t *
3695 ilg_lookup_ipif(conn_t *connp, ipaddr_t group, ipif_t *ipif)
3696 {
3697 	in6_addr_t v6group;
3698 	int	i;
3699 	ilg_t	*ilg;
3700 
3701 	ASSERT(MUTEX_HELD(&connp->conn_lock));
3702 	ASSERT(!ipif->ipif_ill->ill_isv6);
3703 
3704 	if (group == INADDR_ANY)
3705 		v6group = ipv6_all_zeros;
3706 	else
3707 		IN6_IPADDR_TO_V4MAPPED(group, &v6group);
3708 
3709 	for (i = 0; i < connp->conn_ilg_inuse; i++) {
3710 		ilg = &connp->conn_ilg[i];
3711 		if ((ilg->ilg_flags & ILG_DELETED) == 0 &&
3712 		    IN6_ARE_ADDR_EQUAL(&ilg->ilg_v6group, &v6group) &&
3713 		    ilg->ilg_ipif == ipif)
3714 			return (ilg);
3715 	}
3716 	return (NULL);
3717 }
3718 
3719 /*
3720  * If a source address is passed in (src != NULL and src is not
3721  * unspecified), remove the specified src addr from the given ilg's
3722  * filter list, else delete the ilg.
3723  */
3724 static void
3725 ilg_delete(conn_t *connp, ilg_t *ilg, const in6_addr_t *src)
3726 {
3727 	int	i;
3728 
3729 	ASSERT((ilg->ilg_ipif != NULL) ^ (ilg->ilg_ill != NULL));
3730 	ASSERT(ilg->ilg_ipif == NULL || IAM_WRITER_IPIF(ilg->ilg_ipif));
3731 	ASSERT(ilg->ilg_ill == NULL || IAM_WRITER_ILL(ilg->ilg_ill));
3732 	ASSERT(MUTEX_HELD(&connp->conn_lock));
3733 	ASSERT(!(ilg->ilg_flags & ILG_DELETED));
3734 
3735 	if (src == NULL || IN6_IS_ADDR_UNSPECIFIED(src)) {
3736 		if (connp->conn_ilg_walker_cnt != 0) {
3737 			ilg->ilg_flags |= ILG_DELETED;
3738 			return;
3739 		}
3740 
3741 		FREE_SLIST(ilg->ilg_filter);
3742 
3743 		i = ilg - &connp->conn_ilg[0];
3744 		ASSERT(i >= 0 && i < connp->conn_ilg_inuse);
3745 
3746 		/* Move other entries up one step */
3747 		connp->conn_ilg_inuse--;
3748 		for (; i < connp->conn_ilg_inuse; i++)
3749 			connp->conn_ilg[i] = connp->conn_ilg[i+1];
3750 
3751 		if (connp->conn_ilg_inuse == 0) {
3752 			mi_free((char *)connp->conn_ilg);
3753 			connp->conn_ilg = NULL;
3754 			cv_broadcast(&connp->conn_refcv);
3755 		}
3756 	} else {
3757 		l_remove(ilg->ilg_filter, src);
3758 	}
3759 }
3760 
3761 /*
3762  * Called from conn close. No new ilg can be added or removed.
3763  * because CONN_CLOSING has been set by ip_close. ilg_add / ilg_delete
3764  * will return error if conn has started closing.
3765  */
3766 void
3767 ilg_delete_all(conn_t *connp)
3768 {
3769 	int	i;
3770 	ipif_t	*ipif = NULL;
3771 	ill_t	*ill = NULL;
3772 	ilg_t	*ilg;
3773 	in6_addr_t v6group;
3774 	boolean_t success;
3775 	ipsq_t	*ipsq;
3776 	int	orig_ifindex;
3777 
3778 	mutex_enter(&connp->conn_lock);
3779 retry:
3780 	ILG_WALKER_HOLD(connp);
3781 	for (i = connp->conn_ilg_inuse - 1; i >= 0; ) {
3782 		ilg = &connp->conn_ilg[i];
3783 		/*
3784 		 * Since this walk is not atomic (we drop the
3785 		 * conn_lock and wait in ipsq_enter) we need
3786 		 * to check for the ILG_DELETED flag.
3787 		 */
3788 		if (ilg->ilg_flags & ILG_DELETED) {
3789 			/* Go to the next ilg */
3790 			i--;
3791 			continue;
3792 		}
3793 		v6group = ilg->ilg_v6group;
3794 
3795 		if (IN6_IS_ADDR_V4MAPPED(&v6group)) {
3796 			ipif = ilg->ilg_ipif;
3797 			ill = ipif->ipif_ill;
3798 		} else {
3799 			ipif = NULL;
3800 			ill = ilg->ilg_ill;
3801 		}
3802 		/*
3803 		 * We may not be able to refhold the ill if the ill/ipif
3804 		 * is changing. But we need to make sure that the ill will
3805 		 * not vanish. So we just bump up the ill_waiter count.
3806 		 * If we are unable to do even that, then the ill is closing,
3807 		 * in which case the unplumb thread will handle the cleanup,
3808 		 * and we move on to the next ilg.
3809 		 */
3810 		if (!ill_waiter_inc(ill)) {
3811 			/* Go to the next ilg */
3812 			i--;
3813 			continue;
3814 		}
3815 		mutex_exit(&connp->conn_lock);
3816 		/*
3817 		 * To prevent deadlock between ill close which waits inside
3818 		 * the perimeter, and conn close, ipsq_enter returns error,
3819 		 * the moment ILL_CONDEMNED is set, in which case ill close
3820 		 * takes responsibility to cleanup the ilgs. Note that we
3821 		 * have not yet set condemned flag, otherwise the conn can't
3822 		 * be refheld for cleanup by those routines and it would be
3823 		 * a mutual deadlock.
3824 		 */
3825 		success = ipsq_enter(ill, B_FALSE);
3826 		ipsq = ill->ill_phyint->phyint_ipsq;
3827 		ill_waiter_dcr(ill);
3828 		mutex_enter(&connp->conn_lock);
3829 		if (!success) {
3830 			/* Go to the next ilg */
3831 			i--;
3832 			continue;
3833 		}
3834 
3835 		/*
3836 		 * Make sure that nothing has changed under. For eg.
3837 		 * a failover/failback can change ilg_ill while we were
3838 		 * waiting to become exclusive above
3839 		 */
3840 		if (IN6_IS_ADDR_V4MAPPED(&v6group)) {
3841 			ipif = ilg->ilg_ipif;
3842 			ill = ipif->ipif_ill;
3843 		} else {
3844 			ipif = NULL;
3845 			ill = ilg->ilg_ill;
3846 		}
3847 		if (!IAM_WRITER_ILL(ill) || (ilg->ilg_flags & ILG_DELETED)) {
3848 			/*
3849 			 * The ilg has changed under us probably due
3850 			 * to a failover or unplumb. Retry on the same ilg.
3851 			 */
3852 			mutex_exit(&connp->conn_lock);
3853 			ipsq_exit(ipsq, B_TRUE, B_TRUE);
3854 			mutex_enter(&connp->conn_lock);
3855 			continue;
3856 		}
3857 		v6group = ilg->ilg_v6group;
3858 		orig_ifindex = ilg->ilg_orig_ifindex;
3859 		ilg_delete(connp, ilg, NULL);
3860 		mutex_exit(&connp->conn_lock);
3861 
3862 		if (ipif != NULL)
3863 			(void) ip_delmulti(V4_PART_OF_V6(v6group), ipif,
3864 			    B_FALSE, B_TRUE);
3865 
3866 		else
3867 			(void) ip_delmulti_v6(&v6group, ill, orig_ifindex,
3868 			    connp->conn_zoneid, B_FALSE, B_TRUE);
3869 
3870 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
3871 		mutex_enter(&connp->conn_lock);
3872 		/* Go to the next ilg */
3873 		i--;
3874 	}
3875 	ILG_WALKER_RELE(connp);
3876 
3877 	/* If any ill was skipped above wait and retry */
3878 	if (connp->conn_ilg_inuse != 0) {
3879 		cv_wait(&connp->conn_refcv, &connp->conn_lock);
3880 		goto retry;
3881 	}
3882 	mutex_exit(&connp->conn_lock);
3883 }
3884 
3885 /*
3886  * Called from ill close by ipcl_walk for clearing conn_ilg and
3887  * conn_multicast_ipif for a given ipif. conn is held by caller.
3888  * Note that ipcl_walk only walks conns that are not yet condemned.
3889  * condemned conns can't be refheld. For this reason, conn must become clean
3890  * first, i.e. it must not refer to any ill/ire/ipif and then only set
3891  * condemned flag.
3892  */
3893 static void
3894 conn_delete_ipif(conn_t *connp, caddr_t arg)
3895 {
3896 	ipif_t	*ipif = (ipif_t *)arg;
3897 	int	i;
3898 	char	group_buf1[INET6_ADDRSTRLEN];
3899 	char	group_buf2[INET6_ADDRSTRLEN];
3900 	ipaddr_t group;
3901 	ilg_t	*ilg;
3902 
3903 	/*
3904 	 * Even though conn_ilg_inuse can change while we are in this loop,
3905 	 * i.e.ilgs can be created or deleted on this connp, no new ilgs can
3906 	 * be created or deleted for this connp, on this ill, since this ill
3907 	 * is the perimeter. So we won't miss any ilg in this cleanup.
3908 	 */
3909 	mutex_enter(&connp->conn_lock);
3910 
3911 	/*
3912 	 * Increment the walker count, so that ilg repacking does not
3913 	 * occur while we are in the loop.
3914 	 */
3915 	ILG_WALKER_HOLD(connp);
3916 	for (i = connp->conn_ilg_inuse - 1; i >= 0; i--) {
3917 		ilg = &connp->conn_ilg[i];
3918 		if (ilg->ilg_ipif != ipif || (ilg->ilg_flags & ILG_DELETED))
3919 			continue;
3920 		/*
3921 		 * ip_close cannot be cleaning this ilg at the same time.
3922 		 * since it also has to execute in this ill's perimeter which
3923 		 * we are now holding. Only a clean conn can be condemned.
3924 		 */
3925 		ASSERT(!(connp->conn_state_flags & CONN_CONDEMNED));
3926 
3927 		/* Blow away the membership */
3928 		ip1dbg(("conn_delete_ilg_ipif: %s on %s (%s)\n",
3929 		    inet_ntop(AF_INET6, &connp->conn_ilg[i].ilg_v6group,
3930 		    group_buf1, sizeof (group_buf1)),
3931 		    inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr,
3932 		    group_buf2, sizeof (group_buf2)),
3933 		    ipif->ipif_ill->ill_name));
3934 
3935 		/* ilg_ipif is NULL for V6, so we won't be here */
3936 		ASSERT(IN6_IS_ADDR_V4MAPPED(&ilg->ilg_v6group));
3937 
3938 		group = V4_PART_OF_V6(ilg->ilg_v6group);
3939 		ilg_delete(connp, &connp->conn_ilg[i], NULL);
3940 		mutex_exit(&connp->conn_lock);
3941 
3942 		(void) ip_delmulti(group, ipif, B_FALSE, B_TRUE);
3943 		mutex_enter(&connp->conn_lock);
3944 	}
3945 
3946 	/*
3947 	 * If we are the last walker, need to physically delete the
3948 	 * ilgs and repack.
3949 	 */
3950 	ILG_WALKER_RELE(connp);
3951 
3952 	if (connp->conn_multicast_ipif == ipif) {
3953 		/* Revert to late binding */
3954 		connp->conn_multicast_ipif = NULL;
3955 	}
3956 	mutex_exit(&connp->conn_lock);
3957 
3958 	conn_delete_ire(connp, (caddr_t)ipif);
3959 }
3960 
3961 /*
3962  * Called from ill close by ipcl_walk for clearing conn_ilg and
3963  * conn_multicast_ill for a given ill. conn is held by caller.
3964  * Note that ipcl_walk only walks conns that are not yet condemned.
3965  * condemned conns can't be refheld. For this reason, conn must become clean
3966  * first, i.e. it must not refer to any ill/ire/ipif and then only set
3967  * condemned flag.
3968  */
3969 static void
3970 conn_delete_ill(conn_t *connp, caddr_t arg)
3971 {
3972 	ill_t	*ill = (ill_t *)arg;
3973 	int	i;
3974 	char	group_buf[INET6_ADDRSTRLEN];
3975 	in6_addr_t v6group;
3976 	int	orig_ifindex;
3977 	ilg_t	*ilg;
3978 
3979 	/*
3980 	 * Even though conn_ilg_inuse can change while we are in this loop,
3981 	 * no new ilgs can be created/deleted for this connp, on this
3982 	 * ill, since this ill is the perimeter. So we won't miss any ilg
3983 	 * in this cleanup.
3984 	 */
3985 	mutex_enter(&connp->conn_lock);
3986 
3987 	/*
3988 	 * Increment the walker count, so that ilg repacking does not
3989 	 * occur while we are in the loop.
3990 	 */
3991 	ILG_WALKER_HOLD(connp);
3992 	for (i = connp->conn_ilg_inuse - 1; i >= 0; i--) {
3993 		ilg = &connp->conn_ilg[i];
3994 		if ((ilg->ilg_ill == ill) && !(ilg->ilg_flags & ILG_DELETED)) {
3995 			/*
3996 			 * ip_close cannot be cleaning this ilg at the same
3997 			 * time, since it also has to execute in this ill's
3998 			 * perimeter which we are now holding. Only a clean
3999 			 * conn can be condemned.
4000 			 */
4001 			ASSERT(!(connp->conn_state_flags & CONN_CONDEMNED));
4002 
4003 			/* Blow away the membership */
4004 			ip1dbg(("conn_delete_ilg_ill: %s on %s\n",
4005 			    inet_ntop(AF_INET6, &ilg->ilg_v6group,
4006 			    group_buf, sizeof (group_buf)),
4007 			    ill->ill_name));
4008 
4009 			v6group = ilg->ilg_v6group;
4010 			orig_ifindex = ilg->ilg_orig_ifindex;
4011 			ilg_delete(connp, ilg, NULL);
4012 			mutex_exit(&connp->conn_lock);
4013 
4014 			(void) ip_delmulti_v6(&v6group, ill, orig_ifindex,
4015 			    connp->conn_zoneid, B_FALSE, B_TRUE);
4016 			mutex_enter(&connp->conn_lock);
4017 		}
4018 	}
4019 	/*
4020 	 * If we are the last walker, need to physically delete the
4021 	 * ilgs and repack.
4022 	 */
4023 	ILG_WALKER_RELE(connp);
4024 
4025 	if (connp->conn_multicast_ill == ill) {
4026 		/* Revert to late binding */
4027 		connp->conn_multicast_ill = NULL;
4028 		connp->conn_orig_multicast_ifindex = 0;
4029 	}
4030 	mutex_exit(&connp->conn_lock);
4031 }
4032 
4033 /*
4034  * Called when an ipif is unplumbed to make sure that there are no
4035  * dangling conn references to that ipif.
4036  * Handles ilg_ipif and conn_multicast_ipif
4037  */
4038 void
4039 reset_conn_ipif(ipif)
4040 	ipif_t	*ipif;
4041 {
4042 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
4043 
4044 	ipcl_walk(conn_delete_ipif, (caddr_t)ipif, ipst);
4045 }
4046 
4047 /*
4048  * Called when an ill is unplumbed to make sure that there are no
4049  * dangling conn references to that ill.
4050  * Handles ilg_ill, conn_multicast_ill.
4051  */
4052 void
4053 reset_conn_ill(ill_t *ill)
4054 {
4055 	ip_stack_t	*ipst = ill->ill_ipst;
4056 
4057 	ipcl_walk(conn_delete_ill, (caddr_t)ill, ipst);
4058 }
4059 
4060 #ifdef DEBUG
4061 /*
4062  * Walk functions walk all the interfaces in the system to make
4063  * sure that there is no refernece to the ipif or ill that is
4064  * going away.
4065  */
4066 int
4067 ilm_walk_ill(ill_t *ill)
4068 {
4069 	int cnt = 0;
4070 	ill_t *till;
4071 	ilm_t *ilm;
4072 	ill_walk_context_t ctx;
4073 	ip_stack_t	*ipst = ill->ill_ipst;
4074 
4075 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4076 	till = ILL_START_WALK_ALL(&ctx, ipst);
4077 	for (; till != NULL; till = ill_next(&ctx, till)) {
4078 		mutex_enter(&till->ill_lock);
4079 		for (ilm = till->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
4080 			if (ilm->ilm_ill == ill) {
4081 				cnt++;
4082 			}
4083 		}
4084 		mutex_exit(&till->ill_lock);
4085 	}
4086 	rw_exit(&ipst->ips_ill_g_lock);
4087 
4088 	return (cnt);
4089 }
4090 
4091 /*
4092  * This function is called before the ipif is freed.
4093  */
4094 int
4095 ilm_walk_ipif(ipif_t *ipif)
4096 {
4097 	int cnt = 0;
4098 	ill_t *till;
4099 	ilm_t *ilm;
4100 	ill_walk_context_t ctx;
4101 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
4102 
4103 	till = ILL_START_WALK_ALL(&ctx, ipst);
4104 	for (; till != NULL; till = ill_next(&ctx, till)) {
4105 		mutex_enter(&till->ill_lock);
4106 		for (ilm = till->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
4107 			if (ilm->ilm_ipif == ipif) {
4108 					cnt++;
4109 			}
4110 		}
4111 		mutex_exit(&till->ill_lock);
4112 	}
4113 	return (cnt);
4114 }
4115 #endif
4116