xref: /titanic_44/usr/src/uts/common/inet/ip/ip_if.c (revision c138f478d2bc94e73ab8f6a084e323bec25e62f5)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 /* Copyright (c) 1990 Mentat Inc. */
27 
28 #pragma ident	"%Z%%M%	%I%	%E% SMI"
29 
30 /*
31  * This file contains the interface control functions for IP.
32  */
33 
34 #include <sys/types.h>
35 #include <sys/stream.h>
36 #include <sys/dlpi.h>
37 #include <sys/stropts.h>
38 #include <sys/strsun.h>
39 #include <sys/sysmacros.h>
40 #include <sys/strlog.h>
41 #include <sys/ddi.h>
42 #include <sys/sunddi.h>
43 #include <sys/cmn_err.h>
44 #include <sys/kstat.h>
45 #include <sys/debug.h>
46 #include <sys/zone.h>
47 
48 #include <sys/kmem.h>
49 #include <sys/systm.h>
50 #include <sys/param.h>
51 #include <sys/socket.h>
52 #define	_SUN_TPI_VERSION	2
53 #include <sys/tihdr.h>
54 #include <sys/isa_defs.h>
55 #include <net/if.h>
56 #include <net/if_arp.h>
57 #include <net/if_types.h>
58 #include <net/if_dl.h>
59 #include <net/route.h>
60 #include <sys/sockio.h>
61 #include <netinet/in.h>
62 #include <netinet/ip6.h>
63 #include <netinet/icmp6.h>
64 #include <netinet/igmp_var.h>
65 #include <sys/strsun.h>
66 #include <sys/policy.h>
67 #include <sys/ethernet.h>
68 
69 #include <inet/common.h>   /* for various inet/mi.h and inet/nd.h needs */
70 #include <inet/mi.h>
71 #include <inet/nd.h>
72 #include <inet/arp.h>
73 #include <inet/mib2.h>
74 #include <inet/ip.h>
75 #include <inet/ip6.h>
76 #include <inet/ip6_asp.h>
77 #include <inet/tcp.h>
78 #include <inet/ip_multi.h>
79 #include <inet/ip_ire.h>
80 #include <inet/ip_rts.h>
81 #include <inet/ip_ndp.h>
82 #include <inet/ip_if.h>
83 #include <inet/ip_impl.h>
84 #include <inet/tun.h>
85 #include <inet/sctp_ip.h>
86 
87 #include <net/pfkeyv2.h>
88 #include <inet/ipsec_info.h>
89 #include <inet/sadb.h>
90 #include <inet/ipsec_impl.h>
91 #include <sys/iphada.h>
92 
93 
94 #include <netinet/igmp.h>
95 #include <inet/ip_listutils.h>
96 #include <netinet/ip_mroute.h>
97 #include <inet/ipclassifier.h>
98 #include <sys/mac.h>
99 
100 #include <sys/systeminfo.h>
101 #include <sys/bootconf.h>
102 
103 /* The character which tells where the ill_name ends */
104 #define	IPIF_SEPARATOR_CHAR	':'
105 
106 /* IP ioctl function table entry */
107 typedef struct ipft_s {
108 	int	ipft_cmd;
109 	pfi_t	ipft_pfi;
110 	int	ipft_min_size;
111 	int	ipft_flags;
112 } ipft_t;
113 #define	IPFT_F_NO_REPLY		0x1	/* IP ioctl does not expect any reply */
114 #define	IPFT_F_SELF_REPLY	0x2	/* ioctl callee does the ioctl reply */
115 
116 typedef struct ip_sock_ar_s {
117 	union {
118 		area_t	ip_sock_area;
119 		ared_t	ip_sock_ared;
120 		areq_t	ip_sock_areq;
121 	} ip_sock_ar_u;
122 	queue_t	*ip_sock_ar_q;
123 } ip_sock_ar_t;
124 
125 static int	nd_ill_forward_get(queue_t *, mblk_t *, caddr_t, cred_t *);
126 static int	nd_ill_forward_set(queue_t *q, mblk_t *mp,
127 		    char *value, caddr_t cp, cred_t *ioc_cr);
128 
129 static boolean_t ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask);
130 static ip_m_t	*ip_m_lookup(t_uscalar_t mac_type);
131 static int	ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
132     mblk_t *mp, boolean_t need_up);
133 static int	ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
134     mblk_t *mp, boolean_t need_up);
135 static int	ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
136     queue_t *q, mblk_t *mp, boolean_t need_up);
137 static int	ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q,
138     mblk_t *mp, boolean_t need_up);
139 static int	ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
140     mblk_t *mp);
141 static int	ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t, in6_addr_t,
142     queue_t *q, mblk_t *mp, boolean_t need_up);
143 static int	ip_sioctl_arp_common(ill_t *ill, queue_t *q, mblk_t *mp,
144     sin_t *sin, boolean_t x_arp_ioctl, boolean_t if_arp_ioctl);
145 static ipaddr_t	ip_subnet_mask(ipaddr_t addr, ipif_t **);
146 static void	ip_wput_ioctl(queue_t *q, mblk_t *mp);
147 static void	ipsq_flush(ill_t *ill);
148 static void	ipsq_clean_all(ill_t *ill);
149 static void	ipsq_clean_ring(ill_t *ill, ill_rx_ring_t *rx_ring);
150 static	int	ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen,
151     queue_t *q, mblk_t *mp, boolean_t need_up);
152 static void	ipsq_delete(ipsq_t *);
153 
154 static ipif_t	*ipif_allocate(ill_t *ill, int id, uint_t ire_type,
155 		    boolean_t initialize);
156 static void	ipif_check_bcast_ires(ipif_t *test_ipif);
157 static void	ipif_down_delete_ire(ire_t *ire, char *ipif);
158 static void	ipif_delete_cache_ire(ire_t *, char *);
159 static int	ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp);
160 static void	ipif_down_tail(ipif_t *ipif);
161 static void	ipif_free(ipif_t *ipif);
162 static void	ipif_free_tail(ipif_t *ipif);
163 static void	ipif_mask_reply(ipif_t *);
164 static void	ipif_mtu_change(ire_t *ire, char *ipif_arg);
165 static void	ipif_multicast_down(ipif_t *ipif);
166 static void	ipif_recreate_interface_routes(ipif_t *old_ipif, ipif_t *ipif);
167 static void	ipif_set_default(ipif_t *ipif);
168 static int	ipif_set_values(queue_t *q, mblk_t *mp,
169     char *interf_name, uint_t *ppa);
170 static int	ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp,
171     queue_t *q);
172 static ipif_t	*ipif_lookup_on_name(char *name, size_t namelen,
173     boolean_t do_alloc, boolean_t *exists, boolean_t isv6, zoneid_t zoneid,
174     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error);
175 static int	ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp);
176 static void	ipif_update_other_ipifs(ipif_t *old_ipif, ill_group_t *illgrp);
177 
178 static int	ill_alloc_ppa(ill_if_t *, ill_t *);
179 static int	ill_arp_off(ill_t *ill);
180 static int	ill_arp_on(ill_t *ill);
181 static void	ill_delete_interface_type(ill_if_t *);
182 static int	ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q);
183 static void	ill_down(ill_t *ill);
184 static void	ill_downi(ire_t *ire, char *ill_arg);
185 static void	ill_downi_mrtun_srcif(ire_t *ire, char *ill_arg);
186 static void	ill_down_tail(ill_t *ill);
187 static void	ill_free_mib(ill_t *ill);
188 static void	ill_glist_delete(ill_t *);
189 static boolean_t ill_has_usable_ipif(ill_t *);
190 static int	ill_lock_ipsq_ills(ipsq_t *sq, ill_t **list, int);
191 static void	ill_nominate_bcast_rcv(ill_group_t *illgrp);
192 static void	ill_phyint_free(ill_t *ill);
193 static void	ill_phyint_reinit(ill_t *ill);
194 static void	ill_set_nce_router_flags(ill_t *, boolean_t);
195 static void	ill_signal_ipsq_ills(ipsq_t *, boolean_t);
196 static boolean_t ill_split_ipsq(ipsq_t *cur_sq);
197 static void	ill_stq_cache_delete(ire_t *, char *);
198 
199 static boolean_t ip_ether_v6intfid(uint_t, uint8_t *, in6_addr_t *);
200 static boolean_t ip_nodef_v6intfid(uint_t, uint8_t *, in6_addr_t *);
201 static boolean_t ip_ether_v6mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
202     in6_addr_t *);
203 static boolean_t ip_ether_v4mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
204     ipaddr_t *);
205 static boolean_t ip_ib_v6intfid(uint_t, uint8_t *, in6_addr_t *);
206 static boolean_t ip_ib_v6mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
207     in6_addr_t *);
208 static boolean_t ip_ib_v4mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
209     ipaddr_t *);
210 
211 static void	ipif_save_ire(ipif_t *, ire_t *);
212 static void	ipif_remove_ire(ipif_t *, ire_t *);
213 static void 	ip_cgtp_bcast_add(ire_t *, ire_t *);
214 static void 	ip_cgtp_bcast_delete(ire_t *);
215 
216 /*
217  * Per-ill IPsec capabilities management.
218  */
219 static ill_ipsec_capab_t *ill_ipsec_capab_alloc(void);
220 static void	ill_ipsec_capab_free(ill_ipsec_capab_t *);
221 static void	ill_ipsec_capab_add(ill_t *, uint_t, boolean_t);
222 static void	ill_ipsec_capab_delete(ill_t *, uint_t);
223 static boolean_t ill_ipsec_capab_resize_algparm(ill_ipsec_capab_t *, int);
224 static void ill_capability_proto(ill_t *, int, mblk_t *);
225 static void ill_capability_dispatch(ill_t *, mblk_t *, dl_capability_sub_t *,
226     boolean_t);
227 static void ill_capability_id_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
228 static void ill_capability_mdt_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
229 static void ill_capability_mdt_reset(ill_t *, mblk_t **);
230 static void ill_capability_ipsec_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
231 static void ill_capability_ipsec_reset(ill_t *, mblk_t **);
232 static void ill_capability_hcksum_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
233 static void ill_capability_hcksum_reset(ill_t *, mblk_t **);
234 static void ill_capability_zerocopy_ack(ill_t *, mblk_t *,
235     dl_capability_sub_t *);
236 static void ill_capability_zerocopy_reset(ill_t *, mblk_t **);
237 
238 static void ill_capability_dls_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
239 static mac_resource_handle_t ill_ring_add(void *, mac_resource_t *);
240 static void ill_capability_dls_reset(ill_t *, mblk_t **);
241 static void ill_capability_dls_disable(ill_t *);
242 
243 static void	illgrp_cache_delete(ire_t *, char *);
244 static void	illgrp_delete(ill_t *ill);
245 static void	illgrp_reset_schednext(ill_t *ill);
246 
247 static ill_t	*ill_prev_usesrc(ill_t *);
248 static int	ill_relink_usesrc_ills(ill_t *, ill_t *, uint_t);
249 static void	ill_disband_usesrc_group(ill_t *);
250 
251 static void	conn_cleanup_stale_ire(conn_t *, caddr_t);
252 
253 /*
254  * if we go over the memory footprint limit more than once in this msec
255  * interval, we'll start pruning aggressively.
256  */
257 int ip_min_frag_prune_time = 0;
258 
259 /*
260  * max # of IPsec algorithms supported.  Limited to 1 byte by PF_KEY
261  * and the IPsec DOI
262  */
263 #define	MAX_IPSEC_ALGS	256
264 
265 #define	BITSPERBYTE	8
266 #define	BITS(type)	(BITSPERBYTE * (long)sizeof (type))
267 
268 #define	IPSEC_ALG_ENABLE(algs, algid) \
269 		((algs)[(algid) / BITS(ipsec_capab_elem_t)] |= \
270 		(1 << ((algid) % BITS(ipsec_capab_elem_t))))
271 
272 #define	IPSEC_ALG_IS_ENABLED(algid, algs) \
273 		((algs)[(algid) / BITS(ipsec_capab_elem_t)] & \
274 		(1 << ((algid) % BITS(ipsec_capab_elem_t))))
275 
276 typedef uint8_t ipsec_capab_elem_t;
277 
278 /*
279  * Per-algorithm parameters.  Note that at present, only encryption
280  * algorithms have variable keysize (IKE does not provide a way to negotiate
281  * auth algorithm keysize).
282  *
283  * All sizes here are in bits.
284  */
285 typedef struct
286 {
287 	uint16_t	minkeylen;
288 	uint16_t	maxkeylen;
289 } ipsec_capab_algparm_t;
290 
291 /*
292  * Per-ill capabilities.
293  */
294 struct ill_ipsec_capab_s {
295 	ipsec_capab_elem_t *encr_hw_algs;
296 	ipsec_capab_elem_t *auth_hw_algs;
297 	uint32_t algs_size;	/* size of _hw_algs in bytes */
298 	/* algorithm key lengths */
299 	ipsec_capab_algparm_t *encr_algparm;
300 	uint32_t encr_algparm_size;
301 	uint32_t encr_algparm_end;
302 };
303 
304 /*
305  * List of AH and ESP IPsec acceleration capable ills
306  */
307 typedef struct ipsec_capab_ill_s {
308 	uint_t ill_index;
309 	boolean_t ill_isv6;
310 	struct ipsec_capab_ill_s *next;
311 } ipsec_capab_ill_t;
312 
313 static ipsec_capab_ill_t *ipsec_capab_ills_ah;
314 static ipsec_capab_ill_t *ipsec_capab_ills_esp;
315 krwlock_t ipsec_capab_ills_lock;
316 
317 /*
318  * The field values are larger than strictly necessary for simple
319  * AR_ENTRY_ADDs but the padding lets us accomodate the socket ioctls.
320  */
321 static area_t	ip_area_template = {
322 	AR_ENTRY_ADD,			/* area_cmd */
323 	sizeof (ip_sock_ar_t) + (IP_ADDR_LEN*2) + sizeof (struct sockaddr_dl),
324 					/* area_name_offset */
325 	/* area_name_length temporarily holds this structure length */
326 	sizeof (area_t),			/* area_name_length */
327 	IP_ARP_PROTO_TYPE,		/* area_proto */
328 	sizeof (ip_sock_ar_t),		/* area_proto_addr_offset */
329 	IP_ADDR_LEN,			/* area_proto_addr_length */
330 	sizeof (ip_sock_ar_t) + IP_ADDR_LEN,
331 					/* area_proto_mask_offset */
332 	0,				/* area_flags */
333 	sizeof (ip_sock_ar_t) + IP_ADDR_LEN + IP_ADDR_LEN,
334 					/* area_hw_addr_offset */
335 	/* Zero length hw_addr_length means 'use your idea of the address' */
336 	0				/* area_hw_addr_length */
337 };
338 
339 /*
340  * AR_ENTRY_ADD/DELETE templates have been added for IPv6 external resolver
341  * support
342  */
343 static area_t	ip6_area_template = {
344 	AR_ENTRY_ADD,			/* area_cmd */
345 	sizeof (ip_sock_ar_t) + (IPV6_ADDR_LEN*2) + sizeof (sin6_t),
346 					/* area_name_offset */
347 	/* area_name_length temporarily holds this structure length */
348 	sizeof (area_t),			/* area_name_length */
349 	IP_ARP_PROTO_TYPE,		/* area_proto */
350 	sizeof (ip_sock_ar_t),		/* area_proto_addr_offset */
351 	IPV6_ADDR_LEN,			/* area_proto_addr_length */
352 	sizeof (ip_sock_ar_t) + IPV6_ADDR_LEN,
353 					/* area_proto_mask_offset */
354 	0,				/* area_flags */
355 	sizeof (ip_sock_ar_t) + IPV6_ADDR_LEN + IPV6_ADDR_LEN,
356 					/* area_hw_addr_offset */
357 	/* Zero length hw_addr_length means 'use your idea of the address' */
358 	0				/* area_hw_addr_length */
359 };
360 
361 static ared_t	ip_ared_template = {
362 	AR_ENTRY_DELETE,
363 	sizeof (ared_t) + IP_ADDR_LEN,
364 	sizeof (ared_t),
365 	IP_ARP_PROTO_TYPE,
366 	sizeof (ared_t),
367 	IP_ADDR_LEN
368 };
369 
370 static ared_t	ip6_ared_template = {
371 	AR_ENTRY_DELETE,
372 	sizeof (ared_t) + IPV6_ADDR_LEN,
373 	sizeof (ared_t),
374 	IP_ARP_PROTO_TYPE,
375 	sizeof (ared_t),
376 	IPV6_ADDR_LEN
377 };
378 
379 /*
380  * A template for an IPv6 AR_ENTRY_QUERY template has not been created, as
381  * as the areq doesn't include an IP address in ill_dl_up() (the only place a
382  * areq is used).
383  */
384 static areq_t	ip_areq_template = {
385 	AR_ENTRY_QUERY,			/* cmd */
386 	sizeof (areq_t)+(2*IP_ADDR_LEN),	/* name offset */
387 	sizeof (areq_t),	/* name len (filled by ill_arp_alloc) */
388 	IP_ARP_PROTO_TYPE,		/* protocol, from arps perspective */
389 	sizeof (areq_t),			/* target addr offset */
390 	IP_ADDR_LEN,			/* target addr_length */
391 	0,				/* flags */
392 	sizeof (areq_t) + IP_ADDR_LEN,	/* sender addr offset */
393 	IP_ADDR_LEN,			/* sender addr length */
394 	6,				/* xmit_count */
395 	1000,				/* (re)xmit_interval in milliseconds */
396 	4				/* max # of requests to buffer */
397 	/* anything else filled in by the code */
398 };
399 
400 static arc_t	ip_aru_template = {
401 	AR_INTERFACE_UP,
402 	sizeof (arc_t),		/* Name offset */
403 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
404 };
405 
406 static arc_t	ip_ard_template = {
407 	AR_INTERFACE_DOWN,
408 	sizeof (arc_t),		/* Name offset */
409 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
410 };
411 
412 static arc_t	ip_aron_template = {
413 	AR_INTERFACE_ON,
414 	sizeof (arc_t),		/* Name offset */
415 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
416 };
417 
418 static arc_t	ip_aroff_template = {
419 	AR_INTERFACE_OFF,
420 	sizeof (arc_t),		/* Name offset */
421 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
422 };
423 
424 
425 static arma_t	ip_arma_multi_template = {
426 	AR_MAPPING_ADD,
427 	sizeof (arma_t) + 3*IP_ADDR_LEN + IP_MAX_HW_LEN,
428 				/* Name offset */
429 	sizeof (arma_t),	/* Name length (set by ill_arp_alloc) */
430 	IP_ARP_PROTO_TYPE,
431 	sizeof (arma_t),			/* proto_addr_offset */
432 	IP_ADDR_LEN,				/* proto_addr_length */
433 	sizeof (arma_t) + IP_ADDR_LEN,		/* proto_mask_offset */
434 	sizeof (arma_t) + 2*IP_ADDR_LEN,	/* proto_extract_mask_offset */
435 	ACE_F_PERMANENT | ACE_F_MAPPING,	/* flags */
436 	sizeof (arma_t) + 3*IP_ADDR_LEN,	/* hw_addr_offset */
437 	IP_MAX_HW_LEN,				/* hw_addr_length */
438 	0,					/* hw_mapping_start */
439 };
440 
441 static ipft_t	ip_ioctl_ftbl[] = {
442 	{ IP_IOC_IRE_DELETE, ip_ire_delete, sizeof (ipid_t), 0 },
443 	{ IP_IOC_IRE_DELETE_NO_REPLY, ip_ire_delete, sizeof (ipid_t),
444 		IPFT_F_NO_REPLY },
445 	{ IP_IOC_IRE_ADVISE_NO_REPLY, ip_ire_advise, sizeof (ipic_t),
446 		IPFT_F_NO_REPLY },
447 	{ IP_IOC_RTS_REQUEST, ip_rts_request, 0, IPFT_F_SELF_REPLY },
448 	{ 0 }
449 };
450 
451 /* Simple ICMP IP Header Template */
452 static ipha_t icmp_ipha = {
453 	IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
454 };
455 
456 /* Flag descriptors for ip_ipif_report */
457 static nv_t	ipif_nv_tbl[] = {
458 	{ IPIF_UP,		"UP" },
459 	{ IPIF_BROADCAST,	"BROADCAST" },
460 	{ ILLF_DEBUG,		"DEBUG" },
461 	{ PHYI_LOOPBACK,	"LOOPBACK" },
462 	{ IPIF_POINTOPOINT,	"POINTOPOINT" },
463 	{ ILLF_NOTRAILERS,	"NOTRAILERS" },
464 	{ PHYI_RUNNING,		"RUNNING" },
465 	{ ILLF_NOARP,		"NOARP" },
466 	{ PHYI_PROMISC,		"PROMISC" },
467 	{ PHYI_ALLMULTI,	"ALLMULTI" },
468 	{ PHYI_INTELLIGENT,	"INTELLIGENT" },
469 	{ ILLF_MULTICAST,	"MULTICAST" },
470 	{ PHYI_MULTI_BCAST,	"MULTI_BCAST" },
471 	{ IPIF_UNNUMBERED,	"UNNUMBERED" },
472 	{ IPIF_DHCPRUNNING,	"DHCP" },
473 	{ IPIF_PRIVATE,		"PRIVATE" },
474 	{ IPIF_NOXMIT,		"NOXMIT" },
475 	{ IPIF_NOLOCAL,		"NOLOCAL" },
476 	{ IPIF_DEPRECATED,	"DEPRECATED" },
477 	{ IPIF_PREFERRED,	"PREFERRED" },
478 	{ IPIF_TEMPORARY,	"TEMPORARY" },
479 	{ IPIF_ADDRCONF,	"ADDRCONF" },
480 	{ PHYI_VIRTUAL,		"VIRTUAL" },
481 	{ ILLF_ROUTER,		"ROUTER" },
482 	{ ILLF_NONUD,		"NONUD" },
483 	{ IPIF_ANYCAST,		"ANYCAST" },
484 	{ ILLF_NORTEXCH,	"NORTEXCH" },
485 	{ ILLF_IPV4,		"IPV4" },
486 	{ ILLF_IPV6,		"IPV6" },
487 	{ IPIF_MIPRUNNING,	"MIP" },
488 	{ IPIF_NOFAILOVER,	"NOFAILOVER" },
489 	{ PHYI_FAILED,		"FAILED" },
490 	{ PHYI_STANDBY,		"STANDBY" },
491 	{ PHYI_INACTIVE,	"INACTIVE" },
492 	{ PHYI_OFFLINE,		"OFFLINE" },
493 };
494 
495 static uchar_t	ip_six_byte_all_ones[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
496 
497 static ip_m_t	ip_m_tbl[] = {
498 	{ DL_ETHER, IFT_ETHER, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
499 	    ip_ether_v6intfid },
500 	{ DL_CSMACD, IFT_ISO88023, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
501 	    ip_nodef_v6intfid },
502 	{ DL_TPB, IFT_ISO88024, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
503 	    ip_nodef_v6intfid },
504 	{ DL_TPR, IFT_ISO88025, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
505 	    ip_nodef_v6intfid },
506 	{ DL_FDDI, IFT_FDDI, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
507 	    ip_ether_v6intfid },
508 	{ DL_IB, IFT_IB, ip_ib_v4mapinfo, ip_ib_v6mapinfo,
509 	    ip_ib_v6intfid },
510 	{ SUNW_DL_VNI, IFT_OTHER, NULL, NULL, NULL},
511 	{ DL_OTHER, IFT_OTHER, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
512 	    ip_nodef_v6intfid }
513 };
514 
515 static ill_t	ill_null;		/* Empty ILL for init. */
516 char	ipif_loopback_name[] = "lo0";
517 static char *ipv4_forward_suffix = ":ip_forwarding";
518 static char *ipv6_forward_suffix = ":ip6_forwarding";
519 static kstat_t *loopback_ksp = NULL;
520 static	sin6_t	sin6_null;	/* Zero address for quick clears */
521 static	sin_t	sin_null;	/* Zero address for quick clears */
522 static	uint_t	ill_index = 1;	/* Used to assign interface indicies */
523 /* When set search for unused index */
524 static boolean_t ill_index_wrap = B_FALSE;
525 /* When set search for unused ipif_seqid */
526 static ipif_t	ipif_zero;
527 uint_t	ipif_src_random;
528 
529 /*
530  * For details on the protection offered by these locks please refer
531  * to the notes under the Synchronization section at the start of ip.c
532  */
533 krwlock_t	ill_g_lock;		/* The global ill_g_lock */
534 kmutex_t	ip_addr_avail_lock;	/* Address availability check lock */
535 ipsq_t		*ipsq_g_head;		/* List of all ipsq's on the system */
536 
537 krwlock_t	ill_g_usesrc_lock;	/* Protects usesrc related fields */
538 
539 /*
540  * illgrp_head/ifgrp_head is protected by IP's perimeter.
541  */
542 static  ill_group_t *illgrp_head_v4;	/* Head of IPv4 ill groups */
543 ill_group_t *illgrp_head_v6;		/* Head of IPv6 ill groups */
544 
545 ill_g_head_t	ill_g_heads[MAX_G_HEADS];   /* ILL List Head */
546 
547 /*
548  * ppa arena is created after these many
549  * interfaces have been plumbed.
550  */
551 uint_t	ill_no_arena = 12;
552 
553 #pragma align CACHE_ALIGN_SIZE(phyint_g_list)
554 static phyint_list_t phyint_g_list;	/* start of phyint list */
555 
556 /*
557  * Reflects value of FAILBACK variable in IPMP config file
558  * /etc/default/mpathd. Default value is B_TRUE.
559  * Set to B_FALSE if user disabled failback by configuring "FAILBACK=no"
560  * in.mpathd uses SIOCSIPMPFAILBACK ioctl to pass this information to kernel.
561  */
562 static boolean_t ipmp_enable_failback = B_TRUE;
563 
564 /*
565  * Enable soft rings if ip_squeue_soft_ring or ip_squeue_fanout
566  * is set and ip_soft_rings_cnt > 0. ip_squeue_soft_ring is
567  * set through platform specific code (Niagara/Ontario).
568  */
569 #define	SOFT_RINGS_ENABLED()	(ip_soft_rings_cnt ? \
570 		(ip_squeue_soft_ring || ip_squeue_fanout) : B_FALSE)
571 
572 #define	ILL_CAPAB_DLS	(ILL_CAPAB_SOFT_RING | ILL_CAPAB_POLL)
573 
574 static uint_t
575 ipif_rand(void)
576 {
577 	ipif_src_random = ipif_src_random * 1103515245 + 12345;
578 	return ((ipif_src_random >> 16) & 0x7fff);
579 }
580 
581 /*
582  * Allocate per-interface mibs. Only used for ipv6.
583  * Returns true if ok. False otherwise.
584  *  ipsq  may not yet be allocated (loopback case ).
585  */
586 static boolean_t
587 ill_allocate_mibs(ill_t *ill)
588 {
589 	ASSERT(ill->ill_isv6);
590 
591 	/* Already allocated? */
592 	if (ill->ill_ip6_mib != NULL) {
593 		ASSERT(ill->ill_icmp6_mib != NULL);
594 		return (B_TRUE);
595 	}
596 
597 	ill->ill_ip6_mib = kmem_zalloc(sizeof (*ill->ill_ip6_mib),
598 	    KM_NOSLEEP);
599 	if (ill->ill_ip6_mib == NULL) {
600 		return (B_FALSE);
601 	}
602 	ill->ill_icmp6_mib = kmem_zalloc(sizeof (*ill->ill_icmp6_mib),
603 	    KM_NOSLEEP);
604 	if (ill->ill_icmp6_mib == NULL) {
605 		kmem_free(ill->ill_ip6_mib, sizeof (*ill->ill_ip6_mib));
606 		ill->ill_ip6_mib = NULL;
607 		return (B_FALSE);
608 	}
609 	/*
610 	 * The ipv6Ifindex and ipv6IfIcmpIndex will be assigned later
611 	 * after the phyint merge occurs in ipif_set_values -> ill_glist_insert
612 	 * -> ill_phyint_reinit
613 	 */
614 	return (B_TRUE);
615 }
616 
617 /*
618  * Common code for preparation of ARP commands.  Two points to remember:
619  * 	1) The ill_name is tacked on at the end of the allocated space so
620  *	   the templates name_offset field must contain the total space
621  *	   to allocate less the name length.
622  *
623  *	2) The templates name_length field should contain the *template*
624  *	   length.  We use it as a parameter to bcopy() and then write
625  *	   the real ill_name_length into the name_length field of the copy.
626  * (Always called as writer.)
627  */
628 mblk_t *
629 ill_arp_alloc(ill_t *ill, uchar_t *template, caddr_t addr)
630 {
631 	arc_t	*arc = (arc_t *)template;
632 	char	*cp;
633 	int	len;
634 	mblk_t	*mp;
635 	uint_t	name_length = ill->ill_name_length;
636 	uint_t	template_len = arc->arc_name_length;
637 
638 	len = arc->arc_name_offset + name_length;
639 	mp = allocb(len, BPRI_HI);
640 	if (mp == NULL)
641 		return (NULL);
642 	cp = (char *)mp->b_rptr;
643 	mp->b_wptr = (uchar_t *)&cp[len];
644 	if (template_len)
645 		bcopy(template, cp, template_len);
646 	if (len > template_len)
647 		bzero(&cp[template_len], len - template_len);
648 	mp->b_datap->db_type = M_PROTO;
649 
650 	arc = (arc_t *)cp;
651 	arc->arc_name_length = name_length;
652 	cp = (char *)arc + arc->arc_name_offset;
653 	bcopy(ill->ill_name, cp, name_length);
654 
655 	if (addr) {
656 		area_t	*area = (area_t *)mp->b_rptr;
657 
658 		cp = (char *)area + area->area_proto_addr_offset;
659 		bcopy(addr, cp, area->area_proto_addr_length);
660 		if (area->area_cmd == AR_ENTRY_ADD) {
661 			cp = (char *)area;
662 			len = area->area_proto_addr_length;
663 			if (area->area_proto_mask_offset)
664 				cp += area->area_proto_mask_offset;
665 			else
666 				cp += area->area_proto_addr_offset + len;
667 			while (len-- > 0)
668 				*cp++ = (char)~0;
669 		}
670 	}
671 	return (mp);
672 }
673 
674 /*
675  * Completely vaporize a lower level tap and all associated interfaces.
676  * ill_delete is called only out of ip_close when the device control
677  * stream is being closed.
678  */
679 void
680 ill_delete(ill_t *ill)
681 {
682 	ipif_t	*ipif;
683 	ill_t	*prev_ill;
684 
685 	/*
686 	 * ill_delete may be forcibly entering the ipsq. The previous
687 	 * ioctl may not have completed and may need to be aborted.
688 	 * ipsq_flush takes care of it. If we don't need to enter the
689 	 * the ipsq forcibly, the 2nd invocation of ipsq_flush in
690 	 * ill_delete_tail is sufficient.
691 	 */
692 	ipsq_flush(ill);
693 
694 	/*
695 	 * Nuke all interfaces.  ipif_free will take down the interface,
696 	 * remove it from the list, and free the data structure.
697 	 * Walk down the ipif list and remove the logical interfaces
698 	 * first before removing the main ipif. We can't unplumb
699 	 * zeroth interface first in the case of IPv6 as reset_conn_ill
700 	 * -> ip_ll_delmulti_v6 de-references ill_ipif for checking
701 	 * POINTOPOINT.
702 	 *
703 	 * If ill_ipif was not properly initialized (i.e low on memory),
704 	 * then no interfaces to clean up. In this case just clean up the
705 	 * ill.
706 	 */
707 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
708 		ipif_free(ipif);
709 
710 	/*
711 	 * Used only by ill_arp_on and ill_arp_off, which are writers.
712 	 * So nobody can be using this mp now. Free the mp allocated for
713 	 * honoring ILLF_NOARP
714 	 */
715 	freemsg(ill->ill_arp_on_mp);
716 	ill->ill_arp_on_mp = NULL;
717 
718 	/* Clean up msgs on pending upcalls for mrouted */
719 	reset_mrt_ill(ill);
720 
721 	/*
722 	 * ipif_free -> reset_conn_ipif will remove all multicast
723 	 * references for IPv4. For IPv6, we need to do it here as
724 	 * it points only at ills.
725 	 */
726 	reset_conn_ill(ill);
727 
728 	/*
729 	 * ill_down will arrange to blow off any IRE's dependent on this
730 	 * ILL, and shut down fragmentation reassembly.
731 	 */
732 	ill_down(ill);
733 
734 	/* Let SCTP know, so that it can remove this from its list. */
735 	sctp_update_ill(ill, SCTP_ILL_REMOVE);
736 
737 	/*
738 	 * If an address on this ILL is being used as a source address then
739 	 * clear out the pointers in other ILLs that point to this ILL.
740 	 */
741 	rw_enter(&ill_g_usesrc_lock, RW_WRITER);
742 	if (ill->ill_usesrc_grp_next != NULL) {
743 		if (ill->ill_usesrc_ifindex == 0) { /* usesrc ILL ? */
744 			ill_disband_usesrc_group(ill);
745 		} else {	/* consumer of the usesrc ILL */
746 			prev_ill = ill_prev_usesrc(ill);
747 			prev_ill->ill_usesrc_grp_next =
748 			    ill->ill_usesrc_grp_next;
749 		}
750 	}
751 	rw_exit(&ill_g_usesrc_lock);
752 }
753 
754 /*
755  * ill_delete_tail is called from ip_modclose after all references
756  * to the closing ill are gone. The wait is done in ip_modclose
757  */
758 void
759 ill_delete_tail(ill_t *ill)
760 {
761 	mblk_t	**mpp;
762 	ipif_t	*ipif;
763 
764 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
765 		ipif_down_tail(ipif);
766 
767 	/*
768 	 * Send the detach if there's one to send (i.e., if we're above a
769 	 * style 2 DLPI driver).
770 	 */
771 	if (ill->ill_detach_mp != NULL) {
772 		ill_dlpi_send(ill, ill->ill_detach_mp);
773 		ill->ill_detach_mp = NULL;
774 	}
775 
776 	/*
777 	 * If polling capability is enabled (which signifies direct
778 	 * upcall into IP and driver has ill saved as a handle),
779 	 * we need to make sure that unbind has completed before we
780 	 * let the ill disappear and driver no longer has any reference
781 	 * to this ill.
782 	 */
783 	mutex_enter(&ill->ill_lock);
784 	if (ill->ill_capabilities & (ILL_CAPAB_POLL|ILL_CAPAB_SOFT_RING)) {
785 		while (!(ill->ill_state_flags & ILL_DL_UNBIND_DONE))
786 			cv_wait(&ill->ill_cv, &ill->ill_lock);
787 	}
788 	mutex_exit(&ill->ill_lock);
789 
790 	if (ill->ill_net_type != IRE_LOOPBACK)
791 		qprocsoff(ill->ill_rq);
792 
793 	/*
794 	 * We do an ipsq_flush once again now. New messages could have
795 	 * landed up from below (M_ERROR or M_HANGUP). Similarly ioctls
796 	 * could also have landed up if an ioctl thread had looked up
797 	 * the ill before we set the ILL_CONDEMNED flag, but not yet
798 	 * enqueued the ioctl when we did the ipsq_flush last time.
799 	 */
800 	ipsq_flush(ill);
801 
802 	/*
803 	 * Free capabilities.
804 	 */
805 	if (ill->ill_ipsec_capab_ah != NULL) {
806 		ill_ipsec_capab_delete(ill, DL_CAPAB_IPSEC_AH);
807 		ill_ipsec_capab_free(ill->ill_ipsec_capab_ah);
808 		ill->ill_ipsec_capab_ah = NULL;
809 	}
810 
811 	if (ill->ill_ipsec_capab_esp != NULL) {
812 		ill_ipsec_capab_delete(ill, DL_CAPAB_IPSEC_ESP);
813 		ill_ipsec_capab_free(ill->ill_ipsec_capab_esp);
814 		ill->ill_ipsec_capab_esp = NULL;
815 	}
816 
817 	if (ill->ill_mdt_capab != NULL) {
818 		kmem_free(ill->ill_mdt_capab, sizeof (ill_mdt_capab_t));
819 		ill->ill_mdt_capab = NULL;
820 	}
821 
822 	if (ill->ill_hcksum_capab != NULL) {
823 		kmem_free(ill->ill_hcksum_capab, sizeof (ill_hcksum_capab_t));
824 		ill->ill_hcksum_capab = NULL;
825 	}
826 
827 	if (ill->ill_zerocopy_capab != NULL) {
828 		kmem_free(ill->ill_zerocopy_capab,
829 		    sizeof (ill_zerocopy_capab_t));
830 		ill->ill_zerocopy_capab = NULL;
831 	}
832 
833 	/*
834 	 * Clean up polling and soft ring capabilities
835 	 */
836 	if (ill->ill_capabilities & (ILL_CAPAB_POLL|ILL_CAPAB_SOFT_RING))
837 		ill_capability_dls_disable(ill);
838 
839 	if (ill->ill_dls_capab != NULL) {
840 		CONN_DEC_REF(ill->ill_dls_capab->ill_unbind_conn);
841 		ill->ill_dls_capab->ill_unbind_conn = NULL;
842 		kmem_free(ill->ill_dls_capab,
843 		    sizeof (ill_dls_capab_t) +
844 		    (sizeof (ill_rx_ring_t) * ILL_MAX_RINGS));
845 		ill->ill_dls_capab = NULL;
846 	}
847 
848 	ASSERT(!(ill->ill_capabilities & ILL_CAPAB_POLL));
849 
850 	while (ill->ill_ipif != NULL)
851 		ipif_free_tail(ill->ill_ipif);
852 
853 	ill_down_tail(ill);
854 
855 	/*
856 	 * We have removed all references to ilm from conn and the ones joined
857 	 * within the kernel.
858 	 *
859 	 * We don't walk conns, mrts and ires because
860 	 *
861 	 * 1) reset_conn_ill and reset_mrt_ill cleans up conns and mrts.
862 	 * 2) ill_down ->ill_downi walks all the ires and cleans up
863 	 *    ill references.
864 	 */
865 	ASSERT(ilm_walk_ill(ill) == 0);
866 	/*
867 	 * Take us out of the list of ILLs. ill_glist_delete -> ill_phyint_free
868 	 * could free the phyint. No more reference to the phyint after this
869 	 * point.
870 	 */
871 	(void) ill_glist_delete(ill);
872 
873 	rw_enter(&ip_g_nd_lock, RW_WRITER);
874 	if (ill->ill_ndd_name != NULL)
875 		nd_unload(&ip_g_nd, ill->ill_ndd_name);
876 	rw_exit(&ip_g_nd_lock);
877 
878 
879 	if (ill->ill_frag_ptr != NULL) {
880 		uint_t count;
881 
882 		for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
883 			mutex_destroy(&ill->ill_frag_hash_tbl[count].ipfb_lock);
884 		}
885 		mi_free(ill->ill_frag_ptr);
886 		ill->ill_frag_ptr = NULL;
887 		ill->ill_frag_hash_tbl = NULL;
888 	}
889 	if (ill->ill_nd_lla_mp != NULL)
890 		freemsg(ill->ill_nd_lla_mp);
891 	/* Free all retained control messages. */
892 	mpp = &ill->ill_first_mp_to_free;
893 	do {
894 		while (mpp[0]) {
895 			mblk_t  *mp;
896 			mblk_t  *mp1;
897 
898 			mp = mpp[0];
899 			mpp[0] = mp->b_next;
900 			for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont) {
901 				mp1->b_next = NULL;
902 				mp1->b_prev = NULL;
903 			}
904 			freemsg(mp);
905 		}
906 	} while (mpp++ != &ill->ill_last_mp_to_free);
907 
908 	ill_free_mib(ill);
909 	ILL_TRACE_CLEANUP(ill);
910 }
911 
912 static void
913 ill_free_mib(ill_t *ill)
914 {
915 	if (ill->ill_ip6_mib != NULL) {
916 		kmem_free(ill->ill_ip6_mib, sizeof (*ill->ill_ip6_mib));
917 		ill->ill_ip6_mib = NULL;
918 	}
919 	if (ill->ill_icmp6_mib != NULL) {
920 		kmem_free(ill->ill_icmp6_mib, sizeof (*ill->ill_icmp6_mib));
921 		ill->ill_icmp6_mib = NULL;
922 	}
923 }
924 
925 /*
926  * Concatenate together a physical address and a sap.
927  *
928  * Sap_lengths are interpreted as follows:
929  *   sap_length == 0	==>	no sap
930  *   sap_length > 0	==>	sap is at the head of the dlpi address
931  *   sap_length < 0	==>	sap is at the tail of the dlpi address
932  */
933 static void
934 ill_dlur_copy_address(uchar_t *phys_src, uint_t phys_length,
935     t_scalar_t sap_src, t_scalar_t sap_length, uchar_t *dst)
936 {
937 	uint16_t sap_addr = (uint16_t)sap_src;
938 
939 	if (sap_length == 0) {
940 		if (phys_src == NULL)
941 			bzero(dst, phys_length);
942 		else
943 			bcopy(phys_src, dst, phys_length);
944 	} else if (sap_length < 0) {
945 		if (phys_src == NULL)
946 			bzero(dst, phys_length);
947 		else
948 			bcopy(phys_src, dst, phys_length);
949 		bcopy(&sap_addr, (char *)dst + phys_length, sizeof (sap_addr));
950 	} else {
951 		bcopy(&sap_addr, dst, sizeof (sap_addr));
952 		if (phys_src == NULL)
953 			bzero((char *)dst + sap_length, phys_length);
954 		else
955 			bcopy(phys_src, (char *)dst + sap_length, phys_length);
956 	}
957 }
958 
959 /*
960  * Generate a dl_unitdata_req mblk for the device and address given.
961  * addr_length is the length of the physical portion of the address.
962  * If addr is NULL include an all zero address of the specified length.
963  * TRUE? In any case, addr_length is taken to be the entire length of the
964  * dlpi address, including the absolute value of sap_length.
965  */
966 mblk_t *
967 ill_dlur_gen(uchar_t *addr, uint_t addr_length, t_uscalar_t sap,
968 		t_scalar_t sap_length)
969 {
970 	dl_unitdata_req_t *dlur;
971 	mblk_t	*mp;
972 	t_scalar_t	abs_sap_length;		/* absolute value */
973 
974 	abs_sap_length = ABS(sap_length);
975 	mp = ip_dlpi_alloc(sizeof (*dlur) + addr_length + abs_sap_length,
976 		DL_UNITDATA_REQ);
977 	if (mp == NULL)
978 		return (NULL);
979 	dlur = (dl_unitdata_req_t *)mp->b_rptr;
980 	/* HACK: accomodate incompatible DLPI drivers */
981 	if (addr_length == 8)
982 		addr_length = 6;
983 	dlur->dl_dest_addr_length = addr_length + abs_sap_length;
984 	dlur->dl_dest_addr_offset = sizeof (*dlur);
985 	dlur->dl_priority.dl_min = 0;
986 	dlur->dl_priority.dl_max = 0;
987 	ill_dlur_copy_address(addr, addr_length, sap, sap_length,
988 	    (uchar_t *)&dlur[1]);
989 	return (mp);
990 }
991 
992 /*
993  * Add the 'mp' to the list of pending mp's headed by ill_pending_mp
994  * Return an error if we already have 1 or more ioctls in progress.
995  * This is used only for non-exclusive ioctls. Currently this is used
996  * for SIOC*ARP and SIOCGTUNPARAM ioctls. Most set ioctls are exclusive
997  * and thus need to use ipsq_pending_mp_add.
998  */
999 boolean_t
1000 ill_pending_mp_add(ill_t *ill, conn_t *connp, mblk_t *add_mp)
1001 {
1002 	ASSERT(MUTEX_HELD(&ill->ill_lock));
1003 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
1004 	/*
1005 	 * M_IOCDATA from ioctls, M_IOCTL from tunnel ioctls.
1006 	 */
1007 	ASSERT((add_mp->b_datap->db_type == M_IOCDATA) ||
1008 	    (add_mp->b_datap->db_type == M_IOCTL));
1009 
1010 	ASSERT(MUTEX_HELD(&connp->conn_lock));
1011 	/*
1012 	 * Return error if the conn has started closing. The conn
1013 	 * could have finished cleaning up the pending mp list,
1014 	 * If so we should not add another mp to the list negating
1015 	 * the cleanup.
1016 	 */
1017 	if (connp->conn_state_flags & CONN_CLOSING)
1018 		return (B_FALSE);
1019 	/*
1020 	 * Add the pending mp to the head of the list, chained by b_next.
1021 	 * Note down the conn on which the ioctl request came, in b_prev.
1022 	 * This will be used to later get the conn, when we get a response
1023 	 * on the ill queue, from some other module (typically arp)
1024 	 */
1025 	add_mp->b_next = (void *)ill->ill_pending_mp;
1026 	add_mp->b_queue = CONNP_TO_WQ(connp);
1027 	ill->ill_pending_mp = add_mp;
1028 	if (connp != NULL)
1029 		connp->conn_oper_pending_ill = ill;
1030 	return (B_TRUE);
1031 }
1032 
1033 /*
1034  * Retrieve the ill_pending_mp and return it. We have to walk the list
1035  * of mblks starting at ill_pending_mp, and match based on the ioc_id.
1036  */
1037 mblk_t *
1038 ill_pending_mp_get(ill_t *ill, conn_t **connpp, uint_t ioc_id)
1039 {
1040 	mblk_t	*prev = NULL;
1041 	mblk_t	*curr = NULL;
1042 	uint_t	id;
1043 	conn_t	*connp;
1044 
1045 	/*
1046 	 * When the conn closes, conn_ioctl_cleanup needs to clean
1047 	 * up the pending mp, but it does not know the ioc_id and
1048 	 * passes in a zero for it.
1049 	 */
1050 	mutex_enter(&ill->ill_lock);
1051 	if (ioc_id != 0)
1052 		*connpp = NULL;
1053 
1054 	/* Search the list for the appropriate ioctl based on ioc_id */
1055 	for (prev = NULL, curr = ill->ill_pending_mp; curr != NULL;
1056 	    prev = curr, curr = curr->b_next) {
1057 		id = ((struct iocblk *)curr->b_rptr)->ioc_id;
1058 		connp = Q_TO_CONN(curr->b_queue);
1059 		/* Match based on the ioc_id or based on the conn */
1060 		if ((id == ioc_id) || (ioc_id == 0 && connp == *connpp))
1061 			break;
1062 	}
1063 
1064 	if (curr != NULL) {
1065 		/* Unlink the mblk from the pending mp list */
1066 		if (prev != NULL) {
1067 			prev->b_next = curr->b_next;
1068 		} else {
1069 			ASSERT(ill->ill_pending_mp == curr);
1070 			ill->ill_pending_mp = curr->b_next;
1071 		}
1072 
1073 		/*
1074 		 * conn refcnt must have been bumped up at the start of
1075 		 * the ioctl. So we can safely access the conn.
1076 		 */
1077 		ASSERT(CONN_Q(curr->b_queue));
1078 		*connpp = Q_TO_CONN(curr->b_queue);
1079 		curr->b_next = NULL;
1080 		curr->b_queue = NULL;
1081 	}
1082 
1083 	mutex_exit(&ill->ill_lock);
1084 
1085 	return (curr);
1086 }
1087 
1088 /*
1089  * Add the pending mp to the list. There can be only 1 pending mp
1090  * in the list. Any exclusive ioctl that needs to wait for a response
1091  * from another module or driver needs to use this function to set
1092  * the ipsq_pending_mp to the ioctl mblk and wait for the response from
1093  * the other module/driver. This is also used while waiting for the
1094  * ipif/ill/ire refcnts to drop to zero in bringing down an ipif.
1095  */
1096 boolean_t
1097 ipsq_pending_mp_add(conn_t *connp, ipif_t *ipif, queue_t *q, mblk_t *add_mp,
1098     int waitfor)
1099 {
1100 	ipsq_t	*ipsq;
1101 
1102 	ASSERT(IAM_WRITER_IPIF(ipif));
1103 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
1104 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
1105 	/*
1106 	 * M_IOCDATA from ioctls, M_IOCTL from tunnel ioctls,
1107 	 * M_ERROR/M_HANGUP from driver
1108 	 */
1109 	ASSERT((DB_TYPE(add_mp) == M_IOCDATA) || (DB_TYPE(add_mp) == M_IOCTL) ||
1110 	    (DB_TYPE(add_mp) == M_ERROR) || (DB_TYPE(add_mp) == M_HANGUP));
1111 
1112 	ipsq = ipif->ipif_ill->ill_phyint->phyint_ipsq;
1113 	if (connp != NULL) {
1114 		ASSERT(MUTEX_HELD(&connp->conn_lock));
1115 		/*
1116 		 * Return error if the conn has started closing. The conn
1117 		 * could have finished cleaning up the pending mp list,
1118 		 * If so we should not add another mp to the list negating
1119 		 * the cleanup.
1120 		 */
1121 		if (connp->conn_state_flags & CONN_CLOSING)
1122 			return (B_FALSE);
1123 	}
1124 	mutex_enter(&ipsq->ipsq_lock);
1125 	ipsq->ipsq_pending_ipif = ipif;
1126 	/*
1127 	 * Note down the queue in b_queue. This will be returned by
1128 	 * ipsq_pending_mp_get. Caller will then use these values to restart
1129 	 * the processing
1130 	 */
1131 	add_mp->b_next = NULL;
1132 	add_mp->b_queue = q;
1133 	ipsq->ipsq_pending_mp = add_mp;
1134 	ipsq->ipsq_waitfor = waitfor;
1135 	/*
1136 	 * ipsq_current_ipif is needed to restart the operation from
1137 	 * ipif_ill_refrele_tail when the last reference to the ipi/ill
1138 	 * is gone. Since this is not an ioctl ipsq_current_ipif has not
1139 	 * been set until now.
1140 	 */
1141 	if (DB_TYPE(add_mp) == M_ERROR || DB_TYPE(add_mp) == M_HANGUP) {
1142 		ASSERT(ipsq->ipsq_current_ipif == NULL);
1143 		ipsq->ipsq_current_ipif = ipif;
1144 		ipsq->ipsq_last_cmd = DB_TYPE(add_mp);
1145 	}
1146 	if (connp != NULL)
1147 		connp->conn_oper_pending_ill = ipif->ipif_ill;
1148 	mutex_exit(&ipsq->ipsq_lock);
1149 	return (B_TRUE);
1150 }
1151 
1152 /*
1153  * Retrieve the ipsq_pending_mp and return it. There can be only 1 mp
1154  * queued in the list.
1155  */
1156 mblk_t *
1157 ipsq_pending_mp_get(ipsq_t *ipsq, conn_t **connpp)
1158 {
1159 	mblk_t	*curr = NULL;
1160 
1161 	mutex_enter(&ipsq->ipsq_lock);
1162 	*connpp = NULL;
1163 	if (ipsq->ipsq_pending_mp == NULL) {
1164 		mutex_exit(&ipsq->ipsq_lock);
1165 		return (NULL);
1166 	}
1167 
1168 	/* There can be only 1 such excl message */
1169 	curr = ipsq->ipsq_pending_mp;
1170 	ASSERT(curr != NULL && curr->b_next == NULL);
1171 	ipsq->ipsq_pending_ipif = NULL;
1172 	ipsq->ipsq_pending_mp = NULL;
1173 	ipsq->ipsq_waitfor = 0;
1174 	mutex_exit(&ipsq->ipsq_lock);
1175 
1176 	if (CONN_Q(curr->b_queue)) {
1177 		/*
1178 		 * This mp did a refhold on the conn, at the start of the ioctl.
1179 		 * So we can safely return a pointer to the conn to the caller.
1180 		 */
1181 		*connpp = Q_TO_CONN(curr->b_queue);
1182 	} else {
1183 		*connpp = NULL;
1184 	}
1185 	curr->b_next = NULL;
1186 	curr->b_prev = NULL;
1187 	return (curr);
1188 }
1189 
1190 /*
1191  * Cleanup the ioctl mp queued in ipsq_pending_mp
1192  * - Called in the ill_delete path
1193  * - Called in the M_ERROR or M_HANGUP path on the ill.
1194  * - Called in the conn close path.
1195  */
1196 boolean_t
1197 ipsq_pending_mp_cleanup(ill_t *ill, conn_t *connp)
1198 {
1199 	mblk_t	*mp;
1200 	ipsq_t	*ipsq;
1201 	queue_t	*q;
1202 	ipif_t	*ipif;
1203 
1204 	ASSERT(IAM_WRITER_ILL(ill));
1205 	ipsq = ill->ill_phyint->phyint_ipsq;
1206 	mutex_enter(&ipsq->ipsq_lock);
1207 	/*
1208 	 * If connp is null, unconditionally clean up the ipsq_pending_mp.
1209 	 * This happens in M_ERROR/M_HANGUP. We need to abort the current ioctl
1210 	 * even if it is meant for another ill, since we have to enqueue
1211 	 * a new mp now in ipsq_pending_mp to complete the ipif_down.
1212 	 * If connp is non-null we are called from the conn close path.
1213 	 */
1214 	mp = ipsq->ipsq_pending_mp;
1215 	if (mp == NULL || (connp != NULL &&
1216 	    mp->b_queue != CONNP_TO_WQ(connp))) {
1217 		mutex_exit(&ipsq->ipsq_lock);
1218 		return (B_FALSE);
1219 	}
1220 	/* Now remove from the ipsq_pending_mp */
1221 	ipsq->ipsq_pending_mp = NULL;
1222 	q = mp->b_queue;
1223 	mp->b_next = NULL;
1224 	mp->b_prev = NULL;
1225 	mp->b_queue = NULL;
1226 
1227 	/* If MOVE was in progress, clear the move_in_progress fields also. */
1228 	ill = ipsq->ipsq_pending_ipif->ipif_ill;
1229 	if (ill->ill_move_in_progress) {
1230 		ILL_CLEAR_MOVE(ill);
1231 	} else if (ill->ill_up_ipifs) {
1232 		ill_group_cleanup(ill);
1233 	}
1234 
1235 	ipif = ipsq->ipsq_pending_ipif;
1236 	ipsq->ipsq_pending_ipif = NULL;
1237 	ipsq->ipsq_waitfor = 0;
1238 	ipsq->ipsq_current_ipif = NULL;
1239 	mutex_exit(&ipsq->ipsq_lock);
1240 
1241 	if (DB_TYPE(mp) == M_IOCTL || DB_TYPE(mp) == M_IOCDATA) {
1242 		ip_ioctl_finish(q, mp, ENXIO, connp != NULL ? CONN_CLOSE :
1243 		    NO_COPYOUT, connp != NULL ? ipif : NULL, NULL);
1244 	} else {
1245 		/*
1246 		 * IP-MT XXX In the case of TLI/XTI bind / optmgmt this can't
1247 		 * be just inet_freemsg. we have to restart it
1248 		 * otherwise the thread will be stuck.
1249 		 */
1250 		inet_freemsg(mp);
1251 	}
1252 	return (B_TRUE);
1253 }
1254 
1255 /*
1256  * The ill is closing. Cleanup all the pending mps. Called exclusively
1257  * towards the end of ill_delete. The refcount has gone to 0. So nobody
1258  * knows this ill, and hence nobody can add an mp to this list
1259  */
1260 static void
1261 ill_pending_mp_cleanup(ill_t *ill)
1262 {
1263 	mblk_t	*mp;
1264 	queue_t	*q;
1265 
1266 	ASSERT(IAM_WRITER_ILL(ill));
1267 
1268 	mutex_enter(&ill->ill_lock);
1269 	/*
1270 	 * Every mp on the pending mp list originating from an ioctl
1271 	 * added 1 to the conn refcnt, at the start of the ioctl.
1272 	 * So bump it down now.  See comments in ip_wput_nondata()
1273 	 */
1274 	while (ill->ill_pending_mp != NULL) {
1275 		mp = ill->ill_pending_mp;
1276 		ill->ill_pending_mp = mp->b_next;
1277 		mutex_exit(&ill->ill_lock);
1278 
1279 		q = mp->b_queue;
1280 		ASSERT(CONN_Q(q));
1281 		mp->b_next = NULL;
1282 		mp->b_prev = NULL;
1283 		mp->b_queue = NULL;
1284 		ip_ioctl_finish(q, mp, ENXIO, NO_COPYOUT, NULL, NULL);
1285 		mutex_enter(&ill->ill_lock);
1286 	}
1287 	ill->ill_pending_ipif = NULL;
1288 
1289 	mutex_exit(&ill->ill_lock);
1290 }
1291 
1292 /*
1293  * Called in the conn close path and ill delete path
1294  */
1295 static void
1296 ipsq_xopq_mp_cleanup(ill_t *ill, conn_t *connp)
1297 {
1298 	ipsq_t	*ipsq;
1299 	mblk_t	*prev;
1300 	mblk_t	*curr;
1301 	mblk_t	*next;
1302 	queue_t	*q;
1303 	mblk_t	*tmp_list = NULL;
1304 
1305 	ASSERT(IAM_WRITER_ILL(ill));
1306 	if (connp != NULL)
1307 		q = CONNP_TO_WQ(connp);
1308 	else
1309 		q = ill->ill_wq;
1310 
1311 	ipsq = ill->ill_phyint->phyint_ipsq;
1312 	/*
1313 	 * Cleanup the ioctl mp's queued in ipsq_xopq_pending_mp if any.
1314 	 * In the case of ioctl from a conn, there can be only 1 mp
1315 	 * queued on the ipsq. If an ill is being unplumbed, only messages
1316 	 * related to this ill are flushed, like M_ERROR or M_HANGUP message.
1317 	 * ioctls meant for this ill form conn's are not flushed. They will
1318 	 * be processed during ipsq_exit and will not find the ill and will
1319 	 * return error.
1320 	 */
1321 	mutex_enter(&ipsq->ipsq_lock);
1322 	for (prev = NULL, curr = ipsq->ipsq_xopq_mphead; curr != NULL;
1323 	    curr = next) {
1324 		next = curr->b_next;
1325 		if (curr->b_queue == q || curr->b_queue == RD(q)) {
1326 			/* Unlink the mblk from the pending mp list */
1327 			if (prev != NULL) {
1328 				prev->b_next = curr->b_next;
1329 			} else {
1330 				ASSERT(ipsq->ipsq_xopq_mphead == curr);
1331 				ipsq->ipsq_xopq_mphead = curr->b_next;
1332 			}
1333 			if (ipsq->ipsq_xopq_mptail == curr)
1334 				ipsq->ipsq_xopq_mptail = prev;
1335 			/*
1336 			 * Create a temporary list and release the ipsq lock
1337 			 * New elements are added to the head of the tmp_list
1338 			 */
1339 			curr->b_next = tmp_list;
1340 			tmp_list = curr;
1341 		} else {
1342 			prev = curr;
1343 		}
1344 	}
1345 	mutex_exit(&ipsq->ipsq_lock);
1346 
1347 	while (tmp_list != NULL) {
1348 		curr = tmp_list;
1349 		tmp_list = curr->b_next;
1350 		curr->b_next = NULL;
1351 		curr->b_prev = NULL;
1352 		curr->b_queue = NULL;
1353 		if (DB_TYPE(curr) == M_IOCTL || DB_TYPE(curr) == M_IOCDATA) {
1354 			ip_ioctl_finish(q, curr, ENXIO, connp != NULL ?
1355 			    CONN_CLOSE : NO_COPYOUT, NULL, NULL);
1356 		} else {
1357 			/*
1358 			 * IP-MT XXX In the case of TLI/XTI bind / optmgmt
1359 			 * this can't be just inet_freemsg. we have to
1360 			 * restart it otherwise the thread will be stuck.
1361 			 */
1362 			inet_freemsg(curr);
1363 		}
1364 	}
1365 }
1366 
1367 /*
1368  * This conn has started closing. Cleanup any pending ioctl from this conn.
1369  * STREAMS ensures that there can be at most 1 ioctl pending on a stream.
1370  */
1371 void
1372 conn_ioctl_cleanup(conn_t *connp)
1373 {
1374 	mblk_t *curr;
1375 	ipsq_t	*ipsq;
1376 	ill_t	*ill;
1377 	boolean_t refheld;
1378 
1379 	/*
1380 	 * Is any exclusive ioctl pending ? If so clean it up. If the
1381 	 * ioctl has not yet started, the mp is pending in the list headed by
1382 	 * ipsq_xopq_head. If the ioctl has started the mp could be present in
1383 	 * ipsq_pending_mp. If the ioctl timed out in the streamhead but
1384 	 * is currently executing now the mp is not queued anywhere but
1385 	 * conn_oper_pending_ill is null. The conn close will wait
1386 	 * till the conn_ref drops to zero.
1387 	 */
1388 	mutex_enter(&connp->conn_lock);
1389 	ill = connp->conn_oper_pending_ill;
1390 	if (ill == NULL) {
1391 		mutex_exit(&connp->conn_lock);
1392 		return;
1393 	}
1394 
1395 	curr = ill_pending_mp_get(ill, &connp, 0);
1396 	if (curr != NULL) {
1397 		mutex_exit(&connp->conn_lock);
1398 		CONN_DEC_REF(connp);
1399 		inet_freemsg(curr);
1400 		return;
1401 	}
1402 	/*
1403 	 * We may not be able to refhold the ill if the ill/ipif
1404 	 * is changing. But we need to make sure that the ill will
1405 	 * not vanish. So we just bump up the ill_waiter count.
1406 	 */
1407 	refheld = ill_waiter_inc(ill);
1408 	mutex_exit(&connp->conn_lock);
1409 	if (refheld) {
1410 		if (ipsq_enter(ill, B_TRUE)) {
1411 			ill_waiter_dcr(ill);
1412 			/*
1413 			 * Check whether this ioctl has started and is
1414 			 * pending now in ipsq_pending_mp. If it is not
1415 			 * found there then check whether this ioctl has
1416 			 * not even started and is in the ipsq_xopq list.
1417 			 */
1418 			if (!ipsq_pending_mp_cleanup(ill, connp))
1419 				ipsq_xopq_mp_cleanup(ill, connp);
1420 			ipsq = ill->ill_phyint->phyint_ipsq;
1421 			ipsq_exit(ipsq, B_TRUE, B_TRUE);
1422 			return;
1423 		}
1424 	}
1425 
1426 	/*
1427 	 * The ill is also closing and we could not bump up the
1428 	 * ill_waiter_count or we could not enter the ipsq. Leave
1429 	 * the cleanup to ill_delete
1430 	 */
1431 	mutex_enter(&connp->conn_lock);
1432 	while (connp->conn_oper_pending_ill != NULL)
1433 		cv_wait(&connp->conn_refcv, &connp->conn_lock);
1434 	mutex_exit(&connp->conn_lock);
1435 	if (refheld)
1436 		ill_waiter_dcr(ill);
1437 }
1438 
1439 /*
1440  * ipcl_walk function for cleaning up conn_*_ill fields.
1441  */
1442 static void
1443 conn_cleanup_ill(conn_t *connp, caddr_t arg)
1444 {
1445 	ill_t	*ill = (ill_t *)arg;
1446 	ire_t	*ire;
1447 
1448 	mutex_enter(&connp->conn_lock);
1449 	if (connp->conn_multicast_ill == ill) {
1450 		/* Revert to late binding */
1451 		connp->conn_multicast_ill = NULL;
1452 		connp->conn_orig_multicast_ifindex = 0;
1453 	}
1454 	if (connp->conn_incoming_ill == ill)
1455 		connp->conn_incoming_ill = NULL;
1456 	if (connp->conn_outgoing_ill == ill)
1457 		connp->conn_outgoing_ill = NULL;
1458 	if (connp->conn_outgoing_pill == ill)
1459 		connp->conn_outgoing_pill = NULL;
1460 	if (connp->conn_nofailover_ill == ill)
1461 		connp->conn_nofailover_ill = NULL;
1462 	if (connp->conn_xmit_if_ill == ill)
1463 		connp->conn_xmit_if_ill = NULL;
1464 	if (connp->conn_ire_cache != NULL) {
1465 		ire = connp->conn_ire_cache;
1466 		/*
1467 		 * ip_newroute creates IRE_CACHE with ire_stq coming from
1468 		 * interface X and ipif coming from interface Y, if interface
1469 		 * X and Y are part of the same IPMPgroup. Thus whenever
1470 		 * interface X goes down, remove all references to it by
1471 		 * checking both on ire_ipif and ire_stq.
1472 		 */
1473 		if ((ire->ire_ipif != NULL && ire->ire_ipif->ipif_ill == ill) ||
1474 		    (ire->ire_type == IRE_CACHE &&
1475 		    ire->ire_stq == ill->ill_wq)) {
1476 			connp->conn_ire_cache = NULL;
1477 			mutex_exit(&connp->conn_lock);
1478 			ire_refrele_notr(ire);
1479 			return;
1480 		}
1481 	}
1482 	mutex_exit(&connp->conn_lock);
1483 
1484 }
1485 
1486 /* ARGSUSED */
1487 void
1488 ipif_all_down_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
1489 {
1490 	ill_t	*ill = q->q_ptr;
1491 	ipif_t	*ipif;
1492 
1493 	ASSERT(IAM_WRITER_IPSQ(ipsq));
1494 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
1495 		ipif_down_tail(ipif);
1496 	ill_down_tail(ill);
1497 	freemsg(mp);
1498 	ipsq->ipsq_current_ipif = NULL;
1499 }
1500 
1501 /*
1502  * ill_down_start is called when we want to down this ill and bring it up again
1503  * It is called when we receive an M_ERROR / M_HANGUP. In this case we shut down
1504  * all interfaces, but don't tear down any plumbing.
1505  */
1506 boolean_t
1507 ill_down_start(queue_t *q, mblk_t *mp)
1508 {
1509 	ill_t	*ill;
1510 	ipif_t	*ipif;
1511 
1512 	ill = q->q_ptr;
1513 
1514 	ASSERT(IAM_WRITER_ILL(ill));
1515 
1516 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
1517 		(void) ipif_down(ipif, NULL, NULL);
1518 
1519 	ill_down(ill);
1520 
1521 	(void) ipsq_pending_mp_cleanup(ill, NULL);
1522 	mutex_enter(&ill->ill_lock);
1523 	/*
1524 	 * Atomically test and add the pending mp if references are
1525 	 * still active.
1526 	 */
1527 	if (!ill_is_quiescent(ill)) {
1528 		/*
1529 		 * Get rid of any pending mps and cleanup. Call will
1530 		 * not fail since we are passing a null connp.
1531 		 */
1532 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
1533 		    mp, ILL_DOWN);
1534 		mutex_exit(&ill->ill_lock);
1535 		return (B_FALSE);
1536 	}
1537 	mutex_exit(&ill->ill_lock);
1538 	return (B_TRUE);
1539 }
1540 
1541 static void
1542 ill_down(ill_t *ill)
1543 {
1544 	/* Blow off any IREs dependent on this ILL. */
1545 	ire_walk(ill_downi, (char *)ill);
1546 
1547 	mutex_enter(&ire_mrtun_lock);
1548 	if (ire_mrtun_count != 0) {
1549 		mutex_exit(&ire_mrtun_lock);
1550 		ire_walk_ill_mrtun(0, 0, ill_downi_mrtun_srcif,
1551 		    (char *)ill, NULL);
1552 	} else {
1553 		mutex_exit(&ire_mrtun_lock);
1554 	}
1555 
1556 	/*
1557 	 * If any interface based forwarding table exists
1558 	 * Blow off the ires there dependent on this ill
1559 	 */
1560 	mutex_enter(&ire_srcif_table_lock);
1561 	if (ire_srcif_table_count > 0) {
1562 		mutex_exit(&ire_srcif_table_lock);
1563 		ire_walk_srcif_table_v4(ill_downi_mrtun_srcif, (char *)ill);
1564 	} else {
1565 		mutex_exit(&ire_srcif_table_lock);
1566 	}
1567 
1568 	/* Remove any conn_*_ill depending on this ill */
1569 	ipcl_walk(conn_cleanup_ill, (caddr_t)ill);
1570 
1571 	if (ill->ill_group != NULL) {
1572 		illgrp_delete(ill);
1573 	}
1574 
1575 }
1576 
1577 static void
1578 ill_down_tail(ill_t *ill)
1579 {
1580 	int	i;
1581 
1582 	/* Destroy ill_srcif_table if it exists */
1583 	/* Lock not reqd really because nobody should be able to access */
1584 	mutex_enter(&ill->ill_lock);
1585 	if (ill->ill_srcif_table != NULL) {
1586 		ill->ill_srcif_refcnt = 0;
1587 		for (i = 0; i < IP_SRCIF_TABLE_SIZE; i++) {
1588 			rw_destroy(&ill->ill_srcif_table[i].irb_lock);
1589 		}
1590 		kmem_free(ill->ill_srcif_table,
1591 		    IP_SRCIF_TABLE_SIZE * sizeof (irb_t));
1592 		ill->ill_srcif_table = NULL;
1593 		ill->ill_srcif_refcnt = 0;
1594 		ill->ill_mrtun_refcnt = 0;
1595 	}
1596 	mutex_exit(&ill->ill_lock);
1597 }
1598 
1599 /*
1600  * ire_walk routine used to delete every IRE that depends on queues
1601  * associated with 'ill'.  (Always called as writer.)
1602  */
1603 static void
1604 ill_downi(ire_t *ire, char *ill_arg)
1605 {
1606 	ill_t	*ill = (ill_t *)ill_arg;
1607 
1608 	/*
1609 	 * ip_newroute creates IRE_CACHE with ire_stq coming from
1610 	 * interface X and ipif coming from interface Y, if interface
1611 	 * X and Y are part of the same IPMP group. Thus whenever interface
1612 	 * X goes down, remove all references to it by checking both
1613 	 * on ire_ipif and ire_stq.
1614 	 */
1615 	if ((ire->ire_ipif != NULL && ire->ire_ipif->ipif_ill == ill) ||
1616 	    (ire->ire_type == IRE_CACHE && ire->ire_stq == ill->ill_wq)) {
1617 		ire_delete(ire);
1618 	}
1619 }
1620 
1621 /*
1622  * A seperate routine for deleting revtun and srcif based routes
1623  * are needed because the ires only deleted when the interface
1624  * is unplumbed. Also these ires have ire_in_ill non-null as well.
1625  * we want to keep mobile IP specific code separate.
1626  */
1627 static void
1628 ill_downi_mrtun_srcif(ire_t *ire, char *ill_arg)
1629 {
1630 	ill_t   *ill = (ill_t *)ill_arg;
1631 
1632 	ASSERT(ire->ire_in_ill != NULL);
1633 
1634 	if ((ire->ire_in_ill != NULL && ire->ire_in_ill == ill) ||
1635 	    (ire->ire_stq == ill->ill_wq) || (ire->ire_stq == ill->ill_rq)) {
1636 		ire_delete(ire);
1637 	}
1638 }
1639 
1640 /*
1641  * Remove ire/nce from the fastpath list.
1642  */
1643 void
1644 ill_fastpath_nack(ill_t *ill)
1645 {
1646 	if (ill->ill_isv6) {
1647 		nce_fastpath_list_dispatch(ill, NULL, NULL);
1648 	} else {
1649 		ire_fastpath_list_dispatch(ill, NULL, NULL);
1650 	}
1651 }
1652 
1653 /* Consume an M_IOCACK of the fastpath probe. */
1654 void
1655 ill_fastpath_ack(ill_t *ill, mblk_t *mp)
1656 {
1657 	mblk_t	*mp1 = mp;
1658 
1659 	/*
1660 	 * If this was the first attempt turn on the fastpath probing.
1661 	 */
1662 	mutex_enter(&ill->ill_lock);
1663 	if (ill->ill_dlpi_fastpath_state == IDMS_INPROGRESS)
1664 		ill->ill_dlpi_fastpath_state = IDMS_OK;
1665 	mutex_exit(&ill->ill_lock);
1666 
1667 	/* Free the M_IOCACK mblk, hold on to the data */
1668 	mp = mp->b_cont;
1669 	freeb(mp1);
1670 	if (mp == NULL)
1671 		return;
1672 	if (mp->b_cont != NULL) {
1673 		/*
1674 		 * Update all IRE's or NCE's that are waiting for
1675 		 * fastpath update.
1676 		 */
1677 		if (ill->ill_isv6) {
1678 			/*
1679 			 * update nce's in the fastpath list.
1680 			 */
1681 			nce_fastpath_list_dispatch(ill,
1682 			    ndp_fastpath_update, mp);
1683 		} else {
1684 
1685 			/*
1686 			 * update ire's in the fastpath list.
1687 			 */
1688 			ire_fastpath_list_dispatch(ill,
1689 			    ire_fastpath_update, mp);
1690 			/*
1691 			 * Check if we need to traverse reverse tunnel table.
1692 			 * Since there is only single ire_type (IRE_MIPRTUN)
1693 			 * in the table, we don't need to match on ire_type.
1694 			 * We have to check ire_mrtun_count and not the
1695 			 * ill_mrtun_refcnt since ill_mrtun_refcnt is set
1696 			 * on the incoming ill and here we are dealing with
1697 			 * outgoing ill.
1698 			 */
1699 			mutex_enter(&ire_mrtun_lock);
1700 			if (ire_mrtun_count != 0) {
1701 				mutex_exit(&ire_mrtun_lock);
1702 				ire_walk_ill_mrtun(MATCH_IRE_WQ, IRE_MIPRTUN,
1703 				    (void (*)(ire_t *, void *))
1704 					ire_fastpath_update, mp, ill);
1705 			} else {
1706 				mutex_exit(&ire_mrtun_lock);
1707 			}
1708 		}
1709 		mp1 = mp->b_cont;
1710 		freeb(mp);
1711 		mp = mp1;
1712 	} else {
1713 		ip0dbg(("ill_fastpath_ack:  no b_cont\n"));
1714 	}
1715 
1716 	freeb(mp);
1717 }
1718 
1719 /*
1720  * Throw an M_IOCTL message downstream asking "do you know fastpath?"
1721  * The data portion of the request is a dl_unitdata_req_t template for
1722  * what we would send downstream in the absence of a fastpath confirmation.
1723  */
1724 int
1725 ill_fastpath_probe(ill_t *ill, mblk_t *dlur_mp)
1726 {
1727 	struct iocblk	*ioc;
1728 	mblk_t	*mp;
1729 
1730 	if (dlur_mp == NULL)
1731 		return (EINVAL);
1732 
1733 	mutex_enter(&ill->ill_lock);
1734 	switch (ill->ill_dlpi_fastpath_state) {
1735 	case IDMS_FAILED:
1736 		/*
1737 		 * Driver NAKed the first fastpath ioctl - assume it doesn't
1738 		 * support it.
1739 		 */
1740 		mutex_exit(&ill->ill_lock);
1741 		return (ENOTSUP);
1742 	case IDMS_UNKNOWN:
1743 		/* This is the first probe */
1744 		ill->ill_dlpi_fastpath_state = IDMS_INPROGRESS;
1745 		break;
1746 	default:
1747 		break;
1748 	}
1749 	mutex_exit(&ill->ill_lock);
1750 
1751 	if ((mp = mkiocb(DL_IOC_HDR_INFO)) == NULL)
1752 		return (EAGAIN);
1753 
1754 	mp->b_cont = copyb(dlur_mp);
1755 	if (mp->b_cont == NULL) {
1756 		freeb(mp);
1757 		return (EAGAIN);
1758 	}
1759 
1760 	ioc = (struct iocblk *)mp->b_rptr;
1761 	ioc->ioc_count = msgdsize(mp->b_cont);
1762 
1763 	putnext(ill->ill_wq, mp);
1764 	return (0);
1765 }
1766 
1767 void
1768 ill_capability_probe(ill_t *ill)
1769 {
1770 	/*
1771 	 * Do so only if negotiation is enabled, capabilities are unknown,
1772 	 * and a capability negotiation is not already in progress.
1773 	 */
1774 	if (ill->ill_capab_state != IDMS_UNKNOWN &&
1775 	    ill->ill_capab_state != IDMS_RENEG)
1776 		return;
1777 
1778 	ill->ill_capab_state = IDMS_INPROGRESS;
1779 	ip1dbg(("ill_capability_probe: starting capability negotiation\n"));
1780 	ill_capability_proto(ill, DL_CAPABILITY_REQ, NULL);
1781 }
1782 
1783 void
1784 ill_capability_reset(ill_t *ill)
1785 {
1786 	mblk_t *sc_mp = NULL;
1787 	mblk_t *tmp;
1788 
1789 	/*
1790 	 * Note here that we reset the state to UNKNOWN, and later send
1791 	 * down the DL_CAPABILITY_REQ without first setting the state to
1792 	 * INPROGRESS.  We do this in order to distinguish the
1793 	 * DL_CAPABILITY_ACK response which may come back in response to
1794 	 * a "reset" apart from the "probe" DL_CAPABILITY_REQ.  This would
1795 	 * also handle the case where the driver doesn't send us back
1796 	 * a DL_CAPABILITY_ACK in response, since the "probe" routine
1797 	 * requires the state to be in UNKNOWN anyway.  In any case, all
1798 	 * features are turned off until the state reaches IDMS_OK.
1799 	 */
1800 	ill->ill_capab_state = IDMS_UNKNOWN;
1801 
1802 	/*
1803 	 * Disable sub-capabilities and request a list of sub-capability
1804 	 * messages which will be sent down to the driver.  Each handler
1805 	 * allocates the corresponding dl_capability_sub_t inside an
1806 	 * mblk, and links it to the existing sc_mp mblk, or return it
1807 	 * as sc_mp if it's the first sub-capability (the passed in
1808 	 * sc_mp is NULL).  Upon returning from all capability handlers,
1809 	 * sc_mp will be pulled-up, before passing it downstream.
1810 	 */
1811 	ill_capability_mdt_reset(ill, &sc_mp);
1812 	ill_capability_hcksum_reset(ill, &sc_mp);
1813 	ill_capability_zerocopy_reset(ill, &sc_mp);
1814 	ill_capability_ipsec_reset(ill, &sc_mp);
1815 	ill_capability_dls_reset(ill, &sc_mp);
1816 
1817 	/* Nothing to send down in order to disable the capabilities? */
1818 	if (sc_mp == NULL)
1819 		return;
1820 
1821 	tmp = msgpullup(sc_mp, -1);
1822 	freemsg(sc_mp);
1823 	if ((sc_mp = tmp) == NULL) {
1824 		cmn_err(CE_WARN, "ill_capability_reset: unable to send down "
1825 		    "DL_CAPABILITY_REQ (ENOMEM)\n");
1826 		return;
1827 	}
1828 
1829 	ip1dbg(("ill_capability_reset: resetting negotiated capabilities\n"));
1830 	ill_capability_proto(ill, DL_CAPABILITY_REQ, sc_mp);
1831 }
1832 
1833 /*
1834  * Request or set new-style hardware capabilities supported by DLS provider.
1835  */
1836 static void
1837 ill_capability_proto(ill_t *ill, int type, mblk_t *reqp)
1838 {
1839 	mblk_t *mp;
1840 	dl_capability_req_t *capb;
1841 	size_t size = 0;
1842 	uint8_t *ptr;
1843 
1844 	if (reqp != NULL)
1845 		size = MBLKL(reqp);
1846 
1847 	mp = ip_dlpi_alloc(sizeof (dl_capability_req_t) + size, type);
1848 	if (mp == NULL) {
1849 		freemsg(reqp);
1850 		return;
1851 	}
1852 	ptr = mp->b_rptr;
1853 
1854 	capb = (dl_capability_req_t *)ptr;
1855 	ptr += sizeof (dl_capability_req_t);
1856 
1857 	if (reqp != NULL) {
1858 		capb->dl_sub_offset = sizeof (dl_capability_req_t);
1859 		capb->dl_sub_length = size;
1860 		bcopy(reqp->b_rptr, ptr, size);
1861 		ptr += size;
1862 		mp->b_cont = reqp->b_cont;
1863 		freeb(reqp);
1864 	}
1865 	ASSERT(ptr == mp->b_wptr);
1866 
1867 	ill_dlpi_send(ill, mp);
1868 }
1869 
1870 static void
1871 ill_capability_id_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *outers)
1872 {
1873 	dl_capab_id_t *id_ic;
1874 	uint_t sub_dl_cap = outers->dl_cap;
1875 	dl_capability_sub_t *inners;
1876 	uint8_t *capend;
1877 
1878 	ASSERT(sub_dl_cap == DL_CAPAB_ID_WRAPPER);
1879 
1880 	/*
1881 	 * Note: range checks here are not absolutely sufficient to
1882 	 * make us robust against malformed messages sent by drivers;
1883 	 * this is in keeping with the rest of IP's dlpi handling.
1884 	 * (Remember, it's coming from something else in the kernel
1885 	 * address space)
1886 	 */
1887 
1888 	capend = (uint8_t *)(outers + 1) + outers->dl_length;
1889 	if (capend > mp->b_wptr) {
1890 		cmn_err(CE_WARN, "ill_capability_id_ack: "
1891 		    "malformed sub-capability too long for mblk");
1892 		return;
1893 	}
1894 
1895 	id_ic = (dl_capab_id_t *)(outers + 1);
1896 
1897 	if (outers->dl_length < sizeof (*id_ic) ||
1898 	    (inners = &id_ic->id_subcap,
1899 	    inners->dl_length > (outers->dl_length - sizeof (*inners)))) {
1900 		cmn_err(CE_WARN, "ill_capability_id_ack: malformed "
1901 		    "encapsulated capab type %d too long for mblk",
1902 		    inners->dl_cap);
1903 		return;
1904 	}
1905 
1906 	if (!dlcapabcheckqid(&id_ic->id_mid, ill->ill_lmod_rq)) {
1907 		ip1dbg(("ill_capability_id_ack: mid token for capab type %d "
1908 		    "isn't as expected; pass-thru module(s) detected, "
1909 		    "discarding capability\n", inners->dl_cap));
1910 		return;
1911 	}
1912 
1913 	/* Process the encapsulated sub-capability */
1914 	ill_capability_dispatch(ill, mp, inners, B_TRUE);
1915 }
1916 
1917 /*
1918  * Process Multidata Transmit capability negotiation ack received from a
1919  * DLS Provider.  isub must point to the sub-capability (DL_CAPAB_MDT) of a
1920  * DL_CAPABILITY_ACK message.
1921  */
1922 static void
1923 ill_capability_mdt_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1924 {
1925 	mblk_t *nmp = NULL;
1926 	dl_capability_req_t *oc;
1927 	dl_capab_mdt_t *mdt_ic, *mdt_oc;
1928 	ill_mdt_capab_t **ill_mdt_capab;
1929 	uint_t sub_dl_cap = isub->dl_cap;
1930 	uint8_t *capend;
1931 
1932 	ASSERT(sub_dl_cap == DL_CAPAB_MDT);
1933 
1934 	ill_mdt_capab = (ill_mdt_capab_t **)&ill->ill_mdt_capab;
1935 
1936 	/*
1937 	 * Note: range checks here are not absolutely sufficient to
1938 	 * make us robust against malformed messages sent by drivers;
1939 	 * this is in keeping with the rest of IP's dlpi handling.
1940 	 * (Remember, it's coming from something else in the kernel
1941 	 * address space)
1942 	 */
1943 
1944 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1945 	if (capend > mp->b_wptr) {
1946 		cmn_err(CE_WARN, "ill_capability_mdt_ack: "
1947 		    "malformed sub-capability too long for mblk");
1948 		return;
1949 	}
1950 
1951 	mdt_ic = (dl_capab_mdt_t *)(isub + 1);
1952 
1953 	if (mdt_ic->mdt_version != MDT_VERSION_2) {
1954 		cmn_err(CE_CONT, "ill_capability_mdt_ack: "
1955 		    "unsupported MDT sub-capability (version %d, expected %d)",
1956 		    mdt_ic->mdt_version, MDT_VERSION_2);
1957 		return;
1958 	}
1959 
1960 	if (!dlcapabcheckqid(&mdt_ic->mdt_mid, ill->ill_lmod_rq)) {
1961 		ip1dbg(("ill_capability_mdt_ack: mid token for MDT "
1962 		    "capability isn't as expected; pass-thru module(s) "
1963 		    "detected, discarding capability\n"));
1964 		return;
1965 	}
1966 
1967 	if (mdt_ic->mdt_flags & DL_CAPAB_MDT_ENABLE) {
1968 
1969 		if (*ill_mdt_capab == NULL) {
1970 			*ill_mdt_capab = kmem_zalloc(sizeof (ill_mdt_capab_t),
1971 			    KM_NOSLEEP);
1972 
1973 			if (*ill_mdt_capab == NULL) {
1974 				cmn_err(CE_WARN, "ill_capability_mdt_ack: "
1975 				    "could not enable MDT version %d "
1976 				    "for %s (ENOMEM)\n", MDT_VERSION_2,
1977 				    ill->ill_name);
1978 				return;
1979 			}
1980 		}
1981 
1982 		ip1dbg(("ill_capability_mdt_ack: interface %s supports "
1983 		    "MDT version %d (%d bytes leading, %d bytes trailing "
1984 		    "header spaces, %d max pld bufs, %d span limit)\n",
1985 		    ill->ill_name, MDT_VERSION_2,
1986 		    mdt_ic->mdt_hdr_head, mdt_ic->mdt_hdr_tail,
1987 		    mdt_ic->mdt_max_pld, mdt_ic->mdt_span_limit));
1988 
1989 		(*ill_mdt_capab)->ill_mdt_version = MDT_VERSION_2;
1990 		(*ill_mdt_capab)->ill_mdt_on = 1;
1991 		/*
1992 		 * Round the following values to the nearest 32-bit; ULP
1993 		 * may further adjust them to accomodate for additional
1994 		 * protocol headers.  We pass these values to ULP during
1995 		 * bind time.
1996 		 */
1997 		(*ill_mdt_capab)->ill_mdt_hdr_head =
1998 		    roundup(mdt_ic->mdt_hdr_head, 4);
1999 		(*ill_mdt_capab)->ill_mdt_hdr_tail =
2000 		    roundup(mdt_ic->mdt_hdr_tail, 4);
2001 		(*ill_mdt_capab)->ill_mdt_max_pld = mdt_ic->mdt_max_pld;
2002 		(*ill_mdt_capab)->ill_mdt_span_limit = mdt_ic->mdt_span_limit;
2003 
2004 		ill->ill_capabilities |= ILL_CAPAB_MDT;
2005 	} else {
2006 		uint_t size;
2007 		uchar_t *rptr;
2008 
2009 		size = sizeof (dl_capability_req_t) +
2010 		    sizeof (dl_capability_sub_t) + sizeof (dl_capab_mdt_t);
2011 
2012 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2013 			cmn_err(CE_WARN, "ill_capability_mdt_ack: "
2014 			    "could not enable MDT for %s (ENOMEM)\n",
2015 			    ill->ill_name);
2016 			return;
2017 		}
2018 
2019 		rptr = nmp->b_rptr;
2020 		/* initialize dl_capability_req_t */
2021 		oc = (dl_capability_req_t *)nmp->b_rptr;
2022 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
2023 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
2024 		    sizeof (dl_capab_mdt_t);
2025 		nmp->b_rptr += sizeof (dl_capability_req_t);
2026 
2027 		/* initialize dl_capability_sub_t */
2028 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
2029 		nmp->b_rptr += sizeof (*isub);
2030 
2031 		/* initialize dl_capab_mdt_t */
2032 		mdt_oc = (dl_capab_mdt_t *)nmp->b_rptr;
2033 		bcopy(mdt_ic, mdt_oc, sizeof (*mdt_ic));
2034 
2035 		nmp->b_rptr = rptr;
2036 
2037 		ip1dbg(("ill_capability_mdt_ack: asking interface %s "
2038 		    "to enable MDT version %d\n", ill->ill_name,
2039 		    MDT_VERSION_2));
2040 
2041 		/* set ENABLE flag */
2042 		mdt_oc->mdt_flags |= DL_CAPAB_MDT_ENABLE;
2043 
2044 		/* nmp points to a DL_CAPABILITY_REQ message to enable MDT */
2045 		ill_dlpi_send(ill, nmp);
2046 	}
2047 }
2048 
2049 static void
2050 ill_capability_mdt_reset(ill_t *ill, mblk_t **sc_mp)
2051 {
2052 	mblk_t *mp;
2053 	dl_capab_mdt_t *mdt_subcap;
2054 	dl_capability_sub_t *dl_subcap;
2055 	int size;
2056 
2057 	if (!ILL_MDT_CAPABLE(ill))
2058 		return;
2059 
2060 	ASSERT(ill->ill_mdt_capab != NULL);
2061 	/*
2062 	 * Clear the capability flag for MDT but retain the ill_mdt_capab
2063 	 * structure since it's possible that another thread is still
2064 	 * referring to it.  The structure only gets deallocated when
2065 	 * we destroy the ill.
2066 	 */
2067 	ill->ill_capabilities &= ~ILL_CAPAB_MDT;
2068 
2069 	size = sizeof (*dl_subcap) + sizeof (*mdt_subcap);
2070 
2071 	mp = allocb(size, BPRI_HI);
2072 	if (mp == NULL) {
2073 		ip1dbg(("ill_capability_mdt_reset: unable to allocate "
2074 		    "request to disable MDT\n"));
2075 		return;
2076 	}
2077 
2078 	mp->b_wptr = mp->b_rptr + size;
2079 
2080 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
2081 	dl_subcap->dl_cap = DL_CAPAB_MDT;
2082 	dl_subcap->dl_length = sizeof (*mdt_subcap);
2083 
2084 	mdt_subcap = (dl_capab_mdt_t *)(dl_subcap + 1);
2085 	mdt_subcap->mdt_version = ill->ill_mdt_capab->ill_mdt_version;
2086 	mdt_subcap->mdt_flags = 0;
2087 	mdt_subcap->mdt_hdr_head = 0;
2088 	mdt_subcap->mdt_hdr_tail = 0;
2089 
2090 	if (*sc_mp != NULL)
2091 		linkb(*sc_mp, mp);
2092 	else
2093 		*sc_mp = mp;
2094 }
2095 
2096 /*
2097  * Send a DL_NOTIFY_REQ to the specified ill to enable
2098  * DL_NOTE_PROMISC_ON/OFF_PHYS notifications.
2099  * Invoked by ill_capability_ipsec_ack() before enabling IPsec hardware
2100  * acceleration.
2101  * Returns B_TRUE on success, B_FALSE if the message could not be sent.
2102  */
2103 static boolean_t
2104 ill_enable_promisc_notify(ill_t *ill)
2105 {
2106 	mblk_t *mp;
2107 	dl_notify_req_t *req;
2108 
2109 	IPSECHW_DEBUG(IPSECHW_PKT, ("ill_enable_promisc_notify:\n"));
2110 
2111 	mp = ip_dlpi_alloc(sizeof (dl_notify_req_t), DL_NOTIFY_REQ);
2112 	if (mp == NULL)
2113 		return (B_FALSE);
2114 
2115 	req = (dl_notify_req_t *)mp->b_rptr;
2116 	req->dl_notifications = DL_NOTE_PROMISC_ON_PHYS |
2117 	    DL_NOTE_PROMISC_OFF_PHYS;
2118 
2119 	ill_dlpi_send(ill, mp);
2120 
2121 	return (B_TRUE);
2122 }
2123 
2124 
2125 /*
2126  * Allocate an IPsec capability request which will be filled by our
2127  * caller to turn on support for one or more algorithms.
2128  */
2129 static mblk_t *
2130 ill_alloc_ipsec_cap_req(ill_t *ill, dl_capability_sub_t *isub)
2131 {
2132 	mblk_t *nmp;
2133 	dl_capability_req_t	*ocap;
2134 	dl_capab_ipsec_t	*ocip;
2135 	dl_capab_ipsec_t	*icip;
2136 	uint8_t			*ptr;
2137 	icip = (dl_capab_ipsec_t *)(isub + 1);
2138 
2139 	/*
2140 	 * The first time around, we send a DL_NOTIFY_REQ to enable
2141 	 * PROMISC_ON/OFF notification from the provider. We need to
2142 	 * do this before enabling the algorithms to avoid leakage of
2143 	 * cleartext packets.
2144 	 */
2145 
2146 	if (!ill_enable_promisc_notify(ill))
2147 		return (NULL);
2148 
2149 	/*
2150 	 * Allocate new mblk which will contain a new capability
2151 	 * request to enable the capabilities.
2152 	 */
2153 
2154 	nmp = ip_dlpi_alloc(sizeof (dl_capability_req_t) +
2155 	    sizeof (dl_capability_sub_t) + isub->dl_length, DL_CAPABILITY_REQ);
2156 	if (nmp == NULL)
2157 		return (NULL);
2158 
2159 	ptr = nmp->b_rptr;
2160 
2161 	/* initialize dl_capability_req_t */
2162 	ocap = (dl_capability_req_t *)ptr;
2163 	ocap->dl_sub_offset = sizeof (dl_capability_req_t);
2164 	ocap->dl_sub_length = sizeof (dl_capability_sub_t) + isub->dl_length;
2165 	ptr += sizeof (dl_capability_req_t);
2166 
2167 	/* initialize dl_capability_sub_t */
2168 	bcopy(isub, ptr, sizeof (*isub));
2169 	ptr += sizeof (*isub);
2170 
2171 	/* initialize dl_capab_ipsec_t */
2172 	ocip = (dl_capab_ipsec_t *)ptr;
2173 	bcopy(icip, ocip, sizeof (*icip));
2174 
2175 	nmp->b_wptr = (uchar_t *)(&ocip->cip_data[0]);
2176 	return (nmp);
2177 }
2178 
2179 /*
2180  * Process an IPsec capability negotiation ack received from a DLS Provider.
2181  * isub must point to the sub-capability (DL_CAPAB_IPSEC_AH or
2182  * DL_CAPAB_IPSEC_ESP) of a DL_CAPABILITY_ACK message.
2183  */
2184 static void
2185 ill_capability_ipsec_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2186 {
2187 	dl_capab_ipsec_t	*icip;
2188 	dl_capab_ipsec_alg_t	*ialg;	/* ptr to input alg spec. */
2189 	dl_capab_ipsec_alg_t	*oalg;	/* ptr to output alg spec. */
2190 	uint_t cipher, nciphers;
2191 	mblk_t *nmp;
2192 	uint_t alg_len;
2193 	boolean_t need_sadb_dump;
2194 	uint_t sub_dl_cap = isub->dl_cap;
2195 	ill_ipsec_capab_t **ill_capab;
2196 	uint64_t ill_capab_flag;
2197 	uint8_t *capend, *ciphend;
2198 	boolean_t sadb_resync;
2199 
2200 	ASSERT(sub_dl_cap == DL_CAPAB_IPSEC_AH ||
2201 	    sub_dl_cap == DL_CAPAB_IPSEC_ESP);
2202 
2203 	if (sub_dl_cap == DL_CAPAB_IPSEC_AH) {
2204 		ill_capab = (ill_ipsec_capab_t **)&ill->ill_ipsec_capab_ah;
2205 		ill_capab_flag = ILL_CAPAB_AH;
2206 	} else {
2207 		ill_capab = (ill_ipsec_capab_t **)&ill->ill_ipsec_capab_esp;
2208 		ill_capab_flag = ILL_CAPAB_ESP;
2209 	}
2210 
2211 	/*
2212 	 * If the ill capability structure exists, then this incoming
2213 	 * DL_CAPABILITY_ACK is a response to a "renegotiation" cycle.
2214 	 * If this is so, then we'd need to resynchronize the SADB
2215 	 * after re-enabling the offloaded ciphers.
2216 	 */
2217 	sadb_resync = (*ill_capab != NULL);
2218 
2219 	/*
2220 	 * Note: range checks here are not absolutely sufficient to
2221 	 * make us robust against malformed messages sent by drivers;
2222 	 * this is in keeping with the rest of IP's dlpi handling.
2223 	 * (Remember, it's coming from something else in the kernel
2224 	 * address space)
2225 	 */
2226 
2227 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2228 	if (capend > mp->b_wptr) {
2229 		cmn_err(CE_WARN, "ill_capability_ipsec_ack: "
2230 		    "malformed sub-capability too long for mblk");
2231 		return;
2232 	}
2233 
2234 	/*
2235 	 * There are two types of acks we process here:
2236 	 * 1. acks in reply to a (first form) generic capability req
2237 	 *    (no ENABLE flag set)
2238 	 * 2. acks in reply to a ENABLE capability req.
2239 	 *    (ENABLE flag set)
2240 	 *
2241 	 * We process the subcapability passed as argument as follows:
2242 	 * 1 do initializations
2243 	 *   1.1 initialize nmp = NULL
2244 	 *   1.2 set need_sadb_dump to B_FALSE
2245 	 * 2 for each cipher in subcapability:
2246 	 *   2.1 if ENABLE flag is set:
2247 	 *	2.1.1 update per-ill ipsec capabilities info
2248 	 *	2.1.2 set need_sadb_dump to B_TRUE
2249 	 *   2.2 if ENABLE flag is not set:
2250 	 *	2.2.1 if nmp is NULL:
2251 	 *		2.2.1.1 allocate and initialize nmp
2252 	 *		2.2.1.2 init current pos in nmp
2253 	 *	2.2.2 copy current cipher to current pos in nmp
2254 	 *	2.2.3 set ENABLE flag in nmp
2255 	 *	2.2.4 update current pos
2256 	 * 3 if nmp is not equal to NULL, send enable request
2257 	 *   3.1 send capability request
2258 	 * 4 if need_sadb_dump is B_TRUE
2259 	 *   4.1 enable promiscuous on/off notifications
2260 	 *   4.2 call ill_dlpi_send(isub->dlcap) to send all
2261 	 *	AH or ESP SA's to interface.
2262 	 */
2263 
2264 	nmp = NULL;
2265 	oalg = NULL;
2266 	need_sadb_dump = B_FALSE;
2267 	icip = (dl_capab_ipsec_t *)(isub + 1);
2268 	ialg = (dl_capab_ipsec_alg_t *)(&icip->cip_data[0]);
2269 
2270 	nciphers = icip->cip_nciphers;
2271 	ciphend = (uint8_t *)(ialg + icip->cip_nciphers);
2272 
2273 	if (ciphend > capend) {
2274 		cmn_err(CE_WARN, "ill_capability_ipsec_ack: "
2275 		    "too many ciphers for sub-capability len");
2276 		return;
2277 	}
2278 
2279 	for (cipher = 0; cipher < nciphers; cipher++) {
2280 		alg_len = sizeof (dl_capab_ipsec_alg_t);
2281 
2282 		if (ialg->alg_flag & DL_CAPAB_ALG_ENABLE) {
2283 			/*
2284 			 * TBD: when we provide a way to disable capabilities
2285 			 * from above, need to manage the request-pending state
2286 			 * and fail if we were not expecting this ACK.
2287 			 */
2288 			IPSECHW_DEBUG(IPSECHW_CAPAB,
2289 			    ("ill_capability_ipsec_ack: got ENABLE ACK\n"));
2290 
2291 			/*
2292 			 * Update IPsec capabilities for this ill
2293 			 */
2294 
2295 			if (*ill_capab == NULL) {
2296 				IPSECHW_DEBUG(IPSECHW_CAPAB,
2297 				    ("ill_capability_ipsec_ack: "
2298 					"allocating ipsec_capab for ill\n"));
2299 				*ill_capab = ill_ipsec_capab_alloc();
2300 
2301 				if (*ill_capab == NULL) {
2302 					cmn_err(CE_WARN,
2303 					    "ill_capability_ipsec_ack: "
2304 					    "could not enable IPsec Hardware "
2305 					    "acceleration for %s (ENOMEM)\n",
2306 					    ill->ill_name);
2307 					return;
2308 				}
2309 			}
2310 
2311 			ASSERT(ialg->alg_type == DL_CAPAB_IPSEC_ALG_AUTH ||
2312 			    ialg->alg_type == DL_CAPAB_IPSEC_ALG_ENCR);
2313 
2314 			if (ialg->alg_prim >= MAX_IPSEC_ALGS) {
2315 				cmn_err(CE_WARN,
2316 				    "ill_capability_ipsec_ack: "
2317 				    "malformed IPsec algorithm id %d",
2318 				    ialg->alg_prim);
2319 				continue;
2320 			}
2321 
2322 			if (ialg->alg_type == DL_CAPAB_IPSEC_ALG_AUTH) {
2323 				IPSEC_ALG_ENABLE((*ill_capab)->auth_hw_algs,
2324 				    ialg->alg_prim);
2325 			} else {
2326 				ipsec_capab_algparm_t *alp;
2327 
2328 				IPSEC_ALG_ENABLE((*ill_capab)->encr_hw_algs,
2329 				    ialg->alg_prim);
2330 				if (!ill_ipsec_capab_resize_algparm(*ill_capab,
2331 				    ialg->alg_prim)) {
2332 					cmn_err(CE_WARN,
2333 					    "ill_capability_ipsec_ack: "
2334 					    "no space for IPsec alg id %d",
2335 					    ialg->alg_prim);
2336 					continue;
2337 				}
2338 				alp = &((*ill_capab)->encr_algparm[
2339 						ialg->alg_prim]);
2340 				alp->minkeylen = ialg->alg_minbits;
2341 				alp->maxkeylen = ialg->alg_maxbits;
2342 			}
2343 			ill->ill_capabilities |= ill_capab_flag;
2344 			/*
2345 			 * indicate that a capability was enabled, which
2346 			 * will be used below to kick off a SADB dump
2347 			 * to the ill.
2348 			 */
2349 			need_sadb_dump = B_TRUE;
2350 		} else {
2351 			IPSECHW_DEBUG(IPSECHW_CAPAB,
2352 			    ("ill_capability_ipsec_ack: enabling alg 0x%x\n",
2353 				ialg->alg_prim));
2354 
2355 			if (nmp == NULL) {
2356 				nmp = ill_alloc_ipsec_cap_req(ill, isub);
2357 				if (nmp == NULL) {
2358 					/*
2359 					 * Sending the PROMISC_ON/OFF
2360 					 * notification request failed.
2361 					 * We cannot enable the algorithms
2362 					 * since the Provider will not
2363 					 * notify IP of promiscous mode
2364 					 * changes, which could lead
2365 					 * to leakage of packets.
2366 					 */
2367 					cmn_err(CE_WARN,
2368 					    "ill_capability_ipsec_ack: "
2369 					    "could not enable IPsec Hardware "
2370 					    "acceleration for %s (ENOMEM)\n",
2371 					    ill->ill_name);
2372 					return;
2373 				}
2374 				/* ptr to current output alg specifier */
2375 				oalg = (dl_capab_ipsec_alg_t *)nmp->b_wptr;
2376 			}
2377 
2378 			/*
2379 			 * Copy current alg specifier, set ENABLE
2380 			 * flag, and advance to next output alg.
2381 			 * For now we enable all IPsec capabilities.
2382 			 */
2383 			ASSERT(oalg != NULL);
2384 			bcopy(ialg, oalg, alg_len);
2385 			oalg->alg_flag |= DL_CAPAB_ALG_ENABLE;
2386 			nmp->b_wptr += alg_len;
2387 			oalg = (dl_capab_ipsec_alg_t *)nmp->b_wptr;
2388 		}
2389 
2390 		/* move to next input algorithm specifier */
2391 		ialg = (dl_capab_ipsec_alg_t *)
2392 		    ((char *)ialg + alg_len);
2393 	}
2394 
2395 	if (nmp != NULL)
2396 		/*
2397 		 * nmp points to a DL_CAPABILITY_REQ message to enable
2398 		 * IPsec hardware acceleration.
2399 		 */
2400 		ill_dlpi_send(ill, nmp);
2401 
2402 	if (need_sadb_dump)
2403 		/*
2404 		 * An acknowledgement corresponding to a request to
2405 		 * enable acceleration was received, notify SADB.
2406 		 */
2407 		ill_ipsec_capab_add(ill, sub_dl_cap, sadb_resync);
2408 }
2409 
2410 /*
2411  * Given an mblk with enough space in it, create sub-capability entries for
2412  * DL_CAPAB_IPSEC_{AH,ESP} types which consist of previously-advertised
2413  * offloaded ciphers (both AUTH and ENCR) with their enable flags cleared,
2414  * in preparation for the reset the DL_CAPABILITY_REQ message.
2415  */
2416 static void
2417 ill_fill_ipsec_reset(uint_t nciphers, int stype, uint_t slen,
2418     ill_ipsec_capab_t *ill_cap, mblk_t *mp)
2419 {
2420 	dl_capab_ipsec_t *oipsec;
2421 	dl_capab_ipsec_alg_t *oalg;
2422 	dl_capability_sub_t *dl_subcap;
2423 	int i, k;
2424 
2425 	ASSERT(nciphers > 0);
2426 	ASSERT(ill_cap != NULL);
2427 	ASSERT(mp != NULL);
2428 	ASSERT(MBLKTAIL(mp) >= sizeof (*dl_subcap) + sizeof (*oipsec) + slen);
2429 
2430 	/* dl_capability_sub_t for "stype" */
2431 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2432 	dl_subcap->dl_cap = stype;
2433 	dl_subcap->dl_length = sizeof (dl_capab_ipsec_t) + slen;
2434 	mp->b_wptr += sizeof (dl_capability_sub_t);
2435 
2436 	/* dl_capab_ipsec_t for "stype" */
2437 	oipsec = (dl_capab_ipsec_t *)mp->b_wptr;
2438 	oipsec->cip_version = 1;
2439 	oipsec->cip_nciphers = nciphers;
2440 	mp->b_wptr = (uchar_t *)&oipsec->cip_data[0];
2441 
2442 	/* create entries for "stype" AUTH ciphers */
2443 	for (i = 0; i < ill_cap->algs_size; i++) {
2444 		for (k = 0; k < BITSPERBYTE; k++) {
2445 			if ((ill_cap->auth_hw_algs[i] & (1 << k)) == 0)
2446 				continue;
2447 
2448 			oalg = (dl_capab_ipsec_alg_t *)mp->b_wptr;
2449 			bzero((void *)oalg, sizeof (*oalg));
2450 			oalg->alg_type = DL_CAPAB_IPSEC_ALG_AUTH;
2451 			oalg->alg_prim = k + (BITSPERBYTE * i);
2452 			mp->b_wptr += sizeof (dl_capab_ipsec_alg_t);
2453 		}
2454 	}
2455 	/* create entries for "stype" ENCR ciphers */
2456 	for (i = 0; i < ill_cap->algs_size; i++) {
2457 		for (k = 0; k < BITSPERBYTE; k++) {
2458 			if ((ill_cap->encr_hw_algs[i] & (1 << k)) == 0)
2459 				continue;
2460 
2461 			oalg = (dl_capab_ipsec_alg_t *)mp->b_wptr;
2462 			bzero((void *)oalg, sizeof (*oalg));
2463 			oalg->alg_type = DL_CAPAB_IPSEC_ALG_ENCR;
2464 			oalg->alg_prim = k + (BITSPERBYTE * i);
2465 			mp->b_wptr += sizeof (dl_capab_ipsec_alg_t);
2466 		}
2467 	}
2468 }
2469 
2470 /*
2471  * Macro to count number of 1s in a byte (8-bit word).  The total count is
2472  * accumulated into the passed-in argument (sum).  We could use SPARCv9's
2473  * POPC instruction, but our macro is more flexible for an arbitrary length
2474  * of bytes, such as {auth,encr}_hw_algs.  These variables are currently
2475  * 256-bits long (MAX_IPSEC_ALGS), so if we know for sure that the length
2476  * stays that way, we can reduce the number of iterations required.
2477  */
2478 #define	COUNT_1S(val, sum) {					\
2479 	uint8_t x = val & 0xff;					\
2480 	x = (x & 0x55) + ((x >> 1) & 0x55);			\
2481 	x = (x & 0x33) + ((x >> 2) & 0x33);			\
2482 	sum += (x & 0xf) + ((x >> 4) & 0xf);			\
2483 }
2484 
2485 /* ARGSUSED */
2486 static void
2487 ill_capability_ipsec_reset(ill_t *ill, mblk_t **sc_mp)
2488 {
2489 	mblk_t *mp;
2490 	ill_ipsec_capab_t *cap_ah = ill->ill_ipsec_capab_ah;
2491 	ill_ipsec_capab_t *cap_esp = ill->ill_ipsec_capab_esp;
2492 	uint64_t ill_capabilities = ill->ill_capabilities;
2493 	int ah_cnt = 0, esp_cnt = 0;
2494 	int ah_len = 0, esp_len = 0;
2495 	int i, size = 0;
2496 
2497 	if (!(ill_capabilities & (ILL_CAPAB_AH | ILL_CAPAB_ESP)))
2498 		return;
2499 
2500 	ASSERT(cap_ah != NULL || !(ill_capabilities & ILL_CAPAB_AH));
2501 	ASSERT(cap_esp != NULL || !(ill_capabilities & ILL_CAPAB_ESP));
2502 
2503 	/* Find out the number of ciphers for AH */
2504 	if (cap_ah != NULL) {
2505 		for (i = 0; i < cap_ah->algs_size; i++) {
2506 			COUNT_1S(cap_ah->auth_hw_algs[i], ah_cnt);
2507 			COUNT_1S(cap_ah->encr_hw_algs[i], ah_cnt);
2508 		}
2509 		if (ah_cnt > 0) {
2510 			size += sizeof (dl_capability_sub_t) +
2511 			    sizeof (dl_capab_ipsec_t);
2512 			/* dl_capab_ipsec_t contains one dl_capab_ipsec_alg_t */
2513 			ah_len = (ah_cnt - 1) * sizeof (dl_capab_ipsec_alg_t);
2514 			size += ah_len;
2515 		}
2516 	}
2517 
2518 	/* Find out the number of ciphers for ESP */
2519 	if (cap_esp != NULL) {
2520 		for (i = 0; i < cap_esp->algs_size; i++) {
2521 			COUNT_1S(cap_esp->auth_hw_algs[i], esp_cnt);
2522 			COUNT_1S(cap_esp->encr_hw_algs[i], esp_cnt);
2523 		}
2524 		if (esp_cnt > 0) {
2525 			size += sizeof (dl_capability_sub_t) +
2526 			    sizeof (dl_capab_ipsec_t);
2527 			/* dl_capab_ipsec_t contains one dl_capab_ipsec_alg_t */
2528 			esp_len = (esp_cnt - 1) * sizeof (dl_capab_ipsec_alg_t);
2529 			size += esp_len;
2530 		}
2531 	}
2532 
2533 	if (size == 0) {
2534 		ip1dbg(("ill_capability_ipsec_reset: capabilities exist but "
2535 		    "there's nothing to reset\n"));
2536 		return;
2537 	}
2538 
2539 	mp = allocb(size, BPRI_HI);
2540 	if (mp == NULL) {
2541 		ip1dbg(("ill_capability_ipsec_reset: unable to allocate "
2542 		    "request to disable IPSEC Hardware Acceleration\n"));
2543 		return;
2544 	}
2545 
2546 	/*
2547 	 * Clear the capability flags for IPSec HA but retain the ill
2548 	 * capability structures since it's possible that another thread
2549 	 * is still referring to them.  The structures only get deallocated
2550 	 * when we destroy the ill.
2551 	 *
2552 	 * Various places check the flags to see if the ill is capable of
2553 	 * hardware acceleration, and by clearing them we ensure that new
2554 	 * outbound IPSec packets are sent down encrypted.
2555 	 */
2556 	ill->ill_capabilities &= ~(ILL_CAPAB_AH | ILL_CAPAB_ESP);
2557 
2558 	/* Fill in DL_CAPAB_IPSEC_AH sub-capability entries */
2559 	if (ah_cnt > 0) {
2560 		ill_fill_ipsec_reset(ah_cnt, DL_CAPAB_IPSEC_AH, ah_len,
2561 		    cap_ah, mp);
2562 		ASSERT(mp->b_rptr + size >= mp->b_wptr);
2563 	}
2564 
2565 	/* Fill in DL_CAPAB_IPSEC_ESP sub-capability entries */
2566 	if (esp_cnt > 0) {
2567 		ill_fill_ipsec_reset(esp_cnt, DL_CAPAB_IPSEC_ESP, esp_len,
2568 		    cap_esp, mp);
2569 		ASSERT(mp->b_rptr + size >= mp->b_wptr);
2570 	}
2571 
2572 	/*
2573 	 * At this point we've composed a bunch of sub-capabilities to be
2574 	 * encapsulated in a DL_CAPABILITY_REQ and later sent downstream
2575 	 * by the caller.  Upon receiving this reset message, the driver
2576 	 * must stop inbound decryption (by destroying all inbound SAs)
2577 	 * and let the corresponding packets come in encrypted.
2578 	 */
2579 
2580 	if (*sc_mp != NULL)
2581 		linkb(*sc_mp, mp);
2582 	else
2583 		*sc_mp = mp;
2584 }
2585 
2586 static void
2587 ill_capability_dispatch(ill_t *ill, mblk_t *mp, dl_capability_sub_t *subp,
2588     boolean_t encapsulated)
2589 {
2590 	boolean_t legacy = B_FALSE;
2591 
2592 	/*
2593 	 * If this DL_CAPABILITY_ACK came in as a response to our "reset"
2594 	 * DL_CAPABILITY_REQ, ignore it during this cycle.  We've just
2595 	 * instructed the driver to disable its advertised capabilities,
2596 	 * so there's no point in accepting any response at this moment.
2597 	 */
2598 	if (ill->ill_capab_state == IDMS_UNKNOWN)
2599 		return;
2600 
2601 	/*
2602 	 * Note that only the following two sub-capabilities may be
2603 	 * considered as "legacy", since their original definitions
2604 	 * do not incorporate the dl_mid_t module ID token, and hence
2605 	 * may require the use of the wrapper sub-capability.
2606 	 */
2607 	switch (subp->dl_cap) {
2608 	case DL_CAPAB_IPSEC_AH:
2609 	case DL_CAPAB_IPSEC_ESP:
2610 		legacy = B_TRUE;
2611 		break;
2612 	}
2613 
2614 	/*
2615 	 * For legacy sub-capabilities which don't incorporate a queue_t
2616 	 * pointer in their structures, discard them if we detect that
2617 	 * there are intermediate modules in between IP and the driver.
2618 	 */
2619 	if (!encapsulated && legacy && ill->ill_lmod_cnt > 1) {
2620 		ip1dbg(("ill_capability_dispatch: unencapsulated capab type "
2621 		    "%d discarded; %d module(s) present below IP\n",
2622 		    subp->dl_cap, ill->ill_lmod_cnt));
2623 		return;
2624 	}
2625 
2626 	switch (subp->dl_cap) {
2627 	case DL_CAPAB_IPSEC_AH:
2628 	case DL_CAPAB_IPSEC_ESP:
2629 		ill_capability_ipsec_ack(ill, mp, subp);
2630 		break;
2631 	case DL_CAPAB_MDT:
2632 		ill_capability_mdt_ack(ill, mp, subp);
2633 		break;
2634 	case DL_CAPAB_HCKSUM:
2635 		ill_capability_hcksum_ack(ill, mp, subp);
2636 		break;
2637 	case DL_CAPAB_ZEROCOPY:
2638 		ill_capability_zerocopy_ack(ill, mp, subp);
2639 		break;
2640 	case DL_CAPAB_POLL:
2641 		if (!SOFT_RINGS_ENABLED())
2642 			ill_capability_dls_ack(ill, mp, subp);
2643 		break;
2644 	case DL_CAPAB_SOFT_RING:
2645 		if (SOFT_RINGS_ENABLED())
2646 			ill_capability_dls_ack(ill, mp, subp);
2647 		break;
2648 	default:
2649 		ip1dbg(("ill_capability_dispatch: unknown capab type %d\n",
2650 		    subp->dl_cap));
2651 	}
2652 }
2653 
2654 /*
2655  * As part of negotiating polling capability, the driver tells us
2656  * the default (or normal) blanking interval and packet threshold
2657  * (the receive timer fires if blanking interval is reached or
2658  * the packet threshold is reached).
2659  *
2660  * As part of manipulating the polling interval, we always use our
2661  * estimated interval (avg service time * number of packets queued
2662  * on the squeue) but we try to blank for a minimum of
2663  * rr_normal_blank_time * rr_max_blank_ratio. We disable the
2664  * packet threshold during this time. When we are not in polling mode
2665  * we set the blank interval typically lower, rr_normal_pkt_cnt *
2666  * rr_min_blank_ratio but up the packet cnt by a ratio of
2667  * rr_min_pkt_cnt_ratio so that we are still getting chains if
2668  * possible although for a shorter interval.
2669  */
2670 #define	RR_MAX_BLANK_RATIO	20
2671 #define	RR_MIN_BLANK_RATIO	10
2672 #define	RR_MAX_PKT_CNT_RATIO	3
2673 #define	RR_MIN_PKT_CNT_RATIO	3
2674 
2675 /*
2676  * These can be tuned via /etc/system.
2677  */
2678 int rr_max_blank_ratio = RR_MAX_BLANK_RATIO;
2679 int rr_min_blank_ratio = RR_MIN_BLANK_RATIO;
2680 int rr_max_pkt_cnt_ratio = RR_MAX_PKT_CNT_RATIO;
2681 int rr_min_pkt_cnt_ratio = RR_MIN_PKT_CNT_RATIO;
2682 
2683 static mac_resource_handle_t
2684 ill_ring_add(void *arg, mac_resource_t *mrp)
2685 {
2686 	ill_t			*ill = (ill_t *)arg;
2687 	mac_rx_fifo_t		*mrfp = (mac_rx_fifo_t *)mrp;
2688 	ill_rx_ring_t		*rx_ring;
2689 	int			ip_rx_index;
2690 
2691 	ASSERT(mrp != NULL);
2692 	if (mrp->mr_type != MAC_RX_FIFO) {
2693 		return (NULL);
2694 	}
2695 	ASSERT(ill != NULL);
2696 	ASSERT(ill->ill_dls_capab != NULL);
2697 
2698 	mutex_enter(&ill->ill_lock);
2699 	for (ip_rx_index = 0; ip_rx_index < ILL_MAX_RINGS; ip_rx_index++) {
2700 		rx_ring = &ill->ill_dls_capab->ill_ring_tbl[ip_rx_index];
2701 		ASSERT(rx_ring != NULL);
2702 
2703 		if (rx_ring->rr_ring_state == ILL_RING_FREE) {
2704 			time_t normal_blank_time =
2705 			    mrfp->mrf_normal_blank_time;
2706 			uint_t normal_pkt_cnt =
2707 			    mrfp->mrf_normal_pkt_count;
2708 
2709 			bzero(rx_ring, sizeof (ill_rx_ring_t));
2710 
2711 			rx_ring->rr_blank = mrfp->mrf_blank;
2712 			rx_ring->rr_handle = mrfp->mrf_arg;
2713 			rx_ring->rr_ill = ill;
2714 			rx_ring->rr_normal_blank_time = normal_blank_time;
2715 			rx_ring->rr_normal_pkt_cnt = normal_pkt_cnt;
2716 
2717 			rx_ring->rr_max_blank_time =
2718 			    normal_blank_time * rr_max_blank_ratio;
2719 			rx_ring->rr_min_blank_time =
2720 			    normal_blank_time * rr_min_blank_ratio;
2721 			rx_ring->rr_max_pkt_cnt =
2722 			    normal_pkt_cnt * rr_max_pkt_cnt_ratio;
2723 			rx_ring->rr_min_pkt_cnt =
2724 			    normal_pkt_cnt * rr_min_pkt_cnt_ratio;
2725 
2726 			rx_ring->rr_ring_state = ILL_RING_INUSE;
2727 			mutex_exit(&ill->ill_lock);
2728 
2729 			DTRACE_PROBE2(ill__ring__add, (void *), ill,
2730 			    (int), ip_rx_index);
2731 			return ((mac_resource_handle_t)rx_ring);
2732 		}
2733 	}
2734 
2735 	/*
2736 	 * We ran out of ILL_MAX_RINGS worth rx_ring structures. If
2737 	 * we have devices which can overwhelm this limit, ILL_MAX_RING
2738 	 * should be made configurable. Meanwhile it cause no panic because
2739 	 * driver will pass ip_input a NULL handle which will make
2740 	 * IP allocate the default squeue and Polling mode will not
2741 	 * be used for this ring.
2742 	 */
2743 	cmn_err(CE_NOTE, "Reached maximum number of receiving rings (%d) "
2744 	    "for %s\n", ILL_MAX_RINGS, ill->ill_name);
2745 
2746 	mutex_exit(&ill->ill_lock);
2747 	return (NULL);
2748 }
2749 
2750 static boolean_t
2751 ill_capability_dls_init(ill_t *ill)
2752 {
2753 	ill_dls_capab_t	*ill_dls = ill->ill_dls_capab;
2754 	conn_t 			*connp;
2755 	size_t			sz;
2756 
2757 	if (ill->ill_capabilities & ILL_CAPAB_SOFT_RING) {
2758 		if (ill_dls == NULL) {
2759 			cmn_err(CE_PANIC, "ill_capability_dls_init: "
2760 			    "soft_ring enabled for ill=%s (%p) but data "
2761 			    "structs uninitialized\n", ill->ill_name,
2762 			    (void *)ill);
2763 		}
2764 		return (B_TRUE);
2765 	} else if (ill->ill_capabilities & ILL_CAPAB_POLL) {
2766 		if (ill_dls == NULL) {
2767 			cmn_err(CE_PANIC, "ill_capability_dls_init: "
2768 			    "polling enabled for ill=%s (%p) but data "
2769 			    "structs uninitialized\n", ill->ill_name,
2770 			(void *)ill);
2771 		}
2772 		return (B_TRUE);
2773 	}
2774 
2775 	if (ill_dls != NULL) {
2776 		ill_rx_ring_t 	*rx_ring = ill_dls->ill_ring_tbl;
2777 		/* Soft_Ring or polling is being re-enabled */
2778 
2779 		connp = ill_dls->ill_unbind_conn;
2780 		ASSERT(rx_ring != NULL);
2781 		bzero((void *)ill_dls, sizeof (ill_dls_capab_t));
2782 		bzero((void *)rx_ring,
2783 		    sizeof (ill_rx_ring_t) * ILL_MAX_RINGS);
2784 		ill_dls->ill_ring_tbl = rx_ring;
2785 		ill_dls->ill_unbind_conn = connp;
2786 		return (B_TRUE);
2787 	}
2788 
2789 	if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP)) == NULL)
2790 		return (B_FALSE);
2791 
2792 	sz = sizeof (ill_dls_capab_t);
2793 	sz += sizeof (ill_rx_ring_t) * ILL_MAX_RINGS;
2794 
2795 	ill_dls = kmem_zalloc(sz, KM_NOSLEEP);
2796 	if (ill_dls == NULL) {
2797 		cmn_err(CE_WARN, "ill_capability_dls_init: could not "
2798 		    "allocate dls_capab for %s (%p)\n", ill->ill_name,
2799 		    (void *)ill);
2800 		CONN_DEC_REF(connp);
2801 		return (B_FALSE);
2802 	}
2803 
2804 	/* Allocate space to hold ring table */
2805 	ill_dls->ill_ring_tbl = (ill_rx_ring_t *)&ill_dls[1];
2806 	ill->ill_dls_capab = ill_dls;
2807 	ill_dls->ill_unbind_conn = connp;
2808 	return (B_TRUE);
2809 }
2810 
2811 /*
2812  * ill_capability_dls_disable: disable soft_ring and/or polling
2813  * capability. Since any of the rings might already be in use, need
2814  * to call ipsq_clean_all() which gets behind the squeue to disable
2815  * direct calls if necessary.
2816  */
2817 static void
2818 ill_capability_dls_disable(ill_t *ill)
2819 {
2820 	ill_dls_capab_t	*ill_dls = ill->ill_dls_capab;
2821 
2822 	if (ill->ill_capabilities & ILL_CAPAB_DLS) {
2823 		ipsq_clean_all(ill);
2824 		ill_dls->ill_tx = NULL;
2825 		ill_dls->ill_tx_handle = NULL;
2826 		ill_dls->ill_dls_change_status = NULL;
2827 		ill_dls->ill_dls_bind = NULL;
2828 		ill_dls->ill_dls_unbind = NULL;
2829 	}
2830 
2831 	ASSERT(!(ill->ill_capabilities & ILL_CAPAB_DLS));
2832 }
2833 
2834 static void
2835 ill_capability_dls_capable(ill_t *ill, dl_capab_dls_t *idls,
2836     dl_capability_sub_t *isub)
2837 {
2838 	uint_t			size;
2839 	uchar_t			*rptr;
2840 	dl_capab_dls_t	dls, *odls;
2841 	ill_dls_capab_t	*ill_dls;
2842 	mblk_t			*nmp = NULL;
2843 	dl_capability_req_t	*ocap;
2844 	uint_t			sub_dl_cap = isub->dl_cap;
2845 
2846 	if (!ill_capability_dls_init(ill))
2847 		return;
2848 	ill_dls = ill->ill_dls_capab;
2849 
2850 	/* Copy locally to get the members aligned */
2851 	bcopy((void *)idls, (void *)&dls,
2852 	    sizeof (dl_capab_dls_t));
2853 
2854 	/* Get the tx function and handle from dld */
2855 	ill_dls->ill_tx = (ip_dld_tx_t)dls.dls_tx;
2856 	ill_dls->ill_tx_handle = (void *)dls.dls_tx_handle;
2857 
2858 	if (sub_dl_cap == DL_CAPAB_SOFT_RING) {
2859 		ill_dls->ill_dls_change_status =
2860 		    (ip_dls_chg_soft_ring_t)dls.dls_ring_change_status;
2861 		ill_dls->ill_dls_bind = (ip_dls_bind_t)dls.dls_ring_bind;
2862 		ill_dls->ill_dls_unbind =
2863 		    (ip_dls_unbind_t)dls.dls_ring_unbind;
2864 		ill_dls->ill_dls_soft_ring_cnt = ip_soft_rings_cnt;
2865 	}
2866 
2867 	size = sizeof (dl_capability_req_t) + sizeof (dl_capability_sub_t) +
2868 	    isub->dl_length;
2869 
2870 	if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2871 		cmn_err(CE_WARN, "ill_capability_dls_capable: could "
2872 		    "not allocate memory for CAPAB_REQ for %s (%p)\n",
2873 		    ill->ill_name, (void *)ill);
2874 		return;
2875 	}
2876 
2877 	/* initialize dl_capability_req_t */
2878 	rptr = nmp->b_rptr;
2879 	ocap = (dl_capability_req_t *)rptr;
2880 	ocap->dl_sub_offset = sizeof (dl_capability_req_t);
2881 	ocap->dl_sub_length = sizeof (dl_capability_sub_t) + isub->dl_length;
2882 	rptr += sizeof (dl_capability_req_t);
2883 
2884 	/* initialize dl_capability_sub_t */
2885 	bcopy(isub, rptr, sizeof (*isub));
2886 	rptr += sizeof (*isub);
2887 
2888 	odls = (dl_capab_dls_t *)rptr;
2889 	rptr += sizeof (dl_capab_dls_t);
2890 
2891 	/* initialize dl_capab_dls_t to be sent down */
2892 	dls.dls_rx_handle = (uintptr_t)ill;
2893 	dls.dls_rx = (uintptr_t)ip_input;
2894 	dls.dls_ring_add = (uintptr_t)ill_ring_add;
2895 
2896 	if (sub_dl_cap == DL_CAPAB_SOFT_RING) {
2897 		dls.dls_ring_cnt = ip_soft_rings_cnt;
2898 		dls.dls_ring_assign = (uintptr_t)ip_soft_ring_assignment;
2899 		dls.dls_flags = SOFT_RING_ENABLE;
2900 	} else {
2901 		dls.dls_flags = POLL_ENABLE;
2902 		ip1dbg(("ill_capability_dls_capable: asking interface %s "
2903 		    "to enable polling\n", ill->ill_name));
2904 	}
2905 	bcopy((void *)&dls, (void *)odls,
2906 	    sizeof (dl_capab_dls_t));
2907 	ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
2908 	/*
2909 	 * nmp points to a DL_CAPABILITY_REQ message to
2910 	 * enable either soft_ring or polling
2911 	 */
2912 	ill_dlpi_send(ill, nmp);
2913 }
2914 
2915 static void
2916 ill_capability_dls_reset(ill_t *ill, mblk_t **sc_mp)
2917 {
2918 	mblk_t *mp;
2919 	dl_capab_dls_t *idls;
2920 	dl_capability_sub_t *dl_subcap;
2921 	int size;
2922 
2923 	if (!(ill->ill_capabilities & ILL_CAPAB_DLS))
2924 		return;
2925 
2926 	ASSERT(ill->ill_dls_capab != NULL);
2927 
2928 	size = sizeof (*dl_subcap) + sizeof (*idls);
2929 
2930 	mp = allocb(size, BPRI_HI);
2931 	if (mp == NULL) {
2932 		ip1dbg(("ill_capability_dls_reset: unable to allocate "
2933 		    "request to disable soft_ring\n"));
2934 		return;
2935 	}
2936 
2937 	mp->b_wptr = mp->b_rptr + size;
2938 
2939 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
2940 	dl_subcap->dl_length = sizeof (*idls);
2941 	if (ill->ill_capabilities & ILL_CAPAB_SOFT_RING)
2942 		dl_subcap->dl_cap = DL_CAPAB_SOFT_RING;
2943 	else
2944 		dl_subcap->dl_cap = DL_CAPAB_POLL;
2945 
2946 	idls = (dl_capab_dls_t *)(dl_subcap + 1);
2947 	if (ill->ill_capabilities & ILL_CAPAB_SOFT_RING)
2948 		idls->dls_flags = SOFT_RING_DISABLE;
2949 	else
2950 		idls->dls_flags = POLL_DISABLE;
2951 
2952 	if (*sc_mp != NULL)
2953 		linkb(*sc_mp, mp);
2954 	else
2955 		*sc_mp = mp;
2956 }
2957 
2958 /*
2959  * Process a soft_ring/poll capability negotiation ack received
2960  * from a DLS Provider.isub must point to the sub-capability
2961  * (DL_CAPAB_SOFT_RING/DL_CAPAB_POLL) of a DL_CAPABILITY_ACK message.
2962  */
2963 static void
2964 ill_capability_dls_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2965 {
2966 	dl_capab_dls_t		*idls;
2967 	uint_t			sub_dl_cap = isub->dl_cap;
2968 	uint8_t			*capend;
2969 
2970 	ASSERT(sub_dl_cap == DL_CAPAB_SOFT_RING ||
2971 	    sub_dl_cap == DL_CAPAB_POLL);
2972 
2973 	if (ill->ill_isv6)
2974 		return;
2975 
2976 	/*
2977 	 * Note: range checks here are not absolutely sufficient to
2978 	 * make us robust against malformed messages sent by drivers;
2979 	 * this is in keeping with the rest of IP's dlpi handling.
2980 	 * (Remember, it's coming from something else in the kernel
2981 	 * address space)
2982 	 */
2983 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2984 	if (capend > mp->b_wptr) {
2985 		cmn_err(CE_WARN, "ill_capability_dls_ack: "
2986 		    "malformed sub-capability too long for mblk");
2987 		return;
2988 	}
2989 
2990 	/*
2991 	 * There are two types of acks we process here:
2992 	 * 1. acks in reply to a (first form) generic capability req
2993 	 *    (dls_flag will be set to SOFT_RING_CAPABLE or POLL_CAPABLE)
2994 	 * 2. acks in reply to a SOFT_RING_ENABLE or POLL_ENABLE
2995 	 *    capability req.
2996 	 */
2997 	idls = (dl_capab_dls_t *)(isub + 1);
2998 
2999 	if (!dlcapabcheckqid(&idls->dls_mid, ill->ill_lmod_rq)) {
3000 		ip1dbg(("ill_capability_dls_ack: mid token for dls "
3001 		    "capability isn't as expected; pass-thru "
3002 		    "module(s) detected, discarding capability\n"));
3003 		if (ill->ill_capabilities & ILL_CAPAB_DLS) {
3004 			/*
3005 			 * This is a capability renegotitation case.
3006 			 * The interface better be unusable at this
3007 			 * point other wise bad things will happen
3008 			 * if we disable direct calls on a running
3009 			 * and up interface.
3010 			 */
3011 			ill_capability_dls_disable(ill);
3012 		}
3013 		return;
3014 	}
3015 
3016 	switch (idls->dls_flags) {
3017 	default:
3018 		/* Disable if unknown flag */
3019 	case SOFT_RING_DISABLE:
3020 	case POLL_DISABLE:
3021 		ill_capability_dls_disable(ill);
3022 		break;
3023 	case SOFT_RING_CAPABLE:
3024 	case POLL_CAPABLE:
3025 		/*
3026 		 * If the capability was already enabled, its safe
3027 		 * to disable it first to get rid of stale information
3028 		 * and then start enabling it again.
3029 		 */
3030 		ill_capability_dls_disable(ill);
3031 		ill_capability_dls_capable(ill, idls, isub);
3032 		break;
3033 	case SOFT_RING_ENABLE:
3034 	case POLL_ENABLE:
3035 		mutex_enter(&ill->ill_lock);
3036 		if (sub_dl_cap == DL_CAPAB_SOFT_RING &&
3037 		    !(ill->ill_capabilities & ILL_CAPAB_SOFT_RING)) {
3038 			ASSERT(ill->ill_dls_capab != NULL);
3039 			ill->ill_capabilities |= ILL_CAPAB_SOFT_RING;
3040 		}
3041 		if (sub_dl_cap == DL_CAPAB_POLL &&
3042 		    !(ill->ill_capabilities & ILL_CAPAB_POLL)) {
3043 			ASSERT(ill->ill_dls_capab != NULL);
3044 			ill->ill_capabilities |= ILL_CAPAB_POLL;
3045 			ip1dbg(("ill_capability_dls_ack: interface %s "
3046 			    "has enabled polling\n", ill->ill_name));
3047 		}
3048 		mutex_exit(&ill->ill_lock);
3049 		break;
3050 	}
3051 }
3052 
3053 /*
3054  * Process a hardware checksum offload capability negotiation ack received
3055  * from a DLS Provider.isub must point to the sub-capability (DL_CAPAB_HCKSUM)
3056  * of a DL_CAPABILITY_ACK message.
3057  */
3058 static void
3059 ill_capability_hcksum_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
3060 {
3061 	dl_capability_req_t	*ocap;
3062 	dl_capab_hcksum_t	*ihck, *ohck;
3063 	ill_hcksum_capab_t	**ill_hcksum;
3064 	mblk_t			*nmp = NULL;
3065 	uint_t			sub_dl_cap = isub->dl_cap;
3066 	uint8_t			*capend;
3067 
3068 	ASSERT(sub_dl_cap == DL_CAPAB_HCKSUM);
3069 
3070 	ill_hcksum = (ill_hcksum_capab_t **)&ill->ill_hcksum_capab;
3071 
3072 	/*
3073 	 * Note: range checks here are not absolutely sufficient to
3074 	 * make us robust against malformed messages sent by drivers;
3075 	 * this is in keeping with the rest of IP's dlpi handling.
3076 	 * (Remember, it's coming from something else in the kernel
3077 	 * address space)
3078 	 */
3079 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
3080 	if (capend > mp->b_wptr) {
3081 		cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
3082 		    "malformed sub-capability too long for mblk");
3083 		return;
3084 	}
3085 
3086 	/*
3087 	 * There are two types of acks we process here:
3088 	 * 1. acks in reply to a (first form) generic capability req
3089 	 *    (no ENABLE flag set)
3090 	 * 2. acks in reply to a ENABLE capability req.
3091 	 *    (ENABLE flag set)
3092 	 */
3093 	ihck = (dl_capab_hcksum_t *)(isub + 1);
3094 
3095 	if (ihck->hcksum_version != HCKSUM_VERSION_1) {
3096 		cmn_err(CE_CONT, "ill_capability_hcksum_ack: "
3097 		    "unsupported hardware checksum "
3098 		    "sub-capability (version %d, expected %d)",
3099 		    ihck->hcksum_version, HCKSUM_VERSION_1);
3100 		return;
3101 	}
3102 
3103 	if (!dlcapabcheckqid(&ihck->hcksum_mid, ill->ill_lmod_rq)) {
3104 		ip1dbg(("ill_capability_hcksum_ack: mid token for hardware "
3105 		    "checksum capability isn't as expected; pass-thru "
3106 		    "module(s) detected, discarding capability\n"));
3107 		return;
3108 	}
3109 
3110 #define	CURR_HCKSUM_CAPAB				\
3111 	(HCKSUM_INET_PARTIAL | HCKSUM_INET_FULL_V4 |	\
3112 	HCKSUM_INET_FULL_V6 | HCKSUM_IPHDRCKSUM)
3113 
3114 	if ((ihck->hcksum_txflags & HCKSUM_ENABLE) &&
3115 	    (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB)) {
3116 		/* do ENABLE processing */
3117 		if (*ill_hcksum == NULL) {
3118 			*ill_hcksum = kmem_zalloc(sizeof (ill_hcksum_capab_t),
3119 			    KM_NOSLEEP);
3120 
3121 			if (*ill_hcksum == NULL) {
3122 				cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
3123 				    "could not enable hcksum version %d "
3124 				    "for %s (ENOMEM)\n", HCKSUM_CURRENT_VERSION,
3125 				    ill->ill_name);
3126 				return;
3127 			}
3128 		}
3129 
3130 		(*ill_hcksum)->ill_hcksum_version = ihck->hcksum_version;
3131 		(*ill_hcksum)->ill_hcksum_txflags = ihck->hcksum_txflags;
3132 		ill->ill_capabilities |= ILL_CAPAB_HCKSUM;
3133 		ip1dbg(("ill_capability_hcksum_ack: interface %s "
3134 		    "has enabled hardware checksumming\n ",
3135 		    ill->ill_name));
3136 	} else if (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB) {
3137 		/*
3138 		 * Enabling hardware checksum offload
3139 		 * Currently IP supports {TCP,UDP}/IPv4
3140 		 * partial and full cksum offload and
3141 		 * IPv4 header checksum offload.
3142 		 * Allocate new mblk which will
3143 		 * contain a new capability request
3144 		 * to enable hardware checksum offload.
3145 		 */
3146 		uint_t	size;
3147 		uchar_t	*rptr;
3148 
3149 		size = sizeof (dl_capability_req_t) +
3150 		    sizeof (dl_capability_sub_t) + isub->dl_length;
3151 
3152 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
3153 			cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
3154 			    "could not enable hardware cksum for %s (ENOMEM)\n",
3155 			    ill->ill_name);
3156 			return;
3157 		}
3158 
3159 		rptr = nmp->b_rptr;
3160 		/* initialize dl_capability_req_t */
3161 		ocap = (dl_capability_req_t *)nmp->b_rptr;
3162 		ocap->dl_sub_offset =
3163 		    sizeof (dl_capability_req_t);
3164 		ocap->dl_sub_length =
3165 		    sizeof (dl_capability_sub_t) +
3166 		    isub->dl_length;
3167 		nmp->b_rptr += sizeof (dl_capability_req_t);
3168 
3169 		/* initialize dl_capability_sub_t */
3170 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
3171 		nmp->b_rptr += sizeof (*isub);
3172 
3173 		/* initialize dl_capab_hcksum_t */
3174 		ohck = (dl_capab_hcksum_t *)nmp->b_rptr;
3175 		bcopy(ihck, ohck, sizeof (*ihck));
3176 
3177 		nmp->b_rptr = rptr;
3178 		ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
3179 
3180 		/* Set ENABLE flag */
3181 		ohck->hcksum_txflags &= CURR_HCKSUM_CAPAB;
3182 		ohck->hcksum_txflags |= HCKSUM_ENABLE;
3183 
3184 		/*
3185 		 * nmp points to a DL_CAPABILITY_REQ message to enable
3186 		 * hardware checksum acceleration.
3187 		 */
3188 		ill_dlpi_send(ill, nmp);
3189 	} else {
3190 		ip1dbg(("ill_capability_hcksum_ack: interface %s has "
3191 		    "advertised %x hardware checksum capability flags\n",
3192 		    ill->ill_name, ihck->hcksum_txflags));
3193 	}
3194 }
3195 
3196 static void
3197 ill_capability_hcksum_reset(ill_t *ill, mblk_t **sc_mp)
3198 {
3199 	mblk_t *mp;
3200 	dl_capab_hcksum_t *hck_subcap;
3201 	dl_capability_sub_t *dl_subcap;
3202 	int size;
3203 
3204 	if (!ILL_HCKSUM_CAPABLE(ill))
3205 		return;
3206 
3207 	ASSERT(ill->ill_hcksum_capab != NULL);
3208 	/*
3209 	 * Clear the capability flag for hardware checksum offload but
3210 	 * retain the ill_hcksum_capab structure since it's possible that
3211 	 * another thread is still referring to it.  The structure only
3212 	 * gets deallocated when we destroy the ill.
3213 	 */
3214 	ill->ill_capabilities &= ~ILL_CAPAB_HCKSUM;
3215 
3216 	size = sizeof (*dl_subcap) + sizeof (*hck_subcap);
3217 
3218 	mp = allocb(size, BPRI_HI);
3219 	if (mp == NULL) {
3220 		ip1dbg(("ill_capability_hcksum_reset: unable to allocate "
3221 		    "request to disable hardware checksum offload\n"));
3222 		return;
3223 	}
3224 
3225 	mp->b_wptr = mp->b_rptr + size;
3226 
3227 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
3228 	dl_subcap->dl_cap = DL_CAPAB_HCKSUM;
3229 	dl_subcap->dl_length = sizeof (*hck_subcap);
3230 
3231 	hck_subcap = (dl_capab_hcksum_t *)(dl_subcap + 1);
3232 	hck_subcap->hcksum_version = ill->ill_hcksum_capab->ill_hcksum_version;
3233 	hck_subcap->hcksum_txflags = 0;
3234 
3235 	if (*sc_mp != NULL)
3236 		linkb(*sc_mp, mp);
3237 	else
3238 		*sc_mp = mp;
3239 }
3240 
3241 static void
3242 ill_capability_zerocopy_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
3243 {
3244 	mblk_t *nmp = NULL;
3245 	dl_capability_req_t *oc;
3246 	dl_capab_zerocopy_t *zc_ic, *zc_oc;
3247 	ill_zerocopy_capab_t **ill_zerocopy_capab;
3248 	uint_t sub_dl_cap = isub->dl_cap;
3249 	uint8_t *capend;
3250 
3251 	ASSERT(sub_dl_cap == DL_CAPAB_ZEROCOPY);
3252 
3253 	ill_zerocopy_capab = (ill_zerocopy_capab_t **)&ill->ill_zerocopy_capab;
3254 
3255 	/*
3256 	 * Note: range checks here are not absolutely sufficient to
3257 	 * make us robust against malformed messages sent by drivers;
3258 	 * this is in keeping with the rest of IP's dlpi handling.
3259 	 * (Remember, it's coming from something else in the kernel
3260 	 * address space)
3261 	 */
3262 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
3263 	if (capend > mp->b_wptr) {
3264 		cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
3265 		    "malformed sub-capability too long for mblk");
3266 		return;
3267 	}
3268 
3269 	zc_ic = (dl_capab_zerocopy_t *)(isub + 1);
3270 	if (zc_ic->zerocopy_version != ZEROCOPY_VERSION_1) {
3271 		cmn_err(CE_CONT, "ill_capability_zerocopy_ack: "
3272 		    "unsupported ZEROCOPY sub-capability (version %d, "
3273 		    "expected %d)", zc_ic->zerocopy_version,
3274 		    ZEROCOPY_VERSION_1);
3275 		return;
3276 	}
3277 
3278 	if (!dlcapabcheckqid(&zc_ic->zerocopy_mid, ill->ill_lmod_rq)) {
3279 		ip1dbg(("ill_capability_zerocopy_ack: mid token for zerocopy "
3280 		    "capability isn't as expected; pass-thru module(s) "
3281 		    "detected, discarding capability\n"));
3282 		return;
3283 	}
3284 
3285 	if ((zc_ic->zerocopy_flags & DL_CAPAB_VMSAFE_MEM) != 0) {
3286 		if (*ill_zerocopy_capab == NULL) {
3287 			*ill_zerocopy_capab =
3288 			    kmem_zalloc(sizeof (ill_zerocopy_capab_t),
3289 			    KM_NOSLEEP);
3290 
3291 			if (*ill_zerocopy_capab == NULL) {
3292 				cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
3293 				    "could not enable Zero-copy version %d "
3294 				    "for %s (ENOMEM)\n", ZEROCOPY_VERSION_1,
3295 				    ill->ill_name);
3296 				return;
3297 			}
3298 		}
3299 
3300 		ip1dbg(("ill_capability_zerocopy_ack: interface %s "
3301 		    "supports Zero-copy version %d\n", ill->ill_name,
3302 		    ZEROCOPY_VERSION_1));
3303 
3304 		(*ill_zerocopy_capab)->ill_zerocopy_version =
3305 		    zc_ic->zerocopy_version;
3306 		(*ill_zerocopy_capab)->ill_zerocopy_flags =
3307 		    zc_ic->zerocopy_flags;
3308 
3309 		ill->ill_capabilities |= ILL_CAPAB_ZEROCOPY;
3310 	} else {
3311 		uint_t size;
3312 		uchar_t *rptr;
3313 
3314 		size = sizeof (dl_capability_req_t) +
3315 		    sizeof (dl_capability_sub_t) +
3316 		    sizeof (dl_capab_zerocopy_t);
3317 
3318 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
3319 			cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
3320 			    "could not enable zerocopy for %s (ENOMEM)\n",
3321 			    ill->ill_name);
3322 			return;
3323 		}
3324 
3325 		rptr = nmp->b_rptr;
3326 		/* initialize dl_capability_req_t */
3327 		oc = (dl_capability_req_t *)rptr;
3328 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
3329 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
3330 		    sizeof (dl_capab_zerocopy_t);
3331 		rptr += sizeof (dl_capability_req_t);
3332 
3333 		/* initialize dl_capability_sub_t */
3334 		bcopy(isub, rptr, sizeof (*isub));
3335 		rptr += sizeof (*isub);
3336 
3337 		/* initialize dl_capab_zerocopy_t */
3338 		zc_oc = (dl_capab_zerocopy_t *)rptr;
3339 		*zc_oc = *zc_ic;
3340 
3341 		ip1dbg(("ill_capability_zerocopy_ack: asking interface %s "
3342 		    "to enable zero-copy version %d\n", ill->ill_name,
3343 		    ZEROCOPY_VERSION_1));
3344 
3345 		/* set VMSAFE_MEM flag */
3346 		zc_oc->zerocopy_flags |= DL_CAPAB_VMSAFE_MEM;
3347 
3348 		/* nmp points to a DL_CAPABILITY_REQ message to enable zcopy */
3349 		ill_dlpi_send(ill, nmp);
3350 	}
3351 }
3352 
3353 static void
3354 ill_capability_zerocopy_reset(ill_t *ill, mblk_t **sc_mp)
3355 {
3356 	mblk_t *mp;
3357 	dl_capab_zerocopy_t *zerocopy_subcap;
3358 	dl_capability_sub_t *dl_subcap;
3359 	int size;
3360 
3361 	if (!(ill->ill_capabilities & ILL_CAPAB_ZEROCOPY))
3362 		return;
3363 
3364 	ASSERT(ill->ill_zerocopy_capab != NULL);
3365 	/*
3366 	 * Clear the capability flag for Zero-copy but retain the
3367 	 * ill_zerocopy_capab structure since it's possible that another
3368 	 * thread is still referring to it.  The structure only gets
3369 	 * deallocated when we destroy the ill.
3370 	 */
3371 	ill->ill_capabilities &= ~ILL_CAPAB_ZEROCOPY;
3372 
3373 	size = sizeof (*dl_subcap) + sizeof (*zerocopy_subcap);
3374 
3375 	mp = allocb(size, BPRI_HI);
3376 	if (mp == NULL) {
3377 		ip1dbg(("ill_capability_zerocopy_reset: unable to allocate "
3378 		    "request to disable Zero-copy\n"));
3379 		return;
3380 	}
3381 
3382 	mp->b_wptr = mp->b_rptr + size;
3383 
3384 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
3385 	dl_subcap->dl_cap = DL_CAPAB_ZEROCOPY;
3386 	dl_subcap->dl_length = sizeof (*zerocopy_subcap);
3387 
3388 	zerocopy_subcap = (dl_capab_zerocopy_t *)(dl_subcap + 1);
3389 	zerocopy_subcap->zerocopy_version =
3390 	    ill->ill_zerocopy_capab->ill_zerocopy_version;
3391 	zerocopy_subcap->zerocopy_flags = 0;
3392 
3393 	if (*sc_mp != NULL)
3394 		linkb(*sc_mp, mp);
3395 	else
3396 		*sc_mp = mp;
3397 }
3398 
3399 /*
3400  * Consume a new-style hardware capabilities negotiation ack.
3401  * Called from ip_rput_dlpi_writer().
3402  */
3403 void
3404 ill_capability_ack(ill_t *ill, mblk_t *mp)
3405 {
3406 	dl_capability_ack_t *capp;
3407 	dl_capability_sub_t *subp, *endp;
3408 
3409 	if (ill->ill_capab_state == IDMS_INPROGRESS)
3410 		ill->ill_capab_state = IDMS_OK;
3411 
3412 	capp = (dl_capability_ack_t *)mp->b_rptr;
3413 
3414 	if (capp->dl_sub_length == 0)
3415 		/* no new-style capabilities */
3416 		return;
3417 
3418 	/* make sure the driver supplied correct dl_sub_length */
3419 	if ((sizeof (*capp) + capp->dl_sub_length) > MBLKL(mp)) {
3420 		ip0dbg(("ill_capability_ack: bad DL_CAPABILITY_ACK, "
3421 		    "invalid dl_sub_length (%d)\n", capp->dl_sub_length));
3422 		return;
3423 	}
3424 
3425 #define	SC(base, offset) (dl_capability_sub_t *)(((uchar_t *)(base))+(offset))
3426 	/*
3427 	 * There are sub-capabilities. Process the ones we know about.
3428 	 * Loop until we don't have room for another sub-cap header..
3429 	 */
3430 	for (subp = SC(capp, capp->dl_sub_offset),
3431 	    endp = SC(subp, capp->dl_sub_length - sizeof (*subp));
3432 	    subp <= endp;
3433 	    subp = SC(subp, sizeof (dl_capability_sub_t) + subp->dl_length)) {
3434 
3435 		switch (subp->dl_cap) {
3436 		case DL_CAPAB_ID_WRAPPER:
3437 			ill_capability_id_ack(ill, mp, subp);
3438 			break;
3439 		default:
3440 			ill_capability_dispatch(ill, mp, subp, B_FALSE);
3441 			break;
3442 		}
3443 	}
3444 #undef SC
3445 }
3446 
3447 /*
3448  * This routine is called to scan the fragmentation reassembly table for
3449  * the specified ILL for any packets that are starting to smell.
3450  * dead_interval is the maximum time in seconds that will be tolerated.  It
3451  * will either be the value specified in ip_g_frag_timeout, or zero if the
3452  * ILL is shutting down and it is time to blow everything off.
3453  *
3454  * It returns the number of seconds (as a time_t) that the next frag timer
3455  * should be scheduled for, 0 meaning that the timer doesn't need to be
3456  * re-started.  Note that the method of calculating next_timeout isn't
3457  * entirely accurate since time will flow between the time we grab
3458  * current_time and the time we schedule the next timeout.  This isn't a
3459  * big problem since this is the timer for sending an ICMP reassembly time
3460  * exceeded messages, and it doesn't have to be exactly accurate.
3461  *
3462  * This function is
3463  * sometimes called as writer, although this is not required.
3464  */
3465 time_t
3466 ill_frag_timeout(ill_t *ill, time_t dead_interval)
3467 {
3468 	ipfb_t	*ipfb;
3469 	ipfb_t	*endp;
3470 	ipf_t	*ipf;
3471 	ipf_t	*ipfnext;
3472 	mblk_t	*mp;
3473 	time_t	current_time = gethrestime_sec();
3474 	time_t	next_timeout = 0;
3475 	uint32_t	hdr_length;
3476 	mblk_t	*send_icmp_head;
3477 	mblk_t	*send_icmp_head_v6;
3478 
3479 	ipfb = ill->ill_frag_hash_tbl;
3480 	if (ipfb == NULL)
3481 		return (B_FALSE);
3482 	endp = &ipfb[ILL_FRAG_HASH_TBL_COUNT];
3483 	/* Walk the frag hash table. */
3484 	for (; ipfb < endp; ipfb++) {
3485 		send_icmp_head = NULL;
3486 		send_icmp_head_v6 = NULL;
3487 		mutex_enter(&ipfb->ipfb_lock);
3488 		while ((ipf = ipfb->ipfb_ipf) != 0) {
3489 			time_t frag_time = current_time - ipf->ipf_timestamp;
3490 			time_t frag_timeout;
3491 
3492 			if (frag_time < dead_interval) {
3493 				/*
3494 				 * There are some outstanding fragments
3495 				 * that will timeout later.  Make note of
3496 				 * the time so that we can reschedule the
3497 				 * next timeout appropriately.
3498 				 */
3499 				frag_timeout = dead_interval - frag_time;
3500 				if (next_timeout == 0 ||
3501 				    frag_timeout < next_timeout) {
3502 					next_timeout = frag_timeout;
3503 				}
3504 				break;
3505 			}
3506 			/* Time's up.  Get it out of here. */
3507 			hdr_length = ipf->ipf_nf_hdr_len;
3508 			ipfnext = ipf->ipf_hash_next;
3509 			if (ipfnext)
3510 				ipfnext->ipf_ptphn = ipf->ipf_ptphn;
3511 			*ipf->ipf_ptphn = ipfnext;
3512 			mp = ipf->ipf_mp->b_cont;
3513 			for (; mp; mp = mp->b_cont) {
3514 				/* Extra points for neatness. */
3515 				IP_REASS_SET_START(mp, 0);
3516 				IP_REASS_SET_END(mp, 0);
3517 			}
3518 			mp = ipf->ipf_mp->b_cont;
3519 			ill->ill_frag_count -= ipf->ipf_count;
3520 			ASSERT(ipfb->ipfb_count >= ipf->ipf_count);
3521 			ipfb->ipfb_count -= ipf->ipf_count;
3522 			ASSERT(ipfb->ipfb_frag_pkts > 0);
3523 			ipfb->ipfb_frag_pkts--;
3524 			/*
3525 			 * We do not send any icmp message from here because
3526 			 * we currently are holding the ipfb_lock for this
3527 			 * hash chain. If we try and send any icmp messages
3528 			 * from here we may end up via a put back into ip
3529 			 * trying to get the same lock, causing a recursive
3530 			 * mutex panic. Instead we build a list and send all
3531 			 * the icmp messages after we have dropped the lock.
3532 			 */
3533 			if (ill->ill_isv6) {
3534 				BUMP_MIB(ill->ill_ip6_mib, ipv6ReasmFails);
3535 				if (hdr_length != 0) {
3536 					mp->b_next = send_icmp_head_v6;
3537 					send_icmp_head_v6 = mp;
3538 				} else {
3539 					freemsg(mp);
3540 				}
3541 			} else {
3542 				BUMP_MIB(&ip_mib, ipReasmFails);
3543 				if (hdr_length != 0) {
3544 					mp->b_next = send_icmp_head;
3545 					send_icmp_head = mp;
3546 				} else {
3547 					freemsg(mp);
3548 				}
3549 			}
3550 			freeb(ipf->ipf_mp);
3551 		}
3552 		mutex_exit(&ipfb->ipfb_lock);
3553 		/*
3554 		 * Now need to send any icmp messages that we delayed from
3555 		 * above.
3556 		 */
3557 		while (send_icmp_head_v6 != NULL) {
3558 			mp = send_icmp_head_v6;
3559 			send_icmp_head_v6 = send_icmp_head_v6->b_next;
3560 			mp->b_next = NULL;
3561 			icmp_time_exceeded_v6(ill->ill_wq, mp,
3562 			    ICMP_REASSEMBLY_TIME_EXCEEDED, B_FALSE, B_FALSE);
3563 		}
3564 		while (send_icmp_head != NULL) {
3565 			mp = send_icmp_head;
3566 			send_icmp_head = send_icmp_head->b_next;
3567 			mp->b_next = NULL;
3568 			icmp_time_exceeded(ill->ill_wq, mp,
3569 			    ICMP_REASSEMBLY_TIME_EXCEEDED);
3570 		}
3571 	}
3572 	/*
3573 	 * A non-dying ILL will use the return value to decide whether to
3574 	 * restart the frag timer, and for how long.
3575 	 */
3576 	return (next_timeout);
3577 }
3578 
3579 /*
3580  * This routine is called when the approximate count of mblk memory used
3581  * for the specified ILL has exceeded max_count.
3582  */
3583 void
3584 ill_frag_prune(ill_t *ill, uint_t max_count)
3585 {
3586 	ipfb_t	*ipfb;
3587 	ipf_t	*ipf;
3588 	size_t	count;
3589 
3590 	/*
3591 	 * If we are here within ip_min_frag_prune_time msecs remove
3592 	 * ill_frag_free_num_pkts oldest packets from each bucket and increment
3593 	 * ill_frag_free_num_pkts.
3594 	 */
3595 	mutex_enter(&ill->ill_lock);
3596 	if (TICK_TO_MSEC(lbolt - ill->ill_last_frag_clean_time) <=
3597 	    (ip_min_frag_prune_time != 0 ?
3598 	    ip_min_frag_prune_time : msec_per_tick)) {
3599 
3600 		ill->ill_frag_free_num_pkts++;
3601 
3602 	} else {
3603 		ill->ill_frag_free_num_pkts = 0;
3604 	}
3605 	ill->ill_last_frag_clean_time = lbolt;
3606 	mutex_exit(&ill->ill_lock);
3607 
3608 	/*
3609 	 * free ill_frag_free_num_pkts oldest packets from each bucket.
3610 	 */
3611 	if (ill->ill_frag_free_num_pkts != 0) {
3612 		int ix;
3613 
3614 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
3615 			ipfb = &ill->ill_frag_hash_tbl[ix];
3616 			mutex_enter(&ipfb->ipfb_lock);
3617 			if (ipfb->ipfb_ipf != NULL) {
3618 				ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf,
3619 				    ill->ill_frag_free_num_pkts);
3620 			}
3621 			mutex_exit(&ipfb->ipfb_lock);
3622 		}
3623 	}
3624 	/*
3625 	 * While the reassembly list for this ILL is too big, prune a fragment
3626 	 * queue by age, oldest first.  Note that the per ILL count is
3627 	 * approximate, while the per frag hash bucket counts are accurate.
3628 	 */
3629 	while (ill->ill_frag_count > max_count) {
3630 		int	ix;
3631 		ipfb_t	*oipfb = NULL;
3632 		uint_t	oldest = UINT_MAX;
3633 
3634 		count = 0;
3635 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
3636 			ipfb = &ill->ill_frag_hash_tbl[ix];
3637 			mutex_enter(&ipfb->ipfb_lock);
3638 			ipf = ipfb->ipfb_ipf;
3639 			if (ipf != NULL && ipf->ipf_gen < oldest) {
3640 				oldest = ipf->ipf_gen;
3641 				oipfb = ipfb;
3642 			}
3643 			count += ipfb->ipfb_count;
3644 			mutex_exit(&ipfb->ipfb_lock);
3645 		}
3646 		/* Refresh the per ILL count */
3647 		ill->ill_frag_count = count;
3648 		if (oipfb == NULL) {
3649 			ill->ill_frag_count = 0;
3650 			break;
3651 		}
3652 		if (count <= max_count)
3653 			return;	/* Somebody beat us to it, nothing to do */
3654 		mutex_enter(&oipfb->ipfb_lock);
3655 		ipf = oipfb->ipfb_ipf;
3656 		if (ipf != NULL) {
3657 			ill_frag_free_pkts(ill, oipfb, ipf, 1);
3658 		}
3659 		mutex_exit(&oipfb->ipfb_lock);
3660 	}
3661 }
3662 
3663 /*
3664  * free 'free_cnt' fragmented packets starting at ipf.
3665  */
3666 void
3667 ill_frag_free_pkts(ill_t *ill, ipfb_t *ipfb, ipf_t *ipf, int free_cnt)
3668 {
3669 	size_t	count;
3670 	mblk_t	*mp;
3671 	mblk_t	*tmp;
3672 	ipf_t **ipfp = ipf->ipf_ptphn;
3673 
3674 	ASSERT(MUTEX_HELD(&ipfb->ipfb_lock));
3675 	ASSERT(ipfp != NULL);
3676 	ASSERT(ipf != NULL);
3677 
3678 	while (ipf != NULL && free_cnt-- > 0) {
3679 		count = ipf->ipf_count;
3680 		mp = ipf->ipf_mp;
3681 		ipf = ipf->ipf_hash_next;
3682 		for (tmp = mp; tmp; tmp = tmp->b_cont) {
3683 			IP_REASS_SET_START(tmp, 0);
3684 			IP_REASS_SET_END(tmp, 0);
3685 		}
3686 		ill->ill_frag_count -= count;
3687 		ASSERT(ipfb->ipfb_count >= count);
3688 		ipfb->ipfb_count -= count;
3689 		ASSERT(ipfb->ipfb_frag_pkts > 0);
3690 		ipfb->ipfb_frag_pkts--;
3691 		freemsg(mp);
3692 		BUMP_MIB(&ip_mib, ipReasmFails);
3693 	}
3694 
3695 	if (ipf)
3696 		ipf->ipf_ptphn = ipfp;
3697 	ipfp[0] = ipf;
3698 }
3699 
3700 #define	ND_FORWARD_WARNING	"The <if>:ip*_forwarding ndd variables are " \
3701 	"obsolete and may be removed in a future release of Solaris.  Use " \
3702 	"ifconfig(1M) to manipulate the forwarding status of an interface."
3703 
3704 /*
3705  * For obsolete per-interface forwarding configuration;
3706  * called in response to ND_GET.
3707  */
3708 /* ARGSUSED */
3709 static int
3710 nd_ill_forward_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *ioc_cr)
3711 {
3712 	ill_t *ill = (ill_t *)cp;
3713 
3714 	cmn_err(CE_WARN, ND_FORWARD_WARNING);
3715 
3716 	(void) mi_mpprintf(mp, "%d", (ill->ill_flags & ILLF_ROUTER) != 0);
3717 	return (0);
3718 }
3719 
3720 /*
3721  * For obsolete per-interface forwarding configuration;
3722  * called in response to ND_SET.
3723  */
3724 /* ARGSUSED */
3725 static int
3726 nd_ill_forward_set(queue_t *q, mblk_t *mp, char *valuestr, caddr_t cp,
3727     cred_t *ioc_cr)
3728 {
3729 	long value;
3730 	int retval;
3731 
3732 	cmn_err(CE_WARN, ND_FORWARD_WARNING);
3733 
3734 	if (ddi_strtol(valuestr, NULL, 10, &value) != 0 ||
3735 	    value < 0 || value > 1) {
3736 		return (EINVAL);
3737 	}
3738 
3739 	rw_enter(&ill_g_lock, RW_READER);
3740 	retval = ill_forward_set(q, mp, (value != 0), cp);
3741 	rw_exit(&ill_g_lock);
3742 	return (retval);
3743 }
3744 
3745 /*
3746  * Set an ill's ILLF_ROUTER flag appropriately.  If the ill is part of an
3747  * IPMP group, make sure all ill's in the group adopt the new policy.  Send
3748  * up RTS_IFINFO routing socket messages for each interface whose flags we
3749  * change.
3750  */
3751 /* ARGSUSED */
3752 int
3753 ill_forward_set(queue_t *q, mblk_t *mp, boolean_t enable, caddr_t cp)
3754 {
3755 	ill_t *ill = (ill_t *)cp;
3756 	ill_group_t *illgrp;
3757 
3758 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ill_g_lock));
3759 
3760 	if ((enable && (ill->ill_flags & ILLF_ROUTER)) ||
3761 	    (!enable && !(ill->ill_flags & ILLF_ROUTER)) ||
3762 	    (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK))
3763 		return (EINVAL);
3764 
3765 	/*
3766 	 * If the ill is in an IPMP group, set the forwarding policy on all
3767 	 * members of the group to the same value.
3768 	 */
3769 	illgrp = ill->ill_group;
3770 	if (illgrp != NULL) {
3771 		ill_t *tmp_ill;
3772 
3773 		for (tmp_ill = illgrp->illgrp_ill; tmp_ill != NULL;
3774 		    tmp_ill = tmp_ill->ill_group_next) {
3775 			ip1dbg(("ill_forward_set: %s %s forwarding on %s",
3776 			    (enable ? "Enabling" : "Disabling"),
3777 			    (tmp_ill->ill_isv6 ? "IPv6" : "IPv4"),
3778 			    tmp_ill->ill_name));
3779 			mutex_enter(&tmp_ill->ill_lock);
3780 			if (enable)
3781 				tmp_ill->ill_flags |= ILLF_ROUTER;
3782 			else
3783 				tmp_ill->ill_flags &= ~ILLF_ROUTER;
3784 			mutex_exit(&tmp_ill->ill_lock);
3785 			if (tmp_ill->ill_isv6)
3786 				ill_set_nce_router_flags(tmp_ill, enable);
3787 			/* Notify routing socket listeners of this change. */
3788 			ip_rts_ifmsg(tmp_ill->ill_ipif);
3789 		}
3790 	} else {
3791 		ip1dbg(("ill_forward_set: %s %s forwarding on %s",
3792 		    (enable ? "Enabling" : "Disabling"),
3793 		    (ill->ill_isv6 ? "IPv6" : "IPv4"), ill->ill_name));
3794 		mutex_enter(&ill->ill_lock);
3795 		if (enable)
3796 			ill->ill_flags |= ILLF_ROUTER;
3797 		else
3798 			ill->ill_flags &= ~ILLF_ROUTER;
3799 		mutex_exit(&ill->ill_lock);
3800 		if (ill->ill_isv6)
3801 			ill_set_nce_router_flags(ill, enable);
3802 		/* Notify routing socket listeners of this change. */
3803 		ip_rts_ifmsg(ill->ill_ipif);
3804 	}
3805 
3806 	return (0);
3807 }
3808 
3809 /*
3810  * Based on the ILLF_ROUTER flag of an ill, make sure all local nce's for
3811  * addresses assigned to the ill have the NCE_F_ISROUTER flag appropriately
3812  * set or clear.
3813  */
3814 static void
3815 ill_set_nce_router_flags(ill_t *ill, boolean_t enable)
3816 {
3817 	ipif_t *ipif;
3818 	nce_t *nce;
3819 
3820 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
3821 		nce = ndp_lookup(ill, &ipif->ipif_v6lcl_addr, B_FALSE);
3822 		if (nce != NULL) {
3823 			mutex_enter(&nce->nce_lock);
3824 			if (enable)
3825 				nce->nce_flags |= NCE_F_ISROUTER;
3826 			else
3827 				nce->nce_flags &= ~NCE_F_ISROUTER;
3828 			mutex_exit(&nce->nce_lock);
3829 			NCE_REFRELE(nce);
3830 		}
3831 	}
3832 }
3833 
3834 /*
3835  * Given an ill with a _valid_ name, add the ip_forwarding ndd variable
3836  * for this ill.  Make sure the v6/v4 question has been answered about this
3837  * ill.  The creation of this ndd variable is only for backwards compatibility.
3838  * The preferred way to control per-interface IP forwarding is through the
3839  * ILLF_ROUTER interface flag.
3840  */
3841 static int
3842 ill_set_ndd_name(ill_t *ill)
3843 {
3844 	char *suffix;
3845 
3846 	ASSERT(IAM_WRITER_ILL(ill));
3847 
3848 	if (ill->ill_isv6)
3849 		suffix = ipv6_forward_suffix;
3850 	else
3851 		suffix = ipv4_forward_suffix;
3852 
3853 	ill->ill_ndd_name = ill->ill_name + ill->ill_name_length;
3854 	bcopy(ill->ill_name, ill->ill_ndd_name, ill->ill_name_length - 1);
3855 	/*
3856 	 * Copies over the '\0'.
3857 	 * Note that strlen(suffix) is always bounded.
3858 	 */
3859 	bcopy(suffix, ill->ill_ndd_name + ill->ill_name_length - 1,
3860 	    strlen(suffix) + 1);
3861 
3862 	/*
3863 	 * Use of the nd table requires holding the reader lock.
3864 	 * Modifying the nd table thru nd_load/nd_unload requires
3865 	 * the writer lock.
3866 	 */
3867 	rw_enter(&ip_g_nd_lock, RW_WRITER);
3868 	if (!nd_load(&ip_g_nd, ill->ill_ndd_name, nd_ill_forward_get,
3869 	    nd_ill_forward_set, (caddr_t)ill)) {
3870 		/*
3871 		 * If the nd_load failed, it only meant that it could not
3872 		 * allocate a new bunch of room for further NDD expansion.
3873 		 * Because of that, the ill_ndd_name will be set to 0, and
3874 		 * this interface is at the mercy of the global ip_forwarding
3875 		 * variable.
3876 		 */
3877 		rw_exit(&ip_g_nd_lock);
3878 		ill->ill_ndd_name = NULL;
3879 		return (ENOMEM);
3880 	}
3881 	rw_exit(&ip_g_nd_lock);
3882 	return (0);
3883 }
3884 
3885 /*
3886  * Intializes the context structure and returns the first ill in the list
3887  * cuurently start_list and end_list can have values:
3888  * MAX_G_HEADS		Traverse both IPV4 and IPV6 lists.
3889  * IP_V4_G_HEAD		Traverse IPV4 list only.
3890  * IP_V6_G_HEAD		Traverse IPV6 list only.
3891  */
3892 
3893 /*
3894  * We don't check for CONDEMNED ills here. Caller must do that if
3895  * necessary under the ill lock.
3896  */
3897 ill_t *
3898 ill_first(int start_list, int end_list, ill_walk_context_t *ctx)
3899 {
3900 	ill_if_t *ifp;
3901 	ill_t *ill;
3902 	avl_tree_t *avl_tree;
3903 
3904 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
3905 	ASSERT(end_list <= MAX_G_HEADS && start_list >= 0);
3906 
3907 	/*
3908 	 * setup the lists to search
3909 	 */
3910 	if (end_list != MAX_G_HEADS) {
3911 		ctx->ctx_current_list = start_list;
3912 		ctx->ctx_last_list = end_list;
3913 	} else {
3914 		ctx->ctx_last_list = MAX_G_HEADS - 1;
3915 		ctx->ctx_current_list = 0;
3916 	}
3917 
3918 	while (ctx->ctx_current_list <= ctx->ctx_last_list) {
3919 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list);
3920 		if (ifp != (ill_if_t *)
3921 		    &IP_VX_ILL_G_LIST(ctx->ctx_current_list)) {
3922 			avl_tree = &ifp->illif_avl_by_ppa;
3923 			ill = avl_first(avl_tree);
3924 			/*
3925 			 * ill is guaranteed to be non NULL or ifp should have
3926 			 * not existed.
3927 			 */
3928 			ASSERT(ill != NULL);
3929 			return (ill);
3930 		}
3931 		ctx->ctx_current_list++;
3932 	}
3933 
3934 	return (NULL);
3935 }
3936 
3937 /*
3938  * returns the next ill in the list. ill_first() must have been called
3939  * before calling ill_next() or bad things will happen.
3940  */
3941 
3942 /*
3943  * We don't check for CONDEMNED ills here. Caller must do that if
3944  * necessary under the ill lock.
3945  */
3946 ill_t *
3947 ill_next(ill_walk_context_t *ctx, ill_t *lastill)
3948 {
3949 	ill_if_t *ifp;
3950 	ill_t *ill;
3951 
3952 
3953 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
3954 	ASSERT(lastill->ill_ifptr != (ill_if_t *)
3955 	    &IP_VX_ILL_G_LIST(ctx->ctx_current_list));
3956 	if ((ill = avl_walk(&lastill->ill_ifptr->illif_avl_by_ppa, lastill,
3957 	    AVL_AFTER)) != NULL) {
3958 		return (ill);
3959 	}
3960 
3961 	/* goto next ill_ifp in the list. */
3962 	ifp = lastill->ill_ifptr->illif_next;
3963 
3964 	/* make sure not at end of circular list */
3965 	while (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(ctx->ctx_current_list)) {
3966 		if (++ctx->ctx_current_list > ctx->ctx_last_list)
3967 			return (NULL);
3968 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list);
3969 	}
3970 
3971 	return (avl_first(&ifp->illif_avl_by_ppa));
3972 }
3973 
3974 /*
3975  * Check interface name for correct format which is name+ppa.
3976  * name can contain characters and digits, the right most digits
3977  * make up the ppa number. use of octal is not allowed, name must contain
3978  * a ppa, return pointer to the start of ppa.
3979  * In case of error return NULL.
3980  */
3981 static char *
3982 ill_get_ppa_ptr(char *name)
3983 {
3984 	int namelen = mi_strlen(name);
3985 
3986 	int len = namelen;
3987 
3988 	name += len;
3989 	while (len > 0) {
3990 		name--;
3991 		if (*name < '0' || *name > '9')
3992 			break;
3993 		len--;
3994 	}
3995 
3996 	/* empty string, all digits, or no trailing digits */
3997 	if (len == 0 || len == (int)namelen)
3998 		return (NULL);
3999 
4000 	name++;
4001 	/* check for attempted use of octal */
4002 	if (*name == '0' && len != (int)namelen - 1)
4003 		return (NULL);
4004 	return (name);
4005 }
4006 
4007 /*
4008  * use avl tree to locate the ill.
4009  */
4010 static ill_t *
4011 ill_find_by_name(char *name, boolean_t isv6, queue_t *q, mblk_t *mp,
4012     ipsq_func_t func, int *error)
4013 {
4014 	char *ppa_ptr = NULL;
4015 	int len;
4016 	uint_t ppa;
4017 	ill_t *ill = NULL;
4018 	ill_if_t *ifp;
4019 	int list;
4020 	ipsq_t *ipsq;
4021 
4022 	if (error != NULL)
4023 		*error = 0;
4024 
4025 	/*
4026 	 * get ppa ptr
4027 	 */
4028 	if (isv6)
4029 		list = IP_V6_G_HEAD;
4030 	else
4031 		list = IP_V4_G_HEAD;
4032 
4033 	if ((ppa_ptr = ill_get_ppa_ptr(name)) == NULL) {
4034 		if (error != NULL)
4035 			*error = ENXIO;
4036 		return (NULL);
4037 	}
4038 
4039 	len = ppa_ptr - name + 1;
4040 
4041 	ppa = stoi(&ppa_ptr);
4042 
4043 	ifp = IP_VX_ILL_G_LIST(list);
4044 
4045 	while (ifp != (ill_if_t *)&IP_VX_ILL_G_LIST(list)) {
4046 		/*
4047 		 * match is done on len - 1 as the name is not null
4048 		 * terminated it contains ppa in addition to the interface
4049 		 * name.
4050 		 */
4051 		if ((ifp->illif_name_len == len) &&
4052 		    bcmp(ifp->illif_name, name, len - 1) == 0) {
4053 			break;
4054 		} else {
4055 			ifp = ifp->illif_next;
4056 		}
4057 	}
4058 
4059 
4060 	if (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(list)) {
4061 		/*
4062 		 * Even the interface type does not exist.
4063 		 */
4064 		if (error != NULL)
4065 			*error = ENXIO;
4066 		return (NULL);
4067 	}
4068 
4069 	ill = avl_find(&ifp->illif_avl_by_ppa, (void *) &ppa, NULL);
4070 	if (ill != NULL) {
4071 		/*
4072 		 * The block comment at the start of ipif_down
4073 		 * explains the use of the macros used below
4074 		 */
4075 		GRAB_CONN_LOCK(q);
4076 		mutex_enter(&ill->ill_lock);
4077 		if (ILL_CAN_LOOKUP(ill)) {
4078 			ill_refhold_locked(ill);
4079 			mutex_exit(&ill->ill_lock);
4080 			RELEASE_CONN_LOCK(q);
4081 			return (ill);
4082 		} else if (ILL_CAN_WAIT(ill, q)) {
4083 			ipsq = ill->ill_phyint->phyint_ipsq;
4084 			mutex_enter(&ipsq->ipsq_lock);
4085 			mutex_exit(&ill->ill_lock);
4086 			ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
4087 			mutex_exit(&ipsq->ipsq_lock);
4088 			RELEASE_CONN_LOCK(q);
4089 			*error = EINPROGRESS;
4090 			return (NULL);
4091 		}
4092 		mutex_exit(&ill->ill_lock);
4093 		RELEASE_CONN_LOCK(q);
4094 	}
4095 	if (error != NULL)
4096 		*error = ENXIO;
4097 	return (NULL);
4098 }
4099 
4100 /*
4101  * comparison function for use with avl.
4102  */
4103 static int
4104 ill_compare_ppa(const void *ppa_ptr, const void *ill_ptr)
4105 {
4106 	uint_t ppa;
4107 	uint_t ill_ppa;
4108 
4109 	ASSERT(ppa_ptr != NULL && ill_ptr != NULL);
4110 
4111 	ppa = *((uint_t *)ppa_ptr);
4112 	ill_ppa = ((const ill_t *)ill_ptr)->ill_ppa;
4113 	/*
4114 	 * We want the ill with the lowest ppa to be on the
4115 	 * top.
4116 	 */
4117 	if (ill_ppa < ppa)
4118 		return (1);
4119 	if (ill_ppa > ppa)
4120 		return (-1);
4121 	return (0);
4122 }
4123 
4124 /*
4125  * remove an interface type from the global list.
4126  */
4127 static void
4128 ill_delete_interface_type(ill_if_t *interface)
4129 {
4130 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
4131 
4132 	ASSERT(interface != NULL);
4133 	ASSERT(avl_numnodes(&interface->illif_avl_by_ppa) == 0);
4134 
4135 	avl_destroy(&interface->illif_avl_by_ppa);
4136 	if (interface->illif_ppa_arena != NULL)
4137 		vmem_destroy(interface->illif_ppa_arena);
4138 
4139 	remque(interface);
4140 
4141 	mi_free(interface);
4142 }
4143 
4144 /*
4145  * remove ill from the global list.
4146  */
4147 static void
4148 ill_glist_delete(ill_t *ill)
4149 {
4150 	if (ill == NULL)
4151 		return;
4152 
4153 	rw_enter(&ill_g_lock, RW_WRITER);
4154 	/*
4155 	 * If the ill was never inserted into the AVL tree
4156 	 * we skip the if branch.
4157 	 */
4158 	if (ill->ill_ifptr != NULL) {
4159 		/*
4160 		 * remove from AVL tree and free ppa number
4161 		 */
4162 		avl_remove(&ill->ill_ifptr->illif_avl_by_ppa, ill);
4163 
4164 		if (ill->ill_ifptr->illif_ppa_arena != NULL) {
4165 			vmem_free(ill->ill_ifptr->illif_ppa_arena,
4166 			    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
4167 		}
4168 		if (avl_numnodes(&ill->ill_ifptr->illif_avl_by_ppa) == 0) {
4169 			ill_delete_interface_type(ill->ill_ifptr);
4170 		}
4171 
4172 		/*
4173 		 * Indicate ill is no longer in the list.
4174 		 */
4175 		ill->ill_ifptr = NULL;
4176 		ill->ill_name_length = 0;
4177 		ill->ill_name[0] = '\0';
4178 		ill->ill_ppa = UINT_MAX;
4179 	}
4180 	ill_phyint_free(ill);
4181 	rw_exit(&ill_g_lock);
4182 }
4183 
4184 /*
4185  * allocate a ppa, if the number of plumbed interfaces of this type are
4186  * less than ill_no_arena do a linear search to find a unused ppa.
4187  * When the number goes beyond ill_no_arena switch to using an arena.
4188  * Note: ppa value of zero cannot be allocated from vmem_arena as it
4189  * is the return value for an error condition, so allocation starts at one
4190  * and is decremented by one.
4191  */
4192 static int
4193 ill_alloc_ppa(ill_if_t *ifp, ill_t *ill)
4194 {
4195 	ill_t *tmp_ill;
4196 	uint_t start, end;
4197 	int ppa;
4198 
4199 	if (ifp->illif_ppa_arena == NULL &&
4200 	    (avl_numnodes(&ifp->illif_avl_by_ppa) + 1 > ill_no_arena)) {
4201 		/*
4202 		 * Create an arena.
4203 		 */
4204 		ifp->illif_ppa_arena = vmem_create(ifp->illif_name,
4205 		    (void *)1, UINT_MAX - 1, 1, NULL, NULL,
4206 		    NULL, 0, VM_SLEEP | VMC_IDENTIFIER);
4207 			/* allocate what has already been assigned */
4208 		for (tmp_ill = avl_first(&ifp->illif_avl_by_ppa);
4209 		    tmp_ill != NULL; tmp_ill = avl_walk(&ifp->illif_avl_by_ppa,
4210 		    tmp_ill, AVL_AFTER)) {
4211 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
4212 			    1,		/* size */
4213 			    1,		/* align/quantum */
4214 			    0,		/* phase */
4215 			    0,		/* nocross */
4216 		(void *)((uintptr_t)tmp_ill->ill_ppa + 1), /* minaddr */
4217 		(void *)((uintptr_t)tmp_ill->ill_ppa + 2), /* maxaddr */
4218 			    VM_NOSLEEP|VM_FIRSTFIT);
4219 			if (ppa == 0) {
4220 				ip1dbg(("ill_alloc_ppa: ppa allocation"
4221 				    " failed while switching"));
4222 				vmem_destroy(ifp->illif_ppa_arena);
4223 				ifp->illif_ppa_arena = NULL;
4224 				break;
4225 			}
4226 		}
4227 	}
4228 
4229 	if (ifp->illif_ppa_arena != NULL) {
4230 		if (ill->ill_ppa == UINT_MAX) {
4231 			ppa = (int)(uintptr_t)vmem_alloc(ifp->illif_ppa_arena,
4232 			    1, VM_NOSLEEP|VM_FIRSTFIT);
4233 			if (ppa == 0)
4234 				return (EAGAIN);
4235 			ill->ill_ppa = --ppa;
4236 		} else {
4237 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
4238 			    1, 		/* size */
4239 			    1, 		/* align/quantum */
4240 			    0, 		/* phase */
4241 			    0, 		/* nocross */
4242 			    (void *)(uintptr_t)(ill->ill_ppa + 1), /* minaddr */
4243 			    (void *)(uintptr_t)(ill->ill_ppa + 2), /* maxaddr */
4244 			    VM_NOSLEEP|VM_FIRSTFIT);
4245 			/*
4246 			 * Most likely the allocation failed because
4247 			 * the requested ppa was in use.
4248 			 */
4249 			if (ppa == 0)
4250 				return (EEXIST);
4251 		}
4252 		return (0);
4253 	}
4254 
4255 	/*
4256 	 * No arena is in use and not enough (>ill_no_arena) interfaces have
4257 	 * been plumbed to create one. Do a linear search to get a unused ppa.
4258 	 */
4259 	if (ill->ill_ppa == UINT_MAX) {
4260 		end = UINT_MAX - 1;
4261 		start = 0;
4262 	} else {
4263 		end = start = ill->ill_ppa;
4264 	}
4265 
4266 	tmp_ill = avl_find(&ifp->illif_avl_by_ppa, (void *)&start, NULL);
4267 	while (tmp_ill != NULL && tmp_ill->ill_ppa == start) {
4268 		if (start++ >= end) {
4269 			if (ill->ill_ppa == UINT_MAX)
4270 				return (EAGAIN);
4271 			else
4272 				return (EEXIST);
4273 		}
4274 		tmp_ill = avl_walk(&ifp->illif_avl_by_ppa, tmp_ill, AVL_AFTER);
4275 	}
4276 	ill->ill_ppa = start;
4277 	return (0);
4278 }
4279 
4280 /*
4281  * Insert ill into the list of configured ill's. Once this function completes,
4282  * the ill is globally visible and is available through lookups. More precisely
4283  * this happens after the caller drops the ill_g_lock.
4284  */
4285 static int
4286 ill_glist_insert(ill_t *ill, char *name, boolean_t isv6)
4287 {
4288 	ill_if_t *ill_interface;
4289 	avl_index_t where = 0;
4290 	int error;
4291 	int name_length;
4292 	int index;
4293 	boolean_t check_length = B_FALSE;
4294 
4295 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
4296 
4297 	name_length = mi_strlen(name) + 1;
4298 
4299 	if (isv6)
4300 		index = IP_V6_G_HEAD;
4301 	else
4302 		index = IP_V4_G_HEAD;
4303 
4304 	ill_interface = IP_VX_ILL_G_LIST(index);
4305 	/*
4306 	 * Search for interface type based on name
4307 	 */
4308 	while (ill_interface != (ill_if_t *)&IP_VX_ILL_G_LIST(index)) {
4309 		if ((ill_interface->illif_name_len == name_length) &&
4310 		    (strcmp(ill_interface->illif_name, name) == 0)) {
4311 			break;
4312 		}
4313 		ill_interface = ill_interface->illif_next;
4314 	}
4315 
4316 	/*
4317 	 * Interface type not found, create one.
4318 	 */
4319 	if (ill_interface == (ill_if_t *)&IP_VX_ILL_G_LIST(index)) {
4320 
4321 		ill_g_head_t ghead;
4322 
4323 		/*
4324 		 * allocate ill_if_t structure
4325 		 */
4326 
4327 		ill_interface = (ill_if_t *)mi_zalloc(sizeof (ill_if_t));
4328 		if (ill_interface == NULL) {
4329 			return (ENOMEM);
4330 		}
4331 
4332 
4333 
4334 		(void) strcpy(ill_interface->illif_name, name);
4335 		ill_interface->illif_name_len = name_length;
4336 
4337 		avl_create(&ill_interface->illif_avl_by_ppa,
4338 		    ill_compare_ppa, sizeof (ill_t),
4339 		    offsetof(struct ill_s, ill_avl_byppa));
4340 
4341 		/*
4342 		 * link the structure in the back to maintain order
4343 		 * of configuration for ifconfig output.
4344 		 */
4345 		ghead = ill_g_heads[index];
4346 		insque(ill_interface, ghead.ill_g_list_tail);
4347 
4348 	}
4349 
4350 	if (ill->ill_ppa == UINT_MAX)
4351 		check_length = B_TRUE;
4352 
4353 	error = ill_alloc_ppa(ill_interface, ill);
4354 	if (error != 0) {
4355 		if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
4356 			ill_delete_interface_type(ill->ill_ifptr);
4357 		return (error);
4358 	}
4359 
4360 	/*
4361 	 * When the ppa is choosen by the system, check that there is
4362 	 * enough space to insert ppa. if a specific ppa was passed in this
4363 	 * check is not required as the interface name passed in will have
4364 	 * the right ppa in it.
4365 	 */
4366 	if (check_length) {
4367 		/*
4368 		 * UINT_MAX - 1 should fit in 10 chars, alloc 12 chars.
4369 		 */
4370 		char buf[sizeof (uint_t) * 3];
4371 
4372 		/*
4373 		 * convert ppa to string to calculate the amount of space
4374 		 * required for it in the name.
4375 		 */
4376 		numtos(ill->ill_ppa, buf);
4377 
4378 		/* Do we have enough space to insert ppa ? */
4379 
4380 		if ((mi_strlen(name) + mi_strlen(buf) + 1) > LIFNAMSIZ) {
4381 			/* Free ppa and interface type struct */
4382 			if (ill_interface->illif_ppa_arena != NULL) {
4383 				vmem_free(ill_interface->illif_ppa_arena,
4384 				    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
4385 			}
4386 			if (avl_numnodes(&ill_interface->illif_avl_by_ppa) ==
4387 			    0) {
4388 				ill_delete_interface_type(ill->ill_ifptr);
4389 			}
4390 
4391 			return (EINVAL);
4392 		}
4393 	}
4394 
4395 	(void) sprintf(ill->ill_name, "%s%u", name, ill->ill_ppa);
4396 	ill->ill_name_length = mi_strlen(ill->ill_name) + 1;
4397 
4398 	(void) avl_find(&ill_interface->illif_avl_by_ppa, &ill->ill_ppa,
4399 	    &where);
4400 	ill->ill_ifptr = ill_interface;
4401 	avl_insert(&ill_interface->illif_avl_by_ppa, ill, where);
4402 
4403 	ill_phyint_reinit(ill);
4404 	return (0);
4405 }
4406 
4407 /* Initialize the per phyint (per IPMP group) ipsq used for serialization */
4408 static boolean_t
4409 ipsq_init(ill_t *ill)
4410 {
4411 	ipsq_t  *ipsq;
4412 
4413 	/* Init the ipsq and impicitly enter as writer */
4414 	ill->ill_phyint->phyint_ipsq =
4415 	    kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP);
4416 	if (ill->ill_phyint->phyint_ipsq == NULL)
4417 		return (B_FALSE);
4418 	ipsq = ill->ill_phyint->phyint_ipsq;
4419 	ipsq->ipsq_phyint_list = ill->ill_phyint;
4420 	ill->ill_phyint->phyint_ipsq_next = NULL;
4421 	mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, 0);
4422 	ipsq->ipsq_refs = 1;
4423 	ipsq->ipsq_writer = curthread;
4424 	ipsq->ipsq_reentry_cnt = 1;
4425 #ifdef ILL_DEBUG
4426 	ipsq->ipsq_depth = getpcstack((pc_t *)ipsq->ipsq_stack, IP_STACK_DEPTH);
4427 #endif
4428 	(void) strcpy(ipsq->ipsq_name, ill->ill_name);
4429 	return (B_TRUE);
4430 }
4431 
4432 /*
4433  * ill_init is called by ip_open when a device control stream is opened.
4434  * It does a few initializations, and shoots a DL_INFO_REQ message down
4435  * to the driver.  The response is later picked up in ip_rput_dlpi and
4436  * used to set up default mechanisms for talking to the driver.  (Always
4437  * called as writer.)
4438  *
4439  * If this function returns error, ip_open will call ip_close which in
4440  * turn will call ill_delete to clean up any memory allocated here that
4441  * is not yet freed.
4442  */
4443 int
4444 ill_init(queue_t *q, ill_t *ill)
4445 {
4446 	int	count;
4447 	dl_info_req_t	*dlir;
4448 	mblk_t	*info_mp;
4449 	uchar_t *frag_ptr;
4450 
4451 	/*
4452 	 * The ill is initialized to zero by mi_alloc*(). In addition
4453 	 * some fields already contain valid values, initialized in
4454 	 * ip_open(), before we reach here.
4455 	 */
4456 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, 0);
4457 
4458 	ill->ill_rq = q;
4459 	ill->ill_wq = WR(q);
4460 
4461 	info_mp = allocb(MAX(sizeof (dl_info_req_t), sizeof (dl_info_ack_t)),
4462 	    BPRI_HI);
4463 	if (info_mp == NULL)
4464 		return (ENOMEM);
4465 
4466 	/*
4467 	 * Allocate sufficient space to contain our fragment hash table and
4468 	 * the device name.
4469 	 */
4470 	frag_ptr = (uchar_t *)mi_zalloc(ILL_FRAG_HASH_TBL_SIZE +
4471 	    2 * LIFNAMSIZ + 5 + strlen(ipv6_forward_suffix));
4472 	if (frag_ptr == NULL) {
4473 		freemsg(info_mp);
4474 		return (ENOMEM);
4475 	}
4476 	ill->ill_frag_ptr = frag_ptr;
4477 	ill->ill_frag_free_num_pkts = 0;
4478 	ill->ill_last_frag_clean_time = 0;
4479 	ill->ill_frag_hash_tbl = (ipfb_t *)frag_ptr;
4480 	ill->ill_name = (char *)(frag_ptr + ILL_FRAG_HASH_TBL_SIZE);
4481 	for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
4482 		mutex_init(&ill->ill_frag_hash_tbl[count].ipfb_lock,
4483 		    NULL, MUTEX_DEFAULT, NULL);
4484 	}
4485 
4486 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
4487 	if (ill->ill_phyint == NULL) {
4488 		freemsg(info_mp);
4489 		mi_free(frag_ptr);
4490 		return (ENOMEM);
4491 	}
4492 
4493 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
4494 	/*
4495 	 * For now pretend this is a v4 ill. We need to set phyint_ill*
4496 	 * at this point because of the following reason. If we can't
4497 	 * enter the ipsq at some point and cv_wait, the writer that
4498 	 * wakes us up tries to locate us using the list of all phyints
4499 	 * in an ipsq and the ills from the phyint thru the phyint_ill*.
4500 	 * If we don't set it now, we risk a missed wakeup.
4501 	 */
4502 	ill->ill_phyint->phyint_illv4 = ill;
4503 	ill->ill_ppa = UINT_MAX;
4504 	ill->ill_fastpath_list = &ill->ill_fastpath_list;
4505 
4506 	if (!ipsq_init(ill)) {
4507 		freemsg(info_mp);
4508 		mi_free(frag_ptr);
4509 		mi_free(ill->ill_phyint);
4510 		return (ENOMEM);
4511 	}
4512 
4513 	ill->ill_state_flags |= ILL_LL_SUBNET_PENDING;
4514 
4515 
4516 	/* Frag queue limit stuff */
4517 	ill->ill_frag_count = 0;
4518 	ill->ill_ipf_gen = 0;
4519 
4520 	ill->ill_global_timer = INFINITY;
4521 	ill->ill_mcast_type = IGMP_V3_ROUTER;	/* == MLD_V2_ROUTER */
4522 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
4523 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
4524 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
4525 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
4526 
4527 	/*
4528 	 * Initialize IPv6 configuration variables.  The IP module is always
4529 	 * opened as an IPv4 module.  Instead tracking down the cases where
4530 	 * it switches to do ipv6, we'll just initialize the IPv6 configuration
4531 	 * here for convenience, this has no effect until the ill is set to do
4532 	 * IPv6.
4533 	 */
4534 	ill->ill_reachable_time = ND_REACHABLE_TIME;
4535 	ill->ill_reachable_retrans_time = ND_RETRANS_TIMER;
4536 	ill->ill_xmit_count = ND_MAX_MULTICAST_SOLICIT;
4537 	ill->ill_max_buf = ND_MAX_Q;
4538 	ill->ill_refcnt = 0;
4539 
4540 	/* Send down the Info Request to the driver. */
4541 	info_mp->b_datap->db_type = M_PCPROTO;
4542 	dlir = (dl_info_req_t *)info_mp->b_rptr;
4543 	info_mp->b_wptr = (uchar_t *)&dlir[1];
4544 	dlir->dl_primitive = DL_INFO_REQ;
4545 
4546 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
4547 
4548 	qprocson(q);
4549 	ill_dlpi_send(ill, info_mp);
4550 
4551 	return (0);
4552 }
4553 
4554 /*
4555  * ill_dls_info
4556  * creates datalink socket info from the device.
4557  */
4558 int
4559 ill_dls_info(struct sockaddr_dl *sdl, ipif_t *ipif)
4560 {
4561 	size_t	length;
4562 	ill_t	*ill = ipif->ipif_ill;
4563 
4564 	sdl->sdl_family = AF_LINK;
4565 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
4566 	sdl->sdl_type = ipif->ipif_type;
4567 	(void) ipif_get_name(ipif, sdl->sdl_data, sizeof (sdl->sdl_data));
4568 	length = mi_strlen(sdl->sdl_data);
4569 	ASSERT(length < 256);
4570 	sdl->sdl_nlen = (uchar_t)length;
4571 	sdl->sdl_alen = ill->ill_phys_addr_length;
4572 	mutex_enter(&ill->ill_lock);
4573 	if (ill->ill_phys_addr_length != 0 && ill->ill_phys_addr != NULL) {
4574 		bcopy(ill->ill_phys_addr, &sdl->sdl_data[length],
4575 		    ill->ill_phys_addr_length);
4576 	}
4577 	mutex_exit(&ill->ill_lock);
4578 	sdl->sdl_slen = 0;
4579 	return (sizeof (struct sockaddr_dl));
4580 }
4581 
4582 /*
4583  * ill_xarp_info
4584  * creates xarp info from the device.
4585  */
4586 static int
4587 ill_xarp_info(struct sockaddr_dl *sdl, ill_t *ill)
4588 {
4589 	sdl->sdl_family = AF_LINK;
4590 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
4591 	sdl->sdl_type = ill->ill_type;
4592 	(void) ipif_get_name(ill->ill_ipif, sdl->sdl_data,
4593 	    sizeof (sdl->sdl_data));
4594 	sdl->sdl_nlen = (uchar_t)mi_strlen(sdl->sdl_data);
4595 	sdl->sdl_alen = ill->ill_phys_addr_length;
4596 	sdl->sdl_slen = 0;
4597 	return (sdl->sdl_nlen);
4598 }
4599 
4600 static int
4601 loopback_kstat_update(kstat_t *ksp, int rw)
4602 {
4603 	kstat_named_t *kn = KSTAT_NAMED_PTR(ksp);
4604 
4605 	if (rw == KSTAT_WRITE)
4606 		return (EACCES);
4607 	kn[0].value.ui32 = loopback_packets;
4608 	kn[1].value.ui32 = loopback_packets;
4609 	return (0);
4610 }
4611 
4612 
4613 /*
4614  * Has ifindex been plumbed already.
4615  */
4616 static boolean_t
4617 phyint_exists(uint_t index)
4618 {
4619 	phyint_t *phyi;
4620 
4621 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
4622 	/*
4623 	 * Indexes are stored in the phyint - a common structure
4624 	 * to both IPv4 and IPv6.
4625 	 */
4626 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_index,
4627 	    (void *) &index, NULL);
4628 	return (phyi != NULL);
4629 }
4630 
4631 /*
4632  * Assign a unique interface index for the phyint.
4633  */
4634 static boolean_t
4635 phyint_assign_ifindex(phyint_t *phyi)
4636 {
4637 	uint_t starting_index;
4638 
4639 	ASSERT(phyi->phyint_ifindex == 0);
4640 	if (!ill_index_wrap) {
4641 		phyi->phyint_ifindex = ill_index++;
4642 		if (ill_index == 0) {
4643 			/* Reached the uint_t limit Next time wrap  */
4644 			ill_index_wrap = B_TRUE;
4645 		}
4646 		return (B_TRUE);
4647 	}
4648 
4649 	/*
4650 	 * Start reusing unused indexes. Note that we hold the ill_g_lock
4651 	 * at this point and don't want to call any function that attempts
4652 	 * to get the lock again.
4653 	 */
4654 	starting_index = ill_index++;
4655 	for (; ill_index != starting_index; ill_index++) {
4656 		if (ill_index != 0 && !phyint_exists(ill_index)) {
4657 			/* found unused index - use it */
4658 			phyi->phyint_ifindex = ill_index;
4659 			return (B_TRUE);
4660 		}
4661 	}
4662 
4663 	/*
4664 	 * all interface indicies are inuse.
4665 	 */
4666 	return (B_FALSE);
4667 }
4668 
4669 /*
4670  * Return a pointer to the ill which matches the supplied name.  Note that
4671  * the ill name length includes the null termination character.  (May be
4672  * called as writer.)
4673  * If do_alloc and the interface is "lo0" it will be automatically created.
4674  * Cannot bump up reference on condemned ills. So dup detect can't be done
4675  * using this func.
4676  */
4677 ill_t *
4678 ill_lookup_on_name(char *name, boolean_t do_alloc, boolean_t isv6,
4679     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, boolean_t *did_alloc)
4680 {
4681 	ill_t	*ill;
4682 	ipif_t	*ipif;
4683 	kstat_named_t	*kn;
4684 	boolean_t isloopback;
4685 	ipsq_t *old_ipsq;
4686 
4687 	isloopback = mi_strcmp(name, ipif_loopback_name) == 0;
4688 
4689 	rw_enter(&ill_g_lock, RW_READER);
4690 	ill = ill_find_by_name(name, isv6, q, mp, func, error);
4691 	rw_exit(&ill_g_lock);
4692 	if (ill != NULL || (error != NULL && *error == EINPROGRESS))
4693 		return (ill);
4694 
4695 	/*
4696 	 * Couldn't find it.  Does this happen to be a lookup for the
4697 	 * loopback device and are we allowed to allocate it?
4698 	 */
4699 	if (!isloopback || !do_alloc)
4700 		return (NULL);
4701 
4702 	rw_enter(&ill_g_lock, RW_WRITER);
4703 
4704 	ill = ill_find_by_name(name, isv6, q, mp, func, error);
4705 	if (ill != NULL || (error != NULL && *error == EINPROGRESS)) {
4706 		rw_exit(&ill_g_lock);
4707 		return (ill);
4708 	}
4709 
4710 	/* Create the loopback device on demand */
4711 	ill = (ill_t *)(mi_alloc(sizeof (ill_t) +
4712 	    sizeof (ipif_loopback_name), BPRI_MED));
4713 	if (ill == NULL)
4714 		goto done;
4715 
4716 	*ill = ill_null;
4717 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, NULL);
4718 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
4719 	if (ill->ill_phyint == NULL)
4720 		goto done;
4721 
4722 	if (isv6)
4723 		ill->ill_phyint->phyint_illv6 = ill;
4724 	else
4725 		ill->ill_phyint->phyint_illv4 = ill;
4726 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
4727 	ill->ill_max_frag = IP_LOOPBACK_MTU;
4728 	/* Add room for tcp+ip headers */
4729 	if (isv6) {
4730 		ill->ill_isv6 = B_TRUE;
4731 		ill->ill_max_frag += IPV6_HDR_LEN + 20;	/* for TCP */
4732 		if (!ill_allocate_mibs(ill))
4733 			goto done;
4734 	} else {
4735 		ill->ill_max_frag += IP_SIMPLE_HDR_LENGTH + 20;
4736 	}
4737 	ill->ill_max_mtu = ill->ill_max_frag;
4738 	/*
4739 	 * ipif_loopback_name can't be pointed at directly because its used
4740 	 * by both the ipv4 and ipv6 interfaces.  When the ill is removed
4741 	 * from the glist, ill_glist_delete() sets the first character of
4742 	 * ill_name to '\0'.
4743 	 */
4744 	ill->ill_name = (char *)ill + sizeof (*ill);
4745 	(void) strcpy(ill->ill_name, ipif_loopback_name);
4746 	ill->ill_name_length = sizeof (ipif_loopback_name);
4747 	/* Set ill_name_set for ill_phyint_reinit to work properly */
4748 
4749 	ill->ill_global_timer = INFINITY;
4750 	ill->ill_mcast_type = IGMP_V3_ROUTER;	/* == MLD_V2_ROUTER */
4751 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
4752 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
4753 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
4754 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
4755 
4756 	/* No resolver here. */
4757 	ill->ill_net_type = IRE_LOOPBACK;
4758 
4759 	/* Initialize the ipsq */
4760 	if (!ipsq_init(ill))
4761 		goto done;
4762 
4763 	ill->ill_phyint->phyint_ipsq->ipsq_writer = NULL;
4764 	ill->ill_phyint->phyint_ipsq->ipsq_reentry_cnt--;
4765 	ASSERT(ill->ill_phyint->phyint_ipsq->ipsq_reentry_cnt == 0);
4766 #ifdef ILL_DEBUG
4767 	ill->ill_phyint->phyint_ipsq->ipsq_depth = 0;
4768 #endif
4769 	ipif = ipif_allocate(ill, 0L, IRE_LOOPBACK, B_TRUE);
4770 	if (ipif == NULL)
4771 		goto done;
4772 
4773 	ill->ill_flags = ILLF_MULTICAST;
4774 
4775 	/* Set up default loopback address and mask. */
4776 	if (!isv6) {
4777 		ipaddr_t inaddr_loopback = htonl(INADDR_LOOPBACK);
4778 
4779 		IN6_IPADDR_TO_V4MAPPED(inaddr_loopback, &ipif->ipif_v6lcl_addr);
4780 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
4781 		V4MASK_TO_V6(htonl(IN_CLASSA_NET), ipif->ipif_v6net_mask);
4782 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
4783 		    ipif->ipif_v6subnet);
4784 		ill->ill_flags |= ILLF_IPV4;
4785 	} else {
4786 		ipif->ipif_v6lcl_addr = ipv6_loopback;
4787 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
4788 		ipif->ipif_v6net_mask = ipv6_all_ones;
4789 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
4790 		    ipif->ipif_v6subnet);
4791 		ill->ill_flags |= ILLF_IPV6;
4792 	}
4793 
4794 	/*
4795 	 * Chain us in at the end of the ill list. hold the ill
4796 	 * before we make it globally visible. 1 for the lookup.
4797 	 */
4798 	ill->ill_refcnt = 0;
4799 	ill_refhold(ill);
4800 
4801 	ill->ill_frag_count = 0;
4802 	ill->ill_frag_free_num_pkts = 0;
4803 	ill->ill_last_frag_clean_time = 0;
4804 
4805 	old_ipsq = ill->ill_phyint->phyint_ipsq;
4806 
4807 	if (ill_glist_insert(ill, "lo", isv6) != 0)
4808 		cmn_err(CE_PANIC, "cannot insert loopback interface");
4809 
4810 	/* Let SCTP know so that it can add this to its list */
4811 	sctp_update_ill(ill, SCTP_ILL_INSERT);
4812 
4813 	/* Let SCTP know about this IPIF, so that it can add it to its list */
4814 	sctp_update_ipif(ipif, SCTP_IPIF_INSERT);
4815 
4816 	/*
4817 	 * If the ipsq was changed in ill_phyint_reinit free the old ipsq.
4818 	 */
4819 	if (old_ipsq != ill->ill_phyint->phyint_ipsq) {
4820 		/* Loopback ills aren't in any IPMP group */
4821 		ASSERT(!(old_ipsq->ipsq_flags & IPSQ_GROUP));
4822 		ipsq_delete(old_ipsq);
4823 	}
4824 
4825 	/*
4826 	 * Delay this till the ipif is allocated as ipif_allocate
4827 	 * de-references ill_phyint for getting the ifindex. We
4828 	 * can't do this before ipif_allocate because ill_phyint_reinit
4829 	 * -> phyint_assign_ifindex expects ipif to be present.
4830 	 */
4831 	mutex_enter(&ill->ill_phyint->phyint_lock);
4832 	ill->ill_phyint->phyint_flags |= PHYI_LOOPBACK | PHYI_VIRTUAL;
4833 	mutex_exit(&ill->ill_phyint->phyint_lock);
4834 
4835 	if (loopback_ksp == NULL) {
4836 		/* Export loopback interface statistics */
4837 		loopback_ksp = kstat_create("lo", 0, ipif_loopback_name, "net",
4838 		    KSTAT_TYPE_NAMED, 2, 0);
4839 		if (loopback_ksp != NULL) {
4840 			loopback_ksp->ks_update = loopback_kstat_update;
4841 			kn = KSTAT_NAMED_PTR(loopback_ksp);
4842 			kstat_named_init(&kn[0], "ipackets", KSTAT_DATA_UINT32);
4843 			kstat_named_init(&kn[1], "opackets", KSTAT_DATA_UINT32);
4844 			kstat_install(loopback_ksp);
4845 		}
4846 	}
4847 
4848 	if (error != NULL)
4849 		*error = 0;
4850 	*did_alloc = B_TRUE;
4851 	rw_exit(&ill_g_lock);
4852 	return (ill);
4853 done:
4854 	if (ill != NULL) {
4855 		if (ill->ill_phyint != NULL) {
4856 			ipsq_t	*ipsq;
4857 
4858 			ipsq = ill->ill_phyint->phyint_ipsq;
4859 			if (ipsq != NULL)
4860 				kmem_free(ipsq, sizeof (ipsq_t));
4861 			mi_free(ill->ill_phyint);
4862 		}
4863 		ill_free_mib(ill);
4864 		mi_free(ill);
4865 	}
4866 	rw_exit(&ill_g_lock);
4867 	if (error != NULL)
4868 		*error = ENOMEM;
4869 	return (NULL);
4870 }
4871 
4872 /*
4873  * Return a pointer to the ill which matches the index and IP version type.
4874  */
4875 ill_t *
4876 ill_lookup_on_ifindex(uint_t index, boolean_t isv6, queue_t *q, mblk_t *mp,
4877     ipsq_func_t func, int *err)
4878 {
4879 	ill_t	*ill;
4880 	ipsq_t  *ipsq;
4881 	phyint_t *phyi;
4882 
4883 	ASSERT((q == NULL && mp == NULL && func == NULL && err == NULL) ||
4884 	    (q != NULL && mp != NULL && func != NULL && err != NULL));
4885 
4886 	if (err != NULL)
4887 		*err = 0;
4888 
4889 	/*
4890 	 * Indexes are stored in the phyint - a common structure
4891 	 * to both IPv4 and IPv6.
4892 	 */
4893 	rw_enter(&ill_g_lock, RW_READER);
4894 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_index,
4895 	    (void *) &index, NULL);
4896 	if (phyi != NULL) {
4897 		ill = isv6 ? phyi->phyint_illv6: phyi->phyint_illv4;
4898 		if (ill != NULL) {
4899 			/*
4900 			 * The block comment at the start of ipif_down
4901 			 * explains the use of the macros used below
4902 			 */
4903 			GRAB_CONN_LOCK(q);
4904 			mutex_enter(&ill->ill_lock);
4905 			if (ILL_CAN_LOOKUP(ill)) {
4906 				ill_refhold_locked(ill);
4907 				mutex_exit(&ill->ill_lock);
4908 				RELEASE_CONN_LOCK(q);
4909 				rw_exit(&ill_g_lock);
4910 				return (ill);
4911 			} else if (ILL_CAN_WAIT(ill, q)) {
4912 				ipsq = ill->ill_phyint->phyint_ipsq;
4913 				mutex_enter(&ipsq->ipsq_lock);
4914 				rw_exit(&ill_g_lock);
4915 				mutex_exit(&ill->ill_lock);
4916 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
4917 				mutex_exit(&ipsq->ipsq_lock);
4918 				RELEASE_CONN_LOCK(q);
4919 				*err = EINPROGRESS;
4920 				return (NULL);
4921 			}
4922 			RELEASE_CONN_LOCK(q);
4923 			mutex_exit(&ill->ill_lock);
4924 		}
4925 	}
4926 	rw_exit(&ill_g_lock);
4927 	if (err != NULL)
4928 		*err = ENXIO;
4929 	return (NULL);
4930 }
4931 
4932 /*
4933  * Obtain a reference to the ill. The ill_refcnt is a dynamic refcnt
4934  * that gives a running thread a reference to the ill. This reference must be
4935  * released by the thread when it is done accessing the ill and related
4936  * objects. ill_refcnt can not be used to account for static references
4937  * such as other structures pointing to an ill. Callers must generally
4938  * check whether an ill can be refheld by using ILL_CAN_LOOKUP macros
4939  * or be sure that the ill is not being deleted or changing state before
4940  * calling the refhold functions. A non-zero ill_refcnt ensures that the
4941  * ill won't change any of its critical state such as address, netmask etc.
4942  */
4943 void
4944 ill_refhold(ill_t *ill)
4945 {
4946 	mutex_enter(&ill->ill_lock);
4947 	ill->ill_refcnt++;
4948 	ILL_TRACE_REF(ill);
4949 	mutex_exit(&ill->ill_lock);
4950 }
4951 
4952 void
4953 ill_refhold_locked(ill_t *ill)
4954 {
4955 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4956 	ill->ill_refcnt++;
4957 	ILL_TRACE_REF(ill);
4958 }
4959 
4960 int
4961 ill_check_and_refhold(ill_t *ill)
4962 {
4963 	mutex_enter(&ill->ill_lock);
4964 	if (ILL_CAN_LOOKUP(ill)) {
4965 		ill_refhold_locked(ill);
4966 		mutex_exit(&ill->ill_lock);
4967 		return (0);
4968 	}
4969 	mutex_exit(&ill->ill_lock);
4970 	return (ILL_LOOKUP_FAILED);
4971 }
4972 
4973 /*
4974  * Must not be called while holding any locks. Otherwise if this is
4975  * the last reference to be released, there is a chance of recursive mutex
4976  * panic due to ill_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
4977  * to restart an ioctl.
4978  */
4979 void
4980 ill_refrele(ill_t *ill)
4981 {
4982 	mutex_enter(&ill->ill_lock);
4983 	ASSERT(ill->ill_refcnt != 0);
4984 	ill->ill_refcnt--;
4985 	ILL_UNTRACE_REF(ill);
4986 	if (ill->ill_refcnt != 0) {
4987 		/* Every ire pointing to the ill adds 1 to ill_refcnt */
4988 		mutex_exit(&ill->ill_lock);
4989 		return;
4990 	}
4991 
4992 	/* Drops the ill_lock */
4993 	ipif_ill_refrele_tail(ill);
4994 }
4995 
4996 /*
4997  * Obtain a weak reference count on the ill. This reference ensures the
4998  * ill won't be freed, but the ill may change any of its critical state
4999  * such as netmask, address etc. Returns an error if the ill has started
5000  * closing.
5001  */
5002 boolean_t
5003 ill_waiter_inc(ill_t *ill)
5004 {
5005 	mutex_enter(&ill->ill_lock);
5006 	if (ill->ill_state_flags & ILL_CONDEMNED) {
5007 		mutex_exit(&ill->ill_lock);
5008 		return (B_FALSE);
5009 	}
5010 	ill->ill_waiters++;
5011 	mutex_exit(&ill->ill_lock);
5012 	return (B_TRUE);
5013 }
5014 
5015 void
5016 ill_waiter_dcr(ill_t *ill)
5017 {
5018 	mutex_enter(&ill->ill_lock);
5019 	ill->ill_waiters--;
5020 	if (ill->ill_waiters == 0)
5021 		cv_broadcast(&ill->ill_cv);
5022 	mutex_exit(&ill->ill_lock);
5023 }
5024 
5025 /*
5026  * Named Dispatch routine to produce a formatted report on all ILLs.
5027  * This report is accessed by using the ndd utility to "get" ND variable
5028  * "ip_ill_status".
5029  */
5030 /* ARGSUSED */
5031 int
5032 ip_ill_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
5033 {
5034 	ill_t		*ill;
5035 	ill_walk_context_t ctx;
5036 
5037 	(void) mi_mpprintf(mp,
5038 	    "ILL      " MI_COL_HDRPAD_STR
5039 	/*   01234567[89ABCDEF] */
5040 	    "rq       " MI_COL_HDRPAD_STR
5041 	/*   01234567[89ABCDEF] */
5042 	    "wq       " MI_COL_HDRPAD_STR
5043 	/*   01234567[89ABCDEF] */
5044 	    "upcnt mxfrg err name");
5045 	/*   12345 12345 123 xxxxxxxx  */
5046 
5047 	rw_enter(&ill_g_lock, RW_READER);
5048 	ill = ILL_START_WALK_ALL(&ctx);
5049 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5050 		(void) mi_mpprintf(mp,
5051 		    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR
5052 		    "%05u %05u %03d %s",
5053 		    (void *)ill, (void *)ill->ill_rq, (void *)ill->ill_wq,
5054 		    ill->ill_ipif_up_count,
5055 		    ill->ill_max_frag, ill->ill_error, ill->ill_name);
5056 	}
5057 	rw_exit(&ill_g_lock);
5058 
5059 	return (0);
5060 }
5061 
5062 /*
5063  * Named Dispatch routine to produce a formatted report on all IPIFs.
5064  * This report is accessed by using the ndd utility to "get" ND variable
5065  * "ip_ipif_status".
5066  */
5067 /* ARGSUSED */
5068 int
5069 ip_ipif_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
5070 {
5071 	char	buf1[INET6_ADDRSTRLEN];
5072 	char	buf2[INET6_ADDRSTRLEN];
5073 	char	buf3[INET6_ADDRSTRLEN];
5074 	char	buf4[INET6_ADDRSTRLEN];
5075 	char	buf5[INET6_ADDRSTRLEN];
5076 	char	buf6[INET6_ADDRSTRLEN];
5077 	char	buf[LIFNAMSIZ];
5078 	ill_t	*ill;
5079 	ipif_t	*ipif;
5080 	nv_t	*nvp;
5081 	uint64_t flags;
5082 	zoneid_t zoneid;
5083 	ill_walk_context_t ctx;
5084 
5085 	(void) mi_mpprintf(mp,
5086 	    "IPIF metric mtu in/out/forward name zone flags...\n"
5087 	    "\tlocal address\n"
5088 	    "\tsrc address\n"
5089 	    "\tsubnet\n"
5090 	    "\tmask\n"
5091 	    "\tbroadcast\n"
5092 	    "\tp-p-dst");
5093 
5094 	ASSERT(q->q_next == NULL);
5095 	zoneid = Q_TO_CONN(q)->conn_zoneid;	/* IP is a driver */
5096 
5097 	rw_enter(&ill_g_lock, RW_READER);
5098 	ill = ILL_START_WALK_ALL(&ctx);
5099 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5100 		for (ipif = ill->ill_ipif; ipif; ipif = ipif->ipif_next) {
5101 			if (zoneid != GLOBAL_ZONEID &&
5102 			    zoneid != ipif->ipif_zoneid)
5103 				continue;
5104 			(void) mi_mpprintf(mp,
5105 			    MI_COL_PTRFMT_STR
5106 			    "%04u %05u %u/%u/%u %s %d",
5107 			    (void *)ipif,
5108 			    ipif->ipif_metric, ipif->ipif_mtu,
5109 			    ipif->ipif_ib_pkt_count,
5110 			    ipif->ipif_ob_pkt_count,
5111 			    ipif->ipif_fo_pkt_count,
5112 			    ipif_get_name(ipif, buf, sizeof (buf)),
5113 			    ipif->ipif_zoneid);
5114 
5115 		flags = ipif->ipif_flags | ipif->ipif_ill->ill_flags |
5116 		    ipif->ipif_ill->ill_phyint->phyint_flags;
5117 
5118 		/* Tack on text strings for any flags. */
5119 		nvp = ipif_nv_tbl;
5120 		for (; nvp < A_END(ipif_nv_tbl); nvp++) {
5121 			if (nvp->nv_value & flags)
5122 				(void) mi_mpprintf_nr(mp, " %s",
5123 				    nvp->nv_name);
5124 		}
5125 		(void) mi_mpprintf(mp,
5126 		    "\t%s\n\t%s\n\t%s\n\t%s\n\t%s\n\t%s",
5127 		    inet_ntop(AF_INET6,
5128 			&ipif->ipif_v6lcl_addr, buf1, sizeof (buf1)),
5129 		    inet_ntop(AF_INET6,
5130 			&ipif->ipif_v6src_addr, buf2, sizeof (buf2)),
5131 		    inet_ntop(AF_INET6,
5132 			&ipif->ipif_v6subnet, buf3, sizeof (buf3)),
5133 		    inet_ntop(AF_INET6,
5134 			&ipif->ipif_v6net_mask, buf4, sizeof (buf4)),
5135 		    inet_ntop(AF_INET6,
5136 			&ipif->ipif_v6brd_addr, buf5, sizeof (buf5)),
5137 		    inet_ntop(AF_INET6,
5138 			&ipif->ipif_v6pp_dst_addr,
5139 			buf6, sizeof (buf6)));
5140 		}
5141 	}
5142 	rw_exit(&ill_g_lock);
5143 	return (0);
5144 }
5145 
5146 /*
5147  * ip_ll_subnet_defaults is called when we get the DL_INFO_ACK back from the
5148  * driver.  We construct best guess defaults for lower level information that
5149  * we need.  If an interface is brought up without injection of any overriding
5150  * information from outside, we have to be ready to go with these defaults.
5151  * When we get the first DL_INFO_ACK (from ip_open() sending a DL_INFO_REQ)
5152  * we primarely want the dl_provider_style.
5153  * The subsequent DL_INFO_ACK is received after doing a DL_ATTACH and DL_BIND
5154  * at which point we assume the other part of the information is valid.
5155  */
5156 void
5157 ip_ll_subnet_defaults(ill_t *ill, mblk_t *mp)
5158 {
5159 	uchar_t		*brdcst_addr;
5160 	uint_t		brdcst_addr_length, phys_addr_length;
5161 	t_scalar_t	sap_length;
5162 	dl_info_ack_t	*dlia;
5163 	ip_m_t		*ipm;
5164 	dl_qos_cl_sel1_t *sel1;
5165 
5166 	ASSERT(IAM_WRITER_ILL(ill));
5167 
5168 	/*
5169 	 * Till the ill is fully up ILL_CHANGING will be set and
5170 	 * the ill is not globally visible. So no need for a lock.
5171 	 */
5172 	dlia = (dl_info_ack_t *)mp->b_rptr;
5173 	ill->ill_mactype = dlia->dl_mac_type;
5174 
5175 	ipm = ip_m_lookup(dlia->dl_mac_type);
5176 	if (ipm == NULL) {
5177 		ipm = ip_m_lookup(DL_OTHER);
5178 		ASSERT(ipm != NULL);
5179 	}
5180 	ill->ill_media = ipm;
5181 
5182 	/*
5183 	 * When the new DLPI stuff is ready we'll pull lengths
5184 	 * from dlia.
5185 	 */
5186 	if (dlia->dl_version == DL_VERSION_2) {
5187 		brdcst_addr_length = dlia->dl_brdcst_addr_length;
5188 		brdcst_addr = mi_offset_param(mp, dlia->dl_brdcst_addr_offset,
5189 		    brdcst_addr_length);
5190 		if (brdcst_addr == NULL) {
5191 			brdcst_addr_length = 0;
5192 		}
5193 		sap_length = dlia->dl_sap_length;
5194 		phys_addr_length = dlia->dl_addr_length - ABS(sap_length);
5195 		ip1dbg(("ip: bcast_len %d, sap_len %d, phys_len %d\n",
5196 		    brdcst_addr_length, sap_length, phys_addr_length));
5197 	} else {
5198 		brdcst_addr_length = 6;
5199 		brdcst_addr = ip_six_byte_all_ones;
5200 		sap_length = -2;
5201 		phys_addr_length = brdcst_addr_length;
5202 	}
5203 
5204 	ill->ill_bcast_addr_length = brdcst_addr_length;
5205 	ill->ill_phys_addr_length = phys_addr_length;
5206 	ill->ill_sap_length = sap_length;
5207 	ill->ill_max_frag = dlia->dl_max_sdu;
5208 	ill->ill_max_mtu = ill->ill_max_frag;
5209 
5210 	ill->ill_type = ipm->ip_m_type;
5211 
5212 	if (!ill->ill_dlpi_style_set) {
5213 		if (dlia->dl_provider_style == DL_STYLE2)
5214 			ill->ill_needs_attach = 1;
5215 
5216 		/*
5217 		 * Allocate the first ipif on this ill. We don't delay it
5218 		 * further as ioctl handling assumes atleast one ipif to
5219 		 * be present.
5220 		 *
5221 		 * At this point we don't know whether the ill is v4 or v6.
5222 		 * We will know this whan the SIOCSLIFNAME happens and
5223 		 * the correct value for ill_isv6 will be assigned in
5224 		 * ipif_set_values(). We need to hold the ill lock and
5225 		 * clear the ILL_LL_SUBNET_PENDING flag and atomically do
5226 		 * the wakeup.
5227 		 */
5228 		(void) ipif_allocate(ill, 0, IRE_LOCAL,
5229 		    dlia->dl_provider_style == DL_STYLE2 ? B_FALSE : B_TRUE);
5230 		mutex_enter(&ill->ill_lock);
5231 		ASSERT(ill->ill_dlpi_style_set == 0);
5232 		ill->ill_dlpi_style_set = 1;
5233 		ill->ill_state_flags &= ~ILL_LL_SUBNET_PENDING;
5234 		cv_broadcast(&ill->ill_cv);
5235 		mutex_exit(&ill->ill_lock);
5236 		freemsg(mp);
5237 		return;
5238 	}
5239 	ASSERT(ill->ill_ipif != NULL);
5240 	/*
5241 	 * We know whether it is IPv4 or IPv6 now, as this is the
5242 	 * second DL_INFO_ACK we are recieving in response to the
5243 	 * DL_INFO_REQ sent in ipif_set_values.
5244 	 */
5245 	if (ill->ill_isv6)
5246 		ill->ill_sap = IP6_DL_SAP;
5247 	else
5248 		ill->ill_sap = IP_DL_SAP;
5249 	/*
5250 	 * Set ipif_mtu which is used to set the IRE's
5251 	 * ire_max_frag value. The driver could have sent
5252 	 * a different mtu from what it sent last time. No
5253 	 * need to call ipif_mtu_change because IREs have
5254 	 * not yet been created.
5255 	 */
5256 	ill->ill_ipif->ipif_mtu = ill->ill_max_mtu;
5257 	/*
5258 	 * Clear all the flags that were set based on ill_bcast_addr_length
5259 	 * and ill_phys_addr_length (in ipif_set_values) as these could have
5260 	 * changed now and we need to re-evaluate.
5261 	 */
5262 	ill->ill_flags &= ~(ILLF_MULTICAST | ILLF_NONUD | ILLF_NOARP);
5263 	ill->ill_ipif->ipif_flags &= ~(IPIF_BROADCAST | IPIF_POINTOPOINT);
5264 
5265 	/*
5266 	 * Free ill_resolver_mp and ill_bcast_mp as things could have
5267 	 * changed now.
5268 	 */
5269 	if (ill->ill_bcast_addr_length == 0) {
5270 		if (ill->ill_resolver_mp != NULL)
5271 			freemsg(ill->ill_resolver_mp);
5272 		if (ill->ill_bcast_mp != NULL)
5273 			freemsg(ill->ill_bcast_mp);
5274 		if (ill->ill_flags & ILLF_XRESOLV)
5275 			ill->ill_net_type = IRE_IF_RESOLVER;
5276 		else
5277 			ill->ill_net_type = IRE_IF_NORESOLVER;
5278 		ill->ill_resolver_mp = ill_dlur_gen(NULL,
5279 		    ill->ill_phys_addr_length,
5280 		    ill->ill_sap,
5281 		    ill->ill_sap_length);
5282 		ill->ill_bcast_mp = copymsg(ill->ill_resolver_mp);
5283 
5284 		if (ill->ill_isv6)
5285 			/*
5286 			 * Note: xresolv interfaces will eventually need NOARP
5287 			 * set here as well, but that will require those
5288 			 * external resolvers to have some knowledge of
5289 			 * that flag and act appropriately. Not to be changed
5290 			 * at present.
5291 			 */
5292 			ill->ill_flags |= ILLF_NONUD;
5293 		else
5294 			ill->ill_flags |= ILLF_NOARP;
5295 
5296 		if (ill->ill_phys_addr_length == 0) {
5297 			if (ill->ill_media->ip_m_mac_type == SUNW_DL_VNI) {
5298 				ill->ill_ipif->ipif_flags |= IPIF_NOXMIT;
5299 				ill->ill_phyint->phyint_flags |= PHYI_VIRTUAL;
5300 			} else {
5301 				/* pt-pt supports multicast. */
5302 				ill->ill_flags |= ILLF_MULTICAST;
5303 				ill->ill_ipif->ipif_flags |= IPIF_POINTOPOINT;
5304 			}
5305 		}
5306 	} else {
5307 		ill->ill_net_type = IRE_IF_RESOLVER;
5308 		if (ill->ill_bcast_mp != NULL)
5309 			freemsg(ill->ill_bcast_mp);
5310 		ill->ill_bcast_mp = ill_dlur_gen(brdcst_addr,
5311 		    ill->ill_bcast_addr_length, ill->ill_sap,
5312 		    ill->ill_sap_length);
5313 		/*
5314 		 * Later detect lack of DLPI driver multicast
5315 		 * capability by catching DL_ENABMULTI errors in
5316 		 * ip_rput_dlpi.
5317 		 */
5318 		ill->ill_flags |= ILLF_MULTICAST;
5319 		if (!ill->ill_isv6)
5320 			ill->ill_ipif->ipif_flags |= IPIF_BROADCAST;
5321 	}
5322 	/* By default an interface does not support any CoS marking */
5323 	ill->ill_flags &= ~ILLF_COS_ENABLED;
5324 
5325 	/*
5326 	 * If we get QoS information in DL_INFO_ACK, the device supports
5327 	 * some form of CoS marking, set ILLF_COS_ENABLED.
5328 	 */
5329 	sel1 = (dl_qos_cl_sel1_t *)mi_offset_param(mp, dlia->dl_qos_offset,
5330 	    dlia->dl_qos_length);
5331 	if ((sel1 != NULL) && (sel1->dl_qos_type == DL_QOS_CL_SEL1)) {
5332 		ill->ill_flags |= ILLF_COS_ENABLED;
5333 	}
5334 
5335 	/* Clear any previous error indication. */
5336 	ill->ill_error = 0;
5337 	freemsg(mp);
5338 }
5339 
5340 /*
5341  * Perform various checks to verify that an address would make sense as a
5342  * local, remote, or subnet interface address.
5343  */
5344 static boolean_t
5345 ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask)
5346 {
5347 	ipaddr_t	net_mask;
5348 
5349 	/*
5350 	 * Don't allow all zeroes, all ones or experimental address, but allow
5351 	 * all ones netmask.
5352 	 */
5353 	if ((net_mask = ip_net_mask(addr)) == 0)
5354 		return (B_FALSE);
5355 	/* A given netmask overrides the "guess" netmask */
5356 	if (subnet_mask != 0)
5357 		net_mask = subnet_mask;
5358 	if ((net_mask != ~(ipaddr_t)0) && ((addr == (addr & net_mask)) ||
5359 	    (addr == (addr | ~net_mask)))) {
5360 		return (B_FALSE);
5361 	}
5362 	if (CLASSD(addr))
5363 		return (B_FALSE);
5364 
5365 	return (B_TRUE);
5366 }
5367 
5368 /*
5369  * ipif_lookup_group
5370  * Returns held ipif
5371  */
5372 ipif_t *
5373 ipif_lookup_group(ipaddr_t group, zoneid_t zoneid)
5374 {
5375 	ire_t	*ire;
5376 	ipif_t	*ipif;
5377 
5378 	ire = ire_lookup_multi(group, zoneid);
5379 	if (ire == NULL)
5380 		return (NULL);
5381 	ipif = ire->ire_ipif;
5382 	ipif_refhold(ipif);
5383 	ire_refrele(ire);
5384 	return (ipif);
5385 }
5386 
5387 /*
5388  * Look for an ipif with the specified interface address and destination.
5389  * The destination address is used only for matching point-to-point interfaces.
5390  */
5391 ipif_t *
5392 ipif_lookup_interface(ipaddr_t if_addr, ipaddr_t dst, queue_t *q, mblk_t *mp,
5393     ipsq_func_t func, int *error)
5394 {
5395 	ipif_t	*ipif;
5396 	ill_t	*ill;
5397 	ill_walk_context_t ctx;
5398 	ipsq_t	*ipsq;
5399 
5400 	if (error != NULL)
5401 		*error = 0;
5402 
5403 	/*
5404 	 * First match all the point-to-point interfaces
5405 	 * before looking at non-point-to-point interfaces.
5406 	 * This is done to avoid returning non-point-to-point
5407 	 * ipif instead of unnumbered point-to-point ipif.
5408 	 */
5409 	rw_enter(&ill_g_lock, RW_READER);
5410 	ill = ILL_START_WALK_V4(&ctx);
5411 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5412 		GRAB_CONN_LOCK(q);
5413 		mutex_enter(&ill->ill_lock);
5414 		for (ipif = ill->ill_ipif; ipif != NULL;
5415 		    ipif = ipif->ipif_next) {
5416 			/* Allow the ipif to be down */
5417 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
5418 			    (ipif->ipif_lcl_addr == if_addr) &&
5419 			    (ipif->ipif_pp_dst_addr == dst)) {
5420 				/*
5421 				 * The block comment at the start of ipif_down
5422 				 * explains the use of the macros used below
5423 				 */
5424 				if (IPIF_CAN_LOOKUP(ipif)) {
5425 					ipif_refhold_locked(ipif);
5426 					mutex_exit(&ill->ill_lock);
5427 					RELEASE_CONN_LOCK(q);
5428 					rw_exit(&ill_g_lock);
5429 					return (ipif);
5430 				} else if (IPIF_CAN_WAIT(ipif, q)) {
5431 					ipsq = ill->ill_phyint->phyint_ipsq;
5432 					mutex_enter(&ipsq->ipsq_lock);
5433 					mutex_exit(&ill->ill_lock);
5434 					rw_exit(&ill_g_lock);
5435 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
5436 						ill);
5437 					mutex_exit(&ipsq->ipsq_lock);
5438 					RELEASE_CONN_LOCK(q);
5439 					*error = EINPROGRESS;
5440 					return (NULL);
5441 				}
5442 			}
5443 		}
5444 		mutex_exit(&ill->ill_lock);
5445 		RELEASE_CONN_LOCK(q);
5446 	}
5447 	rw_exit(&ill_g_lock);
5448 
5449 	/* lookup the ipif based on interface address */
5450 	ipif = ipif_lookup_addr(if_addr, NULL, ALL_ZONES, q, mp, func, error);
5451 	ASSERT(ipif == NULL || !ipif->ipif_isv6);
5452 	return (ipif);
5453 }
5454 
5455 /*
5456  * Look for an ipif with the specified address. For point-point links
5457  * we look for matches on either the destination address and the local
5458  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
5459  * is set.
5460  * Matches on a specific ill if match_ill is set.
5461  */
5462 ipif_t *
5463 ipif_lookup_addr(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid, queue_t *q,
5464     mblk_t *mp, ipsq_func_t func, int *error)
5465 {
5466 	ipif_t  *ipif;
5467 	ill_t   *ill;
5468 	boolean_t ptp = B_FALSE;
5469 	ipsq_t	*ipsq;
5470 	ill_walk_context_t	ctx;
5471 
5472 	if (error != NULL)
5473 		*error = 0;
5474 
5475 	rw_enter(&ill_g_lock, RW_READER);
5476 	/*
5477 	 * Repeat twice, first based on local addresses and
5478 	 * next time for pointopoint.
5479 	 */
5480 repeat:
5481 	ill = ILL_START_WALK_V4(&ctx);
5482 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5483 		if (match_ill != NULL && ill != match_ill) {
5484 			continue;
5485 		}
5486 		GRAB_CONN_LOCK(q);
5487 		mutex_enter(&ill->ill_lock);
5488 		for (ipif = ill->ill_ipif; ipif != NULL;
5489 		    ipif = ipif->ipif_next) {
5490 			if (zoneid != ALL_ZONES && zoneid != ipif->ipif_zoneid)
5491 				continue;
5492 			/* Allow the ipif to be down */
5493 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
5494 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
5495 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
5496 			    (ipif->ipif_pp_dst_addr == addr))) {
5497 				/*
5498 				 * The block comment at the start of ipif_down
5499 				 * explains the use of the macros used below
5500 				 */
5501 				if (IPIF_CAN_LOOKUP(ipif)) {
5502 					ipif_refhold_locked(ipif);
5503 					mutex_exit(&ill->ill_lock);
5504 					RELEASE_CONN_LOCK(q);
5505 					rw_exit(&ill_g_lock);
5506 					return (ipif);
5507 				} else if (IPIF_CAN_WAIT(ipif, q)) {
5508 					ipsq = ill->ill_phyint->phyint_ipsq;
5509 					mutex_enter(&ipsq->ipsq_lock);
5510 					mutex_exit(&ill->ill_lock);
5511 					rw_exit(&ill_g_lock);
5512 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
5513 						ill);
5514 					mutex_exit(&ipsq->ipsq_lock);
5515 					RELEASE_CONN_LOCK(q);
5516 					*error = EINPROGRESS;
5517 					return (NULL);
5518 				}
5519 			}
5520 		}
5521 		mutex_exit(&ill->ill_lock);
5522 		RELEASE_CONN_LOCK(q);
5523 	}
5524 
5525 	/* Now try the ptp case */
5526 	if (ptp) {
5527 		rw_exit(&ill_g_lock);
5528 		if (error != NULL)
5529 			*error = ENXIO;
5530 		return (NULL);
5531 	}
5532 	ptp = B_TRUE;
5533 	goto repeat;
5534 }
5535 
5536 /*
5537  * Look for an ipif that matches the specified remote address i.e. the
5538  * ipif that would receive the specified packet.
5539  * First look for directly connected interfaces and then do a recursive
5540  * IRE lookup and pick the first ipif corresponding to the source address in the
5541  * ire.
5542  * Returns: held ipif
5543  */
5544 ipif_t *
5545 ipif_lookup_remote(ill_t *ill, ipaddr_t addr, zoneid_t zoneid)
5546 {
5547 	ipif_t	*ipif;
5548 	ire_t	*ire;
5549 
5550 	ASSERT(!ill->ill_isv6);
5551 
5552 	/*
5553 	 * Someone could be changing this ipif currently or change it
5554 	 * after we return this. Thus  a few packets could use the old
5555 	 * old values. However structure updates/creates (ire, ilg, ilm etc)
5556 	 * will atomically be updated or cleaned up with the new value
5557 	 * Thus we don't need a lock to check the flags or other attrs below.
5558 	 */
5559 	mutex_enter(&ill->ill_lock);
5560 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
5561 		if (!IPIF_CAN_LOOKUP(ipif))
5562 			continue;
5563 		if (zoneid != ALL_ZONES && zoneid != ipif->ipif_zoneid)
5564 			continue;
5565 		/* Allow the ipif to be down */
5566 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
5567 			if ((ipif->ipif_pp_dst_addr == addr) ||
5568 			    (!(ipif->ipif_flags & IPIF_UNNUMBERED) &&
5569 			    ipif->ipif_lcl_addr == addr)) {
5570 				ipif_refhold_locked(ipif);
5571 				mutex_exit(&ill->ill_lock);
5572 				return (ipif);
5573 			}
5574 		} else if (ipif->ipif_subnet == (addr & ipif->ipif_net_mask)) {
5575 			ipif_refhold_locked(ipif);
5576 			mutex_exit(&ill->ill_lock);
5577 			return (ipif);
5578 		}
5579 	}
5580 	mutex_exit(&ill->ill_lock);
5581 	ire = ire_route_lookup(addr, 0, 0, 0, NULL, NULL, zoneid,
5582 	    MATCH_IRE_RECURSIVE);
5583 	if (ire != NULL) {
5584 		/*
5585 		 * The callers of this function wants to know the
5586 		 * interface on which they have to send the replies
5587 		 * back. For IRE_CACHES that have ire_stq and ire_ipif
5588 		 * derived from different ills, we really don't care
5589 		 * what we return here.
5590 		 */
5591 		ipif = ire->ire_ipif;
5592 		if (ipif != NULL) {
5593 			ipif_refhold(ipif);
5594 			ire_refrele(ire);
5595 			return (ipif);
5596 		}
5597 		ire_refrele(ire);
5598 	}
5599 	/* Pick the first interface */
5600 	ipif = ipif_get_next_ipif(NULL, ill);
5601 	return (ipif);
5602 }
5603 
5604 /*
5605  * This func does not prevent refcnt from increasing. But if
5606  * the caller has taken steps to that effect, then this func
5607  * can be used to determine whether the ill has become quiescent
5608  */
5609 boolean_t
5610 ill_is_quiescent(ill_t *ill)
5611 {
5612 	ipif_t	*ipif;
5613 
5614 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5615 
5616 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
5617 		if (ipif->ipif_refcnt != 0 || ipif->ipif_ire_cnt != 0)
5618 			return (B_FALSE);
5619 	}
5620 	if (ill->ill_ire_cnt != 0 || ill->ill_refcnt != 0 ||
5621 	    ill->ill_nce_cnt != 0 || ill->ill_srcif_refcnt != 0 ||
5622 	    ill->ill_mrtun_refcnt != 0)
5623 		return (B_FALSE);
5624 	return (B_TRUE);
5625 }
5626 
5627 /*
5628  * This func does not prevent refcnt from increasing. But if
5629  * the caller has taken steps to that effect, then this func
5630  * can be used to determine whether the ipif has become quiescent
5631  */
5632 static boolean_t
5633 ipif_is_quiescent(ipif_t *ipif)
5634 {
5635 	ill_t *ill;
5636 
5637 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5638 
5639 	if (ipif->ipif_refcnt != 0 || ipif->ipif_ire_cnt != 0)
5640 		return (B_FALSE);
5641 
5642 	ill = ipif->ipif_ill;
5643 	if (ill->ill_ipif_up_count != 0 || ill->ill_logical_down)
5644 		return (B_TRUE);
5645 
5646 	/* This is the last ipif going down or being deleted on this ill */
5647 	if (ill->ill_ire_cnt != 0 || ill->ill_refcnt != 0)
5648 		return (B_FALSE);
5649 
5650 	return (B_TRUE);
5651 }
5652 
5653 /*
5654  * This func does not prevent refcnt from increasing. But if
5655  * the caller has taken steps to that effect, then this func
5656  * can be used to determine whether the ipifs marked with IPIF_MOVING
5657  * have become quiescent and can be moved in a failover/failback.
5658  */
5659 static ipif_t *
5660 ill_quiescent_to_move(ill_t *ill)
5661 {
5662 	ipif_t  *ipif;
5663 
5664 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5665 
5666 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
5667 		if (ipif->ipif_state_flags & IPIF_MOVING) {
5668 			if (ipif->ipif_refcnt != 0 || ipif->ipif_ire_cnt != 0) {
5669 				return (ipif);
5670 			}
5671 		}
5672 	}
5673 	return (NULL);
5674 }
5675 
5676 /*
5677  * The ipif/ill/ire has been refreled. Do the tail processing.
5678  * Determine if the ipif or ill in question has become quiescent and if so
5679  * wakeup close and/or restart any queued pending ioctl that is waiting
5680  * for the ipif_down (or ill_down)
5681  */
5682 void
5683 ipif_ill_refrele_tail(ill_t *ill)
5684 {
5685 	mblk_t	*mp;
5686 	conn_t	*connp;
5687 	ipsq_t	*ipsq;
5688 	ipif_t	*ipif;
5689 
5690 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5691 
5692 	if ((ill->ill_state_flags & ILL_CONDEMNED) &&
5693 	    ill_is_quiescent(ill)) {
5694 		/* ill_close may be waiting */
5695 		cv_broadcast(&ill->ill_cv);
5696 	}
5697 
5698 	/* ipsq can't change because ill_lock  is held */
5699 	ipsq = ill->ill_phyint->phyint_ipsq;
5700 	if (ipsq->ipsq_waitfor == 0) {
5701 		/* Not waiting for anything, just return. */
5702 		mutex_exit(&ill->ill_lock);
5703 		return;
5704 	}
5705 	ASSERT(ipsq->ipsq_pending_mp != NULL &&
5706 		ipsq->ipsq_pending_ipif != NULL);
5707 	/*
5708 	 * ipif->ipif_refcnt must go down to zero for restarting REMOVEIF.
5709 	 * Last ipif going down needs to down the ill, so ill_ire_cnt must
5710 	 * be zero for restarting an ioctl that ends up downing the ill.
5711 	 */
5712 	ipif = ipsq->ipsq_pending_ipif;
5713 	if (ipif->ipif_ill != ill) {
5714 		/* The ioctl is pending on some other ill. */
5715 		mutex_exit(&ill->ill_lock);
5716 		return;
5717 	}
5718 
5719 	switch (ipsq->ipsq_waitfor) {
5720 	case IPIF_DOWN:
5721 	case IPIF_FREE:
5722 		if (!ipif_is_quiescent(ipif)) {
5723 			mutex_exit(&ill->ill_lock);
5724 			return;
5725 		}
5726 		break;
5727 
5728 	case ILL_DOWN:
5729 	case ILL_FREE:
5730 		/*
5731 		 * case ILL_FREE arises only for loopback. otherwise ill_delete
5732 		 * waits synchronously in ip_close, and no message is queued in
5733 		 * ipsq_pending_mp at all in this case
5734 		 */
5735 		if (!ill_is_quiescent(ill)) {
5736 			mutex_exit(&ill->ill_lock);
5737 			return;
5738 		}
5739 
5740 		break;
5741 
5742 	case ILL_MOVE_OK:
5743 		if (ill_quiescent_to_move(ill) != NULL) {
5744 			mutex_exit(&ill->ill_lock);
5745 			return;
5746 		}
5747 
5748 		break;
5749 	default:
5750 		cmn_err(CE_PANIC, "ipsq: %p unknown ipsq_waitfor %d\n",
5751 		    (void *)ipsq, ipsq->ipsq_waitfor);
5752 	}
5753 
5754 	/*
5755 	 * Incr refcnt for the qwriter_ip call below which
5756 	 * does a refrele
5757 	 */
5758 	ill_refhold_locked(ill);
5759 	mutex_exit(&ill->ill_lock);
5760 
5761 	mp = ipsq_pending_mp_get(ipsq, &connp);
5762 	ASSERT(mp != NULL);
5763 
5764 	switch (mp->b_datap->db_type) {
5765 	case M_ERROR:
5766 	case M_HANGUP:
5767 		(void) qwriter_ip(NULL, ill, ill->ill_rq, mp,
5768 		    ipif_all_down_tail, CUR_OP, B_TRUE);
5769 		return;
5770 
5771 	case M_IOCTL:
5772 	case M_IOCDATA:
5773 		(void) qwriter_ip(NULL, ill,
5774 		    (connp != NULL ? CONNP_TO_WQ(connp) : ill->ill_wq), mp,
5775 		    ip_reprocess_ioctl, CUR_OP, B_TRUE);
5776 		return;
5777 
5778 	default:
5779 		cmn_err(CE_PANIC, "ipif_ill_refrele_tail mp %p "
5780 		    "db_type %d\n", (void *)mp, mp->b_datap->db_type);
5781 	}
5782 }
5783 
5784 #ifdef ILL_DEBUG
5785 /* Reuse trace buffer from beginning (if reached the end) and record trace */
5786 void
5787 th_trace_rrecord(th_trace_t *th_trace)
5788 {
5789 	tr_buf_t *tr_buf;
5790 	uint_t lastref;
5791 
5792 	lastref = th_trace->th_trace_lastref;
5793 	lastref++;
5794 	if (lastref == TR_BUF_MAX)
5795 		lastref = 0;
5796 	th_trace->th_trace_lastref = lastref;
5797 	tr_buf = &th_trace->th_trbuf[lastref];
5798 	tr_buf->tr_depth = getpcstack(tr_buf->tr_stack, IP_STACK_DEPTH);
5799 }
5800 
5801 th_trace_t *
5802 th_trace_ipif_lookup(ipif_t *ipif)
5803 {
5804 	int bucket_id;
5805 	th_trace_t *th_trace;
5806 
5807 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5808 
5809 	bucket_id = IP_TR_HASH(curthread);
5810 	ASSERT(bucket_id < IP_TR_HASH_MAX);
5811 
5812 	for (th_trace = ipif->ipif_trace[bucket_id]; th_trace != NULL;
5813 	    th_trace = th_trace->th_next) {
5814 		if (th_trace->th_id == curthread)
5815 			return (th_trace);
5816 	}
5817 	return (NULL);
5818 }
5819 
5820 void
5821 ipif_trace_ref(ipif_t *ipif)
5822 {
5823 	int bucket_id;
5824 	th_trace_t *th_trace;
5825 
5826 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5827 
5828 	if (ipif->ipif_trace_disable)
5829 		return;
5830 
5831 	/*
5832 	 * Attempt to locate the trace buffer for the curthread.
5833 	 * If it does not exist, then allocate a new trace buffer
5834 	 * and link it in list of trace bufs for this ipif, at the head
5835 	 */
5836 	th_trace = th_trace_ipif_lookup(ipif);
5837 	if (th_trace == NULL) {
5838 		bucket_id = IP_TR_HASH(curthread);
5839 		th_trace = (th_trace_t *)kmem_zalloc(sizeof (th_trace_t),
5840 		    KM_NOSLEEP);
5841 		if (th_trace == NULL) {
5842 			ipif->ipif_trace_disable = B_TRUE;
5843 			ipif_trace_cleanup(ipif);
5844 			return;
5845 		}
5846 		th_trace->th_id = curthread;
5847 		th_trace->th_next = ipif->ipif_trace[bucket_id];
5848 		th_trace->th_prev = &ipif->ipif_trace[bucket_id];
5849 		if (th_trace->th_next != NULL)
5850 			th_trace->th_next->th_prev = &th_trace->th_next;
5851 		ipif->ipif_trace[bucket_id] = th_trace;
5852 	}
5853 	ASSERT(th_trace->th_refcnt >= 0 &&
5854 		th_trace->th_refcnt < TR_BUF_MAX -1);
5855 	th_trace->th_refcnt++;
5856 	th_trace_rrecord(th_trace);
5857 }
5858 
5859 void
5860 ipif_untrace_ref(ipif_t *ipif)
5861 {
5862 	th_trace_t *th_trace;
5863 
5864 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5865 
5866 	if (ipif->ipif_trace_disable)
5867 		return;
5868 	th_trace = th_trace_ipif_lookup(ipif);
5869 	ASSERT(th_trace != NULL);
5870 	ASSERT(th_trace->th_refcnt > 0);
5871 
5872 	th_trace->th_refcnt--;
5873 	th_trace_rrecord(th_trace);
5874 }
5875 
5876 th_trace_t *
5877 th_trace_ill_lookup(ill_t *ill)
5878 {
5879 	th_trace_t *th_trace;
5880 	int bucket_id;
5881 
5882 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5883 
5884 	bucket_id = IP_TR_HASH(curthread);
5885 	ASSERT(bucket_id < IP_TR_HASH_MAX);
5886 
5887 	for (th_trace = ill->ill_trace[bucket_id]; th_trace != NULL;
5888 	    th_trace = th_trace->th_next) {
5889 		if (th_trace->th_id == curthread)
5890 			return (th_trace);
5891 	}
5892 	return (NULL);
5893 }
5894 
5895 void
5896 ill_trace_ref(ill_t *ill)
5897 {
5898 	int bucket_id;
5899 	th_trace_t *th_trace;
5900 
5901 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5902 	if (ill->ill_trace_disable)
5903 		return;
5904 	/*
5905 	 * Attempt to locate the trace buffer for the curthread.
5906 	 * If it does not exist, then allocate a new trace buffer
5907 	 * and link it in list of trace bufs for this ill, at the head
5908 	 */
5909 	th_trace = th_trace_ill_lookup(ill);
5910 	if (th_trace == NULL) {
5911 		bucket_id = IP_TR_HASH(curthread);
5912 		th_trace = (th_trace_t *)kmem_zalloc(sizeof (th_trace_t),
5913 		    KM_NOSLEEP);
5914 		if (th_trace == NULL) {
5915 			ill->ill_trace_disable = B_TRUE;
5916 			ill_trace_cleanup(ill);
5917 			return;
5918 		}
5919 		th_trace->th_id = curthread;
5920 		th_trace->th_next = ill->ill_trace[bucket_id];
5921 		th_trace->th_prev = &ill->ill_trace[bucket_id];
5922 		if (th_trace->th_next != NULL)
5923 			th_trace->th_next->th_prev = &th_trace->th_next;
5924 		ill->ill_trace[bucket_id] = th_trace;
5925 	}
5926 	ASSERT(th_trace->th_refcnt >= 0 &&
5927 		th_trace->th_refcnt < TR_BUF_MAX - 1);
5928 
5929 	th_trace->th_refcnt++;
5930 	th_trace_rrecord(th_trace);
5931 }
5932 
5933 void
5934 ill_untrace_ref(ill_t *ill)
5935 {
5936 	th_trace_t *th_trace;
5937 
5938 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5939 
5940 	if (ill->ill_trace_disable)
5941 		return;
5942 	th_trace = th_trace_ill_lookup(ill);
5943 	ASSERT(th_trace != NULL);
5944 	ASSERT(th_trace->th_refcnt > 0);
5945 
5946 	th_trace->th_refcnt--;
5947 	th_trace_rrecord(th_trace);
5948 }
5949 
5950 /*
5951  * Verify that this thread has no refs to the ipif and free
5952  * the trace buffers
5953  */
5954 /* ARGSUSED */
5955 void
5956 ipif_thread_exit(ipif_t *ipif, void *dummy)
5957 {
5958 	th_trace_t *th_trace;
5959 
5960 	mutex_enter(&ipif->ipif_ill->ill_lock);
5961 
5962 	th_trace = th_trace_ipif_lookup(ipif);
5963 	if (th_trace == NULL) {
5964 		mutex_exit(&ipif->ipif_ill->ill_lock);
5965 		return;
5966 	}
5967 	ASSERT(th_trace->th_refcnt == 0);
5968 	/* unlink th_trace and free it */
5969 	*th_trace->th_prev = th_trace->th_next;
5970 	if (th_trace->th_next != NULL)
5971 		th_trace->th_next->th_prev = th_trace->th_prev;
5972 	th_trace->th_next = NULL;
5973 	th_trace->th_prev = NULL;
5974 	kmem_free(th_trace, sizeof (th_trace_t));
5975 
5976 	mutex_exit(&ipif->ipif_ill->ill_lock);
5977 }
5978 
5979 /*
5980  * Verify that this thread has no refs to the ill and free
5981  * the trace buffers
5982  */
5983 /* ARGSUSED */
5984 void
5985 ill_thread_exit(ill_t *ill, void *dummy)
5986 {
5987 	th_trace_t *th_trace;
5988 
5989 	mutex_enter(&ill->ill_lock);
5990 
5991 	th_trace = th_trace_ill_lookup(ill);
5992 	if (th_trace == NULL) {
5993 		mutex_exit(&ill->ill_lock);
5994 		return;
5995 	}
5996 	ASSERT(th_trace->th_refcnt == 0);
5997 	/* unlink th_trace and free it */
5998 	*th_trace->th_prev = th_trace->th_next;
5999 	if (th_trace->th_next != NULL)
6000 		th_trace->th_next->th_prev = th_trace->th_prev;
6001 	th_trace->th_next = NULL;
6002 	th_trace->th_prev = NULL;
6003 	kmem_free(th_trace, sizeof (th_trace_t));
6004 
6005 	mutex_exit(&ill->ill_lock);
6006 }
6007 #endif
6008 
6009 #ifdef ILL_DEBUG
6010 void
6011 ip_thread_exit(void)
6012 {
6013 	ill_t	*ill;
6014 	ipif_t	*ipif;
6015 	ill_walk_context_t	ctx;
6016 
6017 	rw_enter(&ill_g_lock, RW_READER);
6018 	ill = ILL_START_WALK_ALL(&ctx);
6019 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
6020 		for (ipif = ill->ill_ipif; ipif != NULL;
6021 		    ipif = ipif->ipif_next) {
6022 			ipif_thread_exit(ipif, NULL);
6023 		}
6024 		ill_thread_exit(ill, NULL);
6025 	}
6026 	rw_exit(&ill_g_lock);
6027 
6028 	ire_walk(ire_thread_exit, NULL);
6029 	ndp_walk_impl(NULL, nce_thread_exit, NULL, B_FALSE);
6030 }
6031 
6032 /*
6033  * Called when ipif is unplumbed or when memory alloc fails
6034  */
6035 void
6036 ipif_trace_cleanup(ipif_t *ipif)
6037 {
6038 	int	i;
6039 	th_trace_t	*th_trace;
6040 	th_trace_t	*th_trace_next;
6041 
6042 	for (i = 0; i < IP_TR_HASH_MAX; i++) {
6043 		for (th_trace = ipif->ipif_trace[i]; th_trace != NULL;
6044 		    th_trace = th_trace_next) {
6045 			th_trace_next = th_trace->th_next;
6046 			kmem_free(th_trace, sizeof (th_trace_t));
6047 		}
6048 		ipif->ipif_trace[i] = NULL;
6049 	}
6050 }
6051 
6052 /*
6053  * Called when ill is unplumbed or when memory alloc fails
6054  */
6055 void
6056 ill_trace_cleanup(ill_t *ill)
6057 {
6058 	int	i;
6059 	th_trace_t	*th_trace;
6060 	th_trace_t	*th_trace_next;
6061 
6062 	for (i = 0; i < IP_TR_HASH_MAX; i++) {
6063 		for (th_trace = ill->ill_trace[i]; th_trace != NULL;
6064 		    th_trace = th_trace_next) {
6065 			th_trace_next = th_trace->th_next;
6066 			kmem_free(th_trace, sizeof (th_trace_t));
6067 		}
6068 		ill->ill_trace[i] = NULL;
6069 	}
6070 }
6071 
6072 #else
6073 void ip_thread_exit(void) {}
6074 #endif
6075 
6076 void
6077 ipif_refhold_locked(ipif_t *ipif)
6078 {
6079 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6080 	ipif->ipif_refcnt++;
6081 	IPIF_TRACE_REF(ipif);
6082 }
6083 
6084 void
6085 ipif_refhold(ipif_t *ipif)
6086 {
6087 	ill_t	*ill;
6088 
6089 	ill = ipif->ipif_ill;
6090 	mutex_enter(&ill->ill_lock);
6091 	ipif->ipif_refcnt++;
6092 	IPIF_TRACE_REF(ipif);
6093 	mutex_exit(&ill->ill_lock);
6094 }
6095 
6096 /*
6097  * Must not be called while holding any locks. Otherwise if this is
6098  * the last reference to be released there is a chance of recursive mutex
6099  * panic due to ipif_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
6100  * to restart an ioctl.
6101  */
6102 void
6103 ipif_refrele(ipif_t *ipif)
6104 {
6105 	ill_t	*ill;
6106 
6107 	ill = ipif->ipif_ill;
6108 
6109 	mutex_enter(&ill->ill_lock);
6110 	ASSERT(ipif->ipif_refcnt != 0);
6111 	ipif->ipif_refcnt--;
6112 	IPIF_UNTRACE_REF(ipif);
6113 	if (ipif->ipif_refcnt != 0) {
6114 		mutex_exit(&ill->ill_lock);
6115 		return;
6116 	}
6117 
6118 	/* Drops the ill_lock */
6119 	ipif_ill_refrele_tail(ill);
6120 }
6121 
6122 ipif_t *
6123 ipif_get_next_ipif(ipif_t *curr, ill_t *ill)
6124 {
6125 	ipif_t	*ipif;
6126 
6127 	mutex_enter(&ill->ill_lock);
6128 	for (ipif = (curr == NULL ? ill->ill_ipif : curr->ipif_next);
6129 	    ipif != NULL; ipif = ipif->ipif_next) {
6130 		if (!IPIF_CAN_LOOKUP(ipif))
6131 			continue;
6132 		ipif_refhold_locked(ipif);
6133 		mutex_exit(&ill->ill_lock);
6134 		return (ipif);
6135 	}
6136 	mutex_exit(&ill->ill_lock);
6137 	return (NULL);
6138 }
6139 
6140 /*
6141  * TODO: make this table extendible at run time
6142  * Return a pointer to the mac type info for 'mac_type'
6143  */
6144 static ip_m_t *
6145 ip_m_lookup(t_uscalar_t mac_type)
6146 {
6147 	ip_m_t	*ipm;
6148 
6149 	for (ipm = ip_m_tbl; ipm < A_END(ip_m_tbl); ipm++)
6150 		if (ipm->ip_m_mac_type == mac_type)
6151 			return (ipm);
6152 	return (NULL);
6153 }
6154 
6155 /*
6156  * ip_rt_add is called to add an IPv4 route to the forwarding table.
6157  * ipif_arg is passed in to associate it with the correct interface.
6158  * We may need to restart this operation if the ipif cannot be looked up
6159  * due to an exclusive operation that is currently in progress. The restart
6160  * entry point is specified by 'func'
6161  */
6162 int
6163 ip_rt_add(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
6164     ipaddr_t src_addr, int flags, ipif_t *ipif_arg, ipif_t *src_ipif,
6165     ire_t **ire_arg, boolean_t ioctl_msg, queue_t *q, mblk_t *mp,
6166     ipsq_func_t func)
6167 {
6168 	ire_t	*ire;
6169 	ire_t	*gw_ire = NULL;
6170 	ipif_t	*ipif = NULL;
6171 	boolean_t ipif_refheld = B_FALSE;
6172 	uint_t	type;
6173 	int	match_flags = MATCH_IRE_TYPE;
6174 	int	error;
6175 
6176 	ip1dbg(("ip_rt_add:"));
6177 
6178 	if (ire_arg != NULL)
6179 		*ire_arg = NULL;
6180 
6181 	/*
6182 	 * If this is the case of RTF_HOST being set, then we set the netmask
6183 	 * to all ones (regardless if one was supplied).
6184 	 */
6185 	if (flags & RTF_HOST)
6186 		mask = IP_HOST_MASK;
6187 
6188 	/*
6189 	 * Prevent routes with a zero gateway from being created (since
6190 	 * interfaces can currently be plumbed and brought up no assigned
6191 	 * address).
6192 	 * For routes with RTA_SRCIFP, the gateway address can be 0.0.0.0.
6193 	 */
6194 	if (gw_addr == 0 && src_ipif == NULL)
6195 		return (ENETUNREACH);
6196 	/*
6197 	 * Get the ipif, if any, corresponding to the gw_addr
6198 	 */
6199 	if (gw_addr != 0) {
6200 		ipif = ipif_lookup_interface(gw_addr, dst_addr, q, mp, func,
6201 		    &error);
6202 		if (ipif != NULL) {
6203 			if (IS_VNI(ipif->ipif_ill)) {
6204 				ipif_refrele(ipif);
6205 				return (EINVAL);
6206 			}
6207 			ipif_refheld = B_TRUE;
6208 		} else if (error == EINPROGRESS) {
6209 			ip1dbg(("ip_rt_add: null and EINPROGRESS"));
6210 			return (EINPROGRESS);
6211 		} else {
6212 			error = 0;
6213 		}
6214 	}
6215 
6216 	if (ipif != NULL) {
6217 		ip1dbg(("ip_rt_add: ipif_lookup_interface done ipif nonnull"));
6218 		ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6219 	} else {
6220 		ip1dbg(("ip_rt_add: ipif_lookup_interface done ipif is null"));
6221 	}
6222 
6223 	/*
6224 	 * GateD will attempt to create routes with a loopback interface
6225 	 * address as the gateway and with RTF_GATEWAY set.  We allow
6226 	 * these routes to be added, but create them as interface routes
6227 	 * since the gateway is an interface address.
6228 	 */
6229 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK))
6230 		flags &= ~RTF_GATEWAY;
6231 
6232 	/*
6233 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
6234 	 * and the gateway address provided is one of the system's interface
6235 	 * addresses.  By using the routing socket interface and supplying an
6236 	 * RTA_IFP sockaddr with an interface index, an alternate method of
6237 	 * specifying an interface route to be created is available which uses
6238 	 * the interface index that specifies the outgoing interface rather than
6239 	 * the address of an outgoing interface (which may not be able to
6240 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
6241 	 * flag, routes can be specified which not only specify the next-hop to
6242 	 * be used when routing to a certain prefix, but also which outgoing
6243 	 * interface should be used.
6244 	 *
6245 	 * Previously, interfaces would have unique addresses assigned to them
6246 	 * and so the address assigned to a particular interface could be used
6247 	 * to identify a particular interface.  One exception to this was the
6248 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
6249 	 *
6250 	 * With the advent of IPv6 and its link-local addresses, this
6251 	 * restriction was relaxed and interfaces could share addresses between
6252 	 * themselves.  In fact, typically all of the link-local interfaces on
6253 	 * an IPv6 node or router will have the same link-local address.  In
6254 	 * order to differentiate between these interfaces, the use of an
6255 	 * interface index is necessary and this index can be carried inside a
6256 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
6257 	 * of using the interface index, however, is that all of the ipif's that
6258 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
6259 	 * cannot be used to differentiate between ipif's (or logical
6260 	 * interfaces) that belong to the same ill (physical interface).
6261 	 *
6262 	 * For example, in the following case involving IPv4 interfaces and
6263 	 * logical interfaces
6264 	 *
6265 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
6266 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0:1
6267 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0:2
6268 	 *
6269 	 * the ipif's corresponding to each of these interface routes can be
6270 	 * uniquely identified by the "gateway" (actually interface address).
6271 	 *
6272 	 * In this case involving multiple IPv6 default routes to a particular
6273 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
6274 	 * default route is of interest:
6275 	 *
6276 	 *	default		fe80::123:4567:89ab:cdef	U	if0
6277 	 *	default		fe80::123:4567:89ab:cdef	U	if1
6278 	 */
6279 
6280 	/* RTF_GATEWAY not set */
6281 	if (!(flags & RTF_GATEWAY)) {
6282 		queue_t	*stq;
6283 		queue_t	*rfq = NULL;
6284 		ill_t	*in_ill = NULL;
6285 
6286 		/*
6287 		 * As the interface index specified with the RTA_IFP sockaddr is
6288 		 * the same for all ipif's off of an ill, the matching logic
6289 		 * below uses MATCH_IRE_ILL if such an index was specified.
6290 		 * This means that routes sharing the same prefix when added
6291 		 * using a RTA_IFP sockaddr must have distinct interface
6292 		 * indices (namely, they must be on distinct ill's).
6293 		 *
6294 		 * On the other hand, since the gateway address will usually be
6295 		 * different for each ipif on the system, the matching logic
6296 		 * uses MATCH_IRE_IPIF in the case of a traditional interface
6297 		 * route.  This means that interface routes for the same prefix
6298 		 * can be created if they belong to distinct ipif's and if a
6299 		 * RTA_IFP sockaddr is not present.
6300 		 */
6301 		if (ipif_arg != NULL) {
6302 			if (ipif_refheld)  {
6303 				ipif_refrele(ipif);
6304 				ipif_refheld = B_FALSE;
6305 			}
6306 			ipif = ipif_arg;
6307 			match_flags |= MATCH_IRE_ILL;
6308 		} else {
6309 			/*
6310 			 * Check the ipif corresponding to the gw_addr
6311 			 */
6312 			if (ipif == NULL)
6313 				return (ENETUNREACH);
6314 			match_flags |= MATCH_IRE_IPIF;
6315 		}
6316 		ASSERT(ipif != NULL);
6317 		/*
6318 		 * If src_ipif is not NULL, we have to create
6319 		 * an ire with non-null ire_in_ill value
6320 		 */
6321 		if (src_ipif != NULL) {
6322 			in_ill = src_ipif->ipif_ill;
6323 		}
6324 
6325 		/*
6326 		 * We check for an existing entry at this point.
6327 		 *
6328 		 * Since a netmask isn't passed in via the ioctl interface
6329 		 * (SIOCADDRT), we don't check for a matching netmask in that
6330 		 * case.
6331 		 */
6332 		if (!ioctl_msg)
6333 			match_flags |= MATCH_IRE_MASK;
6334 		if (src_ipif != NULL) {
6335 			/* Look up in the special table */
6336 			ire = ire_srcif_table_lookup(dst_addr, IRE_INTERFACE,
6337 			    ipif, src_ipif->ipif_ill, match_flags);
6338 		} else {
6339 			ire = ire_ftable_lookup(dst_addr, mask, 0,
6340 			    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0,
6341 			    match_flags);
6342 		}
6343 		if (ire != NULL) {
6344 			ire_refrele(ire);
6345 			if (ipif_refheld)
6346 				ipif_refrele(ipif);
6347 			return (EEXIST);
6348 		}
6349 
6350 		if (src_ipif != NULL) {
6351 			/*
6352 			 * Create the special ire for the IRE table
6353 			 * which hangs out of ire_in_ill. This ire
6354 			 * is in-between IRE_CACHE and IRE_INTERFACE.
6355 			 * Thus rfq is non-NULL.
6356 			 */
6357 			rfq = ipif->ipif_rq;
6358 		}
6359 		/* Create the usual interface ires */
6360 
6361 		stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
6362 		    ? ipif->ipif_rq : ipif->ipif_wq;
6363 
6364 		/*
6365 		 * Create a copy of the IRE_LOOPBACK,
6366 		 * IRE_IF_NORESOLVER or IRE_IF_RESOLVER with
6367 		 * the modified address and netmask.
6368 		 */
6369 		ire = ire_create(
6370 		    (uchar_t *)&dst_addr,
6371 		    (uint8_t *)&mask,
6372 		    (uint8_t *)&ipif->ipif_src_addr,
6373 		    NULL,
6374 		    NULL,
6375 		    &ipif->ipif_mtu,
6376 		    NULL,
6377 		    rfq,
6378 		    stq,
6379 		    ipif->ipif_net_type,
6380 		    ipif->ipif_resolver_mp,
6381 		    ipif,
6382 		    in_ill,
6383 		    0,
6384 		    0,
6385 		    0,
6386 		    flags,
6387 		    &ire_uinfo_null);
6388 		if (ire == NULL) {
6389 			if (ipif_refheld)
6390 				ipif_refrele(ipif);
6391 			return (ENOMEM);
6392 		}
6393 
6394 		/*
6395 		 * Some software (for example, GateD and Sun Cluster) attempts
6396 		 * to create (what amount to) IRE_PREFIX routes with the
6397 		 * loopback address as the gateway.  This is primarily done to
6398 		 * set up prefixes with the RTF_REJECT flag set (for example,
6399 		 * when generating aggregate routes.)
6400 		 *
6401 		 * If the IRE type (as defined by ipif->ipif_net_type) is
6402 		 * IRE_LOOPBACK, then we map the request into a
6403 		 * IRE_IF_NORESOLVER.
6404 		 *
6405 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
6406 		 * routine, but rather using ire_create() directly.
6407 		 */
6408 		if (ipif->ipif_net_type == IRE_LOOPBACK)
6409 			ire->ire_type = IRE_IF_NORESOLVER;
6410 		error = ire_add(&ire, q, mp, func);
6411 		if (error == 0)
6412 			goto save_ire;
6413 
6414 		/*
6415 		 * In the result of failure, ire_add() will have already
6416 		 * deleted the ire in question, so there is no need to
6417 		 * do that here.
6418 		 */
6419 		if (ipif_refheld)
6420 			ipif_refrele(ipif);
6421 		return (error);
6422 	}
6423 	if (ipif_refheld) {
6424 		ipif_refrele(ipif);
6425 		ipif_refheld = B_FALSE;
6426 	}
6427 
6428 	if (src_ipif != NULL) {
6429 		/* RTA_SRCIFP is not supported on RTF_GATEWAY */
6430 		ip2dbg(("ip_rt_add: SRCIF cannot be set with gateway route\n"));
6431 		return (EINVAL);
6432 	}
6433 	/*
6434 	 * Get an interface IRE for the specified gateway.
6435 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
6436 	 * gateway, it is currently unreachable and we fail the request
6437 	 * accordingly.
6438 	 */
6439 	ipif = ipif_arg;
6440 	if (ipif_arg != NULL)
6441 		match_flags |= MATCH_IRE_ILL;
6442 	gw_ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg, NULL,
6443 	    ALL_ZONES, 0, match_flags);
6444 	if (gw_ire == NULL)
6445 		return (ENETUNREACH);
6446 
6447 	/*
6448 	 * We create one of three types of IREs as a result of this request
6449 	 * based on the netmask.  A netmask of all ones (which is automatically
6450 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
6451 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
6452 	 * created.  Otherwise, an IRE_PREFIX route is created for the
6453 	 * destination prefix.
6454 	 */
6455 	if (mask == IP_HOST_MASK)
6456 		type = IRE_HOST;
6457 	else if (mask == 0)
6458 		type = IRE_DEFAULT;
6459 	else
6460 		type = IRE_PREFIX;
6461 
6462 	/* check for a duplicate entry */
6463 	ire = ire_ftable_lookup(dst_addr, mask, gw_addr, type, ipif_arg,
6464 	    NULL, ALL_ZONES, 0, match_flags | MATCH_IRE_MASK | MATCH_IRE_GW);
6465 	if (ire != NULL) {
6466 		ire_refrele(gw_ire);
6467 		ire_refrele(ire);
6468 		return (EEXIST);
6469 	}
6470 
6471 	/* Create the IRE. */
6472 	ire = ire_create(
6473 	    (uchar_t *)&dst_addr,		/* dest address */
6474 	    (uchar_t *)&mask,			/* mask */
6475 	    /* src address assigned by the caller? */
6476 	    (uchar_t *)(((src_addr != INADDR_ANY) &&
6477 		(flags & RTF_SETSRC)) ?  &src_addr : NULL),
6478 	    (uchar_t *)&gw_addr,		/* gateway address */
6479 	    NULL,				/* no in-srcaddress */
6480 	    &gw_ire->ire_max_frag,
6481 	    NULL,				/* no Fast Path header */
6482 	    NULL,				/* no recv-from queue */
6483 	    NULL,				/* no send-to queue */
6484 	    (ushort_t)type,			/* IRE type */
6485 	    NULL,
6486 	    ipif_arg,
6487 	    NULL,
6488 	    0,
6489 	    0,
6490 	    0,
6491 	    flags,
6492 	    &gw_ire->ire_uinfo);		/* Inherit ULP info from gw */
6493 	if (ire == NULL) {
6494 		ire_refrele(gw_ire);
6495 		return (ENOMEM);
6496 	}
6497 
6498 	/*
6499 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
6500 	 * SUN/OS socket stuff does but do we really want to allow 0.0.0.0?
6501 	 */
6502 
6503 	/* Add the new IRE. */
6504 	error = ire_add(&ire, q, mp, func);
6505 	if (error != 0) {
6506 		/*
6507 		 * In the result of failure, ire_add() will have already
6508 		 * deleted the ire in question, so there is no need to
6509 		 * do that here.
6510 		 */
6511 		ire_refrele(gw_ire);
6512 		return (error);
6513 	}
6514 
6515 	if (flags & RTF_MULTIRT) {
6516 		/*
6517 		 * Invoke the CGTP (multirouting) filtering module
6518 		 * to add the dst address in the filtering database.
6519 		 * Replicated inbound packets coming from that address
6520 		 * will be filtered to discard the duplicates.
6521 		 * It is not necessary to call the CGTP filter hook
6522 		 * when the dst address is a broadcast or multicast,
6523 		 * because an IP source address cannot be a broadcast
6524 		 * or a multicast.
6525 		 */
6526 		ire_t *ire_dst = ire_ctable_lookup(ire->ire_addr, 0,
6527 		    IRE_BROADCAST, NULL, NULL, MATCH_IRE_TYPE);
6528 		if (ire_dst != NULL) {
6529 			ip_cgtp_bcast_add(ire, ire_dst);
6530 			ire_refrele(ire_dst);
6531 			goto save_ire;
6532 		}
6533 		if ((ip_cgtp_filter_ops != NULL) && !CLASSD(ire->ire_addr)) {
6534 			int res = ip_cgtp_filter_ops->cfo_add_dest_v4(
6535 			    ire->ire_addr,
6536 			    ire->ire_gateway_addr,
6537 			    ire->ire_src_addr,
6538 			    gw_ire->ire_src_addr);
6539 			if (res != 0) {
6540 				ire_refrele(gw_ire);
6541 				ire_delete(ire);
6542 				return (res);
6543 			}
6544 		}
6545 	}
6546 
6547 save_ire:
6548 	if (gw_ire != NULL) {
6549 		ire_refrele(gw_ire);
6550 	}
6551 	/*
6552 	 * We do not do save_ire for the routes added with RTA_SRCIFP
6553 	 * flag. This route is only added and deleted by mipagent.
6554 	 * So, for simplicity of design, we refrain from saving
6555 	 * ires that are created with srcif value. This may change
6556 	 * in future if we find more usage of srcifp feature.
6557 	 */
6558 	if (ipif != NULL && src_ipif == NULL) {
6559 		/*
6560 		 * Save enough information so that we can recreate the IRE if
6561 		 * the interface goes down and then up.  The metrics associated
6562 		 * with the route will be saved as well when rts_setmetrics() is
6563 		 * called after the IRE has been created.  In the case where
6564 		 * memory cannot be allocated, none of this information will be
6565 		 * saved.
6566 		 */
6567 		ipif_save_ire(ipif, ire);
6568 	}
6569 	if (ioctl_msg)
6570 		ip_rts_rtmsg(RTM_OLDADD, ire, 0);
6571 	if (ire_arg != NULL) {
6572 		/*
6573 		 * Store the ire that was successfully added into where ire_arg
6574 		 * points to so that callers don't have to look it up
6575 		 * themselves (but they are responsible for ire_refrele()ing
6576 		 * the ire when they are finished with it).
6577 		 */
6578 		*ire_arg = ire;
6579 	} else {
6580 		ire_refrele(ire);		/* Held in ire_add */
6581 	}
6582 	if (ipif_refheld)
6583 		ipif_refrele(ipif);
6584 	return (0);
6585 }
6586 
6587 /*
6588  * ip_rt_delete is called to delete an IPv4 route.
6589  * ipif_arg is passed in to associate it with the correct interface.
6590  * src_ipif is passed to associate the incoming interface of the packet.
6591  * We may need to restart this operation if the ipif cannot be looked up
6592  * due to an exclusive operation that is currently in progress. The restart
6593  * entry point is specified by 'func'
6594  */
6595 /* ARGSUSED4 */
6596 int
6597 ip_rt_delete(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
6598     uint_t rtm_addrs, int flags, ipif_t *ipif_arg, ipif_t *src_ipif,
6599     boolean_t ioctl_msg, queue_t *q, mblk_t *mp, ipsq_func_t func)
6600 {
6601 	ire_t	*ire = NULL;
6602 	ipif_t	*ipif;
6603 	boolean_t ipif_refheld = B_FALSE;
6604 	uint_t	type;
6605 	uint_t	match_flags = MATCH_IRE_TYPE;
6606 	int	err = 0;
6607 
6608 	ip1dbg(("ip_rt_delete:"));
6609 	/*
6610 	 * If this is the case of RTF_HOST being set, then we set the netmask
6611 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
6612 	 */
6613 	if (flags & RTF_HOST) {
6614 		mask = IP_HOST_MASK;
6615 		match_flags |= MATCH_IRE_MASK;
6616 	} else if (rtm_addrs & RTA_NETMASK) {
6617 		match_flags |= MATCH_IRE_MASK;
6618 	}
6619 
6620 	/*
6621 	 * Note that RTF_GATEWAY is never set on a delete, therefore
6622 	 * we check if the gateway address is one of our interfaces first,
6623 	 * and fall back on RTF_GATEWAY routes.
6624 	 *
6625 	 * This makes it possible to delete an original
6626 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
6627 	 *
6628 	 * As the interface index specified with the RTA_IFP sockaddr is the
6629 	 * same for all ipif's off of an ill, the matching logic below uses
6630 	 * MATCH_IRE_ILL if such an index was specified.  This means a route
6631 	 * sharing the same prefix and interface index as the the route
6632 	 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr
6633 	 * is specified in the request.
6634 	 *
6635 	 * On the other hand, since the gateway address will usually be
6636 	 * different for each ipif on the system, the matching logic
6637 	 * uses MATCH_IRE_IPIF in the case of a traditional interface
6638 	 * route.  This means that interface routes for the same prefix can be
6639 	 * uniquely identified if they belong to distinct ipif's and if a
6640 	 * RTA_IFP sockaddr is not present.
6641 	 *
6642 	 * For more detail on specifying routes by gateway address and by
6643 	 * interface index, see the comments in ip_rt_add().
6644 	 * gw_addr could be zero in some cases when both RTA_SRCIFP and
6645 	 * RTA_IFP are specified. If RTA_SRCIFP is specified and  both
6646 	 * RTA_IFP and gateway_addr are NULL/zero, then delete will not
6647 	 * succeed.
6648 	 */
6649 	if (src_ipif != NULL) {
6650 		if (ipif_arg == NULL && gw_addr != 0) {
6651 			ipif_arg = ipif_lookup_interface(gw_addr, dst_addr,
6652 			    q, mp, func, &err);
6653 			if (ipif_arg != NULL)
6654 				ipif_refheld = B_TRUE;
6655 		}
6656 		if (ipif_arg == NULL) {
6657 			err = (err == EINPROGRESS) ? err : ESRCH;
6658 			return (err);
6659 		}
6660 		ipif = ipif_arg;
6661 	} else {
6662 		ipif = ipif_lookup_interface(gw_addr, dst_addr,
6663 			    q, mp, func, &err);
6664 		if (ipif != NULL)
6665 			ipif_refheld = B_TRUE;
6666 		else if (err == EINPROGRESS)
6667 			return (err);
6668 		else
6669 			err = 0;
6670 	}
6671 	if (ipif != NULL) {
6672 		if (ipif_arg != NULL) {
6673 			if (ipif_refheld) {
6674 				ipif_refrele(ipif);
6675 				ipif_refheld = B_FALSE;
6676 			}
6677 			ipif = ipif_arg;
6678 			match_flags |= MATCH_IRE_ILL;
6679 		} else {
6680 			match_flags |= MATCH_IRE_IPIF;
6681 		}
6682 		if (src_ipif != NULL) {
6683 			ire = ire_srcif_table_lookup(dst_addr, IRE_INTERFACE,
6684 			    ipif, src_ipif->ipif_ill, match_flags);
6685 		} else {
6686 			if (ipif->ipif_ire_type == IRE_LOOPBACK) {
6687 				ire = ire_ctable_lookup(dst_addr, 0,
6688 				    IRE_LOOPBACK, ipif, ALL_ZONES, match_flags);
6689 			}
6690 			if (ire == NULL) {
6691 				ire = ire_ftable_lookup(dst_addr, mask, 0,
6692 				    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0,
6693 				    match_flags);
6694 			}
6695 		}
6696 	}
6697 
6698 	if (ire == NULL) {
6699 		/*
6700 		 * At this point, the gateway address is not one of our own
6701 		 * addresses or a matching interface route was not found.  We
6702 		 * set the IRE type to lookup based on whether
6703 		 * this is a host route, a default route or just a prefix.
6704 		 *
6705 		 * If an ipif_arg was passed in, then the lookup is based on an
6706 		 * interface index so MATCH_IRE_ILL is added to match_flags.
6707 		 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is
6708 		 * set as the route being looked up is not a traditional
6709 		 * interface route.
6710 		 * Since we do not add gateway route with srcipif, we don't
6711 		 * expect to find it either.
6712 		 */
6713 		if (src_ipif != NULL) {
6714 			if (ipif_refheld)
6715 				ipif_refrele(ipif);
6716 			return (ESRCH);
6717 		} else {
6718 			match_flags &= ~MATCH_IRE_IPIF;
6719 			match_flags |= MATCH_IRE_GW;
6720 			if (ipif_arg != NULL)
6721 				match_flags |= MATCH_IRE_ILL;
6722 			if (mask == IP_HOST_MASK)
6723 				type = IRE_HOST;
6724 			else if (mask == 0)
6725 				type = IRE_DEFAULT;
6726 			else
6727 				type = IRE_PREFIX;
6728 			ire = ire_ftable_lookup(dst_addr, mask, gw_addr, type,
6729 			    ipif_arg, NULL, ALL_ZONES, 0, match_flags);
6730 			if (ire == NULL && type == IRE_HOST) {
6731 				ire = ire_ftable_lookup(dst_addr, mask, gw_addr,
6732 				    IRE_HOST_REDIRECT, ipif_arg, NULL,
6733 				    ALL_ZONES, 0, match_flags);
6734 			}
6735 		}
6736 	}
6737 
6738 	if (ipif_refheld)
6739 		ipif_refrele(ipif);
6740 
6741 	/* ipif is not refheld anymore */
6742 	if (ire == NULL)
6743 		return (ESRCH);
6744 
6745 	if (ire->ire_flags & RTF_MULTIRT) {
6746 		/*
6747 		 * Invoke the CGTP (multirouting) filtering module
6748 		 * to remove the dst address from the filtering database.
6749 		 * Packets coming from that address will no longer be
6750 		 * filtered to remove duplicates.
6751 		 */
6752 		if (ip_cgtp_filter_ops != NULL) {
6753 			err = ip_cgtp_filter_ops->cfo_del_dest_v4(ire->ire_addr,
6754 			    ire->ire_gateway_addr);
6755 		}
6756 		ip_cgtp_bcast_delete(ire);
6757 	}
6758 
6759 	ipif = ire->ire_ipif;
6760 	/*
6761 	 * Removing from ipif_saved_ire_mp is not necessary
6762 	 * when src_ipif being non-NULL. ip_rt_add does not
6763 	 * save the ires which src_ipif being non-NULL.
6764 	 */
6765 	if (ipif != NULL && src_ipif == NULL) {
6766 		ipif_remove_ire(ipif, ire);
6767 	}
6768 	if (ioctl_msg)
6769 		ip_rts_rtmsg(RTM_OLDDEL, ire, 0);
6770 	ire_delete(ire);
6771 	ire_refrele(ire);
6772 	return (err);
6773 }
6774 
6775 /*
6776  * ip_siocaddrt is called to complete processing of an SIOCADDRT IOCTL.
6777  */
6778 /* ARGSUSED */
6779 int
6780 ip_siocaddrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
6781     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
6782 {
6783 	ipaddr_t dst_addr;
6784 	ipaddr_t gw_addr;
6785 	ipaddr_t mask;
6786 	int error = 0;
6787 	mblk_t *mp1;
6788 	struct rtentry *rt;
6789 	ipif_t *ipif = NULL;
6790 
6791 	ip1dbg(("ip_siocaddrt:"));
6792 	/* Existence of mp1 verified in ip_wput_nondata */
6793 	mp1 = mp->b_cont->b_cont;
6794 	rt = (struct rtentry *)mp1->b_rptr;
6795 
6796 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
6797 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
6798 
6799 	/*
6800 	 * If the RTF_HOST flag is on, this is a request to assign a gateway
6801 	 * to a particular host address.  In this case, we set the netmask to
6802 	 * all ones for the particular destination address.  Otherwise,
6803 	 * determine the netmask to be used based on dst_addr and the interfaces
6804 	 * in use.
6805 	 */
6806 	if (rt->rt_flags & RTF_HOST) {
6807 		mask = IP_HOST_MASK;
6808 	} else {
6809 		/*
6810 		 * Note that ip_subnet_mask returns a zero mask in the case of
6811 		 * default (an all-zeroes address).
6812 		 */
6813 		mask = ip_subnet_mask(dst_addr, &ipif);
6814 	}
6815 
6816 	error = ip_rt_add(dst_addr, mask, gw_addr, 0, rt->rt_flags,
6817 	    NULL, NULL, NULL, B_TRUE, q, mp, ip_process_ioctl);
6818 	if (ipif != NULL)
6819 		ipif_refrele(ipif);
6820 	return (error);
6821 }
6822 
6823 /*
6824  * ip_siocdelrt is called to complete processing of an SIOCDELRT IOCTL.
6825  */
6826 /* ARGSUSED */
6827 int
6828 ip_siocdelrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
6829     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
6830 {
6831 	ipaddr_t dst_addr;
6832 	ipaddr_t gw_addr;
6833 	ipaddr_t mask;
6834 	int error;
6835 	mblk_t *mp1;
6836 	struct rtentry *rt;
6837 	ipif_t *ipif = NULL;
6838 
6839 	ip1dbg(("ip_siocdelrt:"));
6840 	/* Existence of mp1 verified in ip_wput_nondata */
6841 	mp1 = mp->b_cont->b_cont;
6842 	rt = (struct rtentry *)mp1->b_rptr;
6843 
6844 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
6845 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
6846 
6847 	/*
6848 	 * If the RTF_HOST flag is on, this is a request to delete a gateway
6849 	 * to a particular host address.  In this case, we set the netmask to
6850 	 * all ones for the particular destination address.  Otherwise,
6851 	 * determine the netmask to be used based on dst_addr and the interfaces
6852 	 * in use.
6853 	 */
6854 	if (rt->rt_flags & RTF_HOST) {
6855 		mask = IP_HOST_MASK;
6856 	} else {
6857 		/*
6858 		 * Note that ip_subnet_mask returns a zero mask in the case of
6859 		 * default (an all-zeroes address).
6860 		 */
6861 		mask = ip_subnet_mask(dst_addr, &ipif);
6862 	}
6863 
6864 	error = ip_rt_delete(dst_addr, mask, gw_addr,
6865 	    RTA_DST | RTA_GATEWAY | RTA_NETMASK, rt->rt_flags, NULL, NULL,
6866 	    B_TRUE, q, mp, ip_process_ioctl);
6867 	if (ipif != NULL)
6868 		ipif_refrele(ipif);
6869 	return (error);
6870 }
6871 
6872 /*
6873  * Enqueue the mp onto the ipsq, chained by b_next.
6874  * b_prev stores the function to be executed later, and b_queue the queue
6875  * where this mp originated.
6876  */
6877 void
6878 ipsq_enq(ipsq_t *ipsq, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
6879     ill_t *pending_ill)
6880 {
6881 	conn_t	*connp = NULL;
6882 
6883 	ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
6884 	ASSERT(func != NULL);
6885 
6886 	mp->b_queue = q;
6887 	mp->b_prev = (void *)func;
6888 	mp->b_next = NULL;
6889 
6890 	switch (type) {
6891 	case CUR_OP:
6892 		if (ipsq->ipsq_mptail != NULL) {
6893 			ASSERT(ipsq->ipsq_mphead != NULL);
6894 			ipsq->ipsq_mptail->b_next = mp;
6895 		} else {
6896 			ASSERT(ipsq->ipsq_mphead == NULL);
6897 			ipsq->ipsq_mphead = mp;
6898 		}
6899 		ipsq->ipsq_mptail = mp;
6900 		break;
6901 
6902 	case NEW_OP:
6903 		if (ipsq->ipsq_xopq_mptail != NULL) {
6904 			ASSERT(ipsq->ipsq_xopq_mphead != NULL);
6905 			ipsq->ipsq_xopq_mptail->b_next = mp;
6906 		} else {
6907 			ASSERT(ipsq->ipsq_xopq_mphead == NULL);
6908 			ipsq->ipsq_xopq_mphead = mp;
6909 		}
6910 		ipsq->ipsq_xopq_mptail = mp;
6911 		break;
6912 	default:
6913 		cmn_err(CE_PANIC, "ipsq_enq %d type \n", type);
6914 	}
6915 
6916 	if (CONN_Q(q) && pending_ill != NULL) {
6917 		connp = Q_TO_CONN(q);
6918 
6919 		ASSERT(MUTEX_HELD(&connp->conn_lock));
6920 		connp->conn_oper_pending_ill = pending_ill;
6921 	}
6922 }
6923 
6924 /*
6925  * Return the mp at the head of the ipsq. After emptying the ipsq
6926  * look at the next ioctl, if this ioctl is complete. Otherwise
6927  * return, we will resume when we complete the current ioctl.
6928  * The current ioctl will wait till it gets a response from the
6929  * driver below.
6930  */
6931 static mblk_t *
6932 ipsq_dq(ipsq_t *ipsq)
6933 {
6934 	mblk_t	*mp;
6935 
6936 	ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
6937 
6938 	mp = ipsq->ipsq_mphead;
6939 	if (mp != NULL) {
6940 		ipsq->ipsq_mphead = mp->b_next;
6941 		if (ipsq->ipsq_mphead == NULL)
6942 			ipsq->ipsq_mptail = NULL;
6943 		mp->b_next = NULL;
6944 		return (mp);
6945 	}
6946 	if (ipsq->ipsq_current_ipif != NULL)
6947 		return (NULL);
6948 	mp = ipsq->ipsq_xopq_mphead;
6949 	if (mp != NULL) {
6950 		ipsq->ipsq_xopq_mphead = mp->b_next;
6951 		if (ipsq->ipsq_xopq_mphead == NULL)
6952 			ipsq->ipsq_xopq_mptail = NULL;
6953 		mp->b_next = NULL;
6954 		return (mp);
6955 	}
6956 	return (NULL);
6957 }
6958 
6959 /*
6960  * Enter the ipsq corresponding to ill, by waiting synchronously till
6961  * we can enter the ipsq exclusively. Unless 'force' is used, the ipsq
6962  * will have to drain completely before ipsq_enter returns success.
6963  * ipsq_current_ipif will be set if some exclusive ioctl is in progress,
6964  * and the ipsq_exit logic will start the next enqueued ioctl after
6965  * completion of the current ioctl. If 'force' is used, we don't wait
6966  * for the enqueued ioctls. This is needed when a conn_close wants to
6967  * enter the ipsq and abort an ioctl that is somehow stuck. Unplumb
6968  * of an ill can also use this option. But we dont' use it currently.
6969  */
6970 #define	ENTER_SQ_WAIT_TICKS 100
6971 boolean_t
6972 ipsq_enter(ill_t *ill, boolean_t force)
6973 {
6974 	ipsq_t	*ipsq;
6975 	boolean_t waited_enough = B_FALSE;
6976 
6977 	/*
6978 	 * Holding the ill_lock prevents <ill-ipsq> assocs from changing.
6979 	 * Since the <ill-ipsq> assocs could change while we wait for the
6980 	 * writer, it is easier to wait on a fixed global rather than try to
6981 	 * cv_wait on a changing ipsq.
6982 	 */
6983 	mutex_enter(&ill->ill_lock);
6984 	for (;;) {
6985 		if (ill->ill_state_flags & ILL_CONDEMNED) {
6986 			mutex_exit(&ill->ill_lock);
6987 			return (B_FALSE);
6988 		}
6989 
6990 		ipsq = ill->ill_phyint->phyint_ipsq;
6991 		mutex_enter(&ipsq->ipsq_lock);
6992 		if (ipsq->ipsq_writer == NULL &&
6993 		    (ipsq->ipsq_current_ipif == NULL || waited_enough)) {
6994 			break;
6995 		} else if (ipsq->ipsq_writer != NULL) {
6996 			mutex_exit(&ipsq->ipsq_lock);
6997 			cv_wait(&ill->ill_cv, &ill->ill_lock);
6998 		} else {
6999 			mutex_exit(&ipsq->ipsq_lock);
7000 			if (force) {
7001 				(void) cv_timedwait(&ill->ill_cv,
7002 				    &ill->ill_lock,
7003 				    lbolt + ENTER_SQ_WAIT_TICKS);
7004 				waited_enough = B_TRUE;
7005 				continue;
7006 			} else {
7007 				cv_wait(&ill->ill_cv, &ill->ill_lock);
7008 			}
7009 		}
7010 	}
7011 
7012 	ASSERT(ipsq->ipsq_mphead == NULL && ipsq->ipsq_mptail == NULL);
7013 	ASSERT(ipsq->ipsq_reentry_cnt == 0);
7014 	ipsq->ipsq_writer = curthread;
7015 	ipsq->ipsq_reentry_cnt++;
7016 #ifdef ILL_DEBUG
7017 	ipsq->ipsq_depth = getpcstack(ipsq->ipsq_stack, IP_STACK_DEPTH);
7018 #endif
7019 	mutex_exit(&ipsq->ipsq_lock);
7020 	mutex_exit(&ill->ill_lock);
7021 	return (B_TRUE);
7022 }
7023 
7024 /*
7025  * The ipsq_t (ipsq) is the synchronization data structure used to serialize
7026  * certain critical operations like plumbing (i.e. most set ioctls),
7027  * multicast joins, igmp/mld timers, IPMP operations etc. On a non-IPMP
7028  * system there is 1 ipsq per phyint. On an IPMP system there is 1 ipsq per
7029  * IPMP group. The ipsq serializes exclusive ioctls issued by applications
7030  * on a per ipsq basis in ipsq_xopq_mphead. It also protects against multiple
7031  * threads executing in the ipsq. Responses from the driver pertain to the
7032  * current ioctl (say a DL_BIND_ACK in response to a DL_BIND_REQUEST initiated
7033  * as part of bringing up the interface) and are enqueued in ipsq_mphead.
7034  *
7035  * If a thread does not want to reenter the ipsq when it is already writer,
7036  * it must make sure that the specified reentry point to be called later
7037  * when the ipsq is empty, nor any code path starting from the specified reentry
7038  * point must never ever try to enter the ipsq again. Otherwise it can lead
7039  * to an infinite loop. The reentry point ip_rput_dlpi_writer is an example.
7040  * When the thread that is currently exclusive finishes, it (ipsq_exit)
7041  * dequeues the requests waiting to become exclusive in ipsq_mphead and calls
7042  * the reentry point. When the list at ipsq_mphead becomes empty ipsq_exit
7043  * proceeds to dequeue the next ioctl in ipsq_xopq_mphead and start the next
7044  * ioctl if the current ioctl has completed. If the current ioctl is still
7045  * in progress it simply returns. The current ioctl could be waiting for
7046  * a response from another module (arp_ or the driver or could be waiting for
7047  * the ipif/ill/ire refcnts to drop to zero. In such a case the ipsq_pending_mp
7048  * and ipsq_pending_ipif are set. ipsq_current_ipif is set throughout the
7049  * execution of the ioctl and ipsq_exit does not start the next ioctl unless
7050  * ipsq_current_ipif is clear which happens only on ioctl completion.
7051  */
7052 
7053 /*
7054  * Try to enter the ipsq exclusively, corresponding to ipif or ill. (only 1 of
7055  * ipif or ill can be specified). The caller ensures ipif or ill is valid by
7056  * ref-holding it if necessary. If the ipsq cannot be entered, the mp is queued
7057  * completion.
7058  */
7059 ipsq_t *
7060 ipsq_try_enter(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
7061     ipsq_func_t func, int type, boolean_t reentry_ok)
7062 {
7063 	ipsq_t	*ipsq;
7064 
7065 	/* Only 1 of ipif or ill can be specified */
7066 	ASSERT((ipif != NULL) ^ (ill != NULL));
7067 	if (ipif != NULL)
7068 		ill = ipif->ipif_ill;
7069 
7070 	/*
7071 	 * lock ordering ill_g_lock -> conn_lock -> ill_lock -> ipsq_lock
7072 	 * ipsq of an ill can't change when ill_lock is held.
7073 	 */
7074 	GRAB_CONN_LOCK(q);
7075 	mutex_enter(&ill->ill_lock);
7076 	ipsq = ill->ill_phyint->phyint_ipsq;
7077 	mutex_enter(&ipsq->ipsq_lock);
7078 
7079 	/*
7080 	 * 1. Enter the ipsq if we are already writer and reentry is ok.
7081 	 *    (Note: If the caller does not specify reentry_ok then neither
7082 	 *    'func' nor any of its callees must ever attempt to enter the ipsq
7083 	 *    again. Otherwise it can lead to an infinite loop
7084 	 * 2. Enter the ipsq if there is no current writer and this attempted
7085 	 *    entry is part of the current ioctl or operation
7086 	 * 3. Enter the ipsq if there is no current writer and this is a new
7087 	 *    ioctl (or operation) and the ioctl (or operation) queue is
7088 	 *    empty and there is no ioctl (or operation) currently in progress
7089 	 */
7090 	if ((ipsq->ipsq_writer == NULL && ((type == CUR_OP) ||
7091 	    (type == NEW_OP && ipsq->ipsq_xopq_mphead == NULL &&
7092 	    ipsq->ipsq_current_ipif == NULL))) ||
7093 	    (ipsq->ipsq_writer == curthread && reentry_ok)) {
7094 		/* Success. */
7095 		ipsq->ipsq_reentry_cnt++;
7096 		ipsq->ipsq_writer = curthread;
7097 		mutex_exit(&ipsq->ipsq_lock);
7098 		mutex_exit(&ill->ill_lock);
7099 		RELEASE_CONN_LOCK(q);
7100 #ifdef ILL_DEBUG
7101 		ipsq->ipsq_depth = getpcstack(ipsq->ipsq_stack, IP_STACK_DEPTH);
7102 #endif
7103 		return (ipsq);
7104 	}
7105 
7106 	ipsq_enq(ipsq, q, mp, func, type, ill);
7107 
7108 	mutex_exit(&ipsq->ipsq_lock);
7109 	mutex_exit(&ill->ill_lock);
7110 	RELEASE_CONN_LOCK(q);
7111 	return (NULL);
7112 }
7113 
7114 /*
7115  * Try to enter the ipsq exclusively, corresponding to ipif or ill. (only 1 of
7116  * ipif or ill can be specified). The caller ensures ipif or ill is valid by
7117  * ref-holding it if necessary. If the ipsq cannot be entered, the mp is queued
7118  * completion.
7119  *
7120  * This function does a refrele on the ipif/ill.
7121  */
7122 void
7123 qwriter_ip(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
7124     ipsq_func_t func, int type, boolean_t reentry_ok)
7125 {
7126 	ipsq_t	*ipsq;
7127 
7128 	ipsq = ipsq_try_enter(ipif, ill, q, mp, func, type, reentry_ok);
7129 	/*
7130 	 * Caller must have done a refhold on the ipif. ipif_refrele
7131 	 * happens on the passed ipif. We can do this since we are
7132 	 * already exclusive, or we won't access ipif henceforth, Both
7133 	 * this func and caller will just return if we ipsq_try_enter
7134 	 * fails above. This is needed because func needs to
7135 	 * see the correct refcount. Eg. removeif can work only then.
7136 	 */
7137 	if (ipif != NULL)
7138 		ipif_refrele(ipif);
7139 	else
7140 		ill_refrele(ill);
7141 	if (ipsq != NULL) {
7142 		(*func)(ipsq, q, mp, NULL);
7143 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
7144 	}
7145 }
7146 
7147 /*
7148  * If there are more than ILL_GRP_CNT ills in a group,
7149  * we use kmem alloc'd buffers, else use the stack
7150  */
7151 #define	ILL_GRP_CNT	14
7152 /*
7153  * Drain the ipsq, if there are messages on it, and then leave the ipsq.
7154  * Called by a thread that is currently exclusive on this ipsq.
7155  */
7156 void
7157 ipsq_exit(ipsq_t *ipsq, boolean_t start_igmp_timer, boolean_t start_mld_timer)
7158 {
7159 	queue_t	*q;
7160 	mblk_t	*mp;
7161 	ipsq_func_t	func;
7162 	int	next;
7163 	ill_t	**ill_list = NULL;
7164 	size_t	ill_list_size = 0;
7165 	int	cnt = 0;
7166 	boolean_t need_ipsq_free = B_FALSE;
7167 
7168 	ASSERT(IAM_WRITER_IPSQ(ipsq));
7169 	mutex_enter(&ipsq->ipsq_lock);
7170 	ASSERT(ipsq->ipsq_reentry_cnt >= 1);
7171 	if (ipsq->ipsq_reentry_cnt != 1) {
7172 		ipsq->ipsq_reentry_cnt--;
7173 		mutex_exit(&ipsq->ipsq_lock);
7174 		return;
7175 	}
7176 
7177 	mp = ipsq_dq(ipsq);
7178 	while (mp != NULL) {
7179 again:
7180 		mutex_exit(&ipsq->ipsq_lock);
7181 		func = (ipsq_func_t)mp->b_prev;
7182 		q = (queue_t *)mp->b_queue;
7183 		mp->b_prev = NULL;
7184 		mp->b_queue = NULL;
7185 
7186 		/*
7187 		 * If 'q' is an conn queue, it is valid, since we did a
7188 		 * a refhold on the connp, at the start of the ioctl.
7189 		 * If 'q' is an ill queue, it is valid, since close of an
7190 		 * ill will clean up the 'ipsq'.
7191 		 */
7192 		(*func)(ipsq, q, mp, NULL);
7193 
7194 		mutex_enter(&ipsq->ipsq_lock);
7195 		mp = ipsq_dq(ipsq);
7196 	}
7197 
7198 	mutex_exit(&ipsq->ipsq_lock);
7199 
7200 	/*
7201 	 * Need to grab the locks in the right order. Need to
7202 	 * atomically check (under ipsq_lock) that there are no
7203 	 * messages before relinquishing the ipsq. Also need to
7204 	 * atomically wakeup waiters on ill_cv while holding ill_lock.
7205 	 * Holding ill_g_lock ensures that ipsq list of ills is stable.
7206 	 * If we need to call ill_split_ipsq and change <ill-ipsq> we need
7207 	 * to grab ill_g_lock as writer.
7208 	 */
7209 	rw_enter(&ill_g_lock, ipsq->ipsq_split ? RW_WRITER : RW_READER);
7210 
7211 	/* ipsq_refs can't change while ill_g_lock is held as reader */
7212 	if (ipsq->ipsq_refs != 0) {
7213 		/* At most 2 ills v4/v6 per phyint */
7214 		cnt = ipsq->ipsq_refs << 1;
7215 		ill_list_size = cnt * sizeof (ill_t *);
7216 		/*
7217 		 * If memory allocation fails, we will do the split
7218 		 * the next time ipsq_exit is called for whatever reason.
7219 		 * As long as the ipsq_split flag is set the need to
7220 		 * split is remembered.
7221 		 */
7222 		ill_list = kmem_zalloc(ill_list_size, KM_NOSLEEP);
7223 		if (ill_list != NULL)
7224 			cnt = ill_lock_ipsq_ills(ipsq, ill_list, cnt);
7225 	}
7226 	mutex_enter(&ipsq->ipsq_lock);
7227 	mp = ipsq_dq(ipsq);
7228 	if (mp != NULL) {
7229 		/* oops, some message has landed up, we can't get out */
7230 		if (ill_list != NULL)
7231 			ill_unlock_ills(ill_list, cnt);
7232 		rw_exit(&ill_g_lock);
7233 		if (ill_list != NULL)
7234 			kmem_free(ill_list, ill_list_size);
7235 		ill_list = NULL;
7236 		ill_list_size = 0;
7237 		cnt = 0;
7238 		goto again;
7239 	}
7240 
7241 	/*
7242 	 * Split only if no ioctl is pending and if memory alloc succeeded
7243 	 * above.
7244 	 */
7245 	if (ipsq->ipsq_split && ipsq->ipsq_current_ipif == NULL &&
7246 		ill_list != NULL) {
7247 		/*
7248 		 * No new ill can join this ipsq since we are holding the
7249 		 * ill_g_lock. Hence ill_split_ipsq can safely traverse the
7250 		 * ipsq. ill_split_ipsq may fail due to memory shortage.
7251 		 * If so we will retry on the next ipsq_exit.
7252 		 */
7253 		ipsq->ipsq_split = ill_split_ipsq(ipsq);
7254 	}
7255 
7256 	/*
7257 	 * We are holding the ipsq lock, hence no new messages can
7258 	 * land up on the ipsq, and there are no messages currently.
7259 	 * Now safe to get out. Wake up waiters and relinquish ipsq
7260 	 * atomically while holding ill locks.
7261 	 */
7262 	ipsq->ipsq_writer = NULL;
7263 	ipsq->ipsq_reentry_cnt--;
7264 	ASSERT(ipsq->ipsq_reentry_cnt == 0);
7265 #ifdef ILL_DEBUG
7266 	ipsq->ipsq_depth = 0;
7267 #endif
7268 	mutex_exit(&ipsq->ipsq_lock);
7269 	/*
7270 	 * For IPMP this should wake up all ills in this ipsq.
7271 	 * We need to hold the ill_lock while waking up waiters to
7272 	 * avoid missed wakeups. But there is no need to acquire all
7273 	 * the ill locks and then wakeup. If we have not acquired all
7274 	 * the locks (due to memory failure above) ill_signal_ipsq_ills
7275 	 * wakes up ills one at a time after getting the right ill_lock
7276 	 */
7277 	ill_signal_ipsq_ills(ipsq, ill_list != NULL);
7278 	if (ill_list != NULL)
7279 		ill_unlock_ills(ill_list, cnt);
7280 	if (ipsq->ipsq_refs == 0)
7281 		need_ipsq_free = B_TRUE;
7282 	rw_exit(&ill_g_lock);
7283 	if (ill_list != 0)
7284 		kmem_free(ill_list, ill_list_size);
7285 
7286 	if (need_ipsq_free) {
7287 		/*
7288 		 * Free the ipsq. ipsq_refs can't increase because ipsq can't be
7289 		 * looked up. ipsq can be looked up only thru ill or phyint
7290 		 * and there are no ills/phyint on this ipsq.
7291 		 */
7292 		ipsq_delete(ipsq);
7293 	}
7294 	/*
7295 	 * Now start any igmp or mld timers that could not be started
7296 	 * while inside the ipsq. The timers can't be started while inside
7297 	 * the ipsq, since igmp_start_timers may need to call untimeout()
7298 	 * which can't be done while holding a lock i.e. the ipsq. Otherwise
7299 	 * there could be a deadlock since the timeout handlers
7300 	 * mld_timeout_handler / igmp_timeout_handler also synchronously
7301 	 * wait in ipsq_enter() trying to get the ipsq.
7302 	 *
7303 	 * However there is one exception to the above. If this thread is
7304 	 * itself the igmp/mld timeout handler thread, then we don't want
7305 	 * to start any new timer until the current handler is done. The
7306 	 * handler thread passes in B_FALSE for start_igmp/mld_timers, while
7307 	 * all others pass B_TRUE.
7308 	 */
7309 	if (start_igmp_timer) {
7310 		mutex_enter(&igmp_timer_lock);
7311 		next = igmp_deferred_next;
7312 		igmp_deferred_next = INFINITY;
7313 		mutex_exit(&igmp_timer_lock);
7314 
7315 		if (next != INFINITY)
7316 			igmp_start_timers(next);
7317 	}
7318 
7319 	if (start_mld_timer) {
7320 		mutex_enter(&mld_timer_lock);
7321 		next = mld_deferred_next;
7322 		mld_deferred_next = INFINITY;
7323 		mutex_exit(&mld_timer_lock);
7324 
7325 		if (next != INFINITY)
7326 			mld_start_timers(next);
7327 	}
7328 }
7329 
7330 /*
7331  * The ill is closing. Flush all messages on the ipsq that originated
7332  * from this ill. Usually there wont' be any messages on the ipsq_xopq_mphead
7333  * for this ill since ipsq_enter could not have entered until then.
7334  * New messages can't be queued since the CONDEMNED flag is set.
7335  */
7336 static void
7337 ipsq_flush(ill_t *ill)
7338 {
7339 	queue_t	*q;
7340 	mblk_t	*prev;
7341 	mblk_t	*mp;
7342 	mblk_t	*mp_next;
7343 	ipsq_t	*ipsq;
7344 
7345 	ASSERT(IAM_WRITER_ILL(ill));
7346 	ipsq = ill->ill_phyint->phyint_ipsq;
7347 	/*
7348 	 * Flush any messages sent up by the driver.
7349 	 */
7350 	mutex_enter(&ipsq->ipsq_lock);
7351 	for (prev = NULL, mp = ipsq->ipsq_mphead; mp != NULL; mp = mp_next) {
7352 		mp_next = mp->b_next;
7353 		q = mp->b_queue;
7354 		if (q == ill->ill_rq || q == ill->ill_wq) {
7355 			/* Remove the mp from the ipsq */
7356 			if (prev == NULL)
7357 				ipsq->ipsq_mphead = mp->b_next;
7358 			else
7359 				prev->b_next = mp->b_next;
7360 			if (ipsq->ipsq_mptail == mp) {
7361 				ASSERT(mp_next == NULL);
7362 				ipsq->ipsq_mptail = prev;
7363 			}
7364 			inet_freemsg(mp);
7365 		} else {
7366 			prev = mp;
7367 		}
7368 	}
7369 	mutex_exit(&ipsq->ipsq_lock);
7370 	(void) ipsq_pending_mp_cleanup(ill, NULL);
7371 	ipsq_xopq_mp_cleanup(ill, NULL);
7372 	ill_pending_mp_cleanup(ill);
7373 }
7374 
7375 /*
7376  * Clean up one squeue element. ill_inuse_ref is protected by ill_lock.
7377  * The real cleanup happens behind the squeue via ip_squeue_clean function but
7378  * we need to protect ourselfs from 2 threads trying to cleanup at the same
7379  * time (possible with one port going down for aggr and someone tearing down the
7380  * entire aggr simultaneously. So we use ill_inuse_ref protected by ill_lock
7381  * to indicate when the cleanup has started (1 ref) and when the cleanup
7382  * is done (0 ref). When a new ring gets assigned to squeue, we start by
7383  * putting 2 ref on ill_inuse_ref.
7384  */
7385 static void
7386 ipsq_clean_ring(ill_t *ill, ill_rx_ring_t *rx_ring)
7387 {
7388 	conn_t *connp;
7389 	squeue_t *sqp;
7390 	mblk_t *mp;
7391 
7392 	ASSERT(rx_ring != NULL);
7393 
7394 	/* Just clean one squeue */
7395 	mutex_enter(&ill->ill_lock);
7396 	/*
7397 	 * Reset the ILL_SOFT_RING_ASSIGN bit so that
7398 	 * ip_squeue_soft_ring_affinty() will not go
7399 	 * ahead with assigning rings.
7400 	 */
7401 	ill->ill_state_flags &= ~ILL_SOFT_RING_ASSIGN;
7402 	while (rx_ring->rr_ring_state == ILL_RING_INPROC)
7403 		/* Some operations pending on the ring. Wait */
7404 		cv_wait(&ill->ill_cv, &ill->ill_lock);
7405 
7406 	if (rx_ring->rr_ring_state != ILL_RING_INUSE) {
7407 		/*
7408 		 * Someone already trying to clean
7409 		 * this squeue or its already been cleaned.
7410 		 */
7411 		mutex_exit(&ill->ill_lock);
7412 		return;
7413 	}
7414 	sqp = rx_ring->rr_sqp;
7415 
7416 	if (sqp == NULL) {
7417 		/*
7418 		 * The rx_ring never had a squeue assigned to it.
7419 		 * We are under ill_lock so we can clean it up
7420 		 * here itself since no one can get to it.
7421 		 */
7422 		rx_ring->rr_blank = NULL;
7423 		rx_ring->rr_handle = NULL;
7424 		rx_ring->rr_sqp = NULL;
7425 		rx_ring->rr_ring_state = ILL_RING_FREE;
7426 		mutex_exit(&ill->ill_lock);
7427 		return;
7428 	}
7429 
7430 	/* Set the state that its being cleaned */
7431 	rx_ring->rr_ring_state = ILL_RING_BEING_FREED;
7432 	ASSERT(sqp != NULL);
7433 	mutex_exit(&ill->ill_lock);
7434 
7435 	/*
7436 	 * Use the preallocated ill_unbind_conn for this purpose
7437 	 */
7438 	connp = ill->ill_dls_capab->ill_unbind_conn;
7439 	mp = &connp->conn_tcp->tcp_closemp;
7440 	CONN_INC_REF(connp);
7441 	squeue_enter(sqp, mp, ip_squeue_clean, connp, NULL);
7442 
7443 	mutex_enter(&ill->ill_lock);
7444 	while (rx_ring->rr_ring_state != ILL_RING_FREE)
7445 		cv_wait(&ill->ill_cv, &ill->ill_lock);
7446 
7447 	mutex_exit(&ill->ill_lock);
7448 }
7449 
7450 static void
7451 ipsq_clean_all(ill_t *ill)
7452 {
7453 	int idx;
7454 
7455 	/*
7456 	 * No need to clean if poll_capab isn't set for this ill
7457 	 */
7458 	if (!(ill->ill_capabilities & (ILL_CAPAB_POLL|ILL_CAPAB_SOFT_RING)))
7459 		return;
7460 
7461 	for (idx = 0; idx < ILL_MAX_RINGS; idx++) {
7462 		ill_rx_ring_t *ipr = &ill->ill_dls_capab->ill_ring_tbl[idx];
7463 		ipsq_clean_ring(ill, ipr);
7464 	}
7465 
7466 	ill->ill_capabilities &= ~(ILL_CAPAB_POLL|ILL_CAPAB_SOFT_RING);
7467 }
7468 
7469 /* ARGSUSED */
7470 int
7471 ip_sioctl_slifoindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
7472     ip_ioctl_cmd_t *ipip, void *ifreq)
7473 {
7474 	ill_t	*ill;
7475 	struct lifreq	*lifr = (struct lifreq *)ifreq;
7476 	boolean_t isv6;
7477 	conn_t	*connp;
7478 
7479 	connp = Q_TO_CONN(q);
7480 	isv6 = connp->conn_af_isv6;
7481 	/*
7482 	 * Set original index.
7483 	 * Failover and failback move logical interfaces
7484 	 * from one physical interface to another.  The
7485 	 * original index indicates the parent of a logical
7486 	 * interface, in other words, the physical interface
7487 	 * the logical interface will be moved back to on
7488 	 * failback.
7489 	 */
7490 
7491 	/*
7492 	 * Don't allow the original index to be changed
7493 	 * for non-failover addresses, autoconfigured
7494 	 * addresses, or IPv6 link local addresses.
7495 	 */
7496 	if (((ipif->ipif_flags & (IPIF_NOFAILOVER | IPIF_ADDRCONF)) != NULL) ||
7497 	    (isv6 && IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6lcl_addr))) {
7498 		return (EINVAL);
7499 	}
7500 	/*
7501 	 * The new original index must be in use by some
7502 	 * physical interface.
7503 	 */
7504 	ill = ill_lookup_on_ifindex(lifr->lifr_index, isv6, NULL, NULL,
7505 	    NULL, NULL);
7506 	if (ill == NULL)
7507 		return (ENXIO);
7508 	ill_refrele(ill);
7509 
7510 	ipif->ipif_orig_ifindex = lifr->lifr_index;
7511 	/*
7512 	 * When this ipif gets failed back, don't
7513 	 * preserve the original id, as it is no
7514 	 * longer applicable.
7515 	 */
7516 	ipif->ipif_orig_ipifid = 0;
7517 	/*
7518 	 * For IPv4, change the original index of any
7519 	 * multicast addresses associated with the
7520 	 * ipif to the new value.
7521 	 */
7522 	if (!isv6) {
7523 		ilm_t *ilm;
7524 
7525 		mutex_enter(&ipif->ipif_ill->ill_lock);
7526 		for (ilm = ipif->ipif_ill->ill_ilm; ilm != NULL;
7527 		    ilm = ilm->ilm_next) {
7528 			if (ilm->ilm_ipif == ipif) {
7529 				ilm->ilm_orig_ifindex = lifr->lifr_index;
7530 			}
7531 		}
7532 		mutex_exit(&ipif->ipif_ill->ill_lock);
7533 	}
7534 	return (0);
7535 }
7536 
7537 /* ARGSUSED */
7538 int
7539 ip_sioctl_get_oindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
7540     ip_ioctl_cmd_t *ipip, void *ifreq)
7541 {
7542 	struct lifreq *lifr = (struct lifreq *)ifreq;
7543 
7544 	/*
7545 	 * Get the original interface index i.e the one
7546 	 * before FAILOVER if it ever happened.
7547 	 */
7548 	lifr->lifr_index = ipif->ipif_orig_ifindex;
7549 	return (0);
7550 }
7551 
7552 /*
7553  * Parse an iftun_req structure coming down SIOC[GS]TUNPARAM ioctls,
7554  * refhold and return the associated ipif
7555  */
7556 int
7557 ip_extract_tunreq(queue_t *q, mblk_t *mp, ipif_t **ipifp, ipsq_func_t func)
7558 {
7559 	boolean_t exists;
7560 	struct iftun_req *ta;
7561 	ipif_t	*ipif;
7562 	ill_t	*ill;
7563 	boolean_t isv6;
7564 	mblk_t	*mp1;
7565 	int	error;
7566 	conn_t	*connp;
7567 
7568 	/* Existence verified in ip_wput_nondata */
7569 	mp1 = mp->b_cont->b_cont;
7570 	ta = (struct iftun_req *)mp1->b_rptr;
7571 	/*
7572 	 * Null terminate the string to protect against buffer
7573 	 * overrun. String was generated by user code and may not
7574 	 * be trusted.
7575 	 */
7576 	ta->ifta_lifr_name[LIFNAMSIZ - 1] = '\0';
7577 
7578 	connp = Q_TO_CONN(q);
7579 	isv6 = connp->conn_af_isv6;
7580 
7581 	/* Disallows implicit create */
7582 	ipif = ipif_lookup_on_name(ta->ifta_lifr_name,
7583 	    mi_strlen(ta->ifta_lifr_name), B_FALSE, &exists, isv6,
7584 	    connp->conn_zoneid, CONNP_TO_WQ(connp), mp, func, &error);
7585 	if (ipif == NULL)
7586 		return (error);
7587 
7588 	if (ipif->ipif_id != 0) {
7589 		/*
7590 		 * We really don't want to set/get tunnel parameters
7591 		 * on virtual tunnel interfaces.  Only allow the
7592 		 * base tunnel to do these.
7593 		 */
7594 		ipif_refrele(ipif);
7595 		return (EINVAL);
7596 	}
7597 
7598 	/*
7599 	 * Send down to tunnel mod for ioctl processing.
7600 	 * Will finish ioctl in ip_rput_other().
7601 	 */
7602 	ill = ipif->ipif_ill;
7603 	if (ill->ill_net_type == IRE_LOOPBACK) {
7604 		ipif_refrele(ipif);
7605 		return (EOPNOTSUPP);
7606 	}
7607 
7608 	if (ill->ill_wq == NULL) {
7609 		ipif_refrele(ipif);
7610 		return (ENXIO);
7611 	}
7612 	/*
7613 	 * Mark the ioctl as coming from an IPv6 interface for
7614 	 * tun's convenience.
7615 	 */
7616 	if (ill->ill_isv6)
7617 		ta->ifta_flags |= 0x80000000;
7618 	*ipifp = ipif;
7619 	return (0);
7620 }
7621 
7622 /*
7623  * Parse an ifreq or lifreq struct coming down ioctls and refhold
7624  * and return the associated ipif.
7625  * Return value:
7626  *	Non zero: An error has occurred. ci may not be filled out.
7627  *	zero : ci is filled out with the ioctl cmd in ci.ci_name, and
7628  *	a held ipif in ci.ci_ipif.
7629  */
7630 int
7631 ip_extract_lifreq_cmn(queue_t *q, mblk_t *mp, int cmd_type, int flags,
7632     cmd_info_t *ci, ipsq_func_t func)
7633 {
7634 	sin_t		*sin;
7635 	sin6_t		*sin6;
7636 	char		*name;
7637 	struct ifreq    *ifr;
7638 	struct lifreq    *lifr;
7639 	ipif_t		*ipif = NULL;
7640 	ill_t		*ill;
7641 	conn_t		*connp;
7642 	boolean_t	isv6;
7643 	struct iocblk   *iocp = (struct iocblk *)mp->b_rptr;
7644 	boolean_t	exists;
7645 	int		err;
7646 	mblk_t		*mp1;
7647 	zoneid_t	zoneid;
7648 
7649 	if (q->q_next != NULL) {
7650 		ill = (ill_t *)q->q_ptr;
7651 		isv6 = ill->ill_isv6;
7652 		connp = NULL;
7653 		zoneid = ALL_ZONES;
7654 	} else {
7655 		ill = NULL;
7656 		connp = Q_TO_CONN(q);
7657 		isv6 = connp->conn_af_isv6;
7658 		zoneid = connp->conn_zoneid;
7659 		if (zoneid == GLOBAL_ZONEID) {
7660 			/* global zone can access ipifs in all zones */
7661 			zoneid = ALL_ZONES;
7662 		}
7663 	}
7664 
7665 	/* Has been checked in ip_wput_nondata */
7666 	mp1 = mp->b_cont->b_cont;
7667 
7668 
7669 	if (cmd_type == IF_CMD) {
7670 		/* This a old style SIOC[GS]IF* command */
7671 		ifr = (struct ifreq *)mp1->b_rptr;
7672 		/*
7673 		 * Null terminate the string to protect against buffer
7674 		 * overrun. String was generated by user code and may not
7675 		 * be trusted.
7676 		 */
7677 		ifr->ifr_name[IFNAMSIZ - 1] = '\0';
7678 		sin = (sin_t *)&ifr->ifr_addr;
7679 		name = ifr->ifr_name;
7680 		ci->ci_sin = sin;
7681 		ci->ci_sin6 = NULL;
7682 		ci->ci_lifr = (struct lifreq *)ifr;
7683 	} else {
7684 		/* This a new style SIOC[GS]LIF* command */
7685 		ASSERT(cmd_type == LIF_CMD);
7686 		lifr = (struct lifreq *)mp1->b_rptr;
7687 		/*
7688 		 * Null terminate the string to protect against buffer
7689 		 * overrun. String was generated by user code and may not
7690 		 * be trusted.
7691 		 */
7692 		lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
7693 		name = lifr->lifr_name;
7694 		sin = (sin_t *)&lifr->lifr_addr;
7695 		sin6 = (sin6_t *)&lifr->lifr_addr;
7696 		if (iocp->ioc_cmd == SIOCSLIFGROUPNAME) {
7697 			(void) strncpy(ci->ci_groupname, lifr->lifr_groupname,
7698 			    LIFNAMSIZ);
7699 		}
7700 		ci->ci_sin = sin;
7701 		ci->ci_sin6 = sin6;
7702 		ci->ci_lifr = lifr;
7703 	}
7704 
7705 
7706 	if (iocp->ioc_cmd == SIOCSLIFNAME) {
7707 		/*
7708 		 * The ioctl will be failed if the ioctl comes down
7709 		 * an conn stream
7710 		 */
7711 		if (ill == NULL) {
7712 			/*
7713 			 * Not an ill queue, return EINVAL same as the
7714 			 * old error code.
7715 			 */
7716 			return (ENXIO);
7717 		}
7718 		ipif = ill->ill_ipif;
7719 		ipif_refhold(ipif);
7720 	} else {
7721 		ipif = ipif_lookup_on_name(name, mi_strlen(name), B_FALSE,
7722 		    &exists, isv6, zoneid,
7723 		    (connp == NULL) ? q : CONNP_TO_WQ(connp), mp, func, &err);
7724 		if (ipif == NULL) {
7725 			if (err == EINPROGRESS)
7726 				return (err);
7727 			if (iocp->ioc_cmd == SIOCLIFFAILOVER ||
7728 			    iocp->ioc_cmd == SIOCLIFFAILBACK) {
7729 				/*
7730 				 * Need to try both v4 and v6 since this
7731 				 * ioctl can come down either v4 or v6
7732 				 * socket. The lifreq.lifr_family passed
7733 				 * down by this ioctl is AF_UNSPEC.
7734 				 */
7735 				ipif = ipif_lookup_on_name(name,
7736 				    mi_strlen(name), B_FALSE, &exists, !isv6,
7737 				    zoneid, (connp == NULL) ? q :
7738 				    CONNP_TO_WQ(connp), mp, func, &err);
7739 				if (err == EINPROGRESS)
7740 					return (err);
7741 			}
7742 			err = 0;	/* Ensure we don't use it below */
7743 		}
7744 	}
7745 
7746 	/*
7747 	 * Old style [GS]IFCMD does not admit IPv6 ipif
7748 	 */
7749 	if (ipif != NULL && ipif->ipif_isv6 && cmd_type == IF_CMD) {
7750 		ipif_refrele(ipif);
7751 		return (ENXIO);
7752 	}
7753 
7754 	if (ipif == NULL && ill != NULL && ill->ill_ipif != NULL &&
7755 	    name[0] == '\0') {
7756 		/*
7757 		 * Handle a or a SIOC?IF* with a null name
7758 		 * during plumb (on the ill queue before the I_PLINK).
7759 		 */
7760 		ipif = ill->ill_ipif;
7761 		ipif_refhold(ipif);
7762 	}
7763 
7764 	if (ipif == NULL)
7765 		return (ENXIO);
7766 
7767 	/*
7768 	 * Allow only GET operations if this ipif has been created
7769 	 * temporarily due to a MOVE operation.
7770 	 */
7771 	if (ipif->ipif_replace_zero && !(flags & IPI_REPL)) {
7772 		ipif_refrele(ipif);
7773 		return (EINVAL);
7774 	}
7775 
7776 	ci->ci_ipif = ipif;
7777 	return (0);
7778 }
7779 
7780 /*
7781  * Return the total number of ipifs.
7782  */
7783 static uint_t
7784 ip_get_numifs(zoneid_t zoneid)
7785 {
7786 	uint_t numifs = 0;
7787 	ill_t	*ill;
7788 	ill_walk_context_t	ctx;
7789 	ipif_t	*ipif;
7790 
7791 	rw_enter(&ill_g_lock, RW_READER);
7792 	ill = ILL_START_WALK_V4(&ctx);
7793 
7794 	while (ill != NULL) {
7795 		for (ipif = ill->ill_ipif; ipif != NULL;
7796 		    ipif = ipif->ipif_next) {
7797 			if (ipif->ipif_zoneid == zoneid)
7798 				numifs++;
7799 		}
7800 		ill = ill_next(&ctx, ill);
7801 	}
7802 	rw_exit(&ill_g_lock);
7803 	return (numifs);
7804 }
7805 
7806 /*
7807  * Return the total number of ipifs.
7808  */
7809 static uint_t
7810 ip_get_numlifs(int family, int lifn_flags, zoneid_t zoneid)
7811 {
7812 	uint_t numifs = 0;
7813 	ill_t	*ill;
7814 	ipif_t	*ipif;
7815 	ill_walk_context_t	ctx;
7816 
7817 	ip1dbg(("ip_get_numlifs(%d %u %d)\n", family, lifn_flags, (int)zoneid));
7818 
7819 	rw_enter(&ill_g_lock, RW_READER);
7820 	if (family == AF_INET)
7821 		ill = ILL_START_WALK_V4(&ctx);
7822 	else if (family == AF_INET6)
7823 		ill = ILL_START_WALK_V6(&ctx);
7824 	else
7825 		ill = ILL_START_WALK_ALL(&ctx);
7826 
7827 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7828 		for (ipif = ill->ill_ipif; ipif != NULL;
7829 		    ipif = ipif->ipif_next) {
7830 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
7831 			    !(lifn_flags & LIFC_NOXMIT))
7832 				continue;
7833 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
7834 			    !(lifn_flags & LIFC_TEMPORARY))
7835 				continue;
7836 			if (((ipif->ipif_flags &
7837 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
7838 			    IPIF_DEPRECATED)) ||
7839 			    (ill->ill_phyint->phyint_flags &
7840 			    PHYI_LOOPBACK) ||
7841 			    !(ipif->ipif_flags & IPIF_UP)) &&
7842 			    (lifn_flags & LIFC_EXTERNAL_SOURCE))
7843 				continue;
7844 
7845 			if (zoneid != ipif->ipif_zoneid &&
7846 			    (zoneid != GLOBAL_ZONEID ||
7847 			    !(lifn_flags & LIFC_ALLZONES)))
7848 				continue;
7849 
7850 			numifs++;
7851 		}
7852 	}
7853 	rw_exit(&ill_g_lock);
7854 	return (numifs);
7855 }
7856 
7857 uint_t
7858 ip_get_lifsrcofnum(ill_t *ill)
7859 {
7860 	uint_t numifs = 0;
7861 	ill_t	*ill_head = ill;
7862 
7863 	/*
7864 	 * ill_g_usesrc_lock protects ill_usesrc_grp_next, for example, some
7865 	 * other thread may be trying to relink the ILLs in this usesrc group
7866 	 * and adjusting the ill_usesrc_grp_next pointers
7867 	 */
7868 	rw_enter(&ill_g_usesrc_lock, RW_READER);
7869 	if ((ill->ill_usesrc_ifindex == 0) &&
7870 	    (ill->ill_usesrc_grp_next != NULL)) {
7871 		for (; (ill != NULL) && (ill->ill_usesrc_grp_next != ill_head);
7872 		    ill = ill->ill_usesrc_grp_next)
7873 			numifs++;
7874 	}
7875 	rw_exit(&ill_g_usesrc_lock);
7876 
7877 	return (numifs);
7878 }
7879 
7880 /* Null values are passed in for ipif, sin, and ifreq */
7881 /* ARGSUSED */
7882 int
7883 ip_sioctl_get_ifnum(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7884     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7885 {
7886 	int *nump;
7887 
7888 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
7889 
7890 	/* Existence of b_cont->b_cont checked in ip_wput_nondata */
7891 	nump = (int *)mp->b_cont->b_cont->b_rptr;
7892 
7893 	*nump = ip_get_numifs(Q_TO_CONN(q)->conn_zoneid);
7894 	ip1dbg(("ip_sioctl_get_ifnum numifs %d", *nump));
7895 	return (0);
7896 }
7897 
7898 /* Null values are passed in for ipif, sin, and ifreq */
7899 /* ARGSUSED */
7900 int
7901 ip_sioctl_get_lifnum(ipif_t *dummy_ipif, sin_t *dummy_sin,
7902     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7903 {
7904 	struct lifnum *lifn;
7905 	mblk_t	*mp1;
7906 
7907 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
7908 
7909 	/* Existence checked in ip_wput_nondata */
7910 	mp1 = mp->b_cont->b_cont;
7911 
7912 	lifn = (struct lifnum *)mp1->b_rptr;
7913 	switch (lifn->lifn_family) {
7914 	case AF_UNSPEC:
7915 	case AF_INET:
7916 	case AF_INET6:
7917 		break;
7918 	default:
7919 		return (EAFNOSUPPORT);
7920 	}
7921 
7922 	lifn->lifn_count = ip_get_numlifs(lifn->lifn_family, lifn->lifn_flags,
7923 	    Q_TO_CONN(q)->conn_zoneid);
7924 	ip1dbg(("ip_sioctl_get_lifnum numifs %d", lifn->lifn_count));
7925 	return (0);
7926 }
7927 
7928 /* ARGSUSED */
7929 int
7930 ip_sioctl_get_ifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7931     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7932 {
7933 	STRUCT_HANDLE(ifconf, ifc);
7934 	mblk_t *mp1;
7935 	struct iocblk *iocp;
7936 	struct ifreq *ifr;
7937 	ill_walk_context_t	ctx;
7938 	ill_t	*ill;
7939 	ipif_t	*ipif;
7940 	struct sockaddr_in *sin;
7941 	int32_t	ifclen;
7942 	zoneid_t zoneid;
7943 
7944 	ASSERT(q->q_next == NULL); /* not valid ioctls for ip as a module */
7945 
7946 	ip1dbg(("ip_sioctl_get_ifconf"));
7947 	/* Existence verified in ip_wput_nondata */
7948 	mp1 = mp->b_cont->b_cont;
7949 	iocp = (struct iocblk *)mp->b_rptr;
7950 	zoneid = Q_TO_CONN(q)->conn_zoneid;
7951 
7952 	/*
7953 	 * The original SIOCGIFCONF passed in a struct ifconf which specified
7954 	 * the user buffer address and length into which the list of struct
7955 	 * ifreqs was to be copied.  Since AT&T Streams does not seem to
7956 	 * allow M_COPYOUT to be used in conjunction with I_STR IOCTLS,
7957 	 * the SIOCGIFCONF operation was redefined to simply provide
7958 	 * a large output buffer into which we are supposed to jam the ifreq
7959 	 * array.  The same ioctl command code was used, despite the fact that
7960 	 * both the applications and the kernel code had to change, thus making
7961 	 * it impossible to support both interfaces.
7962 	 *
7963 	 * For reasons not good enough to try to explain, the following
7964 	 * algorithm is used for deciding what to do with one of these:
7965 	 * If the IOCTL comes in as an I_STR, it is assumed to be of the new
7966 	 * form with the output buffer coming down as the continuation message.
7967 	 * If it arrives as a TRANSPARENT IOCTL, it is assumed to be old style,
7968 	 * and we have to copy in the ifconf structure to find out how big the
7969 	 * output buffer is and where to copy out to.  Sure no problem...
7970 	 *
7971 	 */
7972 	STRUCT_SET_HANDLE(ifc, iocp->ioc_flag, NULL);
7973 	if ((mp1->b_wptr - mp1->b_rptr) == STRUCT_SIZE(ifc)) {
7974 		int numifs = 0;
7975 		size_t ifc_bufsize;
7976 
7977 		/*
7978 		 * Must be (better be!) continuation of a TRANSPARENT
7979 		 * IOCTL.  We just copied in the ifconf structure.
7980 		 */
7981 		STRUCT_SET_HANDLE(ifc, iocp->ioc_flag,
7982 		    (struct ifconf *)mp1->b_rptr);
7983 
7984 		/*
7985 		 * Allocate a buffer to hold requested information.
7986 		 *
7987 		 * If ifc_len is larger than what is needed, we only
7988 		 * allocate what we will use.
7989 		 *
7990 		 * If ifc_len is smaller than what is needed, return
7991 		 * EINVAL.
7992 		 *
7993 		 * XXX: the ill_t structure can hava 2 counters, for
7994 		 * v4 and v6 (not just ill_ipif_up_count) to store the
7995 		 * number of interfaces for a device, so we don't need
7996 		 * to count them here...
7997 		 */
7998 		numifs = ip_get_numifs(zoneid);
7999 
8000 		ifclen = STRUCT_FGET(ifc, ifc_len);
8001 		ifc_bufsize = numifs * sizeof (struct ifreq);
8002 		if (ifc_bufsize > ifclen) {
8003 			if (iocp->ioc_cmd == O_SIOCGIFCONF) {
8004 				/* old behaviour */
8005 				return (EINVAL);
8006 			} else {
8007 				ifc_bufsize = ifclen;
8008 			}
8009 		}
8010 
8011 		mp1 = mi_copyout_alloc(q, mp,
8012 		    STRUCT_FGETP(ifc, ifc_buf), ifc_bufsize, B_FALSE);
8013 		if (mp1 == NULL)
8014 			return (ENOMEM);
8015 
8016 		mp1->b_wptr = mp1->b_rptr + ifc_bufsize;
8017 	}
8018 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
8019 	/*
8020 	 * the SIOCGIFCONF ioctl only knows about
8021 	 * IPv4 addresses, so don't try to tell
8022 	 * it about interfaces with IPv6-only
8023 	 * addresses. (Last parm 'isv6' is B_FALSE)
8024 	 */
8025 
8026 	ifr = (struct ifreq *)mp1->b_rptr;
8027 
8028 	rw_enter(&ill_g_lock, RW_READER);
8029 	ill = ILL_START_WALK_V4(&ctx);
8030 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8031 		for (ipif = ill->ill_ipif; ipif;
8032 		    ipif = ipif->ipif_next) {
8033 			if (zoneid != ipif->ipif_zoneid)
8034 				continue;
8035 			if ((uchar_t *)&ifr[1] > mp1->b_wptr) {
8036 				if (iocp->ioc_cmd == O_SIOCGIFCONF) {
8037 					/* old behaviour */
8038 					rw_exit(&ill_g_lock);
8039 					return (EINVAL);
8040 				} else {
8041 					goto if_copydone;
8042 				}
8043 			}
8044 			(void) ipif_get_name(ipif,
8045 			    ifr->ifr_name,
8046 			    sizeof (ifr->ifr_name));
8047 			sin = (sin_t *)&ifr->ifr_addr;
8048 			*sin = sin_null;
8049 			sin->sin_family = AF_INET;
8050 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
8051 			ifr++;
8052 		}
8053 	}
8054 if_copydone:
8055 	rw_exit(&ill_g_lock);
8056 	mp1->b_wptr = (uchar_t *)ifr;
8057 
8058 	if (STRUCT_BUF(ifc) != NULL) {
8059 		STRUCT_FSET(ifc, ifc_len,
8060 			(int)((uchar_t *)ifr - mp1->b_rptr));
8061 	}
8062 	return (0);
8063 }
8064 
8065 /*
8066  * Get the interfaces using the address hosted on the interface passed in,
8067  * as a source adddress
8068  */
8069 /* ARGSUSED */
8070 int
8071 ip_sioctl_get_lifsrcof(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8072     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8073 {
8074 	mblk_t *mp1;
8075 	ill_t	*ill, *ill_head;
8076 	ipif_t	*ipif, *orig_ipif;
8077 	int	numlifs = 0;
8078 	size_t	lifs_bufsize, lifsmaxlen;
8079 	struct	lifreq *lifr;
8080 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8081 	uint_t	ifindex;
8082 	zoneid_t zoneid;
8083 	int err = 0;
8084 	boolean_t isv6 = B_FALSE;
8085 	struct	sockaddr_in	*sin;
8086 	struct	sockaddr_in6	*sin6;
8087 
8088 	STRUCT_HANDLE(lifsrcof, lifs);
8089 
8090 	ASSERT(q->q_next == NULL);
8091 
8092 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8093 
8094 	/* Existence verified in ip_wput_nondata */
8095 	mp1 = mp->b_cont->b_cont;
8096 
8097 	/*
8098 	 * Must be (better be!) continuation of a TRANSPARENT
8099 	 * IOCTL.  We just copied in the lifsrcof structure.
8100 	 */
8101 	STRUCT_SET_HANDLE(lifs, iocp->ioc_flag,
8102 	    (struct lifsrcof *)mp1->b_rptr);
8103 
8104 	if (MBLKL(mp1) != STRUCT_SIZE(lifs))
8105 		return (EINVAL);
8106 
8107 	ifindex = STRUCT_FGET(lifs, lifs_ifindex);
8108 	isv6 = (Q_TO_CONN(q))->conn_af_isv6;
8109 	ipif = ipif_lookup_on_ifindex(ifindex, isv6, zoneid, q, mp,
8110 	    ip_process_ioctl, &err);
8111 	if (ipif == NULL) {
8112 		ip1dbg(("ip_sioctl_get_lifsrcof: no ipif for ifindex %d\n",
8113 		    ifindex));
8114 		return (err);
8115 	}
8116 
8117 
8118 	/* Allocate a buffer to hold requested information */
8119 	numlifs = ip_get_lifsrcofnum(ipif->ipif_ill);
8120 	lifs_bufsize = numlifs * sizeof (struct lifreq);
8121 	lifsmaxlen =  STRUCT_FGET(lifs, lifs_maxlen);
8122 	/* The actual size needed is always returned in lifs_len */
8123 	STRUCT_FSET(lifs, lifs_len, lifs_bufsize);
8124 
8125 	/* If the amount we need is more than what is passed in, abort */
8126 	if (lifs_bufsize > lifsmaxlen || lifs_bufsize == 0) {
8127 		ipif_refrele(ipif);
8128 		return (0);
8129 	}
8130 
8131 	mp1 = mi_copyout_alloc(q, mp,
8132 	    STRUCT_FGETP(lifs, lifs_buf), lifs_bufsize, B_FALSE);
8133 	if (mp1 == NULL) {
8134 		ipif_refrele(ipif);
8135 		return (ENOMEM);
8136 	}
8137 
8138 	mp1->b_wptr = mp1->b_rptr + lifs_bufsize;
8139 	bzero(mp1->b_rptr, lifs_bufsize);
8140 
8141 	lifr = (struct lifreq *)mp1->b_rptr;
8142 
8143 	ill = ill_head = ipif->ipif_ill;
8144 	orig_ipif = ipif;
8145 
8146 	/* ill_g_usesrc_lock protects ill_usesrc_grp_next */
8147 	rw_enter(&ill_g_usesrc_lock, RW_READER);
8148 	rw_enter(&ill_g_lock, RW_READER);
8149 
8150 	ill = ill->ill_usesrc_grp_next; /* start from next ill */
8151 	for (; (ill != NULL) && (ill != ill_head);
8152 	    ill = ill->ill_usesrc_grp_next) {
8153 
8154 		if ((uchar_t *)&lifr[1] > mp1->b_wptr)
8155 			break;
8156 
8157 		ipif = ill->ill_ipif;
8158 		(void) ipif_get_name(ipif,
8159 		    lifr->lifr_name, sizeof (lifr->lifr_name));
8160 		if (ipif->ipif_isv6) {
8161 			sin6 = (sin6_t *)&lifr->lifr_addr;
8162 			*sin6 = sin6_null;
8163 			sin6->sin6_family = AF_INET6;
8164 			sin6->sin6_addr = ipif->ipif_v6lcl_addr;
8165 			lifr->lifr_addrlen = ip_mask_to_plen_v6(
8166 			    &ipif->ipif_v6net_mask);
8167 		} else {
8168 			sin = (sin_t *)&lifr->lifr_addr;
8169 			*sin = sin_null;
8170 			sin->sin_family = AF_INET;
8171 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
8172 			lifr->lifr_addrlen = ip_mask_to_plen(
8173 			    ipif->ipif_net_mask);
8174 		}
8175 		lifr++;
8176 	}
8177 	rw_exit(&ill_g_usesrc_lock);
8178 	rw_exit(&ill_g_lock);
8179 	ipif_refrele(orig_ipif);
8180 	mp1->b_wptr = (uchar_t *)lifr;
8181 	STRUCT_FSET(lifs, lifs_len, (int)((uchar_t *)lifr - mp1->b_rptr));
8182 
8183 	return (0);
8184 }
8185 
8186 /* ARGSUSED */
8187 int
8188 ip_sioctl_get_lifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8189     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8190 {
8191 	mblk_t *mp1;
8192 	int	list;
8193 	ill_t	*ill;
8194 	ipif_t	*ipif;
8195 	int	flags;
8196 	int	numlifs = 0;
8197 	size_t	lifc_bufsize;
8198 	struct	lifreq *lifr;
8199 	sa_family_t	family;
8200 	struct	sockaddr_in	*sin;
8201 	struct	sockaddr_in6	*sin6;
8202 	ill_walk_context_t	ctx;
8203 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8204 	int32_t	lifclen;
8205 	zoneid_t zoneid;
8206 	STRUCT_HANDLE(lifconf, lifc);
8207 
8208 	ip1dbg(("ip_sioctl_get_lifconf"));
8209 
8210 	ASSERT(q->q_next == NULL);
8211 
8212 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8213 
8214 	/* Existence verified in ip_wput_nondata */
8215 	mp1 = mp->b_cont->b_cont;
8216 
8217 	/*
8218 	 * An extended version of SIOCGIFCONF that takes an
8219 	 * additional address family and flags field.
8220 	 * AF_UNSPEC retrieve both IPv4 and IPv6.
8221 	 * Unless LIFC_NOXMIT is specified the IPIF_NOXMIT
8222 	 * interfaces are omitted.
8223 	 * Similarly, IPIF_TEMPORARY interfaces are omitted
8224 	 * unless LIFC_TEMPORARY is specified.
8225 	 * If LIFC_EXTERNAL_SOURCE is specified, IPIF_NOXMIT,
8226 	 * IPIF_NOLOCAL, PHYI_LOOPBACK, IPIF_DEPRECATED and
8227 	 * not IPIF_UP interfaces are omitted. LIFC_EXTERNAL_SOURCE
8228 	 * has priority over LIFC_NOXMIT.
8229 	 */
8230 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, NULL);
8231 
8232 	if ((mp1->b_wptr - mp1->b_rptr) != STRUCT_SIZE(lifc))
8233 		return (EINVAL);
8234 
8235 	/*
8236 	 * Must be (better be!) continuation of a TRANSPARENT
8237 	 * IOCTL.  We just copied in the lifconf structure.
8238 	 */
8239 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, (struct lifconf *)mp1->b_rptr);
8240 
8241 	family = STRUCT_FGET(lifc, lifc_family);
8242 	flags = STRUCT_FGET(lifc, lifc_flags);
8243 
8244 	switch (family) {
8245 	case AF_UNSPEC:
8246 		/*
8247 		 * walk all ILL's.
8248 		 */
8249 		list = MAX_G_HEADS;
8250 		break;
8251 	case AF_INET:
8252 		/*
8253 		 * walk only IPV4 ILL's.
8254 		 */
8255 		list = IP_V4_G_HEAD;
8256 		break;
8257 	case AF_INET6:
8258 		/*
8259 		 * walk only IPV6 ILL's.
8260 		 */
8261 		list = IP_V6_G_HEAD;
8262 		break;
8263 	default:
8264 		return (EAFNOSUPPORT);
8265 	}
8266 
8267 	/*
8268 	 * Allocate a buffer to hold requested information.
8269 	 *
8270 	 * If lifc_len is larger than what is needed, we only
8271 	 * allocate what we will use.
8272 	 *
8273 	 * If lifc_len is smaller than what is needed, return
8274 	 * EINVAL.
8275 	 */
8276 	numlifs = ip_get_numlifs(family, flags, zoneid);
8277 	lifc_bufsize = numlifs * sizeof (struct lifreq);
8278 	lifclen = STRUCT_FGET(lifc, lifc_len);
8279 	if (lifc_bufsize > lifclen) {
8280 		if (iocp->ioc_cmd == O_SIOCGLIFCONF)
8281 			return (EINVAL);
8282 		else
8283 			lifc_bufsize = lifclen;
8284 	}
8285 
8286 	mp1 = mi_copyout_alloc(q, mp,
8287 	    STRUCT_FGETP(lifc, lifc_buf), lifc_bufsize, B_FALSE);
8288 	if (mp1 == NULL)
8289 		return (ENOMEM);
8290 
8291 	mp1->b_wptr = mp1->b_rptr + lifc_bufsize;
8292 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
8293 
8294 	lifr = (struct lifreq *)mp1->b_rptr;
8295 
8296 	rw_enter(&ill_g_lock, RW_READER);
8297 	ill = ill_first(list, list, &ctx);
8298 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8299 		for (ipif = ill->ill_ipif; ipif != NULL;
8300 		    ipif = ipif->ipif_next) {
8301 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
8302 			    !(flags & LIFC_NOXMIT))
8303 				continue;
8304 
8305 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
8306 			    !(flags & LIFC_TEMPORARY))
8307 				continue;
8308 
8309 			if (((ipif->ipif_flags &
8310 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
8311 			    IPIF_DEPRECATED)) ||
8312 			    (ill->ill_phyint->phyint_flags &
8313 			    PHYI_LOOPBACK) ||
8314 			    !(ipif->ipif_flags & IPIF_UP)) &&
8315 			    (flags & LIFC_EXTERNAL_SOURCE))
8316 				continue;
8317 
8318 			if (zoneid != ipif->ipif_zoneid &&
8319 			    (zoneid != GLOBAL_ZONEID ||
8320 			    !(flags & LIFC_ALLZONES)))
8321 				continue;
8322 
8323 			if ((uchar_t *)&lifr[1] > mp1->b_wptr) {
8324 				if (iocp->ioc_cmd == O_SIOCGLIFCONF) {
8325 					rw_exit(&ill_g_lock);
8326 					return (EINVAL);
8327 				} else {
8328 					goto lif_copydone;
8329 				}
8330 			}
8331 
8332 			(void) ipif_get_name(ipif,
8333 				lifr->lifr_name,
8334 				sizeof (lifr->lifr_name));
8335 			if (ipif->ipif_isv6) {
8336 				sin6 = (sin6_t *)&lifr->lifr_addr;
8337 				*sin6 = sin6_null;
8338 				sin6->sin6_family = AF_INET6;
8339 				sin6->sin6_addr =
8340 				ipif->ipif_v6lcl_addr;
8341 				lifr->lifr_addrlen =
8342 				ip_mask_to_plen_v6(
8343 				    &ipif->ipif_v6net_mask);
8344 			} else {
8345 				sin = (sin_t *)&lifr->lifr_addr;
8346 				*sin = sin_null;
8347 				sin->sin_family = AF_INET;
8348 				sin->sin_addr.s_addr =
8349 				    ipif->ipif_lcl_addr;
8350 				lifr->lifr_addrlen =
8351 				    ip_mask_to_plen(
8352 				    ipif->ipif_net_mask);
8353 			}
8354 			lifr++;
8355 		}
8356 	}
8357 lif_copydone:
8358 	rw_exit(&ill_g_lock);
8359 
8360 	mp1->b_wptr = (uchar_t *)lifr;
8361 	if (STRUCT_BUF(lifc) != NULL) {
8362 		STRUCT_FSET(lifc, lifc_len,
8363 			(int)((uchar_t *)lifr - mp1->b_rptr));
8364 	}
8365 	return (0);
8366 }
8367 
8368 /* ARGSUSED */
8369 int
8370 ip_sioctl_set_ipmpfailback(ipif_t *dummy_ipif, sin_t *dummy_sin,
8371     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8372 {
8373 	/* Existence of b_cont->b_cont checked in ip_wput_nondata */
8374 	ipmp_enable_failback = *(int *)mp->b_cont->b_cont->b_rptr;
8375 	return (0);
8376 }
8377 
8378 static void
8379 ip_sioctl_ip6addrpolicy(queue_t *q, mblk_t *mp)
8380 {
8381 	ip6_asp_t *table;
8382 	size_t table_size;
8383 	mblk_t *data_mp;
8384 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8385 
8386 	/* These two ioctls are I_STR only */
8387 	if (iocp->ioc_count == TRANSPARENT) {
8388 		miocnak(q, mp, 0, EINVAL);
8389 		return;
8390 	}
8391 
8392 	data_mp = mp->b_cont;
8393 	if (data_mp == NULL) {
8394 		/* The user passed us a NULL argument */
8395 		table = NULL;
8396 		table_size = iocp->ioc_count;
8397 	} else {
8398 		/*
8399 		 * The user provided a table.  The stream head
8400 		 * may have copied in the user data in chunks,
8401 		 * so make sure everything is pulled up
8402 		 * properly.
8403 		 */
8404 		if (MBLKL(data_mp) < iocp->ioc_count) {
8405 			mblk_t *new_data_mp;
8406 			if ((new_data_mp = msgpullup(data_mp, -1)) ==
8407 			    NULL) {
8408 				miocnak(q, mp, 0, ENOMEM);
8409 				return;
8410 			}
8411 			freemsg(data_mp);
8412 			data_mp = new_data_mp;
8413 			mp->b_cont = data_mp;
8414 		}
8415 		table = (ip6_asp_t *)data_mp->b_rptr;
8416 		table_size = iocp->ioc_count;
8417 	}
8418 
8419 	switch (iocp->ioc_cmd) {
8420 	case SIOCGIP6ADDRPOLICY:
8421 		iocp->ioc_rval = ip6_asp_get(table, table_size);
8422 		if (iocp->ioc_rval == -1)
8423 			iocp->ioc_error = EINVAL;
8424 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
8425 		else if (table != NULL &&
8426 		    (iocp->ioc_flag & IOC_MODELS) == IOC_ILP32) {
8427 			ip6_asp_t *src = table;
8428 			ip6_asp32_t *dst = (void *)table;
8429 			int count = table_size / sizeof (ip6_asp_t);
8430 			int i;
8431 
8432 			/*
8433 			 * We need to do an in-place shrink of the array
8434 			 * to match the alignment attributes of the
8435 			 * 32-bit ABI looking at it.
8436 			 */
8437 			/* LINTED: logical expression always true: op "||" */
8438 			ASSERT(sizeof (*src) > sizeof (*dst));
8439 			for (i = 1; i < count; i++)
8440 				bcopy(src + i, dst + i, sizeof (*dst));
8441 		}
8442 #endif
8443 		break;
8444 
8445 	case SIOCSIP6ADDRPOLICY:
8446 		ASSERT(mp->b_prev == NULL);
8447 		mp->b_prev = (void *)q;
8448 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
8449 		/*
8450 		 * We pass in the datamodel here so that the ip6_asp_replace()
8451 		 * routine can handle converting from 32-bit to native formats
8452 		 * where necessary.
8453 		 *
8454 		 * A better way to handle this might be to convert the inbound
8455 		 * data structure here, and hang it off a new 'mp'; thus the
8456 		 * ip6_asp_replace() logic would always be dealing with native
8457 		 * format data structures..
8458 		 *
8459 		 * (An even simpler way to handle these ioctls is to just
8460 		 * add a 32-bit trailing 'pad' field to the ip6_asp_t structure
8461 		 * and just recompile everything that depends on it.)
8462 		 */
8463 #endif
8464 		ip6_asp_replace(mp, table, table_size, B_FALSE,
8465 		    iocp->ioc_flag & IOC_MODELS);
8466 		return;
8467 	}
8468 
8469 	DB_TYPE(mp) =  (iocp->ioc_error == 0) ? M_IOCACK : M_IOCNAK;
8470 	qreply(q, mp);
8471 }
8472 
8473 static void
8474 ip_sioctl_dstinfo(queue_t *q, mblk_t *mp)
8475 {
8476 	mblk_t 		*data_mp;
8477 	struct dstinforeq	*dir;
8478 	uint8_t		*end, *cur;
8479 	in6_addr_t	*daddr, *saddr;
8480 	ipaddr_t	v4daddr;
8481 	ire_t		*ire;
8482 	char		*slabel, *dlabel;
8483 	boolean_t	isipv4;
8484 	int		match_ire;
8485 	ill_t		*dst_ill;
8486 	ipif_t		*src_ipif, *ire_ipif;
8487 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8488 	zoneid_t	zoneid;
8489 
8490 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8491 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8492 
8493 	/*
8494 	 * This ioctl is I_STR only, and must have a
8495 	 * data mblk following the M_IOCTL mblk.
8496 	 */
8497 	data_mp = mp->b_cont;
8498 	if (iocp->ioc_count == TRANSPARENT || data_mp == NULL) {
8499 		miocnak(q, mp, 0, EINVAL);
8500 		return;
8501 	}
8502 
8503 	if (MBLKL(data_mp) < iocp->ioc_count) {
8504 		mblk_t *new_data_mp;
8505 
8506 		if ((new_data_mp = msgpullup(data_mp, -1)) == NULL) {
8507 			miocnak(q, mp, 0, ENOMEM);
8508 			return;
8509 		}
8510 		freemsg(data_mp);
8511 		data_mp = new_data_mp;
8512 		mp->b_cont = data_mp;
8513 	}
8514 	match_ire = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | MATCH_IRE_PARENT;
8515 
8516 	for (cur = data_mp->b_rptr, end = data_mp->b_wptr;
8517 	    end - cur >= sizeof (struct dstinforeq);
8518 	    cur += sizeof (struct dstinforeq)) {
8519 		dir = (struct dstinforeq *)cur;
8520 		daddr = &dir->dir_daddr;
8521 		saddr = &dir->dir_saddr;
8522 
8523 		/*
8524 		 * ip_addr_scope_v6() and ip6_asp_lookup() handle
8525 		 * v4 mapped addresses; ire_ftable_lookup[_v6]()
8526 		 * and ipif_select_source[_v6]() do not.
8527 		 */
8528 		dir->dir_dscope = ip_addr_scope_v6(daddr);
8529 		dlabel = ip6_asp_lookup(daddr, &dir->dir_precedence);
8530 
8531 		isipv4 = IN6_IS_ADDR_V4MAPPED(daddr);
8532 		if (isipv4) {
8533 			IN6_V4MAPPED_TO_IPADDR(daddr, v4daddr);
8534 			ire = ire_ftable_lookup(v4daddr, NULL, NULL,
8535 			    0, NULL, NULL, zoneid, 0, match_ire);
8536 		} else {
8537 			ire = ire_ftable_lookup_v6(daddr, NULL, NULL,
8538 			    0, NULL, NULL, zoneid, 0, match_ire);
8539 		}
8540 		if (ire == NULL) {
8541 			dir->dir_dreachable = 0;
8542 
8543 			/* move on to next dst addr */
8544 			continue;
8545 		}
8546 		dir->dir_dreachable = 1;
8547 
8548 		ire_ipif = ire->ire_ipif;
8549 		if (ire_ipif == NULL)
8550 			goto next_dst;
8551 
8552 		/*
8553 		 * We expect to get back an interface ire or a
8554 		 * gateway ire cache entry.  For both types, the
8555 		 * output interface is ire_ipif->ipif_ill.
8556 		 */
8557 		dst_ill = ire_ipif->ipif_ill;
8558 		dir->dir_dmactype = dst_ill->ill_mactype;
8559 
8560 		if (isipv4) {
8561 			src_ipif = ipif_select_source(dst_ill, v4daddr, zoneid);
8562 		} else {
8563 			src_ipif = ipif_select_source_v6(dst_ill,
8564 			    daddr, B_FALSE, IPV6_PREFER_SRC_DEFAULT,
8565 			    zoneid);
8566 		}
8567 		if (src_ipif == NULL)
8568 			goto next_dst;
8569 
8570 		*saddr = src_ipif->ipif_v6lcl_addr;
8571 		dir->dir_sscope = ip_addr_scope_v6(saddr);
8572 		slabel = ip6_asp_lookup(saddr, NULL);
8573 		dir->dir_labelmatch = ip6_asp_labelcmp(dlabel, slabel);
8574 		dir->dir_sdeprecated =
8575 		    (src_ipif->ipif_flags & IPIF_DEPRECATED) ? 1 : 0;
8576 		ipif_refrele(src_ipif);
8577 next_dst:
8578 		ire_refrele(ire);
8579 	}
8580 	miocack(q, mp, iocp->ioc_count, 0);
8581 }
8582 
8583 
8584 /*
8585  * Check if this is an address assigned to this machine.
8586  * Skips interfaces that are down by using ire checks.
8587  * Translates mapped addresses to v4 addresses and then
8588  * treats them as such, returning true if the v4 address
8589  * associated with this mapped address is configured.
8590  * Note: Applications will have to be careful what they do
8591  * with the response; use of mapped addresses limits
8592  * what can be done with the socket, especially with
8593  * respect to socket options and ioctls - neither IPv4
8594  * options nor IPv6 sticky options/ancillary data options
8595  * may be used.
8596  */
8597 /* ARGSUSED */
8598 int
8599 ip_sioctl_tmyaddr(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8600     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
8601 {
8602 	struct sioc_addrreq *sia;
8603 	sin_t *sin;
8604 	ire_t *ire;
8605 	mblk_t *mp1;
8606 	zoneid_t zoneid;
8607 
8608 	ip1dbg(("ip_sioctl_tmyaddr"));
8609 
8610 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8611 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8612 
8613 	/* Existence verified in ip_wput_nondata */
8614 	mp1 = mp->b_cont->b_cont;
8615 	sia = (struct sioc_addrreq *)mp1->b_rptr;
8616 	sin = (sin_t *)&sia->sa_addr;
8617 	switch (sin->sin_family) {
8618 	case AF_INET6: {
8619 		sin6_t *sin6 = (sin6_t *)sin;
8620 
8621 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
8622 			ipaddr_t v4_addr;
8623 
8624 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
8625 			    v4_addr);
8626 			ire = ire_ctable_lookup(v4_addr, 0,
8627 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
8628 			    MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY);
8629 		} else {
8630 			in6_addr_t v6addr;
8631 
8632 			v6addr = sin6->sin6_addr;
8633 			ire = ire_ctable_lookup_v6(&v6addr, 0,
8634 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
8635 			    MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY);
8636 		}
8637 		break;
8638 	}
8639 	case AF_INET: {
8640 		ipaddr_t v4addr;
8641 
8642 		v4addr = sin->sin_addr.s_addr;
8643 		ire = ire_ctable_lookup(v4addr, 0,
8644 		    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
8645 		    MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY);
8646 		break;
8647 	}
8648 	default:
8649 		return (EAFNOSUPPORT);
8650 	}
8651 	if (ire != NULL) {
8652 		sia->sa_res = 1;
8653 		ire_refrele(ire);
8654 	} else {
8655 		sia->sa_res = 0;
8656 	}
8657 	return (0);
8658 }
8659 
8660 /*
8661  * Check if this is an address assigned on-link i.e. neighbor,
8662  * and makes sure it's reachable from the current zone.
8663  * Returns true for my addresses as well.
8664  * Translates mapped addresses to v4 addresses and then
8665  * treats them as such, returning true if the v4 address
8666  * associated with this mapped address is configured.
8667  * Note: Applications will have to be careful what they do
8668  * with the response; use of mapped addresses limits
8669  * what can be done with the socket, especially with
8670  * respect to socket options and ioctls - neither IPv4
8671  * options nor IPv6 sticky options/ancillary data options
8672  * may be used.
8673  */
8674 /* ARGSUSED */
8675 int
8676 ip_sioctl_tonlink(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8677     ip_ioctl_cmd_t *ipip, void *duymmy_ifreq)
8678 {
8679 	struct sioc_addrreq *sia;
8680 	sin_t *sin;
8681 	mblk_t	*mp1;
8682 	ire_t *ire = NULL;
8683 	zoneid_t zoneid;
8684 
8685 	ip1dbg(("ip_sioctl_tonlink"));
8686 
8687 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8688 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8689 
8690 	/* Existence verified in ip_wput_nondata */
8691 	mp1 = mp->b_cont->b_cont;
8692 	sia = (struct sioc_addrreq *)mp1->b_rptr;
8693 	sin = (sin_t *)&sia->sa_addr;
8694 
8695 	/*
8696 	 * Match addresses with a zero gateway field to avoid
8697 	 * routes going through a router.
8698 	 * Exclude broadcast and multicast addresses.
8699 	 */
8700 	switch (sin->sin_family) {
8701 	case AF_INET6: {
8702 		sin6_t *sin6 = (sin6_t *)sin;
8703 
8704 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
8705 			ipaddr_t v4_addr;
8706 
8707 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
8708 			    v4_addr);
8709 			if (!CLASSD(v4_addr)) {
8710 				ire = ire_route_lookup(v4_addr, 0, 0, 0,
8711 				    NULL, NULL, zoneid, MATCH_IRE_GW);
8712 			}
8713 		} else {
8714 			in6_addr_t v6addr;
8715 			in6_addr_t v6gw;
8716 
8717 			v6addr = sin6->sin6_addr;
8718 			v6gw = ipv6_all_zeros;
8719 			if (!IN6_IS_ADDR_MULTICAST(&v6addr)) {
8720 				ire = ire_route_lookup_v6(&v6addr, 0,
8721 				    &v6gw, 0, NULL, NULL, zoneid,
8722 				    MATCH_IRE_GW);
8723 			}
8724 		}
8725 		break;
8726 	}
8727 	case AF_INET: {
8728 		ipaddr_t v4addr;
8729 
8730 		v4addr = sin->sin_addr.s_addr;
8731 		if (!CLASSD(v4addr)) {
8732 			ire = ire_route_lookup(v4addr, 0, 0, 0,
8733 			    NULL, NULL, zoneid, MATCH_IRE_GW);
8734 		}
8735 		break;
8736 	}
8737 	default:
8738 		return (EAFNOSUPPORT);
8739 	}
8740 	sia->sa_res = 0;
8741 	if (ire != NULL) {
8742 		if (ire->ire_type & (IRE_INTERFACE|IRE_CACHE|
8743 		    IRE_LOCAL|IRE_LOOPBACK)) {
8744 			sia->sa_res = 1;
8745 		}
8746 		ire_refrele(ire);
8747 	}
8748 	return (0);
8749 }
8750 
8751 /*
8752  * TBD: implement when kernel maintaines a list of site prefixes.
8753  */
8754 /* ARGSUSED */
8755 int
8756 ip_sioctl_tmysite(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
8757     ip_ioctl_cmd_t *ipip, void *ifreq)
8758 {
8759 	return (ENXIO);
8760 }
8761 
8762 /* ARGSUSED */
8763 int
8764 ip_sioctl_tunparam(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8765     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
8766 {
8767 	ill_t  		*ill;
8768 	mblk_t		*mp1;
8769 	conn_t		*connp;
8770 	boolean_t	success;
8771 
8772 	ip1dbg(("ip_sioctl_tunparam(%s:%u %p)\n",
8773 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
8774 	/* ioctl comes down on an conn */
8775 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
8776 	connp = Q_TO_CONN(q);
8777 
8778 	mp->b_datap->db_type = M_IOCTL;
8779 
8780 	/*
8781 	 * Send down a copy. (copymsg does not copy b_next/b_prev).
8782 	 * The original mp contains contaminated b_next values due to 'mi',
8783 	 * which is needed to do the mi_copy_done. Unfortunately if we
8784 	 * send down the original mblk itself and if we are popped due to an
8785 	 * an unplumb before the response comes back from tunnel,
8786 	 * the streamhead (which does a freemsg) will see this contaminated
8787 	 * message and the assertion in freemsg about non-null b_next/b_prev
8788 	 * will panic a DEBUG kernel.
8789 	 */
8790 	mp1 = copymsg(mp);
8791 	if (mp1 == NULL)
8792 		return (ENOMEM);
8793 
8794 	ill = ipif->ipif_ill;
8795 	mutex_enter(&connp->conn_lock);
8796 	mutex_enter(&ill->ill_lock);
8797 	if (ipip->ipi_cmd == SIOCSTUNPARAM || ipip->ipi_cmd == OSIOCSTUNPARAM) {
8798 		success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp),
8799 		    mp, 0);
8800 	} else {
8801 		success = ill_pending_mp_add(ill, connp, mp);
8802 	}
8803 	mutex_exit(&ill->ill_lock);
8804 	mutex_exit(&connp->conn_lock);
8805 
8806 	if (success) {
8807 		ip1dbg(("sending down tunparam request "));
8808 		putnext(ill->ill_wq, mp1);
8809 		return (EINPROGRESS);
8810 	} else {
8811 		/* The conn has started closing */
8812 		freemsg(mp1);
8813 		return (EINTR);
8814 	}
8815 }
8816 
8817 static int
8818 ip_sioctl_arp_common(ill_t *ill, queue_t *q, mblk_t *mp, sin_t *sin,
8819     boolean_t x_arp_ioctl, boolean_t if_arp_ioctl)
8820 {
8821 	mblk_t *mp1;
8822 	mblk_t *mp2;
8823 	mblk_t *pending_mp;
8824 	ipaddr_t ipaddr;
8825 	area_t *area;
8826 	struct iocblk *iocp;
8827 	conn_t *connp;
8828 	struct arpreq *ar;
8829 	struct xarpreq *xar;
8830 	boolean_t success;
8831 	int flags, alength;
8832 	char *lladdr;
8833 
8834 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
8835 	connp = Q_TO_CONN(q);
8836 
8837 	iocp = (struct iocblk *)mp->b_rptr;
8838 	/*
8839 	 * ill has already been set depending on whether
8840 	 * bsd style or interface style ioctl.
8841 	 */
8842 	ASSERT(ill != NULL);
8843 
8844 	/*
8845 	 * Is this one of the new SIOC*XARP ioctls?
8846 	 */
8847 	if (x_arp_ioctl) {
8848 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->XARPREQ_MBLK */
8849 		xar = (struct xarpreq *)mp->b_cont->b_cont->b_rptr;
8850 		ar = NULL;
8851 
8852 		flags = xar->xarp_flags;
8853 		lladdr = LLADDR(&xar->xarp_ha);
8854 		/*
8855 		 * Validate against user's link layer address length
8856 		 * input and name and addr length limits.
8857 		 */
8858 		alength = ill->ill_phys_addr_length;
8859 		if (iocp->ioc_cmd == SIOCSXARP) {
8860 			if (alength != xar->xarp_ha.sdl_alen ||
8861 			    (alength + xar->xarp_ha.sdl_nlen >
8862 			    sizeof (xar->xarp_ha.sdl_data)))
8863 				return (EINVAL);
8864 		}
8865 	} else {
8866 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->ARPREQ_MBLK */
8867 		ar = (struct arpreq *)mp->b_cont->b_cont->b_rptr;
8868 		xar = NULL;
8869 
8870 		flags = ar->arp_flags;
8871 		lladdr = ar->arp_ha.sa_data;
8872 		/*
8873 		 * Theoretically, the sa_family could tell us what link
8874 		 * layer type this operation is trying to deal with. By
8875 		 * common usage AF_UNSPEC means ethernet. We'll assume
8876 		 * any attempt to use the SIOC?ARP ioctls is for ethernet,
8877 		 * for now. Our new SIOC*XARP ioctls can be used more
8878 		 * generally.
8879 		 *
8880 		 * If the underlying media happens to have a non 6 byte
8881 		 * address, arp module will fail set/get, but the del
8882 		 * operation will succeed.
8883 		 */
8884 		alength = 6;
8885 		if ((iocp->ioc_cmd != SIOCDARP) &&
8886 		    (alength != ill->ill_phys_addr_length)) {
8887 			return (EINVAL);
8888 		}
8889 	}
8890 
8891 	/*
8892 	 * We are going to pass up to ARP a packet chain that looks
8893 	 * like:
8894 	 *
8895 	 * M_IOCTL-->ARP_op_MBLK-->ORIG_M_IOCTL-->MI_COPY_MBLK-->[X]ARPREQ_MBLK
8896 	 *
8897 	 * Get a copy of the original IOCTL mblk to head the chain,
8898 	 * to be sent up (in mp1). Also get another copy to store
8899 	 * in the ill_pending_mp list, for matching the response
8900 	 * when it comes back from ARP.
8901 	 */
8902 	mp1 = copyb(mp);
8903 	pending_mp = copymsg(mp);
8904 	if (mp1 == NULL || pending_mp == NULL) {
8905 		if (mp1 != NULL)
8906 			freeb(mp1);
8907 		if (pending_mp != NULL)
8908 			inet_freemsg(pending_mp);
8909 		return (ENOMEM);
8910 	}
8911 
8912 	ipaddr = sin->sin_addr.s_addr;
8913 
8914 	mp2 = ill_arp_alloc(ill, (uchar_t *)&ip_area_template,
8915 	    (caddr_t)&ipaddr);
8916 	if (mp2 == NULL) {
8917 		freeb(mp1);
8918 		inet_freemsg(pending_mp);
8919 		return (ENOMEM);
8920 	}
8921 	/* Put together the chain. */
8922 	mp1->b_cont = mp2;
8923 	mp1->b_datap->db_type = M_IOCTL;
8924 	mp2->b_cont = mp;
8925 	mp2->b_datap->db_type = M_DATA;
8926 
8927 	iocp = (struct iocblk *)mp1->b_rptr;
8928 
8929 	/*
8930 	 * An M_IOCDATA's payload (struct copyresp) is mostly the same as an
8931 	 * M_IOCTL's payload (struct iocblk), but 'struct copyresp' has a
8932 	 * cp_private field (or cp_rval on 32-bit systems) in place of the
8933 	 * ioc_count field; set ioc_count to be correct.
8934 	 */
8935 	iocp->ioc_count = MBLKL(mp1->b_cont);
8936 
8937 	/*
8938 	 * Set the proper command in the ARP message.
8939 	 * Convert the SIOC{G|S|D}ARP calls into our
8940 	 * AR_ENTRY_xxx calls.
8941 	 */
8942 	area = (area_t *)mp2->b_rptr;
8943 	switch (iocp->ioc_cmd) {
8944 	case SIOCDARP:
8945 	case SIOCDXARP:
8946 		/*
8947 		 * We defer deleting the corresponding IRE until
8948 		 * we return from arp.
8949 		 */
8950 		area->area_cmd = AR_ENTRY_DELETE;
8951 		area->area_proto_mask_offset = 0;
8952 		break;
8953 	case SIOCGARP:
8954 	case SIOCGXARP:
8955 		area->area_cmd = AR_ENTRY_SQUERY;
8956 		area->area_proto_mask_offset = 0;
8957 		break;
8958 	case SIOCSARP:
8959 	case SIOCSXARP: {
8960 		/*
8961 		 * Delete the corresponding ire to make sure IP will
8962 		 * pick up any change from arp.
8963 		 */
8964 		if (!if_arp_ioctl) {
8965 			(void) ip_ire_clookup_and_delete(ipaddr, NULL);
8966 			break;
8967 		} else {
8968 			ipif_t *ipif = ipif_get_next_ipif(NULL, ill);
8969 			if (ipif != NULL) {
8970 				(void) ip_ire_clookup_and_delete(ipaddr, ipif);
8971 				ipif_refrele(ipif);
8972 			}
8973 			break;
8974 		}
8975 	}
8976 	}
8977 	iocp->ioc_cmd = area->area_cmd;
8978 
8979 	/*
8980 	 * Before sending 'mp' to ARP, we have to clear the b_next
8981 	 * and b_prev. Otherwise if STREAMS encounters such a message
8982 	 * in freemsg(), (because ARP can close any time) it can cause
8983 	 * a panic. But mi code needs the b_next and b_prev values of
8984 	 * mp->b_cont, to complete the ioctl. So we store it here
8985 	 * in pending_mp->bcont, and restore it in ip_sioctl_iocack()
8986 	 * when the response comes down from ARP.
8987 	 */
8988 	pending_mp->b_cont->b_next = mp->b_cont->b_next;
8989 	pending_mp->b_cont->b_prev = mp->b_cont->b_prev;
8990 	mp->b_cont->b_next = NULL;
8991 	mp->b_cont->b_prev = NULL;
8992 
8993 	mutex_enter(&connp->conn_lock);
8994 	mutex_enter(&ill->ill_lock);
8995 	/* conn has not yet started closing, hence this can't fail */
8996 	success = ill_pending_mp_add(ill, connp, pending_mp);
8997 	ASSERT(success);
8998 	mutex_exit(&ill->ill_lock);
8999 	mutex_exit(&connp->conn_lock);
9000 
9001 	/*
9002 	 * Fill in the rest of the ARP operation fields.
9003 	 */
9004 	area->area_hw_addr_length = alength;
9005 	bcopy(lladdr,
9006 	    (char *)area + area->area_hw_addr_offset,
9007 	    area->area_hw_addr_length);
9008 	/* Translate the flags. */
9009 	if (flags & ATF_PERM)
9010 		area->area_flags |= ACE_F_PERMANENT;
9011 	if (flags & ATF_PUBL)
9012 		area->area_flags |= ACE_F_PUBLISH;
9013 
9014 	/*
9015 	 * Up to ARP it goes.  The response will come
9016 	 * back in ip_wput as an M_IOCACK message, and
9017 	 * will be handed to ip_sioctl_iocack for
9018 	 * completion.
9019 	 */
9020 	putnext(ill->ill_rq, mp1);
9021 	return (EINPROGRESS);
9022 }
9023 
9024 /* ARGSUSED */
9025 int
9026 ip_sioctl_xarp(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9027     ip_ioctl_cmd_t *ipip, void *ifreq)
9028 {
9029 	struct xarpreq *xar;
9030 	boolean_t isv6;
9031 	mblk_t	*mp1;
9032 	int	err;
9033 	conn_t	*connp;
9034 	int ifnamelen;
9035 	ire_t	*ire = NULL;
9036 	ill_t	*ill = NULL;
9037 	struct sockaddr_in *sin;
9038 	boolean_t if_arp_ioctl = B_FALSE;
9039 
9040 	/* ioctl comes down on an conn */
9041 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9042 	connp = Q_TO_CONN(q);
9043 	isv6 = connp->conn_af_isv6;
9044 
9045 	/* Existance verified in ip_wput_nondata */
9046 	mp1 = mp->b_cont->b_cont;
9047 
9048 	ASSERT(MBLKL(mp1) >= sizeof (*xar));
9049 	xar = (struct xarpreq *)mp1->b_rptr;
9050 	sin = (sin_t *)&xar->xarp_pa;
9051 
9052 	if (isv6 || (xar->xarp_ha.sdl_family != AF_LINK) ||
9053 	    (xar->xarp_pa.ss_family != AF_INET))
9054 		return (ENXIO);
9055 
9056 	ifnamelen = xar->xarp_ha.sdl_nlen;
9057 	if (ifnamelen != 0) {
9058 		char	*cptr, cval;
9059 
9060 		if (ifnamelen >= LIFNAMSIZ)
9061 			return (EINVAL);
9062 
9063 		/*
9064 		 * Instead of bcopying a bunch of bytes,
9065 		 * null-terminate the string in-situ.
9066 		 */
9067 		cptr = xar->xarp_ha.sdl_data + ifnamelen;
9068 		cval = *cptr;
9069 		*cptr = '\0';
9070 		ill = ill_lookup_on_name(xar->xarp_ha.sdl_data,
9071 		    B_FALSE, isv6, CONNP_TO_WQ(connp), mp, ip_process_ioctl,
9072 		    &err, NULL);
9073 		*cptr = cval;
9074 		if (ill == NULL)
9075 			return (err);
9076 		if (ill->ill_net_type != IRE_IF_RESOLVER) {
9077 			ill_refrele(ill);
9078 			return (ENXIO);
9079 		}
9080 
9081 		if_arp_ioctl = B_TRUE;
9082 	} else {
9083 		/*
9084 		 * PSARC 2003/088 states that if sdl_nlen == 0, it behaves
9085 		 * as an extended BSD ioctl. The kernel uses the IP address
9086 		 * to figure out the network interface.
9087 		 */
9088 		ire = ire_cache_lookup(sin->sin_addr.s_addr, ALL_ZONES);
9089 		if ((ire == NULL) || (ire->ire_type == IRE_LOOPBACK) ||
9090 		    ((ill = ire_to_ill(ire)) == NULL)) {
9091 			if (ire != NULL)
9092 				ire_refrele(ire);
9093 			ire = ire_ftable_lookup(sin->sin_addr.s_addr,
9094 			    0, 0, IRE_IF_RESOLVER, NULL, NULL, ALL_ZONES, 0,
9095 			    MATCH_IRE_TYPE);
9096 			if ((ire == NULL) ||
9097 			    ((ill = ire_to_ill(ire)) == NULL)) {
9098 				if (ire != NULL)
9099 					ire_refrele(ire);
9100 				return (ENXIO);
9101 			}
9102 		}
9103 		ASSERT(ire != NULL && ill != NULL);
9104 	}
9105 
9106 	err = ip_sioctl_arp_common(ill, q, mp, sin, B_TRUE, if_arp_ioctl);
9107 	if (if_arp_ioctl)
9108 		ill_refrele(ill);
9109 	if (ire != NULL)
9110 		ire_refrele(ire);
9111 
9112 	return (err);
9113 }
9114 
9115 /*
9116  * ARP IOCTLs.
9117  * How does IP get in the business of fronting ARP configuration/queries?
9118  * Well its like this, the Berkeley ARP IOCTLs (SIOCGARP, SIOCDARP, SIOCSARP)
9119  * are by tradition passed in through a datagram socket.  That lands in IP.
9120  * As it happens, this is just as well since the interface is quite crude in
9121  * that it passes in no information about protocol or hardware types, or
9122  * interface association.  After making the protocol assumption, IP is in
9123  * the position to look up the name of the ILL, which ARP will need, and
9124  * format a request that can be handled by ARP.	 The request is passed up
9125  * stream to ARP, and the original IOCTL is completed by IP when ARP passes
9126  * back a response.  ARP supports its own set of more general IOCTLs, in
9127  * case anyone is interested.
9128  */
9129 /* ARGSUSED */
9130 int
9131 ip_sioctl_arp(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9132     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9133 {
9134 	struct arpreq *ar;
9135 	struct sockaddr_in *sin;
9136 	ire_t	*ire;
9137 	boolean_t isv6;
9138 	mblk_t	*mp1;
9139 	int	err;
9140 	conn_t	*connp;
9141 	ill_t	*ill;
9142 
9143 	/* ioctl comes down on an conn */
9144 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9145 	connp = Q_TO_CONN(q);
9146 	isv6 = connp->conn_af_isv6;
9147 	if (isv6)
9148 		return (ENXIO);
9149 
9150 	/* Existance verified in ip_wput_nondata */
9151 	mp1 = mp->b_cont->b_cont;
9152 
9153 	ar = (struct arpreq *)mp1->b_rptr;
9154 	sin = (sin_t *)&ar->arp_pa;
9155 
9156 	/*
9157 	 * We need to let ARP know on which interface the IP
9158 	 * address has an ARP mapping. In the IPMP case, a
9159 	 * simple forwarding table lookup will return the
9160 	 * IRE_IF_RESOLVER for the first interface in the group,
9161 	 * which might not be the interface on which the
9162 	 * requested IP address was resolved due to the ill
9163 	 * selection algorithm (see ip_newroute_get_dst_ill()).
9164 	 * So we do a cache table lookup first: if the IRE cache
9165 	 * entry for the IP address is still there, it will
9166 	 * contain the ill pointer for the right interface, so
9167 	 * we use that. If the cache entry has been flushed, we
9168 	 * fall back to the forwarding table lookup. This should
9169 	 * be rare enough since IRE cache entries have a longer
9170 	 * life expectancy than ARP cache entries.
9171 	 */
9172 	ire = ire_cache_lookup(sin->sin_addr.s_addr, ALL_ZONES);
9173 	if ((ire == NULL) || (ire->ire_type == IRE_LOOPBACK) ||
9174 	    ((ill = ire_to_ill(ire)) == NULL)) {
9175 		if (ire != NULL)
9176 			ire_refrele(ire);
9177 		ire = ire_ftable_lookup(sin->sin_addr.s_addr,
9178 		    0, 0, IRE_IF_RESOLVER, NULL, NULL, ALL_ZONES, 0,
9179 		    MATCH_IRE_TYPE);
9180 		if ((ire == NULL) || ((ill = ire_to_ill(ire)) == NULL)) {
9181 			if (ire != NULL)
9182 				ire_refrele(ire);
9183 			return (ENXIO);
9184 		}
9185 	}
9186 	ASSERT(ire != NULL && ill != NULL);
9187 
9188 	err = ip_sioctl_arp_common(ill, q, mp, sin, B_FALSE, B_FALSE);
9189 	ire_refrele(ire);
9190 	return (err);
9191 }
9192 
9193 /*
9194  * Do I_PLINK/I_LINK or I_PUNLINK/I_UNLINK with consistency checks and also
9195  * atomically set/clear the muxids. Also complete the ioctl by acking or
9196  * naking it.  Note that the code is structured such that the link type,
9197  * whether it's persistent or not, is treated equally.  ifconfig(1M) and
9198  * its clones use the persistent link, while pppd(1M) and perhaps many
9199  * other daemons may use non-persistent link.  When combined with some
9200  * ill_t states, linking and unlinking lower streams may be used as
9201  * indicators of dynamic re-plumbing events [see PSARC/1999/348].
9202  */
9203 /* ARGSUSED */
9204 void
9205 ip_sioctl_plink(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
9206 {
9207 	mblk_t *mp1;
9208 	mblk_t *mp2;
9209 	struct linkblk *li;
9210 	queue_t	*ipwq;
9211 	char	*name;
9212 	struct qinit *qinfo;
9213 	struct ipmx_s *ipmxp;
9214 	ill_t	*ill = NULL;
9215 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
9216 	int	err = 0;
9217 	boolean_t	entered_ipsq = B_FALSE;
9218 	boolean_t islink;
9219 	queue_t *dwq = NULL;
9220 
9221 	ASSERT(iocp->ioc_cmd == I_PLINK || iocp->ioc_cmd == I_PUNLINK ||
9222 	    iocp->ioc_cmd == I_LINK || iocp->ioc_cmd == I_UNLINK);
9223 
9224 	islink = (iocp->ioc_cmd == I_PLINK || iocp->ioc_cmd == I_LINK) ?
9225 	    B_TRUE : B_FALSE;
9226 
9227 	mp1 = mp->b_cont;	/* This is the linkblk info */
9228 	li = (struct linkblk *)mp1->b_rptr;
9229 
9230 	/*
9231 	 * ARP has added this special mblk, and the utility is asking us
9232 	 * to perform consistency checks, and also atomically set the
9233 	 * muxid. Ifconfig is an example.  It achieves this by using
9234 	 * /dev/arp as the mux to plink the arp stream, and pushes arp on
9235 	 * to /dev/udp[6] stream for use as the mux when plinking the IP
9236 	 * stream. SIOCSLIFMUXID is not required.  See ifconfig.c, arp.c
9237 	 * and other comments in this routine for more details.
9238 	 */
9239 	mp2 = mp1->b_cont;	/* This is added by ARP */
9240 
9241 	/*
9242 	 * If I_{P}LINK/I_{P}UNLINK is issued by a utility other than
9243 	 * ifconfig which didn't push ARP on top of the dummy mux, we won't
9244 	 * get the special mblk above.  For backward compatibility, we just
9245 	 * return success.  The utility will use SIOCSLIFMUXID to store
9246 	 * the muxids.  This is not atomic, and can leave the streams
9247 	 * unplumbable if the utility is interrrupted, before it does the
9248 	 * SIOCSLIFMUXID.
9249 	 */
9250 	if (mp2 == NULL) {
9251 		/*
9252 		 * At this point we don't know whether or not this is the
9253 		 * IP module stream or the ARP device stream.  We need to
9254 		 * walk the lower stream in order to find this out, since
9255 		 * the capability negotiation is done only on the IP module
9256 		 * stream.  IP module instance is identified by the module
9257 		 * name IP, non-null q_next, and it's wput not being ip_lwput.
9258 		 * STREAMS ensures that the lower stream (l_qbot) will not
9259 		 * vanish until this ioctl completes. So we can safely walk
9260 		 * the stream or refer to the q_ptr.
9261 		 */
9262 		ipwq = li->l_qbot;
9263 		while (ipwq != NULL) {
9264 			qinfo = ipwq->q_qinfo;
9265 			name = qinfo->qi_minfo->mi_idname;
9266 			if (name != NULL && name[0] != NULL &&
9267 			    (strcmp(name, ip_mod_info.mi_idname) == 0) &&
9268 			    ((void *)(qinfo->qi_putp) != (void *)ip_lwput) &&
9269 			    (ipwq->q_next != NULL)) {
9270 				break;
9271 			}
9272 			ipwq = ipwq->q_next;
9273 		}
9274 		/*
9275 		 * This looks like an IP module stream, so trigger
9276 		 * the capability reset or re-negotiation if necessary.
9277 		 */
9278 		if (ipwq != NULL) {
9279 			ill = ipwq->q_ptr;
9280 			ASSERT(ill != NULL);
9281 
9282 			if (ipsq == NULL) {
9283 				ipsq = ipsq_try_enter(NULL, ill, q, mp,
9284 				    ip_sioctl_plink, NEW_OP, B_TRUE);
9285 				if (ipsq == NULL)
9286 					return;
9287 				entered_ipsq = B_TRUE;
9288 			}
9289 			ASSERT(IAM_WRITER_ILL(ill));
9290 			/*
9291 			 * Store the upper read queue of the module
9292 			 * immediately below IP, and count the total
9293 			 * number of lower modules.  Do this only
9294 			 * for I_PLINK or I_LINK event.
9295 			 */
9296 			ill->ill_lmod_rq = NULL;
9297 			ill->ill_lmod_cnt = 0;
9298 			if (islink && (dwq = ipwq->q_next) != NULL) {
9299 				ill->ill_lmod_rq = RD(dwq);
9300 
9301 				while (dwq != NULL) {
9302 					ill->ill_lmod_cnt++;
9303 					dwq = dwq->q_next;
9304 				}
9305 			}
9306 			/*
9307 			 * There's no point in resetting or re-negotiating if
9308 			 * we are not bound to the driver, so only do this if
9309 			 * the DLPI state is idle (up); we assume such state
9310 			 * since ill_ipif_up_count gets incremented in
9311 			 * ipif_up_done(), which is after we are bound to the
9312 			 * driver.  Note that in the case of logical
9313 			 * interfaces, IP won't rebind to the driver unless
9314 			 * the ill_ipif_up_count is 0, meaning that all other
9315 			 * IP interfaces (including the main ipif) are in the
9316 			 * down state.  Because of this, we use such counter
9317 			 * as an indicator, instead of relying on the IPIF_UP
9318 			 * flag, which is per ipif instance.
9319 			 */
9320 			if (ill->ill_ipif_up_count > 0) {
9321 				if (islink)
9322 					ill_capability_probe(ill);
9323 				else
9324 					ill_capability_reset(ill);
9325 			}
9326 		}
9327 		goto done;
9328 	}
9329 
9330 	/*
9331 	 * This is an I_{P}LINK sent down by ifconfig on
9332 	 * /dev/arp. ARP has appended this last (3rd) mblk,
9333 	 * giving more info. STREAMS ensures that the lower
9334 	 * stream (l_qbot) will not vanish until this ioctl
9335 	 * completes. So we can safely walk the stream or refer
9336 	 * to the q_ptr.
9337 	 */
9338 	ipmxp = (struct ipmx_s *)mp2->b_rptr;
9339 	if (ipmxp->ipmx_arpdev_stream) {
9340 		/*
9341 		 * The operation is occuring on the arp-device
9342 		 * stream.
9343 		 */
9344 		ill = ill_lookup_on_name(ipmxp->ipmx_name, B_FALSE, B_FALSE,
9345 		    q, mp, ip_sioctl_plink, &err, NULL);
9346 		if (ill == NULL) {
9347 			if (err == EINPROGRESS) {
9348 				return;
9349 			} else {
9350 				err = EINVAL;
9351 				goto done;
9352 			}
9353 		}
9354 
9355 		if (ipsq == NULL) {
9356 			ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_sioctl_plink,
9357 			    NEW_OP, B_TRUE);
9358 			if (ipsq == NULL) {
9359 				ill_refrele(ill);
9360 				return;
9361 			}
9362 			entered_ipsq = B_TRUE;
9363 		}
9364 		ASSERT(IAM_WRITER_ILL(ill));
9365 		ill_refrele(ill);
9366 		/*
9367 		 * To ensure consistency between IP and ARP,
9368 		 * the following LIFO scheme is used in
9369 		 * plink/punlink. (IP first, ARP last).
9370 		 * This is because the muxid's are stored
9371 		 * in the IP stream on the ill.
9372 		 *
9373 		 * I_{P}LINK: ifconfig plinks the IP stream before
9374 		 * plinking the ARP stream. On an arp-dev
9375 		 * stream, IP checks that it is not yet
9376 		 * plinked, and it also checks that the
9377 		 * corresponding IP stream is already plinked.
9378 		 *
9379 		 * I_{P}UNLINK: ifconfig punlinks the ARP stream
9380 		 * before punlinking the IP stream. IP does
9381 		 * not allow punlink of the IP stream unless
9382 		 * the arp stream has been punlinked.
9383 		 *
9384 		 */
9385 		if ((islink &&
9386 		    (ill->ill_arp_muxid != 0 || ill->ill_ip_muxid == 0)) ||
9387 		    (!islink &&
9388 		    ill->ill_arp_muxid != li->l_index)) {
9389 			err = EINVAL;
9390 			goto done;
9391 		}
9392 		if (islink) {
9393 			ill->ill_arp_muxid = li->l_index;
9394 		} else {
9395 			ill->ill_arp_muxid = 0;
9396 		}
9397 	} else {
9398 		/*
9399 		 * This must be the IP module stream with or
9400 		 * without arp. Walk the stream and locate the
9401 		 * IP module. An IP module instance is
9402 		 * identified by the module name IP, non-null
9403 		 * q_next, and it's wput not being ip_lwput.
9404 		 */
9405 		ipwq = li->l_qbot;
9406 		while (ipwq != NULL) {
9407 			qinfo = ipwq->q_qinfo;
9408 			name = qinfo->qi_minfo->mi_idname;
9409 			if (name != NULL && name[0] != NULL &&
9410 			    (strcmp(name, ip_mod_info.mi_idname) == 0) &&
9411 			    ((void *)(qinfo->qi_putp) != (void *)ip_lwput) &&
9412 			    (ipwq->q_next != NULL)) {
9413 				break;
9414 			}
9415 			ipwq = ipwq->q_next;
9416 		}
9417 		if (ipwq != NULL) {
9418 			ill = ipwq->q_ptr;
9419 			ASSERT(ill != NULL);
9420 
9421 			if (ipsq == NULL) {
9422 				ipsq = ipsq_try_enter(NULL, ill, q, mp,
9423 				    ip_sioctl_plink, NEW_OP, B_TRUE);
9424 				if (ipsq == NULL)
9425 					return;
9426 				entered_ipsq = B_TRUE;
9427 			}
9428 			ASSERT(IAM_WRITER_ILL(ill));
9429 			/*
9430 			 * Return error if the ip_mux_id is
9431 			 * non-zero and command is I_{P}LINK.
9432 			 * If command is I_{P}UNLINK, return
9433 			 * error if the arp-devstr is not
9434 			 * yet punlinked.
9435 			 */
9436 			if ((islink && ill->ill_ip_muxid != 0) ||
9437 			    (!islink && ill->ill_arp_muxid != 0)) {
9438 				err = EINVAL;
9439 				goto done;
9440 			}
9441 			ill->ill_lmod_rq = NULL;
9442 			ill->ill_lmod_cnt = 0;
9443 			if (islink) {
9444 				/*
9445 				 * Store the upper read queue of the module
9446 				 * immediately below IP, and count the total
9447 				 * number of lower modules.
9448 				 */
9449 				if ((dwq = ipwq->q_next) != NULL) {
9450 					ill->ill_lmod_rq = RD(dwq);
9451 
9452 					while (dwq != NULL) {
9453 						ill->ill_lmod_cnt++;
9454 						dwq = dwq->q_next;
9455 					}
9456 				}
9457 				ill->ill_ip_muxid = li->l_index;
9458 			} else {
9459 				ill->ill_ip_muxid = 0;
9460 			}
9461 
9462 			/*
9463 			 * See comments above about resetting/re-
9464 			 * negotiating driver sub-capabilities.
9465 			 */
9466 			if (ill->ill_ipif_up_count > 0) {
9467 				if (islink)
9468 					ill_capability_probe(ill);
9469 				else
9470 					ill_capability_reset(ill);
9471 			}
9472 		}
9473 	}
9474 done:
9475 	iocp->ioc_count = 0;
9476 	iocp->ioc_error = err;
9477 	if (err == 0)
9478 		mp->b_datap->db_type = M_IOCACK;
9479 	else
9480 		mp->b_datap->db_type = M_IOCNAK;
9481 	qreply(q, mp);
9482 
9483 	/* Conn was refheld in ip_sioctl_copyin_setup */
9484 	if (CONN_Q(q))
9485 		CONN_OPER_PENDING_DONE(Q_TO_CONN(q));
9486 	if (entered_ipsq)
9487 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
9488 }
9489 
9490 /*
9491  * Search the ioctl command in the ioctl tables and return a pointer
9492  * to the ioctl command information. The ioctl command tables are
9493  * static and fully populated at compile time.
9494  */
9495 ip_ioctl_cmd_t *
9496 ip_sioctl_lookup(int ioc_cmd)
9497 {
9498 	int index;
9499 	ip_ioctl_cmd_t *ipip;
9500 	ip_ioctl_cmd_t *ipip_end;
9501 
9502 	if (ioc_cmd == IPI_DONTCARE)
9503 		return (NULL);
9504 
9505 	/*
9506 	 * Do a 2 step search. First search the indexed table
9507 	 * based on the least significant byte of the ioctl cmd.
9508 	 * If we don't find a match, then search the misc table
9509 	 * serially.
9510 	 */
9511 	index = ioc_cmd & 0xFF;
9512 	if (index < ip_ndx_ioctl_count) {
9513 		ipip = &ip_ndx_ioctl_table[index];
9514 		if (ipip->ipi_cmd == ioc_cmd) {
9515 			/* Found a match in the ndx table */
9516 			return (ipip);
9517 		}
9518 	}
9519 
9520 	/* Search the misc table */
9521 	ipip_end = &ip_misc_ioctl_table[ip_misc_ioctl_count];
9522 	for (ipip = ip_misc_ioctl_table; ipip < ipip_end; ipip++) {
9523 		if (ipip->ipi_cmd == ioc_cmd)
9524 			/* Found a match in the misc table */
9525 			return (ipip);
9526 	}
9527 
9528 	return (NULL);
9529 }
9530 
9531 /*
9532  * Wrapper function for resuming deferred ioctl processing
9533  * Used for SIOCGDSTINFO, SIOCGIP6ADDRPOLICY, SIOCGMSFILTER,
9534  * SIOCSMSFILTER, SIOCGIPMSFILTER, and SIOCSIPMSFILTER currently.
9535  */
9536 /* ARGSUSED */
9537 void
9538 ip_sioctl_copyin_resume(ipsq_t *dummy_ipsq, queue_t *q, mblk_t *mp,
9539     void *dummy_arg)
9540 {
9541 	ip_sioctl_copyin_setup(q, mp);
9542 }
9543 
9544 /*
9545  * ip_sioctl_copyin_setup is called by ip_wput with any M_IOCTL message
9546  * that arrives.  Most of the IOCTLs are "socket" IOCTLs which we handle
9547  * in either I_STR or TRANSPARENT form, using the mi_copy facility.
9548  * We establish here the size of the block to be copied in.  mi_copyin
9549  * arranges for this to happen, an processing continues in ip_wput with
9550  * an M_IOCDATA message.
9551  */
9552 void
9553 ip_sioctl_copyin_setup(queue_t *q, mblk_t *mp)
9554 {
9555 	int	copyin_size;
9556 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
9557 	ip_ioctl_cmd_t *ipip;
9558 	cred_t *cr;
9559 
9560 	ipip = ip_sioctl_lookup(iocp->ioc_cmd);
9561 	if (ipip == NULL) {
9562 		/*
9563 		 * The ioctl is not one we understand or own.
9564 		 * Pass it along to be processed down stream,
9565 		 * if this is a module instance of IP, else nak
9566 		 * the ioctl.
9567 		 */
9568 		if (q->q_next == NULL) {
9569 			goto nak;
9570 		} else {
9571 			putnext(q, mp);
9572 			return;
9573 		}
9574 	}
9575 
9576 	/*
9577 	 * If this is deferred, then we will do all the checks when we
9578 	 * come back.
9579 	 */
9580 	if ((iocp->ioc_cmd == SIOCGDSTINFO ||
9581 	    iocp->ioc_cmd == SIOCGIP6ADDRPOLICY) && !ip6_asp_can_lookup()) {
9582 		ip6_asp_pending_op(q, mp, ip_sioctl_copyin_resume);
9583 		return;
9584 	}
9585 
9586 	/*
9587 	 * Only allow a very small subset of IP ioctls on this stream if
9588 	 * IP is a module and not a driver. Allowing ioctls to be processed
9589 	 * in this case may cause assert failures or data corruption.
9590 	 * Typically G[L]IFFLAGS, SLIFNAME/IF_UNITSEL are the only few
9591 	 * ioctls allowed on an IP module stream, after which this stream
9592 	 * normally becomes a multiplexor (at which time the stream head
9593 	 * will fail all ioctls).
9594 	 */
9595 	if ((q->q_next != NULL) && !(ipip->ipi_flags & IPI_MODOK)) {
9596 		if (ipip->ipi_flags & IPI_PASS_DOWN) {
9597 			/*
9598 			 * Pass common Streams ioctls which the IP
9599 			 * module does not own or consume along to
9600 			 * be processed down stream.
9601 			 */
9602 			putnext(q, mp);
9603 			return;
9604 		} else {
9605 			goto nak;
9606 		}
9607 	}
9608 
9609 	/* Make sure we have ioctl data to process. */
9610 	if (mp->b_cont == NULL && !(ipip->ipi_flags & IPI_NULL_BCONT))
9611 		goto nak;
9612 
9613 	/*
9614 	 * Prefer dblk credential over ioctl credential; some synthesized
9615 	 * ioctls have kcred set because there's no way to crhold()
9616 	 * a credential in some contexts.  (ioc_cr is not crfree() by
9617 	 * the framework; the caller of ioctl needs to hold the reference
9618 	 * for the duration of the call).
9619 	 */
9620 	cr = DB_CREDDEF(mp, iocp->ioc_cr);
9621 
9622 	/* Make sure normal users don't send down privileged ioctls */
9623 	if ((ipip->ipi_flags & IPI_PRIV) &&
9624 	    (cr != NULL) && secpolicy_net_config(cr, B_TRUE) != 0) {
9625 		/* We checked the privilege earlier but log it here */
9626 		miocnak(q, mp, 0, secpolicy_net_config(cr, B_FALSE));
9627 		return;
9628 	}
9629 
9630 	/*
9631 	 * The ioctl command tables can only encode fixed length
9632 	 * ioctl data. If the length is variable, the table will
9633 	 * encode the length as zero. Such special cases are handled
9634 	 * below in the switch.
9635 	 */
9636 	if (ipip->ipi_copyin_size != 0) {
9637 		mi_copyin(q, mp, NULL, ipip->ipi_copyin_size);
9638 		return;
9639 	}
9640 
9641 	switch (iocp->ioc_cmd) {
9642 	case O_SIOCGIFCONF:
9643 	case SIOCGIFCONF:
9644 		/*
9645 		 * This IOCTL is hilarious.  See comments in
9646 		 * ip_sioctl_get_ifconf for the story.
9647 		 */
9648 		if (iocp->ioc_count == TRANSPARENT)
9649 			copyin_size = SIZEOF_STRUCT(ifconf,
9650 			    iocp->ioc_flag);
9651 		else
9652 			copyin_size = iocp->ioc_count;
9653 		mi_copyin(q, mp, NULL, copyin_size);
9654 		return;
9655 
9656 	case O_SIOCGLIFCONF:
9657 	case SIOCGLIFCONF:
9658 		copyin_size = SIZEOF_STRUCT(lifconf, iocp->ioc_flag);
9659 		mi_copyin(q, mp, NULL, copyin_size);
9660 		return;
9661 
9662 	case SIOCGLIFSRCOF:
9663 		copyin_size = SIZEOF_STRUCT(lifsrcof, iocp->ioc_flag);
9664 		mi_copyin(q, mp, NULL, copyin_size);
9665 		return;
9666 	case SIOCGIP6ADDRPOLICY:
9667 		ip_sioctl_ip6addrpolicy(q, mp);
9668 		ip6_asp_table_refrele();
9669 		return;
9670 
9671 	case SIOCSIP6ADDRPOLICY:
9672 		ip_sioctl_ip6addrpolicy(q, mp);
9673 		return;
9674 
9675 	case SIOCGDSTINFO:
9676 		ip_sioctl_dstinfo(q, mp);
9677 		ip6_asp_table_refrele();
9678 		return;
9679 
9680 	case I_PLINK:
9681 	case I_PUNLINK:
9682 	case I_LINK:
9683 	case I_UNLINK:
9684 		/*
9685 		 * We treat non-persistent link similarly as the persistent
9686 		 * link case, in terms of plumbing/unplumbing, as well as
9687 		 * dynamic re-plumbing events indicator.  See comments
9688 		 * in ip_sioctl_plink() for more.
9689 		 *
9690 		 * Request can be enqueued in the 'ipsq' while waiting
9691 		 * to become exclusive. So bump up the conn ref.
9692 		 */
9693 		if (CONN_Q(q))
9694 			CONN_INC_REF(Q_TO_CONN(q));
9695 		ip_sioctl_plink(NULL, q, mp, NULL);
9696 		return;
9697 
9698 	case ND_GET:
9699 	case ND_SET:
9700 		/*
9701 		 * Use of the nd table requires holding the reader lock.
9702 		 * Modifying the nd table thru nd_load/nd_unload requires
9703 		 * the writer lock.
9704 		 */
9705 		rw_enter(&ip_g_nd_lock, RW_READER);
9706 		if (nd_getset(q, ip_g_nd, mp)) {
9707 			rw_exit(&ip_g_nd_lock);
9708 
9709 			if (iocp->ioc_error)
9710 				iocp->ioc_count = 0;
9711 			mp->b_datap->db_type = M_IOCACK;
9712 			qreply(q, mp);
9713 			return;
9714 		}
9715 		rw_exit(&ip_g_nd_lock);
9716 		/*
9717 		 * We don't understand this subioctl of ND_GET / ND_SET.
9718 		 * Maybe intended for some driver / module below us
9719 		 */
9720 		if (q->q_next) {
9721 			putnext(q, mp);
9722 		} else {
9723 			iocp->ioc_error = ENOENT;
9724 			mp->b_datap->db_type = M_IOCNAK;
9725 			iocp->ioc_count = 0;
9726 			qreply(q, mp);
9727 		}
9728 		return;
9729 
9730 	case IP_IOCTL:
9731 		ip_wput_ioctl(q, mp);
9732 		return;
9733 	default:
9734 		cmn_err(CE_PANIC, "should not happen ");
9735 	}
9736 nak:
9737 	if (mp->b_cont != NULL) {
9738 		freemsg(mp->b_cont);
9739 		mp->b_cont = NULL;
9740 	}
9741 	iocp->ioc_error = EINVAL;
9742 	mp->b_datap->db_type = M_IOCNAK;
9743 	iocp->ioc_count = 0;
9744 	qreply(q, mp);
9745 }
9746 
9747 /* ip_wput hands off ARP IOCTL responses to us */
9748 void
9749 ip_sioctl_iocack(queue_t *q, mblk_t *mp)
9750 {
9751 	struct arpreq *ar;
9752 	struct xarpreq *xar;
9753 	area_t	*area;
9754 	mblk_t	*area_mp;
9755 	struct iocblk *iocp;
9756 	mblk_t	*orig_ioc_mp, *tmp;
9757 	struct iocblk	*orig_iocp;
9758 	ill_t *ill;
9759 	conn_t *connp = NULL;
9760 	uint_t ioc_id;
9761 	mblk_t *pending_mp;
9762 	int x_arp_ioctl = B_FALSE, ifx_arp_ioctl = B_FALSE;
9763 	int *flagsp;
9764 	char *storage = NULL;
9765 	sin_t *sin;
9766 	ipaddr_t addr;
9767 	int err;
9768 
9769 	ill = q->q_ptr;
9770 	ASSERT(ill != NULL);
9771 
9772 	/*
9773 	 * We should get back from ARP a packet chain that looks like:
9774 	 * M_IOCACK-->ARP_op_MBLK-->ORIG_M_IOCTL-->MI_COPY_MBLK-->[X]ARPREQ_MBLK
9775 	 */
9776 	if (!(area_mp = mp->b_cont) ||
9777 	    (area_mp->b_wptr - area_mp->b_rptr) < sizeof (ip_sock_ar_t) ||
9778 	    !(orig_ioc_mp = area_mp->b_cont) ||
9779 	    !orig_ioc_mp->b_cont || !orig_ioc_mp->b_cont->b_cont) {
9780 		freemsg(mp);
9781 		return;
9782 	}
9783 
9784 	orig_iocp = (struct iocblk *)orig_ioc_mp->b_rptr;
9785 
9786 	tmp = (orig_ioc_mp->b_cont)->b_cont;
9787 	if ((orig_iocp->ioc_cmd == SIOCGXARP) ||
9788 	    (orig_iocp->ioc_cmd == SIOCSXARP) ||
9789 	    (orig_iocp->ioc_cmd == SIOCDXARP)) {
9790 		x_arp_ioctl = B_TRUE;
9791 		xar = (struct xarpreq *)tmp->b_rptr;
9792 		sin = (sin_t *)&xar->xarp_pa;
9793 		flagsp = &xar->xarp_flags;
9794 		storage = xar->xarp_ha.sdl_data;
9795 		if (xar->xarp_ha.sdl_nlen != 0)
9796 			ifx_arp_ioctl = B_TRUE;
9797 	} else {
9798 		ar = (struct arpreq *)tmp->b_rptr;
9799 		sin = (sin_t *)&ar->arp_pa;
9800 		flagsp = &ar->arp_flags;
9801 		storage = ar->arp_ha.sa_data;
9802 	}
9803 
9804 	iocp = (struct iocblk *)mp->b_rptr;
9805 
9806 	/*
9807 	 * Pick out the originating queue based on the ioc_id.
9808 	 */
9809 	ioc_id = iocp->ioc_id;
9810 	pending_mp = ill_pending_mp_get(ill, &connp, ioc_id);
9811 	if (pending_mp == NULL) {
9812 		ASSERT(connp == NULL);
9813 		inet_freemsg(mp);
9814 		return;
9815 	}
9816 	ASSERT(connp != NULL);
9817 	q = CONNP_TO_WQ(connp);
9818 
9819 	/* Uncouple the internally generated IOCTL from the original one */
9820 	area = (area_t *)area_mp->b_rptr;
9821 	area_mp->b_cont = NULL;
9822 
9823 	/*
9824 	 * Restore the b_next and b_prev used by mi code. This is needed
9825 	 * to complete the ioctl using mi* functions. We stored them in
9826 	 * the pending mp prior to sending the request to ARP.
9827 	 */
9828 	orig_ioc_mp->b_cont->b_next = pending_mp->b_cont->b_next;
9829 	orig_ioc_mp->b_cont->b_prev = pending_mp->b_cont->b_prev;
9830 	inet_freemsg(pending_mp);
9831 
9832 	/*
9833 	 * We're done if there was an error or if this is not an SIOCG{X}ARP
9834 	 * Catch the case where there is an IRE_CACHE by no entry in the
9835 	 * arp table.
9836 	 */
9837 	addr = sin->sin_addr.s_addr;
9838 	if (iocp->ioc_error && iocp->ioc_cmd == AR_ENTRY_SQUERY) {
9839 		ire_t			*ire;
9840 		dl_unitdata_req_t	*dlup;
9841 		mblk_t			*llmp;
9842 		int			addr_len;
9843 		ill_t			*ipsqill = NULL;
9844 
9845 		if (ifx_arp_ioctl) {
9846 			/*
9847 			 * There's no need to lookup the ill, since
9848 			 * we've already done that when we started
9849 			 * processing the ioctl and sent the message
9850 			 * to ARP on that ill.  So use the ill that
9851 			 * is stored in q->q_ptr.
9852 			 */
9853 			ipsqill = ill;
9854 			ire = ire_ctable_lookup(addr, 0, IRE_CACHE,
9855 			    ipsqill->ill_ipif, ALL_ZONES,
9856 			    MATCH_IRE_TYPE | MATCH_IRE_ILL);
9857 		} else {
9858 			ire = ire_ctable_lookup(addr, 0, IRE_CACHE,
9859 			    NULL, ALL_ZONES, MATCH_IRE_TYPE);
9860 			if (ire != NULL)
9861 				ipsqill = ire_to_ill(ire);
9862 		}
9863 
9864 		if ((x_arp_ioctl) && (ipsqill != NULL))
9865 			storage += ill_xarp_info(&xar->xarp_ha, ipsqill);
9866 
9867 		if (ire != NULL) {
9868 			*flagsp = ATF_INUSE;
9869 			llmp = ire->ire_dlureq_mp;
9870 			if (llmp != NULL && ipsqill != NULL) {
9871 				uchar_t *macaddr;
9872 
9873 				addr_len = ipsqill->ill_phys_addr_length;
9874 				if (x_arp_ioctl && ((addr_len +
9875 				    ipsqill->ill_name_length) >
9876 				    sizeof (xar->xarp_ha.sdl_data))) {
9877 					ire_refrele(ire);
9878 					freemsg(mp);
9879 					ip_ioctl_finish(q, orig_ioc_mp,
9880 					    EINVAL, NO_COPYOUT, NULL, NULL);
9881 					return;
9882 				}
9883 				*flagsp |= ATF_COM;
9884 				dlup = (dl_unitdata_req_t *)llmp->b_rptr;
9885 				if (ipsqill->ill_sap_length < 0)
9886 					macaddr = llmp->b_rptr +
9887 					    dlup->dl_dest_addr_offset;
9888 				else
9889 					macaddr = llmp->b_rptr +
9890 					    dlup->dl_dest_addr_offset +
9891 					    ipsqill->ill_sap_length;
9892 				/*
9893 				 * For SIOCGARP, MAC address length
9894 				 * validation has already been done
9895 				 * before the ioctl was issued to ARP to
9896 				 * allow it to progress only on 6 byte
9897 				 * addressable (ethernet like) media. Thus
9898 				 * the mac address copying can not overwrite
9899 				 * the sa_data area below.
9900 				 */
9901 				bcopy(macaddr, storage, addr_len);
9902 			}
9903 			/* Ditch the internal IOCTL. */
9904 			freemsg(mp);
9905 			ire_refrele(ire);
9906 			ip_ioctl_finish(q, orig_ioc_mp, 0, COPYOUT, NULL, NULL);
9907 			return;
9908 		}
9909 	}
9910 
9911 	/*
9912 	 * Delete the coresponding IRE_CACHE if any.
9913 	 * Reset the error if there was one (in case there was no entry
9914 	 * in arp.)
9915 	 */
9916 	if (iocp->ioc_cmd == AR_ENTRY_DELETE) {
9917 		ipif_t *ipintf = NULL;
9918 
9919 		if (ifx_arp_ioctl) {
9920 			/*
9921 			 * There's no need to lookup the ill, since
9922 			 * we've already done that when we started
9923 			 * processing the ioctl and sent the message
9924 			 * to ARP on that ill.  So use the ill that
9925 			 * is stored in q->q_ptr.
9926 			 */
9927 			ipintf = ill->ill_ipif;
9928 		}
9929 		if (ip_ire_clookup_and_delete(addr, ipintf)) {
9930 			/*
9931 			 * The address in "addr" may be an entry for a
9932 			 * router. If that's true, then any off-net
9933 			 * IRE_CACHE entries that go through the router
9934 			 * with address "addr" must be clobbered. Use
9935 			 * ire_walk to achieve this goal.
9936 			 */
9937 			if (ifx_arp_ioctl)
9938 				ire_walk_ill_v4(MATCH_IRE_ILL, 0,
9939 				    ire_delete_cache_gw, (char *)&addr, ill);
9940 			else
9941 				ire_walk_v4(ire_delete_cache_gw, (char *)&addr,
9942 				    ALL_ZONES);
9943 			iocp->ioc_error = 0;
9944 		}
9945 	}
9946 
9947 	if (iocp->ioc_error || iocp->ioc_cmd != AR_ENTRY_SQUERY) {
9948 		err = iocp->ioc_error;
9949 		freemsg(mp);
9950 		ip_ioctl_finish(q, orig_ioc_mp, err, NO_COPYOUT, NULL, NULL);
9951 		return;
9952 	}
9953 
9954 	/*
9955 	 * Completion of an SIOCG{X}ARP.  Translate the information from
9956 	 * the area_t into the struct {x}arpreq.
9957 	 */
9958 	if (x_arp_ioctl) {
9959 		storage += ill_xarp_info(&xar->xarp_ha, ill);
9960 		if ((ill->ill_phys_addr_length + ill->ill_name_length) >
9961 		    sizeof (xar->xarp_ha.sdl_data)) {
9962 			freemsg(mp);
9963 			ip_ioctl_finish(q, orig_ioc_mp, EINVAL,
9964 			    NO_COPYOUT, NULL, NULL);
9965 			return;
9966 		}
9967 	}
9968 	*flagsp = ATF_INUSE;
9969 	if (area->area_flags & ACE_F_PERMANENT)
9970 		*flagsp |= ATF_PERM;
9971 	if (area->area_flags & ACE_F_PUBLISH)
9972 		*flagsp |= ATF_PUBL;
9973 	if (area->area_hw_addr_length != 0) {
9974 		*flagsp |= ATF_COM;
9975 		/*
9976 		 * For SIOCGARP, MAC address length validation has
9977 		 * already been done before the ioctl was issued to ARP
9978 		 * to allow it to progress only on 6 byte addressable
9979 		 * (ethernet like) media. Thus the mac address copying
9980 		 * can not overwrite the sa_data area below.
9981 		 */
9982 		bcopy((char *)area + area->area_hw_addr_offset,
9983 		    storage, area->area_hw_addr_length);
9984 	}
9985 
9986 	/* Ditch the internal IOCTL. */
9987 	freemsg(mp);
9988 	/* Complete the original. */
9989 	ip_ioctl_finish(q, orig_ioc_mp, 0, COPYOUT, NULL, NULL);
9990 }
9991 
9992 /*
9993  * Create a new logical interface. If ipif_id is zero (i.e. not a logical
9994  * interface) create the next available logical interface for this
9995  * physical interface.
9996  * If ipif is NULL (i.e. the lookup didn't find one) attempt to create an
9997  * ipif with the specified name.
9998  *
9999  * If the address family is not AF_UNSPEC then set the address as well.
10000  *
10001  * If ip_sioctl_addr returns EINPROGRESS then the ioctl (the copyout)
10002  * is completed when the DL_BIND_ACK arrive in ip_rput_dlpi_writer.
10003  *
10004  * Executed as a writer on the ill or ill group.
10005  * So no lock is needed to traverse the ipif chain, or examine the
10006  * phyint flags.
10007  */
10008 /* ARGSUSED */
10009 int
10010 ip_sioctl_addif(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
10011     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
10012 {
10013 	mblk_t	*mp1;
10014 	struct lifreq *lifr;
10015 	boolean_t	isv6;
10016 	boolean_t	exists;
10017 	char 	*name;
10018 	char	*endp;
10019 	char	*cp;
10020 	int	namelen;
10021 	ipif_t	*ipif;
10022 	long	id;
10023 	ipsq_t	*ipsq;
10024 	ill_t	*ill;
10025 	sin_t	*sin;
10026 	int	err = 0;
10027 	boolean_t found_sep = B_FALSE;
10028 	conn_t	*connp;
10029 	zoneid_t zoneid;
10030 	int	orig_ifindex = 0;
10031 
10032 	ip1dbg(("ip_sioctl_addif\n"));
10033 	/* Existence of mp1 has been checked in ip_wput_nondata */
10034 	mp1 = mp->b_cont->b_cont;
10035 	/*
10036 	 * Null terminate the string to protect against buffer
10037 	 * overrun. String was generated by user code and may not
10038 	 * be trusted.
10039 	 */
10040 	lifr = (struct lifreq *)mp1->b_rptr;
10041 	lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
10042 	name = lifr->lifr_name;
10043 	ASSERT(CONN_Q(q));
10044 	connp = Q_TO_CONN(q);
10045 	isv6 = connp->conn_af_isv6;
10046 	zoneid = connp->conn_zoneid;
10047 	namelen = mi_strlen(name);
10048 	if (namelen == 0)
10049 		return (EINVAL);
10050 
10051 	exists = B_FALSE;
10052 	if ((namelen + 1 == sizeof (ipif_loopback_name)) &&
10053 	    (mi_strcmp(name, ipif_loopback_name) == 0)) {
10054 		/*
10055 		 * Allow creating lo0 using SIOCLIFADDIF.
10056 		 * can't be any other writer thread. So can pass null below
10057 		 * for the last 4 args to ipif_lookup_name.
10058 		 */
10059 		ipif = ipif_lookup_on_name(lifr->lifr_name, namelen,
10060 		    B_TRUE, &exists, isv6, zoneid, NULL, NULL, NULL, NULL);
10061 		/* Prevent any further action */
10062 		if (ipif == NULL) {
10063 			return (ENOBUFS);
10064 		} else if (!exists) {
10065 			/* We created the ipif now and as writer */
10066 			ipif_refrele(ipif);
10067 			return (0);
10068 		} else {
10069 			ill = ipif->ipif_ill;
10070 			ill_refhold(ill);
10071 			ipif_refrele(ipif);
10072 		}
10073 	} else {
10074 		/* Look for a colon in the name. */
10075 		endp = &name[namelen];
10076 		for (cp = endp; --cp > name; ) {
10077 			if (*cp == IPIF_SEPARATOR_CHAR) {
10078 				found_sep = B_TRUE;
10079 				/*
10080 				 * Reject any non-decimal aliases for plumbing
10081 				 * of logical interfaces. Aliases with leading
10082 				 * zeroes are also rejected as they introduce
10083 				 * ambiguity in the naming of the interfaces.
10084 				 * Comparing with "0" takes care of all such
10085 				 * cases.
10086 				 */
10087 				if ((strncmp("0", cp+1, 1)) == 0)
10088 					return (EINVAL);
10089 
10090 				if (ddi_strtol(cp+1, &endp, 10, &id) != 0 ||
10091 				    id <= 0 || *endp != '\0') {
10092 					return (EINVAL);
10093 				}
10094 				*cp = '\0';
10095 				break;
10096 			}
10097 		}
10098 		ill = ill_lookup_on_name(name, B_FALSE, isv6,
10099 		    CONNP_TO_WQ(connp), mp, ip_process_ioctl, &err, NULL);
10100 		if (found_sep)
10101 			*cp = IPIF_SEPARATOR_CHAR;
10102 		if (ill == NULL)
10103 			return (err);
10104 	}
10105 
10106 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_process_ioctl, NEW_OP,
10107 	    B_TRUE);
10108 
10109 	/*
10110 	 * Release the refhold due to the lookup, now that we are excl
10111 	 * or we are just returning
10112 	 */
10113 	ill_refrele(ill);
10114 
10115 	if (ipsq == NULL)
10116 		return (EINPROGRESS);
10117 
10118 	/*
10119 	 * If the interface is failed, inactive or offlined, look for a working
10120 	 * interface in the ill group and create the ipif there. If we can't
10121 	 * find a good interface, create the ipif anyway so that in.mpathd can
10122 	 * move it to the first repaired interface.
10123 	 */
10124 	if ((ill->ill_phyint->phyint_flags &
10125 	    (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) &&
10126 	    ill->ill_phyint->phyint_groupname_len != 0) {
10127 		phyint_t *phyi;
10128 		char *groupname = ill->ill_phyint->phyint_groupname;
10129 
10130 		/*
10131 		 * We're looking for a working interface, but it doesn't matter
10132 		 * if it's up or down; so instead of following the group lists,
10133 		 * we look at each physical interface and compare the groupname.
10134 		 * We're only interested in interfaces with IPv4 (resp. IPv6)
10135 		 * plumbed when we're adding an IPv4 (resp. IPv6) ipif.
10136 		 * Otherwise we create the ipif on the failed interface.
10137 		 */
10138 		rw_enter(&ill_g_lock, RW_READER);
10139 		phyi = avl_first(&phyint_g_list.phyint_list_avl_by_index);
10140 		for (; phyi != NULL;
10141 		    phyi = avl_walk(&phyint_g_list.phyint_list_avl_by_index,
10142 		    phyi, AVL_AFTER)) {
10143 			if (phyi->phyint_groupname_len == 0)
10144 				continue;
10145 			ASSERT(phyi->phyint_groupname != NULL);
10146 			if (mi_strcmp(groupname, phyi->phyint_groupname) == 0 &&
10147 			    !(phyi->phyint_flags &
10148 			    (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) &&
10149 			    (ill->ill_isv6 ? (phyi->phyint_illv6 != NULL) :
10150 			    (phyi->phyint_illv4 != NULL))) {
10151 				break;
10152 			}
10153 		}
10154 		rw_exit(&ill_g_lock);
10155 
10156 		if (phyi != NULL) {
10157 			orig_ifindex = ill->ill_phyint->phyint_ifindex;
10158 			ill = (ill->ill_isv6 ? phyi->phyint_illv6 :
10159 			    phyi->phyint_illv4);
10160 		}
10161 	}
10162 
10163 	/*
10164 	 * We are now exclusive on the ipsq, so an ill move will be serialized
10165 	 * before or after us.
10166 	 */
10167 	ASSERT(IAM_WRITER_ILL(ill));
10168 	ASSERT(ill->ill_move_in_progress == B_FALSE);
10169 
10170 	if (found_sep && orig_ifindex == 0) {
10171 		/* Now see if there is an IPIF with this unit number. */
10172 		for (ipif = ill->ill_ipif; ipif; ipif = ipif->ipif_next) {
10173 			if (ipif->ipif_id == id) {
10174 				err = EEXIST;
10175 				goto done;
10176 			}
10177 		}
10178 	}
10179 
10180 	/*
10181 	 * We use IRE_LOCAL for lo0:1 etc. for "receive only" use
10182 	 * of lo0. We never come here when we plumb lo0:0. It
10183 	 * happens in ipif_lookup_on_name.
10184 	 * The specified unit number is ignored when we create the ipif on a
10185 	 * different interface. However, we save it in ipif_orig_ipifid below so
10186 	 * that the ipif fails back to the right position.
10187 	 */
10188 	if ((ipif = ipif_allocate(ill, (found_sep && orig_ifindex == 0) ?
10189 	    id : -1, IRE_LOCAL, B_TRUE)) == NULL) {
10190 		err = ENOBUFS;
10191 		goto done;
10192 	}
10193 
10194 	/* Return created name with ioctl */
10195 	(void) sprintf(lifr->lifr_name, "%s%c%d", ill->ill_name,
10196 	    IPIF_SEPARATOR_CHAR, ipif->ipif_id);
10197 	ip1dbg(("created %s\n", lifr->lifr_name));
10198 
10199 	/* Set address */
10200 	sin = (sin_t *)&lifr->lifr_addr;
10201 	if (sin->sin_family != AF_UNSPEC) {
10202 		err = ip_sioctl_addr(ipif, sin, q, mp,
10203 		    &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], lifr);
10204 	}
10205 
10206 	/* Set ifindex and unit number for failback */
10207 	if (err == 0 && orig_ifindex != 0) {
10208 		ipif->ipif_orig_ifindex = orig_ifindex;
10209 		if (found_sep) {
10210 			ipif->ipif_orig_ipifid = id;
10211 		}
10212 	}
10213 
10214 done:
10215 	ipsq_exit(ipsq, B_TRUE, B_TRUE);
10216 	return (err);
10217 }
10218 
10219 /*
10220  * Remove an existing logical interface. If ipif_id is zero (i.e. not a logical
10221  * interface) delete it based on the IP address (on this physical interface).
10222  * Otherwise delete it based on the ipif_id.
10223  * Also, special handling to allow a removeif of lo0.
10224  */
10225 /* ARGSUSED */
10226 int
10227 ip_sioctl_removeif(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10228     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
10229 {
10230 	conn_t		*connp;
10231 	ill_t		*ill = ipif->ipif_ill;
10232 	boolean_t	 success;
10233 
10234 	ip1dbg(("ip_sioctl_remove_if(%s:%u %p)\n",
10235 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10236 	ASSERT(IAM_WRITER_IPIF(ipif));
10237 
10238 	connp = Q_TO_CONN(q);
10239 	/*
10240 	 * Special case for unplumbing lo0 (the loopback physical interface).
10241 	 * If unplumbing lo0, the incoming address structure has been
10242 	 * initialized to all zeros. When unplumbing lo0, all its logical
10243 	 * interfaces must be removed too.
10244 	 *
10245 	 * Note that this interface may be called to remove a specific
10246 	 * loopback logical interface (eg, lo0:1). But in that case
10247 	 * ipif->ipif_id != 0 so that the code path for that case is the
10248 	 * same as any other interface (meaning it skips the code directly
10249 	 * below).
10250 	 */
10251 	if (ipif->ipif_id == 0 && ipif->ipif_net_type == IRE_LOOPBACK) {
10252 		if (sin->sin_family == AF_UNSPEC &&
10253 		    (IN6_IS_ADDR_UNSPECIFIED(&((sin6_t *)sin)->sin6_addr))) {
10254 			/*
10255 			 * Mark it condemned. No new ref. will be made to ill.
10256 			 */
10257 			mutex_enter(&ill->ill_lock);
10258 			ill->ill_state_flags |= ILL_CONDEMNED;
10259 			for (ipif = ill->ill_ipif; ipif != NULL;
10260 			    ipif = ipif->ipif_next) {
10261 				ipif->ipif_state_flags |= IPIF_CONDEMNED;
10262 			}
10263 			mutex_exit(&ill->ill_lock);
10264 
10265 			ipif = ill->ill_ipif;
10266 			/* unplumb the loopback interface */
10267 			ill_delete(ill);
10268 			mutex_enter(&connp->conn_lock);
10269 			mutex_enter(&ill->ill_lock);
10270 			ASSERT(ill->ill_group == NULL);
10271 
10272 			/* Are any references to this ill active */
10273 			if (ill_is_quiescent(ill)) {
10274 				mutex_exit(&ill->ill_lock);
10275 				mutex_exit(&connp->conn_lock);
10276 				ill_delete_tail(ill);
10277 				mi_free(ill);
10278 				return (0);
10279 			}
10280 			success = ipsq_pending_mp_add(connp, ipif,
10281 			    CONNP_TO_WQ(connp), mp, ILL_FREE);
10282 			mutex_exit(&connp->conn_lock);
10283 			mutex_exit(&ill->ill_lock);
10284 			if (success)
10285 				return (EINPROGRESS);
10286 			else
10287 				return (EINTR);
10288 		}
10289 	}
10290 
10291 	/*
10292 	 * We are exclusive on the ipsq, so an ill move will be serialized
10293 	 * before or after us.
10294 	 */
10295 	ASSERT(ill->ill_move_in_progress == B_FALSE);
10296 
10297 	if (ipif->ipif_id == 0) {
10298 		/* Find based on address */
10299 		if (ipif->ipif_isv6) {
10300 			sin6_t *sin6;
10301 
10302 			if (sin->sin_family != AF_INET6)
10303 				return (EAFNOSUPPORT);
10304 
10305 			sin6 = (sin6_t *)sin;
10306 			/* We are a writer, so we should be able to lookup */
10307 			ipif = ipif_lookup_addr_v6(&sin6->sin6_addr,
10308 			    ill, ALL_ZONES, NULL, NULL, NULL, NULL);
10309 			if (ipif == NULL) {
10310 				/*
10311 				 * Maybe the address in on another interface in
10312 				 * the same IPMP group? We check this below.
10313 				 */
10314 				ipif = ipif_lookup_addr_v6(&sin6->sin6_addr,
10315 				    NULL, ALL_ZONES, NULL, NULL, NULL, NULL);
10316 			}
10317 		} else {
10318 			ipaddr_t addr;
10319 
10320 			if (sin->sin_family != AF_INET)
10321 				return (EAFNOSUPPORT);
10322 
10323 			addr = sin->sin_addr.s_addr;
10324 			/* We are a writer, so we should be able to lookup */
10325 			ipif = ipif_lookup_addr(addr, ill, ALL_ZONES, NULL,
10326 			    NULL, NULL, NULL);
10327 			if (ipif == NULL) {
10328 				/*
10329 				 * Maybe the address in on another interface in
10330 				 * the same IPMP group? We check this below.
10331 				 */
10332 				ipif = ipif_lookup_addr(addr, NULL, ALL_ZONES,
10333 				    NULL, NULL, NULL, NULL);
10334 			}
10335 		}
10336 		if (ipif == NULL) {
10337 			return (EADDRNOTAVAIL);
10338 		}
10339 		/*
10340 		 * When the address to be removed is hosted on a different
10341 		 * interface, we check if the interface is in the same IPMP
10342 		 * group as the specified one; if so we proceed with the
10343 		 * removal.
10344 		 * ill->ill_group is NULL when the ill is down, so we have to
10345 		 * compare the group names instead.
10346 		 */
10347 		if (ipif->ipif_ill != ill &&
10348 		    (ipif->ipif_ill->ill_phyint->phyint_groupname_len == 0 ||
10349 		    ill->ill_phyint->phyint_groupname_len == 0 ||
10350 		    mi_strcmp(ipif->ipif_ill->ill_phyint->phyint_groupname,
10351 		    ill->ill_phyint->phyint_groupname) != 0)) {
10352 			ipif_refrele(ipif);
10353 			return (EADDRNOTAVAIL);
10354 		}
10355 
10356 		/* This is a writer */
10357 		ipif_refrele(ipif);
10358 	}
10359 
10360 	/*
10361 	 * Can not delete instance zero since it is tied to the ill.
10362 	 */
10363 	if (ipif->ipif_id == 0)
10364 		return (EBUSY);
10365 
10366 	mutex_enter(&ill->ill_lock);
10367 	ipif->ipif_state_flags |= IPIF_CONDEMNED;
10368 	mutex_exit(&ill->ill_lock);
10369 
10370 	ipif_free(ipif);
10371 
10372 	mutex_enter(&connp->conn_lock);
10373 	mutex_enter(&ill->ill_lock);
10374 
10375 	/* Are any references to this ipif active */
10376 	if (ipif->ipif_refcnt == 0 && ipif->ipif_ire_cnt == 0) {
10377 		mutex_exit(&ill->ill_lock);
10378 		mutex_exit(&connp->conn_lock);
10379 		ipif_down_tail(ipif);
10380 		ipif_free_tail(ipif);
10381 		return (0);
10382 	    }
10383 	success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp), mp,
10384 	    IPIF_FREE);
10385 	mutex_exit(&ill->ill_lock);
10386 	mutex_exit(&connp->conn_lock);
10387 	if (success)
10388 		return (EINPROGRESS);
10389 	else
10390 		return (EINTR);
10391 }
10392 
10393 /*
10394  * Restart the removeif ioctl. The refcnt has gone down to 0.
10395  * The ipif is already condemned. So can't find it thru lookups.
10396  */
10397 /* ARGSUSED */
10398 int
10399 ip_sioctl_removeif_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
10400     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_if_req)
10401 {
10402 	ill_t *ill;
10403 
10404 	ip1dbg(("ip_sioctl_removeif_restart(%s:%u %p)\n",
10405 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10406 	if (ipif->ipif_id == 0 && ipif->ipif_net_type == IRE_LOOPBACK) {
10407 		ill = ipif->ipif_ill;
10408 		ASSERT(IAM_WRITER_ILL(ill));
10409 		ASSERT((ipif->ipif_state_flags & IPIF_CONDEMNED) &&
10410 		    (ill->ill_state_flags & IPIF_CONDEMNED));
10411 		ill_delete_tail(ill);
10412 		mi_free(ill);
10413 		return (0);
10414 	}
10415 
10416 	ill = ipif->ipif_ill;
10417 	ASSERT(IAM_WRITER_IPIF(ipif));
10418 	ASSERT(ipif->ipif_state_flags & IPIF_CONDEMNED);
10419 
10420 	ipif_down_tail(ipif);
10421 	ipif_free_tail(ipif);
10422 
10423 	ILL_UNMARK_CHANGING(ill);
10424 	return (0);
10425 }
10426 
10427 /*
10428  * Set the local interface address.
10429  * Allow an address of all zero when the interface is down.
10430  */
10431 /* ARGSUSED */
10432 int
10433 ip_sioctl_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10434     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
10435 {
10436 	int err = 0;
10437 	in6_addr_t v6addr;
10438 	boolean_t need_up = B_FALSE;
10439 
10440 	ip1dbg(("ip_sioctl_addr(%s:%u %p)\n",
10441 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10442 
10443 	ASSERT(IAM_WRITER_IPIF(ipif));
10444 
10445 	if (ipif->ipif_isv6) {
10446 		sin6_t *sin6;
10447 		ill_t *ill;
10448 		phyint_t *phyi;
10449 
10450 		if (sin->sin_family != AF_INET6)
10451 			return (EAFNOSUPPORT);
10452 
10453 		sin6 = (sin6_t *)sin;
10454 		v6addr = sin6->sin6_addr;
10455 		ill = ipif->ipif_ill;
10456 		phyi = ill->ill_phyint;
10457 
10458 		/*
10459 		 * Enforce that true multicast interfaces have a link-local
10460 		 * address for logical unit 0.
10461 		 */
10462 		if (ipif->ipif_id == 0 &&
10463 		    (ill->ill_flags & ILLF_MULTICAST) &&
10464 		    !(ipif->ipif_flags & (IPIF_POINTOPOINT)) &&
10465 		    !(phyi->phyint_flags & (PHYI_LOOPBACK)) &&
10466 		    !IN6_IS_ADDR_LINKLOCAL(&v6addr)) {
10467 			return (EADDRNOTAVAIL);
10468 		}
10469 
10470 		/*
10471 		 * up interfaces shouldn't have the unspecified address
10472 		 * unless they also have the IPIF_NOLOCAL flags set and
10473 		 * have a subnet assigned.
10474 		 */
10475 		if ((ipif->ipif_flags & IPIF_UP) &&
10476 		    IN6_IS_ADDR_UNSPECIFIED(&v6addr) &&
10477 		    (!(ipif->ipif_flags & IPIF_NOLOCAL) ||
10478 		    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) {
10479 			return (EADDRNOTAVAIL);
10480 		}
10481 
10482 		if (!ip_local_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
10483 			return (EADDRNOTAVAIL);
10484 	} else {
10485 		ipaddr_t addr;
10486 
10487 		if (sin->sin_family != AF_INET)
10488 			return (EAFNOSUPPORT);
10489 
10490 		addr = sin->sin_addr.s_addr;
10491 
10492 		/* Allow 0 as the local address. */
10493 		if (addr != 0 && !ip_addr_ok_v4(addr, ipif->ipif_net_mask))
10494 			return (EADDRNOTAVAIL);
10495 
10496 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10497 	}
10498 
10499 
10500 	/*
10501 	 * Even if there is no change we redo things just to rerun
10502 	 * ipif_set_default.
10503 	 */
10504 	if (ipif->ipif_flags & IPIF_UP) {
10505 		/*
10506 		 * Setting a new local address, make sure
10507 		 * we have net and subnet bcast ire's for
10508 		 * the old address if we need them.
10509 		 */
10510 		if (!ipif->ipif_isv6)
10511 			ipif_check_bcast_ires(ipif);
10512 		/*
10513 		 * If the interface is already marked up,
10514 		 * we call ipif_down which will take care
10515 		 * of ditching any IREs that have been set
10516 		 * up based on the old interface address.
10517 		 */
10518 		err = ipif_logical_down(ipif, q, mp);
10519 		if (err == EINPROGRESS)
10520 			return (err);
10521 		ipif_down_tail(ipif);
10522 		need_up = 1;
10523 	}
10524 
10525 	err = ip_sioctl_addr_tail(ipif, sin, q, mp, need_up);
10526 	return (err);
10527 }
10528 
10529 int
10530 ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10531     boolean_t need_up)
10532 {
10533 	in6_addr_t v6addr;
10534 	ipaddr_t addr;
10535 	sin6_t	*sin6;
10536 	int	err = 0;
10537 
10538 	ip1dbg(("ip_sioctl_addr_tail(%s:%u %p)\n",
10539 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10540 	ASSERT(IAM_WRITER_IPIF(ipif));
10541 	if (ipif->ipif_isv6) {
10542 		sin6 = (sin6_t *)sin;
10543 		v6addr = sin6->sin6_addr;
10544 	} else {
10545 		addr = sin->sin_addr.s_addr;
10546 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10547 	}
10548 	mutex_enter(&ipif->ipif_ill->ill_lock);
10549 	ipif->ipif_v6lcl_addr = v6addr;
10550 	if (ipif->ipif_flags & (IPIF_ANYCAST | IPIF_NOLOCAL)) {
10551 		ipif->ipif_v6src_addr = ipv6_all_zeros;
10552 	} else {
10553 		ipif->ipif_v6src_addr = v6addr;
10554 	}
10555 
10556 	if ((ipif->ipif_isv6) && IN6_IS_ADDR_6TO4(&v6addr) &&
10557 		(!ipif->ipif_ill->ill_is_6to4tun)) {
10558 		queue_t *wqp = ipif->ipif_ill->ill_wq;
10559 
10560 		/*
10561 		 * The local address of this interface is a 6to4 address,
10562 		 * check if this interface is in fact a 6to4 tunnel or just
10563 		 * an interface configured with a 6to4 address.  We are only
10564 		 * interested in the former.
10565 		 */
10566 		if (wqp != NULL) {
10567 			while ((wqp->q_next != NULL) &&
10568 			    (wqp->q_next->q_qinfo != NULL) &&
10569 			    (wqp->q_next->q_qinfo->qi_minfo != NULL)) {
10570 
10571 				if (wqp->q_next->q_qinfo->qi_minfo->mi_idnum
10572 				    == TUN6TO4_MODID) {
10573 					/* set for use in IP */
10574 					ipif->ipif_ill->ill_is_6to4tun = 1;
10575 					break;
10576 				}
10577 				wqp = wqp->q_next;
10578 			}
10579 		}
10580 	}
10581 
10582 	ipif_set_default(ipif);
10583 	mutex_exit(&ipif->ipif_ill->ill_lock);
10584 
10585 	if (need_up) {
10586 		/*
10587 		 * Now bring the interface back up.  If this
10588 		 * is the only IPIF for the ILL, ipif_up
10589 		 * will have to re-bind to the device, so
10590 		 * we may get back EINPROGRESS, in which
10591 		 * case, this IOCTL will get completed in
10592 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
10593 		 */
10594 		err = ipif_up(ipif, q, mp);
10595 	} else {
10596 		/*
10597 		 * Update the IPIF list in SCTP, ipif_up_done() will do it
10598 		 * if need_up is true.
10599 		 */
10600 		sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
10601 	}
10602 
10603 	return (err);
10604 }
10605 
10606 
10607 /*
10608  * Restart entry point to restart the address set operation after the
10609  * refcounts have dropped to zero.
10610  */
10611 /* ARGSUSED */
10612 int
10613 ip_sioctl_addr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10614     ip_ioctl_cmd_t *ipip, void *ifreq)
10615 {
10616 	ip1dbg(("ip_sioctl_addr_restart(%s:%u %p)\n",
10617 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10618 	ASSERT(IAM_WRITER_IPIF(ipif));
10619 	ipif_down_tail(ipif);
10620 	return (ip_sioctl_addr_tail(ipif, sin, q, mp, B_TRUE));
10621 }
10622 
10623 /* ARGSUSED */
10624 int
10625 ip_sioctl_get_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10626     ip_ioctl_cmd_t *ipip, void *if_req)
10627 {
10628 	sin6_t *sin6 = (struct sockaddr_in6 *)sin;
10629 	struct lifreq *lifr = (struct lifreq *)if_req;
10630 
10631 	ip1dbg(("ip_sioctl_get_addr(%s:%u %p)\n",
10632 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10633 	/*
10634 	 * The net mask and address can't change since we have a
10635 	 * reference to the ipif. So no lock is necessary.
10636 	 */
10637 	if (ipif->ipif_isv6) {
10638 		*sin6 = sin6_null;
10639 		sin6->sin6_family = AF_INET6;
10640 		sin6->sin6_addr = ipif->ipif_v6lcl_addr;
10641 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
10642 		lifr->lifr_addrlen =
10643 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
10644 	} else {
10645 		*sin = sin_null;
10646 		sin->sin_family = AF_INET;
10647 		sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
10648 		if (ipip->ipi_cmd_type == LIF_CMD) {
10649 			lifr->lifr_addrlen =
10650 			    ip_mask_to_plen(ipif->ipif_net_mask);
10651 		}
10652 	}
10653 	return (0);
10654 }
10655 
10656 /*
10657  * Set the destination address for a pt-pt interface.
10658  */
10659 /* ARGSUSED */
10660 int
10661 ip_sioctl_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10662     ip_ioctl_cmd_t *ipip, void *if_req)
10663 {
10664 	int err = 0;
10665 	in6_addr_t v6addr;
10666 	boolean_t need_up = B_FALSE;
10667 
10668 	ip1dbg(("ip_sioctl_dstaddr(%s:%u %p)\n",
10669 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10670 	ASSERT(IAM_WRITER_IPIF(ipif));
10671 
10672 	if (ipif->ipif_isv6) {
10673 		sin6_t *sin6;
10674 
10675 		if (sin->sin_family != AF_INET6)
10676 			return (EAFNOSUPPORT);
10677 
10678 		sin6 = (sin6_t *)sin;
10679 		v6addr = sin6->sin6_addr;
10680 
10681 		if (!ip_remote_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
10682 			return (EADDRNOTAVAIL);
10683 	} else {
10684 		ipaddr_t addr;
10685 
10686 		if (sin->sin_family != AF_INET)
10687 			return (EAFNOSUPPORT);
10688 
10689 		addr = sin->sin_addr.s_addr;
10690 		if (!ip_addr_ok_v4(addr, ipif->ipif_net_mask))
10691 			return (EADDRNOTAVAIL);
10692 
10693 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10694 	}
10695 
10696 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, &v6addr))
10697 		return (0);	/* No change */
10698 
10699 	if (ipif->ipif_flags & IPIF_UP) {
10700 		/*
10701 		 * If the interface is already marked up,
10702 		 * we call ipif_down which will take care
10703 		 * of ditching any IREs that have been set
10704 		 * up based on the old pp dst address.
10705 		 */
10706 		err = ipif_logical_down(ipif, q, mp);
10707 		if (err == EINPROGRESS)
10708 			return (err);
10709 		ipif_down_tail(ipif);
10710 		need_up = B_TRUE;
10711 	}
10712 	/*
10713 	 * could return EINPROGRESS. If so ioctl will complete in
10714 	 * ip_rput_dlpi_writer
10715 	 */
10716 	err = ip_sioctl_dstaddr_tail(ipif, sin, q, mp, need_up);
10717 	return (err);
10718 }
10719 
10720 static int
10721 ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10722     boolean_t need_up)
10723 {
10724 	in6_addr_t v6addr;
10725 	ill_t	*ill = ipif->ipif_ill;
10726 	int	err = 0;
10727 
10728 	ip1dbg(("ip_sioctl_dstaddr_tail(%s:%u %p)\n",
10729 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10730 	if (ipif->ipif_isv6) {
10731 		sin6_t *sin6;
10732 
10733 		sin6 = (sin6_t *)sin;
10734 		v6addr = sin6->sin6_addr;
10735 	} else {
10736 		ipaddr_t addr;
10737 
10738 		addr = sin->sin_addr.s_addr;
10739 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10740 	}
10741 	mutex_enter(&ill->ill_lock);
10742 	/* Set point to point destination address. */
10743 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
10744 		/*
10745 		 * Allow this as a means of creating logical
10746 		 * pt-pt interfaces on top of e.g. an Ethernet.
10747 		 * XXX Undocumented HACK for testing.
10748 		 * pt-pt interfaces are created with NUD disabled.
10749 		 */
10750 		ipif->ipif_flags |= IPIF_POINTOPOINT;
10751 		ipif->ipif_flags &= ~IPIF_BROADCAST;
10752 		if (ipif->ipif_isv6)
10753 			ipif->ipif_ill->ill_flags |= ILLF_NONUD;
10754 	}
10755 
10756 	/* Set the new address. */
10757 	ipif->ipif_v6pp_dst_addr = v6addr;
10758 	/* Make sure subnet tracks pp_dst */
10759 	ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
10760 	mutex_exit(&ill->ill_lock);
10761 
10762 	if (need_up) {
10763 		/*
10764 		 * Now bring the interface back up.  If this
10765 		 * is the only IPIF for the ILL, ipif_up
10766 		 * will have to re-bind to the device, so
10767 		 * we may get back EINPROGRESS, in which
10768 		 * case, this IOCTL will get completed in
10769 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
10770 		 */
10771 		err = ipif_up(ipif, q, mp);
10772 	}
10773 	return (err);
10774 }
10775 
10776 /*
10777  * Restart entry point to restart the dstaddress set operation after the
10778  * refcounts have dropped to zero.
10779  */
10780 /* ARGSUSED */
10781 int
10782 ip_sioctl_dstaddr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10783     ip_ioctl_cmd_t *ipip, void *ifreq)
10784 {
10785 	ip1dbg(("ip_sioctl_dstaddr_restart(%s:%u %p)\n",
10786 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10787 	ipif_down_tail(ipif);
10788 	return (ip_sioctl_dstaddr_tail(ipif, sin, q, mp, B_TRUE));
10789 }
10790 
10791 /* ARGSUSED */
10792 int
10793 ip_sioctl_get_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10794     ip_ioctl_cmd_t *ipip, void *if_req)
10795 {
10796 	sin6_t	*sin6 = (struct sockaddr_in6 *)sin;
10797 
10798 	ip1dbg(("ip_sioctl_get_dstaddr(%s:%u %p)\n",
10799 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10800 	/*
10801 	 * Get point to point destination address. The addresses can't
10802 	 * change since we hold a reference to the ipif.
10803 	 */
10804 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0)
10805 		return (EADDRNOTAVAIL);
10806 
10807 	if (ipif->ipif_isv6) {
10808 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
10809 		*sin6 = sin6_null;
10810 		sin6->sin6_family = AF_INET6;
10811 		sin6->sin6_addr = ipif->ipif_v6pp_dst_addr;
10812 	} else {
10813 		*sin = sin_null;
10814 		sin->sin_family = AF_INET;
10815 		sin->sin_addr.s_addr = ipif->ipif_pp_dst_addr;
10816 	}
10817 	return (0);
10818 }
10819 
10820 /*
10821  * part of ipmp, make this func return the active/inactive state and
10822  * caller can set once atomically instead of multiple mutex_enter/mutex_exit
10823  */
10824 /*
10825  * This function either sets or clears the IFF_INACTIVE flag.
10826  *
10827  * As long as there are some addresses or multicast memberships on the
10828  * IPv4 or IPv6 interface of the "phyi" that does not belong in here, we
10829  * will consider it to be ACTIVE (clear IFF_INACTIVE) i.e the interface
10830  * will be used for outbound packets.
10831  *
10832  * Caller needs to verify the validity of setting IFF_INACTIVE.
10833  */
10834 static void
10835 phyint_inactive(phyint_t *phyi)
10836 {
10837 	ill_t *ill_v4;
10838 	ill_t *ill_v6;
10839 	ipif_t *ipif;
10840 	ilm_t *ilm;
10841 
10842 	ill_v4 = phyi->phyint_illv4;
10843 	ill_v6 = phyi->phyint_illv6;
10844 
10845 	/*
10846 	 * No need for a lock while traversing the list since iam
10847 	 * a writer
10848 	 */
10849 	if (ill_v4 != NULL) {
10850 		ASSERT(IAM_WRITER_ILL(ill_v4));
10851 		for (ipif = ill_v4->ill_ipif; ipif != NULL;
10852 		    ipif = ipif->ipif_next) {
10853 			if (ipif->ipif_orig_ifindex != phyi->phyint_ifindex) {
10854 				mutex_enter(&phyi->phyint_lock);
10855 				phyi->phyint_flags &= ~PHYI_INACTIVE;
10856 				mutex_exit(&phyi->phyint_lock);
10857 				return;
10858 			}
10859 		}
10860 		for (ilm = ill_v4->ill_ilm; ilm != NULL;
10861 		    ilm = ilm->ilm_next) {
10862 			if (ilm->ilm_orig_ifindex != phyi->phyint_ifindex) {
10863 				mutex_enter(&phyi->phyint_lock);
10864 				phyi->phyint_flags &= ~PHYI_INACTIVE;
10865 				mutex_exit(&phyi->phyint_lock);
10866 				return;
10867 			}
10868 		}
10869 	}
10870 	if (ill_v6 != NULL) {
10871 		ill_v6 = phyi->phyint_illv6;
10872 		for (ipif = ill_v6->ill_ipif; ipif != NULL;
10873 		    ipif = ipif->ipif_next) {
10874 			if (ipif->ipif_orig_ifindex != phyi->phyint_ifindex) {
10875 				mutex_enter(&phyi->phyint_lock);
10876 				phyi->phyint_flags &= ~PHYI_INACTIVE;
10877 				mutex_exit(&phyi->phyint_lock);
10878 				return;
10879 			}
10880 		}
10881 		for (ilm = ill_v6->ill_ilm; ilm != NULL;
10882 		    ilm = ilm->ilm_next) {
10883 			if (ilm->ilm_orig_ifindex != phyi->phyint_ifindex) {
10884 				mutex_enter(&phyi->phyint_lock);
10885 				phyi->phyint_flags &= ~PHYI_INACTIVE;
10886 				mutex_exit(&phyi->phyint_lock);
10887 				return;
10888 			}
10889 		}
10890 	}
10891 	mutex_enter(&phyi->phyint_lock);
10892 	phyi->phyint_flags |= PHYI_INACTIVE;
10893 	mutex_exit(&phyi->phyint_lock);
10894 }
10895 
10896 /*
10897  * This function is called only when the phyint flags change. Currently
10898  * called from ip_sioctl_flags. We re-do the broadcast nomination so
10899  * that we can select a good ill.
10900  */
10901 static void
10902 ip_redo_nomination(phyint_t *phyi)
10903 {
10904 	ill_t *ill_v4;
10905 
10906 	ill_v4 = phyi->phyint_illv4;
10907 
10908 	if (ill_v4 != NULL && ill_v4->ill_group != NULL) {
10909 		ASSERT(IAM_WRITER_ILL(ill_v4));
10910 		if (ill_v4->ill_group->illgrp_ill_count > 1)
10911 			ill_nominate_bcast_rcv(ill_v4->ill_group);
10912 	}
10913 }
10914 
10915 /*
10916  * Heuristic to check if ill is INACTIVE.
10917  * Checks if ill has an ipif with an usable ip address.
10918  *
10919  * Return values:
10920  *	B_TRUE	- ill is INACTIVE; has no usable ipif
10921  *	B_FALSE - ill is not INACTIVE; ill has at least one usable ipif
10922  */
10923 static boolean_t
10924 ill_is_inactive(ill_t *ill)
10925 {
10926 	ipif_t *ipif;
10927 
10928 	/* Check whether it is in an IPMP group */
10929 	if (ill->ill_phyint->phyint_groupname == NULL)
10930 		return (B_FALSE);
10931 
10932 	if (ill->ill_ipif_up_count == 0)
10933 		return (B_TRUE);
10934 
10935 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
10936 		uint64_t flags = ipif->ipif_flags;
10937 
10938 		/*
10939 		 * This ipif is usable if it is IPIF_UP and not a
10940 		 * dedicated test address.  A dedicated test address
10941 		 * is marked IPIF_NOFAILOVER *and* IPIF_DEPRECATED
10942 		 * (note in particular that V6 test addresses are
10943 		 * link-local data addresses and thus are marked
10944 		 * IPIF_NOFAILOVER but not IPIF_DEPRECATED).
10945 		 */
10946 		if ((flags & IPIF_UP) &&
10947 		    ((flags & (IPIF_DEPRECATED|IPIF_NOFAILOVER)) !=
10948 		    (IPIF_DEPRECATED|IPIF_NOFAILOVER)))
10949 			return (B_FALSE);
10950 	}
10951 	return (B_TRUE);
10952 }
10953 
10954 /*
10955  * Set interface flags.
10956  * Need to do special action for IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT,
10957  * IPIF_NOLOCAL, ILLF_NONUD, ILLF_NOARP, IPIF_PRIVATE, IPIF_ANYCAST,
10958  * IPIF_PREFERRED, PHYI_STANDBY, PHYI_FAILED and PHYI_OFFLINE.
10959  *
10960  * NOTE : We really don't enforce that ipif_id zero should be used
10961  *	  for setting any flags other than IFF_LOGINT_FLAGS. This
10962  *	  is because applications generally does SICGLIFFLAGS and
10963  *	  ORs in the new flags (that affects the logical) and does a
10964  *	  SIOCSLIFFLAGS. Thus, "flags" below could contain bits other
10965  *	  than IFF_LOGINT_FLAGS. One could check whether "turn_on" - the
10966  *	  flags that will be turned on is correct with respect to
10967  *	  ipif_id 0. For backward compatibility reasons, it is not done.
10968  */
10969 /* ARGSUSED */
10970 int
10971 ip_sioctl_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10972     ip_ioctl_cmd_t *ipip, void *if_req)
10973 {
10974 	uint64_t turn_on;
10975 	uint64_t turn_off;
10976 	int	err;
10977 	boolean_t need_up = B_FALSE;
10978 	phyint_t *phyi;
10979 	ill_t *ill;
10980 	uint64_t intf_flags;
10981 	boolean_t phyint_flags_modified = B_FALSE;
10982 	uint64_t flags;
10983 	struct ifreq *ifr;
10984 	struct lifreq *lifr;
10985 	boolean_t set_linklocal = B_FALSE;
10986 	boolean_t zero_source = B_FALSE;
10987 
10988 	ip1dbg(("ip_sioctl_flags(%s:%u %p)\n",
10989 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10990 
10991 	ASSERT(IAM_WRITER_IPIF(ipif));
10992 
10993 	ill = ipif->ipif_ill;
10994 	phyi = ill->ill_phyint;
10995 
10996 	if (ipip->ipi_cmd_type == IF_CMD) {
10997 		ifr = (struct ifreq *)if_req;
10998 		flags =  (uint64_t)(ifr->ifr_flags & 0x0000ffff);
10999 	} else {
11000 		lifr = (struct lifreq *)if_req;
11001 		flags = lifr->lifr_flags;
11002 	}
11003 
11004 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
11005 
11006 	/*
11007 	 * Has the flags been set correctly till now ?
11008 	 */
11009 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
11010 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
11011 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
11012 	/*
11013 	 * Compare the new flags to the old, and partition
11014 	 * into those coming on and those going off.
11015 	 * For the 16 bit command keep the bits above bit 16 unchanged.
11016 	 */
11017 	if (ipip->ipi_cmd == SIOCSIFFLAGS)
11018 		flags |= intf_flags & ~0xFFFF;
11019 
11020 	/*
11021 	 * First check which bits will change and then which will
11022 	 * go on and off
11023 	 */
11024 	turn_on = (flags ^ intf_flags) & ~IFF_CANTCHANGE;
11025 	if (!turn_on)
11026 		return (0);	/* No change */
11027 
11028 	turn_off = intf_flags & turn_on;
11029 	turn_on ^= turn_off;
11030 	err = 0;
11031 
11032 	/*
11033 	 * Don't allow any bits belonging to the logical interface
11034 	 * to be set or cleared on the replacement ipif that was
11035 	 * created temporarily during a MOVE.
11036 	 */
11037 	if (ipif->ipif_replace_zero &&
11038 	    ((turn_on|turn_off) & IFF_LOGINT_FLAGS) != 0) {
11039 		return (EINVAL);
11040 	}
11041 
11042 	/*
11043 	 * Only allow the IFF_XRESOLV and IFF_TEMPORARY flags to be set on
11044 	 * IPv6 interfaces.
11045 	 */
11046 	if ((turn_on & (IFF_XRESOLV|IFF_TEMPORARY)) && !(ipif->ipif_isv6))
11047 		return (EINVAL);
11048 
11049 	/*
11050 	 * Don't allow the IFF_ROUTER flag to be turned on on loopback
11051 	 * interfaces.  It makes no sense in that context.
11052 	 */
11053 	if ((turn_on & IFF_ROUTER) && (phyi->phyint_flags & PHYI_LOOPBACK))
11054 		return (EINVAL);
11055 
11056 	if (flags & (IFF_NOLOCAL|IFF_ANYCAST))
11057 		zero_source = B_TRUE;
11058 
11059 	/*
11060 	 * For IPv6 ipif_id 0, don't allow the interface to be up without
11061 	 * a link local address if IFF_NOLOCAL or IFF_ANYCAST are not set.
11062 	 * If the link local address isn't set, and can be set, it will get
11063 	 * set later on in this function.
11064 	 */
11065 	if (ipif->ipif_id == 0 && ipif->ipif_isv6 &&
11066 	    (flags & IFF_UP) && !zero_source &&
11067 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
11068 		if (ipif_cant_setlinklocal(ipif))
11069 			return (EINVAL);
11070 		set_linklocal = B_TRUE;
11071 	}
11072 
11073 	/*
11074 	 * ILL cannot be part of a usesrc group and and IPMP group at the
11075 	 * same time. No need to grab ill_g_usesrc_lock here, see
11076 	 * synchronization notes in ip.c
11077 	 */
11078 	if (turn_on & PHYI_STANDBY &&
11079 	    ipif->ipif_ill->ill_usesrc_grp_next != NULL) {
11080 		return (EINVAL);
11081 	}
11082 
11083 	/*
11084 	 * If we modify physical interface flags, we'll potentially need to
11085 	 * send up two routing socket messages for the changes (one for the
11086 	 * IPv4 ill, and another for the IPv6 ill).  Note that here.
11087 	 */
11088 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
11089 		phyint_flags_modified = B_TRUE;
11090 
11091 	/*
11092 	 * If we are setting or clearing FAILED or STANDBY or OFFLINE,
11093 	 * we need to flush the IRE_CACHES belonging to this ill.
11094 	 * We handle this case here without doing the DOWN/UP dance
11095 	 * like it is done for other flags. If some other flags are
11096 	 * being turned on/off with FAILED/STANDBY/OFFLINE, the code
11097 	 * below will handle it by bringing it down and then
11098 	 * bringing it UP.
11099 	 */
11100 	if ((turn_on|turn_off) & (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE)) {
11101 		ill_t *ill_v4, *ill_v6;
11102 
11103 		ill_v4 = phyi->phyint_illv4;
11104 		ill_v6 = phyi->phyint_illv6;
11105 
11106 		/*
11107 		 * First set the INACTIVE flag if needed. Then delete the ires.
11108 		 * ire_add will atomically prevent creating new IRE_CACHEs
11109 		 * unless hidden flag is set.
11110 		 * PHYI_FAILED and PHYI_INACTIVE are exclusive
11111 		 */
11112 		if ((turn_on & PHYI_FAILED) &&
11113 		    ((intf_flags & PHYI_STANDBY) || !ipmp_enable_failback)) {
11114 			/* Reset PHYI_INACTIVE when PHYI_FAILED is being set */
11115 			phyi->phyint_flags &= ~PHYI_INACTIVE;
11116 		}
11117 		if ((turn_off & PHYI_FAILED) &&
11118 		    ((intf_flags & PHYI_STANDBY) ||
11119 		    (!ipmp_enable_failback && ill_is_inactive(ill)))) {
11120 			phyint_inactive(phyi);
11121 		}
11122 
11123 		if (turn_on & PHYI_STANDBY) {
11124 			/*
11125 			 * We implicitly set INACTIVE only when STANDBY is set.
11126 			 * INACTIVE is also set on non-STANDBY phyint when user
11127 			 * disables FAILBACK using configuration file.
11128 			 * Do not allow STANDBY to be set on such INACTIVE
11129 			 * phyint
11130 			 */
11131 			if (phyi->phyint_flags & PHYI_INACTIVE)
11132 				return (EINVAL);
11133 			if (!(phyi->phyint_flags & PHYI_FAILED))
11134 				phyint_inactive(phyi);
11135 		}
11136 		if (turn_off & PHYI_STANDBY) {
11137 			if (ipmp_enable_failback) {
11138 				/*
11139 				 * Reset PHYI_INACTIVE.
11140 				 */
11141 				phyi->phyint_flags &= ~PHYI_INACTIVE;
11142 			} else if (ill_is_inactive(ill) &&
11143 			    !(phyi->phyint_flags & PHYI_FAILED)) {
11144 				/*
11145 				 * Need to set INACTIVE, when user sets
11146 				 * STANDBY on a non-STANDBY phyint and
11147 				 * later resets STANDBY
11148 				 */
11149 				phyint_inactive(phyi);
11150 			}
11151 		}
11152 		/*
11153 		 * We should always send up a message so that the
11154 		 * daemons come to know of it. Note that the zeroth
11155 		 * interface can be down and the check below for IPIF_UP
11156 		 * will not make sense as we are actually setting
11157 		 * a phyint flag here. We assume that the ipif used
11158 		 * is always the zeroth ipif. (ip_rts_ifmsg does not
11159 		 * send up any message for non-zero ipifs).
11160 		 */
11161 		phyint_flags_modified = B_TRUE;
11162 
11163 		if (ill_v4 != NULL) {
11164 			ire_walk_ill_v4(MATCH_IRE_ILL | MATCH_IRE_TYPE,
11165 			    IRE_CACHE, ill_stq_cache_delete,
11166 			    (char *)ill_v4, ill_v4);
11167 			illgrp_reset_schednext(ill_v4);
11168 		}
11169 		if (ill_v6 != NULL) {
11170 			ire_walk_ill_v6(MATCH_IRE_ILL | MATCH_IRE_TYPE,
11171 			    IRE_CACHE, ill_stq_cache_delete,
11172 			    (char *)ill_v6, ill_v6);
11173 			illgrp_reset_schednext(ill_v6);
11174 		}
11175 	}
11176 
11177 	/*
11178 	 * If ILLF_ROUTER changes, we need to change the ip forwarding
11179 	 * status of the interface and, if the interface is part of an IPMP
11180 	 * group, all other interfaces that are part of the same IPMP
11181 	 * group.
11182 	 */
11183 	if ((turn_on | turn_off) & ILLF_ROUTER) {
11184 		(void) ill_forward_set(q, mp, ((turn_on & ILLF_ROUTER) != 0),
11185 		    (caddr_t)ill);
11186 	}
11187 
11188 	/*
11189 	 * If the interface is not UP and we are not going to
11190 	 * bring it UP, record the flags and return. When the
11191 	 * interface comes UP later, the right actions will be
11192 	 * taken.
11193 	 */
11194 	if (!(ipif->ipif_flags & IPIF_UP) &&
11195 	    !(turn_on & IPIF_UP)) {
11196 		/* Record new flags in their respective places. */
11197 		mutex_enter(&ill->ill_lock);
11198 		mutex_enter(&ill->ill_phyint->phyint_lock);
11199 		ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
11200 		ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
11201 		ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
11202 		ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
11203 		phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
11204 		phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
11205 		mutex_exit(&ill->ill_lock);
11206 		mutex_exit(&ill->ill_phyint->phyint_lock);
11207 
11208 		/*
11209 		 * We do the broadcast and nomination here rather
11210 		 * than waiting for a FAILOVER/FAILBACK to happen. In
11211 		 * the case of FAILBACK from INACTIVE standby to the
11212 		 * interface that has been repaired, PHYI_FAILED has not
11213 		 * been cleared yet. If there are only two interfaces in
11214 		 * that group, all we have is a FAILED and INACTIVE
11215 		 * interface. If we do the nomination soon after a failback,
11216 		 * the broadcast nomination code would select the
11217 		 * INACTIVE interface for receiving broadcasts as FAILED is
11218 		 * not yet cleared. As we don't want STANDBY/INACTIVE to
11219 		 * receive broadcast packets, we need to redo nomination
11220 		 * when the FAILED is cleared here. Thus, in general we
11221 		 * always do the nomination here for FAILED, STANDBY
11222 		 * and OFFLINE.
11223 		 */
11224 		if (((turn_on | turn_off) &
11225 		    (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE))) {
11226 			ip_redo_nomination(phyi);
11227 		}
11228 		if (phyint_flags_modified) {
11229 			if (phyi->phyint_illv4 != NULL) {
11230 				ip_rts_ifmsg(phyi->phyint_illv4->
11231 				    ill_ipif);
11232 			}
11233 			if (phyi->phyint_illv6 != NULL) {
11234 				ip_rts_ifmsg(phyi->phyint_illv6->
11235 				    ill_ipif);
11236 			}
11237 		}
11238 		return (0);
11239 	} else if (set_linklocal || zero_source) {
11240 		mutex_enter(&ill->ill_lock);
11241 		if (set_linklocal)
11242 			ipif->ipif_state_flags |= IPIF_SET_LINKLOCAL;
11243 		if (zero_source)
11244 			ipif->ipif_state_flags |= IPIF_ZERO_SOURCE;
11245 		mutex_exit(&ill->ill_lock);
11246 	}
11247 
11248 	/*
11249 	 * Disallow IPv6 interfaces coming up that have the unspecified address,
11250 	 * or point-to-point interfaces with an unspecified destination. We do
11251 	 * allow the address to be unspecified for IPIF_NOLOCAL interfaces that
11252 	 * have a subnet assigned, which is how in.ndpd currently manages its
11253 	 * onlink prefix list when no addresses are configured with those
11254 	 * prefixes.
11255 	 */
11256 	if (ipif->ipif_isv6 &&
11257 	    ((IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
11258 	    (!(ipif->ipif_flags & IPIF_NOLOCAL) && !(turn_on & IPIF_NOLOCAL) ||
11259 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) ||
11260 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
11261 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)))) {
11262 		return (EINVAL);
11263 	}
11264 
11265 	/*
11266 	 * Prevent IPv4 point-to-point interfaces with a 0.0.0.0 destination
11267 	 * from being brought up.
11268 	 */
11269 	if (!ipif->ipif_isv6 &&
11270 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
11271 	    ipif->ipif_pp_dst_addr == INADDR_ANY)) {
11272 		return (EINVAL);
11273 	}
11274 
11275 	/*
11276 	 * The only flag changes that we currently take specific action on
11277 	 * is IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT, IPIF_NOLOCAL,
11278 	 * ILLF_NOARP, ILLF_NONUD, IPIF_PRIVATE, IPIF_ANYCAST, and
11279 	 * IPIF_PREFERRED.  This is done by bring the ipif down, changing
11280 	 * the flags and bringing it back up again.
11281 	 */
11282 	if ((turn_on|turn_off) &
11283 	    (IPIF_UP|IPIF_DEPRECATED|IPIF_NOXMIT|IPIF_NOLOCAL|ILLF_NOARP|
11284 	    ILLF_NONUD|IPIF_PRIVATE|IPIF_ANYCAST|IPIF_PREFERRED)) {
11285 		/*
11286 		 * Taking this ipif down, make sure we have
11287 		 * valid net and subnet bcast ire's for other
11288 		 * logical interfaces, if we need them.
11289 		 */
11290 		if (!ipif->ipif_isv6)
11291 			ipif_check_bcast_ires(ipif);
11292 
11293 		if (((ipif->ipif_flags | turn_on) & IPIF_UP) &&
11294 		    !(turn_off & IPIF_UP)) {
11295 			need_up = B_TRUE;
11296 			if (ipif->ipif_flags & IPIF_UP)
11297 				ill->ill_logical_down = 1;
11298 			turn_on &= ~IPIF_UP;
11299 		}
11300 		err = ipif_down(ipif, q, mp);
11301 		ip1dbg(("ipif_down returns %d err ", err));
11302 		if (err == EINPROGRESS)
11303 			return (err);
11304 		ipif_down_tail(ipif);
11305 	}
11306 	return (ip_sioctl_flags_tail(ipif, flags, q, mp, need_up));
11307 }
11308 
11309 static int
11310 ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q, mblk_t *mp,
11311     boolean_t need_up)
11312 {
11313 	ill_t	*ill;
11314 	phyint_t *phyi;
11315 	uint64_t turn_on;
11316 	uint64_t turn_off;
11317 	uint64_t intf_flags;
11318 	boolean_t phyint_flags_modified = B_FALSE;
11319 	int	err = 0;
11320 	boolean_t set_linklocal = B_FALSE;
11321 	boolean_t zero_source = B_FALSE;
11322 
11323 	ip1dbg(("ip_sioctl_flags_tail(%s:%u)\n",
11324 		ipif->ipif_ill->ill_name, ipif->ipif_id));
11325 
11326 	ASSERT(IAM_WRITER_IPIF(ipif));
11327 
11328 	ill = ipif->ipif_ill;
11329 	phyi = ill->ill_phyint;
11330 
11331 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
11332 	turn_on = (flags ^ intf_flags) & ~(IFF_CANTCHANGE | IFF_UP);
11333 
11334 	turn_off = intf_flags & turn_on;
11335 	turn_on ^= turn_off;
11336 
11337 	if ((turn_on|turn_off) & (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE))
11338 		phyint_flags_modified = B_TRUE;
11339 
11340 	/*
11341 	 * Now we change the flags. Track current value of
11342 	 * other flags in their respective places.
11343 	 */
11344 	mutex_enter(&ill->ill_lock);
11345 	mutex_enter(&phyi->phyint_lock);
11346 	ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
11347 	ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
11348 	ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
11349 	ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
11350 	phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
11351 	phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
11352 	if (ipif->ipif_state_flags & IPIF_SET_LINKLOCAL) {
11353 		set_linklocal = B_TRUE;
11354 		ipif->ipif_state_flags &= ~IPIF_SET_LINKLOCAL;
11355 	}
11356 	if (ipif->ipif_state_flags & IPIF_ZERO_SOURCE) {
11357 		zero_source = B_TRUE;
11358 		ipif->ipif_state_flags &= ~IPIF_ZERO_SOURCE;
11359 	}
11360 	mutex_exit(&ill->ill_lock);
11361 	mutex_exit(&phyi->phyint_lock);
11362 
11363 	if (((turn_on | turn_off) & (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE)))
11364 		ip_redo_nomination(phyi);
11365 
11366 	if (set_linklocal)
11367 		(void) ipif_setlinklocal(ipif);
11368 
11369 	if (zero_source)
11370 		ipif->ipif_v6src_addr = ipv6_all_zeros;
11371 	else
11372 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
11373 
11374 	if (need_up) {
11375 		/*
11376 		 * XXX ipif_up really does not know whether a phyint flags
11377 		 * was modified or not. So, it sends up information on
11378 		 * only one routing sockets message. As we don't bring up
11379 		 * the interface and also set STANDBY/FAILED simultaneously
11380 		 * it should be okay.
11381 		 */
11382 		err = ipif_up(ipif, q, mp);
11383 	} else {
11384 		/*
11385 		 * Make sure routing socket sees all changes to the flags.
11386 		 * ipif_up_done* handles this when we use ipif_up.
11387 		 */
11388 		if (phyint_flags_modified) {
11389 			if (phyi->phyint_illv4 != NULL) {
11390 				ip_rts_ifmsg(phyi->phyint_illv4->
11391 				    ill_ipif);
11392 			}
11393 			if (phyi->phyint_illv6 != NULL) {
11394 				ip_rts_ifmsg(phyi->phyint_illv6->
11395 				    ill_ipif);
11396 			}
11397 		} else {
11398 			ip_rts_ifmsg(ipif);
11399 		}
11400 	}
11401 	return (err);
11402 }
11403 
11404 /*
11405  * Restart entry point to restart the flags restart operation after the
11406  * refcounts have dropped to zero.
11407  */
11408 /* ARGSUSED */
11409 int
11410 ip_sioctl_flags_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11411     ip_ioctl_cmd_t *ipip, void *if_req)
11412 {
11413 	int	err;
11414 	struct ifreq *ifr = (struct ifreq *)if_req;
11415 	struct lifreq *lifr = (struct lifreq *)if_req;
11416 
11417 	ip1dbg(("ip_sioctl_flags_restart(%s:%u %p)\n",
11418 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11419 
11420 	ipif_down_tail(ipif);
11421 	if (ipip->ipi_cmd_type == IF_CMD) {
11422 		/*
11423 		 * Since ip_sioctl_flags expects an int and ifr_flags
11424 		 * is a short we need to cast ifr_flags into an int
11425 		 * to avoid having sign extension cause bits to get
11426 		 * set that should not be.
11427 		 */
11428 		err = ip_sioctl_flags_tail(ipif,
11429 		    (uint64_t)(ifr->ifr_flags & 0x0000ffff),
11430 		    q, mp, B_TRUE);
11431 	} else {
11432 		err = ip_sioctl_flags_tail(ipif, lifr->lifr_flags,
11433 		    q, mp, B_TRUE);
11434 	}
11435 	return (err);
11436 }
11437 
11438 /* ARGSUSED */
11439 int
11440 ip_sioctl_get_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11441     ip_ioctl_cmd_t *ipip, void *if_req)
11442 {
11443 	/*
11444 	 * Has the flags been set correctly till now ?
11445 	 */
11446 	ill_t *ill = ipif->ipif_ill;
11447 	phyint_t *phyi = ill->ill_phyint;
11448 
11449 	ip1dbg(("ip_sioctl_get_flags(%s:%u %p)\n",
11450 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11451 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
11452 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
11453 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
11454 
11455 	/*
11456 	 * Need a lock since some flags can be set even when there are
11457 	 * references to the ipif.
11458 	 */
11459 	mutex_enter(&ill->ill_lock);
11460 	if (ipip->ipi_cmd_type == IF_CMD) {
11461 		struct ifreq *ifr = (struct ifreq *)if_req;
11462 
11463 		/* Get interface flags (low 16 only). */
11464 		ifr->ifr_flags = ((ipif->ipif_flags |
11465 		    ill->ill_flags | phyi->phyint_flags) & 0xffff);
11466 	} else {
11467 		struct lifreq *lifr = (struct lifreq *)if_req;
11468 
11469 		/* Get interface flags. */
11470 		lifr->lifr_flags = ipif->ipif_flags |
11471 		    ill->ill_flags | phyi->phyint_flags;
11472 	}
11473 	mutex_exit(&ill->ill_lock);
11474 	return (0);
11475 }
11476 
11477 /* ARGSUSED */
11478 int
11479 ip_sioctl_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11480     ip_ioctl_cmd_t *ipip, void *if_req)
11481 {
11482 	int mtu;
11483 	int ip_min_mtu;
11484 	struct ifreq	*ifr;
11485 	struct lifreq *lifr;
11486 	ire_t	*ire;
11487 
11488 	ip1dbg(("ip_sioctl_mtu(%s:%u %p)\n", ipif->ipif_ill->ill_name,
11489 	    ipif->ipif_id, (void *)ipif));
11490 	if (ipip->ipi_cmd_type == IF_CMD) {
11491 		ifr = (struct ifreq *)if_req;
11492 		mtu = ifr->ifr_metric;
11493 	} else {
11494 		lifr = (struct lifreq *)if_req;
11495 		mtu = lifr->lifr_mtu;
11496 	}
11497 
11498 	if (ipif->ipif_isv6)
11499 		ip_min_mtu = IPV6_MIN_MTU;
11500 	else
11501 		ip_min_mtu = IP_MIN_MTU;
11502 
11503 	if (mtu > ipif->ipif_ill->ill_max_frag || mtu < ip_min_mtu)
11504 		return (EINVAL);
11505 
11506 	/*
11507 	 * Change the MTU size in all relevant ire's.
11508 	 * Mtu change Vs. new ire creation - protocol below.
11509 	 * First change ipif_mtu and the ire_max_frag of the
11510 	 * interface ire. Then do an ire walk and change the
11511 	 * ire_max_frag of all affected ires. During ire_add
11512 	 * under the bucket lock, set the ire_max_frag of the
11513 	 * new ire being created from the ipif/ire from which
11514 	 * it is being derived. If an mtu change happens after
11515 	 * the ire is added, the new ire will be cleaned up.
11516 	 * Conversely if the mtu change happens before the ire
11517 	 * is added, ire_add will see the new value of the mtu.
11518 	 */
11519 	ipif->ipif_mtu = mtu;
11520 	ipif->ipif_flags |= IPIF_FIXEDMTU;
11521 
11522 	if (ipif->ipif_isv6)
11523 		ire = ipif_to_ire_v6(ipif);
11524 	else
11525 		ire = ipif_to_ire(ipif);
11526 	if (ire != NULL) {
11527 		ire->ire_max_frag = ipif->ipif_mtu;
11528 		ire_refrele(ire);
11529 	}
11530 	if (ipif->ipif_flags & IPIF_UP) {
11531 		if (ipif->ipif_isv6)
11532 			ire_walk_v6(ipif_mtu_change, (char *)ipif, ALL_ZONES);
11533 		else
11534 			ire_walk_v4(ipif_mtu_change, (char *)ipif, ALL_ZONES);
11535 	}
11536 	/* Update the MTU in SCTP's list */
11537 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
11538 	return (0);
11539 }
11540 
11541 /* Get interface MTU. */
11542 /* ARGSUSED */
11543 int
11544 ip_sioctl_get_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11545 	ip_ioctl_cmd_t *ipip, void *if_req)
11546 {
11547 	struct ifreq	*ifr;
11548 	struct lifreq	*lifr;
11549 
11550 	ip1dbg(("ip_sioctl_get_mtu(%s:%u %p)\n",
11551 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11552 	if (ipip->ipi_cmd_type == IF_CMD) {
11553 		ifr = (struct ifreq *)if_req;
11554 		ifr->ifr_metric = ipif->ipif_mtu;
11555 	} else {
11556 		lifr = (struct lifreq *)if_req;
11557 		lifr->lifr_mtu = ipif->ipif_mtu;
11558 	}
11559 	return (0);
11560 }
11561 
11562 /* Set interface broadcast address. */
11563 /* ARGSUSED2 */
11564 int
11565 ip_sioctl_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11566 	ip_ioctl_cmd_t *ipip, void *if_req)
11567 {
11568 	ipaddr_t addr;
11569 	ire_t	*ire;
11570 
11571 	ip1dbg(("ip_sioctl_brdaddr(%s:%u)\n", ipif->ipif_ill->ill_name,
11572 	    ipif->ipif_id));
11573 
11574 	ASSERT(IAM_WRITER_IPIF(ipif));
11575 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
11576 		return (EADDRNOTAVAIL);
11577 
11578 	ASSERT(!(ipif->ipif_isv6));	/* No IPv6 broadcast */
11579 
11580 	if (sin->sin_family != AF_INET)
11581 		return (EAFNOSUPPORT);
11582 
11583 	addr = sin->sin_addr.s_addr;
11584 	if (ipif->ipif_flags & IPIF_UP) {
11585 		/*
11586 		 * If we are already up, make sure the new
11587 		 * broadcast address makes sense.  If it does,
11588 		 * there should be an IRE for it already.
11589 		 * Don't match on ipif, only on the ill
11590 		 * since we are sharing these now. Don't use
11591 		 * MATCH_IRE_ILL_GROUP as we are looking for
11592 		 * the broadcast ire on this ill and each ill
11593 		 * in the group has its own broadcast ire.
11594 		 */
11595 		ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST,
11596 		    ipif, ALL_ZONES, (MATCH_IRE_ILL | MATCH_IRE_TYPE));
11597 		if (ire == NULL) {
11598 			return (EINVAL);
11599 		} else {
11600 			ire_refrele(ire);
11601 		}
11602 	}
11603 	/*
11604 	 * Changing the broadcast addr for this ipif.
11605 	 * Make sure we have valid net and subnet bcast
11606 	 * ire's for other logical interfaces, if needed.
11607 	 */
11608 	if (addr != ipif->ipif_brd_addr)
11609 		ipif_check_bcast_ires(ipif);
11610 	IN6_IPADDR_TO_V4MAPPED(addr, &ipif->ipif_v6brd_addr);
11611 	return (0);
11612 }
11613 
11614 /* Get interface broadcast address. */
11615 /* ARGSUSED */
11616 int
11617 ip_sioctl_get_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11618     ip_ioctl_cmd_t *ipip, void *if_req)
11619 {
11620 	ip1dbg(("ip_sioctl_get_brdaddr(%s:%u %p)\n",
11621 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11622 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
11623 		return (EADDRNOTAVAIL);
11624 
11625 	/* IPIF_BROADCAST not possible with IPv6 */
11626 	ASSERT(!ipif->ipif_isv6);
11627 	*sin = sin_null;
11628 	sin->sin_family = AF_INET;
11629 	sin->sin_addr.s_addr = ipif->ipif_brd_addr;
11630 	return (0);
11631 }
11632 
11633 /*
11634  * This routine is called to handle the SIOCS*IFNETMASK IOCTL.
11635  */
11636 /* ARGSUSED */
11637 int
11638 ip_sioctl_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11639     ip_ioctl_cmd_t *ipip, void *if_req)
11640 {
11641 	int err = 0;
11642 	in6_addr_t v6mask;
11643 
11644 	ip1dbg(("ip_sioctl_netmask(%s:%u %p)\n",
11645 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11646 
11647 	ASSERT(IAM_WRITER_IPIF(ipif));
11648 
11649 	if (ipif->ipif_isv6) {
11650 		sin6_t *sin6;
11651 
11652 		if (sin->sin_family != AF_INET6)
11653 			return (EAFNOSUPPORT);
11654 
11655 		sin6 = (sin6_t *)sin;
11656 		v6mask = sin6->sin6_addr;
11657 	} else {
11658 		ipaddr_t mask;
11659 
11660 		if (sin->sin_family != AF_INET)
11661 			return (EAFNOSUPPORT);
11662 
11663 		mask = sin->sin_addr.s_addr;
11664 		V4MASK_TO_V6(mask, v6mask);
11665 	}
11666 
11667 	/*
11668 	 * No big deal if the interface isn't already up, or the mask
11669 	 * isn't really changing, or this is pt-pt.
11670 	 */
11671 	if (!(ipif->ipif_flags & IPIF_UP) ||
11672 	    IN6_ARE_ADDR_EQUAL(&v6mask, &ipif->ipif_v6net_mask) ||
11673 	    (ipif->ipif_flags & IPIF_POINTOPOINT)) {
11674 		ipif->ipif_v6net_mask = v6mask;
11675 		if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11676 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
11677 			    ipif->ipif_v6net_mask,
11678 			    ipif->ipif_v6subnet);
11679 		}
11680 		return (0);
11681 	}
11682 	/*
11683 	 * Make sure we have valid net and subnet broadcast ire's
11684 	 * for the old netmask, if needed by other logical interfaces.
11685 	 */
11686 	if (!ipif->ipif_isv6)
11687 		ipif_check_bcast_ires(ipif);
11688 
11689 	err = ipif_logical_down(ipif, q, mp);
11690 	if (err == EINPROGRESS)
11691 		return (err);
11692 	ipif_down_tail(ipif);
11693 	err = ip_sioctl_netmask_tail(ipif, sin, q, mp);
11694 	return (err);
11695 }
11696 
11697 static int
11698 ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp)
11699 {
11700 	in6_addr_t v6mask;
11701 	int err = 0;
11702 
11703 	ip1dbg(("ip_sioctl_netmask_tail(%s:%u %p)\n",
11704 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11705 
11706 	if (ipif->ipif_isv6) {
11707 		sin6_t *sin6;
11708 
11709 		sin6 = (sin6_t *)sin;
11710 		v6mask = sin6->sin6_addr;
11711 	} else {
11712 		ipaddr_t mask;
11713 
11714 		mask = sin->sin_addr.s_addr;
11715 		V4MASK_TO_V6(mask, v6mask);
11716 	}
11717 
11718 	ipif->ipif_v6net_mask = v6mask;
11719 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11720 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
11721 		    ipif->ipif_v6subnet);
11722 	}
11723 	err = ipif_up(ipif, q, mp);
11724 
11725 	if (err == 0 || err == EINPROGRESS) {
11726 		/*
11727 		 * The interface must be DL_BOUND if this packet has to
11728 		 * go out on the wire. Since we only go through a logical
11729 		 * down and are bound with the driver during an internal
11730 		 * down/up that is satisfied.
11731 		 */
11732 		if (!ipif->ipif_isv6 && ipif->ipif_ill->ill_wq != NULL) {
11733 			/* Potentially broadcast an address mask reply. */
11734 			ipif_mask_reply(ipif);
11735 		}
11736 	}
11737 	return (err);
11738 }
11739 
11740 /* ARGSUSED */
11741 int
11742 ip_sioctl_netmask_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11743     ip_ioctl_cmd_t *ipip, void *if_req)
11744 {
11745 	ip1dbg(("ip_sioctl_netmask_restart(%s:%u %p)\n",
11746 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11747 	ipif_down_tail(ipif);
11748 	return (ip_sioctl_netmask_tail(ipif, sin, q, mp));
11749 }
11750 
11751 /* Get interface net mask. */
11752 /* ARGSUSED */
11753 int
11754 ip_sioctl_get_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11755     ip_ioctl_cmd_t *ipip, void *if_req)
11756 {
11757 	struct lifreq *lifr = (struct lifreq *)if_req;
11758 	struct sockaddr_in6 *sin6 = (sin6_t *)sin;
11759 
11760 	ip1dbg(("ip_sioctl_get_netmask(%s:%u %p)\n",
11761 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11762 
11763 	/*
11764 	 * net mask can't change since we have a reference to the ipif.
11765 	 */
11766 	if (ipif->ipif_isv6) {
11767 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11768 		*sin6 = sin6_null;
11769 		sin6->sin6_family = AF_INET6;
11770 		sin6->sin6_addr = ipif->ipif_v6net_mask;
11771 		lifr->lifr_addrlen =
11772 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
11773 	} else {
11774 		*sin = sin_null;
11775 		sin->sin_family = AF_INET;
11776 		sin->sin_addr.s_addr = ipif->ipif_net_mask;
11777 		if (ipip->ipi_cmd_type == LIF_CMD) {
11778 			lifr->lifr_addrlen =
11779 			    ip_mask_to_plen(ipif->ipif_net_mask);
11780 		}
11781 	}
11782 	return (0);
11783 }
11784 
11785 /* ARGSUSED */
11786 int
11787 ip_sioctl_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11788     ip_ioctl_cmd_t *ipip, void *if_req)
11789 {
11790 
11791 	ip1dbg(("ip_sioctl_metric(%s:%u %p)\n",
11792 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11793 	/*
11794 	 * Set interface metric.  We don't use this for
11795 	 * anything but we keep track of it in case it is
11796 	 * important to routing applications or such.
11797 	 */
11798 	if (ipip->ipi_cmd_type == IF_CMD) {
11799 		struct ifreq    *ifr;
11800 
11801 		ifr = (struct ifreq *)if_req;
11802 		ipif->ipif_metric = ifr->ifr_metric;
11803 	} else {
11804 		struct lifreq   *lifr;
11805 
11806 		lifr = (struct lifreq *)if_req;
11807 		ipif->ipif_metric = lifr->lifr_metric;
11808 	}
11809 	return (0);
11810 }
11811 
11812 
11813 /* ARGSUSED */
11814 int
11815 ip_sioctl_get_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11816     ip_ioctl_cmd_t *ipip, void *if_req)
11817 {
11818 
11819 	/* Get interface metric. */
11820 	ip1dbg(("ip_sioctl_get_metric(%s:%u %p)\n",
11821 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11822 	if (ipip->ipi_cmd_type == IF_CMD) {
11823 		struct ifreq    *ifr;
11824 
11825 		ifr = (struct ifreq *)if_req;
11826 		ifr->ifr_metric = ipif->ipif_metric;
11827 	} else {
11828 		struct lifreq   *lifr;
11829 
11830 		lifr = (struct lifreq *)if_req;
11831 		lifr->lifr_metric = ipif->ipif_metric;
11832 	}
11833 
11834 	return (0);
11835 }
11836 
11837 /* ARGSUSED */
11838 int
11839 ip_sioctl_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11840     ip_ioctl_cmd_t *ipip, void *if_req)
11841 {
11842 
11843 	ip1dbg(("ip_sioctl_muxid(%s:%u %p)\n",
11844 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11845 	/*
11846 	 * Set the muxid returned from I_PLINK.
11847 	 */
11848 	if (ipip->ipi_cmd_type == IF_CMD) {
11849 		struct ifreq *ifr = (struct ifreq *)if_req;
11850 
11851 		ipif->ipif_ill->ill_ip_muxid = ifr->ifr_ip_muxid;
11852 		ipif->ipif_ill->ill_arp_muxid = ifr->ifr_arp_muxid;
11853 	} else {
11854 		struct lifreq *lifr = (struct lifreq *)if_req;
11855 
11856 		ipif->ipif_ill->ill_ip_muxid = lifr->lifr_ip_muxid;
11857 		ipif->ipif_ill->ill_arp_muxid = lifr->lifr_arp_muxid;
11858 	}
11859 	return (0);
11860 }
11861 
11862 /* ARGSUSED */
11863 int
11864 ip_sioctl_get_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11865     ip_ioctl_cmd_t *ipip, void *if_req)
11866 {
11867 
11868 	ip1dbg(("ip_sioctl_get_muxid(%s:%u %p)\n",
11869 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11870 	/*
11871 	 * Get the muxid saved in ill for I_PUNLINK.
11872 	 */
11873 	if (ipip->ipi_cmd_type == IF_CMD) {
11874 		struct ifreq *ifr = (struct ifreq *)if_req;
11875 
11876 		ifr->ifr_ip_muxid = ipif->ipif_ill->ill_ip_muxid;
11877 		ifr->ifr_arp_muxid = ipif->ipif_ill->ill_arp_muxid;
11878 	} else {
11879 		struct lifreq *lifr = (struct lifreq *)if_req;
11880 
11881 		lifr->lifr_ip_muxid = ipif->ipif_ill->ill_ip_muxid;
11882 		lifr->lifr_arp_muxid = ipif->ipif_ill->ill_arp_muxid;
11883 	}
11884 	return (0);
11885 }
11886 
11887 /*
11888  * Set the subnet prefix. Does not modify the broadcast address.
11889  */
11890 /* ARGSUSED */
11891 int
11892 ip_sioctl_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11893     ip_ioctl_cmd_t *ipip, void *if_req)
11894 {
11895 	int err = 0;
11896 	in6_addr_t v6addr;
11897 	in6_addr_t v6mask;
11898 	boolean_t need_up = B_FALSE;
11899 	int addrlen;
11900 
11901 	ip1dbg(("ip_sioctl_subnet(%s:%u %p)\n",
11902 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11903 
11904 	ASSERT(IAM_WRITER_IPIF(ipif));
11905 	addrlen = ((struct lifreq *)if_req)->lifr_addrlen;
11906 
11907 	if (ipif->ipif_isv6) {
11908 		sin6_t *sin6;
11909 
11910 		if (sin->sin_family != AF_INET6)
11911 			return (EAFNOSUPPORT);
11912 
11913 		sin6 = (sin6_t *)sin;
11914 		v6addr = sin6->sin6_addr;
11915 		if (!ip_remote_addr_ok_v6(&v6addr, &ipv6_all_ones))
11916 			return (EADDRNOTAVAIL);
11917 	} else {
11918 		ipaddr_t addr;
11919 
11920 		if (sin->sin_family != AF_INET)
11921 			return (EAFNOSUPPORT);
11922 
11923 		addr = sin->sin_addr.s_addr;
11924 		if (!ip_addr_ok_v4(addr, 0xFFFFFFFF))
11925 			return (EADDRNOTAVAIL);
11926 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11927 		/* Add 96 bits */
11928 		addrlen += IPV6_ABITS - IP_ABITS;
11929 	}
11930 
11931 	if (ip_plen_to_mask_v6(addrlen, &v6mask) == NULL)
11932 		return (EINVAL);
11933 
11934 	/* Check if bits in the address is set past the mask */
11935 	if (!V6_MASK_EQ(v6addr, v6mask, v6addr))
11936 		return (EINVAL);
11937 
11938 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6subnet, &v6addr) &&
11939 	    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6net_mask, &v6mask))
11940 		return (0);	/* No change */
11941 
11942 	if (ipif->ipif_flags & IPIF_UP) {
11943 		/*
11944 		 * If the interface is already marked up,
11945 		 * we call ipif_down which will take care
11946 		 * of ditching any IREs that have been set
11947 		 * up based on the old interface address.
11948 		 */
11949 		err = ipif_logical_down(ipif, q, mp);
11950 		if (err == EINPROGRESS)
11951 			return (err);
11952 		ipif_down_tail(ipif);
11953 		need_up = B_TRUE;
11954 	}
11955 
11956 	err = ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, need_up);
11957 	return (err);
11958 }
11959 
11960 static int
11961 ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t v6addr, in6_addr_t v6mask,
11962     queue_t *q, mblk_t *mp, boolean_t need_up)
11963 {
11964 	ill_t	*ill = ipif->ipif_ill;
11965 	int	err = 0;
11966 
11967 	ip1dbg(("ip_sioctl_subnet_tail(%s:%u %p)\n",
11968 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11969 
11970 	/* Set the new address. */
11971 	mutex_enter(&ill->ill_lock);
11972 	ipif->ipif_v6net_mask = v6mask;
11973 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11974 		V6_MASK_COPY(v6addr, ipif->ipif_v6net_mask,
11975 		    ipif->ipif_v6subnet);
11976 	}
11977 	mutex_exit(&ill->ill_lock);
11978 
11979 	if (need_up) {
11980 		/*
11981 		 * Now bring the interface back up.  If this
11982 		 * is the only IPIF for the ILL, ipif_up
11983 		 * will have to re-bind to the device, so
11984 		 * we may get back EINPROGRESS, in which
11985 		 * case, this IOCTL will get completed in
11986 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11987 		 */
11988 		err = ipif_up(ipif, q, mp);
11989 		if (err == EINPROGRESS)
11990 			return (err);
11991 	}
11992 	return (err);
11993 }
11994 
11995 /* ARGSUSED */
11996 int
11997 ip_sioctl_subnet_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11998     ip_ioctl_cmd_t *ipip, void *if_req)
11999 {
12000 	int	addrlen;
12001 	in6_addr_t v6addr;
12002 	in6_addr_t v6mask;
12003 	struct lifreq *lifr = (struct lifreq *)if_req;
12004 
12005 	ip1dbg(("ip_sioctl_subnet_restart(%s:%u %p)\n",
12006 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12007 	ipif_down_tail(ipif);
12008 
12009 	addrlen = lifr->lifr_addrlen;
12010 	if (ipif->ipif_isv6) {
12011 		sin6_t *sin6;
12012 
12013 		sin6 = (sin6_t *)sin;
12014 		v6addr = sin6->sin6_addr;
12015 	} else {
12016 		ipaddr_t addr;
12017 
12018 		addr = sin->sin_addr.s_addr;
12019 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
12020 		addrlen += IPV6_ABITS - IP_ABITS;
12021 	}
12022 	(void) ip_plen_to_mask_v6(addrlen, &v6mask);
12023 
12024 	return (ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, B_TRUE));
12025 }
12026 
12027 /* ARGSUSED */
12028 int
12029 ip_sioctl_get_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12030     ip_ioctl_cmd_t *ipip, void *if_req)
12031 {
12032 	struct lifreq *lifr = (struct lifreq *)if_req;
12033 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sin;
12034 
12035 	ip1dbg(("ip_sioctl_get_subnet(%s:%u %p)\n",
12036 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12037 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
12038 
12039 	if (ipif->ipif_isv6) {
12040 		*sin6 = sin6_null;
12041 		sin6->sin6_family = AF_INET6;
12042 		sin6->sin6_addr = ipif->ipif_v6subnet;
12043 		lifr->lifr_addrlen =
12044 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
12045 	} else {
12046 		*sin = sin_null;
12047 		sin->sin_family = AF_INET;
12048 		sin->sin_addr.s_addr = ipif->ipif_subnet;
12049 		lifr->lifr_addrlen = ip_mask_to_plen(ipif->ipif_net_mask);
12050 	}
12051 	return (0);
12052 }
12053 
12054 /*
12055  * Set the IPv6 address token.
12056  */
12057 /* ARGSUSED */
12058 int
12059 ip_sioctl_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12060     ip_ioctl_cmd_t *ipi, void *if_req)
12061 {
12062 	ill_t *ill = ipif->ipif_ill;
12063 	int err;
12064 	in6_addr_t v6addr;
12065 	in6_addr_t v6mask;
12066 	boolean_t need_up = B_FALSE;
12067 	int i;
12068 	sin6_t *sin6 = (sin6_t *)sin;
12069 	struct lifreq *lifr = (struct lifreq *)if_req;
12070 	int addrlen;
12071 
12072 	ip1dbg(("ip_sioctl_token(%s:%u %p)\n",
12073 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12074 	ASSERT(IAM_WRITER_IPIF(ipif));
12075 
12076 	addrlen = lifr->lifr_addrlen;
12077 	/* Only allow for logical unit zero i.e. not on "le0:17" */
12078 	if (ipif->ipif_id != 0)
12079 		return (EINVAL);
12080 
12081 	if (!ipif->ipif_isv6)
12082 		return (EINVAL);
12083 
12084 	if (addrlen > IPV6_ABITS)
12085 		return (EINVAL);
12086 
12087 	v6addr = sin6->sin6_addr;
12088 
12089 	/*
12090 	 * The length of the token is the length from the end.  To get
12091 	 * the proper mask for this, compute the mask of the bits not
12092 	 * in the token; ie. the prefix, and then xor to get the mask.
12093 	 */
12094 	if (ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask) == NULL)
12095 		return (EINVAL);
12096 	for (i = 0; i < 4; i++) {
12097 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
12098 	}
12099 
12100 	if (V6_MASK_EQ(v6addr, v6mask, ill->ill_token) &&
12101 	    ill->ill_token_length == addrlen)
12102 		return (0);	/* No change */
12103 
12104 	if (ipif->ipif_flags & IPIF_UP) {
12105 		err = ipif_logical_down(ipif, q, mp);
12106 		if (err == EINPROGRESS)
12107 			return (err);
12108 		ipif_down_tail(ipif);
12109 		need_up = B_TRUE;
12110 	}
12111 	err = ip_sioctl_token_tail(ipif, sin6, addrlen, q, mp, need_up);
12112 	return (err);
12113 }
12114 
12115 static int
12116 ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen, queue_t *q,
12117     mblk_t *mp, boolean_t need_up)
12118 {
12119 	in6_addr_t v6addr;
12120 	in6_addr_t v6mask;
12121 	ill_t	*ill = ipif->ipif_ill;
12122 	int	i;
12123 	int	err = 0;
12124 
12125 	ip1dbg(("ip_sioctl_token_tail(%s:%u %p)\n",
12126 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12127 	v6addr = sin6->sin6_addr;
12128 	/*
12129 	 * The length of the token is the length from the end.  To get
12130 	 * the proper mask for this, compute the mask of the bits not
12131 	 * in the token; ie. the prefix, and then xor to get the mask.
12132 	 */
12133 	(void) ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask);
12134 	for (i = 0; i < 4; i++)
12135 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
12136 
12137 	mutex_enter(&ill->ill_lock);
12138 	V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
12139 	ill->ill_token_length = addrlen;
12140 	mutex_exit(&ill->ill_lock);
12141 
12142 	if (need_up) {
12143 		/*
12144 		 * Now bring the interface back up.  If this
12145 		 * is the only IPIF for the ILL, ipif_up
12146 		 * will have to re-bind to the device, so
12147 		 * we may get back EINPROGRESS, in which
12148 		 * case, this IOCTL will get completed in
12149 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
12150 		 */
12151 		err = ipif_up(ipif, q, mp);
12152 		if (err == EINPROGRESS)
12153 			return (err);
12154 	}
12155 	return (err);
12156 }
12157 
12158 /* ARGSUSED */
12159 int
12160 ip_sioctl_get_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12161     ip_ioctl_cmd_t *ipi, void *if_req)
12162 {
12163 	ill_t *ill;
12164 	sin6_t *sin6 = (sin6_t *)sin;
12165 	struct lifreq *lifr = (struct lifreq *)if_req;
12166 
12167 	ip1dbg(("ip_sioctl_get_token(%s:%u %p)\n",
12168 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12169 	if (ipif->ipif_id != 0)
12170 		return (EINVAL);
12171 
12172 	ill = ipif->ipif_ill;
12173 	if (!ill->ill_isv6)
12174 		return (ENXIO);
12175 
12176 	*sin6 = sin6_null;
12177 	sin6->sin6_family = AF_INET6;
12178 	ASSERT(!IN6_IS_ADDR_V4MAPPED(&ill->ill_token));
12179 	sin6->sin6_addr = ill->ill_token;
12180 	lifr->lifr_addrlen = ill->ill_token_length;
12181 	return (0);
12182 }
12183 
12184 /*
12185  * Set (hardware) link specific information that might override
12186  * what was acquired through the DL_INFO_ACK.
12187  * The logic is as follows.
12188  *
12189  * become exclusive
12190  * set CHANGING flag
12191  * change mtu on affected IREs
12192  * clear CHANGING flag
12193  *
12194  * An ire add that occurs before the CHANGING flag is set will have its mtu
12195  * changed by the ip_sioctl_lnkinfo.
12196  *
12197  * During the time the CHANGING flag is set, no new ires will be added to the
12198  * bucket, and ire add will fail (due the CHANGING flag).
12199  *
12200  * An ire add that occurs after the CHANGING flag is set will have the right mtu
12201  * before it is added to the bucket.
12202  *
12203  * Obviously only 1 thread can set the CHANGING flag and we need to become
12204  * exclusive to set the flag.
12205  */
12206 /* ARGSUSED */
12207 int
12208 ip_sioctl_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12209     ip_ioctl_cmd_t *ipi, void *if_req)
12210 {
12211 	ill_t		*ill = ipif->ipif_ill;
12212 	ipif_t		*nipif;
12213 	int		ip_min_mtu;
12214 	boolean_t	mtu_walk = B_FALSE;
12215 	struct lifreq	*lifr = (struct lifreq *)if_req;
12216 	lif_ifinfo_req_t *lir;
12217 	ire_t		*ire;
12218 
12219 	ip1dbg(("ip_sioctl_lnkinfo(%s:%u %p)\n",
12220 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12221 	lir = &lifr->lifr_ifinfo;
12222 	ASSERT(IAM_WRITER_IPIF(ipif));
12223 
12224 	/* Only allow for logical unit zero i.e. not on "le0:17" */
12225 	if (ipif->ipif_id != 0)
12226 		return (EINVAL);
12227 
12228 	/* Set interface MTU. */
12229 	if (ipif->ipif_isv6)
12230 		ip_min_mtu = IPV6_MIN_MTU;
12231 	else
12232 		ip_min_mtu = IP_MIN_MTU;
12233 
12234 	/*
12235 	 * Verify values before we set anything. Allow zero to
12236 	 * mean unspecified.
12237 	 */
12238 	if (lir->lir_maxmtu != 0 &&
12239 	    (lir->lir_maxmtu > ill->ill_max_frag ||
12240 	    lir->lir_maxmtu < ip_min_mtu))
12241 		return (EINVAL);
12242 	if (lir->lir_reachtime != 0 &&
12243 	    lir->lir_reachtime > ND_MAX_REACHTIME)
12244 		return (EINVAL);
12245 	if (lir->lir_reachretrans != 0 &&
12246 	    lir->lir_reachretrans > ND_MAX_REACHRETRANSTIME)
12247 		return (EINVAL);
12248 
12249 	mutex_enter(&ill->ill_lock);
12250 	ill->ill_state_flags |= ILL_CHANGING;
12251 	for (nipif = ill->ill_ipif; nipif != NULL;
12252 	    nipif = nipif->ipif_next) {
12253 		nipif->ipif_state_flags |= IPIF_CHANGING;
12254 	}
12255 
12256 	mutex_exit(&ill->ill_lock);
12257 
12258 	if (lir->lir_maxmtu != 0) {
12259 		ill->ill_max_mtu = lir->lir_maxmtu;
12260 		ill->ill_mtu_userspecified = 1;
12261 		mtu_walk = B_TRUE;
12262 	}
12263 
12264 	if (lir->lir_reachtime != 0)
12265 		ill->ill_reachable_time = lir->lir_reachtime;
12266 
12267 	if (lir->lir_reachretrans != 0)
12268 		ill->ill_reachable_retrans_time = lir->lir_reachretrans;
12269 
12270 	ill->ill_max_hops = lir->lir_maxhops;
12271 
12272 	ill->ill_max_buf = ND_MAX_Q;
12273 
12274 	if (mtu_walk) {
12275 		/*
12276 		 * Set the MTU on all ipifs associated with this ill except
12277 		 * for those whose MTU was fixed via SIOCSLIFMTU.
12278 		 */
12279 		for (nipif = ill->ill_ipif; nipif != NULL;
12280 		    nipif = nipif->ipif_next) {
12281 			if (nipif->ipif_flags & IPIF_FIXEDMTU)
12282 				continue;
12283 
12284 			nipif->ipif_mtu = ill->ill_max_mtu;
12285 
12286 			if (!(nipif->ipif_flags & IPIF_UP))
12287 				continue;
12288 
12289 			if (nipif->ipif_isv6)
12290 				ire = ipif_to_ire_v6(nipif);
12291 			else
12292 				ire = ipif_to_ire(nipif);
12293 			if (ire != NULL) {
12294 				ire->ire_max_frag = ipif->ipif_mtu;
12295 				ire_refrele(ire);
12296 			}
12297 			if (ill->ill_isv6) {
12298 				ire_walk_ill_v6(MATCH_IRE_ILL, 0,
12299 				    ipif_mtu_change, (char *)nipif,
12300 				    ill);
12301 			} else {
12302 				ire_walk_ill_v4(MATCH_IRE_ILL, 0,
12303 				    ipif_mtu_change, (char *)nipif,
12304 				    ill);
12305 			}
12306 		}
12307 	}
12308 
12309 	mutex_enter(&ill->ill_lock);
12310 	for (nipif = ill->ill_ipif; nipif != NULL;
12311 	    nipif = nipif->ipif_next) {
12312 		nipif->ipif_state_flags &= ~IPIF_CHANGING;
12313 	}
12314 	ILL_UNMARK_CHANGING(ill);
12315 	mutex_exit(&ill->ill_lock);
12316 
12317 	return (0);
12318 }
12319 
12320 /* ARGSUSED */
12321 int
12322 ip_sioctl_get_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12323     ip_ioctl_cmd_t *ipi, void *if_req)
12324 {
12325 	struct lif_ifinfo_req *lir;
12326 	ill_t *ill = ipif->ipif_ill;
12327 
12328 	ip1dbg(("ip_sioctl_get_lnkinfo(%s:%u %p)\n",
12329 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12330 	if (ipif->ipif_id != 0)
12331 		return (EINVAL);
12332 
12333 	lir = &((struct lifreq *)if_req)->lifr_ifinfo;
12334 	lir->lir_maxhops = ill->ill_max_hops;
12335 	lir->lir_reachtime = ill->ill_reachable_time;
12336 	lir->lir_reachretrans = ill->ill_reachable_retrans_time;
12337 	lir->lir_maxmtu = ill->ill_max_mtu;
12338 
12339 	return (0);
12340 }
12341 
12342 /*
12343  * Return best guess as to the subnet mask for the specified address.
12344  * Based on the subnet masks for all the configured interfaces.
12345  *
12346  * We end up returning a zero mask in the case of default, multicast or
12347  * experimental.
12348  */
12349 static ipaddr_t
12350 ip_subnet_mask(ipaddr_t addr, ipif_t **ipifp)
12351 {
12352 	ipaddr_t net_mask;
12353 	ill_t	*ill;
12354 	ipif_t	*ipif;
12355 	ill_walk_context_t ctx;
12356 	ipif_t	*fallback_ipif = NULL;
12357 
12358 	net_mask = ip_net_mask(addr);
12359 	if (net_mask == 0) {
12360 		*ipifp = NULL;
12361 		return (0);
12362 	}
12363 
12364 	/* Let's check to see if this is maybe a local subnet route. */
12365 	/* this function only applies to IPv4 interfaces */
12366 	rw_enter(&ill_g_lock, RW_READER);
12367 	ill = ILL_START_WALK_V4(&ctx);
12368 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
12369 		mutex_enter(&ill->ill_lock);
12370 		for (ipif = ill->ill_ipif; ipif != NULL;
12371 		    ipif = ipif->ipif_next) {
12372 			if (!IPIF_CAN_LOOKUP(ipif))
12373 				continue;
12374 			if (!(ipif->ipif_flags & IPIF_UP))
12375 				continue;
12376 			if ((ipif->ipif_subnet & net_mask) ==
12377 			    (addr & net_mask)) {
12378 				/*
12379 				 * Don't trust pt-pt interfaces if there are
12380 				 * other interfaces.
12381 				 */
12382 				if (ipif->ipif_flags & IPIF_POINTOPOINT) {
12383 					if (fallback_ipif == NULL) {
12384 						ipif_refhold_locked(ipif);
12385 						fallback_ipif = ipif;
12386 					}
12387 					continue;
12388 				}
12389 
12390 				/*
12391 				 * Fine. Just assume the same net mask as the
12392 				 * directly attached subnet interface is using.
12393 				 */
12394 				ipif_refhold_locked(ipif);
12395 				mutex_exit(&ill->ill_lock);
12396 				rw_exit(&ill_g_lock);
12397 				if (fallback_ipif != NULL)
12398 					ipif_refrele(fallback_ipif);
12399 				*ipifp = ipif;
12400 				return (ipif->ipif_net_mask);
12401 			}
12402 		}
12403 		mutex_exit(&ill->ill_lock);
12404 	}
12405 	rw_exit(&ill_g_lock);
12406 
12407 	*ipifp = fallback_ipif;
12408 	return ((fallback_ipif != NULL) ?
12409 	    fallback_ipif->ipif_net_mask : net_mask);
12410 }
12411 
12412 /*
12413  * ip_sioctl_copyin_setup calls ip_wput_ioctl to process the IP_IOCTL ioctl.
12414  */
12415 static void
12416 ip_wput_ioctl(queue_t *q, mblk_t *mp)
12417 {
12418 	IOCP	iocp;
12419 	ipft_t	*ipft;
12420 	ipllc_t	*ipllc;
12421 	mblk_t	*mp1;
12422 	cred_t	*cr;
12423 	int	error = 0;
12424 	conn_t	*connp;
12425 
12426 	ip1dbg(("ip_wput_ioctl"));
12427 	iocp = (IOCP)mp->b_rptr;
12428 	mp1 = mp->b_cont;
12429 	if (mp1 == NULL) {
12430 		iocp->ioc_error = EINVAL;
12431 		mp->b_datap->db_type = M_IOCNAK;
12432 		iocp->ioc_count = 0;
12433 		qreply(q, mp);
12434 		return;
12435 	}
12436 
12437 	/*
12438 	 * These IOCTLs provide various control capabilities to
12439 	 * upstream agents such as ULPs and processes.	There
12440 	 * are currently two such IOCTLs implemented.  They
12441 	 * are used by TCP to provide update information for
12442 	 * existing IREs and to forcibly delete an IRE for a
12443 	 * host that is not responding, thereby forcing an
12444 	 * attempt at a new route.
12445 	 */
12446 	iocp->ioc_error = EINVAL;
12447 	if (!pullupmsg(mp1, sizeof (ipllc->ipllc_cmd)))
12448 		goto done;
12449 
12450 	ipllc = (ipllc_t *)mp1->b_rptr;
12451 	for (ipft = ip_ioctl_ftbl; ipft->ipft_pfi; ipft++) {
12452 		if (ipllc->ipllc_cmd == ipft->ipft_cmd)
12453 			break;
12454 	}
12455 	/*
12456 	 * prefer credential from mblk over ioctl;
12457 	 * see ip_sioctl_copyin_setup
12458 	 */
12459 	cr = DB_CREDDEF(mp, iocp->ioc_cr);
12460 
12461 	/*
12462 	 * Refhold the conn in case the request gets queued up in some lookup
12463 	 */
12464 	ASSERT(CONN_Q(q));
12465 	connp = Q_TO_CONN(q);
12466 	CONN_INC_REF(connp);
12467 	if (ipft->ipft_pfi &&
12468 	    ((mp1->b_wptr - mp1->b_rptr) >= ipft->ipft_min_size ||
12469 		pullupmsg(mp1, ipft->ipft_min_size))) {
12470 		error = (*ipft->ipft_pfi)(q,
12471 		    (ipft->ipft_flags & IPFT_F_SELF_REPLY) ? mp : mp1, cr);
12472 	}
12473 	if (ipft->ipft_flags & IPFT_F_SELF_REPLY) {
12474 		/*
12475 		 * CONN_OPER_PENDING_DONE happens in the function called
12476 		 * through ipft_pfi above.
12477 		 */
12478 		return;
12479 	}
12480 
12481 	CONN_OPER_PENDING_DONE(connp);
12482 	if (ipft->ipft_flags & IPFT_F_NO_REPLY) {
12483 		freemsg(mp);
12484 		return;
12485 	}
12486 	iocp->ioc_error = error;
12487 
12488 done:
12489 	mp->b_datap->db_type = M_IOCACK;
12490 	if (iocp->ioc_error)
12491 		iocp->ioc_count = 0;
12492 	qreply(q, mp);
12493 }
12494 
12495 /*
12496  * Lookup an ipif using the sequence id (ipif_seqid)
12497  */
12498 ipif_t *
12499 ipif_lookup_seqid(ill_t *ill, uint_t seqid)
12500 {
12501 	ipif_t *ipif;
12502 
12503 	ASSERT(MUTEX_HELD(&ill->ill_lock));
12504 
12505 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12506 		if (ipif->ipif_seqid == seqid && IPIF_CAN_LOOKUP(ipif))
12507 			return (ipif);
12508 	}
12509 	return (NULL);
12510 }
12511 
12512 uint64_t ipif_g_seqid;
12513 
12514 /*
12515  * Assign a unique id for the ipif. This is used later when we send
12516  * IRES to ARP for resolution where we initialize ire_ipif_seqid
12517  * to the value pointed by ire_ipif->ipif_seqid. Later when the
12518  * IRE is added, we verify that ipif has not disappeared.
12519  */
12520 
12521 static void
12522 ipif_assign_seqid(ipif_t *ipif)
12523 {
12524 	ipif->ipif_seqid = atomic_add_64_nv(&ipif_g_seqid, 1);
12525 }
12526 
12527 /*
12528  * Insert the ipif, so that the list of ipifs on the ill will be sorted
12529  * with respect to ipif_id. Note that an ipif with an ipif_id of -1 will
12530  * be inserted into the first space available in the list. The value of
12531  * ipif_id will then be set to the appropriate value for its position.
12532  */
12533 static int
12534 ipif_insert(ipif_t *ipif, boolean_t acquire_g_lock, boolean_t acquire_ill_lock)
12535 {
12536 	ill_t *ill;
12537 	ipif_t *tipif;
12538 	ipif_t **tipifp;
12539 	int id;
12540 
12541 	ASSERT(ipif->ipif_ill->ill_net_type == IRE_LOOPBACK ||
12542 	    IAM_WRITER_IPIF(ipif));
12543 
12544 	ill = ipif->ipif_ill;
12545 	ASSERT(ill != NULL);
12546 
12547 	/*
12548 	 * In the case of lo0:0 we already hold the ill_g_lock.
12549 	 * ill_lookup_on_name (acquires ill_g_lock) -> ipif_allocate ->
12550 	 * ipif_insert. Another such caller is ipif_move.
12551 	 */
12552 	if (acquire_g_lock)
12553 		rw_enter(&ill_g_lock, RW_WRITER);
12554 	if (acquire_ill_lock)
12555 		mutex_enter(&ill->ill_lock);
12556 	id = ipif->ipif_id;
12557 	tipifp = &(ill->ill_ipif);
12558 	if (id == -1) {	/* need to find a real id */
12559 		id = 0;
12560 		while ((tipif = *tipifp) != NULL) {
12561 			ASSERT(tipif->ipif_id >= id);
12562 			if (tipif->ipif_id != id)
12563 				break; /* non-consecutive id */
12564 			id++;
12565 			tipifp = &(tipif->ipif_next);
12566 		}
12567 		/* limit number of logical interfaces */
12568 		if (id >= ip_addrs_per_if) {
12569 			if (acquire_ill_lock)
12570 				mutex_exit(&ill->ill_lock);
12571 			if (acquire_g_lock)
12572 				rw_exit(&ill_g_lock);
12573 			return (-1);
12574 		}
12575 		ipif->ipif_id = id; /* assign new id */
12576 	} else if (id < ip_addrs_per_if) {
12577 		/* we have a real id; insert ipif in the right place */
12578 		while ((tipif = *tipifp) != NULL) {
12579 			ASSERT(tipif->ipif_id != id);
12580 			if (tipif->ipif_id > id)
12581 				break; /* found correct location */
12582 			tipifp = &(tipif->ipif_next);
12583 		}
12584 	} else {
12585 		if (acquire_ill_lock)
12586 			mutex_exit(&ill->ill_lock);
12587 		if (acquire_g_lock)
12588 			rw_exit(&ill_g_lock);
12589 		return (-1);
12590 	}
12591 
12592 	ASSERT(tipifp != &(ill->ill_ipif) || id == 0);
12593 
12594 	ipif->ipif_next = tipif;
12595 	*tipifp = ipif;
12596 	if (acquire_ill_lock)
12597 		mutex_exit(&ill->ill_lock);
12598 	if (acquire_g_lock)
12599 		rw_exit(&ill_g_lock);
12600 	return (0);
12601 }
12602 
12603 /*
12604  * Allocate and initialize a new interface control structure.  (Always
12605  * called as writer.)
12606  * When ipif_allocate() is called from ip_ll_subnet_defaults, the ill
12607  * is not part of the global linked list of ills. ipif_seqid is unique
12608  * in the system and to preserve the uniqueness, it is assigned only
12609  * when ill becomes part of the global list. At that point ill will
12610  * have a name. If it doesn't get assigned here, it will get assigned
12611  * in ipif_set_values() as part of SIOCSLIFNAME processing.
12612  * Aditionally, if we come here from ip_ll_subnet_defaults, we don't set
12613  * the interface flags or any other information from the DL_INFO_ACK for
12614  * DL_STYLE2 drivers (initialize == B_FALSE), since we won't have them at
12615  * this point. The flags etc. will be set in ip_ll_subnet_defaults when the
12616  * second DL_INFO_ACK comes in from the driver.
12617  */
12618 static ipif_t *
12619 ipif_allocate(ill_t *ill, int id, uint_t ire_type, boolean_t initialize)
12620 {
12621 	ipif_t	*ipif;
12622 	phyint_t *phyi;
12623 
12624 	ip1dbg(("ipif_allocate(%s:%d ill %p)\n",
12625 	    ill->ill_name, id, (void *)ill));
12626 	ASSERT(ire_type == IRE_LOOPBACK || IAM_WRITER_ILL(ill));
12627 
12628 	if ((ipif = (ipif_t *)mi_alloc(sizeof (ipif_t), BPRI_MED)) == NULL)
12629 		return (NULL);
12630 	*ipif = ipif_zero;	/* start clean */
12631 
12632 	ipif->ipif_ill = ill;
12633 	ipif->ipif_id = id;	/* could be -1 */
12634 	ipif->ipif_zoneid = GLOBAL_ZONEID;
12635 
12636 	mutex_init(&ipif->ipif_saved_ire_lock, NULL, MUTEX_DEFAULT, NULL);
12637 
12638 	ipif->ipif_refcnt = 0;
12639 	ipif->ipif_saved_ire_cnt = 0;
12640 
12641 	if (ipif_insert(ipif, ire_type != IRE_LOOPBACK, B_TRUE)) {
12642 		mi_free(ipif);
12643 		return (NULL);
12644 	}
12645 	/* -1 id should have been replaced by real id */
12646 	id = ipif->ipif_id;
12647 	ASSERT(id >= 0);
12648 
12649 	if (ill->ill_name[0] != '\0') {
12650 		ipif_assign_seqid(ipif);
12651 		if (ill->ill_phyint->phyint_ifindex != 0)
12652 			sctp_update_ipif(ipif, SCTP_IPIF_INSERT);
12653 	}
12654 	/*
12655 	 * Keep a copy of original id in ipif_orig_ipifid.  Failback
12656 	 * will attempt to restore the original id.  The SIOCSLIFOINDEX
12657 	 * ioctl sets ipif_orig_ipifid to zero.
12658 	 */
12659 	ipif->ipif_orig_ipifid = id;
12660 
12661 	/*
12662 	 * We grab the ill_lock and phyint_lock to protect the flag changes.
12663 	 * The ipif is still not up and can't be looked up until the
12664 	 * ioctl completes and the IPIF_CHANGING flag is cleared.
12665 	 */
12666 	mutex_enter(&ill->ill_lock);
12667 	mutex_enter(&ill->ill_phyint->phyint_lock);
12668 	/*
12669 	 * Set the running flag when logical interface zero is created.
12670 	 * For subsequent logical interfaces, a DLPI link down
12671 	 * notification message may have cleared the running flag to
12672 	 * indicate the link is down, so we shouldn't just blindly set it.
12673 	 */
12674 	if (id == 0)
12675 		ill->ill_phyint->phyint_flags |= PHYI_RUNNING;
12676 	ipif->ipif_ire_type = ire_type;
12677 	phyi = ill->ill_phyint;
12678 	ipif->ipif_orig_ifindex = phyi->phyint_ifindex;
12679 
12680 	if (ipif->ipif_isv6) {
12681 		ill->ill_flags |= ILLF_IPV6;
12682 	} else {
12683 		ipaddr_t inaddr_any = INADDR_ANY;
12684 
12685 		ill->ill_flags |= ILLF_IPV4;
12686 
12687 		/* Keep the IN6_IS_ADDR_V4MAPPED assertions happy */
12688 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12689 		    &ipif->ipif_v6lcl_addr);
12690 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12691 		    &ipif->ipif_v6src_addr);
12692 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12693 		    &ipif->ipif_v6subnet);
12694 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12695 		    &ipif->ipif_v6net_mask);
12696 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12697 		    &ipif->ipif_v6brd_addr);
12698 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12699 		    &ipif->ipif_v6pp_dst_addr);
12700 	}
12701 
12702 	/*
12703 	 * Don't set the interface flags etc. now, will do it in
12704 	 * ip_ll_subnet_defaults.
12705 	 */
12706 	if (!initialize) {
12707 		mutex_exit(&ill->ill_lock);
12708 		mutex_exit(&ill->ill_phyint->phyint_lock);
12709 		return (ipif);
12710 	}
12711 	ipif->ipif_mtu = ill->ill_max_mtu;
12712 
12713 	if (ill->ill_bcast_addr_length != 0) {
12714 		/*
12715 		 * Later detect lack of DLPI driver multicast
12716 		 * capability by catching DL_ENABMULTI errors in
12717 		 * ip_rput_dlpi.
12718 		 */
12719 		ill->ill_flags |= ILLF_MULTICAST;
12720 		if (!ipif->ipif_isv6)
12721 			ipif->ipif_flags |= IPIF_BROADCAST;
12722 	} else {
12723 		if (ill->ill_net_type != IRE_LOOPBACK) {
12724 			if (ipif->ipif_isv6)
12725 				/*
12726 				 * Note: xresolv interfaces will eventually need
12727 				 * NOARP set here as well, but that will require
12728 				 * those external resolvers to have some
12729 				 * knowledge of that flag and act appropriately.
12730 				 * Not to be changed at present.
12731 				 */
12732 				ill->ill_flags |= ILLF_NONUD;
12733 			else
12734 				ill->ill_flags |= ILLF_NOARP;
12735 		}
12736 		if (ill->ill_phys_addr_length == 0) {
12737 			if (ill->ill_media &&
12738 			    ill->ill_media->ip_m_mac_type == SUNW_DL_VNI) {
12739 				ipif->ipif_flags |= IPIF_NOXMIT;
12740 				phyi->phyint_flags |= PHYI_VIRTUAL;
12741 			} else {
12742 				/* pt-pt supports multicast. */
12743 				ill->ill_flags |= ILLF_MULTICAST;
12744 				if (ill->ill_net_type == IRE_LOOPBACK) {
12745 					phyi->phyint_flags |=
12746 					    (PHYI_LOOPBACK | PHYI_VIRTUAL);
12747 				} else {
12748 					ipif->ipif_flags |= IPIF_POINTOPOINT;
12749 				}
12750 			}
12751 		}
12752 	}
12753 	mutex_exit(&ill->ill_lock);
12754 	mutex_exit(&ill->ill_phyint->phyint_lock);
12755 	return (ipif);
12756 }
12757 
12758 /*
12759  * If appropriate, send a message up to the resolver delete the entry
12760  * for the address of this interface which is going out of business.
12761  * (Always called as writer).
12762  *
12763  * NOTE : We need to check for NULL mps as some of the fields are
12764  *	  initialized only for some interface types. See ipif_resolver_up()
12765  *	  for details.
12766  */
12767 void
12768 ipif_arp_down(ipif_t *ipif)
12769 {
12770 	mblk_t	*mp;
12771 
12772 	ip1dbg(("ipif_arp_down(%s:%u)\n",
12773 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
12774 	ASSERT(IAM_WRITER_IPIF(ipif));
12775 
12776 	/* Delete the mapping for the local address */
12777 	mp = ipif->ipif_arp_del_mp;
12778 	if (mp != NULL) {
12779 		ip1dbg(("ipif_arp_down: %s (%u) for %s:%u\n",
12780 		    dlpi_prim_str(*(int *)mp->b_rptr), *(int *)mp->b_rptr,
12781 		    ipif->ipif_ill->ill_name, ipif->ipif_id));
12782 		putnext(ipif->ipif_ill->ill_rq, mp);
12783 		ipif->ipif_arp_del_mp = NULL;
12784 	}
12785 
12786 	/*
12787 	 * If this is the last ipif that is going down, we need
12788 	 * to clean up ARP completely.
12789 	 */
12790 	if (ipif->ipif_ill->ill_ipif_up_count == 0) {
12791 
12792 		/* Send up AR_INTERFACE_DOWN message */
12793 		mp = ipif->ipif_ill->ill_arp_down_mp;
12794 		if (mp != NULL) {
12795 			ip1dbg(("ipif_arp_down: %s (%u) for %s:%u\n",
12796 			    dlpi_prim_str(*(int *)mp->b_rptr),
12797 			    *(int *)mp->b_rptr, ipif->ipif_ill->ill_name,
12798 			    ipif->ipif_id));
12799 			putnext(ipif->ipif_ill->ill_rq, mp);
12800 			ipif->ipif_ill->ill_arp_down_mp = NULL;
12801 		}
12802 
12803 		/* Tell ARP to delete the multicast mappings */
12804 		mp = ipif->ipif_ill->ill_arp_del_mapping_mp;
12805 		if (mp != NULL) {
12806 			ip1dbg(("ipif_arp_down: %s (%u) for %s:%u\n",
12807 			    dlpi_prim_str(*(int *)mp->b_rptr),
12808 			    *(int *)mp->b_rptr, ipif->ipif_ill->ill_name,
12809 			    ipif->ipif_id));
12810 			putnext(ipif->ipif_ill->ill_rq, mp);
12811 			ipif->ipif_ill->ill_arp_del_mapping_mp = NULL;
12812 		}
12813 	}
12814 }
12815 
12816 /*
12817  * This function sets up the multicast mappings in ARP. When ipif_resolver_up
12818  * calls this function, it passes a non-NULL arp_add_mapping_mp indicating
12819  * that it wants the add_mp allocated in this function to be returned
12820  * wihtout sending it to arp. When ip_rput_dlpi_writer calls this to
12821  * just re-do the multicast, it wants us to send the add_mp to ARP also.
12822  * ipif_resolver_up does not want us to do the "add" i.e sending to ARP,
12823  * as it does a ipif_arp_down after calling this function - which will
12824  * remove what we add here.
12825  *
12826  * Returns -1 on failures and 0 on success.
12827  */
12828 int
12829 ipif_arp_setup_multicast(ipif_t *ipif, mblk_t **arp_add_mapping_mp)
12830 {
12831 	mblk_t	*del_mp = NULL;
12832 	mblk_t *add_mp = NULL;
12833 	mblk_t *mp;
12834 	ill_t	*ill = ipif->ipif_ill;
12835 	phyint_t *phyi = ill->ill_phyint;
12836 	ipaddr_t addr, mask, extract_mask = 0;
12837 	arma_t	*arma;
12838 	uint8_t *maddr, *bphys_addr;
12839 	uint32_t hw_start;
12840 	dl_unitdata_req_t *dlur;
12841 
12842 	ASSERT(IAM_WRITER_IPIF(ipif));
12843 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
12844 		return (0);
12845 
12846 	/*
12847 	 * Delete the existing mapping from ARP. Normally ipif_down
12848 	 * -> ipif_arp_down should send this up to ARP. The only
12849 	 * reason we would find this when we are switching from
12850 	 * Multicast to Broadcast where we did not do a down.
12851 	 */
12852 	mp = ill->ill_arp_del_mapping_mp;
12853 	if (mp != NULL) {
12854 		ip1dbg(("ipif_arp_down: %s (%u) for %s:%u\n",
12855 		    dlpi_prim_str(*(int *)mp->b_rptr),
12856 		    *(int *)mp->b_rptr, ill->ill_name, ipif->ipif_id));
12857 		putnext(ill->ill_rq, mp);
12858 		ill->ill_arp_del_mapping_mp = NULL;
12859 	}
12860 
12861 	if (arp_add_mapping_mp != NULL)
12862 		*arp_add_mapping_mp = NULL;
12863 
12864 	/*
12865 	 * Check that the address is not to long for the constant
12866 	 * length reserved in the template arma_t.
12867 	 */
12868 	if (ill->ill_phys_addr_length > IP_MAX_HW_LEN)
12869 		return (-1);
12870 
12871 	/* Add mapping mblk */
12872 	addr = (ipaddr_t)htonl(INADDR_UNSPEC_GROUP);
12873 	mask = (ipaddr_t)htonl(IN_CLASSD_NET);
12874 	add_mp = ill_arp_alloc(ill, (uchar_t *)&ip_arma_multi_template,
12875 	    (caddr_t)&addr);
12876 	if (add_mp == NULL)
12877 		return (-1);
12878 	arma = (arma_t *)add_mp->b_rptr;
12879 	maddr = (uint8_t *)arma + arma->arma_hw_addr_offset;
12880 	bcopy(&mask, (char *)arma + arma->arma_proto_mask_offset, IP_ADDR_LEN);
12881 	arma->arma_hw_addr_length = ill->ill_phys_addr_length;
12882 
12883 	/*
12884 	 * Determine the broadcast address.
12885 	 */
12886 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
12887 	if (ill->ill_sap_length < 0)
12888 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
12889 	else
12890 		bphys_addr = (uchar_t *)dlur +
12891 		    dlur->dl_dest_addr_offset + ill->ill_sap_length;
12892 	/*
12893 	 * Check PHYI_MULTI_BCAST and length of physical
12894 	 * address to determine if we use the mapping or the
12895 	 * broadcast address.
12896 	 */
12897 	if (!(phyi->phyint_flags & PHYI_MULTI_BCAST))
12898 		if (!MEDIA_V4MINFO(ill->ill_media, ill->ill_phys_addr_length,
12899 		    bphys_addr, maddr, &hw_start, &extract_mask))
12900 			phyi->phyint_flags |= PHYI_MULTI_BCAST;
12901 
12902 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) ||
12903 	    (ill->ill_flags & ILLF_MULTICAST)) {
12904 		/* Make sure this will not match the "exact" entry. */
12905 		addr = (ipaddr_t)htonl(INADDR_ALLHOSTS_GROUP);
12906 		del_mp = ill_arp_alloc(ill, (uchar_t *)&ip_ared_template,
12907 		    (caddr_t)&addr);
12908 		if (del_mp == NULL) {
12909 			freemsg(add_mp);
12910 			return (-1);
12911 		}
12912 		bcopy(&extract_mask, (char *)arma +
12913 		    arma->arma_proto_extract_mask_offset, IP_ADDR_LEN);
12914 		if (phyi->phyint_flags & PHYI_MULTI_BCAST) {
12915 			/* Use link-layer broadcast address for MULTI_BCAST */
12916 			bcopy(bphys_addr, maddr, ill->ill_phys_addr_length);
12917 			ip2dbg(("ipif_arp_setup_multicast: adding"
12918 			    " MULTI_BCAST ARP setup for %s\n", ill->ill_name));
12919 		} else {
12920 			arma->arma_hw_mapping_start = hw_start;
12921 			ip2dbg(("ipif_arp_setup_multicast: adding multicast"
12922 			    " ARP setup for %s\n", ill->ill_name));
12923 		}
12924 	} else {
12925 		freemsg(add_mp);
12926 		ASSERT(del_mp == NULL);
12927 		/* It is neither MULTICAST nor MULTI_BCAST */
12928 		return (0);
12929 	}
12930 	ASSERT(add_mp != NULL && del_mp != NULL);
12931 	ill->ill_arp_del_mapping_mp = del_mp;
12932 	if (arp_add_mapping_mp != NULL) {
12933 		/* The caller just wants the mblks allocated */
12934 		*arp_add_mapping_mp = add_mp;
12935 	} else {
12936 		/* The caller wants us to send it to arp */
12937 		putnext(ill->ill_rq, add_mp);
12938 	}
12939 	return (0);
12940 }
12941 
12942 /*
12943  * Get the resolver set up for a new interface address.
12944  * (Always called as writer.)
12945  * Called both for IPv4 and IPv6 interfaces,
12946  * though it only sets up the resolver for v6
12947  * if it's an xresolv interface (one using an external resolver).
12948  * Honors ILLF_NOARP.
12949  * The boolean value arp_just_publish, if B_TRUE, indicates that
12950  * it only needs to send an AR_ENTRY_ADD message up to ARP for
12951  * IPv4 interfaces. Currently, B_TRUE is only set when this
12952  * function is called by ip_rput_dlpi_writer() to handle
12953  * asynchronous hardware address change notification.
12954  * Returns error on failure.
12955  */
12956 int
12957 ipif_resolver_up(ipif_t *ipif, boolean_t arp_just_publish)
12958 {
12959 	caddr_t	addr;
12960 	mblk_t	*arp_up_mp = NULL;
12961 	mblk_t	*arp_down_mp = NULL;
12962 	mblk_t	*arp_add_mp = NULL;
12963 	mblk_t	*arp_del_mp = NULL;
12964 	mblk_t	*arp_add_mapping_mp = NULL;
12965 	mblk_t	*arp_del_mapping_mp = NULL;
12966 	ill_t	*ill = ipif->ipif_ill;
12967 	uchar_t	*area_p = NULL;
12968 	uchar_t	*ared_p = NULL;
12969 	int	err = ENOMEM;
12970 
12971 	ip1dbg(("ipif_resolver_up(%s:%u) flags 0x%x\n",
12972 	    ipif->ipif_ill->ill_name, ipif->ipif_id,
12973 	    (uint_t)ipif->ipif_flags));
12974 	ASSERT(IAM_WRITER_IPIF(ipif));
12975 
12976 	if ((ill->ill_net_type != IRE_IF_RESOLVER) ||
12977 	    (ill->ill_isv6 && !(ill->ill_flags & ILLF_XRESOLV))) {
12978 		return (0);
12979 	}
12980 
12981 	if (ill->ill_isv6) {
12982 		/*
12983 		 * External resolver for IPv6
12984 		 */
12985 		ASSERT(!arp_just_publish);
12986 		if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
12987 			addr = (caddr_t)&ipif->ipif_v6lcl_addr;
12988 			area_p = (uchar_t *)&ip6_area_template;
12989 			ared_p = (uchar_t *)&ip6_ared_template;
12990 		}
12991 	} else {
12992 		/*
12993 		 * IPv4 arp case. If the ARP stream has already started
12994 		 * closing, fail this request for ARP bringup. Else
12995 		 * record the fact that an ARP bringup is pending.
12996 		 */
12997 		mutex_enter(&ill->ill_lock);
12998 		if (ill->ill_arp_closing) {
12999 			mutex_exit(&ill->ill_lock);
13000 			err = EINVAL;
13001 			goto failed;
13002 		} else {
13003 			if (ill->ill_ipif_up_count == 0)
13004 				ill->ill_arp_bringup_pending = 1;
13005 			mutex_exit(&ill->ill_lock);
13006 		}
13007 		if (ipif->ipif_lcl_addr != INADDR_ANY) {
13008 			addr = (caddr_t)&ipif->ipif_lcl_addr;
13009 			area_p = (uchar_t *)&ip_area_template;
13010 			ared_p = (uchar_t *)&ip_ared_template;
13011 		}
13012 	}
13013 
13014 	/*
13015 	 * Add an entry for the local address in ARP only if it
13016 	 * is not UNNUMBERED and the address is not INADDR_ANY.
13017 	 */
13018 	if (((ipif->ipif_flags & IPIF_UNNUMBERED) == 0) && area_p != NULL) {
13019 		/* Now ask ARP to publish our address. */
13020 		arp_add_mp = ill_arp_alloc(ill, area_p, addr);
13021 		if (arp_add_mp == NULL)
13022 			goto failed;
13023 		if (arp_just_publish) {
13024 			/*
13025 			 * Copy the new hardware address and length into
13026 			 * arp_add_mp to be sent to ARP.
13027 			 */
13028 			area_t *area = (area_t *)arp_add_mp->b_rptr;
13029 			area->area_hw_addr_length =
13030 			    ill->ill_phys_addr_length;
13031 			bcopy((char *)ill->ill_phys_addr,
13032 			    ((char *)area + area->area_hw_addr_offset),
13033 			    area->area_hw_addr_length);
13034 		}
13035 
13036 		((area_t *)arp_add_mp->b_rptr)->area_flags =
13037 		    ACE_F_PERMANENT | ACE_F_PUBLISH | ACE_F_MYADDR;
13038 
13039 		if (arp_just_publish)
13040 			goto arp_setup_multicast;
13041 
13042 		/*
13043 		 * Allocate an ARP deletion message so we know we can tell ARP
13044 		 * when the interface goes down.
13045 		 */
13046 		arp_del_mp = ill_arp_alloc(ill, ared_p, addr);
13047 		if (arp_del_mp == NULL)
13048 			goto failed;
13049 
13050 	} else {
13051 		if (arp_just_publish)
13052 			goto done;
13053 	}
13054 	/*
13055 	 * Need to bring up ARP or setup multicast mapping only
13056 	 * when the first interface is coming UP.
13057 	 */
13058 	if (ill->ill_ipif_up_count != 0)
13059 		goto done;
13060 
13061 	/*
13062 	 * Allocate an ARP down message (to be saved) and an ARP up
13063 	 * message.
13064 	 */
13065 	arp_down_mp = ill_arp_alloc(ill, (uchar_t *)&ip_ard_template, 0);
13066 	if (arp_down_mp == NULL)
13067 		goto failed;
13068 
13069 	arp_up_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aru_template, 0);
13070 	if (arp_up_mp == NULL)
13071 		goto failed;
13072 
13073 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
13074 		goto done;
13075 
13076 arp_setup_multicast:
13077 	/*
13078 	 * Setup the multicast mappings. This function initializes
13079 	 * ill_arp_del_mapping_mp also. This does not need to be done for
13080 	 * IPv6.
13081 	 */
13082 	if (!ill->ill_isv6) {
13083 		err = ipif_arp_setup_multicast(ipif, &arp_add_mapping_mp);
13084 		if (err != 0)
13085 			goto failed;
13086 		ASSERT(ill->ill_arp_del_mapping_mp != NULL);
13087 		ASSERT(arp_add_mapping_mp != NULL);
13088 	}
13089 
13090 done:;
13091 	if (arp_del_mp != NULL) {
13092 		ASSERT(ipif->ipif_arp_del_mp == NULL);
13093 		ipif->ipif_arp_del_mp = arp_del_mp;
13094 	}
13095 	if (arp_down_mp != NULL) {
13096 		ASSERT(ill->ill_arp_down_mp == NULL);
13097 		ill->ill_arp_down_mp = arp_down_mp;
13098 	}
13099 	if (arp_del_mapping_mp != NULL) {
13100 		ASSERT(ill->ill_arp_del_mapping_mp == NULL);
13101 		ill->ill_arp_del_mapping_mp = arp_del_mapping_mp;
13102 	}
13103 	if (arp_up_mp != NULL) {
13104 		ip1dbg(("ipif_resolver_up: ARP_UP for %s:%u\n",
13105 			ipif->ipif_ill->ill_name, ipif->ipif_id));
13106 		putnext(ill->ill_rq, arp_up_mp);
13107 	}
13108 	if (arp_add_mp != NULL) {
13109 		ip1dbg(("ipif_resolver_up: ARP_ADD for %s:%u\n",
13110 			ipif->ipif_ill->ill_name, ipif->ipif_id));
13111 		putnext(ill->ill_rq, arp_add_mp);
13112 	}
13113 	if (arp_add_mapping_mp != NULL) {
13114 		ip1dbg(("ipif_resolver_up: MAPPING_ADD for %s:%u\n",
13115 			ipif->ipif_ill->ill_name, ipif->ipif_id));
13116 		putnext(ill->ill_rq, arp_add_mapping_mp);
13117 	}
13118 	if (arp_just_publish)
13119 		return (0);
13120 
13121 	if (ill->ill_flags & ILLF_NOARP)
13122 		err = ill_arp_off(ill);
13123 	else
13124 		err = ill_arp_on(ill);
13125 	if (err) {
13126 		ip0dbg(("ipif_resolver_up: arp_on/off failed %d\n", err));
13127 		freemsg(ipif->ipif_arp_del_mp);
13128 		if (arp_down_mp != NULL)
13129 			freemsg(ill->ill_arp_down_mp);
13130 		if (ill->ill_arp_del_mapping_mp != NULL)
13131 			freemsg(ill->ill_arp_del_mapping_mp);
13132 		ipif->ipif_arp_del_mp = NULL;
13133 		ill->ill_arp_down_mp = NULL;
13134 		ill->ill_arp_del_mapping_mp = NULL;
13135 		return (err);
13136 	}
13137 	return (ill->ill_ipif_up_count != 0 ? 0 : EINPROGRESS);
13138 
13139 failed:;
13140 	ip1dbg(("ipif_resolver_up: FAILED\n"));
13141 	freemsg(arp_add_mp);
13142 	freemsg(arp_del_mp);
13143 	freemsg(arp_add_mapping_mp);
13144 	freemsg(arp_up_mp);
13145 	freemsg(arp_down_mp);
13146 	ill->ill_arp_bringup_pending = 0;
13147 	return (err);
13148 }
13149 
13150 /*
13151  * Wakeup all threads waiting to enter the ipsq, and sleeping
13152  * on any of the ills in this ipsq. The ill_lock of the ill
13153  * must be held so that waiters don't miss wakeups
13154  */
13155 static void
13156 ill_signal_ipsq_ills(ipsq_t *ipsq, boolean_t caller_holds_lock)
13157 {
13158 	phyint_t *phyint;
13159 
13160 	phyint = ipsq->ipsq_phyint_list;
13161 	while (phyint != NULL) {
13162 		if (phyint->phyint_illv4) {
13163 			if (!caller_holds_lock)
13164 				mutex_enter(&phyint->phyint_illv4->ill_lock);
13165 			ASSERT(MUTEX_HELD(&phyint->phyint_illv4->ill_lock));
13166 			cv_broadcast(&phyint->phyint_illv4->ill_cv);
13167 			if (!caller_holds_lock)
13168 				mutex_exit(&phyint->phyint_illv4->ill_lock);
13169 		}
13170 		if (phyint->phyint_illv6) {
13171 			if (!caller_holds_lock)
13172 				mutex_enter(&phyint->phyint_illv6->ill_lock);
13173 			ASSERT(MUTEX_HELD(&phyint->phyint_illv6->ill_lock));
13174 			cv_broadcast(&phyint->phyint_illv6->ill_cv);
13175 			if (!caller_holds_lock)
13176 				mutex_exit(&phyint->phyint_illv6->ill_lock);
13177 		}
13178 		phyint = phyint->phyint_ipsq_next;
13179 	}
13180 }
13181 
13182 static ipsq_t *
13183 ipsq_create(char *groupname)
13184 {
13185 	ipsq_t	*ipsq;
13186 
13187 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
13188 	ipsq = kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP);
13189 	if (ipsq == NULL) {
13190 		return (NULL);
13191 	}
13192 
13193 	if (groupname != NULL)
13194 		(void) strcpy(ipsq->ipsq_name, groupname);
13195 	else
13196 		ipsq->ipsq_name[0] = '\0';
13197 
13198 	mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, NULL);
13199 	ipsq->ipsq_flags |= IPSQ_GROUP;
13200 	ipsq->ipsq_next = ipsq_g_head;
13201 	ipsq_g_head = ipsq;
13202 	return (ipsq);
13203 }
13204 
13205 /*
13206  * Return an ipsq correspoding to the groupname. If 'create' is true
13207  * allocate a new ipsq if one does not exist. Usually an ipsq is associated
13208  * uniquely with an IPMP group. However during IPMP groupname operations,
13209  * multiple IPMP groups may be associated with a single ipsq. But no
13210  * IPMP group can be associated with more than 1 ipsq at any time.
13211  * For example
13212  *	Interfaces		IPMP grpname	ipsq	ipsq_name      ipsq_refs
13213  * 	hme1, hme2		mpk17-84	ipsq1	mpk17-84	2
13214  *	hme3, hme4		mpk17-85	ipsq2	mpk17-85	2
13215  *
13216  * Now the command ifconfig hme3 group mpk17-84 results in the temporary
13217  * status shown below during the execution of the above command.
13218  * 	hme1, hme2, hme3, hme4	mpk17-84, mpk17-85	ipsq1	mpk17-84  4
13219  *
13220  * After the completion of the above groupname command we return to the stable
13221  * state shown below.
13222  * 	hme1, hme2, hme3	mpk17-84	ipsq1	mpk17-84	3
13223  *	hme4			mpk17-85	ipsq2	mpk17-85	1
13224  *
13225  * Because of the above, we don't search based on the ipsq_name since that
13226  * would miss the correct ipsq during certain windows as shown above.
13227  * The ipsq_name is only used during split of an ipsq to return the ipsq to its
13228  * natural state.
13229  */
13230 static ipsq_t *
13231 ip_ipsq_lookup(char *groupname, boolean_t create, ipsq_t *exclude_ipsq)
13232 {
13233 	ipsq_t	*ipsq;
13234 	int	group_len;
13235 	phyint_t *phyint;
13236 
13237 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
13238 
13239 	group_len = strlen(groupname);
13240 	ASSERT(group_len != 0);
13241 	group_len++;
13242 
13243 	for (ipsq = ipsq_g_head; ipsq != NULL; ipsq = ipsq->ipsq_next) {
13244 		/*
13245 		 * When an ipsq is being split, and ill_split_ipsq
13246 		 * calls this function, we exclude it from being considered.
13247 		 */
13248 		if (ipsq == exclude_ipsq)
13249 			continue;
13250 
13251 		/*
13252 		 * Compare against the ipsq_name. The groupname change happens
13253 		 * in 2 phases. The 1st phase merges the from group into
13254 		 * the to group's ipsq, by calling ill_merge_groups and restarts
13255 		 * the ioctl. The 2nd phase then locates the ipsq again thru
13256 		 * ipsq_name. At this point the phyint_groupname has not been
13257 		 * updated.
13258 		 */
13259 		if ((group_len == strlen(ipsq->ipsq_name) + 1) &&
13260 		    (bcmp(ipsq->ipsq_name, groupname, group_len) == 0)) {
13261 			/*
13262 			 * Verify that an ipmp groupname is exactly
13263 			 * part of 1 ipsq and is not found in any other
13264 			 * ipsq.
13265 			 */
13266 			ASSERT(ip_ipsq_lookup(groupname, B_FALSE, ipsq) ==
13267 			    NULL);
13268 			return (ipsq);
13269 		}
13270 
13271 		/*
13272 		 * Comparison against ipsq_name alone is not sufficient.
13273 		 * In the case when groups are currently being
13274 		 * merged, the ipsq could hold other IPMP groups temporarily.
13275 		 * so we walk the phyint list and compare against the
13276 		 * phyint_groupname as well.
13277 		 */
13278 		phyint = ipsq->ipsq_phyint_list;
13279 		while (phyint != NULL) {
13280 			if ((group_len == phyint->phyint_groupname_len) &&
13281 			    (bcmp(phyint->phyint_groupname, groupname,
13282 			    group_len) == 0)) {
13283 				/*
13284 				 * Verify that an ipmp groupname is exactly
13285 				 * part of 1 ipsq and is not found in any other
13286 				 * ipsq.
13287 				 */
13288 				ASSERT(ip_ipsq_lookup(groupname, B_FALSE, ipsq)
13289 					== NULL);
13290 				return (ipsq);
13291 			}
13292 			phyint = phyint->phyint_ipsq_next;
13293 		}
13294 	}
13295 	if (create)
13296 		ipsq = ipsq_create(groupname);
13297 	return (ipsq);
13298 }
13299 
13300 static void
13301 ipsq_delete(ipsq_t *ipsq)
13302 {
13303 	ipsq_t *nipsq;
13304 	ipsq_t *pipsq = NULL;
13305 
13306 	/*
13307 	 * We don't hold the ipsq lock, but we are sure no new
13308 	 * messages can land up, since the ipsq_refs is zero.
13309 	 * i.e. this ipsq is unnamed and no phyint or phyint group
13310 	 * is associated with this ipsq. (Lookups are based on ill_name
13311 	 * or phyint_group_name)
13312 	 */
13313 	ASSERT(ipsq->ipsq_refs == 0);
13314 	ASSERT(ipsq->ipsq_xopq_mphead == NULL && ipsq->ipsq_mphead == NULL);
13315 	ASSERT(ipsq->ipsq_pending_mp == NULL);
13316 	if (!(ipsq->ipsq_flags & IPSQ_GROUP)) {
13317 		/*
13318 		 * This is not the ipsq of an IPMP group.
13319 		 */
13320 		kmem_free(ipsq, sizeof (ipsq_t));
13321 		return;
13322 	}
13323 
13324 	rw_enter(&ill_g_lock, RW_WRITER);
13325 
13326 	/*
13327 	 * Locate the ipsq  before we can remove it from
13328 	 * the singly linked list of ipsq's.
13329 	 */
13330 	for (nipsq = ipsq_g_head; nipsq != NULL; nipsq = nipsq->ipsq_next) {
13331 		if (nipsq == ipsq) {
13332 			break;
13333 		}
13334 		pipsq = nipsq;
13335 	}
13336 
13337 	ASSERT(nipsq == ipsq);
13338 
13339 	/* unlink ipsq from the list */
13340 	if (pipsq != NULL)
13341 		pipsq->ipsq_next = ipsq->ipsq_next;
13342 	else
13343 		ipsq_g_head = ipsq->ipsq_next;
13344 	kmem_free(ipsq, sizeof (ipsq_t));
13345 	rw_exit(&ill_g_lock);
13346 }
13347 
13348 static void
13349 ill_move_to_new_ipsq(ipsq_t *old_ipsq, ipsq_t *new_ipsq, mblk_t *current_mp,
13350     queue_t *q)
13351 
13352 {
13353 
13354 	ASSERT(MUTEX_HELD(&new_ipsq->ipsq_lock));
13355 	ASSERT(old_ipsq->ipsq_mphead == NULL && old_ipsq->ipsq_mptail == NULL);
13356 	ASSERT(old_ipsq->ipsq_pending_ipif == NULL);
13357 	ASSERT(old_ipsq->ipsq_pending_mp == NULL);
13358 	ASSERT(current_mp != NULL);
13359 
13360 	ipsq_enq(new_ipsq, q, current_mp, (ipsq_func_t)ip_process_ioctl,
13361 		NEW_OP, NULL);
13362 
13363 	ASSERT(new_ipsq->ipsq_xopq_mptail != NULL &&
13364 	    new_ipsq->ipsq_xopq_mphead != NULL);
13365 
13366 	/*
13367 	 * move from old ipsq to the new ipsq.
13368 	 */
13369 	new_ipsq->ipsq_xopq_mptail->b_next = old_ipsq->ipsq_xopq_mphead;
13370 	if (old_ipsq->ipsq_xopq_mphead != NULL)
13371 		new_ipsq->ipsq_xopq_mptail = old_ipsq->ipsq_xopq_mptail;
13372 
13373 	old_ipsq->ipsq_xopq_mphead = old_ipsq->ipsq_xopq_mptail = NULL;
13374 }
13375 
13376 void
13377 ill_group_cleanup(ill_t *ill)
13378 {
13379 	ill_t *ill_v4;
13380 	ill_t *ill_v6;
13381 	ipif_t *ipif;
13382 
13383 	ill_v4 = ill->ill_phyint->phyint_illv4;
13384 	ill_v6 = ill->ill_phyint->phyint_illv6;
13385 
13386 	if (ill_v4 != NULL) {
13387 		mutex_enter(&ill_v4->ill_lock);
13388 		for (ipif = ill_v4->ill_ipif; ipif != NULL;
13389 		    ipif = ipif->ipif_next) {
13390 			IPIF_UNMARK_MOVING(ipif);
13391 		}
13392 		ill_v4->ill_up_ipifs = B_FALSE;
13393 		mutex_exit(&ill_v4->ill_lock);
13394 	}
13395 
13396 	if (ill_v6 != NULL) {
13397 		mutex_enter(&ill_v6->ill_lock);
13398 		for (ipif = ill_v6->ill_ipif; ipif != NULL;
13399 		    ipif = ipif->ipif_next) {
13400 			IPIF_UNMARK_MOVING(ipif);
13401 		}
13402 		ill_v6->ill_up_ipifs = B_FALSE;
13403 		mutex_exit(&ill_v6->ill_lock);
13404 	}
13405 }
13406 /*
13407  * This function is called when an ill has had a change in its group status
13408  * to bring up all the ipifs that were up before the change.
13409  */
13410 int
13411 ill_up_ipifs(ill_t *ill, queue_t *q, mblk_t *mp)
13412 {
13413 	ipif_t *ipif;
13414 	ill_t *ill_v4;
13415 	ill_t *ill_v6;
13416 	ill_t *from_ill;
13417 	int err = 0;
13418 
13419 
13420 	ASSERT(IAM_WRITER_ILL(ill));
13421 
13422 	/*
13423 	 * Except for ipif_state_flags and ill_state_flags the other
13424 	 * fields of the ipif/ill that are modified below are protected
13425 	 * implicitly since we are a writer. We would have tried to down
13426 	 * even an ipif that was already down, in ill_down_ipifs. So we
13427 	 * just blindly clear the IPIF_CHANGING flag here on all ipifs.
13428 	 */
13429 	ill_v4 = ill->ill_phyint->phyint_illv4;
13430 	ill_v6 = ill->ill_phyint->phyint_illv6;
13431 	if (ill_v4 != NULL) {
13432 		ill_v4->ill_up_ipifs = B_TRUE;
13433 		for (ipif = ill_v4->ill_ipif; ipif != NULL;
13434 		    ipif = ipif->ipif_next) {
13435 			mutex_enter(&ill_v4->ill_lock);
13436 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
13437 			IPIF_UNMARK_MOVING(ipif);
13438 			mutex_exit(&ill_v4->ill_lock);
13439 			if (ipif->ipif_was_up) {
13440 				if (!(ipif->ipif_flags & IPIF_UP))
13441 					err = ipif_up(ipif, q, mp);
13442 				ipif->ipif_was_up = B_FALSE;
13443 				if (err != 0) {
13444 					/*
13445 					 * Can there be any other error ?
13446 					 */
13447 					ASSERT(err == EINPROGRESS);
13448 					return (err);
13449 				}
13450 			}
13451 		}
13452 		mutex_enter(&ill_v4->ill_lock);
13453 		ill_v4->ill_state_flags &= ~ILL_CHANGING;
13454 		mutex_exit(&ill_v4->ill_lock);
13455 		ill_v4->ill_up_ipifs = B_FALSE;
13456 		if (ill_v4->ill_move_in_progress) {
13457 			ASSERT(ill_v4->ill_move_peer != NULL);
13458 			ill_v4->ill_move_in_progress = B_FALSE;
13459 			from_ill = ill_v4->ill_move_peer;
13460 			from_ill->ill_move_in_progress = B_FALSE;
13461 			from_ill->ill_move_peer = NULL;
13462 			mutex_enter(&from_ill->ill_lock);
13463 			from_ill->ill_state_flags &= ~ILL_CHANGING;
13464 			mutex_exit(&from_ill->ill_lock);
13465 			if (ill_v6 == NULL) {
13466 				if (from_ill->ill_phyint->phyint_flags &
13467 				    PHYI_STANDBY) {
13468 					phyint_inactive(from_ill->ill_phyint);
13469 				}
13470 				if (ill_v4->ill_phyint->phyint_flags &
13471 				    PHYI_STANDBY) {
13472 					phyint_inactive(ill_v4->ill_phyint);
13473 				}
13474 			}
13475 			ill_v4->ill_move_peer = NULL;
13476 		}
13477 	}
13478 
13479 	if (ill_v6 != NULL) {
13480 		ill_v6->ill_up_ipifs = B_TRUE;
13481 		for (ipif = ill_v6->ill_ipif; ipif != NULL;
13482 		    ipif = ipif->ipif_next) {
13483 			mutex_enter(&ill_v6->ill_lock);
13484 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
13485 			IPIF_UNMARK_MOVING(ipif);
13486 			mutex_exit(&ill_v6->ill_lock);
13487 			if (ipif->ipif_was_up) {
13488 				if (!(ipif->ipif_flags & IPIF_UP))
13489 					err = ipif_up(ipif, q, mp);
13490 				ipif->ipif_was_up = B_FALSE;
13491 				if (err != 0) {
13492 					/*
13493 					 * Can there be any other error ?
13494 					 */
13495 					ASSERT(err == EINPROGRESS);
13496 					return (err);
13497 				}
13498 			}
13499 		}
13500 		mutex_enter(&ill_v6->ill_lock);
13501 		ill_v6->ill_state_flags &= ~ILL_CHANGING;
13502 		mutex_exit(&ill_v6->ill_lock);
13503 		ill_v6->ill_up_ipifs = B_FALSE;
13504 		if (ill_v6->ill_move_in_progress) {
13505 			ASSERT(ill_v6->ill_move_peer != NULL);
13506 			ill_v6->ill_move_in_progress = B_FALSE;
13507 			from_ill = ill_v6->ill_move_peer;
13508 			from_ill->ill_move_in_progress = B_FALSE;
13509 			from_ill->ill_move_peer = NULL;
13510 			mutex_enter(&from_ill->ill_lock);
13511 			from_ill->ill_state_flags &= ~ILL_CHANGING;
13512 			mutex_exit(&from_ill->ill_lock);
13513 			if (from_ill->ill_phyint->phyint_flags & PHYI_STANDBY) {
13514 				phyint_inactive(from_ill->ill_phyint);
13515 			}
13516 			if (ill_v6->ill_phyint->phyint_flags & PHYI_STANDBY) {
13517 				phyint_inactive(ill_v6->ill_phyint);
13518 			}
13519 			ill_v6->ill_move_peer = NULL;
13520 		}
13521 	}
13522 	return (0);
13523 }
13524 
13525 /*
13526  * bring down all the approriate ipifs.
13527  */
13528 /* ARGSUSED */
13529 static void
13530 ill_down_ipifs(ill_t *ill, mblk_t *mp, int index, boolean_t chk_nofailover)
13531 {
13532 	ipif_t *ipif;
13533 
13534 	ASSERT(IAM_WRITER_ILL(ill));
13535 
13536 	/*
13537 	 * Except for ipif_state_flags the other fields of the ipif/ill that
13538 	 * are modified below are protected implicitly since we are a writer
13539 	 */
13540 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13541 		if (chk_nofailover && (ipif->ipif_flags & IPIF_NOFAILOVER))
13542 			continue;
13543 		if (index == 0 || index == ipif->ipif_orig_ifindex) {
13544 			/*
13545 			 * We go through the ipif_down logic even if the ipif
13546 			 * is already down, since routes can be added based
13547 			 * on down ipifs. Going through ipif_down once again
13548 			 * will delete any IREs created based on these routes.
13549 			 */
13550 			if (ipif->ipif_flags & IPIF_UP)
13551 				ipif->ipif_was_up = B_TRUE;
13552 			/*
13553 			 * If called with chk_nofailover true ipif is moving.
13554 			 */
13555 			mutex_enter(&ill->ill_lock);
13556 			if (chk_nofailover) {
13557 				ipif->ipif_state_flags |=
13558 					IPIF_MOVING | IPIF_CHANGING;
13559 			} else {
13560 				ipif->ipif_state_flags |= IPIF_CHANGING;
13561 			}
13562 			mutex_exit(&ill->ill_lock);
13563 			/*
13564 			 * Need to re-create net/subnet bcast ires if
13565 			 * they are dependent on ipif.
13566 			 */
13567 			if (!ipif->ipif_isv6)
13568 				ipif_check_bcast_ires(ipif);
13569 			(void) ipif_logical_down(ipif, NULL, NULL);
13570 			ipif_down_tail(ipif);
13571 			/*
13572 			 * We don't do ipif_multicast_down for IPv4 in
13573 			 * ipif_down. We need to set this so that
13574 			 * ipif_multicast_up will join the
13575 			 * ALLHOSTS_GROUP on to_ill.
13576 			 */
13577 			ipif->ipif_multicast_up = B_FALSE;
13578 		}
13579 	}
13580 }
13581 
13582 #define	IPSQ_INC_REF(ipsq)	{			\
13583 	ASSERT(RW_WRITE_HELD(&ill_g_lock));		\
13584 	(ipsq)->ipsq_refs++;				\
13585 }
13586 
13587 #define	IPSQ_DEC_REF(ipsq)	{			\
13588 	ASSERT(RW_WRITE_HELD(&ill_g_lock));		\
13589 	(ipsq)->ipsq_refs--;				\
13590 	if ((ipsq)->ipsq_refs == 0)				\
13591 		(ipsq)->ipsq_name[0] = '\0'; 		\
13592 }
13593 
13594 /*
13595  * Change the ipsq of all the ill's whose current ipsq is 'cur_ipsq' to
13596  * new_ipsq.
13597  */
13598 static void
13599 ill_merge_ipsq(ipsq_t *cur_ipsq, ipsq_t *new_ipsq)
13600 {
13601 	phyint_t *phyint;
13602 	phyint_t *next_phyint;
13603 
13604 	/*
13605 	 * To change the ipsq of an ill, we need to hold the ill_g_lock as
13606 	 * writer and the ill_lock of the ill in question. Also the dest
13607 	 * ipsq can't vanish while we hold the ill_g_lock as writer.
13608 	 */
13609 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
13610 
13611 	phyint = cur_ipsq->ipsq_phyint_list;
13612 	cur_ipsq->ipsq_phyint_list = NULL;
13613 	while (phyint != NULL) {
13614 		next_phyint = phyint->phyint_ipsq_next;
13615 		IPSQ_DEC_REF(cur_ipsq);
13616 		phyint->phyint_ipsq_next = new_ipsq->ipsq_phyint_list;
13617 		new_ipsq->ipsq_phyint_list = phyint;
13618 		IPSQ_INC_REF(new_ipsq);
13619 		phyint->phyint_ipsq = new_ipsq;
13620 		phyint = next_phyint;
13621 	}
13622 }
13623 
13624 #define	SPLIT_SUCCESS		0
13625 #define	SPLIT_NOT_NEEDED	1
13626 #define	SPLIT_FAILED		2
13627 
13628 int
13629 ill_split_to_grp_ipsq(phyint_t *phyint, ipsq_t *cur_ipsq, boolean_t need_retry)
13630 {
13631 	ipsq_t *newipsq = NULL;
13632 
13633 	/*
13634 	 * Assertions denote pre-requisites for changing the ipsq of
13635 	 * a phyint
13636 	 */
13637 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
13638 	/*
13639 	 * <ill-phyint> assocs can't change while ill_g_lock
13640 	 * is held as writer. See ill_phyint_reinit()
13641 	 */
13642 	ASSERT(phyint->phyint_illv4 == NULL ||
13643 	    MUTEX_HELD(&phyint->phyint_illv4->ill_lock));
13644 	ASSERT(phyint->phyint_illv6 == NULL ||
13645 	    MUTEX_HELD(&phyint->phyint_illv6->ill_lock));
13646 
13647 	if ((phyint->phyint_groupname_len !=
13648 	    (strlen(cur_ipsq->ipsq_name) + 1) ||
13649 	    bcmp(phyint->phyint_groupname, cur_ipsq->ipsq_name,
13650 	    phyint->phyint_groupname_len) != 0)) {
13651 		/*
13652 		 * Once we fail in creating a new ipsq due to memory shortage,
13653 		 * don't attempt to create new ipsq again, based on another
13654 		 * phyint, since we want all phyints belonging to an IPMP group
13655 		 * to be in the same ipsq even in the event of mem alloc fails.
13656 		 */
13657 		newipsq = ip_ipsq_lookup(phyint->phyint_groupname, !need_retry,
13658 		    cur_ipsq);
13659 		if (newipsq == NULL) {
13660 			/* Memory allocation failure */
13661 			return (SPLIT_FAILED);
13662 		} else {
13663 			/* ipsq_refs protected by ill_g_lock (writer) */
13664 			IPSQ_DEC_REF(cur_ipsq);
13665 			phyint->phyint_ipsq = newipsq;
13666 			phyint->phyint_ipsq_next = newipsq->ipsq_phyint_list;
13667 			newipsq->ipsq_phyint_list = phyint;
13668 			IPSQ_INC_REF(newipsq);
13669 			return (SPLIT_SUCCESS);
13670 		}
13671 	}
13672 	return (SPLIT_NOT_NEEDED);
13673 }
13674 
13675 /*
13676  * The ill locks of the phyint and the ill_g_lock (writer) must be held
13677  * to do this split
13678  */
13679 static int
13680 ill_split_to_own_ipsq(phyint_t *phyint, ipsq_t *cur_ipsq)
13681 {
13682 	ipsq_t *newipsq;
13683 
13684 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
13685 	/*
13686 	 * <ill-phyint> assocs can't change while ill_g_lock
13687 	 * is held as writer. See ill_phyint_reinit()
13688 	 */
13689 
13690 	ASSERT(phyint->phyint_illv4 == NULL ||
13691 	    MUTEX_HELD(&phyint->phyint_illv4->ill_lock));
13692 	ASSERT(phyint->phyint_illv6 == NULL ||
13693 	    MUTEX_HELD(&phyint->phyint_illv6->ill_lock));
13694 
13695 	if (!ipsq_init((phyint->phyint_illv4 != NULL) ?
13696 	    phyint->phyint_illv4: phyint->phyint_illv6)) {
13697 		/*
13698 		 * ipsq_init failed due to no memory
13699 		 * caller will use the same ipsq
13700 		 */
13701 		return (SPLIT_FAILED);
13702 	}
13703 
13704 	/* ipsq_ref is protected by ill_g_lock (writer) */
13705 	IPSQ_DEC_REF(cur_ipsq);
13706 
13707 	/*
13708 	 * This is a new ipsq that is unknown to the world.
13709 	 * So we don't need to hold ipsq_lock,
13710 	 */
13711 	newipsq = phyint->phyint_ipsq;
13712 	newipsq->ipsq_writer = NULL;
13713 	newipsq->ipsq_reentry_cnt--;
13714 	ASSERT(newipsq->ipsq_reentry_cnt == 0);
13715 #ifdef ILL_DEBUG
13716 	newipsq->ipsq_depth = 0;
13717 #endif
13718 
13719 	return (SPLIT_SUCCESS);
13720 }
13721 
13722 /*
13723  * Change the ipsq of all the ill's whose current ipsq is 'cur_ipsq' to
13724  * ipsq's representing their individual groups or themselves. Return
13725  * whether split needs to be retried again later.
13726  */
13727 static boolean_t
13728 ill_split_ipsq(ipsq_t *cur_ipsq)
13729 {
13730 	phyint_t *phyint;
13731 	phyint_t *next_phyint;
13732 	int	error;
13733 	boolean_t need_retry = B_FALSE;
13734 
13735 	phyint = cur_ipsq->ipsq_phyint_list;
13736 	cur_ipsq->ipsq_phyint_list = NULL;
13737 	while (phyint != NULL) {
13738 		next_phyint = phyint->phyint_ipsq_next;
13739 		/*
13740 		 * 'created' will tell us whether the callee actually
13741 		 * created an ipsq. Lack of memory may force the callee
13742 		 * to return without creating an ipsq.
13743 		 */
13744 		if (phyint->phyint_groupname == NULL) {
13745 			error = ill_split_to_own_ipsq(phyint, cur_ipsq);
13746 		} else {
13747 			error = ill_split_to_grp_ipsq(phyint, cur_ipsq,
13748 					need_retry);
13749 		}
13750 
13751 		switch (error) {
13752 		case SPLIT_FAILED:
13753 			need_retry = B_TRUE;
13754 			/* FALLTHRU */
13755 		case SPLIT_NOT_NEEDED:
13756 			/*
13757 			 * Keep it on the list.
13758 			 */
13759 			phyint->phyint_ipsq_next = cur_ipsq->ipsq_phyint_list;
13760 			cur_ipsq->ipsq_phyint_list = phyint;
13761 			break;
13762 		case SPLIT_SUCCESS:
13763 			break;
13764 		default:
13765 			ASSERT(0);
13766 		}
13767 
13768 		phyint = next_phyint;
13769 	}
13770 	return (need_retry);
13771 }
13772 
13773 /*
13774  * given an ipsq 'ipsq' lock all ills associated with this ipsq.
13775  * and return the ills in the list. This list will be
13776  * needed to unlock all the ills later on by the caller.
13777  * The <ill-ipsq> associations could change between the
13778  * lock and unlock. Hence the unlock can't traverse the
13779  * ipsq to get the list of ills.
13780  */
13781 static int
13782 ill_lock_ipsq_ills(ipsq_t *ipsq, ill_t **list, int list_max)
13783 {
13784 	int	cnt = 0;
13785 	phyint_t	*phyint;
13786 
13787 	/*
13788 	 * The caller holds ill_g_lock to ensure that the ill memberships
13789 	 * of the ipsq don't change
13790 	 */
13791 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
13792 
13793 	phyint = ipsq->ipsq_phyint_list;
13794 	while (phyint != NULL) {
13795 		if (phyint->phyint_illv4 != NULL) {
13796 			ASSERT(cnt < list_max);
13797 			list[cnt++] = phyint->phyint_illv4;
13798 		}
13799 		if (phyint->phyint_illv6 != NULL) {
13800 			ASSERT(cnt < list_max);
13801 			list[cnt++] = phyint->phyint_illv6;
13802 		}
13803 		phyint = phyint->phyint_ipsq_next;
13804 	}
13805 	ill_lock_ills(list, cnt);
13806 	return (cnt);
13807 }
13808 
13809 void
13810 ill_lock_ills(ill_t **list, int cnt)
13811 {
13812 	int	i;
13813 
13814 	if (cnt > 1) {
13815 		boolean_t try_again;
13816 		do {
13817 			try_again = B_FALSE;
13818 			for (i = 0; i < cnt - 1; i++) {
13819 				if (list[i] < list[i + 1]) {
13820 					ill_t	*tmp;
13821 
13822 					/* swap the elements */
13823 					tmp = list[i];
13824 					list[i] = list[i + 1];
13825 					list[i + 1] = tmp;
13826 					try_again = B_TRUE;
13827 				}
13828 			}
13829 		} while (try_again);
13830 	}
13831 
13832 	for (i = 0; i < cnt; i++) {
13833 		if (i == 0) {
13834 			if (list[i] != NULL)
13835 				mutex_enter(&list[i]->ill_lock);
13836 			else
13837 				return;
13838 		} else if ((list[i-1] != list[i]) && (list[i] != NULL)) {
13839 			mutex_enter(&list[i]->ill_lock);
13840 		}
13841 	}
13842 }
13843 
13844 void
13845 ill_unlock_ills(ill_t **list, int cnt)
13846 {
13847 	int	i;
13848 
13849 	for (i = 0; i < cnt; i++) {
13850 		if ((i == 0) && (list[i] != NULL)) {
13851 			mutex_exit(&list[i]->ill_lock);
13852 		} else if ((list[i-1] != list[i]) && (list[i] != NULL)) {
13853 			mutex_exit(&list[i]->ill_lock);
13854 		}
13855 	}
13856 }
13857 
13858 /*
13859  * Merge all the ills from 1 ipsq group into another ipsq group.
13860  * The source ipsq group is specified by the ipsq associated with
13861  * 'from_ill'. The destination ipsq group is specified by the ipsq
13862  * associated with 'to_ill' or 'groupname' respectively.
13863  * Note that ipsq itself does not have a reference count mechanism
13864  * and functions don't look up an ipsq and pass it around. Instead
13865  * functions pass around an ill or groupname, and the ipsq is looked
13866  * up from the ill or groupname and the required operation performed
13867  * atomically with the lookup on the ipsq.
13868  */
13869 static int
13870 ill_merge_groups(ill_t *from_ill, ill_t *to_ill, char *groupname, mblk_t *mp,
13871     queue_t *q)
13872 {
13873 	ipsq_t *old_ipsq;
13874 	ipsq_t *new_ipsq;
13875 	ill_t	**ill_list;
13876 	int	cnt;
13877 	size_t	ill_list_size;
13878 	boolean_t became_writer_on_new_sq = B_FALSE;
13879 
13880 	/* Exactly 1 of 'to_ill' and groupname can be specified. */
13881 	ASSERT((to_ill != NULL) ^ (groupname != NULL));
13882 
13883 	/*
13884 	 * Need to hold ill_g_lock as writer and also the ill_lock to
13885 	 * change the <ill-ipsq> assoc of an ill. Need to hold the
13886 	 * ipsq_lock to prevent new messages from landing on an ipsq.
13887 	 */
13888 	rw_enter(&ill_g_lock, RW_WRITER);
13889 
13890 	old_ipsq = from_ill->ill_phyint->phyint_ipsq;
13891 	if (groupname != NULL)
13892 		new_ipsq = ip_ipsq_lookup(groupname, B_TRUE, NULL);
13893 	else {
13894 		new_ipsq = to_ill->ill_phyint->phyint_ipsq;
13895 	}
13896 
13897 	ASSERT(old_ipsq != NULL && new_ipsq != NULL);
13898 
13899 	/*
13900 	 * both groups are on the same ipsq.
13901 	 */
13902 	if (old_ipsq == new_ipsq) {
13903 		rw_exit(&ill_g_lock);
13904 		return (0);
13905 	}
13906 
13907 	cnt = old_ipsq->ipsq_refs << 1;
13908 	ill_list_size = cnt * sizeof (ill_t *);
13909 	ill_list = kmem_zalloc(ill_list_size, KM_NOSLEEP);
13910 	if (ill_list == NULL) {
13911 		rw_exit(&ill_g_lock);
13912 		return (ENOMEM);
13913 	}
13914 	cnt = ill_lock_ipsq_ills(old_ipsq, ill_list, cnt);
13915 
13916 	/* Need ipsq lock to enque messages on new ipsq or to become writer */
13917 	mutex_enter(&new_ipsq->ipsq_lock);
13918 	if ((new_ipsq->ipsq_writer == NULL &&
13919 		new_ipsq->ipsq_current_ipif == NULL) ||
13920 	    (new_ipsq->ipsq_writer == curthread)) {
13921 		new_ipsq->ipsq_writer = curthread;
13922 		new_ipsq->ipsq_reentry_cnt++;
13923 		became_writer_on_new_sq = B_TRUE;
13924 	}
13925 
13926 	/*
13927 	 * We are holding ill_g_lock as writer and all the ill locks of
13928 	 * the old ipsq. So the old_ipsq can't be looked up, and hence no new
13929 	 * message can land up on the old ipsq even though we don't hold the
13930 	 * ipsq_lock of the old_ipsq. Now move all messages to the newipsq.
13931 	 */
13932 	ill_move_to_new_ipsq(old_ipsq, new_ipsq, mp, q);
13933 
13934 	/*
13935 	 * now change the ipsq of all ills in the 'old_ipsq' to 'new_ipsq'.
13936 	 * 'new_ipsq' has been looked up, and it can't change its <ill-ipsq>
13937 	 * assocs. till we release the ill_g_lock, and hence it can't vanish.
13938 	 */
13939 	ill_merge_ipsq(old_ipsq, new_ipsq);
13940 
13941 	/*
13942 	 * Mark the new ipsq as needing a split since it is currently
13943 	 * being shared by more than 1 IPMP group. The split will
13944 	 * occur at the end of ipsq_exit
13945 	 */
13946 	new_ipsq->ipsq_split = B_TRUE;
13947 
13948 	/* Now release all the locks */
13949 	mutex_exit(&new_ipsq->ipsq_lock);
13950 	ill_unlock_ills(ill_list, cnt);
13951 	rw_exit(&ill_g_lock);
13952 
13953 	kmem_free(ill_list, ill_list_size);
13954 
13955 	/*
13956 	 * If we succeeded in becoming writer on the new ipsq, then
13957 	 * drain the new ipsq and start processing  all enqueued messages
13958 	 * including the current ioctl we are processing which is either
13959 	 * a set groupname or failover/failback.
13960 	 */
13961 	if (became_writer_on_new_sq)
13962 		ipsq_exit(new_ipsq, B_TRUE, B_TRUE);
13963 
13964 	/*
13965 	 * syncq has been changed and all the messages have been moved.
13966 	 */
13967 	mutex_enter(&old_ipsq->ipsq_lock);
13968 	old_ipsq->ipsq_current_ipif = NULL;
13969 	mutex_exit(&old_ipsq->ipsq_lock);
13970 	return (EINPROGRESS);
13971 }
13972 
13973 /*
13974  * Delete and add the loopback copy and non-loopback copy of
13975  * the BROADCAST ire corresponding to ill and addr. Used to
13976  * group broadcast ires together when ill becomes part of
13977  * a group.
13978  *
13979  * This function is also called when ill is leaving the group
13980  * so that the ires belonging to the group gets re-grouped.
13981  */
13982 static void
13983 ill_bcast_delete_and_add(ill_t *ill, ipaddr_t addr)
13984 {
13985 	ire_t *ire, *nire, *nire_next, *ire_head = NULL;
13986 	ire_t **ire_ptpn = &ire_head;
13987 
13988 	/*
13989 	 * The loopback and non-loopback IREs are inserted in the order in which
13990 	 * they're found, on the basis that they are correctly ordered (loopback
13991 	 * first).
13992 	 */
13993 	for (;;) {
13994 		ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, ill->ill_ipif,
13995 		    ALL_ZONES, MATCH_IRE_TYPE | MATCH_IRE_ILL);
13996 		if (ire == NULL)
13997 			break;
13998 
13999 		/*
14000 		 * we are passing in KM_SLEEP because it is not easy to
14001 		 * go back to a sane state in case of memory failure.
14002 		 */
14003 		nire = kmem_cache_alloc(ire_cache, KM_SLEEP);
14004 		ASSERT(nire != NULL);
14005 		bzero(nire, sizeof (ire_t));
14006 		/*
14007 		 * Don't use ire_max_frag directly since we don't
14008 		 * hold on to 'ire' until we add the new ire 'nire' and
14009 		 * we don't want the new ire to have a dangling reference
14010 		 * to 'ire'. The ire_max_frag of a broadcast ire must
14011 		 * be in sync with the ipif_mtu of the associate ipif.
14012 		 * For eg. this happens as a result of SIOCSLIFNAME,
14013 		 * SIOCSLIFLNKINFO or a DL_NOTE_SDU_SIZE inititated by
14014 		 * the driver. A change in ire_max_frag triggered as
14015 		 * as a result of path mtu discovery, or due to an
14016 		 * IP_IOC_IRE_ADVISE_NOREPLY from the transport or due a
14017 		 * route change -mtu command does not apply to broadcast ires.
14018 		 *
14019 		 * XXX We need a recovery strategy here if ire_init fails
14020 		 */
14021 		if (ire_init(nire,
14022 		    (uchar_t *)&ire->ire_addr,
14023 		    (uchar_t *)&ire->ire_mask,
14024 		    (uchar_t *)&ire->ire_src_addr,
14025 		    (uchar_t *)&ire->ire_gateway_addr,
14026 		    (uchar_t *)&ire->ire_in_src_addr,
14027 		    ire->ire_stq == NULL ? &ip_loopback_mtu :
14028 			&ire->ire_ipif->ipif_mtu,
14029 		    ire->ire_fp_mp,
14030 		    ire->ire_rfq,
14031 		    ire->ire_stq,
14032 		    ire->ire_type,
14033 		    ire->ire_dlureq_mp,
14034 		    ire->ire_ipif,
14035 		    ire->ire_in_ill,
14036 		    ire->ire_cmask,
14037 		    ire->ire_phandle,
14038 		    ire->ire_ihandle,
14039 		    ire->ire_flags,
14040 		    &ire->ire_uinfo) == NULL) {
14041 			cmn_err(CE_PANIC, "ire_init() failed");
14042 		}
14043 		ire_delete(ire);
14044 		ire_refrele(ire);
14045 
14046 		/*
14047 		 * The newly created IREs are inserted at the tail of the list
14048 		 * starting with ire_head. As we've just allocated them no one
14049 		 * knows about them so it's safe.
14050 		 */
14051 		*ire_ptpn = nire;
14052 		ire_ptpn = &nire->ire_next;
14053 	}
14054 
14055 	for (nire = ire_head; nire != NULL; nire = nire_next) {
14056 		int error;
14057 		ire_t *oire;
14058 		/* unlink the IRE from our list before calling ire_add() */
14059 		nire_next = nire->ire_next;
14060 		nire->ire_next = NULL;
14061 
14062 		/* ire_add adds the ire at the right place in the list */
14063 		oire = nire;
14064 		error = ire_add(&nire, NULL, NULL, NULL);
14065 		ASSERT(error == 0);
14066 		ASSERT(oire == nire);
14067 		ire_refrele(nire);	/* Held in ire_add */
14068 	}
14069 }
14070 
14071 /*
14072  * This function is usually called when an ill is inserted in
14073  * a group and all the ipifs are already UP. As all the ipifs
14074  * are already UP, the broadcast ires have already been created
14075  * and been inserted. But, ire_add_v4 would not have grouped properly.
14076  * We need to re-group for the benefit of ip_wput_ire which
14077  * expects BROADCAST ires to be grouped properly to avoid sending
14078  * more than one copy of the broadcast packet per group.
14079  *
14080  * NOTE : We don't check for ill_ipif_up_count to be non-zero here
14081  *	  because when ipif_up_done ends up calling this, ires have
14082  *        already been added before illgrp_insert i.e before ill_group
14083  *	  has been initialized.
14084  */
14085 static void
14086 ill_group_bcast_for_xmit(ill_t *ill)
14087 {
14088 	ill_group_t *illgrp;
14089 	ipif_t *ipif;
14090 	ipaddr_t addr;
14091 	ipaddr_t net_mask;
14092 	ipaddr_t subnet_netmask;
14093 
14094 	illgrp = ill->ill_group;
14095 
14096 	/*
14097 	 * This function is called even when an ill is deleted from
14098 	 * the group. Hence, illgrp could be null.
14099 	 */
14100 	if (illgrp != NULL && illgrp->illgrp_ill_count == 1)
14101 		return;
14102 
14103 	/*
14104 	 * Delete all the BROADCAST ires matching this ill and add
14105 	 * them back. This time, ire_add_v4 should take care of
14106 	 * grouping them with others because ill is part of the
14107 	 * group.
14108 	 */
14109 	ill_bcast_delete_and_add(ill, 0);
14110 	ill_bcast_delete_and_add(ill, INADDR_BROADCAST);
14111 
14112 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
14113 
14114 		if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14115 		    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14116 			net_mask = ip_net_mask(ipif->ipif_lcl_addr);
14117 		} else {
14118 			net_mask = htonl(IN_CLASSA_NET);
14119 		}
14120 		addr = net_mask & ipif->ipif_subnet;
14121 		ill_bcast_delete_and_add(ill, addr);
14122 		ill_bcast_delete_and_add(ill, ~net_mask | addr);
14123 
14124 		subnet_netmask = ipif->ipif_net_mask;
14125 		addr = ipif->ipif_subnet;
14126 		ill_bcast_delete_and_add(ill, addr);
14127 		ill_bcast_delete_and_add(ill, ~subnet_netmask | addr);
14128 	}
14129 }
14130 
14131 /*
14132  * This function is called from illgrp_delete when ill is being deleted
14133  * from the group.
14134  *
14135  * As ill is not there in the group anymore, any address belonging
14136  * to this ill should be cleared of IRE_MARK_NORECV.
14137  */
14138 static void
14139 ill_clear_bcast_mark(ill_t *ill, ipaddr_t addr)
14140 {
14141 	ire_t *ire;
14142 	irb_t *irb;
14143 
14144 	ASSERT(ill->ill_group == NULL);
14145 
14146 	ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, ill->ill_ipif,
14147 	    ALL_ZONES, MATCH_IRE_TYPE | MATCH_IRE_ILL);
14148 
14149 	if (ire != NULL) {
14150 		/*
14151 		 * IPMP and plumbing operations are serialized on the ipsq, so
14152 		 * no one will insert or delete a broadcast ire under our feet.
14153 		 */
14154 		irb = ire->ire_bucket;
14155 		rw_enter(&irb->irb_lock, RW_READER);
14156 		ire_refrele(ire);
14157 
14158 		for (; ire != NULL; ire = ire->ire_next) {
14159 			if (ire->ire_addr != addr)
14160 				break;
14161 			if (ire_to_ill(ire) != ill)
14162 				continue;
14163 
14164 			ASSERT(!(ire->ire_marks & IRE_MARK_CONDEMNED));
14165 			ire->ire_marks &= ~IRE_MARK_NORECV;
14166 		}
14167 		rw_exit(&irb->irb_lock);
14168 	}
14169 }
14170 
14171 /*
14172  * This function must be called only after the broadcast ires
14173  * have been grouped together. For a given address addr, nominate
14174  * only one of the ires whose interface is not FAILED or OFFLINE.
14175  *
14176  * This is also called when an ipif goes down, so that we can nominate
14177  * a different ire with the same address for receiving.
14178  */
14179 static void
14180 ill_mark_bcast(ill_group_t *illgrp, ipaddr_t addr)
14181 {
14182 	irb_t *irb;
14183 	ire_t *ire;
14184 	ire_t *ire1;
14185 	ire_t *save_ire;
14186 	ire_t **irep = NULL;
14187 	boolean_t first = B_TRUE;
14188 	ire_t *clear_ire = NULL;
14189 	ire_t *start_ire = NULL;
14190 	ire_t	*new_lb_ire;
14191 	ire_t	*new_nlb_ire;
14192 	boolean_t new_lb_ire_used = B_FALSE;
14193 	boolean_t new_nlb_ire_used = B_FALSE;
14194 	uint64_t match_flags;
14195 	uint64_t phyi_flags;
14196 	boolean_t fallback = B_FALSE;
14197 
14198 	ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, NULL, ALL_ZONES,
14199 	    MATCH_IRE_TYPE);
14200 	/*
14201 	 * We may not be able to find some ires if a previous
14202 	 * ire_create failed. This happens when an ipif goes
14203 	 * down and we are unable to create BROADCAST ires due
14204 	 * to memory failure. Thus, we have to check for NULL
14205 	 * below. This should handle the case for LOOPBACK,
14206 	 * POINTOPOINT and interfaces with some POINTOPOINT
14207 	 * logicals for which there are no BROADCAST ires.
14208 	 */
14209 	if (ire == NULL)
14210 		return;
14211 	/*
14212 	 * Currently IRE_BROADCASTS are deleted when an ipif
14213 	 * goes down which runs exclusively. Thus, setting
14214 	 * IRE_MARK_RCVD should not race with ire_delete marking
14215 	 * IRE_MARK_CONDEMNED. We grab the lock below just to
14216 	 * be consistent with other parts of the code that walks
14217 	 * a given bucket.
14218 	 */
14219 	save_ire = ire;
14220 	irb = ire->ire_bucket;
14221 	new_lb_ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
14222 	if (new_lb_ire == NULL) {
14223 		ire_refrele(ire);
14224 		return;
14225 	}
14226 	new_nlb_ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
14227 	if (new_nlb_ire == NULL) {
14228 		ire_refrele(ire);
14229 		kmem_cache_free(ire_cache, new_lb_ire);
14230 		return;
14231 	}
14232 	IRB_REFHOLD(irb);
14233 	rw_enter(&irb->irb_lock, RW_WRITER);
14234 	/*
14235 	 * Get to the first ire matching the address and the
14236 	 * group. If the address does not match we are done
14237 	 * as we could not find the IRE. If the address matches
14238 	 * we should get to the first one matching the group.
14239 	 */
14240 	while (ire != NULL) {
14241 		if (ire->ire_addr != addr ||
14242 		    ire->ire_ipif->ipif_ill->ill_group == illgrp) {
14243 			break;
14244 		}
14245 		ire = ire->ire_next;
14246 	}
14247 	match_flags = PHYI_FAILED | PHYI_INACTIVE;
14248 	start_ire = ire;
14249 redo:
14250 	while (ire != NULL && ire->ire_addr == addr &&
14251 	    ire->ire_ipif->ipif_ill->ill_group == illgrp) {
14252 		/*
14253 		 * The first ire for any address within a group
14254 		 * should always be the one with IRE_MARK_NORECV cleared
14255 		 * so that ip_wput_ire can avoid searching for one.
14256 		 * Note down the insertion point which will be used
14257 		 * later.
14258 		 */
14259 		if (first && (irep == NULL))
14260 			irep = ire->ire_ptpn;
14261 		/*
14262 		 * PHYI_FAILED is set when the interface fails.
14263 		 * This interface might have become good, but the
14264 		 * daemon has not yet detected. We should still
14265 		 * not receive on this. PHYI_OFFLINE should never
14266 		 * be picked as this has been offlined and soon
14267 		 * be removed.
14268 		 */
14269 		phyi_flags = ire->ire_ipif->ipif_ill->ill_phyint->phyint_flags;
14270 		if (phyi_flags & PHYI_OFFLINE) {
14271 			ire->ire_marks |= IRE_MARK_NORECV;
14272 			ire = ire->ire_next;
14273 			continue;
14274 		}
14275 		if (phyi_flags & match_flags) {
14276 			ire->ire_marks |= IRE_MARK_NORECV;
14277 			ire = ire->ire_next;
14278 			if ((phyi_flags & (PHYI_FAILED | PHYI_INACTIVE)) ==
14279 			    PHYI_INACTIVE) {
14280 				fallback = B_TRUE;
14281 			}
14282 			continue;
14283 		}
14284 		if (first) {
14285 			/*
14286 			 * We will move this to the front of the list later
14287 			 * on.
14288 			 */
14289 			clear_ire = ire;
14290 			ire->ire_marks &= ~IRE_MARK_NORECV;
14291 		} else {
14292 			ire->ire_marks |= IRE_MARK_NORECV;
14293 		}
14294 		first = B_FALSE;
14295 		ire = ire->ire_next;
14296 	}
14297 	/*
14298 	 * If we never nominated anybody, try nominating at least
14299 	 * an INACTIVE, if we found one. Do it only once though.
14300 	 */
14301 	if (first && (match_flags == (PHYI_FAILED | PHYI_INACTIVE)) &&
14302 	    fallback) {
14303 		match_flags = PHYI_FAILED;
14304 		ire = start_ire;
14305 		irep = NULL;
14306 		goto redo;
14307 	}
14308 	ire_refrele(save_ire);
14309 
14310 	/*
14311 	 * irep non-NULL indicates that we entered the while loop
14312 	 * above. If clear_ire is at the insertion point, we don't
14313 	 * have to do anything. clear_ire will be NULL if all the
14314 	 * interfaces are failed.
14315 	 *
14316 	 * We cannot unlink and reinsert the ire at the right place
14317 	 * in the list since there can be other walkers of this bucket.
14318 	 * Instead we delete and recreate the ire
14319 	 */
14320 	if (clear_ire != NULL && irep != NULL && *irep != clear_ire) {
14321 		ire_t *clear_ire_stq = NULL;
14322 		bzero(new_lb_ire, sizeof (ire_t));
14323 		/* XXX We need a recovery strategy here. */
14324 		if (ire_init(new_lb_ire,
14325 		    (uchar_t *)&clear_ire->ire_addr,
14326 		    (uchar_t *)&clear_ire->ire_mask,
14327 		    (uchar_t *)&clear_ire->ire_src_addr,
14328 		    (uchar_t *)&clear_ire->ire_gateway_addr,
14329 		    (uchar_t *)&clear_ire->ire_in_src_addr,
14330 		    &clear_ire->ire_max_frag,
14331 		    clear_ire->ire_fp_mp,
14332 		    clear_ire->ire_rfq,
14333 		    clear_ire->ire_stq,
14334 		    clear_ire->ire_type,
14335 		    clear_ire->ire_dlureq_mp,
14336 		    clear_ire->ire_ipif,
14337 		    clear_ire->ire_in_ill,
14338 		    clear_ire->ire_cmask,
14339 		    clear_ire->ire_phandle,
14340 		    clear_ire->ire_ihandle,
14341 		    clear_ire->ire_flags,
14342 		    &clear_ire->ire_uinfo) == NULL)
14343 			cmn_err(CE_PANIC, "ire_init() failed");
14344 		if (clear_ire->ire_stq == NULL) {
14345 			ire_t *ire_next = clear_ire->ire_next;
14346 			if (ire_next != NULL &&
14347 			    ire_next->ire_stq != NULL &&
14348 			    ire_next->ire_addr == clear_ire->ire_addr &&
14349 			    ire_next->ire_ipif->ipif_ill ==
14350 			    clear_ire->ire_ipif->ipif_ill) {
14351 				clear_ire_stq = ire_next;
14352 
14353 				bzero(new_nlb_ire, sizeof (ire_t));
14354 				/* XXX We need a recovery strategy here. */
14355 				if (ire_init(new_nlb_ire,
14356 				    (uchar_t *)&clear_ire_stq->ire_addr,
14357 				    (uchar_t *)&clear_ire_stq->ire_mask,
14358 				    (uchar_t *)&clear_ire_stq->ire_src_addr,
14359 				    (uchar_t *)&clear_ire_stq->ire_gateway_addr,
14360 				    (uchar_t *)&clear_ire_stq->ire_in_src_addr,
14361 				    &clear_ire_stq->ire_max_frag,
14362 				    clear_ire_stq->ire_fp_mp,
14363 				    clear_ire_stq->ire_rfq,
14364 				    clear_ire_stq->ire_stq,
14365 				    clear_ire_stq->ire_type,
14366 				    clear_ire_stq->ire_dlureq_mp,
14367 				    clear_ire_stq->ire_ipif,
14368 				    clear_ire_stq->ire_in_ill,
14369 				    clear_ire_stq->ire_cmask,
14370 				    clear_ire_stq->ire_phandle,
14371 				    clear_ire_stq->ire_ihandle,
14372 				    clear_ire_stq->ire_flags,
14373 				    &clear_ire_stq->ire_uinfo) == NULL)
14374 					cmn_err(CE_PANIC, "ire_init() failed");
14375 			}
14376 		}
14377 
14378 		/*
14379 		 * Delete the ire. We can't call ire_delete() since
14380 		 * we are holding the bucket lock. We can't release the
14381 		 * bucket lock since we can't allow irep to change. So just
14382 		 * mark it CONDEMNED. The IRB_REFRELE will delete the
14383 		 * ire from the list and do the refrele.
14384 		 */
14385 		clear_ire->ire_marks |= IRE_MARK_CONDEMNED;
14386 		irb->irb_marks |= IRE_MARK_CONDEMNED;
14387 
14388 		if (clear_ire_stq != NULL) {
14389 			ire_fastpath_list_delete(
14390 			    (ill_t *)clear_ire_stq->ire_stq->q_ptr,
14391 			    clear_ire_stq);
14392 			clear_ire_stq->ire_marks |= IRE_MARK_CONDEMNED;
14393 		}
14394 
14395 		/*
14396 		 * Also take care of otherfields like ib/ob pkt count
14397 		 * etc. Need to dup them. ditto in ill_bcast_delete_and_add
14398 		 */
14399 
14400 		/* Add the new ire's. Insert at *irep */
14401 		new_lb_ire->ire_bucket = clear_ire->ire_bucket;
14402 		ire1 = *irep;
14403 		if (ire1 != NULL)
14404 			ire1->ire_ptpn = &new_lb_ire->ire_next;
14405 		new_lb_ire->ire_next = ire1;
14406 		/* Link the new one in. */
14407 		new_lb_ire->ire_ptpn = irep;
14408 		membar_producer();
14409 		*irep = new_lb_ire;
14410 		new_lb_ire_used = B_TRUE;
14411 		BUMP_IRE_STATS(ire_stats_v4, ire_stats_inserted);
14412 		new_lb_ire->ire_bucket->irb_ire_cnt++;
14413 		new_lb_ire->ire_ipif->ipif_ire_cnt++;
14414 
14415 		if (clear_ire_stq != NULL) {
14416 			new_nlb_ire->ire_bucket = clear_ire->ire_bucket;
14417 			irep = &new_lb_ire->ire_next;
14418 			/* Add the new ire. Insert at *irep */
14419 			ire1 = *irep;
14420 			if (ire1 != NULL)
14421 				ire1->ire_ptpn = &new_nlb_ire->ire_next;
14422 			new_nlb_ire->ire_next = ire1;
14423 			/* Link the new one in. */
14424 			new_nlb_ire->ire_ptpn = irep;
14425 			membar_producer();
14426 			*irep = new_nlb_ire;
14427 			new_nlb_ire_used = B_TRUE;
14428 			BUMP_IRE_STATS(ire_stats_v4, ire_stats_inserted);
14429 			new_nlb_ire->ire_bucket->irb_ire_cnt++;
14430 			new_nlb_ire->ire_ipif->ipif_ire_cnt++;
14431 			((ill_t *)new_nlb_ire->ire_stq->q_ptr)->ill_ire_cnt++;
14432 		}
14433 	}
14434 	rw_exit(&irb->irb_lock);
14435 	if (!new_lb_ire_used)
14436 		kmem_cache_free(ire_cache, new_lb_ire);
14437 	if (!new_nlb_ire_used)
14438 		kmem_cache_free(ire_cache, new_nlb_ire);
14439 	IRB_REFRELE(irb);
14440 }
14441 
14442 /*
14443  * Whenever an ipif goes down we have to renominate a different
14444  * broadcast ire to receive. Whenever an ipif comes up, we need
14445  * to make sure that we have only one nominated to receive.
14446  */
14447 static void
14448 ipif_renominate_bcast(ipif_t *ipif)
14449 {
14450 	ill_t *ill = ipif->ipif_ill;
14451 	ipaddr_t subnet_addr;
14452 	ipaddr_t net_addr;
14453 	ipaddr_t net_mask = 0;
14454 	ipaddr_t subnet_netmask;
14455 	ipaddr_t addr;
14456 	ill_group_t *illgrp;
14457 
14458 	illgrp = ill->ill_group;
14459 	/*
14460 	 * If this is the last ipif going down, it might take
14461 	 * the ill out of the group. In that case ipif_down ->
14462 	 * illgrp_delete takes care of doing the nomination.
14463 	 * ipif_down does not call for this case.
14464 	 */
14465 	ASSERT(illgrp != NULL);
14466 
14467 	/* There could not have been any ires associated with this */
14468 	if (ipif->ipif_subnet == 0)
14469 		return;
14470 
14471 	ill_mark_bcast(illgrp, 0);
14472 	ill_mark_bcast(illgrp, INADDR_BROADCAST);
14473 
14474 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14475 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14476 		net_mask = ip_net_mask(ipif->ipif_lcl_addr);
14477 	} else {
14478 		net_mask = htonl(IN_CLASSA_NET);
14479 	}
14480 	addr = net_mask & ipif->ipif_subnet;
14481 	ill_mark_bcast(illgrp, addr);
14482 
14483 	net_addr = ~net_mask | addr;
14484 	ill_mark_bcast(illgrp, net_addr);
14485 
14486 	subnet_netmask = ipif->ipif_net_mask;
14487 	addr = ipif->ipif_subnet;
14488 	ill_mark_bcast(illgrp, addr);
14489 
14490 	subnet_addr = ~subnet_netmask | addr;
14491 	ill_mark_bcast(illgrp, subnet_addr);
14492 }
14493 
14494 /*
14495  * Whenever we form or delete ill groups, we need to nominate one set of
14496  * BROADCAST ires for receiving in the group.
14497  *
14498  * 1) When ipif_up_done -> ilgrp_insert calls this function, BROADCAST ires
14499  *    have been added, but ill_ipif_up_count is 0. Thus, we don't assert
14500  *    for ill_ipif_up_count to be non-zero. This is the only case where
14501  *    ill_ipif_up_count is zero and we would still find the ires.
14502  *
14503  * 2) ip_sioctl_group_name/ifgrp_insert calls this function, at least one
14504  *    ipif is UP and we just have to do the nomination.
14505  *
14506  * 3) When ill_handoff_responsibility calls us, some ill has been removed
14507  *    from the group. So, we have to do the nomination.
14508  *
14509  * Because of (3), there could be just one ill in the group. But we have
14510  * to nominate still as IRE_MARK_NORCV may have been marked on this.
14511  * Thus, this function does not optimize when there is only one ill as
14512  * it is not correct for (3).
14513  */
14514 static void
14515 ill_nominate_bcast_rcv(ill_group_t *illgrp)
14516 {
14517 	ill_t *ill;
14518 	ipif_t *ipif;
14519 	ipaddr_t subnet_addr;
14520 	ipaddr_t prev_subnet_addr = 0;
14521 	ipaddr_t net_addr;
14522 	ipaddr_t prev_net_addr = 0;
14523 	ipaddr_t net_mask = 0;
14524 	ipaddr_t subnet_netmask;
14525 	ipaddr_t addr;
14526 
14527 	/*
14528 	 * When the last memeber is leaving, there is nothing to
14529 	 * nominate.
14530 	 */
14531 	if (illgrp->illgrp_ill_count == 0) {
14532 		ASSERT(illgrp->illgrp_ill == NULL);
14533 		return;
14534 	}
14535 
14536 	ill = illgrp->illgrp_ill;
14537 	ASSERT(!ill->ill_isv6);
14538 	/*
14539 	 * We assume that ires with same address and belonging to the
14540 	 * same group, has been grouped together. Nominating a *single*
14541 	 * ill in the group for sending and receiving broadcast is done
14542 	 * by making sure that the first BROADCAST ire (which will be
14543 	 * the one returned by ire_ctable_lookup for ip_rput and the
14544 	 * one that will be used in ip_wput_ire) will be the one that
14545 	 * will not have IRE_MARK_NORECV set.
14546 	 *
14547 	 * 1) ip_rput checks and discards packets received on ires marked
14548 	 *    with IRE_MARK_NORECV. Thus, we don't send up duplicate
14549 	 *    broadcast packets. We need to clear IRE_MARK_NORECV on the
14550 	 *    first ire in the group for every broadcast address in the group.
14551 	 *    ip_rput will accept packets only on the first ire i.e only
14552 	 *    one copy of the ill.
14553 	 *
14554 	 * 2) ip_wput_ire needs to send out just one copy of the broadcast
14555 	 *    packet for the whole group. It needs to send out on the ill
14556 	 *    whose ire has not been marked with IRE_MARK_NORECV. If it sends
14557 	 *    on the one marked with IRE_MARK_NORECV, ip_rput will accept
14558 	 *    the copy echoed back on other port where the ire is not marked
14559 	 *    with IRE_MARK_NORECV.
14560 	 *
14561 	 * Note that we just need to have the first IRE either loopback or
14562 	 * non-loopback (either of them may not exist if ire_create failed
14563 	 * during ipif_down) with IRE_MARK_NORECV not set. ip_rput will
14564 	 * always hit the first one and hence will always accept one copy.
14565 	 *
14566 	 * We have a broadcast ire per ill for all the unique prefixes
14567 	 * hosted on that ill. As we don't have a way of knowing the
14568 	 * unique prefixes on a given ill and hence in the whole group,
14569 	 * we just call ill_mark_bcast on all the prefixes that exist
14570 	 * in the group. For the common case of one prefix, the code
14571 	 * below optimizes by remebering the last address used for
14572 	 * markng. In the case of multiple prefixes, this will still
14573 	 * optimize depending the order of prefixes.
14574 	 *
14575 	 * The only unique address across the whole group is 0.0.0.0 and
14576 	 * 255.255.255.255 and thus we call only once. ill_mark_bcast enables
14577 	 * the first ire in the bucket for receiving and disables the
14578 	 * others.
14579 	 */
14580 	ill_mark_bcast(illgrp, 0);
14581 	ill_mark_bcast(illgrp, INADDR_BROADCAST);
14582 	for (; ill != NULL; ill = ill->ill_group_next) {
14583 
14584 		for (ipif = ill->ill_ipif; ipif != NULL;
14585 		    ipif = ipif->ipif_next) {
14586 
14587 			if (!(ipif->ipif_flags & IPIF_UP) ||
14588 			    ipif->ipif_subnet == 0) {
14589 				continue;
14590 			}
14591 			if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14592 			    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14593 				net_mask = ip_net_mask(ipif->ipif_lcl_addr);
14594 			} else {
14595 				net_mask = htonl(IN_CLASSA_NET);
14596 			}
14597 			addr = net_mask & ipif->ipif_subnet;
14598 			if (prev_net_addr == 0 || prev_net_addr != addr) {
14599 				ill_mark_bcast(illgrp, addr);
14600 				net_addr = ~net_mask | addr;
14601 				ill_mark_bcast(illgrp, net_addr);
14602 			}
14603 			prev_net_addr = addr;
14604 
14605 			subnet_netmask = ipif->ipif_net_mask;
14606 			addr = ipif->ipif_subnet;
14607 			if (prev_subnet_addr == 0 ||
14608 			    prev_subnet_addr != addr) {
14609 				ill_mark_bcast(illgrp, addr);
14610 				subnet_addr = ~subnet_netmask | addr;
14611 				ill_mark_bcast(illgrp, subnet_addr);
14612 			}
14613 			prev_subnet_addr = addr;
14614 		}
14615 	}
14616 }
14617 
14618 /*
14619  * This function is called while forming ill groups.
14620  *
14621  * Currently, we handle only allmulti groups. We want to join
14622  * allmulti on only one of the ills in the groups. In future,
14623  * when we have link aggregation, we may have to join normal
14624  * multicast groups on multiple ills as switch does inbound load
14625  * balancing. Following are the functions that calls this
14626  * function :
14627  *
14628  * 1) ill_recover_multicast : Interface is coming back UP.
14629  *    When the first ipif comes back UP, ipif_up_done/ipif_up_done_v6
14630  *    will call ill_recover_multicast to recover all the multicast
14631  *    groups. We need to make sure that only one member is joined
14632  *    in the ill group.
14633  *
14634  * 2) ip_addmulti/ip_addmulti_v6 : ill groups has already been formed.
14635  *    Somebody is joining allmulti. We need to make sure that only one
14636  *    member is joined in the group.
14637  *
14638  * 3) illgrp_insert : If allmulti has already joined, we need to make
14639  *    sure that only one member is joined in the group.
14640  *
14641  * 4) ip_delmulti/ip_delmulti_v6 : Somebody in the group is leaving
14642  *    allmulti who we have nominated. We need to pick someother ill.
14643  *
14644  * 5) illgrp_delete : The ill we nominated is leaving the group,
14645  *    we need to pick a new ill to join the group.
14646  *
14647  * For (1), (2), (5) - we just have to check whether there is
14648  * a good ill joined in the group. If we could not find any ills
14649  * joined the group, we should join.
14650  *
14651  * For (4), the one that was nominated to receive, left the group.
14652  * There could be nobody joined in the group when this function is
14653  * called.
14654  *
14655  * For (3) - we need to explicitly check whether there are multiple
14656  * ills joined in the group.
14657  *
14658  * For simplicity, we don't differentiate any of the above cases. We
14659  * just leave the group if it is joined on any of them and join on
14660  * the first good ill.
14661  */
14662 int
14663 ill_nominate_mcast_rcv(ill_group_t *illgrp)
14664 {
14665 	ilm_t *ilm;
14666 	ill_t *ill;
14667 	ill_t *fallback_inactive_ill = NULL;
14668 	ill_t *fallback_failed_ill = NULL;
14669 	int ret = 0;
14670 
14671 	/*
14672 	 * Leave the allmulti on all the ills and start fresh.
14673 	 */
14674 	for (ill = illgrp->illgrp_ill; ill != NULL;
14675 	    ill = ill->ill_group_next) {
14676 		if (ill->ill_join_allmulti)
14677 			(void) ip_leave_allmulti(ill->ill_ipif);
14678 	}
14679 
14680 	/*
14681 	 * Choose a good ill. Fallback to inactive or failed if
14682 	 * none available. We need to fallback to FAILED in the
14683 	 * case where we have 2 interfaces in a group - where
14684 	 * one of them is failed and another is a good one and
14685 	 * the good one (not marked inactive) is leaving the group.
14686 	 */
14687 	ret = 0;
14688 	for (ill = illgrp->illgrp_ill; ill != NULL;
14689 	    ill = ill->ill_group_next) {
14690 		/* Never pick an offline interface */
14691 		if (ill->ill_phyint->phyint_flags & PHYI_OFFLINE)
14692 			continue;
14693 
14694 		if (ill->ill_phyint->phyint_flags & PHYI_FAILED) {
14695 			fallback_failed_ill = ill;
14696 			continue;
14697 		}
14698 		if (ill->ill_phyint->phyint_flags & PHYI_INACTIVE) {
14699 			fallback_inactive_ill = ill;
14700 			continue;
14701 		}
14702 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
14703 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
14704 				ret = ip_join_allmulti(ill->ill_ipif);
14705 				/*
14706 				 * ip_join_allmulti can fail because of memory
14707 				 * failures. So, make sure we join at least
14708 				 * on one ill.
14709 				 */
14710 				if (ill->ill_join_allmulti)
14711 					return (0);
14712 			}
14713 		}
14714 	}
14715 	if (ret != 0) {
14716 		/*
14717 		 * If we tried nominating above and failed to do so,
14718 		 * return error. We might have tried multiple times.
14719 		 * But, return the latest error.
14720 		 */
14721 		return (ret);
14722 	}
14723 	if ((ill = fallback_inactive_ill) != NULL) {
14724 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
14725 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
14726 				ret = ip_join_allmulti(ill->ill_ipif);
14727 				return (ret);
14728 			}
14729 		}
14730 	} else if ((ill = fallback_failed_ill) != NULL) {
14731 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
14732 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
14733 				ret = ip_join_allmulti(ill->ill_ipif);
14734 				return (ret);
14735 			}
14736 		}
14737 	}
14738 	return (0);
14739 }
14740 
14741 /*
14742  * This function is called from illgrp_delete after it is
14743  * deleted from the group to reschedule responsibilities
14744  * to a different ill.
14745  */
14746 static void
14747 ill_handoff_responsibility(ill_t *ill, ill_group_t *illgrp)
14748 {
14749 	ilm_t	*ilm;
14750 	ipif_t	*ipif;
14751 	ipaddr_t subnet_addr;
14752 	ipaddr_t net_addr;
14753 	ipaddr_t net_mask = 0;
14754 	ipaddr_t subnet_netmask;
14755 	ipaddr_t addr;
14756 
14757 	ASSERT(ill->ill_group == NULL);
14758 	/*
14759 	 * Broadcast Responsibility:
14760 	 *
14761 	 * 1. If this ill has been nominated for receiving broadcast
14762 	 * packets, we need to find a new one. Before we find a new
14763 	 * one, we need to re-group the ires that are part of this new
14764 	 * group (assumed by ill_nominate_bcast_rcv). We do this by
14765 	 * calling ill_group_bcast_for_xmit(ill) which will do the right
14766 	 * thing for us.
14767 	 *
14768 	 * 2. If this ill was not nominated for receiving broadcast
14769 	 * packets, we need to clear the IRE_MARK_NORECV flag
14770 	 * so that we continue to send up broadcast packets.
14771 	 */
14772 	if (!ill->ill_isv6) {
14773 		/*
14774 		 * Case 1 above : No optimization here. Just redo the
14775 		 * nomination.
14776 		 */
14777 		ill_group_bcast_for_xmit(ill);
14778 		ill_nominate_bcast_rcv(illgrp);
14779 
14780 		/*
14781 		 * Case 2 above : Lookup and clear IRE_MARK_NORECV.
14782 		 */
14783 		ill_clear_bcast_mark(ill, 0);
14784 		ill_clear_bcast_mark(ill, INADDR_BROADCAST);
14785 
14786 		for (ipif = ill->ill_ipif; ipif != NULL;
14787 		    ipif = ipif->ipif_next) {
14788 
14789 			if (!(ipif->ipif_flags & IPIF_UP) ||
14790 			    ipif->ipif_subnet == 0) {
14791 				continue;
14792 			}
14793 			if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14794 			    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14795 				net_mask = ip_net_mask(ipif->ipif_lcl_addr);
14796 			} else {
14797 				net_mask = htonl(IN_CLASSA_NET);
14798 			}
14799 			addr = net_mask & ipif->ipif_subnet;
14800 			ill_clear_bcast_mark(ill, addr);
14801 
14802 			net_addr = ~net_mask | addr;
14803 			ill_clear_bcast_mark(ill, net_addr);
14804 
14805 			subnet_netmask = ipif->ipif_net_mask;
14806 			addr = ipif->ipif_subnet;
14807 			ill_clear_bcast_mark(ill, addr);
14808 
14809 			subnet_addr = ~subnet_netmask | addr;
14810 			ill_clear_bcast_mark(ill, subnet_addr);
14811 		}
14812 	}
14813 
14814 	/*
14815 	 * Multicast Responsibility.
14816 	 *
14817 	 * If we have joined allmulti on this one, find a new member
14818 	 * in the group to join allmulti. As this ill is already part
14819 	 * of allmulti, we don't have to join on this one.
14820 	 *
14821 	 * If we have not joined allmulti on this one, there is no
14822 	 * responsibility to handoff. But we need to take new
14823 	 * responsibility i.e, join allmulti on this one if we need
14824 	 * to.
14825 	 */
14826 	if (ill->ill_join_allmulti) {
14827 		(void) ill_nominate_mcast_rcv(illgrp);
14828 	} else {
14829 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
14830 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
14831 				(void) ip_join_allmulti(ill->ill_ipif);
14832 				break;
14833 			}
14834 		}
14835 	}
14836 
14837 	/*
14838 	 * We intentionally do the flushing of IRE_CACHES only matching
14839 	 * on the ill and not on groups. Note that we are already deleted
14840 	 * from the group.
14841 	 *
14842 	 * This will make sure that all IRE_CACHES whose stq is pointing
14843 	 * at ill_wq or ire_ipif->ipif_ill pointing at this ill will get
14844 	 * deleted and IRE_CACHES that are not pointing at this ill will
14845 	 * be left alone.
14846 	 */
14847 	if (ill->ill_isv6) {
14848 		ire_walk_ill_v6(MATCH_IRE_ILL | MATCH_IRE_TYPE,
14849 		    IRE_CACHE, illgrp_cache_delete, (char *)ill, ill);
14850 	} else {
14851 		ire_walk_ill_v4(MATCH_IRE_ILL | MATCH_IRE_TYPE,
14852 		    IRE_CACHE, illgrp_cache_delete, (char *)ill, ill);
14853 	}
14854 
14855 	/*
14856 	 * Some conn may have cached one of the IREs deleted above. By removing
14857 	 * the ire reference, we clean up the extra reference to the ill held in
14858 	 * ire->ire_stq.
14859 	 */
14860 	ipcl_walk(conn_cleanup_stale_ire, NULL);
14861 
14862 	/*
14863 	 * Re-do source address selection for all the members in the
14864 	 * group, if they borrowed source address from one of the ipifs
14865 	 * in this ill.
14866 	 */
14867 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
14868 		if (ill->ill_isv6) {
14869 			ipif_update_other_ipifs_v6(ipif, illgrp);
14870 		} else {
14871 			ipif_update_other_ipifs(ipif, illgrp);
14872 		}
14873 	}
14874 }
14875 
14876 /*
14877  * Delete the ill from the group. The caller makes sure that it is
14878  * in a group and it okay to delete from the group. So, we always
14879  * delete here.
14880  */
14881 static void
14882 illgrp_delete(ill_t *ill)
14883 {
14884 	ill_group_t *illgrp;
14885 	ill_group_t *tmpg;
14886 	ill_t *tmp_ill;
14887 
14888 	/*
14889 	 * Reset illgrp_ill_schednext if it was pointing at us.
14890 	 * We need to do this before we set ill_group to NULL.
14891 	 */
14892 	rw_enter(&ill_g_lock, RW_WRITER);
14893 	mutex_enter(&ill->ill_lock);
14894 
14895 	illgrp_reset_schednext(ill);
14896 
14897 	illgrp = ill->ill_group;
14898 
14899 	/* Delete the ill from illgrp. */
14900 	if (illgrp->illgrp_ill == ill) {
14901 		illgrp->illgrp_ill = ill->ill_group_next;
14902 	} else {
14903 		tmp_ill = illgrp->illgrp_ill;
14904 		while (tmp_ill->ill_group_next != ill) {
14905 			tmp_ill = tmp_ill->ill_group_next;
14906 			ASSERT(tmp_ill != NULL);
14907 		}
14908 		tmp_ill->ill_group_next = ill->ill_group_next;
14909 	}
14910 	ill->ill_group = NULL;
14911 	ill->ill_group_next = NULL;
14912 
14913 	illgrp->illgrp_ill_count--;
14914 	mutex_exit(&ill->ill_lock);
14915 	rw_exit(&ill_g_lock);
14916 
14917 	/*
14918 	 * As this ill is leaving the group, we need to hand off
14919 	 * the responsibilities to the other ills in the group, if
14920 	 * this ill had some responsibilities.
14921 	 */
14922 
14923 	ill_handoff_responsibility(ill, illgrp);
14924 
14925 	rw_enter(&ill_g_lock, RW_WRITER);
14926 
14927 	if (illgrp->illgrp_ill_count == 0) {
14928 
14929 		ASSERT(illgrp->illgrp_ill == NULL);
14930 		if (ill->ill_isv6) {
14931 			if (illgrp == illgrp_head_v6) {
14932 				illgrp_head_v6 = illgrp->illgrp_next;
14933 			} else {
14934 				tmpg = illgrp_head_v6;
14935 				while (tmpg->illgrp_next != illgrp) {
14936 					tmpg = tmpg->illgrp_next;
14937 					ASSERT(tmpg != NULL);
14938 				}
14939 				tmpg->illgrp_next = illgrp->illgrp_next;
14940 			}
14941 		} else {
14942 			if (illgrp == illgrp_head_v4) {
14943 				illgrp_head_v4 = illgrp->illgrp_next;
14944 			} else {
14945 				tmpg = illgrp_head_v4;
14946 				while (tmpg->illgrp_next != illgrp) {
14947 					tmpg = tmpg->illgrp_next;
14948 					ASSERT(tmpg != NULL);
14949 				}
14950 				tmpg->illgrp_next = illgrp->illgrp_next;
14951 			}
14952 		}
14953 		mutex_destroy(&illgrp->illgrp_lock);
14954 		mi_free(illgrp);
14955 	}
14956 	rw_exit(&ill_g_lock);
14957 
14958 	/*
14959 	 * Even though the ill is out of the group its not necessary
14960 	 * to set ipsq_split as TRUE as the ipifs could be down temporarily
14961 	 * We will split the ipsq when phyint_groupname is set to NULL.
14962 	 */
14963 
14964 	/*
14965 	 * Send a routing sockets message if we are deleting from
14966 	 * groups with names.
14967 	 */
14968 	if (ill->ill_phyint->phyint_groupname_len != 0)
14969 		ip_rts_ifmsg(ill->ill_ipif);
14970 }
14971 
14972 /*
14973  * Re-do source address selection. This is normally called when
14974  * an ill joins the group or when a non-NOLOCAL/DEPRECATED/ANYCAST
14975  * ipif comes up.
14976  */
14977 void
14978 ill_update_source_selection(ill_t *ill)
14979 {
14980 	ipif_t *ipif;
14981 
14982 	ASSERT(IAM_WRITER_ILL(ill));
14983 
14984 	if (ill->ill_group != NULL)
14985 		ill = ill->ill_group->illgrp_ill;
14986 
14987 	for (; ill != NULL; ill = ill->ill_group_next) {
14988 		for (ipif = ill->ill_ipif; ipif != NULL;
14989 		    ipif = ipif->ipif_next) {
14990 			if (ill->ill_isv6)
14991 				ipif_recreate_interface_routes_v6(NULL, ipif);
14992 			else
14993 				ipif_recreate_interface_routes(NULL, ipif);
14994 		}
14995 	}
14996 }
14997 
14998 /*
14999  * Insert ill in a group headed by illgrp_head. The caller can either
15000  * pass a groupname in which case we search for a group with the
15001  * same name to insert in or pass a group to insert in. This function
15002  * would only search groups with names.
15003  *
15004  * NOTE : The caller should make sure that there is at least one ipif
15005  *	  UP on this ill so that illgrp_scheduler can pick this ill
15006  *	  for outbound packets. If ill_ipif_up_count is zero, we have
15007  *	  already sent a DL_UNBIND to the driver and we don't want to
15008  *	  send anymore packets. We don't assert for ipif_up_count
15009  *	  to be greater than zero, because ipif_up_done wants to call
15010  *	  this function before bumping up the ipif_up_count. See
15011  *	  ipif_up_done() for details.
15012  */
15013 int
15014 illgrp_insert(ill_group_t **illgrp_head, ill_t *ill, char *groupname,
15015     ill_group_t *grp_to_insert, boolean_t ipif_is_coming_up)
15016 {
15017 	ill_group_t *illgrp;
15018 	ill_t *prev_ill;
15019 	phyint_t *phyi;
15020 
15021 	ASSERT(ill->ill_group == NULL);
15022 
15023 	rw_enter(&ill_g_lock, RW_WRITER);
15024 	mutex_enter(&ill->ill_lock);
15025 
15026 	if (groupname != NULL) {
15027 		/*
15028 		 * Look for a group with a matching groupname to insert.
15029 		 */
15030 		for (illgrp = *illgrp_head; illgrp != NULL;
15031 		    illgrp = illgrp->illgrp_next) {
15032 
15033 			ill_t *tmp_ill;
15034 
15035 			tmp_ill = illgrp->illgrp_ill;
15036 			ASSERT(tmp_ill != NULL && tmp_ill->ill_phyint != NULL);
15037 			phyi = tmp_ill->ill_phyint;
15038 			/*
15039 			 * Look at groups which has names only.
15040 			 */
15041 			if (phyi->phyint_groupname_len == 0)
15042 				continue;
15043 			/*
15044 			 * Names are stored in the phyint common to both
15045 			 * IPv4 and IPv6.
15046 			 */
15047 			if (mi_strcmp(phyi->phyint_groupname,
15048 			    groupname) == 0) {
15049 				break;
15050 			}
15051 		}
15052 	} else {
15053 		/*
15054 		 * If the caller passes in a NULL "grp_to_insert", we
15055 		 * allocate one below and insert this singleton.
15056 		 */
15057 		illgrp = grp_to_insert;
15058 	}
15059 
15060 	ill->ill_group_next = NULL;
15061 
15062 	if (illgrp == NULL) {
15063 		illgrp = (ill_group_t *)mi_zalloc(sizeof (ill_group_t));
15064 		if (illgrp == NULL) {
15065 			return (ENOMEM);
15066 		}
15067 		illgrp->illgrp_next = *illgrp_head;
15068 		*illgrp_head = illgrp;
15069 		illgrp->illgrp_ill = ill;
15070 		illgrp->illgrp_ill_count = 1;
15071 		ill->ill_group = illgrp;
15072 		/*
15073 		 * Used in illgrp_scheduler to protect multiple threads
15074 		 * from traversing the list.
15075 		 */
15076 		mutex_init(&illgrp->illgrp_lock, NULL, MUTEX_DEFAULT, 0);
15077 	} else {
15078 		ASSERT(ill->ill_net_type ==
15079 		    illgrp->illgrp_ill->ill_net_type);
15080 		ASSERT(ill->ill_type == illgrp->illgrp_ill->ill_type);
15081 
15082 		/* Insert ill at tail of this group */
15083 		prev_ill = illgrp->illgrp_ill;
15084 		while (prev_ill->ill_group_next != NULL)
15085 			prev_ill = prev_ill->ill_group_next;
15086 		prev_ill->ill_group_next = ill;
15087 		ill->ill_group = illgrp;
15088 		illgrp->illgrp_ill_count++;
15089 		/*
15090 		 * Inherit group properties. Currently only forwarding
15091 		 * is the property we try to keep the same with all the
15092 		 * ills. When there are more, we will abstract this into
15093 		 * a function.
15094 		 */
15095 		ill->ill_flags &= ~ILLF_ROUTER;
15096 		ill->ill_flags |= (illgrp->illgrp_ill->ill_flags & ILLF_ROUTER);
15097 	}
15098 	mutex_exit(&ill->ill_lock);
15099 	rw_exit(&ill_g_lock);
15100 
15101 	/*
15102 	 * 1) When ipif_up_done() calls this function, ipif_up_count
15103 	 *    may be zero as it has not yet been bumped. But the ires
15104 	 *    have already been added. So, we do the nomination here
15105 	 *    itself. But, when ip_sioctl_groupname calls this, it checks
15106 	 *    for ill_ipif_up_count != 0. Thus we don't check for
15107 	 *    ill_ipif_up_count here while nominating broadcast ires for
15108 	 *    receive.
15109 	 *
15110 	 * 2) Similarly, we need to call ill_group_bcast_for_xmit here
15111 	 *    to group them properly as ire_add() has already happened
15112 	 *    in the ipif_up_done() case. For ip_sioctl_groupname/ifgrp_insert
15113 	 *    case, we need to do it here anyway.
15114 	 */
15115 	if (!ill->ill_isv6) {
15116 		ill_group_bcast_for_xmit(ill);
15117 		ill_nominate_bcast_rcv(illgrp);
15118 	}
15119 
15120 	if (!ipif_is_coming_up) {
15121 		/*
15122 		 * When ipif_up_done() calls this function, the multicast
15123 		 * groups have not been joined yet. So, there is no point in
15124 		 * nomination. ip_join_allmulti will handle groups when
15125 		 * ill_recover_multicast is called from ipif_up_done() later.
15126 		 */
15127 		(void) ill_nominate_mcast_rcv(illgrp);
15128 		/*
15129 		 * ipif_up_done calls ill_update_source_selection
15130 		 * anyway. Moreover, we don't want to re-create
15131 		 * interface routes while ipif_up_done() still has reference
15132 		 * to them. Refer to ipif_up_done() for more details.
15133 		 */
15134 		ill_update_source_selection(ill);
15135 	}
15136 
15137 	/*
15138 	 * Send a routing sockets message if we are inserting into
15139 	 * groups with names.
15140 	 */
15141 	if (groupname != NULL)
15142 		ip_rts_ifmsg(ill->ill_ipif);
15143 	return (0);
15144 }
15145 
15146 /*
15147  * Return the first phyint matching the groupname. There could
15148  * be more than one when there are ill groups.
15149  *
15150  * Needs work: called only from ip_sioctl_groupname
15151  */
15152 static phyint_t *
15153 phyint_lookup_group(char *groupname)
15154 {
15155 	phyint_t *phyi;
15156 
15157 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
15158 	/*
15159 	 * Group names are stored in the phyint - a common structure
15160 	 * to both IPv4 and IPv6.
15161 	 */
15162 	phyi = avl_first(&phyint_g_list.phyint_list_avl_by_index);
15163 	for (; phyi != NULL;
15164 	    phyi = avl_walk(&phyint_g_list.phyint_list_avl_by_index,
15165 	    phyi, AVL_AFTER)) {
15166 		if (phyi->phyint_groupname_len == 0)
15167 			continue;
15168 		ASSERT(phyi->phyint_groupname != NULL);
15169 		if (mi_strcmp(groupname, phyi->phyint_groupname) == 0)
15170 			return (phyi);
15171 	}
15172 	return (NULL);
15173 }
15174 
15175 
15176 
15177 /*
15178  * MT notes on creation and deletion of IPMP groups
15179  *
15180  * Creation and deletion of IPMP groups introduce the need to merge or
15181  * split the associated serialization objects i.e the ipsq's. Normally all
15182  * the ills in an IPMP group would map to a single ipsq. If IPMP is not enabled
15183  * an ill-pair(v4, v6) i.e. phyint would map to a single ipsq. However during
15184  * the execution of the SIOCSLIFGROUPNAME command the picture changes. There
15185  * is a need to change the <ill-ipsq> association and we have to operate on both
15186  * the source and destination IPMP groups. For eg. attempting to set the
15187  * groupname of hme0 to mpk17-85 when it already belongs to mpk17-84 has to
15188  * handle 2 IPMP groups and 2 ipsqs. All the ills belonging to either of the
15189  * source or destination IPMP group are mapped to a single ipsq for executing
15190  * the SIOCSLIFGROUPNAME command. This is termed as a merge of the ipsq's.
15191  * The <ill-ipsq> mapping is restored back to normal at a later point. This is
15192  * termed as a split of the ipsq. The converse of the merge i.e. a split of the
15193  * ipsq happens while unwinding from ipsq_exit. If at least 1 set groupname
15194  * occurred on the ipsq, then the ipsq_split flag is set. This indicates the
15195  * ipsq has to be examined for redoing the <ill-ipsq> associations.
15196  *
15197  * In the above example the ioctl handling code locates the current ipsq of hme0
15198  * which is ipsq(mpk17-84). It then enters the above ipsq immediately or
15199  * eventually (after queueing the ioctl in ipsq(mpk17-84)). Then it locates
15200  * the destination ipsq which is ipsq(mpk17-85) and merges the source ipsq into
15201  * the destination ipsq. If the destination ipsq is not busy, it also enters
15202  * the destination ipsq exclusively. Now the actual groupname setting operation
15203  * can proceed. If the destination ipsq is busy, the operation is enqueued
15204  * on the destination (merged) ipsq and will be handled in the unwind from
15205  * ipsq_exit.
15206  *
15207  * To prevent other threads accessing the ill while the group name change is
15208  * in progres, we bring down the ipifs which also removes the ill from the
15209  * group. The group is changed in phyint and when the first ipif on the ill
15210  * is brought up, the ill is inserted into the right IPMP group by
15211  * illgrp_insert.
15212  */
15213 /* ARGSUSED */
15214 int
15215 ip_sioctl_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15216     ip_ioctl_cmd_t *ipip, void *ifreq)
15217 {
15218 	int i;
15219 	char *tmp;
15220 	int namelen;
15221 	ill_t *ill = ipif->ipif_ill;
15222 	ill_t *ill_v4, *ill_v6;
15223 	int err = 0;
15224 	phyint_t *phyi;
15225 	phyint_t *phyi_tmp;
15226 	struct lifreq *lifr;
15227 	mblk_t	*mp1;
15228 	char *groupname;
15229 	ipsq_t *ipsq;
15230 
15231 	ASSERT(IAM_WRITER_IPIF(ipif));
15232 
15233 	/* Existance verified in ip_wput_nondata */
15234 	mp1 = mp->b_cont->b_cont;
15235 	lifr = (struct lifreq *)mp1->b_rptr;
15236 	groupname = lifr->lifr_groupname;
15237 
15238 	if (ipif->ipif_id != 0)
15239 		return (EINVAL);
15240 
15241 	phyi = ill->ill_phyint;
15242 	ASSERT(phyi != NULL);
15243 
15244 	if (phyi->phyint_flags & PHYI_VIRTUAL)
15245 		return (EINVAL);
15246 
15247 	tmp = groupname;
15248 	for (i = 0; i < LIFNAMSIZ && *tmp != '\0'; tmp++, i++)
15249 		;
15250 
15251 	if (i == LIFNAMSIZ) {
15252 		/* no null termination */
15253 		return (EINVAL);
15254 	}
15255 
15256 	/*
15257 	 * Calculate the namelen exclusive of the null
15258 	 * termination character.
15259 	 */
15260 	namelen = tmp - groupname;
15261 
15262 	ill_v4 = phyi->phyint_illv4;
15263 	ill_v6 = phyi->phyint_illv6;
15264 
15265 	/*
15266 	 * ILL cannot be part of a usesrc group and and IPMP group at the
15267 	 * same time. No need to grab the ill_g_usesrc_lock here, see
15268 	 * synchronization notes in ip.c
15269 	 */
15270 	if (ipif->ipif_ill->ill_usesrc_grp_next != NULL) {
15271 		return (EINVAL);
15272 	}
15273 
15274 	/*
15275 	 * mark the ill as changing.
15276 	 * this should queue all new requests on the syncq.
15277 	 */
15278 	GRAB_ILL_LOCKS(ill_v4, ill_v6);
15279 
15280 	if (ill_v4 != NULL)
15281 		ill_v4->ill_state_flags |= ILL_CHANGING;
15282 	if (ill_v6 != NULL)
15283 		ill_v6->ill_state_flags |= ILL_CHANGING;
15284 	RELEASE_ILL_LOCKS(ill_v4, ill_v6);
15285 
15286 	if (namelen == 0) {
15287 		/*
15288 		 * Null string means remove this interface from the
15289 		 * existing group.
15290 		 */
15291 		if (phyi->phyint_groupname_len == 0) {
15292 			/*
15293 			 * Never was in a group.
15294 			 */
15295 			err = 0;
15296 			goto done;
15297 		}
15298 
15299 		/*
15300 		 * IPv4 or IPv6 may be temporarily out of the group when all
15301 		 * the ipifs are down. Thus, we need to check for ill_group to
15302 		 * be non-NULL.
15303 		 */
15304 		if (ill_v4 != NULL && ill_v4->ill_group != NULL) {
15305 			ill_down_ipifs(ill_v4, mp, 0, B_FALSE);
15306 			mutex_enter(&ill_v4->ill_lock);
15307 			if (!ill_is_quiescent(ill_v4)) {
15308 				/*
15309 				 * ipsq_pending_mp_add will not fail since
15310 				 * connp is NULL
15311 				 */
15312 				(void) ipsq_pending_mp_add(NULL,
15313 				    ill_v4->ill_ipif, q, mp, ILL_DOWN);
15314 				mutex_exit(&ill_v4->ill_lock);
15315 				err = EINPROGRESS;
15316 				goto done;
15317 			}
15318 			mutex_exit(&ill_v4->ill_lock);
15319 		}
15320 
15321 		if (ill_v6 != NULL && ill_v6->ill_group != NULL) {
15322 			ill_down_ipifs(ill_v6, mp, 0, B_FALSE);
15323 			mutex_enter(&ill_v6->ill_lock);
15324 			if (!ill_is_quiescent(ill_v6)) {
15325 				(void) ipsq_pending_mp_add(NULL,
15326 				    ill_v6->ill_ipif, q, mp, ILL_DOWN);
15327 				mutex_exit(&ill_v6->ill_lock);
15328 				err = EINPROGRESS;
15329 				goto done;
15330 			}
15331 			mutex_exit(&ill_v6->ill_lock);
15332 		}
15333 
15334 		rw_enter(&ill_g_lock, RW_WRITER);
15335 		GRAB_ILL_LOCKS(ill_v4, ill_v6);
15336 		mutex_enter(&phyi->phyint_lock);
15337 		ASSERT(phyi->phyint_groupname != NULL);
15338 		mi_free(phyi->phyint_groupname);
15339 		phyi->phyint_groupname = NULL;
15340 		phyi->phyint_groupname_len = 0;
15341 		mutex_exit(&phyi->phyint_lock);
15342 		RELEASE_ILL_LOCKS(ill_v4, ill_v6);
15343 		rw_exit(&ill_g_lock);
15344 		err = ill_up_ipifs(ill, q, mp);
15345 
15346 		/*
15347 		 * set the split flag so that the ipsq can be split
15348 		 */
15349 		mutex_enter(&phyi->phyint_ipsq->ipsq_lock);
15350 		phyi->phyint_ipsq->ipsq_split = B_TRUE;
15351 		mutex_exit(&phyi->phyint_ipsq->ipsq_lock);
15352 
15353 	} else {
15354 		if (phyi->phyint_groupname_len != 0) {
15355 			ASSERT(phyi->phyint_groupname != NULL);
15356 			/* Are we inserting in the same group ? */
15357 			if (mi_strcmp(groupname,
15358 			    phyi->phyint_groupname) == 0) {
15359 				err = 0;
15360 				goto done;
15361 			}
15362 		}
15363 
15364 		rw_enter(&ill_g_lock, RW_READER);
15365 		/*
15366 		 * Merge ipsq for the group's.
15367 		 * This check is here as multiple groups/ills might be
15368 		 * sharing the same ipsq.
15369 		 * If we have to merege than the operation is restarted
15370 		 * on the new ipsq.
15371 		 */
15372 		ipsq = ip_ipsq_lookup(groupname, B_FALSE, NULL);
15373 		if (phyi->phyint_ipsq != ipsq) {
15374 			rw_exit(&ill_g_lock);
15375 			err = ill_merge_groups(ill, NULL, groupname, mp, q);
15376 			goto done;
15377 		}
15378 		/*
15379 		 * Running exclusive on new ipsq.
15380 		 */
15381 
15382 		ASSERT(ipsq != NULL);
15383 		ASSERT(ipsq->ipsq_writer == curthread);
15384 
15385 		/*
15386 		 * Check whether the ill_type and ill_net_type matches before
15387 		 * we allocate any memory so that the cleanup is easier.
15388 		 *
15389 		 * We can't group dissimilar ones as we can't load spread
15390 		 * packets across the group because of potential link-level
15391 		 * header differences.
15392 		 */
15393 		phyi_tmp = phyint_lookup_group(groupname);
15394 		if (phyi_tmp != NULL) {
15395 			if ((ill_v4 != NULL &&
15396 			    phyi_tmp->phyint_illv4 != NULL) &&
15397 			    ((ill_v4->ill_net_type !=
15398 			    phyi_tmp->phyint_illv4->ill_net_type) ||
15399 			    (ill_v4->ill_type !=
15400 			    phyi_tmp->phyint_illv4->ill_type))) {
15401 				mutex_enter(&phyi->phyint_ipsq->ipsq_lock);
15402 				phyi->phyint_ipsq->ipsq_split = B_TRUE;
15403 				mutex_exit(&phyi->phyint_ipsq->ipsq_lock);
15404 				rw_exit(&ill_g_lock);
15405 				return (EINVAL);
15406 			}
15407 			if ((ill_v6 != NULL &&
15408 			    phyi_tmp->phyint_illv6 != NULL) &&
15409 			    ((ill_v6->ill_net_type !=
15410 			    phyi_tmp->phyint_illv6->ill_net_type) ||
15411 			    (ill_v6->ill_type !=
15412 			    phyi_tmp->phyint_illv6->ill_type))) {
15413 				mutex_enter(&phyi->phyint_ipsq->ipsq_lock);
15414 				phyi->phyint_ipsq->ipsq_split = B_TRUE;
15415 				mutex_exit(&phyi->phyint_ipsq->ipsq_lock);
15416 				rw_exit(&ill_g_lock);
15417 				return (EINVAL);
15418 			}
15419 		}
15420 
15421 		rw_exit(&ill_g_lock);
15422 
15423 		/*
15424 		 * bring down all v4 ipifs.
15425 		 */
15426 		if (ill_v4 != NULL) {
15427 			ill_down_ipifs(ill_v4, mp, 0, B_FALSE);
15428 		}
15429 
15430 		/*
15431 		 * bring down all v6 ipifs.
15432 		 */
15433 		if (ill_v6 != NULL) {
15434 			ill_down_ipifs(ill_v6, mp, 0, B_FALSE);
15435 		}
15436 
15437 		/*
15438 		 * make sure all ipifs are down and there are no active
15439 		 * references. Call to ipsq_pending_mp_add will not fail
15440 		 * since connp is NULL.
15441 		 */
15442 		if (ill_v4 != NULL) {
15443 			mutex_enter(&ill_v4->ill_lock);
15444 			if (!ill_is_quiescent(ill_v4)) {
15445 				(void) ipsq_pending_mp_add(NULL,
15446 				    ill_v4->ill_ipif, q, mp, ILL_DOWN);
15447 				mutex_exit(&ill_v4->ill_lock);
15448 				err = EINPROGRESS;
15449 				goto done;
15450 			}
15451 			mutex_exit(&ill_v4->ill_lock);
15452 		}
15453 
15454 		if (ill_v6 != NULL) {
15455 			mutex_enter(&ill_v6->ill_lock);
15456 			if (!ill_is_quiescent(ill_v6)) {
15457 				(void) ipsq_pending_mp_add(NULL,
15458 				    ill_v6->ill_ipif, q, mp, ILL_DOWN);
15459 				mutex_exit(&ill_v6->ill_lock);
15460 				err = EINPROGRESS;
15461 				goto done;
15462 			}
15463 			mutex_exit(&ill_v6->ill_lock);
15464 		}
15465 
15466 		/*
15467 		 * allocate including space for null terminator
15468 		 * before we insert.
15469 		 */
15470 		tmp = (char *)mi_alloc(namelen + 1, BPRI_MED);
15471 		if (tmp == NULL)
15472 			return (ENOMEM);
15473 
15474 		rw_enter(&ill_g_lock, RW_WRITER);
15475 		GRAB_ILL_LOCKS(ill_v4, ill_v6);
15476 		mutex_enter(&phyi->phyint_lock);
15477 		if (phyi->phyint_groupname_len != 0) {
15478 			ASSERT(phyi->phyint_groupname != NULL);
15479 			mi_free(phyi->phyint_groupname);
15480 		}
15481 
15482 		/*
15483 		 * setup the new group name.
15484 		 */
15485 		phyi->phyint_groupname = tmp;
15486 		bcopy(groupname, phyi->phyint_groupname, namelen + 1);
15487 		phyi->phyint_groupname_len = namelen + 1;
15488 		mutex_exit(&phyi->phyint_lock);
15489 		RELEASE_ILL_LOCKS(ill_v4, ill_v6);
15490 		rw_exit(&ill_g_lock);
15491 
15492 		err = ill_up_ipifs(ill, q, mp);
15493 	}
15494 
15495 done:
15496 	/*
15497 	 *  normally ILL_CHANGING is cleared in ill_up_ipifs.
15498 	 */
15499 	if (err != EINPROGRESS) {
15500 		GRAB_ILL_LOCKS(ill_v4, ill_v6);
15501 		if (ill_v4 != NULL)
15502 			ill_v4->ill_state_flags &= ~ILL_CHANGING;
15503 		if (ill_v6 != NULL)
15504 			ill_v6->ill_state_flags &= ~ILL_CHANGING;
15505 		RELEASE_ILL_LOCKS(ill_v4, ill_v6);
15506 	}
15507 	return (err);
15508 }
15509 
15510 /* ARGSUSED */
15511 int
15512 ip_sioctl_get_groupname(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
15513     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15514 {
15515 	ill_t *ill;
15516 	phyint_t *phyi;
15517 	struct lifreq *lifr;
15518 	mblk_t	*mp1;
15519 
15520 	/* Existence verified in ip_wput_nondata */
15521 	mp1 = mp->b_cont->b_cont;
15522 	lifr = (struct lifreq *)mp1->b_rptr;
15523 	ill = ipif->ipif_ill;
15524 	phyi = ill->ill_phyint;
15525 
15526 	lifr->lifr_groupname[0] = '\0';
15527 	/*
15528 	 * ill_group may be null if all the interfaces
15529 	 * are down. But still, the phyint should always
15530 	 * hold the name.
15531 	 */
15532 	if (phyi->phyint_groupname_len != 0) {
15533 		bcopy(phyi->phyint_groupname, lifr->lifr_groupname,
15534 		    phyi->phyint_groupname_len);
15535 	}
15536 
15537 	return (0);
15538 }
15539 
15540 
15541 typedef struct conn_move_s {
15542 	ill_t	*cm_from_ill;
15543 	ill_t	*cm_to_ill;
15544 	int	cm_ifindex;
15545 } conn_move_t;
15546 
15547 /*
15548  * ipcl_walk function for moving conn_multicast_ill for a given ill.
15549  */
15550 static void
15551 conn_move(conn_t *connp, caddr_t arg)
15552 {
15553 	conn_move_t *connm;
15554 	int ifindex;
15555 	int i;
15556 	ill_t *from_ill;
15557 	ill_t *to_ill;
15558 	ilg_t *ilg;
15559 	ilm_t *ret_ilm;
15560 
15561 	connm = (conn_move_t *)arg;
15562 	ifindex = connm->cm_ifindex;
15563 	from_ill = connm->cm_from_ill;
15564 	to_ill = connm->cm_to_ill;
15565 
15566 	/* Change IP_BOUND_IF/IPV6_BOUND_IF associations. */
15567 
15568 	/* All multicast fields protected by conn_lock */
15569 	mutex_enter(&connp->conn_lock);
15570 	ASSERT(connp->conn_outgoing_ill == connp->conn_incoming_ill);
15571 	if ((connp->conn_outgoing_ill == from_ill) &&
15572 	    (ifindex == 0 || connp->conn_orig_bound_ifindex == ifindex)) {
15573 		connp->conn_outgoing_ill = to_ill;
15574 		connp->conn_incoming_ill = to_ill;
15575 	}
15576 
15577 	/* Change IP_MULTICAST_IF/IPV6_MULTICAST_IF associations */
15578 
15579 	if ((connp->conn_multicast_ill == from_ill) &&
15580 	    (ifindex == 0 || connp->conn_orig_multicast_ifindex == ifindex)) {
15581 		connp->conn_multicast_ill = connm->cm_to_ill;
15582 	}
15583 
15584 	/* Change IP_XMIT_IF associations */
15585 	if ((connp->conn_xmit_if_ill == from_ill) &&
15586 	    (ifindex == 0 || connp->conn_orig_xmit_ifindex == ifindex)) {
15587 		connp->conn_xmit_if_ill = to_ill;
15588 	}
15589 	/*
15590 	 * Change the ilg_ill to point to the new one. This assumes
15591 	 * ilm_move_v6 has moved the ilms to new_ill and the driver
15592 	 * has been told to receive packets on this interface.
15593 	 * ilm_move_v6 FAILBACKS all the ilms successfully always.
15594 	 * But when doing a FAILOVER, it might fail with ENOMEM and so
15595 	 * some ilms may not have moved. We check to see whether
15596 	 * the ilms have moved to to_ill. We can't check on from_ill
15597 	 * as in the process of moving, we could have split an ilm
15598 	 * in to two - which has the same orig_ifindex and v6group.
15599 	 *
15600 	 * For IPv4, ilg_ipif moves implicitly. The code below really
15601 	 * does not do anything for IPv4 as ilg_ill is NULL for IPv4.
15602 	 */
15603 	for (i = connp->conn_ilg_inuse - 1; i >= 0; i--) {
15604 		ilg = &connp->conn_ilg[i];
15605 		if ((ilg->ilg_ill == from_ill) &&
15606 		    (ifindex == 0 || ilg->ilg_orig_ifindex == ifindex)) {
15607 			/* ifindex != 0 indicates failback */
15608 			if (ifindex != 0) {
15609 				connp->conn_ilg[i].ilg_ill = to_ill;
15610 				continue;
15611 			}
15612 
15613 			ret_ilm = ilm_lookup_ill_index_v6(to_ill,
15614 			    &ilg->ilg_v6group, ilg->ilg_orig_ifindex,
15615 			    connp->conn_zoneid);
15616 
15617 			if (ret_ilm != NULL)
15618 				connp->conn_ilg[i].ilg_ill = to_ill;
15619 		}
15620 	}
15621 	mutex_exit(&connp->conn_lock);
15622 }
15623 
15624 static void
15625 conn_move_ill(ill_t *from_ill, ill_t *to_ill, int ifindex)
15626 {
15627 	conn_move_t connm;
15628 
15629 	connm.cm_from_ill = from_ill;
15630 	connm.cm_to_ill = to_ill;
15631 	connm.cm_ifindex = ifindex;
15632 
15633 	ipcl_walk(conn_move, (caddr_t)&connm);
15634 }
15635 
15636 /*
15637  * ilm has been moved from from_ill to to_ill.
15638  * Send DL_DISABMULTI_REQ to ill and DL_ENABMULTI_REQ on to_ill.
15639  * appropriately.
15640  *
15641  * NOTE : We can't reuse the code in ip_ll_addmulti/delmulti because
15642  *	  the code there de-references ipif_ill to get the ill to
15643  *	  send multicast requests. It does not work as ipif is on its
15644  *	  move and already moved when this function is called.
15645  *	  Thus, we need to use from_ill and to_ill send down multicast
15646  *	  requests.
15647  */
15648 static void
15649 ilm_send_multicast_reqs(ill_t *from_ill, ill_t *to_ill)
15650 {
15651 	ipif_t *ipif;
15652 	ilm_t *ilm;
15653 
15654 	/*
15655 	 * See whether we need to send down DL_ENABMULTI_REQ on
15656 	 * to_ill as ilm has just been added.
15657 	 */
15658 	ASSERT(IAM_WRITER_ILL(to_ill));
15659 	ASSERT(IAM_WRITER_ILL(from_ill));
15660 
15661 	ILM_WALKER_HOLD(to_ill);
15662 	for (ilm = to_ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
15663 
15664 		if (!ilm->ilm_is_new || (ilm->ilm_flags & ILM_DELETED))
15665 			continue;
15666 		/*
15667 		 * no locks held, ill/ipif cannot dissappear as long
15668 		 * as we are writer.
15669 		 */
15670 		ipif = to_ill->ill_ipif;
15671 		/*
15672 		 * No need to hold any lock as we are the writer and this
15673 		 * can only be changed by a writer.
15674 		 */
15675 		ilm->ilm_is_new = B_FALSE;
15676 
15677 		if (to_ill->ill_net_type != IRE_IF_RESOLVER ||
15678 		    ipif->ipif_flags & IPIF_POINTOPOINT) {
15679 			ip1dbg(("ilm_send_multicast_reqs: to_ill not "
15680 			    "resolver\n"));
15681 			continue;		/* Must be IRE_IF_NORESOLVER */
15682 		}
15683 
15684 
15685 		if (to_ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST) {
15686 			ip1dbg(("ilm_send_multicast_reqs: "
15687 			    "to_ill MULTI_BCAST\n"));
15688 			goto from;
15689 		}
15690 
15691 		if (to_ill->ill_isv6)
15692 			mld_joingroup(ilm);
15693 		else
15694 			igmp_joingroup(ilm);
15695 
15696 		if (to_ill->ill_ipif_up_count == 0) {
15697 			/*
15698 			 * Nobody there. All multicast addresses will be
15699 			 * re-joined when we get the DL_BIND_ACK bringing the
15700 			 * interface up.
15701 			 */
15702 			ilm->ilm_notify_driver = B_FALSE;
15703 			ip1dbg(("ilm_send_multicast_reqs: to_ill nobody up\n"));
15704 			goto from;
15705 		}
15706 
15707 		/*
15708 		 * For allmulti address, we want to join on only one interface.
15709 		 * Checking for ilm_numentries_v6 is not correct as you may
15710 		 * find an ilm with zero address on to_ill, but we may not
15711 		 * have nominated to_ill for receiving. Thus, if we have
15712 		 * nominated from_ill (ill_join_allmulti is set), nominate
15713 		 * only if to_ill is not already nominated (to_ill normally
15714 		 * should not have been nominated if "from_ill" has already
15715 		 * been nominated. As we don't prevent failovers from happening
15716 		 * across groups, we don't assert).
15717 		 */
15718 		if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
15719 			/*
15720 			 * There is no need to hold ill locks as we are
15721 			 * writer on both ills and when ill_join_allmulti
15722 			 * is changed the thread is always a writer.
15723 			 */
15724 			if (from_ill->ill_join_allmulti &&
15725 			    !to_ill->ill_join_allmulti) {
15726 				(void) ip_join_allmulti(to_ill->ill_ipif);
15727 			}
15728 		} else if (ilm->ilm_notify_driver) {
15729 
15730 			/*
15731 			 * This is a newly moved ilm so we need to tell the
15732 			 * driver about the new group. There can be more than
15733 			 * one ilm's for the same group in the list each with a
15734 			 * different orig_ifindex. We have to inform the driver
15735 			 * once. In ilm_move_v[4,6] we only set the flag
15736 			 * ilm_notify_driver for the first ilm.
15737 			 */
15738 
15739 			(void) ip_ll_send_enabmulti_req(to_ill,
15740 			    &ilm->ilm_v6addr);
15741 		}
15742 
15743 		ilm->ilm_notify_driver = B_FALSE;
15744 
15745 		/*
15746 		 * See whether we need to send down DL_DISABMULTI_REQ on
15747 		 * from_ill as ilm has just been removed.
15748 		 */
15749 from:
15750 		ipif = from_ill->ill_ipif;
15751 		if (from_ill->ill_net_type != IRE_IF_RESOLVER ||
15752 		    ipif->ipif_flags & IPIF_POINTOPOINT) {
15753 			ip1dbg(("ilm_send_multicast_reqs: "
15754 			    "from_ill not resolver\n"));
15755 			continue;		/* Must be IRE_IF_NORESOLVER */
15756 		}
15757 
15758 		if (from_ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST) {
15759 			ip1dbg(("ilm_send_multicast_reqs: "
15760 			    "from_ill MULTI_BCAST\n"));
15761 			continue;
15762 		}
15763 
15764 		if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
15765 			if (from_ill->ill_join_allmulti)
15766 			    (void) ip_leave_allmulti(from_ill->ill_ipif);
15767 		} else if (ilm_numentries_v6(from_ill, &ilm->ilm_v6addr) == 0) {
15768 			(void) ip_ll_send_disabmulti_req(from_ill,
15769 		    &ilm->ilm_v6addr);
15770 		}
15771 	}
15772 	ILM_WALKER_RELE(to_ill);
15773 }
15774 
15775 /*
15776  * This function is called when all multicast memberships needs
15777  * to be moved from "from_ill" to "to_ill" for IPv6. This function is
15778  * called only once unlike the IPv4 counterpart where it is called after
15779  * every logical interface is moved. The reason is due to multicast
15780  * memberships are joined using an interface address in IPv4 while in
15781  * IPv6, interface index is used.
15782  */
15783 static void
15784 ilm_move_v6(ill_t *from_ill, ill_t *to_ill, int ifindex)
15785 {
15786 	ilm_t	*ilm;
15787 	ilm_t	*ilm_next;
15788 	ilm_t	*new_ilm;
15789 	ilm_t	**ilmp;
15790 	int	count;
15791 	char buf[INET6_ADDRSTRLEN];
15792 	in6_addr_t ipv6_snm = ipv6_solicited_node_mcast;
15793 
15794 	ASSERT(MUTEX_HELD(&to_ill->ill_lock));
15795 	ASSERT(MUTEX_HELD(&from_ill->ill_lock));
15796 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
15797 
15798 	if (ifindex == 0) {
15799 		/*
15800 		 * Form the solicited node mcast address which is used later.
15801 		 */
15802 		ipif_t *ipif;
15803 
15804 		ipif = from_ill->ill_ipif;
15805 		ASSERT(ipif->ipif_id == 0);
15806 
15807 		ipv6_snm.s6_addr32[3] |= ipif->ipif_v6lcl_addr.s6_addr32[3];
15808 	}
15809 
15810 	ilmp = &from_ill->ill_ilm;
15811 	for (ilm = from_ill->ill_ilm; ilm != NULL; ilm = ilm_next) {
15812 
15813 		if (ilm->ilm_flags & ILM_DELETED)
15814 			continue;
15815 
15816 		ilm_next = ilm->ilm_next;
15817 		new_ilm = ilm_lookup_ill_index_v6(to_ill, &ilm->ilm_v6addr,
15818 		    ilm->ilm_orig_ifindex, ilm->ilm_zoneid);
15819 		ASSERT(ilm->ilm_orig_ifindex != 0);
15820 		if (ilm->ilm_orig_ifindex == ifindex) {
15821 			/*
15822 			 * We are failing back multicast memberships.
15823 			 * If the same ilm exists in to_ill, it means somebody
15824 			 * has joined the same group there e.g. ff02::1
15825 			 * is joined within the kernel when the interfaces
15826 			 * came UP.
15827 			 */
15828 			ASSERT(ilm->ilm_ipif == NULL);
15829 			if (new_ilm != NULL) {
15830 				new_ilm->ilm_refcnt += ilm->ilm_refcnt;
15831 				if (new_ilm->ilm_fmode != MODE_IS_EXCLUDE ||
15832 				    !SLIST_IS_EMPTY(new_ilm->ilm_filter)) {
15833 					new_ilm->ilm_is_new = B_TRUE;
15834 				}
15835 			} else {
15836 				/*
15837 				 * check if we can just move the ilm
15838 				 */
15839 				if (from_ill->ill_ilm_walker_cnt != 0) {
15840 					/*
15841 					 * We have walkers we cannot move
15842 					 * the ilm, so allocate a new ilm,
15843 					 * this (old) ilm will be marked
15844 					 * ILM_DELETED at the end of the loop
15845 					 * and will be freed when the
15846 					 * last walker exits.
15847 					 */
15848 					new_ilm = (ilm_t *)mi_zalloc
15849 					    (sizeof (ilm_t));
15850 					if (new_ilm == NULL) {
15851 						ip0dbg(("ilm_move_v6: "
15852 						    "FAILBACK of IPv6"
15853 						    " multicast address %s : "
15854 						    "from %s to"
15855 						    " %s failed : ENOMEM \n",
15856 						    inet_ntop(AF_INET6,
15857 						    &ilm->ilm_v6addr, buf,
15858 						    sizeof (buf)),
15859 						    from_ill->ill_name,
15860 						    to_ill->ill_name));
15861 
15862 							ilmp = &ilm->ilm_next;
15863 							continue;
15864 					}
15865 					*new_ilm = *ilm;
15866 					/*
15867 					 * we don't want new_ilm linked to
15868 					 * ilm's filter list.
15869 					 */
15870 					new_ilm->ilm_filter = NULL;
15871 				} else {
15872 					/*
15873 					 * No walkers we can move the ilm.
15874 					 * lets take it out of the list.
15875 					 */
15876 					*ilmp = ilm->ilm_next;
15877 					ilm->ilm_next = NULL;
15878 					new_ilm = ilm;
15879 				}
15880 
15881 				/*
15882 				 * if this is the first ilm for the group
15883 				 * set ilm_notify_driver so that we notify the
15884 				 * driver in ilm_send_multicast_reqs.
15885 				 */
15886 				if (ilm_lookup_ill_v6(to_ill,
15887 				    &new_ilm->ilm_v6addr, ALL_ZONES) == NULL)
15888 					new_ilm->ilm_notify_driver = B_TRUE;
15889 
15890 				new_ilm->ilm_ill = to_ill;
15891 				/* Add to the to_ill's list */
15892 				new_ilm->ilm_next = to_ill->ill_ilm;
15893 				to_ill->ill_ilm = new_ilm;
15894 				/*
15895 				 * set the flag so that mld_joingroup is
15896 				 * called in ilm_send_multicast_reqs().
15897 				 */
15898 				new_ilm->ilm_is_new = B_TRUE;
15899 			}
15900 			goto bottom;
15901 		} else if (ifindex != 0) {
15902 			/*
15903 			 * If this is FAILBACK (ifindex != 0) and the ifindex
15904 			 * has not matched above, look at the next ilm.
15905 			 */
15906 			ilmp = &ilm->ilm_next;
15907 			continue;
15908 		}
15909 		/*
15910 		 * If we are here, it means ifindex is 0. Failover
15911 		 * everything.
15912 		 *
15913 		 * We need to handle solicited node mcast address
15914 		 * and all_nodes mcast address differently as they
15915 		 * are joined witin the kenrel (ipif_multicast_up)
15916 		 * and potentially from the userland. We are called
15917 		 * after the ipifs of from_ill has been moved.
15918 		 * If we still find ilms on ill with solicited node
15919 		 * mcast address or all_nodes mcast address, it must
15920 		 * belong to the UP interface that has not moved e.g.
15921 		 * ipif_id 0 with the link local prefix does not move.
15922 		 * We join this on the new ill accounting for all the
15923 		 * userland memberships so that applications don't
15924 		 * see any failure.
15925 		 *
15926 		 * We need to make sure that we account only for the
15927 		 * solicited node and all node multicast addresses
15928 		 * that was brought UP on these. In the case of
15929 		 * a failover from A to B, we might have ilms belonging
15930 		 * to A (ilm_orig_ifindex pointing at A) on B accounting
15931 		 * for the membership from the userland. If we are failing
15932 		 * over from B to C now, we will find the ones belonging
15933 		 * to A on B. These don't account for the ill_ipif_up_count.
15934 		 * They just move from B to C. The check below on
15935 		 * ilm_orig_ifindex ensures that.
15936 		 */
15937 		if ((ilm->ilm_orig_ifindex ==
15938 		    from_ill->ill_phyint->phyint_ifindex) &&
15939 		    (IN6_ARE_ADDR_EQUAL(&ipv6_snm, &ilm->ilm_v6addr) ||
15940 		    IN6_ARE_ADDR_EQUAL(&ipv6_all_hosts_mcast,
15941 		    &ilm->ilm_v6addr))) {
15942 			ASSERT(ilm->ilm_refcnt > 0);
15943 			count = ilm->ilm_refcnt - from_ill->ill_ipif_up_count;
15944 			/*
15945 			 * For indentation reasons, we are not using a
15946 			 * "else" here.
15947 			 */
15948 			if (count == 0) {
15949 				ilmp = &ilm->ilm_next;
15950 				continue;
15951 			}
15952 			ilm->ilm_refcnt -= count;
15953 			if (new_ilm != NULL) {
15954 				/*
15955 				 * Can find one with the same
15956 				 * ilm_orig_ifindex, if we are failing
15957 				 * over to a STANDBY. This happens
15958 				 * when somebody wants to join a group
15959 				 * on a STANDBY interface and we
15960 				 * internally join on a different one.
15961 				 * If we had joined on from_ill then, a
15962 				 * failover now will find a new ilm
15963 				 * with this index.
15964 				 */
15965 				ip1dbg(("ilm_move_v6: FAILOVER, found"
15966 				    " new ilm on %s, group address %s\n",
15967 				    to_ill->ill_name,
15968 				    inet_ntop(AF_INET6,
15969 				    &ilm->ilm_v6addr, buf,
15970 				    sizeof (buf))));
15971 				new_ilm->ilm_refcnt += count;
15972 				if (new_ilm->ilm_fmode != MODE_IS_EXCLUDE ||
15973 				    !SLIST_IS_EMPTY(new_ilm->ilm_filter)) {
15974 					new_ilm->ilm_is_new = B_TRUE;
15975 				}
15976 			} else {
15977 				new_ilm = (ilm_t *)mi_zalloc(sizeof (ilm_t));
15978 				if (new_ilm == NULL) {
15979 					ip0dbg(("ilm_move_v6: FAILOVER of IPv6"
15980 					    " multicast address %s : from %s to"
15981 					    " %s failed : ENOMEM \n",
15982 					    inet_ntop(AF_INET6,
15983 					    &ilm->ilm_v6addr, buf,
15984 					    sizeof (buf)), from_ill->ill_name,
15985 					    to_ill->ill_name));
15986 					ilmp = &ilm->ilm_next;
15987 					continue;
15988 				}
15989 				*new_ilm = *ilm;
15990 				new_ilm->ilm_filter = NULL;
15991 				new_ilm->ilm_refcnt = count;
15992 				new_ilm->ilm_timer = INFINITY;
15993 				new_ilm->ilm_rtx.rtx_timer = INFINITY;
15994 				new_ilm->ilm_is_new = B_TRUE;
15995 				/*
15996 				 * If the to_ill has not joined this
15997 				 * group we need to tell the driver in
15998 				 * ill_send_multicast_reqs.
15999 				 */
16000 				if (ilm_lookup_ill_v6(to_ill,
16001 				    &new_ilm->ilm_v6addr, ALL_ZONES) == NULL)
16002 					new_ilm->ilm_notify_driver = B_TRUE;
16003 
16004 				new_ilm->ilm_ill = to_ill;
16005 				/* Add to the to_ill's list */
16006 				new_ilm->ilm_next = to_ill->ill_ilm;
16007 				to_ill->ill_ilm = new_ilm;
16008 				ASSERT(new_ilm->ilm_ipif == NULL);
16009 			}
16010 			if (ilm->ilm_refcnt == 0) {
16011 				goto bottom;
16012 			} else {
16013 				new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
16014 				CLEAR_SLIST(new_ilm->ilm_filter);
16015 				ilmp = &ilm->ilm_next;
16016 			}
16017 			continue;
16018 		} else {
16019 			/*
16020 			 * ifindex = 0 means, move everything pointing at
16021 			 * from_ill. We are doing this becuase ill has
16022 			 * either FAILED or became INACTIVE.
16023 			 *
16024 			 * As we would like to move things later back to
16025 			 * from_ill, we want to retain the identity of this
16026 			 * ilm. Thus, we don't blindly increment the reference
16027 			 * count on the ilms matching the address alone. We
16028 			 * need to match on the ilm_orig_index also. new_ilm
16029 			 * was obtained by matching ilm_orig_index also.
16030 			 */
16031 			if (new_ilm != NULL) {
16032 				/*
16033 				 * This is possible only if a previous restore
16034 				 * was incomplete i.e restore to
16035 				 * ilm_orig_ifindex left some ilms because
16036 				 * of some failures. Thus when we are failing
16037 				 * again, we might find our old friends there.
16038 				 */
16039 				ip1dbg(("ilm_move_v6: FAILOVER, found new ilm"
16040 				    " on %s, group address %s\n",
16041 				    to_ill->ill_name,
16042 				    inet_ntop(AF_INET6,
16043 				    &ilm->ilm_v6addr, buf,
16044 				    sizeof (buf))));
16045 				new_ilm->ilm_refcnt += ilm->ilm_refcnt;
16046 				if (new_ilm->ilm_fmode != MODE_IS_EXCLUDE ||
16047 				    !SLIST_IS_EMPTY(new_ilm->ilm_filter)) {
16048 					new_ilm->ilm_is_new = B_TRUE;
16049 				}
16050 			} else {
16051 				if (from_ill->ill_ilm_walker_cnt != 0) {
16052 					new_ilm = (ilm_t *)
16053 					    mi_zalloc(sizeof (ilm_t));
16054 					if (new_ilm == NULL) {
16055 						ip0dbg(("ilm_move_v6: "
16056 						    "FAILOVER of IPv6"
16057 						    " multicast address %s : "
16058 						    "from %s to"
16059 						    " %s failed : ENOMEM \n",
16060 						    inet_ntop(AF_INET6,
16061 						    &ilm->ilm_v6addr, buf,
16062 						    sizeof (buf)),
16063 						    from_ill->ill_name,
16064 						    to_ill->ill_name));
16065 
16066 							ilmp = &ilm->ilm_next;
16067 							continue;
16068 					}
16069 					*new_ilm = *ilm;
16070 					new_ilm->ilm_filter = NULL;
16071 				} else {
16072 					*ilmp = ilm->ilm_next;
16073 					new_ilm = ilm;
16074 				}
16075 				/*
16076 				 * If the to_ill has not joined this
16077 				 * group we need to tell the driver in
16078 				 * ill_send_multicast_reqs.
16079 				 */
16080 				if (ilm_lookup_ill_v6(to_ill,
16081 				    &new_ilm->ilm_v6addr, ALL_ZONES) == NULL)
16082 					new_ilm->ilm_notify_driver = B_TRUE;
16083 
16084 				/* Add to the to_ill's list */
16085 				new_ilm->ilm_next = to_ill->ill_ilm;
16086 				to_ill->ill_ilm = new_ilm;
16087 				ASSERT(ilm->ilm_ipif == NULL);
16088 				new_ilm->ilm_ill = to_ill;
16089 				new_ilm->ilm_is_new = B_TRUE;
16090 			}
16091 
16092 		}
16093 
16094 bottom:
16095 		/*
16096 		 * Revert multicast filter state to (EXCLUDE, NULL).
16097 		 * new_ilm->ilm_is_new should already be set if needed.
16098 		 */
16099 		new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
16100 		CLEAR_SLIST(new_ilm->ilm_filter);
16101 		/*
16102 		 * We allocated/got a new ilm, free the old one.
16103 		 */
16104 		if (new_ilm != ilm) {
16105 			if (from_ill->ill_ilm_walker_cnt == 0) {
16106 				*ilmp = ilm->ilm_next;
16107 				ilm->ilm_next = NULL;
16108 				FREE_SLIST(ilm->ilm_filter);
16109 				FREE_SLIST(ilm->ilm_pendsrcs);
16110 				FREE_SLIST(ilm->ilm_rtx.rtx_allow);
16111 				FREE_SLIST(ilm->ilm_rtx.rtx_block);
16112 				mi_free((char *)ilm);
16113 			} else {
16114 				ilm->ilm_flags |= ILM_DELETED;
16115 				from_ill->ill_ilm_cleanup_reqd = 1;
16116 				ilmp = &ilm->ilm_next;
16117 			}
16118 		}
16119 	}
16120 }
16121 
16122 /*
16123  * Move all the multicast memberships to to_ill. Called when
16124  * an ipif moves from "from_ill" to "to_ill". This function is slightly
16125  * different from IPv6 counterpart as multicast memberships are associated
16126  * with ills in IPv6. This function is called after every ipif is moved
16127  * unlike IPv6, where it is moved only once.
16128  */
16129 static void
16130 ilm_move_v4(ill_t *from_ill, ill_t *to_ill, ipif_t *ipif)
16131 {
16132 	ilm_t	*ilm;
16133 	ilm_t	*ilm_next;
16134 	ilm_t	*new_ilm;
16135 	ilm_t	**ilmp;
16136 
16137 	ASSERT(MUTEX_HELD(&to_ill->ill_lock));
16138 	ASSERT(MUTEX_HELD(&from_ill->ill_lock));
16139 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
16140 
16141 	ilmp = &from_ill->ill_ilm;
16142 	for (ilm = from_ill->ill_ilm; ilm != NULL; ilm = ilm_next) {
16143 
16144 		if (ilm->ilm_flags & ILM_DELETED)
16145 			continue;
16146 
16147 		ilm_next = ilm->ilm_next;
16148 		ASSERT(ilm->ilm_ipif != NULL);
16149 
16150 		if (ilm->ilm_ipif != ipif) {
16151 			ilmp = &ilm->ilm_next;
16152 			continue;
16153 		}
16154 
16155 		if (V4_PART_OF_V6(ilm->ilm_v6addr) ==
16156 		    htonl(INADDR_ALLHOSTS_GROUP)) {
16157 			/*
16158 			 * We joined this in ipif_multicast_up
16159 			 * and we never did an ipif_multicast_down
16160 			 * for IPv4. If nobody else from the userland
16161 			 * has reference, we free the ilm, and later
16162 			 * when this ipif comes up on the new ill,
16163 			 * we will join this again.
16164 			 */
16165 			if (--ilm->ilm_refcnt == 0)
16166 				goto delete_ilm;
16167 
16168 			new_ilm = ilm_lookup_ipif(ipif,
16169 			    V4_PART_OF_V6(ilm->ilm_v6addr));
16170 			if (new_ilm != NULL) {
16171 				new_ilm->ilm_refcnt += ilm->ilm_refcnt;
16172 				/*
16173 				 * We still need to deal with the from_ill.
16174 				 */
16175 				new_ilm->ilm_is_new = B_TRUE;
16176 				new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
16177 				CLEAR_SLIST(new_ilm->ilm_filter);
16178 				goto delete_ilm;
16179 			}
16180 			/*
16181 			 * If we could not find one e.g. ipif is
16182 			 * still down on to_ill, we add this ilm
16183 			 * on ill_new to preserve the reference
16184 			 * count.
16185 			 */
16186 		}
16187 		/*
16188 		 * When ipifs move, ilms always move with it
16189 		 * to the NEW ill. Thus we should never be
16190 		 * able to find ilm till we really move it here.
16191 		 */
16192 		ASSERT(ilm_lookup_ipif(ipif,
16193 		    V4_PART_OF_V6(ilm->ilm_v6addr)) == NULL);
16194 
16195 		if (from_ill->ill_ilm_walker_cnt != 0) {
16196 			new_ilm = (ilm_t *)mi_zalloc(sizeof (ilm_t));
16197 			if (new_ilm == NULL) {
16198 				char buf[INET6_ADDRSTRLEN];
16199 				ip0dbg(("ilm_move_v4: FAILBACK of IPv4"
16200 				    " multicast address %s : "
16201 				    "from %s to"
16202 				    " %s failed : ENOMEM \n",
16203 				    inet_ntop(AF_INET,
16204 				    &ilm->ilm_v6addr, buf,
16205 				    sizeof (buf)),
16206 				    from_ill->ill_name,
16207 				    to_ill->ill_name));
16208 
16209 				ilmp = &ilm->ilm_next;
16210 				continue;
16211 			}
16212 			*new_ilm = *ilm;
16213 			/* We don't want new_ilm linked to ilm's filter list */
16214 			new_ilm->ilm_filter = NULL;
16215 		} else {
16216 			/* Remove from the list */
16217 			*ilmp = ilm->ilm_next;
16218 			new_ilm = ilm;
16219 		}
16220 
16221 		/*
16222 		 * If we have never joined this group on the to_ill
16223 		 * make sure we tell the driver.
16224 		 */
16225 		if (ilm_lookup_ill_v6(to_ill, &new_ilm->ilm_v6addr,
16226 		    ALL_ZONES) == NULL)
16227 			new_ilm->ilm_notify_driver = B_TRUE;
16228 
16229 		/* Add to the to_ill's list */
16230 		new_ilm->ilm_next = to_ill->ill_ilm;
16231 		to_ill->ill_ilm = new_ilm;
16232 		new_ilm->ilm_is_new = B_TRUE;
16233 
16234 		/*
16235 		 * Revert multicast filter state to (EXCLUDE, NULL)
16236 		 */
16237 		new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
16238 		CLEAR_SLIST(new_ilm->ilm_filter);
16239 
16240 		/*
16241 		 * Delete only if we have allocated a new ilm.
16242 		 */
16243 		if (new_ilm != ilm) {
16244 delete_ilm:
16245 			if (from_ill->ill_ilm_walker_cnt == 0) {
16246 				/* Remove from the list */
16247 				*ilmp = ilm->ilm_next;
16248 				ilm->ilm_next = NULL;
16249 				FREE_SLIST(ilm->ilm_filter);
16250 				FREE_SLIST(ilm->ilm_pendsrcs);
16251 				FREE_SLIST(ilm->ilm_rtx.rtx_allow);
16252 				FREE_SLIST(ilm->ilm_rtx.rtx_block);
16253 				mi_free((char *)ilm);
16254 			} else {
16255 				ilm->ilm_flags |= ILM_DELETED;
16256 				from_ill->ill_ilm_cleanup_reqd = 1;
16257 				ilmp = &ilm->ilm_next;
16258 			}
16259 		}
16260 	}
16261 }
16262 
16263 static uint_t
16264 ipif_get_id(ill_t *ill, uint_t id)
16265 {
16266 	uint_t	unit;
16267 	ipif_t	*tipif;
16268 	boolean_t found = B_FALSE;
16269 
16270 	/*
16271 	 * During failback, we want to go back to the same id
16272 	 * instead of the smallest id so that the original
16273 	 * configuration is maintained. id is non-zero in that
16274 	 * case.
16275 	 */
16276 	if (id != 0) {
16277 		/*
16278 		 * While failing back, if we still have an ipif with
16279 		 * MAX_ADDRS_PER_IF, it means this will be replaced
16280 		 * as soon as we return from this function. It was
16281 		 * to set to MAX_ADDRS_PER_IF by the caller so that
16282 		 * we can choose the smallest id. Thus we return zero
16283 		 * in that case ignoring the hint.
16284 		 */
16285 		if (ill->ill_ipif->ipif_id == MAX_ADDRS_PER_IF)
16286 			return (0);
16287 		for (tipif = ill->ill_ipif; tipif != NULL;
16288 		    tipif = tipif->ipif_next) {
16289 			if (tipif->ipif_id == id) {
16290 				found = B_TRUE;
16291 				break;
16292 			}
16293 		}
16294 		/*
16295 		 * If somebody already plumbed another logical
16296 		 * with the same id, we won't be able to find it.
16297 		 */
16298 		if (!found)
16299 			return (id);
16300 	}
16301 	for (unit = 0; unit <= ip_addrs_per_if; unit++) {
16302 		found = B_FALSE;
16303 		for (tipif = ill->ill_ipif; tipif != NULL;
16304 		    tipif = tipif->ipif_next) {
16305 			if (tipif->ipif_id == unit) {
16306 				found = B_TRUE;
16307 				break;
16308 			}
16309 		}
16310 		if (!found)
16311 			break;
16312 	}
16313 	return (unit);
16314 }
16315 
16316 /* ARGSUSED */
16317 static int
16318 ipif_move(ipif_t *ipif, ill_t *to_ill, queue_t *q, mblk_t *mp,
16319     ipif_t **rep_ipif_ptr)
16320 {
16321 	ill_t	*from_ill;
16322 	ipif_t	*rep_ipif;
16323 	ipif_t	**ipifp;
16324 	uint_t	unit;
16325 	int err = 0;
16326 	ipif_t	*to_ipif;
16327 	struct iocblk	*iocp;
16328 	boolean_t failback_cmd;
16329 	boolean_t remove_ipif;
16330 	int	rc;
16331 
16332 	ASSERT(IAM_WRITER_ILL(to_ill));
16333 	ASSERT(IAM_WRITER_IPIF(ipif));
16334 
16335 	iocp = (struct iocblk *)mp->b_rptr;
16336 	failback_cmd = (iocp->ioc_cmd == SIOCLIFFAILBACK);
16337 	remove_ipif = B_FALSE;
16338 
16339 	from_ill = ipif->ipif_ill;
16340 
16341 	ASSERT(MUTEX_HELD(&to_ill->ill_lock));
16342 	ASSERT(MUTEX_HELD(&from_ill->ill_lock));
16343 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
16344 
16345 	/*
16346 	 * Don't move LINK LOCAL addresses as they are tied to
16347 	 * physical interface.
16348 	 */
16349 	if (from_ill->ill_isv6 &&
16350 	    IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6lcl_addr)) {
16351 		ipif->ipif_was_up = B_FALSE;
16352 		IPIF_UNMARK_MOVING(ipif);
16353 		return (0);
16354 	}
16355 
16356 	/*
16357 	 * We set the ipif_id to maximum so that the search for
16358 	 * ipif_id will pick the lowest number i.e 0 in the
16359 	 * following 2 cases :
16360 	 *
16361 	 * 1) We have a replacement ipif at the head of to_ill.
16362 	 *    We can't remove it yet as we can exceed ip_addrs_per_if
16363 	 *    on to_ill and hence the MOVE might fail. We want to
16364 	 *    remove it only if we could move the ipif. Thus, by
16365 	 *    setting it to the MAX value, we make the search in
16366 	 *    ipif_get_id return the zeroth id.
16367 	 *
16368 	 * 2) When DR pulls out the NIC and re-plumbs the interface,
16369 	 *    we might just have a zero address plumbed on the ipif
16370 	 *    with zero id in the case of IPv4. We remove that while
16371 	 *    doing the failback. We want to remove it only if we
16372 	 *    could move the ipif. Thus, by setting it to the MAX
16373 	 *    value, we make the search in ipif_get_id return the
16374 	 *    zeroth id.
16375 	 *
16376 	 * Both (1) and (2) are done only when when we are moving
16377 	 * an ipif (either due to failover/failback) which originally
16378 	 * belonged to this interface i.e the ipif_orig_ifindex is
16379 	 * the same as to_ill's ifindex. This is needed so that
16380 	 * FAILOVER from A -> B ( A failed) followed by FAILOVER
16381 	 * from B -> A (B is being removed from the group) and
16382 	 * FAILBACK from A -> B restores the original configuration.
16383 	 * Without the check for orig_ifindex, the second FAILOVER
16384 	 * could make the ipif belonging to B replace the A's zeroth
16385 	 * ipif and the subsequent failback re-creating the replacement
16386 	 * ipif again.
16387 	 *
16388 	 * NOTE : We created the replacement ipif when we did a
16389 	 * FAILOVER (See below). We could check for FAILBACK and
16390 	 * then look for replacement ipif to be removed. But we don't
16391 	 * want to do that because we wan't to allow the possibility
16392 	 * of a FAILOVER from A -> B (which creates the replacement ipif),
16393 	 * followed by a *FAILOVER* from B -> A instead of a FAILBACK
16394 	 * from B -> A.
16395 	 */
16396 	to_ipif = to_ill->ill_ipif;
16397 	if ((to_ill->ill_phyint->phyint_ifindex ==
16398 	    ipif->ipif_orig_ifindex) &&
16399 	    IPIF_REPL_CHECK(to_ipif, failback_cmd)) {
16400 		ASSERT(to_ipif->ipif_id == 0);
16401 		remove_ipif = B_TRUE;
16402 		to_ipif->ipif_id = MAX_ADDRS_PER_IF;
16403 	}
16404 	/*
16405 	 * Find the lowest logical unit number on the to_ill.
16406 	 * If we are failing back, try to get the original id
16407 	 * rather than the lowest one so that the original
16408 	 * configuration is maintained.
16409 	 *
16410 	 * XXX need a better scheme for this.
16411 	 */
16412 	if (failback_cmd) {
16413 		unit = ipif_get_id(to_ill, ipif->ipif_orig_ipifid);
16414 	} else {
16415 		unit = ipif_get_id(to_ill, 0);
16416 	}
16417 
16418 	/* Reset back to zero in case we fail below */
16419 	if (to_ipif->ipif_id == MAX_ADDRS_PER_IF)
16420 		to_ipif->ipif_id = 0;
16421 
16422 	if (unit == ip_addrs_per_if) {
16423 		ipif->ipif_was_up = B_FALSE;
16424 		IPIF_UNMARK_MOVING(ipif);
16425 		return (EINVAL);
16426 	}
16427 
16428 	/*
16429 	 * ipif is ready to move from "from_ill" to "to_ill".
16430 	 *
16431 	 * 1) If we are moving ipif with id zero, create a
16432 	 *    replacement ipif for this ipif on from_ill. If this fails
16433 	 *    fail the MOVE operation.
16434 	 *
16435 	 * 2) Remove the replacement ipif on to_ill if any.
16436 	 *    We could remove the replacement ipif when we are moving
16437 	 *    the ipif with id zero. But what if somebody already
16438 	 *    unplumbed it ? Thus we always remove it if it is present.
16439 	 *    We want to do it only if we are sure we are going to
16440 	 *    move the ipif to to_ill which is why there are no
16441 	 *    returns due to error till ipif is linked to to_ill.
16442 	 *    Note that the first ipif that we failback will always
16443 	 *    be zero if it is present.
16444 	 */
16445 	if (ipif->ipif_id == 0) {
16446 		ipaddr_t inaddr_any = INADDR_ANY;
16447 
16448 		rep_ipif = (ipif_t *)mi_alloc(sizeof (ipif_t), BPRI_MED);
16449 		if (rep_ipif == NULL) {
16450 			ipif->ipif_was_up = B_FALSE;
16451 			IPIF_UNMARK_MOVING(ipif);
16452 			return (ENOMEM);
16453 		}
16454 		*rep_ipif = ipif_zero;
16455 		/*
16456 		 * Before we put the ipif on the list, store the addresses
16457 		 * as mapped addresses as some of the ioctls e.g SIOCGIFADDR
16458 		 * assumes so. This logic is not any different from what
16459 		 * ipif_allocate does.
16460 		 */
16461 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16462 		    &rep_ipif->ipif_v6lcl_addr);
16463 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16464 		    &rep_ipif->ipif_v6src_addr);
16465 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16466 		    &rep_ipif->ipif_v6subnet);
16467 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16468 		    &rep_ipif->ipif_v6net_mask);
16469 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16470 		    &rep_ipif->ipif_v6brd_addr);
16471 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16472 		    &rep_ipif->ipif_v6pp_dst_addr);
16473 		/*
16474 		 * We mark IPIF_NOFAILOVER so that this can never
16475 		 * move.
16476 		 */
16477 		rep_ipif->ipif_flags = ipif->ipif_flags | IPIF_NOFAILOVER;
16478 		rep_ipif->ipif_flags &= ~IPIF_UP;
16479 		rep_ipif->ipif_replace_zero = B_TRUE;
16480 		mutex_init(&rep_ipif->ipif_saved_ire_lock, NULL,
16481 		    MUTEX_DEFAULT, NULL);
16482 		rep_ipif->ipif_id = 0;
16483 		rep_ipif->ipif_ire_type = ipif->ipif_ire_type;
16484 		rep_ipif->ipif_ill = from_ill;
16485 		rep_ipif->ipif_orig_ifindex =
16486 		    from_ill->ill_phyint->phyint_ifindex;
16487 		/* Insert at head */
16488 		rep_ipif->ipif_next = from_ill->ill_ipif;
16489 		from_ill->ill_ipif = rep_ipif;
16490 		/*
16491 		 * We don't really care to let apps know about
16492 		 * this interface.
16493 		 */
16494 	}
16495 
16496 	if (remove_ipif) {
16497 		/*
16498 		 * We set to a max value above for this case to get
16499 		 * id zero. ASSERT that we did get one.
16500 		 */
16501 		ASSERT((to_ipif->ipif_id == 0) && (unit == 0));
16502 		rep_ipif = to_ipif;
16503 		to_ill->ill_ipif = rep_ipif->ipif_next;
16504 		rep_ipif->ipif_next = NULL;
16505 		/*
16506 		 * If some apps scanned and find this interface,
16507 		 * it is time to let them know, so that they can
16508 		 * delete it.
16509 		 */
16510 
16511 		*rep_ipif_ptr = rep_ipif;
16512 	}
16513 
16514 	/* Get it out of the ILL interface list. */
16515 	ipifp = &ipif->ipif_ill->ill_ipif;
16516 	for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
16517 		if (*ipifp == ipif) {
16518 			*ipifp = ipif->ipif_next;
16519 			break;
16520 		}
16521 	}
16522 
16523 	/* Assign the new ill */
16524 	ipif->ipif_ill = to_ill;
16525 	ipif->ipif_id = unit;
16526 	/* id has already been checked */
16527 	rc = ipif_insert(ipif, B_FALSE, B_FALSE);
16528 	ASSERT(rc == 0);
16529 	/* Let SCTP update its list */
16530 	sctp_move_ipif(ipif, from_ill, to_ill);
16531 	/*
16532 	 * Handle the failover and failback of ipif_t between
16533 	 * ill_t that have differing maximum mtu values.
16534 	 */
16535 	if (ipif->ipif_mtu > to_ill->ill_max_mtu) {
16536 		if (ipif->ipif_saved_mtu == 0) {
16537 			/*
16538 			 * As this ipif_t is moving to an ill_t
16539 			 * that has a lower ill_max_mtu, its
16540 			 * ipif_mtu needs to be saved so it can
16541 			 * be restored during failback or during
16542 			 * failover to an ill_t which has a
16543 			 * higher ill_max_mtu.
16544 			 */
16545 			ipif->ipif_saved_mtu = ipif->ipif_mtu;
16546 			ipif->ipif_mtu = to_ill->ill_max_mtu;
16547 		} else {
16548 			/*
16549 			 * The ipif_t is, once again, moving to
16550 			 * an ill_t that has a lower maximum mtu
16551 			 * value.
16552 			 */
16553 			ipif->ipif_mtu = to_ill->ill_max_mtu;
16554 		}
16555 	} else if (ipif->ipif_mtu < to_ill->ill_max_mtu &&
16556 	    ipif->ipif_saved_mtu != 0) {
16557 		/*
16558 		 * The mtu of this ipif_t had to be reduced
16559 		 * during an earlier failover; this is an
16560 		 * opportunity for it to be increased (either as
16561 		 * part of another failover or a failback).
16562 		 */
16563 		if (ipif->ipif_saved_mtu <= to_ill->ill_max_mtu) {
16564 			ipif->ipif_mtu = ipif->ipif_saved_mtu;
16565 			ipif->ipif_saved_mtu = 0;
16566 		} else {
16567 			ipif->ipif_mtu = to_ill->ill_max_mtu;
16568 		}
16569 	}
16570 
16571 	/*
16572 	 * We preserve all the other fields of the ipif including
16573 	 * ipif_saved_ire_mp. The routes that are saved here will
16574 	 * be recreated on the new interface and back on the old
16575 	 * interface when we move back.
16576 	 */
16577 	ASSERT(ipif->ipif_arp_del_mp == NULL);
16578 
16579 	return (err);
16580 }
16581 
16582 static int
16583 ipif_move_all(ill_t *from_ill, ill_t *to_ill, queue_t *q, mblk_t *mp,
16584     int ifindex, ipif_t **rep_ipif_ptr)
16585 {
16586 	ipif_t *mipif;
16587 	ipif_t *ipif_next;
16588 	int err;
16589 
16590 	/*
16591 	 * We don't really try to MOVE back things if some of the
16592 	 * operations fail. The daemon will take care of moving again
16593 	 * later on.
16594 	 */
16595 	for (mipif = from_ill->ill_ipif; mipif != NULL; mipif = ipif_next) {
16596 		ipif_next = mipif->ipif_next;
16597 		if (!(mipif->ipif_flags & IPIF_NOFAILOVER) &&
16598 		    (ifindex == 0 || ifindex == mipif->ipif_orig_ifindex)) {
16599 
16600 			err = ipif_move(mipif, to_ill, q, mp, rep_ipif_ptr);
16601 
16602 			/*
16603 			 * When the MOVE fails, it is the job of the
16604 			 * application to take care of this properly
16605 			 * i.e try again if it is ENOMEM.
16606 			 */
16607 			if (mipif->ipif_ill != from_ill) {
16608 				/*
16609 				 * ipif has moved.
16610 				 *
16611 				 * Move the multicast memberships associated
16612 				 * with this ipif to the new ill. For IPv6, we
16613 				 * do it once after all the ipifs are moved
16614 				 * (in ill_move) as they are not associated
16615 				 * with ipifs.
16616 				 *
16617 				 * We need to move the ilms as the ipif has
16618 				 * already been moved to a new ill even
16619 				 * in the case of errors. Neither
16620 				 * ilm_free(ipif) will find the ilm
16621 				 * when somebody unplumbs this ipif nor
16622 				 * ilm_delete(ilm) will be able to find the
16623 				 * ilm, if we don't move now.
16624 				 */
16625 				if (!from_ill->ill_isv6)
16626 					ilm_move_v4(from_ill, to_ill, mipif);
16627 			}
16628 
16629 			if (err != 0)
16630 				return (err);
16631 		}
16632 	}
16633 	return (0);
16634 }
16635 
16636 static int
16637 ill_move(ill_t *from_ill, ill_t *to_ill, queue_t *q, mblk_t *mp)
16638 {
16639 	int ifindex;
16640 	int err;
16641 	struct iocblk	*iocp;
16642 	ipif_t	*ipif;
16643 	ipif_t *rep_ipif_ptr = NULL;
16644 	ipif_t	*from_ipif = NULL;
16645 	boolean_t check_rep_if = B_FALSE;
16646 
16647 	iocp = (struct iocblk *)mp->b_rptr;
16648 	if (iocp->ioc_cmd == SIOCLIFFAILOVER) {
16649 		/*
16650 		 * Move everything pointing at from_ill to to_ill.
16651 		 * We acheive this by passing in 0 as ifindex.
16652 		 */
16653 		ifindex = 0;
16654 	} else {
16655 		/*
16656 		 * Move everything pointing at from_ill whose original
16657 		 * ifindex of connp, ipif, ilm points at to_ill->ill_index.
16658 		 * We acheive this by passing in ifindex rather than 0.
16659 		 * Multicast vifs, ilgs move implicitly because ipifs move.
16660 		 */
16661 		ASSERT(iocp->ioc_cmd == SIOCLIFFAILBACK);
16662 		ifindex = to_ill->ill_phyint->phyint_ifindex;
16663 	}
16664 
16665 	/*
16666 	 * Determine if there is at least one ipif that would move from
16667 	 * 'from_ill' to 'to_ill'. If so, it is possible that the replacement
16668 	 * ipif (if it exists) on the to_ill would be consumed as a result of
16669 	 * the move, in which case we need to quiesce the replacement ipif also.
16670 	 */
16671 	for (from_ipif = from_ill->ill_ipif; from_ipif != NULL;
16672 	    from_ipif = from_ipif->ipif_next) {
16673 		if (((ifindex == 0) ||
16674 		    (ifindex == from_ipif->ipif_orig_ifindex)) &&
16675 		    !(from_ipif->ipif_flags & IPIF_NOFAILOVER)) {
16676 			check_rep_if = B_TRUE;
16677 			break;
16678 		}
16679 	}
16680 
16681 
16682 	ill_down_ipifs(from_ill, mp, ifindex, B_TRUE);
16683 
16684 	GRAB_ILL_LOCKS(from_ill, to_ill);
16685 	if ((ipif = ill_quiescent_to_move(from_ill)) != NULL) {
16686 		(void) ipsq_pending_mp_add(NULL, ipif, q,
16687 		    mp, ILL_MOVE_OK);
16688 		RELEASE_ILL_LOCKS(from_ill, to_ill);
16689 		return (EINPROGRESS);
16690 	}
16691 
16692 	/* Check if the replacement ipif is quiescent to delete */
16693 	if (check_rep_if && IPIF_REPL_CHECK(to_ill->ill_ipif,
16694 	    (iocp->ioc_cmd == SIOCLIFFAILBACK))) {
16695 		to_ill->ill_ipif->ipif_state_flags |=
16696 		    IPIF_MOVING | IPIF_CHANGING;
16697 		if ((ipif = ill_quiescent_to_move(to_ill)) != NULL) {
16698 			(void) ipsq_pending_mp_add(NULL, ipif, q,
16699 			    mp, ILL_MOVE_OK);
16700 			RELEASE_ILL_LOCKS(from_ill, to_ill);
16701 			return (EINPROGRESS);
16702 		}
16703 	}
16704 	RELEASE_ILL_LOCKS(from_ill, to_ill);
16705 
16706 	ASSERT(!MUTEX_HELD(&to_ill->ill_lock));
16707 	rw_enter(&ill_g_lock, RW_WRITER);
16708 	GRAB_ILL_LOCKS(from_ill, to_ill);
16709 	err = ipif_move_all(from_ill, to_ill, q, mp, ifindex, &rep_ipif_ptr);
16710 
16711 	/* ilm_move is done inside ipif_move for IPv4 */
16712 	if (err == 0 && from_ill->ill_isv6)
16713 		ilm_move_v6(from_ill, to_ill, ifindex);
16714 
16715 	RELEASE_ILL_LOCKS(from_ill, to_ill);
16716 	rw_exit(&ill_g_lock);
16717 
16718 	/*
16719 	 * send rts messages and multicast messages.
16720 	 */
16721 	if (rep_ipif_ptr != NULL) {
16722 		ip_rts_ifmsg(rep_ipif_ptr);
16723 		ip_rts_newaddrmsg(RTM_DELETE, 0, rep_ipif_ptr);
16724 		IPIF_TRACE_CLEANUP(rep_ipif_ptr);
16725 		mi_free(rep_ipif_ptr);
16726 	}
16727 
16728 	ilm_send_multicast_reqs(from_ill, to_ill);
16729 
16730 	conn_move_ill(from_ill, to_ill, ifindex);
16731 
16732 	return (err);
16733 }
16734 
16735 /*
16736  * Used to extract arguments for FAILOVER/FAILBACK ioctls.
16737  * Also checks for the validity of the arguments.
16738  * Note: We are already exclusive inside the from group.
16739  * It is upto the caller to release refcnt on the to_ill's.
16740  */
16741 static int
16742 ip_extract_move_args(queue_t *q, mblk_t *mp, ill_t **ill_from_v4,
16743     ill_t **ill_from_v6, ill_t **ill_to_v4, ill_t **ill_to_v6)
16744 {
16745 	int dst_index;
16746 	ipif_t *ipif_v4, *ipif_v6;
16747 	struct lifreq *lifr;
16748 	mblk_t *mp1;
16749 	boolean_t exists;
16750 	sin_t	*sin;
16751 	int	err = 0;
16752 
16753 	if ((mp1 = mp->b_cont) == NULL)
16754 		return (EPROTO);
16755 
16756 	if ((mp1 = mp1->b_cont) == NULL)
16757 		return (EPROTO);
16758 
16759 	lifr = (struct lifreq *)mp1->b_rptr;
16760 	sin = (sin_t *)&lifr->lifr_addr;
16761 
16762 	/*
16763 	 * We operate on both IPv4 and IPv6. Thus, we don't allow IPv4/IPv6
16764 	 * specific operations.
16765 	 */
16766 	if (sin->sin_family != AF_UNSPEC)
16767 		return (EINVAL);
16768 
16769 	/*
16770 	 * Get ipif with id 0. We are writer on the from ill. So we can pass
16771 	 * NULLs for the last 4 args and we know the lookup won't fail
16772 	 * with EINPROGRESS.
16773 	 */
16774 	ipif_v4 = ipif_lookup_on_name(lifr->lifr_name,
16775 	    mi_strlen(lifr->lifr_name), B_FALSE, &exists, B_FALSE,
16776 	    ALL_ZONES, NULL, NULL, NULL, NULL);
16777 	ipif_v6 = ipif_lookup_on_name(lifr->lifr_name,
16778 	    mi_strlen(lifr->lifr_name), B_FALSE, &exists, B_TRUE,
16779 	    ALL_ZONES, NULL, NULL, NULL, NULL);
16780 
16781 	if (ipif_v4 == NULL && ipif_v6 == NULL)
16782 		return (ENXIO);
16783 
16784 	if (ipif_v4 != NULL) {
16785 		ASSERT(ipif_v4->ipif_refcnt != 0);
16786 		if (ipif_v4->ipif_id != 0) {
16787 			err = EINVAL;
16788 			goto done;
16789 		}
16790 
16791 		ASSERT(IAM_WRITER_IPIF(ipif_v4));
16792 		*ill_from_v4 = ipif_v4->ipif_ill;
16793 	}
16794 
16795 	if (ipif_v6 != NULL) {
16796 		ASSERT(ipif_v6->ipif_refcnt != 0);
16797 		if (ipif_v6->ipif_id != 0) {
16798 			err = EINVAL;
16799 			goto done;
16800 		}
16801 
16802 		ASSERT(IAM_WRITER_IPIF(ipif_v6));
16803 		*ill_from_v6 = ipif_v6->ipif_ill;
16804 	}
16805 
16806 	err = 0;
16807 	dst_index = lifr->lifr_movetoindex;
16808 	*ill_to_v4 = ill_lookup_on_ifindex(dst_index, B_FALSE,
16809 	    q, mp, ip_process_ioctl, &err);
16810 	if (err != 0) {
16811 		/*
16812 		 * There could be only v6.
16813 		 */
16814 		if (err != ENXIO)
16815 			goto done;
16816 		err = 0;
16817 	}
16818 
16819 	*ill_to_v6 = ill_lookup_on_ifindex(dst_index, B_TRUE,
16820 	    q, mp, ip_process_ioctl, &err);
16821 	if (err != 0) {
16822 		if (err != ENXIO)
16823 			goto done;
16824 		if (*ill_to_v4 == NULL) {
16825 			err = ENXIO;
16826 			goto done;
16827 		}
16828 		err = 0;
16829 	}
16830 
16831 	/*
16832 	 * If we have something to MOVE i.e "from" not NULL,
16833 	 * "to" should be non-NULL.
16834 	 */
16835 	if ((*ill_from_v4 != NULL && *ill_to_v4 == NULL) ||
16836 	    (*ill_from_v6 != NULL && *ill_to_v6 == NULL)) {
16837 		err = EINVAL;
16838 	}
16839 
16840 done:
16841 	if (ipif_v4 != NULL)
16842 		ipif_refrele(ipif_v4);
16843 	if (ipif_v6 != NULL)
16844 		ipif_refrele(ipif_v6);
16845 	return (err);
16846 }
16847 
16848 /*
16849  * FAILOVER and FAILBACK are modelled as MOVE operations.
16850  *
16851  * We don't check whether the MOVE is within the same group or
16852  * not, because this ioctl can be used as a generic mechanism
16853  * to failover from interface A to B, though things will function
16854  * only if they are really part of the same group. Moreover,
16855  * all ipifs may be down and hence temporarily out of the group.
16856  *
16857  * ipif's that need to be moved are first brought down; V4 ipifs are brought
16858  * down first and then V6.  For each we wait for the ipif's to become quiescent.
16859  * Bringing down the ipifs ensures that all ires pointing to these ipifs's
16860  * have been deleted and there are no active references. Once quiescent the
16861  * ipif's are moved and brought up on the new ill.
16862  *
16863  * Normally the source ill and destination ill belong to the same IPMP group
16864  * and hence the same ipsq_t. In the event they don't belong to the same
16865  * same group the two ipsq's are first merged into one ipsq - that of the
16866  * to_ill. The multicast memberships on the source and destination ill cannot
16867  * change during the move operation since multicast joins/leaves also have to
16868  * execute on the same ipsq and are hence serialized.
16869  */
16870 /* ARGSUSED */
16871 int
16872 ip_sioctl_move(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16873     ip_ioctl_cmd_t *ipip, void *ifreq)
16874 {
16875 	ill_t *ill_to_v4 = NULL;
16876 	ill_t *ill_to_v6 = NULL;
16877 	ill_t *ill_from_v4 = NULL;
16878 	ill_t *ill_from_v6 = NULL;
16879 	int err = 0;
16880 
16881 	/*
16882 	 * setup from and to ill's, we can get EINPROGRESS only for
16883 	 * to_ill's.
16884 	 */
16885 	err = ip_extract_move_args(q, mp, &ill_from_v4, &ill_from_v6,
16886 	    &ill_to_v4, &ill_to_v6);
16887 
16888 	if (err != 0) {
16889 		ip0dbg(("ip_sioctl_move: extract args failed\n"));
16890 		goto done;
16891 	}
16892 
16893 	/*
16894 	 * nothing to do.
16895 	 */
16896 	if ((ill_from_v4 != NULL) && (ill_from_v4 == ill_to_v4)) {
16897 		goto done;
16898 	}
16899 
16900 	/*
16901 	 * nothing to do.
16902 	 */
16903 	if ((ill_from_v6 != NULL) && (ill_from_v6 == ill_to_v6)) {
16904 		goto done;
16905 	}
16906 
16907 	/*
16908 	 * Mark the ill as changing.
16909 	 * ILL_CHANGING flag is cleared when the ipif's are brought up
16910 	 * in ill_up_ipifs in case of error they are cleared below.
16911 	 */
16912 
16913 	GRAB_ILL_LOCKS(ill_from_v4, ill_from_v6);
16914 	if (ill_from_v4 != NULL)
16915 		ill_from_v4->ill_state_flags |= ILL_CHANGING;
16916 	if (ill_from_v6 != NULL)
16917 		ill_from_v6->ill_state_flags |= ILL_CHANGING;
16918 	RELEASE_ILL_LOCKS(ill_from_v4, ill_from_v6);
16919 
16920 	/*
16921 	 * Make sure that both src and dst are
16922 	 * in the same syncq group. If not make it happen.
16923 	 * We are not holding any locks because we are the writer
16924 	 * on the from_ipsq and we will hold locks in ill_merge_groups
16925 	 * to protect to_ipsq against changing.
16926 	 */
16927 	if (ill_from_v4 != NULL) {
16928 		if (ill_from_v4->ill_phyint->phyint_ipsq !=
16929 		    ill_to_v4->ill_phyint->phyint_ipsq) {
16930 			err = ill_merge_groups(ill_from_v4, ill_to_v4,
16931 			    NULL, mp, q);
16932 			goto err_ret;
16933 
16934 		}
16935 		ASSERT(!MUTEX_HELD(&ill_to_v4->ill_lock));
16936 	} else {
16937 
16938 		if (ill_from_v6->ill_phyint->phyint_ipsq !=
16939 		    ill_to_v6->ill_phyint->phyint_ipsq) {
16940 			err = ill_merge_groups(ill_from_v6, ill_to_v6,
16941 			    NULL, mp, q);
16942 			goto err_ret;
16943 
16944 		}
16945 		ASSERT(!MUTEX_HELD(&ill_to_v6->ill_lock));
16946 	}
16947 
16948 	/*
16949 	 * Now that the ipsq's have been merged and we are the writer
16950 	 * lets mark to_ill as changing as well.
16951 	 */
16952 
16953 	GRAB_ILL_LOCKS(ill_to_v4, ill_to_v6);
16954 	if (ill_to_v4 != NULL)
16955 		ill_to_v4->ill_state_flags |= ILL_CHANGING;
16956 	if (ill_to_v6 != NULL)
16957 		ill_to_v6->ill_state_flags |= ILL_CHANGING;
16958 	RELEASE_ILL_LOCKS(ill_to_v4, ill_to_v6);
16959 
16960 	/*
16961 	 * Its ok for us to proceed with the move even if
16962 	 * ill_pending_mp is non null on one of the from ill's as the reply
16963 	 * should not be looking at the ipif, it should only care about the
16964 	 * ill itself.
16965 	 */
16966 
16967 	/*
16968 	 * lets move ipv4 first.
16969 	 */
16970 	if (ill_from_v4 != NULL) {
16971 		ASSERT(IAM_WRITER_ILL(ill_to_v4));
16972 		ill_from_v4->ill_move_in_progress = B_TRUE;
16973 		ill_to_v4->ill_move_in_progress = B_TRUE;
16974 		ill_to_v4->ill_move_peer = ill_from_v4;
16975 		ill_from_v4->ill_move_peer = ill_to_v4;
16976 		err = ill_move(ill_from_v4, ill_to_v4, q, mp);
16977 	}
16978 
16979 	/*
16980 	 * Now lets move ipv6.
16981 	 */
16982 	if (err == 0 && ill_from_v6 != NULL) {
16983 		ASSERT(IAM_WRITER_ILL(ill_to_v6));
16984 		ill_from_v6->ill_move_in_progress = B_TRUE;
16985 		ill_to_v6->ill_move_in_progress = B_TRUE;
16986 		ill_to_v6->ill_move_peer = ill_from_v6;
16987 		ill_from_v6->ill_move_peer = ill_to_v6;
16988 		err = ill_move(ill_from_v6, ill_to_v6, q, mp);
16989 	}
16990 
16991 err_ret:
16992 	/*
16993 	 * EINPROGRESS means we are waiting for the ipif's that need to be
16994 	 * moved to become quiescent.
16995 	 */
16996 	if (err == EINPROGRESS) {
16997 		goto done;
16998 	}
16999 
17000 	/*
17001 	 * if err is set ill_up_ipifs will not be called
17002 	 * lets clear the flags.
17003 	 */
17004 
17005 	GRAB_ILL_LOCKS(ill_to_v4, ill_to_v6);
17006 	GRAB_ILL_LOCKS(ill_from_v4, ill_from_v6);
17007 	/*
17008 	 * Some of the clearing may be redundant. But it is simple
17009 	 * not making any extra checks.
17010 	 */
17011 	if (ill_from_v6 != NULL) {
17012 		ill_from_v6->ill_move_in_progress = B_FALSE;
17013 		ill_from_v6->ill_move_peer = NULL;
17014 		ill_from_v6->ill_state_flags &= ~ILL_CHANGING;
17015 	}
17016 	if (ill_from_v4 != NULL) {
17017 		ill_from_v4->ill_move_in_progress = B_FALSE;
17018 		ill_from_v4->ill_move_peer = NULL;
17019 		ill_from_v4->ill_state_flags &= ~ILL_CHANGING;
17020 	}
17021 	if (ill_to_v6 != NULL) {
17022 		ill_to_v6->ill_move_in_progress = B_FALSE;
17023 		ill_to_v6->ill_move_peer = NULL;
17024 		ill_to_v6->ill_state_flags &= ~ILL_CHANGING;
17025 	}
17026 	if (ill_to_v4 != NULL) {
17027 		ill_to_v4->ill_move_in_progress = B_FALSE;
17028 		ill_to_v4->ill_move_peer = NULL;
17029 		ill_to_v4->ill_state_flags &= ~ILL_CHANGING;
17030 	}
17031 
17032 	/*
17033 	 * Check for setting INACTIVE, if STANDBY is set and FAILED is not set.
17034 	 * Do this always to maintain proper state i.e even in case of errors.
17035 	 * As phyint_inactive looks at both v4 and v6 interfaces,
17036 	 * we need not call on both v4 and v6 interfaces.
17037 	 */
17038 	if (ill_from_v4 != NULL) {
17039 		if ((ill_from_v4->ill_phyint->phyint_flags &
17040 		    (PHYI_STANDBY | PHYI_FAILED)) == PHYI_STANDBY) {
17041 			phyint_inactive(ill_from_v4->ill_phyint);
17042 		}
17043 	} else if (ill_from_v6 != NULL) {
17044 		if ((ill_from_v6->ill_phyint->phyint_flags &
17045 		    (PHYI_STANDBY | PHYI_FAILED)) == PHYI_STANDBY) {
17046 			phyint_inactive(ill_from_v6->ill_phyint);
17047 		}
17048 	}
17049 
17050 	if (ill_to_v4 != NULL) {
17051 		if (ill_to_v4->ill_phyint->phyint_flags & PHYI_INACTIVE) {
17052 			ill_to_v4->ill_phyint->phyint_flags &= ~PHYI_INACTIVE;
17053 		}
17054 	} else if (ill_to_v6 != NULL) {
17055 		if (ill_to_v6->ill_phyint->phyint_flags & PHYI_INACTIVE) {
17056 			ill_to_v6->ill_phyint->phyint_flags &= ~PHYI_INACTIVE;
17057 		}
17058 	}
17059 
17060 	RELEASE_ILL_LOCKS(ill_to_v4, ill_to_v6);
17061 	RELEASE_ILL_LOCKS(ill_from_v4, ill_from_v6);
17062 
17063 no_err:
17064 	/*
17065 	 * lets bring the interfaces up on the to_ill.
17066 	 */
17067 	if (err == 0) {
17068 		err = ill_up_ipifs(ill_to_v4 == NULL ? ill_to_v6:ill_to_v4,
17069 		    q, mp);
17070 	}
17071 done:
17072 
17073 	if (ill_to_v4 != NULL) {
17074 		ill_refrele(ill_to_v4);
17075 	}
17076 	if (ill_to_v6 != NULL) {
17077 		ill_refrele(ill_to_v6);
17078 	}
17079 
17080 	return (err);
17081 }
17082 
17083 static void
17084 ill_dl_down(ill_t *ill)
17085 {
17086 	/*
17087 	 * The ill is down; unbind but stay attached since we're still
17088 	 * associated with a PPA.
17089 	 */
17090 	mblk_t	*mp = ill->ill_unbind_mp;
17091 
17092 	ill->ill_unbind_mp = NULL;
17093 	ip1dbg(("ill_dl_down(%s)\n", ill->ill_name));
17094 	if (mp != NULL) {
17095 		ip1dbg(("ill_dl_down: %s (%u) for %s\n",
17096 		    dlpi_prim_str(*(int *)mp->b_rptr), *(int *)mp->b_rptr,
17097 		    ill->ill_name));
17098 		ill_dlpi_send(ill, mp);
17099 	}
17100 
17101 	/*
17102 	 * Toss all of our multicast memberships.  We could keep them, but
17103 	 * then we'd have to do bookkeeping of any joins and leaves performed
17104 	 * by the application while the the interface is down (we can't just
17105 	 * issue them because arp cannot currently process AR_ENTRY_SQUERY's
17106 	 * on a downed interface).
17107 	 */
17108 	ill_leave_multicast(ill);
17109 
17110 	mutex_enter(&ill->ill_lock);
17111 	ill->ill_dl_up = 0;
17112 	mutex_exit(&ill->ill_lock);
17113 }
17114 
17115 void
17116 ill_dlpi_dispatch(ill_t *ill, mblk_t *mp)
17117 {
17118 	union DL_primitives *dlp;
17119 	t_uscalar_t prim;
17120 
17121 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
17122 
17123 	dlp = (union DL_primitives *)mp->b_rptr;
17124 	prim = dlp->dl_primitive;
17125 
17126 	ip1dbg(("ill_dlpi_dispatch: sending %s (%u) to %s\n",
17127 		dlpi_prim_str(prim), prim, ill->ill_name));
17128 
17129 	switch (prim) {
17130 	case DL_PHYS_ADDR_REQ:
17131 	{
17132 		dl_phys_addr_req_t *dlpap = (dl_phys_addr_req_t *)mp->b_rptr;
17133 		ill->ill_phys_addr_pend = dlpap->dl_addr_type;
17134 		break;
17135 	}
17136 	case DL_BIND_REQ:
17137 		mutex_enter(&ill->ill_lock);
17138 		ill->ill_state_flags &= ~ILL_DL_UNBIND_DONE;
17139 		mutex_exit(&ill->ill_lock);
17140 		break;
17141 	}
17142 
17143 	ill->ill_dlpi_pending = prim;
17144 
17145 	/*
17146 	 * Some drivers send M_FLUSH up to IP as part of unbind
17147 	 * request.  When this M_FLUSH is sent back to the driver,
17148 	 * this can go after we send the detach request if the
17149 	 * M_FLUSH ends up in IP's syncq. To avoid that, we reply
17150 	 * to the M_FLUSH in ip_rput and locally generate another
17151 	 * M_FLUSH for the correctness.  This will get freed in
17152 	 * ip_wput_nondata.
17153 	 */
17154 	if (prim == DL_UNBIND_REQ)
17155 		(void) putnextctl1(ill->ill_rq, M_FLUSH, FLUSHRW);
17156 
17157 	putnext(ill->ill_wq, mp);
17158 }
17159 
17160 /*
17161  * Send a DLPI control message to the driver but make sure there
17162  * is only one outstanding message. Uses ill_dlpi_pending to tell
17163  * when it must queue. ip_rput_dlpi_writer calls ill_dlpi_done()
17164  * when an ACK or a NAK is received to process the next queued message.
17165  *
17166  * We don't protect ill_dlpi_pending with any lock. This is okay as
17167  * every place where its accessed, ip is exclusive while accessing
17168  * ill_dlpi_pending except when this function is called from ill_init()
17169  */
17170 void
17171 ill_dlpi_send(ill_t *ill, mblk_t *mp)
17172 {
17173 	mblk_t **mpp;
17174 
17175 	ASSERT(IAM_WRITER_ILL(ill));
17176 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
17177 
17178 	if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
17179 		/* Must queue message. Tail insertion */
17180 		mpp = &ill->ill_dlpi_deferred;
17181 		while (*mpp != NULL)
17182 			mpp = &((*mpp)->b_next);
17183 
17184 		ip1dbg(("ill_dlpi_send: deferring request for %s\n",
17185 		    ill->ill_name));
17186 
17187 		*mpp = mp;
17188 		return;
17189 	}
17190 
17191 	ill_dlpi_dispatch(ill, mp);
17192 }
17193 
17194 /*
17195  * Called when an DLPI control message has been acked or nacked to
17196  * send down the next queued message (if any).
17197  */
17198 void
17199 ill_dlpi_done(ill_t *ill, t_uscalar_t prim)
17200 {
17201 	mblk_t *mp;
17202 
17203 	ASSERT(IAM_WRITER_ILL(ill));
17204 
17205 	ASSERT(prim != DL_PRIM_INVAL);
17206 	if (ill->ill_dlpi_pending != prim) {
17207 		if (ill->ill_dlpi_pending == DL_PRIM_INVAL) {
17208 			(void) mi_strlog(ill->ill_rq, 1,
17209 			    SL_CONSOLE|SL_ERROR|SL_TRACE,
17210 			    "ill_dlpi_done: unsolicited ack for %s from %s\n",
17211 			    dlpi_prim_str(prim), ill->ill_name);
17212 		} else {
17213 			(void) mi_strlog(ill->ill_rq, 1,
17214 			    SL_CONSOLE|SL_ERROR|SL_TRACE,
17215 			    "ill_dlpi_done: unexpected ack for %s from %s "
17216 			    "(expecting ack for %s)\n",
17217 			    dlpi_prim_str(prim), ill->ill_name,
17218 			    dlpi_prim_str(ill->ill_dlpi_pending));
17219 		}
17220 		return;
17221 	}
17222 
17223 	ip1dbg(("ill_dlpi_done: %s has completed %s (%u)\n", ill->ill_name,
17224 	    dlpi_prim_str(ill->ill_dlpi_pending), ill->ill_dlpi_pending));
17225 
17226 	if ((mp = ill->ill_dlpi_deferred) == NULL) {
17227 		ill->ill_dlpi_pending = DL_PRIM_INVAL;
17228 		return;
17229 	}
17230 
17231 	ill->ill_dlpi_deferred = mp->b_next;
17232 	mp->b_next = NULL;
17233 
17234 	ill_dlpi_dispatch(ill, mp);
17235 }
17236 
17237 void
17238 conn_delete_ire(conn_t *connp, caddr_t arg)
17239 {
17240 	ipif_t	*ipif = (ipif_t *)arg;
17241 	ire_t	*ire;
17242 
17243 	/*
17244 	 * Look at the cached ires on conns which has pointers to ipifs.
17245 	 * We just call ire_refrele which clears up the reference
17246 	 * to ire. Called when a conn closes. Also called from ipif_free
17247 	 * to cleanup indirect references to the stale ipif via the cached ire.
17248 	 */
17249 	mutex_enter(&connp->conn_lock);
17250 	ire = connp->conn_ire_cache;
17251 	if (ire != NULL && (ipif == NULL || ire->ire_ipif == ipif)) {
17252 		connp->conn_ire_cache = NULL;
17253 		mutex_exit(&connp->conn_lock);
17254 		IRE_REFRELE_NOTR(ire);
17255 		return;
17256 	}
17257 	mutex_exit(&connp->conn_lock);
17258 
17259 }
17260 
17261 /*
17262  * Some operations (illgrp_delete(), ipif_down()) conditionally delete a number
17263  * of IREs. Those IREs may have been previously cached in the conn structure.
17264  * This ipcl_walk() walker function releases all references to such IREs based
17265  * on the condemned flag.
17266  */
17267 /* ARGSUSED */
17268 void
17269 conn_cleanup_stale_ire(conn_t *connp, caddr_t arg)
17270 {
17271 	ire_t	*ire;
17272 
17273 	mutex_enter(&connp->conn_lock);
17274 	ire = connp->conn_ire_cache;
17275 	if (ire != NULL && (ire->ire_marks & IRE_MARK_CONDEMNED)) {
17276 		connp->conn_ire_cache = NULL;
17277 		mutex_exit(&connp->conn_lock);
17278 		IRE_REFRELE_NOTR(ire);
17279 		return;
17280 	}
17281 	mutex_exit(&connp->conn_lock);
17282 }
17283 
17284 /*
17285  * Take down a specific interface, but don't lose any information about it.
17286  * Also delete interface from its interface group (ifgrp).
17287  * (Always called as writer.)
17288  * This function goes through the down sequence even if the interface is
17289  * already down. There are 2 reasons.
17290  * a. Currently we permit interface routes that depend on down interfaces
17291  *    to be added. This behaviour itself is questionable. However it appears
17292  *    that both Solaris and 4.3 BSD have exhibited this behaviour for a long
17293  *    time. We go thru the cleanup in order to remove these routes.
17294  * b. The bringup of the interface could fail in ill_dl_up i.e. we get
17295  *    DL_ERROR_ACK in response to the the DL_BIND request. The interface is
17296  *    down, but we need to cleanup i.e. do ill_dl_down and
17297  *    ip_rput_dlpi_writer (DL_ERROR_ACK) -> ipif_down.
17298  *
17299  * IP-MT notes:
17300  *
17301  * Model of reference to interfaces.
17302  *
17303  * The following members in ipif_t track references to the ipif.
17304  *	int     ipif_refcnt;    Active reference count
17305  *	uint_t  ipif_ire_cnt;   Number of ire's referencing this ipif
17306  * The following members in ill_t track references to the ill.
17307  *	int             ill_refcnt;     active refcnt
17308  *	uint_t          ill_ire_cnt;	Number of ires referencing ill
17309  *	uint_t          ill_nce_cnt;	Number of nces referencing ill
17310  *
17311  * Reference to an ipif or ill can be obtained in any of the following ways.
17312  *
17313  * Through the lookup functions ipif_lookup_* / ill_lookup_* functions
17314  * Pointers to ipif / ill from other data structures viz ire and conn.
17315  * Implicit reference to the ipif / ill by holding a reference to the ire.
17316  *
17317  * The ipif/ill lookup functions return a reference held ipif / ill.
17318  * ipif_refcnt and ill_refcnt track the reference counts respectively.
17319  * This is a purely dynamic reference count associated with threads holding
17320  * references to the ipif / ill. Pointers from other structures do not
17321  * count towards this reference count.
17322  *
17323  * ipif_ire_cnt/ill_ire_cnt is the number of ire's associated with the
17324  * ipif/ill. This is incremented whenever a new ire is created referencing the
17325  * ipif/ill. This is done atomically inside ire_add_v[46] where the ire is
17326  * actually added to the ire hash table. The count is decremented in
17327  * ire_inactive where the ire is destroyed.
17328  *
17329  * nce's reference ill's thru nce_ill and the count of nce's associated with
17330  * an ill is recorded in ill_nce_cnt. This is incremented atomically in
17331  * ndp_add() where the nce is actually added to the table. Similarly it is
17332  * decremented in ndp_inactive where the nce is destroyed.
17333  *
17334  * Flow of ioctls involving interface down/up
17335  *
17336  * The following is the sequence of an attempt to set some critical flags on an
17337  * up interface.
17338  * ip_sioctl_flags
17339  * ipif_down
17340  * wait for ipif to be quiescent
17341  * ipif_down_tail
17342  * ip_sioctl_flags_tail
17343  *
17344  * All set ioctls that involve down/up sequence would have a skeleton similar
17345  * to the above. All the *tail functions are called after the refcounts have
17346  * dropped to the appropriate values.
17347  *
17348  * The mechanism to quiesce an ipif is as follows.
17349  *
17350  * Mark the ipif as IPIF_CHANGING. No more lookups will be allowed
17351  * on the ipif. Callers either pass a flag requesting wait or the lookup
17352  *  functions will return NULL.
17353  *
17354  * Delete all ires referencing this ipif
17355  *
17356  * Any thread attempting to do an ipif_refhold on an ipif that has been
17357  * obtained thru a cached pointer will first make sure that
17358  * the ipif can be refheld using the macro IPIF_CAN_LOOKUP and only then
17359  * increment the refcount.
17360  *
17361  * The above guarantees that the ipif refcount will eventually come down to
17362  * zero and the ipif will quiesce, once all threads that currently hold a
17363  * reference to the ipif refrelease the ipif. The ipif is quiescent after the
17364  * ipif_refcount has dropped to zero and all ire's associated with this ipif
17365  * have also been ire_inactive'd. i.e. when ipif_ire_cnt and ipif_refcnt both
17366  * drop to zero.
17367  *
17368  * Lookups during the IPIF_CHANGING/ILL_CHANGING interval.
17369  *
17370  * Threads trying to lookup an ipif or ill can pass a flag requesting
17371  * wait and restart if the ipif / ill cannot be looked up currently.
17372  * For eg. bind, and route operations (Eg. route add / delete) cannot return
17373  * failure if the ipif is currently undergoing an exclusive operation, and
17374  * hence pass the flag. The mblk is then enqueued in the ipsq and the operation
17375  * is restarted by ipsq_exit() when the currently exclusive ioctl completes.
17376  * The lookup and enqueue is atomic using the ill_lock and ipsq_lock. The
17377  * lookup is done holding the ill_lock. Hence the ill/ipif state flags can't
17378  * change while the ill_lock is held. Before dropping the ill_lock we acquire
17379  * the ipsq_lock and call ipsq_enq. This ensures that ipsq_exit can't finish
17380  * until we release the ipsq_lock, even though the the ill/ipif state flags
17381  * can change after we drop the ill_lock.
17382  *
17383  * An attempt to send out a packet using an ipif that is currently
17384  * IPIF_CHANGING will fail. No attempt is made in this case to enqueue this
17385  * operation and restart it later when the exclusive condition on the ipif ends.
17386  * This is an example of not passing the wait flag to the lookup functions. For
17387  * example an attempt to refhold and use conn->conn_multicast_ipif and send
17388  * out a multicast packet on that ipif will fail while the ipif is
17389  * IPIF_CHANGING. An attempt to create an IRE_CACHE using an ipif that is
17390  * currently IPIF_CHANGING will also fail.
17391  */
17392 int
17393 ipif_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
17394 {
17395 	ill_t		*ill = ipif->ipif_ill;
17396 	phyint_t	*phyi;
17397 	conn_t		*connp;
17398 	boolean_t	success;
17399 	boolean_t	ipif_was_up = B_FALSE;
17400 
17401 	ASSERT(IAM_WRITER_IPIF(ipif));
17402 
17403 	ip1dbg(("ipif_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
17404 
17405 	if (ipif->ipif_flags & IPIF_UP) {
17406 		mutex_enter(&ill->ill_lock);
17407 		ipif->ipif_flags &= ~IPIF_UP;
17408 		ASSERT(ill->ill_ipif_up_count > 0);
17409 		--ill->ill_ipif_up_count;
17410 		mutex_exit(&ill->ill_lock);
17411 		ipif_was_up = B_TRUE;
17412 		/* Update status in SCTP's list */
17413 		sctp_update_ipif(ipif, SCTP_IPIF_DOWN);
17414 	}
17415 
17416 	/*
17417 	 * Blow away v6 memberships we established in ipif_multicast_up(); the
17418 	 * v4 ones are left alone (as is the ipif_multicast_up flag, so we
17419 	 * know not to rejoin when the interface is brought back up).
17420 	 */
17421 	if (ipif->ipif_isv6)
17422 		ipif_multicast_down(ipif);
17423 	/*
17424 	 * Remove from the mapping for __sin6_src_id. We insert only
17425 	 * when the address is not INADDR_ANY. As IPv4 addresses are
17426 	 * stored as mapped addresses, we need to check for mapped
17427 	 * INADDR_ANY also.
17428 	 */
17429 	if (ipif_was_up && !IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
17430 	    !IN6_IS_ADDR_V4MAPPED_ANY(&ipif->ipif_v6lcl_addr) &&
17431 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
17432 		int err;
17433 
17434 		err = ip_srcid_remove(&ipif->ipif_v6lcl_addr,
17435 		    ipif->ipif_zoneid);
17436 		if (err != 0) {
17437 			ip0dbg(("ipif_down: srcid_remove %d\n", err));
17438 		}
17439 	}
17440 
17441 	/*
17442 	 * Before we delete the ill from the group (if any), we need
17443 	 * to make sure that we delete all the routes dependent on
17444 	 * this and also any ipifs dependent on this ipif for
17445 	 * source address. We need to do before we delete from
17446 	 * the group because
17447 	 *
17448 	 * 1) ipif_down_delete_ire de-references ill->ill_group.
17449 	 *
17450 	 * 2) ipif_update_other_ipifs needs to walk the whole group
17451 	 *    for re-doing source address selection. Note that
17452 	 *    ipif_select_source[_v6] called from
17453 	 *    ipif_update_other_ipifs[_v6] will not pick this ipif
17454 	 *    because we have already marked down here i.e cleared
17455 	 *    IPIF_UP.
17456 	 */
17457 	if (ipif->ipif_isv6)
17458 		ire_walk_v6(ipif_down_delete_ire, (char *)ipif, ALL_ZONES);
17459 	else
17460 		ire_walk_v4(ipif_down_delete_ire, (char *)ipif, ALL_ZONES);
17461 
17462 	/*
17463 	 * Need to add these also to be saved and restored when the
17464 	 * ipif is brought down and up
17465 	 */
17466 	mutex_enter(&ire_mrtun_lock);
17467 	if (ire_mrtun_count != 0) {
17468 		mutex_exit(&ire_mrtun_lock);
17469 		ire_walk_ill_mrtun(0, 0, ipif_down_delete_ire,
17470 		    (char *)ipif, NULL);
17471 	} else {
17472 		mutex_exit(&ire_mrtun_lock);
17473 	}
17474 
17475 	mutex_enter(&ire_srcif_table_lock);
17476 	if (ire_srcif_table_count > 0) {
17477 		mutex_exit(&ire_srcif_table_lock);
17478 		ire_walk_srcif_table_v4(ipif_down_delete_ire, (char *)ipif);
17479 	} else {
17480 		mutex_exit(&ire_srcif_table_lock);
17481 	}
17482 
17483 	/*
17484 	 * Cleaning up the conn_ire_cache or conns must be done only after the
17485 	 * ires have been deleted above. Otherwise a thread could end up
17486 	 * caching an ire in a conn after we have finished the cleanup of the
17487 	 * conn. The caching is done after making sure that the ire is not yet
17488 	 * condemned. Also documented in the block comment above ip_output
17489 	 */
17490 	ipcl_walk(conn_cleanup_stale_ire, NULL);
17491 	/* Also, delete the ires cached in SCTP */
17492 	sctp_ire_cache_flush(ipif);
17493 
17494 	/* Resolve any IPsec/IKE NAT-T instances that depend on this ipif. */
17495 	nattymod_clean_ipif(ipif);
17496 
17497 	/*
17498 	 * Update any other ipifs which have used "our" local address as
17499 	 * a source address. This entails removing and recreating IRE_INTERFACE
17500 	 * entries for such ipifs.
17501 	 */
17502 	if (ipif->ipif_isv6)
17503 		ipif_update_other_ipifs_v6(ipif, ill->ill_group);
17504 	else
17505 		ipif_update_other_ipifs(ipif, ill->ill_group);
17506 
17507 	if (ipif_was_up) {
17508 		/*
17509 		 * Check whether it is last ipif to leave this group.
17510 		 * If this is the last ipif to leave, we should remove
17511 		 * this ill from the group as ipif_select_source will not
17512 		 * be able to find any useful ipifs if this ill is selected
17513 		 * for load balancing.
17514 		 *
17515 		 * For nameless groups, we should call ifgrp_delete if this
17516 		 * belongs to some group. As this ipif is going down, we may
17517 		 * need to reconstruct groups.
17518 		 */
17519 		phyi = ill->ill_phyint;
17520 		/*
17521 		 * If the phyint_groupname_len is 0, it may or may not
17522 		 * be in the nameless group. If the phyint_groupname_len is
17523 		 * not 0, then this ill should be part of some group.
17524 		 * As we always insert this ill in the group if
17525 		 * phyint_groupname_len is not zero when the first ipif
17526 		 * comes up (in ipif_up_done), it should be in a group
17527 		 * when the namelen is not 0.
17528 		 *
17529 		 * NOTE : When we delete the ill from the group,it will
17530 		 * blow away all the IRE_CACHES pointing either at this ipif or
17531 		 * ill_wq (illgrp_cache_delete does this). Thus, no IRES
17532 		 * should be pointing at this ill.
17533 		 */
17534 		ASSERT(phyi->phyint_groupname_len == 0 ||
17535 		    (phyi->phyint_groupname != NULL && ill->ill_group != NULL));
17536 
17537 		if (phyi->phyint_groupname_len != 0) {
17538 			if (ill->ill_ipif_up_count == 0)
17539 				illgrp_delete(ill);
17540 		}
17541 
17542 		/*
17543 		 * If we have deleted some of the broadcast ires associated
17544 		 * with this ipif, we need to re-nominate somebody else if
17545 		 * the ires that we deleted were the nominated ones.
17546 		 */
17547 		if (ill->ill_group != NULL && !ill->ill_isv6)
17548 			ipif_renominate_bcast(ipif);
17549 	}
17550 
17551 	if (ipif->ipif_isv6)
17552 		ipif_ndp_down(ipif);
17553 
17554 	/*
17555 	 * If mp is NULL the caller will wait for the appropriate refcnt.
17556 	 * Eg. ip_sioctl_removeif -> ipif_free  -> ipif_down
17557 	 * and ill_delete -> ipif_free -> ipif_down
17558 	 */
17559 	if (mp == NULL) {
17560 		ASSERT(q == NULL);
17561 		return (0);
17562 	}
17563 
17564 	if (CONN_Q(q)) {
17565 		connp = Q_TO_CONN(q);
17566 		mutex_enter(&connp->conn_lock);
17567 	} else {
17568 		connp = NULL;
17569 	}
17570 	mutex_enter(&ill->ill_lock);
17571 	/*
17572 	 * Are there any ire's pointing to this ipif that are still active ?
17573 	 * If this is the last ipif going down, are there any ire's pointing
17574 	 * to this ill that are still active ?
17575 	 */
17576 	if (ipif_is_quiescent(ipif)) {
17577 		mutex_exit(&ill->ill_lock);
17578 		if (connp != NULL)
17579 			mutex_exit(&connp->conn_lock);
17580 		return (0);
17581 	}
17582 
17583 	ip1dbg(("ipif_down: need to wait, adding pending mp %s ill %p",
17584 	    ill->ill_name, (void *)ill));
17585 	/*
17586 	 * Enqueue the mp atomically in ipsq_pending_mp. When the refcount
17587 	 * drops down, the operation will be restarted by ipif_ill_refrele_tail
17588 	 * which in turn is called by the last refrele on the ipif/ill/ire.
17589 	 */
17590 	success = ipsq_pending_mp_add(connp, ipif, q, mp, IPIF_DOWN);
17591 	if (!success) {
17592 		/* The conn is closing. So just return */
17593 		ASSERT(connp != NULL);
17594 		mutex_exit(&ill->ill_lock);
17595 		mutex_exit(&connp->conn_lock);
17596 		return (EINTR);
17597 	}
17598 
17599 	mutex_exit(&ill->ill_lock);
17600 	if (connp != NULL)
17601 		mutex_exit(&connp->conn_lock);
17602 	return (EINPROGRESS);
17603 }
17604 
17605 static void
17606 ipif_down_tail(ipif_t *ipif)
17607 {
17608 	ill_t	*ill = ipif->ipif_ill;
17609 
17610 	/*
17611 	 * Skip any loopback interface (null wq).
17612 	 * If this is the last logical interface on the ill
17613 	 * have ill_dl_down tell the driver we are gone (unbind)
17614 	 * Note that lun 0 can ipif_down even though
17615 	 * there are other logical units that are up.
17616 	 * This occurs e.g. when we change a "significant" IFF_ flag.
17617 	 */
17618 	if (ipif->ipif_ill->ill_wq != NULL) {
17619 		if (!ill->ill_logical_down && (ill->ill_ipif_up_count == 0) &&
17620 		    ill->ill_dl_up) {
17621 			ill_dl_down(ill);
17622 		}
17623 	}
17624 	ill->ill_logical_down = 0;
17625 
17626 	/*
17627 	 * Have to be after removing the routes in ipif_down_delete_ire.
17628 	 */
17629 	if (ipif->ipif_isv6) {
17630 		if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV)
17631 			ipif_arp_down(ipif);
17632 	} else {
17633 		ipif_arp_down(ipif);
17634 	}
17635 
17636 	ip_rts_ifmsg(ipif);
17637 	ip_rts_newaddrmsg(RTM_DELETE, 0, ipif);
17638 }
17639 
17640 /*
17641  * Bring interface logically down without bringing the physical interface
17642  * down e.g. when the netmask is changed. This avoids long lasting link
17643  * negotiations between an ethernet interface and a certain switches.
17644  */
17645 static int
17646 ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
17647 {
17648 	/*
17649 	 * The ill_logical_down flag is a transient flag. It is set here
17650 	 * and is cleared once the down has completed in ipif_down_tail.
17651 	 * This flag does not indicate whether the ill stream is in the
17652 	 * DL_BOUND state with the driver. Instead this flag is used by
17653 	 * ipif_down_tail to determine whether to DL_UNBIND the stream with
17654 	 * the driver. The state of the ill stream i.e. whether it is
17655 	 * DL_BOUND with the driver or not is indicated by the ill_dl_up flag.
17656 	 */
17657 	ipif->ipif_ill->ill_logical_down = 1;
17658 	return (ipif_down(ipif, q, mp));
17659 }
17660 
17661 /*
17662  * This is called when the SIOCSLIFUSESRC ioctl is processed in IP.
17663  * If the usesrc client ILL is already part of a usesrc group or not,
17664  * in either case a ire_stq with the matching usesrc client ILL will
17665  * locate the IRE's that need to be deleted. We want IREs to be created
17666  * with the new source address.
17667  */
17668 static void
17669 ipif_delete_cache_ire(ire_t *ire, char *ill_arg)
17670 {
17671 	ill_t	*ucill = (ill_t *)ill_arg;
17672 
17673 	ASSERT(IAM_WRITER_ILL(ucill));
17674 
17675 	if (ire->ire_stq == NULL)
17676 		return;
17677 
17678 	if ((ire->ire_type == IRE_CACHE) &&
17679 	    ((ill_t *)ire->ire_stq->q_ptr == ucill))
17680 		ire_delete(ire);
17681 }
17682 
17683 /*
17684  * ire_walk routine to delete every IRE dependent on the interface
17685  * address that is going down.	(Always called as writer.)
17686  * Works for both v4 and v6.
17687  * In addition for checking for ire_ipif matches it also checks for
17688  * IRE_CACHE entries which have the same source address as the
17689  * disappearing ipif since ipif_select_source might have picked
17690  * that source. Note that ipif_down/ipif_update_other_ipifs takes
17691  * care of any IRE_INTERFACE with the disappearing source address.
17692  */
17693 static void
17694 ipif_down_delete_ire(ire_t *ire, char *ipif_arg)
17695 {
17696 	ipif_t	*ipif = (ipif_t *)ipif_arg;
17697 	ill_t *ire_ill;
17698 	ill_t *ipif_ill;
17699 
17700 	ASSERT(IAM_WRITER_IPIF(ipif));
17701 	if (ire->ire_ipif == NULL)
17702 		return;
17703 
17704 	/*
17705 	 * For IPv4, we derive source addresses for an IRE from ipif's
17706 	 * belonging to the same IPMP group as the IRE's outgoing
17707 	 * interface.  If an IRE's outgoing interface isn't in the
17708 	 * same IPMP group as a particular ipif, then that ipif
17709 	 * couldn't have been used as a source address for this IRE.
17710 	 *
17711 	 * For IPv6, source addresses are only restricted to the IPMP group
17712 	 * if the IRE is for a link-local address or a multicast address.
17713 	 * Otherwise, source addresses for an IRE can be chosen from
17714 	 * interfaces other than the the outgoing interface for that IRE.
17715 	 *
17716 	 * For source address selection details, see ipif_select_source()
17717 	 * and ipif_select_source_v6().
17718 	 */
17719 	if (ire->ire_ipversion == IPV4_VERSION ||
17720 	    IN6_IS_ADDR_LINKLOCAL(&ire->ire_addr_v6) ||
17721 	    IN6_IS_ADDR_MULTICAST(&ire->ire_addr_v6)) {
17722 		ire_ill = ire->ire_ipif->ipif_ill;
17723 		ipif_ill = ipif->ipif_ill;
17724 
17725 		if (ire_ill->ill_group != ipif_ill->ill_group) {
17726 			return;
17727 		}
17728 	}
17729 
17730 
17731 	if (ire->ire_ipif != ipif) {
17732 		/*
17733 		 * Look for a matching source address.
17734 		 */
17735 		if (ire->ire_type != IRE_CACHE)
17736 			return;
17737 		if (ipif->ipif_flags & IPIF_NOLOCAL)
17738 			return;
17739 
17740 		if (ire->ire_ipversion == IPV4_VERSION) {
17741 			if (ire->ire_src_addr != ipif->ipif_src_addr)
17742 				return;
17743 		} else {
17744 			if (!IN6_ARE_ADDR_EQUAL(&ire->ire_src_addr_v6,
17745 			    &ipif->ipif_v6lcl_addr))
17746 				return;
17747 		}
17748 		ire_delete(ire);
17749 		return;
17750 	}
17751 	/*
17752 	 * ire_delete() will do an ire_flush_cache which will delete
17753 	 * all ire_ipif matches
17754 	 */
17755 	ire_delete(ire);
17756 }
17757 
17758 /*
17759  * ire_walk_ill function for deleting all IRE_CACHE entries for an ill when
17760  * 1) an ipif (on that ill) changes the IPIF_DEPRECATED flags, or
17761  * 2) when an interface is brought up or down (on that ill).
17762  * This ensures that the IRE_CACHE entries don't retain stale source
17763  * address selection results.
17764  */
17765 void
17766 ill_ipif_cache_delete(ire_t *ire, char *ill_arg)
17767 {
17768 	ill_t	*ill = (ill_t *)ill_arg;
17769 	ill_t	*ipif_ill;
17770 
17771 	ASSERT(IAM_WRITER_ILL(ill));
17772 	/*
17773 	 * We use MATCH_IRE_TYPE/IRE_CACHE while calling ire_walk_ill_v4.
17774 	 * Hence this should be IRE_CACHE.
17775 	 */
17776 	ASSERT(ire->ire_type == IRE_CACHE);
17777 
17778 	/*
17779 	 * We are called for IRE_CACHES whose ire_ipif matches ill.
17780 	 * We are only interested in IRE_CACHES that has borrowed
17781 	 * the source address from ill_arg e.g. ipif_up_done[_v6]
17782 	 * for which we need to look at ire_ipif->ipif_ill match
17783 	 * with ill.
17784 	 */
17785 	ASSERT(ire->ire_ipif != NULL);
17786 	ipif_ill = ire->ire_ipif->ipif_ill;
17787 	if (ipif_ill == ill || (ill->ill_group != NULL &&
17788 	    ipif_ill->ill_group == ill->ill_group)) {
17789 		ire_delete(ire);
17790 	}
17791 }
17792 
17793 /*
17794  * Delete all the ire whose stq references ill_arg.
17795  */
17796 static void
17797 ill_stq_cache_delete(ire_t *ire, char *ill_arg)
17798 {
17799 	ill_t	*ill = (ill_t *)ill_arg;
17800 	ill_t	*ire_ill;
17801 
17802 	ASSERT(IAM_WRITER_ILL(ill));
17803 	/*
17804 	 * We use MATCH_IRE_TYPE/IRE_CACHE while calling ire_walk_ill_v4.
17805 	 * Hence this should be IRE_CACHE.
17806 	 */
17807 	ASSERT(ire->ire_type == IRE_CACHE);
17808 
17809 	/*
17810 	 * We are called for IRE_CACHES whose ire_stq and ire_ipif
17811 	 * matches ill. We are only interested in IRE_CACHES that
17812 	 * has ire_stq->q_ptr pointing at ill_arg. Thus we do the
17813 	 * filtering here.
17814 	 */
17815 	ire_ill = (ill_t *)ire->ire_stq->q_ptr;
17816 
17817 	if (ire_ill == ill)
17818 		ire_delete(ire);
17819 }
17820 
17821 /*
17822  * This is called when an ill leaves the group. We want to delete
17823  * all IRE_CACHES whose stq is pointing at ill_wq or ire_ipif is
17824  * pointing at ill.
17825  */
17826 static void
17827 illgrp_cache_delete(ire_t *ire, char *ill_arg)
17828 {
17829 	ill_t	*ill = (ill_t *)ill_arg;
17830 
17831 	ASSERT(IAM_WRITER_ILL(ill));
17832 	ASSERT(ill->ill_group == NULL);
17833 	/*
17834 	 * We use MATCH_IRE_TYPE/IRE_CACHE while calling ire_walk_ill_v4.
17835 	 * Hence this should be IRE_CACHE.
17836 	 */
17837 	ASSERT(ire->ire_type == IRE_CACHE);
17838 	/*
17839 	 * We are called for IRE_CACHES whose ire_stq and ire_ipif
17840 	 * matches ill. We are interested in both.
17841 	 */
17842 	ASSERT((ill == (ill_t *)ire->ire_stq->q_ptr) ||
17843 	    (ire->ire_ipif->ipif_ill == ill));
17844 
17845 	ire_delete(ire);
17846 }
17847 
17848 /*
17849  * Initiate deallocate of an IPIF. Always called as writer. Called by
17850  * ill_delete or ip_sioctl_removeif.
17851  */
17852 static void
17853 ipif_free(ipif_t *ipif)
17854 {
17855 	ASSERT(IAM_WRITER_IPIF(ipif));
17856 
17857 	/* Remove conn references */
17858 	reset_conn_ipif(ipif);
17859 
17860 	/*
17861 	 * Make sure we have valid net and subnet broadcast ire's for the
17862 	 * other ipif's which share them with this ipif.
17863 	 */
17864 	if (!ipif->ipif_isv6)
17865 		ipif_check_bcast_ires(ipif);
17866 
17867 	/*
17868 	 * Take down the interface. We can be called either from ill_delete
17869 	 * or from ip_sioctl_removeif.
17870 	 */
17871 	(void) ipif_down(ipif, NULL, NULL);
17872 
17873 	rw_enter(&ill_g_lock, RW_WRITER);
17874 	/* Remove pointers to this ill in the multicast routing tables */
17875 	reset_mrt_vif_ipif(ipif);
17876 	rw_exit(&ill_g_lock);
17877 }
17878 
17879 static void
17880 ipif_free_tail(ipif_t *ipif)
17881 {
17882 	mblk_t	*mp;
17883 	ipif_t	**ipifp;
17884 
17885 	/*
17886 	 * Free state for addition IRE_IF_[NO]RESOLVER ire's.
17887 	 */
17888 	mutex_enter(&ipif->ipif_saved_ire_lock);
17889 	mp = ipif->ipif_saved_ire_mp;
17890 	ipif->ipif_saved_ire_mp = NULL;
17891 	mutex_exit(&ipif->ipif_saved_ire_lock);
17892 	freemsg(mp);
17893 
17894 	/*
17895 	 * Need to hold both ill_g_lock and ill_lock while
17896 	 * inserting or removing an ipif from the linked list
17897 	 * of ipifs hanging off the ill.
17898 	 */
17899 	rw_enter(&ill_g_lock, RW_WRITER);
17900 	/*
17901 	 * Remove all multicast memberships on the interface now.
17902 	 * This removes IPv4 multicast memberships joined within
17903 	 * the kernel as ipif_down does not do ipif_multicast_down
17904 	 * for IPv4. IPv6 is not handled here as the multicast memberships
17905 	 * are based on ill and not on ipif.
17906 	 */
17907 	ilm_free(ipif);
17908 
17909 	/*
17910 	 * Since we held the ill_g_lock while doing the ilm_free above,
17911 	 * we can assert the ilms were really deleted and not just marked
17912 	 * ILM_DELETED.
17913 	 */
17914 	ASSERT(ilm_walk_ipif(ipif) == 0);
17915 
17916 
17917 	IPIF_TRACE_CLEANUP(ipif);
17918 
17919 	/* Ask SCTP to take it out of it list */
17920 	sctp_update_ipif(ipif, SCTP_IPIF_REMOVE);
17921 
17922 	mutex_enter(&ipif->ipif_ill->ill_lock);
17923 	/* Get it out of the ILL interface list. */
17924 	ipifp = &ipif->ipif_ill->ill_ipif;
17925 	for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
17926 		if (*ipifp == ipif) {
17927 			*ipifp = ipif->ipif_next;
17928 			break;
17929 		}
17930 	}
17931 
17932 	mutex_exit(&ipif->ipif_ill->ill_lock);
17933 	rw_exit(&ill_g_lock);
17934 
17935 	mutex_destroy(&ipif->ipif_saved_ire_lock);
17936 	/* Free the memory. */
17937 	mi_free((char *)ipif);
17938 }
17939 
17940 /*
17941  * Returns an ipif name in the form "ill_name/unit" if ipif_id is not zero,
17942  * "ill_name" otherwise.
17943  */
17944 char *
17945 ipif_get_name(ipif_t *ipif, char *buf, int len)
17946 {
17947 	char	lbuf[32];
17948 	char	*name;
17949 	size_t	name_len;
17950 
17951 	buf[0] = '\0';
17952 	if (!ipif)
17953 		return (buf);
17954 	name = ipif->ipif_ill->ill_name;
17955 	name_len = ipif->ipif_ill->ill_name_length;
17956 	if (ipif->ipif_id != 0) {
17957 		(void) sprintf(lbuf, "%s%c%d", name, IPIF_SEPARATOR_CHAR,
17958 		    ipif->ipif_id);
17959 		name = lbuf;
17960 		name_len = mi_strlen(name) + 1;
17961 	}
17962 	len -= 1;
17963 	buf[len] = '\0';
17964 	len = MIN(len, name_len);
17965 	bcopy(name, buf, len);
17966 	return (buf);
17967 }
17968 
17969 /*
17970  * Find an IPIF based on the name passed in.  Names can be of the
17971  * form <phys> (e.g., le0), <phys>:<#> (e.g., le0:1),
17972  * The <phys> string can have forms like <dev><#> (e.g., le0),
17973  * <dev><#>.<module> (e.g. le0.foo), or <dev>.<module><#> (e.g. ip.tun3).
17974  * When there is no colon, the implied unit id is zero. <phys> must
17975  * correspond to the name of an ILL.  (May be called as writer.)
17976  */
17977 static ipif_t *
17978 ipif_lookup_on_name(char *name, size_t namelen, boolean_t do_alloc,
17979     boolean_t *exists, boolean_t isv6, zoneid_t zoneid, queue_t *q,
17980     mblk_t *mp, ipsq_func_t func, int *error)
17981 {
17982 	char	*cp;
17983 	char	*endp;
17984 	long	id;
17985 	ill_t	*ill;
17986 	ipif_t	*ipif;
17987 	uint_t	ire_type;
17988 	boolean_t did_alloc = B_FALSE;
17989 	ipsq_t	*ipsq;
17990 
17991 	if (error != NULL)
17992 		*error = 0;
17993 
17994 	/*
17995 	 * If the caller wants to us to create the ipif, make sure we have a
17996 	 * valid zoneid
17997 	 */
17998 	ASSERT(!do_alloc || zoneid != ALL_ZONES);
17999 
18000 	if (namelen == 0) {
18001 		if (error != NULL)
18002 			*error = ENXIO;
18003 		return (NULL);
18004 	}
18005 
18006 	*exists = B_FALSE;
18007 	/* Look for a colon in the name. */
18008 	endp = &name[namelen];
18009 	for (cp = endp; --cp > name; ) {
18010 		if (*cp == IPIF_SEPARATOR_CHAR)
18011 			break;
18012 	}
18013 
18014 	if (*cp == IPIF_SEPARATOR_CHAR) {
18015 		/*
18016 		 * Reject any non-decimal aliases for logical
18017 		 * interfaces. Aliases with leading zeroes
18018 		 * are also rejected as they introduce ambiguity
18019 		 * in the naming of the interfaces.
18020 		 * In order to confirm with existing semantics,
18021 		 * and to not break any programs/script relying
18022 		 * on that behaviour, if<0>:0 is considered to be
18023 		 * a valid interface.
18024 		 *
18025 		 * If alias has two or more digits and the first
18026 		 * is zero, fail.
18027 		 */
18028 		if (&cp[2] < endp && cp[1] == '0')
18029 			return (NULL);
18030 	}
18031 
18032 	if (cp <= name) {
18033 		cp = endp;
18034 	} else {
18035 		*cp = '\0';
18036 	}
18037 
18038 	/*
18039 	 * Look up the ILL, based on the portion of the name
18040 	 * before the slash. ill_lookup_on_name returns a held ill.
18041 	 * Temporary to check whether ill exists already. If so
18042 	 * ill_lookup_on_name will clear it.
18043 	 */
18044 	ill = ill_lookup_on_name(name, do_alloc, isv6,
18045 	    q, mp, func, error, &did_alloc);
18046 	if (cp != endp)
18047 		*cp = IPIF_SEPARATOR_CHAR;
18048 	if (ill == NULL)
18049 		return (NULL);
18050 
18051 	/* Establish the unit number in the name. */
18052 	id = 0;
18053 	if (cp < endp && *endp == '\0') {
18054 		/* If there was a colon, the unit number follows. */
18055 		cp++;
18056 		if (ddi_strtol(cp, NULL, 0, &id) != 0) {
18057 			ill_refrele(ill);
18058 			if (error != NULL)
18059 				*error = ENXIO;
18060 			return (NULL);
18061 		}
18062 	}
18063 
18064 	GRAB_CONN_LOCK(q);
18065 	mutex_enter(&ill->ill_lock);
18066 	/* Now see if there is an IPIF with this unit number. */
18067 	for (ipif = ill->ill_ipif; ipif; ipif = ipif->ipif_next) {
18068 		if (ipif->ipif_id == id) {
18069 			if (zoneid != ALL_ZONES &&
18070 			    zoneid != ipif->ipif_zoneid) {
18071 				mutex_exit(&ill->ill_lock);
18072 				RELEASE_CONN_LOCK(q);
18073 				ill_refrele(ill);
18074 				if (error != NULL)
18075 					*error = ENXIO;
18076 				return (NULL);
18077 			}
18078 			/*
18079 			 * The block comment at the start of ipif_down
18080 			 * explains the use of the macros used below
18081 			 */
18082 			if (IPIF_CAN_LOOKUP(ipif)) {
18083 				ipif_refhold_locked(ipif);
18084 				mutex_exit(&ill->ill_lock);
18085 				if (!did_alloc)
18086 					*exists = B_TRUE;
18087 				/*
18088 				 * Drop locks before calling ill_refrele
18089 				 * since it can potentially call into
18090 				 * ipif_ill_refrele_tail which can end up
18091 				 * in trying to acquire any lock.
18092 				 */
18093 				RELEASE_CONN_LOCK(q);
18094 				ill_refrele(ill);
18095 				return (ipif);
18096 			} else if (IPIF_CAN_WAIT(ipif, q)) {
18097 				ipsq = ill->ill_phyint->phyint_ipsq;
18098 				mutex_enter(&ipsq->ipsq_lock);
18099 				mutex_exit(&ill->ill_lock);
18100 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
18101 				mutex_exit(&ipsq->ipsq_lock);
18102 				RELEASE_CONN_LOCK(q);
18103 				ill_refrele(ill);
18104 				*error = EINPROGRESS;
18105 				return (NULL);
18106 			}
18107 		}
18108 	}
18109 	RELEASE_CONN_LOCK(q);
18110 
18111 	if (!do_alloc) {
18112 		mutex_exit(&ill->ill_lock);
18113 		ill_refrele(ill);
18114 		if (error != NULL)
18115 			*error = ENXIO;
18116 		return (NULL);
18117 	}
18118 
18119 	/*
18120 	 * If none found, atomically allocate and return a new one.
18121 	 * Historically, we used IRE_LOOPBACK only for lun 0, and IRE_LOCAL
18122 	 * to support "receive only" use of lo0:1 etc. as is still done
18123 	 * below as an initial guess.
18124 	 * However, this is now likely to be overriden later in ipif_up_done()
18125 	 * when we know for sure what address has been configured on the
18126 	 * interface, since we might have more than one loopback interface
18127 	 * with a loopback address, e.g. in the case of zones, and all the
18128 	 * interfaces with loopback addresses need to be marked IRE_LOOPBACK.
18129 	 */
18130 	if (ill->ill_net_type == IRE_LOOPBACK && id == 0)
18131 		ire_type = IRE_LOOPBACK;
18132 	else
18133 		ire_type = IRE_LOCAL;
18134 	ipif = ipif_allocate(ill, id, ire_type, B_TRUE);
18135 	if (ipif != NULL)
18136 		ipif_refhold_locked(ipif);
18137 	else if (error != NULL)
18138 		*error = ENOMEM;
18139 	mutex_exit(&ill->ill_lock);
18140 	ill_refrele(ill);
18141 	return (ipif);
18142 }
18143 
18144 /*
18145  * This routine is called whenever a new address comes up on an ipif.  If
18146  * we are configured to respond to address mask requests, then we are supposed
18147  * to broadcast an address mask reply at this time.  This routine is also
18148  * called if we are already up, but a netmask change is made.  This is legal
18149  * but might not make the system manager very popular.	(May be called
18150  * as writer.)
18151  */
18152 static void
18153 ipif_mask_reply(ipif_t *ipif)
18154 {
18155 	icmph_t	*icmph;
18156 	ipha_t	*ipha;
18157 	mblk_t	*mp;
18158 
18159 #define	REPLY_LEN	(sizeof (icmp_ipha) + sizeof (icmph_t) + IP_ADDR_LEN)
18160 
18161 	if (!ip_respond_to_address_mask_broadcast)
18162 		return;
18163 
18164 	/* ICMP mask reply is IPv4 only */
18165 	ASSERT(!ipif->ipif_isv6);
18166 	/* ICMP mask reply is not for a loopback interface */
18167 	ASSERT(ipif->ipif_ill->ill_wq != NULL);
18168 
18169 	mp = allocb(REPLY_LEN, BPRI_HI);
18170 	if (mp == NULL)
18171 		return;
18172 	mp->b_wptr = mp->b_rptr + REPLY_LEN;
18173 
18174 	ipha = (ipha_t *)mp->b_rptr;
18175 	bzero(ipha, REPLY_LEN);
18176 	*ipha = icmp_ipha;
18177 	ipha->ipha_ttl = ip_broadcast_ttl;
18178 	ipha->ipha_src = ipif->ipif_src_addr;
18179 	ipha->ipha_dst = ipif->ipif_brd_addr;
18180 	ipha->ipha_length = htons(REPLY_LEN);
18181 	ipha->ipha_ident = 0;
18182 
18183 	icmph = (icmph_t *)&ipha[1];
18184 	icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY;
18185 	bcopy(&ipif->ipif_net_mask, &icmph[1], IP_ADDR_LEN);
18186 	icmph->icmph_checksum = IP_CSUM(mp, sizeof (ipha_t), 0);
18187 	if (icmph->icmph_checksum == 0)
18188 		icmph->icmph_checksum = 0xffff;
18189 
18190 	put(ipif->ipif_wq, mp);
18191 
18192 #undef	REPLY_LEN
18193 }
18194 
18195 /*
18196  * When the mtu in the ipif changes, we call this routine through ire_walk
18197  * to update all the relevant IREs.
18198  * Skip IRE_LOCAL and "loopback" IRE_BROADCAST by checking ire_stq.
18199  */
18200 static void
18201 ipif_mtu_change(ire_t *ire, char *ipif_arg)
18202 {
18203 	ipif_t *ipif = (ipif_t *)ipif_arg;
18204 
18205 	if (ire->ire_stq == NULL || ire->ire_ipif != ipif)
18206 		return;
18207 	ire->ire_max_frag = MIN(ipif->ipif_mtu, IP_MAXPACKET);
18208 }
18209 
18210 /*
18211  * When the mtu in the ill changes, we call this routine through ire_walk
18212  * to update all the relevant IREs.
18213  * Skip IRE_LOCAL and "loopback" IRE_BROADCAST by checking ire_stq.
18214  */
18215 void
18216 ill_mtu_change(ire_t *ire, char *ill_arg)
18217 {
18218 	ill_t	*ill = (ill_t *)ill_arg;
18219 
18220 	if (ire->ire_stq == NULL || ire->ire_ipif->ipif_ill != ill)
18221 		return;
18222 	ire->ire_max_frag = ire->ire_ipif->ipif_mtu;
18223 }
18224 
18225 /*
18226  * Join the ipif specific multicast groups.
18227  * Must be called after a mapping has been set up in the resolver.  (Always
18228  * called as writer.)
18229  */
18230 void
18231 ipif_multicast_up(ipif_t *ipif)
18232 {
18233 	int err, index;
18234 	ill_t *ill;
18235 
18236 	ASSERT(IAM_WRITER_IPIF(ipif));
18237 
18238 	ill = ipif->ipif_ill;
18239 	index = ill->ill_phyint->phyint_ifindex;
18240 
18241 	ip1dbg(("ipif_multicast_up\n"));
18242 	if (!(ill->ill_flags & ILLF_MULTICAST) || ipif->ipif_multicast_up)
18243 		return;
18244 
18245 	if (ipif->ipif_isv6) {
18246 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
18247 			return;
18248 
18249 		/* Join the all hosts multicast address */
18250 		ip1dbg(("ipif_multicast_up - addmulti\n"));
18251 		/*
18252 		 * Passing B_TRUE means we have to join the multicast
18253 		 * membership on this interface even though this is
18254 		 * FAILED. If we join on a different one in the group,
18255 		 * we will not be able to delete the membership later
18256 		 * as we currently don't track where we join when we
18257 		 * join within the kernel unlike applications where
18258 		 * we have ilg/ilg_orig_index. See ip_addmulti_v6
18259 		 * for more on this.
18260 		 */
18261 		err = ip_addmulti_v6(&ipv6_all_hosts_mcast, ill, index,
18262 		    ipif->ipif_zoneid, ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
18263 		if (err != 0) {
18264 			ip0dbg(("ipif_multicast_up: "
18265 			    "all_hosts_mcast failed %d\n",
18266 			    err));
18267 			return;
18268 		}
18269 		/*
18270 		 * Enable multicast for the solicited node multicast address
18271 		 */
18272 		if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
18273 			in6_addr_t ipv6_multi = ipv6_solicited_node_mcast;
18274 
18275 			ipv6_multi.s6_addr32[3] |=
18276 			    ipif->ipif_v6lcl_addr.s6_addr32[3];
18277 
18278 			err = ip_addmulti_v6(&ipv6_multi, ill, index,
18279 			    ipif->ipif_zoneid, ILGSTAT_NONE, MODE_IS_EXCLUDE,
18280 			    NULL);
18281 			if (err != 0) {
18282 				ip0dbg(("ipif_multicast_up: solicited MC"
18283 				    " failed %d\n", err));
18284 				(void) ip_delmulti_v6(&ipv6_all_hosts_mcast,
18285 				    ill, ill->ill_phyint->phyint_ifindex,
18286 				    ipif->ipif_zoneid, B_TRUE, B_TRUE);
18287 				return;
18288 			}
18289 		}
18290 	} else {
18291 		if (ipif->ipif_lcl_addr == INADDR_ANY)
18292 			return;
18293 
18294 		/* Join the all hosts multicast address */
18295 		ip1dbg(("ipif_multicast_up - addmulti\n"));
18296 		err = ip_addmulti(htonl(INADDR_ALLHOSTS_GROUP), ipif,
18297 		    ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
18298 		if (err) {
18299 			ip0dbg(("ipif_multicast_up: failed %d\n", err));
18300 			return;
18301 		}
18302 	}
18303 	ipif->ipif_multicast_up = 1;
18304 }
18305 
18306 /*
18307  * Blow away any IPv6 multicast groups that we joined in ipif_multicast_up();
18308  * any explicit memberships are blown away in ill_leave_multicast() when the
18309  * ill is brought down.
18310  */
18311 static void
18312 ipif_multicast_down(ipif_t *ipif)
18313 {
18314 	int err;
18315 
18316 	ASSERT(IAM_WRITER_IPIF(ipif));
18317 
18318 	ip1dbg(("ipif_multicast_down\n"));
18319 	if (!ipif->ipif_multicast_up)
18320 		return;
18321 
18322 	ASSERT(ipif->ipif_isv6);
18323 
18324 	ip1dbg(("ipif_multicast_down - delmulti\n"));
18325 
18326 	/*
18327 	 * Leave the all hosts multicast address. Similar to ip_addmulti_v6,
18328 	 * we should look for ilms on this ill rather than the ones that have
18329 	 * been failed over here.  They are here temporarily. As
18330 	 * ipif_multicast_up has joined on this ill, we should delete only
18331 	 * from this ill.
18332 	 */
18333 	err = ip_delmulti_v6(&ipv6_all_hosts_mcast, ipif->ipif_ill,
18334 	    ipif->ipif_ill->ill_phyint->phyint_ifindex, ipif->ipif_zoneid,
18335 	    B_TRUE, B_TRUE);
18336 	if (err != 0) {
18337 		ip0dbg(("ipif_multicast_down: all_hosts_mcast failed %d\n",
18338 		    err));
18339 	}
18340 	/*
18341 	 * Disable multicast for the solicited node multicast address
18342 	 */
18343 	if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
18344 		in6_addr_t ipv6_multi = ipv6_solicited_node_mcast;
18345 
18346 		ipv6_multi.s6_addr32[3] |=
18347 		    ipif->ipif_v6lcl_addr.s6_addr32[3];
18348 
18349 		err = ip_delmulti_v6(&ipv6_multi, ipif->ipif_ill,
18350 		    ipif->ipif_ill->ill_phyint->phyint_ifindex,
18351 		    ipif->ipif_zoneid, B_TRUE, B_TRUE);
18352 
18353 		if (err != 0) {
18354 			ip0dbg(("ipif_multicast_down: sol MC failed %d\n",
18355 			    err));
18356 		}
18357 	}
18358 
18359 	ipif->ipif_multicast_up = 0;
18360 }
18361 
18362 /*
18363  * Used when an interface comes up to recreate any extra routes on this
18364  * interface.
18365  */
18366 static ire_t **
18367 ipif_recover_ire(ipif_t *ipif)
18368 {
18369 	mblk_t	*mp;
18370 	ire_t	**ipif_saved_irep;
18371 	ire_t	**irep;
18372 
18373 	ip1dbg(("ipif_recover_ire(%s:%u)", ipif->ipif_ill->ill_name,
18374 	    ipif->ipif_id));
18375 
18376 	mutex_enter(&ipif->ipif_saved_ire_lock);
18377 	ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) *
18378 	    ipif->ipif_saved_ire_cnt, KM_NOSLEEP);
18379 	if (ipif_saved_irep == NULL) {
18380 		mutex_exit(&ipif->ipif_saved_ire_lock);
18381 		return (NULL);
18382 	}
18383 
18384 	irep = ipif_saved_irep;
18385 	for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
18386 		ire_t		*ire;
18387 		queue_t		*rfq;
18388 		queue_t		*stq;
18389 		ifrt_t		*ifrt;
18390 		uchar_t		*src_addr;
18391 		uchar_t		*gateway_addr;
18392 		mblk_t		*resolver_mp;
18393 		ushort_t	type;
18394 
18395 		/*
18396 		 * When the ire was initially created and then added in
18397 		 * ip_rt_add(), it was created either using ipif->ipif_net_type
18398 		 * in the case of a traditional interface route, or as one of
18399 		 * the IRE_OFFSUBNET types (with the exception of
18400 		 * IRE_HOST_REDIRECT which is created by icmp_redirect() and
18401 		 * which we don't need to save or recover).  In the case where
18402 		 * ipif->ipif_net_type was IRE_LOOPBACK, ip_rt_add() will update
18403 		 * the ire_type to IRE_IF_NORESOLVER before calling ire_add()
18404 		 * to satisfy software like GateD and Sun Cluster which creates
18405 		 * routes using the the loopback interface's address as a
18406 		 * gateway.
18407 		 *
18408 		 * As ifrt->ifrt_type reflects the already updated ire_type and
18409 		 * since ire_create() expects that IRE_IF_NORESOLVER will have
18410 		 * a valid ire_dlureq_mp field (which doesn't make sense for a
18411 		 * IRE_LOOPBACK), ire_create() will be called in the same way
18412 		 * here as in ip_rt_add(), namely using ipif->ipif_net_type when
18413 		 * the route looks like a traditional interface route (where
18414 		 * ifrt->ifrt_type & IRE_INTERFACE is true) and otherwise using
18415 		 * the saved ifrt->ifrt_type.  This means that in the case where
18416 		 * ipif->ipif_net_type is IRE_LOOPBACK, the ire created by
18417 		 * ire_create() will be an IRE_LOOPBACK, it will then be turned
18418 		 * into an IRE_IF_NORESOLVER and then added by ire_add().
18419 		 */
18420 		ifrt = (ifrt_t *)mp->b_rptr;
18421 		if (ifrt->ifrt_type & IRE_INTERFACE) {
18422 			rfq = NULL;
18423 			stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
18424 			    ? ipif->ipif_rq : ipif->ipif_wq;
18425 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
18426 			    ? (uint8_t *)&ifrt->ifrt_src_addr
18427 			    : (uint8_t *)&ipif->ipif_src_addr;
18428 			gateway_addr = NULL;
18429 			resolver_mp = ipif->ipif_resolver_mp;
18430 			type = ipif->ipif_net_type;
18431 		} else if (ifrt->ifrt_type & IRE_BROADCAST) {
18432 			/* Recover multiroute broadcast IRE. */
18433 			rfq = ipif->ipif_rq;
18434 			stq = ipif->ipif_wq;
18435 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
18436 			    ? (uint8_t *)&ifrt->ifrt_src_addr
18437 			    : (uint8_t *)&ipif->ipif_src_addr;
18438 			gateway_addr = (uint8_t *)&ifrt->ifrt_gateway_addr;
18439 			resolver_mp = ipif->ipif_bcast_mp;
18440 			type = ifrt->ifrt_type;
18441 		} else {
18442 			rfq = NULL;
18443 			stq = NULL;
18444 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
18445 			    ? (uint8_t *)&ifrt->ifrt_src_addr : NULL;
18446 			gateway_addr = (uint8_t *)&ifrt->ifrt_gateway_addr;
18447 			resolver_mp = NULL;
18448 			type = ifrt->ifrt_type;
18449 		}
18450 
18451 		/*
18452 		 * Create a copy of the IRE with the saved address and netmask.
18453 		 */
18454 		ip1dbg(("ipif_recover_ire: creating IRE %s (%d) for "
18455 		    "0x%x/0x%x\n",
18456 		    ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type,
18457 		    ntohl(ifrt->ifrt_addr),
18458 		    ntohl(ifrt->ifrt_mask)));
18459 		ire = ire_create(
18460 		    (uint8_t *)&ifrt->ifrt_addr,
18461 		    (uint8_t *)&ifrt->ifrt_mask,
18462 		    src_addr,
18463 		    gateway_addr,
18464 		    NULL,
18465 		    &ifrt->ifrt_max_frag,
18466 		    NULL,
18467 		    rfq,
18468 		    stq,
18469 		    type,
18470 		    resolver_mp,
18471 		    ipif,
18472 		    NULL,
18473 		    0,
18474 		    0,
18475 		    0,
18476 		    ifrt->ifrt_flags,
18477 		    &ifrt->ifrt_iulp_info);
18478 
18479 		if (ire == NULL) {
18480 			mutex_exit(&ipif->ipif_saved_ire_lock);
18481 			kmem_free(ipif_saved_irep,
18482 			    ipif->ipif_saved_ire_cnt * sizeof (ire_t *));
18483 			return (NULL);
18484 		}
18485 
18486 		/*
18487 		 * Some software (for example, GateD and Sun Cluster) attempts
18488 		 * to create (what amount to) IRE_PREFIX routes with the
18489 		 * loopback address as the gateway.  This is primarily done to
18490 		 * set up prefixes with the RTF_REJECT flag set (for example,
18491 		 * when generating aggregate routes.)
18492 		 *
18493 		 * If the IRE type (as defined by ipif->ipif_net_type) is
18494 		 * IRE_LOOPBACK, then we map the request into a
18495 		 * IRE_IF_NORESOLVER.
18496 		 */
18497 		if (ipif->ipif_net_type == IRE_LOOPBACK)
18498 			ire->ire_type = IRE_IF_NORESOLVER;
18499 		/*
18500 		 * ire held by ire_add, will be refreled' towards the
18501 		 * the end of ipif_up_done
18502 		 */
18503 		(void) ire_add(&ire, NULL, NULL, NULL);
18504 		*irep = ire;
18505 		irep++;
18506 		ip1dbg(("ipif_recover_ire: added ire %p\n", (void *)ire));
18507 	}
18508 	mutex_exit(&ipif->ipif_saved_ire_lock);
18509 	return (ipif_saved_irep);
18510 }
18511 
18512 /*
18513  * Used to set the netmask and broadcast address to default values when the
18514  * interface is brought up.  (Always called as writer.)
18515  */
18516 static void
18517 ipif_set_default(ipif_t *ipif)
18518 {
18519 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
18520 
18521 	if (!ipif->ipif_isv6) {
18522 		/*
18523 		 * Interface holds an IPv4 address. Default
18524 		 * mask is the natural netmask.
18525 		 */
18526 		if (!ipif->ipif_net_mask) {
18527 			ipaddr_t	v4mask;
18528 
18529 			v4mask = ip_net_mask(ipif->ipif_lcl_addr);
18530 			V4MASK_TO_V6(v4mask, ipif->ipif_v6net_mask);
18531 		}
18532 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
18533 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
18534 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
18535 		} else {
18536 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
18537 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
18538 		}
18539 		/*
18540 		 * NOTE: SunOS 4.X does this even if the broadcast address
18541 		 * has been already set thus we do the same here.
18542 		 */
18543 		if (ipif->ipif_flags & IPIF_BROADCAST) {
18544 			ipaddr_t	v4addr;
18545 
18546 			v4addr = ipif->ipif_subnet | ~ipif->ipif_net_mask;
18547 			IN6_IPADDR_TO_V4MAPPED(v4addr, &ipif->ipif_v6brd_addr);
18548 		}
18549 	} else {
18550 		/*
18551 		 * Interface holds an IPv6-only address.  Default
18552 		 * mask is all-ones.
18553 		 */
18554 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
18555 			ipif->ipif_v6net_mask = ipv6_all_ones;
18556 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
18557 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
18558 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
18559 		} else {
18560 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
18561 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
18562 		}
18563 	}
18564 }
18565 
18566 /*
18567  * Return 0 if this address can be used as local address without causing
18568  * duplicate address problems. Otherwise, return EADDRNOTAVAIL if the address
18569  * is already up on a different ill, and EADDRINUSE if it's up on the same ill.
18570  * Special checks are needed to allow the same IPv6 link-local address
18571  * on different ills.
18572  * TODO: allowing the same site-local address on different ill's.
18573  */
18574 int
18575 ip_addr_availability_check(ipif_t *new_ipif)
18576 {
18577 	in6_addr_t our_v6addr;
18578 	ill_t *ill;
18579 	ipif_t *ipif;
18580 	ill_walk_context_t ctx;
18581 
18582 	ASSERT(IAM_WRITER_IPIF(new_ipif));
18583 	ASSERT(MUTEX_HELD(&ip_addr_avail_lock));
18584 	ASSERT(RW_READ_HELD(&ill_g_lock));
18585 
18586 	new_ipif->ipif_flags &= ~IPIF_UNNUMBERED;
18587 	if (IN6_IS_ADDR_UNSPECIFIED(&new_ipif->ipif_v6lcl_addr) ||
18588 	    IN6_IS_ADDR_V4MAPPED_ANY(&new_ipif->ipif_v6lcl_addr))
18589 		return (0);
18590 
18591 	our_v6addr = new_ipif->ipif_v6lcl_addr;
18592 
18593 	if (new_ipif->ipif_isv6)
18594 		ill = ILL_START_WALK_V6(&ctx);
18595 	else
18596 		ill = ILL_START_WALK_V4(&ctx);
18597 
18598 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
18599 		for (ipif = ill->ill_ipif; ipif != NULL;
18600 		    ipif = ipif->ipif_next) {
18601 			if ((ipif == new_ipif) ||
18602 			    !(ipif->ipif_flags & IPIF_UP) ||
18603 			    (ipif->ipif_flags & IPIF_UNNUMBERED))
18604 				continue;
18605 			if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
18606 			    &our_v6addr)) {
18607 				if (new_ipif->ipif_flags & IPIF_POINTOPOINT)
18608 				    new_ipif->ipif_flags |= IPIF_UNNUMBERED;
18609 				else if (ipif->ipif_flags & IPIF_POINTOPOINT)
18610 				    ipif->ipif_flags |= IPIF_UNNUMBERED;
18611 				else if (IN6_IS_ADDR_LINKLOCAL(&our_v6addr) &&
18612 				    new_ipif->ipif_ill != ill)
18613 					continue;
18614 				else if (IN6_IS_ADDR_SITELOCAL(&our_v6addr) &&
18615 				    new_ipif->ipif_ill != ill)
18616 					continue;
18617 				else if (new_ipif->ipif_zoneid !=
18618 				    ipif->ipif_zoneid &&
18619 				    (ill->ill_phyint->phyint_flags &
18620 				    PHYI_LOOPBACK))
18621 					continue;
18622 				else if (new_ipif->ipif_ill == ill)
18623 					return (EADDRINUSE);
18624 				else
18625 					return (EADDRNOTAVAIL);
18626 			}
18627 		}
18628 	}
18629 
18630 	return (0);
18631 }
18632 
18633 /*
18634  * Bring up an ipif: bring up arp/ndp, bring up the DLPI stream, and add
18635  * IREs for the ipif.
18636  * When the routine returns EINPROGRESS then mp has been consumed and
18637  * the ioctl will be acked from ip_rput_dlpi.
18638  */
18639 static int
18640 ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp)
18641 {
18642 	ill_t	*ill = ipif->ipif_ill;
18643 	boolean_t isv6 = ipif->ipif_isv6;
18644 	int	err = 0;
18645 	boolean_t success;
18646 
18647 	ASSERT(IAM_WRITER_IPIF(ipif));
18648 
18649 	ip1dbg(("ipif_up(%s:%u)\n", ill->ill_name, ipif->ipif_id));
18650 
18651 	/* Shouldn't get here if it is already up. */
18652 	if (ipif->ipif_flags & IPIF_UP)
18653 		return (EALREADY);
18654 
18655 	/* Skip arp/ndp for any loopback interface. */
18656 	if (ill->ill_wq != NULL) {
18657 		conn_t *connp = Q_TO_CONN(q);
18658 		ipsq_t	*ipsq = ill->ill_phyint->phyint_ipsq;
18659 
18660 		if (!ill->ill_dl_up) {
18661 			/*
18662 			 * ill_dl_up is not yet set. i.e. we are yet to
18663 			 * DL_BIND with the driver and this is the first
18664 			 * logical interface on the ill to become "up".
18665 			 * Tell the driver to get going (via DL_BIND_REQ).
18666 			 * Note that changing "significant" IFF_ flags
18667 			 * address/netmask etc cause a down/up dance, but
18668 			 * does not cause an unbind (DL_UNBIND) with the driver
18669 			 */
18670 			return (ill_dl_up(ill, ipif, mp, q));
18671 		}
18672 
18673 		/*
18674 		 * ipif_resolver_up may end up sending an
18675 		 * AR_INTERFACE_UP message to ARP, which would, in
18676 		 * turn send a DLPI message to the driver. ioctls are
18677 		 * serialized and so we cannot send more than one
18678 		 * interface up message at a time. If ipif_resolver_up
18679 		 * does send an interface up message to ARP, we get
18680 		 * EINPROGRESS and we will complete in ip_arp_done.
18681 		 */
18682 
18683 		ASSERT(connp != NULL);
18684 		ASSERT(ipsq->ipsq_pending_mp == NULL);
18685 		mutex_enter(&connp->conn_lock);
18686 		mutex_enter(&ill->ill_lock);
18687 		success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
18688 		mutex_exit(&ill->ill_lock);
18689 		mutex_exit(&connp->conn_lock);
18690 		if (!success)
18691 			return (EINTR);
18692 
18693 		/*
18694 		 * Crank up IPv6 neighbor discovery
18695 		 * Unlike ARP, this should complete when
18696 		 * ipif_ndp_up returns. However, for
18697 		 * ILLF_XRESOLV interfaces we also send a
18698 		 * AR_INTERFACE_UP to the external resolver.
18699 		 * That ioctl will complete in ip_rput.
18700 		 */
18701 		if (isv6) {
18702 			err = ipif_ndp_up(ipif, &ipif->ipif_v6lcl_addr,
18703 			    B_FALSE);
18704 			if (err != 0) {
18705 				mp = ipsq_pending_mp_get(ipsq, &connp);
18706 				return (err);
18707 			}
18708 		}
18709 		/* Now, ARP */
18710 		if ((err = ipif_resolver_up(ipif, B_FALSE)) ==
18711 		    EINPROGRESS) {
18712 			/* We will complete it in ip_arp_done */
18713 			return (err);
18714 		}
18715 		mp = ipsq_pending_mp_get(ipsq, &connp);
18716 		ASSERT(mp != NULL);
18717 		if (err != 0)
18718 			return (err);
18719 	}
18720 	return (isv6 ? ipif_up_done_v6(ipif) : ipif_up_done(ipif));
18721 }
18722 
18723 /*
18724  * Perform a bind for the physical device.
18725  * When the routine returns EINPROGRESS then mp has been consumed and
18726  * the ioctl will be acked from ip_rput_dlpi.
18727  * Allocate an unbind message and save it until ipif_down.
18728  */
18729 static int
18730 ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
18731 {
18732 	mblk_t	*areq_mp = NULL;
18733 	mblk_t	*bind_mp = NULL;
18734 	mblk_t	*unbind_mp = NULL;
18735 	conn_t	*connp;
18736 	boolean_t success;
18737 
18738 	ip1dbg(("ill_dl_up(%s)\n", ill->ill_name));
18739 	ASSERT(IAM_WRITER_ILL(ill));
18740 
18741 	ASSERT(mp != NULL);
18742 
18743 	/* Create a resolver cookie for ARP */
18744 	if (!ill->ill_isv6 && ill->ill_net_type == IRE_IF_RESOLVER) {
18745 		areq_t		*areq;
18746 		uint16_t	sap_addr;
18747 
18748 		areq_mp = ill_arp_alloc(ill,
18749 			(uchar_t *)&ip_areq_template, 0);
18750 		if (areq_mp == NULL) {
18751 			return (ENOMEM);
18752 		}
18753 		freemsg(ill->ill_resolver_mp);
18754 		ill->ill_resolver_mp = areq_mp;
18755 		areq = (areq_t *)areq_mp->b_rptr;
18756 		sap_addr = ill->ill_sap;
18757 		bcopy(&sap_addr, areq->areq_sap, sizeof (sap_addr));
18758 		/*
18759 		 * Wait till we call ill_pending_mp_add to determine
18760 		 * the success before we free the ill_resolver_mp and
18761 		 * attach areq_mp in it's place.
18762 		 */
18763 	}
18764 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
18765 	    DL_BIND_REQ);
18766 	if (bind_mp == NULL)
18767 		goto bad;
18768 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
18769 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
18770 
18771 	unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ);
18772 	if (unbind_mp == NULL)
18773 		goto bad;
18774 
18775 	/*
18776 	 * Record state needed to complete this operation when the
18777 	 * DL_BIND_ACK shows up.  Also remember the pre-allocated mblks.
18778 	 */
18779 	if (WR(q)->q_next == NULL) {
18780 		connp = Q_TO_CONN(q);
18781 		mutex_enter(&connp->conn_lock);
18782 	} else {
18783 		connp = NULL;
18784 	}
18785 	mutex_enter(&ipif->ipif_ill->ill_lock);
18786 	success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
18787 	mutex_exit(&ipif->ipif_ill->ill_lock);
18788 	if (connp != NULL)
18789 		mutex_exit(&connp->conn_lock);
18790 	if (!success)
18791 		goto bad;
18792 
18793 	/*
18794 	 * Save the unbind message for ill_dl_down(); it will be consumed when
18795 	 * the interface goes down.
18796 	 */
18797 	ASSERT(ill->ill_unbind_mp == NULL);
18798 	ill->ill_unbind_mp = unbind_mp;
18799 
18800 	ill_dlpi_send(ill, bind_mp);
18801 	/* Send down link-layer capabilities probe if not already done. */
18802 	ill_capability_probe(ill);
18803 
18804 	/*
18805 	 * Sysid used to rely on the fact that netboots set domainname
18806 	 * and the like. Now that miniroot boots aren't strictly netboots
18807 	 * and miniroot network configuration is driven from userland
18808 	 * these things still need to be set. This situation can be detected
18809 	 * by comparing the interface being configured here to the one
18810 	 * dhcack was set to reference by the boot loader. Once sysid is
18811 	 * converted to use dhcp_ipc_getinfo() this call can go away.
18812 	 */
18813 	if ((ipif->ipif_flags & IPIF_DHCPRUNNING) && (dhcack != NULL) &&
18814 	    (strcmp(ill->ill_name, dhcack) == 0) &&
18815 	    (strlen(srpc_domain) == 0)) {
18816 		if (dhcpinit() != 0)
18817 			cmn_err(CE_WARN, "no cached dhcp response");
18818 	}
18819 
18820 	/*
18821 	 * This operation will complete in ip_rput_dlpi with either
18822 	 * a DL_BIND_ACK or DL_ERROR_ACK.
18823 	 */
18824 	return (EINPROGRESS);
18825 bad:
18826 	ip1dbg(("ill_dl_up(%s) FAILED\n", ill->ill_name));
18827 	/*
18828 	 * We don't have to check for possible removal from illgrp
18829 	 * as we have not yet inserted in illgrp. For groups
18830 	 * without names, this ipif is still not UP and hence
18831 	 * this could not have possibly had any influence in forming
18832 	 * groups.
18833 	 */
18834 
18835 	if (bind_mp != NULL)
18836 		freemsg(bind_mp);
18837 	if (unbind_mp != NULL)
18838 		freemsg(unbind_mp);
18839 	return (ENOMEM);
18840 }
18841 
18842 uint_t ip_loopback_mtuplus = IP_LOOPBACK_MTU + IP_SIMPLE_HDR_LENGTH + 20;
18843 
18844 /*
18845  * DLPI and ARP is up.
18846  * Create all the IREs associated with an interface bring up multicast.
18847  * Set the interface flag and finish other initialization
18848  * that potentially had to be differed to after DL_BIND_ACK.
18849  */
18850 int
18851 ipif_up_done(ipif_t *ipif)
18852 {
18853 	ire_t	*ire_array[20];
18854 	ire_t	**irep = ire_array;
18855 	ire_t	**irep1;
18856 	ipaddr_t net_mask = 0;
18857 	ipaddr_t subnet_mask, route_mask;
18858 	ill_t	*ill = ipif->ipif_ill;
18859 	queue_t	*stq;
18860 	ipif_t	 *src_ipif;
18861 	ipif_t   *tmp_ipif;
18862 	boolean_t	flush_ire_cache = B_TRUE;
18863 	int	err = 0;
18864 	phyint_t *phyi;
18865 	ire_t	**ipif_saved_irep = NULL;
18866 	int ipif_saved_ire_cnt;
18867 	int	cnt;
18868 	boolean_t	src_ipif_held = B_FALSE;
18869 	boolean_t	ire_added = B_FALSE;
18870 	boolean_t	loopback = B_FALSE;
18871 
18872 	ip1dbg(("ipif_up_done(%s:%u)\n",
18873 		ipif->ipif_ill->ill_name, ipif->ipif_id));
18874 	/* Check if this is a loopback interface */
18875 	if (ipif->ipif_ill->ill_wq == NULL)
18876 		loopback = B_TRUE;
18877 
18878 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
18879 	/*
18880 	 * If all other interfaces for this ill are down or DEPRECATED,
18881 	 * or otherwise unsuitable for source address selection, remove
18882 	 * any IRE_CACHE entries for this ill to make sure source
18883 	 * address selection gets to take this new ipif into account.
18884 	 * No need to hold ill_lock while traversing the ipif list since
18885 	 * we are writer
18886 	 */
18887 	for (tmp_ipif = ill->ill_ipif; tmp_ipif;
18888 		tmp_ipif = tmp_ipif->ipif_next) {
18889 		if (((tmp_ipif->ipif_flags &
18890 		    (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
18891 		    !(tmp_ipif->ipif_flags & IPIF_UP)) ||
18892 		    (tmp_ipif == ipif))
18893 			continue;
18894 		/* first useable pre-existing interface */
18895 		flush_ire_cache = B_FALSE;
18896 		break;
18897 	}
18898 	if (flush_ire_cache)
18899 		ire_walk_ill_v4(MATCH_IRE_ILL_GROUP | MATCH_IRE_TYPE,
18900 		    IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill);
18901 
18902 	/*
18903 	 * Figure out which way the send-to queue should go.  Only
18904 	 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER or IRE_LOOPBACK
18905 	 * should show up here.
18906 	 */
18907 	switch (ill->ill_net_type) {
18908 	case IRE_IF_RESOLVER:
18909 		stq = ill->ill_rq;
18910 		break;
18911 	case IRE_IF_NORESOLVER:
18912 	case IRE_LOOPBACK:
18913 		stq = ill->ill_wq;
18914 		break;
18915 	default:
18916 		return (EINVAL);
18917 	}
18918 
18919 	if (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK) {
18920 		/*
18921 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
18922 		 * ipif_lookup_on_name(), but in the case of zones we can have
18923 		 * several loopback addresses on lo0. So all the interfaces with
18924 		 * loopback addresses need to be marked IRE_LOOPBACK.
18925 		 */
18926 		if (V4_PART_OF_V6(ipif->ipif_v6lcl_addr) ==
18927 		    htonl(INADDR_LOOPBACK))
18928 			ipif->ipif_ire_type = IRE_LOOPBACK;
18929 		else
18930 			ipif->ipif_ire_type = IRE_LOCAL;
18931 	}
18932 
18933 	if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)) {
18934 		/*
18935 		 * Can't use our source address. Select a different
18936 		 * source address for the IRE_INTERFACE and IRE_LOCAL
18937 		 */
18938 		src_ipif = ipif_select_source(ipif->ipif_ill,
18939 		    ipif->ipif_subnet, ipif->ipif_zoneid);
18940 		if (src_ipif == NULL)
18941 			src_ipif = ipif;	/* Last resort */
18942 		else
18943 			src_ipif_held = B_TRUE;
18944 	} else {
18945 		src_ipif = ipif;
18946 	}
18947 
18948 	/* Create all the IREs associated with this interface */
18949 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
18950 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
18951 		/* Register the source address for __sin6_src_id */
18952 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
18953 		    ipif->ipif_zoneid);
18954 		if (err != 0) {
18955 			ip0dbg(("ipif_up_done: srcid_insert %d\n", err));
18956 			return (err);
18957 		}
18958 		/* If the interface address is set, create the local IRE. */
18959 		ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x for 0x%x\n",
18960 			(void *)ipif,
18961 			ipif->ipif_ire_type,
18962 			ntohl(ipif->ipif_lcl_addr)));
18963 		*irep++ = ire_create(
18964 		    (uchar_t *)&ipif->ipif_lcl_addr,	/* dest address */
18965 		    (uchar_t *)&ip_g_all_ones,		/* mask */
18966 		    (uchar_t *)&src_ipif->ipif_src_addr, /* source address */
18967 		    NULL,				/* no gateway */
18968 		    NULL,
18969 		    &ip_loopback_mtuplus,		/* max frag size */
18970 		    NULL,
18971 		    ipif->ipif_rq,			/* recv-from queue */
18972 		    NULL,				/* no send-to queue */
18973 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
18974 		    NULL,
18975 		    ipif,
18976 		    NULL,
18977 		    0,
18978 		    0,
18979 		    0,
18980 		    (ipif->ipif_flags & IPIF_PRIVATE) ?
18981 		    RTF_PRIVATE : 0,
18982 		    &ire_uinfo_null);
18983 	} else {
18984 		ip1dbg((
18985 		    "ipif_up_done: not creating IRE %d for 0x%x: flags 0x%x\n",
18986 		    ipif->ipif_ire_type,
18987 		    ntohl(ipif->ipif_lcl_addr),
18988 		    (uint_t)ipif->ipif_flags));
18989 	}
18990 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
18991 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
18992 		net_mask = ip_net_mask(ipif->ipif_lcl_addr);
18993 	} else {
18994 		net_mask = htonl(IN_CLASSA_NET);	/* fallback */
18995 	}
18996 
18997 	subnet_mask = ipif->ipif_net_mask;
18998 
18999 	/*
19000 	 * If mask was not specified, use natural netmask of
19001 	 * interface address. Also, store this mask back into the
19002 	 * ipif struct.
19003 	 */
19004 	if (subnet_mask == 0) {
19005 		subnet_mask = net_mask;
19006 		V4MASK_TO_V6(subnet_mask, ipif->ipif_v6net_mask);
19007 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
19008 		    ipif->ipif_v6subnet);
19009 	}
19010 
19011 	/* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */
19012 	if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) &&
19013 	    ipif->ipif_subnet != INADDR_ANY) {
19014 		/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
19015 
19016 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
19017 			route_mask = IP_HOST_MASK;
19018 		} else {
19019 			route_mask = subnet_mask;
19020 		}
19021 
19022 		ip1dbg(("ipif_up_done: ipif 0x%p ill 0x%p "
19023 		    "creating if IRE ill_net_type 0x%x for 0x%x\n",
19024 			(void *)ipif, (void *)ill,
19025 			ill->ill_net_type,
19026 			ntohl(ipif->ipif_subnet)));
19027 		*irep++ = ire_create(
19028 		    (uchar_t *)&ipif->ipif_subnet,	/* dest address */
19029 		    (uchar_t *)&route_mask,		/* mask */
19030 		    (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */
19031 		    NULL,				/* no gateway */
19032 		    NULL,
19033 		    &ipif->ipif_mtu,			/* max frag */
19034 		    NULL,
19035 		    NULL,				/* no recv queue */
19036 		    stq,				/* send-to queue */
19037 		    ill->ill_net_type,			/* IF_[NO]RESOLVER */
19038 		    ill->ill_resolver_mp,		/* xmit header */
19039 		    ipif,
19040 		    NULL,
19041 		    0,
19042 		    0,
19043 		    0,
19044 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE: 0,
19045 		    &ire_uinfo_null);
19046 	}
19047 
19048 	/*
19049 	 * If the interface address is set, create the broadcast IREs.
19050 	 *
19051 	 * ire_create_bcast checks if the proposed new IRE matches
19052 	 * any existing IRE's with the same physical interface (ILL).
19053 	 * This should get rid of duplicates.
19054 	 * ire_create_bcast also check IPIF_NOXMIT and does not create
19055 	 * any broadcast ires.
19056 	 */
19057 	if ((ipif->ipif_subnet != INADDR_ANY) &&
19058 	    (ipif->ipif_flags & IPIF_BROADCAST)) {
19059 		ipaddr_t addr;
19060 
19061 		ip1dbg(("ipif_up_done: creating broadcast IRE\n"));
19062 		irep = ire_check_and_create_bcast(ipif, 0, irep,
19063 		    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19064 		irep = ire_check_and_create_bcast(ipif, INADDR_BROADCAST, irep,
19065 		    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19066 
19067 		/*
19068 		 * For backward compatibility, we need to create net
19069 		 * broadcast ire's based on the old "IP address class
19070 		 * system."  The reason is that some old machines only
19071 		 * respond to these class derived net broadcast.
19072 		 *
19073 		 * But we should not create these net broadcast ire's if
19074 		 * the subnet_mask is shorter than the IP address class based
19075 		 * derived netmask.  Otherwise, we may create a net
19076 		 * broadcast address which is the same as an IP address
19077 		 * on the subnet.  Then TCP will refuse to talk to that
19078 		 * address.
19079 		 *
19080 		 * Nor do we need IRE_BROADCAST ire's for the interface
19081 		 * with the netmask as 0xFFFFFFFF, as IRE_LOCAL for that
19082 		 * interface is already created.  Creating these broadcast
19083 		 * ire's will only create confusion as the "addr" is going
19084 		 * to be same as that of the IP address of the interface.
19085 		 */
19086 		if (net_mask < subnet_mask) {
19087 			addr = net_mask & ipif->ipif_subnet;
19088 			irep = ire_check_and_create_bcast(ipif, addr, irep,
19089 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19090 			irep = ire_check_and_create_bcast(ipif,
19091 			    ~net_mask | addr, irep,
19092 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19093 		}
19094 
19095 		if (subnet_mask != 0xFFFFFFFF) {
19096 			addr = ipif->ipif_subnet;
19097 			irep = ire_check_and_create_bcast(ipif, addr, irep,
19098 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19099 			irep = ire_check_and_create_bcast(ipif,
19100 			    ~subnet_mask|addr, irep,
19101 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19102 		}
19103 	}
19104 
19105 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
19106 
19107 	/* If an earlier ire_create failed, get out now */
19108 	for (irep1 = irep; irep1 > ire_array; ) {
19109 		irep1--;
19110 		if (*irep1 == NULL) {
19111 			ip1dbg(("ipif_up_done: NULL ire found in ire_array\n"));
19112 			err = ENOMEM;
19113 			goto bad;
19114 		}
19115 	}
19116 
19117 	/*
19118 	 * Need to atomically check for ip_addr_availablity_check
19119 	 * under ip_addr_avail_lock, and if it fails got bad, and remove
19120 	 * from group also.The ill_g_lock is grabbed as reader
19121 	 * just to make sure no new ills or new ipifs are being added
19122 	 * to the system while we are checking the uniqueness of addresses.
19123 	 */
19124 	rw_enter(&ill_g_lock, RW_READER);
19125 	mutex_enter(&ip_addr_avail_lock);
19126 	/* Mark it up, and increment counters. */
19127 	ill->ill_ipif_up_count++;
19128 	ipif->ipif_flags |= IPIF_UP;
19129 	err = ip_addr_availability_check(ipif);
19130 	mutex_exit(&ip_addr_avail_lock);
19131 	rw_exit(&ill_g_lock);
19132 
19133 	if (err != 0) {
19134 		/*
19135 		 * Our address may already be up on the same ill. In this case,
19136 		 * the ARP entry for our ipif replaced the one for the other
19137 		 * ipif. So we don't want to delete it (otherwise the other ipif
19138 		 * would be unable to send packets).
19139 		 * ip_addr_availability_check() identifies this case for us and
19140 		 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL
19141 		 * which is the expected error code.
19142 		 */
19143 		if (err == EADDRINUSE) {
19144 			freemsg(ipif->ipif_arp_del_mp);
19145 			ipif->ipif_arp_del_mp = NULL;
19146 			err = EADDRNOTAVAIL;
19147 		}
19148 		ill->ill_ipif_up_count--;
19149 		ipif->ipif_flags &= ~IPIF_UP;
19150 		goto bad;
19151 	}
19152 
19153 	/*
19154 	 * Add in all newly created IREs.  ire_create_bcast() has
19155 	 * already checked for duplicates of the IRE_BROADCAST type.
19156 	 * We want to add before we call ifgrp_insert which wants
19157 	 * to know whether IRE_IF_RESOLVER exists or not.
19158 	 *
19159 	 * NOTE : We refrele the ire though we may branch to "bad"
19160 	 *	  later on where we do ire_delete. This is okay
19161 	 *	  because nobody can delete it as we are running
19162 	 *	  exclusively.
19163 	 */
19164 	for (irep1 = irep; irep1 > ire_array; ) {
19165 		irep1--;
19166 		ASSERT(!MUTEX_HELD(&((*irep1)->ire_ipif->ipif_ill->ill_lock)));
19167 		/*
19168 		 * refheld by ire_add. refele towards the end of the func
19169 		 */
19170 		(void) ire_add(irep1, NULL, NULL, NULL);
19171 	}
19172 	ire_added = B_TRUE;
19173 	/*
19174 	 * Form groups if possible.
19175 	 *
19176 	 * If we are supposed to be in a ill_group with a name, insert it
19177 	 * now as we know that at least one ipif is UP. Otherwise form
19178 	 * nameless groups.
19179 	 *
19180 	 * If ip_enable_group_ifs is set and ipif address is not 0, insert
19181 	 * this ipif into the appropriate interface group, or create a
19182 	 * new one. If this is already in a nameless group, we try to form
19183 	 * a bigger group looking at other ills potentially sharing this
19184 	 * ipif's prefix.
19185 	 */
19186 	phyi = ill->ill_phyint;
19187 	if (phyi->phyint_groupname_len != 0) {
19188 		ASSERT(phyi->phyint_groupname != NULL);
19189 		if (ill->ill_ipif_up_count == 1) {
19190 			ASSERT(ill->ill_group == NULL);
19191 			err = illgrp_insert(&illgrp_head_v4, ill,
19192 			    phyi->phyint_groupname, NULL, B_TRUE);
19193 			if (err != 0) {
19194 				ip1dbg(("ipif_up_done: illgrp allocation "
19195 				    "failed, error %d\n", err));
19196 				goto bad;
19197 			}
19198 		}
19199 		ASSERT(ill->ill_group != NULL);
19200 	}
19201 
19202 	/*
19203 	 * When this is part of group, we need to make sure that
19204 	 * any broadcast ires created because of this ipif coming
19205 	 * UP gets marked/cleared with IRE_MARK_NORECV appropriately
19206 	 * so that we don't receive duplicate broadcast packets.
19207 	 */
19208 	if (ill->ill_group != NULL && ill->ill_ipif_up_count != 0)
19209 		ipif_renominate_bcast(ipif);
19210 
19211 	/* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */
19212 	ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt;
19213 	ipif_saved_irep = ipif_recover_ire(ipif);
19214 
19215 	if (!loopback) {
19216 		/*
19217 		 * If the broadcast address has been set, make sure it makes
19218 		 * sense based on the interface address.
19219 		 * Only match on ill since we are sharing broadcast addresses.
19220 		 */
19221 		if ((ipif->ipif_brd_addr != INADDR_ANY) &&
19222 		    (ipif->ipif_flags & IPIF_BROADCAST)) {
19223 			ire_t	*ire;
19224 
19225 			ire = ire_ctable_lookup(ipif->ipif_brd_addr, 0,
19226 			    IRE_BROADCAST, ipif, ALL_ZONES,
19227 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19228 
19229 			if (ire == NULL) {
19230 				/*
19231 				 * If there isn't a matching broadcast IRE,
19232 				 * revert to the default for this netmask.
19233 				 */
19234 				ipif->ipif_v6brd_addr = ipv6_all_zeros;
19235 				mutex_enter(&ipif->ipif_ill->ill_lock);
19236 				ipif_set_default(ipif);
19237 				mutex_exit(&ipif->ipif_ill->ill_lock);
19238 			} else {
19239 				ire_refrele(ire);
19240 			}
19241 		}
19242 
19243 	}
19244 
19245 
19246 	/* This is the first interface on this ill */
19247 	if (ipif->ipif_ipif_up_count == 1 && !loopback) {
19248 		/*
19249 		 * Need to recover all multicast memberships in the driver.
19250 		 * This had to be deferred until we had attached.
19251 		 */
19252 		ill_recover_multicast(ill);
19253 	}
19254 	/* Join the allhosts multicast address */
19255 	ipif_multicast_up(ipif);
19256 
19257 	if (!loopback) {
19258 		/*
19259 		 * See whether anybody else would benefit from the
19260 		 * new ipif that we added. We call this always rather
19261 		 * than while adding a non-IPIF_NOLOCAL/DEPRECATED/ANYCAST
19262 		 * ipif is for the benefit of illgrp_insert (done above)
19263 		 * which does not do source address selection as it does
19264 		 * not want to re-create interface routes that we are
19265 		 * having reference to it here.
19266 		 */
19267 		ill_update_source_selection(ill);
19268 	}
19269 
19270 	for (irep1 = irep; irep1 > ire_array; ) {
19271 		irep1--;
19272 		if (*irep1 != NULL) {
19273 			/* was held in ire_add */
19274 			ire_refrele(*irep1);
19275 		}
19276 	}
19277 
19278 	cnt = ipif_saved_ire_cnt;
19279 	for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) {
19280 		if (*irep1 != NULL) {
19281 			/* was held in ire_add */
19282 			ire_refrele(*irep1);
19283 		}
19284 	}
19285 
19286 	/*
19287 	 * This had to be deferred until we had bound.
19288 	 * tell routing sockets that this interface is up
19289 	 */
19290 	ip_rts_ifmsg(ipif);
19291 	ip_rts_newaddrmsg(RTM_ADD, 0, ipif);
19292 
19293 	if (!loopback) {
19294 		/* Broadcast an address mask reply. */
19295 		ipif_mask_reply(ipif);
19296 	}
19297 	if (ipif_saved_irep != NULL) {
19298 		kmem_free(ipif_saved_irep,
19299 		    ipif_saved_ire_cnt * sizeof (ire_t *));
19300 	}
19301 	if (src_ipif_held)
19302 		ipif_refrele(src_ipif);
19303 	/* Let SCTP update the status for this ipif */
19304 	sctp_update_ipif(ipif, SCTP_IPIF_UP);
19305 	return (0);
19306 
19307 bad:
19308 	ip1dbg(("ipif_up_done: FAILED \n"));
19309 	/*
19310 	 * We don't have to bother removing from ill groups because
19311 	 *
19312 	 * 1) For groups with names, we insert only when the first ipif
19313 	 *    comes up. In that case if it fails, it will not be in any
19314 	 *    group. So, we need not try to remove for that case.
19315 	 *
19316 	 * 2) For groups without names, either we tried to insert ipif_ill
19317 	 *    in a group as singleton or found some other group to become
19318 	 *    a bigger group. For the former, if it fails we don't have
19319 	 *    anything to do as ipif_ill is not in the group and for the
19320 	 *    latter, there are no failures in illgrp_insert/illgrp_delete
19321 	 *    (ENOMEM can't occur for this. Check ifgrp_insert).
19322 	 */
19323 	while (irep > ire_array) {
19324 		irep--;
19325 		if (*irep != NULL) {
19326 			ire_delete(*irep);
19327 			if (ire_added)
19328 				ire_refrele(*irep);
19329 		}
19330 	}
19331 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid);
19332 
19333 	if (ipif_saved_irep != NULL) {
19334 		kmem_free(ipif_saved_irep,
19335 		    ipif_saved_ire_cnt * sizeof (ire_t *));
19336 	}
19337 	if (src_ipif_held)
19338 		ipif_refrele(src_ipif);
19339 
19340 	ipif_arp_down(ipif);
19341 	return (err);
19342 }
19343 
19344 /*
19345  * Turn off the ARP with the ILLF_NOARP flag.
19346  */
19347 static int
19348 ill_arp_off(ill_t *ill)
19349 {
19350 	mblk_t	*arp_off_mp = NULL;
19351 	mblk_t	*arp_on_mp = NULL;
19352 
19353 	ip1dbg(("ill_arp_off(%s)\n", ill->ill_name));
19354 
19355 	ASSERT(IAM_WRITER_ILL(ill));
19356 	ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
19357 
19358 	/*
19359 	 * If the on message is still around we've already done
19360 	 * an arp_off without doing an arp_on thus there is no
19361 	 * work needed.
19362 	 */
19363 	if (ill->ill_arp_on_mp != NULL)
19364 		return (0);
19365 
19366 	/*
19367 	 * Allocate an ARP on message (to be saved) and an ARP off message
19368 	 */
19369 	arp_off_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aroff_template, 0);
19370 	if (!arp_off_mp)
19371 		return (ENOMEM);
19372 
19373 	arp_on_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aron_template, 0);
19374 	if (!arp_on_mp)
19375 		goto failed;
19376 
19377 	ASSERT(ill->ill_arp_on_mp == NULL);
19378 	ill->ill_arp_on_mp = arp_on_mp;
19379 
19380 	/* Send an AR_INTERFACE_OFF request */
19381 	putnext(ill->ill_rq, arp_off_mp);
19382 	return (0);
19383 failed:
19384 
19385 	if (arp_off_mp)
19386 		freemsg(arp_off_mp);
19387 	return (ENOMEM);
19388 }
19389 
19390 /*
19391  * Turn on ARP by turning off the ILLF_NOARP flag.
19392  */
19393 static int
19394 ill_arp_on(ill_t *ill)
19395 {
19396 	mblk_t	*mp;
19397 
19398 	ip1dbg(("ipif_arp_on(%s)\n", ill->ill_name));
19399 
19400 	ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
19401 
19402 	ASSERT(IAM_WRITER_ILL(ill));
19403 	/*
19404 	 * Send an AR_INTERFACE_ON request if we have already done
19405 	 * an arp_off (which allocated the message).
19406 	 */
19407 	if (ill->ill_arp_on_mp != NULL) {
19408 		mp = ill->ill_arp_on_mp;
19409 		ill->ill_arp_on_mp = NULL;
19410 		putnext(ill->ill_rq, mp);
19411 	}
19412 	return (0);
19413 }
19414 
19415 /*
19416  * Called after either deleting ill from the group or when setting
19417  * FAILED or STANDBY on the interface.
19418  */
19419 static void
19420 illgrp_reset_schednext(ill_t *ill)
19421 {
19422 	ill_group_t *illgrp;
19423 	ill_t *save_ill;
19424 
19425 	ASSERT(IAM_WRITER_ILL(ill));
19426 	/*
19427 	 * When called from illgrp_delete, ill_group will be non-NULL.
19428 	 * But when called from ip_sioctl_flags, it could be NULL if
19429 	 * somebody is setting FAILED/INACTIVE on some interface which
19430 	 * is not part of a group.
19431 	 */
19432 	illgrp = ill->ill_group;
19433 	if (illgrp == NULL)
19434 		return;
19435 	if (illgrp->illgrp_ill_schednext != ill)
19436 		return;
19437 
19438 	illgrp->illgrp_ill_schednext = NULL;
19439 	save_ill = ill;
19440 	/*
19441 	 * Choose a good ill to be the next one for
19442 	 * outbound traffic. As the flags FAILED/STANDBY is
19443 	 * not yet marked when called from ip_sioctl_flags,
19444 	 * we check for ill separately.
19445 	 */
19446 	for (ill = illgrp->illgrp_ill; ill != NULL;
19447 	    ill = ill->ill_group_next) {
19448 		if ((ill != save_ill) &&
19449 		    !(ill->ill_phyint->phyint_flags &
19450 		    (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE))) {
19451 			illgrp->illgrp_ill_schednext = ill;
19452 			return;
19453 		}
19454 	}
19455 }
19456 
19457 /*
19458  * Given an ill, find the next ill in the group to be scheduled.
19459  * (This should be called by ip_newroute() before ire_create().)
19460  * The passed in ill may be pulled out of the group, after we have picked
19461  * up a different outgoing ill from the same group. However ire add will
19462  * atomically check this.
19463  */
19464 ill_t *
19465 illgrp_scheduler(ill_t *ill)
19466 {
19467 	ill_t *retill;
19468 	ill_group_t *illgrp;
19469 	int illcnt;
19470 	int i;
19471 	uint64_t flags;
19472 
19473 	/*
19474 	 * We don't use a lock to check for the ill_group. If this ill
19475 	 * is currently being inserted we may end up just returning this
19476 	 * ill itself. That is ok.
19477 	 */
19478 	if (ill->ill_group == NULL) {
19479 		ill_refhold(ill);
19480 		return (ill);
19481 	}
19482 
19483 	/*
19484 	 * Grab the ill_g_lock as reader to make sure we are dealing with
19485 	 * a set of stable ills. No ill can be added or deleted or change
19486 	 * group while we hold the reader lock.
19487 	 */
19488 	rw_enter(&ill_g_lock, RW_READER);
19489 	if ((illgrp = ill->ill_group) == NULL) {
19490 		rw_exit(&ill_g_lock);
19491 		ill_refhold(ill);
19492 		return (ill);
19493 	}
19494 
19495 	illcnt = illgrp->illgrp_ill_count;
19496 	mutex_enter(&illgrp->illgrp_lock);
19497 	retill = illgrp->illgrp_ill_schednext;
19498 
19499 	if (retill == NULL)
19500 		retill = illgrp->illgrp_ill;
19501 
19502 	/*
19503 	 * We do a circular search beginning at illgrp_ill_schednext
19504 	 * or illgrp_ill. We don't check the flags against the ill lock
19505 	 * since it can change anytime. The ire creation will be atomic
19506 	 * and will fail if the ill is FAILED or OFFLINE.
19507 	 */
19508 	for (i = 0; i < illcnt; i++) {
19509 		flags = retill->ill_phyint->phyint_flags;
19510 
19511 		if (!(flags & (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) &&
19512 		    ILL_CAN_LOOKUP(retill)) {
19513 			illgrp->illgrp_ill_schednext = retill->ill_group_next;
19514 			ill_refhold(retill);
19515 			break;
19516 		}
19517 		retill = retill->ill_group_next;
19518 		if (retill == NULL)
19519 			retill = illgrp->illgrp_ill;
19520 	}
19521 	mutex_exit(&illgrp->illgrp_lock);
19522 	rw_exit(&ill_g_lock);
19523 
19524 	return (i == illcnt ? NULL : retill);
19525 }
19526 
19527 /*
19528  * Checks for availbility of a usable source address (if there is one) when the
19529  * destination ILL has the ill_usesrc_ifindex pointing to another ILL. Note
19530  * this selection is done regardless of the destination.
19531  */
19532 boolean_t
19533 ipif_usesrc_avail(ill_t *ill, zoneid_t zoneid)
19534 {
19535 	uint_t	ifindex;
19536 	ipif_t	*ipif = NULL;
19537 	ill_t	*uill;
19538 	boolean_t isv6;
19539 
19540 	ASSERT(ill != NULL);
19541 
19542 	isv6 = ill->ill_isv6;
19543 	ifindex = ill->ill_usesrc_ifindex;
19544 	if (ifindex != 0) {
19545 		uill = ill_lookup_on_ifindex(ifindex, isv6, NULL, NULL, NULL,
19546 		    NULL);
19547 		if (uill == NULL)
19548 			return (NULL);
19549 		mutex_enter(&uill->ill_lock);
19550 		for (ipif = uill->ill_ipif; ipif != NULL;
19551 		    ipif = ipif->ipif_next) {
19552 			if (!IPIF_CAN_LOOKUP(ipif))
19553 				continue;
19554 			if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
19555 				continue;
19556 			if (!(ipif->ipif_flags & IPIF_UP))
19557 				continue;
19558 			if (ipif->ipif_zoneid != zoneid)
19559 				continue;
19560 			if ((isv6 &&
19561 			    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) ||
19562 			    (ipif->ipif_lcl_addr == INADDR_ANY))
19563 				continue;
19564 			mutex_exit(&uill->ill_lock);
19565 			ill_refrele(uill);
19566 			return (B_TRUE);
19567 		}
19568 		mutex_exit(&uill->ill_lock);
19569 		ill_refrele(uill);
19570 	}
19571 	return (B_FALSE);
19572 }
19573 
19574 /*
19575  * Determine the best source address given a destination address and an ill.
19576  * Prefers non-deprecated over deprecated but will return a deprecated
19577  * address if there is no other choice. If there is a usable source address
19578  * on the interface pointed to by ill_usesrc_ifindex then that is given
19579  * first preference.
19580  *
19581  * Returns NULL if there is no suitable source address for the ill.
19582  * This only occurs when there is no valid source address for the ill.
19583  */
19584 ipif_t *
19585 ipif_select_source(ill_t *ill, ipaddr_t dst, zoneid_t zoneid)
19586 {
19587 	ipif_t *ipif;
19588 	ipif_t *ipif_dep = NULL;	/* Fallback to deprecated */
19589 	ipif_t *ipif_arr[MAX_IPIF_SELECT_SOURCE];
19590 	int index = 0;
19591 	boolean_t wrapped = B_FALSE;
19592 	boolean_t same_subnet_only = B_FALSE;
19593 	boolean_t ipif_same_found, ipif_other_found;
19594 	ill_t	*till, *usill = NULL;
19595 
19596 	if (ill->ill_usesrc_ifindex != 0) {
19597 		usill = ill_lookup_on_ifindex(ill->ill_usesrc_ifindex, B_FALSE,
19598 		    NULL, NULL, NULL, NULL);
19599 		if (usill != NULL)
19600 			ill = usill;	/* Select source from usesrc ILL */
19601 		else
19602 			return (NULL);
19603 	}
19604 
19605 	/*
19606 	 * Holds the ill_g_lock as reader. This makes sure that no ipif/ill
19607 	 * can be deleted. But an ipif/ill can get CONDEMNED any time.
19608 	 * After selecting the right ipif, under ill_lock make sure ipif is
19609 	 * not condemned, and increment refcnt. If ipif is CONDEMNED,
19610 	 * we retry. Inside the loop we still need to check for CONDEMNED,
19611 	 * but not under a lock.
19612 	 */
19613 	rw_enter(&ill_g_lock, RW_READER);
19614 
19615 retry:
19616 	till = ill;
19617 	ipif_arr[0] = NULL;
19618 
19619 	if (till->ill_group != NULL)
19620 		till = till->ill_group->illgrp_ill;
19621 
19622 	/*
19623 	 * Choose one good source address from each ill across the group.
19624 	 * If possible choose a source address in the same subnet as
19625 	 * the destination address.
19626 	 *
19627 	 * We don't check for PHYI_FAILED or PHYI_INACTIVE or PHYI_OFFLINE
19628 	 * This is okay because of the following.
19629 	 *
19630 	 *    If PHYI_FAILED is set and we still have non-deprecated
19631 	 *    addresses, it means the addresses have not yet been
19632 	 *    failed over to a different interface. We potentially
19633 	 *    select them to create IRE_CACHES, which will be later
19634 	 *    flushed when the addresses move over.
19635 	 *
19636 	 *    If PHYI_INACTIVE is set and we still have non-deprecated
19637 	 *    addresses, it means either the user has configured them
19638 	 *    or PHYI_INACTIVE has not been cleared after the addresses
19639 	 *    been moved over. For the former, in.mpathd does a failover
19640 	 *    when the interface becomes INACTIVE and hence we should
19641 	 *    not find them. Once INACTIVE is set, we don't allow them
19642 	 *    to create logical interfaces anymore. For the latter, a
19643 	 *    flush will happen when INACTIVE is cleared which will
19644 	 *    flush the IRE_CACHES.
19645 	 *
19646 	 *    If PHYI_OFFLINE is set, all the addresses will be failed
19647 	 *    over soon. We potentially select them to create IRE_CACHEs,
19648 	 *    which will be later flushed when the addresses move over.
19649 	 *
19650 	 * NOTE : As ipif_select_source is called to borrow source address
19651 	 * for an ipif that is part of a group, source address selection
19652 	 * will be re-done whenever the group changes i.e either an
19653 	 * insertion/deletion in the group.
19654 	 *
19655 	 * Fill ipif_arr[] with source addresses, using these rules:
19656 	 *
19657 	 *	1. At most one source address from a given ill ends up
19658 	 *	   in ipif_arr[] -- that is, at most one of the ipif's
19659 	 *	   associated with a given ill ends up in ipif_arr[].
19660 	 *
19661 	 *	2. If there is at least one non-deprecated ipif in the
19662 	 *	   IPMP group with a source address on the same subnet as
19663 	 *	   our destination, then fill ipif_arr[] only with
19664 	 *	   source addresses on the same subnet as our destination.
19665 	 *	   Note that because of (1), only the first
19666 	 *	   non-deprecated ipif found with a source address
19667 	 *	   matching the destination ends up in ipif_arr[].
19668 	 *
19669 	 *	3. Otherwise, fill ipif_arr[] with non-deprecated source
19670 	 *	   addresses not in the same subnet as our destination.
19671 	 *	   Again, because of (1), only the first off-subnet source
19672 	 *	   address will be chosen.
19673 	 *
19674 	 *	4. If there are no non-deprecated ipifs, then just use
19675 	 *	   the source address associated with the last deprecated
19676 	 *	   one we find that happens to be on the same subnet,
19677 	 *	   otherwise the first one not in the same subnet.
19678 	 */
19679 	for (; till != NULL; till = till->ill_group_next) {
19680 		ipif_same_found = B_FALSE;
19681 		ipif_other_found = B_FALSE;
19682 		for (ipif = till->ill_ipif; ipif != NULL;
19683 		    ipif = ipif->ipif_next) {
19684 			if (!IPIF_CAN_LOOKUP(ipif))
19685 				continue;
19686 			/* Always skip NOLOCAL and ANYCAST interfaces */
19687 			if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
19688 				continue;
19689 			if (!(ipif->ipif_flags & IPIF_UP))
19690 				continue;
19691 			if (ipif->ipif_zoneid != zoneid)
19692 				continue;
19693 			/*
19694 			 * Interfaces with 0.0.0.0 address are allowed to be UP,
19695 			 * but are not valid as source addresses.
19696 			 */
19697 			if (ipif->ipif_lcl_addr == INADDR_ANY)
19698 				continue;
19699 			if (ipif->ipif_flags & IPIF_DEPRECATED) {
19700 				if (ipif_dep == NULL ||
19701 				    (ipif->ipif_net_mask & dst) ==
19702 				    ipif->ipif_subnet)
19703 					ipif_dep = ipif;
19704 				continue;
19705 			}
19706 			if ((ipif->ipif_net_mask & dst) == ipif->ipif_subnet) {
19707 				/* found a source address in the same subnet */
19708 				if (same_subnet_only == B_FALSE) {
19709 					same_subnet_only = B_TRUE;
19710 					index = 0;
19711 				}
19712 				ipif_same_found = B_TRUE;
19713 			} else {
19714 				if (same_subnet_only == B_TRUE ||
19715 				    ipif_other_found == B_TRUE)
19716 					continue;
19717 				ipif_other_found = B_TRUE;
19718 			}
19719 			ipif_arr[index++] = ipif;
19720 			if (index == MAX_IPIF_SELECT_SOURCE) {
19721 				wrapped = B_TRUE;
19722 				index = 0;
19723 			}
19724 			if (ipif_same_found == B_TRUE)
19725 				break;
19726 		}
19727 	}
19728 
19729 	if (ipif_arr[0] == NULL) {
19730 		ipif = ipif_dep;
19731 	} else {
19732 		if (wrapped)
19733 			index = MAX_IPIF_SELECT_SOURCE;
19734 		ipif = ipif_arr[ipif_rand() % index];
19735 		ASSERT(ipif != NULL);
19736 	}
19737 
19738 	if (ipif != NULL) {
19739 		mutex_enter(&ipif->ipif_ill->ill_lock);
19740 		if (!IPIF_CAN_LOOKUP(ipif)) {
19741 			mutex_exit(&ipif->ipif_ill->ill_lock);
19742 			goto retry;
19743 		}
19744 		ipif_refhold_locked(ipif);
19745 		mutex_exit(&ipif->ipif_ill->ill_lock);
19746 	}
19747 
19748 	rw_exit(&ill_g_lock);
19749 	if (usill != NULL)
19750 		ill_refrele(usill);
19751 
19752 #ifdef DEBUG
19753 	if (ipif == NULL) {
19754 		char buf1[INET6_ADDRSTRLEN];
19755 
19756 		ip1dbg(("ipif_select_source(%s, %s) -> NULL\n",
19757 		    ill->ill_name,
19758 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1))));
19759 	} else {
19760 		char buf1[INET6_ADDRSTRLEN];
19761 		char buf2[INET6_ADDRSTRLEN];
19762 
19763 		ip1dbg(("ipif_select_source(%s, %s) -> %s\n",
19764 		    ipif->ipif_ill->ill_name,
19765 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1)),
19766 		    inet_ntop(AF_INET, &ipif->ipif_lcl_addr,
19767 		    buf2, sizeof (buf2))));
19768 	}
19769 #endif /* DEBUG */
19770 	return (ipif);
19771 }
19772 
19773 
19774 /*
19775  * If old_ipif is not NULL, see if ipif was derived from old
19776  * ipif and if so, recreate the interface route by re-doing
19777  * source address selection. This happens when ipif_down ->
19778  * ipif_update_other_ipifs calls us.
19779  *
19780  * If old_ipif is NULL, just redo the source address selection
19781  * if needed. This happens when illgrp_insert or ipif_up_done
19782  * calls us.
19783  */
19784 static void
19785 ipif_recreate_interface_routes(ipif_t *old_ipif, ipif_t *ipif)
19786 {
19787 	ire_t *ire;
19788 	ire_t *ipif_ire;
19789 	queue_t *stq;
19790 	ipif_t *nipif;
19791 	ill_t *ill;
19792 	boolean_t need_rele = B_FALSE;
19793 
19794 	ASSERT(old_ipif == NULL || IAM_WRITER_IPIF(old_ipif));
19795 	ASSERT(IAM_WRITER_IPIF(ipif));
19796 
19797 	ill = ipif->ipif_ill;
19798 	if (!(ipif->ipif_flags &
19799 	    (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) {
19800 		/*
19801 		 * Can't possibly have borrowed the source
19802 		 * from old_ipif.
19803 		 */
19804 		return;
19805 	}
19806 
19807 	/*
19808 	 * Is there any work to be done? No work if the address
19809 	 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST (
19810 	 * ipif_select_source() does not borrow addresses from
19811 	 * NOLOCAL and ANYCAST interfaces).
19812 	 */
19813 	if ((old_ipif != NULL) &&
19814 	    ((old_ipif->ipif_lcl_addr == INADDR_ANY) ||
19815 	    (old_ipif->ipif_ill->ill_wq == NULL) ||
19816 	    (old_ipif->ipif_flags &
19817 	    (IPIF_NOLOCAL|IPIF_ANYCAST)))) {
19818 		return;
19819 	}
19820 
19821 	/*
19822 	 * Perform the same checks as when creating the
19823 	 * IRE_INTERFACE in ipif_up_done.
19824 	 */
19825 	if (!(ipif->ipif_flags & IPIF_UP))
19826 		return;
19827 
19828 	if ((ipif->ipif_flags & IPIF_NOXMIT) ||
19829 	    (ipif->ipif_subnet == INADDR_ANY))
19830 		return;
19831 
19832 	ipif_ire = ipif_to_ire(ipif);
19833 	if (ipif_ire == NULL)
19834 		return;
19835 
19836 	/*
19837 	 * We know that ipif uses some other source for its
19838 	 * IRE_INTERFACE. Is it using the source of this
19839 	 * old_ipif?
19840 	 */
19841 	if (old_ipif != NULL &&
19842 	    old_ipif->ipif_lcl_addr != ipif_ire->ire_src_addr) {
19843 		ire_refrele(ipif_ire);
19844 		return;
19845 	}
19846 	if (ip_debug > 2) {
19847 		/* ip1dbg */
19848 		pr_addr_dbg("ipif_recreate_interface_routes: deleting IRE for"
19849 		    " src %s\n", AF_INET, &ipif_ire->ire_src_addr);
19850 	}
19851 
19852 	stq = ipif_ire->ire_stq;
19853 
19854 	/*
19855 	 * Can't use our source address. Select a different
19856 	 * source address for the IRE_INTERFACE.
19857 	 */
19858 	nipif = ipif_select_source(ill, ipif->ipif_subnet, ipif->ipif_zoneid);
19859 	if (nipif == NULL) {
19860 		/* Last resort - all ipif's have IPIF_NOLOCAL */
19861 		nipif = ipif;
19862 	} else {
19863 		need_rele = B_TRUE;
19864 	}
19865 
19866 	ire = ire_create(
19867 	    (uchar_t *)&ipif->ipif_subnet,	/* dest pref */
19868 	    (uchar_t *)&ipif->ipif_net_mask,	/* mask */
19869 	    (uchar_t *)&nipif->ipif_src_addr,	/* src addr */
19870 	    NULL,				/* no gateway */
19871 	    NULL,
19872 	    &ipif->ipif_mtu,			/* max frag */
19873 	    NULL,				/* fast path header */
19874 	    NULL,				/* no recv from queue */
19875 	    stq,				/* send-to queue */
19876 	    ill->ill_net_type,			/* IF_[NO]RESOLVER */
19877 	    ill->ill_resolver_mp,		/* xmit header */
19878 	    ipif,
19879 	    NULL,
19880 	    0,
19881 	    0,
19882 	    0,
19883 	    0,
19884 	    &ire_uinfo_null);
19885 
19886 	if (ire != NULL) {
19887 		ire_t *ret_ire;
19888 		int error;
19889 
19890 		/*
19891 		 * We don't need ipif_ire anymore. We need to delete
19892 		 * before we add so that ire_add does not detect
19893 		 * duplicates.
19894 		 */
19895 		ire_delete(ipif_ire);
19896 		ret_ire = ire;
19897 		error = ire_add(&ret_ire, NULL, NULL, NULL);
19898 		ASSERT(error == 0);
19899 		ASSERT(ire == ret_ire);
19900 		/* Held in ire_add */
19901 		ire_refrele(ret_ire);
19902 	}
19903 	/*
19904 	 * Either we are falling through from above or could not
19905 	 * allocate a replacement.
19906 	 */
19907 	ire_refrele(ipif_ire);
19908 	if (need_rele)
19909 		ipif_refrele(nipif);
19910 }
19911 
19912 /*
19913  * This old_ipif is going away.
19914  *
19915  * Determine if any other ipif's is using our address as
19916  * ipif_lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or
19917  * IPIF_DEPRECATED).
19918  * Find the IRE_INTERFACE for such ipifs and recreate them
19919  * to use an different source address following the rules in
19920  * ipif_up_done.
19921  *
19922  * This function takes an illgrp as an argument so that illgrp_delete
19923  * can call this to update source address even after deleting the
19924  * old_ipif->ipif_ill from the ill group.
19925  */
19926 static void
19927 ipif_update_other_ipifs(ipif_t *old_ipif, ill_group_t *illgrp)
19928 {
19929 	ipif_t *ipif;
19930 	ill_t *ill;
19931 	char	buf[INET6_ADDRSTRLEN];
19932 
19933 	ASSERT(IAM_WRITER_IPIF(old_ipif));
19934 	ASSERT(illgrp == NULL || IAM_WRITER_IPIF(old_ipif));
19935 
19936 	ill = old_ipif->ipif_ill;
19937 
19938 	ip1dbg(("ipif_update_other_ipifs(%s, %s)\n",
19939 	    ill->ill_name,
19940 	    inet_ntop(AF_INET, &old_ipif->ipif_lcl_addr,
19941 	    buf, sizeof (buf))));
19942 	/*
19943 	 * If this part of a group, look at all ills as ipif_select_source
19944 	 * borrows source address across all the ills in the group.
19945 	 */
19946 	if (illgrp != NULL)
19947 		ill = illgrp->illgrp_ill;
19948 
19949 	for (; ill != NULL; ill = ill->ill_group_next) {
19950 		for (ipif = ill->ill_ipif; ipif != NULL;
19951 		    ipif = ipif->ipif_next) {
19952 
19953 			if (ipif == old_ipif)
19954 				continue;
19955 
19956 			ipif_recreate_interface_routes(old_ipif, ipif);
19957 		}
19958 	}
19959 }
19960 
19961 /* ARGSUSED */
19962 int
19963 if_unitsel_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
19964 	ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
19965 {
19966 	/*
19967 	 * ill_phyint_reinit merged the v4 and v6 into a single
19968 	 * ipsq. Could also have become part of a ipmp group in the
19969 	 * process, and we might not have been able to complete the
19970 	 * operation in ipif_set_values, if we could not become
19971 	 * exclusive.  If so restart it here.
19972 	 */
19973 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
19974 }
19975 
19976 
19977 /* ARGSUSED */
19978 int
19979 if_unitsel(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
19980     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
19981 {
19982 	queue_t		*q1 = q;
19983 	char 		*cp;
19984 	char		interf_name[LIFNAMSIZ];
19985 	uint_t		ppa = *(uint_t *)mp->b_cont->b_cont->b_rptr;
19986 
19987 	if (!q->q_next) {
19988 		ip1dbg((
19989 		    "if_unitsel: IF_UNITSEL: no q_next\n"));
19990 		return (EINVAL);
19991 	}
19992 
19993 	if (((ill_t *)(q->q_ptr))->ill_name[0] != '\0')
19994 		return (EALREADY);
19995 
19996 	do {
19997 		q1 = q1->q_next;
19998 	} while (q1->q_next);
19999 	cp = q1->q_qinfo->qi_minfo->mi_idname;
20000 	(void) sprintf(interf_name, "%s%d", cp, ppa);
20001 
20002 	/*
20003 	 * Here we are not going to delay the ioack until after
20004 	 * ACKs from DL_ATTACH_REQ/DL_BIND_REQ. So no need to save the
20005 	 * original ioctl message before sending the requests.
20006 	 */
20007 	return (ipif_set_values(q, mp, interf_name, &ppa));
20008 }
20009 
20010 /* ARGSUSED */
20011 int
20012 ip_sioctl_sifname(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
20013     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
20014 {
20015 	return (ENXIO);
20016 }
20017 
20018 /*
20019  * Net and subnet broadcast ire's are now specific to the particular
20020  * physical interface (ill) and not to any one locigal interface (ipif).
20021  * However, if a particular logical interface is being taken down, it's
20022  * associated ire's will be taken down as well.  Hence, when we go to
20023  * take down or change the local address, broadcast address or netmask
20024  * of a specific logical interface, we must check to make sure that we
20025  * have valid net and subnet broadcast ire's for the other logical
20026  * interfaces which may have been shared with the logical interface
20027  * being brought down or changed.
20028  *
20029  * There is one set of 0.0.0.0 and 255.255.255.255 per ill. Usually it
20030  * is tied to the first interface coming UP. If that ipif is going down,
20031  * we need to recreate them on the next valid ipif.
20032  *
20033  * Note: assume that the ipif passed in is still up so that it's IRE
20034  * entries are still valid.
20035  */
20036 static void
20037 ipif_check_bcast_ires(ipif_t *test_ipif)
20038 {
20039 	ipif_t	*ipif;
20040 	ire_t	*test_subnet_ire, *test_net_ire;
20041 	ire_t	*test_allzero_ire, *test_allone_ire;
20042 	ire_t	*ire_array[12];
20043 	ire_t	**irep = &ire_array[0];
20044 	ire_t	**irep1;
20045 
20046 	ipaddr_t net_addr, subnet_addr, net_mask, subnet_mask;
20047 	ipaddr_t test_net_addr, test_subnet_addr;
20048 	ipaddr_t test_net_mask, test_subnet_mask;
20049 	boolean_t need_net_bcast_ire = B_FALSE;
20050 	boolean_t need_subnet_bcast_ire = B_FALSE;
20051 	boolean_t allzero_bcast_ire_created = B_FALSE;
20052 	boolean_t allone_bcast_ire_created = B_FALSE;
20053 	boolean_t net_bcast_ire_created = B_FALSE;
20054 	boolean_t subnet_bcast_ire_created = B_FALSE;
20055 
20056 	ipif_t  *backup_ipif_net = (ipif_t *)NULL;
20057 	ipif_t  *backup_ipif_subnet = (ipif_t *)NULL;
20058 	ipif_t  *backup_ipif_allzeros = (ipif_t *)NULL;
20059 	ipif_t  *backup_ipif_allones = (ipif_t *)NULL;
20060 	uint64_t check_flags = IPIF_DEPRECATED | IPIF_NOLOCAL | IPIF_ANYCAST;
20061 
20062 	ASSERT(!test_ipif->ipif_isv6);
20063 	ASSERT(IAM_WRITER_IPIF(test_ipif));
20064 
20065 	/*
20066 	 * No broadcast IREs for the LOOPBACK interface
20067 	 * or others such as point to point and IPIF_NOXMIT.
20068 	 */
20069 	if (!(test_ipif->ipif_flags & IPIF_BROADCAST) ||
20070 	    (test_ipif->ipif_flags & IPIF_NOXMIT))
20071 		return;
20072 
20073 	test_allzero_ire = ire_ctable_lookup(0, 0, IRE_BROADCAST,
20074 	    test_ipif, ALL_ZONES, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
20075 
20076 	test_allone_ire = ire_ctable_lookup(INADDR_BROADCAST, 0, IRE_BROADCAST,
20077 	    test_ipif, ALL_ZONES, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
20078 
20079 	test_net_mask = ip_net_mask(test_ipif->ipif_subnet);
20080 	test_subnet_mask = test_ipif->ipif_net_mask;
20081 
20082 	/*
20083 	 * If no net mask set, assume the default based on net class.
20084 	 */
20085 	if (test_subnet_mask == 0)
20086 		test_subnet_mask = test_net_mask;
20087 
20088 	/*
20089 	 * Check if there is a network broadcast ire associated with this ipif
20090 	 */
20091 	test_net_addr = test_net_mask  & test_ipif->ipif_subnet;
20092 	test_net_ire = ire_ctable_lookup(test_net_addr, 0, IRE_BROADCAST,
20093 	    test_ipif, ALL_ZONES, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
20094 
20095 	/*
20096 	 * Check if there is a subnet broadcast IRE associated with this ipif
20097 	 */
20098 	test_subnet_addr = test_subnet_mask  & test_ipif->ipif_subnet;
20099 	test_subnet_ire = ire_ctable_lookup(test_subnet_addr, 0, IRE_BROADCAST,
20100 	    test_ipif, ALL_ZONES, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
20101 
20102 	/*
20103 	 * No broadcast ire's associated with this ipif.
20104 	 */
20105 	if ((test_subnet_ire == NULL) && (test_net_ire == NULL) &&
20106 	    (test_allzero_ire == NULL) && (test_allone_ire == NULL)) {
20107 		return;
20108 	}
20109 
20110 	/*
20111 	 * We have established which bcast ires have to be replaced.
20112 	 * Next we try to locate ipifs that match there ires.
20113 	 * The rules are simple: If we find an ipif that matches on the subnet
20114 	 * address it will also match on the net address, the allzeros and
20115 	 * allones address. Any ipif that matches only on the net address will
20116 	 * also match the allzeros and allones addresses.
20117 	 * The other criterion is the ipif_flags. We look for non-deprecated
20118 	 * (and non-anycast and non-nolocal) ipifs as the best choice.
20119 	 * ipifs with check_flags matching (deprecated, etc) are used only
20120 	 * if good ipifs are not available. While looping, we save existing
20121 	 * deprecated ipifs as backup_ipif.
20122 	 * We loop through all the ipifs for this ill looking for ipifs
20123 	 * whose broadcast addr match the ipif passed in, but do not have
20124 	 * their own broadcast ires. For creating 0.0.0.0 and
20125 	 * 255.255.255.255 we just need an ipif on this ill to create.
20126 	 */
20127 	for (ipif = test_ipif->ipif_ill->ill_ipif; ipif != NULL;
20128 	    ipif = ipif->ipif_next) {
20129 
20130 		ASSERT(!ipif->ipif_isv6);
20131 		/*
20132 		 * Already checked the ipif passed in.
20133 		 */
20134 		if (ipif == test_ipif) {
20135 			continue;
20136 		}
20137 
20138 		/*
20139 		 * We only need to recreate broadcast ires if another ipif in
20140 		 * the same zone uses them. The new ires must be created in the
20141 		 * same zone.
20142 		 */
20143 		if (ipif->ipif_zoneid != test_ipif->ipif_zoneid) {
20144 			continue;
20145 		}
20146 
20147 		/*
20148 		 * Only interested in logical interfaces with valid local
20149 		 * addresses or with the ability to broadcast.
20150 		 */
20151 		if ((ipif->ipif_subnet == 0) ||
20152 		    !(ipif->ipif_flags & IPIF_BROADCAST) ||
20153 		    (ipif->ipif_flags & IPIF_NOXMIT) ||
20154 		    !(ipif->ipif_flags & IPIF_UP)) {
20155 			continue;
20156 		}
20157 		/*
20158 		 * Check if there is a net broadcast ire for this
20159 		 * net address.  If it turns out that the ipif we are
20160 		 * about to take down owns this ire, we must make a
20161 		 * new one because it is potentially going away.
20162 		 */
20163 		if (test_net_ire && (!net_bcast_ire_created)) {
20164 			net_mask = ip_net_mask(ipif->ipif_subnet);
20165 			net_addr = net_mask & ipif->ipif_subnet;
20166 			if (net_addr == test_net_addr) {
20167 				need_net_bcast_ire = B_TRUE;
20168 				/*
20169 				 * Use DEPRECATED ipif only if no good
20170 				 * ires are available. subnet_addr is
20171 				 * a better match than net_addr.
20172 				 */
20173 				if ((ipif->ipif_flags & check_flags) &&
20174 				    (backup_ipif_net == NULL)) {
20175 					backup_ipif_net = ipif;
20176 				}
20177 			}
20178 		}
20179 		/*
20180 		 * Check if there is a subnet broadcast ire for this
20181 		 * net address.  If it turns out that the ipif we are
20182 		 * about to take down owns this ire, we must make a
20183 		 * new one because it is potentially going away.
20184 		 */
20185 		if (test_subnet_ire && (!subnet_bcast_ire_created)) {
20186 			subnet_mask = ipif->ipif_net_mask;
20187 			subnet_addr = ipif->ipif_subnet;
20188 			if (subnet_addr == test_subnet_addr) {
20189 				need_subnet_bcast_ire = B_TRUE;
20190 				if ((ipif->ipif_flags & check_flags) &&
20191 				    (backup_ipif_subnet == NULL)) {
20192 					backup_ipif_subnet = ipif;
20193 				}
20194 			}
20195 		}
20196 
20197 
20198 		/* Short circuit here if this ipif is deprecated */
20199 		if (ipif->ipif_flags & check_flags) {
20200 			if ((test_allzero_ire != NULL) &&
20201 			    (!allzero_bcast_ire_created) &&
20202 			    (backup_ipif_allzeros == NULL)) {
20203 				backup_ipif_allzeros = ipif;
20204 			}
20205 			if ((test_allone_ire != NULL) &&
20206 			    (!allone_bcast_ire_created) &&
20207 			    (backup_ipif_allones == NULL)) {
20208 				backup_ipif_allones = ipif;
20209 			}
20210 			continue;
20211 		}
20212 
20213 		/*
20214 		 * Found an ipif which has the same broadcast ire as the
20215 		 * ipif passed in and the ipif passed in "owns" the ire.
20216 		 * Create new broadcast ire's for this broadcast addr.
20217 		 */
20218 		if (need_net_bcast_ire && !net_bcast_ire_created) {
20219 			irep = ire_create_bcast(ipif, net_addr, irep);
20220 			irep = ire_create_bcast(ipif,
20221 			    ~net_mask | net_addr, irep);
20222 			net_bcast_ire_created = B_TRUE;
20223 		}
20224 		if (need_subnet_bcast_ire && !subnet_bcast_ire_created) {
20225 			irep = ire_create_bcast(ipif, subnet_addr, irep);
20226 			irep = ire_create_bcast(ipif,
20227 			    ~subnet_mask | subnet_addr, irep);
20228 			subnet_bcast_ire_created = B_TRUE;
20229 		}
20230 		if (test_allzero_ire != NULL && !allzero_bcast_ire_created) {
20231 			irep = ire_create_bcast(ipif, 0, irep);
20232 			allzero_bcast_ire_created = B_TRUE;
20233 		}
20234 		if (test_allone_ire != NULL && !allone_bcast_ire_created) {
20235 			irep = ire_create_bcast(ipif, INADDR_BROADCAST, irep);
20236 			allone_bcast_ire_created = B_TRUE;
20237 		}
20238 		/*
20239 		 * Once we have created all the appropriate ires, we
20240 		 * just break out of this loop to add what we have created.
20241 		 * This has been indented similar to ire_match_args for
20242 		 * readability.
20243 		 */
20244 		if (((test_net_ire == NULL) ||
20245 			(net_bcast_ire_created)) &&
20246 		    ((test_subnet_ire == NULL) ||
20247 			(subnet_bcast_ire_created)) &&
20248 		    ((test_allzero_ire == NULL) ||
20249 			(allzero_bcast_ire_created)) &&
20250 		    ((test_allone_ire == NULL) ||
20251 			(allone_bcast_ire_created))) {
20252 			break;
20253 		}
20254 	}
20255 
20256 	/*
20257 	 * Create bcast ires on deprecated ipifs if no non-deprecated ipifs
20258 	 * exist. 6 pairs of bcast ires are needed.
20259 	 * Note - the old ires are deleted in ipif_down.
20260 	 */
20261 	if (need_net_bcast_ire && !net_bcast_ire_created && backup_ipif_net) {
20262 		ipif = backup_ipif_net;
20263 		irep = ire_create_bcast(ipif, net_addr, irep);
20264 		irep = ire_create_bcast(ipif, ~net_mask | net_addr, irep);
20265 		net_bcast_ire_created = B_TRUE;
20266 	}
20267 	if (need_subnet_bcast_ire && !subnet_bcast_ire_created &&
20268 	    backup_ipif_subnet) {
20269 		ipif = backup_ipif_subnet;
20270 		irep = ire_create_bcast(ipif, subnet_addr, irep);
20271 		irep = ire_create_bcast(ipif,
20272 		    ~subnet_mask | subnet_addr, irep);
20273 		subnet_bcast_ire_created = B_TRUE;
20274 	}
20275 	if (test_allzero_ire != NULL && !allzero_bcast_ire_created &&
20276 	    backup_ipif_allzeros) {
20277 		irep = ire_create_bcast(backup_ipif_allzeros, 0, irep);
20278 		allzero_bcast_ire_created = B_TRUE;
20279 	}
20280 	if (test_allone_ire != NULL && !allone_bcast_ire_created &&
20281 	    backup_ipif_allones) {
20282 		irep = ire_create_bcast(backup_ipif_allones,
20283 		    INADDR_BROADCAST, irep);
20284 		allone_bcast_ire_created = B_TRUE;
20285 	}
20286 
20287 	/*
20288 	 * If we can't create all of them, don't add any of them.
20289 	 * Code in ip_wput_ire and ire_to_ill assumes that we
20290 	 * always have a non-loopback copy and loopback copy
20291 	 * for a given address.
20292 	 */
20293 	for (irep1 = irep; irep1 > ire_array; ) {
20294 		irep1--;
20295 		if (*irep1 == NULL) {
20296 			ip0dbg(("ipif_check_bcast_ires: can't create "
20297 			    "IRE_BROADCAST, memory allocation failure\n"));
20298 			while (irep > ire_array) {
20299 				irep--;
20300 				if (*irep != NULL)
20301 					ire_delete(*irep);
20302 			}
20303 			goto bad;
20304 		}
20305 	}
20306 	for (irep1 = irep; irep1 > ire_array; ) {
20307 		int error;
20308 
20309 		irep1--;
20310 		error = ire_add(irep1, NULL, NULL, NULL);
20311 		if (error == 0) {
20312 			ire_refrele(*irep1);		/* Held in ire_add */
20313 		}
20314 	}
20315 bad:
20316 	if (test_allzero_ire != NULL)
20317 		ire_refrele(test_allzero_ire);
20318 	if (test_allone_ire != NULL)
20319 		ire_refrele(test_allone_ire);
20320 	if (test_net_ire != NULL)
20321 		ire_refrele(test_net_ire);
20322 	if (test_subnet_ire != NULL)
20323 		ire_refrele(test_subnet_ire);
20324 }
20325 
20326 /*
20327  * Extract both the flags (including IFF_CANTCHANGE) such as IFF_IPV*
20328  * from lifr_flags and the name from lifr_name.
20329  * Set IFF_IPV* and ill_isv6 prior to doing the lookup
20330  * since ipif_lookup_on_name uses the _isv6 flags when matching.
20331  * Returns EINPROGRESS when mp has been consumed by queueing it on
20332  * ill_pending_mp and the ioctl will complete in ip_rput.
20333  */
20334 /* ARGSUSED */
20335 int
20336 ip_sioctl_slifname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20337     ip_ioctl_cmd_t *ipip, void *if_req)
20338 {
20339 	int	err;
20340 	ill_t	*ill;
20341 	struct lifreq *lifr = (struct lifreq *)if_req;
20342 
20343 	ASSERT(ipif != NULL);
20344 	ip1dbg(("ip_sioctl_slifname %s\n", lifr->lifr_name));
20345 	ASSERT(q->q_next != NULL);
20346 
20347 	ill = (ill_t *)q->q_ptr;
20348 	/*
20349 	 * If we are not writer on 'q' then this interface exists already
20350 	 * and previous lookups (ipif_extract_lifreq_cmn) found this ipif.
20351 	 * So return EALREADY
20352 	 */
20353 	if (ill != ipif->ipif_ill)
20354 		return (EALREADY);
20355 
20356 	if (ill->ill_name[0] != '\0')
20357 		return (EALREADY);
20358 
20359 	/*
20360 	 * Set all the flags. Allows all kinds of override. Provide some
20361 	 * sanity checking by not allowing IFF_BROADCAST and IFF_MULTICAST
20362 	 * unless there is either multicast/broadcast support in the driver
20363 	 * or it is a pt-pt link.
20364 	 */
20365 	if (lifr->lifr_flags & (IFF_PROMISC|IFF_ALLMULTI)) {
20366 		/* Meaningless to IP thus don't allow them to be set. */
20367 		ip1dbg(("ip_setname: EINVAL 1\n"));
20368 		return (EINVAL);
20369 	}
20370 	/*
20371 	 * For a DL_STYLE2 driver (ill_needs_attach), we would not have the
20372 	 * ill_bcast_addr_length info.
20373 	 */
20374 	if (!ill->ill_needs_attach &&
20375 	    ((lifr->lifr_flags & IFF_MULTICAST) &&
20376 	    !(lifr->lifr_flags & IFF_POINTOPOINT) &&
20377 	    ill->ill_bcast_addr_length == 0)) {
20378 		/* Link not broadcast/pt-pt capable i.e. no multicast */
20379 		ip1dbg(("ip_setname: EINVAL 2\n"));
20380 		return (EINVAL);
20381 	}
20382 	if ((lifr->lifr_flags & IFF_BROADCAST) &&
20383 	    ((lifr->lifr_flags & IFF_IPV6) ||
20384 	    (!ill->ill_needs_attach && ill->ill_bcast_addr_length == 0))) {
20385 		/* Link not broadcast capable or IPv6 i.e. no broadcast */
20386 		ip1dbg(("ip_setname: EINVAL 3\n"));
20387 		return (EINVAL);
20388 	}
20389 	if (lifr->lifr_flags & IFF_UP) {
20390 		/* Can only be set with SIOCSLIFFLAGS */
20391 		ip1dbg(("ip_setname: EINVAL 4\n"));
20392 		return (EINVAL);
20393 	}
20394 	if ((lifr->lifr_flags & (IFF_IPV6|IFF_IPV4)) != IFF_IPV6 &&
20395 	    (lifr->lifr_flags & (IFF_IPV6|IFF_IPV4)) != IFF_IPV4) {
20396 		ip1dbg(("ip_setname: EINVAL 5\n"));
20397 		return (EINVAL);
20398 	}
20399 	/*
20400 	 * Only allow the IFF_XRESOLV flag to be set on IPv6 interfaces.
20401 	 */
20402 	if ((lifr->lifr_flags & IFF_XRESOLV) &&
20403 	    !(lifr->lifr_flags & IFF_IPV6) &&
20404 	    !(ipif->ipif_isv6)) {
20405 		ip1dbg(("ip_setname: EINVAL 6\n"));
20406 		return (EINVAL);
20407 	}
20408 
20409 	/*
20410 	 * The user has done SIOCGLIFFLAGS prior to this ioctl and hence
20411 	 * we have all the flags here. So, we assign rather than we OR.
20412 	 * We can't OR the flags here because we don't want to set
20413 	 * both IFF_IPV4 and IFF_IPV6. We start off as IFF_IPV4 in
20414 	 * ipif_allocate and become IFF_IPV4 or IFF_IPV6 here depending
20415 	 * on lifr_flags value here.
20416 	 */
20417 	/*
20418 	 * This ill has not been inserted into the global list.
20419 	 * So we are still single threaded and don't need any lock
20420 	 */
20421 	ipif->ipif_flags = lifr->lifr_flags & IFF_LOGINT_FLAGS;
20422 	ill->ill_flags = lifr->lifr_flags & IFF_PHYINTINST_FLAGS;
20423 	ill->ill_phyint->phyint_flags = lifr->lifr_flags & IFF_PHYINT_FLAGS;
20424 
20425 	/* We started off as V4. */
20426 	if (ill->ill_flags & ILLF_IPV6) {
20427 		ill->ill_phyint->phyint_illv6 = ill;
20428 		ill->ill_phyint->phyint_illv4 = NULL;
20429 	}
20430 	err = ipif_set_values(q, mp, lifr->lifr_name, &lifr->lifr_ppa);
20431 	return (err);
20432 }
20433 
20434 /* ARGSUSED */
20435 int
20436 ip_sioctl_slifname_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20437     ip_ioctl_cmd_t *ipip, void *if_req)
20438 {
20439 	/*
20440 	 * ill_phyint_reinit merged the v4 and v6 into a single
20441 	 * ipsq. Could also have become part of a ipmp group in the
20442 	 * process, and we might not have been able to complete the
20443 	 * slifname in ipif_set_values, if we could not become
20444 	 * exclusive.  If so restart it here
20445 	 */
20446 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
20447 }
20448 
20449 /*
20450  * Return a pointer to the ipif which matches the index, IP version type and
20451  * zoneid.
20452  */
20453 ipif_t *
20454 ipif_lookup_on_ifindex(uint_t index, boolean_t isv6, zoneid_t zoneid,
20455     queue_t *q, mblk_t *mp, ipsq_func_t func, int *err)
20456 {
20457 	ill_t	*ill;
20458 	ipsq_t  *ipsq;
20459 	phyint_t *phyi;
20460 	ipif_t	*ipif;
20461 
20462 	ASSERT((q == NULL && mp == NULL && func == NULL && err == NULL) ||
20463 	    (q != NULL && mp != NULL && func != NULL && err != NULL));
20464 
20465 	if (err != NULL)
20466 		*err = 0;
20467 
20468 	/*
20469 	 * Indexes are stored in the phyint - a common structure
20470 	 * to both IPv4 and IPv6.
20471 	 */
20472 
20473 	rw_enter(&ill_g_lock, RW_READER);
20474 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_index,
20475 	    (void *) &index, NULL);
20476 	if (phyi != NULL) {
20477 		ill = isv6 ? phyi->phyint_illv6 : phyi->phyint_illv4;
20478 		if (ill == NULL) {
20479 			rw_exit(&ill_g_lock);
20480 			if (err != NULL)
20481 				*err = ENXIO;
20482 			return (NULL);
20483 		}
20484 		GRAB_CONN_LOCK(q);
20485 		mutex_enter(&ill->ill_lock);
20486 		if (ILL_CAN_LOOKUP(ill)) {
20487 			for (ipif = ill->ill_ipif; ipif != NULL;
20488 			    ipif = ipif->ipif_next) {
20489 				if (IPIF_CAN_LOOKUP(ipif) &&
20490 				    (zoneid == ALL_ZONES ||
20491 				    zoneid == ipif->ipif_zoneid)) {
20492 					ipif_refhold_locked(ipif);
20493 					mutex_exit(&ill->ill_lock);
20494 					RELEASE_CONN_LOCK(q);
20495 					rw_exit(&ill_g_lock);
20496 					return (ipif);
20497 				}
20498 			}
20499 		} else if (ILL_CAN_WAIT(ill, q)) {
20500 			ipsq = ill->ill_phyint->phyint_ipsq;
20501 			mutex_enter(&ipsq->ipsq_lock);
20502 			rw_exit(&ill_g_lock);
20503 			mutex_exit(&ill->ill_lock);
20504 			ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
20505 			mutex_exit(&ipsq->ipsq_lock);
20506 			RELEASE_CONN_LOCK(q);
20507 			*err = EINPROGRESS;
20508 			return (NULL);
20509 		}
20510 		mutex_exit(&ill->ill_lock);
20511 		RELEASE_CONN_LOCK(q);
20512 	}
20513 	rw_exit(&ill_g_lock);
20514 	if (err != NULL)
20515 		*err = ENXIO;
20516 	return (NULL);
20517 }
20518 
20519 typedef struct conn_change_s {
20520 	uint_t cc_old_ifindex;
20521 	uint_t cc_new_ifindex;
20522 } conn_change_t;
20523 
20524 /*
20525  * ipcl_walk function for changing interface index.
20526  */
20527 static void
20528 conn_change_ifindex(conn_t *connp, caddr_t arg)
20529 {
20530 	conn_change_t *connc;
20531 	uint_t old_ifindex;
20532 	uint_t new_ifindex;
20533 	int i;
20534 	ilg_t *ilg;
20535 
20536 	connc = (conn_change_t *)arg;
20537 	old_ifindex = connc->cc_old_ifindex;
20538 	new_ifindex = connc->cc_new_ifindex;
20539 
20540 	if (connp->conn_orig_bound_ifindex == old_ifindex)
20541 		connp->conn_orig_bound_ifindex = new_ifindex;
20542 
20543 	if (connp->conn_orig_multicast_ifindex == old_ifindex)
20544 		connp->conn_orig_multicast_ifindex = new_ifindex;
20545 
20546 	if (connp->conn_orig_xmit_ifindex == old_ifindex)
20547 		connp->conn_orig_xmit_ifindex = new_ifindex;
20548 
20549 	for (i = connp->conn_ilg_inuse - 1; i >= 0; i--) {
20550 		ilg = &connp->conn_ilg[i];
20551 		if (ilg->ilg_orig_ifindex == old_ifindex)
20552 			ilg->ilg_orig_ifindex = new_ifindex;
20553 	}
20554 }
20555 
20556 /*
20557  * Walk all the ipifs and ilms on this ill and change the orig_ifindex
20558  * to new_index if it matches the old_index.
20559  *
20560  * Failovers typically happen within a group of ills. But somebody
20561  * can remove an ill from the group after a failover happened. If
20562  * we are setting the ifindex after this, we potentially need to
20563  * look at all the ills rather than just the ones in the group.
20564  * We cut down the work by looking at matching ill_net_types
20565  * and ill_types as we could not possibly grouped them together.
20566  */
20567 static void
20568 ip_change_ifindex(ill_t *ill_orig, conn_change_t *connc)
20569 {
20570 	ill_t *ill;
20571 	ipif_t *ipif;
20572 	uint_t old_ifindex;
20573 	uint_t new_ifindex;
20574 	ilm_t *ilm;
20575 	ill_walk_context_t ctx;
20576 
20577 	old_ifindex = connc->cc_old_ifindex;
20578 	new_ifindex = connc->cc_new_ifindex;
20579 
20580 	rw_enter(&ill_g_lock, RW_READER);
20581 	ill = ILL_START_WALK_ALL(&ctx);
20582 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
20583 		if ((ill_orig->ill_net_type != ill->ill_net_type) ||
20584 			(ill_orig->ill_type != ill->ill_type)) {
20585 			continue;
20586 		}
20587 		for (ipif = ill->ill_ipif; ipif != NULL;
20588 				ipif = ipif->ipif_next) {
20589 			if (ipif->ipif_orig_ifindex == old_ifindex)
20590 				ipif->ipif_orig_ifindex = new_ifindex;
20591 		}
20592 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
20593 			if (ilm->ilm_orig_ifindex == old_ifindex)
20594 				ilm->ilm_orig_ifindex = new_ifindex;
20595 		}
20596 	}
20597 	rw_exit(&ill_g_lock);
20598 }
20599 
20600 /*
20601  * We first need to ensure that the new index is unique, and
20602  * then carry the change across both v4 and v6 ill representation
20603  * of the physical interface.
20604  */
20605 /* ARGSUSED */
20606 int
20607 ip_sioctl_slifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20608     ip_ioctl_cmd_t *ipip, void *ifreq)
20609 {
20610 	ill_t		*ill;
20611 	ill_t		*ill_other;
20612 	phyint_t	*phyi;
20613 	int		old_index;
20614 	conn_change_t	connc;
20615 	struct ifreq	*ifr = (struct ifreq *)ifreq;
20616 	struct lifreq	*lifr = (struct lifreq *)ifreq;
20617 	uint_t	index;
20618 	ill_t	*ill_v4;
20619 	ill_t	*ill_v6;
20620 
20621 	if (ipip->ipi_cmd_type == IF_CMD)
20622 		index = ifr->ifr_index;
20623 	else
20624 		index = lifr->lifr_index;
20625 
20626 	/*
20627 	 * Only allow on physical interface. Also, index zero is illegal.
20628 	 *
20629 	 * Need to check for PHYI_FAILED and PHYI_INACTIVE
20630 	 *
20631 	 * 1) If PHYI_FAILED is set, a failover could have happened which
20632 	 *    implies a possible failback might have to happen. As failback
20633 	 *    depends on the old index, we should fail setting the index.
20634 	 *
20635 	 * 2) If PHYI_INACTIVE is set, in.mpathd does a failover so that
20636 	 *    any addresses or multicast memberships are failed over to
20637 	 *    a non-STANDBY interface. As failback depends on the old
20638 	 *    index, we should fail setting the index for this case also.
20639 	 *
20640 	 * 3) If PHYI_OFFLINE is set, a possible failover has happened.
20641 	 *    Be consistent with PHYI_FAILED and fail the ioctl.
20642 	 */
20643 	ill = ipif->ipif_ill;
20644 	phyi = ill->ill_phyint;
20645 	if ((phyi->phyint_flags & (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) ||
20646 	    ipif->ipif_id != 0 || index == 0) {
20647 		return (EINVAL);
20648 	}
20649 	old_index = phyi->phyint_ifindex;
20650 
20651 	/* If the index is not changing, no work to do */
20652 	if (old_index == index)
20653 		return (0);
20654 
20655 	/*
20656 	 * Use ill_lookup_on_ifindex to determine if the
20657 	 * new index is unused and if so allow the change.
20658 	 */
20659 	ill_v6 = ill_lookup_on_ifindex(index, B_TRUE, NULL, NULL, NULL, NULL);
20660 	ill_v4 = ill_lookup_on_ifindex(index, B_FALSE, NULL, NULL, NULL, NULL);
20661 	if (ill_v6 != NULL || ill_v4 != NULL) {
20662 		if (ill_v4 != NULL)
20663 			ill_refrele(ill_v4);
20664 		if (ill_v6 != NULL)
20665 			ill_refrele(ill_v6);
20666 		return (EBUSY);
20667 	}
20668 
20669 	/*
20670 	 * The new index is unused. Set it in the phyint.
20671 	 * Locate the other ill so that we can send a routing
20672 	 * sockets message.
20673 	 */
20674 	if (ill->ill_isv6) {
20675 		ill_other = phyi->phyint_illv4;
20676 	} else {
20677 		ill_other = phyi->phyint_illv6;
20678 	}
20679 
20680 	phyi->phyint_ifindex = index;
20681 
20682 	connc.cc_old_ifindex = old_index;
20683 	connc.cc_new_ifindex = index;
20684 	ip_change_ifindex(ill, &connc);
20685 	ipcl_walk(conn_change_ifindex, (caddr_t)&connc);
20686 
20687 	/* Send the routing sockets message */
20688 	ip_rts_ifmsg(ipif);
20689 	if (ill_other != NULL)
20690 		ip_rts_ifmsg(ill_other->ill_ipif);
20691 
20692 	return (0);
20693 }
20694 
20695 /* ARGSUSED */
20696 int
20697 ip_sioctl_get_lifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20698     ip_ioctl_cmd_t *ipip, void *ifreq)
20699 {
20700 	struct ifreq	*ifr = (struct ifreq *)ifreq;
20701 	struct lifreq	*lifr = (struct lifreq *)ifreq;
20702 
20703 	ip1dbg(("ip_sioctl_get_lifindex(%s:%u %p)\n",
20704 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
20705 	/* Get the interface index */
20706 	if (ipip->ipi_cmd_type == IF_CMD) {
20707 		ifr->ifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
20708 	} else {
20709 		lifr->lifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
20710 	}
20711 	return (0);
20712 }
20713 
20714 /* ARGSUSED */
20715 int
20716 ip_sioctl_get_lifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20717     ip_ioctl_cmd_t *ipip, void *ifreq)
20718 {
20719 	struct lifreq	*lifr = (struct lifreq *)ifreq;
20720 
20721 	ip1dbg(("ip_sioctl_get_lifzone(%s:%u %p)\n",
20722 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
20723 	/* Get the interface zone */
20724 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
20725 	lifr->lifr_zoneid = ipif->ipif_zoneid;
20726 	return (0);
20727 }
20728 
20729 /*
20730  * Set the zoneid of an interface.
20731  */
20732 /* ARGSUSED */
20733 int
20734 ip_sioctl_slifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20735     ip_ioctl_cmd_t *ipip, void *ifreq)
20736 {
20737 	struct lifreq	*lifr = (struct lifreq *)ifreq;
20738 	int err = 0;
20739 	boolean_t need_up = B_FALSE;
20740 	zone_t *zptr;
20741 	zone_status_t status;
20742 	zoneid_t zoneid;
20743 
20744 	/* cannot assign instance zero to a non-global zone */
20745 	if (ipif->ipif_id == 0)
20746 		return (ENOTSUP);
20747 
20748 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
20749 	zoneid = lifr->lifr_zoneid;
20750 
20751 	/*
20752 	 * Cannot assign to a zone that doesn't exist or is shutting down.  In
20753 	 * the event of a race with the zone shutdown processing, since IP
20754 	 * serializes this ioctl and SIOCGLIFCONF/SIOCLIFREMOVEIF, we know the
20755 	 * interface will be cleaned up even if the zone is shut down
20756 	 * immediately after the status check. If the interface can't be brought
20757 	 * down right away, and the zone is shut down before the restart
20758 	 * function is called, we resolve the possible races by rechecking the
20759 	 * zone status in the restart function.
20760 	 */
20761 	if ((zptr = zone_find_by_id(zoneid)) == NULL)
20762 		return (EINVAL);
20763 	status = zone_status_get(zptr);
20764 	zone_rele(zptr);
20765 
20766 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING)
20767 		return (EINVAL);
20768 
20769 	if (ipif->ipif_flags & IPIF_UP) {
20770 		/*
20771 		 * If the interface is already marked up,
20772 		 * we call ipif_down which will take care
20773 		 * of ditching any IREs that have been set
20774 		 * up based on the old interface address.
20775 		 */
20776 		err = ipif_logical_down(ipif, q, mp);
20777 		if (err == EINPROGRESS)
20778 			return (err);
20779 		ipif_down_tail(ipif);
20780 		need_up = B_TRUE;
20781 	}
20782 
20783 	err = ip_sioctl_slifzone_tail(ipif, zoneid, q, mp, need_up);
20784 	return (err);
20785 }
20786 
20787 static int
20788 ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
20789     queue_t *q, mblk_t *mp, boolean_t need_up)
20790 {
20791 	int	err = 0;
20792 
20793 	ip1dbg(("ip_sioctl_zoneid_tail(%s:%u %p)\n",
20794 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
20795 
20796 	/* Set the new zone id. */
20797 	ipif->ipif_zoneid = zoneid;
20798 
20799 	/* Update sctp list */
20800 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
20801 
20802 	if (need_up) {
20803 		/*
20804 		 * Now bring the interface back up.  If this
20805 		 * is the only IPIF for the ILL, ipif_up
20806 		 * will have to re-bind to the device, so
20807 		 * we may get back EINPROGRESS, in which
20808 		 * case, this IOCTL will get completed in
20809 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
20810 		 */
20811 		err = ipif_up(ipif, q, mp);
20812 	}
20813 	return (err);
20814 }
20815 
20816 /* ARGSUSED */
20817 int
20818 ip_sioctl_slifzone_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20819     ip_ioctl_cmd_t *ipip, void *if_req)
20820 {
20821 	struct lifreq *lifr = (struct lifreq *)if_req;
20822 	zoneid_t zoneid;
20823 	zone_t *zptr;
20824 	zone_status_t status;
20825 
20826 	ASSERT(ipif->ipif_id != 0);
20827 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
20828 	zoneid = lifr->lifr_zoneid;
20829 
20830 	ip1dbg(("ip_sioctl_slifzone_restart(%s:%u %p)\n",
20831 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
20832 
20833 	/*
20834 	 * We recheck the zone status to resolve the following race condition:
20835 	 * 1) process sends SIOCSLIFZONE to put hme0:1 in zone "myzone";
20836 	 * 2) hme0:1 is up and can't be brought down right away;
20837 	 * ip_sioctl_slifzone() returns EINPROGRESS and the request is queued;
20838 	 * 3) zone "myzone" is halted; the zone status switches to
20839 	 * 'shutting_down' and the zones framework sends SIOCGLIFCONF to list
20840 	 * the interfaces to remove - hme0:1 is not returned because it's not
20841 	 * yet in "myzone", so it won't be removed;
20842 	 * 4) the restart function for SIOCSLIFZONE is called; without the
20843 	 * status check here, we would have hme0:1 in "myzone" after it's been
20844 	 * destroyed.
20845 	 * Note that if the status check fails, we need to bring the interface
20846 	 * back to its state prior to ip_sioctl_slifzone(), hence the call to
20847 	 * ipif_up_done[_v6]().
20848 	 */
20849 	status = ZONE_IS_UNINITIALIZED;
20850 	if ((zptr = zone_find_by_id(zoneid)) != NULL) {
20851 		status = zone_status_get(zptr);
20852 		zone_rele(zptr);
20853 	}
20854 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING) {
20855 		if (ipif->ipif_isv6) {
20856 			(void) ipif_up_done_v6(ipif);
20857 		} else {
20858 			(void) ipif_up_done(ipif);
20859 		}
20860 		return (EINVAL);
20861 	}
20862 
20863 	ipif_down_tail(ipif);
20864 
20865 	return (ip_sioctl_slifzone_tail(ipif, zoneid, q, mp, B_TRUE));
20866 }
20867 
20868 /* ARGSUSED */
20869 int
20870 ip_sioctl_get_lifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20871 	ip_ioctl_cmd_t *ipip, void *ifreq)
20872 {
20873 	struct lifreq	*lifr = ifreq;
20874 
20875 	ASSERT(q->q_next == NULL);
20876 	ASSERT(CONN_Q(q));
20877 
20878 	ip1dbg(("ip_sioctl_get_lifusesrc(%s:%u %p)\n",
20879 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
20880 	lifr->lifr_index = ipif->ipif_ill->ill_usesrc_ifindex;
20881 	ip1dbg(("ip_sioctl_get_lifusesrc:lifr_index = %d\n", lifr->lifr_index));
20882 
20883 	return (0);
20884 }
20885 
20886 
20887 /* Find the previous ILL in this usesrc group */
20888 static ill_t *
20889 ill_prev_usesrc(ill_t *uill)
20890 {
20891 	ill_t *ill;
20892 
20893 	for (ill = uill->ill_usesrc_grp_next;
20894 	    ASSERT(ill), ill->ill_usesrc_grp_next != uill;
20895 	    ill = ill->ill_usesrc_grp_next)
20896 		/* do nothing */;
20897 	return (ill);
20898 }
20899 
20900 /*
20901  * Release all members of the usesrc group. This routine is called
20902  * from ill_delete when the interface being unplumbed is the
20903  * group head.
20904  */
20905 static void
20906 ill_disband_usesrc_group(ill_t *uill)
20907 {
20908 	ill_t *next_ill, *tmp_ill;
20909 	ASSERT(RW_WRITE_HELD(&ill_g_usesrc_lock));
20910 	next_ill = uill->ill_usesrc_grp_next;
20911 
20912 	do {
20913 		ASSERT(next_ill != NULL);
20914 		tmp_ill = next_ill->ill_usesrc_grp_next;
20915 		ASSERT(tmp_ill != NULL);
20916 		next_ill->ill_usesrc_grp_next = NULL;
20917 		next_ill->ill_usesrc_ifindex = 0;
20918 		next_ill = tmp_ill;
20919 	} while (next_ill->ill_usesrc_ifindex != 0);
20920 	uill->ill_usesrc_grp_next = NULL;
20921 }
20922 
20923 /*
20924  * Remove the client usesrc ILL from the list and relink to a new list
20925  */
20926 int
20927 ill_relink_usesrc_ills(ill_t *ucill, ill_t *uill, uint_t ifindex)
20928 {
20929 	ill_t *ill, *tmp_ill;
20930 
20931 	ASSERT((ucill != NULL) && (ucill->ill_usesrc_grp_next != NULL) &&
20932 	    (uill != NULL) && RW_WRITE_HELD(&ill_g_usesrc_lock));
20933 
20934 	/*
20935 	 * Check if the usesrc client ILL passed in is not already
20936 	 * in use as a usesrc ILL i.e one whose source address is
20937 	 * in use OR a usesrc ILL is not already in use as a usesrc
20938 	 * client ILL
20939 	 */
20940 	if ((ucill->ill_usesrc_ifindex == 0) ||
20941 	    (uill->ill_usesrc_ifindex != 0)) {
20942 		return (-1);
20943 	}
20944 
20945 	ill = ill_prev_usesrc(ucill);
20946 	ASSERT(ill->ill_usesrc_grp_next != NULL);
20947 
20948 	/* Remove from the current list */
20949 	if (ill->ill_usesrc_grp_next->ill_usesrc_grp_next == ill) {
20950 		/* Only two elements in the list */
20951 		ASSERT(ill->ill_usesrc_ifindex == 0);
20952 		ill->ill_usesrc_grp_next = NULL;
20953 	} else {
20954 		ill->ill_usesrc_grp_next = ucill->ill_usesrc_grp_next;
20955 	}
20956 
20957 	if (ifindex == 0) {
20958 		ucill->ill_usesrc_ifindex = 0;
20959 		ucill->ill_usesrc_grp_next = NULL;
20960 		return (0);
20961 	}
20962 
20963 	ucill->ill_usesrc_ifindex = ifindex;
20964 	tmp_ill = uill->ill_usesrc_grp_next;
20965 	uill->ill_usesrc_grp_next = ucill;
20966 	ucill->ill_usesrc_grp_next =
20967 	    (tmp_ill != NULL) ? tmp_ill : uill;
20968 	return (0);
20969 }
20970 
20971 /*
20972  * Set the ill_usesrc and ill_usesrc_head fields. See synchronization notes in
20973  * ip.c for locking details.
20974  */
20975 /* ARGSUSED */
20976 int
20977 ip_sioctl_slifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20978     ip_ioctl_cmd_t *ipip, void *ifreq)
20979 {
20980 	struct lifreq *lifr = (struct lifreq *)ifreq;
20981 	boolean_t isv6 = B_FALSE, reset_flg = B_FALSE,
20982 	    ill_flag_changed = B_FALSE;
20983 	ill_t *usesrc_ill, *usesrc_cli_ill = ipif->ipif_ill;
20984 	int err = 0, ret;
20985 	uint_t ifindex;
20986 	phyint_t *us_phyint, *us_cli_phyint;
20987 	ipsq_t *ipsq = NULL;
20988 
20989 	ASSERT(IAM_WRITER_IPIF(ipif));
20990 	ASSERT(q->q_next == NULL);
20991 	ASSERT(CONN_Q(q));
20992 
20993 	isv6 = (Q_TO_CONN(q))->conn_af_isv6;
20994 	us_cli_phyint = usesrc_cli_ill->ill_phyint;
20995 
20996 	ASSERT(us_cli_phyint != NULL);
20997 
20998 	/*
20999 	 * If the client ILL is being used for IPMP, abort.
21000 	 * Note, this can be done before ipsq_try_enter since we are already
21001 	 * exclusive on this ILL
21002 	 */
21003 	if ((us_cli_phyint->phyint_groupname != NULL) ||
21004 	    (us_cli_phyint->phyint_flags & PHYI_STANDBY)) {
21005 		return (EINVAL);
21006 	}
21007 
21008 	ifindex = lifr->lifr_index;
21009 	if (ifindex == 0) {
21010 		if (usesrc_cli_ill->ill_usesrc_grp_next == NULL) {
21011 			/* non usesrc group interface, nothing to reset */
21012 			return (0);
21013 		}
21014 		ifindex = usesrc_cli_ill->ill_usesrc_ifindex;
21015 		/* valid reset request */
21016 		reset_flg = B_TRUE;
21017 	}
21018 
21019 	usesrc_ill = ill_lookup_on_ifindex(ifindex, isv6, q, mp,
21020 	    ip_process_ioctl, &err);
21021 
21022 	if (usesrc_ill == NULL) {
21023 		return (err);
21024 	}
21025 
21026 	/*
21027 	 * The usesrc_cli_ill or the usesrc_ill cannot be part of an IPMP
21028 	 * group nor can either of the interfaces be used for standy. So
21029 	 * to guarantee mutual exclusion with ip_sioctl_flags (which sets
21030 	 * PHYI_STANDBY) and ip_sioctl_groupname (which sets the groupname)
21031 	 * we need to be exclusive on the ipsq belonging to the usesrc_ill.
21032 	 * We are already exlusive on this ipsq i.e ipsq corresponding to
21033 	 * the usesrc_cli_ill
21034 	 */
21035 	ipsq = ipsq_try_enter(NULL, usesrc_ill, q, mp, ip_process_ioctl,
21036 	    NEW_OP, B_TRUE);
21037 	if (ipsq == NULL) {
21038 		err = EINPROGRESS;
21039 		/* Operation enqueued on the ipsq of the usesrc ILL */
21040 		goto done;
21041 	}
21042 
21043 	/* Check if the usesrc_ill is used for IPMP */
21044 	us_phyint = usesrc_ill->ill_phyint;
21045 	if ((us_phyint->phyint_groupname != NULL) ||
21046 	    (us_phyint->phyint_flags & PHYI_STANDBY)) {
21047 		err = EINVAL;
21048 		goto done;
21049 	}
21050 
21051 	/*
21052 	 * If the client is already in use as a usesrc_ill or a usesrc_ill is
21053 	 * already a client then return EINVAL
21054 	 */
21055 	if (IS_USESRC_ILL(usesrc_cli_ill) || IS_USESRC_CLI_ILL(usesrc_ill)) {
21056 		err = EINVAL;
21057 		goto done;
21058 	}
21059 
21060 	/*
21061 	 * If the ill_usesrc_ifindex field is already set to what it needs to
21062 	 * be then this is a duplicate operation.
21063 	 */
21064 	if (!reset_flg && usesrc_cli_ill->ill_usesrc_ifindex == ifindex) {
21065 		err = 0;
21066 		goto done;
21067 	}
21068 
21069 	ip1dbg(("ip_sioctl_slifusesrc: usesrc_cli_ill %s, usesrc_ill %s,"
21070 	    " v6 = %d", usesrc_cli_ill->ill_name, usesrc_ill->ill_name,
21071 	    usesrc_ill->ill_isv6));
21072 
21073 	/*
21074 	 * The next step ensures that no new ires will be created referencing
21075 	 * the client ill, until the ILL_CHANGING flag is cleared. Then
21076 	 * we go through an ire walk deleting all ire caches that reference
21077 	 * the client ill. New ires referencing the client ill that are added
21078 	 * to the ire table before the ILL_CHANGING flag is set, will be
21079 	 * cleaned up by the ire walk below. Attempt to add new ires referencing
21080 	 * the client ill while the ILL_CHANGING flag is set will be failed
21081 	 * during the ire_add in ire_atomic_start. ire_atomic_start atomically
21082 	 * checks (under the ill_g_usesrc_lock) that the ire being added
21083 	 * is not stale, i.e the ire_stq and ire_ipif are consistent and
21084 	 * belong to the same usesrc group.
21085 	 */
21086 	mutex_enter(&usesrc_cli_ill->ill_lock);
21087 	usesrc_cli_ill->ill_state_flags |= ILL_CHANGING;
21088 	mutex_exit(&usesrc_cli_ill->ill_lock);
21089 	ill_flag_changed = B_TRUE;
21090 
21091 	if (ipif->ipif_isv6)
21092 		ire_walk_v6(ipif_delete_cache_ire, (char *)usesrc_cli_ill,
21093 		    ALL_ZONES);
21094 	else
21095 		ire_walk_v4(ipif_delete_cache_ire, (char *)usesrc_cli_ill,
21096 		    ALL_ZONES);
21097 
21098 	/*
21099 	 * ill_g_usesrc_lock global lock protects the ill_usesrc_grp_next
21100 	 * and the ill_usesrc_ifindex fields
21101 	 */
21102 	rw_enter(&ill_g_usesrc_lock, RW_WRITER);
21103 
21104 	if (reset_flg) {
21105 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill, 0);
21106 		if (ret != 0) {
21107 			err = EINVAL;
21108 		}
21109 		rw_exit(&ill_g_usesrc_lock);
21110 		goto done;
21111 	}
21112 
21113 	/*
21114 	 * Four possibilities to consider:
21115 	 * 1. Both usesrc_ill and usesrc_cli_ill are not part of any usesrc grp
21116 	 * 2. usesrc_ill is part of a group but usesrc_cli_ill isn't
21117 	 * 3. usesrc_cli_ill is part of a group but usesrc_ill isn't
21118 	 * 4. Both are part of their respective usesrc groups
21119 	 */
21120 	if ((usesrc_ill->ill_usesrc_grp_next == NULL) &&
21121 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
21122 		ASSERT(usesrc_ill->ill_usesrc_ifindex == 0);
21123 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
21124 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
21125 		usesrc_cli_ill->ill_usesrc_grp_next = usesrc_ill;
21126 	} else if ((usesrc_ill->ill_usesrc_grp_next != NULL) &&
21127 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
21128 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
21129 		/* Insert at head of list */
21130 		usesrc_cli_ill->ill_usesrc_grp_next =
21131 		    usesrc_ill->ill_usesrc_grp_next;
21132 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
21133 	} else {
21134 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill,
21135 		    ifindex);
21136 		if (ret != 0)
21137 			err = EINVAL;
21138 	}
21139 	rw_exit(&ill_g_usesrc_lock);
21140 
21141 done:
21142 	if (ill_flag_changed) {
21143 		mutex_enter(&usesrc_cli_ill->ill_lock);
21144 		usesrc_cli_ill->ill_state_flags &= ~ILL_CHANGING;
21145 		mutex_exit(&usesrc_cli_ill->ill_lock);
21146 	}
21147 	if (ipsq != NULL)
21148 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
21149 	/* The refrele on the lifr_name ipif is done by ip_process_ioctl */
21150 	ill_refrele(usesrc_ill);
21151 	return (err);
21152 }
21153 
21154 /*
21155  * comparison function used by avl.
21156  */
21157 static int
21158 ill_phyint_compare_index(const void *index_ptr, const void *phyip)
21159 {
21160 
21161 	uint_t index;
21162 
21163 	ASSERT(phyip != NULL && index_ptr != NULL);
21164 
21165 	index = *((uint_t *)index_ptr);
21166 	/*
21167 	 * let the phyint with the lowest index be on top.
21168 	 */
21169 	if (((phyint_t *)phyip)->phyint_ifindex < index)
21170 		return (1);
21171 	if (((phyint_t *)phyip)->phyint_ifindex > index)
21172 		return (-1);
21173 	return (0);
21174 }
21175 
21176 /*
21177  * comparison function used by avl.
21178  */
21179 static int
21180 ill_phyint_compare_name(const void *name_ptr, const void *phyip)
21181 {
21182 	ill_t *ill;
21183 	int res = 0;
21184 
21185 	ASSERT(phyip != NULL && name_ptr != NULL);
21186 
21187 	if (((phyint_t *)phyip)->phyint_illv4)
21188 		ill = ((phyint_t *)phyip)->phyint_illv4;
21189 	else
21190 		ill = ((phyint_t *)phyip)->phyint_illv6;
21191 	ASSERT(ill != NULL);
21192 
21193 	res = strcmp(ill->ill_name, (char *)name_ptr);
21194 	if (res > 0)
21195 		return (1);
21196 	else if (res < 0)
21197 		return (-1);
21198 	return (0);
21199 }
21200 /*
21201  * This function is called from ill_delete when the ill is being
21202  * unplumbed. We remove the reference from the phyint and we also
21203  * free the phyint when there are no more references to it.
21204  */
21205 static void
21206 ill_phyint_free(ill_t *ill)
21207 {
21208 	phyint_t *phyi;
21209 	phyint_t *next_phyint;
21210 	ipsq_t *cur_ipsq;
21211 
21212 	ASSERT(ill->ill_phyint != NULL);
21213 
21214 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
21215 	phyi = ill->ill_phyint;
21216 	ill->ill_phyint = NULL;
21217 	/*
21218 	 * ill_init allocates a phyint always to store the copy
21219 	 * of flags relevant to phyint. At that point in time, we could
21220 	 * not assign the name and hence phyint_illv4/v6 could not be
21221 	 * initialized. Later in ipif_set_values, we assign the name to
21222 	 * the ill, at which point in time we assign phyint_illv4/v6.
21223 	 * Thus we don't rely on phyint_illv6 to be initialized always.
21224 	 */
21225 	if (ill->ill_flags & ILLF_IPV6) {
21226 		phyi->phyint_illv6 = NULL;
21227 	} else {
21228 		phyi->phyint_illv4 = NULL;
21229 	}
21230 	/*
21231 	 * ipif_down removes it from the group when the last ipif goes
21232 	 * down.
21233 	 */
21234 	ASSERT(ill->ill_group == NULL);
21235 
21236 	if (phyi->phyint_illv4 != NULL || phyi->phyint_illv6 != NULL)
21237 		return;
21238 
21239 	/*
21240 	 * Make sure this phyint was put in the list.
21241 	 */
21242 	if (phyi->phyint_ifindex > 0) {
21243 		avl_remove(&phyint_g_list.phyint_list_avl_by_index,
21244 		    phyi);
21245 		avl_remove(&phyint_g_list.phyint_list_avl_by_name,
21246 		    phyi);
21247 	}
21248 	/*
21249 	 * remove phyint from the ipsq list.
21250 	 */
21251 	cur_ipsq = phyi->phyint_ipsq;
21252 	if (phyi == cur_ipsq->ipsq_phyint_list) {
21253 		cur_ipsq->ipsq_phyint_list = phyi->phyint_ipsq_next;
21254 	} else {
21255 		next_phyint = cur_ipsq->ipsq_phyint_list;
21256 		while (next_phyint != NULL) {
21257 			if (next_phyint->phyint_ipsq_next == phyi) {
21258 				next_phyint->phyint_ipsq_next =
21259 					phyi->phyint_ipsq_next;
21260 				break;
21261 			}
21262 			next_phyint = next_phyint->phyint_ipsq_next;
21263 		}
21264 		ASSERT(next_phyint != NULL);
21265 	}
21266 	IPSQ_DEC_REF(cur_ipsq);
21267 
21268 	if (phyi->phyint_groupname_len != 0) {
21269 		ASSERT(phyi->phyint_groupname != NULL);
21270 		mi_free(phyi->phyint_groupname);
21271 	}
21272 	mi_free(phyi);
21273 }
21274 
21275 /*
21276  * Attach the ill to the phyint structure which can be shared by both
21277  * IPv4 and IPv6 ill. ill_init allocates a phyint to just hold flags. This
21278  * function is called from ipif_set_values and ill_lookup_on_name (for
21279  * loopback) where we know the name of the ill. We lookup the ill and if
21280  * there is one present already with the name use that phyint. Otherwise
21281  * reuse the one allocated by ill_init.
21282  */
21283 static void
21284 ill_phyint_reinit(ill_t *ill)
21285 {
21286 	boolean_t isv6 = ill->ill_isv6;
21287 	phyint_t *phyi_old;
21288 	phyint_t *phyi;
21289 	avl_index_t where = 0;
21290 	ill_t	*ill_other = NULL;
21291 	ipsq_t	*ipsq;
21292 
21293 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
21294 
21295 	phyi_old = ill->ill_phyint;
21296 	ASSERT(isv6 || (phyi_old->phyint_illv4 == ill &&
21297 	    phyi_old->phyint_illv6 == NULL));
21298 	ASSERT(!isv6 || (phyi_old->phyint_illv6 == ill &&
21299 	    phyi_old->phyint_illv4 == NULL));
21300 	ASSERT(phyi_old->phyint_ifindex == 0);
21301 
21302 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_name,
21303 	    ill->ill_name, &where);
21304 
21305 	/*
21306 	 * 1. We grabbed the ill_g_lock before inserting this ill into
21307 	 *    the global list of ills. So no other thread could have located
21308 	 *    this ill and hence the ipsq of this ill is guaranteed to be empty.
21309 	 * 2. Now locate the other protocol instance of this ill.
21310 	 * 3. Now grab both ill locks in the right order, and the phyint lock of
21311 	 *    the new ipsq. Holding ill locks + ill_g_lock ensures that the ipsq
21312 	 *    of neither ill can change.
21313 	 * 4. Merge the phyint and thus the ipsq as well of this ill onto the
21314 	 *    other ill.
21315 	 * 5. Release all locks.
21316 	 */
21317 
21318 	/*
21319 	 * Look for IPv4 if we are initializing IPv6 or look for IPv6 if
21320 	 * we are initializing IPv4.
21321 	 */
21322 	if (phyi != NULL) {
21323 		ill_other = (isv6) ? phyi->phyint_illv4 :
21324 		    phyi->phyint_illv6;
21325 		ASSERT(ill_other->ill_phyint != NULL);
21326 		ASSERT((isv6 && !ill_other->ill_isv6) ||
21327 		    (!isv6 && ill_other->ill_isv6));
21328 		GRAB_ILL_LOCKS(ill, ill_other);
21329 		/*
21330 		 * We are potentially throwing away phyint_flags which
21331 		 * could be different from the one that we obtain from
21332 		 * ill_other->ill_phyint. But it is okay as we are assuming
21333 		 * that the state maintained within IP is correct.
21334 		 */
21335 		mutex_enter(&phyi->phyint_lock);
21336 		if (isv6) {
21337 			ASSERT(phyi->phyint_illv6 == NULL);
21338 			phyi->phyint_illv6 = ill;
21339 		} else {
21340 			ASSERT(phyi->phyint_illv4 == NULL);
21341 			phyi->phyint_illv4 = ill;
21342 		}
21343 		/*
21344 		 * This is a new ill, currently undergoing SLIFNAME
21345 		 * So we could not have joined an IPMP group until now.
21346 		 */
21347 		ASSERT(phyi_old->phyint_ipsq_next == NULL &&
21348 		    phyi_old->phyint_groupname == NULL);
21349 
21350 		/*
21351 		 * This phyi_old is going away. Decref ipsq_refs and
21352 		 * assert it is zero. The ipsq itself will be freed in
21353 		 * ipsq_exit
21354 		 */
21355 		ipsq = phyi_old->phyint_ipsq;
21356 		IPSQ_DEC_REF(ipsq);
21357 		ASSERT(ipsq->ipsq_refs == 0);
21358 		/* Get the singleton phyint out of the ipsq list */
21359 		ASSERT(phyi_old->phyint_ipsq_next == NULL);
21360 		ipsq->ipsq_phyint_list = NULL;
21361 		phyi_old->phyint_illv4 = NULL;
21362 		phyi_old->phyint_illv6 = NULL;
21363 		mi_free(phyi_old);
21364 	} else {
21365 		mutex_enter(&ill->ill_lock);
21366 		/*
21367 		 * We don't need to acquire any lock, since
21368 		 * the ill is not yet visible globally  and we
21369 		 * have not yet released the ill_g_lock.
21370 		 */
21371 		phyi = phyi_old;
21372 		mutex_enter(&phyi->phyint_lock);
21373 		/* XXX We need a recovery strategy here. */
21374 		if (!phyint_assign_ifindex(phyi))
21375 			cmn_err(CE_PANIC, "phyint_assign_ifindex() failed");
21376 
21377 		avl_insert(&phyint_g_list.phyint_list_avl_by_name,
21378 		    (void *)phyi, where);
21379 
21380 		(void) avl_find(&phyint_g_list.phyint_list_avl_by_index,
21381 		    &phyi->phyint_ifindex, &where);
21382 		avl_insert(&phyint_g_list.phyint_list_avl_by_index,
21383 		    (void *)phyi, where);
21384 	}
21385 
21386 	/*
21387 	 * Reassigning ill_phyint automatically reassigns the ipsq also.
21388 	 * pending mp is not affected because that is per ill basis.
21389 	 */
21390 	ill->ill_phyint = phyi;
21391 
21392 	/*
21393 	 * Keep the index on ipif_orig_index to be used by FAILOVER.
21394 	 * We do this here as when the first ipif was allocated,
21395 	 * ipif_allocate does not know the right interface index.
21396 	 */
21397 
21398 	ill->ill_ipif->ipif_orig_ifindex = ill->ill_phyint->phyint_ifindex;
21399 	/*
21400 	 * Now that the phyint's ifindex has been assigned, complete the
21401 	 * remaining
21402 	 */
21403 	if (ill->ill_isv6) {
21404 		ill->ill_ip6_mib->ipv6IfIndex =
21405 		    ill->ill_phyint->phyint_ifindex;
21406 		ill->ill_icmp6_mib->ipv6IfIcmpIfIndex =
21407 		    ill->ill_phyint->phyint_ifindex;
21408 	}
21409 
21410 	RELEASE_ILL_LOCKS(ill, ill_other);
21411 	mutex_exit(&phyi->phyint_lock);
21412 }
21413 
21414 /*
21415  * Notify any downstream modules of the name of this interface.
21416  * An M_IOCTL is used even though we don't expect a successful reply.
21417  * Any reply message from the driver (presumably an M_IOCNAK) will
21418  * eventually get discarded somewhere upstream.  The message format is
21419  * simply an SIOCSLIFNAME ioctl just as might be sent from ifconfig
21420  * to IP.
21421  */
21422 static void
21423 ip_ifname_notify(ill_t *ill, queue_t *q)
21424 {
21425 	mblk_t *mp1, *mp2;
21426 	struct iocblk *iocp;
21427 	struct lifreq *lifr;
21428 
21429 	mp1 = mkiocb(SIOCSLIFNAME);
21430 	if (mp1 == NULL)
21431 		return;
21432 	mp2 = allocb(sizeof (struct lifreq), BPRI_HI);
21433 	if (mp2 == NULL) {
21434 		freeb(mp1);
21435 		return;
21436 	}
21437 
21438 	mp1->b_cont = mp2;
21439 	iocp = (struct iocblk *)mp1->b_rptr;
21440 	iocp->ioc_count = sizeof (struct lifreq);
21441 
21442 	lifr = (struct lifreq *)mp2->b_rptr;
21443 	mp2->b_wptr += sizeof (struct lifreq);
21444 	bzero(lifr, sizeof (struct lifreq));
21445 
21446 	(void) strncpy(lifr->lifr_name, ill->ill_name, LIFNAMSIZ);
21447 	lifr->lifr_ppa = ill->ill_ppa;
21448 	lifr->lifr_flags = (ill->ill_flags & (ILLF_IPV4|ILLF_IPV6));
21449 
21450 	putnext(q, mp1);
21451 }
21452 
21453 static boolean_t ip_trash_timer_started = B_FALSE;
21454 
21455 static int
21456 ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
21457 {
21458 	int err;
21459 
21460 	/* Set the obsolete NDD per-interface forwarding name. */
21461 	err = ill_set_ndd_name(ill);
21462 	if (err != 0) {
21463 		cmn_err(CE_WARN, "ipif_set_values: ill_set_ndd_name (%d)\n",
21464 		    err);
21465 	}
21466 
21467 	/* Tell downstream modules where they are. */
21468 	ip_ifname_notify(ill, q);
21469 
21470 	/*
21471 	 * ill_dl_phys returns EINPROGRESS in the usual case.
21472 	 * Error cases are ENOMEM ...
21473 	 */
21474 	err = ill_dl_phys(ill, ipif, mp, q);
21475 
21476 	/*
21477 	 * If there is no IRE expiration timer running, get one started.
21478 	 * igmp and mld timers will be triggered by the first multicast
21479 	 */
21480 	if (!ip_trash_timer_started) {
21481 		/*
21482 		 * acquire the lock and check again.
21483 		 */
21484 		mutex_enter(&ip_trash_timer_lock);
21485 		if (!ip_trash_timer_started) {
21486 			ip_ire_expire_id = timeout(ip_trash_timer_expire, NULL,
21487 			    MSEC_TO_TICK(ip_timer_interval));
21488 			ip_trash_timer_started = B_TRUE;
21489 		}
21490 		mutex_exit(&ip_trash_timer_lock);
21491 	}
21492 
21493 	if (ill->ill_isv6) {
21494 		mutex_enter(&mld_slowtimeout_lock);
21495 		if (mld_slowtimeout_id == 0) {
21496 			mld_slowtimeout_id = timeout(mld_slowtimo, NULL,
21497 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
21498 		}
21499 		mutex_exit(&mld_slowtimeout_lock);
21500 	} else {
21501 		mutex_enter(&igmp_slowtimeout_lock);
21502 		if (igmp_slowtimeout_id == 0) {
21503 			igmp_slowtimeout_id = timeout(igmp_slowtimo, NULL,
21504 				MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
21505 		}
21506 		mutex_exit(&igmp_slowtimeout_lock);
21507 	}
21508 
21509 	return (err);
21510 }
21511 
21512 /*
21513  * Common routine for ppa and ifname setting. Should be called exclusive.
21514  *
21515  * Returns EINPROGRESS when mp has been consumed by queueing it on
21516  * ill_pending_mp and the ioctl will complete in ip_rput.
21517  *
21518  * NOTE : If ppa is UNIT_MAX, we assign the next valid ppa and return
21519  * the new name and new ppa in lifr_name and lifr_ppa respectively.
21520  * For SLIFNAME, we pass these values back to the userland.
21521  */
21522 static int
21523 ipif_set_values(queue_t *q, mblk_t *mp, char *interf_name, uint_t *new_ppa_ptr)
21524 {
21525 	ill_t	*ill;
21526 	ipif_t	*ipif;
21527 	ipsq_t	*ipsq;
21528 	char	*ppa_ptr;
21529 	char	*old_ptr;
21530 	char	old_char;
21531 	int	error;
21532 
21533 	ip1dbg(("ipif_set_values: interface %s\n", interf_name));
21534 	ASSERT(q->q_next != NULL);
21535 	ASSERT(interf_name != NULL);
21536 
21537 	ill = (ill_t *)q->q_ptr;
21538 
21539 	ASSERT(ill->ill_name[0] == '\0');
21540 	ASSERT(IAM_WRITER_ILL(ill));
21541 	ASSERT((mi_strlen(interf_name) + 1) <= LIFNAMSIZ);
21542 	ASSERT(ill->ill_ppa == UINT_MAX);
21543 
21544 	/* The ppa is sent down by ifconfig or is chosen */
21545 	if ((ppa_ptr = ill_get_ppa_ptr(interf_name)) == NULL) {
21546 		return (EINVAL);
21547 	}
21548 
21549 	/*
21550 	 * make sure ppa passed in is same as ppa in the name.
21551 	 * This check is not made when ppa == UINT_MAX in that case ppa
21552 	 * in the name could be anything. System will choose a ppa and
21553 	 * update new_ppa_ptr and inter_name to contain the choosen ppa.
21554 	 */
21555 	if (*new_ppa_ptr != UINT_MAX) {
21556 		/* stoi changes the pointer */
21557 		old_ptr = ppa_ptr;
21558 		/*
21559 		 * ifconfig passed in 0 for the ppa for DLPI 1 style devices
21560 		 * (they don't have an externally visible ppa).  We assign one
21561 		 * here so that we can manage the interface.  Note that in
21562 		 * the past this value was always 0 for DLPI 1 drivers.
21563 		 */
21564 		if (*new_ppa_ptr == 0)
21565 			*new_ppa_ptr = stoi(&old_ptr);
21566 		else if (*new_ppa_ptr != (uint_t)stoi(&old_ptr))
21567 			return (EINVAL);
21568 	}
21569 	/*
21570 	 * terminate string before ppa
21571 	 * save char at that location.
21572 	 */
21573 	old_char = ppa_ptr[0];
21574 	ppa_ptr[0] = '\0';
21575 
21576 	ill->ill_ppa = *new_ppa_ptr;
21577 	/*
21578 	 * Finish as much work now as possible before calling ill_glist_insert
21579 	 * which makes the ill globally visible and also merges it with the
21580 	 * other protocol instance of this phyint. The remaining work is
21581 	 * done after entering the ipsq which may happen sometime later.
21582 	 * ill_set_ndd_name occurs after the ill has been made globally visible.
21583 	 */
21584 	ipif = ill->ill_ipif;
21585 
21586 	/* We didn't do this when we allocated ipif in ip_ll_subnet_defaults */
21587 	ipif_assign_seqid(ipif);
21588 
21589 	if (!(ill->ill_flags & (ILLF_IPV4|ILLF_IPV6)))
21590 		ill->ill_flags |= ILLF_IPV4;
21591 
21592 	ASSERT(ipif->ipif_next == NULL);	/* Only one ipif on ill */
21593 	ASSERT((ipif->ipif_flags & IPIF_UP) == 0);
21594 
21595 	if (ill->ill_flags & ILLF_IPV6) {
21596 
21597 		ill->ill_isv6 = B_TRUE;
21598 		if (ill->ill_rq != NULL) {
21599 			ill->ill_rq->q_qinfo = &rinit_ipv6;
21600 			ill->ill_wq->q_qinfo = &winit_ipv6;
21601 		}
21602 
21603 		/* Keep the !IN6_IS_ADDR_V4MAPPED assertions happy */
21604 		ipif->ipif_v6lcl_addr = ipv6_all_zeros;
21605 		ipif->ipif_v6src_addr = ipv6_all_zeros;
21606 		ipif->ipif_v6subnet = ipv6_all_zeros;
21607 		ipif->ipif_v6net_mask = ipv6_all_zeros;
21608 		ipif->ipif_v6brd_addr = ipv6_all_zeros;
21609 		ipif->ipif_v6pp_dst_addr = ipv6_all_zeros;
21610 		/*
21611 		 * point-to-point or Non-mulicast capable
21612 		 * interfaces won't do NUD unless explicitly
21613 		 * configured to do so.
21614 		 */
21615 		if (ipif->ipif_flags & IPIF_POINTOPOINT ||
21616 		    !(ill->ill_flags & ILLF_MULTICAST)) {
21617 			ill->ill_flags |= ILLF_NONUD;
21618 		}
21619 		/* Make sure IPv4 specific flag is not set on IPv6 if */
21620 		if (ill->ill_flags & ILLF_NOARP) {
21621 			/*
21622 			 * Note: xresolv interfaces will eventually need
21623 			 * NOARP set here as well, but that will require
21624 			 * those external resolvers to have some
21625 			 * knowledge of that flag and act appropriately.
21626 			 * Not to be changed at present.
21627 			 */
21628 			ill->ill_flags &= ~ILLF_NOARP;
21629 		}
21630 		/*
21631 		 * Set the ILLF_ROUTER flag according to the global
21632 		 * IPv6 forwarding policy.
21633 		 */
21634 		if (ipv6_forward != 0)
21635 			ill->ill_flags |= ILLF_ROUTER;
21636 	} else if (ill->ill_flags & ILLF_IPV4) {
21637 		ill->ill_isv6 = B_FALSE;
21638 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6lcl_addr);
21639 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6src_addr);
21640 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6subnet);
21641 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6net_mask);
21642 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6brd_addr);
21643 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6pp_dst_addr);
21644 		/*
21645 		 * Set the ILLF_ROUTER flag according to the global
21646 		 * IPv4 forwarding policy.
21647 		 */
21648 		if (ip_g_forward != 0)
21649 			ill->ill_flags |= ILLF_ROUTER;
21650 	}
21651 
21652 	ASSERT(ill->ill_phyint != NULL);
21653 
21654 	/*
21655 	 * The ipv6Ifindex and ipv6IfIcmpIfIndex assignments will
21656 	 * be completed in ill_glist_insert -> ill_phyint_reinit
21657 	 */
21658 	if (ill->ill_isv6) {
21659 		/* allocate v6 mib */
21660 		if (!ill_allocate_mibs(ill))
21661 			return (ENOMEM);
21662 	}
21663 
21664 	/*
21665 	 * Pick a default sap until we get the DL_INFO_ACK back from
21666 	 * the driver.
21667 	 */
21668 	if (ill->ill_sap == 0) {
21669 		if (ill->ill_isv6)
21670 			ill->ill_sap  = IP6_DL_SAP;
21671 		else
21672 			ill->ill_sap  = IP_DL_SAP;
21673 	}
21674 
21675 	ill->ill_ifname_pending = 1;
21676 	ill->ill_ifname_pending_err = 0;
21677 
21678 	ill_refhold(ill);
21679 	rw_enter(&ill_g_lock, RW_WRITER);
21680 	if ((error = ill_glist_insert(ill, interf_name,
21681 	    (ill->ill_flags & ILLF_IPV6) == ILLF_IPV6)) > 0) {
21682 		ill->ill_ppa = UINT_MAX;
21683 		ill->ill_name[0] = '\0';
21684 		/*
21685 		 * undo null termination done above.
21686 		 */
21687 		ppa_ptr[0] = old_char;
21688 		rw_exit(&ill_g_lock);
21689 		ill_refrele(ill);
21690 		return (error);
21691 	}
21692 
21693 	ASSERT(ill->ill_name_length <= LIFNAMSIZ);
21694 
21695 	/*
21696 	 * When we return the buffer pointed to by interf_name should contain
21697 	 * the same name as in ill_name.
21698 	 * If a ppa was choosen by the system (ppa passed in was UINT_MAX)
21699 	 * the buffer pointed to by new_ppa_ptr would not contain the right ppa
21700 	 * so copy full name and update the ppa ptr.
21701 	 * When ppa passed in != UINT_MAX all values are correct just undo
21702 	 * null termination, this saves a bcopy.
21703 	 */
21704 	if (*new_ppa_ptr == UINT_MAX) {
21705 		bcopy(ill->ill_name, interf_name, ill->ill_name_length);
21706 		*new_ppa_ptr = ill->ill_ppa;
21707 	} else {
21708 		/*
21709 		 * undo null termination done above.
21710 		 */
21711 		ppa_ptr[0] = old_char;
21712 	}
21713 
21714 	/* Let SCTP know about this ILL */
21715 	sctp_update_ill(ill, SCTP_ILL_INSERT);
21716 
21717 	/* and also about the first ipif */
21718 	sctp_update_ipif(ipif, SCTP_IPIF_INSERT);
21719 
21720 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_reprocess_ioctl, NEW_OP,
21721 	    B_TRUE);
21722 
21723 	rw_exit(&ill_g_lock);
21724 	ill_refrele(ill);
21725 	if (ipsq == NULL)
21726 		return (EINPROGRESS);
21727 
21728 	/*
21729 	 * Need to set the ipsq_current_ipif now, if we have changed ipsq
21730 	 * due to the phyint merge in ill_phyint_reinit.
21731 	 */
21732 	ASSERT(ipsq->ipsq_current_ipif == NULL ||
21733 		ipsq->ipsq_current_ipif == ipif);
21734 	ipsq->ipsq_current_ipif = ipif;
21735 	ipsq->ipsq_last_cmd = SIOCSLIFNAME;
21736 	error = ipif_set_values_tail(ill, ipif, mp, q);
21737 	ipsq_exit(ipsq, B_TRUE, B_TRUE);
21738 	if (error != 0 && error != EINPROGRESS) {
21739 		/*
21740 		 * restore previous values
21741 		 */
21742 		ill->ill_isv6 = B_FALSE;
21743 	}
21744 	return (error);
21745 }
21746 
21747 
21748 extern void (*ip_cleanup_func)(void);
21749 
21750 void
21751 ipif_init(void)
21752 {
21753 	hrtime_t hrt;
21754 	int i;
21755 
21756 	/*
21757 	 * Can't call drv_getparm here as it is too early in the boot.
21758 	 * As we use ipif_src_random just for picking a different
21759 	 * source address everytime, this need not be really random.
21760 	 */
21761 	hrt = gethrtime();
21762 	ipif_src_random = ((hrt >> 32) & 0xffffffff) * (hrt & 0xffffffff);
21763 
21764 	for (i = 0; i < MAX_G_HEADS; i++) {
21765 		ill_g_heads[i].ill_g_list_head = (ill_if_t *)&ill_g_heads[i];
21766 		ill_g_heads[i].ill_g_list_tail = (ill_if_t *)&ill_g_heads[i];
21767 	}
21768 
21769 	avl_create(&phyint_g_list.phyint_list_avl_by_index,
21770 	    ill_phyint_compare_index,
21771 	    sizeof (phyint_t),
21772 	    offsetof(struct phyint, phyint_avl_by_index));
21773 	avl_create(&phyint_g_list.phyint_list_avl_by_name,
21774 	    ill_phyint_compare_name,
21775 	    sizeof (phyint_t),
21776 	    offsetof(struct phyint, phyint_avl_by_name));
21777 
21778 	ip_cleanup_func = ip_thread_exit;
21779 }
21780 
21781 /*
21782  * This is called by ip_rt_add when src_addr value is other than zero.
21783  * src_addr signifies the source address of the incoming packet. For
21784  * reverse tunnel route we need to create a source addr based routing
21785  * table. This routine creates ip_mrtun_table if it's empty and then
21786  * it adds the route entry hashed by source address. It verifies that
21787  * the outgoing interface is always a non-resolver interface (tunnel).
21788  */
21789 int
21790 ip_mrtun_rt_add(ipaddr_t in_src_addr, int flags, ipif_t *ipif_arg,
21791     ipif_t *src_ipif, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func)
21792 {
21793 	ire_t   *ire;
21794 	ire_t	*save_ire;
21795 	ipif_t  *ipif;
21796 	ill_t   *in_ill = NULL;
21797 	ill_t	*out_ill;
21798 	queue_t	*stq;
21799 	mblk_t	*dlureq_mp;
21800 	int	error;
21801 
21802 	if (ire_arg != NULL)
21803 		*ire_arg = NULL;
21804 	ASSERT(in_src_addr != INADDR_ANY);
21805 
21806 	ipif = ipif_arg;
21807 	if (ipif != NULL) {
21808 		out_ill = ipif->ipif_ill;
21809 	} else {
21810 		ip1dbg(("ip_mrtun_rt_add: ipif is NULL\n"));
21811 		return (EINVAL);
21812 	}
21813 
21814 	if (src_ipif == NULL) {
21815 		ip1dbg(("ip_mrtun_rt_add: src_ipif is NULL\n"));
21816 		return (EINVAL);
21817 	}
21818 	in_ill = src_ipif->ipif_ill;
21819 
21820 	/*
21821 	 * Check for duplicates. We don't need to
21822 	 * match out_ill, because the uniqueness of
21823 	 * a route is only dependent on src_addr and
21824 	 * in_ill.
21825 	 */
21826 	ire = ire_mrtun_lookup(in_src_addr, in_ill);
21827 	if (ire != NULL) {
21828 		ire_refrele(ire);
21829 		return (EEXIST);
21830 	}
21831 	if (ipif->ipif_net_type != IRE_IF_NORESOLVER) {
21832 		ip2dbg(("ip_mrtun_rt_add: outgoing interface is type %d\n",
21833 		    ipif->ipif_net_type));
21834 		return (EINVAL);
21835 	}
21836 
21837 	stq = ipif->ipif_wq;
21838 	ASSERT(stq != NULL);
21839 
21840 	/*
21841 	 * The outgoing interface must be non-resolver
21842 	 * interface.
21843 	 */
21844 	dlureq_mp = ill_dlur_gen(NULL,
21845 	    out_ill->ill_phys_addr_length, out_ill->ill_sap,
21846 	    out_ill->ill_sap_length);
21847 
21848 	if (dlureq_mp == NULL) {
21849 		ip1dbg(("ip_newroute: dlureq_mp NULL\n"));
21850 		return (ENOMEM);
21851 	}
21852 
21853 	/* Create the IRE. */
21854 
21855 	ire = ire_create(
21856 	    NULL,				/* Zero dst addr */
21857 	    NULL,				/* Zero mask */
21858 	    NULL,				/* Zero gateway addr */
21859 	    NULL,				/* Zero ipif_src addr */
21860 	    (uint8_t *)&in_src_addr,		/* in_src-addr */
21861 	    &ipif->ipif_mtu,
21862 	    NULL,
21863 	    NULL,				/* rfq */
21864 	    stq,
21865 	    IRE_MIPRTUN,
21866 	    dlureq_mp,
21867 	    ipif,
21868 	    in_ill,
21869 	    0,
21870 	    0,
21871 	    0,
21872 	    flags,
21873 	    &ire_uinfo_null);
21874 
21875 	if (ire == NULL)
21876 		return (ENOMEM);
21877 	ip2dbg(("ip_mrtun_rt_add: mrtun route is created with type %d\n",
21878 	    ire->ire_type));
21879 	save_ire = ire;
21880 	ASSERT(save_ire != NULL);
21881 	error = ire_add_mrtun(&ire, q, mp, func);
21882 	/*
21883 	 * If ire_add_mrtun() failed, the ire passed in was freed
21884 	 * so there is no need to do so here.
21885 	 */
21886 	if (error != 0) {
21887 		return (error);
21888 	}
21889 
21890 	/* Duplicate check */
21891 	if (ire != save_ire) {
21892 		/* route already exists by now */
21893 		ire_refrele(ire);
21894 		return (EEXIST);
21895 	}
21896 
21897 	if (ire_arg != NULL) {
21898 		/*
21899 		 * Store the ire that was just added. the caller
21900 		 * ip_rts_request responsible for doing ire_refrele()
21901 		 * on it.
21902 		 */
21903 		*ire_arg = ire;
21904 	} else {
21905 		ire_refrele(ire);	/* held in ire_add_mrtun */
21906 	}
21907 
21908 	return (0);
21909 }
21910 
21911 /*
21912  * It is called by ip_rt_delete() only when mipagent requests to delete
21913  * a reverse tunnel route that was added by ip_mrtun_rt_add() before.
21914  */
21915 
21916 int
21917 ip_mrtun_rt_delete(ipaddr_t in_src_addr, ipif_t *src_ipif)
21918 {
21919 	ire_t   *ire = NULL;
21920 
21921 	if (in_src_addr == INADDR_ANY)
21922 		return (EINVAL);
21923 	if (src_ipif == NULL)
21924 		return (EINVAL);
21925 
21926 	/* search if this route exists in the ip_mrtun_table */
21927 	ire = ire_mrtun_lookup(in_src_addr, src_ipif->ipif_ill);
21928 	if (ire == NULL) {
21929 		ip2dbg(("ip_mrtun_rt_delete: ire not found\n"));
21930 		return (ESRCH);
21931 	}
21932 	ire_delete(ire);
21933 	ire_refrele(ire);
21934 	return (0);
21935 }
21936 
21937 /*
21938  * Lookup the ipif corresponding to the onlink destination address. For
21939  * point-to-point interfaces, it matches with remote endpoint destination
21940  * address. For point-to-multipoint interfaces it only tries to match the
21941  * destination with the interface's subnet address. The longest, most specific
21942  * match is found to take care of such rare network configurations like -
21943  * le0: 129.146.1.1/16
21944  * le1: 129.146.2.2/24
21945  * It is used only by SO_DONTROUTE at the moment.
21946  */
21947 ipif_t *
21948 ipif_lookup_onlink_addr(ipaddr_t addr, zoneid_t zoneid)
21949 {
21950 	ipif_t	*ipif, *best_ipif;
21951 	ill_t	*ill;
21952 	ill_walk_context_t ctx;
21953 
21954 	ASSERT(zoneid != ALL_ZONES);
21955 	best_ipif = NULL;
21956 
21957 	rw_enter(&ill_g_lock, RW_READER);
21958 	ill = ILL_START_WALK_V4(&ctx);
21959 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
21960 		mutex_enter(&ill->ill_lock);
21961 		for (ipif = ill->ill_ipif; ipif != NULL;
21962 		    ipif = ipif->ipif_next) {
21963 			if (!IPIF_CAN_LOOKUP(ipif))
21964 				continue;
21965 			if (ipif->ipif_zoneid != zoneid)
21966 				continue;
21967 			/*
21968 			 * Point-to-point case. Look for exact match with
21969 			 * destination address.
21970 			 */
21971 			if (ipif->ipif_flags & IPIF_POINTOPOINT) {
21972 				if (ipif->ipif_pp_dst_addr == addr) {
21973 					ipif_refhold_locked(ipif);
21974 					mutex_exit(&ill->ill_lock);
21975 					rw_exit(&ill_g_lock);
21976 					if (best_ipif != NULL)
21977 						ipif_refrele(best_ipif);
21978 					return (ipif);
21979 				}
21980 			} else if (ipif->ipif_subnet == (addr &
21981 			    ipif->ipif_net_mask)) {
21982 				/*
21983 				 * Point-to-multipoint case. Looping through to
21984 				 * find the most specific match. If there are
21985 				 * multiple best match ipif's then prefer ipif's
21986 				 * that are UP. If there is only one best match
21987 				 * ipif and it is DOWN we must still return it.
21988 				 */
21989 				if ((best_ipif == NULL) ||
21990 				    (ipif->ipif_net_mask >
21991 				    best_ipif->ipif_net_mask) ||
21992 				    ((ipif->ipif_net_mask ==
21993 				    best_ipif->ipif_net_mask) &&
21994 				    ((ipif->ipif_flags & IPIF_UP) &&
21995 				    (!(best_ipif->ipif_flags & IPIF_UP))))) {
21996 					ipif_refhold_locked(ipif);
21997 					mutex_exit(&ill->ill_lock);
21998 					rw_exit(&ill_g_lock);
21999 					if (best_ipif != NULL)
22000 						ipif_refrele(best_ipif);
22001 					best_ipif = ipif;
22002 					rw_enter(&ill_g_lock, RW_READER);
22003 					mutex_enter(&ill->ill_lock);
22004 				}
22005 			}
22006 		}
22007 		mutex_exit(&ill->ill_lock);
22008 	}
22009 	rw_exit(&ill_g_lock);
22010 	return (best_ipif);
22011 }
22012 
22013 
22014 /*
22015  * Save enough information so that we can recreate the IRE if
22016  * the interface goes down and then up.
22017  */
22018 static void
22019 ipif_save_ire(ipif_t *ipif, ire_t *ire)
22020 {
22021 	mblk_t	*save_mp;
22022 
22023 	save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
22024 	if (save_mp != NULL) {
22025 		ifrt_t	*ifrt;
22026 
22027 		save_mp->b_wptr += sizeof (ifrt_t);
22028 		ifrt = (ifrt_t *)save_mp->b_rptr;
22029 		bzero(ifrt, sizeof (ifrt_t));
22030 		ifrt->ifrt_type = ire->ire_type;
22031 		ifrt->ifrt_addr = ire->ire_addr;
22032 		ifrt->ifrt_gateway_addr = ire->ire_gateway_addr;
22033 		ifrt->ifrt_src_addr = ire->ire_src_addr;
22034 		ifrt->ifrt_mask = ire->ire_mask;
22035 		ifrt->ifrt_flags = ire->ire_flags;
22036 		ifrt->ifrt_max_frag = ire->ire_max_frag;
22037 		mutex_enter(&ipif->ipif_saved_ire_lock);
22038 		save_mp->b_cont = ipif->ipif_saved_ire_mp;
22039 		ipif->ipif_saved_ire_mp = save_mp;
22040 		ipif->ipif_saved_ire_cnt++;
22041 		mutex_exit(&ipif->ipif_saved_ire_lock);
22042 	}
22043 }
22044 
22045 
22046 static void
22047 ipif_remove_ire(ipif_t *ipif, ire_t *ire)
22048 {
22049 	mblk_t	**mpp;
22050 	mblk_t	*mp;
22051 	ifrt_t	*ifrt;
22052 
22053 	/* Remove from ipif_saved_ire_mp list if it is there */
22054 	mutex_enter(&ipif->ipif_saved_ire_lock);
22055 	for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL;
22056 	    mpp = &(*mpp)->b_cont) {
22057 		/*
22058 		 * On a given ipif, the triple of address, gateway and
22059 		 * mask is unique for each saved IRE (in the case of
22060 		 * ordinary interface routes, the gateway address is
22061 		 * all-zeroes).
22062 		 */
22063 		mp = *mpp;
22064 		ifrt = (ifrt_t *)mp->b_rptr;
22065 		if (ifrt->ifrt_addr == ire->ire_addr &&
22066 		    ifrt->ifrt_gateway_addr == ire->ire_gateway_addr &&
22067 		    ifrt->ifrt_mask == ire->ire_mask) {
22068 			*mpp = mp->b_cont;
22069 			ipif->ipif_saved_ire_cnt--;
22070 			freeb(mp);
22071 			break;
22072 		}
22073 	}
22074 	mutex_exit(&ipif->ipif_saved_ire_lock);
22075 }
22076 
22077 
22078 /*
22079  * IP multirouting broadcast routes handling
22080  * Append CGTP broadcast IREs to regular ones created
22081  * at ifconfig time.
22082  */
22083 static void
22084 ip_cgtp_bcast_add(ire_t *ire, ire_t *ire_dst)
22085 {
22086 	ire_t *ire_prim;
22087 
22088 	ASSERT(ire != NULL);
22089 	ASSERT(ire_dst != NULL);
22090 
22091 	ire_prim = ire_ctable_lookup(ire->ire_gateway_addr, 0,
22092 	    IRE_BROADCAST, NULL, NULL, MATCH_IRE_TYPE);
22093 	if (ire_prim != NULL) {
22094 		/*
22095 		 * We are in the special case of broadcasts for
22096 		 * CGTP. We add an IRE_BROADCAST that holds
22097 		 * the RTF_MULTIRT flag, the destination
22098 		 * address of ire_dst and the low level
22099 		 * info of ire_prim. In other words, CGTP
22100 		 * broadcast is added to the redundant ipif.
22101 		 */
22102 		ipif_t *ipif_prim;
22103 		ire_t  *bcast_ire;
22104 
22105 		ipif_prim = ire_prim->ire_ipif;
22106 
22107 		ip2dbg(("ip_cgtp_filter_bcast_add: "
22108 		    "ire_dst %p, ire_prim %p, ipif_prim %p\n",
22109 		    (void *)ire_dst, (void *)ire_prim,
22110 		    (void *)ipif_prim));
22111 
22112 		bcast_ire = ire_create(
22113 		    (uchar_t *)&ire->ire_addr,
22114 		    (uchar_t *)&ip_g_all_ones,
22115 		    (uchar_t *)&ire_dst->ire_src_addr,
22116 		    (uchar_t *)&ire->ire_gateway_addr,
22117 		    NULL,
22118 		    &ipif_prim->ipif_mtu,
22119 		    NULL,
22120 		    ipif_prim->ipif_rq,
22121 		    ipif_prim->ipif_wq,
22122 		    IRE_BROADCAST,
22123 		    ipif_prim->ipif_bcast_mp,
22124 		    ipif_prim,
22125 		    NULL,
22126 		    0,
22127 		    0,
22128 		    0,
22129 		    ire->ire_flags,
22130 		    &ire_uinfo_null);
22131 
22132 		if (bcast_ire != NULL) {
22133 
22134 			if (ire_add(&bcast_ire, NULL, NULL, NULL) == 0) {
22135 				ip2dbg(("ip_cgtp_filter_bcast_add: "
22136 				    "added bcast_ire %p\n",
22137 				    (void *)bcast_ire));
22138 
22139 				ipif_save_ire(bcast_ire->ire_ipif,
22140 				    bcast_ire);
22141 				ire_refrele(bcast_ire);
22142 			}
22143 		}
22144 		ire_refrele(ire_prim);
22145 	}
22146 }
22147 
22148 
22149 /*
22150  * IP multirouting broadcast routes handling
22151  * Remove the broadcast ire
22152  */
22153 static void
22154 ip_cgtp_bcast_delete(ire_t *ire)
22155 {
22156 	ire_t *ire_dst;
22157 
22158 	ASSERT(ire != NULL);
22159 	ire_dst = ire_ctable_lookup(ire->ire_addr, 0, IRE_BROADCAST,
22160 	    NULL, NULL, MATCH_IRE_TYPE);
22161 	if (ire_dst != NULL) {
22162 		ire_t *ire_prim;
22163 
22164 		ire_prim = ire_ctable_lookup(ire->ire_gateway_addr, 0,
22165 		    IRE_BROADCAST, NULL, NULL, MATCH_IRE_TYPE);
22166 		if (ire_prim != NULL) {
22167 			ipif_t *ipif_prim;
22168 			ire_t  *bcast_ire;
22169 
22170 			ipif_prim = ire_prim->ire_ipif;
22171 
22172 			ip2dbg(("ip_cgtp_filter_bcast_delete: "
22173 			    "ire_dst %p, ire_prim %p, ipif_prim %p\n",
22174 			    (void *)ire_dst, (void *)ire_prim,
22175 			    (void *)ipif_prim));
22176 
22177 			bcast_ire = ire_ctable_lookup(ire->ire_addr,
22178 			    ire->ire_gateway_addr,
22179 			    IRE_BROADCAST,
22180 			    ipif_prim,
22181 			    NULL,
22182 			    MATCH_IRE_TYPE | MATCH_IRE_GW | MATCH_IRE_IPIF |
22183 			    MATCH_IRE_MASK);
22184 
22185 			if (bcast_ire != NULL) {
22186 				ip2dbg(("ip_cgtp_filter_bcast_delete: "
22187 				    "looked up bcast_ire %p\n",
22188 				    (void *)bcast_ire));
22189 				ipif_remove_ire(bcast_ire->ire_ipif,
22190 					bcast_ire);
22191 				ire_delete(bcast_ire);
22192 			}
22193 			ire_refrele(ire_prim);
22194 		}
22195 		ire_refrele(ire_dst);
22196 	}
22197 }
22198 
22199 /*
22200  * IPsec hardware acceleration capabilities related functions.
22201  */
22202 
22203 /*
22204  * Free a per-ill IPsec capabilities structure.
22205  */
22206 static void
22207 ill_ipsec_capab_free(ill_ipsec_capab_t *capab)
22208 {
22209 	if (capab->auth_hw_algs != NULL)
22210 		kmem_free(capab->auth_hw_algs, capab->algs_size);
22211 	if (capab->encr_hw_algs != NULL)
22212 		kmem_free(capab->encr_hw_algs, capab->algs_size);
22213 	if (capab->encr_algparm != NULL)
22214 		kmem_free(capab->encr_algparm, capab->encr_algparm_size);
22215 	kmem_free(capab, sizeof (ill_ipsec_capab_t));
22216 }
22217 
22218 /*
22219  * Allocate a new per-ill IPsec capabilities structure. This structure
22220  * is specific to an IPsec protocol (AH or ESP). It is implemented as
22221  * an array which specifies, for each algorithm, whether this algorithm
22222  * is supported by the ill or not.
22223  */
22224 static ill_ipsec_capab_t *
22225 ill_ipsec_capab_alloc(void)
22226 {
22227 	ill_ipsec_capab_t *capab;
22228 	uint_t nelems;
22229 
22230 	capab = kmem_zalloc(sizeof (ill_ipsec_capab_t), KM_NOSLEEP);
22231 	if (capab == NULL)
22232 		return (NULL);
22233 
22234 	/* we need one bit per algorithm */
22235 	nelems = MAX_IPSEC_ALGS / BITS(ipsec_capab_elem_t);
22236 	capab->algs_size = nelems * sizeof (ipsec_capab_elem_t);
22237 
22238 	/* allocate memory to store algorithm flags */
22239 	capab->encr_hw_algs = kmem_zalloc(capab->algs_size, KM_NOSLEEP);
22240 	if (capab->encr_hw_algs == NULL)
22241 		goto nomem;
22242 	capab->auth_hw_algs = kmem_zalloc(capab->algs_size, KM_NOSLEEP);
22243 	if (capab->auth_hw_algs == NULL)
22244 		goto nomem;
22245 	/*
22246 	 * Leave encr_algparm NULL for now since we won't need it half
22247 	 * the time
22248 	 */
22249 	return (capab);
22250 
22251 nomem:
22252 	ill_ipsec_capab_free(capab);
22253 	return (NULL);
22254 }
22255 
22256 /*
22257  * Resize capability array.  Since we're exclusive, this is OK.
22258  */
22259 static boolean_t
22260 ill_ipsec_capab_resize_algparm(ill_ipsec_capab_t *capab, int algid)
22261 {
22262 	ipsec_capab_algparm_t *nalp, *oalp;
22263 	uint32_t olen, nlen;
22264 
22265 	oalp = capab->encr_algparm;
22266 	olen = capab->encr_algparm_size;
22267 
22268 	if (oalp != NULL) {
22269 		if (algid < capab->encr_algparm_end)
22270 			return (B_TRUE);
22271 	}
22272 
22273 	nlen = (algid + 1) * sizeof (*nalp);
22274 	nalp = kmem_zalloc(nlen, KM_NOSLEEP);
22275 	if (nalp == NULL)
22276 		return (B_FALSE);
22277 
22278 	if (oalp != NULL) {
22279 		bcopy(oalp, nalp, olen);
22280 		kmem_free(oalp, olen);
22281 	}
22282 	capab->encr_algparm = nalp;
22283 	capab->encr_algparm_size = nlen;
22284 	capab->encr_algparm_end = algid + 1;
22285 
22286 	return (B_TRUE);
22287 }
22288 
22289 /*
22290  * Compare the capabilities of the specified ill with the protocol
22291  * and algorithms specified by the SA passed as argument.
22292  * If they match, returns B_TRUE, B_FALSE if they do not match.
22293  *
22294  * The ill can be passed as a pointer to it, or by specifying its index
22295  * and whether it is an IPv6 ill (ill_index and ill_isv6 arguments).
22296  *
22297  * Called by ipsec_out_is_accelerated() do decide whether an outbound
22298  * packet is eligible for hardware acceleration, and by
22299  * ill_ipsec_capab_send_all() to decide whether a SA must be sent down
22300  * to a particular ill.
22301  */
22302 boolean_t
22303 ipsec_capab_match(ill_t *ill, uint_t ill_index, boolean_t ill_isv6,
22304     ipsa_t *sa)
22305 {
22306 	boolean_t sa_isv6;
22307 	uint_t algid;
22308 	struct ill_ipsec_capab_s *cpp;
22309 	boolean_t need_refrele = B_FALSE;
22310 
22311 	if (ill == NULL) {
22312 		ill = ill_lookup_on_ifindex(ill_index, ill_isv6, NULL,
22313 		    NULL, NULL, NULL);
22314 		if (ill == NULL) {
22315 			ip0dbg(("ipsec_capab_match: ill doesn't exist\n"));
22316 			return (B_FALSE);
22317 		}
22318 		need_refrele = B_TRUE;
22319 	}
22320 
22321 	/*
22322 	 * Use the address length specified by the SA to determine
22323 	 * if it corresponds to a IPv6 address, and fail the matching
22324 	 * if the isv6 flag passed as argument does not match.
22325 	 * Note: this check is used for SADB capability checking before
22326 	 * sending SA information to an ill.
22327 	 */
22328 	sa_isv6 = (sa->ipsa_addrfam == AF_INET6);
22329 	if (sa_isv6 != ill_isv6)
22330 		/* protocol mismatch */
22331 		goto done;
22332 
22333 	/*
22334 	 * Check if the ill supports the protocol, algorithm(s) and
22335 	 * key size(s) specified by the SA, and get the pointers to
22336 	 * the algorithms supported by the ill.
22337 	 */
22338 	switch (sa->ipsa_type) {
22339 
22340 	case SADB_SATYPE_ESP:
22341 		if (!(ill->ill_capabilities & ILL_CAPAB_ESP))
22342 			/* ill does not support ESP acceleration */
22343 			goto done;
22344 		cpp = ill->ill_ipsec_capab_esp;
22345 		algid = sa->ipsa_auth_alg;
22346 		if (!IPSEC_ALG_IS_ENABLED(algid, cpp->auth_hw_algs))
22347 			goto done;
22348 		algid = sa->ipsa_encr_alg;
22349 		if (!IPSEC_ALG_IS_ENABLED(algid, cpp->encr_hw_algs))
22350 			goto done;
22351 		if (algid < cpp->encr_algparm_end) {
22352 			ipsec_capab_algparm_t *alp = &cpp->encr_algparm[algid];
22353 			if (sa->ipsa_encrkeybits < alp->minkeylen)
22354 				goto done;
22355 			if (sa->ipsa_encrkeybits > alp->maxkeylen)
22356 				goto done;
22357 		}
22358 		break;
22359 
22360 	case SADB_SATYPE_AH:
22361 		if (!(ill->ill_capabilities & ILL_CAPAB_AH))
22362 			/* ill does not support AH acceleration */
22363 			goto done;
22364 		if (!IPSEC_ALG_IS_ENABLED(sa->ipsa_auth_alg,
22365 		    ill->ill_ipsec_capab_ah->auth_hw_algs))
22366 			goto done;
22367 		break;
22368 	}
22369 
22370 	if (need_refrele)
22371 		ill_refrele(ill);
22372 	return (B_TRUE);
22373 done:
22374 	if (need_refrele)
22375 		ill_refrele(ill);
22376 	return (B_FALSE);
22377 }
22378 
22379 
22380 /*
22381  * Add a new ill to the list of IPsec capable ills.
22382  * Called from ill_capability_ipsec_ack() when an ACK was received
22383  * indicating that IPsec hardware processing was enabled for an ill.
22384  *
22385  * ill must point to the ill for which acceleration was enabled.
22386  * dl_cap must be set to DL_CAPAB_IPSEC_AH or DL_CAPAB_IPSEC_ESP.
22387  */
22388 static void
22389 ill_ipsec_capab_add(ill_t *ill, uint_t dl_cap, boolean_t sadb_resync)
22390 {
22391 	ipsec_capab_ill_t **ills, *cur_ill, *new_ill;
22392 	uint_t sa_type;
22393 	uint_t ipproto;
22394 
22395 	ASSERT((dl_cap == DL_CAPAB_IPSEC_AH) ||
22396 	    (dl_cap == DL_CAPAB_IPSEC_ESP));
22397 
22398 	switch (dl_cap) {
22399 	case DL_CAPAB_IPSEC_AH:
22400 		sa_type = SADB_SATYPE_AH;
22401 		ills = &ipsec_capab_ills_ah;
22402 		ipproto = IPPROTO_AH;
22403 		break;
22404 	case DL_CAPAB_IPSEC_ESP:
22405 		sa_type = SADB_SATYPE_ESP;
22406 		ills = &ipsec_capab_ills_esp;
22407 		ipproto = IPPROTO_ESP;
22408 		break;
22409 	}
22410 
22411 	rw_enter(&ipsec_capab_ills_lock, RW_WRITER);
22412 
22413 	/*
22414 	 * Add ill index to list of hardware accelerators. If
22415 	 * already in list, do nothing.
22416 	 */
22417 	for (cur_ill = *ills; cur_ill != NULL &&
22418 	    (cur_ill->ill_index != ill->ill_phyint->phyint_ifindex ||
22419 	    cur_ill->ill_isv6 != ill->ill_isv6); cur_ill = cur_ill->next)
22420 		;
22421 
22422 	if (cur_ill == NULL) {
22423 		/* if this is a new entry for this ill */
22424 		new_ill = kmem_zalloc(sizeof (ipsec_capab_ill_t), KM_NOSLEEP);
22425 		if (new_ill == NULL) {
22426 			rw_exit(&ipsec_capab_ills_lock);
22427 			return;
22428 		}
22429 
22430 		new_ill->ill_index = ill->ill_phyint->phyint_ifindex;
22431 		new_ill->ill_isv6 = ill->ill_isv6;
22432 		new_ill->next = *ills;
22433 		*ills = new_ill;
22434 	} else if (!sadb_resync) {
22435 		/* not resync'ing SADB and an entry exists for this ill */
22436 		rw_exit(&ipsec_capab_ills_lock);
22437 		return;
22438 	}
22439 
22440 	rw_exit(&ipsec_capab_ills_lock);
22441 
22442 	if (ipcl_proto_fanout_v6[ipproto].connf_head != NULL)
22443 		/*
22444 		 * IPsec module for protocol loaded, initiate dump
22445 		 * of the SADB to this ill.
22446 		 */
22447 		sadb_ill_download(ill, sa_type);
22448 }
22449 
22450 /*
22451  * Remove an ill from the list of IPsec capable ills.
22452  */
22453 static void
22454 ill_ipsec_capab_delete(ill_t *ill, uint_t dl_cap)
22455 {
22456 	ipsec_capab_ill_t **ills, *cur_ill, *prev_ill;
22457 
22458 	ASSERT(dl_cap == DL_CAPAB_IPSEC_AH ||
22459 	    dl_cap == DL_CAPAB_IPSEC_ESP);
22460 
22461 	ills = (dl_cap == DL_CAPAB_IPSEC_AH) ? &ipsec_capab_ills_ah :
22462 	    &ipsec_capab_ills_esp;
22463 
22464 	rw_enter(&ipsec_capab_ills_lock, RW_WRITER);
22465 
22466 	prev_ill = NULL;
22467 	for (cur_ill = *ills; cur_ill != NULL && (cur_ill->ill_index !=
22468 	    ill->ill_phyint->phyint_ifindex || cur_ill->ill_isv6 !=
22469 	    ill->ill_isv6); prev_ill = cur_ill, cur_ill = cur_ill->next)
22470 		;
22471 	if (cur_ill == NULL) {
22472 		/* entry not found */
22473 		rw_exit(&ipsec_capab_ills_lock);
22474 		return;
22475 	}
22476 	if (prev_ill == NULL) {
22477 		/* entry at front of list */
22478 		*ills = NULL;
22479 	} else {
22480 		prev_ill->next = cur_ill->next;
22481 	}
22482 	kmem_free(cur_ill, sizeof (ipsec_capab_ill_t));
22483 	rw_exit(&ipsec_capab_ills_lock);
22484 }
22485 
22486 
22487 /*
22488  * Handling of DL_CONTROL_REQ messages that must be sent down to
22489  * an ill while having exclusive access.
22490  */
22491 /* ARGSUSED */
22492 static void
22493 ill_ipsec_capab_send_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
22494 {
22495 	ill_t *ill = (ill_t *)q->q_ptr;
22496 
22497 	ill_dlpi_send(ill, mp);
22498 }
22499 
22500 
22501 /*
22502  * Called by SADB to send a DL_CONTROL_REQ message to every ill
22503  * supporting the specified IPsec protocol acceleration.
22504  * sa_type must be SADB_SATYPE_AH or SADB_SATYPE_ESP.
22505  * We free the mblk and, if sa is non-null, release the held referece.
22506  */
22507 void
22508 ill_ipsec_capab_send_all(uint_t sa_type, mblk_t *mp, ipsa_t *sa)
22509 {
22510 	ipsec_capab_ill_t *ici, *cur_ici;
22511 	ill_t *ill;
22512 	mblk_t *nmp, *mp_ship_list = NULL, *next_mp;
22513 
22514 	ici = (sa_type == SADB_SATYPE_AH) ? ipsec_capab_ills_ah :
22515 	    ipsec_capab_ills_esp;
22516 
22517 	rw_enter(&ipsec_capab_ills_lock, RW_READER);
22518 
22519 	for (cur_ici = ici; cur_ici != NULL; cur_ici = cur_ici->next) {
22520 		ill = ill_lookup_on_ifindex(cur_ici->ill_index,
22521 		    cur_ici->ill_isv6, NULL, NULL, NULL, NULL);
22522 
22523 		/*
22524 		 * Handle the case where the ill goes away while the SADB is
22525 		 * attempting to send messages.  If it's going away, it's
22526 		 * nuking its shadow SADB, so we don't care..
22527 		 */
22528 
22529 		if (ill == NULL)
22530 			continue;
22531 
22532 		if (sa != NULL) {
22533 			/*
22534 			 * Make sure capabilities match before
22535 			 * sending SA to ill.
22536 			 */
22537 			if (!ipsec_capab_match(ill, cur_ici->ill_index,
22538 			    cur_ici->ill_isv6, sa)) {
22539 				ill_refrele(ill);
22540 				continue;
22541 			}
22542 
22543 			mutex_enter(&sa->ipsa_lock);
22544 			sa->ipsa_flags |= IPSA_F_HW;
22545 			mutex_exit(&sa->ipsa_lock);
22546 		}
22547 
22548 		/*
22549 		 * Copy template message, and add it to the front
22550 		 * of the mblk ship list. We want to avoid holding
22551 		 * the ipsec_capab_ills_lock while sending the
22552 		 * message to the ills.
22553 		 *
22554 		 * The b_next and b_prev are temporarily used
22555 		 * to build a list of mblks to be sent down, and to
22556 		 * save the ill to which they must be sent.
22557 		 */
22558 		nmp = copymsg(mp);
22559 		if (nmp == NULL) {
22560 			ill_refrele(ill);
22561 			continue;
22562 		}
22563 		ASSERT(nmp->b_next == NULL && nmp->b_prev == NULL);
22564 		nmp->b_next = mp_ship_list;
22565 		mp_ship_list = nmp;
22566 		nmp->b_prev = (mblk_t *)ill;
22567 	}
22568 
22569 	rw_exit(&ipsec_capab_ills_lock);
22570 
22571 	nmp = mp_ship_list;
22572 	while (nmp != NULL) {
22573 		/* restore the mblk to a sane state */
22574 		next_mp = nmp->b_next;
22575 		nmp->b_next = NULL;
22576 		ill = (ill_t *)nmp->b_prev;
22577 		nmp->b_prev = NULL;
22578 
22579 		/*
22580 		 * Ship the mblk to the ill, must be exclusive. Keep the
22581 		 * reference to the ill as qwriter_ip() does a ill_referele().
22582 		 */
22583 		(void) qwriter_ip(NULL, ill, ill->ill_wq, nmp,
22584 		    ill_ipsec_capab_send_writer, NEW_OP, B_TRUE);
22585 
22586 		nmp = next_mp;
22587 	}
22588 
22589 	if (sa != NULL)
22590 		IPSA_REFRELE(sa);
22591 	freemsg(mp);
22592 }
22593 
22594 
22595 /*
22596  * Derive an interface id from the link layer address.
22597  * Knows about IEEE 802 and IEEE EUI-64 mappings.
22598  */
22599 static boolean_t
22600 ip_ether_v6intfid(uint_t phys_length, uint8_t *phys_addr, in6_addr_t *v6addr)
22601 {
22602 	char		*addr;
22603 
22604 	if (phys_length != ETHERADDRL)
22605 		return (B_FALSE);
22606 
22607 	/* Form EUI-64 like address */
22608 	addr = (char *)&v6addr->s6_addr32[2];
22609 	bcopy((char *)phys_addr, addr, 3);
22610 	addr[0] ^= 0x2;		/* Toggle Universal/Local bit */
22611 	addr[3] = (char)0xff;
22612 	addr[4] = (char)0xfe;
22613 	bcopy((char *)phys_addr + 3, addr + 5, 3);
22614 	return (B_TRUE);
22615 }
22616 
22617 /* ARGSUSED */
22618 static boolean_t
22619 ip_nodef_v6intfid(uint_t phys_length, uint8_t *phys_addr, in6_addr_t *v6addr)
22620 {
22621 	return (B_FALSE);
22622 }
22623 
22624 /* ARGSUSED */
22625 static boolean_t
22626 ip_ether_v6mapinfo(uint_t lla_length, uint8_t *bphys_addr, uint8_t *maddr,
22627     uint32_t *hw_start, in6_addr_t *v6_extract_mask)
22628 {
22629 	/*
22630 	 * Multicast address mappings used over Ethernet/802.X.
22631 	 * This address is used as a base for mappings.
22632 	 */
22633 	static uint8_t ipv6_g_phys_multi_addr[] = {0x33, 0x33, 0x00,
22634 	    0x00, 0x00, 0x00};
22635 
22636 	/*
22637 	 * Extract low order 32 bits from IPv6 multicast address.
22638 	 * Or that into the link layer address, starting from the
22639 	 * second byte.
22640 	 */
22641 	*hw_start = 2;
22642 	v6_extract_mask->s6_addr32[0] = 0;
22643 	v6_extract_mask->s6_addr32[1] = 0;
22644 	v6_extract_mask->s6_addr32[2] = 0;
22645 	v6_extract_mask->s6_addr32[3] = 0xffffffffU;
22646 	bcopy(ipv6_g_phys_multi_addr, maddr, lla_length);
22647 	return (B_TRUE);
22648 }
22649 
22650 /*
22651  * Indicate by return value whether multicast is supported. If not,
22652  * this code should not touch/change any parameters.
22653  */
22654 /* ARGSUSED */
22655 static boolean_t
22656 ip_ether_v4mapinfo(uint_t phys_length, uint8_t *bphys_addr, uint8_t *maddr,
22657     uint32_t *hw_start, ipaddr_t *extract_mask)
22658 {
22659 	/*
22660 	 * Multicast address mappings used over Ethernet/802.X.
22661 	 * This address is used as a base for mappings.
22662 	 */
22663 	static uint8_t ip_g_phys_multi_addr[] = { 0x01, 0x00, 0x5e,
22664 	    0x00, 0x00, 0x00 };
22665 
22666 	if (phys_length != ETHERADDRL)
22667 		return (B_FALSE);
22668 
22669 	*extract_mask = htonl(0x007fffff);
22670 	*hw_start = 2;
22671 	bcopy(ip_g_phys_multi_addr, maddr, ETHERADDRL);
22672 	return (B_TRUE);
22673 }
22674 
22675 /*
22676  * Derive IPoIB interface id from the link layer address.
22677  */
22678 static boolean_t
22679 ip_ib_v6intfid(uint_t phys_length, uint8_t *phys_addr, in6_addr_t *v6addr)
22680 {
22681 	char		*addr;
22682 
22683 	if (phys_length != 20)
22684 		return (B_FALSE);
22685 	addr = (char *)&v6addr->s6_addr32[2];
22686 	bcopy(phys_addr + 12, addr, 8);
22687 	/*
22688 	 * In IBA 1.1 timeframe, some vendors erroneously set the u/l bit
22689 	 * in the globally assigned EUI-64 GUID to 1, in violation of IEEE
22690 	 * rules. In these cases, the IBA considers these GUIDs to be in
22691 	 * "Modified EUI-64" format, and thus toggling the u/l bit is not
22692 	 * required; vendors are required not to assign global EUI-64's
22693 	 * that differ only in u/l bit values, thus guaranteeing uniqueness
22694 	 * of the interface identifier. Whether the GUID is in modified
22695 	 * or proper EUI-64 format, the ipv6 identifier must have the u/l
22696 	 * bit set to 1.
22697 	 */
22698 	addr[0] |= 2;			/* Set Universal/Local bit to 1 */
22699 	return (B_TRUE);
22700 }
22701 
22702 /*
22703  * Note on mapping from multicast IP addresses to IPoIB multicast link
22704  * addresses. IPoIB multicast link addresses are based on IBA link addresses.
22705  * The format of an IPoIB multicast address is:
22706  *
22707  *  4 byte QPN      Scope Sign.  Pkey
22708  * +--------------------------------------------+
22709  * | 00FFFFFF | FF | 1X | X01B | Pkey | GroupID |
22710  * +--------------------------------------------+
22711  *
22712  * The Scope and Pkey components are properties of the IBA port and
22713  * network interface. They can be ascertained from the broadcast address.
22714  * The Sign. part is the signature, and is 401B for IPv4 and 601B for IPv6.
22715  */
22716 
22717 static boolean_t
22718 ip_ib_v6mapinfo(uint_t lla_length, uint8_t *bphys_addr, uint8_t *maddr,
22719     uint32_t *hw_start, in6_addr_t *v6_extract_mask)
22720 {
22721 	/*
22722 	 * Base IPoIB IPv6 multicast address used for mappings.
22723 	 * Does not contain the IBA scope/Pkey values.
22724 	 */
22725 	static uint8_t ipv6_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
22726 	    0xff, 0x10, 0x60, 0x1b, 0x00, 0x00, 0x00, 0x00,
22727 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
22728 
22729 	/*
22730 	 * Extract low order 80 bits from IPv6 multicast address.
22731 	 * Or that into the link layer address, starting from the
22732 	 * sixth byte.
22733 	 */
22734 	*hw_start = 6;
22735 	bcopy(ipv6_g_phys_ibmulti_addr, maddr, lla_length);
22736 
22737 	/*
22738 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
22739 	 */
22740 	*(maddr + 5) = *(bphys_addr + 5);
22741 	*(maddr + 8) = *(bphys_addr + 8);
22742 	*(maddr + 9) = *(bphys_addr + 9);
22743 
22744 	v6_extract_mask->s6_addr32[0] = 0;
22745 	v6_extract_mask->s6_addr32[1] = htonl(0x0000ffff);
22746 	v6_extract_mask->s6_addr32[2] = 0xffffffffU;
22747 	v6_extract_mask->s6_addr32[3] = 0xffffffffU;
22748 	return (B_TRUE);
22749 }
22750 
22751 static boolean_t
22752 ip_ib_v4mapinfo(uint_t phys_length, uint8_t *bphys_addr, uint8_t *maddr,
22753     uint32_t *hw_start, ipaddr_t *extract_mask)
22754 {
22755 	/*
22756 	 * Base IPoIB IPv4 multicast address used for mappings.
22757 	 * Does not contain the IBA scope/Pkey values.
22758 	 */
22759 	static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
22760 	    0xff, 0x10, 0x40, 0x1b, 0x00, 0x00, 0x00, 0x00,
22761 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
22762 
22763 	if (phys_length != sizeof (ipv4_g_phys_ibmulti_addr))
22764 		return (B_FALSE);
22765 
22766 	/*
22767 	 * Extract low order 28 bits from IPv4 multicast address.
22768 	 * Or that into the link layer address, starting from the
22769 	 * sixteenth byte.
22770 	 */
22771 	*extract_mask = htonl(0x0fffffff);
22772 	*hw_start = 16;
22773 	bcopy(ipv4_g_phys_ibmulti_addr, maddr, phys_length);
22774 
22775 	/*
22776 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
22777 	 */
22778 	*(maddr + 5) = *(bphys_addr + 5);
22779 	*(maddr + 8) = *(bphys_addr + 8);
22780 	*(maddr + 9) = *(bphys_addr + 9);
22781 	return (B_TRUE);
22782 }
22783 
22784 /*
22785  * Returns B_TRUE if an ipif is present in the given zone, matching some flags
22786  * (typically IPIF_UP). If ipifp is non-null, the held ipif is returned there.
22787  * This works for both IPv4 and IPv6; if the passed-in ill is v6, the ipif with
22788  * the link-local address is preferred.
22789  */
22790 boolean_t
22791 ipif_lookup_zoneid(ill_t *ill, zoneid_t zoneid, int flags, ipif_t **ipifp)
22792 {
22793 	ipif_t	*ipif;
22794 	ipif_t	*maybe_ipif = NULL;
22795 
22796 	mutex_enter(&ill->ill_lock);
22797 	if (ill->ill_state_flags & ILL_CONDEMNED) {
22798 		mutex_exit(&ill->ill_lock);
22799 		if (ipifp != NULL)
22800 			*ipifp = NULL;
22801 		return (B_FALSE);
22802 	}
22803 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
22804 		if (!IPIF_CAN_LOOKUP(ipif))
22805 			continue;
22806 		if (zoneid != ALL_ZONES && ipif->ipif_zoneid != zoneid)
22807 			continue;
22808 		if ((ipif->ipif_flags & flags) != flags)
22809 			continue;
22810 
22811 		if (ipifp == NULL) {
22812 			mutex_exit(&ill->ill_lock);
22813 			ASSERT(maybe_ipif == NULL);
22814 			return (B_TRUE);
22815 		}
22816 		if (!ill->ill_isv6 ||
22817 		    IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6src_addr)) {
22818 			ipif_refhold_locked(ipif);
22819 			mutex_exit(&ill->ill_lock);
22820 			*ipifp = ipif;
22821 			return (B_TRUE);
22822 		}
22823 		if (maybe_ipif == NULL)
22824 			maybe_ipif = ipif;
22825 	}
22826 	if (ipifp != NULL) {
22827 		if (maybe_ipif != NULL)
22828 			ipif_refhold_locked(maybe_ipif);
22829 		*ipifp = maybe_ipif;
22830 	}
22831 	mutex_exit(&ill->ill_lock);
22832 	return (maybe_ipif != NULL);
22833 }
22834 
22835 /*
22836  * Same as ipif_lookup_zoneid() but looks at all the ills in the same group.
22837  */
22838 boolean_t
22839 ipif_lookup_zoneid_group(ill_t *ill, zoneid_t zoneid, int flags, ipif_t **ipifp)
22840 {
22841 	ill_t *illg;
22842 
22843 	/*
22844 	 * We look at the passed-in ill first without grabbing ill_g_lock.
22845 	 */
22846 	if (ipif_lookup_zoneid(ill, zoneid, flags, ipifp)) {
22847 		return (B_TRUE);
22848 	}
22849 	rw_enter(&ill_g_lock, RW_READER);
22850 	if (ill->ill_group == NULL) {
22851 		/* ill not in a group */
22852 		rw_exit(&ill_g_lock);
22853 		return (B_FALSE);
22854 	}
22855 
22856 	/*
22857 	 * There's no ipif in the zone on ill, however ill is part of an IPMP
22858 	 * group. We need to look for an ipif in the zone on all the ills in the
22859 	 * group.
22860 	 */
22861 	illg = ill->ill_group->illgrp_ill;
22862 	do {
22863 		/*
22864 		 * We don't call ipif_lookup_zoneid() on ill as we already know
22865 		 * that it's not there.
22866 		 */
22867 		if (illg != ill &&
22868 		    ipif_lookup_zoneid(illg, zoneid, flags, ipifp)) {
22869 			break;
22870 		}
22871 	} while ((illg = illg->ill_group_next) != NULL);
22872 	rw_exit(&ill_g_lock);
22873 	return (illg != NULL);
22874 }
22875 
22876 /*
22877  * Check if this ill is only being used to send ICMP probes for IPMP
22878  */
22879 boolean_t
22880 ill_is_probeonly(ill_t *ill)
22881 {
22882 	/*
22883 	 * Check if the interface is FAILED, or INACTIVE
22884 	 */
22885 	if (ill->ill_phyint->phyint_flags & (PHYI_FAILED|PHYI_INACTIVE))
22886 		return (B_TRUE);
22887 
22888 	return (B_FALSE);
22889 }
22890