xref: /titanic_50/usr/src/uts/common/inet/ip/ip_if.c (revision 657b1f3d64bcf8eaa2385dba72a6047f089433b2) 
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /* Copyright (c) 1990 Mentat Inc. */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 /*
30  * This file contains the interface control functions for IP.
31  */
32 
33 #include <sys/types.h>
34 #include <sys/stream.h>
35 #include <sys/dlpi.h>
36 #include <sys/stropts.h>
37 #include <sys/strsun.h>
38 #include <sys/sysmacros.h>
39 #include <sys/strlog.h>
40 #include <sys/ddi.h>
41 #include <sys/sunddi.h>
42 #include <sys/cmn_err.h>
43 #include <sys/kstat.h>
44 #include <sys/debug.h>
45 #include <sys/zone.h>
46 
47 #include <sys/kmem.h>
48 #include <sys/systm.h>
49 #include <sys/param.h>
50 #include <sys/socket.h>
51 #include <sys/isa_defs.h>
52 #include <net/if.h>
53 #include <net/if_arp.h>
54 #include <net/if_types.h>
55 #include <net/if_dl.h>
56 #include <net/route.h>
57 #include <sys/sockio.h>
58 #include <netinet/in.h>
59 #include <netinet/ip6.h>
60 #include <netinet/icmp6.h>
61 #include <netinet/igmp_var.h>
62 #include <sys/strsun.h>
63 #include <sys/policy.h>
64 #include <sys/ethernet.h>
65 
66 #include <inet/common.h>   /* for various inet/mi.h and inet/nd.h needs */
67 #include <inet/mi.h>
68 #include <inet/nd.h>
69 #include <inet/arp.h>
70 #include <inet/mib2.h>
71 #include <inet/ip.h>
72 #include <inet/ip6.h>
73 #include <inet/ip6_asp.h>
74 #include <inet/tcp.h>
75 #include <inet/ip_multi.h>
76 #include <inet/ip_ire.h>
77 #include <inet/ip_ftable.h>
78 #include <inet/ip_rts.h>
79 #include <inet/ip_ndp.h>
80 #include <inet/ip_if.h>
81 #include <inet/ip_impl.h>
82 #include <inet/tun.h>
83 #include <inet/sctp_ip.h>
84 #include <inet/ip_netinfo.h>
85 
86 #include <net/pfkeyv2.h>
87 #include <inet/ipsec_info.h>
88 #include <inet/sadb.h>
89 #include <inet/ipsec_impl.h>
90 #include <sys/iphada.h>
91 
92 
93 #include <netinet/igmp.h>
94 #include <inet/ip_listutils.h>
95 #include <inet/ipclassifier.h>
96 #include <sys/mac.h>
97 
98 #include <sys/systeminfo.h>
99 #include <sys/bootconf.h>
100 
101 #include <sys/tsol/tndb.h>
102 #include <sys/tsol/tnet.h>
103 
104 /* The character which tells where the ill_name ends */
105 #define	IPIF_SEPARATOR_CHAR	':'
106 
107 /* IP ioctl function table entry */
108 typedef struct ipft_s {
109 	int	ipft_cmd;
110 	pfi_t	ipft_pfi;
111 	int	ipft_min_size;
112 	int	ipft_flags;
113 } ipft_t;
114 #define	IPFT_F_NO_REPLY		0x1	/* IP ioctl does not expect any reply */
115 #define	IPFT_F_SELF_REPLY	0x2	/* ioctl callee does the ioctl reply */
116 
117 typedef struct ip_sock_ar_s {
118 	union {
119 		area_t	ip_sock_area;
120 		ared_t	ip_sock_ared;
121 		areq_t	ip_sock_areq;
122 	} ip_sock_ar_u;
123 	queue_t	*ip_sock_ar_q;
124 } ip_sock_ar_t;
125 
126 static int	nd_ill_forward_get(queue_t *, mblk_t *, caddr_t, cred_t *);
127 static int	nd_ill_forward_set(queue_t *q, mblk_t *mp,
128 		    char *value, caddr_t cp, cred_t *ioc_cr);
129 
130 static boolean_t ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask);
131 static ip_m_t	*ip_m_lookup(t_uscalar_t mac_type);
132 static int	ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
133     mblk_t *mp, boolean_t need_up);
134 static int	ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
135     mblk_t *mp, boolean_t need_up);
136 static int	ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
137     queue_t *q, mblk_t *mp, boolean_t need_up);
138 static int	ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q,
139     mblk_t *mp, boolean_t need_up);
140 static int	ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
141     mblk_t *mp);
142 static int	ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t, in6_addr_t,
143     queue_t *q, mblk_t *mp, boolean_t need_up);
144 static int	ip_sioctl_arp_common(ill_t *ill, queue_t *q, mblk_t *mp,
145     sin_t *sin, boolean_t x_arp_ioctl, boolean_t if_arp_ioctl);
146 static ipaddr_t	ip_subnet_mask(ipaddr_t addr, ipif_t **);
147 static void	ip_wput_ioctl(queue_t *q, mblk_t *mp);
148 static void	ipsq_flush(ill_t *ill);
149 static void	ipsq_clean_all(ill_t *ill);
150 static void	ipsq_clean_ring(ill_t *ill, ill_rx_ring_t *rx_ring);
151 static	int	ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen,
152     queue_t *q, mblk_t *mp, boolean_t need_up);
153 static void	ipsq_delete(ipsq_t *);
154 
155 static ipif_t	*ipif_allocate(ill_t *ill, int id, uint_t ire_type,
156 		    boolean_t initialize);
157 static void	ipif_check_bcast_ires(ipif_t *test_ipif);
158 static void	ipif_down_delete_ire(ire_t *ire, char *ipif);
159 static void	ipif_delete_cache_ire(ire_t *, char *);
160 static int	ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp);
161 static void	ipif_free(ipif_t *ipif);
162 static void	ipif_free_tail(ipif_t *ipif);
163 static void	ipif_mtu_change(ire_t *ire, char *ipif_arg);
164 static void	ipif_multicast_down(ipif_t *ipif);
165 static void	ipif_recreate_interface_routes(ipif_t *old_ipif, ipif_t *ipif);
166 static void	ipif_set_default(ipif_t *ipif);
167 static int	ipif_set_values(queue_t *q, mblk_t *mp,
168     char *interf_name, uint_t *ppa);
169 static int	ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp,
170     queue_t *q);
171 static ipif_t	*ipif_lookup_on_name(char *name, size_t namelen,
172     boolean_t do_alloc, boolean_t *exists, boolean_t isv6, zoneid_t zoneid,
173     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error);
174 static int	ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp);
175 static void	ipif_update_other_ipifs(ipif_t *old_ipif, ill_group_t *illgrp);
176 
177 static int	ill_alloc_ppa(ill_if_t *, ill_t *);
178 static int	ill_arp_off(ill_t *ill);
179 static int	ill_arp_on(ill_t *ill);
180 static void	ill_delete_interface_type(ill_if_t *);
181 static int	ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q);
182 static void	ill_dl_down(ill_t *ill);
183 static void	ill_down(ill_t *ill);
184 static void	ill_downi(ire_t *ire, char *ill_arg);
185 static void	ill_downi_mrtun_srcif(ire_t *ire, char *ill_arg);
186 static void	ill_down_tail(ill_t *ill);
187 static void	ill_free_mib(ill_t *ill);
188 static void	ill_glist_delete(ill_t *);
189 static boolean_t ill_has_usable_ipif(ill_t *);
190 static int	ill_lock_ipsq_ills(ipsq_t *sq, ill_t **list, int);
191 static void	ill_nominate_bcast_rcv(ill_group_t *illgrp);
192 static void	ill_phyint_free(ill_t *ill);
193 static void	ill_phyint_reinit(ill_t *ill);
194 static void	ill_set_nce_router_flags(ill_t *, boolean_t);
195 static void	ill_signal_ipsq_ills(ipsq_t *, boolean_t);
196 static boolean_t ill_split_ipsq(ipsq_t *cur_sq);
197 static void	ill_stq_cache_delete(ire_t *, char *);
198 
199 static boolean_t ip_ether_v6intfid(uint_t, uint8_t *, in6_addr_t *);
200 static boolean_t ip_nodef_v6intfid(uint_t, uint8_t *, in6_addr_t *);
201 static boolean_t ip_ether_v6mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
202     in6_addr_t *);
203 static boolean_t ip_ether_v4mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
204     ipaddr_t *);
205 static boolean_t ip_ib_v6intfid(uint_t, uint8_t *, in6_addr_t *);
206 static boolean_t ip_ib_v6mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
207     in6_addr_t *);
208 static boolean_t ip_ib_v4mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
209     ipaddr_t *);
210 
211 static void	ipif_save_ire(ipif_t *, ire_t *);
212 static void	ipif_remove_ire(ipif_t *, ire_t *);
213 static void 	ip_cgtp_bcast_add(ire_t *, ire_t *);
214 static void 	ip_cgtp_bcast_delete(ire_t *);
215 
216 /*
217  * Per-ill IPsec capabilities management.
218  */
219 static ill_ipsec_capab_t *ill_ipsec_capab_alloc(void);
220 static void	ill_ipsec_capab_free(ill_ipsec_capab_t *);
221 static void	ill_ipsec_capab_add(ill_t *, uint_t, boolean_t);
222 static void	ill_ipsec_capab_delete(ill_t *, uint_t);
223 static boolean_t ill_ipsec_capab_resize_algparm(ill_ipsec_capab_t *, int);
224 static void ill_capability_proto(ill_t *, int, mblk_t *);
225 static void ill_capability_dispatch(ill_t *, mblk_t *, dl_capability_sub_t *,
226     boolean_t);
227 static void ill_capability_id_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
228 static void ill_capability_mdt_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
229 static void ill_capability_mdt_reset(ill_t *, mblk_t **);
230 static void ill_capability_ipsec_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
231 static void ill_capability_ipsec_reset(ill_t *, mblk_t **);
232 static void ill_capability_hcksum_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
233 static void ill_capability_hcksum_reset(ill_t *, mblk_t **);
234 static void ill_capability_zerocopy_ack(ill_t *, mblk_t *,
235     dl_capability_sub_t *);
236 static void ill_capability_zerocopy_reset(ill_t *, mblk_t **);
237 static void ill_capability_lso_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
238 static void ill_capability_lso_reset(ill_t *, mblk_t **);
239 static void ill_capability_dls_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
240 static mac_resource_handle_t ill_ring_add(void *, mac_resource_t *);
241 static void ill_capability_dls_reset(ill_t *, mblk_t **);
242 static void ill_capability_dls_disable(ill_t *);
243 
244 static void	illgrp_cache_delete(ire_t *, char *);
245 static void	illgrp_delete(ill_t *ill);
246 static void	illgrp_reset_schednext(ill_t *ill);
247 
248 static ill_t	*ill_prev_usesrc(ill_t *);
249 static int	ill_relink_usesrc_ills(ill_t *, ill_t *, uint_t);
250 static void	ill_disband_usesrc_group(ill_t *);
251 
252 static void	conn_cleanup_stale_ire(conn_t *, caddr_t);
253 
254 /*
255  * if we go over the memory footprint limit more than once in this msec
256  * interval, we'll start pruning aggressively.
257  */
258 int ip_min_frag_prune_time = 0;
259 
260 /*
261  * max # of IPsec algorithms supported.  Limited to 1 byte by PF_KEY
262  * and the IPsec DOI
263  */
264 #define	MAX_IPSEC_ALGS	256
265 
266 #define	BITSPERBYTE	8
267 #define	BITS(type)	(BITSPERBYTE * (long)sizeof (type))
268 
269 #define	IPSEC_ALG_ENABLE(algs, algid) \
270 		((algs)[(algid) / BITS(ipsec_capab_elem_t)] |= \
271 		(1 << ((algid) % BITS(ipsec_capab_elem_t))))
272 
273 #define	IPSEC_ALG_IS_ENABLED(algid, algs) \
274 		((algs)[(algid) / BITS(ipsec_capab_elem_t)] & \
275 		(1 << ((algid) % BITS(ipsec_capab_elem_t))))
276 
277 typedef uint8_t ipsec_capab_elem_t;
278 
279 /*
280  * Per-algorithm parameters.  Note that at present, only encryption
281  * algorithms have variable keysize (IKE does not provide a way to negotiate
282  * auth algorithm keysize).
283  *
284  * All sizes here are in bits.
285  */
286 typedef struct
287 {
288 	uint16_t	minkeylen;
289 	uint16_t	maxkeylen;
290 } ipsec_capab_algparm_t;
291 
292 /*
293  * Per-ill capabilities.
294  */
295 struct ill_ipsec_capab_s {
296 	ipsec_capab_elem_t *encr_hw_algs;
297 	ipsec_capab_elem_t *auth_hw_algs;
298 	uint32_t algs_size;	/* size of _hw_algs in bytes */
299 	/* algorithm key lengths */
300 	ipsec_capab_algparm_t *encr_algparm;
301 	uint32_t encr_algparm_size;
302 	uint32_t encr_algparm_end;
303 };
304 
305 /*
306  * List of AH and ESP IPsec acceleration capable ills
307  */
308 typedef struct ipsec_capab_ill_s {
309 	uint_t ill_index;
310 	boolean_t ill_isv6;
311 	struct ipsec_capab_ill_s *next;
312 } ipsec_capab_ill_t;
313 
314 static ipsec_capab_ill_t *ipsec_capab_ills_ah;
315 static ipsec_capab_ill_t *ipsec_capab_ills_esp;
316 krwlock_t ipsec_capab_ills_lock;
317 
318 /*
319  * The field values are larger than strictly necessary for simple
320  * AR_ENTRY_ADDs but the padding lets us accomodate the socket ioctls.
321  */
322 static area_t	ip_area_template = {
323 	AR_ENTRY_ADD,			/* area_cmd */
324 	sizeof (ip_sock_ar_t) + (IP_ADDR_LEN*2) + sizeof (struct sockaddr_dl),
325 					/* area_name_offset */
326 	/* area_name_length temporarily holds this structure length */
327 	sizeof (area_t),			/* area_name_length */
328 	IP_ARP_PROTO_TYPE,		/* area_proto */
329 	sizeof (ip_sock_ar_t),		/* area_proto_addr_offset */
330 	IP_ADDR_LEN,			/* area_proto_addr_length */
331 	sizeof (ip_sock_ar_t) + IP_ADDR_LEN,
332 					/* area_proto_mask_offset */
333 	0,				/* area_flags */
334 	sizeof (ip_sock_ar_t) + IP_ADDR_LEN + IP_ADDR_LEN,
335 					/* area_hw_addr_offset */
336 	/* Zero length hw_addr_length means 'use your idea of the address' */
337 	0				/* area_hw_addr_length */
338 };
339 
340 /*
341  * AR_ENTRY_ADD/DELETE templates have been added for IPv6 external resolver
342  * support
343  */
344 static area_t	ip6_area_template = {
345 	AR_ENTRY_ADD,			/* area_cmd */
346 	sizeof (ip_sock_ar_t) + (IPV6_ADDR_LEN*2) + sizeof (sin6_t),
347 					/* area_name_offset */
348 	/* area_name_length temporarily holds this structure length */
349 	sizeof (area_t),			/* area_name_length */
350 	IP_ARP_PROTO_TYPE,		/* area_proto */
351 	sizeof (ip_sock_ar_t),		/* area_proto_addr_offset */
352 	IPV6_ADDR_LEN,			/* area_proto_addr_length */
353 	sizeof (ip_sock_ar_t) + IPV6_ADDR_LEN,
354 					/* area_proto_mask_offset */
355 	0,				/* area_flags */
356 	sizeof (ip_sock_ar_t) + IPV6_ADDR_LEN + IPV6_ADDR_LEN,
357 					/* area_hw_addr_offset */
358 	/* Zero length hw_addr_length means 'use your idea of the address' */
359 	0				/* area_hw_addr_length */
360 };
361 
362 static ared_t	ip_ared_template = {
363 	AR_ENTRY_DELETE,
364 	sizeof (ared_t) + IP_ADDR_LEN,
365 	sizeof (ared_t),
366 	IP_ARP_PROTO_TYPE,
367 	sizeof (ared_t),
368 	IP_ADDR_LEN
369 };
370 
371 static ared_t	ip6_ared_template = {
372 	AR_ENTRY_DELETE,
373 	sizeof (ared_t) + IPV6_ADDR_LEN,
374 	sizeof (ared_t),
375 	IP_ARP_PROTO_TYPE,
376 	sizeof (ared_t),
377 	IPV6_ADDR_LEN
378 };
379 
380 /*
381  * A template for an IPv6 AR_ENTRY_QUERY template has not been created, as
382  * as the areq doesn't include an IP address in ill_dl_up() (the only place a
383  * areq is used).
384  */
385 static areq_t	ip_areq_template = {
386 	AR_ENTRY_QUERY,			/* cmd */
387 	sizeof (areq_t)+(2*IP_ADDR_LEN),	/* name offset */
388 	sizeof (areq_t),	/* name len (filled by ill_arp_alloc) */
389 	IP_ARP_PROTO_TYPE,		/* protocol, from arps perspective */
390 	sizeof (areq_t),			/* target addr offset */
391 	IP_ADDR_LEN,			/* target addr_length */
392 	0,				/* flags */
393 	sizeof (areq_t) + IP_ADDR_LEN,	/* sender addr offset */
394 	IP_ADDR_LEN,			/* sender addr length */
395 	6,				/* xmit_count */
396 	1000,				/* (re)xmit_interval in milliseconds */
397 	4				/* max # of requests to buffer */
398 	/* anything else filled in by the code */
399 };
400 
401 static arc_t	ip_aru_template = {
402 	AR_INTERFACE_UP,
403 	sizeof (arc_t),		/* Name offset */
404 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
405 };
406 
407 static arc_t	ip_ard_template = {
408 	AR_INTERFACE_DOWN,
409 	sizeof (arc_t),		/* Name offset */
410 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
411 };
412 
413 static arc_t	ip_aron_template = {
414 	AR_INTERFACE_ON,
415 	sizeof (arc_t),		/* Name offset */
416 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
417 };
418 
419 static arc_t	ip_aroff_template = {
420 	AR_INTERFACE_OFF,
421 	sizeof (arc_t),		/* Name offset */
422 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
423 };
424 
425 
426 static arma_t	ip_arma_multi_template = {
427 	AR_MAPPING_ADD,
428 	sizeof (arma_t) + 3*IP_ADDR_LEN + IP_MAX_HW_LEN,
429 				/* Name offset */
430 	sizeof (arma_t),	/* Name length (set by ill_arp_alloc) */
431 	IP_ARP_PROTO_TYPE,
432 	sizeof (arma_t),			/* proto_addr_offset */
433 	IP_ADDR_LEN,				/* proto_addr_length */
434 	sizeof (arma_t) + IP_ADDR_LEN,		/* proto_mask_offset */
435 	sizeof (arma_t) + 2*IP_ADDR_LEN,	/* proto_extract_mask_offset */
436 	ACE_F_PERMANENT | ACE_F_MAPPING,	/* flags */
437 	sizeof (arma_t) + 3*IP_ADDR_LEN,	/* hw_addr_offset */
438 	IP_MAX_HW_LEN,				/* hw_addr_length */
439 	0,					/* hw_mapping_start */
440 };
441 
442 static ipft_t	ip_ioctl_ftbl[] = {
443 	{ IP_IOC_IRE_DELETE, ip_ire_delete, sizeof (ipid_t), 0 },
444 	{ IP_IOC_IRE_DELETE_NO_REPLY, ip_ire_delete, sizeof (ipid_t),
445 		IPFT_F_NO_REPLY },
446 	{ IP_IOC_IRE_ADVISE_NO_REPLY, ip_ire_advise, sizeof (ipic_t),
447 		IPFT_F_NO_REPLY },
448 	{ IP_IOC_RTS_REQUEST, ip_rts_request, 0, IPFT_F_SELF_REPLY },
449 	{ 0 }
450 };
451 
452 /* Simple ICMP IP Header Template */
453 static ipha_t icmp_ipha = {
454 	IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
455 };
456 
457 /* Flag descriptors for ip_ipif_report */
458 static nv_t	ipif_nv_tbl[] = {
459 	{ IPIF_UP,		"UP" },
460 	{ IPIF_BROADCAST,	"BROADCAST" },
461 	{ ILLF_DEBUG,		"DEBUG" },
462 	{ PHYI_LOOPBACK,	"LOOPBACK" },
463 	{ IPIF_POINTOPOINT,	"POINTOPOINT" },
464 	{ ILLF_NOTRAILERS,	"NOTRAILERS" },
465 	{ PHYI_RUNNING,		"RUNNING" },
466 	{ ILLF_NOARP,		"NOARP" },
467 	{ PHYI_PROMISC,		"PROMISC" },
468 	{ PHYI_ALLMULTI,	"ALLMULTI" },
469 	{ PHYI_INTELLIGENT,	"INTELLIGENT" },
470 	{ ILLF_MULTICAST,	"MULTICAST" },
471 	{ PHYI_MULTI_BCAST,	"MULTI_BCAST" },
472 	{ IPIF_UNNUMBERED,	"UNNUMBERED" },
473 	{ IPIF_DHCPRUNNING,	"DHCP" },
474 	{ IPIF_PRIVATE,		"PRIVATE" },
475 	{ IPIF_NOXMIT,		"NOXMIT" },
476 	{ IPIF_NOLOCAL,		"NOLOCAL" },
477 	{ IPIF_DEPRECATED,	"DEPRECATED" },
478 	{ IPIF_PREFERRED,	"PREFERRED" },
479 	{ IPIF_TEMPORARY,	"TEMPORARY" },
480 	{ IPIF_ADDRCONF,	"ADDRCONF" },
481 	{ PHYI_VIRTUAL,		"VIRTUAL" },
482 	{ ILLF_ROUTER,		"ROUTER" },
483 	{ ILLF_NONUD,		"NONUD" },
484 	{ IPIF_ANYCAST,		"ANYCAST" },
485 	{ ILLF_NORTEXCH,	"NORTEXCH" },
486 	{ ILLF_IPV4,		"IPV4" },
487 	{ ILLF_IPV6,		"IPV6" },
488 	{ IPIF_MIPRUNNING,	"MIP" },
489 	{ IPIF_NOFAILOVER,	"NOFAILOVER" },
490 	{ PHYI_FAILED,		"FAILED" },
491 	{ PHYI_STANDBY,		"STANDBY" },
492 	{ PHYI_INACTIVE,	"INACTIVE" },
493 	{ PHYI_OFFLINE,		"OFFLINE" },
494 };
495 
496 static uchar_t	ip_six_byte_all_ones[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
497 
498 static ip_m_t	ip_m_tbl[] = {
499 	{ DL_ETHER, IFT_ETHER, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
500 	    ip_ether_v6intfid },
501 	{ DL_CSMACD, IFT_ISO88023, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
502 	    ip_nodef_v6intfid },
503 	{ DL_TPB, IFT_ISO88024, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
504 	    ip_nodef_v6intfid },
505 	{ DL_TPR, IFT_ISO88025, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
506 	    ip_nodef_v6intfid },
507 	{ DL_FDDI, IFT_FDDI, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
508 	    ip_ether_v6intfid },
509 	{ DL_IB, IFT_IB, ip_ib_v4mapinfo, ip_ib_v6mapinfo,
510 	    ip_ib_v6intfid },
511 	{ SUNW_DL_VNI, IFT_OTHER, NULL, NULL, NULL},
512 	{ DL_OTHER, IFT_OTHER, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
513 	    ip_nodef_v6intfid }
514 };
515 
516 static ill_t	ill_null;		/* Empty ILL for init. */
517 char	ipif_loopback_name[] = "lo0";
518 static char *ipv4_forward_suffix = ":ip_forwarding";
519 static char *ipv6_forward_suffix = ":ip6_forwarding";
520 static kstat_t *loopback_ksp = NULL;
521 static	sin6_t	sin6_null;	/* Zero address for quick clears */
522 static	sin_t	sin_null;	/* Zero address for quick clears */
523 static	uint_t	ill_index = 1;	/* Used to assign interface indicies */
524 /* When set search for unused index */
525 static boolean_t ill_index_wrap = B_FALSE;
526 /* When set search for unused ipif_seqid */
527 static ipif_t	ipif_zero;
528 uint_t	ipif_src_random;
529 
530 /*
531  * For details on the protection offered by these locks please refer
532  * to the notes under the Synchronization section at the start of ip.c
533  */
534 krwlock_t	ill_g_lock;		/* The global ill_g_lock */
535 kmutex_t	ip_addr_avail_lock;	/* Address availability check lock */
536 ipsq_t		*ipsq_g_head;		/* List of all ipsq's on the system */
537 
538 krwlock_t	ill_g_usesrc_lock;	/* Protects usesrc related fields */
539 
540 /*
541  * illgrp_head/ifgrp_head is protected by IP's perimeter.
542  */
543 static  ill_group_t *illgrp_head_v4;	/* Head of IPv4 ill groups */
544 ill_group_t *illgrp_head_v6;		/* Head of IPv6 ill groups */
545 
546 ill_g_head_t	ill_g_heads[MAX_G_HEADS];   /* ILL List Head */
547 
548 /*
549  * ppa arena is created after these many
550  * interfaces have been plumbed.
551  */
552 uint_t	ill_no_arena = 12;
553 
554 #pragma align CACHE_ALIGN_SIZE(phyint_g_list)
555 static phyint_list_t phyint_g_list;	/* start of phyint list */
556 
557 /*
558  * Reflects value of FAILBACK variable in IPMP config file
559  * /etc/default/mpathd. Default value is B_TRUE.
560  * Set to B_FALSE if user disabled failback by configuring "FAILBACK=no"
561  * in.mpathd uses SIOCSIPMPFAILBACK ioctl to pass this information to kernel.
562  */
563 static boolean_t ipmp_enable_failback = B_TRUE;
564 
565 /*
566  * Enable soft rings if ip_squeue_soft_ring or ip_squeue_fanout
567  * is set and ip_soft_rings_cnt > 0. ip_squeue_soft_ring is
568  * set through platform specific code (Niagara/Ontario).
569  */
570 #define	SOFT_RINGS_ENABLED()	(ip_soft_rings_cnt ? \
571 		(ip_squeue_soft_ring || ip_squeue_fanout) : B_FALSE)
572 
573 #define	ILL_CAPAB_DLS	(ILL_CAPAB_SOFT_RING | ILL_CAPAB_POLL)
574 
575 static uint_t
576 ipif_rand(void)
577 {
578 	ipif_src_random = ipif_src_random * 1103515245 + 12345;
579 	return ((ipif_src_random >> 16) & 0x7fff);
580 }
581 
582 /*
583  * Allocate per-interface mibs. Only used for ipv6.
584  * Returns true if ok. False otherwise.
585  *  ipsq  may not yet be allocated (loopback case ).
586  */
587 static boolean_t
588 ill_allocate_mibs(ill_t *ill)
589 {
590 	ASSERT(ill->ill_isv6);
591 
592 	/* Already allocated? */
593 	if (ill->ill_ip6_mib != NULL) {
594 		ASSERT(ill->ill_icmp6_mib != NULL);
595 		return (B_TRUE);
596 	}
597 
598 	ill->ill_ip6_mib = kmem_zalloc(sizeof (*ill->ill_ip6_mib),
599 	    KM_NOSLEEP);
600 	if (ill->ill_ip6_mib == NULL) {
601 		return (B_FALSE);
602 	}
603 	ill->ill_icmp6_mib = kmem_zalloc(sizeof (*ill->ill_icmp6_mib),
604 	    KM_NOSLEEP);
605 	if (ill->ill_icmp6_mib == NULL) {
606 		kmem_free(ill->ill_ip6_mib, sizeof (*ill->ill_ip6_mib));
607 		ill->ill_ip6_mib = NULL;
608 		return (B_FALSE);
609 	}
610 	/*
611 	 * The ipv6Ifindex and ipv6IfIcmpIndex will be assigned later
612 	 * after the phyint merge occurs in ipif_set_values -> ill_glist_insert
613 	 * -> ill_phyint_reinit
614 	 */
615 	return (B_TRUE);
616 }
617 
618 /*
619  * Common code for preparation of ARP commands.  Two points to remember:
620  * 	1) The ill_name is tacked on at the end of the allocated space so
621  *	   the templates name_offset field must contain the total space
622  *	   to allocate less the name length.
623  *
624  *	2) The templates name_length field should contain the *template*
625  *	   length.  We use it as a parameter to bcopy() and then write
626  *	   the real ill_name_length into the name_length field of the copy.
627  * (Always called as writer.)
628  */
629 mblk_t *
630 ill_arp_alloc(ill_t *ill, uchar_t *template, caddr_t addr)
631 {
632 	arc_t	*arc = (arc_t *)template;
633 	char	*cp;
634 	int	len;
635 	mblk_t	*mp;
636 	uint_t	name_length = ill->ill_name_length;
637 	uint_t	template_len = arc->arc_name_length;
638 
639 	len = arc->arc_name_offset + name_length;
640 	mp = allocb(len, BPRI_HI);
641 	if (mp == NULL)
642 		return (NULL);
643 	cp = (char *)mp->b_rptr;
644 	mp->b_wptr = (uchar_t *)&cp[len];
645 	if (template_len)
646 		bcopy(template, cp, template_len);
647 	if (len > template_len)
648 		bzero(&cp[template_len], len - template_len);
649 	mp->b_datap->db_type = M_PROTO;
650 
651 	arc = (arc_t *)cp;
652 	arc->arc_name_length = name_length;
653 	cp = (char *)arc + arc->arc_name_offset;
654 	bcopy(ill->ill_name, cp, name_length);
655 
656 	if (addr) {
657 		area_t	*area = (area_t *)mp->b_rptr;
658 
659 		cp = (char *)area + area->area_proto_addr_offset;
660 		bcopy(addr, cp, area->area_proto_addr_length);
661 		if (area->area_cmd == AR_ENTRY_ADD) {
662 			cp = (char *)area;
663 			len = area->area_proto_addr_length;
664 			if (area->area_proto_mask_offset)
665 				cp += area->area_proto_mask_offset;
666 			else
667 				cp += area->area_proto_addr_offset + len;
668 			while (len-- > 0)
669 				*cp++ = (char)~0;
670 		}
671 	}
672 	return (mp);
673 }
674 
675 mblk_t *
676 ipif_area_alloc(ipif_t *ipif)
677 {
678 	return (ill_arp_alloc(ipif->ipif_ill, (uchar_t *)&ip_area_template,
679 	    (char *)&ipif->ipif_lcl_addr));
680 }
681 
682 mblk_t *
683 ipif_ared_alloc(ipif_t *ipif)
684 {
685 	return (ill_arp_alloc(ipif->ipif_ill, (uchar_t *)&ip_ared_template,
686 	    (char *)&ipif->ipif_lcl_addr));
687 }
688 
689 mblk_t *
690 ill_ared_alloc(ill_t *ill, ipaddr_t addr)
691 {
692 	return (ill_arp_alloc(ill, (uchar_t *)&ip_ared_template,
693 	    (char *)&addr));
694 }
695 
696 /*
697  * Completely vaporize a lower level tap and all associated interfaces.
698  * ill_delete is called only out of ip_close when the device control
699  * stream is being closed.
700  */
701 void
702 ill_delete(ill_t *ill)
703 {
704 	ipif_t	*ipif;
705 	ill_t	*prev_ill;
706 
707 	/*
708 	 * ill_delete may be forcibly entering the ipsq. The previous
709 	 * ioctl may not have completed and may need to be aborted.
710 	 * ipsq_flush takes care of it. If we don't need to enter the
711 	 * the ipsq forcibly, the 2nd invocation of ipsq_flush in
712 	 * ill_delete_tail is sufficient.
713 	 */
714 	ipsq_flush(ill);
715 
716 	/*
717 	 * Nuke all interfaces.  ipif_free will take down the interface,
718 	 * remove it from the list, and free the data structure.
719 	 * Walk down the ipif list and remove the logical interfaces
720 	 * first before removing the main ipif. We can't unplumb
721 	 * zeroth interface first in the case of IPv6 as reset_conn_ill
722 	 * -> ip_ll_delmulti_v6 de-references ill_ipif for checking
723 	 * POINTOPOINT.
724 	 *
725 	 * If ill_ipif was not properly initialized (i.e low on memory),
726 	 * then no interfaces to clean up. In this case just clean up the
727 	 * ill.
728 	 */
729 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
730 		ipif_free(ipif);
731 
732 	/*
733 	 * Used only by ill_arp_on and ill_arp_off, which are writers.
734 	 * So nobody can be using this mp now. Free the mp allocated for
735 	 * honoring ILLF_NOARP
736 	 */
737 	freemsg(ill->ill_arp_on_mp);
738 	ill->ill_arp_on_mp = NULL;
739 
740 	/* Clean up msgs on pending upcalls for mrouted */
741 	reset_mrt_ill(ill);
742 
743 	/*
744 	 * ipif_free -> reset_conn_ipif will remove all multicast
745 	 * references for IPv4. For IPv6, we need to do it here as
746 	 * it points only at ills.
747 	 */
748 	reset_conn_ill(ill);
749 
750 	/*
751 	 * ill_down will arrange to blow off any IRE's dependent on this
752 	 * ILL, and shut down fragmentation reassembly.
753 	 */
754 	ill_down(ill);
755 
756 	/* Let SCTP know, so that it can remove this from its list. */
757 	sctp_update_ill(ill, SCTP_ILL_REMOVE);
758 
759 	/*
760 	 * If an address on this ILL is being used as a source address then
761 	 * clear out the pointers in other ILLs that point to this ILL.
762 	 */
763 	rw_enter(&ill_g_usesrc_lock, RW_WRITER);
764 	if (ill->ill_usesrc_grp_next != NULL) {
765 		if (ill->ill_usesrc_ifindex == 0) { /* usesrc ILL ? */
766 			ill_disband_usesrc_group(ill);
767 		} else {	/* consumer of the usesrc ILL */
768 			prev_ill = ill_prev_usesrc(ill);
769 			prev_ill->ill_usesrc_grp_next =
770 			    ill->ill_usesrc_grp_next;
771 		}
772 	}
773 	rw_exit(&ill_g_usesrc_lock);
774 }
775 
776 static void
777 ipif_non_duplicate(ipif_t *ipif)
778 {
779 	ill_t *ill = ipif->ipif_ill;
780 	mutex_enter(&ill->ill_lock);
781 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
782 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
783 		ASSERT(ill->ill_ipif_dup_count > 0);
784 		ill->ill_ipif_dup_count--;
785 	}
786 	mutex_exit(&ill->ill_lock);
787 }
788 
789 /*
790  * Send all deferred messages without waiting for their ACKs.
791  */
792 void
793 ill_send_all_deferred_mp(ill_t *ill)
794 {
795 	mblk_t *mp, *next;
796 
797 	/*
798 	 * Clear ill_dlpi_pending so that the message is not queued in
799 	 * ill_dlpi_send().
800 	 */
801 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
802 
803 	for (mp = ill->ill_dlpi_deferred; mp != NULL; mp = next) {
804 		next = mp->b_next;
805 		mp->b_next = NULL;
806 		ill_dlpi_send(ill, mp);
807 	}
808 	ill->ill_dlpi_deferred = NULL;
809 }
810 
811 /*
812  * ill_delete_tail is called from ip_modclose after all references
813  * to the closing ill are gone. The wait is done in ip_modclose
814  */
815 void
816 ill_delete_tail(ill_t *ill)
817 {
818 	mblk_t	**mpp;
819 	ipif_t	*ipif;
820 
821 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
822 		ipif_non_duplicate(ipif);
823 		ipif_down_tail(ipif);
824 	}
825 
826 	ASSERT(ill->ill_ipif_dup_count == 0 &&
827 	    ill->ill_arp_down_mp == NULL &&
828 	    ill->ill_arp_del_mapping_mp == NULL);
829 
830 	/*
831 	 * If polling capability is enabled (which signifies direct
832 	 * upcall into IP and driver has ill saved as a handle),
833 	 * we need to make sure that unbind has completed before we
834 	 * let the ill disappear and driver no longer has any reference
835 	 * to this ill.
836 	 */
837 	mutex_enter(&ill->ill_lock);
838 	while (ill->ill_state_flags & ILL_DL_UNBIND_IN_PROGRESS)
839 		cv_wait(&ill->ill_cv, &ill->ill_lock);
840 	mutex_exit(&ill->ill_lock);
841 
842 	/*
843 	 * Clean up polling and soft ring capabilities
844 	 */
845 	if (ill->ill_capabilities & (ILL_CAPAB_POLL|ILL_CAPAB_SOFT_RING))
846 		ill_capability_dls_disable(ill);
847 
848 	/*
849 	 * Send the detach if there's one to send (i.e., if we're above a
850 	 * style 2 DLPI driver).
851 	 */
852 	if (ill->ill_detach_mp != NULL) {
853 		ill_dlpi_send(ill, ill->ill_detach_mp);
854 		ill->ill_detach_mp = NULL;
855 	}
856 
857 	if (ill->ill_net_type != IRE_LOOPBACK)
858 		qprocsoff(ill->ill_rq);
859 
860 	/*
861 	 * We do an ipsq_flush once again now. New messages could have
862 	 * landed up from below (M_ERROR or M_HANGUP). Similarly ioctls
863 	 * could also have landed up if an ioctl thread had looked up
864 	 * the ill before we set the ILL_CONDEMNED flag, but not yet
865 	 * enqueued the ioctl when we did the ipsq_flush last time.
866 	 */
867 	ipsq_flush(ill);
868 
869 	/*
870 	 * Free capabilities.
871 	 */
872 	if (ill->ill_ipsec_capab_ah != NULL) {
873 		ill_ipsec_capab_delete(ill, DL_CAPAB_IPSEC_AH);
874 		ill_ipsec_capab_free(ill->ill_ipsec_capab_ah);
875 		ill->ill_ipsec_capab_ah = NULL;
876 	}
877 
878 	if (ill->ill_ipsec_capab_esp != NULL) {
879 		ill_ipsec_capab_delete(ill, DL_CAPAB_IPSEC_ESP);
880 		ill_ipsec_capab_free(ill->ill_ipsec_capab_esp);
881 		ill->ill_ipsec_capab_esp = NULL;
882 	}
883 
884 	if (ill->ill_mdt_capab != NULL) {
885 		kmem_free(ill->ill_mdt_capab, sizeof (ill_mdt_capab_t));
886 		ill->ill_mdt_capab = NULL;
887 	}
888 
889 	if (ill->ill_hcksum_capab != NULL) {
890 		kmem_free(ill->ill_hcksum_capab, sizeof (ill_hcksum_capab_t));
891 		ill->ill_hcksum_capab = NULL;
892 	}
893 
894 	if (ill->ill_zerocopy_capab != NULL) {
895 		kmem_free(ill->ill_zerocopy_capab,
896 		    sizeof (ill_zerocopy_capab_t));
897 		ill->ill_zerocopy_capab = NULL;
898 	}
899 
900 	if (ill->ill_lso_capab != NULL) {
901 		kmem_free(ill->ill_lso_capab, sizeof (ill_lso_capab_t));
902 		ill->ill_lso_capab = NULL;
903 	}
904 
905 	if (ill->ill_dls_capab != NULL) {
906 		CONN_DEC_REF(ill->ill_dls_capab->ill_unbind_conn);
907 		ill->ill_dls_capab->ill_unbind_conn = NULL;
908 		kmem_free(ill->ill_dls_capab,
909 		    sizeof (ill_dls_capab_t) +
910 		    (sizeof (ill_rx_ring_t) * ILL_MAX_RINGS));
911 		ill->ill_dls_capab = NULL;
912 	}
913 
914 	ASSERT(!(ill->ill_capabilities & ILL_CAPAB_POLL));
915 
916 	while (ill->ill_ipif != NULL)
917 		ipif_free_tail(ill->ill_ipif);
918 
919 	ill_down_tail(ill);
920 
921 	/*
922 	 * We have removed all references to ilm from conn and the ones joined
923 	 * within the kernel.
924 	 *
925 	 * We don't walk conns, mrts and ires because
926 	 *
927 	 * 1) reset_conn_ill and reset_mrt_ill cleans up conns and mrts.
928 	 * 2) ill_down ->ill_downi walks all the ires and cleans up
929 	 *    ill references.
930 	 */
931 	ASSERT(ilm_walk_ill(ill) == 0);
932 	/*
933 	 * Take us out of the list of ILLs. ill_glist_delete -> ill_phyint_free
934 	 * could free the phyint. No more reference to the phyint after this
935 	 * point.
936 	 */
937 	(void) ill_glist_delete(ill);
938 
939 	rw_enter(&ip_g_nd_lock, RW_WRITER);
940 	if (ill->ill_ndd_name != NULL)
941 		nd_unload(&ip_g_nd, ill->ill_ndd_name);
942 	rw_exit(&ip_g_nd_lock);
943 
944 
945 	if (ill->ill_frag_ptr != NULL) {
946 		uint_t count;
947 
948 		for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
949 			mutex_destroy(&ill->ill_frag_hash_tbl[count].ipfb_lock);
950 		}
951 		mi_free(ill->ill_frag_ptr);
952 		ill->ill_frag_ptr = NULL;
953 		ill->ill_frag_hash_tbl = NULL;
954 	}
955 	if (ill->ill_nd_lla_mp != NULL)
956 		freemsg(ill->ill_nd_lla_mp);
957 	/* Free all retained control messages. */
958 	mpp = &ill->ill_first_mp_to_free;
959 	do {
960 		while (mpp[0]) {
961 			mblk_t  *mp;
962 			mblk_t  *mp1;
963 
964 			mp = mpp[0];
965 			mpp[0] = mp->b_next;
966 			for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont) {
967 				mp1->b_next = NULL;
968 				mp1->b_prev = NULL;
969 			}
970 			freemsg(mp);
971 		}
972 	} while (mpp++ != &ill->ill_last_mp_to_free);
973 
974 	ill_free_mib(ill);
975 	ILL_TRACE_CLEANUP(ill);
976 }
977 
978 static void
979 ill_free_mib(ill_t *ill)
980 {
981 	if (ill->ill_ip6_mib != NULL) {
982 		kmem_free(ill->ill_ip6_mib, sizeof (*ill->ill_ip6_mib));
983 		ill->ill_ip6_mib = NULL;
984 	}
985 	if (ill->ill_icmp6_mib != NULL) {
986 		kmem_free(ill->ill_icmp6_mib, sizeof (*ill->ill_icmp6_mib));
987 		ill->ill_icmp6_mib = NULL;
988 	}
989 }
990 
991 /*
992  * Concatenate together a physical address and a sap.
993  *
994  * Sap_lengths are interpreted as follows:
995  *   sap_length == 0	==>	no sap
996  *   sap_length > 0	==>	sap is at the head of the dlpi address
997  *   sap_length < 0	==>	sap is at the tail of the dlpi address
998  */
999 static void
1000 ill_dlur_copy_address(uchar_t *phys_src, uint_t phys_length,
1001     t_scalar_t sap_src, t_scalar_t sap_length, uchar_t *dst)
1002 {
1003 	uint16_t sap_addr = (uint16_t)sap_src;
1004 
1005 	if (sap_length == 0) {
1006 		if (phys_src == NULL)
1007 			bzero(dst, phys_length);
1008 		else
1009 			bcopy(phys_src, dst, phys_length);
1010 	} else if (sap_length < 0) {
1011 		if (phys_src == NULL)
1012 			bzero(dst, phys_length);
1013 		else
1014 			bcopy(phys_src, dst, phys_length);
1015 		bcopy(&sap_addr, (char *)dst + phys_length, sizeof (sap_addr));
1016 	} else {
1017 		bcopy(&sap_addr, dst, sizeof (sap_addr));
1018 		if (phys_src == NULL)
1019 			bzero((char *)dst + sap_length, phys_length);
1020 		else
1021 			bcopy(phys_src, (char *)dst + sap_length, phys_length);
1022 	}
1023 }
1024 
1025 /*
1026  * Generate a dl_unitdata_req mblk for the device and address given.
1027  * addr_length is the length of the physical portion of the address.
1028  * If addr is NULL include an all zero address of the specified length.
1029  * TRUE? In any case, addr_length is taken to be the entire length of the
1030  * dlpi address, including the absolute value of sap_length.
1031  */
1032 mblk_t *
1033 ill_dlur_gen(uchar_t *addr, uint_t addr_length, t_uscalar_t sap,
1034 		t_scalar_t sap_length)
1035 {
1036 	dl_unitdata_req_t *dlur;
1037 	mblk_t	*mp;
1038 	t_scalar_t	abs_sap_length;		/* absolute value */
1039 
1040 	abs_sap_length = ABS(sap_length);
1041 	mp = ip_dlpi_alloc(sizeof (*dlur) + addr_length + abs_sap_length,
1042 		DL_UNITDATA_REQ);
1043 	if (mp == NULL)
1044 		return (NULL);
1045 	dlur = (dl_unitdata_req_t *)mp->b_rptr;
1046 	/* HACK: accomodate incompatible DLPI drivers */
1047 	if (addr_length == 8)
1048 		addr_length = 6;
1049 	dlur->dl_dest_addr_length = addr_length + abs_sap_length;
1050 	dlur->dl_dest_addr_offset = sizeof (*dlur);
1051 	dlur->dl_priority.dl_min = 0;
1052 	dlur->dl_priority.dl_max = 0;
1053 	ill_dlur_copy_address(addr, addr_length, sap, sap_length,
1054 	    (uchar_t *)&dlur[1]);
1055 	return (mp);
1056 }
1057 
1058 /*
1059  * Add the 'mp' to the list of pending mp's headed by ill_pending_mp
1060  * Return an error if we already have 1 or more ioctls in progress.
1061  * This is used only for non-exclusive ioctls. Currently this is used
1062  * for SIOC*ARP and SIOCGTUNPARAM ioctls. Most set ioctls are exclusive
1063  * and thus need to use ipsq_pending_mp_add.
1064  */
1065 boolean_t
1066 ill_pending_mp_add(ill_t *ill, conn_t *connp, mblk_t *add_mp)
1067 {
1068 	ASSERT(MUTEX_HELD(&ill->ill_lock));
1069 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
1070 	/*
1071 	 * M_IOCDATA from ioctls, M_IOCTL from tunnel ioctls.
1072 	 */
1073 	ASSERT((add_mp->b_datap->db_type == M_IOCDATA) ||
1074 	    (add_mp->b_datap->db_type == M_IOCTL));
1075 
1076 	ASSERT(MUTEX_HELD(&connp->conn_lock));
1077 	/*
1078 	 * Return error if the conn has started closing. The conn
1079 	 * could have finished cleaning up the pending mp list,
1080 	 * If so we should not add another mp to the list negating
1081 	 * the cleanup.
1082 	 */
1083 	if (connp->conn_state_flags & CONN_CLOSING)
1084 		return (B_FALSE);
1085 	/*
1086 	 * Add the pending mp to the head of the list, chained by b_next.
1087 	 * Note down the conn on which the ioctl request came, in b_prev.
1088 	 * This will be used to later get the conn, when we get a response
1089 	 * on the ill queue, from some other module (typically arp)
1090 	 */
1091 	add_mp->b_next = (void *)ill->ill_pending_mp;
1092 	add_mp->b_queue = CONNP_TO_WQ(connp);
1093 	ill->ill_pending_mp = add_mp;
1094 	if (connp != NULL)
1095 		connp->conn_oper_pending_ill = ill;
1096 	return (B_TRUE);
1097 }
1098 
1099 /*
1100  * Retrieve the ill_pending_mp and return it. We have to walk the list
1101  * of mblks starting at ill_pending_mp, and match based on the ioc_id.
1102  */
1103 mblk_t *
1104 ill_pending_mp_get(ill_t *ill, conn_t **connpp, uint_t ioc_id)
1105 {
1106 	mblk_t	*prev = NULL;
1107 	mblk_t	*curr = NULL;
1108 	uint_t	id;
1109 	conn_t	*connp;
1110 
1111 	/*
1112 	 * When the conn closes, conn_ioctl_cleanup needs to clean
1113 	 * up the pending mp, but it does not know the ioc_id and
1114 	 * passes in a zero for it.
1115 	 */
1116 	mutex_enter(&ill->ill_lock);
1117 	if (ioc_id != 0)
1118 		*connpp = NULL;
1119 
1120 	/* Search the list for the appropriate ioctl based on ioc_id */
1121 	for (prev = NULL, curr = ill->ill_pending_mp; curr != NULL;
1122 	    prev = curr, curr = curr->b_next) {
1123 		id = ((struct iocblk *)curr->b_rptr)->ioc_id;
1124 		connp = Q_TO_CONN(curr->b_queue);
1125 		/* Match based on the ioc_id or based on the conn */
1126 		if ((id == ioc_id) || (ioc_id == 0 && connp == *connpp))
1127 			break;
1128 	}
1129 
1130 	if (curr != NULL) {
1131 		/* Unlink the mblk from the pending mp list */
1132 		if (prev != NULL) {
1133 			prev->b_next = curr->b_next;
1134 		} else {
1135 			ASSERT(ill->ill_pending_mp == curr);
1136 			ill->ill_pending_mp = curr->b_next;
1137 		}
1138 
1139 		/*
1140 		 * conn refcnt must have been bumped up at the start of
1141 		 * the ioctl. So we can safely access the conn.
1142 		 */
1143 		ASSERT(CONN_Q(curr->b_queue));
1144 		*connpp = Q_TO_CONN(curr->b_queue);
1145 		curr->b_next = NULL;
1146 		curr->b_queue = NULL;
1147 	}
1148 
1149 	mutex_exit(&ill->ill_lock);
1150 
1151 	return (curr);
1152 }
1153 
1154 /*
1155  * Add the pending mp to the list. There can be only 1 pending mp
1156  * in the list. Any exclusive ioctl that needs to wait for a response
1157  * from another module or driver needs to use this function to set
1158  * the ipsq_pending_mp to the ioctl mblk and wait for the response from
1159  * the other module/driver. This is also used while waiting for the
1160  * ipif/ill/ire refcnts to drop to zero in bringing down an ipif.
1161  */
1162 boolean_t
1163 ipsq_pending_mp_add(conn_t *connp, ipif_t *ipif, queue_t *q, mblk_t *add_mp,
1164     int waitfor)
1165 {
1166 	ipsq_t	*ipsq;
1167 
1168 	ASSERT(IAM_WRITER_IPIF(ipif));
1169 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
1170 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
1171 	/*
1172 	 * M_IOCDATA from ioctls, M_IOCTL from tunnel ioctls,
1173 	 * M_ERROR/M_HANGUP from driver
1174 	 */
1175 	ASSERT((DB_TYPE(add_mp) == M_IOCDATA) || (DB_TYPE(add_mp) == M_IOCTL) ||
1176 	    (DB_TYPE(add_mp) == M_ERROR) || (DB_TYPE(add_mp) == M_HANGUP));
1177 
1178 	ipsq = ipif->ipif_ill->ill_phyint->phyint_ipsq;
1179 	if (connp != NULL) {
1180 		ASSERT(MUTEX_HELD(&connp->conn_lock));
1181 		/*
1182 		 * Return error if the conn has started closing. The conn
1183 		 * could have finished cleaning up the pending mp list,
1184 		 * If so we should not add another mp to the list negating
1185 		 * the cleanup.
1186 		 */
1187 		if (connp->conn_state_flags & CONN_CLOSING)
1188 			return (B_FALSE);
1189 	}
1190 	mutex_enter(&ipsq->ipsq_lock);
1191 	ipsq->ipsq_pending_ipif = ipif;
1192 	/*
1193 	 * Note down the queue in b_queue. This will be returned by
1194 	 * ipsq_pending_mp_get. Caller will then use these values to restart
1195 	 * the processing
1196 	 */
1197 	add_mp->b_next = NULL;
1198 	add_mp->b_queue = q;
1199 	ipsq->ipsq_pending_mp = add_mp;
1200 	ipsq->ipsq_waitfor = waitfor;
1201 	/*
1202 	 * ipsq_current_ipif is needed to restart the operation from
1203 	 * ipif_ill_refrele_tail when the last reference to the ipi/ill
1204 	 * is gone. Since this is not an ioctl ipsq_current_ipif has not
1205 	 * been set until now.
1206 	 */
1207 	if (DB_TYPE(add_mp) == M_ERROR || DB_TYPE(add_mp) == M_HANGUP) {
1208 		ASSERT(ipsq->ipsq_current_ipif == NULL);
1209 		ipsq->ipsq_current_ipif = ipif;
1210 		ipsq->ipsq_last_cmd = DB_TYPE(add_mp);
1211 	}
1212 	if (connp != NULL)
1213 		connp->conn_oper_pending_ill = ipif->ipif_ill;
1214 	mutex_exit(&ipsq->ipsq_lock);
1215 	return (B_TRUE);
1216 }
1217 
1218 /*
1219  * Retrieve the ipsq_pending_mp and return it. There can be only 1 mp
1220  * queued in the list.
1221  */
1222 mblk_t *
1223 ipsq_pending_mp_get(ipsq_t *ipsq, conn_t **connpp)
1224 {
1225 	mblk_t	*curr = NULL;
1226 
1227 	mutex_enter(&ipsq->ipsq_lock);
1228 	*connpp = NULL;
1229 	if (ipsq->ipsq_pending_mp == NULL) {
1230 		mutex_exit(&ipsq->ipsq_lock);
1231 		return (NULL);
1232 	}
1233 
1234 	/* There can be only 1 such excl message */
1235 	curr = ipsq->ipsq_pending_mp;
1236 	ASSERT(curr != NULL && curr->b_next == NULL);
1237 	ipsq->ipsq_pending_ipif = NULL;
1238 	ipsq->ipsq_pending_mp = NULL;
1239 	ipsq->ipsq_waitfor = 0;
1240 	mutex_exit(&ipsq->ipsq_lock);
1241 
1242 	if (CONN_Q(curr->b_queue)) {
1243 		/*
1244 		 * This mp did a refhold on the conn, at the start of the ioctl.
1245 		 * So we can safely return a pointer to the conn to the caller.
1246 		 */
1247 		*connpp = Q_TO_CONN(curr->b_queue);
1248 	} else {
1249 		*connpp = NULL;
1250 	}
1251 	curr->b_next = NULL;
1252 	curr->b_prev = NULL;
1253 	return (curr);
1254 }
1255 
1256 /*
1257  * Cleanup the ioctl mp queued in ipsq_pending_mp
1258  * - Called in the ill_delete path
1259  * - Called in the M_ERROR or M_HANGUP path on the ill.
1260  * - Called in the conn close path.
1261  */
1262 boolean_t
1263 ipsq_pending_mp_cleanup(ill_t *ill, conn_t *connp)
1264 {
1265 	mblk_t	*mp;
1266 	ipsq_t	*ipsq;
1267 	queue_t	*q;
1268 	ipif_t	*ipif;
1269 
1270 	ASSERT(IAM_WRITER_ILL(ill));
1271 	ipsq = ill->ill_phyint->phyint_ipsq;
1272 	mutex_enter(&ipsq->ipsq_lock);
1273 	/*
1274 	 * If connp is null, unconditionally clean up the ipsq_pending_mp.
1275 	 * This happens in M_ERROR/M_HANGUP. We need to abort the current ioctl
1276 	 * even if it is meant for another ill, since we have to enqueue
1277 	 * a new mp now in ipsq_pending_mp to complete the ipif_down.
1278 	 * If connp is non-null we are called from the conn close path.
1279 	 */
1280 	mp = ipsq->ipsq_pending_mp;
1281 	if (mp == NULL || (connp != NULL &&
1282 	    mp->b_queue != CONNP_TO_WQ(connp))) {
1283 		mutex_exit(&ipsq->ipsq_lock);
1284 		return (B_FALSE);
1285 	}
1286 	/* Now remove from the ipsq_pending_mp */
1287 	ipsq->ipsq_pending_mp = NULL;
1288 	q = mp->b_queue;
1289 	mp->b_next = NULL;
1290 	mp->b_prev = NULL;
1291 	mp->b_queue = NULL;
1292 
1293 	/* If MOVE was in progress, clear the move_in_progress fields also. */
1294 	ill = ipsq->ipsq_pending_ipif->ipif_ill;
1295 	if (ill->ill_move_in_progress) {
1296 		ILL_CLEAR_MOVE(ill);
1297 	} else if (ill->ill_up_ipifs) {
1298 		ill_group_cleanup(ill);
1299 	}
1300 
1301 	ipif = ipsq->ipsq_pending_ipif;
1302 	ipsq->ipsq_pending_ipif = NULL;
1303 	ipsq->ipsq_waitfor = 0;
1304 	ipsq->ipsq_current_ipif = NULL;
1305 	mutex_exit(&ipsq->ipsq_lock);
1306 
1307 	if (DB_TYPE(mp) == M_IOCTL || DB_TYPE(mp) == M_IOCDATA) {
1308 		ip_ioctl_finish(q, mp, ENXIO, connp != NULL ? CONN_CLOSE :
1309 		    NO_COPYOUT, connp != NULL ? ipif : NULL, NULL);
1310 	} else {
1311 		/*
1312 		 * IP-MT XXX In the case of TLI/XTI bind / optmgmt this can't
1313 		 * be just inet_freemsg. we have to restart it
1314 		 * otherwise the thread will be stuck.
1315 		 */
1316 		inet_freemsg(mp);
1317 	}
1318 	return (B_TRUE);
1319 }
1320 
1321 /*
1322  * The ill is closing. Cleanup all the pending mps. Called exclusively
1323  * towards the end of ill_delete. The refcount has gone to 0. So nobody
1324  * knows this ill, and hence nobody can add an mp to this list
1325  */
1326 static void
1327 ill_pending_mp_cleanup(ill_t *ill)
1328 {
1329 	mblk_t	*mp;
1330 	queue_t	*q;
1331 
1332 	ASSERT(IAM_WRITER_ILL(ill));
1333 
1334 	mutex_enter(&ill->ill_lock);
1335 	/*
1336 	 * Every mp on the pending mp list originating from an ioctl
1337 	 * added 1 to the conn refcnt, at the start of the ioctl.
1338 	 * So bump it down now.  See comments in ip_wput_nondata()
1339 	 */
1340 	while (ill->ill_pending_mp != NULL) {
1341 		mp = ill->ill_pending_mp;
1342 		ill->ill_pending_mp = mp->b_next;
1343 		mutex_exit(&ill->ill_lock);
1344 
1345 		q = mp->b_queue;
1346 		ASSERT(CONN_Q(q));
1347 		mp->b_next = NULL;
1348 		mp->b_prev = NULL;
1349 		mp->b_queue = NULL;
1350 		ip_ioctl_finish(q, mp, ENXIO, NO_COPYOUT, NULL, NULL);
1351 		mutex_enter(&ill->ill_lock);
1352 	}
1353 	ill->ill_pending_ipif = NULL;
1354 
1355 	mutex_exit(&ill->ill_lock);
1356 }
1357 
1358 /*
1359  * Called in the conn close path and ill delete path
1360  */
1361 static void
1362 ipsq_xopq_mp_cleanup(ill_t *ill, conn_t *connp)
1363 {
1364 	ipsq_t	*ipsq;
1365 	mblk_t	*prev;
1366 	mblk_t	*curr;
1367 	mblk_t	*next;
1368 	queue_t	*q;
1369 	mblk_t	*tmp_list = NULL;
1370 
1371 	ASSERT(IAM_WRITER_ILL(ill));
1372 	if (connp != NULL)
1373 		q = CONNP_TO_WQ(connp);
1374 	else
1375 		q = ill->ill_wq;
1376 
1377 	ipsq = ill->ill_phyint->phyint_ipsq;
1378 	/*
1379 	 * Cleanup the ioctl mp's queued in ipsq_xopq_pending_mp if any.
1380 	 * In the case of ioctl from a conn, there can be only 1 mp
1381 	 * queued on the ipsq. If an ill is being unplumbed, only messages
1382 	 * related to this ill are flushed, like M_ERROR or M_HANGUP message.
1383 	 * ioctls meant for this ill form conn's are not flushed. They will
1384 	 * be processed during ipsq_exit and will not find the ill and will
1385 	 * return error.
1386 	 */
1387 	mutex_enter(&ipsq->ipsq_lock);
1388 	for (prev = NULL, curr = ipsq->ipsq_xopq_mphead; curr != NULL;
1389 	    curr = next) {
1390 		next = curr->b_next;
1391 		if (curr->b_queue == q || curr->b_queue == RD(q)) {
1392 			/* Unlink the mblk from the pending mp list */
1393 			if (prev != NULL) {
1394 				prev->b_next = curr->b_next;
1395 			} else {
1396 				ASSERT(ipsq->ipsq_xopq_mphead == curr);
1397 				ipsq->ipsq_xopq_mphead = curr->b_next;
1398 			}
1399 			if (ipsq->ipsq_xopq_mptail == curr)
1400 				ipsq->ipsq_xopq_mptail = prev;
1401 			/*
1402 			 * Create a temporary list and release the ipsq lock
1403 			 * New elements are added to the head of the tmp_list
1404 			 */
1405 			curr->b_next = tmp_list;
1406 			tmp_list = curr;
1407 		} else {
1408 			prev = curr;
1409 		}
1410 	}
1411 	mutex_exit(&ipsq->ipsq_lock);
1412 
1413 	while (tmp_list != NULL) {
1414 		curr = tmp_list;
1415 		tmp_list = curr->b_next;
1416 		curr->b_next = NULL;
1417 		curr->b_prev = NULL;
1418 		curr->b_queue = NULL;
1419 		if (DB_TYPE(curr) == M_IOCTL || DB_TYPE(curr) == M_IOCDATA) {
1420 			ip_ioctl_finish(q, curr, ENXIO, connp != NULL ?
1421 			    CONN_CLOSE : NO_COPYOUT, NULL, NULL);
1422 		} else {
1423 			/*
1424 			 * IP-MT XXX In the case of TLI/XTI bind / optmgmt
1425 			 * this can't be just inet_freemsg. we have to
1426 			 * restart it otherwise the thread will be stuck.
1427 			 */
1428 			inet_freemsg(curr);
1429 		}
1430 	}
1431 }
1432 
1433 /*
1434  * This conn has started closing. Cleanup any pending ioctl from this conn.
1435  * STREAMS ensures that there can be at most 1 ioctl pending on a stream.
1436  */
1437 void
1438 conn_ioctl_cleanup(conn_t *connp)
1439 {
1440 	mblk_t *curr;
1441 	ipsq_t	*ipsq;
1442 	ill_t	*ill;
1443 	boolean_t refheld;
1444 
1445 	/*
1446 	 * Is any exclusive ioctl pending ? If so clean it up. If the
1447 	 * ioctl has not yet started, the mp is pending in the list headed by
1448 	 * ipsq_xopq_head. If the ioctl has started the mp could be present in
1449 	 * ipsq_pending_mp. If the ioctl timed out in the streamhead but
1450 	 * is currently executing now the mp is not queued anywhere but
1451 	 * conn_oper_pending_ill is null. The conn close will wait
1452 	 * till the conn_ref drops to zero.
1453 	 */
1454 	mutex_enter(&connp->conn_lock);
1455 	ill = connp->conn_oper_pending_ill;
1456 	if (ill == NULL) {
1457 		mutex_exit(&connp->conn_lock);
1458 		return;
1459 	}
1460 
1461 	curr = ill_pending_mp_get(ill, &connp, 0);
1462 	if (curr != NULL) {
1463 		mutex_exit(&connp->conn_lock);
1464 		CONN_DEC_REF(connp);
1465 		inet_freemsg(curr);
1466 		return;
1467 	}
1468 	/*
1469 	 * We may not be able to refhold the ill if the ill/ipif
1470 	 * is changing. But we need to make sure that the ill will
1471 	 * not vanish. So we just bump up the ill_waiter count.
1472 	 */
1473 	refheld = ill_waiter_inc(ill);
1474 	mutex_exit(&connp->conn_lock);
1475 	if (refheld) {
1476 		if (ipsq_enter(ill, B_TRUE)) {
1477 			ill_waiter_dcr(ill);
1478 			/*
1479 			 * Check whether this ioctl has started and is
1480 			 * pending now in ipsq_pending_mp. If it is not
1481 			 * found there then check whether this ioctl has
1482 			 * not even started and is in the ipsq_xopq list.
1483 			 */
1484 			if (!ipsq_pending_mp_cleanup(ill, connp))
1485 				ipsq_xopq_mp_cleanup(ill, connp);
1486 			ipsq = ill->ill_phyint->phyint_ipsq;
1487 			ipsq_exit(ipsq, B_TRUE, B_TRUE);
1488 			return;
1489 		}
1490 	}
1491 
1492 	/*
1493 	 * The ill is also closing and we could not bump up the
1494 	 * ill_waiter_count or we could not enter the ipsq. Leave
1495 	 * the cleanup to ill_delete
1496 	 */
1497 	mutex_enter(&connp->conn_lock);
1498 	while (connp->conn_oper_pending_ill != NULL)
1499 		cv_wait(&connp->conn_refcv, &connp->conn_lock);
1500 	mutex_exit(&connp->conn_lock);
1501 	if (refheld)
1502 		ill_waiter_dcr(ill);
1503 }
1504 
1505 /*
1506  * ipcl_walk function for cleaning up conn_*_ill fields.
1507  */
1508 static void
1509 conn_cleanup_ill(conn_t *connp, caddr_t arg)
1510 {
1511 	ill_t	*ill = (ill_t *)arg;
1512 	ire_t	*ire;
1513 
1514 	mutex_enter(&connp->conn_lock);
1515 	if (connp->conn_multicast_ill == ill) {
1516 		/* Revert to late binding */
1517 		connp->conn_multicast_ill = NULL;
1518 		connp->conn_orig_multicast_ifindex = 0;
1519 	}
1520 	if (connp->conn_incoming_ill == ill)
1521 		connp->conn_incoming_ill = NULL;
1522 	if (connp->conn_outgoing_ill == ill)
1523 		connp->conn_outgoing_ill = NULL;
1524 	if (connp->conn_outgoing_pill == ill)
1525 		connp->conn_outgoing_pill = NULL;
1526 	if (connp->conn_nofailover_ill == ill)
1527 		connp->conn_nofailover_ill = NULL;
1528 	if (connp->conn_xmit_if_ill == ill)
1529 		connp->conn_xmit_if_ill = NULL;
1530 	if (connp->conn_ire_cache != NULL) {
1531 		ire = connp->conn_ire_cache;
1532 		/*
1533 		 * ip_newroute creates IRE_CACHE with ire_stq coming from
1534 		 * interface X and ipif coming from interface Y, if interface
1535 		 * X and Y are part of the same IPMPgroup. Thus whenever
1536 		 * interface X goes down, remove all references to it by
1537 		 * checking both on ire_ipif and ire_stq.
1538 		 */
1539 		if ((ire->ire_ipif != NULL && ire->ire_ipif->ipif_ill == ill) ||
1540 		    (ire->ire_type == IRE_CACHE &&
1541 		    ire->ire_stq == ill->ill_wq)) {
1542 			connp->conn_ire_cache = NULL;
1543 			mutex_exit(&connp->conn_lock);
1544 			ire_refrele_notr(ire);
1545 			return;
1546 		}
1547 	}
1548 	mutex_exit(&connp->conn_lock);
1549 
1550 }
1551 
1552 /* ARGSUSED */
1553 void
1554 ipif_all_down_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
1555 {
1556 	ill_t	*ill = q->q_ptr;
1557 	ipif_t	*ipif;
1558 
1559 	ASSERT(IAM_WRITER_IPSQ(ipsq));
1560 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
1561 		ipif_non_duplicate(ipif);
1562 		ipif_down_tail(ipif);
1563 	}
1564 	ill_down_tail(ill);
1565 	freemsg(mp);
1566 	ipsq->ipsq_current_ipif = NULL;
1567 }
1568 
1569 /*
1570  * ill_down_start is called when we want to down this ill and bring it up again
1571  * It is called when we receive an M_ERROR / M_HANGUP. In this case we shut down
1572  * all interfaces, but don't tear down any plumbing.
1573  */
1574 boolean_t
1575 ill_down_start(queue_t *q, mblk_t *mp)
1576 {
1577 	ill_t	*ill;
1578 	ipif_t	*ipif;
1579 
1580 	ill = q->q_ptr;
1581 
1582 	ASSERT(IAM_WRITER_ILL(ill));
1583 
1584 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
1585 		(void) ipif_down(ipif, NULL, NULL);
1586 
1587 	ill_down(ill);
1588 
1589 	(void) ipsq_pending_mp_cleanup(ill, NULL);
1590 	mutex_enter(&ill->ill_lock);
1591 	/*
1592 	 * Atomically test and add the pending mp if references are
1593 	 * still active.
1594 	 */
1595 	if (!ill_is_quiescent(ill)) {
1596 		/*
1597 		 * Get rid of any pending mps and cleanup. Call will
1598 		 * not fail since we are passing a null connp.
1599 		 */
1600 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
1601 		    mp, ILL_DOWN);
1602 		mutex_exit(&ill->ill_lock);
1603 		return (B_FALSE);
1604 	}
1605 	mutex_exit(&ill->ill_lock);
1606 	return (B_TRUE);
1607 }
1608 
1609 static void
1610 ill_down(ill_t *ill)
1611 {
1612 	/* Blow off any IREs dependent on this ILL. */
1613 	ire_walk(ill_downi, (char *)ill);
1614 
1615 	mutex_enter(&ire_mrtun_lock);
1616 	if (ire_mrtun_count != 0) {
1617 		mutex_exit(&ire_mrtun_lock);
1618 		ire_walk_ill_mrtun(0, 0, ill_downi_mrtun_srcif,
1619 		    (char *)ill, NULL);
1620 	} else {
1621 		mutex_exit(&ire_mrtun_lock);
1622 	}
1623 
1624 	/*
1625 	 * If any interface based forwarding table exists
1626 	 * Blow off the ires there dependent on this ill
1627 	 */
1628 	mutex_enter(&ire_srcif_table_lock);
1629 	if (ire_srcif_table_count > 0) {
1630 		mutex_exit(&ire_srcif_table_lock);
1631 		ire_walk_srcif_table_v4(ill_downi_mrtun_srcif, (char *)ill);
1632 	} else {
1633 		mutex_exit(&ire_srcif_table_lock);
1634 	}
1635 
1636 	/* Remove any conn_*_ill depending on this ill */
1637 	ipcl_walk(conn_cleanup_ill, (caddr_t)ill);
1638 
1639 	if (ill->ill_group != NULL) {
1640 		illgrp_delete(ill);
1641 	}
1642 
1643 }
1644 
1645 static void
1646 ill_down_tail(ill_t *ill)
1647 {
1648 	int	i;
1649 
1650 	/* Destroy ill_srcif_table if it exists */
1651 	/* Lock not reqd really because nobody should be able to access */
1652 	mutex_enter(&ill->ill_lock);
1653 	if (ill->ill_srcif_table != NULL) {
1654 		ill->ill_srcif_refcnt = 0;
1655 		for (i = 0; i < IP_SRCIF_TABLE_SIZE; i++) {
1656 			rw_destroy(&ill->ill_srcif_table[i].irb_lock);
1657 		}
1658 		kmem_free(ill->ill_srcif_table,
1659 		    IP_SRCIF_TABLE_SIZE * sizeof (irb_t));
1660 		ill->ill_srcif_table = NULL;
1661 		ill->ill_srcif_refcnt = 0;
1662 		ill->ill_mrtun_refcnt = 0;
1663 	}
1664 	mutex_exit(&ill->ill_lock);
1665 }
1666 
1667 /*
1668  * ire_walk routine used to delete every IRE that depends on queues
1669  * associated with 'ill'.  (Always called as writer.)
1670  */
1671 static void
1672 ill_downi(ire_t *ire, char *ill_arg)
1673 {
1674 	ill_t	*ill = (ill_t *)ill_arg;
1675 
1676 	/*
1677 	 * ip_newroute creates IRE_CACHE with ire_stq coming from
1678 	 * interface X and ipif coming from interface Y, if interface
1679 	 * X and Y are part of the same IPMP group. Thus whenever interface
1680 	 * X goes down, remove all references to it by checking both
1681 	 * on ire_ipif and ire_stq.
1682 	 */
1683 	if ((ire->ire_ipif != NULL && ire->ire_ipif->ipif_ill == ill) ||
1684 	    (ire->ire_type == IRE_CACHE && ire->ire_stq == ill->ill_wq)) {
1685 		ire_delete(ire);
1686 	}
1687 }
1688 
1689 /*
1690  * A seperate routine for deleting revtun and srcif based routes
1691  * are needed because the ires only deleted when the interface
1692  * is unplumbed. Also these ires have ire_in_ill non-null as well.
1693  * we want to keep mobile IP specific code separate.
1694  */
1695 static void
1696 ill_downi_mrtun_srcif(ire_t *ire, char *ill_arg)
1697 {
1698 	ill_t   *ill = (ill_t *)ill_arg;
1699 
1700 	ASSERT(ire->ire_in_ill != NULL);
1701 
1702 	if ((ire->ire_in_ill != NULL && ire->ire_in_ill == ill) ||
1703 	    (ire->ire_stq == ill->ill_wq) || (ire->ire_stq == ill->ill_rq)) {
1704 		ire_delete(ire);
1705 	}
1706 }
1707 
1708 /*
1709  * Remove ire/nce from the fastpath list.
1710  */
1711 void
1712 ill_fastpath_nack(ill_t *ill)
1713 {
1714 	if (ill->ill_isv6) {
1715 		nce_fastpath_list_dispatch(ill, NULL, NULL);
1716 	} else {
1717 		ire_fastpath_list_dispatch(ill, NULL, NULL);
1718 	}
1719 }
1720 
1721 /* Consume an M_IOCACK of the fastpath probe. */
1722 void
1723 ill_fastpath_ack(ill_t *ill, mblk_t *mp)
1724 {
1725 	mblk_t	*mp1 = mp;
1726 
1727 	/*
1728 	 * If this was the first attempt turn on the fastpath probing.
1729 	 */
1730 	mutex_enter(&ill->ill_lock);
1731 	if (ill->ill_dlpi_fastpath_state == IDS_INPROGRESS)
1732 		ill->ill_dlpi_fastpath_state = IDS_OK;
1733 	mutex_exit(&ill->ill_lock);
1734 
1735 	/* Free the M_IOCACK mblk, hold on to the data */
1736 	mp = mp->b_cont;
1737 	freeb(mp1);
1738 	if (mp == NULL)
1739 		return;
1740 	if (mp->b_cont != NULL) {
1741 		/*
1742 		 * Update all IRE's or NCE's that are waiting for
1743 		 * fastpath update.
1744 		 */
1745 		if (ill->ill_isv6) {
1746 			/*
1747 			 * update nce's in the fastpath list.
1748 			 */
1749 			nce_fastpath_list_dispatch(ill,
1750 			    ndp_fastpath_update, mp);
1751 		} else {
1752 
1753 			/*
1754 			 * update ire's in the fastpath list.
1755 			 */
1756 			ire_fastpath_list_dispatch(ill,
1757 			    ire_fastpath_update, mp);
1758 			/*
1759 			 * Check if we need to traverse reverse tunnel table.
1760 			 * Since there is only single ire_type (IRE_MIPRTUN)
1761 			 * in the table, we don't need to match on ire_type.
1762 			 * We have to check ire_mrtun_count and not the
1763 			 * ill_mrtun_refcnt since ill_mrtun_refcnt is set
1764 			 * on the incoming ill and here we are dealing with
1765 			 * outgoing ill.
1766 			 */
1767 			mutex_enter(&ire_mrtun_lock);
1768 			if (ire_mrtun_count != 0) {
1769 				mutex_exit(&ire_mrtun_lock);
1770 				ire_walk_ill_mrtun(MATCH_IRE_WQ, IRE_MIPRTUN,
1771 				    (void (*)(ire_t *, void *))
1772 					ire_fastpath_update, mp, ill);
1773 			} else {
1774 				mutex_exit(&ire_mrtun_lock);
1775 			}
1776 		}
1777 		mp1 = mp->b_cont;
1778 		freeb(mp);
1779 		mp = mp1;
1780 	} else {
1781 		ip0dbg(("ill_fastpath_ack:  no b_cont\n"));
1782 	}
1783 
1784 	freeb(mp);
1785 }
1786 
1787 /*
1788  * Throw an M_IOCTL message downstream asking "do you know fastpath?"
1789  * The data portion of the request is a dl_unitdata_req_t template for
1790  * what we would send downstream in the absence of a fastpath confirmation.
1791  */
1792 int
1793 ill_fastpath_probe(ill_t *ill, mblk_t *dlur_mp)
1794 {
1795 	struct iocblk	*ioc;
1796 	mblk_t	*mp;
1797 
1798 	if (dlur_mp == NULL)
1799 		return (EINVAL);
1800 
1801 	mutex_enter(&ill->ill_lock);
1802 	switch (ill->ill_dlpi_fastpath_state) {
1803 	case IDS_FAILED:
1804 		/*
1805 		 * Driver NAKed the first fastpath ioctl - assume it doesn't
1806 		 * support it.
1807 		 */
1808 		mutex_exit(&ill->ill_lock);
1809 		return (ENOTSUP);
1810 	case IDS_UNKNOWN:
1811 		/* This is the first probe */
1812 		ill->ill_dlpi_fastpath_state = IDS_INPROGRESS;
1813 		break;
1814 	default:
1815 		break;
1816 	}
1817 	mutex_exit(&ill->ill_lock);
1818 
1819 	if ((mp = mkiocb(DL_IOC_HDR_INFO)) == NULL)
1820 		return (EAGAIN);
1821 
1822 	mp->b_cont = copyb(dlur_mp);
1823 	if (mp->b_cont == NULL) {
1824 		freeb(mp);
1825 		return (EAGAIN);
1826 	}
1827 
1828 	ioc = (struct iocblk *)mp->b_rptr;
1829 	ioc->ioc_count = msgdsize(mp->b_cont);
1830 
1831 	putnext(ill->ill_wq, mp);
1832 	return (0);
1833 }
1834 
1835 void
1836 ill_capability_probe(ill_t *ill)
1837 {
1838 	/*
1839 	 * Do so only if negotiation is enabled, capabilities are unknown,
1840 	 * and a capability negotiation is not already in progress.
1841 	 */
1842 	if (ill->ill_dlpi_capab_state != IDS_UNKNOWN &&
1843 	    ill->ill_dlpi_capab_state != IDS_RENEG)
1844 		return;
1845 
1846 	ill->ill_dlpi_capab_state = IDS_INPROGRESS;
1847 	ip1dbg(("ill_capability_probe: starting capability negotiation\n"));
1848 	ill_capability_proto(ill, DL_CAPABILITY_REQ, NULL);
1849 }
1850 
1851 void
1852 ill_capability_reset(ill_t *ill)
1853 {
1854 	mblk_t *sc_mp = NULL;
1855 	mblk_t *tmp;
1856 
1857 	/*
1858 	 * Note here that we reset the state to UNKNOWN, and later send
1859 	 * down the DL_CAPABILITY_REQ without first setting the state to
1860 	 * INPROGRESS.  We do this in order to distinguish the
1861 	 * DL_CAPABILITY_ACK response which may come back in response to
1862 	 * a "reset" apart from the "probe" DL_CAPABILITY_REQ.  This would
1863 	 * also handle the case where the driver doesn't send us back
1864 	 * a DL_CAPABILITY_ACK in response, since the "probe" routine
1865 	 * requires the state to be in UNKNOWN anyway.  In any case, all
1866 	 * features are turned off until the state reaches IDS_OK.
1867 	 */
1868 	ill->ill_dlpi_capab_state = IDS_UNKNOWN;
1869 
1870 	/*
1871 	 * Disable sub-capabilities and request a list of sub-capability
1872 	 * messages which will be sent down to the driver.  Each handler
1873 	 * allocates the corresponding dl_capability_sub_t inside an
1874 	 * mblk, and links it to the existing sc_mp mblk, or return it
1875 	 * as sc_mp if it's the first sub-capability (the passed in
1876 	 * sc_mp is NULL).  Upon returning from all capability handlers,
1877 	 * sc_mp will be pulled-up, before passing it downstream.
1878 	 */
1879 	ill_capability_mdt_reset(ill, &sc_mp);
1880 	ill_capability_hcksum_reset(ill, &sc_mp);
1881 	ill_capability_zerocopy_reset(ill, &sc_mp);
1882 	ill_capability_ipsec_reset(ill, &sc_mp);
1883 	ill_capability_dls_reset(ill, &sc_mp);
1884 	ill_capability_lso_reset(ill, &sc_mp);
1885 
1886 	/* Nothing to send down in order to disable the capabilities? */
1887 	if (sc_mp == NULL)
1888 		return;
1889 
1890 	tmp = msgpullup(sc_mp, -1);
1891 	freemsg(sc_mp);
1892 	if ((sc_mp = tmp) == NULL) {
1893 		cmn_err(CE_WARN, "ill_capability_reset: unable to send down "
1894 		    "DL_CAPABILITY_REQ (ENOMEM)\n");
1895 		return;
1896 	}
1897 
1898 	ip1dbg(("ill_capability_reset: resetting negotiated capabilities\n"));
1899 	ill_capability_proto(ill, DL_CAPABILITY_REQ, sc_mp);
1900 }
1901 
1902 /*
1903  * Request or set new-style hardware capabilities supported by DLS provider.
1904  */
1905 static void
1906 ill_capability_proto(ill_t *ill, int type, mblk_t *reqp)
1907 {
1908 	mblk_t *mp;
1909 	dl_capability_req_t *capb;
1910 	size_t size = 0;
1911 	uint8_t *ptr;
1912 
1913 	if (reqp != NULL)
1914 		size = MBLKL(reqp);
1915 
1916 	mp = ip_dlpi_alloc(sizeof (dl_capability_req_t) + size, type);
1917 	if (mp == NULL) {
1918 		freemsg(reqp);
1919 		return;
1920 	}
1921 	ptr = mp->b_rptr;
1922 
1923 	capb = (dl_capability_req_t *)ptr;
1924 	ptr += sizeof (dl_capability_req_t);
1925 
1926 	if (reqp != NULL) {
1927 		capb->dl_sub_offset = sizeof (dl_capability_req_t);
1928 		capb->dl_sub_length = size;
1929 		bcopy(reqp->b_rptr, ptr, size);
1930 		ptr += size;
1931 		mp->b_cont = reqp->b_cont;
1932 		freeb(reqp);
1933 	}
1934 	ASSERT(ptr == mp->b_wptr);
1935 
1936 	ill_dlpi_send(ill, mp);
1937 }
1938 
1939 static void
1940 ill_capability_id_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *outers)
1941 {
1942 	dl_capab_id_t *id_ic;
1943 	uint_t sub_dl_cap = outers->dl_cap;
1944 	dl_capability_sub_t *inners;
1945 	uint8_t *capend;
1946 
1947 	ASSERT(sub_dl_cap == DL_CAPAB_ID_WRAPPER);
1948 
1949 	/*
1950 	 * Note: range checks here are not absolutely sufficient to
1951 	 * make us robust against malformed messages sent by drivers;
1952 	 * this is in keeping with the rest of IP's dlpi handling.
1953 	 * (Remember, it's coming from something else in the kernel
1954 	 * address space)
1955 	 */
1956 
1957 	capend = (uint8_t *)(outers + 1) + outers->dl_length;
1958 	if (capend > mp->b_wptr) {
1959 		cmn_err(CE_WARN, "ill_capability_id_ack: "
1960 		    "malformed sub-capability too long for mblk");
1961 		return;
1962 	}
1963 
1964 	id_ic = (dl_capab_id_t *)(outers + 1);
1965 
1966 	if (outers->dl_length < sizeof (*id_ic) ||
1967 	    (inners = &id_ic->id_subcap,
1968 	    inners->dl_length > (outers->dl_length - sizeof (*inners)))) {
1969 		cmn_err(CE_WARN, "ill_capability_id_ack: malformed "
1970 		    "encapsulated capab type %d too long for mblk",
1971 		    inners->dl_cap);
1972 		return;
1973 	}
1974 
1975 	if (!dlcapabcheckqid(&id_ic->id_mid, ill->ill_lmod_rq)) {
1976 		ip1dbg(("ill_capability_id_ack: mid token for capab type %d "
1977 		    "isn't as expected; pass-thru module(s) detected, "
1978 		    "discarding capability\n", inners->dl_cap));
1979 		return;
1980 	}
1981 
1982 	/* Process the encapsulated sub-capability */
1983 	ill_capability_dispatch(ill, mp, inners, B_TRUE);
1984 }
1985 
1986 /*
1987  * Process Multidata Transmit capability negotiation ack received from a
1988  * DLS Provider.  isub must point to the sub-capability (DL_CAPAB_MDT) of a
1989  * DL_CAPABILITY_ACK message.
1990  */
1991 static void
1992 ill_capability_mdt_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1993 {
1994 	mblk_t *nmp = NULL;
1995 	dl_capability_req_t *oc;
1996 	dl_capab_mdt_t *mdt_ic, *mdt_oc;
1997 	ill_mdt_capab_t **ill_mdt_capab;
1998 	uint_t sub_dl_cap = isub->dl_cap;
1999 	uint8_t *capend;
2000 
2001 	ASSERT(sub_dl_cap == DL_CAPAB_MDT);
2002 
2003 	ill_mdt_capab = (ill_mdt_capab_t **)&ill->ill_mdt_capab;
2004 
2005 	/*
2006 	 * Note: range checks here are not absolutely sufficient to
2007 	 * make us robust against malformed messages sent by drivers;
2008 	 * this is in keeping with the rest of IP's dlpi handling.
2009 	 * (Remember, it's coming from something else in the kernel
2010 	 * address space)
2011 	 */
2012 
2013 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2014 	if (capend > mp->b_wptr) {
2015 		cmn_err(CE_WARN, "ill_capability_mdt_ack: "
2016 		    "malformed sub-capability too long for mblk");
2017 		return;
2018 	}
2019 
2020 	mdt_ic = (dl_capab_mdt_t *)(isub + 1);
2021 
2022 	if (mdt_ic->mdt_version != MDT_VERSION_2) {
2023 		cmn_err(CE_CONT, "ill_capability_mdt_ack: "
2024 		    "unsupported MDT sub-capability (version %d, expected %d)",
2025 		    mdt_ic->mdt_version, MDT_VERSION_2);
2026 		return;
2027 	}
2028 
2029 	if (!dlcapabcheckqid(&mdt_ic->mdt_mid, ill->ill_lmod_rq)) {
2030 		ip1dbg(("ill_capability_mdt_ack: mid token for MDT "
2031 		    "capability isn't as expected; pass-thru module(s) "
2032 		    "detected, discarding capability\n"));
2033 		return;
2034 	}
2035 
2036 	if (mdt_ic->mdt_flags & DL_CAPAB_MDT_ENABLE) {
2037 
2038 		if (*ill_mdt_capab == NULL) {
2039 			*ill_mdt_capab = kmem_zalloc(sizeof (ill_mdt_capab_t),
2040 			    KM_NOSLEEP);
2041 
2042 			if (*ill_mdt_capab == NULL) {
2043 				cmn_err(CE_WARN, "ill_capability_mdt_ack: "
2044 				    "could not enable MDT version %d "
2045 				    "for %s (ENOMEM)\n", MDT_VERSION_2,
2046 				    ill->ill_name);
2047 				return;
2048 			}
2049 		}
2050 
2051 		ip1dbg(("ill_capability_mdt_ack: interface %s supports "
2052 		    "MDT version %d (%d bytes leading, %d bytes trailing "
2053 		    "header spaces, %d max pld bufs, %d span limit)\n",
2054 		    ill->ill_name, MDT_VERSION_2,
2055 		    mdt_ic->mdt_hdr_head, mdt_ic->mdt_hdr_tail,
2056 		    mdt_ic->mdt_max_pld, mdt_ic->mdt_span_limit));
2057 
2058 		(*ill_mdt_capab)->ill_mdt_version = MDT_VERSION_2;
2059 		(*ill_mdt_capab)->ill_mdt_on = 1;
2060 		/*
2061 		 * Round the following values to the nearest 32-bit; ULP
2062 		 * may further adjust them to accomodate for additional
2063 		 * protocol headers.  We pass these values to ULP during
2064 		 * bind time.
2065 		 */
2066 		(*ill_mdt_capab)->ill_mdt_hdr_head =
2067 		    roundup(mdt_ic->mdt_hdr_head, 4);
2068 		(*ill_mdt_capab)->ill_mdt_hdr_tail =
2069 		    roundup(mdt_ic->mdt_hdr_tail, 4);
2070 		(*ill_mdt_capab)->ill_mdt_max_pld = mdt_ic->mdt_max_pld;
2071 		(*ill_mdt_capab)->ill_mdt_span_limit = mdt_ic->mdt_span_limit;
2072 
2073 		ill->ill_capabilities |= ILL_CAPAB_MDT;
2074 	} else {
2075 		uint_t size;
2076 		uchar_t *rptr;
2077 
2078 		size = sizeof (dl_capability_req_t) +
2079 		    sizeof (dl_capability_sub_t) + sizeof (dl_capab_mdt_t);
2080 
2081 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2082 			cmn_err(CE_WARN, "ill_capability_mdt_ack: "
2083 			    "could not enable MDT for %s (ENOMEM)\n",
2084 			    ill->ill_name);
2085 			return;
2086 		}
2087 
2088 		rptr = nmp->b_rptr;
2089 		/* initialize dl_capability_req_t */
2090 		oc = (dl_capability_req_t *)nmp->b_rptr;
2091 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
2092 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
2093 		    sizeof (dl_capab_mdt_t);
2094 		nmp->b_rptr += sizeof (dl_capability_req_t);
2095 
2096 		/* initialize dl_capability_sub_t */
2097 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
2098 		nmp->b_rptr += sizeof (*isub);
2099 
2100 		/* initialize dl_capab_mdt_t */
2101 		mdt_oc = (dl_capab_mdt_t *)nmp->b_rptr;
2102 		bcopy(mdt_ic, mdt_oc, sizeof (*mdt_ic));
2103 
2104 		nmp->b_rptr = rptr;
2105 
2106 		ip1dbg(("ill_capability_mdt_ack: asking interface %s "
2107 		    "to enable MDT version %d\n", ill->ill_name,
2108 		    MDT_VERSION_2));
2109 
2110 		/* set ENABLE flag */
2111 		mdt_oc->mdt_flags |= DL_CAPAB_MDT_ENABLE;
2112 
2113 		/* nmp points to a DL_CAPABILITY_REQ message to enable MDT */
2114 		ill_dlpi_send(ill, nmp);
2115 	}
2116 }
2117 
2118 static void
2119 ill_capability_mdt_reset(ill_t *ill, mblk_t **sc_mp)
2120 {
2121 	mblk_t *mp;
2122 	dl_capab_mdt_t *mdt_subcap;
2123 	dl_capability_sub_t *dl_subcap;
2124 	int size;
2125 
2126 	if (!ILL_MDT_CAPABLE(ill))
2127 		return;
2128 
2129 	ASSERT(ill->ill_mdt_capab != NULL);
2130 	/*
2131 	 * Clear the capability flag for MDT but retain the ill_mdt_capab
2132 	 * structure since it's possible that another thread is still
2133 	 * referring to it.  The structure only gets deallocated when
2134 	 * we destroy the ill.
2135 	 */
2136 	ill->ill_capabilities &= ~ILL_CAPAB_MDT;
2137 
2138 	size = sizeof (*dl_subcap) + sizeof (*mdt_subcap);
2139 
2140 	mp = allocb(size, BPRI_HI);
2141 	if (mp == NULL) {
2142 		ip1dbg(("ill_capability_mdt_reset: unable to allocate "
2143 		    "request to disable MDT\n"));
2144 		return;
2145 	}
2146 
2147 	mp->b_wptr = mp->b_rptr + size;
2148 
2149 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
2150 	dl_subcap->dl_cap = DL_CAPAB_MDT;
2151 	dl_subcap->dl_length = sizeof (*mdt_subcap);
2152 
2153 	mdt_subcap = (dl_capab_mdt_t *)(dl_subcap + 1);
2154 	mdt_subcap->mdt_version = ill->ill_mdt_capab->ill_mdt_version;
2155 	mdt_subcap->mdt_flags = 0;
2156 	mdt_subcap->mdt_hdr_head = 0;
2157 	mdt_subcap->mdt_hdr_tail = 0;
2158 
2159 	if (*sc_mp != NULL)
2160 		linkb(*sc_mp, mp);
2161 	else
2162 		*sc_mp = mp;
2163 }
2164 
2165 /*
2166  * Send a DL_NOTIFY_REQ to the specified ill to enable
2167  * DL_NOTE_PROMISC_ON/OFF_PHYS notifications.
2168  * Invoked by ill_capability_ipsec_ack() before enabling IPsec hardware
2169  * acceleration.
2170  * Returns B_TRUE on success, B_FALSE if the message could not be sent.
2171  */
2172 static boolean_t
2173 ill_enable_promisc_notify(ill_t *ill)
2174 {
2175 	mblk_t *mp;
2176 	dl_notify_req_t *req;
2177 
2178 	IPSECHW_DEBUG(IPSECHW_PKT, ("ill_enable_promisc_notify:\n"));
2179 
2180 	mp = ip_dlpi_alloc(sizeof (dl_notify_req_t), DL_NOTIFY_REQ);
2181 	if (mp == NULL)
2182 		return (B_FALSE);
2183 
2184 	req = (dl_notify_req_t *)mp->b_rptr;
2185 	req->dl_notifications = DL_NOTE_PROMISC_ON_PHYS |
2186 	    DL_NOTE_PROMISC_OFF_PHYS;
2187 
2188 	ill_dlpi_send(ill, mp);
2189 
2190 	return (B_TRUE);
2191 }
2192 
2193 
2194 /*
2195  * Allocate an IPsec capability request which will be filled by our
2196  * caller to turn on support for one or more algorithms.
2197  */
2198 static mblk_t *
2199 ill_alloc_ipsec_cap_req(ill_t *ill, dl_capability_sub_t *isub)
2200 {
2201 	mblk_t *nmp;
2202 	dl_capability_req_t	*ocap;
2203 	dl_capab_ipsec_t	*ocip;
2204 	dl_capab_ipsec_t	*icip;
2205 	uint8_t			*ptr;
2206 	icip = (dl_capab_ipsec_t *)(isub + 1);
2207 
2208 	/*
2209 	 * The first time around, we send a DL_NOTIFY_REQ to enable
2210 	 * PROMISC_ON/OFF notification from the provider. We need to
2211 	 * do this before enabling the algorithms to avoid leakage of
2212 	 * cleartext packets.
2213 	 */
2214 
2215 	if (!ill_enable_promisc_notify(ill))
2216 		return (NULL);
2217 
2218 	/*
2219 	 * Allocate new mblk which will contain a new capability
2220 	 * request to enable the capabilities.
2221 	 */
2222 
2223 	nmp = ip_dlpi_alloc(sizeof (dl_capability_req_t) +
2224 	    sizeof (dl_capability_sub_t) + isub->dl_length, DL_CAPABILITY_REQ);
2225 	if (nmp == NULL)
2226 		return (NULL);
2227 
2228 	ptr = nmp->b_rptr;
2229 
2230 	/* initialize dl_capability_req_t */
2231 	ocap = (dl_capability_req_t *)ptr;
2232 	ocap->dl_sub_offset = sizeof (dl_capability_req_t);
2233 	ocap->dl_sub_length = sizeof (dl_capability_sub_t) + isub->dl_length;
2234 	ptr += sizeof (dl_capability_req_t);
2235 
2236 	/* initialize dl_capability_sub_t */
2237 	bcopy(isub, ptr, sizeof (*isub));
2238 	ptr += sizeof (*isub);
2239 
2240 	/* initialize dl_capab_ipsec_t */
2241 	ocip = (dl_capab_ipsec_t *)ptr;
2242 	bcopy(icip, ocip, sizeof (*icip));
2243 
2244 	nmp->b_wptr = (uchar_t *)(&ocip->cip_data[0]);
2245 	return (nmp);
2246 }
2247 
2248 /*
2249  * Process an IPsec capability negotiation ack received from a DLS Provider.
2250  * isub must point to the sub-capability (DL_CAPAB_IPSEC_AH or
2251  * DL_CAPAB_IPSEC_ESP) of a DL_CAPABILITY_ACK message.
2252  */
2253 static void
2254 ill_capability_ipsec_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2255 {
2256 	dl_capab_ipsec_t	*icip;
2257 	dl_capab_ipsec_alg_t	*ialg;	/* ptr to input alg spec. */
2258 	dl_capab_ipsec_alg_t	*oalg;	/* ptr to output alg spec. */
2259 	uint_t cipher, nciphers;
2260 	mblk_t *nmp;
2261 	uint_t alg_len;
2262 	boolean_t need_sadb_dump;
2263 	uint_t sub_dl_cap = isub->dl_cap;
2264 	ill_ipsec_capab_t **ill_capab;
2265 	uint64_t ill_capab_flag;
2266 	uint8_t *capend, *ciphend;
2267 	boolean_t sadb_resync;
2268 
2269 	ASSERT(sub_dl_cap == DL_CAPAB_IPSEC_AH ||
2270 	    sub_dl_cap == DL_CAPAB_IPSEC_ESP);
2271 
2272 	if (sub_dl_cap == DL_CAPAB_IPSEC_AH) {
2273 		ill_capab = (ill_ipsec_capab_t **)&ill->ill_ipsec_capab_ah;
2274 		ill_capab_flag = ILL_CAPAB_AH;
2275 	} else {
2276 		ill_capab = (ill_ipsec_capab_t **)&ill->ill_ipsec_capab_esp;
2277 		ill_capab_flag = ILL_CAPAB_ESP;
2278 	}
2279 
2280 	/*
2281 	 * If the ill capability structure exists, then this incoming
2282 	 * DL_CAPABILITY_ACK is a response to a "renegotiation" cycle.
2283 	 * If this is so, then we'd need to resynchronize the SADB
2284 	 * after re-enabling the offloaded ciphers.
2285 	 */
2286 	sadb_resync = (*ill_capab != NULL);
2287 
2288 	/*
2289 	 * Note: range checks here are not absolutely sufficient to
2290 	 * make us robust against malformed messages sent by drivers;
2291 	 * this is in keeping with the rest of IP's dlpi handling.
2292 	 * (Remember, it's coming from something else in the kernel
2293 	 * address space)
2294 	 */
2295 
2296 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2297 	if (capend > mp->b_wptr) {
2298 		cmn_err(CE_WARN, "ill_capability_ipsec_ack: "
2299 		    "malformed sub-capability too long for mblk");
2300 		return;
2301 	}
2302 
2303 	/*
2304 	 * There are two types of acks we process here:
2305 	 * 1. acks in reply to a (first form) generic capability req
2306 	 *    (no ENABLE flag set)
2307 	 * 2. acks in reply to a ENABLE capability req.
2308 	 *    (ENABLE flag set)
2309 	 *
2310 	 * We process the subcapability passed as argument as follows:
2311 	 * 1 do initializations
2312 	 *   1.1 initialize nmp = NULL
2313 	 *   1.2 set need_sadb_dump to B_FALSE
2314 	 * 2 for each cipher in subcapability:
2315 	 *   2.1 if ENABLE flag is set:
2316 	 *	2.1.1 update per-ill ipsec capabilities info
2317 	 *	2.1.2 set need_sadb_dump to B_TRUE
2318 	 *   2.2 if ENABLE flag is not set:
2319 	 *	2.2.1 if nmp is NULL:
2320 	 *		2.2.1.1 allocate and initialize nmp
2321 	 *		2.2.1.2 init current pos in nmp
2322 	 *	2.2.2 copy current cipher to current pos in nmp
2323 	 *	2.2.3 set ENABLE flag in nmp
2324 	 *	2.2.4 update current pos
2325 	 * 3 if nmp is not equal to NULL, send enable request
2326 	 *   3.1 send capability request
2327 	 * 4 if need_sadb_dump is B_TRUE
2328 	 *   4.1 enable promiscuous on/off notifications
2329 	 *   4.2 call ill_dlpi_send(isub->dlcap) to send all
2330 	 *	AH or ESP SA's to interface.
2331 	 */
2332 
2333 	nmp = NULL;
2334 	oalg = NULL;
2335 	need_sadb_dump = B_FALSE;
2336 	icip = (dl_capab_ipsec_t *)(isub + 1);
2337 	ialg = (dl_capab_ipsec_alg_t *)(&icip->cip_data[0]);
2338 
2339 	nciphers = icip->cip_nciphers;
2340 	ciphend = (uint8_t *)(ialg + icip->cip_nciphers);
2341 
2342 	if (ciphend > capend) {
2343 		cmn_err(CE_WARN, "ill_capability_ipsec_ack: "
2344 		    "too many ciphers for sub-capability len");
2345 		return;
2346 	}
2347 
2348 	for (cipher = 0; cipher < nciphers; cipher++) {
2349 		alg_len = sizeof (dl_capab_ipsec_alg_t);
2350 
2351 		if (ialg->alg_flag & DL_CAPAB_ALG_ENABLE) {
2352 			/*
2353 			 * TBD: when we provide a way to disable capabilities
2354 			 * from above, need to manage the request-pending state
2355 			 * and fail if we were not expecting this ACK.
2356 			 */
2357 			IPSECHW_DEBUG(IPSECHW_CAPAB,
2358 			    ("ill_capability_ipsec_ack: got ENABLE ACK\n"));
2359 
2360 			/*
2361 			 * Update IPsec capabilities for this ill
2362 			 */
2363 
2364 			if (*ill_capab == NULL) {
2365 				IPSECHW_DEBUG(IPSECHW_CAPAB,
2366 				    ("ill_capability_ipsec_ack: "
2367 					"allocating ipsec_capab for ill\n"));
2368 				*ill_capab = ill_ipsec_capab_alloc();
2369 
2370 				if (*ill_capab == NULL) {
2371 					cmn_err(CE_WARN,
2372 					    "ill_capability_ipsec_ack: "
2373 					    "could not enable IPsec Hardware "
2374 					    "acceleration for %s (ENOMEM)\n",
2375 					    ill->ill_name);
2376 					return;
2377 				}
2378 			}
2379 
2380 			ASSERT(ialg->alg_type == DL_CAPAB_IPSEC_ALG_AUTH ||
2381 			    ialg->alg_type == DL_CAPAB_IPSEC_ALG_ENCR);
2382 
2383 			if (ialg->alg_prim >= MAX_IPSEC_ALGS) {
2384 				cmn_err(CE_WARN,
2385 				    "ill_capability_ipsec_ack: "
2386 				    "malformed IPsec algorithm id %d",
2387 				    ialg->alg_prim);
2388 				continue;
2389 			}
2390 
2391 			if (ialg->alg_type == DL_CAPAB_IPSEC_ALG_AUTH) {
2392 				IPSEC_ALG_ENABLE((*ill_capab)->auth_hw_algs,
2393 				    ialg->alg_prim);
2394 			} else {
2395 				ipsec_capab_algparm_t *alp;
2396 
2397 				IPSEC_ALG_ENABLE((*ill_capab)->encr_hw_algs,
2398 				    ialg->alg_prim);
2399 				if (!ill_ipsec_capab_resize_algparm(*ill_capab,
2400 				    ialg->alg_prim)) {
2401 					cmn_err(CE_WARN,
2402 					    "ill_capability_ipsec_ack: "
2403 					    "no space for IPsec alg id %d",
2404 					    ialg->alg_prim);
2405 					continue;
2406 				}
2407 				alp = &((*ill_capab)->encr_algparm[
2408 						ialg->alg_prim]);
2409 				alp->minkeylen = ialg->alg_minbits;
2410 				alp->maxkeylen = ialg->alg_maxbits;
2411 			}
2412 			ill->ill_capabilities |= ill_capab_flag;
2413 			/*
2414 			 * indicate that a capability was enabled, which
2415 			 * will be used below to kick off a SADB dump
2416 			 * to the ill.
2417 			 */
2418 			need_sadb_dump = B_TRUE;
2419 		} else {
2420 			IPSECHW_DEBUG(IPSECHW_CAPAB,
2421 			    ("ill_capability_ipsec_ack: enabling alg 0x%x\n",
2422 				ialg->alg_prim));
2423 
2424 			if (nmp == NULL) {
2425 				nmp = ill_alloc_ipsec_cap_req(ill, isub);
2426 				if (nmp == NULL) {
2427 					/*
2428 					 * Sending the PROMISC_ON/OFF
2429 					 * notification request failed.
2430 					 * We cannot enable the algorithms
2431 					 * since the Provider will not
2432 					 * notify IP of promiscous mode
2433 					 * changes, which could lead
2434 					 * to leakage of packets.
2435 					 */
2436 					cmn_err(CE_WARN,
2437 					    "ill_capability_ipsec_ack: "
2438 					    "could not enable IPsec Hardware "
2439 					    "acceleration for %s (ENOMEM)\n",
2440 					    ill->ill_name);
2441 					return;
2442 				}
2443 				/* ptr to current output alg specifier */
2444 				oalg = (dl_capab_ipsec_alg_t *)nmp->b_wptr;
2445 			}
2446 
2447 			/*
2448 			 * Copy current alg specifier, set ENABLE
2449 			 * flag, and advance to next output alg.
2450 			 * For now we enable all IPsec capabilities.
2451 			 */
2452 			ASSERT(oalg != NULL);
2453 			bcopy(ialg, oalg, alg_len);
2454 			oalg->alg_flag |= DL_CAPAB_ALG_ENABLE;
2455 			nmp->b_wptr += alg_len;
2456 			oalg = (dl_capab_ipsec_alg_t *)nmp->b_wptr;
2457 		}
2458 
2459 		/* move to next input algorithm specifier */
2460 		ialg = (dl_capab_ipsec_alg_t *)
2461 		    ((char *)ialg + alg_len);
2462 	}
2463 
2464 	if (nmp != NULL)
2465 		/*
2466 		 * nmp points to a DL_CAPABILITY_REQ message to enable
2467 		 * IPsec hardware acceleration.
2468 		 */
2469 		ill_dlpi_send(ill, nmp);
2470 
2471 	if (need_sadb_dump)
2472 		/*
2473 		 * An acknowledgement corresponding to a request to
2474 		 * enable acceleration was received, notify SADB.
2475 		 */
2476 		ill_ipsec_capab_add(ill, sub_dl_cap, sadb_resync);
2477 }
2478 
2479 /*
2480  * Given an mblk with enough space in it, create sub-capability entries for
2481  * DL_CAPAB_IPSEC_{AH,ESP} types which consist of previously-advertised
2482  * offloaded ciphers (both AUTH and ENCR) with their enable flags cleared,
2483  * in preparation for the reset the DL_CAPABILITY_REQ message.
2484  */
2485 static void
2486 ill_fill_ipsec_reset(uint_t nciphers, int stype, uint_t slen,
2487     ill_ipsec_capab_t *ill_cap, mblk_t *mp)
2488 {
2489 	dl_capab_ipsec_t *oipsec;
2490 	dl_capab_ipsec_alg_t *oalg;
2491 	dl_capability_sub_t *dl_subcap;
2492 	int i, k;
2493 
2494 	ASSERT(nciphers > 0);
2495 	ASSERT(ill_cap != NULL);
2496 	ASSERT(mp != NULL);
2497 	ASSERT(MBLKTAIL(mp) >= sizeof (*dl_subcap) + sizeof (*oipsec) + slen);
2498 
2499 	/* dl_capability_sub_t for "stype" */
2500 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2501 	dl_subcap->dl_cap = stype;
2502 	dl_subcap->dl_length = sizeof (dl_capab_ipsec_t) + slen;
2503 	mp->b_wptr += sizeof (dl_capability_sub_t);
2504 
2505 	/* dl_capab_ipsec_t for "stype" */
2506 	oipsec = (dl_capab_ipsec_t *)mp->b_wptr;
2507 	oipsec->cip_version = 1;
2508 	oipsec->cip_nciphers = nciphers;
2509 	mp->b_wptr = (uchar_t *)&oipsec->cip_data[0];
2510 
2511 	/* create entries for "stype" AUTH ciphers */
2512 	for (i = 0; i < ill_cap->algs_size; i++) {
2513 		for (k = 0; k < BITSPERBYTE; k++) {
2514 			if ((ill_cap->auth_hw_algs[i] & (1 << k)) == 0)
2515 				continue;
2516 
2517 			oalg = (dl_capab_ipsec_alg_t *)mp->b_wptr;
2518 			bzero((void *)oalg, sizeof (*oalg));
2519 			oalg->alg_type = DL_CAPAB_IPSEC_ALG_AUTH;
2520 			oalg->alg_prim = k + (BITSPERBYTE * i);
2521 			mp->b_wptr += sizeof (dl_capab_ipsec_alg_t);
2522 		}
2523 	}
2524 	/* create entries for "stype" ENCR ciphers */
2525 	for (i = 0; i < ill_cap->algs_size; i++) {
2526 		for (k = 0; k < BITSPERBYTE; k++) {
2527 			if ((ill_cap->encr_hw_algs[i] & (1 << k)) == 0)
2528 				continue;
2529 
2530 			oalg = (dl_capab_ipsec_alg_t *)mp->b_wptr;
2531 			bzero((void *)oalg, sizeof (*oalg));
2532 			oalg->alg_type = DL_CAPAB_IPSEC_ALG_ENCR;
2533 			oalg->alg_prim = k + (BITSPERBYTE * i);
2534 			mp->b_wptr += sizeof (dl_capab_ipsec_alg_t);
2535 		}
2536 	}
2537 }
2538 
2539 /*
2540  * Macro to count number of 1s in a byte (8-bit word).  The total count is
2541  * accumulated into the passed-in argument (sum).  We could use SPARCv9's
2542  * POPC instruction, but our macro is more flexible for an arbitrary length
2543  * of bytes, such as {auth,encr}_hw_algs.  These variables are currently
2544  * 256-bits long (MAX_IPSEC_ALGS), so if we know for sure that the length
2545  * stays that way, we can reduce the number of iterations required.
2546  */
2547 #define	COUNT_1S(val, sum) {					\
2548 	uint8_t x = val & 0xff;					\
2549 	x = (x & 0x55) + ((x >> 1) & 0x55);			\
2550 	x = (x & 0x33) + ((x >> 2) & 0x33);			\
2551 	sum += (x & 0xf) + ((x >> 4) & 0xf);			\
2552 }
2553 
2554 /* ARGSUSED */
2555 static void
2556 ill_capability_ipsec_reset(ill_t *ill, mblk_t **sc_mp)
2557 {
2558 	mblk_t *mp;
2559 	ill_ipsec_capab_t *cap_ah = ill->ill_ipsec_capab_ah;
2560 	ill_ipsec_capab_t *cap_esp = ill->ill_ipsec_capab_esp;
2561 	uint64_t ill_capabilities = ill->ill_capabilities;
2562 	int ah_cnt = 0, esp_cnt = 0;
2563 	int ah_len = 0, esp_len = 0;
2564 	int i, size = 0;
2565 
2566 	if (!(ill_capabilities & (ILL_CAPAB_AH | ILL_CAPAB_ESP)))
2567 		return;
2568 
2569 	ASSERT(cap_ah != NULL || !(ill_capabilities & ILL_CAPAB_AH));
2570 	ASSERT(cap_esp != NULL || !(ill_capabilities & ILL_CAPAB_ESP));
2571 
2572 	/* Find out the number of ciphers for AH */
2573 	if (cap_ah != NULL) {
2574 		for (i = 0; i < cap_ah->algs_size; i++) {
2575 			COUNT_1S(cap_ah->auth_hw_algs[i], ah_cnt);
2576 			COUNT_1S(cap_ah->encr_hw_algs[i], ah_cnt);
2577 		}
2578 		if (ah_cnt > 0) {
2579 			size += sizeof (dl_capability_sub_t) +
2580 			    sizeof (dl_capab_ipsec_t);
2581 			/* dl_capab_ipsec_t contains one dl_capab_ipsec_alg_t */
2582 			ah_len = (ah_cnt - 1) * sizeof (dl_capab_ipsec_alg_t);
2583 			size += ah_len;
2584 		}
2585 	}
2586 
2587 	/* Find out the number of ciphers for ESP */
2588 	if (cap_esp != NULL) {
2589 		for (i = 0; i < cap_esp->algs_size; i++) {
2590 			COUNT_1S(cap_esp->auth_hw_algs[i], esp_cnt);
2591 			COUNT_1S(cap_esp->encr_hw_algs[i], esp_cnt);
2592 		}
2593 		if (esp_cnt > 0) {
2594 			size += sizeof (dl_capability_sub_t) +
2595 			    sizeof (dl_capab_ipsec_t);
2596 			/* dl_capab_ipsec_t contains one dl_capab_ipsec_alg_t */
2597 			esp_len = (esp_cnt - 1) * sizeof (dl_capab_ipsec_alg_t);
2598 			size += esp_len;
2599 		}
2600 	}
2601 
2602 	if (size == 0) {
2603 		ip1dbg(("ill_capability_ipsec_reset: capabilities exist but "
2604 		    "there's nothing to reset\n"));
2605 		return;
2606 	}
2607 
2608 	mp = allocb(size, BPRI_HI);
2609 	if (mp == NULL) {
2610 		ip1dbg(("ill_capability_ipsec_reset: unable to allocate "
2611 		    "request to disable IPSEC Hardware Acceleration\n"));
2612 		return;
2613 	}
2614 
2615 	/*
2616 	 * Clear the capability flags for IPSec HA but retain the ill
2617 	 * capability structures since it's possible that another thread
2618 	 * is still referring to them.  The structures only get deallocated
2619 	 * when we destroy the ill.
2620 	 *
2621 	 * Various places check the flags to see if the ill is capable of
2622 	 * hardware acceleration, and by clearing them we ensure that new
2623 	 * outbound IPSec packets are sent down encrypted.
2624 	 */
2625 	ill->ill_capabilities &= ~(ILL_CAPAB_AH | ILL_CAPAB_ESP);
2626 
2627 	/* Fill in DL_CAPAB_IPSEC_AH sub-capability entries */
2628 	if (ah_cnt > 0) {
2629 		ill_fill_ipsec_reset(ah_cnt, DL_CAPAB_IPSEC_AH, ah_len,
2630 		    cap_ah, mp);
2631 		ASSERT(mp->b_rptr + size >= mp->b_wptr);
2632 	}
2633 
2634 	/* Fill in DL_CAPAB_IPSEC_ESP sub-capability entries */
2635 	if (esp_cnt > 0) {
2636 		ill_fill_ipsec_reset(esp_cnt, DL_CAPAB_IPSEC_ESP, esp_len,
2637 		    cap_esp, mp);
2638 		ASSERT(mp->b_rptr + size >= mp->b_wptr);
2639 	}
2640 
2641 	/*
2642 	 * At this point we've composed a bunch of sub-capabilities to be
2643 	 * encapsulated in a DL_CAPABILITY_REQ and later sent downstream
2644 	 * by the caller.  Upon receiving this reset message, the driver
2645 	 * must stop inbound decryption (by destroying all inbound SAs)
2646 	 * and let the corresponding packets come in encrypted.
2647 	 */
2648 
2649 	if (*sc_mp != NULL)
2650 		linkb(*sc_mp, mp);
2651 	else
2652 		*sc_mp = mp;
2653 }
2654 
2655 static void
2656 ill_capability_dispatch(ill_t *ill, mblk_t *mp, dl_capability_sub_t *subp,
2657     boolean_t encapsulated)
2658 {
2659 	boolean_t legacy = B_FALSE;
2660 
2661 	/*
2662 	 * If this DL_CAPABILITY_ACK came in as a response to our "reset"
2663 	 * DL_CAPABILITY_REQ, ignore it during this cycle.  We've just
2664 	 * instructed the driver to disable its advertised capabilities,
2665 	 * so there's no point in accepting any response at this moment.
2666 	 */
2667 	if (ill->ill_dlpi_capab_state == IDS_UNKNOWN)
2668 		return;
2669 
2670 	/*
2671 	 * Note that only the following two sub-capabilities may be
2672 	 * considered as "legacy", since their original definitions
2673 	 * do not incorporate the dl_mid_t module ID token, and hence
2674 	 * may require the use of the wrapper sub-capability.
2675 	 */
2676 	switch (subp->dl_cap) {
2677 	case DL_CAPAB_IPSEC_AH:
2678 	case DL_CAPAB_IPSEC_ESP:
2679 		legacy = B_TRUE;
2680 		break;
2681 	}
2682 
2683 	/*
2684 	 * For legacy sub-capabilities which don't incorporate a queue_t
2685 	 * pointer in their structures, discard them if we detect that
2686 	 * there are intermediate modules in between IP and the driver.
2687 	 */
2688 	if (!encapsulated && legacy && ill->ill_lmod_cnt > 1) {
2689 		ip1dbg(("ill_capability_dispatch: unencapsulated capab type "
2690 		    "%d discarded; %d module(s) present below IP\n",
2691 		    subp->dl_cap, ill->ill_lmod_cnt));
2692 		return;
2693 	}
2694 
2695 	switch (subp->dl_cap) {
2696 	case DL_CAPAB_IPSEC_AH:
2697 	case DL_CAPAB_IPSEC_ESP:
2698 		ill_capability_ipsec_ack(ill, mp, subp);
2699 		break;
2700 	case DL_CAPAB_MDT:
2701 		ill_capability_mdt_ack(ill, mp, subp);
2702 		break;
2703 	case DL_CAPAB_HCKSUM:
2704 		ill_capability_hcksum_ack(ill, mp, subp);
2705 		break;
2706 	case DL_CAPAB_ZEROCOPY:
2707 		ill_capability_zerocopy_ack(ill, mp, subp);
2708 		break;
2709 	case DL_CAPAB_POLL:
2710 		if (!SOFT_RINGS_ENABLED())
2711 			ill_capability_dls_ack(ill, mp, subp);
2712 		break;
2713 	case DL_CAPAB_SOFT_RING:
2714 		if (SOFT_RINGS_ENABLED())
2715 			ill_capability_dls_ack(ill, mp, subp);
2716 		break;
2717 	case DL_CAPAB_LSO:
2718 		ill_capability_lso_ack(ill, mp, subp);
2719 		break;
2720 	default:
2721 		ip1dbg(("ill_capability_dispatch: unknown capab type %d\n",
2722 		    subp->dl_cap));
2723 	}
2724 }
2725 
2726 /*
2727  * As part of negotiating polling capability, the driver tells us
2728  * the default (or normal) blanking interval and packet threshold
2729  * (the receive timer fires if blanking interval is reached or
2730  * the packet threshold is reached).
2731  *
2732  * As part of manipulating the polling interval, we always use our
2733  * estimated interval (avg service time * number of packets queued
2734  * on the squeue) but we try to blank for a minimum of
2735  * rr_normal_blank_time * rr_max_blank_ratio. We disable the
2736  * packet threshold during this time. When we are not in polling mode
2737  * we set the blank interval typically lower, rr_normal_pkt_cnt *
2738  * rr_min_blank_ratio but up the packet cnt by a ratio of
2739  * rr_min_pkt_cnt_ratio so that we are still getting chains if
2740  * possible although for a shorter interval.
2741  */
2742 #define	RR_MAX_BLANK_RATIO	20
2743 #define	RR_MIN_BLANK_RATIO	10
2744 #define	RR_MAX_PKT_CNT_RATIO	3
2745 #define	RR_MIN_PKT_CNT_RATIO	3
2746 
2747 /*
2748  * These can be tuned via /etc/system.
2749  */
2750 int rr_max_blank_ratio = RR_MAX_BLANK_RATIO;
2751 int rr_min_blank_ratio = RR_MIN_BLANK_RATIO;
2752 int rr_max_pkt_cnt_ratio = RR_MAX_PKT_CNT_RATIO;
2753 int rr_min_pkt_cnt_ratio = RR_MIN_PKT_CNT_RATIO;
2754 
2755 static mac_resource_handle_t
2756 ill_ring_add(void *arg, mac_resource_t *mrp)
2757 {
2758 	ill_t			*ill = (ill_t *)arg;
2759 	mac_rx_fifo_t		*mrfp = (mac_rx_fifo_t *)mrp;
2760 	ill_rx_ring_t		*rx_ring;
2761 	int			ip_rx_index;
2762 
2763 	ASSERT(mrp != NULL);
2764 	if (mrp->mr_type != MAC_RX_FIFO) {
2765 		return (NULL);
2766 	}
2767 	ASSERT(ill != NULL);
2768 	ASSERT(ill->ill_dls_capab != NULL);
2769 
2770 	mutex_enter(&ill->ill_lock);
2771 	for (ip_rx_index = 0; ip_rx_index < ILL_MAX_RINGS; ip_rx_index++) {
2772 		rx_ring = &ill->ill_dls_capab->ill_ring_tbl[ip_rx_index];
2773 		ASSERT(rx_ring != NULL);
2774 
2775 		if (rx_ring->rr_ring_state == ILL_RING_FREE) {
2776 			time_t normal_blank_time =
2777 			    mrfp->mrf_normal_blank_time;
2778 			uint_t normal_pkt_cnt =
2779 			    mrfp->mrf_normal_pkt_count;
2780 
2781 			bzero(rx_ring, sizeof (ill_rx_ring_t));
2782 
2783 			rx_ring->rr_blank = mrfp->mrf_blank;
2784 			rx_ring->rr_handle = mrfp->mrf_arg;
2785 			rx_ring->rr_ill = ill;
2786 			rx_ring->rr_normal_blank_time = normal_blank_time;
2787 			rx_ring->rr_normal_pkt_cnt = normal_pkt_cnt;
2788 
2789 			rx_ring->rr_max_blank_time =
2790 			    normal_blank_time * rr_max_blank_ratio;
2791 			rx_ring->rr_min_blank_time =
2792 			    normal_blank_time * rr_min_blank_ratio;
2793 			rx_ring->rr_max_pkt_cnt =
2794 			    normal_pkt_cnt * rr_max_pkt_cnt_ratio;
2795 			rx_ring->rr_min_pkt_cnt =
2796 			    normal_pkt_cnt * rr_min_pkt_cnt_ratio;
2797 
2798 			rx_ring->rr_ring_state = ILL_RING_INUSE;
2799 			mutex_exit(&ill->ill_lock);
2800 
2801 			DTRACE_PROBE2(ill__ring__add, (void *), ill,
2802 			    (int), ip_rx_index);
2803 			return ((mac_resource_handle_t)rx_ring);
2804 		}
2805 	}
2806 
2807 	/*
2808 	 * We ran out of ILL_MAX_RINGS worth rx_ring structures. If
2809 	 * we have devices which can overwhelm this limit, ILL_MAX_RING
2810 	 * should be made configurable. Meanwhile it cause no panic because
2811 	 * driver will pass ip_input a NULL handle which will make
2812 	 * IP allocate the default squeue and Polling mode will not
2813 	 * be used for this ring.
2814 	 */
2815 	cmn_err(CE_NOTE, "Reached maximum number of receiving rings (%d) "
2816 	    "for %s\n", ILL_MAX_RINGS, ill->ill_name);
2817 
2818 	mutex_exit(&ill->ill_lock);
2819 	return (NULL);
2820 }
2821 
2822 static boolean_t
2823 ill_capability_dls_init(ill_t *ill)
2824 {
2825 	ill_dls_capab_t	*ill_dls = ill->ill_dls_capab;
2826 	conn_t 			*connp;
2827 	size_t			sz;
2828 
2829 	if (ill->ill_capabilities & ILL_CAPAB_SOFT_RING) {
2830 		if (ill_dls == NULL) {
2831 			cmn_err(CE_PANIC, "ill_capability_dls_init: "
2832 			    "soft_ring enabled for ill=%s (%p) but data "
2833 			    "structs uninitialized\n", ill->ill_name,
2834 			    (void *)ill);
2835 		}
2836 		return (B_TRUE);
2837 	} else if (ill->ill_capabilities & ILL_CAPAB_POLL) {
2838 		if (ill_dls == NULL) {
2839 			cmn_err(CE_PANIC, "ill_capability_dls_init: "
2840 			    "polling enabled for ill=%s (%p) but data "
2841 			    "structs uninitialized\n", ill->ill_name,
2842 			(void *)ill);
2843 		}
2844 		return (B_TRUE);
2845 	}
2846 
2847 	if (ill_dls != NULL) {
2848 		ill_rx_ring_t 	*rx_ring = ill_dls->ill_ring_tbl;
2849 		/* Soft_Ring or polling is being re-enabled */
2850 
2851 		connp = ill_dls->ill_unbind_conn;
2852 		ASSERT(rx_ring != NULL);
2853 		bzero((void *)ill_dls, sizeof (ill_dls_capab_t));
2854 		bzero((void *)rx_ring,
2855 		    sizeof (ill_rx_ring_t) * ILL_MAX_RINGS);
2856 		ill_dls->ill_ring_tbl = rx_ring;
2857 		ill_dls->ill_unbind_conn = connp;
2858 		return (B_TRUE);
2859 	}
2860 
2861 	if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP)) == NULL)
2862 		return (B_FALSE);
2863 
2864 	sz = sizeof (ill_dls_capab_t);
2865 	sz += sizeof (ill_rx_ring_t) * ILL_MAX_RINGS;
2866 
2867 	ill_dls = kmem_zalloc(sz, KM_NOSLEEP);
2868 	if (ill_dls == NULL) {
2869 		cmn_err(CE_WARN, "ill_capability_dls_init: could not "
2870 		    "allocate dls_capab for %s (%p)\n", ill->ill_name,
2871 		    (void *)ill);
2872 		CONN_DEC_REF(connp);
2873 		return (B_FALSE);
2874 	}
2875 
2876 	/* Allocate space to hold ring table */
2877 	ill_dls->ill_ring_tbl = (ill_rx_ring_t *)&ill_dls[1];
2878 	ill->ill_dls_capab = ill_dls;
2879 	ill_dls->ill_unbind_conn = connp;
2880 	return (B_TRUE);
2881 }
2882 
2883 /*
2884  * ill_capability_dls_disable: disable soft_ring and/or polling
2885  * capability. Since any of the rings might already be in use, need
2886  * to call ipsq_clean_all() which gets behind the squeue to disable
2887  * direct calls if necessary.
2888  */
2889 static void
2890 ill_capability_dls_disable(ill_t *ill)
2891 {
2892 	ill_dls_capab_t	*ill_dls = ill->ill_dls_capab;
2893 
2894 	if (ill->ill_capabilities & ILL_CAPAB_DLS) {
2895 		ipsq_clean_all(ill);
2896 		ill_dls->ill_tx = NULL;
2897 		ill_dls->ill_tx_handle = NULL;
2898 		ill_dls->ill_dls_change_status = NULL;
2899 		ill_dls->ill_dls_bind = NULL;
2900 		ill_dls->ill_dls_unbind = NULL;
2901 	}
2902 
2903 	ASSERT(!(ill->ill_capabilities & ILL_CAPAB_DLS));
2904 }
2905 
2906 static void
2907 ill_capability_dls_capable(ill_t *ill, dl_capab_dls_t *idls,
2908     dl_capability_sub_t *isub)
2909 {
2910 	uint_t			size;
2911 	uchar_t			*rptr;
2912 	dl_capab_dls_t	dls, *odls;
2913 	ill_dls_capab_t	*ill_dls;
2914 	mblk_t			*nmp = NULL;
2915 	dl_capability_req_t	*ocap;
2916 	uint_t			sub_dl_cap = isub->dl_cap;
2917 
2918 	if (!ill_capability_dls_init(ill))
2919 		return;
2920 	ill_dls = ill->ill_dls_capab;
2921 
2922 	/* Copy locally to get the members aligned */
2923 	bcopy((void *)idls, (void *)&dls,
2924 	    sizeof (dl_capab_dls_t));
2925 
2926 	/* Get the tx function and handle from dld */
2927 	ill_dls->ill_tx = (ip_dld_tx_t)dls.dls_tx;
2928 	ill_dls->ill_tx_handle = (void *)dls.dls_tx_handle;
2929 
2930 	if (sub_dl_cap == DL_CAPAB_SOFT_RING) {
2931 		ill_dls->ill_dls_change_status =
2932 		    (ip_dls_chg_soft_ring_t)dls.dls_ring_change_status;
2933 		ill_dls->ill_dls_bind = (ip_dls_bind_t)dls.dls_ring_bind;
2934 		ill_dls->ill_dls_unbind =
2935 		    (ip_dls_unbind_t)dls.dls_ring_unbind;
2936 		ill_dls->ill_dls_soft_ring_cnt = ip_soft_rings_cnt;
2937 	}
2938 
2939 	size = sizeof (dl_capability_req_t) + sizeof (dl_capability_sub_t) +
2940 	    isub->dl_length;
2941 
2942 	if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2943 		cmn_err(CE_WARN, "ill_capability_dls_capable: could "
2944 		    "not allocate memory for CAPAB_REQ for %s (%p)\n",
2945 		    ill->ill_name, (void *)ill);
2946 		return;
2947 	}
2948 
2949 	/* initialize dl_capability_req_t */
2950 	rptr = nmp->b_rptr;
2951 	ocap = (dl_capability_req_t *)rptr;
2952 	ocap->dl_sub_offset = sizeof (dl_capability_req_t);
2953 	ocap->dl_sub_length = sizeof (dl_capability_sub_t) + isub->dl_length;
2954 	rptr += sizeof (dl_capability_req_t);
2955 
2956 	/* initialize dl_capability_sub_t */
2957 	bcopy(isub, rptr, sizeof (*isub));
2958 	rptr += sizeof (*isub);
2959 
2960 	odls = (dl_capab_dls_t *)rptr;
2961 	rptr += sizeof (dl_capab_dls_t);
2962 
2963 	/* initialize dl_capab_dls_t to be sent down */
2964 	dls.dls_rx_handle = (uintptr_t)ill;
2965 	dls.dls_rx = (uintptr_t)ip_input;
2966 	dls.dls_ring_add = (uintptr_t)ill_ring_add;
2967 
2968 	if (sub_dl_cap == DL_CAPAB_SOFT_RING) {
2969 		dls.dls_ring_cnt = ip_soft_rings_cnt;
2970 		dls.dls_ring_assign = (uintptr_t)ip_soft_ring_assignment;
2971 		dls.dls_flags = SOFT_RING_ENABLE;
2972 	} else {
2973 		dls.dls_flags = POLL_ENABLE;
2974 		ip1dbg(("ill_capability_dls_capable: asking interface %s "
2975 		    "to enable polling\n", ill->ill_name));
2976 	}
2977 	bcopy((void *)&dls, (void *)odls,
2978 	    sizeof (dl_capab_dls_t));
2979 	ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
2980 	/*
2981 	 * nmp points to a DL_CAPABILITY_REQ message to
2982 	 * enable either soft_ring or polling
2983 	 */
2984 	ill_dlpi_send(ill, nmp);
2985 }
2986 
2987 static void
2988 ill_capability_dls_reset(ill_t *ill, mblk_t **sc_mp)
2989 {
2990 	mblk_t *mp;
2991 	dl_capab_dls_t *idls;
2992 	dl_capability_sub_t *dl_subcap;
2993 	int size;
2994 
2995 	if (!(ill->ill_capabilities & ILL_CAPAB_DLS))
2996 		return;
2997 
2998 	ASSERT(ill->ill_dls_capab != NULL);
2999 
3000 	size = sizeof (*dl_subcap) + sizeof (*idls);
3001 
3002 	mp = allocb(size, BPRI_HI);
3003 	if (mp == NULL) {
3004 		ip1dbg(("ill_capability_dls_reset: unable to allocate "
3005 		    "request to disable soft_ring\n"));
3006 		return;
3007 	}
3008 
3009 	mp->b_wptr = mp->b_rptr + size;
3010 
3011 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
3012 	dl_subcap->dl_length = sizeof (*idls);
3013 	if (ill->ill_capabilities & ILL_CAPAB_SOFT_RING)
3014 		dl_subcap->dl_cap = DL_CAPAB_SOFT_RING;
3015 	else
3016 		dl_subcap->dl_cap = DL_CAPAB_POLL;
3017 
3018 	idls = (dl_capab_dls_t *)(dl_subcap + 1);
3019 	if (ill->ill_capabilities & ILL_CAPAB_SOFT_RING)
3020 		idls->dls_flags = SOFT_RING_DISABLE;
3021 	else
3022 		idls->dls_flags = POLL_DISABLE;
3023 
3024 	if (*sc_mp != NULL)
3025 		linkb(*sc_mp, mp);
3026 	else
3027 		*sc_mp = mp;
3028 }
3029 
3030 /*
3031  * Process a soft_ring/poll capability negotiation ack received
3032  * from a DLS Provider.isub must point to the sub-capability
3033  * (DL_CAPAB_SOFT_RING/DL_CAPAB_POLL) of a DL_CAPABILITY_ACK message.
3034  */
3035 static void
3036 ill_capability_dls_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
3037 {
3038 	dl_capab_dls_t		*idls;
3039 	uint_t			sub_dl_cap = isub->dl_cap;
3040 	uint8_t			*capend;
3041 
3042 	ASSERT(sub_dl_cap == DL_CAPAB_SOFT_RING ||
3043 	    sub_dl_cap == DL_CAPAB_POLL);
3044 
3045 	if (ill->ill_isv6)
3046 		return;
3047 
3048 	/*
3049 	 * Note: range checks here are not absolutely sufficient to
3050 	 * make us robust against malformed messages sent by drivers;
3051 	 * this is in keeping with the rest of IP's dlpi handling.
3052 	 * (Remember, it's coming from something else in the kernel
3053 	 * address space)
3054 	 */
3055 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
3056 	if (capend > mp->b_wptr) {
3057 		cmn_err(CE_WARN, "ill_capability_dls_ack: "
3058 		    "malformed sub-capability too long for mblk");
3059 		return;
3060 	}
3061 
3062 	/*
3063 	 * There are two types of acks we process here:
3064 	 * 1. acks in reply to a (first form) generic capability req
3065 	 *    (dls_flag will be set to SOFT_RING_CAPABLE or POLL_CAPABLE)
3066 	 * 2. acks in reply to a SOFT_RING_ENABLE or POLL_ENABLE
3067 	 *    capability req.
3068 	 */
3069 	idls = (dl_capab_dls_t *)(isub + 1);
3070 
3071 	if (!dlcapabcheckqid(&idls->dls_mid, ill->ill_lmod_rq)) {
3072 		ip1dbg(("ill_capability_dls_ack: mid token for dls "
3073 		    "capability isn't as expected; pass-thru "
3074 		    "module(s) detected, discarding capability\n"));
3075 		if (ill->ill_capabilities & ILL_CAPAB_DLS) {
3076 			/*
3077 			 * This is a capability renegotitation case.
3078 			 * The interface better be unusable at this
3079 			 * point other wise bad things will happen
3080 			 * if we disable direct calls on a running
3081 			 * and up interface.
3082 			 */
3083 			ill_capability_dls_disable(ill);
3084 		}
3085 		return;
3086 	}
3087 
3088 	switch (idls->dls_flags) {
3089 	default:
3090 		/* Disable if unknown flag */
3091 	case SOFT_RING_DISABLE:
3092 	case POLL_DISABLE:
3093 		ill_capability_dls_disable(ill);
3094 		break;
3095 	case SOFT_RING_CAPABLE:
3096 	case POLL_CAPABLE:
3097 		/*
3098 		 * If the capability was already enabled, its safe
3099 		 * to disable it first to get rid of stale information
3100 		 * and then start enabling it again.
3101 		 */
3102 		ill_capability_dls_disable(ill);
3103 		ill_capability_dls_capable(ill, idls, isub);
3104 		break;
3105 	case SOFT_RING_ENABLE:
3106 	case POLL_ENABLE:
3107 		mutex_enter(&ill->ill_lock);
3108 		if (sub_dl_cap == DL_CAPAB_SOFT_RING &&
3109 		    !(ill->ill_capabilities & ILL_CAPAB_SOFT_RING)) {
3110 			ASSERT(ill->ill_dls_capab != NULL);
3111 			ill->ill_capabilities |= ILL_CAPAB_SOFT_RING;
3112 		}
3113 		if (sub_dl_cap == DL_CAPAB_POLL &&
3114 		    !(ill->ill_capabilities & ILL_CAPAB_POLL)) {
3115 			ASSERT(ill->ill_dls_capab != NULL);
3116 			ill->ill_capabilities |= ILL_CAPAB_POLL;
3117 			ip1dbg(("ill_capability_dls_ack: interface %s "
3118 			    "has enabled polling\n", ill->ill_name));
3119 		}
3120 		mutex_exit(&ill->ill_lock);
3121 		break;
3122 	}
3123 }
3124 
3125 /*
3126  * Process a hardware checksum offload capability negotiation ack received
3127  * from a DLS Provider.isub must point to the sub-capability (DL_CAPAB_HCKSUM)
3128  * of a DL_CAPABILITY_ACK message.
3129  */
3130 static void
3131 ill_capability_hcksum_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
3132 {
3133 	dl_capability_req_t	*ocap;
3134 	dl_capab_hcksum_t	*ihck, *ohck;
3135 	ill_hcksum_capab_t	**ill_hcksum;
3136 	mblk_t			*nmp = NULL;
3137 	uint_t			sub_dl_cap = isub->dl_cap;
3138 	uint8_t			*capend;
3139 
3140 	ASSERT(sub_dl_cap == DL_CAPAB_HCKSUM);
3141 
3142 	ill_hcksum = (ill_hcksum_capab_t **)&ill->ill_hcksum_capab;
3143 
3144 	/*
3145 	 * Note: range checks here are not absolutely sufficient to
3146 	 * make us robust against malformed messages sent by drivers;
3147 	 * this is in keeping with the rest of IP's dlpi handling.
3148 	 * (Remember, it's coming from something else in the kernel
3149 	 * address space)
3150 	 */
3151 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
3152 	if (capend > mp->b_wptr) {
3153 		cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
3154 		    "malformed sub-capability too long for mblk");
3155 		return;
3156 	}
3157 
3158 	/*
3159 	 * There are two types of acks we process here:
3160 	 * 1. acks in reply to a (first form) generic capability req
3161 	 *    (no ENABLE flag set)
3162 	 * 2. acks in reply to a ENABLE capability req.
3163 	 *    (ENABLE flag set)
3164 	 */
3165 	ihck = (dl_capab_hcksum_t *)(isub + 1);
3166 
3167 	if (ihck->hcksum_version != HCKSUM_VERSION_1) {
3168 		cmn_err(CE_CONT, "ill_capability_hcksum_ack: "
3169 		    "unsupported hardware checksum "
3170 		    "sub-capability (version %d, expected %d)",
3171 		    ihck->hcksum_version, HCKSUM_VERSION_1);
3172 		return;
3173 	}
3174 
3175 	if (!dlcapabcheckqid(&ihck->hcksum_mid, ill->ill_lmod_rq)) {
3176 		ip1dbg(("ill_capability_hcksum_ack: mid token for hardware "
3177 		    "checksum capability isn't as expected; pass-thru "
3178 		    "module(s) detected, discarding capability\n"));
3179 		return;
3180 	}
3181 
3182 #define	CURR_HCKSUM_CAPAB				\
3183 	(HCKSUM_INET_PARTIAL | HCKSUM_INET_FULL_V4 |	\
3184 	HCKSUM_INET_FULL_V6 | HCKSUM_IPHDRCKSUM)
3185 
3186 	if ((ihck->hcksum_txflags & HCKSUM_ENABLE) &&
3187 	    (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB)) {
3188 		/* do ENABLE processing */
3189 		if (*ill_hcksum == NULL) {
3190 			*ill_hcksum = kmem_zalloc(sizeof (ill_hcksum_capab_t),
3191 			    KM_NOSLEEP);
3192 
3193 			if (*ill_hcksum == NULL) {
3194 				cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
3195 				    "could not enable hcksum version %d "
3196 				    "for %s (ENOMEM)\n", HCKSUM_CURRENT_VERSION,
3197 				    ill->ill_name);
3198 				return;
3199 			}
3200 		}
3201 
3202 		(*ill_hcksum)->ill_hcksum_version = ihck->hcksum_version;
3203 		(*ill_hcksum)->ill_hcksum_txflags = ihck->hcksum_txflags;
3204 		ill->ill_capabilities |= ILL_CAPAB_HCKSUM;
3205 		ip1dbg(("ill_capability_hcksum_ack: interface %s "
3206 		    "has enabled hardware checksumming\n ",
3207 		    ill->ill_name));
3208 	} else if (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB) {
3209 		/*
3210 		 * Enabling hardware checksum offload
3211 		 * Currently IP supports {TCP,UDP}/IPv4
3212 		 * partial and full cksum offload and
3213 		 * IPv4 header checksum offload.
3214 		 * Allocate new mblk which will
3215 		 * contain a new capability request
3216 		 * to enable hardware checksum offload.
3217 		 */
3218 		uint_t	size;
3219 		uchar_t	*rptr;
3220 
3221 		size = sizeof (dl_capability_req_t) +
3222 		    sizeof (dl_capability_sub_t) + isub->dl_length;
3223 
3224 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
3225 			cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
3226 			    "could not enable hardware cksum for %s (ENOMEM)\n",
3227 			    ill->ill_name);
3228 			return;
3229 		}
3230 
3231 		rptr = nmp->b_rptr;
3232 		/* initialize dl_capability_req_t */
3233 		ocap = (dl_capability_req_t *)nmp->b_rptr;
3234 		ocap->dl_sub_offset =
3235 		    sizeof (dl_capability_req_t);
3236 		ocap->dl_sub_length =
3237 		    sizeof (dl_capability_sub_t) +
3238 		    isub->dl_length;
3239 		nmp->b_rptr += sizeof (dl_capability_req_t);
3240 
3241 		/* initialize dl_capability_sub_t */
3242 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
3243 		nmp->b_rptr += sizeof (*isub);
3244 
3245 		/* initialize dl_capab_hcksum_t */
3246 		ohck = (dl_capab_hcksum_t *)nmp->b_rptr;
3247 		bcopy(ihck, ohck, sizeof (*ihck));
3248 
3249 		nmp->b_rptr = rptr;
3250 		ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
3251 
3252 		/* Set ENABLE flag */
3253 		ohck->hcksum_txflags &= CURR_HCKSUM_CAPAB;
3254 		ohck->hcksum_txflags |= HCKSUM_ENABLE;
3255 
3256 		/*
3257 		 * nmp points to a DL_CAPABILITY_REQ message to enable
3258 		 * hardware checksum acceleration.
3259 		 */
3260 		ill_dlpi_send(ill, nmp);
3261 	} else {
3262 		ip1dbg(("ill_capability_hcksum_ack: interface %s has "
3263 		    "advertised %x hardware checksum capability flags\n",
3264 		    ill->ill_name, ihck->hcksum_txflags));
3265 	}
3266 }
3267 
3268 static void
3269 ill_capability_hcksum_reset(ill_t *ill, mblk_t **sc_mp)
3270 {
3271 	mblk_t *mp;
3272 	dl_capab_hcksum_t *hck_subcap;
3273 	dl_capability_sub_t *dl_subcap;
3274 	int size;
3275 
3276 	if (!ILL_HCKSUM_CAPABLE(ill))
3277 		return;
3278 
3279 	ASSERT(ill->ill_hcksum_capab != NULL);
3280 	/*
3281 	 * Clear the capability flag for hardware checksum offload but
3282 	 * retain the ill_hcksum_capab structure since it's possible that
3283 	 * another thread is still referring to it.  The structure only
3284 	 * gets deallocated when we destroy the ill.
3285 	 */
3286 	ill->ill_capabilities &= ~ILL_CAPAB_HCKSUM;
3287 
3288 	size = sizeof (*dl_subcap) + sizeof (*hck_subcap);
3289 
3290 	mp = allocb(size, BPRI_HI);
3291 	if (mp == NULL) {
3292 		ip1dbg(("ill_capability_hcksum_reset: unable to allocate "
3293 		    "request to disable hardware checksum offload\n"));
3294 		return;
3295 	}
3296 
3297 	mp->b_wptr = mp->b_rptr + size;
3298 
3299 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
3300 	dl_subcap->dl_cap = DL_CAPAB_HCKSUM;
3301 	dl_subcap->dl_length = sizeof (*hck_subcap);
3302 
3303 	hck_subcap = (dl_capab_hcksum_t *)(dl_subcap + 1);
3304 	hck_subcap->hcksum_version = ill->ill_hcksum_capab->ill_hcksum_version;
3305 	hck_subcap->hcksum_txflags = 0;
3306 
3307 	if (*sc_mp != NULL)
3308 		linkb(*sc_mp, mp);
3309 	else
3310 		*sc_mp = mp;
3311 }
3312 
3313 static void
3314 ill_capability_zerocopy_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
3315 {
3316 	mblk_t *nmp = NULL;
3317 	dl_capability_req_t *oc;
3318 	dl_capab_zerocopy_t *zc_ic, *zc_oc;
3319 	ill_zerocopy_capab_t **ill_zerocopy_capab;
3320 	uint_t sub_dl_cap = isub->dl_cap;
3321 	uint8_t *capend;
3322 
3323 	ASSERT(sub_dl_cap == DL_CAPAB_ZEROCOPY);
3324 
3325 	ill_zerocopy_capab = (ill_zerocopy_capab_t **)&ill->ill_zerocopy_capab;
3326 
3327 	/*
3328 	 * Note: range checks here are not absolutely sufficient to
3329 	 * make us robust against malformed messages sent by drivers;
3330 	 * this is in keeping with the rest of IP's dlpi handling.
3331 	 * (Remember, it's coming from something else in the kernel
3332 	 * address space)
3333 	 */
3334 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
3335 	if (capend > mp->b_wptr) {
3336 		cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
3337 		    "malformed sub-capability too long for mblk");
3338 		return;
3339 	}
3340 
3341 	zc_ic = (dl_capab_zerocopy_t *)(isub + 1);
3342 	if (zc_ic->zerocopy_version != ZEROCOPY_VERSION_1) {
3343 		cmn_err(CE_CONT, "ill_capability_zerocopy_ack: "
3344 		    "unsupported ZEROCOPY sub-capability (version %d, "
3345 		    "expected %d)", zc_ic->zerocopy_version,
3346 		    ZEROCOPY_VERSION_1);
3347 		return;
3348 	}
3349 
3350 	if (!dlcapabcheckqid(&zc_ic->zerocopy_mid, ill->ill_lmod_rq)) {
3351 		ip1dbg(("ill_capability_zerocopy_ack: mid token for zerocopy "
3352 		    "capability isn't as expected; pass-thru module(s) "
3353 		    "detected, discarding capability\n"));
3354 		return;
3355 	}
3356 
3357 	if ((zc_ic->zerocopy_flags & DL_CAPAB_VMSAFE_MEM) != 0) {
3358 		if (*ill_zerocopy_capab == NULL) {
3359 			*ill_zerocopy_capab =
3360 			    kmem_zalloc(sizeof (ill_zerocopy_capab_t),
3361 			    KM_NOSLEEP);
3362 
3363 			if (*ill_zerocopy_capab == NULL) {
3364 				cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
3365 				    "could not enable Zero-copy version %d "
3366 				    "for %s (ENOMEM)\n", ZEROCOPY_VERSION_1,
3367 				    ill->ill_name);
3368 				return;
3369 			}
3370 		}
3371 
3372 		ip1dbg(("ill_capability_zerocopy_ack: interface %s "
3373 		    "supports Zero-copy version %d\n", ill->ill_name,
3374 		    ZEROCOPY_VERSION_1));
3375 
3376 		(*ill_zerocopy_capab)->ill_zerocopy_version =
3377 		    zc_ic->zerocopy_version;
3378 		(*ill_zerocopy_capab)->ill_zerocopy_flags =
3379 		    zc_ic->zerocopy_flags;
3380 
3381 		ill->ill_capabilities |= ILL_CAPAB_ZEROCOPY;
3382 	} else {
3383 		uint_t size;
3384 		uchar_t *rptr;
3385 
3386 		size = sizeof (dl_capability_req_t) +
3387 		    sizeof (dl_capability_sub_t) +
3388 		    sizeof (dl_capab_zerocopy_t);
3389 
3390 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
3391 			cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
3392 			    "could not enable zerocopy for %s (ENOMEM)\n",
3393 			    ill->ill_name);
3394 			return;
3395 		}
3396 
3397 		rptr = nmp->b_rptr;
3398 		/* initialize dl_capability_req_t */
3399 		oc = (dl_capability_req_t *)rptr;
3400 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
3401 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
3402 		    sizeof (dl_capab_zerocopy_t);
3403 		rptr += sizeof (dl_capability_req_t);
3404 
3405 		/* initialize dl_capability_sub_t */
3406 		bcopy(isub, rptr, sizeof (*isub));
3407 		rptr += sizeof (*isub);
3408 
3409 		/* initialize dl_capab_zerocopy_t */
3410 		zc_oc = (dl_capab_zerocopy_t *)rptr;
3411 		*zc_oc = *zc_ic;
3412 
3413 		ip1dbg(("ill_capability_zerocopy_ack: asking interface %s "
3414 		    "to enable zero-copy version %d\n", ill->ill_name,
3415 		    ZEROCOPY_VERSION_1));
3416 
3417 		/* set VMSAFE_MEM flag */
3418 		zc_oc->zerocopy_flags |= DL_CAPAB_VMSAFE_MEM;
3419 
3420 		/* nmp points to a DL_CAPABILITY_REQ message to enable zcopy */
3421 		ill_dlpi_send(ill, nmp);
3422 	}
3423 }
3424 
3425 static void
3426 ill_capability_zerocopy_reset(ill_t *ill, mblk_t **sc_mp)
3427 {
3428 	mblk_t *mp;
3429 	dl_capab_zerocopy_t *zerocopy_subcap;
3430 	dl_capability_sub_t *dl_subcap;
3431 	int size;
3432 
3433 	if (!(ill->ill_capabilities & ILL_CAPAB_ZEROCOPY))
3434 		return;
3435 
3436 	ASSERT(ill->ill_zerocopy_capab != NULL);
3437 	/*
3438 	 * Clear the capability flag for Zero-copy but retain the
3439 	 * ill_zerocopy_capab structure since it's possible that another
3440 	 * thread is still referring to it.  The structure only gets
3441 	 * deallocated when we destroy the ill.
3442 	 */
3443 	ill->ill_capabilities &= ~ILL_CAPAB_ZEROCOPY;
3444 
3445 	size = sizeof (*dl_subcap) + sizeof (*zerocopy_subcap);
3446 
3447 	mp = allocb(size, BPRI_HI);
3448 	if (mp == NULL) {
3449 		ip1dbg(("ill_capability_zerocopy_reset: unable to allocate "
3450 		    "request to disable Zero-copy\n"));
3451 		return;
3452 	}
3453 
3454 	mp->b_wptr = mp->b_rptr + size;
3455 
3456 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
3457 	dl_subcap->dl_cap = DL_CAPAB_ZEROCOPY;
3458 	dl_subcap->dl_length = sizeof (*zerocopy_subcap);
3459 
3460 	zerocopy_subcap = (dl_capab_zerocopy_t *)(dl_subcap + 1);
3461 	zerocopy_subcap->zerocopy_version =
3462 	    ill->ill_zerocopy_capab->ill_zerocopy_version;
3463 	zerocopy_subcap->zerocopy_flags = 0;
3464 
3465 	if (*sc_mp != NULL)
3466 		linkb(*sc_mp, mp);
3467 	else
3468 		*sc_mp = mp;
3469 }
3470 
3471 /*
3472  * Process Large Segment Offload capability negotiation ack received from a
3473  * DLS Provider.  isub must point to the sub-capability (DL_CAPAB_LSO) of a
3474  * DL_CAPABILITY_ACK message.
3475  */
3476 static void
3477 ill_capability_lso_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
3478 {
3479 	mblk_t *nmp = NULL;
3480 	dl_capability_req_t *oc;
3481 	dl_capab_lso_t *lso_ic, *lso_oc;
3482 	ill_lso_capab_t **ill_lso_capab;
3483 	uint_t sub_dl_cap = isub->dl_cap;
3484 	uint8_t *capend;
3485 
3486 	ASSERT(sub_dl_cap == DL_CAPAB_LSO);
3487 
3488 	ill_lso_capab = (ill_lso_capab_t **)&ill->ill_lso_capab;
3489 
3490 	/*
3491 	 * Note: range checks here are not absolutely sufficient to
3492 	 * make us robust against malformed messages sent by drivers;
3493 	 * this is in keeping with the rest of IP's dlpi handling.
3494 	 * (Remember, it's coming from something else in the kernel
3495 	 * address space)
3496 	 */
3497 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
3498 	if (capend > mp->b_wptr) {
3499 		cmn_err(CE_WARN, "ill_capability_lso_ack: "
3500 		    "malformed sub-capability too long for mblk");
3501 		return;
3502 	}
3503 
3504 	lso_ic = (dl_capab_lso_t *)(isub + 1);
3505 
3506 	if (lso_ic->lso_version != LSO_VERSION_1) {
3507 		cmn_err(CE_CONT, "ill_capability_lso_ack: "
3508 		    "unsupported LSO sub-capability (version %d, expected %d)",
3509 		    lso_ic->lso_version, LSO_VERSION_1);
3510 		return;
3511 	}
3512 
3513 	if (!dlcapabcheckqid(&lso_ic->lso_mid, ill->ill_lmod_rq)) {
3514 		ip1dbg(("ill_capability_lso_ack: mid token for LSO "
3515 		    "capability isn't as expected; pass-thru module(s) "
3516 		    "detected, discarding capability\n"));
3517 		return;
3518 	}
3519 
3520 	if ((lso_ic->lso_flags & LSO_TX_ENABLE) &&
3521 	    (lso_ic->lso_flags & LSO_TX_BASIC_TCP_IPV4)) {
3522 		if (*ill_lso_capab == NULL) {
3523 			*ill_lso_capab = kmem_zalloc(sizeof (ill_lso_capab_t),
3524 			    KM_NOSLEEP);
3525 
3526 			if (*ill_lso_capab == NULL) {
3527 				cmn_err(CE_WARN, "ill_capability_lso_ack: "
3528 				    "could not enable LSO version %d "
3529 				    "for %s (ENOMEM)\n", LSO_VERSION_1,
3530 				    ill->ill_name);
3531 				return;
3532 			}
3533 		}
3534 
3535 		(*ill_lso_capab)->ill_lso_version = lso_ic->lso_version;
3536 		(*ill_lso_capab)->ill_lso_flags = lso_ic->lso_flags;
3537 		(*ill_lso_capab)->ill_lso_max = lso_ic->lso_max;
3538 		ill->ill_capabilities |= ILL_CAPAB_LSO;
3539 
3540 		ip1dbg(("ill_capability_lso_ack: interface %s "
3541 		    "has enabled LSO\n ", ill->ill_name));
3542 	} else if (lso_ic->lso_flags & LSO_TX_BASIC_TCP_IPV4) {
3543 		uint_t size;
3544 		uchar_t *rptr;
3545 
3546 		size = sizeof (dl_capability_req_t) +
3547 		    sizeof (dl_capability_sub_t) + sizeof (dl_capab_lso_t);
3548 
3549 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
3550 			cmn_err(CE_WARN, "ill_capability_lso_ack: "
3551 			    "could not enable LSO for %s (ENOMEM)\n",
3552 			    ill->ill_name);
3553 			return;
3554 		}
3555 
3556 		rptr = nmp->b_rptr;
3557 		/* initialize dl_capability_req_t */
3558 		oc = (dl_capability_req_t *)nmp->b_rptr;
3559 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
3560 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
3561 		    sizeof (dl_capab_lso_t);
3562 		nmp->b_rptr += sizeof (dl_capability_req_t);
3563 
3564 		/* initialize dl_capability_sub_t */
3565 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
3566 		nmp->b_rptr += sizeof (*isub);
3567 
3568 		/* initialize dl_capab_lso_t */
3569 		lso_oc = (dl_capab_lso_t *)nmp->b_rptr;
3570 		bcopy(lso_ic, lso_oc, sizeof (*lso_ic));
3571 
3572 		nmp->b_rptr = rptr;
3573 		ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
3574 
3575 		/* set ENABLE flag */
3576 		lso_oc->lso_flags |= LSO_TX_ENABLE;
3577 
3578 		/* nmp points to a DL_CAPABILITY_REQ message to enable LSO */
3579 		ill_dlpi_send(ill, nmp);
3580 	} else {
3581 		ip1dbg(("ill_capability_lso_ack: interface %s has "
3582 		    "advertised %x LSO capability flags\n",
3583 		    ill->ill_name, lso_ic->lso_flags));
3584 	}
3585 }
3586 
3587 
3588 static void
3589 ill_capability_lso_reset(ill_t *ill, mblk_t **sc_mp)
3590 {
3591 	mblk_t *mp;
3592 	dl_capab_lso_t *lso_subcap;
3593 	dl_capability_sub_t *dl_subcap;
3594 	int size;
3595 
3596 	if (!(ill->ill_capabilities & ILL_CAPAB_LSO))
3597 		return;
3598 
3599 	ASSERT(ill->ill_lso_capab != NULL);
3600 	/*
3601 	 * Clear the capability flag for LSO but retain the
3602 	 * ill_lso_capab structure since it's possible that another
3603 	 * thread is still referring to it.  The structure only gets
3604 	 * deallocated when we destroy the ill.
3605 	 */
3606 	ill->ill_capabilities &= ~ILL_CAPAB_LSO;
3607 
3608 	size = sizeof (*dl_subcap) + sizeof (*lso_subcap);
3609 
3610 	mp = allocb(size, BPRI_HI);
3611 	if (mp == NULL) {
3612 		ip1dbg(("ill_capability_lso_reset: unable to allocate "
3613 		    "request to disable LSO\n"));
3614 		return;
3615 	}
3616 
3617 	mp->b_wptr = mp->b_rptr + size;
3618 
3619 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
3620 	dl_subcap->dl_cap = DL_CAPAB_LSO;
3621 	dl_subcap->dl_length = sizeof (*lso_subcap);
3622 
3623 	lso_subcap = (dl_capab_lso_t *)(dl_subcap + 1);
3624 	lso_subcap->lso_version = ill->ill_lso_capab->ill_lso_version;
3625 	lso_subcap->lso_flags = 0;
3626 
3627 	if (*sc_mp != NULL)
3628 		linkb(*sc_mp, mp);
3629 	else
3630 		*sc_mp = mp;
3631 }
3632 
3633 /*
3634  * Consume a new-style hardware capabilities negotiation ack.
3635  * Called from ip_rput_dlpi_writer().
3636  */
3637 void
3638 ill_capability_ack(ill_t *ill, mblk_t *mp)
3639 {
3640 	dl_capability_ack_t *capp;
3641 	dl_capability_sub_t *subp, *endp;
3642 
3643 	if (ill->ill_dlpi_capab_state == IDS_INPROGRESS)
3644 		ill->ill_dlpi_capab_state = IDS_OK;
3645 
3646 	capp = (dl_capability_ack_t *)mp->b_rptr;
3647 
3648 	if (capp->dl_sub_length == 0)
3649 		/* no new-style capabilities */
3650 		return;
3651 
3652 	/* make sure the driver supplied correct dl_sub_length */
3653 	if ((sizeof (*capp) + capp->dl_sub_length) > MBLKL(mp)) {
3654 		ip0dbg(("ill_capability_ack: bad DL_CAPABILITY_ACK, "
3655 		    "invalid dl_sub_length (%d)\n", capp->dl_sub_length));
3656 		return;
3657 	}
3658 
3659 #define	SC(base, offset) (dl_capability_sub_t *)(((uchar_t *)(base))+(offset))
3660 	/*
3661 	 * There are sub-capabilities. Process the ones we know about.
3662 	 * Loop until we don't have room for another sub-cap header..
3663 	 */
3664 	for (subp = SC(capp, capp->dl_sub_offset),
3665 	    endp = SC(subp, capp->dl_sub_length - sizeof (*subp));
3666 	    subp <= endp;
3667 	    subp = SC(subp, sizeof (dl_capability_sub_t) + subp->dl_length)) {
3668 
3669 		switch (subp->dl_cap) {
3670 		case DL_CAPAB_ID_WRAPPER:
3671 			ill_capability_id_ack(ill, mp, subp);
3672 			break;
3673 		default:
3674 			ill_capability_dispatch(ill, mp, subp, B_FALSE);
3675 			break;
3676 		}
3677 	}
3678 #undef SC
3679 }
3680 
3681 /*
3682  * This routine is called to scan the fragmentation reassembly table for
3683  * the specified ILL for any packets that are starting to smell.
3684  * dead_interval is the maximum time in seconds that will be tolerated.  It
3685  * will either be the value specified in ip_g_frag_timeout, or zero if the
3686  * ILL is shutting down and it is time to blow everything off.
3687  *
3688  * It returns the number of seconds (as a time_t) that the next frag timer
3689  * should be scheduled for, 0 meaning that the timer doesn't need to be
3690  * re-started.  Note that the method of calculating next_timeout isn't
3691  * entirely accurate since time will flow between the time we grab
3692  * current_time and the time we schedule the next timeout.  This isn't a
3693  * big problem since this is the timer for sending an ICMP reassembly time
3694  * exceeded messages, and it doesn't have to be exactly accurate.
3695  *
3696  * This function is
3697  * sometimes called as writer, although this is not required.
3698  */
3699 time_t
3700 ill_frag_timeout(ill_t *ill, time_t dead_interval)
3701 {
3702 	ipfb_t	*ipfb;
3703 	ipfb_t	*endp;
3704 	ipf_t	*ipf;
3705 	ipf_t	*ipfnext;
3706 	mblk_t	*mp;
3707 	time_t	current_time = gethrestime_sec();
3708 	time_t	next_timeout = 0;
3709 	uint32_t	hdr_length;
3710 	mblk_t	*send_icmp_head;
3711 	mblk_t	*send_icmp_head_v6;
3712 	zoneid_t zoneid;
3713 
3714 	ipfb = ill->ill_frag_hash_tbl;
3715 	if (ipfb == NULL)
3716 		return (B_FALSE);
3717 	endp = &ipfb[ILL_FRAG_HASH_TBL_COUNT];
3718 	/* Walk the frag hash table. */
3719 	for (; ipfb < endp; ipfb++) {
3720 		send_icmp_head = NULL;
3721 		send_icmp_head_v6 = NULL;
3722 		mutex_enter(&ipfb->ipfb_lock);
3723 		while ((ipf = ipfb->ipfb_ipf) != 0) {
3724 			time_t frag_time = current_time - ipf->ipf_timestamp;
3725 			time_t frag_timeout;
3726 
3727 			if (frag_time < dead_interval) {
3728 				/*
3729 				 * There are some outstanding fragments
3730 				 * that will timeout later.  Make note of
3731 				 * the time so that we can reschedule the
3732 				 * next timeout appropriately.
3733 				 */
3734 				frag_timeout = dead_interval - frag_time;
3735 				if (next_timeout == 0 ||
3736 				    frag_timeout < next_timeout) {
3737 					next_timeout = frag_timeout;
3738 				}
3739 				break;
3740 			}
3741 			/* Time's up.  Get it out of here. */
3742 			hdr_length = ipf->ipf_nf_hdr_len;
3743 			ipfnext = ipf->ipf_hash_next;
3744 			if (ipfnext)
3745 				ipfnext->ipf_ptphn = ipf->ipf_ptphn;
3746 			*ipf->ipf_ptphn = ipfnext;
3747 			mp = ipf->ipf_mp->b_cont;
3748 			for (; mp; mp = mp->b_cont) {
3749 				/* Extra points for neatness. */
3750 				IP_REASS_SET_START(mp, 0);
3751 				IP_REASS_SET_END(mp, 0);
3752 			}
3753 			mp = ipf->ipf_mp->b_cont;
3754 			ill->ill_frag_count -= ipf->ipf_count;
3755 			ASSERT(ipfb->ipfb_count >= ipf->ipf_count);
3756 			ipfb->ipfb_count -= ipf->ipf_count;
3757 			ASSERT(ipfb->ipfb_frag_pkts > 0);
3758 			ipfb->ipfb_frag_pkts--;
3759 			/*
3760 			 * We do not send any icmp message from here because
3761 			 * we currently are holding the ipfb_lock for this
3762 			 * hash chain. If we try and send any icmp messages
3763 			 * from here we may end up via a put back into ip
3764 			 * trying to get the same lock, causing a recursive
3765 			 * mutex panic. Instead we build a list and send all
3766 			 * the icmp messages after we have dropped the lock.
3767 			 */
3768 			if (ill->ill_isv6) {
3769 				BUMP_MIB(ill->ill_ip6_mib, ipv6ReasmFails);
3770 				if (hdr_length != 0) {
3771 					mp->b_next = send_icmp_head_v6;
3772 					send_icmp_head_v6 = mp;
3773 				} else {
3774 					freemsg(mp);
3775 				}
3776 			} else {
3777 				BUMP_MIB(&ip_mib, ipReasmFails);
3778 				if (hdr_length != 0) {
3779 					mp->b_next = send_icmp_head;
3780 					send_icmp_head = mp;
3781 				} else {
3782 					freemsg(mp);
3783 				}
3784 			}
3785 			freeb(ipf->ipf_mp);
3786 		}
3787 		mutex_exit(&ipfb->ipfb_lock);
3788 		/*
3789 		 * Now need to send any icmp messages that we delayed from
3790 		 * above.
3791 		 */
3792 		while (send_icmp_head_v6 != NULL) {
3793 			ip6_t *ip6h;
3794 
3795 			mp = send_icmp_head_v6;
3796 			send_icmp_head_v6 = send_icmp_head_v6->b_next;
3797 			mp->b_next = NULL;
3798 			if (mp->b_datap->db_type == M_CTL)
3799 				ip6h = (ip6_t *)mp->b_cont->b_rptr;
3800 			else
3801 				ip6h = (ip6_t *)mp->b_rptr;
3802 			zoneid = ipif_lookup_addr_zoneid_v6(&ip6h->ip6_dst,
3803 			    ill);
3804 			if (zoneid == ALL_ZONES) {
3805 				freemsg(mp);
3806 			} else {
3807 				icmp_time_exceeded_v6(ill->ill_wq, mp,
3808 				    ICMP_REASSEMBLY_TIME_EXCEEDED, B_FALSE,
3809 				    B_FALSE, zoneid);
3810 			}
3811 		}
3812 		while (send_icmp_head != NULL) {
3813 			ipaddr_t dst;
3814 
3815 			mp = send_icmp_head;
3816 			send_icmp_head = send_icmp_head->b_next;
3817 			mp->b_next = NULL;
3818 
3819 			if (mp->b_datap->db_type == M_CTL)
3820 				dst = ((ipha_t *)mp->b_cont->b_rptr)->ipha_dst;
3821 			else
3822 				dst = ((ipha_t *)mp->b_rptr)->ipha_dst;
3823 
3824 			zoneid = ipif_lookup_addr_zoneid(dst, ill);
3825 			if (zoneid == ALL_ZONES) {
3826 				freemsg(mp);
3827 			} else {
3828 				icmp_time_exceeded(ill->ill_wq, mp,
3829 				    ICMP_REASSEMBLY_TIME_EXCEEDED, zoneid);
3830 			}
3831 		}
3832 	}
3833 	/*
3834 	 * A non-dying ILL will use the return value to decide whether to
3835 	 * restart the frag timer, and for how long.
3836 	 */
3837 	return (next_timeout);
3838 }
3839 
3840 /*
3841  * This routine is called when the approximate count of mblk memory used
3842  * for the specified ILL has exceeded max_count.
3843  */
3844 void
3845 ill_frag_prune(ill_t *ill, uint_t max_count)
3846 {
3847 	ipfb_t	*ipfb;
3848 	ipf_t	*ipf;
3849 	size_t	count;
3850 
3851 	/*
3852 	 * If we are here within ip_min_frag_prune_time msecs remove
3853 	 * ill_frag_free_num_pkts oldest packets from each bucket and increment
3854 	 * ill_frag_free_num_pkts.
3855 	 */
3856 	mutex_enter(&ill->ill_lock);
3857 	if (TICK_TO_MSEC(lbolt - ill->ill_last_frag_clean_time) <=
3858 	    (ip_min_frag_prune_time != 0 ?
3859 	    ip_min_frag_prune_time : msec_per_tick)) {
3860 
3861 		ill->ill_frag_free_num_pkts++;
3862 
3863 	} else {
3864 		ill->ill_frag_free_num_pkts = 0;
3865 	}
3866 	ill->ill_last_frag_clean_time = lbolt;
3867 	mutex_exit(&ill->ill_lock);
3868 
3869 	/*
3870 	 * free ill_frag_free_num_pkts oldest packets from each bucket.
3871 	 */
3872 	if (ill->ill_frag_free_num_pkts != 0) {
3873 		int ix;
3874 
3875 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
3876 			ipfb = &ill->ill_frag_hash_tbl[ix];
3877 			mutex_enter(&ipfb->ipfb_lock);
3878 			if (ipfb->ipfb_ipf != NULL) {
3879 				ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf,
3880 				    ill->ill_frag_free_num_pkts);
3881 			}
3882 			mutex_exit(&ipfb->ipfb_lock);
3883 		}
3884 	}
3885 	/*
3886 	 * While the reassembly list for this ILL is too big, prune a fragment
3887 	 * queue by age, oldest first.  Note that the per ILL count is
3888 	 * approximate, while the per frag hash bucket counts are accurate.
3889 	 */
3890 	while (ill->ill_frag_count > max_count) {
3891 		int	ix;
3892 		ipfb_t	*oipfb = NULL;
3893 		uint_t	oldest = UINT_MAX;
3894 
3895 		count = 0;
3896 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
3897 			ipfb = &ill->ill_frag_hash_tbl[ix];
3898 			mutex_enter(&ipfb->ipfb_lock);
3899 			ipf = ipfb->ipfb_ipf;
3900 			if (ipf != NULL && ipf->ipf_gen < oldest) {
3901 				oldest = ipf->ipf_gen;
3902 				oipfb = ipfb;
3903 			}
3904 			count += ipfb->ipfb_count;
3905 			mutex_exit(&ipfb->ipfb_lock);
3906 		}
3907 		/* Refresh the per ILL count */
3908 		ill->ill_frag_count = count;
3909 		if (oipfb == NULL) {
3910 			ill->ill_frag_count = 0;
3911 			break;
3912 		}
3913 		if (count <= max_count)
3914 			return;	/* Somebody beat us to it, nothing to do */
3915 		mutex_enter(&oipfb->ipfb_lock);
3916 		ipf = oipfb->ipfb_ipf;
3917 		if (ipf != NULL) {
3918 			ill_frag_free_pkts(ill, oipfb, ipf, 1);
3919 		}
3920 		mutex_exit(&oipfb->ipfb_lock);
3921 	}
3922 }
3923 
3924 /*
3925  * free 'free_cnt' fragmented packets starting at ipf.
3926  */
3927 void
3928 ill_frag_free_pkts(ill_t *ill, ipfb_t *ipfb, ipf_t *ipf, int free_cnt)
3929 {
3930 	size_t	count;
3931 	mblk_t	*mp;
3932 	mblk_t	*tmp;
3933 	ipf_t **ipfp = ipf->ipf_ptphn;
3934 
3935 	ASSERT(MUTEX_HELD(&ipfb->ipfb_lock));
3936 	ASSERT(ipfp != NULL);
3937 	ASSERT(ipf != NULL);
3938 
3939 	while (ipf != NULL && free_cnt-- > 0) {
3940 		count = ipf->ipf_count;
3941 		mp = ipf->ipf_mp;
3942 		ipf = ipf->ipf_hash_next;
3943 		for (tmp = mp; tmp; tmp = tmp->b_cont) {
3944 			IP_REASS_SET_START(tmp, 0);
3945 			IP_REASS_SET_END(tmp, 0);
3946 		}
3947 		ill->ill_frag_count -= count;
3948 		ASSERT(ipfb->ipfb_count >= count);
3949 		ipfb->ipfb_count -= count;
3950 		ASSERT(ipfb->ipfb_frag_pkts > 0);
3951 		ipfb->ipfb_frag_pkts--;
3952 		freemsg(mp);
3953 		BUMP_MIB(&ip_mib, ipReasmFails);
3954 	}
3955 
3956 	if (ipf)
3957 		ipf->ipf_ptphn = ipfp;
3958 	ipfp[0] = ipf;
3959 }
3960 
3961 #define	ND_FORWARD_WARNING	"The <if>:ip*_forwarding ndd variables are " \
3962 	"obsolete and may be removed in a future release of Solaris.  Use " \
3963 	"ifconfig(1M) to manipulate the forwarding status of an interface."
3964 
3965 /*
3966  * For obsolete per-interface forwarding configuration;
3967  * called in response to ND_GET.
3968  */
3969 /* ARGSUSED */
3970 static int
3971 nd_ill_forward_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *ioc_cr)
3972 {
3973 	ill_t *ill = (ill_t *)cp;
3974 
3975 	cmn_err(CE_WARN, ND_FORWARD_WARNING);
3976 
3977 	(void) mi_mpprintf(mp, "%d", (ill->ill_flags & ILLF_ROUTER) != 0);
3978 	return (0);
3979 }
3980 
3981 /*
3982  * For obsolete per-interface forwarding configuration;
3983  * called in response to ND_SET.
3984  */
3985 /* ARGSUSED */
3986 static int
3987 nd_ill_forward_set(queue_t *q, mblk_t *mp, char *valuestr, caddr_t cp,
3988     cred_t *ioc_cr)
3989 {
3990 	long value;
3991 	int retval;
3992 
3993 	cmn_err(CE_WARN, ND_FORWARD_WARNING);
3994 
3995 	if (ddi_strtol(valuestr, NULL, 10, &value) != 0 ||
3996 	    value < 0 || value > 1) {
3997 		return (EINVAL);
3998 	}
3999 
4000 	rw_enter(&ill_g_lock, RW_READER);
4001 	retval = ill_forward_set(q, mp, (value != 0), cp);
4002 	rw_exit(&ill_g_lock);
4003 	return (retval);
4004 }
4005 
4006 /*
4007  * Set an ill's ILLF_ROUTER flag appropriately.  If the ill is part of an
4008  * IPMP group, make sure all ill's in the group adopt the new policy.  Send
4009  * up RTS_IFINFO routing socket messages for each interface whose flags we
4010  * change.
4011  */
4012 /* ARGSUSED */
4013 int
4014 ill_forward_set(queue_t *q, mblk_t *mp, boolean_t enable, caddr_t cp)
4015 {
4016 	ill_t *ill = (ill_t *)cp;
4017 	ill_group_t *illgrp;
4018 
4019 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ill_g_lock));
4020 
4021 	if ((enable && (ill->ill_flags & ILLF_ROUTER)) ||
4022 	    (!enable && !(ill->ill_flags & ILLF_ROUTER)) ||
4023 	    (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK))
4024 		return (EINVAL);
4025 
4026 	/*
4027 	 * If the ill is in an IPMP group, set the forwarding policy on all
4028 	 * members of the group to the same value.
4029 	 */
4030 	illgrp = ill->ill_group;
4031 	if (illgrp != NULL) {
4032 		ill_t *tmp_ill;
4033 
4034 		for (tmp_ill = illgrp->illgrp_ill; tmp_ill != NULL;
4035 		    tmp_ill = tmp_ill->ill_group_next) {
4036 			ip1dbg(("ill_forward_set: %s %s forwarding on %s",
4037 			    (enable ? "Enabling" : "Disabling"),
4038 			    (tmp_ill->ill_isv6 ? "IPv6" : "IPv4"),
4039 			    tmp_ill->ill_name));
4040 			mutex_enter(&tmp_ill->ill_lock);
4041 			if (enable)
4042 				tmp_ill->ill_flags |= ILLF_ROUTER;
4043 			else
4044 				tmp_ill->ill_flags &= ~ILLF_ROUTER;
4045 			mutex_exit(&tmp_ill->ill_lock);
4046 			if (tmp_ill->ill_isv6)
4047 				ill_set_nce_router_flags(tmp_ill, enable);
4048 			/* Notify routing socket listeners of this change. */
4049 			ip_rts_ifmsg(tmp_ill->ill_ipif);
4050 		}
4051 	} else {
4052 		ip1dbg(("ill_forward_set: %s %s forwarding on %s",
4053 		    (enable ? "Enabling" : "Disabling"),
4054 		    (ill->ill_isv6 ? "IPv6" : "IPv4"), ill->ill_name));
4055 		mutex_enter(&ill->ill_lock);
4056 		if (enable)
4057 			ill->ill_flags |= ILLF_ROUTER;
4058 		else
4059 			ill->ill_flags &= ~ILLF_ROUTER;
4060 		mutex_exit(&ill->ill_lock);
4061 		if (ill->ill_isv6)
4062 			ill_set_nce_router_flags(ill, enable);
4063 		/* Notify routing socket listeners of this change. */
4064 		ip_rts_ifmsg(ill->ill_ipif);
4065 	}
4066 
4067 	return (0);
4068 }
4069 
4070 /*
4071  * Based on the ILLF_ROUTER flag of an ill, make sure all local nce's for
4072  * addresses assigned to the ill have the NCE_F_ISROUTER flag appropriately
4073  * set or clear.
4074  */
4075 static void
4076 ill_set_nce_router_flags(ill_t *ill, boolean_t enable)
4077 {
4078 	ipif_t *ipif;
4079 	nce_t *nce;
4080 
4081 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
4082 		nce = ndp_lookup_v6(ill, &ipif->ipif_v6lcl_addr, B_FALSE);
4083 		if (nce != NULL) {
4084 			mutex_enter(&nce->nce_lock);
4085 			if (enable)
4086 				nce->nce_flags |= NCE_F_ISROUTER;
4087 			else
4088 				nce->nce_flags &= ~NCE_F_ISROUTER;
4089 			mutex_exit(&nce->nce_lock);
4090 			NCE_REFRELE(nce);
4091 		}
4092 	}
4093 }
4094 
4095 /*
4096  * Given an ill with a _valid_ name, add the ip_forwarding ndd variable
4097  * for this ill.  Make sure the v6/v4 question has been answered about this
4098  * ill.  The creation of this ndd variable is only for backwards compatibility.
4099  * The preferred way to control per-interface IP forwarding is through the
4100  * ILLF_ROUTER interface flag.
4101  */
4102 static int
4103 ill_set_ndd_name(ill_t *ill)
4104 {
4105 	char *suffix;
4106 
4107 	ASSERT(IAM_WRITER_ILL(ill));
4108 
4109 	if (ill->ill_isv6)
4110 		suffix = ipv6_forward_suffix;
4111 	else
4112 		suffix = ipv4_forward_suffix;
4113 
4114 	ill->ill_ndd_name = ill->ill_name + ill->ill_name_length;
4115 	bcopy(ill->ill_name, ill->ill_ndd_name, ill->ill_name_length - 1);
4116 	/*
4117 	 * Copies over the '\0'.
4118 	 * Note that strlen(suffix) is always bounded.
4119 	 */
4120 	bcopy(suffix, ill->ill_ndd_name + ill->ill_name_length - 1,
4121 	    strlen(suffix) + 1);
4122 
4123 	/*
4124 	 * Use of the nd table requires holding the reader lock.
4125 	 * Modifying the nd table thru nd_load/nd_unload requires
4126 	 * the writer lock.
4127 	 */
4128 	rw_enter(&ip_g_nd_lock, RW_WRITER);
4129 	if (!nd_load(&ip_g_nd, ill->ill_ndd_name, nd_ill_forward_get,
4130 	    nd_ill_forward_set, (caddr_t)ill)) {
4131 		/*
4132 		 * If the nd_load failed, it only meant that it could not
4133 		 * allocate a new bunch of room for further NDD expansion.
4134 		 * Because of that, the ill_ndd_name will be set to 0, and
4135 		 * this interface is at the mercy of the global ip_forwarding
4136 		 * variable.
4137 		 */
4138 		rw_exit(&ip_g_nd_lock);
4139 		ill->ill_ndd_name = NULL;
4140 		return (ENOMEM);
4141 	}
4142 	rw_exit(&ip_g_nd_lock);
4143 	return (0);
4144 }
4145 
4146 /*
4147  * Intializes the context structure and returns the first ill in the list
4148  * cuurently start_list and end_list can have values:
4149  * MAX_G_HEADS		Traverse both IPV4 and IPV6 lists.
4150  * IP_V4_G_HEAD		Traverse IPV4 list only.
4151  * IP_V6_G_HEAD		Traverse IPV6 list only.
4152  */
4153 
4154 /*
4155  * We don't check for CONDEMNED ills here. Caller must do that if
4156  * necessary under the ill lock.
4157  */
4158 ill_t *
4159 ill_first(int start_list, int end_list, ill_walk_context_t *ctx)
4160 {
4161 	ill_if_t *ifp;
4162 	ill_t *ill;
4163 	avl_tree_t *avl_tree;
4164 
4165 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
4166 	ASSERT(end_list <= MAX_G_HEADS && start_list >= 0);
4167 
4168 	/*
4169 	 * setup the lists to search
4170 	 */
4171 	if (end_list != MAX_G_HEADS) {
4172 		ctx->ctx_current_list = start_list;
4173 		ctx->ctx_last_list = end_list;
4174 	} else {
4175 		ctx->ctx_last_list = MAX_G_HEADS - 1;
4176 		ctx->ctx_current_list = 0;
4177 	}
4178 
4179 	while (ctx->ctx_current_list <= ctx->ctx_last_list) {
4180 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list);
4181 		if (ifp != (ill_if_t *)
4182 		    &IP_VX_ILL_G_LIST(ctx->ctx_current_list)) {
4183 			avl_tree = &ifp->illif_avl_by_ppa;
4184 			ill = avl_first(avl_tree);
4185 			/*
4186 			 * ill is guaranteed to be non NULL or ifp should have
4187 			 * not existed.
4188 			 */
4189 			ASSERT(ill != NULL);
4190 			return (ill);
4191 		}
4192 		ctx->ctx_current_list++;
4193 	}
4194 
4195 	return (NULL);
4196 }
4197 
4198 /*
4199  * returns the next ill in the list. ill_first() must have been called
4200  * before calling ill_next() or bad things will happen.
4201  */
4202 
4203 /*
4204  * We don't check for CONDEMNED ills here. Caller must do that if
4205  * necessary under the ill lock.
4206  */
4207 ill_t *
4208 ill_next(ill_walk_context_t *ctx, ill_t *lastill)
4209 {
4210 	ill_if_t *ifp;
4211 	ill_t *ill;
4212 
4213 
4214 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
4215 	ASSERT(lastill->ill_ifptr != (ill_if_t *)
4216 	    &IP_VX_ILL_G_LIST(ctx->ctx_current_list));
4217 	if ((ill = avl_walk(&lastill->ill_ifptr->illif_avl_by_ppa, lastill,
4218 	    AVL_AFTER)) != NULL) {
4219 		return (ill);
4220 	}
4221 
4222 	/* goto next ill_ifp in the list. */
4223 	ifp = lastill->ill_ifptr->illif_next;
4224 
4225 	/* make sure not at end of circular list */
4226 	while (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(ctx->ctx_current_list)) {
4227 		if (++ctx->ctx_current_list > ctx->ctx_last_list)
4228 			return (NULL);
4229 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list);
4230 	}
4231 
4232 	return (avl_first(&ifp->illif_avl_by_ppa));
4233 }
4234 
4235 /*
4236  * Check interface name for correct format which is name+ppa.
4237  * name can contain characters and digits, the right most digits
4238  * make up the ppa number. use of octal is not allowed, name must contain
4239  * a ppa, return pointer to the start of ppa.
4240  * In case of error return NULL.
4241  */
4242 static char *
4243 ill_get_ppa_ptr(char *name)
4244 {
4245 	int namelen = mi_strlen(name);
4246 
4247 	int len = namelen;
4248 
4249 	name += len;
4250 	while (len > 0) {
4251 		name--;
4252 		if (*name < '0' || *name > '9')
4253 			break;
4254 		len--;
4255 	}
4256 
4257 	/* empty string, all digits, or no trailing digits */
4258 	if (len == 0 || len == (int)namelen)
4259 		return (NULL);
4260 
4261 	name++;
4262 	/* check for attempted use of octal */
4263 	if (*name == '0' && len != (int)namelen - 1)
4264 		return (NULL);
4265 	return (name);
4266 }
4267 
4268 /*
4269  * use avl tree to locate the ill.
4270  */
4271 static ill_t *
4272 ill_find_by_name(char *name, boolean_t isv6, queue_t *q, mblk_t *mp,
4273     ipsq_func_t func, int *error)
4274 {
4275 	char *ppa_ptr = NULL;
4276 	int len;
4277 	uint_t ppa;
4278 	ill_t *ill = NULL;
4279 	ill_if_t *ifp;
4280 	int list;
4281 	ipsq_t *ipsq;
4282 
4283 	if (error != NULL)
4284 		*error = 0;
4285 
4286 	/*
4287 	 * get ppa ptr
4288 	 */
4289 	if (isv6)
4290 		list = IP_V6_G_HEAD;
4291 	else
4292 		list = IP_V4_G_HEAD;
4293 
4294 	if ((ppa_ptr = ill_get_ppa_ptr(name)) == NULL) {
4295 		if (error != NULL)
4296 			*error = ENXIO;
4297 		return (NULL);
4298 	}
4299 
4300 	len = ppa_ptr - name + 1;
4301 
4302 	ppa = stoi(&ppa_ptr);
4303 
4304 	ifp = IP_VX_ILL_G_LIST(list);
4305 
4306 	while (ifp != (ill_if_t *)&IP_VX_ILL_G_LIST(list)) {
4307 		/*
4308 		 * match is done on len - 1 as the name is not null
4309 		 * terminated it contains ppa in addition to the interface
4310 		 * name.
4311 		 */
4312 		if ((ifp->illif_name_len == len) &&
4313 		    bcmp(ifp->illif_name, name, len - 1) == 0) {
4314 			break;
4315 		} else {
4316 			ifp = ifp->illif_next;
4317 		}
4318 	}
4319 
4320 
4321 	if (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(list)) {
4322 		/*
4323 		 * Even the interface type does not exist.
4324 		 */
4325 		if (error != NULL)
4326 			*error = ENXIO;
4327 		return (NULL);
4328 	}
4329 
4330 	ill = avl_find(&ifp->illif_avl_by_ppa, (void *) &ppa, NULL);
4331 	if (ill != NULL) {
4332 		/*
4333 		 * The block comment at the start of ipif_down
4334 		 * explains the use of the macros used below
4335 		 */
4336 		GRAB_CONN_LOCK(q);
4337 		mutex_enter(&ill->ill_lock);
4338 		if (ILL_CAN_LOOKUP(ill)) {
4339 			ill_refhold_locked(ill);
4340 			mutex_exit(&ill->ill_lock);
4341 			RELEASE_CONN_LOCK(q);
4342 			return (ill);
4343 		} else if (ILL_CAN_WAIT(ill, q)) {
4344 			ipsq = ill->ill_phyint->phyint_ipsq;
4345 			mutex_enter(&ipsq->ipsq_lock);
4346 			mutex_exit(&ill->ill_lock);
4347 			ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
4348 			mutex_exit(&ipsq->ipsq_lock);
4349 			RELEASE_CONN_LOCK(q);
4350 			*error = EINPROGRESS;
4351 			return (NULL);
4352 		}
4353 		mutex_exit(&ill->ill_lock);
4354 		RELEASE_CONN_LOCK(q);
4355 	}
4356 	if (error != NULL)
4357 		*error = ENXIO;
4358 	return (NULL);
4359 }
4360 
4361 /*
4362  * comparison function for use with avl.
4363  */
4364 static int
4365 ill_compare_ppa(const void *ppa_ptr, const void *ill_ptr)
4366 {
4367 	uint_t ppa;
4368 	uint_t ill_ppa;
4369 
4370 	ASSERT(ppa_ptr != NULL && ill_ptr != NULL);
4371 
4372 	ppa = *((uint_t *)ppa_ptr);
4373 	ill_ppa = ((const ill_t *)ill_ptr)->ill_ppa;
4374 	/*
4375 	 * We want the ill with the lowest ppa to be on the
4376 	 * top.
4377 	 */
4378 	if (ill_ppa < ppa)
4379 		return (1);
4380 	if (ill_ppa > ppa)
4381 		return (-1);
4382 	return (0);
4383 }
4384 
4385 /*
4386  * remove an interface type from the global list.
4387  */
4388 static void
4389 ill_delete_interface_type(ill_if_t *interface)
4390 {
4391 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
4392 
4393 	ASSERT(interface != NULL);
4394 	ASSERT(avl_numnodes(&interface->illif_avl_by_ppa) == 0);
4395 
4396 	avl_destroy(&interface->illif_avl_by_ppa);
4397 	if (interface->illif_ppa_arena != NULL)
4398 		vmem_destroy(interface->illif_ppa_arena);
4399 
4400 	remque(interface);
4401 
4402 	mi_free(interface);
4403 }
4404 
4405 /* Defined in ip_netinfo.c */
4406 extern ddi_taskq_t	*eventq_queue_nic;
4407 
4408 /*
4409  * remove ill from the global list.
4410  */
4411 static void
4412 ill_glist_delete(ill_t *ill)
4413 {
4414 	char *nicname;
4415 	size_t nicnamelen;
4416 	hook_nic_event_t *info;
4417 
4418 	if (ill == NULL)
4419 		return;
4420 
4421 	rw_enter(&ill_g_lock, RW_WRITER);
4422 
4423 	if (ill->ill_name != NULL) {
4424 		nicname = kmem_alloc(ill->ill_name_length, KM_NOSLEEP);
4425 		if (nicname != NULL) {
4426 			bcopy(ill->ill_name, nicname, ill->ill_name_length);
4427 			nicnamelen = ill->ill_name_length;
4428 		}
4429 	} else {
4430 		nicname = NULL;
4431 		nicnamelen = 0;
4432 	}
4433 
4434 	/*
4435 	 * If the ill was never inserted into the AVL tree
4436 	 * we skip the if branch.
4437 	 */
4438 	if (ill->ill_ifptr != NULL) {
4439 		/*
4440 		 * remove from AVL tree and free ppa number
4441 		 */
4442 		avl_remove(&ill->ill_ifptr->illif_avl_by_ppa, ill);
4443 
4444 		if (ill->ill_ifptr->illif_ppa_arena != NULL) {
4445 			vmem_free(ill->ill_ifptr->illif_ppa_arena,
4446 			    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
4447 		}
4448 		if (avl_numnodes(&ill->ill_ifptr->illif_avl_by_ppa) == 0) {
4449 			ill_delete_interface_type(ill->ill_ifptr);
4450 		}
4451 
4452 		/*
4453 		 * Indicate ill is no longer in the list.
4454 		 */
4455 		ill->ill_ifptr = NULL;
4456 		ill->ill_name_length = 0;
4457 		ill->ill_name[0] = '\0';
4458 		ill->ill_ppa = UINT_MAX;
4459 	}
4460 
4461 	/*
4462 	 * Run the unplumb hook after the NIC has disappeared from being
4463 	 * visible so that attempts to revalidate its existance will fail.
4464 	 *
4465 	 * This needs to be run inside the ill_g_lock perimeter to ensure
4466 	 * that the ordering of delivered events to listeners matches the
4467 	 * order of them in the kernel.
4468 	 */
4469 	if ((info = ill->ill_nic_event_info) != NULL) {
4470 		if (info->hne_event != NE_DOWN) {
4471 			ip2dbg(("ill_glist_delete: unexpected nic event %d "
4472 			    "attached for %s\n", info->hne_event,
4473 			    ill->ill_name));
4474 			if (info->hne_data != NULL)
4475 				kmem_free(info->hne_data, info->hne_datalen);
4476 			kmem_free(info, sizeof (hook_nic_event_t));
4477 		} else {
4478 			if (ddi_taskq_dispatch(eventq_queue_nic,
4479 			    ip_ne_queue_func, (void *)info, DDI_SLEEP)
4480 			    == DDI_FAILURE) {
4481 				ip2dbg(("ill_glist_delete: ddi_taskq_dispatch "
4482 				    "failed\n"));
4483 				if (info->hne_data != NULL)
4484 					kmem_free(info->hne_data,
4485 					    info->hne_datalen);
4486 				kmem_free(info, sizeof (hook_nic_event_t));
4487 			}
4488 		}
4489 	}
4490 
4491 	info = kmem_alloc(sizeof (hook_nic_event_t), KM_NOSLEEP);
4492 	if (info != NULL) {
4493 		info->hne_nic = ill->ill_phyint->phyint_ifindex;
4494 		info->hne_lif = 0;
4495 		info->hne_event = NE_UNPLUMB;
4496 		info->hne_data = nicname;
4497 		info->hne_datalen = nicnamelen;
4498 		info->hne_family = ill->ill_isv6 ? ipv6 : ipv4;
4499 	} else {
4500 		ip2dbg(("ill_glist_delete: could not attach UNPLUMB nic event "
4501 		    "information for %s (ENOMEM)\n", ill->ill_name));
4502 		if (nicname != NULL)
4503 			kmem_free(nicname, nicnamelen);
4504 	}
4505 
4506 	ill->ill_nic_event_info = info;
4507 
4508 	ill_phyint_free(ill);
4509 
4510 	rw_exit(&ill_g_lock);
4511 }
4512 
4513 /*
4514  * allocate a ppa, if the number of plumbed interfaces of this type are
4515  * less than ill_no_arena do a linear search to find a unused ppa.
4516  * When the number goes beyond ill_no_arena switch to using an arena.
4517  * Note: ppa value of zero cannot be allocated from vmem_arena as it
4518  * is the return value for an error condition, so allocation starts at one
4519  * and is decremented by one.
4520  */
4521 static int
4522 ill_alloc_ppa(ill_if_t *ifp, ill_t *ill)
4523 {
4524 	ill_t *tmp_ill;
4525 	uint_t start, end;
4526 	int ppa;
4527 
4528 	if (ifp->illif_ppa_arena == NULL &&
4529 	    (avl_numnodes(&ifp->illif_avl_by_ppa) + 1 > ill_no_arena)) {
4530 		/*
4531 		 * Create an arena.
4532 		 */
4533 		ifp->illif_ppa_arena = vmem_create(ifp->illif_name,
4534 		    (void *)1, UINT_MAX - 1, 1, NULL, NULL,
4535 		    NULL, 0, VM_SLEEP | VMC_IDENTIFIER);
4536 			/* allocate what has already been assigned */
4537 		for (tmp_ill = avl_first(&ifp->illif_avl_by_ppa);
4538 		    tmp_ill != NULL; tmp_ill = avl_walk(&ifp->illif_avl_by_ppa,
4539 		    tmp_ill, AVL_AFTER)) {
4540 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
4541 			    1,		/* size */
4542 			    1,		/* align/quantum */
4543 			    0,		/* phase */
4544 			    0,		/* nocross */
4545 		(void *)((uintptr_t)tmp_ill->ill_ppa + 1), /* minaddr */
4546 		(void *)((uintptr_t)tmp_ill->ill_ppa + 2), /* maxaddr */
4547 			    VM_NOSLEEP|VM_FIRSTFIT);
4548 			if (ppa == 0) {
4549 				ip1dbg(("ill_alloc_ppa: ppa allocation"
4550 				    " failed while switching"));
4551 				vmem_destroy(ifp->illif_ppa_arena);
4552 				ifp->illif_ppa_arena = NULL;
4553 				break;
4554 			}
4555 		}
4556 	}
4557 
4558 	if (ifp->illif_ppa_arena != NULL) {
4559 		if (ill->ill_ppa == UINT_MAX) {
4560 			ppa = (int)(uintptr_t)vmem_alloc(ifp->illif_ppa_arena,
4561 			    1, VM_NOSLEEP|VM_FIRSTFIT);
4562 			if (ppa == 0)
4563 				return (EAGAIN);
4564 			ill->ill_ppa = --ppa;
4565 		} else {
4566 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
4567 			    1, 		/* size */
4568 			    1, 		/* align/quantum */
4569 			    0, 		/* phase */
4570 			    0, 		/* nocross */
4571 			    (void *)(uintptr_t)(ill->ill_ppa + 1), /* minaddr */
4572 			    (void *)(uintptr_t)(ill->ill_ppa + 2), /* maxaddr */
4573 			    VM_NOSLEEP|VM_FIRSTFIT);
4574 			/*
4575 			 * Most likely the allocation failed because
4576 			 * the requested ppa was in use.
4577 			 */
4578 			if (ppa == 0)
4579 				return (EEXIST);
4580 		}
4581 		return (0);
4582 	}
4583 
4584 	/*
4585 	 * No arena is in use and not enough (>ill_no_arena) interfaces have
4586 	 * been plumbed to create one. Do a linear search to get a unused ppa.
4587 	 */
4588 	if (ill->ill_ppa == UINT_MAX) {
4589 		end = UINT_MAX - 1;
4590 		start = 0;
4591 	} else {
4592 		end = start = ill->ill_ppa;
4593 	}
4594 
4595 	tmp_ill = avl_find(&ifp->illif_avl_by_ppa, (void *)&start, NULL);
4596 	while (tmp_ill != NULL && tmp_ill->ill_ppa == start) {
4597 		if (start++ >= end) {
4598 			if (ill->ill_ppa == UINT_MAX)
4599 				return (EAGAIN);
4600 			else
4601 				return (EEXIST);
4602 		}
4603 		tmp_ill = avl_walk(&ifp->illif_avl_by_ppa, tmp_ill, AVL_AFTER);
4604 	}
4605 	ill->ill_ppa = start;
4606 	return (0);
4607 }
4608 
4609 /*
4610  * Insert ill into the list of configured ill's. Once this function completes,
4611  * the ill is globally visible and is available through lookups. More precisely
4612  * this happens after the caller drops the ill_g_lock.
4613  */
4614 static int
4615 ill_glist_insert(ill_t *ill, char *name, boolean_t isv6)
4616 {
4617 	ill_if_t *ill_interface;
4618 	avl_index_t where = 0;
4619 	int error;
4620 	int name_length;
4621 	int index;
4622 	boolean_t check_length = B_FALSE;
4623 
4624 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
4625 
4626 	name_length = mi_strlen(name) + 1;
4627 
4628 	if (isv6)
4629 		index = IP_V6_G_HEAD;
4630 	else
4631 		index = IP_V4_G_HEAD;
4632 
4633 	ill_interface = IP_VX_ILL_G_LIST(index);
4634 	/*
4635 	 * Search for interface type based on name
4636 	 */
4637 	while (ill_interface != (ill_if_t *)&IP_VX_ILL_G_LIST(index)) {
4638 		if ((ill_interface->illif_name_len == name_length) &&
4639 		    (strcmp(ill_interface->illif_name, name) == 0)) {
4640 			break;
4641 		}
4642 		ill_interface = ill_interface->illif_next;
4643 	}
4644 
4645 	/*
4646 	 * Interface type not found, create one.
4647 	 */
4648 	if (ill_interface == (ill_if_t *)&IP_VX_ILL_G_LIST(index)) {
4649 
4650 		ill_g_head_t ghead;
4651 
4652 		/*
4653 		 * allocate ill_if_t structure
4654 		 */
4655 
4656 		ill_interface = (ill_if_t *)mi_zalloc(sizeof (ill_if_t));
4657 		if (ill_interface == NULL) {
4658 			return (ENOMEM);
4659 		}
4660 
4661 
4662 
4663 		(void) strcpy(ill_interface->illif_name, name);
4664 		ill_interface->illif_name_len = name_length;
4665 
4666 		avl_create(&ill_interface->illif_avl_by_ppa,
4667 		    ill_compare_ppa, sizeof (ill_t),
4668 		    offsetof(struct ill_s, ill_avl_byppa));
4669 
4670 		/*
4671 		 * link the structure in the back to maintain order
4672 		 * of configuration for ifconfig output.
4673 		 */
4674 		ghead = ill_g_heads[index];
4675 		insque(ill_interface, ghead.ill_g_list_tail);
4676 
4677 	}
4678 
4679 	if (ill->ill_ppa == UINT_MAX)
4680 		check_length = B_TRUE;
4681 
4682 	error = ill_alloc_ppa(ill_interface, ill);
4683 	if (error != 0) {
4684 		if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
4685 			ill_delete_interface_type(ill->ill_ifptr);
4686 		return (error);
4687 	}
4688 
4689 	/*
4690 	 * When the ppa is choosen by the system, check that there is
4691 	 * enough space to insert ppa. if a specific ppa was passed in this
4692 	 * check is not required as the interface name passed in will have
4693 	 * the right ppa in it.
4694 	 */
4695 	if (check_length) {
4696 		/*
4697 		 * UINT_MAX - 1 should fit in 10 chars, alloc 12 chars.
4698 		 */
4699 		char buf[sizeof (uint_t) * 3];
4700 
4701 		/*
4702 		 * convert ppa to string to calculate the amount of space
4703 		 * required for it in the name.
4704 		 */
4705 		numtos(ill->ill_ppa, buf);
4706 
4707 		/* Do we have enough space to insert ppa ? */
4708 
4709 		if ((mi_strlen(name) + mi_strlen(buf) + 1) > LIFNAMSIZ) {
4710 			/* Free ppa and interface type struct */
4711 			if (ill_interface->illif_ppa_arena != NULL) {
4712 				vmem_free(ill_interface->illif_ppa_arena,
4713 				    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
4714 			}
4715 			if (avl_numnodes(&ill_interface->illif_avl_by_ppa) ==
4716 			    0) {
4717 				ill_delete_interface_type(ill->ill_ifptr);
4718 			}
4719 
4720 			return (EINVAL);
4721 		}
4722 	}
4723 
4724 	(void) sprintf(ill->ill_name, "%s%u", name, ill->ill_ppa);
4725 	ill->ill_name_length = mi_strlen(ill->ill_name) + 1;
4726 
4727 	(void) avl_find(&ill_interface->illif_avl_by_ppa, &ill->ill_ppa,
4728 	    &where);
4729 	ill->ill_ifptr = ill_interface;
4730 	avl_insert(&ill_interface->illif_avl_by_ppa, ill, where);
4731 
4732 	ill_phyint_reinit(ill);
4733 	return (0);
4734 }
4735 
4736 /* Initialize the per phyint (per IPMP group) ipsq used for serialization */
4737 static boolean_t
4738 ipsq_init(ill_t *ill)
4739 {
4740 	ipsq_t  *ipsq;
4741 
4742 	/* Init the ipsq and impicitly enter as writer */
4743 	ill->ill_phyint->phyint_ipsq =
4744 	    kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP);
4745 	if (ill->ill_phyint->phyint_ipsq == NULL)
4746 		return (B_FALSE);
4747 	ipsq = ill->ill_phyint->phyint_ipsq;
4748 	ipsq->ipsq_phyint_list = ill->ill_phyint;
4749 	ill->ill_phyint->phyint_ipsq_next = NULL;
4750 	mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, 0);
4751 	ipsq->ipsq_refs = 1;
4752 	ipsq->ipsq_writer = curthread;
4753 	ipsq->ipsq_reentry_cnt = 1;
4754 #ifdef ILL_DEBUG
4755 	ipsq->ipsq_depth = getpcstack((pc_t *)ipsq->ipsq_stack, IP_STACK_DEPTH);
4756 #endif
4757 	(void) strcpy(ipsq->ipsq_name, ill->ill_name);
4758 	return (B_TRUE);
4759 }
4760 
4761 /*
4762  * ill_init is called by ip_open when a device control stream is opened.
4763  * It does a few initializations, and shoots a DL_INFO_REQ message down
4764  * to the driver.  The response is later picked up in ip_rput_dlpi and
4765  * used to set up default mechanisms for talking to the driver.  (Always
4766  * called as writer.)
4767  *
4768  * If this function returns error, ip_open will call ip_close which in
4769  * turn will call ill_delete to clean up any memory allocated here that
4770  * is not yet freed.
4771  */
4772 int
4773 ill_init(queue_t *q, ill_t *ill)
4774 {
4775 	int	count;
4776 	dl_info_req_t	*dlir;
4777 	mblk_t	*info_mp;
4778 	uchar_t *frag_ptr;
4779 
4780 	/*
4781 	 * The ill is initialized to zero by mi_alloc*(). In addition
4782 	 * some fields already contain valid values, initialized in
4783 	 * ip_open(), before we reach here.
4784 	 */
4785 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, 0);
4786 
4787 	ill->ill_rq = q;
4788 	ill->ill_wq = WR(q);
4789 
4790 	info_mp = allocb(MAX(sizeof (dl_info_req_t), sizeof (dl_info_ack_t)),
4791 	    BPRI_HI);
4792 	if (info_mp == NULL)
4793 		return (ENOMEM);
4794 
4795 	/*
4796 	 * Allocate sufficient space to contain our fragment hash table and
4797 	 * the device name.
4798 	 */
4799 	frag_ptr = (uchar_t *)mi_zalloc(ILL_FRAG_HASH_TBL_SIZE +
4800 	    2 * LIFNAMSIZ + 5 + strlen(ipv6_forward_suffix));
4801 	if (frag_ptr == NULL) {
4802 		freemsg(info_mp);
4803 		return (ENOMEM);
4804 	}
4805 	ill->ill_frag_ptr = frag_ptr;
4806 	ill->ill_frag_free_num_pkts = 0;
4807 	ill->ill_last_frag_clean_time = 0;
4808 	ill->ill_frag_hash_tbl = (ipfb_t *)frag_ptr;
4809 	ill->ill_name = (char *)(frag_ptr + ILL_FRAG_HASH_TBL_SIZE);
4810 	for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
4811 		mutex_init(&ill->ill_frag_hash_tbl[count].ipfb_lock,
4812 		    NULL, MUTEX_DEFAULT, NULL);
4813 	}
4814 
4815 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
4816 	if (ill->ill_phyint == NULL) {
4817 		freemsg(info_mp);
4818 		mi_free(frag_ptr);
4819 		return (ENOMEM);
4820 	}
4821 
4822 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
4823 	/*
4824 	 * For now pretend this is a v4 ill. We need to set phyint_ill*
4825 	 * at this point because of the following reason. If we can't
4826 	 * enter the ipsq at some point and cv_wait, the writer that
4827 	 * wakes us up tries to locate us using the list of all phyints
4828 	 * in an ipsq and the ills from the phyint thru the phyint_ill*.
4829 	 * If we don't set it now, we risk a missed wakeup.
4830 	 */
4831 	ill->ill_phyint->phyint_illv4 = ill;
4832 	ill->ill_ppa = UINT_MAX;
4833 	ill->ill_fastpath_list = &ill->ill_fastpath_list;
4834 
4835 	if (!ipsq_init(ill)) {
4836 		freemsg(info_mp);
4837 		mi_free(frag_ptr);
4838 		mi_free(ill->ill_phyint);
4839 		return (ENOMEM);
4840 	}
4841 
4842 	ill->ill_state_flags |= ILL_LL_SUBNET_PENDING;
4843 
4844 
4845 	/* Frag queue limit stuff */
4846 	ill->ill_frag_count = 0;
4847 	ill->ill_ipf_gen = 0;
4848 
4849 	ill->ill_global_timer = INFINITY;
4850 	ill->ill_mcast_type = IGMP_V3_ROUTER;	/* == MLD_V2_ROUTER */
4851 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
4852 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
4853 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
4854 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
4855 
4856 	/*
4857 	 * Initialize IPv6 configuration variables.  The IP module is always
4858 	 * opened as an IPv4 module.  Instead tracking down the cases where
4859 	 * it switches to do ipv6, we'll just initialize the IPv6 configuration
4860 	 * here for convenience, this has no effect until the ill is set to do
4861 	 * IPv6.
4862 	 */
4863 	ill->ill_reachable_time = ND_REACHABLE_TIME;
4864 	ill->ill_reachable_retrans_time = ND_RETRANS_TIMER;
4865 	ill->ill_xmit_count = ND_MAX_MULTICAST_SOLICIT;
4866 	ill->ill_max_buf = ND_MAX_Q;
4867 	ill->ill_refcnt = 0;
4868 
4869 	/* Send down the Info Request to the driver. */
4870 	info_mp->b_datap->db_type = M_PCPROTO;
4871 	dlir = (dl_info_req_t *)info_mp->b_rptr;
4872 	info_mp->b_wptr = (uchar_t *)&dlir[1];
4873 	dlir->dl_primitive = DL_INFO_REQ;
4874 
4875 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
4876 
4877 	qprocson(q);
4878 	ill_dlpi_send(ill, info_mp);
4879 
4880 	return (0);
4881 }
4882 
4883 /*
4884  * ill_dls_info
4885  * creates datalink socket info from the device.
4886  */
4887 int
4888 ill_dls_info(struct sockaddr_dl *sdl, const ipif_t *ipif)
4889 {
4890 	size_t	length;
4891 	ill_t	*ill = ipif->ipif_ill;
4892 
4893 	sdl->sdl_family = AF_LINK;
4894 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
4895 	sdl->sdl_type = ipif->ipif_type;
4896 	(void) ipif_get_name(ipif, sdl->sdl_data, sizeof (sdl->sdl_data));
4897 	length = mi_strlen(sdl->sdl_data);
4898 	ASSERT(length < 256);
4899 	sdl->sdl_nlen = (uchar_t)length;
4900 	sdl->sdl_alen = ill->ill_phys_addr_length;
4901 	mutex_enter(&ill->ill_lock);
4902 	if (ill->ill_phys_addr_length != 0 && ill->ill_phys_addr != NULL) {
4903 		bcopy(ill->ill_phys_addr, &sdl->sdl_data[length],
4904 		    ill->ill_phys_addr_length);
4905 	}
4906 	mutex_exit(&ill->ill_lock);
4907 	sdl->sdl_slen = 0;
4908 	return (sizeof (struct sockaddr_dl));
4909 }
4910 
4911 /*
4912  * ill_xarp_info
4913  * creates xarp info from the device.
4914  */
4915 static int
4916 ill_xarp_info(struct sockaddr_dl *sdl, ill_t *ill)
4917 {
4918 	sdl->sdl_family = AF_LINK;
4919 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
4920 	sdl->sdl_type = ill->ill_type;
4921 	(void) ipif_get_name(ill->ill_ipif, sdl->sdl_data,
4922 	    sizeof (sdl->sdl_data));
4923 	sdl->sdl_nlen = (uchar_t)mi_strlen(sdl->sdl_data);
4924 	sdl->sdl_alen = ill->ill_phys_addr_length;
4925 	sdl->sdl_slen = 0;
4926 	return (sdl->sdl_nlen);
4927 }
4928 
4929 static int
4930 loopback_kstat_update(kstat_t *ksp, int rw)
4931 {
4932 	kstat_named_t *kn = KSTAT_NAMED_PTR(ksp);
4933 
4934 	if (rw == KSTAT_WRITE)
4935 		return (EACCES);
4936 	kn[0].value.ui32 = loopback_packets;
4937 	kn[1].value.ui32 = loopback_packets;
4938 	return (0);
4939 }
4940 
4941 
4942 /*
4943  * Has ifindex been plumbed already.
4944  */
4945 static boolean_t
4946 phyint_exists(uint_t index)
4947 {
4948 	phyint_t *phyi;
4949 
4950 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
4951 	/*
4952 	 * Indexes are stored in the phyint - a common structure
4953 	 * to both IPv4 and IPv6.
4954 	 */
4955 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_index,
4956 	    (void *) &index, NULL);
4957 	return (phyi != NULL);
4958 }
4959 
4960 /*
4961  * Assign a unique interface index for the phyint.
4962  */
4963 static boolean_t
4964 phyint_assign_ifindex(phyint_t *phyi)
4965 {
4966 	uint_t starting_index;
4967 
4968 	ASSERT(phyi->phyint_ifindex == 0);
4969 	if (!ill_index_wrap) {
4970 		phyi->phyint_ifindex = ill_index++;
4971 		if (ill_index == 0) {
4972 			/* Reached the uint_t limit Next time wrap  */
4973 			ill_index_wrap = B_TRUE;
4974 		}
4975 		return (B_TRUE);
4976 	}
4977 
4978 	/*
4979 	 * Start reusing unused indexes. Note that we hold the ill_g_lock
4980 	 * at this point and don't want to call any function that attempts
4981 	 * to get the lock again.
4982 	 */
4983 	starting_index = ill_index++;
4984 	for (; ill_index != starting_index; ill_index++) {
4985 		if (ill_index != 0 && !phyint_exists(ill_index)) {
4986 			/* found unused index - use it */
4987 			phyi->phyint_ifindex = ill_index;
4988 			return (B_TRUE);
4989 		}
4990 	}
4991 
4992 	/*
4993 	 * all interface indicies are inuse.
4994 	 */
4995 	return (B_FALSE);
4996 }
4997 
4998 /*
4999  * Return a pointer to the ill which matches the supplied name.  Note that
5000  * the ill name length includes the null termination character.  (May be
5001  * called as writer.)
5002  * If do_alloc and the interface is "lo0" it will be automatically created.
5003  * Cannot bump up reference on condemned ills. So dup detect can't be done
5004  * using this func.
5005  */
5006 ill_t *
5007 ill_lookup_on_name(char *name, boolean_t do_alloc, boolean_t isv6,
5008     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, boolean_t *did_alloc)
5009 {
5010 	ill_t	*ill;
5011 	ipif_t	*ipif;
5012 	kstat_named_t	*kn;
5013 	boolean_t isloopback;
5014 	ipsq_t *old_ipsq;
5015 
5016 	isloopback = mi_strcmp(name, ipif_loopback_name) == 0;
5017 
5018 	rw_enter(&ill_g_lock, RW_READER);
5019 	ill = ill_find_by_name(name, isv6, q, mp, func, error);
5020 	rw_exit(&ill_g_lock);
5021 	if (ill != NULL || (error != NULL && *error == EINPROGRESS))
5022 		return (ill);
5023 
5024 	/*
5025 	 * Couldn't find it.  Does this happen to be a lookup for the
5026 	 * loopback device and are we allowed to allocate it?
5027 	 */
5028 	if (!isloopback || !do_alloc)
5029 		return (NULL);
5030 
5031 	rw_enter(&ill_g_lock, RW_WRITER);
5032 
5033 	ill = ill_find_by_name(name, isv6, q, mp, func, error);
5034 	if (ill != NULL || (error != NULL && *error == EINPROGRESS)) {
5035 		rw_exit(&ill_g_lock);
5036 		return (ill);
5037 	}
5038 
5039 	/* Create the loopback device on demand */
5040 	ill = (ill_t *)(mi_alloc(sizeof (ill_t) +
5041 	    sizeof (ipif_loopback_name), BPRI_MED));
5042 	if (ill == NULL)
5043 		goto done;
5044 
5045 	*ill = ill_null;
5046 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, NULL);
5047 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
5048 	if (ill->ill_phyint == NULL)
5049 		goto done;
5050 
5051 	if (isv6)
5052 		ill->ill_phyint->phyint_illv6 = ill;
5053 	else
5054 		ill->ill_phyint->phyint_illv4 = ill;
5055 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
5056 	ill->ill_max_frag = IP_LOOPBACK_MTU;
5057 	/* Add room for tcp+ip headers */
5058 	if (isv6) {
5059 		ill->ill_isv6 = B_TRUE;
5060 		ill->ill_max_frag += IPV6_HDR_LEN + 20;	/* for TCP */
5061 		if (!ill_allocate_mibs(ill))
5062 			goto done;
5063 	} else {
5064 		ill->ill_max_frag += IP_SIMPLE_HDR_LENGTH + 20;
5065 	}
5066 	ill->ill_max_mtu = ill->ill_max_frag;
5067 	/*
5068 	 * ipif_loopback_name can't be pointed at directly because its used
5069 	 * by both the ipv4 and ipv6 interfaces.  When the ill is removed
5070 	 * from the glist, ill_glist_delete() sets the first character of
5071 	 * ill_name to '\0'.
5072 	 */
5073 	ill->ill_name = (char *)ill + sizeof (*ill);
5074 	(void) strcpy(ill->ill_name, ipif_loopback_name);
5075 	ill->ill_name_length = sizeof (ipif_loopback_name);
5076 	/* Set ill_name_set for ill_phyint_reinit to work properly */
5077 
5078 	ill->ill_global_timer = INFINITY;
5079 	ill->ill_mcast_type = IGMP_V3_ROUTER;	/* == MLD_V2_ROUTER */
5080 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
5081 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
5082 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
5083 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
5084 
5085 	/* No resolver here. */
5086 	ill->ill_net_type = IRE_LOOPBACK;
5087 
5088 	/* Initialize the ipsq */
5089 	if (!ipsq_init(ill))
5090 		goto done;
5091 
5092 	ill->ill_phyint->phyint_ipsq->ipsq_writer = NULL;
5093 	ill->ill_phyint->phyint_ipsq->ipsq_reentry_cnt--;
5094 	ASSERT(ill->ill_phyint->phyint_ipsq->ipsq_reentry_cnt == 0);
5095 #ifdef ILL_DEBUG
5096 	ill->ill_phyint->phyint_ipsq->ipsq_depth = 0;
5097 #endif
5098 	ipif = ipif_allocate(ill, 0L, IRE_LOOPBACK, B_TRUE);
5099 	if (ipif == NULL)
5100 		goto done;
5101 
5102 	ill->ill_flags = ILLF_MULTICAST;
5103 
5104 	/* Set up default loopback address and mask. */
5105 	if (!isv6) {
5106 		ipaddr_t inaddr_loopback = htonl(INADDR_LOOPBACK);
5107 
5108 		IN6_IPADDR_TO_V4MAPPED(inaddr_loopback, &ipif->ipif_v6lcl_addr);
5109 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
5110 		V4MASK_TO_V6(htonl(IN_CLASSA_NET), ipif->ipif_v6net_mask);
5111 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
5112 		    ipif->ipif_v6subnet);
5113 		ill->ill_flags |= ILLF_IPV4;
5114 	} else {
5115 		ipif->ipif_v6lcl_addr = ipv6_loopback;
5116 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
5117 		ipif->ipif_v6net_mask = ipv6_all_ones;
5118 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
5119 		    ipif->ipif_v6subnet);
5120 		ill->ill_flags |= ILLF_IPV6;
5121 	}
5122 
5123 	/*
5124 	 * Chain us in at the end of the ill list. hold the ill
5125 	 * before we make it globally visible. 1 for the lookup.
5126 	 */
5127 	ill->ill_refcnt = 0;
5128 	ill_refhold(ill);
5129 
5130 	ill->ill_frag_count = 0;
5131 	ill->ill_frag_free_num_pkts = 0;
5132 	ill->ill_last_frag_clean_time = 0;
5133 
5134 	old_ipsq = ill->ill_phyint->phyint_ipsq;
5135 
5136 	if (ill_glist_insert(ill, "lo", isv6) != 0)
5137 		cmn_err(CE_PANIC, "cannot insert loopback interface");
5138 
5139 	/* Let SCTP know so that it can add this to its list */
5140 	sctp_update_ill(ill, SCTP_ILL_INSERT);
5141 
5142 	/* Let SCTP know about this IPIF, so that it can add it to its list */
5143 	sctp_update_ipif(ipif, SCTP_IPIF_INSERT);
5144 
5145 	/*
5146 	 * If the ipsq was changed in ill_phyint_reinit free the old ipsq.
5147 	 */
5148 	if (old_ipsq != ill->ill_phyint->phyint_ipsq) {
5149 		/* Loopback ills aren't in any IPMP group */
5150 		ASSERT(!(old_ipsq->ipsq_flags & IPSQ_GROUP));
5151 		ipsq_delete(old_ipsq);
5152 	}
5153 
5154 	/*
5155 	 * Delay this till the ipif is allocated as ipif_allocate
5156 	 * de-references ill_phyint for getting the ifindex. We
5157 	 * can't do this before ipif_allocate because ill_phyint_reinit
5158 	 * -> phyint_assign_ifindex expects ipif to be present.
5159 	 */
5160 	mutex_enter(&ill->ill_phyint->phyint_lock);
5161 	ill->ill_phyint->phyint_flags |= PHYI_LOOPBACK | PHYI_VIRTUAL;
5162 	mutex_exit(&ill->ill_phyint->phyint_lock);
5163 
5164 	if (loopback_ksp == NULL) {
5165 		/* Export loopback interface statistics */
5166 		loopback_ksp = kstat_create("lo", 0, ipif_loopback_name, "net",
5167 		    KSTAT_TYPE_NAMED, 2, 0);
5168 		if (loopback_ksp != NULL) {
5169 			loopback_ksp->ks_update = loopback_kstat_update;
5170 			kn = KSTAT_NAMED_PTR(loopback_ksp);
5171 			kstat_named_init(&kn[0], "ipackets", KSTAT_DATA_UINT32);
5172 			kstat_named_init(&kn[1], "opackets", KSTAT_DATA_UINT32);
5173 			kstat_install(loopback_ksp);
5174 		}
5175 	}
5176 
5177 	if (error != NULL)
5178 		*error = 0;
5179 	*did_alloc = B_TRUE;
5180 	rw_exit(&ill_g_lock);
5181 	return (ill);
5182 done:
5183 	if (ill != NULL) {
5184 		if (ill->ill_phyint != NULL) {
5185 			ipsq_t	*ipsq;
5186 
5187 			ipsq = ill->ill_phyint->phyint_ipsq;
5188 			if (ipsq != NULL)
5189 				kmem_free(ipsq, sizeof (ipsq_t));
5190 			mi_free(ill->ill_phyint);
5191 		}
5192 		ill_free_mib(ill);
5193 		mi_free(ill);
5194 	}
5195 	rw_exit(&ill_g_lock);
5196 	if (error != NULL)
5197 		*error = ENOMEM;
5198 	return (NULL);
5199 }
5200 
5201 /*
5202  * Return a pointer to the ill which matches the index and IP version type.
5203  */
5204 ill_t *
5205 ill_lookup_on_ifindex(uint_t index, boolean_t isv6, queue_t *q, mblk_t *mp,
5206     ipsq_func_t func, int *err)
5207 {
5208 	ill_t	*ill;
5209 	ipsq_t  *ipsq;
5210 	phyint_t *phyi;
5211 
5212 	ASSERT((q == NULL && mp == NULL && func == NULL && err == NULL) ||
5213 	    (q != NULL && mp != NULL && func != NULL && err != NULL));
5214 
5215 	if (err != NULL)
5216 		*err = 0;
5217 
5218 	/*
5219 	 * Indexes are stored in the phyint - a common structure
5220 	 * to both IPv4 and IPv6.
5221 	 */
5222 	rw_enter(&ill_g_lock, RW_READER);
5223 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_index,
5224 	    (void *) &index, NULL);
5225 	if (phyi != NULL) {
5226 		ill = isv6 ? phyi->phyint_illv6: phyi->phyint_illv4;
5227 		if (ill != NULL) {
5228 			/*
5229 			 * The block comment at the start of ipif_down
5230 			 * explains the use of the macros used below
5231 			 */
5232 			GRAB_CONN_LOCK(q);
5233 			mutex_enter(&ill->ill_lock);
5234 			if (ILL_CAN_LOOKUP(ill)) {
5235 				ill_refhold_locked(ill);
5236 				mutex_exit(&ill->ill_lock);
5237 				RELEASE_CONN_LOCK(q);
5238 				rw_exit(&ill_g_lock);
5239 				return (ill);
5240 			} else if (ILL_CAN_WAIT(ill, q)) {
5241 				ipsq = ill->ill_phyint->phyint_ipsq;
5242 				mutex_enter(&ipsq->ipsq_lock);
5243 				rw_exit(&ill_g_lock);
5244 				mutex_exit(&ill->ill_lock);
5245 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
5246 				mutex_exit(&ipsq->ipsq_lock);
5247 				RELEASE_CONN_LOCK(q);
5248 				*err = EINPROGRESS;
5249 				return (NULL);
5250 			}
5251 			RELEASE_CONN_LOCK(q);
5252 			mutex_exit(&ill->ill_lock);
5253 		}
5254 	}
5255 	rw_exit(&ill_g_lock);
5256 	if (err != NULL)
5257 		*err = ENXIO;
5258 	return (NULL);
5259 }
5260 
5261 /*
5262  * Return the ifindex next in sequence after the passed in ifindex.
5263  * If there is no next ifindex for the given protocol, return 0.
5264  */
5265 uint_t
5266 ill_get_next_ifindex(uint_t index, boolean_t isv6)
5267 {
5268 	phyint_t *phyi;
5269 	phyint_t *phyi_initial;
5270 	uint_t   ifindex;
5271 
5272 	rw_enter(&ill_g_lock, RW_READER);
5273 
5274 	if (index == 0) {
5275 		phyi = avl_first(&phyint_g_list.phyint_list_avl_by_index);
5276 	} else {
5277 		phyi = phyi_initial = avl_find(
5278 		    &phyint_g_list.phyint_list_avl_by_index,
5279 		    (void *) &index, NULL);
5280 	}
5281 
5282 	for (; phyi != NULL;
5283 	    phyi = avl_walk(&phyint_g_list.phyint_list_avl_by_index,
5284 	    phyi, AVL_AFTER)) {
5285 		/*
5286 		 * If we're not returning the first interface in the tree
5287 		 * and we still haven't moved past the phyint_t that
5288 		 * corresponds to index, avl_walk needs to be called again
5289 		 */
5290 		if (!((index != 0) && (phyi == phyi_initial))) {
5291 			if (isv6) {
5292 				if ((phyi->phyint_illv6) &&
5293 				    ILL_CAN_LOOKUP(phyi->phyint_illv6) &&
5294 				    (phyi->phyint_illv6->ill_isv6 == 1))
5295 					break;
5296 			} else {
5297 				if ((phyi->phyint_illv4) &&
5298 				    ILL_CAN_LOOKUP(phyi->phyint_illv4) &&
5299 				    (phyi->phyint_illv4->ill_isv6 == 0))
5300 					break;
5301 			}
5302 		}
5303 	}
5304 
5305 	rw_exit(&ill_g_lock);
5306 
5307 	if (phyi != NULL)
5308 		ifindex = phyi->phyint_ifindex;
5309 	else
5310 		ifindex = 0;
5311 
5312 	return (ifindex);
5313 }
5314 
5315 
5316 /*
5317  * Return the ifindex for the named interface.
5318  * If there is no next ifindex for the interface, return 0.
5319  */
5320 uint_t
5321 ill_get_ifindex_by_name(char *name)
5322 {
5323 	phyint_t	*phyi;
5324 	avl_index_t	where = 0;
5325 	uint_t		ifindex;
5326 
5327 	rw_enter(&ill_g_lock, RW_READER);
5328 
5329 	if ((phyi = avl_find(&phyint_g_list.phyint_list_avl_by_name,
5330 	    name, &where)) == NULL) {
5331 		rw_exit(&ill_g_lock);
5332 		return (0);
5333 	}
5334 
5335 	ifindex = phyi->phyint_ifindex;
5336 
5337 	rw_exit(&ill_g_lock);
5338 
5339 	return (ifindex);
5340 }
5341 
5342 
5343 /*
5344  * Obtain a reference to the ill. The ill_refcnt is a dynamic refcnt
5345  * that gives a running thread a reference to the ill. This reference must be
5346  * released by the thread when it is done accessing the ill and related
5347  * objects. ill_refcnt can not be used to account for static references
5348  * such as other structures pointing to an ill. Callers must generally
5349  * check whether an ill can be refheld by using ILL_CAN_LOOKUP macros
5350  * or be sure that the ill is not being deleted or changing state before
5351  * calling the refhold functions. A non-zero ill_refcnt ensures that the
5352  * ill won't change any of its critical state such as address, netmask etc.
5353  */
5354 void
5355 ill_refhold(ill_t *ill)
5356 {
5357 	mutex_enter(&ill->ill_lock);
5358 	ill->ill_refcnt++;
5359 	ILL_TRACE_REF(ill);
5360 	mutex_exit(&ill->ill_lock);
5361 }
5362 
5363 void
5364 ill_refhold_locked(ill_t *ill)
5365 {
5366 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5367 	ill->ill_refcnt++;
5368 	ILL_TRACE_REF(ill);
5369 }
5370 
5371 int
5372 ill_check_and_refhold(ill_t *ill)
5373 {
5374 	mutex_enter(&ill->ill_lock);
5375 	if (ILL_CAN_LOOKUP(ill)) {
5376 		ill_refhold_locked(ill);
5377 		mutex_exit(&ill->ill_lock);
5378 		return (0);
5379 	}
5380 	mutex_exit(&ill->ill_lock);
5381 	return (ILL_LOOKUP_FAILED);
5382 }
5383 
5384 /*
5385  * Must not be called while holding any locks. Otherwise if this is
5386  * the last reference to be released, there is a chance of recursive mutex
5387  * panic due to ill_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
5388  * to restart an ioctl.
5389  */
5390 void
5391 ill_refrele(ill_t *ill)
5392 {
5393 	mutex_enter(&ill->ill_lock);
5394 	ASSERT(ill->ill_refcnt != 0);
5395 	ill->ill_refcnt--;
5396 	ILL_UNTRACE_REF(ill);
5397 	if (ill->ill_refcnt != 0) {
5398 		/* Every ire pointing to the ill adds 1 to ill_refcnt */
5399 		mutex_exit(&ill->ill_lock);
5400 		return;
5401 	}
5402 
5403 	/* Drops the ill_lock */
5404 	ipif_ill_refrele_tail(ill);
5405 }
5406 
5407 /*
5408  * Obtain a weak reference count on the ill. This reference ensures the
5409  * ill won't be freed, but the ill may change any of its critical state
5410  * such as netmask, address etc. Returns an error if the ill has started
5411  * closing.
5412  */
5413 boolean_t
5414 ill_waiter_inc(ill_t *ill)
5415 {
5416 	mutex_enter(&ill->ill_lock);
5417 	if (ill->ill_state_flags & ILL_CONDEMNED) {
5418 		mutex_exit(&ill->ill_lock);
5419 		return (B_FALSE);
5420 	}
5421 	ill->ill_waiters++;
5422 	mutex_exit(&ill->ill_lock);
5423 	return (B_TRUE);
5424 }
5425 
5426 void
5427 ill_waiter_dcr(ill_t *ill)
5428 {
5429 	mutex_enter(&ill->ill_lock);
5430 	ill->ill_waiters--;
5431 	if (ill->ill_waiters == 0)
5432 		cv_broadcast(&ill->ill_cv);
5433 	mutex_exit(&ill->ill_lock);
5434 }
5435 
5436 /*
5437  * Named Dispatch routine to produce a formatted report on all ILLs.
5438  * This report is accessed by using the ndd utility to "get" ND variable
5439  * "ip_ill_status".
5440  */
5441 /* ARGSUSED */
5442 int
5443 ip_ill_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
5444 {
5445 	ill_t		*ill;
5446 	ill_walk_context_t ctx;
5447 
5448 	(void) mi_mpprintf(mp,
5449 	    "ILL      " MI_COL_HDRPAD_STR
5450 	/*   01234567[89ABCDEF] */
5451 	    "rq       " MI_COL_HDRPAD_STR
5452 	/*   01234567[89ABCDEF] */
5453 	    "wq       " MI_COL_HDRPAD_STR
5454 	/*   01234567[89ABCDEF] */
5455 	    "upcnt mxfrg err name");
5456 	/*   12345 12345 123 xxxxxxxx  */
5457 
5458 	rw_enter(&ill_g_lock, RW_READER);
5459 	ill = ILL_START_WALK_ALL(&ctx);
5460 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5461 		(void) mi_mpprintf(mp,
5462 		    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR
5463 		    "%05u %05u %03d %s",
5464 		    (void *)ill, (void *)ill->ill_rq, (void *)ill->ill_wq,
5465 		    ill->ill_ipif_up_count,
5466 		    ill->ill_max_frag, ill->ill_error, ill->ill_name);
5467 	}
5468 	rw_exit(&ill_g_lock);
5469 
5470 	return (0);
5471 }
5472 
5473 /*
5474  * Named Dispatch routine to produce a formatted report on all IPIFs.
5475  * This report is accessed by using the ndd utility to "get" ND variable
5476  * "ip_ipif_status".
5477  */
5478 /* ARGSUSED */
5479 int
5480 ip_ipif_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
5481 {
5482 	char	buf1[INET6_ADDRSTRLEN];
5483 	char	buf2[INET6_ADDRSTRLEN];
5484 	char	buf3[INET6_ADDRSTRLEN];
5485 	char	buf4[INET6_ADDRSTRLEN];
5486 	char	buf5[INET6_ADDRSTRLEN];
5487 	char	buf6[INET6_ADDRSTRLEN];
5488 	char	buf[LIFNAMSIZ];
5489 	ill_t	*ill;
5490 	ipif_t	*ipif;
5491 	nv_t	*nvp;
5492 	uint64_t flags;
5493 	zoneid_t zoneid;
5494 	ill_walk_context_t ctx;
5495 
5496 	(void) mi_mpprintf(mp,
5497 	    "IPIF metric mtu in/out/forward name zone flags...\n"
5498 	    "\tlocal address\n"
5499 	    "\tsrc address\n"
5500 	    "\tsubnet\n"
5501 	    "\tmask\n"
5502 	    "\tbroadcast\n"
5503 	    "\tp-p-dst");
5504 
5505 	ASSERT(q->q_next == NULL);
5506 	zoneid = Q_TO_CONN(q)->conn_zoneid;	/* IP is a driver */
5507 
5508 	rw_enter(&ill_g_lock, RW_READER);
5509 	ill = ILL_START_WALK_ALL(&ctx);
5510 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5511 		for (ipif = ill->ill_ipif; ipif != NULL;
5512 		    ipif = ipif->ipif_next) {
5513 			if (zoneid != GLOBAL_ZONEID &&
5514 			    zoneid != ipif->ipif_zoneid &&
5515 			    ipif->ipif_zoneid != ALL_ZONES)
5516 				continue;
5517 			(void) mi_mpprintf(mp,
5518 			    MI_COL_PTRFMT_STR
5519 			    "%04u %05u %u/%u/%u %s %d",
5520 			    (void *)ipif,
5521 			    ipif->ipif_metric, ipif->ipif_mtu,
5522 			    ipif->ipif_ib_pkt_count,
5523 			    ipif->ipif_ob_pkt_count,
5524 			    ipif->ipif_fo_pkt_count,
5525 			    ipif_get_name(ipif, buf, sizeof (buf)),
5526 			    ipif->ipif_zoneid);
5527 
5528 		flags = ipif->ipif_flags | ipif->ipif_ill->ill_flags |
5529 		    ipif->ipif_ill->ill_phyint->phyint_flags;
5530 
5531 		/* Tack on text strings for any flags. */
5532 		nvp = ipif_nv_tbl;
5533 		for (; nvp < A_END(ipif_nv_tbl); nvp++) {
5534 			if (nvp->nv_value & flags)
5535 				(void) mi_mpprintf_nr(mp, " %s",
5536 				    nvp->nv_name);
5537 		}
5538 		(void) mi_mpprintf(mp,
5539 		    "\t%s\n\t%s\n\t%s\n\t%s\n\t%s\n\t%s",
5540 		    inet_ntop(AF_INET6,
5541 			&ipif->ipif_v6lcl_addr, buf1, sizeof (buf1)),
5542 		    inet_ntop(AF_INET6,
5543 			&ipif->ipif_v6src_addr, buf2, sizeof (buf2)),
5544 		    inet_ntop(AF_INET6,
5545 			&ipif->ipif_v6subnet, buf3, sizeof (buf3)),
5546 		    inet_ntop(AF_INET6,
5547 			&ipif->ipif_v6net_mask, buf4, sizeof (buf4)),
5548 		    inet_ntop(AF_INET6,
5549 			&ipif->ipif_v6brd_addr, buf5, sizeof (buf5)),
5550 		    inet_ntop(AF_INET6,
5551 			&ipif->ipif_v6pp_dst_addr,
5552 			buf6, sizeof (buf6)));
5553 		}
5554 	}
5555 	rw_exit(&ill_g_lock);
5556 	return (0);
5557 }
5558 
5559 /*
5560  * ip_ll_subnet_defaults is called when we get the DL_INFO_ACK back from the
5561  * driver.  We construct best guess defaults for lower level information that
5562  * we need.  If an interface is brought up without injection of any overriding
5563  * information from outside, we have to be ready to go with these defaults.
5564  * When we get the first DL_INFO_ACK (from ip_open() sending a DL_INFO_REQ)
5565  * we primarely want the dl_provider_style.
5566  * The subsequent DL_INFO_ACK is received after doing a DL_ATTACH and DL_BIND
5567  * at which point we assume the other part of the information is valid.
5568  */
5569 void
5570 ip_ll_subnet_defaults(ill_t *ill, mblk_t *mp)
5571 {
5572 	uchar_t		*brdcst_addr;
5573 	uint_t		brdcst_addr_length, phys_addr_length;
5574 	t_scalar_t	sap_length;
5575 	dl_info_ack_t	*dlia;
5576 	ip_m_t		*ipm;
5577 	dl_qos_cl_sel1_t *sel1;
5578 
5579 	ASSERT(IAM_WRITER_ILL(ill));
5580 
5581 	/*
5582 	 * Till the ill is fully up ILL_CHANGING will be set and
5583 	 * the ill is not globally visible. So no need for a lock.
5584 	 */
5585 	dlia = (dl_info_ack_t *)mp->b_rptr;
5586 	ill->ill_mactype = dlia->dl_mac_type;
5587 
5588 	ipm = ip_m_lookup(dlia->dl_mac_type);
5589 	if (ipm == NULL) {
5590 		ipm = ip_m_lookup(DL_OTHER);
5591 		ASSERT(ipm != NULL);
5592 	}
5593 	ill->ill_media = ipm;
5594 
5595 	/*
5596 	 * When the new DLPI stuff is ready we'll pull lengths
5597 	 * from dlia.
5598 	 */
5599 	if (dlia->dl_version == DL_VERSION_2) {
5600 		brdcst_addr_length = dlia->dl_brdcst_addr_length;
5601 		brdcst_addr = mi_offset_param(mp, dlia->dl_brdcst_addr_offset,
5602 		    brdcst_addr_length);
5603 		if (brdcst_addr == NULL) {
5604 			brdcst_addr_length = 0;
5605 		}
5606 		sap_length = dlia->dl_sap_length;
5607 		phys_addr_length = dlia->dl_addr_length - ABS(sap_length);
5608 		ip1dbg(("ip: bcast_len %d, sap_len %d, phys_len %d\n",
5609 		    brdcst_addr_length, sap_length, phys_addr_length));
5610 	} else {
5611 		brdcst_addr_length = 6;
5612 		brdcst_addr = ip_six_byte_all_ones;
5613 		sap_length = -2;
5614 		phys_addr_length = brdcst_addr_length;
5615 	}
5616 
5617 	ill->ill_bcast_addr_length = brdcst_addr_length;
5618 	ill->ill_phys_addr_length = phys_addr_length;
5619 	ill->ill_sap_length = sap_length;
5620 	ill->ill_max_frag = dlia->dl_max_sdu;
5621 	ill->ill_max_mtu = ill->ill_max_frag;
5622 
5623 	ill->ill_type = ipm->ip_m_type;
5624 
5625 	if (!ill->ill_dlpi_style_set) {
5626 		if (dlia->dl_provider_style == DL_STYLE2)
5627 			ill->ill_needs_attach = 1;
5628 
5629 		/*
5630 		 * Allocate the first ipif on this ill. We don't delay it
5631 		 * further as ioctl handling assumes atleast one ipif to
5632 		 * be present.
5633 		 *
5634 		 * At this point we don't know whether the ill is v4 or v6.
5635 		 * We will know this whan the SIOCSLIFNAME happens and
5636 		 * the correct value for ill_isv6 will be assigned in
5637 		 * ipif_set_values(). We need to hold the ill lock and
5638 		 * clear the ILL_LL_SUBNET_PENDING flag and atomically do
5639 		 * the wakeup.
5640 		 */
5641 		(void) ipif_allocate(ill, 0, IRE_LOCAL,
5642 		    dlia->dl_provider_style == DL_STYLE2 ? B_FALSE : B_TRUE);
5643 		mutex_enter(&ill->ill_lock);
5644 		ASSERT(ill->ill_dlpi_style_set == 0);
5645 		ill->ill_dlpi_style_set = 1;
5646 		ill->ill_state_flags &= ~ILL_LL_SUBNET_PENDING;
5647 		cv_broadcast(&ill->ill_cv);
5648 		mutex_exit(&ill->ill_lock);
5649 		freemsg(mp);
5650 		return;
5651 	}
5652 	ASSERT(ill->ill_ipif != NULL);
5653 	/*
5654 	 * We know whether it is IPv4 or IPv6 now, as this is the
5655 	 * second DL_INFO_ACK we are recieving in response to the
5656 	 * DL_INFO_REQ sent in ipif_set_values.
5657 	 */
5658 	if (ill->ill_isv6)
5659 		ill->ill_sap = IP6_DL_SAP;
5660 	else
5661 		ill->ill_sap = IP_DL_SAP;
5662 	/*
5663 	 * Set ipif_mtu which is used to set the IRE's
5664 	 * ire_max_frag value. The driver could have sent
5665 	 * a different mtu from what it sent last time. No
5666 	 * need to call ipif_mtu_change because IREs have
5667 	 * not yet been created.
5668 	 */
5669 	ill->ill_ipif->ipif_mtu = ill->ill_max_mtu;
5670 	/*
5671 	 * Clear all the flags that were set based on ill_bcast_addr_length
5672 	 * and ill_phys_addr_length (in ipif_set_values) as these could have
5673 	 * changed now and we need to re-evaluate.
5674 	 */
5675 	ill->ill_flags &= ~(ILLF_MULTICAST | ILLF_NONUD | ILLF_NOARP);
5676 	ill->ill_ipif->ipif_flags &= ~(IPIF_BROADCAST | IPIF_POINTOPOINT);
5677 
5678 	/*
5679 	 * Free ill_resolver_mp and ill_bcast_mp as things could have
5680 	 * changed now.
5681 	 */
5682 	if (ill->ill_bcast_addr_length == 0) {
5683 		if (ill->ill_resolver_mp != NULL)
5684 			freemsg(ill->ill_resolver_mp);
5685 		if (ill->ill_bcast_mp != NULL)
5686 			freemsg(ill->ill_bcast_mp);
5687 		if (ill->ill_flags & ILLF_XRESOLV)
5688 			ill->ill_net_type = IRE_IF_RESOLVER;
5689 		else
5690 			ill->ill_net_type = IRE_IF_NORESOLVER;
5691 		ill->ill_resolver_mp = ill_dlur_gen(NULL,
5692 		    ill->ill_phys_addr_length,
5693 		    ill->ill_sap,
5694 		    ill->ill_sap_length);
5695 		ill->ill_bcast_mp = copymsg(ill->ill_resolver_mp);
5696 
5697 		if (ill->ill_isv6)
5698 			/*
5699 			 * Note: xresolv interfaces will eventually need NOARP
5700 			 * set here as well, but that will require those
5701 			 * external resolvers to have some knowledge of
5702 			 * that flag and act appropriately. Not to be changed
5703 			 * at present.
5704 			 */
5705 			ill->ill_flags |= ILLF_NONUD;
5706 		else
5707 			ill->ill_flags |= ILLF_NOARP;
5708 
5709 		if (ill->ill_phys_addr_length == 0) {
5710 			if (ill->ill_media->ip_m_mac_type == SUNW_DL_VNI) {
5711 				ill->ill_ipif->ipif_flags |= IPIF_NOXMIT;
5712 				ill->ill_phyint->phyint_flags |= PHYI_VIRTUAL;
5713 			} else {
5714 				/* pt-pt supports multicast. */
5715 				ill->ill_flags |= ILLF_MULTICAST;
5716 				ill->ill_ipif->ipif_flags |= IPIF_POINTOPOINT;
5717 			}
5718 		}
5719 	} else {
5720 		ill->ill_net_type = IRE_IF_RESOLVER;
5721 		if (ill->ill_bcast_mp != NULL)
5722 			freemsg(ill->ill_bcast_mp);
5723 		ill->ill_bcast_mp = ill_dlur_gen(brdcst_addr,
5724 		    ill->ill_bcast_addr_length, ill->ill_sap,
5725 		    ill->ill_sap_length);
5726 		/*
5727 		 * Later detect lack of DLPI driver multicast
5728 		 * capability by catching DL_ENABMULTI errors in
5729 		 * ip_rput_dlpi.
5730 		 */
5731 		ill->ill_flags |= ILLF_MULTICAST;
5732 		if (!ill->ill_isv6)
5733 			ill->ill_ipif->ipif_flags |= IPIF_BROADCAST;
5734 	}
5735 	/* By default an interface does not support any CoS marking */
5736 	ill->ill_flags &= ~ILLF_COS_ENABLED;
5737 
5738 	/*
5739 	 * If we get QoS information in DL_INFO_ACK, the device supports
5740 	 * some form of CoS marking, set ILLF_COS_ENABLED.
5741 	 */
5742 	sel1 = (dl_qos_cl_sel1_t *)mi_offset_param(mp, dlia->dl_qos_offset,
5743 	    dlia->dl_qos_length);
5744 	if ((sel1 != NULL) && (sel1->dl_qos_type == DL_QOS_CL_SEL1)) {
5745 		ill->ill_flags |= ILLF_COS_ENABLED;
5746 	}
5747 
5748 	/* Clear any previous error indication. */
5749 	ill->ill_error = 0;
5750 	freemsg(mp);
5751 }
5752 
5753 /*
5754  * Perform various checks to verify that an address would make sense as a
5755  * local, remote, or subnet interface address.
5756  */
5757 static boolean_t
5758 ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask)
5759 {
5760 	ipaddr_t	net_mask;
5761 
5762 	/*
5763 	 * Don't allow all zeroes, all ones or experimental address, but allow
5764 	 * all ones netmask.
5765 	 */
5766 	if ((net_mask = ip_net_mask(addr)) == 0)
5767 		return (B_FALSE);
5768 	/* A given netmask overrides the "guess" netmask */
5769 	if (subnet_mask != 0)
5770 		net_mask = subnet_mask;
5771 	if ((net_mask != ~(ipaddr_t)0) && ((addr == (addr & net_mask)) ||
5772 	    (addr == (addr | ~net_mask)))) {
5773 		return (B_FALSE);
5774 	}
5775 	if (CLASSD(addr))
5776 		return (B_FALSE);
5777 
5778 	return (B_TRUE);
5779 }
5780 
5781 /*
5782  * ipif_lookup_group
5783  * Returns held ipif
5784  */
5785 ipif_t *
5786 ipif_lookup_group(ipaddr_t group, zoneid_t zoneid)
5787 {
5788 	ire_t	*ire;
5789 	ipif_t	*ipif;
5790 
5791 	ire = ire_lookup_multi(group, zoneid);
5792 	if (ire == NULL)
5793 		return (NULL);
5794 	ipif = ire->ire_ipif;
5795 	ipif_refhold(ipif);
5796 	ire_refrele(ire);
5797 	return (ipif);
5798 }
5799 
5800 /*
5801  * Look for an ipif with the specified interface address and destination.
5802  * The destination address is used only for matching point-to-point interfaces.
5803  */
5804 ipif_t *
5805 ipif_lookup_interface(ipaddr_t if_addr, ipaddr_t dst, queue_t *q, mblk_t *mp,
5806     ipsq_func_t func, int *error)
5807 {
5808 	ipif_t	*ipif;
5809 	ill_t	*ill;
5810 	ill_walk_context_t ctx;
5811 	ipsq_t	*ipsq;
5812 
5813 	if (error != NULL)
5814 		*error = 0;
5815 
5816 	/*
5817 	 * First match all the point-to-point interfaces
5818 	 * before looking at non-point-to-point interfaces.
5819 	 * This is done to avoid returning non-point-to-point
5820 	 * ipif instead of unnumbered point-to-point ipif.
5821 	 */
5822 	rw_enter(&ill_g_lock, RW_READER);
5823 	ill = ILL_START_WALK_V4(&ctx);
5824 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5825 		GRAB_CONN_LOCK(q);
5826 		mutex_enter(&ill->ill_lock);
5827 		for (ipif = ill->ill_ipif; ipif != NULL;
5828 		    ipif = ipif->ipif_next) {
5829 			/* Allow the ipif to be down */
5830 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
5831 			    (ipif->ipif_lcl_addr == if_addr) &&
5832 			    (ipif->ipif_pp_dst_addr == dst)) {
5833 				/*
5834 				 * The block comment at the start of ipif_down
5835 				 * explains the use of the macros used below
5836 				 */
5837 				if (IPIF_CAN_LOOKUP(ipif)) {
5838 					ipif_refhold_locked(ipif);
5839 					mutex_exit(&ill->ill_lock);
5840 					RELEASE_CONN_LOCK(q);
5841 					rw_exit(&ill_g_lock);
5842 					return (ipif);
5843 				} else if (IPIF_CAN_WAIT(ipif, q)) {
5844 					ipsq = ill->ill_phyint->phyint_ipsq;
5845 					mutex_enter(&ipsq->ipsq_lock);
5846 					mutex_exit(&ill->ill_lock);
5847 					rw_exit(&ill_g_lock);
5848 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
5849 						ill);
5850 					mutex_exit(&ipsq->ipsq_lock);
5851 					RELEASE_CONN_LOCK(q);
5852 					*error = EINPROGRESS;
5853 					return (NULL);
5854 				}
5855 			}
5856 		}
5857 		mutex_exit(&ill->ill_lock);
5858 		RELEASE_CONN_LOCK(q);
5859 	}
5860 	rw_exit(&ill_g_lock);
5861 
5862 	/* lookup the ipif based on interface address */
5863 	ipif = ipif_lookup_addr(if_addr, NULL, ALL_ZONES, q, mp, func, error);
5864 	ASSERT(ipif == NULL || !ipif->ipif_isv6);
5865 	return (ipif);
5866 }
5867 
5868 /*
5869  * Look for an ipif with the specified address. For point-point links
5870  * we look for matches on either the destination address and the local
5871  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
5872  * is set.
5873  * Matches on a specific ill if match_ill is set.
5874  */
5875 ipif_t *
5876 ipif_lookup_addr(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid, queue_t *q,
5877     mblk_t *mp, ipsq_func_t func, int *error)
5878 {
5879 	ipif_t  *ipif;
5880 	ill_t   *ill;
5881 	boolean_t ptp = B_FALSE;
5882 	ipsq_t	*ipsq;
5883 	ill_walk_context_t	ctx;
5884 
5885 	if (error != NULL)
5886 		*error = 0;
5887 
5888 	rw_enter(&ill_g_lock, RW_READER);
5889 	/*
5890 	 * Repeat twice, first based on local addresses and
5891 	 * next time for pointopoint.
5892 	 */
5893 repeat:
5894 	ill = ILL_START_WALK_V4(&ctx);
5895 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5896 		if (match_ill != NULL && ill != match_ill) {
5897 			continue;
5898 		}
5899 		GRAB_CONN_LOCK(q);
5900 		mutex_enter(&ill->ill_lock);
5901 		for (ipif = ill->ill_ipif; ipif != NULL;
5902 		    ipif = ipif->ipif_next) {
5903 			if (zoneid != ALL_ZONES &&
5904 			    zoneid != ipif->ipif_zoneid &&
5905 			    ipif->ipif_zoneid != ALL_ZONES)
5906 				continue;
5907 			/* Allow the ipif to be down */
5908 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
5909 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
5910 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
5911 			    (ipif->ipif_pp_dst_addr == addr))) {
5912 				/*
5913 				 * The block comment at the start of ipif_down
5914 				 * explains the use of the macros used below
5915 				 */
5916 				if (IPIF_CAN_LOOKUP(ipif)) {
5917 					ipif_refhold_locked(ipif);
5918 					mutex_exit(&ill->ill_lock);
5919 					RELEASE_CONN_LOCK(q);
5920 					rw_exit(&ill_g_lock);
5921 					return (ipif);
5922 				} else if (IPIF_CAN_WAIT(ipif, q)) {
5923 					ipsq = ill->ill_phyint->phyint_ipsq;
5924 					mutex_enter(&ipsq->ipsq_lock);
5925 					mutex_exit(&ill->ill_lock);
5926 					rw_exit(&ill_g_lock);
5927 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
5928 						ill);
5929 					mutex_exit(&ipsq->ipsq_lock);
5930 					RELEASE_CONN_LOCK(q);
5931 					*error = EINPROGRESS;
5932 					return (NULL);
5933 				}
5934 			}
5935 		}
5936 		mutex_exit(&ill->ill_lock);
5937 		RELEASE_CONN_LOCK(q);
5938 	}
5939 
5940 	/* If we already did the ptp case, then we are done */
5941 	if (ptp) {
5942 		rw_exit(&ill_g_lock);
5943 		if (error != NULL)
5944 			*error = ENXIO;
5945 		return (NULL);
5946 	}
5947 	ptp = B_TRUE;
5948 	goto repeat;
5949 }
5950 
5951 /*
5952  * Look for an ipif with the specified address. For point-point links
5953  * we look for matches on either the destination address and the local
5954  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
5955  * is set.
5956  * Matches on a specific ill if match_ill is set.
5957  * Return the zoneid for the ipif which matches. ALL_ZONES if no match.
5958  */
5959 zoneid_t
5960 ipif_lookup_addr_zoneid(ipaddr_t addr, ill_t *match_ill)
5961 {
5962 	zoneid_t zoneid;
5963 	ipif_t  *ipif;
5964 	ill_t   *ill;
5965 	boolean_t ptp = B_FALSE;
5966 	ill_walk_context_t	ctx;
5967 
5968 	rw_enter(&ill_g_lock, RW_READER);
5969 	/*
5970 	 * Repeat twice, first based on local addresses and
5971 	 * next time for pointopoint.
5972 	 */
5973 repeat:
5974 	ill = ILL_START_WALK_V4(&ctx);
5975 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5976 		if (match_ill != NULL && ill != match_ill) {
5977 			continue;
5978 		}
5979 		mutex_enter(&ill->ill_lock);
5980 		for (ipif = ill->ill_ipif; ipif != NULL;
5981 		    ipif = ipif->ipif_next) {
5982 			/* Allow the ipif to be down */
5983 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
5984 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
5985 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
5986 			    (ipif->ipif_pp_dst_addr == addr)) &&
5987 			    !(ipif->ipif_state_flags & IPIF_CONDEMNED)) {
5988 				zoneid = ipif->ipif_zoneid;
5989 				mutex_exit(&ill->ill_lock);
5990 				rw_exit(&ill_g_lock);
5991 				/*
5992 				 * If ipif_zoneid was ALL_ZONES then we have
5993 				 * a trusted extensions shared IP address.
5994 				 * In that case GLOBAL_ZONEID works to send.
5995 				 */
5996 				if (zoneid == ALL_ZONES)
5997 					zoneid = GLOBAL_ZONEID;
5998 				return (zoneid);
5999 			}
6000 		}
6001 		mutex_exit(&ill->ill_lock);
6002 	}
6003 
6004 	/* If we already did the ptp case, then we are done */
6005 	if (ptp) {
6006 		rw_exit(&ill_g_lock);
6007 		return (ALL_ZONES);
6008 	}
6009 	ptp = B_TRUE;
6010 	goto repeat;
6011 }
6012 
6013 /*
6014  * Look for an ipif that matches the specified remote address i.e. the
6015  * ipif that would receive the specified packet.
6016  * First look for directly connected interfaces and then do a recursive
6017  * IRE lookup and pick the first ipif corresponding to the source address in the
6018  * ire.
6019  * Returns: held ipif
6020  */
6021 ipif_t *
6022 ipif_lookup_remote(ill_t *ill, ipaddr_t addr, zoneid_t zoneid)
6023 {
6024 	ipif_t	*ipif;
6025 	ire_t	*ire;
6026 
6027 	ASSERT(!ill->ill_isv6);
6028 
6029 	/*
6030 	 * Someone could be changing this ipif currently or change it
6031 	 * after we return this. Thus  a few packets could use the old
6032 	 * old values. However structure updates/creates (ire, ilg, ilm etc)
6033 	 * will atomically be updated or cleaned up with the new value
6034 	 * Thus we don't need a lock to check the flags or other attrs below.
6035 	 */
6036 	mutex_enter(&ill->ill_lock);
6037 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
6038 		if (!IPIF_CAN_LOOKUP(ipif))
6039 			continue;
6040 		if (zoneid != ALL_ZONES && zoneid != ipif->ipif_zoneid &&
6041 		    ipif->ipif_zoneid != ALL_ZONES)
6042 			continue;
6043 		/* Allow the ipif to be down */
6044 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
6045 			if ((ipif->ipif_pp_dst_addr == addr) ||
6046 			    (!(ipif->ipif_flags & IPIF_UNNUMBERED) &&
6047 			    ipif->ipif_lcl_addr == addr)) {
6048 				ipif_refhold_locked(ipif);
6049 				mutex_exit(&ill->ill_lock);
6050 				return (ipif);
6051 			}
6052 		} else if (ipif->ipif_subnet == (addr & ipif->ipif_net_mask)) {
6053 			ipif_refhold_locked(ipif);
6054 			mutex_exit(&ill->ill_lock);
6055 			return (ipif);
6056 		}
6057 	}
6058 	mutex_exit(&ill->ill_lock);
6059 	ire = ire_route_lookup(addr, 0, 0, 0, NULL, NULL, zoneid,
6060 	    NULL, MATCH_IRE_RECURSIVE);
6061 	if (ire != NULL) {
6062 		/*
6063 		 * The callers of this function wants to know the
6064 		 * interface on which they have to send the replies
6065 		 * back. For IRE_CACHES that have ire_stq and ire_ipif
6066 		 * derived from different ills, we really don't care
6067 		 * what we return here.
6068 		 */
6069 		ipif = ire->ire_ipif;
6070 		if (ipif != NULL) {
6071 			ipif_refhold(ipif);
6072 			ire_refrele(ire);
6073 			return (ipif);
6074 		}
6075 		ire_refrele(ire);
6076 	}
6077 	/* Pick the first interface */
6078 	ipif = ipif_get_next_ipif(NULL, ill);
6079 	return (ipif);
6080 }
6081 
6082 /*
6083  * This func does not prevent refcnt from increasing. But if
6084  * the caller has taken steps to that effect, then this func
6085  * can be used to determine whether the ill has become quiescent
6086  */
6087 boolean_t
6088 ill_is_quiescent(ill_t *ill)
6089 {
6090 	ipif_t	*ipif;
6091 
6092 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6093 
6094 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
6095 		if (ipif->ipif_refcnt != 0 || ipif->ipif_ire_cnt != 0) {
6096 			return (B_FALSE);
6097 		}
6098 	}
6099 	if (ill->ill_ire_cnt != 0 || ill->ill_refcnt != 0 ||
6100 	    ill->ill_nce_cnt != 0 || ill->ill_srcif_refcnt != 0 ||
6101 	    ill->ill_mrtun_refcnt != 0) {
6102 		return (B_FALSE);
6103 	}
6104 	return (B_TRUE);
6105 }
6106 
6107 /*
6108  * This func does not prevent refcnt from increasing. But if
6109  * the caller has taken steps to that effect, then this func
6110  * can be used to determine whether the ipif has become quiescent
6111  */
6112 static boolean_t
6113 ipif_is_quiescent(ipif_t *ipif)
6114 {
6115 	ill_t *ill;
6116 
6117 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6118 
6119 	if (ipif->ipif_refcnt != 0 || ipif->ipif_ire_cnt != 0) {
6120 		return (B_FALSE);
6121 	}
6122 
6123 	ill = ipif->ipif_ill;
6124 	if (ill->ill_ipif_up_count != 0 || ill->ill_ipif_dup_count != 0 ||
6125 	    ill->ill_logical_down) {
6126 		return (B_TRUE);
6127 	}
6128 
6129 	/* This is the last ipif going down or being deleted on this ill */
6130 	if (ill->ill_ire_cnt != 0 || ill->ill_refcnt != 0) {
6131 		return (B_FALSE);
6132 	}
6133 
6134 	return (B_TRUE);
6135 }
6136 
6137 /*
6138  * This func does not prevent refcnt from increasing. But if
6139  * the caller has taken steps to that effect, then this func
6140  * can be used to determine whether the ipifs marked with IPIF_MOVING
6141  * have become quiescent and can be moved in a failover/failback.
6142  */
6143 static ipif_t *
6144 ill_quiescent_to_move(ill_t *ill)
6145 {
6146 	ipif_t  *ipif;
6147 
6148 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6149 
6150 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
6151 		if (ipif->ipif_state_flags & IPIF_MOVING) {
6152 			if (ipif->ipif_refcnt != 0 || ipif->ipif_ire_cnt != 0) {
6153 				return (ipif);
6154 			}
6155 		}
6156 	}
6157 	return (NULL);
6158 }
6159 
6160 /*
6161  * The ipif/ill/ire has been refreled. Do the tail processing.
6162  * Determine if the ipif or ill in question has become quiescent and if so
6163  * wakeup close and/or restart any queued pending ioctl that is waiting
6164  * for the ipif_down (or ill_down)
6165  */
6166 void
6167 ipif_ill_refrele_tail(ill_t *ill)
6168 {
6169 	mblk_t	*mp;
6170 	conn_t	*connp;
6171 	ipsq_t	*ipsq;
6172 	ipif_t	*ipif;
6173 
6174 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6175 
6176 	if ((ill->ill_state_flags & ILL_CONDEMNED) &&
6177 	    ill_is_quiescent(ill)) {
6178 		/* ill_close may be waiting */
6179 		cv_broadcast(&ill->ill_cv);
6180 	}
6181 
6182 	/* ipsq can't change because ill_lock  is held */
6183 	ipsq = ill->ill_phyint->phyint_ipsq;
6184 	if (ipsq->ipsq_waitfor == 0) {
6185 		/* Not waiting for anything, just return. */
6186 		mutex_exit(&ill->ill_lock);
6187 		return;
6188 	}
6189 	ASSERT(ipsq->ipsq_pending_mp != NULL &&
6190 		ipsq->ipsq_pending_ipif != NULL);
6191 	/*
6192 	 * ipif->ipif_refcnt must go down to zero for restarting REMOVEIF.
6193 	 * Last ipif going down needs to down the ill, so ill_ire_cnt must
6194 	 * be zero for restarting an ioctl that ends up downing the ill.
6195 	 */
6196 	ipif = ipsq->ipsq_pending_ipif;
6197 	if (ipif->ipif_ill != ill) {
6198 		/* The ioctl is pending on some other ill. */
6199 		mutex_exit(&ill->ill_lock);
6200 		return;
6201 	}
6202 
6203 	switch (ipsq->ipsq_waitfor) {
6204 	case IPIF_DOWN:
6205 	case IPIF_FREE:
6206 		if (!ipif_is_quiescent(ipif)) {
6207 			mutex_exit(&ill->ill_lock);
6208 			return;
6209 		}
6210 		break;
6211 
6212 	case ILL_DOWN:
6213 	case ILL_FREE:
6214 		/*
6215 		 * case ILL_FREE arises only for loopback. otherwise ill_delete
6216 		 * waits synchronously in ip_close, and no message is queued in
6217 		 * ipsq_pending_mp at all in this case
6218 		 */
6219 		if (!ill_is_quiescent(ill)) {
6220 			mutex_exit(&ill->ill_lock);
6221 			return;
6222 		}
6223 
6224 		break;
6225 
6226 	case ILL_MOVE_OK:
6227 		if (ill_quiescent_to_move(ill) != NULL) {
6228 			mutex_exit(&ill->ill_lock);
6229 			return;
6230 		}
6231 
6232 		break;
6233 	default:
6234 		cmn_err(CE_PANIC, "ipsq: %p unknown ipsq_waitfor %d\n",
6235 		    (void *)ipsq, ipsq->ipsq_waitfor);
6236 	}
6237 
6238 	/*
6239 	 * Incr refcnt for the qwriter_ip call below which
6240 	 * does a refrele
6241 	 */
6242 	ill_refhold_locked(ill);
6243 	mutex_exit(&ill->ill_lock);
6244 
6245 	mp = ipsq_pending_mp_get(ipsq, &connp);
6246 	ASSERT(mp != NULL);
6247 
6248 	switch (mp->b_datap->db_type) {
6249 	case M_ERROR:
6250 	case M_HANGUP:
6251 		(void) qwriter_ip(NULL, ill, ill->ill_rq, mp,
6252 		    ipif_all_down_tail, CUR_OP, B_TRUE);
6253 		return;
6254 
6255 	case M_IOCTL:
6256 	case M_IOCDATA:
6257 		(void) qwriter_ip(NULL, ill,
6258 		    (connp != NULL ? CONNP_TO_WQ(connp) : ill->ill_wq), mp,
6259 		    ip_reprocess_ioctl, CUR_OP, B_TRUE);
6260 		return;
6261 
6262 	default:
6263 		cmn_err(CE_PANIC, "ipif_ill_refrele_tail mp %p "
6264 		    "db_type %d\n", (void *)mp, mp->b_datap->db_type);
6265 	}
6266 }
6267 
6268 #ifdef ILL_DEBUG
6269 /* Reuse trace buffer from beginning (if reached the end) and record trace */
6270 void
6271 th_trace_rrecord(th_trace_t *th_trace)
6272 {
6273 	tr_buf_t *tr_buf;
6274 	uint_t lastref;
6275 
6276 	lastref = th_trace->th_trace_lastref;
6277 	lastref++;
6278 	if (lastref == TR_BUF_MAX)
6279 		lastref = 0;
6280 	th_trace->th_trace_lastref = lastref;
6281 	tr_buf = &th_trace->th_trbuf[lastref];
6282 	tr_buf->tr_depth = getpcstack(tr_buf->tr_stack, IP_STACK_DEPTH);
6283 }
6284 
6285 th_trace_t *
6286 th_trace_ipif_lookup(ipif_t *ipif)
6287 {
6288 	int bucket_id;
6289 	th_trace_t *th_trace;
6290 
6291 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6292 
6293 	bucket_id = IP_TR_HASH(curthread);
6294 	ASSERT(bucket_id < IP_TR_HASH_MAX);
6295 
6296 	for (th_trace = ipif->ipif_trace[bucket_id]; th_trace != NULL;
6297 	    th_trace = th_trace->th_next) {
6298 		if (th_trace->th_id == curthread)
6299 			return (th_trace);
6300 	}
6301 	return (NULL);
6302 }
6303 
6304 void
6305 ipif_trace_ref(ipif_t *ipif)
6306 {
6307 	int bucket_id;
6308 	th_trace_t *th_trace;
6309 
6310 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6311 
6312 	if (ipif->ipif_trace_disable)
6313 		return;
6314 
6315 	/*
6316 	 * Attempt to locate the trace buffer for the curthread.
6317 	 * If it does not exist, then allocate a new trace buffer
6318 	 * and link it in list of trace bufs for this ipif, at the head
6319 	 */
6320 	th_trace = th_trace_ipif_lookup(ipif);
6321 	if (th_trace == NULL) {
6322 		bucket_id = IP_TR_HASH(curthread);
6323 		th_trace = (th_trace_t *)kmem_zalloc(sizeof (th_trace_t),
6324 		    KM_NOSLEEP);
6325 		if (th_trace == NULL) {
6326 			ipif->ipif_trace_disable = B_TRUE;
6327 			ipif_trace_cleanup(ipif);
6328 			return;
6329 		}
6330 		th_trace->th_id = curthread;
6331 		th_trace->th_next = ipif->ipif_trace[bucket_id];
6332 		th_trace->th_prev = &ipif->ipif_trace[bucket_id];
6333 		if (th_trace->th_next != NULL)
6334 			th_trace->th_next->th_prev = &th_trace->th_next;
6335 		ipif->ipif_trace[bucket_id] = th_trace;
6336 	}
6337 	ASSERT(th_trace->th_refcnt >= 0 &&
6338 		th_trace->th_refcnt < TR_BUF_MAX -1);
6339 	th_trace->th_refcnt++;
6340 	th_trace_rrecord(th_trace);
6341 }
6342 
6343 void
6344 ipif_untrace_ref(ipif_t *ipif)
6345 {
6346 	th_trace_t *th_trace;
6347 
6348 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6349 
6350 	if (ipif->ipif_trace_disable)
6351 		return;
6352 	th_trace = th_trace_ipif_lookup(ipif);
6353 	ASSERT(th_trace != NULL);
6354 	ASSERT(th_trace->th_refcnt > 0);
6355 
6356 	th_trace->th_refcnt--;
6357 	th_trace_rrecord(th_trace);
6358 }
6359 
6360 th_trace_t *
6361 th_trace_ill_lookup(ill_t *ill)
6362 {
6363 	th_trace_t *th_trace;
6364 	int bucket_id;
6365 
6366 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6367 
6368 	bucket_id = IP_TR_HASH(curthread);
6369 	ASSERT(bucket_id < IP_TR_HASH_MAX);
6370 
6371 	for (th_trace = ill->ill_trace[bucket_id]; th_trace != NULL;
6372 	    th_trace = th_trace->th_next) {
6373 		if (th_trace->th_id == curthread)
6374 			return (th_trace);
6375 	}
6376 	return (NULL);
6377 }
6378 
6379 void
6380 ill_trace_ref(ill_t *ill)
6381 {
6382 	int bucket_id;
6383 	th_trace_t *th_trace;
6384 
6385 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6386 	if (ill->ill_trace_disable)
6387 		return;
6388 	/*
6389 	 * Attempt to locate the trace buffer for the curthread.
6390 	 * If it does not exist, then allocate a new trace buffer
6391 	 * and link it in list of trace bufs for this ill, at the head
6392 	 */
6393 	th_trace = th_trace_ill_lookup(ill);
6394 	if (th_trace == NULL) {
6395 		bucket_id = IP_TR_HASH(curthread);
6396 		th_trace = (th_trace_t *)kmem_zalloc(sizeof (th_trace_t),
6397 		    KM_NOSLEEP);
6398 		if (th_trace == NULL) {
6399 			ill->ill_trace_disable = B_TRUE;
6400 			ill_trace_cleanup(ill);
6401 			return;
6402 		}
6403 		th_trace->th_id = curthread;
6404 		th_trace->th_next = ill->ill_trace[bucket_id];
6405 		th_trace->th_prev = &ill->ill_trace[bucket_id];
6406 		if (th_trace->th_next != NULL)
6407 			th_trace->th_next->th_prev = &th_trace->th_next;
6408 		ill->ill_trace[bucket_id] = th_trace;
6409 	}
6410 	ASSERT(th_trace->th_refcnt >= 0 &&
6411 		th_trace->th_refcnt < TR_BUF_MAX - 1);
6412 
6413 	th_trace->th_refcnt++;
6414 	th_trace_rrecord(th_trace);
6415 }
6416 
6417 void
6418 ill_untrace_ref(ill_t *ill)
6419 {
6420 	th_trace_t *th_trace;
6421 
6422 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6423 
6424 	if (ill->ill_trace_disable)
6425 		return;
6426 	th_trace = th_trace_ill_lookup(ill);
6427 	ASSERT(th_trace != NULL);
6428 	ASSERT(th_trace->th_refcnt > 0);
6429 
6430 	th_trace->th_refcnt--;
6431 	th_trace_rrecord(th_trace);
6432 }
6433 
6434 /*
6435  * Verify that this thread has no refs to the ipif and free
6436  * the trace buffers
6437  */
6438 /* ARGSUSED */
6439 void
6440 ipif_thread_exit(ipif_t *ipif, void *dummy)
6441 {
6442 	th_trace_t *th_trace;
6443 
6444 	mutex_enter(&ipif->ipif_ill->ill_lock);
6445 
6446 	th_trace = th_trace_ipif_lookup(ipif);
6447 	if (th_trace == NULL) {
6448 		mutex_exit(&ipif->ipif_ill->ill_lock);
6449 		return;
6450 	}
6451 	ASSERT(th_trace->th_refcnt == 0);
6452 	/* unlink th_trace and free it */
6453 	*th_trace->th_prev = th_trace->th_next;
6454 	if (th_trace->th_next != NULL)
6455 		th_trace->th_next->th_prev = th_trace->th_prev;
6456 	th_trace->th_next = NULL;
6457 	th_trace->th_prev = NULL;
6458 	kmem_free(th_trace, sizeof (th_trace_t));
6459 
6460 	mutex_exit(&ipif->ipif_ill->ill_lock);
6461 }
6462 
6463 /*
6464  * Verify that this thread has no refs to the ill and free
6465  * the trace buffers
6466  */
6467 /* ARGSUSED */
6468 void
6469 ill_thread_exit(ill_t *ill, void *dummy)
6470 {
6471 	th_trace_t *th_trace;
6472 
6473 	mutex_enter(&ill->ill_lock);
6474 
6475 	th_trace = th_trace_ill_lookup(ill);
6476 	if (th_trace == NULL) {
6477 		mutex_exit(&ill->ill_lock);
6478 		return;
6479 	}
6480 	ASSERT(th_trace->th_refcnt == 0);
6481 	/* unlink th_trace and free it */
6482 	*th_trace->th_prev = th_trace->th_next;
6483 	if (th_trace->th_next != NULL)
6484 		th_trace->th_next->th_prev = th_trace->th_prev;
6485 	th_trace->th_next = NULL;
6486 	th_trace->th_prev = NULL;
6487 	kmem_free(th_trace, sizeof (th_trace_t));
6488 
6489 	mutex_exit(&ill->ill_lock);
6490 }
6491 #endif
6492 
6493 #ifdef ILL_DEBUG
6494 void
6495 ip_thread_exit(void)
6496 {
6497 	ill_t	*ill;
6498 	ipif_t	*ipif;
6499 	ill_walk_context_t	ctx;
6500 
6501 	rw_enter(&ill_g_lock, RW_READER);
6502 	ill = ILL_START_WALK_ALL(&ctx);
6503 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
6504 		for (ipif = ill->ill_ipif; ipif != NULL;
6505 		    ipif = ipif->ipif_next) {
6506 			ipif_thread_exit(ipif, NULL);
6507 		}
6508 		ill_thread_exit(ill, NULL);
6509 	}
6510 	rw_exit(&ill_g_lock);
6511 
6512 	ire_walk(ire_thread_exit, NULL);
6513 	ndp_walk_common(&ndp4, NULL, nce_thread_exit, NULL, B_FALSE);
6514 	ndp_walk_common(&ndp6, NULL, nce_thread_exit, NULL, B_FALSE);
6515 }
6516 
6517 /*
6518  * Called when ipif is unplumbed or when memory alloc fails
6519  */
6520 void
6521 ipif_trace_cleanup(ipif_t *ipif)
6522 {
6523 	int	i;
6524 	th_trace_t	*th_trace;
6525 	th_trace_t	*th_trace_next;
6526 
6527 	for (i = 0; i < IP_TR_HASH_MAX; i++) {
6528 		for (th_trace = ipif->ipif_trace[i]; th_trace != NULL;
6529 		    th_trace = th_trace_next) {
6530 			th_trace_next = th_trace->th_next;
6531 			kmem_free(th_trace, sizeof (th_trace_t));
6532 		}
6533 		ipif->ipif_trace[i] = NULL;
6534 	}
6535 }
6536 
6537 /*
6538  * Called when ill is unplumbed or when memory alloc fails
6539  */
6540 void
6541 ill_trace_cleanup(ill_t *ill)
6542 {
6543 	int	i;
6544 	th_trace_t	*th_trace;
6545 	th_trace_t	*th_trace_next;
6546 
6547 	for (i = 0; i < IP_TR_HASH_MAX; i++) {
6548 		for (th_trace = ill->ill_trace[i]; th_trace != NULL;
6549 		    th_trace = th_trace_next) {
6550 			th_trace_next = th_trace->th_next;
6551 			kmem_free(th_trace, sizeof (th_trace_t));
6552 		}
6553 		ill->ill_trace[i] = NULL;
6554 	}
6555 }
6556 
6557 #else
6558 void ip_thread_exit(void) {}
6559 #endif
6560 
6561 void
6562 ipif_refhold_locked(ipif_t *ipif)
6563 {
6564 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6565 	ipif->ipif_refcnt++;
6566 	IPIF_TRACE_REF(ipif);
6567 }
6568 
6569 void
6570 ipif_refhold(ipif_t *ipif)
6571 {
6572 	ill_t	*ill;
6573 
6574 	ill = ipif->ipif_ill;
6575 	mutex_enter(&ill->ill_lock);
6576 	ipif->ipif_refcnt++;
6577 	IPIF_TRACE_REF(ipif);
6578 	mutex_exit(&ill->ill_lock);
6579 }
6580 
6581 /*
6582  * Must not be called while holding any locks. Otherwise if this is
6583  * the last reference to be released there is a chance of recursive mutex
6584  * panic due to ipif_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
6585  * to restart an ioctl.
6586  */
6587 void
6588 ipif_refrele(ipif_t *ipif)
6589 {
6590 	ill_t	*ill;
6591 
6592 	ill = ipif->ipif_ill;
6593 
6594 	mutex_enter(&ill->ill_lock);
6595 	ASSERT(ipif->ipif_refcnt != 0);
6596 	ipif->ipif_refcnt--;
6597 	IPIF_UNTRACE_REF(ipif);
6598 	if (ipif->ipif_refcnt != 0) {
6599 		mutex_exit(&ill->ill_lock);
6600 		return;
6601 	}
6602 
6603 	/* Drops the ill_lock */
6604 	ipif_ill_refrele_tail(ill);
6605 }
6606 
6607 ipif_t *
6608 ipif_get_next_ipif(ipif_t *curr, ill_t *ill)
6609 {
6610 	ipif_t	*ipif;
6611 
6612 	mutex_enter(&ill->ill_lock);
6613 	for (ipif = (curr == NULL ? ill->ill_ipif : curr->ipif_next);
6614 	    ipif != NULL; ipif = ipif->ipif_next) {
6615 		if (!IPIF_CAN_LOOKUP(ipif))
6616 			continue;
6617 		ipif_refhold_locked(ipif);
6618 		mutex_exit(&ill->ill_lock);
6619 		return (ipif);
6620 	}
6621 	mutex_exit(&ill->ill_lock);
6622 	return (NULL);
6623 }
6624 
6625 /*
6626  * TODO: make this table extendible at run time
6627  * Return a pointer to the mac type info for 'mac_type'
6628  */
6629 static ip_m_t *
6630 ip_m_lookup(t_uscalar_t mac_type)
6631 {
6632 	ip_m_t	*ipm;
6633 
6634 	for (ipm = ip_m_tbl; ipm < A_END(ip_m_tbl); ipm++)
6635 		if (ipm->ip_m_mac_type == mac_type)
6636 			return (ipm);
6637 	return (NULL);
6638 }
6639 
6640 /*
6641  * ip_rt_add is called to add an IPv4 route to the forwarding table.
6642  * ipif_arg is passed in to associate it with the correct interface.
6643  * We may need to restart this operation if the ipif cannot be looked up
6644  * due to an exclusive operation that is currently in progress. The restart
6645  * entry point is specified by 'func'
6646  */
6647 int
6648 ip_rt_add(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
6649     ipaddr_t src_addr, int flags, ipif_t *ipif_arg, ipif_t *src_ipif,
6650     ire_t **ire_arg, boolean_t ioctl_msg, queue_t *q, mblk_t *mp,
6651     ipsq_func_t func, struct rtsa_s *sp)
6652 {
6653 	ire_t	*ire;
6654 	ire_t	*gw_ire = NULL;
6655 	ipif_t	*ipif = NULL;
6656 	boolean_t ipif_refheld = B_FALSE;
6657 	uint_t	type;
6658 	int	match_flags = MATCH_IRE_TYPE;
6659 	int	error;
6660 	tsol_gc_t *gc = NULL;
6661 	tsol_gcgrp_t *gcgrp = NULL;
6662 	boolean_t gcgrp_xtraref = B_FALSE;
6663 
6664 	ip1dbg(("ip_rt_add:"));
6665 
6666 	if (ire_arg != NULL)
6667 		*ire_arg = NULL;
6668 
6669 	/*
6670 	 * If this is the case of RTF_HOST being set, then we set the netmask
6671 	 * to all ones (regardless if one was supplied).
6672 	 */
6673 	if (flags & RTF_HOST)
6674 		mask = IP_HOST_MASK;
6675 
6676 	/*
6677 	 * Prevent routes with a zero gateway from being created (since
6678 	 * interfaces can currently be plumbed and brought up no assigned
6679 	 * address).
6680 	 * For routes with RTA_SRCIFP, the gateway address can be 0.0.0.0.
6681 	 */
6682 	if (gw_addr == 0 && src_ipif == NULL)
6683 		return (ENETUNREACH);
6684 	/*
6685 	 * Get the ipif, if any, corresponding to the gw_addr
6686 	 */
6687 	if (gw_addr != 0) {
6688 		ipif = ipif_lookup_interface(gw_addr, dst_addr, q, mp, func,
6689 		    &error);
6690 		if (ipif != NULL) {
6691 			if (IS_VNI(ipif->ipif_ill)) {
6692 				ipif_refrele(ipif);
6693 				return (EINVAL);
6694 			}
6695 			ipif_refheld = B_TRUE;
6696 		} else if (error == EINPROGRESS) {
6697 			ip1dbg(("ip_rt_add: null and EINPROGRESS"));
6698 			return (EINPROGRESS);
6699 		} else {
6700 			error = 0;
6701 		}
6702 	}
6703 
6704 	if (ipif != NULL) {
6705 		ip1dbg(("ip_rt_add: ipif_lookup_interface done ipif nonnull"));
6706 		ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6707 	} else {
6708 		ip1dbg(("ip_rt_add: ipif_lookup_interface done ipif is null"));
6709 	}
6710 
6711 	/*
6712 	 * GateD will attempt to create routes with a loopback interface
6713 	 * address as the gateway and with RTF_GATEWAY set.  We allow
6714 	 * these routes to be added, but create them as interface routes
6715 	 * since the gateway is an interface address.
6716 	 */
6717 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
6718 		flags &= ~RTF_GATEWAY;
6719 		if (gw_addr == INADDR_LOOPBACK && dst_addr == INADDR_LOOPBACK &&
6720 		    mask == IP_HOST_MASK) {
6721 			ire = ire_ctable_lookup(dst_addr, 0, IRE_LOOPBACK, ipif,
6722 			    ALL_ZONES, NULL, match_flags);
6723 			if (ire != NULL) {
6724 				ire_refrele(ire);
6725 				if (ipif_refheld)
6726 					ipif_refrele(ipif);
6727 				return (EEXIST);
6728 			}
6729 			ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x"
6730 			    "for 0x%x\n", (void *)ipif,
6731 			    ipif->ipif_ire_type,
6732 			    ntohl(ipif->ipif_lcl_addr)));
6733 			ire = ire_create(
6734 			    (uchar_t *)&dst_addr,	/* dest address */
6735 			    (uchar_t *)&mask,		/* mask */
6736 			    (uchar_t *)&ipif->ipif_src_addr,
6737 			    NULL,			/* no gateway */
6738 			    NULL,
6739 			    &ipif->ipif_mtu,
6740 			    NULL,
6741 			    ipif->ipif_rq,		/* recv-from queue */
6742 			    NULL,			/* no send-to queue */
6743 			    ipif->ipif_ire_type,	/* LOOPBACK */
6744 			    NULL,
6745 			    ipif,
6746 			    NULL,
6747 			    0,
6748 			    0,
6749 			    0,
6750 			    (ipif->ipif_flags & IPIF_PRIVATE) ?
6751 			    RTF_PRIVATE : 0,
6752 			    &ire_uinfo_null,
6753 			    NULL,
6754 			    NULL);
6755 
6756 			if (ire == NULL) {
6757 				if (ipif_refheld)
6758 					ipif_refrele(ipif);
6759 				return (ENOMEM);
6760 			}
6761 			error = ire_add(&ire, q, mp, func, B_FALSE);
6762 			if (error == 0)
6763 				goto save_ire;
6764 			if (ipif_refheld)
6765 				ipif_refrele(ipif);
6766 			return (error);
6767 
6768 		}
6769 	}
6770 
6771 	/*
6772 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
6773 	 * and the gateway address provided is one of the system's interface
6774 	 * addresses.  By using the routing socket interface and supplying an
6775 	 * RTA_IFP sockaddr with an interface index, an alternate method of
6776 	 * specifying an interface route to be created is available which uses
6777 	 * the interface index that specifies the outgoing interface rather than
6778 	 * the address of an outgoing interface (which may not be able to
6779 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
6780 	 * flag, routes can be specified which not only specify the next-hop to
6781 	 * be used when routing to a certain prefix, but also which outgoing
6782 	 * interface should be used.
6783 	 *
6784 	 * Previously, interfaces would have unique addresses assigned to them
6785 	 * and so the address assigned to a particular interface could be used
6786 	 * to identify a particular interface.  One exception to this was the
6787 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
6788 	 *
6789 	 * With the advent of IPv6 and its link-local addresses, this
6790 	 * restriction was relaxed and interfaces could share addresses between
6791 	 * themselves.  In fact, typically all of the link-local interfaces on
6792 	 * an IPv6 node or router will have the same link-local address.  In
6793 	 * order to differentiate between these interfaces, the use of an
6794 	 * interface index is necessary and this index can be carried inside a
6795 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
6796 	 * of using the interface index, however, is that all of the ipif's that
6797 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
6798 	 * cannot be used to differentiate between ipif's (or logical
6799 	 * interfaces) that belong to the same ill (physical interface).
6800 	 *
6801 	 * For example, in the following case involving IPv4 interfaces and
6802 	 * logical interfaces
6803 	 *
6804 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
6805 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0:1
6806 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0:2
6807 	 *
6808 	 * the ipif's corresponding to each of these interface routes can be
6809 	 * uniquely identified by the "gateway" (actually interface address).
6810 	 *
6811 	 * In this case involving multiple IPv6 default routes to a particular
6812 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
6813 	 * default route is of interest:
6814 	 *
6815 	 *	default		fe80::123:4567:89ab:cdef	U	if0
6816 	 *	default		fe80::123:4567:89ab:cdef	U	if1
6817 	 */
6818 
6819 	/* RTF_GATEWAY not set */
6820 	if (!(flags & RTF_GATEWAY)) {
6821 		queue_t	*stq;
6822 		queue_t	*rfq = NULL;
6823 		ill_t	*in_ill = NULL;
6824 
6825 		if (sp != NULL) {
6826 			ip2dbg(("ip_rt_add: gateway security attributes "
6827 			    "cannot be set with interface route\n"));
6828 			if (ipif_refheld)
6829 				ipif_refrele(ipif);
6830 			return (EINVAL);
6831 		}
6832 
6833 		/*
6834 		 * As the interface index specified with the RTA_IFP sockaddr is
6835 		 * the same for all ipif's off of an ill, the matching logic
6836 		 * below uses MATCH_IRE_ILL if such an index was specified.
6837 		 * This means that routes sharing the same prefix when added
6838 		 * using a RTA_IFP sockaddr must have distinct interface
6839 		 * indices (namely, they must be on distinct ill's).
6840 		 *
6841 		 * On the other hand, since the gateway address will usually be
6842 		 * different for each ipif on the system, the matching logic
6843 		 * uses MATCH_IRE_IPIF in the case of a traditional interface
6844 		 * route.  This means that interface routes for the same prefix
6845 		 * can be created if they belong to distinct ipif's and if a
6846 		 * RTA_IFP sockaddr is not present.
6847 		 */
6848 		if (ipif_arg != NULL) {
6849 			if (ipif_refheld)  {
6850 				ipif_refrele(ipif);
6851 				ipif_refheld = B_FALSE;
6852 			}
6853 			ipif = ipif_arg;
6854 			match_flags |= MATCH_IRE_ILL;
6855 		} else {
6856 			/*
6857 			 * Check the ipif corresponding to the gw_addr
6858 			 */
6859 			if (ipif == NULL)
6860 				return (ENETUNREACH);
6861 			match_flags |= MATCH_IRE_IPIF;
6862 		}
6863 		ASSERT(ipif != NULL);
6864 		/*
6865 		 * If src_ipif is not NULL, we have to create
6866 		 * an ire with non-null ire_in_ill value
6867 		 */
6868 		if (src_ipif != NULL) {
6869 			in_ill = src_ipif->ipif_ill;
6870 		}
6871 
6872 		/*
6873 		 * We check for an existing entry at this point.
6874 		 *
6875 		 * Since a netmask isn't passed in via the ioctl interface
6876 		 * (SIOCADDRT), we don't check for a matching netmask in that
6877 		 * case.
6878 		 */
6879 		if (!ioctl_msg)
6880 			match_flags |= MATCH_IRE_MASK;
6881 		if (src_ipif != NULL) {
6882 			/* Look up in the special table */
6883 			ire = ire_srcif_table_lookup(dst_addr, IRE_INTERFACE,
6884 			    ipif, src_ipif->ipif_ill, match_flags);
6885 		} else {
6886 			ire = ire_ftable_lookup(dst_addr, mask, 0,
6887 			    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0,
6888 			    NULL, match_flags);
6889 		}
6890 		if (ire != NULL) {
6891 			ire_refrele(ire);
6892 			if (ipif_refheld)
6893 				ipif_refrele(ipif);
6894 			return (EEXIST);
6895 		}
6896 
6897 		if (src_ipif != NULL) {
6898 			/*
6899 			 * Create the special ire for the IRE table
6900 			 * which hangs out of ire_in_ill. This ire
6901 			 * is in-between IRE_CACHE and IRE_INTERFACE.
6902 			 * Thus rfq is non-NULL.
6903 			 */
6904 			rfq = ipif->ipif_rq;
6905 		}
6906 		/* Create the usual interface ires */
6907 
6908 		stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
6909 		    ? ipif->ipif_rq : ipif->ipif_wq;
6910 
6911 		/*
6912 		 * Create a copy of the IRE_LOOPBACK,
6913 		 * IRE_IF_NORESOLVER or IRE_IF_RESOLVER with
6914 		 * the modified address and netmask.
6915 		 */
6916 		ire = ire_create(
6917 		    (uchar_t *)&dst_addr,
6918 		    (uint8_t *)&mask,
6919 		    (uint8_t *)&ipif->ipif_src_addr,
6920 		    NULL,
6921 		    NULL,
6922 		    &ipif->ipif_mtu,
6923 		    NULL,
6924 		    rfq,
6925 		    stq,
6926 		    ipif->ipif_net_type,
6927 		    ipif->ipif_resolver_mp,
6928 		    ipif,
6929 		    in_ill,
6930 		    0,
6931 		    0,
6932 		    0,
6933 		    flags,
6934 		    &ire_uinfo_null,
6935 		    NULL,
6936 		    NULL);
6937 		if (ire == NULL) {
6938 			if (ipif_refheld)
6939 				ipif_refrele(ipif);
6940 			return (ENOMEM);
6941 		}
6942 
6943 		/*
6944 		 * Some software (for example, GateD and Sun Cluster) attempts
6945 		 * to create (what amount to) IRE_PREFIX routes with the
6946 		 * loopback address as the gateway.  This is primarily done to
6947 		 * set up prefixes with the RTF_REJECT flag set (for example,
6948 		 * when generating aggregate routes.)
6949 		 *
6950 		 * If the IRE type (as defined by ipif->ipif_net_type) is
6951 		 * IRE_LOOPBACK, then we map the request into a
6952 		 * IRE_IF_NORESOLVER.
6953 		 *
6954 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
6955 		 * routine, but rather using ire_create() directly.
6956 		 *
6957 		 */
6958 		if (ipif->ipif_net_type == IRE_LOOPBACK)
6959 			ire->ire_type = IRE_IF_NORESOLVER;
6960 
6961 		error = ire_add(&ire, q, mp, func, B_FALSE);
6962 		if (error == 0)
6963 			goto save_ire;
6964 
6965 		/*
6966 		 * In the result of failure, ire_add() will have already
6967 		 * deleted the ire in question, so there is no need to
6968 		 * do that here.
6969 		 */
6970 		if (ipif_refheld)
6971 			ipif_refrele(ipif);
6972 		return (error);
6973 	}
6974 	if (ipif_refheld) {
6975 		ipif_refrele(ipif);
6976 		ipif_refheld = B_FALSE;
6977 	}
6978 
6979 	if (src_ipif != NULL) {
6980 		/* RTA_SRCIFP is not supported on RTF_GATEWAY */
6981 		ip2dbg(("ip_rt_add: SRCIF cannot be set with gateway route\n"));
6982 		return (EINVAL);
6983 	}
6984 	/*
6985 	 * Get an interface IRE for the specified gateway.
6986 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
6987 	 * gateway, it is currently unreachable and we fail the request
6988 	 * accordingly.
6989 	 */
6990 	ipif = ipif_arg;
6991 	if (ipif_arg != NULL)
6992 		match_flags |= MATCH_IRE_ILL;
6993 	gw_ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg, NULL,
6994 	    ALL_ZONES, 0, NULL, match_flags);
6995 	if (gw_ire == NULL)
6996 		return (ENETUNREACH);
6997 
6998 	/*
6999 	 * We create one of three types of IREs as a result of this request
7000 	 * based on the netmask.  A netmask of all ones (which is automatically
7001 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
7002 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
7003 	 * created.  Otherwise, an IRE_PREFIX route is created for the
7004 	 * destination prefix.
7005 	 */
7006 	if (mask == IP_HOST_MASK)
7007 		type = IRE_HOST;
7008 	else if (mask == 0)
7009 		type = IRE_DEFAULT;
7010 	else
7011 		type = IRE_PREFIX;
7012 
7013 	/* check for a duplicate entry */
7014 	ire = ire_ftable_lookup(dst_addr, mask, gw_addr, type, ipif_arg,
7015 	    NULL, ALL_ZONES, 0, NULL,
7016 	    match_flags | MATCH_IRE_MASK | MATCH_IRE_GW);
7017 	if (ire != NULL) {
7018 		ire_refrele(gw_ire);
7019 		ire_refrele(ire);
7020 		return (EEXIST);
7021 	}
7022 
7023 	/* Security attribute exists */
7024 	if (sp != NULL) {
7025 		tsol_gcgrp_addr_t ga;
7026 
7027 		/* find or create the gateway credentials group */
7028 		ga.ga_af = AF_INET;
7029 		IN6_IPADDR_TO_V4MAPPED(gw_addr, &ga.ga_addr);
7030 
7031 		/* we hold reference to it upon success */
7032 		gcgrp = gcgrp_lookup(&ga, B_TRUE);
7033 		if (gcgrp == NULL) {
7034 			ire_refrele(gw_ire);
7035 			return (ENOMEM);
7036 		}
7037 
7038 		/*
7039 		 * Create and add the security attribute to the group; a
7040 		 * reference to the group is made upon allocating a new
7041 		 * entry successfully.  If it finds an already-existing
7042 		 * entry for the security attribute in the group, it simply
7043 		 * returns it and no new reference is made to the group.
7044 		 */
7045 		gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
7046 		if (gc == NULL) {
7047 			/* release reference held by gcgrp_lookup */
7048 			GCGRP_REFRELE(gcgrp);
7049 			ire_refrele(gw_ire);
7050 			return (ENOMEM);
7051 		}
7052 	}
7053 
7054 	/* Create the IRE. */
7055 	ire = ire_create(
7056 	    (uchar_t *)&dst_addr,		/* dest address */
7057 	    (uchar_t *)&mask,			/* mask */
7058 	    /* src address assigned by the caller? */
7059 	    (uchar_t *)(((src_addr != INADDR_ANY) &&
7060 		(flags & RTF_SETSRC)) ?  &src_addr : NULL),
7061 	    (uchar_t *)&gw_addr,		/* gateway address */
7062 	    NULL,				/* no in-srcaddress */
7063 	    &gw_ire->ire_max_frag,
7064 	    NULL,				/* no Fast Path header */
7065 	    NULL,				/* no recv-from queue */
7066 	    NULL,				/* no send-to queue */
7067 	    (ushort_t)type,			/* IRE type */
7068 	    NULL,
7069 	    ipif_arg,
7070 	    NULL,
7071 	    0,
7072 	    0,
7073 	    0,
7074 	    flags,
7075 	    &gw_ire->ire_uinfo,			/* Inherit ULP info from gw */
7076 	    gc,					/* security attribute */
7077 	    NULL);
7078 	/*
7079 	 * The ire holds a reference to the 'gc' and the 'gc' holds a
7080 	 * reference to the 'gcgrp'. We can now release the extra reference
7081 	 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
7082 	 */
7083 	if (gcgrp_xtraref)
7084 		GCGRP_REFRELE(gcgrp);
7085 	if (ire == NULL) {
7086 		if (gc != NULL)
7087 			GC_REFRELE(gc);
7088 		ire_refrele(gw_ire);
7089 		return (ENOMEM);
7090 	}
7091 
7092 	/*
7093 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
7094 	 * SUN/OS socket stuff does but do we really want to allow 0.0.0.0?
7095 	 */
7096 
7097 	/* Add the new IRE. */
7098 	error = ire_add(&ire, q, mp, func, B_FALSE);
7099 	if (error != 0) {
7100 		/*
7101 		 * In the result of failure, ire_add() will have already
7102 		 * deleted the ire in question, so there is no need to
7103 		 * do that here.
7104 		 */
7105 		ire_refrele(gw_ire);
7106 		return (error);
7107 	}
7108 
7109 	if (flags & RTF_MULTIRT) {
7110 		/*
7111 		 * Invoke the CGTP (multirouting) filtering module
7112 		 * to add the dst address in the filtering database.
7113 		 * Replicated inbound packets coming from that address
7114 		 * will be filtered to discard the duplicates.
7115 		 * It is not necessary to call the CGTP filter hook
7116 		 * when the dst address is a broadcast or multicast,
7117 		 * because an IP source address cannot be a broadcast
7118 		 * or a multicast.
7119 		 */
7120 		ire_t *ire_dst = ire_ctable_lookup(ire->ire_addr, 0,
7121 		    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE);
7122 		if (ire_dst != NULL) {
7123 			ip_cgtp_bcast_add(ire, ire_dst);
7124 			ire_refrele(ire_dst);
7125 			goto save_ire;
7126 		}
7127 		if ((ip_cgtp_filter_ops != NULL) && !CLASSD(ire->ire_addr)) {
7128 			int res = ip_cgtp_filter_ops->cfo_add_dest_v4(
7129 			    ire->ire_addr,
7130 			    ire->ire_gateway_addr,
7131 			    ire->ire_src_addr,
7132 			    gw_ire->ire_src_addr);
7133 			if (res != 0) {
7134 				ire_refrele(gw_ire);
7135 				ire_delete(ire);
7136 				return (res);
7137 			}
7138 		}
7139 	}
7140 
7141 	/*
7142 	 * Now that the prefix IRE entry has been created, delete any
7143 	 * existing gateway IRE cache entries as well as any IRE caches
7144 	 * using the gateway, and force them to be created through
7145 	 * ip_newroute.
7146 	 */
7147 	if (gc != NULL) {
7148 		ASSERT(gcgrp != NULL);
7149 		ire_clookup_delete_cache_gw(gw_addr, ALL_ZONES);
7150 	}
7151 
7152 save_ire:
7153 	if (gw_ire != NULL) {
7154 		ire_refrele(gw_ire);
7155 	}
7156 	/*
7157 	 * We do not do save_ire for the routes added with RTA_SRCIFP
7158 	 * flag. This route is only added and deleted by mipagent.
7159 	 * So, for simplicity of design, we refrain from saving
7160 	 * ires that are created with srcif value. This may change
7161 	 * in future if we find more usage of srcifp feature.
7162 	 */
7163 	if (ipif != NULL && src_ipif == NULL) {
7164 		/*
7165 		 * Save enough information so that we can recreate the IRE if
7166 		 * the interface goes down and then up.  The metrics associated
7167 		 * with the route will be saved as well when rts_setmetrics() is
7168 		 * called after the IRE has been created.  In the case where
7169 		 * memory cannot be allocated, none of this information will be
7170 		 * saved.
7171 		 */
7172 		ipif_save_ire(ipif, ire);
7173 	}
7174 	if (ioctl_msg)
7175 		ip_rts_rtmsg(RTM_OLDADD, ire, 0);
7176 	if (ire_arg != NULL) {
7177 		/*
7178 		 * Store the ire that was successfully added into where ire_arg
7179 		 * points to so that callers don't have to look it up
7180 		 * themselves (but they are responsible for ire_refrele()ing
7181 		 * the ire when they are finished with it).
7182 		 */
7183 		*ire_arg = ire;
7184 	} else {
7185 		ire_refrele(ire);		/* Held in ire_add */
7186 	}
7187 	if (ipif_refheld)
7188 		ipif_refrele(ipif);
7189 	return (0);
7190 }
7191 
7192 /*
7193  * ip_rt_delete is called to delete an IPv4 route.
7194  * ipif_arg is passed in to associate it with the correct interface.
7195  * src_ipif is passed to associate the incoming interface of the packet.
7196  * We may need to restart this operation if the ipif cannot be looked up
7197  * due to an exclusive operation that is currently in progress. The restart
7198  * entry point is specified by 'func'
7199  */
7200 /* ARGSUSED4 */
7201 int
7202 ip_rt_delete(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
7203     uint_t rtm_addrs, int flags, ipif_t *ipif_arg, ipif_t *src_ipif,
7204     boolean_t ioctl_msg, queue_t *q, mblk_t *mp, ipsq_func_t func)
7205 {
7206 	ire_t	*ire = NULL;
7207 	ipif_t	*ipif;
7208 	boolean_t ipif_refheld = B_FALSE;
7209 	uint_t	type;
7210 	uint_t	match_flags = MATCH_IRE_TYPE;
7211 	int	err = 0;
7212 
7213 	ip1dbg(("ip_rt_delete:"));
7214 	/*
7215 	 * If this is the case of RTF_HOST being set, then we set the netmask
7216 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
7217 	 */
7218 	if (flags & RTF_HOST) {
7219 		mask = IP_HOST_MASK;
7220 		match_flags |= MATCH_IRE_MASK;
7221 	} else if (rtm_addrs & RTA_NETMASK) {
7222 		match_flags |= MATCH_IRE_MASK;
7223 	}
7224 
7225 	/*
7226 	 * Note that RTF_GATEWAY is never set on a delete, therefore
7227 	 * we check if the gateway address is one of our interfaces first,
7228 	 * and fall back on RTF_GATEWAY routes.
7229 	 *
7230 	 * This makes it possible to delete an original
7231 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
7232 	 *
7233 	 * As the interface index specified with the RTA_IFP sockaddr is the
7234 	 * same for all ipif's off of an ill, the matching logic below uses
7235 	 * MATCH_IRE_ILL if such an index was specified.  This means a route
7236 	 * sharing the same prefix and interface index as the the route
7237 	 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr
7238 	 * is specified in the request.
7239 	 *
7240 	 * On the other hand, since the gateway address will usually be
7241 	 * different for each ipif on the system, the matching logic
7242 	 * uses MATCH_IRE_IPIF in the case of a traditional interface
7243 	 * route.  This means that interface routes for the same prefix can be
7244 	 * uniquely identified if they belong to distinct ipif's and if a
7245 	 * RTA_IFP sockaddr is not present.
7246 	 *
7247 	 * For more detail on specifying routes by gateway address and by
7248 	 * interface index, see the comments in ip_rt_add().
7249 	 * gw_addr could be zero in some cases when both RTA_SRCIFP and
7250 	 * RTA_IFP are specified. If RTA_SRCIFP is specified and  both
7251 	 * RTA_IFP and gateway_addr are NULL/zero, then delete will not
7252 	 * succeed.
7253 	 */
7254 	if (src_ipif != NULL) {
7255 		if (ipif_arg == NULL && gw_addr != 0) {
7256 			ipif_arg = ipif_lookup_interface(gw_addr, dst_addr,
7257 			    q, mp, func, &err);
7258 			if (ipif_arg != NULL)
7259 				ipif_refheld = B_TRUE;
7260 		}
7261 		if (ipif_arg == NULL) {
7262 			err = (err == EINPROGRESS) ? err : ESRCH;
7263 			return (err);
7264 		}
7265 		ipif = ipif_arg;
7266 	} else {
7267 		ipif = ipif_lookup_interface(gw_addr, dst_addr,
7268 			    q, mp, func, &err);
7269 		if (ipif != NULL)
7270 			ipif_refheld = B_TRUE;
7271 		else if (err == EINPROGRESS)
7272 			return (err);
7273 		else
7274 			err = 0;
7275 	}
7276 	if (ipif != NULL) {
7277 		if (ipif_arg != NULL) {
7278 			if (ipif_refheld) {
7279 				ipif_refrele(ipif);
7280 				ipif_refheld = B_FALSE;
7281 			}
7282 			ipif = ipif_arg;
7283 			match_flags |= MATCH_IRE_ILL;
7284 		} else {
7285 			match_flags |= MATCH_IRE_IPIF;
7286 		}
7287 		if (src_ipif != NULL) {
7288 			ire = ire_srcif_table_lookup(dst_addr, IRE_INTERFACE,
7289 			    ipif, src_ipif->ipif_ill, match_flags);
7290 		} else {
7291 			if (ipif->ipif_ire_type == IRE_LOOPBACK) {
7292 				ire = ire_ctable_lookup(dst_addr, 0,
7293 				    IRE_LOOPBACK, ipif, ALL_ZONES, NULL,
7294 				    match_flags);
7295 			}
7296 			if (ire == NULL) {
7297 				ire = ire_ftable_lookup(dst_addr, mask, 0,
7298 				    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0,
7299 				    NULL, match_flags);
7300 			}
7301 		}
7302 	}
7303 
7304 	if (ire == NULL) {
7305 		/*
7306 		 * At this point, the gateway address is not one of our own
7307 		 * addresses or a matching interface route was not found.  We
7308 		 * set the IRE type to lookup based on whether
7309 		 * this is a host route, a default route or just a prefix.
7310 		 *
7311 		 * If an ipif_arg was passed in, then the lookup is based on an
7312 		 * interface index so MATCH_IRE_ILL is added to match_flags.
7313 		 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is
7314 		 * set as the route being looked up is not a traditional
7315 		 * interface route.
7316 		 * Since we do not add gateway route with srcipif, we don't
7317 		 * expect to find it either.
7318 		 */
7319 		if (src_ipif != NULL) {
7320 			if (ipif_refheld)
7321 				ipif_refrele(ipif);
7322 			return (ESRCH);
7323 		} else {
7324 			match_flags &= ~MATCH_IRE_IPIF;
7325 			match_flags |= MATCH_IRE_GW;
7326 			if (ipif_arg != NULL)
7327 				match_flags |= MATCH_IRE_ILL;
7328 			if (mask == IP_HOST_MASK)
7329 				type = IRE_HOST;
7330 			else if (mask == 0)
7331 				type = IRE_DEFAULT;
7332 			else
7333 				type = IRE_PREFIX;
7334 			ire = ire_ftable_lookup(dst_addr, mask, gw_addr, type,
7335 			    ipif_arg, NULL, ALL_ZONES, 0, NULL, match_flags);
7336 		}
7337 	}
7338 
7339 	if (ipif_refheld)
7340 		ipif_refrele(ipif);
7341 
7342 	/* ipif is not refheld anymore */
7343 	if (ire == NULL)
7344 		return (ESRCH);
7345 
7346 	if (ire->ire_flags & RTF_MULTIRT) {
7347 		/*
7348 		 * Invoke the CGTP (multirouting) filtering module
7349 		 * to remove the dst address from the filtering database.
7350 		 * Packets coming from that address will no longer be
7351 		 * filtered to remove duplicates.
7352 		 */
7353 		if (ip_cgtp_filter_ops != NULL) {
7354 			err = ip_cgtp_filter_ops->cfo_del_dest_v4(ire->ire_addr,
7355 			    ire->ire_gateway_addr);
7356 		}
7357 		ip_cgtp_bcast_delete(ire);
7358 	}
7359 
7360 	ipif = ire->ire_ipif;
7361 	/*
7362 	 * Removing from ipif_saved_ire_mp is not necessary
7363 	 * when src_ipif being non-NULL. ip_rt_add does not
7364 	 * save the ires which src_ipif being non-NULL.
7365 	 */
7366 	if (ipif != NULL && src_ipif == NULL) {
7367 		ipif_remove_ire(ipif, ire);
7368 	}
7369 	if (ioctl_msg)
7370 		ip_rts_rtmsg(RTM_OLDDEL, ire, 0);
7371 	ire_delete(ire);
7372 	ire_refrele(ire);
7373 	return (err);
7374 }
7375 
7376 /*
7377  * ip_siocaddrt is called to complete processing of an SIOCADDRT IOCTL.
7378  */
7379 /* ARGSUSED */
7380 int
7381 ip_siocaddrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
7382     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
7383 {
7384 	ipaddr_t dst_addr;
7385 	ipaddr_t gw_addr;
7386 	ipaddr_t mask;
7387 	int error = 0;
7388 	mblk_t *mp1;
7389 	struct rtentry *rt;
7390 	ipif_t *ipif = NULL;
7391 
7392 	ip1dbg(("ip_siocaddrt:"));
7393 	/* Existence of mp1 verified in ip_wput_nondata */
7394 	mp1 = mp->b_cont->b_cont;
7395 	rt = (struct rtentry *)mp1->b_rptr;
7396 
7397 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
7398 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
7399 
7400 	/*
7401 	 * If the RTF_HOST flag is on, this is a request to assign a gateway
7402 	 * to a particular host address.  In this case, we set the netmask to
7403 	 * all ones for the particular destination address.  Otherwise,
7404 	 * determine the netmask to be used based on dst_addr and the interfaces
7405 	 * in use.
7406 	 */
7407 	if (rt->rt_flags & RTF_HOST) {
7408 		mask = IP_HOST_MASK;
7409 	} else {
7410 		/*
7411 		 * Note that ip_subnet_mask returns a zero mask in the case of
7412 		 * default (an all-zeroes address).
7413 		 */
7414 		mask = ip_subnet_mask(dst_addr, &ipif);
7415 	}
7416 
7417 	error = ip_rt_add(dst_addr, mask, gw_addr, 0, rt->rt_flags, NULL, NULL,
7418 	    NULL, B_TRUE, q, mp, ip_process_ioctl, NULL);
7419 	if (ipif != NULL)
7420 		ipif_refrele(ipif);
7421 	return (error);
7422 }
7423 
7424 /*
7425  * ip_siocdelrt is called to complete processing of an SIOCDELRT IOCTL.
7426  */
7427 /* ARGSUSED */
7428 int
7429 ip_siocdelrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
7430     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
7431 {
7432 	ipaddr_t dst_addr;
7433 	ipaddr_t gw_addr;
7434 	ipaddr_t mask;
7435 	int error;
7436 	mblk_t *mp1;
7437 	struct rtentry *rt;
7438 	ipif_t *ipif = NULL;
7439 
7440 	ip1dbg(("ip_siocdelrt:"));
7441 	/* Existence of mp1 verified in ip_wput_nondata */
7442 	mp1 = mp->b_cont->b_cont;
7443 	rt = (struct rtentry *)mp1->b_rptr;
7444 
7445 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
7446 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
7447 
7448 	/*
7449 	 * If the RTF_HOST flag is on, this is a request to delete a gateway
7450 	 * to a particular host address.  In this case, we set the netmask to
7451 	 * all ones for the particular destination address.  Otherwise,
7452 	 * determine the netmask to be used based on dst_addr and the interfaces
7453 	 * in use.
7454 	 */
7455 	if (rt->rt_flags & RTF_HOST) {
7456 		mask = IP_HOST_MASK;
7457 	} else {
7458 		/*
7459 		 * Note that ip_subnet_mask returns a zero mask in the case of
7460 		 * default (an all-zeroes address).
7461 		 */
7462 		mask = ip_subnet_mask(dst_addr, &ipif);
7463 	}
7464 
7465 	error = ip_rt_delete(dst_addr, mask, gw_addr,
7466 	    RTA_DST | RTA_GATEWAY | RTA_NETMASK, rt->rt_flags, NULL, NULL,
7467 	    B_TRUE, q, mp, ip_process_ioctl);
7468 	if (ipif != NULL)
7469 		ipif_refrele(ipif);
7470 	return (error);
7471 }
7472 
7473 /*
7474  * Enqueue the mp onto the ipsq, chained by b_next.
7475  * b_prev stores the function to be executed later, and b_queue the queue
7476  * where this mp originated.
7477  */
7478 void
7479 ipsq_enq(ipsq_t *ipsq, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
7480     ill_t *pending_ill)
7481 {
7482 	conn_t	*connp = NULL;
7483 
7484 	ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
7485 	ASSERT(func != NULL);
7486 
7487 	mp->b_queue = q;
7488 	mp->b_prev = (void *)func;
7489 	mp->b_next = NULL;
7490 
7491 	switch (type) {
7492 	case CUR_OP:
7493 		if (ipsq->ipsq_mptail != NULL) {
7494 			ASSERT(ipsq->ipsq_mphead != NULL);
7495 			ipsq->ipsq_mptail->b_next = mp;
7496 		} else {
7497 			ASSERT(ipsq->ipsq_mphead == NULL);
7498 			ipsq->ipsq_mphead = mp;
7499 		}
7500 		ipsq->ipsq_mptail = mp;
7501 		break;
7502 
7503 	case NEW_OP:
7504 		if (ipsq->ipsq_xopq_mptail != NULL) {
7505 			ASSERT(ipsq->ipsq_xopq_mphead != NULL);
7506 			ipsq->ipsq_xopq_mptail->b_next = mp;
7507 		} else {
7508 			ASSERT(ipsq->ipsq_xopq_mphead == NULL);
7509 			ipsq->ipsq_xopq_mphead = mp;
7510 		}
7511 		ipsq->ipsq_xopq_mptail = mp;
7512 		break;
7513 	default:
7514 		cmn_err(CE_PANIC, "ipsq_enq %d type \n", type);
7515 	}
7516 
7517 	if (CONN_Q(q) && pending_ill != NULL) {
7518 		connp = Q_TO_CONN(q);
7519 
7520 		ASSERT(MUTEX_HELD(&connp->conn_lock));
7521 		connp->conn_oper_pending_ill = pending_ill;
7522 	}
7523 }
7524 
7525 /*
7526  * Return the mp at the head of the ipsq. After emptying the ipsq
7527  * look at the next ioctl, if this ioctl is complete. Otherwise
7528  * return, we will resume when we complete the current ioctl.
7529  * The current ioctl will wait till it gets a response from the
7530  * driver below.
7531  */
7532 static mblk_t *
7533 ipsq_dq(ipsq_t *ipsq)
7534 {
7535 	mblk_t	*mp;
7536 
7537 	ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
7538 
7539 	mp = ipsq->ipsq_mphead;
7540 	if (mp != NULL) {
7541 		ipsq->ipsq_mphead = mp->b_next;
7542 		if (ipsq->ipsq_mphead == NULL)
7543 			ipsq->ipsq_mptail = NULL;
7544 		mp->b_next = NULL;
7545 		return (mp);
7546 	}
7547 	if (ipsq->ipsq_current_ipif != NULL)
7548 		return (NULL);
7549 	mp = ipsq->ipsq_xopq_mphead;
7550 	if (mp != NULL) {
7551 		ipsq->ipsq_xopq_mphead = mp->b_next;
7552 		if (ipsq->ipsq_xopq_mphead == NULL)
7553 			ipsq->ipsq_xopq_mptail = NULL;
7554 		mp->b_next = NULL;
7555 		return (mp);
7556 	}
7557 	return (NULL);
7558 }
7559 
7560 /*
7561  * Enter the ipsq corresponding to ill, by waiting synchronously till
7562  * we can enter the ipsq exclusively. Unless 'force' is used, the ipsq
7563  * will have to drain completely before ipsq_enter returns success.
7564  * ipsq_current_ipif will be set if some exclusive ioctl is in progress,
7565  * and the ipsq_exit logic will start the next enqueued ioctl after
7566  * completion of the current ioctl. If 'force' is used, we don't wait
7567  * for the enqueued ioctls. This is needed when a conn_close wants to
7568  * enter the ipsq and abort an ioctl that is somehow stuck. Unplumb
7569  * of an ill can also use this option. But we dont' use it currently.
7570  */
7571 #define	ENTER_SQ_WAIT_TICKS 100
7572 boolean_t
7573 ipsq_enter(ill_t *ill, boolean_t force)
7574 {
7575 	ipsq_t	*ipsq;
7576 	boolean_t waited_enough = B_FALSE;
7577 
7578 	/*
7579 	 * Holding the ill_lock prevents <ill-ipsq> assocs from changing.
7580 	 * Since the <ill-ipsq> assocs could change while we wait for the
7581 	 * writer, it is easier to wait on a fixed global rather than try to
7582 	 * cv_wait on a changing ipsq.
7583 	 */
7584 	mutex_enter(&ill->ill_lock);
7585 	for (;;) {
7586 		if (ill->ill_state_flags & ILL_CONDEMNED) {
7587 			mutex_exit(&ill->ill_lock);
7588 			return (B_FALSE);
7589 		}
7590 
7591 		ipsq = ill->ill_phyint->phyint_ipsq;
7592 		mutex_enter(&ipsq->ipsq_lock);
7593 		if (ipsq->ipsq_writer == NULL &&
7594 		    (ipsq->ipsq_current_ipif == NULL || waited_enough)) {
7595 			break;
7596 		} else if (ipsq->ipsq_writer != NULL) {
7597 			mutex_exit(&ipsq->ipsq_lock);
7598 			cv_wait(&ill->ill_cv, &ill->ill_lock);
7599 		} else {
7600 			mutex_exit(&ipsq->ipsq_lock);
7601 			if (force) {
7602 				(void) cv_timedwait(&ill->ill_cv,
7603 				    &ill->ill_lock,
7604 				    lbolt + ENTER_SQ_WAIT_TICKS);
7605 				waited_enough = B_TRUE;
7606 				continue;
7607 			} else {
7608 				cv_wait(&ill->ill_cv, &ill->ill_lock);
7609 			}
7610 		}
7611 	}
7612 
7613 	ASSERT(ipsq->ipsq_mphead == NULL && ipsq->ipsq_mptail == NULL);
7614 	ASSERT(ipsq->ipsq_reentry_cnt == 0);
7615 	ipsq->ipsq_writer = curthread;
7616 	ipsq->ipsq_reentry_cnt++;
7617 #ifdef ILL_DEBUG
7618 	ipsq->ipsq_depth = getpcstack(ipsq->ipsq_stack, IP_STACK_DEPTH);
7619 #endif
7620 	mutex_exit(&ipsq->ipsq_lock);
7621 	mutex_exit(&ill->ill_lock);
7622 	return (B_TRUE);
7623 }
7624 
7625 /*
7626  * The ipsq_t (ipsq) is the synchronization data structure used to serialize
7627  * certain critical operations like plumbing (i.e. most set ioctls),
7628  * multicast joins, igmp/mld timers, IPMP operations etc. On a non-IPMP
7629  * system there is 1 ipsq per phyint. On an IPMP system there is 1 ipsq per
7630  * IPMP group. The ipsq serializes exclusive ioctls issued by applications
7631  * on a per ipsq basis in ipsq_xopq_mphead. It also protects against multiple
7632  * threads executing in the ipsq. Responses from the driver pertain to the
7633  * current ioctl (say a DL_BIND_ACK in response to a DL_BIND_REQUEST initiated
7634  * as part of bringing up the interface) and are enqueued in ipsq_mphead.
7635  *
7636  * If a thread does not want to reenter the ipsq when it is already writer,
7637  * it must make sure that the specified reentry point to be called later
7638  * when the ipsq is empty, nor any code path starting from the specified reentry
7639  * point must never ever try to enter the ipsq again. Otherwise it can lead
7640  * to an infinite loop. The reentry point ip_rput_dlpi_writer is an example.
7641  * When the thread that is currently exclusive finishes, it (ipsq_exit)
7642  * dequeues the requests waiting to become exclusive in ipsq_mphead and calls
7643  * the reentry point. When the list at ipsq_mphead becomes empty ipsq_exit
7644  * proceeds to dequeue the next ioctl in ipsq_xopq_mphead and start the next
7645  * ioctl if the current ioctl has completed. If the current ioctl is still
7646  * in progress it simply returns. The current ioctl could be waiting for
7647  * a response from another module (arp_ or the driver or could be waiting for
7648  * the ipif/ill/ire refcnts to drop to zero. In such a case the ipsq_pending_mp
7649  * and ipsq_pending_ipif are set. ipsq_current_ipif is set throughout the
7650  * execution of the ioctl and ipsq_exit does not start the next ioctl unless
7651  * ipsq_current_ipif is clear which happens only on ioctl completion.
7652  */
7653 
7654 /*
7655  * Try to enter the ipsq exclusively, corresponding to ipif or ill. (only 1 of
7656  * ipif or ill can be specified). The caller ensures ipif or ill is valid by
7657  * ref-holding it if necessary. If the ipsq cannot be entered, the mp is queued
7658  * completion.
7659  */
7660 ipsq_t *
7661 ipsq_try_enter(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
7662     ipsq_func_t func, int type, boolean_t reentry_ok)
7663 {
7664 	ipsq_t	*ipsq;
7665 
7666 	/* Only 1 of ipif or ill can be specified */
7667 	ASSERT((ipif != NULL) ^ (ill != NULL));
7668 	if (ipif != NULL)
7669 		ill = ipif->ipif_ill;
7670 
7671 	/*
7672 	 * lock ordering ill_g_lock -> conn_lock -> ill_lock -> ipsq_lock
7673 	 * ipsq of an ill can't change when ill_lock is held.
7674 	 */
7675 	GRAB_CONN_LOCK(q);
7676 	mutex_enter(&ill->ill_lock);
7677 	ipsq = ill->ill_phyint->phyint_ipsq;
7678 	mutex_enter(&ipsq->ipsq_lock);
7679 
7680 	/*
7681 	 * 1. Enter the ipsq if we are already writer and reentry is ok.
7682 	 *    (Note: If the caller does not specify reentry_ok then neither
7683 	 *    'func' nor any of its callees must ever attempt to enter the ipsq
7684 	 *    again. Otherwise it can lead to an infinite loop
7685 	 * 2. Enter the ipsq if there is no current writer and this attempted
7686 	 *    entry is part of the current ioctl or operation
7687 	 * 3. Enter the ipsq if there is no current writer and this is a new
7688 	 *    ioctl (or operation) and the ioctl (or operation) queue is
7689 	 *    empty and there is no ioctl (or operation) currently in progress
7690 	 */
7691 	if ((ipsq->ipsq_writer == NULL && ((type == CUR_OP) ||
7692 	    (type == NEW_OP && ipsq->ipsq_xopq_mphead == NULL &&
7693 	    ipsq->ipsq_current_ipif == NULL))) ||
7694 	    (ipsq->ipsq_writer == curthread && reentry_ok)) {
7695 		/* Success. */
7696 		ipsq->ipsq_reentry_cnt++;
7697 		ipsq->ipsq_writer = curthread;
7698 		mutex_exit(&ipsq->ipsq_lock);
7699 		mutex_exit(&ill->ill_lock);
7700 		RELEASE_CONN_LOCK(q);
7701 #ifdef ILL_DEBUG
7702 		ipsq->ipsq_depth = getpcstack(ipsq->ipsq_stack, IP_STACK_DEPTH);
7703 #endif
7704 		return (ipsq);
7705 	}
7706 
7707 	ipsq_enq(ipsq, q, mp, func, type, ill);
7708 
7709 	mutex_exit(&ipsq->ipsq_lock);
7710 	mutex_exit(&ill->ill_lock);
7711 	RELEASE_CONN_LOCK(q);
7712 	return (NULL);
7713 }
7714 
7715 /*
7716  * Try to enter the ipsq exclusively, corresponding to ipif or ill. (only 1 of
7717  * ipif or ill can be specified). The caller ensures ipif or ill is valid by
7718  * ref-holding it if necessary. If the ipsq cannot be entered, the mp is queued
7719  * completion.
7720  *
7721  * This function does a refrele on the ipif/ill.
7722  */
7723 void
7724 qwriter_ip(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
7725     ipsq_func_t func, int type, boolean_t reentry_ok)
7726 {
7727 	ipsq_t	*ipsq;
7728 
7729 	ipsq = ipsq_try_enter(ipif, ill, q, mp, func, type, reentry_ok);
7730 	/*
7731 	 * Caller must have done a refhold on the ipif. ipif_refrele
7732 	 * happens on the passed ipif. We can do this since we are
7733 	 * already exclusive, or we won't access ipif henceforth, Both
7734 	 * this func and caller will just return if we ipsq_try_enter
7735 	 * fails above. This is needed because func needs to
7736 	 * see the correct refcount. Eg. removeif can work only then.
7737 	 */
7738 	if (ipif != NULL)
7739 		ipif_refrele(ipif);
7740 	else
7741 		ill_refrele(ill);
7742 	if (ipsq != NULL) {
7743 		(*func)(ipsq, q, mp, NULL);
7744 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
7745 	}
7746 }
7747 
7748 /*
7749  * If there are more than ILL_GRP_CNT ills in a group,
7750  * we use kmem alloc'd buffers, else use the stack
7751  */
7752 #define	ILL_GRP_CNT	14
7753 /*
7754  * Drain the ipsq, if there are messages on it, and then leave the ipsq.
7755  * Called by a thread that is currently exclusive on this ipsq.
7756  */
7757 void
7758 ipsq_exit(ipsq_t *ipsq, boolean_t start_igmp_timer, boolean_t start_mld_timer)
7759 {
7760 	queue_t	*q;
7761 	mblk_t	*mp;
7762 	ipsq_func_t	func;
7763 	int	next;
7764 	ill_t	**ill_list = NULL;
7765 	size_t	ill_list_size = 0;
7766 	int	cnt = 0;
7767 	boolean_t need_ipsq_free = B_FALSE;
7768 
7769 	ASSERT(IAM_WRITER_IPSQ(ipsq));
7770 	mutex_enter(&ipsq->ipsq_lock);
7771 	ASSERT(ipsq->ipsq_reentry_cnt >= 1);
7772 	if (ipsq->ipsq_reentry_cnt != 1) {
7773 		ipsq->ipsq_reentry_cnt--;
7774 		mutex_exit(&ipsq->ipsq_lock);
7775 		return;
7776 	}
7777 
7778 	mp = ipsq_dq(ipsq);
7779 	while (mp != NULL) {
7780 again:
7781 		mutex_exit(&ipsq->ipsq_lock);
7782 		func = (ipsq_func_t)mp->b_prev;
7783 		q = (queue_t *)mp->b_queue;
7784 		mp->b_prev = NULL;
7785 		mp->b_queue = NULL;
7786 
7787 		/*
7788 		 * If 'q' is an conn queue, it is valid, since we did a
7789 		 * a refhold on the connp, at the start of the ioctl.
7790 		 * If 'q' is an ill queue, it is valid, since close of an
7791 		 * ill will clean up the 'ipsq'.
7792 		 */
7793 		(*func)(ipsq, q, mp, NULL);
7794 
7795 		mutex_enter(&ipsq->ipsq_lock);
7796 		mp = ipsq_dq(ipsq);
7797 	}
7798 
7799 	mutex_exit(&ipsq->ipsq_lock);
7800 
7801 	/*
7802 	 * Need to grab the locks in the right order. Need to
7803 	 * atomically check (under ipsq_lock) that there are no
7804 	 * messages before relinquishing the ipsq. Also need to
7805 	 * atomically wakeup waiters on ill_cv while holding ill_lock.
7806 	 * Holding ill_g_lock ensures that ipsq list of ills is stable.
7807 	 * If we need to call ill_split_ipsq and change <ill-ipsq> we need
7808 	 * to grab ill_g_lock as writer.
7809 	 */
7810 	rw_enter(&ill_g_lock, ipsq->ipsq_split ? RW_WRITER : RW_READER);
7811 
7812 	/* ipsq_refs can't change while ill_g_lock is held as reader */
7813 	if (ipsq->ipsq_refs != 0) {
7814 		/* At most 2 ills v4/v6 per phyint */
7815 		cnt = ipsq->ipsq_refs << 1;
7816 		ill_list_size = cnt * sizeof (ill_t *);
7817 		/*
7818 		 * If memory allocation fails, we will do the split
7819 		 * the next time ipsq_exit is called for whatever reason.
7820 		 * As long as the ipsq_split flag is set the need to
7821 		 * split is remembered.
7822 		 */
7823 		ill_list = kmem_zalloc(ill_list_size, KM_NOSLEEP);
7824 		if (ill_list != NULL)
7825 			cnt = ill_lock_ipsq_ills(ipsq, ill_list, cnt);
7826 	}
7827 	mutex_enter(&ipsq->ipsq_lock);
7828 	mp = ipsq_dq(ipsq);
7829 	if (mp != NULL) {
7830 		/* oops, some message has landed up, we can't get out */
7831 		if (ill_list != NULL)
7832 			ill_unlock_ills(ill_list, cnt);
7833 		rw_exit(&ill_g_lock);
7834 		if (ill_list != NULL)
7835 			kmem_free(ill_list, ill_list_size);
7836 		ill_list = NULL;
7837 		ill_list_size = 0;
7838 		cnt = 0;
7839 		goto again;
7840 	}
7841 
7842 	/*
7843 	 * Split only if no ioctl is pending and if memory alloc succeeded
7844 	 * above.
7845 	 */
7846 	if (ipsq->ipsq_split && ipsq->ipsq_current_ipif == NULL &&
7847 		ill_list != NULL) {
7848 		/*
7849 		 * No new ill can join this ipsq since we are holding the
7850 		 * ill_g_lock. Hence ill_split_ipsq can safely traverse the
7851 		 * ipsq. ill_split_ipsq may fail due to memory shortage.
7852 		 * If so we will retry on the next ipsq_exit.
7853 		 */
7854 		ipsq->ipsq_split = ill_split_ipsq(ipsq);
7855 	}
7856 
7857 	/*
7858 	 * We are holding the ipsq lock, hence no new messages can
7859 	 * land up on the ipsq, and there are no messages currently.
7860 	 * Now safe to get out. Wake up waiters and relinquish ipsq
7861 	 * atomically while holding ill locks.
7862 	 */
7863 	ipsq->ipsq_writer = NULL;
7864 	ipsq->ipsq_reentry_cnt--;
7865 	ASSERT(ipsq->ipsq_reentry_cnt == 0);
7866 #ifdef ILL_DEBUG
7867 	ipsq->ipsq_depth = 0;
7868 #endif
7869 	mutex_exit(&ipsq->ipsq_lock);
7870 	/*
7871 	 * For IPMP this should wake up all ills in this ipsq.
7872 	 * We need to hold the ill_lock while waking up waiters to
7873 	 * avoid missed wakeups. But there is no need to acquire all
7874 	 * the ill locks and then wakeup. If we have not acquired all
7875 	 * the locks (due to memory failure above) ill_signal_ipsq_ills
7876 	 * wakes up ills one at a time after getting the right ill_lock
7877 	 */
7878 	ill_signal_ipsq_ills(ipsq, ill_list != NULL);
7879 	if (ill_list != NULL)
7880 		ill_unlock_ills(ill_list, cnt);
7881 	if (ipsq->ipsq_refs == 0)
7882 		need_ipsq_free = B_TRUE;
7883 	rw_exit(&ill_g_lock);
7884 	if (ill_list != 0)
7885 		kmem_free(ill_list, ill_list_size);
7886 
7887 	if (need_ipsq_free) {
7888 		/*
7889 		 * Free the ipsq. ipsq_refs can't increase because ipsq can't be
7890 		 * looked up. ipsq can be looked up only thru ill or phyint
7891 		 * and there are no ills/phyint on this ipsq.
7892 		 */
7893 		ipsq_delete(ipsq);
7894 	}
7895 	/*
7896 	 * Now start any igmp or mld timers that could not be started
7897 	 * while inside the ipsq. The timers can't be started while inside
7898 	 * the ipsq, since igmp_start_timers may need to call untimeout()
7899 	 * which can't be done while holding a lock i.e. the ipsq. Otherwise
7900 	 * there could be a deadlock since the timeout handlers
7901 	 * mld_timeout_handler / igmp_timeout_handler also synchronously
7902 	 * wait in ipsq_enter() trying to get the ipsq.
7903 	 *
7904 	 * However there is one exception to the above. If this thread is
7905 	 * itself the igmp/mld timeout handler thread, then we don't want
7906 	 * to start any new timer until the current handler is done. The
7907 	 * handler thread passes in B_FALSE for start_igmp/mld_timers, while
7908 	 * all others pass B_TRUE.
7909 	 */
7910 	if (start_igmp_timer) {
7911 		mutex_enter(&igmp_timer_lock);
7912 		next = igmp_deferred_next;
7913 		igmp_deferred_next = INFINITY;
7914 		mutex_exit(&igmp_timer_lock);
7915 
7916 		if (next != INFINITY)
7917 			igmp_start_timers(next);
7918 	}
7919 
7920 	if (start_mld_timer) {
7921 		mutex_enter(&mld_timer_lock);
7922 		next = mld_deferred_next;
7923 		mld_deferred_next = INFINITY;
7924 		mutex_exit(&mld_timer_lock);
7925 
7926 		if (next != INFINITY)
7927 			mld_start_timers(next);
7928 	}
7929 }
7930 
7931 /*
7932  * The ill is closing. Flush all messages on the ipsq that originated
7933  * from this ill. Usually there wont' be any messages on the ipsq_xopq_mphead
7934  * for this ill since ipsq_enter could not have entered until then.
7935  * New messages can't be queued since the CONDEMNED flag is set.
7936  */
7937 static void
7938 ipsq_flush(ill_t *ill)
7939 {
7940 	queue_t	*q;
7941 	mblk_t	*prev;
7942 	mblk_t	*mp;
7943 	mblk_t	*mp_next;
7944 	ipsq_t	*ipsq;
7945 
7946 	ASSERT(IAM_WRITER_ILL(ill));
7947 	ipsq = ill->ill_phyint->phyint_ipsq;
7948 	/*
7949 	 * Flush any messages sent up by the driver.
7950 	 */
7951 	mutex_enter(&ipsq->ipsq_lock);
7952 	for (prev = NULL, mp = ipsq->ipsq_mphead; mp != NULL; mp = mp_next) {
7953 		mp_next = mp->b_next;
7954 		q = mp->b_queue;
7955 		if (q == ill->ill_rq || q == ill->ill_wq) {
7956 			/* Remove the mp from the ipsq */
7957 			if (prev == NULL)
7958 				ipsq->ipsq_mphead = mp->b_next;
7959 			else
7960 				prev->b_next = mp->b_next;
7961 			if (ipsq->ipsq_mptail == mp) {
7962 				ASSERT(mp_next == NULL);
7963 				ipsq->ipsq_mptail = prev;
7964 			}
7965 			inet_freemsg(mp);
7966 		} else {
7967 			prev = mp;
7968 		}
7969 	}
7970 	mutex_exit(&ipsq->ipsq_lock);
7971 	(void) ipsq_pending_mp_cleanup(ill, NULL);
7972 	ipsq_xopq_mp_cleanup(ill, NULL);
7973 	ill_pending_mp_cleanup(ill);
7974 }
7975 
7976 /*
7977  * Clean up one squeue element. ill_inuse_ref is protected by ill_lock.
7978  * The real cleanup happens behind the squeue via ip_squeue_clean function but
7979  * we need to protect ourselfs from 2 threads trying to cleanup at the same
7980  * time (possible with one port going down for aggr and someone tearing down the
7981  * entire aggr simultaneously. So we use ill_inuse_ref protected by ill_lock
7982  * to indicate when the cleanup has started (1 ref) and when the cleanup
7983  * is done (0 ref). When a new ring gets assigned to squeue, we start by
7984  * putting 2 ref on ill_inuse_ref.
7985  */
7986 static void
7987 ipsq_clean_ring(ill_t *ill, ill_rx_ring_t *rx_ring)
7988 {
7989 	conn_t *connp;
7990 	squeue_t *sqp;
7991 	mblk_t *mp;
7992 
7993 	ASSERT(rx_ring != NULL);
7994 
7995 	/* Just clean one squeue */
7996 	mutex_enter(&ill->ill_lock);
7997 	/*
7998 	 * Reset the ILL_SOFT_RING_ASSIGN bit so that
7999 	 * ip_squeue_soft_ring_affinty() will not go
8000 	 * ahead with assigning rings.
8001 	 */
8002 	ill->ill_state_flags &= ~ILL_SOFT_RING_ASSIGN;
8003 	while (rx_ring->rr_ring_state == ILL_RING_INPROC)
8004 		/* Some operations pending on the ring. Wait */
8005 		cv_wait(&ill->ill_cv, &ill->ill_lock);
8006 
8007 	if (rx_ring->rr_ring_state != ILL_RING_INUSE) {
8008 		/*
8009 		 * Someone already trying to clean
8010 		 * this squeue or its already been cleaned.
8011 		 */
8012 		mutex_exit(&ill->ill_lock);
8013 		return;
8014 	}
8015 	sqp = rx_ring->rr_sqp;
8016 
8017 	if (sqp == NULL) {
8018 		/*
8019 		 * The rx_ring never had a squeue assigned to it.
8020 		 * We are under ill_lock so we can clean it up
8021 		 * here itself since no one can get to it.
8022 		 */
8023 		rx_ring->rr_blank = NULL;
8024 		rx_ring->rr_handle = NULL;
8025 		rx_ring->rr_sqp = NULL;
8026 		rx_ring->rr_ring_state = ILL_RING_FREE;
8027 		mutex_exit(&ill->ill_lock);
8028 		return;
8029 	}
8030 
8031 	/* Set the state that its being cleaned */
8032 	rx_ring->rr_ring_state = ILL_RING_BEING_FREED;
8033 	ASSERT(sqp != NULL);
8034 	mutex_exit(&ill->ill_lock);
8035 
8036 	/*
8037 	 * Use the preallocated ill_unbind_conn for this purpose
8038 	 */
8039 	connp = ill->ill_dls_capab->ill_unbind_conn;
8040 
8041 	ASSERT(!connp->conn_tcp->tcp_closemp.b_prev);
8042 	TCP_DEBUG_GETPCSTACK(connp->conn_tcp->tcmp_stk, 15);
8043 	if (connp->conn_tcp->tcp_closemp.b_prev == NULL)
8044 		connp->conn_tcp->tcp_closemp_used = 1;
8045 	else
8046 		connp->conn_tcp->tcp_closemp_used++;
8047 	mp = &connp->conn_tcp->tcp_closemp;
8048 	CONN_INC_REF(connp);
8049 	squeue_enter(sqp, mp, ip_squeue_clean, connp, NULL);
8050 
8051 	mutex_enter(&ill->ill_lock);
8052 	while (rx_ring->rr_ring_state != ILL_RING_FREE)
8053 		cv_wait(&ill->ill_cv, &ill->ill_lock);
8054 
8055 	mutex_exit(&ill->ill_lock);
8056 }
8057 
8058 static void
8059 ipsq_clean_all(ill_t *ill)
8060 {
8061 	int idx;
8062 
8063 	/*
8064 	 * No need to clean if poll_capab isn't set for this ill
8065 	 */
8066 	if (!(ill->ill_capabilities & (ILL_CAPAB_POLL|ILL_CAPAB_SOFT_RING)))
8067 		return;
8068 
8069 	for (idx = 0; idx < ILL_MAX_RINGS; idx++) {
8070 		ill_rx_ring_t *ipr = &ill->ill_dls_capab->ill_ring_tbl[idx];
8071 		ipsq_clean_ring(ill, ipr);
8072 	}
8073 
8074 	ill->ill_capabilities &= ~(ILL_CAPAB_POLL|ILL_CAPAB_SOFT_RING);
8075 }
8076 
8077 /* ARGSUSED */
8078 int
8079 ip_sioctl_slifoindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
8080     ip_ioctl_cmd_t *ipip, void *ifreq)
8081 {
8082 	ill_t	*ill;
8083 	struct lifreq	*lifr = (struct lifreq *)ifreq;
8084 	boolean_t isv6;
8085 	conn_t	*connp;
8086 
8087 	connp = Q_TO_CONN(q);
8088 	isv6 = connp->conn_af_isv6;
8089 	/*
8090 	 * Set original index.
8091 	 * Failover and failback move logical interfaces
8092 	 * from one physical interface to another.  The
8093 	 * original index indicates the parent of a logical
8094 	 * interface, in other words, the physical interface
8095 	 * the logical interface will be moved back to on
8096 	 * failback.
8097 	 */
8098 
8099 	/*
8100 	 * Don't allow the original index to be changed
8101 	 * for non-failover addresses, autoconfigured
8102 	 * addresses, or IPv6 link local addresses.
8103 	 */
8104 	if (((ipif->ipif_flags & (IPIF_NOFAILOVER | IPIF_ADDRCONF)) != NULL) ||
8105 	    (isv6 && IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6lcl_addr))) {
8106 		return (EINVAL);
8107 	}
8108 	/*
8109 	 * The new original index must be in use by some
8110 	 * physical interface.
8111 	 */
8112 	ill = ill_lookup_on_ifindex(lifr->lifr_index, isv6, NULL, NULL,
8113 	    NULL, NULL);
8114 	if (ill == NULL)
8115 		return (ENXIO);
8116 	ill_refrele(ill);
8117 
8118 	ipif->ipif_orig_ifindex = lifr->lifr_index;
8119 	/*
8120 	 * When this ipif gets failed back, don't
8121 	 * preserve the original id, as it is no
8122 	 * longer applicable.
8123 	 */
8124 	ipif->ipif_orig_ipifid = 0;
8125 	/*
8126 	 * For IPv4, change the original index of any
8127 	 * multicast addresses associated with the
8128 	 * ipif to the new value.
8129 	 */
8130 	if (!isv6) {
8131 		ilm_t *ilm;
8132 
8133 		mutex_enter(&ipif->ipif_ill->ill_lock);
8134 		for (ilm = ipif->ipif_ill->ill_ilm; ilm != NULL;
8135 		    ilm = ilm->ilm_next) {
8136 			if (ilm->ilm_ipif == ipif) {
8137 				ilm->ilm_orig_ifindex = lifr->lifr_index;
8138 			}
8139 		}
8140 		mutex_exit(&ipif->ipif_ill->ill_lock);
8141 	}
8142 	return (0);
8143 }
8144 
8145 /* ARGSUSED */
8146 int
8147 ip_sioctl_get_oindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
8148     ip_ioctl_cmd_t *ipip, void *ifreq)
8149 {
8150 	struct lifreq *lifr = (struct lifreq *)ifreq;
8151 
8152 	/*
8153 	 * Get the original interface index i.e the one
8154 	 * before FAILOVER if it ever happened.
8155 	 */
8156 	lifr->lifr_index = ipif->ipif_orig_ifindex;
8157 	return (0);
8158 }
8159 
8160 /*
8161  * Parse an iftun_req structure coming down SIOC[GS]TUNPARAM ioctls,
8162  * refhold and return the associated ipif
8163  */
8164 int
8165 ip_extract_tunreq(queue_t *q, mblk_t *mp, ipif_t **ipifp, ipsq_func_t func)
8166 {
8167 	boolean_t exists;
8168 	struct iftun_req *ta;
8169 	ipif_t	*ipif;
8170 	ill_t	*ill;
8171 	boolean_t isv6;
8172 	mblk_t	*mp1;
8173 	int	error;
8174 	conn_t	*connp;
8175 
8176 	/* Existence verified in ip_wput_nondata */
8177 	mp1 = mp->b_cont->b_cont;
8178 	ta = (struct iftun_req *)mp1->b_rptr;
8179 	/*
8180 	 * Null terminate the string to protect against buffer
8181 	 * overrun. String was generated by user code and may not
8182 	 * be trusted.
8183 	 */
8184 	ta->ifta_lifr_name[LIFNAMSIZ - 1] = '\0';
8185 
8186 	connp = Q_TO_CONN(q);
8187 	isv6 = connp->conn_af_isv6;
8188 
8189 	/* Disallows implicit create */
8190 	ipif = ipif_lookup_on_name(ta->ifta_lifr_name,
8191 	    mi_strlen(ta->ifta_lifr_name), B_FALSE, &exists, isv6,
8192 	    connp->conn_zoneid, CONNP_TO_WQ(connp), mp, func, &error);
8193 	if (ipif == NULL)
8194 		return (error);
8195 
8196 	if (ipif->ipif_id != 0) {
8197 		/*
8198 		 * We really don't want to set/get tunnel parameters
8199 		 * on virtual tunnel interfaces.  Only allow the
8200 		 * base tunnel to do these.
8201 		 */
8202 		ipif_refrele(ipif);
8203 		return (EINVAL);
8204 	}
8205 
8206 	/*
8207 	 * Send down to tunnel mod for ioctl processing.
8208 	 * Will finish ioctl in ip_rput_other().
8209 	 */
8210 	ill = ipif->ipif_ill;
8211 	if (ill->ill_net_type == IRE_LOOPBACK) {
8212 		ipif_refrele(ipif);
8213 		return (EOPNOTSUPP);
8214 	}
8215 
8216 	if (ill->ill_wq == NULL) {
8217 		ipif_refrele(ipif);
8218 		return (ENXIO);
8219 	}
8220 	/*
8221 	 * Mark the ioctl as coming from an IPv6 interface for
8222 	 * tun's convenience.
8223 	 */
8224 	if (ill->ill_isv6)
8225 		ta->ifta_flags |= 0x80000000;
8226 	*ipifp = ipif;
8227 	return (0);
8228 }
8229 
8230 /*
8231  * Parse an ifreq or lifreq struct coming down ioctls and refhold
8232  * and return the associated ipif.
8233  * Return value:
8234  *	Non zero: An error has occurred. ci may not be filled out.
8235  *	zero : ci is filled out with the ioctl cmd in ci.ci_name, and
8236  *	a held ipif in ci.ci_ipif.
8237  */
8238 int
8239 ip_extract_lifreq_cmn(queue_t *q, mblk_t *mp, int cmd_type, int flags,
8240     cmd_info_t *ci, ipsq_func_t func)
8241 {
8242 	sin_t		*sin;
8243 	sin6_t		*sin6;
8244 	char		*name;
8245 	struct ifreq    *ifr;
8246 	struct lifreq    *lifr;
8247 	ipif_t		*ipif = NULL;
8248 	ill_t		*ill;
8249 	conn_t		*connp;
8250 	boolean_t	isv6;
8251 	struct iocblk   *iocp = (struct iocblk *)mp->b_rptr;
8252 	boolean_t	exists;
8253 	int		err;
8254 	mblk_t		*mp1;
8255 	zoneid_t	zoneid;
8256 
8257 	if (q->q_next != NULL) {
8258 		ill = (ill_t *)q->q_ptr;
8259 		isv6 = ill->ill_isv6;
8260 		connp = NULL;
8261 		zoneid = ALL_ZONES;
8262 	} else {
8263 		ill = NULL;
8264 		connp = Q_TO_CONN(q);
8265 		isv6 = connp->conn_af_isv6;
8266 		zoneid = connp->conn_zoneid;
8267 		if (zoneid == GLOBAL_ZONEID) {
8268 			/* global zone can access ipifs in all zones */
8269 			zoneid = ALL_ZONES;
8270 		}
8271 	}
8272 
8273 	/* Has been checked in ip_wput_nondata */
8274 	mp1 = mp->b_cont->b_cont;
8275 
8276 
8277 	if (cmd_type == IF_CMD) {
8278 		/* This a old style SIOC[GS]IF* command */
8279 		ifr = (struct ifreq *)mp1->b_rptr;
8280 		/*
8281 		 * Null terminate the string to protect against buffer
8282 		 * overrun. String was generated by user code and may not
8283 		 * be trusted.
8284 		 */
8285 		ifr->ifr_name[IFNAMSIZ - 1] = '\0';
8286 		sin = (sin_t *)&ifr->ifr_addr;
8287 		name = ifr->ifr_name;
8288 		ci->ci_sin = sin;
8289 		ci->ci_sin6 = NULL;
8290 		ci->ci_lifr = (struct lifreq *)ifr;
8291 	} else {
8292 		/* This a new style SIOC[GS]LIF* command */
8293 		ASSERT(cmd_type == LIF_CMD);
8294 		lifr = (struct lifreq *)mp1->b_rptr;
8295 		/*
8296 		 * Null terminate the string to protect against buffer
8297 		 * overrun. String was generated by user code and may not
8298 		 * be trusted.
8299 		 */
8300 		lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
8301 		name = lifr->lifr_name;
8302 		sin = (sin_t *)&lifr->lifr_addr;
8303 		sin6 = (sin6_t *)&lifr->lifr_addr;
8304 		if (iocp->ioc_cmd == SIOCSLIFGROUPNAME) {
8305 			(void) strncpy(ci->ci_groupname, lifr->lifr_groupname,
8306 			    LIFNAMSIZ);
8307 		}
8308 		ci->ci_sin = sin;
8309 		ci->ci_sin6 = sin6;
8310 		ci->ci_lifr = lifr;
8311 	}
8312 
8313 
8314 	if (iocp->ioc_cmd == SIOCSLIFNAME) {
8315 		/*
8316 		 * The ioctl will be failed if the ioctl comes down
8317 		 * an conn stream
8318 		 */
8319 		if (ill == NULL) {
8320 			/*
8321 			 * Not an ill queue, return EINVAL same as the
8322 			 * old error code.
8323 			 */
8324 			return (ENXIO);
8325 		}
8326 		ipif = ill->ill_ipif;
8327 		ipif_refhold(ipif);
8328 	} else {
8329 		ipif = ipif_lookup_on_name(name, mi_strlen(name), B_FALSE,
8330 		    &exists, isv6, zoneid,
8331 		    (connp == NULL) ? q : CONNP_TO_WQ(connp), mp, func, &err);
8332 		if (ipif == NULL) {
8333 			if (err == EINPROGRESS)
8334 				return (err);
8335 			if (iocp->ioc_cmd == SIOCLIFFAILOVER ||
8336 			    iocp->ioc_cmd == SIOCLIFFAILBACK) {
8337 				/*
8338 				 * Need to try both v4 and v6 since this
8339 				 * ioctl can come down either v4 or v6
8340 				 * socket. The lifreq.lifr_family passed
8341 				 * down by this ioctl is AF_UNSPEC.
8342 				 */
8343 				ipif = ipif_lookup_on_name(name,
8344 				    mi_strlen(name), B_FALSE, &exists, !isv6,
8345 				    zoneid, (connp == NULL) ? q :
8346 				    CONNP_TO_WQ(connp), mp, func, &err);
8347 				if (err == EINPROGRESS)
8348 					return (err);
8349 			}
8350 			err = 0;	/* Ensure we don't use it below */
8351 		}
8352 	}
8353 
8354 	/*
8355 	 * Old style [GS]IFCMD does not admit IPv6 ipif
8356 	 */
8357 	if (ipif != NULL && ipif->ipif_isv6 && cmd_type == IF_CMD) {
8358 		ipif_refrele(ipif);
8359 		return (ENXIO);
8360 	}
8361 
8362 	if (ipif == NULL && ill != NULL && ill->ill_ipif != NULL &&
8363 	    name[0] == '\0') {
8364 		/*
8365 		 * Handle a or a SIOC?IF* with a null name
8366 		 * during plumb (on the ill queue before the I_PLINK).
8367 		 */
8368 		ipif = ill->ill_ipif;
8369 		ipif_refhold(ipif);
8370 	}
8371 
8372 	if (ipif == NULL)
8373 		return (ENXIO);
8374 
8375 	/*
8376 	 * Allow only GET operations if this ipif has been created
8377 	 * temporarily due to a MOVE operation.
8378 	 */
8379 	if (ipif->ipif_replace_zero && !(flags & IPI_REPL)) {
8380 		ipif_refrele(ipif);
8381 		return (EINVAL);
8382 	}
8383 
8384 	ci->ci_ipif = ipif;
8385 	return (0);
8386 }
8387 
8388 /*
8389  * Return the total number of ipifs.
8390  */
8391 static uint_t
8392 ip_get_numifs(zoneid_t zoneid)
8393 {
8394 	uint_t numifs = 0;
8395 	ill_t	*ill;
8396 	ill_walk_context_t	ctx;
8397 	ipif_t	*ipif;
8398 
8399 	rw_enter(&ill_g_lock, RW_READER);
8400 	ill = ILL_START_WALK_V4(&ctx);
8401 
8402 	while (ill != NULL) {
8403 		for (ipif = ill->ill_ipif; ipif != NULL;
8404 		    ipif = ipif->ipif_next) {
8405 			if (ipif->ipif_zoneid == zoneid ||
8406 			    ipif->ipif_zoneid == ALL_ZONES)
8407 				numifs++;
8408 		}
8409 		ill = ill_next(&ctx, ill);
8410 	}
8411 	rw_exit(&ill_g_lock);
8412 	return (numifs);
8413 }
8414 
8415 /*
8416  * Return the total number of ipifs.
8417  */
8418 static uint_t
8419 ip_get_numlifs(int family, int lifn_flags, zoneid_t zoneid)
8420 {
8421 	uint_t numifs = 0;
8422 	ill_t	*ill;
8423 	ipif_t	*ipif;
8424 	ill_walk_context_t	ctx;
8425 
8426 	ip1dbg(("ip_get_numlifs(%d %u %d)\n", family, lifn_flags, (int)zoneid));
8427 
8428 	rw_enter(&ill_g_lock, RW_READER);
8429 	if (family == AF_INET)
8430 		ill = ILL_START_WALK_V4(&ctx);
8431 	else if (family == AF_INET6)
8432 		ill = ILL_START_WALK_V6(&ctx);
8433 	else
8434 		ill = ILL_START_WALK_ALL(&ctx);
8435 
8436 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8437 		for (ipif = ill->ill_ipif; ipif != NULL;
8438 		    ipif = ipif->ipif_next) {
8439 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
8440 			    !(lifn_flags & LIFC_NOXMIT))
8441 				continue;
8442 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
8443 			    !(lifn_flags & LIFC_TEMPORARY))
8444 				continue;
8445 			if (((ipif->ipif_flags &
8446 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
8447 			    IPIF_DEPRECATED)) ||
8448 			    (ill->ill_phyint->phyint_flags &
8449 			    PHYI_LOOPBACK) ||
8450 			    !(ipif->ipif_flags & IPIF_UP)) &&
8451 			    (lifn_flags & LIFC_EXTERNAL_SOURCE))
8452 				continue;
8453 
8454 			if (zoneid != ipif->ipif_zoneid &&
8455 			    ipif->ipif_zoneid != ALL_ZONES &&
8456 			    (zoneid != GLOBAL_ZONEID ||
8457 			    !(lifn_flags & LIFC_ALLZONES)))
8458 				continue;
8459 
8460 			numifs++;
8461 		}
8462 	}
8463 	rw_exit(&ill_g_lock);
8464 	return (numifs);
8465 }
8466 
8467 uint_t
8468 ip_get_lifsrcofnum(ill_t *ill)
8469 {
8470 	uint_t numifs = 0;
8471 	ill_t	*ill_head = ill;
8472 
8473 	/*
8474 	 * ill_g_usesrc_lock protects ill_usesrc_grp_next, for example, some
8475 	 * other thread may be trying to relink the ILLs in this usesrc group
8476 	 * and adjusting the ill_usesrc_grp_next pointers
8477 	 */
8478 	rw_enter(&ill_g_usesrc_lock, RW_READER);
8479 	if ((ill->ill_usesrc_ifindex == 0) &&
8480 	    (ill->ill_usesrc_grp_next != NULL)) {
8481 		for (; (ill != NULL) && (ill->ill_usesrc_grp_next != ill_head);
8482 		    ill = ill->ill_usesrc_grp_next)
8483 			numifs++;
8484 	}
8485 	rw_exit(&ill_g_usesrc_lock);
8486 
8487 	return (numifs);
8488 }
8489 
8490 /* Null values are passed in for ipif, sin, and ifreq */
8491 /* ARGSUSED */
8492 int
8493 ip_sioctl_get_ifnum(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8494     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8495 {
8496 	int *nump;
8497 
8498 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
8499 
8500 	/* Existence of b_cont->b_cont checked in ip_wput_nondata */
8501 	nump = (int *)mp->b_cont->b_cont->b_rptr;
8502 
8503 	*nump = ip_get_numifs(Q_TO_CONN(q)->conn_zoneid);
8504 	ip1dbg(("ip_sioctl_get_ifnum numifs %d", *nump));
8505 	return (0);
8506 }
8507 
8508 /* Null values are passed in for ipif, sin, and ifreq */
8509 /* ARGSUSED */
8510 int
8511 ip_sioctl_get_lifnum(ipif_t *dummy_ipif, sin_t *dummy_sin,
8512     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8513 {
8514 	struct lifnum *lifn;
8515 	mblk_t	*mp1;
8516 
8517 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
8518 
8519 	/* Existence checked in ip_wput_nondata */
8520 	mp1 = mp->b_cont->b_cont;
8521 
8522 	lifn = (struct lifnum *)mp1->b_rptr;
8523 	switch (lifn->lifn_family) {
8524 	case AF_UNSPEC:
8525 	case AF_INET:
8526 	case AF_INET6:
8527 		break;
8528 	default:
8529 		return (EAFNOSUPPORT);
8530 	}
8531 
8532 	lifn->lifn_count = ip_get_numlifs(lifn->lifn_family, lifn->lifn_flags,
8533 	    Q_TO_CONN(q)->conn_zoneid);
8534 	ip1dbg(("ip_sioctl_get_lifnum numifs %d", lifn->lifn_count));
8535 	return (0);
8536 }
8537 
8538 /* ARGSUSED */
8539 int
8540 ip_sioctl_get_ifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8541     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8542 {
8543 	STRUCT_HANDLE(ifconf, ifc);
8544 	mblk_t *mp1;
8545 	struct iocblk *iocp;
8546 	struct ifreq *ifr;
8547 	ill_walk_context_t	ctx;
8548 	ill_t	*ill;
8549 	ipif_t	*ipif;
8550 	struct sockaddr_in *sin;
8551 	int32_t	ifclen;
8552 	zoneid_t zoneid;
8553 
8554 	ASSERT(q->q_next == NULL); /* not valid ioctls for ip as a module */
8555 
8556 	ip1dbg(("ip_sioctl_get_ifconf"));
8557 	/* Existence verified in ip_wput_nondata */
8558 	mp1 = mp->b_cont->b_cont;
8559 	iocp = (struct iocblk *)mp->b_rptr;
8560 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8561 
8562 	/*
8563 	 * The original SIOCGIFCONF passed in a struct ifconf which specified
8564 	 * the user buffer address and length into which the list of struct
8565 	 * ifreqs was to be copied.  Since AT&T Streams does not seem to
8566 	 * allow M_COPYOUT to be used in conjunction with I_STR IOCTLS,
8567 	 * the SIOCGIFCONF operation was redefined to simply provide
8568 	 * a large output buffer into which we are supposed to jam the ifreq
8569 	 * array.  The same ioctl command code was used, despite the fact that
8570 	 * both the applications and the kernel code had to change, thus making
8571 	 * it impossible to support both interfaces.
8572 	 *
8573 	 * For reasons not good enough to try to explain, the following
8574 	 * algorithm is used for deciding what to do with one of these:
8575 	 * If the IOCTL comes in as an I_STR, it is assumed to be of the new
8576 	 * form with the output buffer coming down as the continuation message.
8577 	 * If it arrives as a TRANSPARENT IOCTL, it is assumed to be old style,
8578 	 * and we have to copy in the ifconf structure to find out how big the
8579 	 * output buffer is and where to copy out to.  Sure no problem...
8580 	 *
8581 	 */
8582 	STRUCT_SET_HANDLE(ifc, iocp->ioc_flag, NULL);
8583 	if ((mp1->b_wptr - mp1->b_rptr) == STRUCT_SIZE(ifc)) {
8584 		int numifs = 0;
8585 		size_t ifc_bufsize;
8586 
8587 		/*
8588 		 * Must be (better be!) continuation of a TRANSPARENT
8589 		 * IOCTL.  We just copied in the ifconf structure.
8590 		 */
8591 		STRUCT_SET_HANDLE(ifc, iocp->ioc_flag,
8592 		    (struct ifconf *)mp1->b_rptr);
8593 
8594 		/*
8595 		 * Allocate a buffer to hold requested information.
8596 		 *
8597 		 * If ifc_len is larger than what is needed, we only
8598 		 * allocate what we will use.
8599 		 *
8600 		 * If ifc_len is smaller than what is needed, return
8601 		 * EINVAL.
8602 		 *
8603 		 * XXX: the ill_t structure can hava 2 counters, for
8604 		 * v4 and v6 (not just ill_ipif_up_count) to store the
8605 		 * number of interfaces for a device, so we don't need
8606 		 * to count them here...
8607 		 */
8608 		numifs = ip_get_numifs(zoneid);
8609 
8610 		ifclen = STRUCT_FGET(ifc, ifc_len);
8611 		ifc_bufsize = numifs * sizeof (struct ifreq);
8612 		if (ifc_bufsize > ifclen) {
8613 			if (iocp->ioc_cmd == O_SIOCGIFCONF) {
8614 				/* old behaviour */
8615 				return (EINVAL);
8616 			} else {
8617 				ifc_bufsize = ifclen;
8618 			}
8619 		}
8620 
8621 		mp1 = mi_copyout_alloc(q, mp,
8622 		    STRUCT_FGETP(ifc, ifc_buf), ifc_bufsize, B_FALSE);
8623 		if (mp1 == NULL)
8624 			return (ENOMEM);
8625 
8626 		mp1->b_wptr = mp1->b_rptr + ifc_bufsize;
8627 	}
8628 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
8629 	/*
8630 	 * the SIOCGIFCONF ioctl only knows about
8631 	 * IPv4 addresses, so don't try to tell
8632 	 * it about interfaces with IPv6-only
8633 	 * addresses. (Last parm 'isv6' is B_FALSE)
8634 	 */
8635 
8636 	ifr = (struct ifreq *)mp1->b_rptr;
8637 
8638 	rw_enter(&ill_g_lock, RW_READER);
8639 	ill = ILL_START_WALK_V4(&ctx);
8640 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8641 		for (ipif = ill->ill_ipif; ipif != NULL;
8642 		    ipif = ipif->ipif_next) {
8643 			if (zoneid != ipif->ipif_zoneid &&
8644 			    ipif->ipif_zoneid != ALL_ZONES)
8645 				continue;
8646 			if ((uchar_t *)&ifr[1] > mp1->b_wptr) {
8647 				if (iocp->ioc_cmd == O_SIOCGIFCONF) {
8648 					/* old behaviour */
8649 					rw_exit(&ill_g_lock);
8650 					return (EINVAL);
8651 				} else {
8652 					goto if_copydone;
8653 				}
8654 			}
8655 			(void) ipif_get_name(ipif,
8656 			    ifr->ifr_name,
8657 			    sizeof (ifr->ifr_name));
8658 			sin = (sin_t *)&ifr->ifr_addr;
8659 			*sin = sin_null;
8660 			sin->sin_family = AF_INET;
8661 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
8662 			ifr++;
8663 		}
8664 	}
8665 if_copydone:
8666 	rw_exit(&ill_g_lock);
8667 	mp1->b_wptr = (uchar_t *)ifr;
8668 
8669 	if (STRUCT_BUF(ifc) != NULL) {
8670 		STRUCT_FSET(ifc, ifc_len,
8671 			(int)((uchar_t *)ifr - mp1->b_rptr));
8672 	}
8673 	return (0);
8674 }
8675 
8676 /*
8677  * Get the interfaces using the address hosted on the interface passed in,
8678  * as a source adddress
8679  */
8680 /* ARGSUSED */
8681 int
8682 ip_sioctl_get_lifsrcof(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8683     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8684 {
8685 	mblk_t *mp1;
8686 	ill_t	*ill, *ill_head;
8687 	ipif_t	*ipif, *orig_ipif;
8688 	int	numlifs = 0;
8689 	size_t	lifs_bufsize, lifsmaxlen;
8690 	struct	lifreq *lifr;
8691 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8692 	uint_t	ifindex;
8693 	zoneid_t zoneid;
8694 	int err = 0;
8695 	boolean_t isv6 = B_FALSE;
8696 	struct	sockaddr_in	*sin;
8697 	struct	sockaddr_in6	*sin6;
8698 
8699 	STRUCT_HANDLE(lifsrcof, lifs);
8700 
8701 	ASSERT(q->q_next == NULL);
8702 
8703 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8704 
8705 	/* Existence verified in ip_wput_nondata */
8706 	mp1 = mp->b_cont->b_cont;
8707 
8708 	/*
8709 	 * Must be (better be!) continuation of a TRANSPARENT
8710 	 * IOCTL.  We just copied in the lifsrcof structure.
8711 	 */
8712 	STRUCT_SET_HANDLE(lifs, iocp->ioc_flag,
8713 	    (struct lifsrcof *)mp1->b_rptr);
8714 
8715 	if (MBLKL(mp1) != STRUCT_SIZE(lifs))
8716 		return (EINVAL);
8717 
8718 	ifindex = STRUCT_FGET(lifs, lifs_ifindex);
8719 	isv6 = (Q_TO_CONN(q))->conn_af_isv6;
8720 	ipif = ipif_lookup_on_ifindex(ifindex, isv6, zoneid, q, mp,
8721 	    ip_process_ioctl, &err);
8722 	if (ipif == NULL) {
8723 		ip1dbg(("ip_sioctl_get_lifsrcof: no ipif for ifindex %d\n",
8724 		    ifindex));
8725 		return (err);
8726 	}
8727 
8728 
8729 	/* Allocate a buffer to hold requested information */
8730 	numlifs = ip_get_lifsrcofnum(ipif->ipif_ill);
8731 	lifs_bufsize = numlifs * sizeof (struct lifreq);
8732 	lifsmaxlen =  STRUCT_FGET(lifs, lifs_maxlen);
8733 	/* The actual size needed is always returned in lifs_len */
8734 	STRUCT_FSET(lifs, lifs_len, lifs_bufsize);
8735 
8736 	/* If the amount we need is more than what is passed in, abort */
8737 	if (lifs_bufsize > lifsmaxlen || lifs_bufsize == 0) {
8738 		ipif_refrele(ipif);
8739 		return (0);
8740 	}
8741 
8742 	mp1 = mi_copyout_alloc(q, mp,
8743 	    STRUCT_FGETP(lifs, lifs_buf), lifs_bufsize, B_FALSE);
8744 	if (mp1 == NULL) {
8745 		ipif_refrele(ipif);
8746 		return (ENOMEM);
8747 	}
8748 
8749 	mp1->b_wptr = mp1->b_rptr + lifs_bufsize;
8750 	bzero(mp1->b_rptr, lifs_bufsize);
8751 
8752 	lifr = (struct lifreq *)mp1->b_rptr;
8753 
8754 	ill = ill_head = ipif->ipif_ill;
8755 	orig_ipif = ipif;
8756 
8757 	/* ill_g_usesrc_lock protects ill_usesrc_grp_next */
8758 	rw_enter(&ill_g_usesrc_lock, RW_READER);
8759 	rw_enter(&ill_g_lock, RW_READER);
8760 
8761 	ill = ill->ill_usesrc_grp_next; /* start from next ill */
8762 	for (; (ill != NULL) && (ill != ill_head);
8763 	    ill = ill->ill_usesrc_grp_next) {
8764 
8765 		if ((uchar_t *)&lifr[1] > mp1->b_wptr)
8766 			break;
8767 
8768 		ipif = ill->ill_ipif;
8769 		(void) ipif_get_name(ipif,
8770 		    lifr->lifr_name, sizeof (lifr->lifr_name));
8771 		if (ipif->ipif_isv6) {
8772 			sin6 = (sin6_t *)&lifr->lifr_addr;
8773 			*sin6 = sin6_null;
8774 			sin6->sin6_family = AF_INET6;
8775 			sin6->sin6_addr = ipif->ipif_v6lcl_addr;
8776 			lifr->lifr_addrlen = ip_mask_to_plen_v6(
8777 			    &ipif->ipif_v6net_mask);
8778 		} else {
8779 			sin = (sin_t *)&lifr->lifr_addr;
8780 			*sin = sin_null;
8781 			sin->sin_family = AF_INET;
8782 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
8783 			lifr->lifr_addrlen = ip_mask_to_plen(
8784 			    ipif->ipif_net_mask);
8785 		}
8786 		lifr++;
8787 	}
8788 	rw_exit(&ill_g_usesrc_lock);
8789 	rw_exit(&ill_g_lock);
8790 	ipif_refrele(orig_ipif);
8791 	mp1->b_wptr = (uchar_t *)lifr;
8792 	STRUCT_FSET(lifs, lifs_len, (int)((uchar_t *)lifr - mp1->b_rptr));
8793 
8794 	return (0);
8795 }
8796 
8797 /* ARGSUSED */
8798 int
8799 ip_sioctl_get_lifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8800     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8801 {
8802 	mblk_t *mp1;
8803 	int	list;
8804 	ill_t	*ill;
8805 	ipif_t	*ipif;
8806 	int	flags;
8807 	int	numlifs = 0;
8808 	size_t	lifc_bufsize;
8809 	struct	lifreq *lifr;
8810 	sa_family_t	family;
8811 	struct	sockaddr_in	*sin;
8812 	struct	sockaddr_in6	*sin6;
8813 	ill_walk_context_t	ctx;
8814 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8815 	int32_t	lifclen;
8816 	zoneid_t zoneid;
8817 	STRUCT_HANDLE(lifconf, lifc);
8818 
8819 	ip1dbg(("ip_sioctl_get_lifconf"));
8820 
8821 	ASSERT(q->q_next == NULL);
8822 
8823 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8824 
8825 	/* Existence verified in ip_wput_nondata */
8826 	mp1 = mp->b_cont->b_cont;
8827 
8828 	/*
8829 	 * An extended version of SIOCGIFCONF that takes an
8830 	 * additional address family and flags field.
8831 	 * AF_UNSPEC retrieve both IPv4 and IPv6.
8832 	 * Unless LIFC_NOXMIT is specified the IPIF_NOXMIT
8833 	 * interfaces are omitted.
8834 	 * Similarly, IPIF_TEMPORARY interfaces are omitted
8835 	 * unless LIFC_TEMPORARY is specified.
8836 	 * If LIFC_EXTERNAL_SOURCE is specified, IPIF_NOXMIT,
8837 	 * IPIF_NOLOCAL, PHYI_LOOPBACK, IPIF_DEPRECATED and
8838 	 * not IPIF_UP interfaces are omitted. LIFC_EXTERNAL_SOURCE
8839 	 * has priority over LIFC_NOXMIT.
8840 	 */
8841 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, NULL);
8842 
8843 	if ((mp1->b_wptr - mp1->b_rptr) != STRUCT_SIZE(lifc))
8844 		return (EINVAL);
8845 
8846 	/*
8847 	 * Must be (better be!) continuation of a TRANSPARENT
8848 	 * IOCTL.  We just copied in the lifconf structure.
8849 	 */
8850 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, (struct lifconf *)mp1->b_rptr);
8851 
8852 	family = STRUCT_FGET(lifc, lifc_family);
8853 	flags = STRUCT_FGET(lifc, lifc_flags);
8854 
8855 	switch (family) {
8856 	case AF_UNSPEC:
8857 		/*
8858 		 * walk all ILL's.
8859 		 */
8860 		list = MAX_G_HEADS;
8861 		break;
8862 	case AF_INET:
8863 		/*
8864 		 * walk only IPV4 ILL's.
8865 		 */
8866 		list = IP_V4_G_HEAD;
8867 		break;
8868 	case AF_INET6:
8869 		/*
8870 		 * walk only IPV6 ILL's.
8871 		 */
8872 		list = IP_V6_G_HEAD;
8873 		break;
8874 	default:
8875 		return (EAFNOSUPPORT);
8876 	}
8877 
8878 	/*
8879 	 * Allocate a buffer to hold requested information.
8880 	 *
8881 	 * If lifc_len is larger than what is needed, we only
8882 	 * allocate what we will use.
8883 	 *
8884 	 * If lifc_len is smaller than what is needed, return
8885 	 * EINVAL.
8886 	 */
8887 	numlifs = ip_get_numlifs(family, flags, zoneid);
8888 	lifc_bufsize = numlifs * sizeof (struct lifreq);
8889 	lifclen = STRUCT_FGET(lifc, lifc_len);
8890 	if (lifc_bufsize > lifclen) {
8891 		if (iocp->ioc_cmd == O_SIOCGLIFCONF)
8892 			return (EINVAL);
8893 		else
8894 			lifc_bufsize = lifclen;
8895 	}
8896 
8897 	mp1 = mi_copyout_alloc(q, mp,
8898 	    STRUCT_FGETP(lifc, lifc_buf), lifc_bufsize, B_FALSE);
8899 	if (mp1 == NULL)
8900 		return (ENOMEM);
8901 
8902 	mp1->b_wptr = mp1->b_rptr + lifc_bufsize;
8903 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
8904 
8905 	lifr = (struct lifreq *)mp1->b_rptr;
8906 
8907 	rw_enter(&ill_g_lock, RW_READER);
8908 	ill = ill_first(list, list, &ctx);
8909 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8910 		for (ipif = ill->ill_ipif; ipif != NULL;
8911 		    ipif = ipif->ipif_next) {
8912 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
8913 			    !(flags & LIFC_NOXMIT))
8914 				continue;
8915 
8916 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
8917 			    !(flags & LIFC_TEMPORARY))
8918 				continue;
8919 
8920 			if (((ipif->ipif_flags &
8921 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
8922 			    IPIF_DEPRECATED)) ||
8923 			    (ill->ill_phyint->phyint_flags &
8924 			    PHYI_LOOPBACK) ||
8925 			    !(ipif->ipif_flags & IPIF_UP)) &&
8926 			    (flags & LIFC_EXTERNAL_SOURCE))
8927 				continue;
8928 
8929 			if (zoneid != ipif->ipif_zoneid &&
8930 			    ipif->ipif_zoneid != ALL_ZONES &&
8931 			    (zoneid != GLOBAL_ZONEID ||
8932 			    !(flags & LIFC_ALLZONES)))
8933 				continue;
8934 
8935 			if ((uchar_t *)&lifr[1] > mp1->b_wptr) {
8936 				if (iocp->ioc_cmd == O_SIOCGLIFCONF) {
8937 					rw_exit(&ill_g_lock);
8938 					return (EINVAL);
8939 				} else {
8940 					goto lif_copydone;
8941 				}
8942 			}
8943 
8944 			(void) ipif_get_name(ipif,
8945 				lifr->lifr_name,
8946 				sizeof (lifr->lifr_name));
8947 			if (ipif->ipif_isv6) {
8948 				sin6 = (sin6_t *)&lifr->lifr_addr;
8949 				*sin6 = sin6_null;
8950 				sin6->sin6_family = AF_INET6;
8951 				sin6->sin6_addr =
8952 				ipif->ipif_v6lcl_addr;
8953 				lifr->lifr_addrlen =
8954 				ip_mask_to_plen_v6(
8955 				    &ipif->ipif_v6net_mask);
8956 			} else {
8957 				sin = (sin_t *)&lifr->lifr_addr;
8958 				*sin = sin_null;
8959 				sin->sin_family = AF_INET;
8960 				sin->sin_addr.s_addr =
8961 				    ipif->ipif_lcl_addr;
8962 				lifr->lifr_addrlen =
8963 				    ip_mask_to_plen(
8964 				    ipif->ipif_net_mask);
8965 			}
8966 			lifr++;
8967 		}
8968 	}
8969 lif_copydone:
8970 	rw_exit(&ill_g_lock);
8971 
8972 	mp1->b_wptr = (uchar_t *)lifr;
8973 	if (STRUCT_BUF(lifc) != NULL) {
8974 		STRUCT_FSET(lifc, lifc_len,
8975 			(int)((uchar_t *)lifr - mp1->b_rptr));
8976 	}
8977 	return (0);
8978 }
8979 
8980 /* ARGSUSED */
8981 int
8982 ip_sioctl_set_ipmpfailback(ipif_t *dummy_ipif, sin_t *dummy_sin,
8983     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8984 {
8985 	/* Existence of b_cont->b_cont checked in ip_wput_nondata */
8986 	ipmp_enable_failback = *(int *)mp->b_cont->b_cont->b_rptr;
8987 	return (0);
8988 }
8989 
8990 static void
8991 ip_sioctl_ip6addrpolicy(queue_t *q, mblk_t *mp)
8992 {
8993 	ip6_asp_t *table;
8994 	size_t table_size;
8995 	mblk_t *data_mp;
8996 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8997 
8998 	/* These two ioctls are I_STR only */
8999 	if (iocp->ioc_count == TRANSPARENT) {
9000 		miocnak(q, mp, 0, EINVAL);
9001 		return;
9002 	}
9003 
9004 	data_mp = mp->b_cont;
9005 	if (data_mp == NULL) {
9006 		/* The user passed us a NULL argument */
9007 		table = NULL;
9008 		table_size = iocp->ioc_count;
9009 	} else {
9010 		/*
9011 		 * The user provided a table.  The stream head
9012 		 * may have copied in the user data in chunks,
9013 		 * so make sure everything is pulled up
9014 		 * properly.
9015 		 */
9016 		if (MBLKL(data_mp) < iocp->ioc_count) {
9017 			mblk_t *new_data_mp;
9018 			if ((new_data_mp = msgpullup(data_mp, -1)) ==
9019 			    NULL) {
9020 				miocnak(q, mp, 0, ENOMEM);
9021 				return;
9022 			}
9023 			freemsg(data_mp);
9024 			data_mp = new_data_mp;
9025 			mp->b_cont = data_mp;
9026 		}
9027 		table = (ip6_asp_t *)data_mp->b_rptr;
9028 		table_size = iocp->ioc_count;
9029 	}
9030 
9031 	switch (iocp->ioc_cmd) {
9032 	case SIOCGIP6ADDRPOLICY:
9033 		iocp->ioc_rval = ip6_asp_get(table, table_size);
9034 		if (iocp->ioc_rval == -1)
9035 			iocp->ioc_error = EINVAL;
9036 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
9037 		else if (table != NULL &&
9038 		    (iocp->ioc_flag & IOC_MODELS) == IOC_ILP32) {
9039 			ip6_asp_t *src = table;
9040 			ip6_asp32_t *dst = (void *)table;
9041 			int count = table_size / sizeof (ip6_asp_t);
9042 			int i;
9043 
9044 			/*
9045 			 * We need to do an in-place shrink of the array
9046 			 * to match the alignment attributes of the
9047 			 * 32-bit ABI looking at it.
9048 			 */
9049 			/* LINTED: logical expression always true: op "||" */
9050 			ASSERT(sizeof (*src) > sizeof (*dst));
9051 			for (i = 1; i < count; i++)
9052 				bcopy(src + i, dst + i, sizeof (*dst));
9053 		}
9054 #endif
9055 		break;
9056 
9057 	case SIOCSIP6ADDRPOLICY:
9058 		ASSERT(mp->b_prev == NULL);
9059 		mp->b_prev = (void *)q;
9060 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
9061 		/*
9062 		 * We pass in the datamodel here so that the ip6_asp_replace()
9063 		 * routine can handle converting from 32-bit to native formats
9064 		 * where necessary.
9065 		 *
9066 		 * A better way to handle this might be to convert the inbound
9067 		 * data structure here, and hang it off a new 'mp'; thus the
9068 		 * ip6_asp_replace() logic would always be dealing with native
9069 		 * format data structures..
9070 		 *
9071 		 * (An even simpler way to handle these ioctls is to just
9072 		 * add a 32-bit trailing 'pad' field to the ip6_asp_t structure
9073 		 * and just recompile everything that depends on it.)
9074 		 */
9075 #endif
9076 		ip6_asp_replace(mp, table, table_size, B_FALSE,
9077 		    iocp->ioc_flag & IOC_MODELS);
9078 		return;
9079 	}
9080 
9081 	DB_TYPE(mp) =  (iocp->ioc_error == 0) ? M_IOCACK : M_IOCNAK;
9082 	qreply(q, mp);
9083 }
9084 
9085 static void
9086 ip_sioctl_dstinfo(queue_t *q, mblk_t *mp)
9087 {
9088 	mblk_t 		*data_mp;
9089 	struct dstinforeq	*dir;
9090 	uint8_t		*end, *cur;
9091 	in6_addr_t	*daddr, *saddr;
9092 	ipaddr_t	v4daddr;
9093 	ire_t		*ire;
9094 	char		*slabel, *dlabel;
9095 	boolean_t	isipv4;
9096 	int		match_ire;
9097 	ill_t		*dst_ill;
9098 	ipif_t		*src_ipif, *ire_ipif;
9099 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
9100 	zoneid_t	zoneid;
9101 
9102 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
9103 	zoneid = Q_TO_CONN(q)->conn_zoneid;
9104 
9105 	/*
9106 	 * This ioctl is I_STR only, and must have a
9107 	 * data mblk following the M_IOCTL mblk.
9108 	 */
9109 	data_mp = mp->b_cont;
9110 	if (iocp->ioc_count == TRANSPARENT || data_mp == NULL) {
9111 		miocnak(q, mp, 0, EINVAL);
9112 		return;
9113 	}
9114 
9115 	if (MBLKL(data_mp) < iocp->ioc_count) {
9116 		mblk_t *new_data_mp;
9117 
9118 		if ((new_data_mp = msgpullup(data_mp, -1)) == NULL) {
9119 			miocnak(q, mp, 0, ENOMEM);
9120 			return;
9121 		}
9122 		freemsg(data_mp);
9123 		data_mp = new_data_mp;
9124 		mp->b_cont = data_mp;
9125 	}
9126 	match_ire = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | MATCH_IRE_PARENT;
9127 
9128 	for (cur = data_mp->b_rptr, end = data_mp->b_wptr;
9129 	    end - cur >= sizeof (struct dstinforeq);
9130 	    cur += sizeof (struct dstinforeq)) {
9131 		dir = (struct dstinforeq *)cur;
9132 		daddr = &dir->dir_daddr;
9133 		saddr = &dir->dir_saddr;
9134 
9135 		/*
9136 		 * ip_addr_scope_v6() and ip6_asp_lookup() handle
9137 		 * v4 mapped addresses; ire_ftable_lookup[_v6]()
9138 		 * and ipif_select_source[_v6]() do not.
9139 		 */
9140 		dir->dir_dscope = ip_addr_scope_v6(daddr);
9141 		dlabel = ip6_asp_lookup(daddr, &dir->dir_precedence);
9142 
9143 		isipv4 = IN6_IS_ADDR_V4MAPPED(daddr);
9144 		if (isipv4) {
9145 			IN6_V4MAPPED_TO_IPADDR(daddr, v4daddr);
9146 			ire = ire_ftable_lookup(v4daddr, NULL, NULL,
9147 			    0, NULL, NULL, zoneid, 0, NULL, match_ire);
9148 		} else {
9149 			ire = ire_ftable_lookup_v6(daddr, NULL, NULL,
9150 			    0, NULL, NULL, zoneid, 0, NULL, match_ire);
9151 		}
9152 		if (ire == NULL) {
9153 			dir->dir_dreachable = 0;
9154 
9155 			/* move on to next dst addr */
9156 			continue;
9157 		}
9158 		dir->dir_dreachable = 1;
9159 
9160 		ire_ipif = ire->ire_ipif;
9161 		if (ire_ipif == NULL)
9162 			goto next_dst;
9163 
9164 		/*
9165 		 * We expect to get back an interface ire or a
9166 		 * gateway ire cache entry.  For both types, the
9167 		 * output interface is ire_ipif->ipif_ill.
9168 		 */
9169 		dst_ill = ire_ipif->ipif_ill;
9170 		dir->dir_dmactype = dst_ill->ill_mactype;
9171 
9172 		if (isipv4) {
9173 			src_ipif = ipif_select_source(dst_ill, v4daddr, zoneid);
9174 		} else {
9175 			src_ipif = ipif_select_source_v6(dst_ill,
9176 			    daddr, RESTRICT_TO_NONE, IPV6_PREFER_SRC_DEFAULT,
9177 			    zoneid);
9178 		}
9179 		if (src_ipif == NULL)
9180 			goto next_dst;
9181 
9182 		*saddr = src_ipif->ipif_v6lcl_addr;
9183 		dir->dir_sscope = ip_addr_scope_v6(saddr);
9184 		slabel = ip6_asp_lookup(saddr, NULL);
9185 		dir->dir_labelmatch = ip6_asp_labelcmp(dlabel, slabel);
9186 		dir->dir_sdeprecated =
9187 		    (src_ipif->ipif_flags & IPIF_DEPRECATED) ? 1 : 0;
9188 		ipif_refrele(src_ipif);
9189 next_dst:
9190 		ire_refrele(ire);
9191 	}
9192 	miocack(q, mp, iocp->ioc_count, 0);
9193 }
9194 
9195 
9196 /*
9197  * Check if this is an address assigned to this machine.
9198  * Skips interfaces that are down by using ire checks.
9199  * Translates mapped addresses to v4 addresses and then
9200  * treats them as such, returning true if the v4 address
9201  * associated with this mapped address is configured.
9202  * Note: Applications will have to be careful what they do
9203  * with the response; use of mapped addresses limits
9204  * what can be done with the socket, especially with
9205  * respect to socket options and ioctls - neither IPv4
9206  * options nor IPv6 sticky options/ancillary data options
9207  * may be used.
9208  */
9209 /* ARGSUSED */
9210 int
9211 ip_sioctl_tmyaddr(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9212     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9213 {
9214 	struct sioc_addrreq *sia;
9215 	sin_t *sin;
9216 	ire_t *ire;
9217 	mblk_t *mp1;
9218 	zoneid_t zoneid;
9219 
9220 	ip1dbg(("ip_sioctl_tmyaddr"));
9221 
9222 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
9223 	zoneid = Q_TO_CONN(q)->conn_zoneid;
9224 
9225 	/* Existence verified in ip_wput_nondata */
9226 	mp1 = mp->b_cont->b_cont;
9227 	sia = (struct sioc_addrreq *)mp1->b_rptr;
9228 	sin = (sin_t *)&sia->sa_addr;
9229 	switch (sin->sin_family) {
9230 	case AF_INET6: {
9231 		sin6_t *sin6 = (sin6_t *)sin;
9232 
9233 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
9234 			ipaddr_t v4_addr;
9235 
9236 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
9237 			    v4_addr);
9238 			ire = ire_ctable_lookup(v4_addr, 0,
9239 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
9240 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY);
9241 		} else {
9242 			in6_addr_t v6addr;
9243 
9244 			v6addr = sin6->sin6_addr;
9245 			ire = ire_ctable_lookup_v6(&v6addr, 0,
9246 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
9247 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY);
9248 		}
9249 		break;
9250 	}
9251 	case AF_INET: {
9252 		ipaddr_t v4addr;
9253 
9254 		v4addr = sin->sin_addr.s_addr;
9255 		ire = ire_ctable_lookup(v4addr, 0,
9256 		    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
9257 		    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY);
9258 		break;
9259 	}
9260 	default:
9261 		return (EAFNOSUPPORT);
9262 	}
9263 	if (ire != NULL) {
9264 		sia->sa_res = 1;
9265 		ire_refrele(ire);
9266 	} else {
9267 		sia->sa_res = 0;
9268 	}
9269 	return (0);
9270 }
9271 
9272 /*
9273  * Check if this is an address assigned on-link i.e. neighbor,
9274  * and makes sure it's reachable from the current zone.
9275  * Returns true for my addresses as well.
9276  * Translates mapped addresses to v4 addresses and then
9277  * treats them as such, returning true if the v4 address
9278  * associated with this mapped address is configured.
9279  * Note: Applications will have to be careful what they do
9280  * with the response; use of mapped addresses limits
9281  * what can be done with the socket, especially with
9282  * respect to socket options and ioctls - neither IPv4
9283  * options nor IPv6 sticky options/ancillary data options
9284  * may be used.
9285  */
9286 /* ARGSUSED */
9287 int
9288 ip_sioctl_tonlink(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9289     ip_ioctl_cmd_t *ipip, void *duymmy_ifreq)
9290 {
9291 	struct sioc_addrreq *sia;
9292 	sin_t *sin;
9293 	mblk_t	*mp1;
9294 	ire_t *ire = NULL;
9295 	zoneid_t zoneid;
9296 
9297 	ip1dbg(("ip_sioctl_tonlink"));
9298 
9299 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
9300 	zoneid = Q_TO_CONN(q)->conn_zoneid;
9301 
9302 	/* Existence verified in ip_wput_nondata */
9303 	mp1 = mp->b_cont->b_cont;
9304 	sia = (struct sioc_addrreq *)mp1->b_rptr;
9305 	sin = (sin_t *)&sia->sa_addr;
9306 
9307 	/*
9308 	 * Match addresses with a zero gateway field to avoid
9309 	 * routes going through a router.
9310 	 * Exclude broadcast and multicast addresses.
9311 	 */
9312 	switch (sin->sin_family) {
9313 	case AF_INET6: {
9314 		sin6_t *sin6 = (sin6_t *)sin;
9315 
9316 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
9317 			ipaddr_t v4_addr;
9318 
9319 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
9320 			    v4_addr);
9321 			if (!CLASSD(v4_addr)) {
9322 				ire = ire_route_lookup(v4_addr, 0, 0, 0,
9323 				    NULL, NULL, zoneid, NULL,
9324 				    MATCH_IRE_GW);
9325 			}
9326 		} else {
9327 			in6_addr_t v6addr;
9328 			in6_addr_t v6gw;
9329 
9330 			v6addr = sin6->sin6_addr;
9331 			v6gw = ipv6_all_zeros;
9332 			if (!IN6_IS_ADDR_MULTICAST(&v6addr)) {
9333 				ire = ire_route_lookup_v6(&v6addr, 0,
9334 				    &v6gw, 0, NULL, NULL, zoneid,
9335 				    NULL, MATCH_IRE_GW);
9336 			}
9337 		}
9338 		break;
9339 	}
9340 	case AF_INET: {
9341 		ipaddr_t v4addr;
9342 
9343 		v4addr = sin->sin_addr.s_addr;
9344 		if (!CLASSD(v4addr)) {
9345 			ire = ire_route_lookup(v4addr, 0, 0, 0,
9346 			    NULL, NULL, zoneid, NULL,
9347 			    MATCH_IRE_GW);
9348 		}
9349 		break;
9350 	}
9351 	default:
9352 		return (EAFNOSUPPORT);
9353 	}
9354 	sia->sa_res = 0;
9355 	if (ire != NULL) {
9356 		if (ire->ire_type & (IRE_INTERFACE|IRE_CACHE|
9357 		    IRE_LOCAL|IRE_LOOPBACK)) {
9358 			sia->sa_res = 1;
9359 		}
9360 		ire_refrele(ire);
9361 	}
9362 	return (0);
9363 }
9364 
9365 /*
9366  * TBD: implement when kernel maintaines a list of site prefixes.
9367  */
9368 /* ARGSUSED */
9369 int
9370 ip_sioctl_tmysite(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9371     ip_ioctl_cmd_t *ipip, void *ifreq)
9372 {
9373 	return (ENXIO);
9374 }
9375 
9376 /* ARGSUSED */
9377 int
9378 ip_sioctl_tunparam(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9379     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9380 {
9381 	ill_t  		*ill;
9382 	mblk_t		*mp1;
9383 	conn_t		*connp;
9384 	boolean_t	success;
9385 
9386 	ip1dbg(("ip_sioctl_tunparam(%s:%u %p)\n",
9387 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9388 	/* ioctl comes down on an conn */
9389 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9390 	connp = Q_TO_CONN(q);
9391 
9392 	mp->b_datap->db_type = M_IOCTL;
9393 
9394 	/*
9395 	 * Send down a copy. (copymsg does not copy b_next/b_prev).
9396 	 * The original mp contains contaminated b_next values due to 'mi',
9397 	 * which is needed to do the mi_copy_done. Unfortunately if we
9398 	 * send down the original mblk itself and if we are popped due to an
9399 	 * an unplumb before the response comes back from tunnel,
9400 	 * the streamhead (which does a freemsg) will see this contaminated
9401 	 * message and the assertion in freemsg about non-null b_next/b_prev
9402 	 * will panic a DEBUG kernel.
9403 	 */
9404 	mp1 = copymsg(mp);
9405 	if (mp1 == NULL)
9406 		return (ENOMEM);
9407 
9408 	ill = ipif->ipif_ill;
9409 	mutex_enter(&connp->conn_lock);
9410 	mutex_enter(&ill->ill_lock);
9411 	if (ipip->ipi_cmd == SIOCSTUNPARAM || ipip->ipi_cmd == OSIOCSTUNPARAM) {
9412 		success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp),
9413 		    mp, 0);
9414 	} else {
9415 		success = ill_pending_mp_add(ill, connp, mp);
9416 	}
9417 	mutex_exit(&ill->ill_lock);
9418 	mutex_exit(&connp->conn_lock);
9419 
9420 	if (success) {
9421 		ip1dbg(("sending down tunparam request "));
9422 		putnext(ill->ill_wq, mp1);
9423 		return (EINPROGRESS);
9424 	} else {
9425 		/* The conn has started closing */
9426 		freemsg(mp1);
9427 		return (EINTR);
9428 	}
9429 }
9430 
9431 static int
9432 ip_sioctl_arp_common(ill_t *ill, queue_t *q, mblk_t *mp, sin_t *sin,
9433     boolean_t x_arp_ioctl, boolean_t if_arp_ioctl)
9434 {
9435 	mblk_t *mp1;
9436 	mblk_t *mp2;
9437 	mblk_t *pending_mp;
9438 	ipaddr_t ipaddr;
9439 	area_t *area;
9440 	struct iocblk *iocp;
9441 	conn_t *connp;
9442 	struct arpreq *ar;
9443 	struct xarpreq *xar;
9444 	boolean_t success;
9445 	int flags, alength;
9446 	char *lladdr;
9447 
9448 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9449 	connp = Q_TO_CONN(q);
9450 
9451 	iocp = (struct iocblk *)mp->b_rptr;
9452 	/*
9453 	 * ill has already been set depending on whether
9454 	 * bsd style or interface style ioctl.
9455 	 */
9456 	ASSERT(ill != NULL);
9457 
9458 	/*
9459 	 * Is this one of the new SIOC*XARP ioctls?
9460 	 */
9461 	if (x_arp_ioctl) {
9462 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->XARPREQ_MBLK */
9463 		xar = (struct xarpreq *)mp->b_cont->b_cont->b_rptr;
9464 		ar = NULL;
9465 
9466 		flags = xar->xarp_flags;
9467 		lladdr = LLADDR(&xar->xarp_ha);
9468 		/*
9469 		 * Validate against user's link layer address length
9470 		 * input and name and addr length limits.
9471 		 */
9472 		alength = ill->ill_phys_addr_length;
9473 		if (iocp->ioc_cmd == SIOCSXARP) {
9474 			if (alength != xar->xarp_ha.sdl_alen ||
9475 			    (alength + xar->xarp_ha.sdl_nlen >
9476 			    sizeof (xar->xarp_ha.sdl_data)))
9477 				return (EINVAL);
9478 		}
9479 	} else {
9480 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->ARPREQ_MBLK */
9481 		ar = (struct arpreq *)mp->b_cont->b_cont->b_rptr;
9482 		xar = NULL;
9483 
9484 		flags = ar->arp_flags;
9485 		lladdr = ar->arp_ha.sa_data;
9486 		/*
9487 		 * Theoretically, the sa_family could tell us what link
9488 		 * layer type this operation is trying to deal with. By
9489 		 * common usage AF_UNSPEC means ethernet. We'll assume
9490 		 * any attempt to use the SIOC?ARP ioctls is for ethernet,
9491 		 * for now. Our new SIOC*XARP ioctls can be used more
9492 		 * generally.
9493 		 *
9494 		 * If the underlying media happens to have a non 6 byte
9495 		 * address, arp module will fail set/get, but the del
9496 		 * operation will succeed.
9497 		 */
9498 		alength = 6;
9499 		if ((iocp->ioc_cmd != SIOCDARP) &&
9500 		    (alength != ill->ill_phys_addr_length)) {
9501 			return (EINVAL);
9502 		}
9503 	}
9504 
9505 	/*
9506 	 * We are going to pass up to ARP a packet chain that looks
9507 	 * like:
9508 	 *
9509 	 * M_IOCTL-->ARP_op_MBLK-->ORIG_M_IOCTL-->MI_COPY_MBLK-->[X]ARPREQ_MBLK
9510 	 *
9511 	 * Get a copy of the original IOCTL mblk to head the chain,
9512 	 * to be sent up (in mp1). Also get another copy to store
9513 	 * in the ill_pending_mp list, for matching the response
9514 	 * when it comes back from ARP.
9515 	 */
9516 	mp1 = copyb(mp);
9517 	pending_mp = copymsg(mp);
9518 	if (mp1 == NULL || pending_mp == NULL) {
9519 		if (mp1 != NULL)
9520 			freeb(mp1);
9521 		if (pending_mp != NULL)
9522 			inet_freemsg(pending_mp);
9523 		return (ENOMEM);
9524 	}
9525 
9526 	ipaddr = sin->sin_addr.s_addr;
9527 
9528 	mp2 = ill_arp_alloc(ill, (uchar_t *)&ip_area_template,
9529 	    (caddr_t)&ipaddr);
9530 	if (mp2 == NULL) {
9531 		freeb(mp1);
9532 		inet_freemsg(pending_mp);
9533 		return (ENOMEM);
9534 	}
9535 	/* Put together the chain. */
9536 	mp1->b_cont = mp2;
9537 	mp1->b_datap->db_type = M_IOCTL;
9538 	mp2->b_cont = mp;
9539 	mp2->b_datap->db_type = M_DATA;
9540 
9541 	iocp = (struct iocblk *)mp1->b_rptr;
9542 
9543 	/*
9544 	 * An M_IOCDATA's payload (struct copyresp) is mostly the same as an
9545 	 * M_IOCTL's payload (struct iocblk), but 'struct copyresp' has a
9546 	 * cp_private field (or cp_rval on 32-bit systems) in place of the
9547 	 * ioc_count field; set ioc_count to be correct.
9548 	 */
9549 	iocp->ioc_count = MBLKL(mp1->b_cont);
9550 
9551 	/*
9552 	 * Set the proper command in the ARP message.
9553 	 * Convert the SIOC{G|S|D}ARP calls into our
9554 	 * AR_ENTRY_xxx calls.
9555 	 */
9556 	area = (area_t *)mp2->b_rptr;
9557 	switch (iocp->ioc_cmd) {
9558 	case SIOCDARP:
9559 	case SIOCDXARP:
9560 		/*
9561 		 * We defer deleting the corresponding IRE until
9562 		 * we return from arp.
9563 		 */
9564 		area->area_cmd = AR_ENTRY_DELETE;
9565 		area->area_proto_mask_offset = 0;
9566 		break;
9567 	case SIOCGARP:
9568 	case SIOCGXARP:
9569 		area->area_cmd = AR_ENTRY_SQUERY;
9570 		area->area_proto_mask_offset = 0;
9571 		break;
9572 	case SIOCSARP:
9573 	case SIOCSXARP: {
9574 		/*
9575 		 * Delete the corresponding ire to make sure IP will
9576 		 * pick up any change from arp.
9577 		 */
9578 		if (!if_arp_ioctl) {
9579 			(void) ip_ire_clookup_and_delete(ipaddr, NULL);
9580 			break;
9581 		} else {
9582 			ipif_t *ipif = ipif_get_next_ipif(NULL, ill);
9583 			if (ipif != NULL) {
9584 				(void) ip_ire_clookup_and_delete(ipaddr, ipif);
9585 				ipif_refrele(ipif);
9586 			}
9587 			break;
9588 		}
9589 	}
9590 	}
9591 	iocp->ioc_cmd = area->area_cmd;
9592 
9593 	/*
9594 	 * Before sending 'mp' to ARP, we have to clear the b_next
9595 	 * and b_prev. Otherwise if STREAMS encounters such a message
9596 	 * in freemsg(), (because ARP can close any time) it can cause
9597 	 * a panic. But mi code needs the b_next and b_prev values of
9598 	 * mp->b_cont, to complete the ioctl. So we store it here
9599 	 * in pending_mp->bcont, and restore it in ip_sioctl_iocack()
9600 	 * when the response comes down from ARP.
9601 	 */
9602 	pending_mp->b_cont->b_next = mp->b_cont->b_next;
9603 	pending_mp->b_cont->b_prev = mp->b_cont->b_prev;
9604 	mp->b_cont->b_next = NULL;
9605 	mp->b_cont->b_prev = NULL;
9606 
9607 	mutex_enter(&connp->conn_lock);
9608 	mutex_enter(&ill->ill_lock);
9609 	/* conn has not yet started closing, hence this can't fail */
9610 	success = ill_pending_mp_add(ill, connp, pending_mp);
9611 	ASSERT(success);
9612 	mutex_exit(&ill->ill_lock);
9613 	mutex_exit(&connp->conn_lock);
9614 
9615 	/*
9616 	 * Fill in the rest of the ARP operation fields.
9617 	 */
9618 	area->area_hw_addr_length = alength;
9619 	bcopy(lladdr,
9620 	    (char *)area + area->area_hw_addr_offset,
9621 	    area->area_hw_addr_length);
9622 	/* Translate the flags. */
9623 	if (flags & ATF_PERM)
9624 		area->area_flags |= ACE_F_PERMANENT;
9625 	if (flags & ATF_PUBL)
9626 		area->area_flags |= ACE_F_PUBLISH;
9627 	if (flags & ATF_AUTHORITY)
9628 		area->area_flags |= ACE_F_AUTHORITY;
9629 
9630 	/*
9631 	 * Up to ARP it goes.  The response will come
9632 	 * back in ip_wput as an M_IOCACK message, and
9633 	 * will be handed to ip_sioctl_iocack for
9634 	 * completion.
9635 	 */
9636 	putnext(ill->ill_rq, mp1);
9637 	return (EINPROGRESS);
9638 }
9639 
9640 /* ARGSUSED */
9641 int
9642 ip_sioctl_xarp(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9643     ip_ioctl_cmd_t *ipip, void *ifreq)
9644 {
9645 	struct xarpreq *xar;
9646 	boolean_t isv6;
9647 	mblk_t	*mp1;
9648 	int	err;
9649 	conn_t	*connp;
9650 	int ifnamelen;
9651 	ire_t	*ire = NULL;
9652 	ill_t	*ill = NULL;
9653 	struct sockaddr_in *sin;
9654 	boolean_t if_arp_ioctl = B_FALSE;
9655 
9656 	/* ioctl comes down on an conn */
9657 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9658 	connp = Q_TO_CONN(q);
9659 	isv6 = connp->conn_af_isv6;
9660 
9661 	/* Existance verified in ip_wput_nondata */
9662 	mp1 = mp->b_cont->b_cont;
9663 
9664 	ASSERT(MBLKL(mp1) >= sizeof (*xar));
9665 	xar = (struct xarpreq *)mp1->b_rptr;
9666 	sin = (sin_t *)&xar->xarp_pa;
9667 
9668 	if (isv6 || (xar->xarp_ha.sdl_family != AF_LINK) ||
9669 	    (xar->xarp_pa.ss_family != AF_INET))
9670 		return (ENXIO);
9671 
9672 	ifnamelen = xar->xarp_ha.sdl_nlen;
9673 	if (ifnamelen != 0) {
9674 		char	*cptr, cval;
9675 
9676 		if (ifnamelen >= LIFNAMSIZ)
9677 			return (EINVAL);
9678 
9679 		/*
9680 		 * Instead of bcopying a bunch of bytes,
9681 		 * null-terminate the string in-situ.
9682 		 */
9683 		cptr = xar->xarp_ha.sdl_data + ifnamelen;
9684 		cval = *cptr;
9685 		*cptr = '\0';
9686 		ill = ill_lookup_on_name(xar->xarp_ha.sdl_data,
9687 		    B_FALSE, isv6, CONNP_TO_WQ(connp), mp, ip_process_ioctl,
9688 		    &err, NULL);
9689 		*cptr = cval;
9690 		if (ill == NULL)
9691 			return (err);
9692 		if (ill->ill_net_type != IRE_IF_RESOLVER) {
9693 			ill_refrele(ill);
9694 			return (ENXIO);
9695 		}
9696 
9697 		if_arp_ioctl = B_TRUE;
9698 	} else {
9699 		/*
9700 		 * PSARC 2003/088 states that if sdl_nlen == 0, it behaves
9701 		 * as an extended BSD ioctl. The kernel uses the IP address
9702 		 * to figure out the network interface.
9703 		 */
9704 		ire = ire_cache_lookup(sin->sin_addr.s_addr, ALL_ZONES, NULL);
9705 		if ((ire == NULL) || (ire->ire_type == IRE_LOOPBACK) ||
9706 		    ((ill = ire_to_ill(ire)) == NULL) ||
9707 		    (ill->ill_net_type != IRE_IF_RESOLVER)) {
9708 			if (ire != NULL)
9709 				ire_refrele(ire);
9710 			ire = ire_ftable_lookup(sin->sin_addr.s_addr,
9711 			    0, 0, IRE_IF_RESOLVER, NULL, NULL, ALL_ZONES, 0,
9712 			    NULL, MATCH_IRE_TYPE);
9713 			if ((ire == NULL) ||
9714 			    ((ill = ire_to_ill(ire)) == NULL)) {
9715 				if (ire != NULL)
9716 					ire_refrele(ire);
9717 				return (ENXIO);
9718 			}
9719 		}
9720 		ASSERT(ire != NULL && ill != NULL);
9721 	}
9722 
9723 	err = ip_sioctl_arp_common(ill, q, mp, sin, B_TRUE, if_arp_ioctl);
9724 	if (if_arp_ioctl)
9725 		ill_refrele(ill);
9726 	if (ire != NULL)
9727 		ire_refrele(ire);
9728 
9729 	return (err);
9730 }
9731 
9732 /*
9733  * ARP IOCTLs.
9734  * How does IP get in the business of fronting ARP configuration/queries?
9735  * Well its like this, the Berkeley ARP IOCTLs (SIOCGARP, SIOCDARP, SIOCSARP)
9736  * are by tradition passed in through a datagram socket.  That lands in IP.
9737  * As it happens, this is just as well since the interface is quite crude in
9738  * that it passes in no information about protocol or hardware types, or
9739  * interface association.  After making the protocol assumption, IP is in
9740  * the position to look up the name of the ILL, which ARP will need, and
9741  * format a request that can be handled by ARP.	 The request is passed up
9742  * stream to ARP, and the original IOCTL is completed by IP when ARP passes
9743  * back a response.  ARP supports its own set of more general IOCTLs, in
9744  * case anyone is interested.
9745  */
9746 /* ARGSUSED */
9747 int
9748 ip_sioctl_arp(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9749     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9750 {
9751 	struct arpreq *ar;
9752 	struct sockaddr_in *sin;
9753 	ire_t	*ire;
9754 	boolean_t isv6;
9755 	mblk_t	*mp1;
9756 	int	err;
9757 	conn_t	*connp;
9758 	ill_t	*ill;
9759 
9760 	/* ioctl comes down on an conn */
9761 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9762 	connp = Q_TO_CONN(q);
9763 	isv6 = connp->conn_af_isv6;
9764 	if (isv6)
9765 		return (ENXIO);
9766 
9767 	/* Existance verified in ip_wput_nondata */
9768 	mp1 = mp->b_cont->b_cont;
9769 
9770 	ar = (struct arpreq *)mp1->b_rptr;
9771 	sin = (sin_t *)&ar->arp_pa;
9772 
9773 	/*
9774 	 * We need to let ARP know on which interface the IP
9775 	 * address has an ARP mapping. In the IPMP case, a
9776 	 * simple forwarding table lookup will return the
9777 	 * IRE_IF_RESOLVER for the first interface in the group,
9778 	 * which might not be the interface on which the
9779 	 * requested IP address was resolved due to the ill
9780 	 * selection algorithm (see ip_newroute_get_dst_ill()).
9781 	 * So we do a cache table lookup first: if the IRE cache
9782 	 * entry for the IP address is still there, it will
9783 	 * contain the ill pointer for the right interface, so
9784 	 * we use that. If the cache entry has been flushed, we
9785 	 * fall back to the forwarding table lookup. This should
9786 	 * be rare enough since IRE cache entries have a longer
9787 	 * life expectancy than ARP cache entries.
9788 	 */
9789 	ire = ire_cache_lookup(sin->sin_addr.s_addr, ALL_ZONES, NULL);
9790 	if ((ire == NULL) || (ire->ire_type == IRE_LOOPBACK) ||
9791 	    ((ill = ire_to_ill(ire)) == NULL)) {
9792 		if (ire != NULL)
9793 			ire_refrele(ire);
9794 		ire = ire_ftable_lookup(sin->sin_addr.s_addr,
9795 		    0, 0, IRE_IF_RESOLVER, NULL, NULL, ALL_ZONES, 0,
9796 		    NULL, MATCH_IRE_TYPE);
9797 		if ((ire == NULL) || ((ill = ire_to_ill(ire)) == NULL)) {
9798 			if (ire != NULL)
9799 				ire_refrele(ire);
9800 			return (ENXIO);
9801 		}
9802 	}
9803 	ASSERT(ire != NULL && ill != NULL);
9804 
9805 	err = ip_sioctl_arp_common(ill, q, mp, sin, B_FALSE, B_FALSE);
9806 	ire_refrele(ire);
9807 	return (err);
9808 }
9809 
9810 /*
9811  * Do I_PLINK/I_LINK or I_PUNLINK/I_UNLINK with consistency checks and also
9812  * atomically set/clear the muxids. Also complete the ioctl by acking or
9813  * naking it.  Note that the code is structured such that the link type,
9814  * whether it's persistent or not, is treated equally.  ifconfig(1M) and
9815  * its clones use the persistent link, while pppd(1M) and perhaps many
9816  * other daemons may use non-persistent link.  When combined with some
9817  * ill_t states, linking and unlinking lower streams may be used as
9818  * indicators of dynamic re-plumbing events [see PSARC/1999/348].
9819  */
9820 /* ARGSUSED */
9821 void
9822 ip_sioctl_plink(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
9823 {
9824 	mblk_t *mp1;
9825 	mblk_t *mp2;
9826 	struct linkblk *li;
9827 	queue_t	*ipwq;
9828 	char	*name;
9829 	struct qinit *qinfo;
9830 	struct ipmx_s *ipmxp;
9831 	ill_t	*ill = NULL;
9832 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
9833 	int	err = 0;
9834 	boolean_t	entered_ipsq = B_FALSE;
9835 	boolean_t islink;
9836 	queue_t *dwq = NULL;
9837 
9838 	ASSERT(iocp->ioc_cmd == I_PLINK || iocp->ioc_cmd == I_PUNLINK ||
9839 	    iocp->ioc_cmd == I_LINK || iocp->ioc_cmd == I_UNLINK);
9840 
9841 	islink = (iocp->ioc_cmd == I_PLINK || iocp->ioc_cmd == I_LINK) ?
9842 	    B_TRUE : B_FALSE;
9843 
9844 	mp1 = mp->b_cont;	/* This is the linkblk info */
9845 	li = (struct linkblk *)mp1->b_rptr;
9846 
9847 	/*
9848 	 * ARP has added this special mblk, and the utility is asking us
9849 	 * to perform consistency checks, and also atomically set the
9850 	 * muxid. Ifconfig is an example.  It achieves this by using
9851 	 * /dev/arp as the mux to plink the arp stream, and pushes arp on
9852 	 * to /dev/udp[6] stream for use as the mux when plinking the IP
9853 	 * stream. SIOCSLIFMUXID is not required.  See ifconfig.c, arp.c
9854 	 * and other comments in this routine for more details.
9855 	 */
9856 	mp2 = mp1->b_cont;	/* This is added by ARP */
9857 
9858 	/*
9859 	 * If I_{P}LINK/I_{P}UNLINK is issued by a utility other than
9860 	 * ifconfig which didn't push ARP on top of the dummy mux, we won't
9861 	 * get the special mblk above.  For backward compatibility, we just
9862 	 * return success.  The utility will use SIOCSLIFMUXID to store
9863 	 * the muxids.  This is not atomic, and can leave the streams
9864 	 * unplumbable if the utility is interrrupted, before it does the
9865 	 * SIOCSLIFMUXID.
9866 	 */
9867 	if (mp2 == NULL) {
9868 		/*
9869 		 * At this point we don't know whether or not this is the
9870 		 * IP module stream or the ARP device stream.  We need to
9871 		 * walk the lower stream in order to find this out, since
9872 		 * the capability negotiation is done only on the IP module
9873 		 * stream.  IP module instance is identified by the module
9874 		 * name IP, non-null q_next, and it's wput not being ip_lwput.
9875 		 * STREAMS ensures that the lower stream (l_qbot) will not
9876 		 * vanish until this ioctl completes. So we can safely walk
9877 		 * the stream or refer to the q_ptr.
9878 		 */
9879 		ipwq = li->l_qbot;
9880 		while (ipwq != NULL) {
9881 			qinfo = ipwq->q_qinfo;
9882 			name = qinfo->qi_minfo->mi_idname;
9883 			if (name != NULL && name[0] != NULL &&
9884 			    (strcmp(name, ip_mod_info.mi_idname) == 0) &&
9885 			    ((void *)(qinfo->qi_putp) != (void *)ip_lwput) &&
9886 			    (ipwq->q_next != NULL)) {
9887 				break;
9888 			}
9889 			ipwq = ipwq->q_next;
9890 		}
9891 		/*
9892 		 * This looks like an IP module stream, so trigger
9893 		 * the capability reset or re-negotiation if necessary.
9894 		 */
9895 		if (ipwq != NULL) {
9896 			ill = ipwq->q_ptr;
9897 			ASSERT(ill != NULL);
9898 
9899 			if (ipsq == NULL) {
9900 				ipsq = ipsq_try_enter(NULL, ill, q, mp,
9901 				    ip_sioctl_plink, NEW_OP, B_TRUE);
9902 				if (ipsq == NULL)
9903 					return;
9904 				entered_ipsq = B_TRUE;
9905 			}
9906 			ASSERT(IAM_WRITER_ILL(ill));
9907 			/*
9908 			 * Store the upper read queue of the module
9909 			 * immediately below IP, and count the total
9910 			 * number of lower modules.  Do this only
9911 			 * for I_PLINK or I_LINK event.
9912 			 */
9913 			ill->ill_lmod_rq = NULL;
9914 			ill->ill_lmod_cnt = 0;
9915 			if (islink && (dwq = ipwq->q_next) != NULL) {
9916 				ill->ill_lmod_rq = RD(dwq);
9917 
9918 				while (dwq != NULL) {
9919 					ill->ill_lmod_cnt++;
9920 					dwq = dwq->q_next;
9921 				}
9922 			}
9923 			/*
9924 			 * There's no point in resetting or re-negotiating if
9925 			 * we are not bound to the driver, so only do this if
9926 			 * the DLPI state is idle (up); we assume such state
9927 			 * since ill_ipif_up_count gets incremented in
9928 			 * ipif_up_done(), which is after we are bound to the
9929 			 * driver.  Note that in the case of logical
9930 			 * interfaces, IP won't rebind to the driver unless
9931 			 * the ill_ipif_up_count is 0, meaning that all other
9932 			 * IP interfaces (including the main ipif) are in the
9933 			 * down state.  Because of this, we use such counter
9934 			 * as an indicator, instead of relying on the IPIF_UP
9935 			 * flag, which is per ipif instance.
9936 			 */
9937 			if (ill->ill_ipif_up_count > 0) {
9938 				if (islink)
9939 					ill_capability_probe(ill);
9940 				else
9941 					ill_capability_reset(ill);
9942 			}
9943 		}
9944 		goto done;
9945 	}
9946 
9947 	/*
9948 	 * This is an I_{P}LINK sent down by ifconfig on
9949 	 * /dev/arp. ARP has appended this last (3rd) mblk,
9950 	 * giving more info. STREAMS ensures that the lower
9951 	 * stream (l_qbot) will not vanish until this ioctl
9952 	 * completes. So we can safely walk the stream or refer
9953 	 * to the q_ptr.
9954 	 */
9955 	ipmxp = (struct ipmx_s *)mp2->b_rptr;
9956 	if (ipmxp->ipmx_arpdev_stream) {
9957 		/*
9958 		 * The operation is occuring on the arp-device
9959 		 * stream.
9960 		 */
9961 		ill = ill_lookup_on_name(ipmxp->ipmx_name, B_FALSE, B_FALSE,
9962 		    q, mp, ip_sioctl_plink, &err, NULL);
9963 		if (ill == NULL) {
9964 			if (err == EINPROGRESS) {
9965 				return;
9966 			} else {
9967 				err = EINVAL;
9968 				goto done;
9969 			}
9970 		}
9971 
9972 		if (ipsq == NULL) {
9973 			ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_sioctl_plink,
9974 			    NEW_OP, B_TRUE);
9975 			if (ipsq == NULL) {
9976 				ill_refrele(ill);
9977 				return;
9978 			}
9979 			entered_ipsq = B_TRUE;
9980 		}
9981 		ASSERT(IAM_WRITER_ILL(ill));
9982 		ill_refrele(ill);
9983 		/*
9984 		 * To ensure consistency between IP and ARP,
9985 		 * the following LIFO scheme is used in
9986 		 * plink/punlink. (IP first, ARP last).
9987 		 * This is because the muxid's are stored
9988 		 * in the IP stream on the ill.
9989 		 *
9990 		 * I_{P}LINK: ifconfig plinks the IP stream before
9991 		 * plinking the ARP stream. On an arp-dev
9992 		 * stream, IP checks that it is not yet
9993 		 * plinked, and it also checks that the
9994 		 * corresponding IP stream is already plinked.
9995 		 *
9996 		 * I_{P}UNLINK: ifconfig punlinks the ARP stream
9997 		 * before punlinking the IP stream. IP does
9998 		 * not allow punlink of the IP stream unless
9999 		 * the arp stream has been punlinked.
10000 		 *
10001 		 */
10002 		if ((islink &&
10003 		    (ill->ill_arp_muxid != 0 || ill->ill_ip_muxid == 0)) ||
10004 		    (!islink &&
10005 		    ill->ill_arp_muxid != li->l_index)) {
10006 			err = EINVAL;
10007 			goto done;
10008 		}
10009 		if (islink) {
10010 			ill->ill_arp_muxid = li->l_index;
10011 		} else {
10012 			ill->ill_arp_muxid = 0;
10013 		}
10014 	} else {
10015 		/*
10016 		 * This must be the IP module stream with or
10017 		 * without arp. Walk the stream and locate the
10018 		 * IP module. An IP module instance is
10019 		 * identified by the module name IP, non-null
10020 		 * q_next, and it's wput not being ip_lwput.
10021 		 */
10022 		ipwq = li->l_qbot;
10023 		while (ipwq != NULL) {
10024 			qinfo = ipwq->q_qinfo;
10025 			name = qinfo->qi_minfo->mi_idname;
10026 			if (name != NULL && name[0] != NULL &&
10027 			    (strcmp(name, ip_mod_info.mi_idname) == 0) &&
10028 			    ((void *)(qinfo->qi_putp) != (void *)ip_lwput) &&
10029 			    (ipwq->q_next != NULL)) {
10030 				break;
10031 			}
10032 			ipwq = ipwq->q_next;
10033 		}
10034 		if (ipwq != NULL) {
10035 			ill = ipwq->q_ptr;
10036 			ASSERT(ill != NULL);
10037 
10038 			if (ipsq == NULL) {
10039 				ipsq = ipsq_try_enter(NULL, ill, q, mp,
10040 				    ip_sioctl_plink, NEW_OP, B_TRUE);
10041 				if (ipsq == NULL)
10042 					return;
10043 				entered_ipsq = B_TRUE;
10044 			}
10045 			ASSERT(IAM_WRITER_ILL(ill));
10046 			/*
10047 			 * Return error if the ip_mux_id is
10048 			 * non-zero and command is I_{P}LINK.
10049 			 * If command is I_{P}UNLINK, return
10050 			 * error if the arp-devstr is not
10051 			 * yet punlinked.
10052 			 */
10053 			if ((islink && ill->ill_ip_muxid != 0) ||
10054 			    (!islink && ill->ill_arp_muxid != 0)) {
10055 				err = EINVAL;
10056 				goto done;
10057 			}
10058 			ill->ill_lmod_rq = NULL;
10059 			ill->ill_lmod_cnt = 0;
10060 			if (islink) {
10061 				/*
10062 				 * Store the upper read queue of the module
10063 				 * immediately below IP, and count the total
10064 				 * number of lower modules.
10065 				 */
10066 				if ((dwq = ipwq->q_next) != NULL) {
10067 					ill->ill_lmod_rq = RD(dwq);
10068 
10069 					while (dwq != NULL) {
10070 						ill->ill_lmod_cnt++;
10071 						dwq = dwq->q_next;
10072 					}
10073 				}
10074 				ill->ill_ip_muxid = li->l_index;
10075 			} else {
10076 				ill->ill_ip_muxid = 0;
10077 			}
10078 
10079 			/*
10080 			 * See comments above about resetting/re-
10081 			 * negotiating driver sub-capabilities.
10082 			 */
10083 			if (ill->ill_ipif_up_count > 0) {
10084 				if (islink)
10085 					ill_capability_probe(ill);
10086 				else
10087 					ill_capability_reset(ill);
10088 			}
10089 		}
10090 	}
10091 done:
10092 	iocp->ioc_count = 0;
10093 	iocp->ioc_error = err;
10094 	if (err == 0)
10095 		mp->b_datap->db_type = M_IOCACK;
10096 	else
10097 		mp->b_datap->db_type = M_IOCNAK;
10098 	qreply(q, mp);
10099 
10100 	/* Conn was refheld in ip_sioctl_copyin_setup */
10101 	if (CONN_Q(q))
10102 		CONN_OPER_PENDING_DONE(Q_TO_CONN(q));
10103 	if (entered_ipsq)
10104 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
10105 }
10106 
10107 /*
10108  * Search the ioctl command in the ioctl tables and return a pointer
10109  * to the ioctl command information. The ioctl command tables are
10110  * static and fully populated at compile time.
10111  */
10112 ip_ioctl_cmd_t *
10113 ip_sioctl_lookup(int ioc_cmd)
10114 {
10115 	int index;
10116 	ip_ioctl_cmd_t *ipip;
10117 	ip_ioctl_cmd_t *ipip_end;
10118 
10119 	if (ioc_cmd == IPI_DONTCARE)
10120 		return (NULL);
10121 
10122 	/*
10123 	 * Do a 2 step search. First search the indexed table
10124 	 * based on the least significant byte of the ioctl cmd.
10125 	 * If we don't find a match, then search the misc table
10126 	 * serially.
10127 	 */
10128 	index = ioc_cmd & 0xFF;
10129 	if (index < ip_ndx_ioctl_count) {
10130 		ipip = &ip_ndx_ioctl_table[index];
10131 		if (ipip->ipi_cmd == ioc_cmd) {
10132 			/* Found a match in the ndx table */
10133 			return (ipip);
10134 		}
10135 	}
10136 
10137 	/* Search the misc table */
10138 	ipip_end = &ip_misc_ioctl_table[ip_misc_ioctl_count];
10139 	for (ipip = ip_misc_ioctl_table; ipip < ipip_end; ipip++) {
10140 		if (ipip->ipi_cmd == ioc_cmd)
10141 			/* Found a match in the misc table */
10142 			return (ipip);
10143 	}
10144 
10145 	return (NULL);
10146 }
10147 
10148 /*
10149  * Wrapper function for resuming deferred ioctl processing
10150  * Used for SIOCGDSTINFO, SIOCGIP6ADDRPOLICY, SIOCGMSFILTER,
10151  * SIOCSMSFILTER, SIOCGIPMSFILTER, and SIOCSIPMSFILTER currently.
10152  */
10153 /* ARGSUSED */
10154 void
10155 ip_sioctl_copyin_resume(ipsq_t *dummy_ipsq, queue_t *q, mblk_t *mp,
10156     void *dummy_arg)
10157 {
10158 	ip_sioctl_copyin_setup(q, mp);
10159 }
10160 
10161 /*
10162  * ip_sioctl_copyin_setup is called by ip_wput with any M_IOCTL message
10163  * that arrives.  Most of the IOCTLs are "socket" IOCTLs which we handle
10164  * in either I_STR or TRANSPARENT form, using the mi_copy facility.
10165  * We establish here the size of the block to be copied in.  mi_copyin
10166  * arranges for this to happen, an processing continues in ip_wput with
10167  * an M_IOCDATA message.
10168  */
10169 void
10170 ip_sioctl_copyin_setup(queue_t *q, mblk_t *mp)
10171 {
10172 	int	copyin_size;
10173 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
10174 	ip_ioctl_cmd_t *ipip;
10175 	cred_t *cr;
10176 
10177 	ipip = ip_sioctl_lookup(iocp->ioc_cmd);
10178 	if (ipip == NULL) {
10179 		/*
10180 		 * The ioctl is not one we understand or own.
10181 		 * Pass it along to be processed down stream,
10182 		 * if this is a module instance of IP, else nak
10183 		 * the ioctl.
10184 		 */
10185 		if (q->q_next == NULL) {
10186 			goto nak;
10187 		} else {
10188 			putnext(q, mp);
10189 			return;
10190 		}
10191 	}
10192 
10193 	/*
10194 	 * If this is deferred, then we will do all the checks when we
10195 	 * come back.
10196 	 */
10197 	if ((iocp->ioc_cmd == SIOCGDSTINFO ||
10198 	    iocp->ioc_cmd == SIOCGIP6ADDRPOLICY) && !ip6_asp_can_lookup()) {
10199 		ip6_asp_pending_op(q, mp, ip_sioctl_copyin_resume);
10200 		return;
10201 	}
10202 
10203 	/*
10204 	 * Only allow a very small subset of IP ioctls on this stream if
10205 	 * IP is a module and not a driver. Allowing ioctls to be processed
10206 	 * in this case may cause assert failures or data corruption.
10207 	 * Typically G[L]IFFLAGS, SLIFNAME/IF_UNITSEL are the only few
10208 	 * ioctls allowed on an IP module stream, after which this stream
10209 	 * normally becomes a multiplexor (at which time the stream head
10210 	 * will fail all ioctls).
10211 	 */
10212 	if ((q->q_next != NULL) && !(ipip->ipi_flags & IPI_MODOK)) {
10213 		if (ipip->ipi_flags & IPI_PASS_DOWN) {
10214 			/*
10215 			 * Pass common Streams ioctls which the IP
10216 			 * module does not own or consume along to
10217 			 * be processed down stream.
10218 			 */
10219 			putnext(q, mp);
10220 			return;
10221 		} else {
10222 			goto nak;
10223 		}
10224 	}
10225 
10226 	/* Make sure we have ioctl data to process. */
10227 	if (mp->b_cont == NULL && !(ipip->ipi_flags & IPI_NULL_BCONT))
10228 		goto nak;
10229 
10230 	/*
10231 	 * Prefer dblk credential over ioctl credential; some synthesized
10232 	 * ioctls have kcred set because there's no way to crhold()
10233 	 * a credential in some contexts.  (ioc_cr is not crfree() by
10234 	 * the framework; the caller of ioctl needs to hold the reference
10235 	 * for the duration of the call).
10236 	 */
10237 	cr = DB_CREDDEF(mp, iocp->ioc_cr);
10238 
10239 	/* Make sure normal users don't send down privileged ioctls */
10240 	if ((ipip->ipi_flags & IPI_PRIV) &&
10241 	    (cr != NULL) && secpolicy_net_config(cr, B_TRUE) != 0) {
10242 		/* We checked the privilege earlier but log it here */
10243 		miocnak(q, mp, 0, secpolicy_net_config(cr, B_FALSE));
10244 		return;
10245 	}
10246 
10247 	/*
10248 	 * The ioctl command tables can only encode fixed length
10249 	 * ioctl data. If the length is variable, the table will
10250 	 * encode the length as zero. Such special cases are handled
10251 	 * below in the switch.
10252 	 */
10253 	if (ipip->ipi_copyin_size != 0) {
10254 		mi_copyin(q, mp, NULL, ipip->ipi_copyin_size);
10255 		return;
10256 	}
10257 
10258 	switch (iocp->ioc_cmd) {
10259 	case O_SIOCGIFCONF:
10260 	case SIOCGIFCONF:
10261 		/*
10262 		 * This IOCTL is hilarious.  See comments in
10263 		 * ip_sioctl_get_ifconf for the story.
10264 		 */
10265 		if (iocp->ioc_count == TRANSPARENT)
10266 			copyin_size = SIZEOF_STRUCT(ifconf,
10267 			    iocp->ioc_flag);
10268 		else
10269 			copyin_size = iocp->ioc_count;
10270 		mi_copyin(q, mp, NULL, copyin_size);
10271 		return;
10272 
10273 	case O_SIOCGLIFCONF:
10274 	case SIOCGLIFCONF:
10275 		copyin_size = SIZEOF_STRUCT(lifconf, iocp->ioc_flag);
10276 		mi_copyin(q, mp, NULL, copyin_size);
10277 		return;
10278 
10279 	case SIOCGLIFSRCOF:
10280 		copyin_size = SIZEOF_STRUCT(lifsrcof, iocp->ioc_flag);
10281 		mi_copyin(q, mp, NULL, copyin_size);
10282 		return;
10283 	case SIOCGIP6ADDRPOLICY:
10284 		ip_sioctl_ip6addrpolicy(q, mp);
10285 		ip6_asp_table_refrele();
10286 		return;
10287 
10288 	case SIOCSIP6ADDRPOLICY:
10289 		ip_sioctl_ip6addrpolicy(q, mp);
10290 		return;
10291 
10292 	case SIOCGDSTINFO:
10293 		ip_sioctl_dstinfo(q, mp);
10294 		ip6_asp_table_refrele();
10295 		return;
10296 
10297 	case I_PLINK:
10298 	case I_PUNLINK:
10299 	case I_LINK:
10300 	case I_UNLINK:
10301 		/*
10302 		 * We treat non-persistent link similarly as the persistent
10303 		 * link case, in terms of plumbing/unplumbing, as well as
10304 		 * dynamic re-plumbing events indicator.  See comments
10305 		 * in ip_sioctl_plink() for more.
10306 		 *
10307 		 * Request can be enqueued in the 'ipsq' while waiting
10308 		 * to become exclusive. So bump up the conn ref.
10309 		 */
10310 		if (CONN_Q(q))
10311 			CONN_INC_REF(Q_TO_CONN(q));
10312 		ip_sioctl_plink(NULL, q, mp, NULL);
10313 		return;
10314 
10315 	case ND_GET:
10316 	case ND_SET:
10317 		/*
10318 		 * Use of the nd table requires holding the reader lock.
10319 		 * Modifying the nd table thru nd_load/nd_unload requires
10320 		 * the writer lock.
10321 		 */
10322 		rw_enter(&ip_g_nd_lock, RW_READER);
10323 		if (nd_getset(q, ip_g_nd, mp)) {
10324 			rw_exit(&ip_g_nd_lock);
10325 
10326 			if (iocp->ioc_error)
10327 				iocp->ioc_count = 0;
10328 			mp->b_datap->db_type = M_IOCACK;
10329 			qreply(q, mp);
10330 			return;
10331 		}
10332 		rw_exit(&ip_g_nd_lock);
10333 		/*
10334 		 * We don't understand this subioctl of ND_GET / ND_SET.
10335 		 * Maybe intended for some driver / module below us
10336 		 */
10337 		if (q->q_next) {
10338 			putnext(q, mp);
10339 		} else {
10340 			iocp->ioc_error = ENOENT;
10341 			mp->b_datap->db_type = M_IOCNAK;
10342 			iocp->ioc_count = 0;
10343 			qreply(q, mp);
10344 		}
10345 		return;
10346 
10347 	case IP_IOCTL:
10348 		ip_wput_ioctl(q, mp);
10349 		return;
10350 	default:
10351 		cmn_err(CE_PANIC, "should not happen ");
10352 	}
10353 nak:
10354 	if (mp->b_cont != NULL) {
10355 		freemsg(mp->b_cont);
10356 		mp->b_cont = NULL;
10357 	}
10358 	iocp->ioc_error = EINVAL;
10359 	mp->b_datap->db_type = M_IOCNAK;
10360 	iocp->ioc_count = 0;
10361 	qreply(q, mp);
10362 }
10363 
10364 /* ip_wput hands off ARP IOCTL responses to us */
10365 void
10366 ip_sioctl_iocack(queue_t *q, mblk_t *mp)
10367 {
10368 	struct arpreq *ar;
10369 	struct xarpreq *xar;
10370 	area_t	*area;
10371 	mblk_t	*area_mp;
10372 	struct iocblk *iocp;
10373 	mblk_t	*orig_ioc_mp, *tmp;
10374 	struct iocblk	*orig_iocp;
10375 	ill_t *ill;
10376 	conn_t *connp = NULL;
10377 	uint_t ioc_id;
10378 	mblk_t *pending_mp;
10379 	int x_arp_ioctl = B_FALSE, ifx_arp_ioctl = B_FALSE;
10380 	int *flagsp;
10381 	char *storage = NULL;
10382 	sin_t *sin;
10383 	ipaddr_t addr;
10384 	int err;
10385 
10386 	ill = q->q_ptr;
10387 	ASSERT(ill != NULL);
10388 
10389 	/*
10390 	 * We should get back from ARP a packet chain that looks like:
10391 	 * M_IOCACK-->ARP_op_MBLK-->ORIG_M_IOCTL-->MI_COPY_MBLK-->[X]ARPREQ_MBLK
10392 	 */
10393 	if (!(area_mp = mp->b_cont) ||
10394 	    (area_mp->b_wptr - area_mp->b_rptr) < sizeof (ip_sock_ar_t) ||
10395 	    !(orig_ioc_mp = area_mp->b_cont) ||
10396 	    !orig_ioc_mp->b_cont || !orig_ioc_mp->b_cont->b_cont) {
10397 		freemsg(mp);
10398 		return;
10399 	}
10400 
10401 	orig_iocp = (struct iocblk *)orig_ioc_mp->b_rptr;
10402 
10403 	tmp = (orig_ioc_mp->b_cont)->b_cont;
10404 	if ((orig_iocp->ioc_cmd == SIOCGXARP) ||
10405 	    (orig_iocp->ioc_cmd == SIOCSXARP) ||
10406 	    (orig_iocp->ioc_cmd == SIOCDXARP)) {
10407 		x_arp_ioctl = B_TRUE;
10408 		xar = (struct xarpreq *)tmp->b_rptr;
10409 		sin = (sin_t *)&xar->xarp_pa;
10410 		flagsp = &xar->xarp_flags;
10411 		storage = xar->xarp_ha.sdl_data;
10412 		if (xar->xarp_ha.sdl_nlen != 0)
10413 			ifx_arp_ioctl = B_TRUE;
10414 	} else {
10415 		ar = (struct arpreq *)tmp->b_rptr;
10416 		sin = (sin_t *)&ar->arp_pa;
10417 		flagsp = &ar->arp_flags;
10418 		storage = ar->arp_ha.sa_data;
10419 	}
10420 
10421 	iocp = (struct iocblk *)mp->b_rptr;
10422 
10423 	/*
10424 	 * Pick out the originating queue based on the ioc_id.
10425 	 */
10426 	ioc_id = iocp->ioc_id;
10427 	pending_mp = ill_pending_mp_get(ill, &connp, ioc_id);
10428 	if (pending_mp == NULL) {
10429 		ASSERT(connp == NULL);
10430 		inet_freemsg(mp);
10431 		return;
10432 	}
10433 	ASSERT(connp != NULL);
10434 	q = CONNP_TO_WQ(connp);
10435 
10436 	/* Uncouple the internally generated IOCTL from the original one */
10437 	area = (area_t *)area_mp->b_rptr;
10438 	area_mp->b_cont = NULL;
10439 
10440 	/*
10441 	 * Restore the b_next and b_prev used by mi code. This is needed
10442 	 * to complete the ioctl using mi* functions. We stored them in
10443 	 * the pending mp prior to sending the request to ARP.
10444 	 */
10445 	orig_ioc_mp->b_cont->b_next = pending_mp->b_cont->b_next;
10446 	orig_ioc_mp->b_cont->b_prev = pending_mp->b_cont->b_prev;
10447 	inet_freemsg(pending_mp);
10448 
10449 	/*
10450 	 * We're done if there was an error or if this is not an SIOCG{X}ARP
10451 	 * Catch the case where there is an IRE_CACHE by no entry in the
10452 	 * arp table.
10453 	 */
10454 	addr = sin->sin_addr.s_addr;
10455 	if (iocp->ioc_error && iocp->ioc_cmd == AR_ENTRY_SQUERY) {
10456 		ire_t			*ire;
10457 		dl_unitdata_req_t	*dlup;
10458 		mblk_t			*llmp;
10459 		int			addr_len;
10460 		ill_t			*ipsqill = NULL;
10461 
10462 		if (ifx_arp_ioctl) {
10463 			/*
10464 			 * There's no need to lookup the ill, since
10465 			 * we've already done that when we started
10466 			 * processing the ioctl and sent the message
10467 			 * to ARP on that ill.  So use the ill that
10468 			 * is stored in q->q_ptr.
10469 			 */
10470 			ipsqill = ill;
10471 			ire = ire_ctable_lookup(addr, 0, IRE_CACHE,
10472 			    ipsqill->ill_ipif, ALL_ZONES,
10473 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ILL);
10474 		} else {
10475 			ire = ire_ctable_lookup(addr, 0, IRE_CACHE,
10476 			    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE);
10477 			if (ire != NULL)
10478 				ipsqill = ire_to_ill(ire);
10479 		}
10480 
10481 		if ((x_arp_ioctl) && (ipsqill != NULL))
10482 			storage += ill_xarp_info(&xar->xarp_ha, ipsqill);
10483 
10484 		if (ire != NULL) {
10485 			/*
10486 			 * Since the ire obtained from cachetable is used for
10487 			 * mac addr copying below, treat an incomplete ire as if
10488 			 * as if we never found it.
10489 			 */
10490 			if (ire->ire_nce != NULL &&
10491 			    ire->ire_nce->nce_state != ND_REACHABLE) {
10492 				ire_refrele(ire);
10493 				ire = NULL;
10494 				ipsqill = NULL;
10495 				goto errack;
10496 			}
10497 			*flagsp = ATF_INUSE;
10498 			llmp = (ire->ire_nce != NULL ?
10499 			    ire->ire_nce->nce_res_mp : NULL);
10500 			if (llmp != NULL && ipsqill != NULL) {
10501 				uchar_t *macaddr;
10502 
10503 				addr_len = ipsqill->ill_phys_addr_length;
10504 				if (x_arp_ioctl && ((addr_len +
10505 				    ipsqill->ill_name_length) >
10506 				    sizeof (xar->xarp_ha.sdl_data))) {
10507 					ire_refrele(ire);
10508 					freemsg(mp);
10509 					ip_ioctl_finish(q, orig_ioc_mp,
10510 					    EINVAL, NO_COPYOUT, NULL, NULL);
10511 					return;
10512 				}
10513 				*flagsp |= ATF_COM;
10514 				dlup = (dl_unitdata_req_t *)llmp->b_rptr;
10515 				if (ipsqill->ill_sap_length < 0)
10516 					macaddr = llmp->b_rptr +
10517 					    dlup->dl_dest_addr_offset;
10518 				else
10519 					macaddr = llmp->b_rptr +
10520 					    dlup->dl_dest_addr_offset +
10521 					    ipsqill->ill_sap_length;
10522 				/*
10523 				 * For SIOCGARP, MAC address length
10524 				 * validation has already been done
10525 				 * before the ioctl was issued to ARP to
10526 				 * allow it to progress only on 6 byte
10527 				 * addressable (ethernet like) media. Thus
10528 				 * the mac address copying can not overwrite
10529 				 * the sa_data area below.
10530 				 */
10531 				bcopy(macaddr, storage, addr_len);
10532 			}
10533 			/* Ditch the internal IOCTL. */
10534 			freemsg(mp);
10535 			ire_refrele(ire);
10536 			ip_ioctl_finish(q, orig_ioc_mp, 0, COPYOUT, NULL, NULL);
10537 			return;
10538 		}
10539 	}
10540 
10541 	/*
10542 	 * Delete the coresponding IRE_CACHE if any.
10543 	 * Reset the error if there was one (in case there was no entry
10544 	 * in arp.)
10545 	 */
10546 	if (iocp->ioc_cmd == AR_ENTRY_DELETE) {
10547 		ipif_t *ipintf = NULL;
10548 
10549 		if (ifx_arp_ioctl) {
10550 			/*
10551 			 * There's no need to lookup the ill, since
10552 			 * we've already done that when we started
10553 			 * processing the ioctl and sent the message
10554 			 * to ARP on that ill.  So use the ill that
10555 			 * is stored in q->q_ptr.
10556 			 */
10557 			ipintf = ill->ill_ipif;
10558 		}
10559 		if (ip_ire_clookup_and_delete(addr, ipintf)) {
10560 			/*
10561 			 * The address in "addr" may be an entry for a
10562 			 * router. If that's true, then any off-net
10563 			 * IRE_CACHE entries that go through the router
10564 			 * with address "addr" must be clobbered. Use
10565 			 * ire_walk to achieve this goal.
10566 			 */
10567 			if (ifx_arp_ioctl)
10568 				ire_walk_ill_v4(MATCH_IRE_ILL, 0,
10569 				    ire_delete_cache_gw, (char *)&addr, ill);
10570 			else
10571 				ire_walk_v4(ire_delete_cache_gw, (char *)&addr,
10572 				    ALL_ZONES);
10573 			iocp->ioc_error = 0;
10574 		}
10575 	}
10576 errack:
10577 	if (iocp->ioc_error || iocp->ioc_cmd != AR_ENTRY_SQUERY) {
10578 		err = iocp->ioc_error;
10579 		freemsg(mp);
10580 		ip_ioctl_finish(q, orig_ioc_mp, err, NO_COPYOUT, NULL, NULL);
10581 		return;
10582 	}
10583 
10584 	/*
10585 	 * Completion of an SIOCG{X}ARP.  Translate the information from
10586 	 * the area_t into the struct {x}arpreq.
10587 	 */
10588 	if (x_arp_ioctl) {
10589 		storage += ill_xarp_info(&xar->xarp_ha, ill);
10590 		if ((ill->ill_phys_addr_length + ill->ill_name_length) >
10591 		    sizeof (xar->xarp_ha.sdl_data)) {
10592 			freemsg(mp);
10593 			ip_ioctl_finish(q, orig_ioc_mp, EINVAL,
10594 			    NO_COPYOUT, NULL, NULL);
10595 			return;
10596 		}
10597 	}
10598 	*flagsp = ATF_INUSE;
10599 	if (area->area_flags & ACE_F_PERMANENT)
10600 		*flagsp |= ATF_PERM;
10601 	if (area->area_flags & ACE_F_PUBLISH)
10602 		*flagsp |= ATF_PUBL;
10603 	if (area->area_flags & ACE_F_AUTHORITY)
10604 		*flagsp |= ATF_AUTHORITY;
10605 	if (area->area_hw_addr_length != 0) {
10606 		*flagsp |= ATF_COM;
10607 		/*
10608 		 * For SIOCGARP, MAC address length validation has
10609 		 * already been done before the ioctl was issued to ARP
10610 		 * to allow it to progress only on 6 byte addressable
10611 		 * (ethernet like) media. Thus the mac address copying
10612 		 * can not overwrite the sa_data area below.
10613 		 */
10614 		bcopy((char *)area + area->area_hw_addr_offset,
10615 		    storage, area->area_hw_addr_length);
10616 	}
10617 
10618 	/* Ditch the internal IOCTL. */
10619 	freemsg(mp);
10620 	/* Complete the original. */
10621 	ip_ioctl_finish(q, orig_ioc_mp, 0, COPYOUT, NULL, NULL);
10622 }
10623 
10624 /*
10625  * Create a new logical interface. If ipif_id is zero (i.e. not a logical
10626  * interface) create the next available logical interface for this
10627  * physical interface.
10628  * If ipif is NULL (i.e. the lookup didn't find one) attempt to create an
10629  * ipif with the specified name.
10630  *
10631  * If the address family is not AF_UNSPEC then set the address as well.
10632  *
10633  * If ip_sioctl_addr returns EINPROGRESS then the ioctl (the copyout)
10634  * is completed when the DL_BIND_ACK arrive in ip_rput_dlpi_writer.
10635  *
10636  * Executed as a writer on the ill or ill group.
10637  * So no lock is needed to traverse the ipif chain, or examine the
10638  * phyint flags.
10639  */
10640 /* ARGSUSED */
10641 int
10642 ip_sioctl_addif(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
10643     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
10644 {
10645 	mblk_t	*mp1;
10646 	struct lifreq *lifr;
10647 	boolean_t	isv6;
10648 	boolean_t	exists;
10649 	char 	*name;
10650 	char	*endp;
10651 	char	*cp;
10652 	int	namelen;
10653 	ipif_t	*ipif;
10654 	long	id;
10655 	ipsq_t	*ipsq;
10656 	ill_t	*ill;
10657 	sin_t	*sin;
10658 	int	err = 0;
10659 	boolean_t found_sep = B_FALSE;
10660 	conn_t	*connp;
10661 	zoneid_t zoneid;
10662 	int	orig_ifindex = 0;
10663 
10664 	ip1dbg(("ip_sioctl_addif\n"));
10665 	/* Existence of mp1 has been checked in ip_wput_nondata */
10666 	mp1 = mp->b_cont->b_cont;
10667 	/*
10668 	 * Null terminate the string to protect against buffer
10669 	 * overrun. String was generated by user code and may not
10670 	 * be trusted.
10671 	 */
10672 	lifr = (struct lifreq *)mp1->b_rptr;
10673 	lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
10674 	name = lifr->lifr_name;
10675 	ASSERT(CONN_Q(q));
10676 	connp = Q_TO_CONN(q);
10677 	isv6 = connp->conn_af_isv6;
10678 	zoneid = connp->conn_zoneid;
10679 	namelen = mi_strlen(name);
10680 	if (namelen == 0)
10681 		return (EINVAL);
10682 
10683 	exists = B_FALSE;
10684 	if ((namelen + 1 == sizeof (ipif_loopback_name)) &&
10685 	    (mi_strcmp(name, ipif_loopback_name) == 0)) {
10686 		/*
10687 		 * Allow creating lo0 using SIOCLIFADDIF.
10688 		 * can't be any other writer thread. So can pass null below
10689 		 * for the last 4 args to ipif_lookup_name.
10690 		 */
10691 		ipif = ipif_lookup_on_name(lifr->lifr_name, namelen,
10692 		    B_TRUE, &exists, isv6, zoneid, NULL, NULL, NULL, NULL);
10693 		/* Prevent any further action */
10694 		if (ipif == NULL) {
10695 			return (ENOBUFS);
10696 		} else if (!exists) {
10697 			/* We created the ipif now and as writer */
10698 			ipif_refrele(ipif);
10699 			return (0);
10700 		} else {
10701 			ill = ipif->ipif_ill;
10702 			ill_refhold(ill);
10703 			ipif_refrele(ipif);
10704 		}
10705 	} else {
10706 		/* Look for a colon in the name. */
10707 		endp = &name[namelen];
10708 		for (cp = endp; --cp > name; ) {
10709 			if (*cp == IPIF_SEPARATOR_CHAR) {
10710 				found_sep = B_TRUE;
10711 				/*
10712 				 * Reject any non-decimal aliases for plumbing
10713 				 * of logical interfaces. Aliases with leading
10714 				 * zeroes are also rejected as they introduce
10715 				 * ambiguity in the naming of the interfaces.
10716 				 * Comparing with "0" takes care of all such
10717 				 * cases.
10718 				 */
10719 				if ((strncmp("0", cp+1, 1)) == 0)
10720 					return (EINVAL);
10721 
10722 				if (ddi_strtol(cp+1, &endp, 10, &id) != 0 ||
10723 				    id <= 0 || *endp != '\0') {
10724 					return (EINVAL);
10725 				}
10726 				*cp = '\0';
10727 				break;
10728 			}
10729 		}
10730 		ill = ill_lookup_on_name(name, B_FALSE, isv6,
10731 		    CONNP_TO_WQ(connp), mp, ip_process_ioctl, &err, NULL);
10732 		if (found_sep)
10733 			*cp = IPIF_SEPARATOR_CHAR;
10734 		if (ill == NULL)
10735 			return (err);
10736 	}
10737 
10738 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_process_ioctl, NEW_OP,
10739 	    B_TRUE);
10740 
10741 	/*
10742 	 * Release the refhold due to the lookup, now that we are excl
10743 	 * or we are just returning
10744 	 */
10745 	ill_refrele(ill);
10746 
10747 	if (ipsq == NULL)
10748 		return (EINPROGRESS);
10749 
10750 	/*
10751 	 * If the interface is failed, inactive or offlined, look for a working
10752 	 * interface in the ill group and create the ipif there. If we can't
10753 	 * find a good interface, create the ipif anyway so that in.mpathd can
10754 	 * move it to the first repaired interface.
10755 	 */
10756 	if ((ill->ill_phyint->phyint_flags &
10757 	    (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) &&
10758 	    ill->ill_phyint->phyint_groupname_len != 0) {
10759 		phyint_t *phyi;
10760 		char *groupname = ill->ill_phyint->phyint_groupname;
10761 
10762 		/*
10763 		 * We're looking for a working interface, but it doesn't matter
10764 		 * if it's up or down; so instead of following the group lists,
10765 		 * we look at each physical interface and compare the groupname.
10766 		 * We're only interested in interfaces with IPv4 (resp. IPv6)
10767 		 * plumbed when we're adding an IPv4 (resp. IPv6) ipif.
10768 		 * Otherwise we create the ipif on the failed interface.
10769 		 */
10770 		rw_enter(&ill_g_lock, RW_READER);
10771 		phyi = avl_first(&phyint_g_list.phyint_list_avl_by_index);
10772 		for (; phyi != NULL;
10773 		    phyi = avl_walk(&phyint_g_list.phyint_list_avl_by_index,
10774 		    phyi, AVL_AFTER)) {
10775 			if (phyi->phyint_groupname_len == 0)
10776 				continue;
10777 			ASSERT(phyi->phyint_groupname != NULL);
10778 			if (mi_strcmp(groupname, phyi->phyint_groupname) == 0 &&
10779 			    !(phyi->phyint_flags &
10780 			    (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) &&
10781 			    (ill->ill_isv6 ? (phyi->phyint_illv6 != NULL) :
10782 			    (phyi->phyint_illv4 != NULL))) {
10783 				break;
10784 			}
10785 		}
10786 		rw_exit(&ill_g_lock);
10787 
10788 		if (phyi != NULL) {
10789 			orig_ifindex = ill->ill_phyint->phyint_ifindex;
10790 			ill = (ill->ill_isv6 ? phyi->phyint_illv6 :
10791 			    phyi->phyint_illv4);
10792 		}
10793 	}
10794 
10795 	/*
10796 	 * We are now exclusive on the ipsq, so an ill move will be serialized
10797 	 * before or after us.
10798 	 */
10799 	ASSERT(IAM_WRITER_ILL(ill));
10800 	ASSERT(ill->ill_move_in_progress == B_FALSE);
10801 
10802 	if (found_sep && orig_ifindex == 0) {
10803 		/* Now see if there is an IPIF with this unit number. */
10804 		for (ipif = ill->ill_ipif; ipif != NULL;
10805 		    ipif = ipif->ipif_next) {
10806 			if (ipif->ipif_id == id) {
10807 				err = EEXIST;
10808 				goto done;
10809 			}
10810 		}
10811 	}
10812 
10813 	/*
10814 	 * We use IRE_LOCAL for lo0:1 etc. for "receive only" use
10815 	 * of lo0. We never come here when we plumb lo0:0. It
10816 	 * happens in ipif_lookup_on_name.
10817 	 * The specified unit number is ignored when we create the ipif on a
10818 	 * different interface. However, we save it in ipif_orig_ipifid below so
10819 	 * that the ipif fails back to the right position.
10820 	 */
10821 	if ((ipif = ipif_allocate(ill, (found_sep && orig_ifindex == 0) ?
10822 	    id : -1, IRE_LOCAL, B_TRUE)) == NULL) {
10823 		err = ENOBUFS;
10824 		goto done;
10825 	}
10826 
10827 	/* Return created name with ioctl */
10828 	(void) sprintf(lifr->lifr_name, "%s%c%d", ill->ill_name,
10829 	    IPIF_SEPARATOR_CHAR, ipif->ipif_id);
10830 	ip1dbg(("created %s\n", lifr->lifr_name));
10831 
10832 	/* Set address */
10833 	sin = (sin_t *)&lifr->lifr_addr;
10834 	if (sin->sin_family != AF_UNSPEC) {
10835 		err = ip_sioctl_addr(ipif, sin, q, mp,
10836 		    &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], lifr);
10837 	}
10838 
10839 	/* Set ifindex and unit number for failback */
10840 	if (err == 0 && orig_ifindex != 0) {
10841 		ipif->ipif_orig_ifindex = orig_ifindex;
10842 		if (found_sep) {
10843 			ipif->ipif_orig_ipifid = id;
10844 		}
10845 	}
10846 
10847 done:
10848 	ipsq_exit(ipsq, B_TRUE, B_TRUE);
10849 	return (err);
10850 }
10851 
10852 /*
10853  * Remove an existing logical interface. If ipif_id is zero (i.e. not a logical
10854  * interface) delete it based on the IP address (on this physical interface).
10855  * Otherwise delete it based on the ipif_id.
10856  * Also, special handling to allow a removeif of lo0.
10857  */
10858 /* ARGSUSED */
10859 int
10860 ip_sioctl_removeif(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10861     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
10862 {
10863 	conn_t		*connp;
10864 	ill_t		*ill = ipif->ipif_ill;
10865 	boolean_t	 success;
10866 
10867 	ip1dbg(("ip_sioctl_remove_if(%s:%u %p)\n",
10868 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10869 	ASSERT(IAM_WRITER_IPIF(ipif));
10870 
10871 	connp = Q_TO_CONN(q);
10872 	/*
10873 	 * Special case for unplumbing lo0 (the loopback physical interface).
10874 	 * If unplumbing lo0, the incoming address structure has been
10875 	 * initialized to all zeros. When unplumbing lo0, all its logical
10876 	 * interfaces must be removed too.
10877 	 *
10878 	 * Note that this interface may be called to remove a specific
10879 	 * loopback logical interface (eg, lo0:1). But in that case
10880 	 * ipif->ipif_id != 0 so that the code path for that case is the
10881 	 * same as any other interface (meaning it skips the code directly
10882 	 * below).
10883 	 */
10884 	if (ipif->ipif_id == 0 && ipif->ipif_net_type == IRE_LOOPBACK) {
10885 		if (sin->sin_family == AF_UNSPEC &&
10886 		    (IN6_IS_ADDR_UNSPECIFIED(&((sin6_t *)sin)->sin6_addr))) {
10887 			/*
10888 			 * Mark it condemned. No new ref. will be made to ill.
10889 			 */
10890 			mutex_enter(&ill->ill_lock);
10891 			ill->ill_state_flags |= ILL_CONDEMNED;
10892 			for (ipif = ill->ill_ipif; ipif != NULL;
10893 			    ipif = ipif->ipif_next) {
10894 				ipif->ipif_state_flags |= IPIF_CONDEMNED;
10895 			}
10896 			mutex_exit(&ill->ill_lock);
10897 
10898 			ipif = ill->ill_ipif;
10899 			/* unplumb the loopback interface */
10900 			ill_delete(ill);
10901 			mutex_enter(&connp->conn_lock);
10902 			mutex_enter(&ill->ill_lock);
10903 			ASSERT(ill->ill_group == NULL);
10904 
10905 			/* Are any references to this ill active */
10906 			if (ill_is_quiescent(ill)) {
10907 				mutex_exit(&ill->ill_lock);
10908 				mutex_exit(&connp->conn_lock);
10909 				ill_delete_tail(ill);
10910 				mi_free(ill);
10911 				return (0);
10912 			}
10913 			success = ipsq_pending_mp_add(connp, ipif,
10914 			    CONNP_TO_WQ(connp), mp, ILL_FREE);
10915 			mutex_exit(&connp->conn_lock);
10916 			mutex_exit(&ill->ill_lock);
10917 			if (success)
10918 				return (EINPROGRESS);
10919 			else
10920 				return (EINTR);
10921 		}
10922 	}
10923 
10924 	/*
10925 	 * We are exclusive on the ipsq, so an ill move will be serialized
10926 	 * before or after us.
10927 	 */
10928 	ASSERT(ill->ill_move_in_progress == B_FALSE);
10929 
10930 	if (ipif->ipif_id == 0) {
10931 		/* Find based on address */
10932 		if (ipif->ipif_isv6) {
10933 			sin6_t *sin6;
10934 
10935 			if (sin->sin_family != AF_INET6)
10936 				return (EAFNOSUPPORT);
10937 
10938 			sin6 = (sin6_t *)sin;
10939 			/* We are a writer, so we should be able to lookup */
10940 			ipif = ipif_lookup_addr_v6(&sin6->sin6_addr,
10941 			    ill, ALL_ZONES, NULL, NULL, NULL, NULL);
10942 			if (ipif == NULL) {
10943 				/*
10944 				 * Maybe the address in on another interface in
10945 				 * the same IPMP group? We check this below.
10946 				 */
10947 				ipif = ipif_lookup_addr_v6(&sin6->sin6_addr,
10948 				    NULL, ALL_ZONES, NULL, NULL, NULL, NULL);
10949 			}
10950 		} else {
10951 			ipaddr_t addr;
10952 
10953 			if (sin->sin_family != AF_INET)
10954 				return (EAFNOSUPPORT);
10955 
10956 			addr = sin->sin_addr.s_addr;
10957 			/* We are a writer, so we should be able to lookup */
10958 			ipif = ipif_lookup_addr(addr, ill, ALL_ZONES, NULL,
10959 			    NULL, NULL, NULL);
10960 			if (ipif == NULL) {
10961 				/*
10962 				 * Maybe the address in on another interface in
10963 				 * the same IPMP group? We check this below.
10964 				 */
10965 				ipif = ipif_lookup_addr(addr, NULL, ALL_ZONES,
10966 				    NULL, NULL, NULL, NULL);
10967 			}
10968 		}
10969 		if (ipif == NULL) {
10970 			return (EADDRNOTAVAIL);
10971 		}
10972 		/*
10973 		 * When the address to be removed is hosted on a different
10974 		 * interface, we check if the interface is in the same IPMP
10975 		 * group as the specified one; if so we proceed with the
10976 		 * removal.
10977 		 * ill->ill_group is NULL when the ill is down, so we have to
10978 		 * compare the group names instead.
10979 		 */
10980 		if (ipif->ipif_ill != ill &&
10981 		    (ipif->ipif_ill->ill_phyint->phyint_groupname_len == 0 ||
10982 		    ill->ill_phyint->phyint_groupname_len == 0 ||
10983 		    mi_strcmp(ipif->ipif_ill->ill_phyint->phyint_groupname,
10984 		    ill->ill_phyint->phyint_groupname) != 0)) {
10985 			ipif_refrele(ipif);
10986 			return (EADDRNOTAVAIL);
10987 		}
10988 
10989 		/* This is a writer */
10990 		ipif_refrele(ipif);
10991 	}
10992 
10993 	/*
10994 	 * Can not delete instance zero since it is tied to the ill.
10995 	 */
10996 	if (ipif->ipif_id == 0)
10997 		return (EBUSY);
10998 
10999 	mutex_enter(&ill->ill_lock);
11000 	ipif->ipif_state_flags |= IPIF_CONDEMNED;
11001 	mutex_exit(&ill->ill_lock);
11002 
11003 	ipif_free(ipif);
11004 
11005 	mutex_enter(&connp->conn_lock);
11006 	mutex_enter(&ill->ill_lock);
11007 
11008 	/* Are any references to this ipif active */
11009 	if (ipif->ipif_refcnt == 0 && ipif->ipif_ire_cnt == 0) {
11010 		mutex_exit(&ill->ill_lock);
11011 		mutex_exit(&connp->conn_lock);
11012 		ipif_non_duplicate(ipif);
11013 		ipif_down_tail(ipif);
11014 		ipif_free_tail(ipif);
11015 		return (0);
11016 	}
11017 	success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp), mp,
11018 	    IPIF_FREE);
11019 	mutex_exit(&ill->ill_lock);
11020 	mutex_exit(&connp->conn_lock);
11021 	if (success)
11022 		return (EINPROGRESS);
11023 	else
11024 		return (EINTR);
11025 }
11026 
11027 /*
11028  * Restart the removeif ioctl. The refcnt has gone down to 0.
11029  * The ipif is already condemned. So can't find it thru lookups.
11030  */
11031 /* ARGSUSED */
11032 int
11033 ip_sioctl_removeif_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
11034     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_if_req)
11035 {
11036 	ill_t *ill;
11037 
11038 	ip1dbg(("ip_sioctl_removeif_restart(%s:%u %p)\n",
11039 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11040 	if (ipif->ipif_id == 0 && ipif->ipif_net_type == IRE_LOOPBACK) {
11041 		ill = ipif->ipif_ill;
11042 		ASSERT(IAM_WRITER_ILL(ill));
11043 		ASSERT((ipif->ipif_state_flags & IPIF_CONDEMNED) &&
11044 		    (ill->ill_state_flags & IPIF_CONDEMNED));
11045 		ill_delete_tail(ill);
11046 		mi_free(ill);
11047 		return (0);
11048 	}
11049 
11050 	ill = ipif->ipif_ill;
11051 	ASSERT(IAM_WRITER_IPIF(ipif));
11052 	ASSERT(ipif->ipif_state_flags & IPIF_CONDEMNED);
11053 
11054 	ipif_non_duplicate(ipif);
11055 	ipif_down_tail(ipif);
11056 	ipif_free_tail(ipif);
11057 
11058 	ILL_UNMARK_CHANGING(ill);
11059 	return (0);
11060 }
11061 
11062 /*
11063  * Set the local interface address.
11064  * Allow an address of all zero when the interface is down.
11065  */
11066 /* ARGSUSED */
11067 int
11068 ip_sioctl_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11069     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
11070 {
11071 	int err = 0;
11072 	in6_addr_t v6addr;
11073 	boolean_t need_up = B_FALSE;
11074 
11075 	ip1dbg(("ip_sioctl_addr(%s:%u %p)\n",
11076 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11077 
11078 	ASSERT(IAM_WRITER_IPIF(ipif));
11079 
11080 	if (ipif->ipif_isv6) {
11081 		sin6_t *sin6;
11082 		ill_t *ill;
11083 		phyint_t *phyi;
11084 
11085 		if (sin->sin_family != AF_INET6)
11086 			return (EAFNOSUPPORT);
11087 
11088 		sin6 = (sin6_t *)sin;
11089 		v6addr = sin6->sin6_addr;
11090 		ill = ipif->ipif_ill;
11091 		phyi = ill->ill_phyint;
11092 
11093 		/*
11094 		 * Enforce that true multicast interfaces have a link-local
11095 		 * address for logical unit 0.
11096 		 */
11097 		if (ipif->ipif_id == 0 &&
11098 		    (ill->ill_flags & ILLF_MULTICAST) &&
11099 		    !(ipif->ipif_flags & (IPIF_POINTOPOINT)) &&
11100 		    !(phyi->phyint_flags & (PHYI_LOOPBACK)) &&
11101 		    !IN6_IS_ADDR_LINKLOCAL(&v6addr)) {
11102 			return (EADDRNOTAVAIL);
11103 		}
11104 
11105 		/*
11106 		 * up interfaces shouldn't have the unspecified address
11107 		 * unless they also have the IPIF_NOLOCAL flags set and
11108 		 * have a subnet assigned.
11109 		 */
11110 		if ((ipif->ipif_flags & IPIF_UP) &&
11111 		    IN6_IS_ADDR_UNSPECIFIED(&v6addr) &&
11112 		    (!(ipif->ipif_flags & IPIF_NOLOCAL) ||
11113 		    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) {
11114 			return (EADDRNOTAVAIL);
11115 		}
11116 
11117 		if (!ip_local_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
11118 			return (EADDRNOTAVAIL);
11119 	} else {
11120 		ipaddr_t addr;
11121 
11122 		if (sin->sin_family != AF_INET)
11123 			return (EAFNOSUPPORT);
11124 
11125 		addr = sin->sin_addr.s_addr;
11126 
11127 		/* Allow 0 as the local address. */
11128 		if (addr != 0 && !ip_addr_ok_v4(addr, ipif->ipif_net_mask))
11129 			return (EADDRNOTAVAIL);
11130 
11131 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11132 	}
11133 
11134 
11135 	/*
11136 	 * Even if there is no change we redo things just to rerun
11137 	 * ipif_set_default.
11138 	 */
11139 	if (ipif->ipif_flags & IPIF_UP) {
11140 		/*
11141 		 * Setting a new local address, make sure
11142 		 * we have net and subnet bcast ire's for
11143 		 * the old address if we need them.
11144 		 */
11145 		if (!ipif->ipif_isv6)
11146 			ipif_check_bcast_ires(ipif);
11147 		/*
11148 		 * If the interface is already marked up,
11149 		 * we call ipif_down which will take care
11150 		 * of ditching any IREs that have been set
11151 		 * up based on the old interface address.
11152 		 */
11153 		err = ipif_logical_down(ipif, q, mp);
11154 		if (err == EINPROGRESS)
11155 			return (err);
11156 		ipif_down_tail(ipif);
11157 		need_up = 1;
11158 	}
11159 
11160 	err = ip_sioctl_addr_tail(ipif, sin, q, mp, need_up);
11161 	return (err);
11162 }
11163 
11164 int
11165 ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11166     boolean_t need_up)
11167 {
11168 	in6_addr_t v6addr;
11169 	ipaddr_t addr;
11170 	sin6_t	*sin6;
11171 	int	sinlen;
11172 	int	err = 0;
11173 	ill_t	*ill = ipif->ipif_ill;
11174 	boolean_t need_dl_down;
11175 	boolean_t need_arp_down;
11176 	struct iocblk *iocp;
11177 
11178 	iocp = (mp != NULL) ? (struct iocblk *)mp->b_rptr : NULL;
11179 
11180 	ip1dbg(("ip_sioctl_addr_tail(%s:%u %p)\n",
11181 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
11182 	ASSERT(IAM_WRITER_IPIF(ipif));
11183 
11184 	/* Must cancel any pending timer before taking the ill_lock */
11185 	if (ipif->ipif_recovery_id != 0)
11186 		(void) untimeout(ipif->ipif_recovery_id);
11187 	ipif->ipif_recovery_id = 0;
11188 
11189 	if (ipif->ipif_isv6) {
11190 		sin6 = (sin6_t *)sin;
11191 		v6addr = sin6->sin6_addr;
11192 		sinlen = sizeof (struct sockaddr_in6);
11193 	} else {
11194 		addr = sin->sin_addr.s_addr;
11195 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11196 		sinlen = sizeof (struct sockaddr_in);
11197 	}
11198 	mutex_enter(&ill->ill_lock);
11199 	ipif->ipif_v6lcl_addr = v6addr;
11200 	if (ipif->ipif_flags & (IPIF_ANYCAST | IPIF_NOLOCAL)) {
11201 		ipif->ipif_v6src_addr = ipv6_all_zeros;
11202 	} else {
11203 		ipif->ipif_v6src_addr = v6addr;
11204 	}
11205 	ipif->ipif_addr_ready = 0;
11206 
11207 	/*
11208 	 * If the interface was previously marked as a duplicate, then since
11209 	 * we've now got a "new" address, it should no longer be considered a
11210 	 * duplicate -- even if the "new" address is the same as the old one.
11211 	 * Note that if all ipifs are down, we may have a pending ARP down
11212 	 * event to handle.  This is because we want to recover from duplicates
11213 	 * and thus delay tearing down ARP until the duplicates have been
11214 	 * removed or disabled.
11215 	 */
11216 	need_dl_down = need_arp_down = B_FALSE;
11217 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
11218 		need_arp_down = !need_up;
11219 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
11220 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
11221 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
11222 			need_dl_down = B_TRUE;
11223 		}
11224 	}
11225 
11226 	if (ipif->ipif_isv6 && IN6_IS_ADDR_6TO4(&v6addr) &&
11227 	    !ill->ill_is_6to4tun) {
11228 		queue_t *wqp = ill->ill_wq;
11229 
11230 		/*
11231 		 * The local address of this interface is a 6to4 address,
11232 		 * check if this interface is in fact a 6to4 tunnel or just
11233 		 * an interface configured with a 6to4 address.  We are only
11234 		 * interested in the former.
11235 		 */
11236 		if (wqp != NULL) {
11237 			while ((wqp->q_next != NULL) &&
11238 			    (wqp->q_next->q_qinfo != NULL) &&
11239 			    (wqp->q_next->q_qinfo->qi_minfo != NULL)) {
11240 
11241 				if (wqp->q_next->q_qinfo->qi_minfo->mi_idnum
11242 				    == TUN6TO4_MODID) {
11243 					/* set for use in IP */
11244 					ill->ill_is_6to4tun = 1;
11245 					break;
11246 				}
11247 				wqp = wqp->q_next;
11248 			}
11249 		}
11250 	}
11251 
11252 	ipif_set_default(ipif);
11253 
11254 	/*
11255 	 * When publishing an interface address change event, we only notify
11256 	 * the event listeners of the new address.  It is assumed that if they
11257 	 * actively care about the addresses assigned that they will have
11258 	 * already discovered the previous address assigned (if there was one.)
11259 	 *
11260 	 * Don't attach nic event message for SIOCLIFADDIF ioctl.
11261 	 */
11262 	if (iocp != NULL && iocp->ioc_cmd != SIOCLIFADDIF) {
11263 		hook_nic_event_t *info;
11264 		if ((info = ipif->ipif_ill->ill_nic_event_info) != NULL) {
11265 			ip2dbg(("ip_sioctl_addr_tail: unexpected nic event %d "
11266 			    "attached for %s\n", info->hne_event,
11267 			    ill->ill_name));
11268 			if (info->hne_data != NULL)
11269 				kmem_free(info->hne_data, info->hne_datalen);
11270 			kmem_free(info, sizeof (hook_nic_event_t));
11271 		}
11272 
11273 		info = kmem_alloc(sizeof (hook_nic_event_t), KM_NOSLEEP);
11274 		if (info != NULL) {
11275 			info->hne_nic =
11276 			    ipif->ipif_ill->ill_phyint->phyint_ifindex;
11277 			info->hne_lif = MAP_IPIF_ID(ipif->ipif_id);
11278 			info->hne_event = NE_ADDRESS_CHANGE;
11279 			info->hne_family = ipif->ipif_isv6 ? ipv6 : ipv4;
11280 			info->hne_data = kmem_alloc(sinlen, KM_NOSLEEP);
11281 			if (info->hne_data != NULL) {
11282 				info->hne_datalen = sinlen;
11283 				bcopy(sin, info->hne_data, sinlen);
11284 			} else {
11285 				ip2dbg(("ip_sioctl_addr_tail: could not attach "
11286 				    "address information for ADDRESS_CHANGE nic"
11287 				    " event of %s (ENOMEM)\n",
11288 				    ipif->ipif_ill->ill_name));
11289 				kmem_free(info, sizeof (hook_nic_event_t));
11290 			}
11291 		} else
11292 			ip2dbg(("ip_sioctl_addr_tail: could not attach "
11293 			    "ADDRESS_CHANGE nic event information for %s "
11294 			    "(ENOMEM)\n", ipif->ipif_ill->ill_name));
11295 
11296 		ipif->ipif_ill->ill_nic_event_info = info;
11297 	}
11298 
11299 	mutex_exit(&ipif->ipif_ill->ill_lock);
11300 
11301 	if (need_up) {
11302 		/*
11303 		 * Now bring the interface back up.  If this
11304 		 * is the only IPIF for the ILL, ipif_up
11305 		 * will have to re-bind to the device, so
11306 		 * we may get back EINPROGRESS, in which
11307 		 * case, this IOCTL will get completed in
11308 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11309 		 */
11310 		err = ipif_up(ipif, q, mp);
11311 	} else {
11312 		/*
11313 		 * Update the IPIF list in SCTP, ipif_up_done() will do it
11314 		 * if need_up is true.
11315 		 */
11316 		sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
11317 	}
11318 
11319 	if (need_dl_down)
11320 		ill_dl_down(ill);
11321 	if (need_arp_down)
11322 		ipif_arp_down(ipif);
11323 
11324 	return (err);
11325 }
11326 
11327 
11328 /*
11329  * Restart entry point to restart the address set operation after the
11330  * refcounts have dropped to zero.
11331  */
11332 /* ARGSUSED */
11333 int
11334 ip_sioctl_addr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11335     ip_ioctl_cmd_t *ipip, void *ifreq)
11336 {
11337 	ip1dbg(("ip_sioctl_addr_restart(%s:%u %p)\n",
11338 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11339 	ASSERT(IAM_WRITER_IPIF(ipif));
11340 	ipif_down_tail(ipif);
11341 	return (ip_sioctl_addr_tail(ipif, sin, q, mp, B_TRUE));
11342 }
11343 
11344 /* ARGSUSED */
11345 int
11346 ip_sioctl_get_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11347     ip_ioctl_cmd_t *ipip, void *if_req)
11348 {
11349 	sin6_t *sin6 = (struct sockaddr_in6 *)sin;
11350 	struct lifreq *lifr = (struct lifreq *)if_req;
11351 
11352 	ip1dbg(("ip_sioctl_get_addr(%s:%u %p)\n",
11353 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11354 	/*
11355 	 * The net mask and address can't change since we have a
11356 	 * reference to the ipif. So no lock is necessary.
11357 	 */
11358 	if (ipif->ipif_isv6) {
11359 		*sin6 = sin6_null;
11360 		sin6->sin6_family = AF_INET6;
11361 		sin6->sin6_addr = ipif->ipif_v6lcl_addr;
11362 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11363 		lifr->lifr_addrlen =
11364 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
11365 	} else {
11366 		*sin = sin_null;
11367 		sin->sin_family = AF_INET;
11368 		sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
11369 		if (ipip->ipi_cmd_type == LIF_CMD) {
11370 			lifr->lifr_addrlen =
11371 			    ip_mask_to_plen(ipif->ipif_net_mask);
11372 		}
11373 	}
11374 	return (0);
11375 }
11376 
11377 /*
11378  * Set the destination address for a pt-pt interface.
11379  */
11380 /* ARGSUSED */
11381 int
11382 ip_sioctl_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11383     ip_ioctl_cmd_t *ipip, void *if_req)
11384 {
11385 	int err = 0;
11386 	in6_addr_t v6addr;
11387 	boolean_t need_up = B_FALSE;
11388 
11389 	ip1dbg(("ip_sioctl_dstaddr(%s:%u %p)\n",
11390 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11391 	ASSERT(IAM_WRITER_IPIF(ipif));
11392 
11393 	if (ipif->ipif_isv6) {
11394 		sin6_t *sin6;
11395 
11396 		if (sin->sin_family != AF_INET6)
11397 			return (EAFNOSUPPORT);
11398 
11399 		sin6 = (sin6_t *)sin;
11400 		v6addr = sin6->sin6_addr;
11401 
11402 		if (!ip_remote_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
11403 			return (EADDRNOTAVAIL);
11404 	} else {
11405 		ipaddr_t addr;
11406 
11407 		if (sin->sin_family != AF_INET)
11408 			return (EAFNOSUPPORT);
11409 
11410 		addr = sin->sin_addr.s_addr;
11411 		if (!ip_addr_ok_v4(addr, ipif->ipif_net_mask))
11412 			return (EADDRNOTAVAIL);
11413 
11414 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11415 	}
11416 
11417 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, &v6addr))
11418 		return (0);	/* No change */
11419 
11420 	if (ipif->ipif_flags & IPIF_UP) {
11421 		/*
11422 		 * If the interface is already marked up,
11423 		 * we call ipif_down which will take care
11424 		 * of ditching any IREs that have been set
11425 		 * up based on the old pp dst address.
11426 		 */
11427 		err = ipif_logical_down(ipif, q, mp);
11428 		if (err == EINPROGRESS)
11429 			return (err);
11430 		ipif_down_tail(ipif);
11431 		need_up = B_TRUE;
11432 	}
11433 	/*
11434 	 * could return EINPROGRESS. If so ioctl will complete in
11435 	 * ip_rput_dlpi_writer
11436 	 */
11437 	err = ip_sioctl_dstaddr_tail(ipif, sin, q, mp, need_up);
11438 	return (err);
11439 }
11440 
11441 static int
11442 ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11443     boolean_t need_up)
11444 {
11445 	in6_addr_t v6addr;
11446 	ill_t	*ill = ipif->ipif_ill;
11447 	int	err = 0;
11448 	boolean_t need_dl_down;
11449 	boolean_t need_arp_down;
11450 
11451 	ip1dbg(("ip_sioctl_dstaddr_tail(%s:%u %p)\n", ill->ill_name,
11452 	    ipif->ipif_id, (void *)ipif));
11453 
11454 	/* Must cancel any pending timer before taking the ill_lock */
11455 	if (ipif->ipif_recovery_id != 0)
11456 		(void) untimeout(ipif->ipif_recovery_id);
11457 	ipif->ipif_recovery_id = 0;
11458 
11459 	if (ipif->ipif_isv6) {
11460 		sin6_t *sin6;
11461 
11462 		sin6 = (sin6_t *)sin;
11463 		v6addr = sin6->sin6_addr;
11464 	} else {
11465 		ipaddr_t addr;
11466 
11467 		addr = sin->sin_addr.s_addr;
11468 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11469 	}
11470 	mutex_enter(&ill->ill_lock);
11471 	/* Set point to point destination address. */
11472 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11473 		/*
11474 		 * Allow this as a means of creating logical
11475 		 * pt-pt interfaces on top of e.g. an Ethernet.
11476 		 * XXX Undocumented HACK for testing.
11477 		 * pt-pt interfaces are created with NUD disabled.
11478 		 */
11479 		ipif->ipif_flags |= IPIF_POINTOPOINT;
11480 		ipif->ipif_flags &= ~IPIF_BROADCAST;
11481 		if (ipif->ipif_isv6)
11482 			ill->ill_flags |= ILLF_NONUD;
11483 	}
11484 
11485 	/*
11486 	 * If the interface was previously marked as a duplicate, then since
11487 	 * we've now got a "new" address, it should no longer be considered a
11488 	 * duplicate -- even if the "new" address is the same as the old one.
11489 	 * Note that if all ipifs are down, we may have a pending ARP down
11490 	 * event to handle.
11491 	 */
11492 	need_dl_down = need_arp_down = B_FALSE;
11493 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
11494 		need_arp_down = !need_up;
11495 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
11496 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
11497 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
11498 			need_dl_down = B_TRUE;
11499 		}
11500 	}
11501 
11502 	/* Set the new address. */
11503 	ipif->ipif_v6pp_dst_addr = v6addr;
11504 	/* Make sure subnet tracks pp_dst */
11505 	ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
11506 	mutex_exit(&ill->ill_lock);
11507 
11508 	if (need_up) {
11509 		/*
11510 		 * Now bring the interface back up.  If this
11511 		 * is the only IPIF for the ILL, ipif_up
11512 		 * will have to re-bind to the device, so
11513 		 * we may get back EINPROGRESS, in which
11514 		 * case, this IOCTL will get completed in
11515 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11516 		 */
11517 		err = ipif_up(ipif, q, mp);
11518 	}
11519 
11520 	if (need_dl_down)
11521 		ill_dl_down(ill);
11522 
11523 	if (need_arp_down)
11524 		ipif_arp_down(ipif);
11525 	return (err);
11526 }
11527 
11528 /*
11529  * Restart entry point to restart the dstaddress set operation after the
11530  * refcounts have dropped to zero.
11531  */
11532 /* ARGSUSED */
11533 int
11534 ip_sioctl_dstaddr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11535     ip_ioctl_cmd_t *ipip, void *ifreq)
11536 {
11537 	ip1dbg(("ip_sioctl_dstaddr_restart(%s:%u %p)\n",
11538 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11539 	ipif_down_tail(ipif);
11540 	return (ip_sioctl_dstaddr_tail(ipif, sin, q, mp, B_TRUE));
11541 }
11542 
11543 /* ARGSUSED */
11544 int
11545 ip_sioctl_get_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11546     ip_ioctl_cmd_t *ipip, void *if_req)
11547 {
11548 	sin6_t	*sin6 = (struct sockaddr_in6 *)sin;
11549 
11550 	ip1dbg(("ip_sioctl_get_dstaddr(%s:%u %p)\n",
11551 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11552 	/*
11553 	 * Get point to point destination address. The addresses can't
11554 	 * change since we hold a reference to the ipif.
11555 	 */
11556 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0)
11557 		return (EADDRNOTAVAIL);
11558 
11559 	if (ipif->ipif_isv6) {
11560 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11561 		*sin6 = sin6_null;
11562 		sin6->sin6_family = AF_INET6;
11563 		sin6->sin6_addr = ipif->ipif_v6pp_dst_addr;
11564 	} else {
11565 		*sin = sin_null;
11566 		sin->sin_family = AF_INET;
11567 		sin->sin_addr.s_addr = ipif->ipif_pp_dst_addr;
11568 	}
11569 	return (0);
11570 }
11571 
11572 /*
11573  * part of ipmp, make this func return the active/inactive state and
11574  * caller can set once atomically instead of multiple mutex_enter/mutex_exit
11575  */
11576 /*
11577  * This function either sets or clears the IFF_INACTIVE flag.
11578  *
11579  * As long as there are some addresses or multicast memberships on the
11580  * IPv4 or IPv6 interface of the "phyi" that does not belong in here, we
11581  * will consider it to be ACTIVE (clear IFF_INACTIVE) i.e the interface
11582  * will be used for outbound packets.
11583  *
11584  * Caller needs to verify the validity of setting IFF_INACTIVE.
11585  */
11586 static void
11587 phyint_inactive(phyint_t *phyi)
11588 {
11589 	ill_t *ill_v4;
11590 	ill_t *ill_v6;
11591 	ipif_t *ipif;
11592 	ilm_t *ilm;
11593 
11594 	ill_v4 = phyi->phyint_illv4;
11595 	ill_v6 = phyi->phyint_illv6;
11596 
11597 	/*
11598 	 * No need for a lock while traversing the list since iam
11599 	 * a writer
11600 	 */
11601 	if (ill_v4 != NULL) {
11602 		ASSERT(IAM_WRITER_ILL(ill_v4));
11603 		for (ipif = ill_v4->ill_ipif; ipif != NULL;
11604 		    ipif = ipif->ipif_next) {
11605 			if (ipif->ipif_orig_ifindex != phyi->phyint_ifindex) {
11606 				mutex_enter(&phyi->phyint_lock);
11607 				phyi->phyint_flags &= ~PHYI_INACTIVE;
11608 				mutex_exit(&phyi->phyint_lock);
11609 				return;
11610 			}
11611 		}
11612 		for (ilm = ill_v4->ill_ilm; ilm != NULL;
11613 		    ilm = ilm->ilm_next) {
11614 			if (ilm->ilm_orig_ifindex != phyi->phyint_ifindex) {
11615 				mutex_enter(&phyi->phyint_lock);
11616 				phyi->phyint_flags &= ~PHYI_INACTIVE;
11617 				mutex_exit(&phyi->phyint_lock);
11618 				return;
11619 			}
11620 		}
11621 	}
11622 	if (ill_v6 != NULL) {
11623 		ill_v6 = phyi->phyint_illv6;
11624 		for (ipif = ill_v6->ill_ipif; ipif != NULL;
11625 		    ipif = ipif->ipif_next) {
11626 			if (ipif->ipif_orig_ifindex != phyi->phyint_ifindex) {
11627 				mutex_enter(&phyi->phyint_lock);
11628 				phyi->phyint_flags &= ~PHYI_INACTIVE;
11629 				mutex_exit(&phyi->phyint_lock);
11630 				return;
11631 			}
11632 		}
11633 		for (ilm = ill_v6->ill_ilm; ilm != NULL;
11634 		    ilm = ilm->ilm_next) {
11635 			if (ilm->ilm_orig_ifindex != phyi->phyint_ifindex) {
11636 				mutex_enter(&phyi->phyint_lock);
11637 				phyi->phyint_flags &= ~PHYI_INACTIVE;
11638 				mutex_exit(&phyi->phyint_lock);
11639 				return;
11640 			}
11641 		}
11642 	}
11643 	mutex_enter(&phyi->phyint_lock);
11644 	phyi->phyint_flags |= PHYI_INACTIVE;
11645 	mutex_exit(&phyi->phyint_lock);
11646 }
11647 
11648 /*
11649  * This function is called only when the phyint flags change. Currently
11650  * called from ip_sioctl_flags. We re-do the broadcast nomination so
11651  * that we can select a good ill.
11652  */
11653 static void
11654 ip_redo_nomination(phyint_t *phyi)
11655 {
11656 	ill_t *ill_v4;
11657 
11658 	ill_v4 = phyi->phyint_illv4;
11659 
11660 	if (ill_v4 != NULL && ill_v4->ill_group != NULL) {
11661 		ASSERT(IAM_WRITER_ILL(ill_v4));
11662 		if (ill_v4->ill_group->illgrp_ill_count > 1)
11663 			ill_nominate_bcast_rcv(ill_v4->ill_group);
11664 	}
11665 }
11666 
11667 /*
11668  * Heuristic to check if ill is INACTIVE.
11669  * Checks if ill has an ipif with an usable ip address.
11670  *
11671  * Return values:
11672  *	B_TRUE	- ill is INACTIVE; has no usable ipif
11673  *	B_FALSE - ill is not INACTIVE; ill has at least one usable ipif
11674  */
11675 static boolean_t
11676 ill_is_inactive(ill_t *ill)
11677 {
11678 	ipif_t *ipif;
11679 
11680 	/* Check whether it is in an IPMP group */
11681 	if (ill->ill_phyint->phyint_groupname == NULL)
11682 		return (B_FALSE);
11683 
11684 	if (ill->ill_ipif_up_count == 0)
11685 		return (B_TRUE);
11686 
11687 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
11688 		uint64_t flags = ipif->ipif_flags;
11689 
11690 		/*
11691 		 * This ipif is usable if it is IPIF_UP and not a
11692 		 * dedicated test address.  A dedicated test address
11693 		 * is marked IPIF_NOFAILOVER *and* IPIF_DEPRECATED
11694 		 * (note in particular that V6 test addresses are
11695 		 * link-local data addresses and thus are marked
11696 		 * IPIF_NOFAILOVER but not IPIF_DEPRECATED).
11697 		 */
11698 		if ((flags & IPIF_UP) &&
11699 		    ((flags & (IPIF_DEPRECATED|IPIF_NOFAILOVER)) !=
11700 		    (IPIF_DEPRECATED|IPIF_NOFAILOVER)))
11701 			return (B_FALSE);
11702 	}
11703 	return (B_TRUE);
11704 }
11705 
11706 /*
11707  * Set interface flags.
11708  * Need to do special action for IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT,
11709  * IPIF_NOLOCAL, ILLF_NONUD, ILLF_NOARP, IPIF_PRIVATE, IPIF_ANYCAST,
11710  * IPIF_PREFERRED, PHYI_STANDBY, PHYI_FAILED and PHYI_OFFLINE.
11711  *
11712  * NOTE : We really don't enforce that ipif_id zero should be used
11713  *	  for setting any flags other than IFF_LOGINT_FLAGS. This
11714  *	  is because applications generally does SICGLIFFLAGS and
11715  *	  ORs in the new flags (that affects the logical) and does a
11716  *	  SIOCSLIFFLAGS. Thus, "flags" below could contain bits other
11717  *	  than IFF_LOGINT_FLAGS. One could check whether "turn_on" - the
11718  *	  flags that will be turned on is correct with respect to
11719  *	  ipif_id 0. For backward compatibility reasons, it is not done.
11720  */
11721 /* ARGSUSED */
11722 int
11723 ip_sioctl_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11724     ip_ioctl_cmd_t *ipip, void *if_req)
11725 {
11726 	uint64_t turn_on;
11727 	uint64_t turn_off;
11728 	int	err;
11729 	boolean_t need_up = B_FALSE;
11730 	phyint_t *phyi;
11731 	ill_t *ill;
11732 	uint64_t intf_flags;
11733 	boolean_t phyint_flags_modified = B_FALSE;
11734 	uint64_t flags;
11735 	struct ifreq *ifr;
11736 	struct lifreq *lifr;
11737 	boolean_t set_linklocal = B_FALSE;
11738 	boolean_t zero_source = B_FALSE;
11739 
11740 	ip1dbg(("ip_sioctl_flags(%s:%u %p)\n",
11741 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11742 
11743 	ASSERT(IAM_WRITER_IPIF(ipif));
11744 
11745 	ill = ipif->ipif_ill;
11746 	phyi = ill->ill_phyint;
11747 
11748 	if (ipip->ipi_cmd_type == IF_CMD) {
11749 		ifr = (struct ifreq *)if_req;
11750 		flags =  (uint64_t)(ifr->ifr_flags & 0x0000ffff);
11751 	} else {
11752 		lifr = (struct lifreq *)if_req;
11753 		flags = lifr->lifr_flags;
11754 	}
11755 
11756 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
11757 
11758 	/*
11759 	 * Has the flags been set correctly till now ?
11760 	 */
11761 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
11762 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
11763 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
11764 	/*
11765 	 * Compare the new flags to the old, and partition
11766 	 * into those coming on and those going off.
11767 	 * For the 16 bit command keep the bits above bit 16 unchanged.
11768 	 */
11769 	if (ipip->ipi_cmd == SIOCSIFFLAGS)
11770 		flags |= intf_flags & ~0xFFFF;
11771 
11772 	/*
11773 	 * First check which bits will change and then which will
11774 	 * go on and off
11775 	 */
11776 	turn_on = (flags ^ intf_flags) & ~IFF_CANTCHANGE;
11777 	if (!turn_on)
11778 		return (0);	/* No change */
11779 
11780 	turn_off = intf_flags & turn_on;
11781 	turn_on ^= turn_off;
11782 	err = 0;
11783 
11784 	/*
11785 	 * Don't allow any bits belonging to the logical interface
11786 	 * to be set or cleared on the replacement ipif that was
11787 	 * created temporarily during a MOVE.
11788 	 */
11789 	if (ipif->ipif_replace_zero &&
11790 	    ((turn_on|turn_off) & IFF_LOGINT_FLAGS) != 0) {
11791 		return (EINVAL);
11792 	}
11793 
11794 	/*
11795 	 * Only allow the IFF_XRESOLV and IFF_TEMPORARY flags to be set on
11796 	 * IPv6 interfaces.
11797 	 */
11798 	if ((turn_on & (IFF_XRESOLV|IFF_TEMPORARY)) && !(ipif->ipif_isv6))
11799 		return (EINVAL);
11800 
11801 	/*
11802 	 * Don't allow the IFF_ROUTER flag to be turned on on loopback
11803 	 * interfaces.  It makes no sense in that context.
11804 	 */
11805 	if ((turn_on & IFF_ROUTER) && (phyi->phyint_flags & PHYI_LOOPBACK))
11806 		return (EINVAL);
11807 
11808 	if (flags & (IFF_NOLOCAL|IFF_ANYCAST))
11809 		zero_source = B_TRUE;
11810 
11811 	/*
11812 	 * For IPv6 ipif_id 0, don't allow the interface to be up without
11813 	 * a link local address if IFF_NOLOCAL or IFF_ANYCAST are not set.
11814 	 * If the link local address isn't set, and can be set, it will get
11815 	 * set later on in this function.
11816 	 */
11817 	if (ipif->ipif_id == 0 && ipif->ipif_isv6 &&
11818 	    (flags & IFF_UP) && !zero_source &&
11819 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
11820 		if (ipif_cant_setlinklocal(ipif))
11821 			return (EINVAL);
11822 		set_linklocal = B_TRUE;
11823 	}
11824 
11825 	/*
11826 	 * ILL cannot be part of a usesrc group and and IPMP group at the
11827 	 * same time. No need to grab ill_g_usesrc_lock here, see
11828 	 * synchronization notes in ip.c
11829 	 */
11830 	if (turn_on & PHYI_STANDBY &&
11831 	    ipif->ipif_ill->ill_usesrc_grp_next != NULL) {
11832 		return (EINVAL);
11833 	}
11834 
11835 	/*
11836 	 * If we modify physical interface flags, we'll potentially need to
11837 	 * send up two routing socket messages for the changes (one for the
11838 	 * IPv4 ill, and another for the IPv6 ill).  Note that here.
11839 	 */
11840 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
11841 		phyint_flags_modified = B_TRUE;
11842 
11843 	/*
11844 	 * If we are setting or clearing FAILED or STANDBY or OFFLINE,
11845 	 * we need to flush the IRE_CACHES belonging to this ill.
11846 	 * We handle this case here without doing the DOWN/UP dance
11847 	 * like it is done for other flags. If some other flags are
11848 	 * being turned on/off with FAILED/STANDBY/OFFLINE, the code
11849 	 * below will handle it by bringing it down and then
11850 	 * bringing it UP.
11851 	 */
11852 	if ((turn_on|turn_off) & (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE)) {
11853 		ill_t *ill_v4, *ill_v6;
11854 
11855 		ill_v4 = phyi->phyint_illv4;
11856 		ill_v6 = phyi->phyint_illv6;
11857 
11858 		/*
11859 		 * First set the INACTIVE flag if needed. Then delete the ires.
11860 		 * ire_add will atomically prevent creating new IRE_CACHEs
11861 		 * unless hidden flag is set.
11862 		 * PHYI_FAILED and PHYI_INACTIVE are exclusive
11863 		 */
11864 		if ((turn_on & PHYI_FAILED) &&
11865 		    ((intf_flags & PHYI_STANDBY) || !ipmp_enable_failback)) {
11866 			/* Reset PHYI_INACTIVE when PHYI_FAILED is being set */
11867 			phyi->phyint_flags &= ~PHYI_INACTIVE;
11868 		}
11869 		if ((turn_off & PHYI_FAILED) &&
11870 		    ((intf_flags & PHYI_STANDBY) ||
11871 		    (!ipmp_enable_failback && ill_is_inactive(ill)))) {
11872 			phyint_inactive(phyi);
11873 		}
11874 
11875 		if (turn_on & PHYI_STANDBY) {
11876 			/*
11877 			 * We implicitly set INACTIVE only when STANDBY is set.
11878 			 * INACTIVE is also set on non-STANDBY phyint when user
11879 			 * disables FAILBACK using configuration file.
11880 			 * Do not allow STANDBY to be set on such INACTIVE
11881 			 * phyint
11882 			 */
11883 			if (phyi->phyint_flags & PHYI_INACTIVE)
11884 				return (EINVAL);
11885 			if (!(phyi->phyint_flags & PHYI_FAILED))
11886 				phyint_inactive(phyi);
11887 		}
11888 		if (turn_off & PHYI_STANDBY) {
11889 			if (ipmp_enable_failback) {
11890 				/*
11891 				 * Reset PHYI_INACTIVE.
11892 				 */
11893 				phyi->phyint_flags &= ~PHYI_INACTIVE;
11894 			} else if (ill_is_inactive(ill) &&
11895 			    !(phyi->phyint_flags & PHYI_FAILED)) {
11896 				/*
11897 				 * Need to set INACTIVE, when user sets
11898 				 * STANDBY on a non-STANDBY phyint and
11899 				 * later resets STANDBY
11900 				 */
11901 				phyint_inactive(phyi);
11902 			}
11903 		}
11904 		/*
11905 		 * We should always send up a message so that the
11906 		 * daemons come to know of it. Note that the zeroth
11907 		 * interface can be down and the check below for IPIF_UP
11908 		 * will not make sense as we are actually setting
11909 		 * a phyint flag here. We assume that the ipif used
11910 		 * is always the zeroth ipif. (ip_rts_ifmsg does not
11911 		 * send up any message for non-zero ipifs).
11912 		 */
11913 		phyint_flags_modified = B_TRUE;
11914 
11915 		if (ill_v4 != NULL) {
11916 			ire_walk_ill_v4(MATCH_IRE_ILL | MATCH_IRE_TYPE,
11917 			    IRE_CACHE, ill_stq_cache_delete,
11918 			    (char *)ill_v4, ill_v4);
11919 			illgrp_reset_schednext(ill_v4);
11920 		}
11921 		if (ill_v6 != NULL) {
11922 			ire_walk_ill_v6(MATCH_IRE_ILL | MATCH_IRE_TYPE,
11923 			    IRE_CACHE, ill_stq_cache_delete,
11924 			    (char *)ill_v6, ill_v6);
11925 			illgrp_reset_schednext(ill_v6);
11926 		}
11927 	}
11928 
11929 	/*
11930 	 * If ILLF_ROUTER changes, we need to change the ip forwarding
11931 	 * status of the interface and, if the interface is part of an IPMP
11932 	 * group, all other interfaces that are part of the same IPMP
11933 	 * group.
11934 	 */
11935 	if ((turn_on | turn_off) & ILLF_ROUTER) {
11936 		(void) ill_forward_set(q, mp, ((turn_on & ILLF_ROUTER) != 0),
11937 		    (caddr_t)ill);
11938 	}
11939 
11940 	/*
11941 	 * If the interface is not UP and we are not going to
11942 	 * bring it UP, record the flags and return. When the
11943 	 * interface comes UP later, the right actions will be
11944 	 * taken.
11945 	 */
11946 	if (!(ipif->ipif_flags & IPIF_UP) &&
11947 	    !(turn_on & IPIF_UP)) {
11948 		/* Record new flags in their respective places. */
11949 		mutex_enter(&ill->ill_lock);
11950 		mutex_enter(&ill->ill_phyint->phyint_lock);
11951 		ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
11952 		ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
11953 		ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
11954 		ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
11955 		phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
11956 		phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
11957 		mutex_exit(&ill->ill_lock);
11958 		mutex_exit(&ill->ill_phyint->phyint_lock);
11959 
11960 		/*
11961 		 * We do the broadcast and nomination here rather
11962 		 * than waiting for a FAILOVER/FAILBACK to happen. In
11963 		 * the case of FAILBACK from INACTIVE standby to the
11964 		 * interface that has been repaired, PHYI_FAILED has not
11965 		 * been cleared yet. If there are only two interfaces in
11966 		 * that group, all we have is a FAILED and INACTIVE
11967 		 * interface. If we do the nomination soon after a failback,
11968 		 * the broadcast nomination code would select the
11969 		 * INACTIVE interface for receiving broadcasts as FAILED is
11970 		 * not yet cleared. As we don't want STANDBY/INACTIVE to
11971 		 * receive broadcast packets, we need to redo nomination
11972 		 * when the FAILED is cleared here. Thus, in general we
11973 		 * always do the nomination here for FAILED, STANDBY
11974 		 * and OFFLINE.
11975 		 */
11976 		if (((turn_on | turn_off) &
11977 		    (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE))) {
11978 			ip_redo_nomination(phyi);
11979 		}
11980 		if (phyint_flags_modified) {
11981 			if (phyi->phyint_illv4 != NULL) {
11982 				ip_rts_ifmsg(phyi->phyint_illv4->
11983 				    ill_ipif);
11984 			}
11985 			if (phyi->phyint_illv6 != NULL) {
11986 				ip_rts_ifmsg(phyi->phyint_illv6->
11987 				    ill_ipif);
11988 			}
11989 		}
11990 		return (0);
11991 	} else if (set_linklocal || zero_source) {
11992 		mutex_enter(&ill->ill_lock);
11993 		if (set_linklocal)
11994 			ipif->ipif_state_flags |= IPIF_SET_LINKLOCAL;
11995 		if (zero_source)
11996 			ipif->ipif_state_flags |= IPIF_ZERO_SOURCE;
11997 		mutex_exit(&ill->ill_lock);
11998 	}
11999 
12000 	/*
12001 	 * Disallow IPv6 interfaces coming up that have the unspecified address,
12002 	 * or point-to-point interfaces with an unspecified destination. We do
12003 	 * allow the address to be unspecified for IPIF_NOLOCAL interfaces that
12004 	 * have a subnet assigned, which is how in.ndpd currently manages its
12005 	 * onlink prefix list when no addresses are configured with those
12006 	 * prefixes.
12007 	 */
12008 	if (ipif->ipif_isv6 &&
12009 	    ((IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
12010 	    (!(ipif->ipif_flags & IPIF_NOLOCAL) && !(turn_on & IPIF_NOLOCAL) ||
12011 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) ||
12012 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
12013 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)))) {
12014 		return (EINVAL);
12015 	}
12016 
12017 	/*
12018 	 * Prevent IPv4 point-to-point interfaces with a 0.0.0.0 destination
12019 	 * from being brought up.
12020 	 */
12021 	if (!ipif->ipif_isv6 &&
12022 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
12023 	    ipif->ipif_pp_dst_addr == INADDR_ANY)) {
12024 		return (EINVAL);
12025 	}
12026 
12027 	/*
12028 	 * The only flag changes that we currently take specific action on
12029 	 * is IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT, IPIF_NOLOCAL,
12030 	 * ILLF_NOARP, ILLF_NONUD, IPIF_PRIVATE, IPIF_ANYCAST, and
12031 	 * IPIF_PREFERRED.  This is done by bring the ipif down, changing
12032 	 * the flags and bringing it back up again.
12033 	 */
12034 	if ((turn_on|turn_off) &
12035 	    (IPIF_UP|IPIF_DEPRECATED|IPIF_NOXMIT|IPIF_NOLOCAL|ILLF_NOARP|
12036 	    ILLF_NONUD|IPIF_PRIVATE|IPIF_ANYCAST|IPIF_PREFERRED)) {
12037 		/*
12038 		 * Taking this ipif down, make sure we have
12039 		 * valid net and subnet bcast ire's for other
12040 		 * logical interfaces, if we need them.
12041 		 */
12042 		if (!ipif->ipif_isv6)
12043 			ipif_check_bcast_ires(ipif);
12044 
12045 		if (((ipif->ipif_flags | turn_on) & IPIF_UP) &&
12046 		    !(turn_off & IPIF_UP)) {
12047 			need_up = B_TRUE;
12048 			if (ipif->ipif_flags & IPIF_UP)
12049 				ill->ill_logical_down = 1;
12050 			turn_on &= ~IPIF_UP;
12051 		}
12052 		err = ipif_down(ipif, q, mp);
12053 		ip1dbg(("ipif_down returns %d err ", err));
12054 		if (err == EINPROGRESS)
12055 			return (err);
12056 		ipif_down_tail(ipif);
12057 	}
12058 	return (ip_sioctl_flags_tail(ipif, flags, q, mp, need_up));
12059 }
12060 
12061 static int
12062 ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q, mblk_t *mp,
12063     boolean_t need_up)
12064 {
12065 	ill_t	*ill;
12066 	phyint_t *phyi;
12067 	uint64_t turn_on;
12068 	uint64_t turn_off;
12069 	uint64_t intf_flags;
12070 	boolean_t phyint_flags_modified = B_FALSE;
12071 	int	err = 0;
12072 	boolean_t set_linklocal = B_FALSE;
12073 	boolean_t zero_source = B_FALSE;
12074 
12075 	ip1dbg(("ip_sioctl_flags_tail(%s:%u)\n",
12076 		ipif->ipif_ill->ill_name, ipif->ipif_id));
12077 
12078 	ASSERT(IAM_WRITER_IPIF(ipif));
12079 
12080 	ill = ipif->ipif_ill;
12081 	phyi = ill->ill_phyint;
12082 
12083 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
12084 	turn_on = (flags ^ intf_flags) & ~(IFF_CANTCHANGE | IFF_UP);
12085 
12086 	turn_off = intf_flags & turn_on;
12087 	turn_on ^= turn_off;
12088 
12089 	if ((turn_on|turn_off) & (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE))
12090 		phyint_flags_modified = B_TRUE;
12091 
12092 	/*
12093 	 * Now we change the flags. Track current value of
12094 	 * other flags in their respective places.
12095 	 */
12096 	mutex_enter(&ill->ill_lock);
12097 	mutex_enter(&phyi->phyint_lock);
12098 	ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
12099 	ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
12100 	ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
12101 	ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
12102 	phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
12103 	phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
12104 	if (ipif->ipif_state_flags & IPIF_SET_LINKLOCAL) {
12105 		set_linklocal = B_TRUE;
12106 		ipif->ipif_state_flags &= ~IPIF_SET_LINKLOCAL;
12107 	}
12108 	if (ipif->ipif_state_flags & IPIF_ZERO_SOURCE) {
12109 		zero_source = B_TRUE;
12110 		ipif->ipif_state_flags &= ~IPIF_ZERO_SOURCE;
12111 	}
12112 	mutex_exit(&ill->ill_lock);
12113 	mutex_exit(&phyi->phyint_lock);
12114 
12115 	if (((turn_on | turn_off) & (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE)))
12116 		ip_redo_nomination(phyi);
12117 
12118 	if (set_linklocal)
12119 		(void) ipif_setlinklocal(ipif);
12120 
12121 	if (zero_source)
12122 		ipif->ipif_v6src_addr = ipv6_all_zeros;
12123 	else
12124 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
12125 
12126 	if (need_up) {
12127 		/*
12128 		 * XXX ipif_up really does not know whether a phyint flags
12129 		 * was modified or not. So, it sends up information on
12130 		 * only one routing sockets message. As we don't bring up
12131 		 * the interface and also set STANDBY/FAILED simultaneously
12132 		 * it should be okay.
12133 		 */
12134 		err = ipif_up(ipif, q, mp);
12135 	} else {
12136 		/*
12137 		 * Make sure routing socket sees all changes to the flags.
12138 		 * ipif_up_done* handles this when we use ipif_up.
12139 		 */
12140 		if (phyint_flags_modified) {
12141 			if (phyi->phyint_illv4 != NULL) {
12142 				ip_rts_ifmsg(phyi->phyint_illv4->
12143 				    ill_ipif);
12144 			}
12145 			if (phyi->phyint_illv6 != NULL) {
12146 				ip_rts_ifmsg(phyi->phyint_illv6->
12147 				    ill_ipif);
12148 			}
12149 		} else {
12150 			ip_rts_ifmsg(ipif);
12151 		}
12152 	}
12153 	return (err);
12154 }
12155 
12156 /*
12157  * Restart entry point to restart the flags restart operation after the
12158  * refcounts have dropped to zero.
12159  */
12160 /* ARGSUSED */
12161 int
12162 ip_sioctl_flags_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12163     ip_ioctl_cmd_t *ipip, void *if_req)
12164 {
12165 	int	err;
12166 	struct ifreq *ifr = (struct ifreq *)if_req;
12167 	struct lifreq *lifr = (struct lifreq *)if_req;
12168 
12169 	ip1dbg(("ip_sioctl_flags_restart(%s:%u %p)\n",
12170 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12171 
12172 	ipif_down_tail(ipif);
12173 	if (ipip->ipi_cmd_type == IF_CMD) {
12174 		/*
12175 		 * Since ip_sioctl_flags expects an int and ifr_flags
12176 		 * is a short we need to cast ifr_flags into an int
12177 		 * to avoid having sign extension cause bits to get
12178 		 * set that should not be.
12179 		 */
12180 		err = ip_sioctl_flags_tail(ipif,
12181 		    (uint64_t)(ifr->ifr_flags & 0x0000ffff),
12182 		    q, mp, B_TRUE);
12183 	} else {
12184 		err = ip_sioctl_flags_tail(ipif, lifr->lifr_flags,
12185 		    q, mp, B_TRUE);
12186 	}
12187 	return (err);
12188 }
12189 
12190 /* ARGSUSED */
12191 int
12192 ip_sioctl_get_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12193     ip_ioctl_cmd_t *ipip, void *if_req)
12194 {
12195 	/*
12196 	 * Has the flags been set correctly till now ?
12197 	 */
12198 	ill_t *ill = ipif->ipif_ill;
12199 	phyint_t *phyi = ill->ill_phyint;
12200 
12201 	ip1dbg(("ip_sioctl_get_flags(%s:%u %p)\n",
12202 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12203 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
12204 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
12205 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
12206 
12207 	/*
12208 	 * Need a lock since some flags can be set even when there are
12209 	 * references to the ipif.
12210 	 */
12211 	mutex_enter(&ill->ill_lock);
12212 	if (ipip->ipi_cmd_type == IF_CMD) {
12213 		struct ifreq *ifr = (struct ifreq *)if_req;
12214 
12215 		/* Get interface flags (low 16 only). */
12216 		ifr->ifr_flags = ((ipif->ipif_flags |
12217 		    ill->ill_flags | phyi->phyint_flags) & 0xffff);
12218 	} else {
12219 		struct lifreq *lifr = (struct lifreq *)if_req;
12220 
12221 		/* Get interface flags. */
12222 		lifr->lifr_flags = ipif->ipif_flags |
12223 		    ill->ill_flags | phyi->phyint_flags;
12224 	}
12225 	mutex_exit(&ill->ill_lock);
12226 	return (0);
12227 }
12228 
12229 /* ARGSUSED */
12230 int
12231 ip_sioctl_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12232     ip_ioctl_cmd_t *ipip, void *if_req)
12233 {
12234 	int mtu;
12235 	int ip_min_mtu;
12236 	struct ifreq	*ifr;
12237 	struct lifreq *lifr;
12238 	ire_t	*ire;
12239 
12240 	ip1dbg(("ip_sioctl_mtu(%s:%u %p)\n", ipif->ipif_ill->ill_name,
12241 	    ipif->ipif_id, (void *)ipif));
12242 	if (ipip->ipi_cmd_type == IF_CMD) {
12243 		ifr = (struct ifreq *)if_req;
12244 		mtu = ifr->ifr_metric;
12245 	} else {
12246 		lifr = (struct lifreq *)if_req;
12247 		mtu = lifr->lifr_mtu;
12248 	}
12249 
12250 	if (ipif->ipif_isv6)
12251 		ip_min_mtu = IPV6_MIN_MTU;
12252 	else
12253 		ip_min_mtu = IP_MIN_MTU;
12254 
12255 	if (mtu > ipif->ipif_ill->ill_max_frag || mtu < ip_min_mtu)
12256 		return (EINVAL);
12257 
12258 	/*
12259 	 * Change the MTU size in all relevant ire's.
12260 	 * Mtu change Vs. new ire creation - protocol below.
12261 	 * First change ipif_mtu and the ire_max_frag of the
12262 	 * interface ire. Then do an ire walk and change the
12263 	 * ire_max_frag of all affected ires. During ire_add
12264 	 * under the bucket lock, set the ire_max_frag of the
12265 	 * new ire being created from the ipif/ire from which
12266 	 * it is being derived. If an mtu change happens after
12267 	 * the ire is added, the new ire will be cleaned up.
12268 	 * Conversely if the mtu change happens before the ire
12269 	 * is added, ire_add will see the new value of the mtu.
12270 	 */
12271 	ipif->ipif_mtu = mtu;
12272 	ipif->ipif_flags |= IPIF_FIXEDMTU;
12273 
12274 	if (ipif->ipif_isv6)
12275 		ire = ipif_to_ire_v6(ipif);
12276 	else
12277 		ire = ipif_to_ire(ipif);
12278 	if (ire != NULL) {
12279 		ire->ire_max_frag = ipif->ipif_mtu;
12280 		ire_refrele(ire);
12281 	}
12282 	if (ipif->ipif_flags & IPIF_UP) {
12283 		if (ipif->ipif_isv6)
12284 			ire_walk_v6(ipif_mtu_change, (char *)ipif, ALL_ZONES);
12285 		else
12286 			ire_walk_v4(ipif_mtu_change, (char *)ipif, ALL_ZONES);
12287 	}
12288 	/* Update the MTU in SCTP's list */
12289 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
12290 	return (0);
12291 }
12292 
12293 /* Get interface MTU. */
12294 /* ARGSUSED */
12295 int
12296 ip_sioctl_get_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12297 	ip_ioctl_cmd_t *ipip, void *if_req)
12298 {
12299 	struct ifreq	*ifr;
12300 	struct lifreq	*lifr;
12301 
12302 	ip1dbg(("ip_sioctl_get_mtu(%s:%u %p)\n",
12303 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12304 	if (ipip->ipi_cmd_type == IF_CMD) {
12305 		ifr = (struct ifreq *)if_req;
12306 		ifr->ifr_metric = ipif->ipif_mtu;
12307 	} else {
12308 		lifr = (struct lifreq *)if_req;
12309 		lifr->lifr_mtu = ipif->ipif_mtu;
12310 	}
12311 	return (0);
12312 }
12313 
12314 /* Set interface broadcast address. */
12315 /* ARGSUSED2 */
12316 int
12317 ip_sioctl_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12318 	ip_ioctl_cmd_t *ipip, void *if_req)
12319 {
12320 	ipaddr_t addr;
12321 	ire_t	*ire;
12322 
12323 	ip1dbg(("ip_sioctl_brdaddr(%s:%u)\n", ipif->ipif_ill->ill_name,
12324 	    ipif->ipif_id));
12325 
12326 	ASSERT(IAM_WRITER_IPIF(ipif));
12327 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
12328 		return (EADDRNOTAVAIL);
12329 
12330 	ASSERT(!(ipif->ipif_isv6));	/* No IPv6 broadcast */
12331 
12332 	if (sin->sin_family != AF_INET)
12333 		return (EAFNOSUPPORT);
12334 
12335 	addr = sin->sin_addr.s_addr;
12336 	if (ipif->ipif_flags & IPIF_UP) {
12337 		/*
12338 		 * If we are already up, make sure the new
12339 		 * broadcast address makes sense.  If it does,
12340 		 * there should be an IRE for it already.
12341 		 * Don't match on ipif, only on the ill
12342 		 * since we are sharing these now. Don't use
12343 		 * MATCH_IRE_ILL_GROUP as we are looking for
12344 		 * the broadcast ire on this ill and each ill
12345 		 * in the group has its own broadcast ire.
12346 		 */
12347 		ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST,
12348 		    ipif, ALL_ZONES, NULL,
12349 		    (MATCH_IRE_ILL | MATCH_IRE_TYPE));
12350 		if (ire == NULL) {
12351 			return (EINVAL);
12352 		} else {
12353 			ire_refrele(ire);
12354 		}
12355 	}
12356 	/*
12357 	 * Changing the broadcast addr for this ipif.
12358 	 * Make sure we have valid net and subnet bcast
12359 	 * ire's for other logical interfaces, if needed.
12360 	 */
12361 	if (addr != ipif->ipif_brd_addr)
12362 		ipif_check_bcast_ires(ipif);
12363 	IN6_IPADDR_TO_V4MAPPED(addr, &ipif->ipif_v6brd_addr);
12364 	return (0);
12365 }
12366 
12367 /* Get interface broadcast address. */
12368 /* ARGSUSED */
12369 int
12370 ip_sioctl_get_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12371     ip_ioctl_cmd_t *ipip, void *if_req)
12372 {
12373 	ip1dbg(("ip_sioctl_get_brdaddr(%s:%u %p)\n",
12374 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12375 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
12376 		return (EADDRNOTAVAIL);
12377 
12378 	/* IPIF_BROADCAST not possible with IPv6 */
12379 	ASSERT(!ipif->ipif_isv6);
12380 	*sin = sin_null;
12381 	sin->sin_family = AF_INET;
12382 	sin->sin_addr.s_addr = ipif->ipif_brd_addr;
12383 	return (0);
12384 }
12385 
12386 /*
12387  * This routine is called to handle the SIOCS*IFNETMASK IOCTL.
12388  */
12389 /* ARGSUSED */
12390 int
12391 ip_sioctl_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12392     ip_ioctl_cmd_t *ipip, void *if_req)
12393 {
12394 	int err = 0;
12395 	in6_addr_t v6mask;
12396 
12397 	ip1dbg(("ip_sioctl_netmask(%s:%u %p)\n",
12398 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12399 
12400 	ASSERT(IAM_WRITER_IPIF(ipif));
12401 
12402 	if (ipif->ipif_isv6) {
12403 		sin6_t *sin6;
12404 
12405 		if (sin->sin_family != AF_INET6)
12406 			return (EAFNOSUPPORT);
12407 
12408 		sin6 = (sin6_t *)sin;
12409 		v6mask = sin6->sin6_addr;
12410 	} else {
12411 		ipaddr_t mask;
12412 
12413 		if (sin->sin_family != AF_INET)
12414 			return (EAFNOSUPPORT);
12415 
12416 		mask = sin->sin_addr.s_addr;
12417 		V4MASK_TO_V6(mask, v6mask);
12418 	}
12419 
12420 	/*
12421 	 * No big deal if the interface isn't already up, or the mask
12422 	 * isn't really changing, or this is pt-pt.
12423 	 */
12424 	if (!(ipif->ipif_flags & IPIF_UP) ||
12425 	    IN6_ARE_ADDR_EQUAL(&v6mask, &ipif->ipif_v6net_mask) ||
12426 	    (ipif->ipif_flags & IPIF_POINTOPOINT)) {
12427 		ipif->ipif_v6net_mask = v6mask;
12428 		if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
12429 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
12430 			    ipif->ipif_v6net_mask,
12431 			    ipif->ipif_v6subnet);
12432 		}
12433 		return (0);
12434 	}
12435 	/*
12436 	 * Make sure we have valid net and subnet broadcast ire's
12437 	 * for the old netmask, if needed by other logical interfaces.
12438 	 */
12439 	if (!ipif->ipif_isv6)
12440 		ipif_check_bcast_ires(ipif);
12441 
12442 	err = ipif_logical_down(ipif, q, mp);
12443 	if (err == EINPROGRESS)
12444 		return (err);
12445 	ipif_down_tail(ipif);
12446 	err = ip_sioctl_netmask_tail(ipif, sin, q, mp);
12447 	return (err);
12448 }
12449 
12450 static int
12451 ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp)
12452 {
12453 	in6_addr_t v6mask;
12454 	int err = 0;
12455 
12456 	ip1dbg(("ip_sioctl_netmask_tail(%s:%u %p)\n",
12457 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12458 
12459 	if (ipif->ipif_isv6) {
12460 		sin6_t *sin6;
12461 
12462 		sin6 = (sin6_t *)sin;
12463 		v6mask = sin6->sin6_addr;
12464 	} else {
12465 		ipaddr_t mask;
12466 
12467 		mask = sin->sin_addr.s_addr;
12468 		V4MASK_TO_V6(mask, v6mask);
12469 	}
12470 
12471 	ipif->ipif_v6net_mask = v6mask;
12472 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
12473 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
12474 		    ipif->ipif_v6subnet);
12475 	}
12476 	err = ipif_up(ipif, q, mp);
12477 
12478 	if (err == 0 || err == EINPROGRESS) {
12479 		/*
12480 		 * The interface must be DL_BOUND if this packet has to
12481 		 * go out on the wire. Since we only go through a logical
12482 		 * down and are bound with the driver during an internal
12483 		 * down/up that is satisfied.
12484 		 */
12485 		if (!ipif->ipif_isv6 && ipif->ipif_ill->ill_wq != NULL) {
12486 			/* Potentially broadcast an address mask reply. */
12487 			ipif_mask_reply(ipif);
12488 		}
12489 	}
12490 	return (err);
12491 }
12492 
12493 /* ARGSUSED */
12494 int
12495 ip_sioctl_netmask_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12496     ip_ioctl_cmd_t *ipip, void *if_req)
12497 {
12498 	ip1dbg(("ip_sioctl_netmask_restart(%s:%u %p)\n",
12499 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12500 	ipif_down_tail(ipif);
12501 	return (ip_sioctl_netmask_tail(ipif, sin, q, mp));
12502 }
12503 
12504 /* Get interface net mask. */
12505 /* ARGSUSED */
12506 int
12507 ip_sioctl_get_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12508     ip_ioctl_cmd_t *ipip, void *if_req)
12509 {
12510 	struct lifreq *lifr = (struct lifreq *)if_req;
12511 	struct sockaddr_in6 *sin6 = (sin6_t *)sin;
12512 
12513 	ip1dbg(("ip_sioctl_get_netmask(%s:%u %p)\n",
12514 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12515 
12516 	/*
12517 	 * net mask can't change since we have a reference to the ipif.
12518 	 */
12519 	if (ipif->ipif_isv6) {
12520 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
12521 		*sin6 = sin6_null;
12522 		sin6->sin6_family = AF_INET6;
12523 		sin6->sin6_addr = ipif->ipif_v6net_mask;
12524 		lifr->lifr_addrlen =
12525 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
12526 	} else {
12527 		*sin = sin_null;
12528 		sin->sin_family = AF_INET;
12529 		sin->sin_addr.s_addr = ipif->ipif_net_mask;
12530 		if (ipip->ipi_cmd_type == LIF_CMD) {
12531 			lifr->lifr_addrlen =
12532 			    ip_mask_to_plen(ipif->ipif_net_mask);
12533 		}
12534 	}
12535 	return (0);
12536 }
12537 
12538 /* ARGSUSED */
12539 int
12540 ip_sioctl_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12541     ip_ioctl_cmd_t *ipip, void *if_req)
12542 {
12543 
12544 	ip1dbg(("ip_sioctl_metric(%s:%u %p)\n",
12545 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12546 	/*
12547 	 * Set interface metric.  We don't use this for
12548 	 * anything but we keep track of it in case it is
12549 	 * important to routing applications or such.
12550 	 */
12551 	if (ipip->ipi_cmd_type == IF_CMD) {
12552 		struct ifreq    *ifr;
12553 
12554 		ifr = (struct ifreq *)if_req;
12555 		ipif->ipif_metric = ifr->ifr_metric;
12556 	} else {
12557 		struct lifreq   *lifr;
12558 
12559 		lifr = (struct lifreq *)if_req;
12560 		ipif->ipif_metric = lifr->lifr_metric;
12561 	}
12562 	return (0);
12563 }
12564 
12565 
12566 /* ARGSUSED */
12567 int
12568 ip_sioctl_get_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12569     ip_ioctl_cmd_t *ipip, void *if_req)
12570 {
12571 
12572 	/* Get interface metric. */
12573 	ip1dbg(("ip_sioctl_get_metric(%s:%u %p)\n",
12574 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12575 	if (ipip->ipi_cmd_type == IF_CMD) {
12576 		struct ifreq    *ifr;
12577 
12578 		ifr = (struct ifreq *)if_req;
12579 		ifr->ifr_metric = ipif->ipif_metric;
12580 	} else {
12581 		struct lifreq   *lifr;
12582 
12583 		lifr = (struct lifreq *)if_req;
12584 		lifr->lifr_metric = ipif->ipif_metric;
12585 	}
12586 
12587 	return (0);
12588 }
12589 
12590 /* ARGSUSED */
12591 int
12592 ip_sioctl_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12593     ip_ioctl_cmd_t *ipip, void *if_req)
12594 {
12595 
12596 	ip1dbg(("ip_sioctl_muxid(%s:%u %p)\n",
12597 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12598 	/*
12599 	 * Set the muxid returned from I_PLINK.
12600 	 */
12601 	if (ipip->ipi_cmd_type == IF_CMD) {
12602 		struct ifreq *ifr = (struct ifreq *)if_req;
12603 
12604 		ipif->ipif_ill->ill_ip_muxid = ifr->ifr_ip_muxid;
12605 		ipif->ipif_ill->ill_arp_muxid = ifr->ifr_arp_muxid;
12606 	} else {
12607 		struct lifreq *lifr = (struct lifreq *)if_req;
12608 
12609 		ipif->ipif_ill->ill_ip_muxid = lifr->lifr_ip_muxid;
12610 		ipif->ipif_ill->ill_arp_muxid = lifr->lifr_arp_muxid;
12611 	}
12612 	return (0);
12613 }
12614 
12615 /* ARGSUSED */
12616 int
12617 ip_sioctl_get_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12618     ip_ioctl_cmd_t *ipip, void *if_req)
12619 {
12620 
12621 	ip1dbg(("ip_sioctl_get_muxid(%s:%u %p)\n",
12622 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12623 	/*
12624 	 * Get the muxid saved in ill for I_PUNLINK.
12625 	 */
12626 	if (ipip->ipi_cmd_type == IF_CMD) {
12627 		struct ifreq *ifr = (struct ifreq *)if_req;
12628 
12629 		ifr->ifr_ip_muxid = ipif->ipif_ill->ill_ip_muxid;
12630 		ifr->ifr_arp_muxid = ipif->ipif_ill->ill_arp_muxid;
12631 	} else {
12632 		struct lifreq *lifr = (struct lifreq *)if_req;
12633 
12634 		lifr->lifr_ip_muxid = ipif->ipif_ill->ill_ip_muxid;
12635 		lifr->lifr_arp_muxid = ipif->ipif_ill->ill_arp_muxid;
12636 	}
12637 	return (0);
12638 }
12639 
12640 /*
12641  * Set the subnet prefix. Does not modify the broadcast address.
12642  */
12643 /* ARGSUSED */
12644 int
12645 ip_sioctl_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12646     ip_ioctl_cmd_t *ipip, void *if_req)
12647 {
12648 	int err = 0;
12649 	in6_addr_t v6addr;
12650 	in6_addr_t v6mask;
12651 	boolean_t need_up = B_FALSE;
12652 	int addrlen;
12653 
12654 	ip1dbg(("ip_sioctl_subnet(%s:%u %p)\n",
12655 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12656 
12657 	ASSERT(IAM_WRITER_IPIF(ipif));
12658 	addrlen = ((struct lifreq *)if_req)->lifr_addrlen;
12659 
12660 	if (ipif->ipif_isv6) {
12661 		sin6_t *sin6;
12662 
12663 		if (sin->sin_family != AF_INET6)
12664 			return (EAFNOSUPPORT);
12665 
12666 		sin6 = (sin6_t *)sin;
12667 		v6addr = sin6->sin6_addr;
12668 		if (!ip_remote_addr_ok_v6(&v6addr, &ipv6_all_ones))
12669 			return (EADDRNOTAVAIL);
12670 	} else {
12671 		ipaddr_t addr;
12672 
12673 		if (sin->sin_family != AF_INET)
12674 			return (EAFNOSUPPORT);
12675 
12676 		addr = sin->sin_addr.s_addr;
12677 		if (!ip_addr_ok_v4(addr, 0xFFFFFFFF))
12678 			return (EADDRNOTAVAIL);
12679 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
12680 		/* Add 96 bits */
12681 		addrlen += IPV6_ABITS - IP_ABITS;
12682 	}
12683 
12684 	if (ip_plen_to_mask_v6(addrlen, &v6mask) == NULL)
12685 		return (EINVAL);
12686 
12687 	/* Check if bits in the address is set past the mask */
12688 	if (!V6_MASK_EQ(v6addr, v6mask, v6addr))
12689 		return (EINVAL);
12690 
12691 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6subnet, &v6addr) &&
12692 	    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6net_mask, &v6mask))
12693 		return (0);	/* No change */
12694 
12695 	if (ipif->ipif_flags & IPIF_UP) {
12696 		/*
12697 		 * If the interface is already marked up,
12698 		 * we call ipif_down which will take care
12699 		 * of ditching any IREs that have been set
12700 		 * up based on the old interface address.
12701 		 */
12702 		err = ipif_logical_down(ipif, q, mp);
12703 		if (err == EINPROGRESS)
12704 			return (err);
12705 		ipif_down_tail(ipif);
12706 		need_up = B_TRUE;
12707 	}
12708 
12709 	err = ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, need_up);
12710 	return (err);
12711 }
12712 
12713 static int
12714 ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t v6addr, in6_addr_t v6mask,
12715     queue_t *q, mblk_t *mp, boolean_t need_up)
12716 {
12717 	ill_t	*ill = ipif->ipif_ill;
12718 	int	err = 0;
12719 
12720 	ip1dbg(("ip_sioctl_subnet_tail(%s:%u %p)\n",
12721 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12722 
12723 	/* Set the new address. */
12724 	mutex_enter(&ill->ill_lock);
12725 	ipif->ipif_v6net_mask = v6mask;
12726 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
12727 		V6_MASK_COPY(v6addr, ipif->ipif_v6net_mask,
12728 		    ipif->ipif_v6subnet);
12729 	}
12730 	mutex_exit(&ill->ill_lock);
12731 
12732 	if (need_up) {
12733 		/*
12734 		 * Now bring the interface back up.  If this
12735 		 * is the only IPIF for the ILL, ipif_up
12736 		 * will have to re-bind to the device, so
12737 		 * we may get back EINPROGRESS, in which
12738 		 * case, this IOCTL will get completed in
12739 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
12740 		 */
12741 		err = ipif_up(ipif, q, mp);
12742 		if (err == EINPROGRESS)
12743 			return (err);
12744 	}
12745 	return (err);
12746 }
12747 
12748 /* ARGSUSED */
12749 int
12750 ip_sioctl_subnet_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12751     ip_ioctl_cmd_t *ipip, void *if_req)
12752 {
12753 	int	addrlen;
12754 	in6_addr_t v6addr;
12755 	in6_addr_t v6mask;
12756 	struct lifreq *lifr = (struct lifreq *)if_req;
12757 
12758 	ip1dbg(("ip_sioctl_subnet_restart(%s:%u %p)\n",
12759 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12760 	ipif_down_tail(ipif);
12761 
12762 	addrlen = lifr->lifr_addrlen;
12763 	if (ipif->ipif_isv6) {
12764 		sin6_t *sin6;
12765 
12766 		sin6 = (sin6_t *)sin;
12767 		v6addr = sin6->sin6_addr;
12768 	} else {
12769 		ipaddr_t addr;
12770 
12771 		addr = sin->sin_addr.s_addr;
12772 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
12773 		addrlen += IPV6_ABITS - IP_ABITS;
12774 	}
12775 	(void) ip_plen_to_mask_v6(addrlen, &v6mask);
12776 
12777 	return (ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, B_TRUE));
12778 }
12779 
12780 /* ARGSUSED */
12781 int
12782 ip_sioctl_get_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12783     ip_ioctl_cmd_t *ipip, void *if_req)
12784 {
12785 	struct lifreq *lifr = (struct lifreq *)if_req;
12786 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sin;
12787 
12788 	ip1dbg(("ip_sioctl_get_subnet(%s:%u %p)\n",
12789 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12790 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
12791 
12792 	if (ipif->ipif_isv6) {
12793 		*sin6 = sin6_null;
12794 		sin6->sin6_family = AF_INET6;
12795 		sin6->sin6_addr = ipif->ipif_v6subnet;
12796 		lifr->lifr_addrlen =
12797 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
12798 	} else {
12799 		*sin = sin_null;
12800 		sin->sin_family = AF_INET;
12801 		sin->sin_addr.s_addr = ipif->ipif_subnet;
12802 		lifr->lifr_addrlen = ip_mask_to_plen(ipif->ipif_net_mask);
12803 	}
12804 	return (0);
12805 }
12806 
12807 /*
12808  * Set the IPv6 address token.
12809  */
12810 /* ARGSUSED */
12811 int
12812 ip_sioctl_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12813     ip_ioctl_cmd_t *ipi, void *if_req)
12814 {
12815 	ill_t *ill = ipif->ipif_ill;
12816 	int err;
12817 	in6_addr_t v6addr;
12818 	in6_addr_t v6mask;
12819 	boolean_t need_up = B_FALSE;
12820 	int i;
12821 	sin6_t *sin6 = (sin6_t *)sin;
12822 	struct lifreq *lifr = (struct lifreq *)if_req;
12823 	int addrlen;
12824 
12825 	ip1dbg(("ip_sioctl_token(%s:%u %p)\n",
12826 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12827 	ASSERT(IAM_WRITER_IPIF(ipif));
12828 
12829 	addrlen = lifr->lifr_addrlen;
12830 	/* Only allow for logical unit zero i.e. not on "le0:17" */
12831 	if (ipif->ipif_id != 0)
12832 		return (EINVAL);
12833 
12834 	if (!ipif->ipif_isv6)
12835 		return (EINVAL);
12836 
12837 	if (addrlen > IPV6_ABITS)
12838 		return (EINVAL);
12839 
12840 	v6addr = sin6->sin6_addr;
12841 
12842 	/*
12843 	 * The length of the token is the length from the end.  To get
12844 	 * the proper mask for this, compute the mask of the bits not
12845 	 * in the token; ie. the prefix, and then xor to get the mask.
12846 	 */
12847 	if (ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask) == NULL)
12848 		return (EINVAL);
12849 	for (i = 0; i < 4; i++) {
12850 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
12851 	}
12852 
12853 	if (V6_MASK_EQ(v6addr, v6mask, ill->ill_token) &&
12854 	    ill->ill_token_length == addrlen)
12855 		return (0);	/* No change */
12856 
12857 	if (ipif->ipif_flags & IPIF_UP) {
12858 		err = ipif_logical_down(ipif, q, mp);
12859 		if (err == EINPROGRESS)
12860 			return (err);
12861 		ipif_down_tail(ipif);
12862 		need_up = B_TRUE;
12863 	}
12864 	err = ip_sioctl_token_tail(ipif, sin6, addrlen, q, mp, need_up);
12865 	return (err);
12866 }
12867 
12868 static int
12869 ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen, queue_t *q,
12870     mblk_t *mp, boolean_t need_up)
12871 {
12872 	in6_addr_t v6addr;
12873 	in6_addr_t v6mask;
12874 	ill_t	*ill = ipif->ipif_ill;
12875 	int	i;
12876 	int	err = 0;
12877 
12878 	ip1dbg(("ip_sioctl_token_tail(%s:%u %p)\n",
12879 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12880 	v6addr = sin6->sin6_addr;
12881 	/*
12882 	 * The length of the token is the length from the end.  To get
12883 	 * the proper mask for this, compute the mask of the bits not
12884 	 * in the token; ie. the prefix, and then xor to get the mask.
12885 	 */
12886 	(void) ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask);
12887 	for (i = 0; i < 4; i++)
12888 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
12889 
12890 	mutex_enter(&ill->ill_lock);
12891 	V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
12892 	ill->ill_token_length = addrlen;
12893 	mutex_exit(&ill->ill_lock);
12894 
12895 	if (need_up) {
12896 		/*
12897 		 * Now bring the interface back up.  If this
12898 		 * is the only IPIF for the ILL, ipif_up
12899 		 * will have to re-bind to the device, so
12900 		 * we may get back EINPROGRESS, in which
12901 		 * case, this IOCTL will get completed in
12902 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
12903 		 */
12904 		err = ipif_up(ipif, q, mp);
12905 		if (err == EINPROGRESS)
12906 			return (err);
12907 	}
12908 	return (err);
12909 }
12910 
12911 /* ARGSUSED */
12912 int
12913 ip_sioctl_get_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12914     ip_ioctl_cmd_t *ipi, void *if_req)
12915 {
12916 	ill_t *ill;
12917 	sin6_t *sin6 = (sin6_t *)sin;
12918 	struct lifreq *lifr = (struct lifreq *)if_req;
12919 
12920 	ip1dbg(("ip_sioctl_get_token(%s:%u %p)\n",
12921 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12922 	if (ipif->ipif_id != 0)
12923 		return (EINVAL);
12924 
12925 	ill = ipif->ipif_ill;
12926 	if (!ill->ill_isv6)
12927 		return (ENXIO);
12928 
12929 	*sin6 = sin6_null;
12930 	sin6->sin6_family = AF_INET6;
12931 	ASSERT(!IN6_IS_ADDR_V4MAPPED(&ill->ill_token));
12932 	sin6->sin6_addr = ill->ill_token;
12933 	lifr->lifr_addrlen = ill->ill_token_length;
12934 	return (0);
12935 }
12936 
12937 /*
12938  * Set (hardware) link specific information that might override
12939  * what was acquired through the DL_INFO_ACK.
12940  * The logic is as follows.
12941  *
12942  * become exclusive
12943  * set CHANGING flag
12944  * change mtu on affected IREs
12945  * clear CHANGING flag
12946  *
12947  * An ire add that occurs before the CHANGING flag is set will have its mtu
12948  * changed by the ip_sioctl_lnkinfo.
12949  *
12950  * During the time the CHANGING flag is set, no new ires will be added to the
12951  * bucket, and ire add will fail (due the CHANGING flag).
12952  *
12953  * An ire add that occurs after the CHANGING flag is set will have the right mtu
12954  * before it is added to the bucket.
12955  *
12956  * Obviously only 1 thread can set the CHANGING flag and we need to become
12957  * exclusive to set the flag.
12958  */
12959 /* ARGSUSED */
12960 int
12961 ip_sioctl_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12962     ip_ioctl_cmd_t *ipi, void *if_req)
12963 {
12964 	ill_t		*ill = ipif->ipif_ill;
12965 	ipif_t		*nipif;
12966 	int		ip_min_mtu;
12967 	boolean_t	mtu_walk = B_FALSE;
12968 	struct lifreq	*lifr = (struct lifreq *)if_req;
12969 	lif_ifinfo_req_t *lir;
12970 	ire_t		*ire;
12971 
12972 	ip1dbg(("ip_sioctl_lnkinfo(%s:%u %p)\n",
12973 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12974 	lir = &lifr->lifr_ifinfo;
12975 	ASSERT(IAM_WRITER_IPIF(ipif));
12976 
12977 	/* Only allow for logical unit zero i.e. not on "le0:17" */
12978 	if (ipif->ipif_id != 0)
12979 		return (EINVAL);
12980 
12981 	/* Set interface MTU. */
12982 	if (ipif->ipif_isv6)
12983 		ip_min_mtu = IPV6_MIN_MTU;
12984 	else
12985 		ip_min_mtu = IP_MIN_MTU;
12986 
12987 	/*
12988 	 * Verify values before we set anything. Allow zero to
12989 	 * mean unspecified.
12990 	 */
12991 	if (lir->lir_maxmtu != 0 &&
12992 	    (lir->lir_maxmtu > ill->ill_max_frag ||
12993 	    lir->lir_maxmtu < ip_min_mtu))
12994 		return (EINVAL);
12995 	if (lir->lir_reachtime != 0 &&
12996 	    lir->lir_reachtime > ND_MAX_REACHTIME)
12997 		return (EINVAL);
12998 	if (lir->lir_reachretrans != 0 &&
12999 	    lir->lir_reachretrans > ND_MAX_REACHRETRANSTIME)
13000 		return (EINVAL);
13001 
13002 	mutex_enter(&ill->ill_lock);
13003 	ill->ill_state_flags |= ILL_CHANGING;
13004 	for (nipif = ill->ill_ipif; nipif != NULL;
13005 	    nipif = nipif->ipif_next) {
13006 		nipif->ipif_state_flags |= IPIF_CHANGING;
13007 	}
13008 
13009 	mutex_exit(&ill->ill_lock);
13010 
13011 	if (lir->lir_maxmtu != 0) {
13012 		ill->ill_max_mtu = lir->lir_maxmtu;
13013 		ill->ill_mtu_userspecified = 1;
13014 		mtu_walk = B_TRUE;
13015 	}
13016 
13017 	if (lir->lir_reachtime != 0)
13018 		ill->ill_reachable_time = lir->lir_reachtime;
13019 
13020 	if (lir->lir_reachretrans != 0)
13021 		ill->ill_reachable_retrans_time = lir->lir_reachretrans;
13022 
13023 	ill->ill_max_hops = lir->lir_maxhops;
13024 
13025 	ill->ill_max_buf = ND_MAX_Q;
13026 
13027 	if (mtu_walk) {
13028 		/*
13029 		 * Set the MTU on all ipifs associated with this ill except
13030 		 * for those whose MTU was fixed via SIOCSLIFMTU.
13031 		 */
13032 		for (nipif = ill->ill_ipif; nipif != NULL;
13033 		    nipif = nipif->ipif_next) {
13034 			if (nipif->ipif_flags & IPIF_FIXEDMTU)
13035 				continue;
13036 
13037 			nipif->ipif_mtu = ill->ill_max_mtu;
13038 
13039 			if (!(nipif->ipif_flags & IPIF_UP))
13040 				continue;
13041 
13042 			if (nipif->ipif_isv6)
13043 				ire = ipif_to_ire_v6(nipif);
13044 			else
13045 				ire = ipif_to_ire(nipif);
13046 			if (ire != NULL) {
13047 				ire->ire_max_frag = ipif->ipif_mtu;
13048 				ire_refrele(ire);
13049 			}
13050 			if (ill->ill_isv6) {
13051 				ire_walk_ill_v6(MATCH_IRE_ILL, 0,
13052 				    ipif_mtu_change, (char *)nipif,
13053 				    ill);
13054 			} else {
13055 				ire_walk_ill_v4(MATCH_IRE_ILL, 0,
13056 				    ipif_mtu_change, (char *)nipif,
13057 				    ill);
13058 			}
13059 		}
13060 	}
13061 
13062 	mutex_enter(&ill->ill_lock);
13063 	for (nipif = ill->ill_ipif; nipif != NULL;
13064 	    nipif = nipif->ipif_next) {
13065 		nipif->ipif_state_flags &= ~IPIF_CHANGING;
13066 	}
13067 	ILL_UNMARK_CHANGING(ill);
13068 	mutex_exit(&ill->ill_lock);
13069 
13070 	return (0);
13071 }
13072 
13073 /* ARGSUSED */
13074 int
13075 ip_sioctl_get_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
13076     ip_ioctl_cmd_t *ipi, void *if_req)
13077 {
13078 	struct lif_ifinfo_req *lir;
13079 	ill_t *ill = ipif->ipif_ill;
13080 
13081 	ip1dbg(("ip_sioctl_get_lnkinfo(%s:%u %p)\n",
13082 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
13083 	if (ipif->ipif_id != 0)
13084 		return (EINVAL);
13085 
13086 	lir = &((struct lifreq *)if_req)->lifr_ifinfo;
13087 	lir->lir_maxhops = ill->ill_max_hops;
13088 	lir->lir_reachtime = ill->ill_reachable_time;
13089 	lir->lir_reachretrans = ill->ill_reachable_retrans_time;
13090 	lir->lir_maxmtu = ill->ill_max_mtu;
13091 
13092 	return (0);
13093 }
13094 
13095 /*
13096  * Return best guess as to the subnet mask for the specified address.
13097  * Based on the subnet masks for all the configured interfaces.
13098  *
13099  * We end up returning a zero mask in the case of default, multicast or
13100  * experimental.
13101  */
13102 static ipaddr_t
13103 ip_subnet_mask(ipaddr_t addr, ipif_t **ipifp)
13104 {
13105 	ipaddr_t net_mask;
13106 	ill_t	*ill;
13107 	ipif_t	*ipif;
13108 	ill_walk_context_t ctx;
13109 	ipif_t	*fallback_ipif = NULL;
13110 
13111 	net_mask = ip_net_mask(addr);
13112 	if (net_mask == 0) {
13113 		*ipifp = NULL;
13114 		return (0);
13115 	}
13116 
13117 	/* Let's check to see if this is maybe a local subnet route. */
13118 	/* this function only applies to IPv4 interfaces */
13119 	rw_enter(&ill_g_lock, RW_READER);
13120 	ill = ILL_START_WALK_V4(&ctx);
13121 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
13122 		mutex_enter(&ill->ill_lock);
13123 		for (ipif = ill->ill_ipif; ipif != NULL;
13124 		    ipif = ipif->ipif_next) {
13125 			if (!IPIF_CAN_LOOKUP(ipif))
13126 				continue;
13127 			if (!(ipif->ipif_flags & IPIF_UP))
13128 				continue;
13129 			if ((ipif->ipif_subnet & net_mask) ==
13130 			    (addr & net_mask)) {
13131 				/*
13132 				 * Don't trust pt-pt interfaces if there are
13133 				 * other interfaces.
13134 				 */
13135 				if (ipif->ipif_flags & IPIF_POINTOPOINT) {
13136 					if (fallback_ipif == NULL) {
13137 						ipif_refhold_locked(ipif);
13138 						fallback_ipif = ipif;
13139 					}
13140 					continue;
13141 				}
13142 
13143 				/*
13144 				 * Fine. Just assume the same net mask as the
13145 				 * directly attached subnet interface is using.
13146 				 */
13147 				ipif_refhold_locked(ipif);
13148 				mutex_exit(&ill->ill_lock);
13149 				rw_exit(&ill_g_lock);
13150 				if (fallback_ipif != NULL)
13151 					ipif_refrele(fallback_ipif);
13152 				*ipifp = ipif;
13153 				return (ipif->ipif_net_mask);
13154 			}
13155 		}
13156 		mutex_exit(&ill->ill_lock);
13157 	}
13158 	rw_exit(&ill_g_lock);
13159 
13160 	*ipifp = fallback_ipif;
13161 	return ((fallback_ipif != NULL) ?
13162 	    fallback_ipif->ipif_net_mask : net_mask);
13163 }
13164 
13165 /*
13166  * ip_sioctl_copyin_setup calls ip_wput_ioctl to process the IP_IOCTL ioctl.
13167  */
13168 static void
13169 ip_wput_ioctl(queue_t *q, mblk_t *mp)
13170 {
13171 	IOCP	iocp;
13172 	ipft_t	*ipft;
13173 	ipllc_t	*ipllc;
13174 	mblk_t	*mp1;
13175 	cred_t	*cr;
13176 	int	error = 0;
13177 	conn_t	*connp;
13178 
13179 	ip1dbg(("ip_wput_ioctl"));
13180 	iocp = (IOCP)mp->b_rptr;
13181 	mp1 = mp->b_cont;
13182 	if (mp1 == NULL) {
13183 		iocp->ioc_error = EINVAL;
13184 		mp->b_datap->db_type = M_IOCNAK;
13185 		iocp->ioc_count = 0;
13186 		qreply(q, mp);
13187 		return;
13188 	}
13189 
13190 	/*
13191 	 * These IOCTLs provide various control capabilities to
13192 	 * upstream agents such as ULPs and processes.	There
13193 	 * are currently two such IOCTLs implemented.  They
13194 	 * are used by TCP to provide update information for
13195 	 * existing IREs and to forcibly delete an IRE for a
13196 	 * host that is not responding, thereby forcing an
13197 	 * attempt at a new route.
13198 	 */
13199 	iocp->ioc_error = EINVAL;
13200 	if (!pullupmsg(mp1, sizeof (ipllc->ipllc_cmd)))
13201 		goto done;
13202 
13203 	ipllc = (ipllc_t *)mp1->b_rptr;
13204 	for (ipft = ip_ioctl_ftbl; ipft->ipft_pfi; ipft++) {
13205 		if (ipllc->ipllc_cmd == ipft->ipft_cmd)
13206 			break;
13207 	}
13208 	/*
13209 	 * prefer credential from mblk over ioctl;
13210 	 * see ip_sioctl_copyin_setup
13211 	 */
13212 	cr = DB_CREDDEF(mp, iocp->ioc_cr);
13213 
13214 	/*
13215 	 * Refhold the conn in case the request gets queued up in some lookup
13216 	 */
13217 	ASSERT(CONN_Q(q));
13218 	connp = Q_TO_CONN(q);
13219 	CONN_INC_REF(connp);
13220 	if (ipft->ipft_pfi &&
13221 	    ((mp1->b_wptr - mp1->b_rptr) >= ipft->ipft_min_size ||
13222 		pullupmsg(mp1, ipft->ipft_min_size))) {
13223 		error = (*ipft->ipft_pfi)(q,
13224 		    (ipft->ipft_flags & IPFT_F_SELF_REPLY) ? mp : mp1, cr);
13225 	}
13226 	if (ipft->ipft_flags & IPFT_F_SELF_REPLY) {
13227 		/*
13228 		 * CONN_OPER_PENDING_DONE happens in the function called
13229 		 * through ipft_pfi above.
13230 		 */
13231 		return;
13232 	}
13233 
13234 	CONN_OPER_PENDING_DONE(connp);
13235 	if (ipft->ipft_flags & IPFT_F_NO_REPLY) {
13236 		freemsg(mp);
13237 		return;
13238 	}
13239 	iocp->ioc_error = error;
13240 
13241 done:
13242 	mp->b_datap->db_type = M_IOCACK;
13243 	if (iocp->ioc_error)
13244 		iocp->ioc_count = 0;
13245 	qreply(q, mp);
13246 }
13247 
13248 /*
13249  * Lookup an ipif using the sequence id (ipif_seqid)
13250  */
13251 ipif_t *
13252 ipif_lookup_seqid(ill_t *ill, uint_t seqid)
13253 {
13254 	ipif_t *ipif;
13255 
13256 	ASSERT(MUTEX_HELD(&ill->ill_lock));
13257 
13258 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13259 		if (ipif->ipif_seqid == seqid && IPIF_CAN_LOOKUP(ipif))
13260 			return (ipif);
13261 	}
13262 	return (NULL);
13263 }
13264 
13265 uint64_t ipif_g_seqid;
13266 
13267 /*
13268  * Assign a unique id for the ipif. This is used later when we send
13269  * IRES to ARP for resolution where we initialize ire_ipif_seqid
13270  * to the value pointed by ire_ipif->ipif_seqid. Later when the
13271  * IRE is added, we verify that ipif has not disappeared.
13272  */
13273 
13274 static void
13275 ipif_assign_seqid(ipif_t *ipif)
13276 {
13277 	ipif->ipif_seqid = atomic_add_64_nv(&ipif_g_seqid, 1);
13278 }
13279 
13280 /*
13281  * Insert the ipif, so that the list of ipifs on the ill will be sorted
13282  * with respect to ipif_id. Note that an ipif with an ipif_id of -1 will
13283  * be inserted into the first space available in the list. The value of
13284  * ipif_id will then be set to the appropriate value for its position.
13285  */
13286 static int
13287 ipif_insert(ipif_t *ipif, boolean_t acquire_g_lock, boolean_t acquire_ill_lock)
13288 {
13289 	ill_t *ill;
13290 	ipif_t *tipif;
13291 	ipif_t **tipifp;
13292 	int id;
13293 
13294 	ASSERT(ipif->ipif_ill->ill_net_type == IRE_LOOPBACK ||
13295 	    IAM_WRITER_IPIF(ipif));
13296 
13297 	ill = ipif->ipif_ill;
13298 	ASSERT(ill != NULL);
13299 
13300 	/*
13301 	 * In the case of lo0:0 we already hold the ill_g_lock.
13302 	 * ill_lookup_on_name (acquires ill_g_lock) -> ipif_allocate ->
13303 	 * ipif_insert. Another such caller is ipif_move.
13304 	 */
13305 	if (acquire_g_lock)
13306 		rw_enter(&ill_g_lock, RW_WRITER);
13307 	if (acquire_ill_lock)
13308 		mutex_enter(&ill->ill_lock);
13309 	id = ipif->ipif_id;
13310 	tipifp = &(ill->ill_ipif);
13311 	if (id == -1) {	/* need to find a real id */
13312 		id = 0;
13313 		while ((tipif = *tipifp) != NULL) {
13314 			ASSERT(tipif->ipif_id >= id);
13315 			if (tipif->ipif_id != id)
13316 				break; /* non-consecutive id */
13317 			id++;
13318 			tipifp = &(tipif->ipif_next);
13319 		}
13320 		/* limit number of logical interfaces */
13321 		if (id >= ip_addrs_per_if) {
13322 			if (acquire_ill_lock)
13323 				mutex_exit(&ill->ill_lock);
13324 			if (acquire_g_lock)
13325 				rw_exit(&ill_g_lock);
13326 			return (-1);
13327 		}
13328 		ipif->ipif_id = id; /* assign new id */
13329 	} else if (id < ip_addrs_per_if) {
13330 		/* we have a real id; insert ipif in the right place */
13331 		while ((tipif = *tipifp) != NULL) {
13332 			ASSERT(tipif->ipif_id != id);
13333 			if (tipif->ipif_id > id)
13334 				break; /* found correct location */
13335 			tipifp = &(tipif->ipif_next);
13336 		}
13337 	} else {
13338 		if (acquire_ill_lock)
13339 			mutex_exit(&ill->ill_lock);
13340 		if (acquire_g_lock)
13341 			rw_exit(&ill_g_lock);
13342 		return (-1);
13343 	}
13344 
13345 	ASSERT(tipifp != &(ill->ill_ipif) || id == 0);
13346 
13347 	ipif->ipif_next = tipif;
13348 	*tipifp = ipif;
13349 	if (acquire_ill_lock)
13350 		mutex_exit(&ill->ill_lock);
13351 	if (acquire_g_lock)
13352 		rw_exit(&ill_g_lock);
13353 	return (0);
13354 }
13355 
13356 /*
13357  * Allocate and initialize a new interface control structure.  (Always
13358  * called as writer.)
13359  * When ipif_allocate() is called from ip_ll_subnet_defaults, the ill
13360  * is not part of the global linked list of ills. ipif_seqid is unique
13361  * in the system and to preserve the uniqueness, it is assigned only
13362  * when ill becomes part of the global list. At that point ill will
13363  * have a name. If it doesn't get assigned here, it will get assigned
13364  * in ipif_set_values() as part of SIOCSLIFNAME processing.
13365  * Aditionally, if we come here from ip_ll_subnet_defaults, we don't set
13366  * the interface flags or any other information from the DL_INFO_ACK for
13367  * DL_STYLE2 drivers (initialize == B_FALSE), since we won't have them at
13368  * this point. The flags etc. will be set in ip_ll_subnet_defaults when the
13369  * second DL_INFO_ACK comes in from the driver.
13370  */
13371 static ipif_t *
13372 ipif_allocate(ill_t *ill, int id, uint_t ire_type, boolean_t initialize)
13373 {
13374 	ipif_t	*ipif;
13375 	phyint_t *phyi;
13376 
13377 	ip1dbg(("ipif_allocate(%s:%d ill %p)\n",
13378 	    ill->ill_name, id, (void *)ill));
13379 	ASSERT(ire_type == IRE_LOOPBACK || IAM_WRITER_ILL(ill));
13380 
13381 	if ((ipif = (ipif_t *)mi_alloc(sizeof (ipif_t), BPRI_MED)) == NULL)
13382 		return (NULL);
13383 	*ipif = ipif_zero;	/* start clean */
13384 
13385 	ipif->ipif_ill = ill;
13386 	ipif->ipif_id = id;	/* could be -1 */
13387 	ipif->ipif_zoneid = GLOBAL_ZONEID;
13388 
13389 	mutex_init(&ipif->ipif_saved_ire_lock, NULL, MUTEX_DEFAULT, NULL);
13390 
13391 	ipif->ipif_refcnt = 0;
13392 	ipif->ipif_saved_ire_cnt = 0;
13393 
13394 	if (ipif_insert(ipif, ire_type != IRE_LOOPBACK, B_TRUE)) {
13395 		mi_free(ipif);
13396 		return (NULL);
13397 	}
13398 	/* -1 id should have been replaced by real id */
13399 	id = ipif->ipif_id;
13400 	ASSERT(id >= 0);
13401 
13402 	if (ill->ill_name[0] != '\0') {
13403 		ipif_assign_seqid(ipif);
13404 		if (ill->ill_phyint->phyint_ifindex != 0)
13405 			sctp_update_ipif(ipif, SCTP_IPIF_INSERT);
13406 	}
13407 	/*
13408 	 * Keep a copy of original id in ipif_orig_ipifid.  Failback
13409 	 * will attempt to restore the original id.  The SIOCSLIFOINDEX
13410 	 * ioctl sets ipif_orig_ipifid to zero.
13411 	 */
13412 	ipif->ipif_orig_ipifid = id;
13413 
13414 	/*
13415 	 * We grab the ill_lock and phyint_lock to protect the flag changes.
13416 	 * The ipif is still not up and can't be looked up until the
13417 	 * ioctl completes and the IPIF_CHANGING flag is cleared.
13418 	 */
13419 	mutex_enter(&ill->ill_lock);
13420 	mutex_enter(&ill->ill_phyint->phyint_lock);
13421 	/*
13422 	 * Set the running flag when logical interface zero is created.
13423 	 * For subsequent logical interfaces, a DLPI link down
13424 	 * notification message may have cleared the running flag to
13425 	 * indicate the link is down, so we shouldn't just blindly set it.
13426 	 */
13427 	if (id == 0)
13428 		ill->ill_phyint->phyint_flags |= PHYI_RUNNING;
13429 	ipif->ipif_ire_type = ire_type;
13430 	phyi = ill->ill_phyint;
13431 	ipif->ipif_orig_ifindex = phyi->phyint_ifindex;
13432 
13433 	if (ipif->ipif_isv6) {
13434 		ill->ill_flags |= ILLF_IPV6;
13435 	} else {
13436 		ipaddr_t inaddr_any = INADDR_ANY;
13437 
13438 		ill->ill_flags |= ILLF_IPV4;
13439 
13440 		/* Keep the IN6_IS_ADDR_V4MAPPED assertions happy */
13441 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13442 		    &ipif->ipif_v6lcl_addr);
13443 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13444 		    &ipif->ipif_v6src_addr);
13445 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13446 		    &ipif->ipif_v6subnet);
13447 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13448 		    &ipif->ipif_v6net_mask);
13449 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13450 		    &ipif->ipif_v6brd_addr);
13451 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13452 		    &ipif->ipif_v6pp_dst_addr);
13453 	}
13454 
13455 	/*
13456 	 * Don't set the interface flags etc. now, will do it in
13457 	 * ip_ll_subnet_defaults.
13458 	 */
13459 	if (!initialize) {
13460 		mutex_exit(&ill->ill_lock);
13461 		mutex_exit(&ill->ill_phyint->phyint_lock);
13462 		return (ipif);
13463 	}
13464 	ipif->ipif_mtu = ill->ill_max_mtu;
13465 
13466 	if (ill->ill_bcast_addr_length != 0) {
13467 		/*
13468 		 * Later detect lack of DLPI driver multicast
13469 		 * capability by catching DL_ENABMULTI errors in
13470 		 * ip_rput_dlpi.
13471 		 */
13472 		ill->ill_flags |= ILLF_MULTICAST;
13473 		if (!ipif->ipif_isv6)
13474 			ipif->ipif_flags |= IPIF_BROADCAST;
13475 	} else {
13476 		if (ill->ill_net_type != IRE_LOOPBACK) {
13477 			if (ipif->ipif_isv6)
13478 				/*
13479 				 * Note: xresolv interfaces will eventually need
13480 				 * NOARP set here as well, but that will require
13481 				 * those external resolvers to have some
13482 				 * knowledge of that flag and act appropriately.
13483 				 * Not to be changed at present.
13484 				 */
13485 				ill->ill_flags |= ILLF_NONUD;
13486 			else
13487 				ill->ill_flags |= ILLF_NOARP;
13488 		}
13489 		if (ill->ill_phys_addr_length == 0) {
13490 			if (ill->ill_media &&
13491 			    ill->ill_media->ip_m_mac_type == SUNW_DL_VNI) {
13492 				ipif->ipif_flags |= IPIF_NOXMIT;
13493 				phyi->phyint_flags |= PHYI_VIRTUAL;
13494 			} else {
13495 				/* pt-pt supports multicast. */
13496 				ill->ill_flags |= ILLF_MULTICAST;
13497 				if (ill->ill_net_type == IRE_LOOPBACK) {
13498 					phyi->phyint_flags |=
13499 					    (PHYI_LOOPBACK | PHYI_VIRTUAL);
13500 				} else {
13501 					ipif->ipif_flags |= IPIF_POINTOPOINT;
13502 				}
13503 			}
13504 		}
13505 	}
13506 	mutex_exit(&ill->ill_lock);
13507 	mutex_exit(&ill->ill_phyint->phyint_lock);
13508 	return (ipif);
13509 }
13510 
13511 /*
13512  * If appropriate, send a message up to the resolver delete the entry
13513  * for the address of this interface which is going out of business.
13514  * (Always called as writer).
13515  *
13516  * NOTE : We need to check for NULL mps as some of the fields are
13517  *	  initialized only for some interface types. See ipif_resolver_up()
13518  *	  for details.
13519  */
13520 void
13521 ipif_arp_down(ipif_t *ipif)
13522 {
13523 	mblk_t	*mp;
13524 	ill_t	*ill = ipif->ipif_ill;
13525 
13526 	ip1dbg(("ipif_arp_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
13527 	ASSERT(IAM_WRITER_IPIF(ipif));
13528 
13529 	/* Delete the mapping for the local address */
13530 	mp = ipif->ipif_arp_del_mp;
13531 	if (mp != NULL) {
13532 		ip1dbg(("ipif_arp_down: arp cmd %x for %s:%u\n",
13533 		    *(unsigned *)mp->b_rptr, ill->ill_name, ipif->ipif_id));
13534 		putnext(ill->ill_rq, mp);
13535 		ipif->ipif_arp_del_mp = NULL;
13536 	}
13537 
13538 	/*
13539 	 * If this is the last ipif that is going down and there are no
13540 	 * duplicate addresses we may yet attempt to re-probe, then we need to
13541 	 * clean up ARP completely.
13542 	 */
13543 	if (ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0) {
13544 
13545 		/* Send up AR_INTERFACE_DOWN message */
13546 		mp = ill->ill_arp_down_mp;
13547 		if (mp != NULL) {
13548 			ip1dbg(("ipif_arp_down: arp cmd %x for %s:%u\n",
13549 			    *(unsigned *)mp->b_rptr, ill->ill_name,
13550 			    ipif->ipif_id));
13551 			putnext(ill->ill_rq, mp);
13552 			ill->ill_arp_down_mp = NULL;
13553 		}
13554 
13555 		/* Tell ARP to delete the multicast mappings */
13556 		mp = ill->ill_arp_del_mapping_mp;
13557 		if (mp != NULL) {
13558 			ip1dbg(("ipif_arp_down: arp cmd %x for %s:%u\n",
13559 			    *(unsigned *)mp->b_rptr, ill->ill_name,
13560 			    ipif->ipif_id));
13561 			putnext(ill->ill_rq, mp);
13562 			ill->ill_arp_del_mapping_mp = NULL;
13563 		}
13564 	}
13565 }
13566 
13567 /*
13568  * This function sets up the multicast mappings in ARP. When ipif_resolver_up
13569  * calls this function, it passes a non-NULL arp_add_mapping_mp indicating
13570  * that it wants the add_mp allocated in this function to be returned
13571  * wihtout sending it to arp. When ip_rput_dlpi_writer calls this to
13572  * just re-do the multicast, it wants us to send the add_mp to ARP also.
13573  * ipif_resolver_up does not want us to do the "add" i.e sending to ARP,
13574  * as it does a ipif_arp_down after calling this function - which will
13575  * remove what we add here.
13576  *
13577  * Returns -1 on failures and 0 on success.
13578  */
13579 int
13580 ipif_arp_setup_multicast(ipif_t *ipif, mblk_t **arp_add_mapping_mp)
13581 {
13582 	mblk_t	*del_mp = NULL;
13583 	mblk_t *add_mp = NULL;
13584 	mblk_t *mp;
13585 	ill_t	*ill = ipif->ipif_ill;
13586 	phyint_t *phyi = ill->ill_phyint;
13587 	ipaddr_t addr, mask, extract_mask = 0;
13588 	arma_t	*arma;
13589 	uint8_t *maddr, *bphys_addr;
13590 	uint32_t hw_start;
13591 	dl_unitdata_req_t *dlur;
13592 
13593 	ASSERT(IAM_WRITER_IPIF(ipif));
13594 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
13595 		return (0);
13596 
13597 	/*
13598 	 * Delete the existing mapping from ARP. Normally ipif_down
13599 	 * -> ipif_arp_down should send this up to ARP. The only
13600 	 * reason we would find this when we are switching from
13601 	 * Multicast to Broadcast where we did not do a down.
13602 	 */
13603 	mp = ill->ill_arp_del_mapping_mp;
13604 	if (mp != NULL) {
13605 		ip1dbg(("ipif_arp_down: arp cmd %x for %s:%u\n",
13606 		    *(unsigned *)mp->b_rptr, ill->ill_name, ipif->ipif_id));
13607 		putnext(ill->ill_rq, mp);
13608 		ill->ill_arp_del_mapping_mp = NULL;
13609 	}
13610 
13611 	if (arp_add_mapping_mp != NULL)
13612 		*arp_add_mapping_mp = NULL;
13613 
13614 	/*
13615 	 * Check that the address is not to long for the constant
13616 	 * length reserved in the template arma_t.
13617 	 */
13618 	if (ill->ill_phys_addr_length > IP_MAX_HW_LEN)
13619 		return (-1);
13620 
13621 	/* Add mapping mblk */
13622 	addr = (ipaddr_t)htonl(INADDR_UNSPEC_GROUP);
13623 	mask = (ipaddr_t)htonl(IN_CLASSD_NET);
13624 	add_mp = ill_arp_alloc(ill, (uchar_t *)&ip_arma_multi_template,
13625 	    (caddr_t)&addr);
13626 	if (add_mp == NULL)
13627 		return (-1);
13628 	arma = (arma_t *)add_mp->b_rptr;
13629 	maddr = (uint8_t *)arma + arma->arma_hw_addr_offset;
13630 	bcopy(&mask, (char *)arma + arma->arma_proto_mask_offset, IP_ADDR_LEN);
13631 	arma->arma_hw_addr_length = ill->ill_phys_addr_length;
13632 
13633 	/*
13634 	 * Determine the broadcast address.
13635 	 */
13636 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
13637 	if (ill->ill_sap_length < 0)
13638 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
13639 	else
13640 		bphys_addr = (uchar_t *)dlur +
13641 		    dlur->dl_dest_addr_offset + ill->ill_sap_length;
13642 	/*
13643 	 * Check PHYI_MULTI_BCAST and length of physical
13644 	 * address to determine if we use the mapping or the
13645 	 * broadcast address.
13646 	 */
13647 	if (!(phyi->phyint_flags & PHYI_MULTI_BCAST))
13648 		if (!MEDIA_V4MINFO(ill->ill_media, ill->ill_phys_addr_length,
13649 		    bphys_addr, maddr, &hw_start, &extract_mask))
13650 			phyi->phyint_flags |= PHYI_MULTI_BCAST;
13651 
13652 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) ||
13653 	    (ill->ill_flags & ILLF_MULTICAST)) {
13654 		/* Make sure this will not match the "exact" entry. */
13655 		addr = (ipaddr_t)htonl(INADDR_ALLHOSTS_GROUP);
13656 		del_mp = ill_arp_alloc(ill, (uchar_t *)&ip_ared_template,
13657 		    (caddr_t)&addr);
13658 		if (del_mp == NULL) {
13659 			freemsg(add_mp);
13660 			return (-1);
13661 		}
13662 		bcopy(&extract_mask, (char *)arma +
13663 		    arma->arma_proto_extract_mask_offset, IP_ADDR_LEN);
13664 		if (phyi->phyint_flags & PHYI_MULTI_BCAST) {
13665 			/* Use link-layer broadcast address for MULTI_BCAST */
13666 			bcopy(bphys_addr, maddr, ill->ill_phys_addr_length);
13667 			ip2dbg(("ipif_arp_setup_multicast: adding"
13668 			    " MULTI_BCAST ARP setup for %s\n", ill->ill_name));
13669 		} else {
13670 			arma->arma_hw_mapping_start = hw_start;
13671 			ip2dbg(("ipif_arp_setup_multicast: adding multicast"
13672 			    " ARP setup for %s\n", ill->ill_name));
13673 		}
13674 	} else {
13675 		freemsg(add_mp);
13676 		ASSERT(del_mp == NULL);
13677 		/* It is neither MULTICAST nor MULTI_BCAST */
13678 		return (0);
13679 	}
13680 	ASSERT(add_mp != NULL && del_mp != NULL);
13681 	ASSERT(ill->ill_arp_del_mapping_mp == NULL);
13682 	ill->ill_arp_del_mapping_mp = del_mp;
13683 	if (arp_add_mapping_mp != NULL) {
13684 		/* The caller just wants the mblks allocated */
13685 		*arp_add_mapping_mp = add_mp;
13686 	} else {
13687 		/* The caller wants us to send it to arp */
13688 		putnext(ill->ill_rq, add_mp);
13689 	}
13690 	return (0);
13691 }
13692 
13693 /*
13694  * Get the resolver set up for a new interface address.
13695  * (Always called as writer.)
13696  * Called both for IPv4 and IPv6 interfaces,
13697  * though it only sets up the resolver for v6
13698  * if it's an xresolv interface (one using an external resolver).
13699  * Honors ILLF_NOARP.
13700  * The enumerated value res_act is used to tune the behavior.
13701  * If set to Res_act_initial, then we set up all the resolver
13702  * structures for a new interface.  If set to Res_act_move, then
13703  * we just send an AR_ENTRY_ADD message up to ARP for IPv4
13704  * interfaces; this is called by ip_rput_dlpi_writer() to handle
13705  * asynchronous hardware address change notification.  If set to
13706  * Res_act_defend, then we tell ARP that it needs to send a single
13707  * gratuitous message in defense of the address.
13708  * Returns error on failure.
13709  */
13710 int
13711 ipif_resolver_up(ipif_t *ipif, enum ip_resolver_action res_act)
13712 {
13713 	caddr_t	addr;
13714 	mblk_t	*arp_up_mp = NULL;
13715 	mblk_t	*arp_down_mp = NULL;
13716 	mblk_t	*arp_add_mp = NULL;
13717 	mblk_t	*arp_del_mp = NULL;
13718 	mblk_t	*arp_add_mapping_mp = NULL;
13719 	mblk_t	*arp_del_mapping_mp = NULL;
13720 	ill_t	*ill = ipif->ipif_ill;
13721 	uchar_t	*area_p = NULL;
13722 	uchar_t	*ared_p = NULL;
13723 	int	err = ENOMEM;
13724 	boolean_t was_dup;
13725 
13726 	ip1dbg(("ipif_resolver_up(%s:%u) flags 0x%x\n",
13727 	    ill->ill_name, ipif->ipif_id, (uint_t)ipif->ipif_flags));
13728 	ASSERT(IAM_WRITER_IPIF(ipif));
13729 
13730 	was_dup = B_FALSE;
13731 	if (res_act == Res_act_initial) {
13732 		ipif->ipif_addr_ready = 0;
13733 		/*
13734 		 * We're bringing an interface up here.  There's no way that we
13735 		 * should need to shut down ARP now.
13736 		 */
13737 		mutex_enter(&ill->ill_lock);
13738 		if (ipif->ipif_flags & IPIF_DUPLICATE) {
13739 			ipif->ipif_flags &= ~IPIF_DUPLICATE;
13740 			ill->ill_ipif_dup_count--;
13741 			was_dup = B_TRUE;
13742 		}
13743 		mutex_exit(&ill->ill_lock);
13744 	}
13745 	if (ipif->ipif_recovery_id != 0)
13746 		(void) untimeout(ipif->ipif_recovery_id);
13747 	ipif->ipif_recovery_id = 0;
13748 	if (ill->ill_net_type != IRE_IF_RESOLVER) {
13749 		ipif->ipif_addr_ready = 1;
13750 		return (0);
13751 	}
13752 	/* NDP will set the ipif_addr_ready flag when it's ready */
13753 	if (ill->ill_isv6 && !(ill->ill_flags & ILLF_XRESOLV))
13754 		return (0);
13755 
13756 	if (ill->ill_isv6) {
13757 		/*
13758 		 * External resolver for IPv6
13759 		 */
13760 		ASSERT(res_act == Res_act_initial);
13761 		if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
13762 			addr = (caddr_t)&ipif->ipif_v6lcl_addr;
13763 			area_p = (uchar_t *)&ip6_area_template;
13764 			ared_p = (uchar_t *)&ip6_ared_template;
13765 		}
13766 	} else {
13767 		/*
13768 		 * IPv4 arp case. If the ARP stream has already started
13769 		 * closing, fail this request for ARP bringup. Else
13770 		 * record the fact that an ARP bringup is pending.
13771 		 */
13772 		mutex_enter(&ill->ill_lock);
13773 		if (ill->ill_arp_closing) {
13774 			mutex_exit(&ill->ill_lock);
13775 			err = EINVAL;
13776 			goto failed;
13777 		} else {
13778 			if (ill->ill_ipif_up_count == 0 &&
13779 			    ill->ill_ipif_dup_count == 0 && !was_dup)
13780 				ill->ill_arp_bringup_pending = 1;
13781 			mutex_exit(&ill->ill_lock);
13782 		}
13783 		if (ipif->ipif_lcl_addr != INADDR_ANY) {
13784 			addr = (caddr_t)&ipif->ipif_lcl_addr;
13785 			area_p = (uchar_t *)&ip_area_template;
13786 			ared_p = (uchar_t *)&ip_ared_template;
13787 		}
13788 	}
13789 
13790 	/*
13791 	 * Add an entry for the local address in ARP only if it
13792 	 * is not UNNUMBERED and the address is not INADDR_ANY.
13793 	 */
13794 	if (!(ipif->ipif_flags & IPIF_UNNUMBERED) && area_p != NULL) {
13795 		area_t *area;
13796 
13797 		/* Now ask ARP to publish our address. */
13798 		arp_add_mp = ill_arp_alloc(ill, area_p, addr);
13799 		if (arp_add_mp == NULL)
13800 			goto failed;
13801 		area = (area_t *)arp_add_mp->b_rptr;
13802 		if (res_act != Res_act_initial) {
13803 			/*
13804 			 * Copy the new hardware address and length into
13805 			 * arp_add_mp to be sent to ARP.
13806 			 */
13807 			area->area_hw_addr_length =
13808 			    ill->ill_phys_addr_length;
13809 			bcopy((char *)ill->ill_phys_addr,
13810 			    ((char *)area + area->area_hw_addr_offset),
13811 			    area->area_hw_addr_length);
13812 		}
13813 
13814 		area->area_flags = ACE_F_PERMANENT | ACE_F_PUBLISH |
13815 		    ACE_F_MYADDR;
13816 
13817 		if (res_act == Res_act_defend) {
13818 			area->area_flags |= ACE_F_DEFEND;
13819 			/*
13820 			 * If we're just defending our address now, then
13821 			 * there's no need to set up ARP multicast mappings.
13822 			 * The publish command is enough.
13823 			 */
13824 			goto done;
13825 		}
13826 
13827 		if (res_act != Res_act_initial)
13828 			goto arp_setup_multicast;
13829 
13830 		/*
13831 		 * Allocate an ARP deletion message so we know we can tell ARP
13832 		 * when the interface goes down.
13833 		 */
13834 		arp_del_mp = ill_arp_alloc(ill, ared_p, addr);
13835 		if (arp_del_mp == NULL)
13836 			goto failed;
13837 
13838 	} else {
13839 		if (res_act != Res_act_initial)
13840 			goto done;
13841 	}
13842 	/*
13843 	 * Need to bring up ARP or setup multicast mapping only
13844 	 * when the first interface is coming UP.
13845 	 */
13846 	if (ill->ill_ipif_up_count != 0 || ill->ill_ipif_dup_count != 0 ||
13847 	    was_dup) {
13848 		goto done;
13849 	}
13850 
13851 	/*
13852 	 * Allocate an ARP down message (to be saved) and an ARP up
13853 	 * message.
13854 	 */
13855 	arp_down_mp = ill_arp_alloc(ill, (uchar_t *)&ip_ard_template, 0);
13856 	if (arp_down_mp == NULL)
13857 		goto failed;
13858 
13859 	arp_up_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aru_template, 0);
13860 	if (arp_up_mp == NULL)
13861 		goto failed;
13862 
13863 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
13864 		goto done;
13865 
13866 arp_setup_multicast:
13867 	/*
13868 	 * Setup the multicast mappings. This function initializes
13869 	 * ill_arp_del_mapping_mp also. This does not need to be done for
13870 	 * IPv6.
13871 	 */
13872 	if (!ill->ill_isv6) {
13873 		err = ipif_arp_setup_multicast(ipif, &arp_add_mapping_mp);
13874 		if (err != 0)
13875 			goto failed;
13876 		ASSERT(ill->ill_arp_del_mapping_mp != NULL);
13877 		ASSERT(arp_add_mapping_mp != NULL);
13878 	}
13879 
13880 done:
13881 	if (arp_del_mp != NULL) {
13882 		ASSERT(ipif->ipif_arp_del_mp == NULL);
13883 		ipif->ipif_arp_del_mp = arp_del_mp;
13884 	}
13885 	if (arp_down_mp != NULL) {
13886 		ASSERT(ill->ill_arp_down_mp == NULL);
13887 		ill->ill_arp_down_mp = arp_down_mp;
13888 	}
13889 	if (arp_del_mapping_mp != NULL) {
13890 		ASSERT(ill->ill_arp_del_mapping_mp == NULL);
13891 		ill->ill_arp_del_mapping_mp = arp_del_mapping_mp;
13892 	}
13893 	if (arp_up_mp != NULL) {
13894 		ip1dbg(("ipif_resolver_up: ARP_UP for %s:%u\n",
13895 		    ill->ill_name, ipif->ipif_id));
13896 		putnext(ill->ill_rq, arp_up_mp);
13897 	}
13898 	if (arp_add_mp != NULL) {
13899 		ip1dbg(("ipif_resolver_up: ARP_ADD for %s:%u\n",
13900 		    ill->ill_name, ipif->ipif_id));
13901 		/*
13902 		 * If it's an extended ARP implementation, then we'll wait to
13903 		 * hear that DAD has finished before using the interface.
13904 		 */
13905 		if (!ill->ill_arp_extend)
13906 			ipif->ipif_addr_ready = 1;
13907 		putnext(ill->ill_rq, arp_add_mp);
13908 	} else {
13909 		ipif->ipif_addr_ready = 1;
13910 	}
13911 	if (arp_add_mapping_mp != NULL) {
13912 		ip1dbg(("ipif_resolver_up: MAPPING_ADD for %s:%u\n",
13913 		    ill->ill_name, ipif->ipif_id));
13914 		putnext(ill->ill_rq, arp_add_mapping_mp);
13915 	}
13916 	if (res_act != Res_act_initial)
13917 		return (0);
13918 
13919 	if (ill->ill_flags & ILLF_NOARP)
13920 		err = ill_arp_off(ill);
13921 	else
13922 		err = ill_arp_on(ill);
13923 	if (err != 0) {
13924 		ip0dbg(("ipif_resolver_up: arp_on/off failed %d\n", err));
13925 		freemsg(ipif->ipif_arp_del_mp);
13926 		freemsg(ill->ill_arp_down_mp);
13927 		freemsg(ill->ill_arp_del_mapping_mp);
13928 		ipif->ipif_arp_del_mp = NULL;
13929 		ill->ill_arp_down_mp = NULL;
13930 		ill->ill_arp_del_mapping_mp = NULL;
13931 		return (err);
13932 	}
13933 	return ((ill->ill_ipif_up_count != 0 || was_dup ||
13934 	    ill->ill_ipif_dup_count != 0) ? 0 : EINPROGRESS);
13935 
13936 failed:
13937 	ip1dbg(("ipif_resolver_up: FAILED\n"));
13938 	freemsg(arp_add_mp);
13939 	freemsg(arp_del_mp);
13940 	freemsg(arp_add_mapping_mp);
13941 	freemsg(arp_up_mp);
13942 	freemsg(arp_down_mp);
13943 	ill->ill_arp_bringup_pending = 0;
13944 	return (err);
13945 }
13946 
13947 /*
13948  * This routine restarts IPv4 duplicate address detection (DAD) when a link has
13949  * just gone back up.
13950  */
13951 static void
13952 ipif_arp_start_dad(ipif_t *ipif)
13953 {
13954 	ill_t *ill = ipif->ipif_ill;
13955 	mblk_t *arp_add_mp;
13956 	area_t *area;
13957 
13958 	if (ill->ill_net_type != IRE_IF_RESOLVER || ill->ill_arp_closing ||
13959 	    (ipif->ipif_flags & IPIF_UNNUMBERED) ||
13960 	    ipif->ipif_lcl_addr == INADDR_ANY ||
13961 	    (arp_add_mp = ill_arp_alloc(ill, (uchar_t *)&ip_area_template,
13962 	    (char *)&ipif->ipif_lcl_addr)) == NULL) {
13963 		/*
13964 		 * If we can't contact ARP for some reason, that's not really a
13965 		 * problem.  Just send out the routing socket notification that
13966 		 * DAD completion would have done, and continue.
13967 		 */
13968 		ipif_mask_reply(ipif);
13969 		ip_rts_ifmsg(ipif);
13970 		ip_rts_newaddrmsg(RTM_ADD, 0, ipif);
13971 		sctp_update_ipif(ipif, SCTP_IPIF_UP);
13972 		ipif->ipif_addr_ready = 1;
13973 		return;
13974 	}
13975 
13976 	/* Setting the 'unverified' flag restarts DAD */
13977 	area = (area_t *)arp_add_mp->b_rptr;
13978 	area->area_flags = ACE_F_PERMANENT | ACE_F_PUBLISH | ACE_F_MYADDR |
13979 	    ACE_F_UNVERIFIED;
13980 	putnext(ill->ill_rq, arp_add_mp);
13981 }
13982 
13983 static void
13984 ipif_ndp_start_dad(ipif_t *ipif)
13985 {
13986 	nce_t *nce;
13987 
13988 	nce = ndp_lookup_v6(ipif->ipif_ill, &ipif->ipif_v6lcl_addr, B_FALSE);
13989 	if (nce == NULL)
13990 		return;
13991 
13992 	if (!ndp_restart_dad(nce)) {
13993 		/*
13994 		 * If we can't restart DAD for some reason, that's not really a
13995 		 * problem.  Just send out the routing socket notification that
13996 		 * DAD completion would have done, and continue.
13997 		 */
13998 		ip_rts_ifmsg(ipif);
13999 		ip_rts_newaddrmsg(RTM_ADD, 0, ipif);
14000 		sctp_update_ipif(ipif, SCTP_IPIF_UP);
14001 		ipif->ipif_addr_ready = 1;
14002 	}
14003 	NCE_REFRELE(nce);
14004 }
14005 
14006 /*
14007  * Restart duplicate address detection on all interfaces on the given ill.
14008  *
14009  * This is called when an interface transitions from down to up
14010  * (DL_NOTE_LINK_UP) or up to down (DL_NOTE_LINK_DOWN).
14011  *
14012  * Note that since the underlying physical link has transitioned, we must cause
14013  * at least one routing socket message to be sent here, either via DAD
14014  * completion or just by default on the first ipif.  (If we don't do this, then
14015  * in.mpathd will see long delays when doing link-based failure recovery.)
14016  */
14017 void
14018 ill_restart_dad(ill_t *ill, boolean_t went_up)
14019 {
14020 	ipif_t *ipif;
14021 
14022 	if (ill == NULL)
14023 		return;
14024 
14025 	/*
14026 	 * If layer two doesn't support duplicate address detection, then just
14027 	 * send the routing socket message now and be done with it.
14028 	 */
14029 	if ((ill->ill_isv6 && (ill->ill_flags & ILLF_XRESOLV)) ||
14030 	    (!ill->ill_isv6 && !ill->ill_arp_extend)) {
14031 		ip_rts_ifmsg(ill->ill_ipif);
14032 		return;
14033 	}
14034 
14035 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
14036 		if (went_up) {
14037 			if (ipif->ipif_flags & IPIF_UP) {
14038 				if (ill->ill_isv6)
14039 					ipif_ndp_start_dad(ipif);
14040 				else
14041 					ipif_arp_start_dad(ipif);
14042 			} else if (ill->ill_isv6 &&
14043 			    (ipif->ipif_flags & IPIF_DUPLICATE)) {
14044 				/*
14045 				 * For IPv4, the ARP module itself will
14046 				 * automatically start the DAD process when it
14047 				 * sees DL_NOTE_LINK_UP.  We respond to the
14048 				 * AR_CN_READY at the completion of that task.
14049 				 * For IPv6, we must kick off the bring-up
14050 				 * process now.
14051 				 */
14052 				ndp_do_recovery(ipif);
14053 			} else {
14054 				/*
14055 				 * Unfortunately, the first ipif is "special"
14056 				 * and represents the underlying ill in the
14057 				 * routing socket messages.  Thus, when this
14058 				 * one ipif is down, we must still notify so
14059 				 * that the user knows the IFF_RUNNING status
14060 				 * change.  (If the first ipif is up, then
14061 				 * we'll handle eventual routing socket
14062 				 * notification via DAD completion.)
14063 				 */
14064 				if (ipif == ill->ill_ipif)
14065 					ip_rts_ifmsg(ill->ill_ipif);
14066 			}
14067 		} else {
14068 			/*
14069 			 * After link down, we'll need to send a new routing
14070 			 * message when the link comes back, so clear
14071 			 * ipif_addr_ready.
14072 			 */
14073 			ipif->ipif_addr_ready = 0;
14074 		}
14075 	}
14076 
14077 	/*
14078 	 * If we've torn down links, then notify the user right away.
14079 	 */
14080 	if (!went_up)
14081 		ip_rts_ifmsg(ill->ill_ipif);
14082 }
14083 
14084 /*
14085  * Wakeup all threads waiting to enter the ipsq, and sleeping
14086  * on any of the ills in this ipsq. The ill_lock of the ill
14087  * must be held so that waiters don't miss wakeups
14088  */
14089 static void
14090 ill_signal_ipsq_ills(ipsq_t *ipsq, boolean_t caller_holds_lock)
14091 {
14092 	phyint_t *phyint;
14093 
14094 	phyint = ipsq->ipsq_phyint_list;
14095 	while (phyint != NULL) {
14096 		if (phyint->phyint_illv4) {
14097 			if (!caller_holds_lock)
14098 				mutex_enter(&phyint->phyint_illv4->ill_lock);
14099 			ASSERT(MUTEX_HELD(&phyint->phyint_illv4->ill_lock));
14100 			cv_broadcast(&phyint->phyint_illv4->ill_cv);
14101 			if (!caller_holds_lock)
14102 				mutex_exit(&phyint->phyint_illv4->ill_lock);
14103 		}
14104 		if (phyint->phyint_illv6) {
14105 			if (!caller_holds_lock)
14106 				mutex_enter(&phyint->phyint_illv6->ill_lock);
14107 			ASSERT(MUTEX_HELD(&phyint->phyint_illv6->ill_lock));
14108 			cv_broadcast(&phyint->phyint_illv6->ill_cv);
14109 			if (!caller_holds_lock)
14110 				mutex_exit(&phyint->phyint_illv6->ill_lock);
14111 		}
14112 		phyint = phyint->phyint_ipsq_next;
14113 	}
14114 }
14115 
14116 static ipsq_t *
14117 ipsq_create(char *groupname)
14118 {
14119 	ipsq_t	*ipsq;
14120 
14121 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
14122 	ipsq = kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP);
14123 	if (ipsq == NULL) {
14124 		return (NULL);
14125 	}
14126 
14127 	if (groupname != NULL)
14128 		(void) strcpy(ipsq->ipsq_name, groupname);
14129 	else
14130 		ipsq->ipsq_name[0] = '\0';
14131 
14132 	mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, NULL);
14133 	ipsq->ipsq_flags |= IPSQ_GROUP;
14134 	ipsq->ipsq_next = ipsq_g_head;
14135 	ipsq_g_head = ipsq;
14136 	return (ipsq);
14137 }
14138 
14139 /*
14140  * Return an ipsq correspoding to the groupname. If 'create' is true
14141  * allocate a new ipsq if one does not exist. Usually an ipsq is associated
14142  * uniquely with an IPMP group. However during IPMP groupname operations,
14143  * multiple IPMP groups may be associated with a single ipsq. But no
14144  * IPMP group can be associated with more than 1 ipsq at any time.
14145  * For example
14146  *	Interfaces		IPMP grpname	ipsq	ipsq_name      ipsq_refs
14147  * 	hme1, hme2		mpk17-84	ipsq1	mpk17-84	2
14148  *	hme3, hme4		mpk17-85	ipsq2	mpk17-85	2
14149  *
14150  * Now the command ifconfig hme3 group mpk17-84 results in the temporary
14151  * status shown below during the execution of the above command.
14152  * 	hme1, hme2, hme3, hme4	mpk17-84, mpk17-85	ipsq1	mpk17-84  4
14153  *
14154  * After the completion of the above groupname command we return to the stable
14155  * state shown below.
14156  * 	hme1, hme2, hme3	mpk17-84	ipsq1	mpk17-84	3
14157  *	hme4			mpk17-85	ipsq2	mpk17-85	1
14158  *
14159  * Because of the above, we don't search based on the ipsq_name since that
14160  * would miss the correct ipsq during certain windows as shown above.
14161  * The ipsq_name is only used during split of an ipsq to return the ipsq to its
14162  * natural state.
14163  */
14164 static ipsq_t *
14165 ip_ipsq_lookup(char *groupname, boolean_t create, ipsq_t *exclude_ipsq)
14166 {
14167 	ipsq_t	*ipsq;
14168 	int	group_len;
14169 	phyint_t *phyint;
14170 
14171 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
14172 
14173 	group_len = strlen(groupname);
14174 	ASSERT(group_len != 0);
14175 	group_len++;
14176 
14177 	for (ipsq = ipsq_g_head; ipsq != NULL; ipsq = ipsq->ipsq_next) {
14178 		/*
14179 		 * When an ipsq is being split, and ill_split_ipsq
14180 		 * calls this function, we exclude it from being considered.
14181 		 */
14182 		if (ipsq == exclude_ipsq)
14183 			continue;
14184 
14185 		/*
14186 		 * Compare against the ipsq_name. The groupname change happens
14187 		 * in 2 phases. The 1st phase merges the from group into
14188 		 * the to group's ipsq, by calling ill_merge_groups and restarts
14189 		 * the ioctl. The 2nd phase then locates the ipsq again thru
14190 		 * ipsq_name. At this point the phyint_groupname has not been
14191 		 * updated.
14192 		 */
14193 		if ((group_len == strlen(ipsq->ipsq_name) + 1) &&
14194 		    (bcmp(ipsq->ipsq_name, groupname, group_len) == 0)) {
14195 			/*
14196 			 * Verify that an ipmp groupname is exactly
14197 			 * part of 1 ipsq and is not found in any other
14198 			 * ipsq.
14199 			 */
14200 			ASSERT(ip_ipsq_lookup(groupname, B_FALSE, ipsq) ==
14201 			    NULL);
14202 			return (ipsq);
14203 		}
14204 
14205 		/*
14206 		 * Comparison against ipsq_name alone is not sufficient.
14207 		 * In the case when groups are currently being
14208 		 * merged, the ipsq could hold other IPMP groups temporarily.
14209 		 * so we walk the phyint list and compare against the
14210 		 * phyint_groupname as well.
14211 		 */
14212 		phyint = ipsq->ipsq_phyint_list;
14213 		while (phyint != NULL) {
14214 			if ((group_len == phyint->phyint_groupname_len) &&
14215 			    (bcmp(phyint->phyint_groupname, groupname,
14216 			    group_len) == 0)) {
14217 				/*
14218 				 * Verify that an ipmp groupname is exactly
14219 				 * part of 1 ipsq and is not found in any other
14220 				 * ipsq.
14221 				 */
14222 				ASSERT(ip_ipsq_lookup(groupname, B_FALSE, ipsq)
14223 					== NULL);
14224 				return (ipsq);
14225 			}
14226 			phyint = phyint->phyint_ipsq_next;
14227 		}
14228 	}
14229 	if (create)
14230 		ipsq = ipsq_create(groupname);
14231 	return (ipsq);
14232 }
14233 
14234 static void
14235 ipsq_delete(ipsq_t *ipsq)
14236 {
14237 	ipsq_t *nipsq;
14238 	ipsq_t *pipsq = NULL;
14239 
14240 	/*
14241 	 * We don't hold the ipsq lock, but we are sure no new
14242 	 * messages can land up, since the ipsq_refs is zero.
14243 	 * i.e. this ipsq is unnamed and no phyint or phyint group
14244 	 * is associated with this ipsq. (Lookups are based on ill_name
14245 	 * or phyint_group_name)
14246 	 */
14247 	ASSERT(ipsq->ipsq_refs == 0);
14248 	ASSERT(ipsq->ipsq_xopq_mphead == NULL && ipsq->ipsq_mphead == NULL);
14249 	ASSERT(ipsq->ipsq_pending_mp == NULL);
14250 	if (!(ipsq->ipsq_flags & IPSQ_GROUP)) {
14251 		/*
14252 		 * This is not the ipsq of an IPMP group.
14253 		 */
14254 		kmem_free(ipsq, sizeof (ipsq_t));
14255 		return;
14256 	}
14257 
14258 	rw_enter(&ill_g_lock, RW_WRITER);
14259 
14260 	/*
14261 	 * Locate the ipsq  before we can remove it from
14262 	 * the singly linked list of ipsq's.
14263 	 */
14264 	for (nipsq = ipsq_g_head; nipsq != NULL; nipsq = nipsq->ipsq_next) {
14265 		if (nipsq == ipsq) {
14266 			break;
14267 		}
14268 		pipsq = nipsq;
14269 	}
14270 
14271 	ASSERT(nipsq == ipsq);
14272 
14273 	/* unlink ipsq from the list */
14274 	if (pipsq != NULL)
14275 		pipsq->ipsq_next = ipsq->ipsq_next;
14276 	else
14277 		ipsq_g_head = ipsq->ipsq_next;
14278 	kmem_free(ipsq, sizeof (ipsq_t));
14279 	rw_exit(&ill_g_lock);
14280 }
14281 
14282 static void
14283 ill_move_to_new_ipsq(ipsq_t *old_ipsq, ipsq_t *new_ipsq, mblk_t *current_mp,
14284     queue_t *q)
14285 
14286 {
14287 
14288 	ASSERT(MUTEX_HELD(&new_ipsq->ipsq_lock));
14289 	ASSERT(old_ipsq->ipsq_mphead == NULL && old_ipsq->ipsq_mptail == NULL);
14290 	ASSERT(old_ipsq->ipsq_pending_ipif == NULL);
14291 	ASSERT(old_ipsq->ipsq_pending_mp == NULL);
14292 	ASSERT(current_mp != NULL);
14293 
14294 	ipsq_enq(new_ipsq, q, current_mp, (ipsq_func_t)ip_process_ioctl,
14295 		NEW_OP, NULL);
14296 
14297 	ASSERT(new_ipsq->ipsq_xopq_mptail != NULL &&
14298 	    new_ipsq->ipsq_xopq_mphead != NULL);
14299 
14300 	/*
14301 	 * move from old ipsq to the new ipsq.
14302 	 */
14303 	new_ipsq->ipsq_xopq_mptail->b_next = old_ipsq->ipsq_xopq_mphead;
14304 	if (old_ipsq->ipsq_xopq_mphead != NULL)
14305 		new_ipsq->ipsq_xopq_mptail = old_ipsq->ipsq_xopq_mptail;
14306 
14307 	old_ipsq->ipsq_xopq_mphead = old_ipsq->ipsq_xopq_mptail = NULL;
14308 }
14309 
14310 void
14311 ill_group_cleanup(ill_t *ill)
14312 {
14313 	ill_t *ill_v4;
14314 	ill_t *ill_v6;
14315 	ipif_t *ipif;
14316 
14317 	ill_v4 = ill->ill_phyint->phyint_illv4;
14318 	ill_v6 = ill->ill_phyint->phyint_illv6;
14319 
14320 	if (ill_v4 != NULL) {
14321 		mutex_enter(&ill_v4->ill_lock);
14322 		for (ipif = ill_v4->ill_ipif; ipif != NULL;
14323 		    ipif = ipif->ipif_next) {
14324 			IPIF_UNMARK_MOVING(ipif);
14325 		}
14326 		ill_v4->ill_up_ipifs = B_FALSE;
14327 		mutex_exit(&ill_v4->ill_lock);
14328 	}
14329 
14330 	if (ill_v6 != NULL) {
14331 		mutex_enter(&ill_v6->ill_lock);
14332 		for (ipif = ill_v6->ill_ipif; ipif != NULL;
14333 		    ipif = ipif->ipif_next) {
14334 			IPIF_UNMARK_MOVING(ipif);
14335 		}
14336 		ill_v6->ill_up_ipifs = B_FALSE;
14337 		mutex_exit(&ill_v6->ill_lock);
14338 	}
14339 }
14340 /*
14341  * This function is called when an ill has had a change in its group status
14342  * to bring up all the ipifs that were up before the change.
14343  */
14344 int
14345 ill_up_ipifs(ill_t *ill, queue_t *q, mblk_t *mp)
14346 {
14347 	ipif_t *ipif;
14348 	ill_t *ill_v4;
14349 	ill_t *ill_v6;
14350 	ill_t *from_ill;
14351 	int err = 0;
14352 
14353 
14354 	ASSERT(IAM_WRITER_ILL(ill));
14355 
14356 	/*
14357 	 * Except for ipif_state_flags and ill_state_flags the other
14358 	 * fields of the ipif/ill that are modified below are protected
14359 	 * implicitly since we are a writer. We would have tried to down
14360 	 * even an ipif that was already down, in ill_down_ipifs. So we
14361 	 * just blindly clear the IPIF_CHANGING flag here on all ipifs.
14362 	 */
14363 	ill_v4 = ill->ill_phyint->phyint_illv4;
14364 	ill_v6 = ill->ill_phyint->phyint_illv6;
14365 	if (ill_v4 != NULL) {
14366 		ill_v4->ill_up_ipifs = B_TRUE;
14367 		for (ipif = ill_v4->ill_ipif; ipif != NULL;
14368 		    ipif = ipif->ipif_next) {
14369 			mutex_enter(&ill_v4->ill_lock);
14370 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
14371 			IPIF_UNMARK_MOVING(ipif);
14372 			mutex_exit(&ill_v4->ill_lock);
14373 			if (ipif->ipif_was_up) {
14374 				if (!(ipif->ipif_flags & IPIF_UP))
14375 					err = ipif_up(ipif, q, mp);
14376 				ipif->ipif_was_up = B_FALSE;
14377 				if (err != 0) {
14378 					/*
14379 					 * Can there be any other error ?
14380 					 */
14381 					ASSERT(err == EINPROGRESS);
14382 					return (err);
14383 				}
14384 			}
14385 		}
14386 		mutex_enter(&ill_v4->ill_lock);
14387 		ill_v4->ill_state_flags &= ~ILL_CHANGING;
14388 		mutex_exit(&ill_v4->ill_lock);
14389 		ill_v4->ill_up_ipifs = B_FALSE;
14390 		if (ill_v4->ill_move_in_progress) {
14391 			ASSERT(ill_v4->ill_move_peer != NULL);
14392 			ill_v4->ill_move_in_progress = B_FALSE;
14393 			from_ill = ill_v4->ill_move_peer;
14394 			from_ill->ill_move_in_progress = B_FALSE;
14395 			from_ill->ill_move_peer = NULL;
14396 			mutex_enter(&from_ill->ill_lock);
14397 			from_ill->ill_state_flags &= ~ILL_CHANGING;
14398 			mutex_exit(&from_ill->ill_lock);
14399 			if (ill_v6 == NULL) {
14400 				if (from_ill->ill_phyint->phyint_flags &
14401 				    PHYI_STANDBY) {
14402 					phyint_inactive(from_ill->ill_phyint);
14403 				}
14404 				if (ill_v4->ill_phyint->phyint_flags &
14405 				    PHYI_STANDBY) {
14406 					phyint_inactive(ill_v4->ill_phyint);
14407 				}
14408 			}
14409 			ill_v4->ill_move_peer = NULL;
14410 		}
14411 	}
14412 
14413 	if (ill_v6 != NULL) {
14414 		ill_v6->ill_up_ipifs = B_TRUE;
14415 		for (ipif = ill_v6->ill_ipif; ipif != NULL;
14416 		    ipif = ipif->ipif_next) {
14417 			mutex_enter(&ill_v6->ill_lock);
14418 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
14419 			IPIF_UNMARK_MOVING(ipif);
14420 			mutex_exit(&ill_v6->ill_lock);
14421 			if (ipif->ipif_was_up) {
14422 				if (!(ipif->ipif_flags & IPIF_UP))
14423 					err = ipif_up(ipif, q, mp);
14424 				ipif->ipif_was_up = B_FALSE;
14425 				if (err != 0) {
14426 					/*
14427 					 * Can there be any other error ?
14428 					 */
14429 					ASSERT(err == EINPROGRESS);
14430 					return (err);
14431 				}
14432 			}
14433 		}
14434 		mutex_enter(&ill_v6->ill_lock);
14435 		ill_v6->ill_state_flags &= ~ILL_CHANGING;
14436 		mutex_exit(&ill_v6->ill_lock);
14437 		ill_v6->ill_up_ipifs = B_FALSE;
14438 		if (ill_v6->ill_move_in_progress) {
14439 			ASSERT(ill_v6->ill_move_peer != NULL);
14440 			ill_v6->ill_move_in_progress = B_FALSE;
14441 			from_ill = ill_v6->ill_move_peer;
14442 			from_ill->ill_move_in_progress = B_FALSE;
14443 			from_ill->ill_move_peer = NULL;
14444 			mutex_enter(&from_ill->ill_lock);
14445 			from_ill->ill_state_flags &= ~ILL_CHANGING;
14446 			mutex_exit(&from_ill->ill_lock);
14447 			if (from_ill->ill_phyint->phyint_flags & PHYI_STANDBY) {
14448 				phyint_inactive(from_ill->ill_phyint);
14449 			}
14450 			if (ill_v6->ill_phyint->phyint_flags & PHYI_STANDBY) {
14451 				phyint_inactive(ill_v6->ill_phyint);
14452 			}
14453 			ill_v6->ill_move_peer = NULL;
14454 		}
14455 	}
14456 	return (0);
14457 }
14458 
14459 /*
14460  * bring down all the approriate ipifs.
14461  */
14462 /* ARGSUSED */
14463 static void
14464 ill_down_ipifs(ill_t *ill, mblk_t *mp, int index, boolean_t chk_nofailover)
14465 {
14466 	ipif_t *ipif;
14467 
14468 	ASSERT(IAM_WRITER_ILL(ill));
14469 
14470 	/*
14471 	 * Except for ipif_state_flags the other fields of the ipif/ill that
14472 	 * are modified below are protected implicitly since we are a writer
14473 	 */
14474 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
14475 		if (chk_nofailover && (ipif->ipif_flags & IPIF_NOFAILOVER))
14476 			continue;
14477 		if (index == 0 || index == ipif->ipif_orig_ifindex) {
14478 			/*
14479 			 * We go through the ipif_down logic even if the ipif
14480 			 * is already down, since routes can be added based
14481 			 * on down ipifs. Going through ipif_down once again
14482 			 * will delete any IREs created based on these routes.
14483 			 */
14484 			if (ipif->ipif_flags & IPIF_UP)
14485 				ipif->ipif_was_up = B_TRUE;
14486 			/*
14487 			 * If called with chk_nofailover true ipif is moving.
14488 			 */
14489 			mutex_enter(&ill->ill_lock);
14490 			if (chk_nofailover) {
14491 				ipif->ipif_state_flags |=
14492 					IPIF_MOVING | IPIF_CHANGING;
14493 			} else {
14494 				ipif->ipif_state_flags |= IPIF_CHANGING;
14495 			}
14496 			mutex_exit(&ill->ill_lock);
14497 			/*
14498 			 * Need to re-create net/subnet bcast ires if
14499 			 * they are dependent on ipif.
14500 			 */
14501 			if (!ipif->ipif_isv6)
14502 				ipif_check_bcast_ires(ipif);
14503 			(void) ipif_logical_down(ipif, NULL, NULL);
14504 			ipif_non_duplicate(ipif);
14505 			ipif_down_tail(ipif);
14506 			/*
14507 			 * We don't do ipif_multicast_down for IPv4 in
14508 			 * ipif_down. We need to set this so that
14509 			 * ipif_multicast_up will join the
14510 			 * ALLHOSTS_GROUP on to_ill.
14511 			 */
14512 			ipif->ipif_multicast_up = B_FALSE;
14513 		}
14514 	}
14515 }
14516 
14517 #define	IPSQ_INC_REF(ipsq)	{			\
14518 	ASSERT(RW_WRITE_HELD(&ill_g_lock));		\
14519 	(ipsq)->ipsq_refs++;				\
14520 }
14521 
14522 #define	IPSQ_DEC_REF(ipsq)	{			\
14523 	ASSERT(RW_WRITE_HELD(&ill_g_lock));		\
14524 	(ipsq)->ipsq_refs--;				\
14525 	if ((ipsq)->ipsq_refs == 0)				\
14526 		(ipsq)->ipsq_name[0] = '\0'; 		\
14527 }
14528 
14529 /*
14530  * Change the ipsq of all the ill's whose current ipsq is 'cur_ipsq' to
14531  * new_ipsq.
14532  */
14533 static void
14534 ill_merge_ipsq(ipsq_t *cur_ipsq, ipsq_t *new_ipsq)
14535 {
14536 	phyint_t *phyint;
14537 	phyint_t *next_phyint;
14538 
14539 	/*
14540 	 * To change the ipsq of an ill, we need to hold the ill_g_lock as
14541 	 * writer and the ill_lock of the ill in question. Also the dest
14542 	 * ipsq can't vanish while we hold the ill_g_lock as writer.
14543 	 */
14544 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
14545 
14546 	phyint = cur_ipsq->ipsq_phyint_list;
14547 	cur_ipsq->ipsq_phyint_list = NULL;
14548 	while (phyint != NULL) {
14549 		next_phyint = phyint->phyint_ipsq_next;
14550 		IPSQ_DEC_REF(cur_ipsq);
14551 		phyint->phyint_ipsq_next = new_ipsq->ipsq_phyint_list;
14552 		new_ipsq->ipsq_phyint_list = phyint;
14553 		IPSQ_INC_REF(new_ipsq);
14554 		phyint->phyint_ipsq = new_ipsq;
14555 		phyint = next_phyint;
14556 	}
14557 }
14558 
14559 #define	SPLIT_SUCCESS		0
14560 #define	SPLIT_NOT_NEEDED	1
14561 #define	SPLIT_FAILED		2
14562 
14563 int
14564 ill_split_to_grp_ipsq(phyint_t *phyint, ipsq_t *cur_ipsq, boolean_t need_retry)
14565 {
14566 	ipsq_t *newipsq = NULL;
14567 
14568 	/*
14569 	 * Assertions denote pre-requisites for changing the ipsq of
14570 	 * a phyint
14571 	 */
14572 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
14573 	/*
14574 	 * <ill-phyint> assocs can't change while ill_g_lock
14575 	 * is held as writer. See ill_phyint_reinit()
14576 	 */
14577 	ASSERT(phyint->phyint_illv4 == NULL ||
14578 	    MUTEX_HELD(&phyint->phyint_illv4->ill_lock));
14579 	ASSERT(phyint->phyint_illv6 == NULL ||
14580 	    MUTEX_HELD(&phyint->phyint_illv6->ill_lock));
14581 
14582 	if ((phyint->phyint_groupname_len !=
14583 	    (strlen(cur_ipsq->ipsq_name) + 1) ||
14584 	    bcmp(phyint->phyint_groupname, cur_ipsq->ipsq_name,
14585 	    phyint->phyint_groupname_len) != 0)) {
14586 		/*
14587 		 * Once we fail in creating a new ipsq due to memory shortage,
14588 		 * don't attempt to create new ipsq again, based on another
14589 		 * phyint, since we want all phyints belonging to an IPMP group
14590 		 * to be in the same ipsq even in the event of mem alloc fails.
14591 		 */
14592 		newipsq = ip_ipsq_lookup(phyint->phyint_groupname, !need_retry,
14593 		    cur_ipsq);
14594 		if (newipsq == NULL) {
14595 			/* Memory allocation failure */
14596 			return (SPLIT_FAILED);
14597 		} else {
14598 			/* ipsq_refs protected by ill_g_lock (writer) */
14599 			IPSQ_DEC_REF(cur_ipsq);
14600 			phyint->phyint_ipsq = newipsq;
14601 			phyint->phyint_ipsq_next = newipsq->ipsq_phyint_list;
14602 			newipsq->ipsq_phyint_list = phyint;
14603 			IPSQ_INC_REF(newipsq);
14604 			return (SPLIT_SUCCESS);
14605 		}
14606 	}
14607 	return (SPLIT_NOT_NEEDED);
14608 }
14609 
14610 /*
14611  * The ill locks of the phyint and the ill_g_lock (writer) must be held
14612  * to do this split
14613  */
14614 static int
14615 ill_split_to_own_ipsq(phyint_t *phyint, ipsq_t *cur_ipsq)
14616 {
14617 	ipsq_t *newipsq;
14618 
14619 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
14620 	/*
14621 	 * <ill-phyint> assocs can't change while ill_g_lock
14622 	 * is held as writer. See ill_phyint_reinit()
14623 	 */
14624 
14625 	ASSERT(phyint->phyint_illv4 == NULL ||
14626 	    MUTEX_HELD(&phyint->phyint_illv4->ill_lock));
14627 	ASSERT(phyint->phyint_illv6 == NULL ||
14628 	    MUTEX_HELD(&phyint->phyint_illv6->ill_lock));
14629 
14630 	if (!ipsq_init((phyint->phyint_illv4 != NULL) ?
14631 	    phyint->phyint_illv4: phyint->phyint_illv6)) {
14632 		/*
14633 		 * ipsq_init failed due to no memory
14634 		 * caller will use the same ipsq
14635 		 */
14636 		return (SPLIT_FAILED);
14637 	}
14638 
14639 	/* ipsq_ref is protected by ill_g_lock (writer) */
14640 	IPSQ_DEC_REF(cur_ipsq);
14641 
14642 	/*
14643 	 * This is a new ipsq that is unknown to the world.
14644 	 * So we don't need to hold ipsq_lock,
14645 	 */
14646 	newipsq = phyint->phyint_ipsq;
14647 	newipsq->ipsq_writer = NULL;
14648 	newipsq->ipsq_reentry_cnt--;
14649 	ASSERT(newipsq->ipsq_reentry_cnt == 0);
14650 #ifdef ILL_DEBUG
14651 	newipsq->ipsq_depth = 0;
14652 #endif
14653 
14654 	return (SPLIT_SUCCESS);
14655 }
14656 
14657 /*
14658  * Change the ipsq of all the ill's whose current ipsq is 'cur_ipsq' to
14659  * ipsq's representing their individual groups or themselves. Return
14660  * whether split needs to be retried again later.
14661  */
14662 static boolean_t
14663 ill_split_ipsq(ipsq_t *cur_ipsq)
14664 {
14665 	phyint_t *phyint;
14666 	phyint_t *next_phyint;
14667 	int	error;
14668 	boolean_t need_retry = B_FALSE;
14669 
14670 	phyint = cur_ipsq->ipsq_phyint_list;
14671 	cur_ipsq->ipsq_phyint_list = NULL;
14672 	while (phyint != NULL) {
14673 		next_phyint = phyint->phyint_ipsq_next;
14674 		/*
14675 		 * 'created' will tell us whether the callee actually
14676 		 * created an ipsq. Lack of memory may force the callee
14677 		 * to return without creating an ipsq.
14678 		 */
14679 		if (phyint->phyint_groupname == NULL) {
14680 			error = ill_split_to_own_ipsq(phyint, cur_ipsq);
14681 		} else {
14682 			error = ill_split_to_grp_ipsq(phyint, cur_ipsq,
14683 					need_retry);
14684 		}
14685 
14686 		switch (error) {
14687 		case SPLIT_FAILED:
14688 			need_retry = B_TRUE;
14689 			/* FALLTHRU */
14690 		case SPLIT_NOT_NEEDED:
14691 			/*
14692 			 * Keep it on the list.
14693 			 */
14694 			phyint->phyint_ipsq_next = cur_ipsq->ipsq_phyint_list;
14695 			cur_ipsq->ipsq_phyint_list = phyint;
14696 			break;
14697 		case SPLIT_SUCCESS:
14698 			break;
14699 		default:
14700 			ASSERT(0);
14701 		}
14702 
14703 		phyint = next_phyint;
14704 	}
14705 	return (need_retry);
14706 }
14707 
14708 /*
14709  * given an ipsq 'ipsq' lock all ills associated with this ipsq.
14710  * and return the ills in the list. This list will be
14711  * needed to unlock all the ills later on by the caller.
14712  * The <ill-ipsq> associations could change between the
14713  * lock and unlock. Hence the unlock can't traverse the
14714  * ipsq to get the list of ills.
14715  */
14716 static int
14717 ill_lock_ipsq_ills(ipsq_t *ipsq, ill_t **list, int list_max)
14718 {
14719 	int	cnt = 0;
14720 	phyint_t	*phyint;
14721 
14722 	/*
14723 	 * The caller holds ill_g_lock to ensure that the ill memberships
14724 	 * of the ipsq don't change
14725 	 */
14726 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
14727 
14728 	phyint = ipsq->ipsq_phyint_list;
14729 	while (phyint != NULL) {
14730 		if (phyint->phyint_illv4 != NULL) {
14731 			ASSERT(cnt < list_max);
14732 			list[cnt++] = phyint->phyint_illv4;
14733 		}
14734 		if (phyint->phyint_illv6 != NULL) {
14735 			ASSERT(cnt < list_max);
14736 			list[cnt++] = phyint->phyint_illv6;
14737 		}
14738 		phyint = phyint->phyint_ipsq_next;
14739 	}
14740 	ill_lock_ills(list, cnt);
14741 	return (cnt);
14742 }
14743 
14744 void
14745 ill_lock_ills(ill_t **list, int cnt)
14746 {
14747 	int	i;
14748 
14749 	if (cnt > 1) {
14750 		boolean_t try_again;
14751 		do {
14752 			try_again = B_FALSE;
14753 			for (i = 0; i < cnt - 1; i++) {
14754 				if (list[i] < list[i + 1]) {
14755 					ill_t	*tmp;
14756 
14757 					/* swap the elements */
14758 					tmp = list[i];
14759 					list[i] = list[i + 1];
14760 					list[i + 1] = tmp;
14761 					try_again = B_TRUE;
14762 				}
14763 			}
14764 		} while (try_again);
14765 	}
14766 
14767 	for (i = 0; i < cnt; i++) {
14768 		if (i == 0) {
14769 			if (list[i] != NULL)
14770 				mutex_enter(&list[i]->ill_lock);
14771 			else
14772 				return;
14773 		} else if ((list[i-1] != list[i]) && (list[i] != NULL)) {
14774 			mutex_enter(&list[i]->ill_lock);
14775 		}
14776 	}
14777 }
14778 
14779 void
14780 ill_unlock_ills(ill_t **list, int cnt)
14781 {
14782 	int	i;
14783 
14784 	for (i = 0; i < cnt; i++) {
14785 		if ((i == 0) && (list[i] != NULL)) {
14786 			mutex_exit(&list[i]->ill_lock);
14787 		} else if ((list[i-1] != list[i]) && (list[i] != NULL)) {
14788 			mutex_exit(&list[i]->ill_lock);
14789 		}
14790 	}
14791 }
14792 
14793 /*
14794  * Merge all the ills from 1 ipsq group into another ipsq group.
14795  * The source ipsq group is specified by the ipsq associated with
14796  * 'from_ill'. The destination ipsq group is specified by the ipsq
14797  * associated with 'to_ill' or 'groupname' respectively.
14798  * Note that ipsq itself does not have a reference count mechanism
14799  * and functions don't look up an ipsq and pass it around. Instead
14800  * functions pass around an ill or groupname, and the ipsq is looked
14801  * up from the ill or groupname and the required operation performed
14802  * atomically with the lookup on the ipsq.
14803  */
14804 static int
14805 ill_merge_groups(ill_t *from_ill, ill_t *to_ill, char *groupname, mblk_t *mp,
14806     queue_t *q)
14807 {
14808 	ipsq_t *old_ipsq;
14809 	ipsq_t *new_ipsq;
14810 	ill_t	**ill_list;
14811 	int	cnt;
14812 	size_t	ill_list_size;
14813 	boolean_t became_writer_on_new_sq = B_FALSE;
14814 
14815 	/* Exactly 1 of 'to_ill' and groupname can be specified. */
14816 	ASSERT((to_ill != NULL) ^ (groupname != NULL));
14817 
14818 	/*
14819 	 * Need to hold ill_g_lock as writer and also the ill_lock to
14820 	 * change the <ill-ipsq> assoc of an ill. Need to hold the
14821 	 * ipsq_lock to prevent new messages from landing on an ipsq.
14822 	 */
14823 	rw_enter(&ill_g_lock, RW_WRITER);
14824 
14825 	old_ipsq = from_ill->ill_phyint->phyint_ipsq;
14826 	if (groupname != NULL)
14827 		new_ipsq = ip_ipsq_lookup(groupname, B_TRUE, NULL);
14828 	else {
14829 		new_ipsq = to_ill->ill_phyint->phyint_ipsq;
14830 	}
14831 
14832 	ASSERT(old_ipsq != NULL && new_ipsq != NULL);
14833 
14834 	/*
14835 	 * both groups are on the same ipsq.
14836 	 */
14837 	if (old_ipsq == new_ipsq) {
14838 		rw_exit(&ill_g_lock);
14839 		return (0);
14840 	}
14841 
14842 	cnt = old_ipsq->ipsq_refs << 1;
14843 	ill_list_size = cnt * sizeof (ill_t *);
14844 	ill_list = kmem_zalloc(ill_list_size, KM_NOSLEEP);
14845 	if (ill_list == NULL) {
14846 		rw_exit(&ill_g_lock);
14847 		return (ENOMEM);
14848 	}
14849 	cnt = ill_lock_ipsq_ills(old_ipsq, ill_list, cnt);
14850 
14851 	/* Need ipsq lock to enque messages on new ipsq or to become writer */
14852 	mutex_enter(&new_ipsq->ipsq_lock);
14853 	if ((new_ipsq->ipsq_writer == NULL &&
14854 		new_ipsq->ipsq_current_ipif == NULL) ||
14855 	    (new_ipsq->ipsq_writer == curthread)) {
14856 		new_ipsq->ipsq_writer = curthread;
14857 		new_ipsq->ipsq_reentry_cnt++;
14858 		became_writer_on_new_sq = B_TRUE;
14859 	}
14860 
14861 	/*
14862 	 * We are holding ill_g_lock as writer and all the ill locks of
14863 	 * the old ipsq. So the old_ipsq can't be looked up, and hence no new
14864 	 * message can land up on the old ipsq even though we don't hold the
14865 	 * ipsq_lock of the old_ipsq. Now move all messages to the newipsq.
14866 	 */
14867 	ill_move_to_new_ipsq(old_ipsq, new_ipsq, mp, q);
14868 
14869 	/*
14870 	 * now change the ipsq of all ills in the 'old_ipsq' to 'new_ipsq'.
14871 	 * 'new_ipsq' has been looked up, and it can't change its <ill-ipsq>
14872 	 * assocs. till we release the ill_g_lock, and hence it can't vanish.
14873 	 */
14874 	ill_merge_ipsq(old_ipsq, new_ipsq);
14875 
14876 	/*
14877 	 * Mark the new ipsq as needing a split since it is currently
14878 	 * being shared by more than 1 IPMP group. The split will
14879 	 * occur at the end of ipsq_exit
14880 	 */
14881 	new_ipsq->ipsq_split = B_TRUE;
14882 
14883 	/* Now release all the locks */
14884 	mutex_exit(&new_ipsq->ipsq_lock);
14885 	ill_unlock_ills(ill_list, cnt);
14886 	rw_exit(&ill_g_lock);
14887 
14888 	kmem_free(ill_list, ill_list_size);
14889 
14890 	/*
14891 	 * If we succeeded in becoming writer on the new ipsq, then
14892 	 * drain the new ipsq and start processing  all enqueued messages
14893 	 * including the current ioctl we are processing which is either
14894 	 * a set groupname or failover/failback.
14895 	 */
14896 	if (became_writer_on_new_sq)
14897 		ipsq_exit(new_ipsq, B_TRUE, B_TRUE);
14898 
14899 	/*
14900 	 * syncq has been changed and all the messages have been moved.
14901 	 */
14902 	mutex_enter(&old_ipsq->ipsq_lock);
14903 	old_ipsq->ipsq_current_ipif = NULL;
14904 	mutex_exit(&old_ipsq->ipsq_lock);
14905 	return (EINPROGRESS);
14906 }
14907 
14908 /*
14909  * Delete and add the loopback copy and non-loopback copy of
14910  * the BROADCAST ire corresponding to ill and addr. Used to
14911  * group broadcast ires together when ill becomes part of
14912  * a group.
14913  *
14914  * This function is also called when ill is leaving the group
14915  * so that the ires belonging to the group gets re-grouped.
14916  */
14917 static void
14918 ill_bcast_delete_and_add(ill_t *ill, ipaddr_t addr)
14919 {
14920 	ire_t *ire, *nire, *nire_next, *ire_head = NULL;
14921 	ire_t **ire_ptpn = &ire_head;
14922 
14923 	/*
14924 	 * The loopback and non-loopback IREs are inserted in the order in which
14925 	 * they're found, on the basis that they are correctly ordered (loopback
14926 	 * first).
14927 	 */
14928 	for (;;) {
14929 		ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, ill->ill_ipif,
14930 		    ALL_ZONES, NULL, MATCH_IRE_TYPE | MATCH_IRE_ILL);
14931 		if (ire == NULL)
14932 			break;
14933 
14934 		/*
14935 		 * we are passing in KM_SLEEP because it is not easy to
14936 		 * go back to a sane state in case of memory failure.
14937 		 */
14938 		nire = kmem_cache_alloc(ire_cache, KM_SLEEP);
14939 		ASSERT(nire != NULL);
14940 		bzero(nire, sizeof (ire_t));
14941 		/*
14942 		 * Don't use ire_max_frag directly since we don't
14943 		 * hold on to 'ire' until we add the new ire 'nire' and
14944 		 * we don't want the new ire to have a dangling reference
14945 		 * to 'ire'. The ire_max_frag of a broadcast ire must
14946 		 * be in sync with the ipif_mtu of the associate ipif.
14947 		 * For eg. this happens as a result of SIOCSLIFNAME,
14948 		 * SIOCSLIFLNKINFO or a DL_NOTE_SDU_SIZE inititated by
14949 		 * the driver. A change in ire_max_frag triggered as
14950 		 * as a result of path mtu discovery, or due to an
14951 		 * IP_IOC_IRE_ADVISE_NOREPLY from the transport or due a
14952 		 * route change -mtu command does not apply to broadcast ires.
14953 		 *
14954 		 * XXX We need a recovery strategy here if ire_init fails
14955 		 */
14956 		if (ire_init(nire,
14957 		    (uchar_t *)&ire->ire_addr,
14958 		    (uchar_t *)&ire->ire_mask,
14959 		    (uchar_t *)&ire->ire_src_addr,
14960 		    (uchar_t *)&ire->ire_gateway_addr,
14961 		    (uchar_t *)&ire->ire_in_src_addr,
14962 		    ire->ire_stq == NULL ? &ip_loopback_mtu :
14963 			&ire->ire_ipif->ipif_mtu,
14964 		    (ire->ire_nce != NULL ? ire->ire_nce->nce_fp_mp : NULL),
14965 		    ire->ire_rfq,
14966 		    ire->ire_stq,
14967 		    ire->ire_type,
14968 		    (ire->ire_nce != NULL? ire->ire_nce->nce_res_mp : NULL),
14969 		    ire->ire_ipif,
14970 		    ire->ire_in_ill,
14971 		    ire->ire_cmask,
14972 		    ire->ire_phandle,
14973 		    ire->ire_ihandle,
14974 		    ire->ire_flags,
14975 		    &ire->ire_uinfo,
14976 		    NULL,
14977 		    NULL) == NULL) {
14978 			cmn_err(CE_PANIC, "ire_init() failed");
14979 		}
14980 		ire_delete(ire);
14981 		ire_refrele(ire);
14982 
14983 		/*
14984 		 * The newly created IREs are inserted at the tail of the list
14985 		 * starting with ire_head. As we've just allocated them no one
14986 		 * knows about them so it's safe.
14987 		 */
14988 		*ire_ptpn = nire;
14989 		ire_ptpn = &nire->ire_next;
14990 	}
14991 
14992 	for (nire = ire_head; nire != NULL; nire = nire_next) {
14993 		int error;
14994 		ire_t *oire;
14995 		/* unlink the IRE from our list before calling ire_add() */
14996 		nire_next = nire->ire_next;
14997 		nire->ire_next = NULL;
14998 
14999 		/* ire_add adds the ire at the right place in the list */
15000 		oire = nire;
15001 		error = ire_add(&nire, NULL, NULL, NULL, B_FALSE);
15002 		ASSERT(error == 0);
15003 		ASSERT(oire == nire);
15004 		ire_refrele(nire);	/* Held in ire_add */
15005 	}
15006 }
15007 
15008 /*
15009  * This function is usually called when an ill is inserted in
15010  * a group and all the ipifs are already UP. As all the ipifs
15011  * are already UP, the broadcast ires have already been created
15012  * and been inserted. But, ire_add_v4 would not have grouped properly.
15013  * We need to re-group for the benefit of ip_wput_ire which
15014  * expects BROADCAST ires to be grouped properly to avoid sending
15015  * more than one copy of the broadcast packet per group.
15016  *
15017  * NOTE : We don't check for ill_ipif_up_count to be non-zero here
15018  *	  because when ipif_up_done ends up calling this, ires have
15019  *        already been added before illgrp_insert i.e before ill_group
15020  *	  has been initialized.
15021  */
15022 static void
15023 ill_group_bcast_for_xmit(ill_t *ill)
15024 {
15025 	ill_group_t *illgrp;
15026 	ipif_t *ipif;
15027 	ipaddr_t addr;
15028 	ipaddr_t net_mask;
15029 	ipaddr_t subnet_netmask;
15030 
15031 	illgrp = ill->ill_group;
15032 
15033 	/*
15034 	 * This function is called even when an ill is deleted from
15035 	 * the group. Hence, illgrp could be null.
15036 	 */
15037 	if (illgrp != NULL && illgrp->illgrp_ill_count == 1)
15038 		return;
15039 
15040 	/*
15041 	 * Delete all the BROADCAST ires matching this ill and add
15042 	 * them back. This time, ire_add_v4 should take care of
15043 	 * grouping them with others because ill is part of the
15044 	 * group.
15045 	 */
15046 	ill_bcast_delete_and_add(ill, 0);
15047 	ill_bcast_delete_and_add(ill, INADDR_BROADCAST);
15048 
15049 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
15050 
15051 		if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
15052 		    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
15053 			net_mask = ip_net_mask(ipif->ipif_lcl_addr);
15054 		} else {
15055 			net_mask = htonl(IN_CLASSA_NET);
15056 		}
15057 		addr = net_mask & ipif->ipif_subnet;
15058 		ill_bcast_delete_and_add(ill, addr);
15059 		ill_bcast_delete_and_add(ill, ~net_mask | addr);
15060 
15061 		subnet_netmask = ipif->ipif_net_mask;
15062 		addr = ipif->ipif_subnet;
15063 		ill_bcast_delete_and_add(ill, addr);
15064 		ill_bcast_delete_and_add(ill, ~subnet_netmask | addr);
15065 	}
15066 }
15067 
15068 /*
15069  * This function is called from illgrp_delete when ill is being deleted
15070  * from the group.
15071  *
15072  * As ill is not there in the group anymore, any address belonging
15073  * to this ill should be cleared of IRE_MARK_NORECV.
15074  */
15075 static void
15076 ill_clear_bcast_mark(ill_t *ill, ipaddr_t addr)
15077 {
15078 	ire_t *ire;
15079 	irb_t *irb;
15080 
15081 	ASSERT(ill->ill_group == NULL);
15082 
15083 	ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, ill->ill_ipif,
15084 	    ALL_ZONES, NULL, MATCH_IRE_TYPE | MATCH_IRE_ILL);
15085 
15086 	if (ire != NULL) {
15087 		/*
15088 		 * IPMP and plumbing operations are serialized on the ipsq, so
15089 		 * no one will insert or delete a broadcast ire under our feet.
15090 		 */
15091 		irb = ire->ire_bucket;
15092 		rw_enter(&irb->irb_lock, RW_READER);
15093 		ire_refrele(ire);
15094 
15095 		for (; ire != NULL; ire = ire->ire_next) {
15096 			if (ire->ire_addr != addr)
15097 				break;
15098 			if (ire_to_ill(ire) != ill)
15099 				continue;
15100 
15101 			ASSERT(!(ire->ire_marks & IRE_MARK_CONDEMNED));
15102 			ire->ire_marks &= ~IRE_MARK_NORECV;
15103 		}
15104 		rw_exit(&irb->irb_lock);
15105 	}
15106 }
15107 
15108 /*
15109  * This function must be called only after the broadcast ires
15110  * have been grouped together. For a given address addr, nominate
15111  * only one of the ires whose interface is not FAILED or OFFLINE.
15112  *
15113  * This is also called when an ipif goes down, so that we can nominate
15114  * a different ire with the same address for receiving.
15115  */
15116 static void
15117 ill_mark_bcast(ill_group_t *illgrp, ipaddr_t addr)
15118 {
15119 	irb_t *irb;
15120 	ire_t *ire;
15121 	ire_t *ire1;
15122 	ire_t *save_ire;
15123 	ire_t **irep = NULL;
15124 	boolean_t first = B_TRUE;
15125 	ire_t *clear_ire = NULL;
15126 	ire_t *start_ire = NULL;
15127 	ire_t	*new_lb_ire;
15128 	ire_t	*new_nlb_ire;
15129 	boolean_t new_lb_ire_used = B_FALSE;
15130 	boolean_t new_nlb_ire_used = B_FALSE;
15131 	uint64_t match_flags;
15132 	uint64_t phyi_flags;
15133 	boolean_t fallback = B_FALSE;
15134 
15135 	ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, NULL, ALL_ZONES,
15136 	    NULL, MATCH_IRE_TYPE);
15137 	/*
15138 	 * We may not be able to find some ires if a previous
15139 	 * ire_create failed. This happens when an ipif goes
15140 	 * down and we are unable to create BROADCAST ires due
15141 	 * to memory failure. Thus, we have to check for NULL
15142 	 * below. This should handle the case for LOOPBACK,
15143 	 * POINTOPOINT and interfaces with some POINTOPOINT
15144 	 * logicals for which there are no BROADCAST ires.
15145 	 */
15146 	if (ire == NULL)
15147 		return;
15148 	/*
15149 	 * Currently IRE_BROADCASTS are deleted when an ipif
15150 	 * goes down which runs exclusively. Thus, setting
15151 	 * IRE_MARK_RCVD should not race with ire_delete marking
15152 	 * IRE_MARK_CONDEMNED. We grab the lock below just to
15153 	 * be consistent with other parts of the code that walks
15154 	 * a given bucket.
15155 	 */
15156 	save_ire = ire;
15157 	irb = ire->ire_bucket;
15158 	new_lb_ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
15159 	if (new_lb_ire == NULL) {
15160 		ire_refrele(ire);
15161 		return;
15162 	}
15163 	new_nlb_ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
15164 	if (new_nlb_ire == NULL) {
15165 		ire_refrele(ire);
15166 		kmem_cache_free(ire_cache, new_lb_ire);
15167 		return;
15168 	}
15169 	IRB_REFHOLD(irb);
15170 	rw_enter(&irb->irb_lock, RW_WRITER);
15171 	/*
15172 	 * Get to the first ire matching the address and the
15173 	 * group. If the address does not match we are done
15174 	 * as we could not find the IRE. If the address matches
15175 	 * we should get to the first one matching the group.
15176 	 */
15177 	while (ire != NULL) {
15178 		if (ire->ire_addr != addr ||
15179 		    ire->ire_ipif->ipif_ill->ill_group == illgrp) {
15180 			break;
15181 		}
15182 		ire = ire->ire_next;
15183 	}
15184 	match_flags = PHYI_FAILED | PHYI_INACTIVE;
15185 	start_ire = ire;
15186 redo:
15187 	while (ire != NULL && ire->ire_addr == addr &&
15188 	    ire->ire_ipif->ipif_ill->ill_group == illgrp) {
15189 		/*
15190 		 * The first ire for any address within a group
15191 		 * should always be the one with IRE_MARK_NORECV cleared
15192 		 * so that ip_wput_ire can avoid searching for one.
15193 		 * Note down the insertion point which will be used
15194 		 * later.
15195 		 */
15196 		if (first && (irep == NULL))
15197 			irep = ire->ire_ptpn;
15198 		/*
15199 		 * PHYI_FAILED is set when the interface fails.
15200 		 * This interface might have become good, but the
15201 		 * daemon has not yet detected. We should still
15202 		 * not receive on this. PHYI_OFFLINE should never
15203 		 * be picked as this has been offlined and soon
15204 		 * be removed.
15205 		 */
15206 		phyi_flags = ire->ire_ipif->ipif_ill->ill_phyint->phyint_flags;
15207 		if (phyi_flags & PHYI_OFFLINE) {
15208 			ire->ire_marks |= IRE_MARK_NORECV;
15209 			ire = ire->ire_next;
15210 			continue;
15211 		}
15212 		if (phyi_flags & match_flags) {
15213 			ire->ire_marks |= IRE_MARK_NORECV;
15214 			ire = ire->ire_next;
15215 			if ((phyi_flags & (PHYI_FAILED | PHYI_INACTIVE)) ==
15216 			    PHYI_INACTIVE) {
15217 				fallback = B_TRUE;
15218 			}
15219 			continue;
15220 		}
15221 		if (first) {
15222 			/*
15223 			 * We will move this to the front of the list later
15224 			 * on.
15225 			 */
15226 			clear_ire = ire;
15227 			ire->ire_marks &= ~IRE_MARK_NORECV;
15228 		} else {
15229 			ire->ire_marks |= IRE_MARK_NORECV;
15230 		}
15231 		first = B_FALSE;
15232 		ire = ire->ire_next;
15233 	}
15234 	/*
15235 	 * If we never nominated anybody, try nominating at least
15236 	 * an INACTIVE, if we found one. Do it only once though.
15237 	 */
15238 	if (first && (match_flags == (PHYI_FAILED | PHYI_INACTIVE)) &&
15239 	    fallback) {
15240 		match_flags = PHYI_FAILED;
15241 		ire = start_ire;
15242 		irep = NULL;
15243 		goto redo;
15244 	}
15245 	ire_refrele(save_ire);
15246 
15247 	/*
15248 	 * irep non-NULL indicates that we entered the while loop
15249 	 * above. If clear_ire is at the insertion point, we don't
15250 	 * have to do anything. clear_ire will be NULL if all the
15251 	 * interfaces are failed.
15252 	 *
15253 	 * We cannot unlink and reinsert the ire at the right place
15254 	 * in the list since there can be other walkers of this bucket.
15255 	 * Instead we delete and recreate the ire
15256 	 */
15257 	if (clear_ire != NULL && irep != NULL && *irep != clear_ire) {
15258 		ire_t *clear_ire_stq = NULL;
15259 		mblk_t *fp_mp = NULL, *res_mp = NULL;
15260 
15261 		bzero(new_lb_ire, sizeof (ire_t));
15262 		if (clear_ire->ire_nce != NULL) {
15263 			fp_mp = clear_ire->ire_nce->nce_fp_mp;
15264 			res_mp = clear_ire->ire_nce->nce_res_mp;
15265 		}
15266 		/* XXX We need a recovery strategy here. */
15267 		if (ire_init(new_lb_ire,
15268 		    (uchar_t *)&clear_ire->ire_addr,
15269 		    (uchar_t *)&clear_ire->ire_mask,
15270 		    (uchar_t *)&clear_ire->ire_src_addr,
15271 		    (uchar_t *)&clear_ire->ire_gateway_addr,
15272 		    (uchar_t *)&clear_ire->ire_in_src_addr,
15273 		    &clear_ire->ire_max_frag,
15274 		    fp_mp,
15275 		    clear_ire->ire_rfq,
15276 		    clear_ire->ire_stq,
15277 		    clear_ire->ire_type,
15278 		    res_mp,
15279 		    clear_ire->ire_ipif,
15280 		    clear_ire->ire_in_ill,
15281 		    clear_ire->ire_cmask,
15282 		    clear_ire->ire_phandle,
15283 		    clear_ire->ire_ihandle,
15284 		    clear_ire->ire_flags,
15285 		    &clear_ire->ire_uinfo,
15286 		    NULL,
15287 		    NULL) == NULL)
15288 			cmn_err(CE_PANIC, "ire_init() failed");
15289 		if (clear_ire->ire_stq == NULL) {
15290 			ire_t *ire_next = clear_ire->ire_next;
15291 			if (ire_next != NULL &&
15292 			    ire_next->ire_stq != NULL &&
15293 			    ire_next->ire_addr == clear_ire->ire_addr &&
15294 			    ire_next->ire_ipif->ipif_ill ==
15295 			    clear_ire->ire_ipif->ipif_ill) {
15296 				clear_ire_stq = ire_next;
15297 
15298 				bzero(new_nlb_ire, sizeof (ire_t));
15299 				if (clear_ire_stq->ire_nce != NULL) {
15300 					fp_mp =
15301 					    clear_ire_stq->ire_nce->nce_fp_mp;
15302 					res_mp =
15303 					    clear_ire_stq->ire_nce->nce_res_mp;
15304 				} else {
15305 					fp_mp = res_mp = NULL;
15306 				}
15307 				/* XXX We need a recovery strategy here. */
15308 				if (ire_init(new_nlb_ire,
15309 				    (uchar_t *)&clear_ire_stq->ire_addr,
15310 				    (uchar_t *)&clear_ire_stq->ire_mask,
15311 				    (uchar_t *)&clear_ire_stq->ire_src_addr,
15312 				    (uchar_t *)&clear_ire_stq->ire_gateway_addr,
15313 				    (uchar_t *)&clear_ire_stq->ire_in_src_addr,
15314 				    &clear_ire_stq->ire_max_frag,
15315 				    fp_mp,
15316 				    clear_ire_stq->ire_rfq,
15317 				    clear_ire_stq->ire_stq,
15318 				    clear_ire_stq->ire_type,
15319 				    res_mp,
15320 				    clear_ire_stq->ire_ipif,
15321 				    clear_ire_stq->ire_in_ill,
15322 				    clear_ire_stq->ire_cmask,
15323 				    clear_ire_stq->ire_phandle,
15324 				    clear_ire_stq->ire_ihandle,
15325 				    clear_ire_stq->ire_flags,
15326 				    &clear_ire_stq->ire_uinfo,
15327 				    NULL,
15328 				    NULL) == NULL)
15329 					cmn_err(CE_PANIC, "ire_init() failed");
15330 			}
15331 		}
15332 
15333 		/*
15334 		 * Delete the ire. We can't call ire_delete() since
15335 		 * we are holding the bucket lock. We can't release the
15336 		 * bucket lock since we can't allow irep to change. So just
15337 		 * mark it CONDEMNED. The IRB_REFRELE will delete the
15338 		 * ire from the list and do the refrele.
15339 		 */
15340 		clear_ire->ire_marks |= IRE_MARK_CONDEMNED;
15341 		irb->irb_marks |= IRB_MARK_CONDEMNED;
15342 
15343 		if (clear_ire_stq != NULL) {
15344 			ire_fastpath_list_delete(
15345 			    (ill_t *)clear_ire_stq->ire_stq->q_ptr,
15346 			    clear_ire_stq);
15347 			clear_ire_stq->ire_marks |= IRE_MARK_CONDEMNED;
15348 		}
15349 
15350 		/*
15351 		 * Also take care of otherfields like ib/ob pkt count
15352 		 * etc. Need to dup them. ditto in ill_bcast_delete_and_add
15353 		 */
15354 
15355 		/* Add the new ire's. Insert at *irep */
15356 		new_lb_ire->ire_bucket = clear_ire->ire_bucket;
15357 		ire1 = *irep;
15358 		if (ire1 != NULL)
15359 			ire1->ire_ptpn = &new_lb_ire->ire_next;
15360 		new_lb_ire->ire_next = ire1;
15361 		/* Link the new one in. */
15362 		new_lb_ire->ire_ptpn = irep;
15363 		membar_producer();
15364 		*irep = new_lb_ire;
15365 		new_lb_ire_used = B_TRUE;
15366 		BUMP_IRE_STATS(ire_stats_v4, ire_stats_inserted);
15367 		new_lb_ire->ire_bucket->irb_ire_cnt++;
15368 		new_lb_ire->ire_ipif->ipif_ire_cnt++;
15369 
15370 		if (clear_ire_stq != NULL) {
15371 			new_nlb_ire->ire_bucket = clear_ire->ire_bucket;
15372 			irep = &new_lb_ire->ire_next;
15373 			/* Add the new ire. Insert at *irep */
15374 			ire1 = *irep;
15375 			if (ire1 != NULL)
15376 				ire1->ire_ptpn = &new_nlb_ire->ire_next;
15377 			new_nlb_ire->ire_next = ire1;
15378 			/* Link the new one in. */
15379 			new_nlb_ire->ire_ptpn = irep;
15380 			membar_producer();
15381 			*irep = new_nlb_ire;
15382 			new_nlb_ire_used = B_TRUE;
15383 			BUMP_IRE_STATS(ire_stats_v4, ire_stats_inserted);
15384 			new_nlb_ire->ire_bucket->irb_ire_cnt++;
15385 			new_nlb_ire->ire_ipif->ipif_ire_cnt++;
15386 			((ill_t *)new_nlb_ire->ire_stq->q_ptr)->ill_ire_cnt++;
15387 		}
15388 	}
15389 	rw_exit(&irb->irb_lock);
15390 	if (!new_lb_ire_used)
15391 		kmem_cache_free(ire_cache, new_lb_ire);
15392 	if (!new_nlb_ire_used)
15393 		kmem_cache_free(ire_cache, new_nlb_ire);
15394 	IRB_REFRELE(irb);
15395 }
15396 
15397 /*
15398  * Whenever an ipif goes down we have to renominate a different
15399  * broadcast ire to receive. Whenever an ipif comes up, we need
15400  * to make sure that we have only one nominated to receive.
15401  */
15402 static void
15403 ipif_renominate_bcast(ipif_t *ipif)
15404 {
15405 	ill_t *ill = ipif->ipif_ill;
15406 	ipaddr_t subnet_addr;
15407 	ipaddr_t net_addr;
15408 	ipaddr_t net_mask = 0;
15409 	ipaddr_t subnet_netmask;
15410 	ipaddr_t addr;
15411 	ill_group_t *illgrp;
15412 
15413 	illgrp = ill->ill_group;
15414 	/*
15415 	 * If this is the last ipif going down, it might take
15416 	 * the ill out of the group. In that case ipif_down ->
15417 	 * illgrp_delete takes care of doing the nomination.
15418 	 * ipif_down does not call for this case.
15419 	 */
15420 	ASSERT(illgrp != NULL);
15421 
15422 	/* There could not have been any ires associated with this */
15423 	if (ipif->ipif_subnet == 0)
15424 		return;
15425 
15426 	ill_mark_bcast(illgrp, 0);
15427 	ill_mark_bcast(illgrp, INADDR_BROADCAST);
15428 
15429 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
15430 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
15431 		net_mask = ip_net_mask(ipif->ipif_lcl_addr);
15432 	} else {
15433 		net_mask = htonl(IN_CLASSA_NET);
15434 	}
15435 	addr = net_mask & ipif->ipif_subnet;
15436 	ill_mark_bcast(illgrp, addr);
15437 
15438 	net_addr = ~net_mask | addr;
15439 	ill_mark_bcast(illgrp, net_addr);
15440 
15441 	subnet_netmask = ipif->ipif_net_mask;
15442 	addr = ipif->ipif_subnet;
15443 	ill_mark_bcast(illgrp, addr);
15444 
15445 	subnet_addr = ~subnet_netmask | addr;
15446 	ill_mark_bcast(illgrp, subnet_addr);
15447 }
15448 
15449 /*
15450  * Whenever we form or delete ill groups, we need to nominate one set of
15451  * BROADCAST ires for receiving in the group.
15452  *
15453  * 1) When ipif_up_done -> ilgrp_insert calls this function, BROADCAST ires
15454  *    have been added, but ill_ipif_up_count is 0. Thus, we don't assert
15455  *    for ill_ipif_up_count to be non-zero. This is the only case where
15456  *    ill_ipif_up_count is zero and we would still find the ires.
15457  *
15458  * 2) ip_sioctl_group_name/ifgrp_insert calls this function, at least one
15459  *    ipif is UP and we just have to do the nomination.
15460  *
15461  * 3) When ill_handoff_responsibility calls us, some ill has been removed
15462  *    from the group. So, we have to do the nomination.
15463  *
15464  * Because of (3), there could be just one ill in the group. But we have
15465  * to nominate still as IRE_MARK_NORCV may have been marked on this.
15466  * Thus, this function does not optimize when there is only one ill as
15467  * it is not correct for (3).
15468  */
15469 static void
15470 ill_nominate_bcast_rcv(ill_group_t *illgrp)
15471 {
15472 	ill_t *ill;
15473 	ipif_t *ipif;
15474 	ipaddr_t subnet_addr;
15475 	ipaddr_t prev_subnet_addr = 0;
15476 	ipaddr_t net_addr;
15477 	ipaddr_t prev_net_addr = 0;
15478 	ipaddr_t net_mask = 0;
15479 	ipaddr_t subnet_netmask;
15480 	ipaddr_t addr;
15481 
15482 	/*
15483 	 * When the last memeber is leaving, there is nothing to
15484 	 * nominate.
15485 	 */
15486 	if (illgrp->illgrp_ill_count == 0) {
15487 		ASSERT(illgrp->illgrp_ill == NULL);
15488 		return;
15489 	}
15490 
15491 	ill = illgrp->illgrp_ill;
15492 	ASSERT(!ill->ill_isv6);
15493 	/*
15494 	 * We assume that ires with same address and belonging to the
15495 	 * same group, has been grouped together. Nominating a *single*
15496 	 * ill in the group for sending and receiving broadcast is done
15497 	 * by making sure that the first BROADCAST ire (which will be
15498 	 * the one returned by ire_ctable_lookup for ip_rput and the
15499 	 * one that will be used in ip_wput_ire) will be the one that
15500 	 * will not have IRE_MARK_NORECV set.
15501 	 *
15502 	 * 1) ip_rput checks and discards packets received on ires marked
15503 	 *    with IRE_MARK_NORECV. Thus, we don't send up duplicate
15504 	 *    broadcast packets. We need to clear IRE_MARK_NORECV on the
15505 	 *    first ire in the group for every broadcast address in the group.
15506 	 *    ip_rput will accept packets only on the first ire i.e only
15507 	 *    one copy of the ill.
15508 	 *
15509 	 * 2) ip_wput_ire needs to send out just one copy of the broadcast
15510 	 *    packet for the whole group. It needs to send out on the ill
15511 	 *    whose ire has not been marked with IRE_MARK_NORECV. If it sends
15512 	 *    on the one marked with IRE_MARK_NORECV, ip_rput will accept
15513 	 *    the copy echoed back on other port where the ire is not marked
15514 	 *    with IRE_MARK_NORECV.
15515 	 *
15516 	 * Note that we just need to have the first IRE either loopback or
15517 	 * non-loopback (either of them may not exist if ire_create failed
15518 	 * during ipif_down) with IRE_MARK_NORECV not set. ip_rput will
15519 	 * always hit the first one and hence will always accept one copy.
15520 	 *
15521 	 * We have a broadcast ire per ill for all the unique prefixes
15522 	 * hosted on that ill. As we don't have a way of knowing the
15523 	 * unique prefixes on a given ill and hence in the whole group,
15524 	 * we just call ill_mark_bcast on all the prefixes that exist
15525 	 * in the group. For the common case of one prefix, the code
15526 	 * below optimizes by remebering the last address used for
15527 	 * markng. In the case of multiple prefixes, this will still
15528 	 * optimize depending the order of prefixes.
15529 	 *
15530 	 * The only unique address across the whole group is 0.0.0.0 and
15531 	 * 255.255.255.255 and thus we call only once. ill_mark_bcast enables
15532 	 * the first ire in the bucket for receiving and disables the
15533 	 * others.
15534 	 */
15535 	ill_mark_bcast(illgrp, 0);
15536 	ill_mark_bcast(illgrp, INADDR_BROADCAST);
15537 	for (; ill != NULL; ill = ill->ill_group_next) {
15538 
15539 		for (ipif = ill->ill_ipif; ipif != NULL;
15540 		    ipif = ipif->ipif_next) {
15541 
15542 			if (!(ipif->ipif_flags & IPIF_UP) ||
15543 			    ipif->ipif_subnet == 0) {
15544 				continue;
15545 			}
15546 			if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
15547 			    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
15548 				net_mask = ip_net_mask(ipif->ipif_lcl_addr);
15549 			} else {
15550 				net_mask = htonl(IN_CLASSA_NET);
15551 			}
15552 			addr = net_mask & ipif->ipif_subnet;
15553 			if (prev_net_addr == 0 || prev_net_addr != addr) {
15554 				ill_mark_bcast(illgrp, addr);
15555 				net_addr = ~net_mask | addr;
15556 				ill_mark_bcast(illgrp, net_addr);
15557 			}
15558 			prev_net_addr = addr;
15559 
15560 			subnet_netmask = ipif->ipif_net_mask;
15561 			addr = ipif->ipif_subnet;
15562 			if (prev_subnet_addr == 0 ||
15563 			    prev_subnet_addr != addr) {
15564 				ill_mark_bcast(illgrp, addr);
15565 				subnet_addr = ~subnet_netmask | addr;
15566 				ill_mark_bcast(illgrp, subnet_addr);
15567 			}
15568 			prev_subnet_addr = addr;
15569 		}
15570 	}
15571 }
15572 
15573 /*
15574  * This function is called while forming ill groups.
15575  *
15576  * Currently, we handle only allmulti groups. We want to join
15577  * allmulti on only one of the ills in the groups. In future,
15578  * when we have link aggregation, we may have to join normal
15579  * multicast groups on multiple ills as switch does inbound load
15580  * balancing. Following are the functions that calls this
15581  * function :
15582  *
15583  * 1) ill_recover_multicast : Interface is coming back UP.
15584  *    When the first ipif comes back UP, ipif_up_done/ipif_up_done_v6
15585  *    will call ill_recover_multicast to recover all the multicast
15586  *    groups. We need to make sure that only one member is joined
15587  *    in the ill group.
15588  *
15589  * 2) ip_addmulti/ip_addmulti_v6 : ill groups has already been formed.
15590  *    Somebody is joining allmulti. We need to make sure that only one
15591  *    member is joined in the group.
15592  *
15593  * 3) illgrp_insert : If allmulti has already joined, we need to make
15594  *    sure that only one member is joined in the group.
15595  *
15596  * 4) ip_delmulti/ip_delmulti_v6 : Somebody in the group is leaving
15597  *    allmulti who we have nominated. We need to pick someother ill.
15598  *
15599  * 5) illgrp_delete : The ill we nominated is leaving the group,
15600  *    we need to pick a new ill to join the group.
15601  *
15602  * For (1), (2), (5) - we just have to check whether there is
15603  * a good ill joined in the group. If we could not find any ills
15604  * joined the group, we should join.
15605  *
15606  * For (4), the one that was nominated to receive, left the group.
15607  * There could be nobody joined in the group when this function is
15608  * called.
15609  *
15610  * For (3) - we need to explicitly check whether there are multiple
15611  * ills joined in the group.
15612  *
15613  * For simplicity, we don't differentiate any of the above cases. We
15614  * just leave the group if it is joined on any of them and join on
15615  * the first good ill.
15616  */
15617 int
15618 ill_nominate_mcast_rcv(ill_group_t *illgrp)
15619 {
15620 	ilm_t *ilm;
15621 	ill_t *ill;
15622 	ill_t *fallback_inactive_ill = NULL;
15623 	ill_t *fallback_failed_ill = NULL;
15624 	int ret = 0;
15625 
15626 	/*
15627 	 * Leave the allmulti on all the ills and start fresh.
15628 	 */
15629 	for (ill = illgrp->illgrp_ill; ill != NULL;
15630 	    ill = ill->ill_group_next) {
15631 		if (ill->ill_join_allmulti)
15632 			(void) ip_leave_allmulti(ill->ill_ipif);
15633 	}
15634 
15635 	/*
15636 	 * Choose a good ill. Fallback to inactive or failed if
15637 	 * none available. We need to fallback to FAILED in the
15638 	 * case where we have 2 interfaces in a group - where
15639 	 * one of them is failed and another is a good one and
15640 	 * the good one (not marked inactive) is leaving the group.
15641 	 */
15642 	ret = 0;
15643 	for (ill = illgrp->illgrp_ill; ill != NULL;
15644 	    ill = ill->ill_group_next) {
15645 		/* Never pick an offline interface */
15646 		if (ill->ill_phyint->phyint_flags & PHYI_OFFLINE)
15647 			continue;
15648 
15649 		if (ill->ill_phyint->phyint_flags & PHYI_FAILED) {
15650 			fallback_failed_ill = ill;
15651 			continue;
15652 		}
15653 		if (ill->ill_phyint->phyint_flags & PHYI_INACTIVE) {
15654 			fallback_inactive_ill = ill;
15655 			continue;
15656 		}
15657 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
15658 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
15659 				ret = ip_join_allmulti(ill->ill_ipif);
15660 				/*
15661 				 * ip_join_allmulti can fail because of memory
15662 				 * failures. So, make sure we join at least
15663 				 * on one ill.
15664 				 */
15665 				if (ill->ill_join_allmulti)
15666 					return (0);
15667 			}
15668 		}
15669 	}
15670 	if (ret != 0) {
15671 		/*
15672 		 * If we tried nominating above and failed to do so,
15673 		 * return error. We might have tried multiple times.
15674 		 * But, return the latest error.
15675 		 */
15676 		return (ret);
15677 	}
15678 	if ((ill = fallback_inactive_ill) != NULL) {
15679 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
15680 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
15681 				ret = ip_join_allmulti(ill->ill_ipif);
15682 				return (ret);
15683 			}
15684 		}
15685 	} else if ((ill = fallback_failed_ill) != NULL) {
15686 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
15687 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
15688 				ret = ip_join_allmulti(ill->ill_ipif);
15689 				return (ret);
15690 			}
15691 		}
15692 	}
15693 	return (0);
15694 }
15695 
15696 /*
15697  * This function is called from illgrp_delete after it is
15698  * deleted from the group to reschedule responsibilities
15699  * to a different ill.
15700  */
15701 static void
15702 ill_handoff_responsibility(ill_t *ill, ill_group_t *illgrp)
15703 {
15704 	ilm_t	*ilm;
15705 	ipif_t	*ipif;
15706 	ipaddr_t subnet_addr;
15707 	ipaddr_t net_addr;
15708 	ipaddr_t net_mask = 0;
15709 	ipaddr_t subnet_netmask;
15710 	ipaddr_t addr;
15711 
15712 	ASSERT(ill->ill_group == NULL);
15713 	/*
15714 	 * Broadcast Responsibility:
15715 	 *
15716 	 * 1. If this ill has been nominated for receiving broadcast
15717 	 * packets, we need to find a new one. Before we find a new
15718 	 * one, we need to re-group the ires that are part of this new
15719 	 * group (assumed by ill_nominate_bcast_rcv). We do this by
15720 	 * calling ill_group_bcast_for_xmit(ill) which will do the right
15721 	 * thing for us.
15722 	 *
15723 	 * 2. If this ill was not nominated for receiving broadcast
15724 	 * packets, we need to clear the IRE_MARK_NORECV flag
15725 	 * so that we continue to send up broadcast packets.
15726 	 */
15727 	if (!ill->ill_isv6) {
15728 		/*
15729 		 * Case 1 above : No optimization here. Just redo the
15730 		 * nomination.
15731 		 */
15732 		ill_group_bcast_for_xmit(ill);
15733 		ill_nominate_bcast_rcv(illgrp);
15734 
15735 		/*
15736 		 * Case 2 above : Lookup and clear IRE_MARK_NORECV.
15737 		 */
15738 		ill_clear_bcast_mark(ill, 0);
15739 		ill_clear_bcast_mark(ill, INADDR_BROADCAST);
15740 
15741 		for (ipif = ill->ill_ipif; ipif != NULL;
15742 		    ipif = ipif->ipif_next) {
15743 
15744 			if (!(ipif->ipif_flags & IPIF_UP) ||
15745 			    ipif->ipif_subnet == 0) {
15746 				continue;
15747 			}
15748 			if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
15749 			    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
15750 				net_mask = ip_net_mask(ipif->ipif_lcl_addr);
15751 			} else {
15752 				net_mask = htonl(IN_CLASSA_NET);
15753 			}
15754 			addr = net_mask & ipif->ipif_subnet;
15755 			ill_clear_bcast_mark(ill, addr);
15756 
15757 			net_addr = ~net_mask | addr;
15758 			ill_clear_bcast_mark(ill, net_addr);
15759 
15760 			subnet_netmask = ipif->ipif_net_mask;
15761 			addr = ipif->ipif_subnet;
15762 			ill_clear_bcast_mark(ill, addr);
15763 
15764 			subnet_addr = ~subnet_netmask | addr;
15765 			ill_clear_bcast_mark(ill, subnet_addr);
15766 		}
15767 	}
15768 
15769 	/*
15770 	 * Multicast Responsibility.
15771 	 *
15772 	 * If we have joined allmulti on this one, find a new member
15773 	 * in the group to join allmulti. As this ill is already part
15774 	 * of allmulti, we don't have to join on this one.
15775 	 *
15776 	 * If we have not joined allmulti on this one, there is no
15777 	 * responsibility to handoff. But we need to take new
15778 	 * responsibility i.e, join allmulti on this one if we need
15779 	 * to.
15780 	 */
15781 	if (ill->ill_join_allmulti) {
15782 		(void) ill_nominate_mcast_rcv(illgrp);
15783 	} else {
15784 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
15785 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
15786 				(void) ip_join_allmulti(ill->ill_ipif);
15787 				break;
15788 			}
15789 		}
15790 	}
15791 
15792 	/*
15793 	 * We intentionally do the flushing of IRE_CACHES only matching
15794 	 * on the ill and not on groups. Note that we are already deleted
15795 	 * from the group.
15796 	 *
15797 	 * This will make sure that all IRE_CACHES whose stq is pointing
15798 	 * at ill_wq or ire_ipif->ipif_ill pointing at this ill will get
15799 	 * deleted and IRE_CACHES that are not pointing at this ill will
15800 	 * be left alone.
15801 	 */
15802 	if (ill->ill_isv6) {
15803 		ire_walk_ill_v6(MATCH_IRE_ILL | MATCH_IRE_TYPE,
15804 		    IRE_CACHE, illgrp_cache_delete, (char *)ill, ill);
15805 	} else {
15806 		ire_walk_ill_v4(MATCH_IRE_ILL | MATCH_IRE_TYPE,
15807 		    IRE_CACHE, illgrp_cache_delete, (char *)ill, ill);
15808 	}
15809 
15810 	/*
15811 	 * Some conn may have cached one of the IREs deleted above. By removing
15812 	 * the ire reference, we clean up the extra reference to the ill held in
15813 	 * ire->ire_stq.
15814 	 */
15815 	ipcl_walk(conn_cleanup_stale_ire, NULL);
15816 
15817 	/*
15818 	 * Re-do source address selection for all the members in the
15819 	 * group, if they borrowed source address from one of the ipifs
15820 	 * in this ill.
15821 	 */
15822 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
15823 		if (ill->ill_isv6) {
15824 			ipif_update_other_ipifs_v6(ipif, illgrp);
15825 		} else {
15826 			ipif_update_other_ipifs(ipif, illgrp);
15827 		}
15828 	}
15829 }
15830 
15831 /*
15832  * Delete the ill from the group. The caller makes sure that it is
15833  * in a group and it okay to delete from the group. So, we always
15834  * delete here.
15835  */
15836 static void
15837 illgrp_delete(ill_t *ill)
15838 {
15839 	ill_group_t *illgrp;
15840 	ill_group_t *tmpg;
15841 	ill_t *tmp_ill;
15842 
15843 	/*
15844 	 * Reset illgrp_ill_schednext if it was pointing at us.
15845 	 * We need to do this before we set ill_group to NULL.
15846 	 */
15847 	rw_enter(&ill_g_lock, RW_WRITER);
15848 	mutex_enter(&ill->ill_lock);
15849 
15850 	illgrp_reset_schednext(ill);
15851 
15852 	illgrp = ill->ill_group;
15853 
15854 	/* Delete the ill from illgrp. */
15855 	if (illgrp->illgrp_ill == ill) {
15856 		illgrp->illgrp_ill = ill->ill_group_next;
15857 	} else {
15858 		tmp_ill = illgrp->illgrp_ill;
15859 		while (tmp_ill->ill_group_next != ill) {
15860 			tmp_ill = tmp_ill->ill_group_next;
15861 			ASSERT(tmp_ill != NULL);
15862 		}
15863 		tmp_ill->ill_group_next = ill->ill_group_next;
15864 	}
15865 	ill->ill_group = NULL;
15866 	ill->ill_group_next = NULL;
15867 
15868 	illgrp->illgrp_ill_count--;
15869 	mutex_exit(&ill->ill_lock);
15870 	rw_exit(&ill_g_lock);
15871 
15872 	/*
15873 	 * As this ill is leaving the group, we need to hand off
15874 	 * the responsibilities to the other ills in the group, if
15875 	 * this ill had some responsibilities.
15876 	 */
15877 
15878 	ill_handoff_responsibility(ill, illgrp);
15879 
15880 	rw_enter(&ill_g_lock, RW_WRITER);
15881 
15882 	if (illgrp->illgrp_ill_count == 0) {
15883 
15884 		ASSERT(illgrp->illgrp_ill == NULL);
15885 		if (ill->ill_isv6) {
15886 			if (illgrp == illgrp_head_v6) {
15887 				illgrp_head_v6 = illgrp->illgrp_next;
15888 			} else {
15889 				tmpg = illgrp_head_v6;
15890 				while (tmpg->illgrp_next != illgrp) {
15891 					tmpg = tmpg->illgrp_next;
15892 					ASSERT(tmpg != NULL);
15893 				}
15894 				tmpg->illgrp_next = illgrp->illgrp_next;
15895 			}
15896 		} else {
15897 			if (illgrp == illgrp_head_v4) {
15898 				illgrp_head_v4 = illgrp->illgrp_next;
15899 			} else {
15900 				tmpg = illgrp_head_v4;
15901 				while (tmpg->illgrp_next != illgrp) {
15902 					tmpg = tmpg->illgrp_next;
15903 					ASSERT(tmpg != NULL);
15904 				}
15905 				tmpg->illgrp_next = illgrp->illgrp_next;
15906 			}
15907 		}
15908 		mutex_destroy(&illgrp->illgrp_lock);
15909 		mi_free(illgrp);
15910 	}
15911 	rw_exit(&ill_g_lock);
15912 
15913 	/*
15914 	 * Even though the ill is out of the group its not necessary
15915 	 * to set ipsq_split as TRUE as the ipifs could be down temporarily
15916 	 * We will split the ipsq when phyint_groupname is set to NULL.
15917 	 */
15918 
15919 	/*
15920 	 * Send a routing sockets message if we are deleting from
15921 	 * groups with names.
15922 	 */
15923 	if (ill->ill_phyint->phyint_groupname_len != 0)
15924 		ip_rts_ifmsg(ill->ill_ipif);
15925 }
15926 
15927 /*
15928  * Re-do source address selection. This is normally called when
15929  * an ill joins the group or when a non-NOLOCAL/DEPRECATED/ANYCAST
15930  * ipif comes up.
15931  */
15932 void
15933 ill_update_source_selection(ill_t *ill)
15934 {
15935 	ipif_t *ipif;
15936 
15937 	ASSERT(IAM_WRITER_ILL(ill));
15938 
15939 	if (ill->ill_group != NULL)
15940 		ill = ill->ill_group->illgrp_ill;
15941 
15942 	for (; ill != NULL; ill = ill->ill_group_next) {
15943 		for (ipif = ill->ill_ipif; ipif != NULL;
15944 		    ipif = ipif->ipif_next) {
15945 			if (ill->ill_isv6)
15946 				ipif_recreate_interface_routes_v6(NULL, ipif);
15947 			else
15948 				ipif_recreate_interface_routes(NULL, ipif);
15949 		}
15950 	}
15951 }
15952 
15953 /*
15954  * Insert ill in a group headed by illgrp_head. The caller can either
15955  * pass a groupname in which case we search for a group with the
15956  * same name to insert in or pass a group to insert in. This function
15957  * would only search groups with names.
15958  *
15959  * NOTE : The caller should make sure that there is at least one ipif
15960  *	  UP on this ill so that illgrp_scheduler can pick this ill
15961  *	  for outbound packets. If ill_ipif_up_count is zero, we have
15962  *	  already sent a DL_UNBIND to the driver and we don't want to
15963  *	  send anymore packets. We don't assert for ipif_up_count
15964  *	  to be greater than zero, because ipif_up_done wants to call
15965  *	  this function before bumping up the ipif_up_count. See
15966  *	  ipif_up_done() for details.
15967  */
15968 int
15969 illgrp_insert(ill_group_t **illgrp_head, ill_t *ill, char *groupname,
15970     ill_group_t *grp_to_insert, boolean_t ipif_is_coming_up)
15971 {
15972 	ill_group_t *illgrp;
15973 	ill_t *prev_ill;
15974 	phyint_t *phyi;
15975 
15976 	ASSERT(ill->ill_group == NULL);
15977 
15978 	rw_enter(&ill_g_lock, RW_WRITER);
15979 	mutex_enter(&ill->ill_lock);
15980 
15981 	if (groupname != NULL) {
15982 		/*
15983 		 * Look for a group with a matching groupname to insert.
15984 		 */
15985 		for (illgrp = *illgrp_head; illgrp != NULL;
15986 		    illgrp = illgrp->illgrp_next) {
15987 
15988 			ill_t *tmp_ill;
15989 
15990 			/*
15991 			 * If we have an ill_group_t in the list which has
15992 			 * no ill_t assigned then we must be in the process of
15993 			 * removing this group. We skip this as illgrp_delete()
15994 			 * will remove it from the list.
15995 			 */
15996 			if ((tmp_ill = illgrp->illgrp_ill) == NULL) {
15997 				ASSERT(illgrp->illgrp_ill_count == 0);
15998 				continue;
15999 			}
16000 
16001 			ASSERT(tmp_ill->ill_phyint != NULL);
16002 			phyi = tmp_ill->ill_phyint;
16003 			/*
16004 			 * Look at groups which has names only.
16005 			 */
16006 			if (phyi->phyint_groupname_len == 0)
16007 				continue;
16008 			/*
16009 			 * Names are stored in the phyint common to both
16010 			 * IPv4 and IPv6.
16011 			 */
16012 			if (mi_strcmp(phyi->phyint_groupname,
16013 			    groupname) == 0) {
16014 				break;
16015 			}
16016 		}
16017 	} else {
16018 		/*
16019 		 * If the caller passes in a NULL "grp_to_insert", we
16020 		 * allocate one below and insert this singleton.
16021 		 */
16022 		illgrp = grp_to_insert;
16023 	}
16024 
16025 	ill->ill_group_next = NULL;
16026 
16027 	if (illgrp == NULL) {
16028 		illgrp = (ill_group_t *)mi_zalloc(sizeof (ill_group_t));
16029 		if (illgrp == NULL) {
16030 			return (ENOMEM);
16031 		}
16032 		illgrp->illgrp_next = *illgrp_head;
16033 		*illgrp_head = illgrp;
16034 		illgrp->illgrp_ill = ill;
16035 		illgrp->illgrp_ill_count = 1;
16036 		ill->ill_group = illgrp;
16037 		/*
16038 		 * Used in illgrp_scheduler to protect multiple threads
16039 		 * from traversing the list.
16040 		 */
16041 		mutex_init(&illgrp->illgrp_lock, NULL, MUTEX_DEFAULT, 0);
16042 	} else {
16043 		ASSERT(ill->ill_net_type ==
16044 		    illgrp->illgrp_ill->ill_net_type);
16045 		ASSERT(ill->ill_type == illgrp->illgrp_ill->ill_type);
16046 
16047 		/* Insert ill at tail of this group */
16048 		prev_ill = illgrp->illgrp_ill;
16049 		while (prev_ill->ill_group_next != NULL)
16050 			prev_ill = prev_ill->ill_group_next;
16051 		prev_ill->ill_group_next = ill;
16052 		ill->ill_group = illgrp;
16053 		illgrp->illgrp_ill_count++;
16054 		/*
16055 		 * Inherit group properties. Currently only forwarding
16056 		 * is the property we try to keep the same with all the
16057 		 * ills. When there are more, we will abstract this into
16058 		 * a function.
16059 		 */
16060 		ill->ill_flags &= ~ILLF_ROUTER;
16061 		ill->ill_flags |= (illgrp->illgrp_ill->ill_flags & ILLF_ROUTER);
16062 	}
16063 	mutex_exit(&ill->ill_lock);
16064 	rw_exit(&ill_g_lock);
16065 
16066 	/*
16067 	 * 1) When ipif_up_done() calls this function, ipif_up_count
16068 	 *    may be zero as it has not yet been bumped. But the ires
16069 	 *    have already been added. So, we do the nomination here
16070 	 *    itself. But, when ip_sioctl_groupname calls this, it checks
16071 	 *    for ill_ipif_up_count != 0. Thus we don't check for
16072 	 *    ill_ipif_up_count here while nominating broadcast ires for
16073 	 *    receive.
16074 	 *
16075 	 * 2) Similarly, we need to call ill_group_bcast_for_xmit here
16076 	 *    to group them properly as ire_add() has already happened
16077 	 *    in the ipif_up_done() case. For ip_sioctl_groupname/ifgrp_insert
16078 	 *    case, we need to do it here anyway.
16079 	 */
16080 	if (!ill->ill_isv6) {
16081 		ill_group_bcast_for_xmit(ill);
16082 		ill_nominate_bcast_rcv(illgrp);
16083 	}
16084 
16085 	if (!ipif_is_coming_up) {
16086 		/*
16087 		 * When ipif_up_done() calls this function, the multicast
16088 		 * groups have not been joined yet. So, there is no point in
16089 		 * nomination. ip_join_allmulti will handle groups when
16090 		 * ill_recover_multicast is called from ipif_up_done() later.
16091 		 */
16092 		(void) ill_nominate_mcast_rcv(illgrp);
16093 		/*
16094 		 * ipif_up_done calls ill_update_source_selection
16095 		 * anyway. Moreover, we don't want to re-create
16096 		 * interface routes while ipif_up_done() still has reference
16097 		 * to them. Refer to ipif_up_done() for more details.
16098 		 */
16099 		ill_update_source_selection(ill);
16100 	}
16101 
16102 	/*
16103 	 * Send a routing sockets message if we are inserting into
16104 	 * groups with names.
16105 	 */
16106 	if (groupname != NULL)
16107 		ip_rts_ifmsg(ill->ill_ipif);
16108 	return (0);
16109 }
16110 
16111 /*
16112  * Return the first phyint matching the groupname. There could
16113  * be more than one when there are ill groups.
16114  *
16115  * Needs work: called only from ip_sioctl_groupname
16116  */
16117 static phyint_t *
16118 phyint_lookup_group(char *groupname)
16119 {
16120 	phyint_t *phyi;
16121 
16122 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
16123 	/*
16124 	 * Group names are stored in the phyint - a common structure
16125 	 * to both IPv4 and IPv6.
16126 	 */
16127 	phyi = avl_first(&phyint_g_list.phyint_list_avl_by_index);
16128 	for (; phyi != NULL;
16129 	    phyi = avl_walk(&phyint_g_list.phyint_list_avl_by_index,
16130 	    phyi, AVL_AFTER)) {
16131 		if (phyi->phyint_groupname_len == 0)
16132 			continue;
16133 		ASSERT(phyi->phyint_groupname != NULL);
16134 		if (mi_strcmp(groupname, phyi->phyint_groupname) == 0)
16135 			return (phyi);
16136 	}
16137 	return (NULL);
16138 }
16139 
16140 
16141 
16142 /*
16143  * MT notes on creation and deletion of IPMP groups
16144  *
16145  * Creation and deletion of IPMP groups introduce the need to merge or
16146  * split the associated serialization objects i.e the ipsq's. Normally all
16147  * the ills in an IPMP group would map to a single ipsq. If IPMP is not enabled
16148  * an ill-pair(v4, v6) i.e. phyint would map to a single ipsq. However during
16149  * the execution of the SIOCSLIFGROUPNAME command the picture changes. There
16150  * is a need to change the <ill-ipsq> association and we have to operate on both
16151  * the source and destination IPMP groups. For eg. attempting to set the
16152  * groupname of hme0 to mpk17-85 when it already belongs to mpk17-84 has to
16153  * handle 2 IPMP groups and 2 ipsqs. All the ills belonging to either of the
16154  * source or destination IPMP group are mapped to a single ipsq for executing
16155  * the SIOCSLIFGROUPNAME command. This is termed as a merge of the ipsq's.
16156  * The <ill-ipsq> mapping is restored back to normal at a later point. This is
16157  * termed as a split of the ipsq. The converse of the merge i.e. a split of the
16158  * ipsq happens while unwinding from ipsq_exit. If at least 1 set groupname
16159  * occurred on the ipsq, then the ipsq_split flag is set. This indicates the
16160  * ipsq has to be examined for redoing the <ill-ipsq> associations.
16161  *
16162  * In the above example the ioctl handling code locates the current ipsq of hme0
16163  * which is ipsq(mpk17-84). It then enters the above ipsq immediately or
16164  * eventually (after queueing the ioctl in ipsq(mpk17-84)). Then it locates
16165  * the destination ipsq which is ipsq(mpk17-85) and merges the source ipsq into
16166  * the destination ipsq. If the destination ipsq is not busy, it also enters
16167  * the destination ipsq exclusively. Now the actual groupname setting operation
16168  * can proceed. If the destination ipsq is busy, the operation is enqueued
16169  * on the destination (merged) ipsq and will be handled in the unwind from
16170  * ipsq_exit.
16171  *
16172  * To prevent other threads accessing the ill while the group name change is
16173  * in progres, we bring down the ipifs which also removes the ill from the
16174  * group. The group is changed in phyint and when the first ipif on the ill
16175  * is brought up, the ill is inserted into the right IPMP group by
16176  * illgrp_insert.
16177  */
16178 /* ARGSUSED */
16179 int
16180 ip_sioctl_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16181     ip_ioctl_cmd_t *ipip, void *ifreq)
16182 {
16183 	int i;
16184 	char *tmp;
16185 	int namelen;
16186 	ill_t *ill = ipif->ipif_ill;
16187 	ill_t *ill_v4, *ill_v6;
16188 	int err = 0;
16189 	phyint_t *phyi;
16190 	phyint_t *phyi_tmp;
16191 	struct lifreq *lifr;
16192 	mblk_t	*mp1;
16193 	char *groupname;
16194 	ipsq_t *ipsq;
16195 
16196 	ASSERT(IAM_WRITER_IPIF(ipif));
16197 
16198 	/* Existance verified in ip_wput_nondata */
16199 	mp1 = mp->b_cont->b_cont;
16200 	lifr = (struct lifreq *)mp1->b_rptr;
16201 	groupname = lifr->lifr_groupname;
16202 
16203 	if (ipif->ipif_id != 0)
16204 		return (EINVAL);
16205 
16206 	phyi = ill->ill_phyint;
16207 	ASSERT(phyi != NULL);
16208 
16209 	if (phyi->phyint_flags & PHYI_VIRTUAL)
16210 		return (EINVAL);
16211 
16212 	tmp = groupname;
16213 	for (i = 0; i < LIFNAMSIZ && *tmp != '\0'; tmp++, i++)
16214 		;
16215 
16216 	if (i == LIFNAMSIZ) {
16217 		/* no null termination */
16218 		return (EINVAL);
16219 	}
16220 
16221 	/*
16222 	 * Calculate the namelen exclusive of the null
16223 	 * termination character.
16224 	 */
16225 	namelen = tmp - groupname;
16226 
16227 	ill_v4 = phyi->phyint_illv4;
16228 	ill_v6 = phyi->phyint_illv6;
16229 
16230 	/*
16231 	 * ILL cannot be part of a usesrc group and and IPMP group at the
16232 	 * same time. No need to grab the ill_g_usesrc_lock here, see
16233 	 * synchronization notes in ip.c
16234 	 */
16235 	if (ipif->ipif_ill->ill_usesrc_grp_next != NULL) {
16236 		return (EINVAL);
16237 	}
16238 
16239 	/*
16240 	 * mark the ill as changing.
16241 	 * this should queue all new requests on the syncq.
16242 	 */
16243 	GRAB_ILL_LOCKS(ill_v4, ill_v6);
16244 
16245 	if (ill_v4 != NULL)
16246 		ill_v4->ill_state_flags |= ILL_CHANGING;
16247 	if (ill_v6 != NULL)
16248 		ill_v6->ill_state_flags |= ILL_CHANGING;
16249 	RELEASE_ILL_LOCKS(ill_v4, ill_v6);
16250 
16251 	if (namelen == 0) {
16252 		/*
16253 		 * Null string means remove this interface from the
16254 		 * existing group.
16255 		 */
16256 		if (phyi->phyint_groupname_len == 0) {
16257 			/*
16258 			 * Never was in a group.
16259 			 */
16260 			err = 0;
16261 			goto done;
16262 		}
16263 
16264 		/*
16265 		 * IPv4 or IPv6 may be temporarily out of the group when all
16266 		 * the ipifs are down. Thus, we need to check for ill_group to
16267 		 * be non-NULL.
16268 		 */
16269 		if (ill_v4 != NULL && ill_v4->ill_group != NULL) {
16270 			ill_down_ipifs(ill_v4, mp, 0, B_FALSE);
16271 			mutex_enter(&ill_v4->ill_lock);
16272 			if (!ill_is_quiescent(ill_v4)) {
16273 				/*
16274 				 * ipsq_pending_mp_add will not fail since
16275 				 * connp is NULL
16276 				 */
16277 				(void) ipsq_pending_mp_add(NULL,
16278 				    ill_v4->ill_ipif, q, mp, ILL_DOWN);
16279 				mutex_exit(&ill_v4->ill_lock);
16280 				err = EINPROGRESS;
16281 				goto done;
16282 			}
16283 			mutex_exit(&ill_v4->ill_lock);
16284 		}
16285 
16286 		if (ill_v6 != NULL && ill_v6->ill_group != NULL) {
16287 			ill_down_ipifs(ill_v6, mp, 0, B_FALSE);
16288 			mutex_enter(&ill_v6->ill_lock);
16289 			if (!ill_is_quiescent(ill_v6)) {
16290 				(void) ipsq_pending_mp_add(NULL,
16291 				    ill_v6->ill_ipif, q, mp, ILL_DOWN);
16292 				mutex_exit(&ill_v6->ill_lock);
16293 				err = EINPROGRESS;
16294 				goto done;
16295 			}
16296 			mutex_exit(&ill_v6->ill_lock);
16297 		}
16298 
16299 		rw_enter(&ill_g_lock, RW_WRITER);
16300 		GRAB_ILL_LOCKS(ill_v4, ill_v6);
16301 		mutex_enter(&phyi->phyint_lock);
16302 		ASSERT(phyi->phyint_groupname != NULL);
16303 		mi_free(phyi->phyint_groupname);
16304 		phyi->phyint_groupname = NULL;
16305 		phyi->phyint_groupname_len = 0;
16306 		mutex_exit(&phyi->phyint_lock);
16307 		RELEASE_ILL_LOCKS(ill_v4, ill_v6);
16308 		rw_exit(&ill_g_lock);
16309 		err = ill_up_ipifs(ill, q, mp);
16310 
16311 		/*
16312 		 * set the split flag so that the ipsq can be split
16313 		 */
16314 		mutex_enter(&phyi->phyint_ipsq->ipsq_lock);
16315 		phyi->phyint_ipsq->ipsq_split = B_TRUE;
16316 		mutex_exit(&phyi->phyint_ipsq->ipsq_lock);
16317 
16318 	} else {
16319 		if (phyi->phyint_groupname_len != 0) {
16320 			ASSERT(phyi->phyint_groupname != NULL);
16321 			/* Are we inserting in the same group ? */
16322 			if (mi_strcmp(groupname,
16323 			    phyi->phyint_groupname) == 0) {
16324 				err = 0;
16325 				goto done;
16326 			}
16327 		}
16328 
16329 		rw_enter(&ill_g_lock, RW_READER);
16330 		/*
16331 		 * Merge ipsq for the group's.
16332 		 * This check is here as multiple groups/ills might be
16333 		 * sharing the same ipsq.
16334 		 * If we have to merege than the operation is restarted
16335 		 * on the new ipsq.
16336 		 */
16337 		ipsq = ip_ipsq_lookup(groupname, B_FALSE, NULL);
16338 		if (phyi->phyint_ipsq != ipsq) {
16339 			rw_exit(&ill_g_lock);
16340 			err = ill_merge_groups(ill, NULL, groupname, mp, q);
16341 			goto done;
16342 		}
16343 		/*
16344 		 * Running exclusive on new ipsq.
16345 		 */
16346 
16347 		ASSERT(ipsq != NULL);
16348 		ASSERT(ipsq->ipsq_writer == curthread);
16349 
16350 		/*
16351 		 * Check whether the ill_type and ill_net_type matches before
16352 		 * we allocate any memory so that the cleanup is easier.
16353 		 *
16354 		 * We can't group dissimilar ones as we can't load spread
16355 		 * packets across the group because of potential link-level
16356 		 * header differences.
16357 		 */
16358 		phyi_tmp = phyint_lookup_group(groupname);
16359 		if (phyi_tmp != NULL) {
16360 			if ((ill_v4 != NULL &&
16361 			    phyi_tmp->phyint_illv4 != NULL) &&
16362 			    ((ill_v4->ill_net_type !=
16363 			    phyi_tmp->phyint_illv4->ill_net_type) ||
16364 			    (ill_v4->ill_type !=
16365 			    phyi_tmp->phyint_illv4->ill_type))) {
16366 				mutex_enter(&phyi->phyint_ipsq->ipsq_lock);
16367 				phyi->phyint_ipsq->ipsq_split = B_TRUE;
16368 				mutex_exit(&phyi->phyint_ipsq->ipsq_lock);
16369 				rw_exit(&ill_g_lock);
16370 				return (EINVAL);
16371 			}
16372 			if ((ill_v6 != NULL &&
16373 			    phyi_tmp->phyint_illv6 != NULL) &&
16374 			    ((ill_v6->ill_net_type !=
16375 			    phyi_tmp->phyint_illv6->ill_net_type) ||
16376 			    (ill_v6->ill_type !=
16377 			    phyi_tmp->phyint_illv6->ill_type))) {
16378 				mutex_enter(&phyi->phyint_ipsq->ipsq_lock);
16379 				phyi->phyint_ipsq->ipsq_split = B_TRUE;
16380 				mutex_exit(&phyi->phyint_ipsq->ipsq_lock);
16381 				rw_exit(&ill_g_lock);
16382 				return (EINVAL);
16383 			}
16384 		}
16385 
16386 		rw_exit(&ill_g_lock);
16387 
16388 		/*
16389 		 * bring down all v4 ipifs.
16390 		 */
16391 		if (ill_v4 != NULL) {
16392 			ill_down_ipifs(ill_v4, mp, 0, B_FALSE);
16393 		}
16394 
16395 		/*
16396 		 * bring down all v6 ipifs.
16397 		 */
16398 		if (ill_v6 != NULL) {
16399 			ill_down_ipifs(ill_v6, mp, 0, B_FALSE);
16400 		}
16401 
16402 		/*
16403 		 * make sure all ipifs are down and there are no active
16404 		 * references. Call to ipsq_pending_mp_add will not fail
16405 		 * since connp is NULL.
16406 		 */
16407 		if (ill_v4 != NULL) {
16408 			mutex_enter(&ill_v4->ill_lock);
16409 			if (!ill_is_quiescent(ill_v4)) {
16410 				(void) ipsq_pending_mp_add(NULL,
16411 				    ill_v4->ill_ipif, q, mp, ILL_DOWN);
16412 				mutex_exit(&ill_v4->ill_lock);
16413 				err = EINPROGRESS;
16414 				goto done;
16415 			}
16416 			mutex_exit(&ill_v4->ill_lock);
16417 		}
16418 
16419 		if (ill_v6 != NULL) {
16420 			mutex_enter(&ill_v6->ill_lock);
16421 			if (!ill_is_quiescent(ill_v6)) {
16422 				(void) ipsq_pending_mp_add(NULL,
16423 				    ill_v6->ill_ipif, q, mp, ILL_DOWN);
16424 				mutex_exit(&ill_v6->ill_lock);
16425 				err = EINPROGRESS;
16426 				goto done;
16427 			}
16428 			mutex_exit(&ill_v6->ill_lock);
16429 		}
16430 
16431 		/*
16432 		 * allocate including space for null terminator
16433 		 * before we insert.
16434 		 */
16435 		tmp = (char *)mi_alloc(namelen + 1, BPRI_MED);
16436 		if (tmp == NULL)
16437 			return (ENOMEM);
16438 
16439 		rw_enter(&ill_g_lock, RW_WRITER);
16440 		GRAB_ILL_LOCKS(ill_v4, ill_v6);
16441 		mutex_enter(&phyi->phyint_lock);
16442 		if (phyi->phyint_groupname_len != 0) {
16443 			ASSERT(phyi->phyint_groupname != NULL);
16444 			mi_free(phyi->phyint_groupname);
16445 		}
16446 
16447 		/*
16448 		 * setup the new group name.
16449 		 */
16450 		phyi->phyint_groupname = tmp;
16451 		bcopy(groupname, phyi->phyint_groupname, namelen + 1);
16452 		phyi->phyint_groupname_len = namelen + 1;
16453 		mutex_exit(&phyi->phyint_lock);
16454 		RELEASE_ILL_LOCKS(ill_v4, ill_v6);
16455 		rw_exit(&ill_g_lock);
16456 
16457 		err = ill_up_ipifs(ill, q, mp);
16458 	}
16459 
16460 done:
16461 	/*
16462 	 *  normally ILL_CHANGING is cleared in ill_up_ipifs.
16463 	 */
16464 	if (err != EINPROGRESS) {
16465 		GRAB_ILL_LOCKS(ill_v4, ill_v6);
16466 		if (ill_v4 != NULL)
16467 			ill_v4->ill_state_flags &= ~ILL_CHANGING;
16468 		if (ill_v6 != NULL)
16469 			ill_v6->ill_state_flags &= ~ILL_CHANGING;
16470 		RELEASE_ILL_LOCKS(ill_v4, ill_v6);
16471 	}
16472 	return (err);
16473 }
16474 
16475 /* ARGSUSED */
16476 int
16477 ip_sioctl_get_groupname(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
16478     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
16479 {
16480 	ill_t *ill;
16481 	phyint_t *phyi;
16482 	struct lifreq *lifr;
16483 	mblk_t	*mp1;
16484 
16485 	/* Existence verified in ip_wput_nondata */
16486 	mp1 = mp->b_cont->b_cont;
16487 	lifr = (struct lifreq *)mp1->b_rptr;
16488 	ill = ipif->ipif_ill;
16489 	phyi = ill->ill_phyint;
16490 
16491 	lifr->lifr_groupname[0] = '\0';
16492 	/*
16493 	 * ill_group may be null if all the interfaces
16494 	 * are down. But still, the phyint should always
16495 	 * hold the name.
16496 	 */
16497 	if (phyi->phyint_groupname_len != 0) {
16498 		bcopy(phyi->phyint_groupname, lifr->lifr_groupname,
16499 		    phyi->phyint_groupname_len);
16500 	}
16501 
16502 	return (0);
16503 }
16504 
16505 
16506 typedef struct conn_move_s {
16507 	ill_t	*cm_from_ill;
16508 	ill_t	*cm_to_ill;
16509 	int	cm_ifindex;
16510 } conn_move_t;
16511 
16512 /*
16513  * ipcl_walk function for moving conn_multicast_ill for a given ill.
16514  */
16515 static void
16516 conn_move(conn_t *connp, caddr_t arg)
16517 {
16518 	conn_move_t *connm;
16519 	int ifindex;
16520 	int i;
16521 	ill_t *from_ill;
16522 	ill_t *to_ill;
16523 	ilg_t *ilg;
16524 	ilm_t *ret_ilm;
16525 
16526 	connm = (conn_move_t *)arg;
16527 	ifindex = connm->cm_ifindex;
16528 	from_ill = connm->cm_from_ill;
16529 	to_ill = connm->cm_to_ill;
16530 
16531 	/* Change IP_BOUND_IF/IPV6_BOUND_IF associations. */
16532 
16533 	/* All multicast fields protected by conn_lock */
16534 	mutex_enter(&connp->conn_lock);
16535 	ASSERT(connp->conn_outgoing_ill == connp->conn_incoming_ill);
16536 	if ((connp->conn_outgoing_ill == from_ill) &&
16537 	    (ifindex == 0 || connp->conn_orig_bound_ifindex == ifindex)) {
16538 		connp->conn_outgoing_ill = to_ill;
16539 		connp->conn_incoming_ill = to_ill;
16540 	}
16541 
16542 	/* Change IP_MULTICAST_IF/IPV6_MULTICAST_IF associations */
16543 
16544 	if ((connp->conn_multicast_ill == from_ill) &&
16545 	    (ifindex == 0 || connp->conn_orig_multicast_ifindex == ifindex)) {
16546 		connp->conn_multicast_ill = connm->cm_to_ill;
16547 	}
16548 
16549 	/* Change IP_XMIT_IF associations */
16550 	if ((connp->conn_xmit_if_ill == from_ill) &&
16551 	    (ifindex == 0 || connp->conn_orig_xmit_ifindex == ifindex)) {
16552 		connp->conn_xmit_if_ill = to_ill;
16553 	}
16554 	/*
16555 	 * Change the ilg_ill to point to the new one. This assumes
16556 	 * ilm_move_v6 has moved the ilms to new_ill and the driver
16557 	 * has been told to receive packets on this interface.
16558 	 * ilm_move_v6 FAILBACKS all the ilms successfully always.
16559 	 * But when doing a FAILOVER, it might fail with ENOMEM and so
16560 	 * some ilms may not have moved. We check to see whether
16561 	 * the ilms have moved to to_ill. We can't check on from_ill
16562 	 * as in the process of moving, we could have split an ilm
16563 	 * in to two - which has the same orig_ifindex and v6group.
16564 	 *
16565 	 * For IPv4, ilg_ipif moves implicitly. The code below really
16566 	 * does not do anything for IPv4 as ilg_ill is NULL for IPv4.
16567 	 */
16568 	for (i = connp->conn_ilg_inuse - 1; i >= 0; i--) {
16569 		ilg = &connp->conn_ilg[i];
16570 		if ((ilg->ilg_ill == from_ill) &&
16571 		    (ifindex == 0 || ilg->ilg_orig_ifindex == ifindex)) {
16572 			/* ifindex != 0 indicates failback */
16573 			if (ifindex != 0) {
16574 				connp->conn_ilg[i].ilg_ill = to_ill;
16575 				continue;
16576 			}
16577 
16578 			ret_ilm = ilm_lookup_ill_index_v6(to_ill,
16579 			    &ilg->ilg_v6group, ilg->ilg_orig_ifindex,
16580 			    connp->conn_zoneid);
16581 
16582 			if (ret_ilm != NULL)
16583 				connp->conn_ilg[i].ilg_ill = to_ill;
16584 		}
16585 	}
16586 	mutex_exit(&connp->conn_lock);
16587 }
16588 
16589 static void
16590 conn_move_ill(ill_t *from_ill, ill_t *to_ill, int ifindex)
16591 {
16592 	conn_move_t connm;
16593 
16594 	connm.cm_from_ill = from_ill;
16595 	connm.cm_to_ill = to_ill;
16596 	connm.cm_ifindex = ifindex;
16597 
16598 	ipcl_walk(conn_move, (caddr_t)&connm);
16599 }
16600 
16601 /*
16602  * ilm has been moved from from_ill to to_ill.
16603  * Send DL_DISABMULTI_REQ to ill and DL_ENABMULTI_REQ on to_ill.
16604  * appropriately.
16605  *
16606  * NOTE : We can't reuse the code in ip_ll_addmulti/delmulti because
16607  *	  the code there de-references ipif_ill to get the ill to
16608  *	  send multicast requests. It does not work as ipif is on its
16609  *	  move and already moved when this function is called.
16610  *	  Thus, we need to use from_ill and to_ill send down multicast
16611  *	  requests.
16612  */
16613 static void
16614 ilm_send_multicast_reqs(ill_t *from_ill, ill_t *to_ill)
16615 {
16616 	ipif_t *ipif;
16617 	ilm_t *ilm;
16618 
16619 	/*
16620 	 * See whether we need to send down DL_ENABMULTI_REQ on
16621 	 * to_ill as ilm has just been added.
16622 	 */
16623 	ASSERT(IAM_WRITER_ILL(to_ill));
16624 	ASSERT(IAM_WRITER_ILL(from_ill));
16625 
16626 	ILM_WALKER_HOLD(to_ill);
16627 	for (ilm = to_ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
16628 
16629 		if (!ilm->ilm_is_new || (ilm->ilm_flags & ILM_DELETED))
16630 			continue;
16631 		/*
16632 		 * no locks held, ill/ipif cannot dissappear as long
16633 		 * as we are writer.
16634 		 */
16635 		ipif = to_ill->ill_ipif;
16636 		/*
16637 		 * No need to hold any lock as we are the writer and this
16638 		 * can only be changed by a writer.
16639 		 */
16640 		ilm->ilm_is_new = B_FALSE;
16641 
16642 		if (to_ill->ill_net_type != IRE_IF_RESOLVER ||
16643 		    ipif->ipif_flags & IPIF_POINTOPOINT) {
16644 			ip1dbg(("ilm_send_multicast_reqs: to_ill not "
16645 			    "resolver\n"));
16646 			continue;		/* Must be IRE_IF_NORESOLVER */
16647 		}
16648 
16649 
16650 		if (to_ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST) {
16651 			ip1dbg(("ilm_send_multicast_reqs: "
16652 			    "to_ill MULTI_BCAST\n"));
16653 			goto from;
16654 		}
16655 
16656 		if (to_ill->ill_isv6)
16657 			mld_joingroup(ilm);
16658 		else
16659 			igmp_joingroup(ilm);
16660 
16661 		if (to_ill->ill_ipif_up_count == 0) {
16662 			/*
16663 			 * Nobody there. All multicast addresses will be
16664 			 * re-joined when we get the DL_BIND_ACK bringing the
16665 			 * interface up.
16666 			 */
16667 			ilm->ilm_notify_driver = B_FALSE;
16668 			ip1dbg(("ilm_send_multicast_reqs: to_ill nobody up\n"));
16669 			goto from;
16670 		}
16671 
16672 		/*
16673 		 * For allmulti address, we want to join on only one interface.
16674 		 * Checking for ilm_numentries_v6 is not correct as you may
16675 		 * find an ilm with zero address on to_ill, but we may not
16676 		 * have nominated to_ill for receiving. Thus, if we have
16677 		 * nominated from_ill (ill_join_allmulti is set), nominate
16678 		 * only if to_ill is not already nominated (to_ill normally
16679 		 * should not have been nominated if "from_ill" has already
16680 		 * been nominated. As we don't prevent failovers from happening
16681 		 * across groups, we don't assert).
16682 		 */
16683 		if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
16684 			/*
16685 			 * There is no need to hold ill locks as we are
16686 			 * writer on both ills and when ill_join_allmulti
16687 			 * is changed the thread is always a writer.
16688 			 */
16689 			if (from_ill->ill_join_allmulti &&
16690 			    !to_ill->ill_join_allmulti) {
16691 				(void) ip_join_allmulti(to_ill->ill_ipif);
16692 			}
16693 		} else if (ilm->ilm_notify_driver) {
16694 
16695 			/*
16696 			 * This is a newly moved ilm so we need to tell the
16697 			 * driver about the new group. There can be more than
16698 			 * one ilm's for the same group in the list each with a
16699 			 * different orig_ifindex. We have to inform the driver
16700 			 * once. In ilm_move_v[4,6] we only set the flag
16701 			 * ilm_notify_driver for the first ilm.
16702 			 */
16703 
16704 			(void) ip_ll_send_enabmulti_req(to_ill,
16705 			    &ilm->ilm_v6addr);
16706 		}
16707 
16708 		ilm->ilm_notify_driver = B_FALSE;
16709 
16710 		/*
16711 		 * See whether we need to send down DL_DISABMULTI_REQ on
16712 		 * from_ill as ilm has just been removed.
16713 		 */
16714 from:
16715 		ipif = from_ill->ill_ipif;
16716 		if (from_ill->ill_net_type != IRE_IF_RESOLVER ||
16717 		    ipif->ipif_flags & IPIF_POINTOPOINT) {
16718 			ip1dbg(("ilm_send_multicast_reqs: "
16719 			    "from_ill not resolver\n"));
16720 			continue;		/* Must be IRE_IF_NORESOLVER */
16721 		}
16722 
16723 		if (from_ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST) {
16724 			ip1dbg(("ilm_send_multicast_reqs: "
16725 			    "from_ill MULTI_BCAST\n"));
16726 			continue;
16727 		}
16728 
16729 		if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
16730 			if (from_ill->ill_join_allmulti)
16731 			    (void) ip_leave_allmulti(from_ill->ill_ipif);
16732 		} else if (ilm_numentries_v6(from_ill, &ilm->ilm_v6addr) == 0) {
16733 			(void) ip_ll_send_disabmulti_req(from_ill,
16734 		    &ilm->ilm_v6addr);
16735 		}
16736 	}
16737 	ILM_WALKER_RELE(to_ill);
16738 }
16739 
16740 /*
16741  * This function is called when all multicast memberships needs
16742  * to be moved from "from_ill" to "to_ill" for IPv6. This function is
16743  * called only once unlike the IPv4 counterpart where it is called after
16744  * every logical interface is moved. The reason is due to multicast
16745  * memberships are joined using an interface address in IPv4 while in
16746  * IPv6, interface index is used.
16747  */
16748 static void
16749 ilm_move_v6(ill_t *from_ill, ill_t *to_ill, int ifindex)
16750 {
16751 	ilm_t	*ilm;
16752 	ilm_t	*ilm_next;
16753 	ilm_t	*new_ilm;
16754 	ilm_t	**ilmp;
16755 	int	count;
16756 	char buf[INET6_ADDRSTRLEN];
16757 	in6_addr_t ipv6_snm = ipv6_solicited_node_mcast;
16758 
16759 	ASSERT(MUTEX_HELD(&to_ill->ill_lock));
16760 	ASSERT(MUTEX_HELD(&from_ill->ill_lock));
16761 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
16762 
16763 	if (ifindex == 0) {
16764 		/*
16765 		 * Form the solicited node mcast address which is used later.
16766 		 */
16767 		ipif_t *ipif;
16768 
16769 		ipif = from_ill->ill_ipif;
16770 		ASSERT(ipif->ipif_id == 0);
16771 
16772 		ipv6_snm.s6_addr32[3] |= ipif->ipif_v6lcl_addr.s6_addr32[3];
16773 	}
16774 
16775 	ilmp = &from_ill->ill_ilm;
16776 	for (ilm = from_ill->ill_ilm; ilm != NULL; ilm = ilm_next) {
16777 		ilm_next = ilm->ilm_next;
16778 
16779 		if (ilm->ilm_flags & ILM_DELETED) {
16780 			ilmp = &ilm->ilm_next;
16781 			continue;
16782 		}
16783 
16784 		new_ilm = ilm_lookup_ill_index_v6(to_ill, &ilm->ilm_v6addr,
16785 		    ilm->ilm_orig_ifindex, ilm->ilm_zoneid);
16786 		ASSERT(ilm->ilm_orig_ifindex != 0);
16787 		if (ilm->ilm_orig_ifindex == ifindex) {
16788 			/*
16789 			 * We are failing back multicast memberships.
16790 			 * If the same ilm exists in to_ill, it means somebody
16791 			 * has joined the same group there e.g. ff02::1
16792 			 * is joined within the kernel when the interfaces
16793 			 * came UP.
16794 			 */
16795 			ASSERT(ilm->ilm_ipif == NULL);
16796 			if (new_ilm != NULL) {
16797 				new_ilm->ilm_refcnt += ilm->ilm_refcnt;
16798 				if (new_ilm->ilm_fmode != MODE_IS_EXCLUDE ||
16799 				    !SLIST_IS_EMPTY(new_ilm->ilm_filter)) {
16800 					new_ilm->ilm_is_new = B_TRUE;
16801 				}
16802 			} else {
16803 				/*
16804 				 * check if we can just move the ilm
16805 				 */
16806 				if (from_ill->ill_ilm_walker_cnt != 0) {
16807 					/*
16808 					 * We have walkers we cannot move
16809 					 * the ilm, so allocate a new ilm,
16810 					 * this (old) ilm will be marked
16811 					 * ILM_DELETED at the end of the loop
16812 					 * and will be freed when the
16813 					 * last walker exits.
16814 					 */
16815 					new_ilm = (ilm_t *)mi_zalloc
16816 					    (sizeof (ilm_t));
16817 					if (new_ilm == NULL) {
16818 						ip0dbg(("ilm_move_v6: "
16819 						    "FAILBACK of IPv6"
16820 						    " multicast address %s : "
16821 						    "from %s to"
16822 						    " %s failed : ENOMEM \n",
16823 						    inet_ntop(AF_INET6,
16824 						    &ilm->ilm_v6addr, buf,
16825 						    sizeof (buf)),
16826 						    from_ill->ill_name,
16827 						    to_ill->ill_name));
16828 
16829 							ilmp = &ilm->ilm_next;
16830 							continue;
16831 					}
16832 					*new_ilm = *ilm;
16833 					/*
16834 					 * we don't want new_ilm linked to
16835 					 * ilm's filter list.
16836 					 */
16837 					new_ilm->ilm_filter = NULL;
16838 				} else {
16839 					/*
16840 					 * No walkers we can move the ilm.
16841 					 * lets take it out of the list.
16842 					 */
16843 					*ilmp = ilm->ilm_next;
16844 					ilm->ilm_next = NULL;
16845 					new_ilm = ilm;
16846 				}
16847 
16848 				/*
16849 				 * if this is the first ilm for the group
16850 				 * set ilm_notify_driver so that we notify the
16851 				 * driver in ilm_send_multicast_reqs.
16852 				 */
16853 				if (ilm_lookup_ill_v6(to_ill,
16854 				    &new_ilm->ilm_v6addr, ALL_ZONES) == NULL)
16855 					new_ilm->ilm_notify_driver = B_TRUE;
16856 
16857 				new_ilm->ilm_ill = to_ill;
16858 				/* Add to the to_ill's list */
16859 				new_ilm->ilm_next = to_ill->ill_ilm;
16860 				to_ill->ill_ilm = new_ilm;
16861 				/*
16862 				 * set the flag so that mld_joingroup is
16863 				 * called in ilm_send_multicast_reqs().
16864 				 */
16865 				new_ilm->ilm_is_new = B_TRUE;
16866 			}
16867 			goto bottom;
16868 		} else if (ifindex != 0) {
16869 			/*
16870 			 * If this is FAILBACK (ifindex != 0) and the ifindex
16871 			 * has not matched above, look at the next ilm.
16872 			 */
16873 			ilmp = &ilm->ilm_next;
16874 			continue;
16875 		}
16876 		/*
16877 		 * If we are here, it means ifindex is 0. Failover
16878 		 * everything.
16879 		 *
16880 		 * We need to handle solicited node mcast address
16881 		 * and all_nodes mcast address differently as they
16882 		 * are joined witin the kenrel (ipif_multicast_up)
16883 		 * and potentially from the userland. We are called
16884 		 * after the ipifs of from_ill has been moved.
16885 		 * If we still find ilms on ill with solicited node
16886 		 * mcast address or all_nodes mcast address, it must
16887 		 * belong to the UP interface that has not moved e.g.
16888 		 * ipif_id 0 with the link local prefix does not move.
16889 		 * We join this on the new ill accounting for all the
16890 		 * userland memberships so that applications don't
16891 		 * see any failure.
16892 		 *
16893 		 * We need to make sure that we account only for the
16894 		 * solicited node and all node multicast addresses
16895 		 * that was brought UP on these. In the case of
16896 		 * a failover from A to B, we might have ilms belonging
16897 		 * to A (ilm_orig_ifindex pointing at A) on B accounting
16898 		 * for the membership from the userland. If we are failing
16899 		 * over from B to C now, we will find the ones belonging
16900 		 * to A on B. These don't account for the ill_ipif_up_count.
16901 		 * They just move from B to C. The check below on
16902 		 * ilm_orig_ifindex ensures that.
16903 		 */
16904 		if ((ilm->ilm_orig_ifindex ==
16905 		    from_ill->ill_phyint->phyint_ifindex) &&
16906 		    (IN6_ARE_ADDR_EQUAL(&ipv6_snm, &ilm->ilm_v6addr) ||
16907 		    IN6_ARE_ADDR_EQUAL(&ipv6_all_hosts_mcast,
16908 		    &ilm->ilm_v6addr))) {
16909 			ASSERT(ilm->ilm_refcnt > 0);
16910 			count = ilm->ilm_refcnt - from_ill->ill_ipif_up_count;
16911 			/*
16912 			 * For indentation reasons, we are not using a
16913 			 * "else" here.
16914 			 */
16915 			if (count == 0) {
16916 				ilmp = &ilm->ilm_next;
16917 				continue;
16918 			}
16919 			ilm->ilm_refcnt -= count;
16920 			if (new_ilm != NULL) {
16921 				/*
16922 				 * Can find one with the same
16923 				 * ilm_orig_ifindex, if we are failing
16924 				 * over to a STANDBY. This happens
16925 				 * when somebody wants to join a group
16926 				 * on a STANDBY interface and we
16927 				 * internally join on a different one.
16928 				 * If we had joined on from_ill then, a
16929 				 * failover now will find a new ilm
16930 				 * with this index.
16931 				 */
16932 				ip1dbg(("ilm_move_v6: FAILOVER, found"
16933 				    " new ilm on %s, group address %s\n",
16934 				    to_ill->ill_name,
16935 				    inet_ntop(AF_INET6,
16936 				    &ilm->ilm_v6addr, buf,
16937 				    sizeof (buf))));
16938 				new_ilm->ilm_refcnt += count;
16939 				if (new_ilm->ilm_fmode != MODE_IS_EXCLUDE ||
16940 				    !SLIST_IS_EMPTY(new_ilm->ilm_filter)) {
16941 					new_ilm->ilm_is_new = B_TRUE;
16942 				}
16943 			} else {
16944 				new_ilm = (ilm_t *)mi_zalloc(sizeof (ilm_t));
16945 				if (new_ilm == NULL) {
16946 					ip0dbg(("ilm_move_v6: FAILOVER of IPv6"
16947 					    " multicast address %s : from %s to"
16948 					    " %s failed : ENOMEM \n",
16949 					    inet_ntop(AF_INET6,
16950 					    &ilm->ilm_v6addr, buf,
16951 					    sizeof (buf)), from_ill->ill_name,
16952 					    to_ill->ill_name));
16953 					ilmp = &ilm->ilm_next;
16954 					continue;
16955 				}
16956 				*new_ilm = *ilm;
16957 				new_ilm->ilm_filter = NULL;
16958 				new_ilm->ilm_refcnt = count;
16959 				new_ilm->ilm_timer = INFINITY;
16960 				new_ilm->ilm_rtx.rtx_timer = INFINITY;
16961 				new_ilm->ilm_is_new = B_TRUE;
16962 				/*
16963 				 * If the to_ill has not joined this
16964 				 * group we need to tell the driver in
16965 				 * ill_send_multicast_reqs.
16966 				 */
16967 				if (ilm_lookup_ill_v6(to_ill,
16968 				    &new_ilm->ilm_v6addr, ALL_ZONES) == NULL)
16969 					new_ilm->ilm_notify_driver = B_TRUE;
16970 
16971 				new_ilm->ilm_ill = to_ill;
16972 				/* Add to the to_ill's list */
16973 				new_ilm->ilm_next = to_ill->ill_ilm;
16974 				to_ill->ill_ilm = new_ilm;
16975 				ASSERT(new_ilm->ilm_ipif == NULL);
16976 			}
16977 			if (ilm->ilm_refcnt == 0) {
16978 				goto bottom;
16979 			} else {
16980 				new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
16981 				CLEAR_SLIST(new_ilm->ilm_filter);
16982 				ilmp = &ilm->ilm_next;
16983 			}
16984 			continue;
16985 		} else {
16986 			/*
16987 			 * ifindex = 0 means, move everything pointing at
16988 			 * from_ill. We are doing this becuase ill has
16989 			 * either FAILED or became INACTIVE.
16990 			 *
16991 			 * As we would like to move things later back to
16992 			 * from_ill, we want to retain the identity of this
16993 			 * ilm. Thus, we don't blindly increment the reference
16994 			 * count on the ilms matching the address alone. We
16995 			 * need to match on the ilm_orig_index also. new_ilm
16996 			 * was obtained by matching ilm_orig_index also.
16997 			 */
16998 			if (new_ilm != NULL) {
16999 				/*
17000 				 * This is possible only if a previous restore
17001 				 * was incomplete i.e restore to
17002 				 * ilm_orig_ifindex left some ilms because
17003 				 * of some failures. Thus when we are failing
17004 				 * again, we might find our old friends there.
17005 				 */
17006 				ip1dbg(("ilm_move_v6: FAILOVER, found new ilm"
17007 				    " on %s, group address %s\n",
17008 				    to_ill->ill_name,
17009 				    inet_ntop(AF_INET6,
17010 				    &ilm->ilm_v6addr, buf,
17011 				    sizeof (buf))));
17012 				new_ilm->ilm_refcnt += ilm->ilm_refcnt;
17013 				if (new_ilm->ilm_fmode != MODE_IS_EXCLUDE ||
17014 				    !SLIST_IS_EMPTY(new_ilm->ilm_filter)) {
17015 					new_ilm->ilm_is_new = B_TRUE;
17016 				}
17017 			} else {
17018 				if (from_ill->ill_ilm_walker_cnt != 0) {
17019 					new_ilm = (ilm_t *)
17020 					    mi_zalloc(sizeof (ilm_t));
17021 					if (new_ilm == NULL) {
17022 						ip0dbg(("ilm_move_v6: "
17023 						    "FAILOVER of IPv6"
17024 						    " multicast address %s : "
17025 						    "from %s to"
17026 						    " %s failed : ENOMEM \n",
17027 						    inet_ntop(AF_INET6,
17028 						    &ilm->ilm_v6addr, buf,
17029 						    sizeof (buf)),
17030 						    from_ill->ill_name,
17031 						    to_ill->ill_name));
17032 
17033 							ilmp = &ilm->ilm_next;
17034 							continue;
17035 					}
17036 					*new_ilm = *ilm;
17037 					new_ilm->ilm_filter = NULL;
17038 				} else {
17039 					*ilmp = ilm->ilm_next;
17040 					new_ilm = ilm;
17041 				}
17042 				/*
17043 				 * If the to_ill has not joined this
17044 				 * group we need to tell the driver in
17045 				 * ill_send_multicast_reqs.
17046 				 */
17047 				if (ilm_lookup_ill_v6(to_ill,
17048 				    &new_ilm->ilm_v6addr, ALL_ZONES) == NULL)
17049 					new_ilm->ilm_notify_driver = B_TRUE;
17050 
17051 				/* Add to the to_ill's list */
17052 				new_ilm->ilm_next = to_ill->ill_ilm;
17053 				to_ill->ill_ilm = new_ilm;
17054 				ASSERT(ilm->ilm_ipif == NULL);
17055 				new_ilm->ilm_ill = to_ill;
17056 				new_ilm->ilm_is_new = B_TRUE;
17057 			}
17058 
17059 		}
17060 
17061 bottom:
17062 		/*
17063 		 * Revert multicast filter state to (EXCLUDE, NULL).
17064 		 * new_ilm->ilm_is_new should already be set if needed.
17065 		 */
17066 		new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
17067 		CLEAR_SLIST(new_ilm->ilm_filter);
17068 		/*
17069 		 * We allocated/got a new ilm, free the old one.
17070 		 */
17071 		if (new_ilm != ilm) {
17072 			if (from_ill->ill_ilm_walker_cnt == 0) {
17073 				*ilmp = ilm->ilm_next;
17074 				ilm->ilm_next = NULL;
17075 				FREE_SLIST(ilm->ilm_filter);
17076 				FREE_SLIST(ilm->ilm_pendsrcs);
17077 				FREE_SLIST(ilm->ilm_rtx.rtx_allow);
17078 				FREE_SLIST(ilm->ilm_rtx.rtx_block);
17079 				mi_free((char *)ilm);
17080 			} else {
17081 				ilm->ilm_flags |= ILM_DELETED;
17082 				from_ill->ill_ilm_cleanup_reqd = 1;
17083 				ilmp = &ilm->ilm_next;
17084 			}
17085 		}
17086 	}
17087 }
17088 
17089 /*
17090  * Move all the multicast memberships to to_ill. Called when
17091  * an ipif moves from "from_ill" to "to_ill". This function is slightly
17092  * different from IPv6 counterpart as multicast memberships are associated
17093  * with ills in IPv6. This function is called after every ipif is moved
17094  * unlike IPv6, where it is moved only once.
17095  */
17096 static void
17097 ilm_move_v4(ill_t *from_ill, ill_t *to_ill, ipif_t *ipif)
17098 {
17099 	ilm_t	*ilm;
17100 	ilm_t	*ilm_next;
17101 	ilm_t	*new_ilm;
17102 	ilm_t	**ilmp;
17103 
17104 	ASSERT(MUTEX_HELD(&to_ill->ill_lock));
17105 	ASSERT(MUTEX_HELD(&from_ill->ill_lock));
17106 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
17107 
17108 	ilmp = &from_ill->ill_ilm;
17109 	for (ilm = from_ill->ill_ilm; ilm != NULL; ilm = ilm_next) {
17110 		ilm_next = ilm->ilm_next;
17111 
17112 		if (ilm->ilm_flags & ILM_DELETED) {
17113 			ilmp = &ilm->ilm_next;
17114 			continue;
17115 		}
17116 
17117 		ASSERT(ilm->ilm_ipif != NULL);
17118 
17119 		if (ilm->ilm_ipif != ipif) {
17120 			ilmp = &ilm->ilm_next;
17121 			continue;
17122 		}
17123 
17124 		if (V4_PART_OF_V6(ilm->ilm_v6addr) ==
17125 		    htonl(INADDR_ALLHOSTS_GROUP)) {
17126 			/*
17127 			 * We joined this in ipif_multicast_up
17128 			 * and we never did an ipif_multicast_down
17129 			 * for IPv4. If nobody else from the userland
17130 			 * has reference, we free the ilm, and later
17131 			 * when this ipif comes up on the new ill,
17132 			 * we will join this again.
17133 			 */
17134 			if (--ilm->ilm_refcnt == 0)
17135 				goto delete_ilm;
17136 
17137 			new_ilm = ilm_lookup_ipif(ipif,
17138 			    V4_PART_OF_V6(ilm->ilm_v6addr));
17139 			if (new_ilm != NULL) {
17140 				new_ilm->ilm_refcnt += ilm->ilm_refcnt;
17141 				/*
17142 				 * We still need to deal with the from_ill.
17143 				 */
17144 				new_ilm->ilm_is_new = B_TRUE;
17145 				new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
17146 				CLEAR_SLIST(new_ilm->ilm_filter);
17147 				goto delete_ilm;
17148 			}
17149 			/*
17150 			 * If we could not find one e.g. ipif is
17151 			 * still down on to_ill, we add this ilm
17152 			 * on ill_new to preserve the reference
17153 			 * count.
17154 			 */
17155 		}
17156 		/*
17157 		 * When ipifs move, ilms always move with it
17158 		 * to the NEW ill. Thus we should never be
17159 		 * able to find ilm till we really move it here.
17160 		 */
17161 		ASSERT(ilm_lookup_ipif(ipif,
17162 		    V4_PART_OF_V6(ilm->ilm_v6addr)) == NULL);
17163 
17164 		if (from_ill->ill_ilm_walker_cnt != 0) {
17165 			new_ilm = (ilm_t *)mi_zalloc(sizeof (ilm_t));
17166 			if (new_ilm == NULL) {
17167 				char buf[INET6_ADDRSTRLEN];
17168 				ip0dbg(("ilm_move_v4: FAILBACK of IPv4"
17169 				    " multicast address %s : "
17170 				    "from %s to"
17171 				    " %s failed : ENOMEM \n",
17172 				    inet_ntop(AF_INET,
17173 				    &ilm->ilm_v6addr, buf,
17174 				    sizeof (buf)),
17175 				    from_ill->ill_name,
17176 				    to_ill->ill_name));
17177 
17178 				ilmp = &ilm->ilm_next;
17179 				continue;
17180 			}
17181 			*new_ilm = *ilm;
17182 			/* We don't want new_ilm linked to ilm's filter list */
17183 			new_ilm->ilm_filter = NULL;
17184 		} else {
17185 			/* Remove from the list */
17186 			*ilmp = ilm->ilm_next;
17187 			new_ilm = ilm;
17188 		}
17189 
17190 		/*
17191 		 * If we have never joined this group on the to_ill
17192 		 * make sure we tell the driver.
17193 		 */
17194 		if (ilm_lookup_ill_v6(to_ill, &new_ilm->ilm_v6addr,
17195 		    ALL_ZONES) == NULL)
17196 			new_ilm->ilm_notify_driver = B_TRUE;
17197 
17198 		/* Add to the to_ill's list */
17199 		new_ilm->ilm_next = to_ill->ill_ilm;
17200 		to_ill->ill_ilm = new_ilm;
17201 		new_ilm->ilm_is_new = B_TRUE;
17202 
17203 		/*
17204 		 * Revert multicast filter state to (EXCLUDE, NULL)
17205 		 */
17206 		new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
17207 		CLEAR_SLIST(new_ilm->ilm_filter);
17208 
17209 		/*
17210 		 * Delete only if we have allocated a new ilm.
17211 		 */
17212 		if (new_ilm != ilm) {
17213 delete_ilm:
17214 			if (from_ill->ill_ilm_walker_cnt == 0) {
17215 				/* Remove from the list */
17216 				*ilmp = ilm->ilm_next;
17217 				ilm->ilm_next = NULL;
17218 				FREE_SLIST(ilm->ilm_filter);
17219 				FREE_SLIST(ilm->ilm_pendsrcs);
17220 				FREE_SLIST(ilm->ilm_rtx.rtx_allow);
17221 				FREE_SLIST(ilm->ilm_rtx.rtx_block);
17222 				mi_free((char *)ilm);
17223 			} else {
17224 				ilm->ilm_flags |= ILM_DELETED;
17225 				from_ill->ill_ilm_cleanup_reqd = 1;
17226 				ilmp = &ilm->ilm_next;
17227 			}
17228 		}
17229 	}
17230 }
17231 
17232 static uint_t
17233 ipif_get_id(ill_t *ill, uint_t id)
17234 {
17235 	uint_t	unit;
17236 	ipif_t	*tipif;
17237 	boolean_t found = B_FALSE;
17238 
17239 	/*
17240 	 * During failback, we want to go back to the same id
17241 	 * instead of the smallest id so that the original
17242 	 * configuration is maintained. id is non-zero in that
17243 	 * case.
17244 	 */
17245 	if (id != 0) {
17246 		/*
17247 		 * While failing back, if we still have an ipif with
17248 		 * MAX_ADDRS_PER_IF, it means this will be replaced
17249 		 * as soon as we return from this function. It was
17250 		 * to set to MAX_ADDRS_PER_IF by the caller so that
17251 		 * we can choose the smallest id. Thus we return zero
17252 		 * in that case ignoring the hint.
17253 		 */
17254 		if (ill->ill_ipif->ipif_id == MAX_ADDRS_PER_IF)
17255 			return (0);
17256 		for (tipif = ill->ill_ipif; tipif != NULL;
17257 		    tipif = tipif->ipif_next) {
17258 			if (tipif->ipif_id == id) {
17259 				found = B_TRUE;
17260 				break;
17261 			}
17262 		}
17263 		/*
17264 		 * If somebody already plumbed another logical
17265 		 * with the same id, we won't be able to find it.
17266 		 */
17267 		if (!found)
17268 			return (id);
17269 	}
17270 	for (unit = 0; unit <= ip_addrs_per_if; unit++) {
17271 		found = B_FALSE;
17272 		for (tipif = ill->ill_ipif; tipif != NULL;
17273 		    tipif = tipif->ipif_next) {
17274 			if (tipif->ipif_id == unit) {
17275 				found = B_TRUE;
17276 				break;
17277 			}
17278 		}
17279 		if (!found)
17280 			break;
17281 	}
17282 	return (unit);
17283 }
17284 
17285 /* ARGSUSED */
17286 static int
17287 ipif_move(ipif_t *ipif, ill_t *to_ill, queue_t *q, mblk_t *mp,
17288     ipif_t **rep_ipif_ptr)
17289 {
17290 	ill_t	*from_ill;
17291 	ipif_t	*rep_ipif;
17292 	ipif_t	**ipifp;
17293 	uint_t	unit;
17294 	int err = 0;
17295 	ipif_t	*to_ipif;
17296 	struct iocblk	*iocp;
17297 	boolean_t failback_cmd;
17298 	boolean_t remove_ipif;
17299 	int	rc;
17300 
17301 	ASSERT(IAM_WRITER_ILL(to_ill));
17302 	ASSERT(IAM_WRITER_IPIF(ipif));
17303 
17304 	iocp = (struct iocblk *)mp->b_rptr;
17305 	failback_cmd = (iocp->ioc_cmd == SIOCLIFFAILBACK);
17306 	remove_ipif = B_FALSE;
17307 
17308 	from_ill = ipif->ipif_ill;
17309 
17310 	ASSERT(MUTEX_HELD(&to_ill->ill_lock));
17311 	ASSERT(MUTEX_HELD(&from_ill->ill_lock));
17312 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
17313 
17314 	/*
17315 	 * Don't move LINK LOCAL addresses as they are tied to
17316 	 * physical interface.
17317 	 */
17318 	if (from_ill->ill_isv6 &&
17319 	    IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6lcl_addr)) {
17320 		ipif->ipif_was_up = B_FALSE;
17321 		IPIF_UNMARK_MOVING(ipif);
17322 		return (0);
17323 	}
17324 
17325 	/*
17326 	 * We set the ipif_id to maximum so that the search for
17327 	 * ipif_id will pick the lowest number i.e 0 in the
17328 	 * following 2 cases :
17329 	 *
17330 	 * 1) We have a replacement ipif at the head of to_ill.
17331 	 *    We can't remove it yet as we can exceed ip_addrs_per_if
17332 	 *    on to_ill and hence the MOVE might fail. We want to
17333 	 *    remove it only if we could move the ipif. Thus, by
17334 	 *    setting it to the MAX value, we make the search in
17335 	 *    ipif_get_id return the zeroth id.
17336 	 *
17337 	 * 2) When DR pulls out the NIC and re-plumbs the interface,
17338 	 *    we might just have a zero address plumbed on the ipif
17339 	 *    with zero id in the case of IPv4. We remove that while
17340 	 *    doing the failback. We want to remove it only if we
17341 	 *    could move the ipif. Thus, by setting it to the MAX
17342 	 *    value, we make the search in ipif_get_id return the
17343 	 *    zeroth id.
17344 	 *
17345 	 * Both (1) and (2) are done only when when we are moving
17346 	 * an ipif (either due to failover/failback) which originally
17347 	 * belonged to this interface i.e the ipif_orig_ifindex is
17348 	 * the same as to_ill's ifindex. This is needed so that
17349 	 * FAILOVER from A -> B ( A failed) followed by FAILOVER
17350 	 * from B -> A (B is being removed from the group) and
17351 	 * FAILBACK from A -> B restores the original configuration.
17352 	 * Without the check for orig_ifindex, the second FAILOVER
17353 	 * could make the ipif belonging to B replace the A's zeroth
17354 	 * ipif and the subsequent failback re-creating the replacement
17355 	 * ipif again.
17356 	 *
17357 	 * NOTE : We created the replacement ipif when we did a
17358 	 * FAILOVER (See below). We could check for FAILBACK and
17359 	 * then look for replacement ipif to be removed. But we don't
17360 	 * want to do that because we wan't to allow the possibility
17361 	 * of a FAILOVER from A -> B (which creates the replacement ipif),
17362 	 * followed by a *FAILOVER* from B -> A instead of a FAILBACK
17363 	 * from B -> A.
17364 	 */
17365 	to_ipif = to_ill->ill_ipif;
17366 	if ((to_ill->ill_phyint->phyint_ifindex ==
17367 	    ipif->ipif_orig_ifindex) &&
17368 	    IPIF_REPL_CHECK(to_ipif, failback_cmd)) {
17369 		ASSERT(to_ipif->ipif_id == 0);
17370 		remove_ipif = B_TRUE;
17371 		to_ipif->ipif_id = MAX_ADDRS_PER_IF;
17372 	}
17373 	/*
17374 	 * Find the lowest logical unit number on the to_ill.
17375 	 * If we are failing back, try to get the original id
17376 	 * rather than the lowest one so that the original
17377 	 * configuration is maintained.
17378 	 *
17379 	 * XXX need a better scheme for this.
17380 	 */
17381 	if (failback_cmd) {
17382 		unit = ipif_get_id(to_ill, ipif->ipif_orig_ipifid);
17383 	} else {
17384 		unit = ipif_get_id(to_ill, 0);
17385 	}
17386 
17387 	/* Reset back to zero in case we fail below */
17388 	if (to_ipif->ipif_id == MAX_ADDRS_PER_IF)
17389 		to_ipif->ipif_id = 0;
17390 
17391 	if (unit == ip_addrs_per_if) {
17392 		ipif->ipif_was_up = B_FALSE;
17393 		IPIF_UNMARK_MOVING(ipif);
17394 		return (EINVAL);
17395 	}
17396 
17397 	/*
17398 	 * ipif is ready to move from "from_ill" to "to_ill".
17399 	 *
17400 	 * 1) If we are moving ipif with id zero, create a
17401 	 *    replacement ipif for this ipif on from_ill. If this fails
17402 	 *    fail the MOVE operation.
17403 	 *
17404 	 * 2) Remove the replacement ipif on to_ill if any.
17405 	 *    We could remove the replacement ipif when we are moving
17406 	 *    the ipif with id zero. But what if somebody already
17407 	 *    unplumbed it ? Thus we always remove it if it is present.
17408 	 *    We want to do it only if we are sure we are going to
17409 	 *    move the ipif to to_ill which is why there are no
17410 	 *    returns due to error till ipif is linked to to_ill.
17411 	 *    Note that the first ipif that we failback will always
17412 	 *    be zero if it is present.
17413 	 */
17414 	if (ipif->ipif_id == 0) {
17415 		ipaddr_t inaddr_any = INADDR_ANY;
17416 
17417 		rep_ipif = (ipif_t *)mi_alloc(sizeof (ipif_t), BPRI_MED);
17418 		if (rep_ipif == NULL) {
17419 			ipif->ipif_was_up = B_FALSE;
17420 			IPIF_UNMARK_MOVING(ipif);
17421 			return (ENOMEM);
17422 		}
17423 		*rep_ipif = ipif_zero;
17424 		/*
17425 		 * Before we put the ipif on the list, store the addresses
17426 		 * as mapped addresses as some of the ioctls e.g SIOCGIFADDR
17427 		 * assumes so. This logic is not any different from what
17428 		 * ipif_allocate does.
17429 		 */
17430 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
17431 		    &rep_ipif->ipif_v6lcl_addr);
17432 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
17433 		    &rep_ipif->ipif_v6src_addr);
17434 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
17435 		    &rep_ipif->ipif_v6subnet);
17436 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
17437 		    &rep_ipif->ipif_v6net_mask);
17438 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
17439 		    &rep_ipif->ipif_v6brd_addr);
17440 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
17441 		    &rep_ipif->ipif_v6pp_dst_addr);
17442 		/*
17443 		 * We mark IPIF_NOFAILOVER so that this can never
17444 		 * move.
17445 		 */
17446 		rep_ipif->ipif_flags = ipif->ipif_flags | IPIF_NOFAILOVER;
17447 		rep_ipif->ipif_flags &= ~IPIF_UP & ~IPIF_DUPLICATE;
17448 		rep_ipif->ipif_replace_zero = B_TRUE;
17449 		mutex_init(&rep_ipif->ipif_saved_ire_lock, NULL,
17450 		    MUTEX_DEFAULT, NULL);
17451 		rep_ipif->ipif_id = 0;
17452 		rep_ipif->ipif_ire_type = ipif->ipif_ire_type;
17453 		rep_ipif->ipif_ill = from_ill;
17454 		rep_ipif->ipif_orig_ifindex =
17455 		    from_ill->ill_phyint->phyint_ifindex;
17456 		/* Insert at head */
17457 		rep_ipif->ipif_next = from_ill->ill_ipif;
17458 		from_ill->ill_ipif = rep_ipif;
17459 		/*
17460 		 * We don't really care to let apps know about
17461 		 * this interface.
17462 		 */
17463 	}
17464 
17465 	if (remove_ipif) {
17466 		/*
17467 		 * We set to a max value above for this case to get
17468 		 * id zero. ASSERT that we did get one.
17469 		 */
17470 		ASSERT((to_ipif->ipif_id == 0) && (unit == 0));
17471 		rep_ipif = to_ipif;
17472 		to_ill->ill_ipif = rep_ipif->ipif_next;
17473 		rep_ipif->ipif_next = NULL;
17474 		/*
17475 		 * If some apps scanned and find this interface,
17476 		 * it is time to let them know, so that they can
17477 		 * delete it.
17478 		 */
17479 
17480 		*rep_ipif_ptr = rep_ipif;
17481 	}
17482 
17483 	/* Get it out of the ILL interface list. */
17484 	ipifp = &ipif->ipif_ill->ill_ipif;
17485 	for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
17486 		if (*ipifp == ipif) {
17487 			*ipifp = ipif->ipif_next;
17488 			break;
17489 		}
17490 	}
17491 
17492 	/* Assign the new ill */
17493 	ipif->ipif_ill = to_ill;
17494 	ipif->ipif_id = unit;
17495 	/* id has already been checked */
17496 	rc = ipif_insert(ipif, B_FALSE, B_FALSE);
17497 	ASSERT(rc == 0);
17498 	/* Let SCTP update its list */
17499 	sctp_move_ipif(ipif, from_ill, to_ill);
17500 	/*
17501 	 * Handle the failover and failback of ipif_t between
17502 	 * ill_t that have differing maximum mtu values.
17503 	 */
17504 	if (ipif->ipif_mtu > to_ill->ill_max_mtu) {
17505 		if (ipif->ipif_saved_mtu == 0) {
17506 			/*
17507 			 * As this ipif_t is moving to an ill_t
17508 			 * that has a lower ill_max_mtu, its
17509 			 * ipif_mtu needs to be saved so it can
17510 			 * be restored during failback or during
17511 			 * failover to an ill_t which has a
17512 			 * higher ill_max_mtu.
17513 			 */
17514 			ipif->ipif_saved_mtu = ipif->ipif_mtu;
17515 			ipif->ipif_mtu = to_ill->ill_max_mtu;
17516 		} else {
17517 			/*
17518 			 * The ipif_t is, once again, moving to
17519 			 * an ill_t that has a lower maximum mtu
17520 			 * value.
17521 			 */
17522 			ipif->ipif_mtu = to_ill->ill_max_mtu;
17523 		}
17524 	} else if (ipif->ipif_mtu < to_ill->ill_max_mtu &&
17525 	    ipif->ipif_saved_mtu != 0) {
17526 		/*
17527 		 * The mtu of this ipif_t had to be reduced
17528 		 * during an earlier failover; this is an
17529 		 * opportunity for it to be increased (either as
17530 		 * part of another failover or a failback).
17531 		 */
17532 		if (ipif->ipif_saved_mtu <= to_ill->ill_max_mtu) {
17533 			ipif->ipif_mtu = ipif->ipif_saved_mtu;
17534 			ipif->ipif_saved_mtu = 0;
17535 		} else {
17536 			ipif->ipif_mtu = to_ill->ill_max_mtu;
17537 		}
17538 	}
17539 
17540 	/*
17541 	 * We preserve all the other fields of the ipif including
17542 	 * ipif_saved_ire_mp. The routes that are saved here will
17543 	 * be recreated on the new interface and back on the old
17544 	 * interface when we move back.
17545 	 */
17546 	ASSERT(ipif->ipif_arp_del_mp == NULL);
17547 
17548 	return (err);
17549 }
17550 
17551 static int
17552 ipif_move_all(ill_t *from_ill, ill_t *to_ill, queue_t *q, mblk_t *mp,
17553     int ifindex, ipif_t **rep_ipif_ptr)
17554 {
17555 	ipif_t *mipif;
17556 	ipif_t *ipif_next;
17557 	int err;
17558 
17559 	/*
17560 	 * We don't really try to MOVE back things if some of the
17561 	 * operations fail. The daemon will take care of moving again
17562 	 * later on.
17563 	 */
17564 	for (mipif = from_ill->ill_ipif; mipif != NULL; mipif = ipif_next) {
17565 		ipif_next = mipif->ipif_next;
17566 		if (!(mipif->ipif_flags & IPIF_NOFAILOVER) &&
17567 		    (ifindex == 0 || ifindex == mipif->ipif_orig_ifindex)) {
17568 
17569 			err = ipif_move(mipif, to_ill, q, mp, rep_ipif_ptr);
17570 
17571 			/*
17572 			 * When the MOVE fails, it is the job of the
17573 			 * application to take care of this properly
17574 			 * i.e try again if it is ENOMEM.
17575 			 */
17576 			if (mipif->ipif_ill != from_ill) {
17577 				/*
17578 				 * ipif has moved.
17579 				 *
17580 				 * Move the multicast memberships associated
17581 				 * with this ipif to the new ill. For IPv6, we
17582 				 * do it once after all the ipifs are moved
17583 				 * (in ill_move) as they are not associated
17584 				 * with ipifs.
17585 				 *
17586 				 * We need to move the ilms as the ipif has
17587 				 * already been moved to a new ill even
17588 				 * in the case of errors. Neither
17589 				 * ilm_free(ipif) will find the ilm
17590 				 * when somebody unplumbs this ipif nor
17591 				 * ilm_delete(ilm) will be able to find the
17592 				 * ilm, if we don't move now.
17593 				 */
17594 				if (!from_ill->ill_isv6)
17595 					ilm_move_v4(from_ill, to_ill, mipif);
17596 			}
17597 
17598 			if (err != 0)
17599 				return (err);
17600 		}
17601 	}
17602 	return (0);
17603 }
17604 
17605 static int
17606 ill_move(ill_t *from_ill, ill_t *to_ill, queue_t *q, mblk_t *mp)
17607 {
17608 	int ifindex;
17609 	int err;
17610 	struct iocblk	*iocp;
17611 	ipif_t	*ipif;
17612 	ipif_t *rep_ipif_ptr = NULL;
17613 	ipif_t	*from_ipif = NULL;
17614 	boolean_t check_rep_if = B_FALSE;
17615 
17616 	iocp = (struct iocblk *)mp->b_rptr;
17617 	if (iocp->ioc_cmd == SIOCLIFFAILOVER) {
17618 		/*
17619 		 * Move everything pointing at from_ill to to_ill.
17620 		 * We acheive this by passing in 0 as ifindex.
17621 		 */
17622 		ifindex = 0;
17623 	} else {
17624 		/*
17625 		 * Move everything pointing at from_ill whose original
17626 		 * ifindex of connp, ipif, ilm points at to_ill->ill_index.
17627 		 * We acheive this by passing in ifindex rather than 0.
17628 		 * Multicast vifs, ilgs move implicitly because ipifs move.
17629 		 */
17630 		ASSERT(iocp->ioc_cmd == SIOCLIFFAILBACK);
17631 		ifindex = to_ill->ill_phyint->phyint_ifindex;
17632 	}
17633 
17634 	/*
17635 	 * Determine if there is at least one ipif that would move from
17636 	 * 'from_ill' to 'to_ill'. If so, it is possible that the replacement
17637 	 * ipif (if it exists) on the to_ill would be consumed as a result of
17638 	 * the move, in which case we need to quiesce the replacement ipif also.
17639 	 */
17640 	for (from_ipif = from_ill->ill_ipif; from_ipif != NULL;
17641 	    from_ipif = from_ipif->ipif_next) {
17642 		if (((ifindex == 0) ||
17643 		    (ifindex == from_ipif->ipif_orig_ifindex)) &&
17644 		    !(from_ipif->ipif_flags & IPIF_NOFAILOVER)) {
17645 			check_rep_if = B_TRUE;
17646 			break;
17647 		}
17648 	}
17649 
17650 
17651 	ill_down_ipifs(from_ill, mp, ifindex, B_TRUE);
17652 
17653 	GRAB_ILL_LOCKS(from_ill, to_ill);
17654 	if ((ipif = ill_quiescent_to_move(from_ill)) != NULL) {
17655 		(void) ipsq_pending_mp_add(NULL, ipif, q,
17656 		    mp, ILL_MOVE_OK);
17657 		RELEASE_ILL_LOCKS(from_ill, to_ill);
17658 		return (EINPROGRESS);
17659 	}
17660 
17661 	/* Check if the replacement ipif is quiescent to delete */
17662 	if (check_rep_if && IPIF_REPL_CHECK(to_ill->ill_ipif,
17663 	    (iocp->ioc_cmd == SIOCLIFFAILBACK))) {
17664 		to_ill->ill_ipif->ipif_state_flags |=
17665 		    IPIF_MOVING | IPIF_CHANGING;
17666 		if ((ipif = ill_quiescent_to_move(to_ill)) != NULL) {
17667 			(void) ipsq_pending_mp_add(NULL, ipif, q,
17668 			    mp, ILL_MOVE_OK);
17669 			RELEASE_ILL_LOCKS(from_ill, to_ill);
17670 			return (EINPROGRESS);
17671 		}
17672 	}
17673 	RELEASE_ILL_LOCKS(from_ill, to_ill);
17674 
17675 	ASSERT(!MUTEX_HELD(&to_ill->ill_lock));
17676 	rw_enter(&ill_g_lock, RW_WRITER);
17677 	GRAB_ILL_LOCKS(from_ill, to_ill);
17678 	err = ipif_move_all(from_ill, to_ill, q, mp, ifindex, &rep_ipif_ptr);
17679 
17680 	/* ilm_move is done inside ipif_move for IPv4 */
17681 	if (err == 0 && from_ill->ill_isv6)
17682 		ilm_move_v6(from_ill, to_ill, ifindex);
17683 
17684 	RELEASE_ILL_LOCKS(from_ill, to_ill);
17685 	rw_exit(&ill_g_lock);
17686 
17687 	/*
17688 	 * send rts messages and multicast messages.
17689 	 */
17690 	if (rep_ipif_ptr != NULL) {
17691 		ip_rts_ifmsg(rep_ipif_ptr);
17692 		ip_rts_newaddrmsg(RTM_DELETE, 0, rep_ipif_ptr);
17693 		IPIF_TRACE_CLEANUP(rep_ipif_ptr);
17694 		mi_free(rep_ipif_ptr);
17695 	}
17696 
17697 	conn_move_ill(from_ill, to_ill, ifindex);
17698 
17699 	return (err);
17700 }
17701 
17702 /*
17703  * Used to extract arguments for FAILOVER/FAILBACK ioctls.
17704  * Also checks for the validity of the arguments.
17705  * Note: We are already exclusive inside the from group.
17706  * It is upto the caller to release refcnt on the to_ill's.
17707  */
17708 static int
17709 ip_extract_move_args(queue_t *q, mblk_t *mp, ill_t **ill_from_v4,
17710     ill_t **ill_from_v6, ill_t **ill_to_v4, ill_t **ill_to_v6)
17711 {
17712 	int dst_index;
17713 	ipif_t *ipif_v4, *ipif_v6;
17714 	struct lifreq *lifr;
17715 	mblk_t *mp1;
17716 	boolean_t exists;
17717 	sin_t	*sin;
17718 	int	err = 0;
17719 
17720 	if ((mp1 = mp->b_cont) == NULL)
17721 		return (EPROTO);
17722 
17723 	if ((mp1 = mp1->b_cont) == NULL)
17724 		return (EPROTO);
17725 
17726 	lifr = (struct lifreq *)mp1->b_rptr;
17727 	sin = (sin_t *)&lifr->lifr_addr;
17728 
17729 	/*
17730 	 * We operate on both IPv4 and IPv6. Thus, we don't allow IPv4/IPv6
17731 	 * specific operations.
17732 	 */
17733 	if (sin->sin_family != AF_UNSPEC)
17734 		return (EINVAL);
17735 
17736 	/*
17737 	 * Get ipif with id 0. We are writer on the from ill. So we can pass
17738 	 * NULLs for the last 4 args and we know the lookup won't fail
17739 	 * with EINPROGRESS.
17740 	 */
17741 	ipif_v4 = ipif_lookup_on_name(lifr->lifr_name,
17742 	    mi_strlen(lifr->lifr_name), B_FALSE, &exists, B_FALSE,
17743 	    ALL_ZONES, NULL, NULL, NULL, NULL);
17744 	ipif_v6 = ipif_lookup_on_name(lifr->lifr_name,
17745 	    mi_strlen(lifr->lifr_name), B_FALSE, &exists, B_TRUE,
17746 	    ALL_ZONES, NULL, NULL, NULL, NULL);
17747 
17748 	if (ipif_v4 == NULL && ipif_v6 == NULL)
17749 		return (ENXIO);
17750 
17751 	if (ipif_v4 != NULL) {
17752 		ASSERT(ipif_v4->ipif_refcnt != 0);
17753 		if (ipif_v4->ipif_id != 0) {
17754 			err = EINVAL;
17755 			goto done;
17756 		}
17757 
17758 		ASSERT(IAM_WRITER_IPIF(ipif_v4));
17759 		*ill_from_v4 = ipif_v4->ipif_ill;
17760 	}
17761 
17762 	if (ipif_v6 != NULL) {
17763 		ASSERT(ipif_v6->ipif_refcnt != 0);
17764 		if (ipif_v6->ipif_id != 0) {
17765 			err = EINVAL;
17766 			goto done;
17767 		}
17768 
17769 		ASSERT(IAM_WRITER_IPIF(ipif_v6));
17770 		*ill_from_v6 = ipif_v6->ipif_ill;
17771 	}
17772 
17773 	err = 0;
17774 	dst_index = lifr->lifr_movetoindex;
17775 	*ill_to_v4 = ill_lookup_on_ifindex(dst_index, B_FALSE,
17776 	    q, mp, ip_process_ioctl, &err);
17777 	if (err != 0) {
17778 		/*
17779 		 * There could be only v6.
17780 		 */
17781 		if (err != ENXIO)
17782 			goto done;
17783 		err = 0;
17784 	}
17785 
17786 	*ill_to_v6 = ill_lookup_on_ifindex(dst_index, B_TRUE,
17787 	    q, mp, ip_process_ioctl, &err);
17788 	if (err != 0) {
17789 		if (err != ENXIO)
17790 			goto done;
17791 		if (*ill_to_v4 == NULL) {
17792 			err = ENXIO;
17793 			goto done;
17794 		}
17795 		err = 0;
17796 	}
17797 
17798 	/*
17799 	 * If we have something to MOVE i.e "from" not NULL,
17800 	 * "to" should be non-NULL.
17801 	 */
17802 	if ((*ill_from_v4 != NULL && *ill_to_v4 == NULL) ||
17803 	    (*ill_from_v6 != NULL && *ill_to_v6 == NULL)) {
17804 		err = EINVAL;
17805 	}
17806 
17807 done:
17808 	if (ipif_v4 != NULL)
17809 		ipif_refrele(ipif_v4);
17810 	if (ipif_v6 != NULL)
17811 		ipif_refrele(ipif_v6);
17812 	return (err);
17813 }
17814 
17815 /*
17816  * FAILOVER and FAILBACK are modelled as MOVE operations.
17817  *
17818  * We don't check whether the MOVE is within the same group or
17819  * not, because this ioctl can be used as a generic mechanism
17820  * to failover from interface A to B, though things will function
17821  * only if they are really part of the same group. Moreover,
17822  * all ipifs may be down and hence temporarily out of the group.
17823  *
17824  * ipif's that need to be moved are first brought down; V4 ipifs are brought
17825  * down first and then V6.  For each we wait for the ipif's to become quiescent.
17826  * Bringing down the ipifs ensures that all ires pointing to these ipifs's
17827  * have been deleted and there are no active references. Once quiescent the
17828  * ipif's are moved and brought up on the new ill.
17829  *
17830  * Normally the source ill and destination ill belong to the same IPMP group
17831  * and hence the same ipsq_t. In the event they don't belong to the same
17832  * same group the two ipsq's are first merged into one ipsq - that of the
17833  * to_ill. The multicast memberships on the source and destination ill cannot
17834  * change during the move operation since multicast joins/leaves also have to
17835  * execute on the same ipsq and are hence serialized.
17836  */
17837 /* ARGSUSED */
17838 int
17839 ip_sioctl_move(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17840     ip_ioctl_cmd_t *ipip, void *ifreq)
17841 {
17842 	ill_t *ill_to_v4 = NULL;
17843 	ill_t *ill_to_v6 = NULL;
17844 	ill_t *ill_from_v4 = NULL;
17845 	ill_t *ill_from_v6 = NULL;
17846 	int err = 0;
17847 
17848 	/*
17849 	 * setup from and to ill's, we can get EINPROGRESS only for
17850 	 * to_ill's.
17851 	 */
17852 	err = ip_extract_move_args(q, mp, &ill_from_v4, &ill_from_v6,
17853 	    &ill_to_v4, &ill_to_v6);
17854 
17855 	if (err != 0) {
17856 		ip0dbg(("ip_sioctl_move: extract args failed\n"));
17857 		goto done;
17858 	}
17859 
17860 	/*
17861 	 * nothing to do.
17862 	 */
17863 	if ((ill_from_v4 != NULL) && (ill_from_v4 == ill_to_v4)) {
17864 		goto done;
17865 	}
17866 
17867 	/*
17868 	 * nothing to do.
17869 	 */
17870 	if ((ill_from_v6 != NULL) && (ill_from_v6 == ill_to_v6)) {
17871 		goto done;
17872 	}
17873 
17874 	/*
17875 	 * Mark the ill as changing.
17876 	 * ILL_CHANGING flag is cleared when the ipif's are brought up
17877 	 * in ill_up_ipifs in case of error they are cleared below.
17878 	 */
17879 
17880 	GRAB_ILL_LOCKS(ill_from_v4, ill_from_v6);
17881 	if (ill_from_v4 != NULL)
17882 		ill_from_v4->ill_state_flags |= ILL_CHANGING;
17883 	if (ill_from_v6 != NULL)
17884 		ill_from_v6->ill_state_flags |= ILL_CHANGING;
17885 	RELEASE_ILL_LOCKS(ill_from_v4, ill_from_v6);
17886 
17887 	/*
17888 	 * Make sure that both src and dst are
17889 	 * in the same syncq group. If not make it happen.
17890 	 * We are not holding any locks because we are the writer
17891 	 * on the from_ipsq and we will hold locks in ill_merge_groups
17892 	 * to protect to_ipsq against changing.
17893 	 */
17894 	if (ill_from_v4 != NULL) {
17895 		if (ill_from_v4->ill_phyint->phyint_ipsq !=
17896 		    ill_to_v4->ill_phyint->phyint_ipsq) {
17897 			err = ill_merge_groups(ill_from_v4, ill_to_v4,
17898 			    NULL, mp, q);
17899 			goto err_ret;
17900 
17901 		}
17902 		ASSERT(!MUTEX_HELD(&ill_to_v4->ill_lock));
17903 	} else {
17904 
17905 		if (ill_from_v6->ill_phyint->phyint_ipsq !=
17906 		    ill_to_v6->ill_phyint->phyint_ipsq) {
17907 			err = ill_merge_groups(ill_from_v6, ill_to_v6,
17908 			    NULL, mp, q);
17909 			goto err_ret;
17910 
17911 		}
17912 		ASSERT(!MUTEX_HELD(&ill_to_v6->ill_lock));
17913 	}
17914 
17915 	/*
17916 	 * Now that the ipsq's have been merged and we are the writer
17917 	 * lets mark to_ill as changing as well.
17918 	 */
17919 
17920 	GRAB_ILL_LOCKS(ill_to_v4, ill_to_v6);
17921 	if (ill_to_v4 != NULL)
17922 		ill_to_v4->ill_state_flags |= ILL_CHANGING;
17923 	if (ill_to_v6 != NULL)
17924 		ill_to_v6->ill_state_flags |= ILL_CHANGING;
17925 	RELEASE_ILL_LOCKS(ill_to_v4, ill_to_v6);
17926 
17927 	/*
17928 	 * Its ok for us to proceed with the move even if
17929 	 * ill_pending_mp is non null on one of the from ill's as the reply
17930 	 * should not be looking at the ipif, it should only care about the
17931 	 * ill itself.
17932 	 */
17933 
17934 	/*
17935 	 * lets move ipv4 first.
17936 	 */
17937 	if (ill_from_v4 != NULL) {
17938 		ASSERT(IAM_WRITER_ILL(ill_to_v4));
17939 		ill_from_v4->ill_move_in_progress = B_TRUE;
17940 		ill_to_v4->ill_move_in_progress = B_TRUE;
17941 		ill_to_v4->ill_move_peer = ill_from_v4;
17942 		ill_from_v4->ill_move_peer = ill_to_v4;
17943 		err = ill_move(ill_from_v4, ill_to_v4, q, mp);
17944 	}
17945 
17946 	/*
17947 	 * Now lets move ipv6.
17948 	 */
17949 	if (err == 0 && ill_from_v6 != NULL) {
17950 		ASSERT(IAM_WRITER_ILL(ill_to_v6));
17951 		ill_from_v6->ill_move_in_progress = B_TRUE;
17952 		ill_to_v6->ill_move_in_progress = B_TRUE;
17953 		ill_to_v6->ill_move_peer = ill_from_v6;
17954 		ill_from_v6->ill_move_peer = ill_to_v6;
17955 		err = ill_move(ill_from_v6, ill_to_v6, q, mp);
17956 	}
17957 
17958 err_ret:
17959 	/*
17960 	 * EINPROGRESS means we are waiting for the ipif's that need to be
17961 	 * moved to become quiescent.
17962 	 */
17963 	if (err == EINPROGRESS) {
17964 		goto done;
17965 	}
17966 
17967 	/*
17968 	 * if err is set ill_up_ipifs will not be called
17969 	 * lets clear the flags.
17970 	 */
17971 
17972 	GRAB_ILL_LOCKS(ill_to_v4, ill_to_v6);
17973 	GRAB_ILL_LOCKS(ill_from_v4, ill_from_v6);
17974 	/*
17975 	 * Some of the clearing may be redundant. But it is simple
17976 	 * not making any extra checks.
17977 	 */
17978 	if (ill_from_v6 != NULL) {
17979 		ill_from_v6->ill_move_in_progress = B_FALSE;
17980 		ill_from_v6->ill_move_peer = NULL;
17981 		ill_from_v6->ill_state_flags &= ~ILL_CHANGING;
17982 	}
17983 	if (ill_from_v4 != NULL) {
17984 		ill_from_v4->ill_move_in_progress = B_FALSE;
17985 		ill_from_v4->ill_move_peer = NULL;
17986 		ill_from_v4->ill_state_flags &= ~ILL_CHANGING;
17987 	}
17988 	if (ill_to_v6 != NULL) {
17989 		ill_to_v6->ill_move_in_progress = B_FALSE;
17990 		ill_to_v6->ill_move_peer = NULL;
17991 		ill_to_v6->ill_state_flags &= ~ILL_CHANGING;
17992 	}
17993 	if (ill_to_v4 != NULL) {
17994 		ill_to_v4->ill_move_in_progress = B_FALSE;
17995 		ill_to_v4->ill_move_peer = NULL;
17996 		ill_to_v4->ill_state_flags &= ~ILL_CHANGING;
17997 	}
17998 
17999 	/*
18000 	 * Check for setting INACTIVE, if STANDBY is set and FAILED is not set.
18001 	 * Do this always to maintain proper state i.e even in case of errors.
18002 	 * As phyint_inactive looks at both v4 and v6 interfaces,
18003 	 * we need not call on both v4 and v6 interfaces.
18004 	 */
18005 	if (ill_from_v4 != NULL) {
18006 		if ((ill_from_v4->ill_phyint->phyint_flags &
18007 		    (PHYI_STANDBY | PHYI_FAILED)) == PHYI_STANDBY) {
18008 			phyint_inactive(ill_from_v4->ill_phyint);
18009 		}
18010 	} else if (ill_from_v6 != NULL) {
18011 		if ((ill_from_v6->ill_phyint->phyint_flags &
18012 		    (PHYI_STANDBY | PHYI_FAILED)) == PHYI_STANDBY) {
18013 			phyint_inactive(ill_from_v6->ill_phyint);
18014 		}
18015 	}
18016 
18017 	if (ill_to_v4 != NULL) {
18018 		if (ill_to_v4->ill_phyint->phyint_flags & PHYI_INACTIVE) {
18019 			ill_to_v4->ill_phyint->phyint_flags &= ~PHYI_INACTIVE;
18020 		}
18021 	} else if (ill_to_v6 != NULL) {
18022 		if (ill_to_v6->ill_phyint->phyint_flags & PHYI_INACTIVE) {
18023 			ill_to_v6->ill_phyint->phyint_flags &= ~PHYI_INACTIVE;
18024 		}
18025 	}
18026 
18027 	RELEASE_ILL_LOCKS(ill_to_v4, ill_to_v6);
18028 	RELEASE_ILL_LOCKS(ill_from_v4, ill_from_v6);
18029 
18030 no_err:
18031 	/*
18032 	 * lets bring the interfaces up on the to_ill.
18033 	 */
18034 	if (err == 0) {
18035 		err = ill_up_ipifs(ill_to_v4 == NULL ? ill_to_v6:ill_to_v4,
18036 		    q, mp);
18037 	}
18038 
18039 	if (err == 0) {
18040 		if (ill_from_v4 != NULL && ill_to_v4 != NULL)
18041 			ilm_send_multicast_reqs(ill_from_v4, ill_to_v4);
18042 
18043 		if (ill_from_v6 != NULL && ill_to_v6 != NULL)
18044 			ilm_send_multicast_reqs(ill_from_v6, ill_to_v6);
18045 	}
18046 done:
18047 
18048 	if (ill_to_v4 != NULL) {
18049 		ill_refrele(ill_to_v4);
18050 	}
18051 	if (ill_to_v6 != NULL) {
18052 		ill_refrele(ill_to_v6);
18053 	}
18054 
18055 	return (err);
18056 }
18057 
18058 static void
18059 ill_dl_down(ill_t *ill)
18060 {
18061 	/*
18062 	 * The ill is down; unbind but stay attached since we're still
18063 	 * associated with a PPA. If we have negotiated DLPI capabilites
18064 	 * with the data link service provider (IDS_OK) then reset them.
18065 	 * The interval between unbinding and rebinding is potentially
18066 	 * unbounded hence we cannot assume things will be the same.
18067 	 * The DLPI capabilities will be probed again when the data link
18068 	 * is brought up.
18069 	 */
18070 	mblk_t	*mp = ill->ill_unbind_mp;
18071 	hook_nic_event_t *info;
18072 
18073 	ip1dbg(("ill_dl_down(%s)\n", ill->ill_name));
18074 
18075 	ill->ill_unbind_mp = NULL;
18076 	if (mp != NULL) {
18077 		ip1dbg(("ill_dl_down: %s (%u) for %s\n",
18078 		    dlpi_prim_str(*(int *)mp->b_rptr), *(int *)mp->b_rptr,
18079 		    ill->ill_name));
18080 		mutex_enter(&ill->ill_lock);
18081 		ill->ill_state_flags |= ILL_DL_UNBIND_IN_PROGRESS;
18082 		mutex_exit(&ill->ill_lock);
18083 		if (ill->ill_dlpi_capab_state == IDS_OK)
18084 			ill_capability_reset(ill);
18085 		ill_dlpi_send(ill, mp);
18086 	}
18087 
18088 	/*
18089 	 * Toss all of our multicast memberships.  We could keep them, but
18090 	 * then we'd have to do bookkeeping of any joins and leaves performed
18091 	 * by the application while the the interface is down (we can't just
18092 	 * issue them because arp cannot currently process AR_ENTRY_SQUERY's
18093 	 * on a downed interface).
18094 	 */
18095 	ill_leave_multicast(ill);
18096 
18097 	mutex_enter(&ill->ill_lock);
18098 
18099 	ill->ill_dl_up = 0;
18100 
18101 	if ((info = ill->ill_nic_event_info) != NULL) {
18102 		ip2dbg(("ill_dl_down:unexpected nic event %d attached for %s\n",
18103 		    info->hne_event, ill->ill_name));
18104 		if (info->hne_data != NULL)
18105 			kmem_free(info->hne_data, info->hne_datalen);
18106 		kmem_free(info, sizeof (hook_nic_event_t));
18107 	}
18108 
18109 	info = kmem_alloc(sizeof (hook_nic_event_t), KM_NOSLEEP);
18110 	if (info != NULL) {
18111 		info->hne_nic = ill->ill_phyint->phyint_ifindex;
18112 		info->hne_lif = 0;
18113 		info->hne_event = NE_DOWN;
18114 		info->hne_data = NULL;
18115 		info->hne_datalen = 0;
18116 		info->hne_family = ill->ill_isv6 ? ipv6 : ipv4;
18117 	} else
18118 		ip2dbg(("ill_dl_down: could not attach DOWN nic event "
18119 		    "information for %s (ENOMEM)\n", ill->ill_name));
18120 
18121 	ill->ill_nic_event_info = info;
18122 
18123 	mutex_exit(&ill->ill_lock);
18124 }
18125 
18126 void
18127 ill_dlpi_dispatch(ill_t *ill, mblk_t *mp)
18128 {
18129 	union DL_primitives *dlp;
18130 	t_uscalar_t prim;
18131 
18132 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
18133 
18134 	dlp = (union DL_primitives *)mp->b_rptr;
18135 	prim = dlp->dl_primitive;
18136 
18137 	ip1dbg(("ill_dlpi_dispatch: sending %s (%u) to %s\n",
18138 		dlpi_prim_str(prim), prim, ill->ill_name));
18139 
18140 	switch (prim) {
18141 	case DL_PHYS_ADDR_REQ:
18142 	{
18143 		dl_phys_addr_req_t *dlpap = (dl_phys_addr_req_t *)mp->b_rptr;
18144 		ill->ill_phys_addr_pend = dlpap->dl_addr_type;
18145 		break;
18146 	}
18147 	case DL_BIND_REQ:
18148 		mutex_enter(&ill->ill_lock);
18149 		ill->ill_state_flags &= ~ILL_DL_UNBIND_IN_PROGRESS;
18150 		mutex_exit(&ill->ill_lock);
18151 		break;
18152 	}
18153 
18154 	/*
18155 	 * Except for the ACKs for the M_PCPROTO messages, all other ACKs
18156 	 * are dropped by ip_rput() if ILL_CONDEMNED is set. Therefore
18157 	 * we only wait for the ACK of the DL_UNBIND_REQ.
18158 	 */
18159 	mutex_enter(&ill->ill_lock);
18160 	if (!(ill->ill_state_flags & ILL_CONDEMNED) ||
18161 	    (prim == DL_UNBIND_REQ)) {
18162 		ill->ill_dlpi_pending = prim;
18163 	}
18164 	mutex_exit(&ill->ill_lock);
18165 
18166 	/*
18167 	 * Some drivers send M_FLUSH up to IP as part of unbind
18168 	 * request.  When this M_FLUSH is sent back to the driver,
18169 	 * this can go after we send the detach request if the
18170 	 * M_FLUSH ends up in IP's syncq. To avoid that, we reply
18171 	 * to the M_FLUSH in ip_rput and locally generate another
18172 	 * M_FLUSH for the correctness.  This will get freed in
18173 	 * ip_wput_nondata.
18174 	 */
18175 	if (prim == DL_UNBIND_REQ)
18176 		(void) putnextctl1(ill->ill_rq, M_FLUSH, FLUSHRW);
18177 
18178 	putnext(ill->ill_wq, mp);
18179 }
18180 
18181 /*
18182  * Send a DLPI control message to the driver but make sure there
18183  * is only one outstanding message. Uses ill_dlpi_pending to tell
18184  * when it must queue. ip_rput_dlpi_writer calls ill_dlpi_done()
18185  * when an ACK or a NAK is received to process the next queued message.
18186  *
18187  * We don't protect ill_dlpi_pending with any lock. This is okay as
18188  * every place where its accessed, ip is exclusive while accessing
18189  * ill_dlpi_pending except when this function is called from ill_init()
18190  */
18191 void
18192 ill_dlpi_send(ill_t *ill, mblk_t *mp)
18193 {
18194 	mblk_t **mpp;
18195 
18196 	ASSERT(IAM_WRITER_ILL(ill));
18197 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
18198 
18199 	if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
18200 		/* Must queue message. Tail insertion */
18201 		mpp = &ill->ill_dlpi_deferred;
18202 		while (*mpp != NULL)
18203 			mpp = &((*mpp)->b_next);
18204 
18205 		ip1dbg(("ill_dlpi_send: deferring request for %s\n",
18206 		    ill->ill_name));
18207 
18208 		*mpp = mp;
18209 		return;
18210 	}
18211 
18212 	ill_dlpi_dispatch(ill, mp);
18213 }
18214 
18215 /*
18216  * Called when an DLPI control message has been acked or nacked to
18217  * send down the next queued message (if any).
18218  */
18219 void
18220 ill_dlpi_done(ill_t *ill, t_uscalar_t prim)
18221 {
18222 	mblk_t *mp;
18223 
18224 	ASSERT(IAM_WRITER_ILL(ill));
18225 
18226 	ASSERT(prim != DL_PRIM_INVAL);
18227 	if (ill->ill_dlpi_pending != prim) {
18228 		if (ill->ill_dlpi_pending == DL_PRIM_INVAL) {
18229 			(void) mi_strlog(ill->ill_rq, 1,
18230 			    SL_CONSOLE|SL_ERROR|SL_TRACE,
18231 			    "ill_dlpi_done: unsolicited ack for %s from %s\n",
18232 			    dlpi_prim_str(prim), ill->ill_name);
18233 		} else {
18234 			(void) mi_strlog(ill->ill_rq, 1,
18235 			    SL_CONSOLE|SL_ERROR|SL_TRACE,
18236 			    "ill_dlpi_done: unexpected ack for %s from %s "
18237 			    "(expecting ack for %s)\n",
18238 			    dlpi_prim_str(prim), ill->ill_name,
18239 			    dlpi_prim_str(ill->ill_dlpi_pending));
18240 		}
18241 		return;
18242 	}
18243 
18244 	ip1dbg(("ill_dlpi_done: %s has completed %s (%u)\n", ill->ill_name,
18245 	    dlpi_prim_str(ill->ill_dlpi_pending), ill->ill_dlpi_pending));
18246 
18247 	if ((mp = ill->ill_dlpi_deferred) == NULL) {
18248 		mutex_enter(&ill->ill_lock);
18249 		ill->ill_dlpi_pending = DL_PRIM_INVAL;
18250 		cv_signal(&ill->ill_cv);
18251 		mutex_exit(&ill->ill_lock);
18252 		return;
18253 	}
18254 
18255 	ill->ill_dlpi_deferred = mp->b_next;
18256 	mp->b_next = NULL;
18257 
18258 	ill_dlpi_dispatch(ill, mp);
18259 }
18260 
18261 void
18262 conn_delete_ire(conn_t *connp, caddr_t arg)
18263 {
18264 	ipif_t	*ipif = (ipif_t *)arg;
18265 	ire_t	*ire;
18266 
18267 	/*
18268 	 * Look at the cached ires on conns which has pointers to ipifs.
18269 	 * We just call ire_refrele which clears up the reference
18270 	 * to ire. Called when a conn closes. Also called from ipif_free
18271 	 * to cleanup indirect references to the stale ipif via the cached ire.
18272 	 */
18273 	mutex_enter(&connp->conn_lock);
18274 	ire = connp->conn_ire_cache;
18275 	if (ire != NULL && (ipif == NULL || ire->ire_ipif == ipif)) {
18276 		connp->conn_ire_cache = NULL;
18277 		mutex_exit(&connp->conn_lock);
18278 		IRE_REFRELE_NOTR(ire);
18279 		return;
18280 	}
18281 	mutex_exit(&connp->conn_lock);
18282 
18283 }
18284 
18285 /*
18286  * Some operations (illgrp_delete(), ipif_down()) conditionally delete a number
18287  * of IREs. Those IREs may have been previously cached in the conn structure.
18288  * This ipcl_walk() walker function releases all references to such IREs based
18289  * on the condemned flag.
18290  */
18291 /* ARGSUSED */
18292 void
18293 conn_cleanup_stale_ire(conn_t *connp, caddr_t arg)
18294 {
18295 	ire_t	*ire;
18296 
18297 	mutex_enter(&connp->conn_lock);
18298 	ire = connp->conn_ire_cache;
18299 	if (ire != NULL && (ire->ire_marks & IRE_MARK_CONDEMNED)) {
18300 		connp->conn_ire_cache = NULL;
18301 		mutex_exit(&connp->conn_lock);
18302 		IRE_REFRELE_NOTR(ire);
18303 		return;
18304 	}
18305 	mutex_exit(&connp->conn_lock);
18306 }
18307 
18308 /*
18309  * Take down a specific interface, but don't lose any information about it.
18310  * Also delete interface from its interface group (ifgrp).
18311  * (Always called as writer.)
18312  * This function goes through the down sequence even if the interface is
18313  * already down. There are 2 reasons.
18314  * a. Currently we permit interface routes that depend on down interfaces
18315  *    to be added. This behaviour itself is questionable. However it appears
18316  *    that both Solaris and 4.3 BSD have exhibited this behaviour for a long
18317  *    time. We go thru the cleanup in order to remove these routes.
18318  * b. The bringup of the interface could fail in ill_dl_up i.e. we get
18319  *    DL_ERROR_ACK in response to the the DL_BIND request. The interface is
18320  *    down, but we need to cleanup i.e. do ill_dl_down and
18321  *    ip_rput_dlpi_writer (DL_ERROR_ACK) -> ipif_down.
18322  *
18323  * IP-MT notes:
18324  *
18325  * Model of reference to interfaces.
18326  *
18327  * The following members in ipif_t track references to the ipif.
18328  *	int     ipif_refcnt;    Active reference count
18329  *	uint_t  ipif_ire_cnt;   Number of ire's referencing this ipif
18330  * The following members in ill_t track references to the ill.
18331  *	int             ill_refcnt;     active refcnt
18332  *	uint_t          ill_ire_cnt;	Number of ires referencing ill
18333  *	uint_t          ill_nce_cnt;	Number of nces referencing ill
18334  *
18335  * Reference to an ipif or ill can be obtained in any of the following ways.
18336  *
18337  * Through the lookup functions ipif_lookup_* / ill_lookup_* functions
18338  * Pointers to ipif / ill from other data structures viz ire and conn.
18339  * Implicit reference to the ipif / ill by holding a reference to the ire.
18340  *
18341  * The ipif/ill lookup functions return a reference held ipif / ill.
18342  * ipif_refcnt and ill_refcnt track the reference counts respectively.
18343  * This is a purely dynamic reference count associated with threads holding
18344  * references to the ipif / ill. Pointers from other structures do not
18345  * count towards this reference count.
18346  *
18347  * ipif_ire_cnt/ill_ire_cnt is the number of ire's associated with the
18348  * ipif/ill. This is incremented whenever a new ire is created referencing the
18349  * ipif/ill. This is done atomically inside ire_add_v[46] where the ire is
18350  * actually added to the ire hash table. The count is decremented in
18351  * ire_inactive where the ire is destroyed.
18352  *
18353  * nce's reference ill's thru nce_ill and the count of nce's associated with
18354  * an ill is recorded in ill_nce_cnt. This is incremented atomically in
18355  * ndp_add() where the nce is actually added to the table. Similarly it is
18356  * decremented in ndp_inactive where the nce is destroyed.
18357  *
18358  * Flow of ioctls involving interface down/up
18359  *
18360  * The following is the sequence of an attempt to set some critical flags on an
18361  * up interface.
18362  * ip_sioctl_flags
18363  * ipif_down
18364  * wait for ipif to be quiescent
18365  * ipif_down_tail
18366  * ip_sioctl_flags_tail
18367  *
18368  * All set ioctls that involve down/up sequence would have a skeleton similar
18369  * to the above. All the *tail functions are called after the refcounts have
18370  * dropped to the appropriate values.
18371  *
18372  * The mechanism to quiesce an ipif is as follows.
18373  *
18374  * Mark the ipif as IPIF_CHANGING. No more lookups will be allowed
18375  * on the ipif. Callers either pass a flag requesting wait or the lookup
18376  *  functions will return NULL.
18377  *
18378  * Delete all ires referencing this ipif
18379  *
18380  * Any thread attempting to do an ipif_refhold on an ipif that has been
18381  * obtained thru a cached pointer will first make sure that
18382  * the ipif can be refheld using the macro IPIF_CAN_LOOKUP and only then
18383  * increment the refcount.
18384  *
18385  * The above guarantees that the ipif refcount will eventually come down to
18386  * zero and the ipif will quiesce, once all threads that currently hold a
18387  * reference to the ipif refrelease the ipif. The ipif is quiescent after the
18388  * ipif_refcount has dropped to zero and all ire's associated with this ipif
18389  * have also been ire_inactive'd. i.e. when ipif_ire_cnt and ipif_refcnt both
18390  * drop to zero.
18391  *
18392  * Lookups during the IPIF_CHANGING/ILL_CHANGING interval.
18393  *
18394  * Threads trying to lookup an ipif or ill can pass a flag requesting
18395  * wait and restart if the ipif / ill cannot be looked up currently.
18396  * For eg. bind, and route operations (Eg. route add / delete) cannot return
18397  * failure if the ipif is currently undergoing an exclusive operation, and
18398  * hence pass the flag. The mblk is then enqueued in the ipsq and the operation
18399  * is restarted by ipsq_exit() when the currently exclusive ioctl completes.
18400  * The lookup and enqueue is atomic using the ill_lock and ipsq_lock. The
18401  * lookup is done holding the ill_lock. Hence the ill/ipif state flags can't
18402  * change while the ill_lock is held. Before dropping the ill_lock we acquire
18403  * the ipsq_lock and call ipsq_enq. This ensures that ipsq_exit can't finish
18404  * until we release the ipsq_lock, even though the the ill/ipif state flags
18405  * can change after we drop the ill_lock.
18406  *
18407  * An attempt to send out a packet using an ipif that is currently
18408  * IPIF_CHANGING will fail. No attempt is made in this case to enqueue this
18409  * operation and restart it later when the exclusive condition on the ipif ends.
18410  * This is an example of not passing the wait flag to the lookup functions. For
18411  * example an attempt to refhold and use conn->conn_multicast_ipif and send
18412  * out a multicast packet on that ipif will fail while the ipif is
18413  * IPIF_CHANGING. An attempt to create an IRE_CACHE using an ipif that is
18414  * currently IPIF_CHANGING will also fail.
18415  */
18416 int
18417 ipif_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
18418 {
18419 	ill_t		*ill = ipif->ipif_ill;
18420 	phyint_t	*phyi;
18421 	conn_t		*connp;
18422 	boolean_t	success;
18423 	boolean_t	ipif_was_up = B_FALSE;
18424 
18425 	ASSERT(IAM_WRITER_IPIF(ipif));
18426 
18427 	ip1dbg(("ipif_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
18428 
18429 	if (ipif->ipif_flags & IPIF_UP) {
18430 		mutex_enter(&ill->ill_lock);
18431 		ipif->ipif_flags &= ~IPIF_UP;
18432 		ASSERT(ill->ill_ipif_up_count > 0);
18433 		--ill->ill_ipif_up_count;
18434 		mutex_exit(&ill->ill_lock);
18435 		ipif_was_up = B_TRUE;
18436 		/* Update status in SCTP's list */
18437 		sctp_update_ipif(ipif, SCTP_IPIF_DOWN);
18438 	}
18439 
18440 	/*
18441 	 * Blow away v6 memberships we established in ipif_multicast_up(); the
18442 	 * v4 ones are left alone (as is the ipif_multicast_up flag, so we
18443 	 * know not to rejoin when the interface is brought back up).
18444 	 */
18445 	if (ipif->ipif_isv6)
18446 		ipif_multicast_down(ipif);
18447 	/*
18448 	 * Remove from the mapping for __sin6_src_id. We insert only
18449 	 * when the address is not INADDR_ANY. As IPv4 addresses are
18450 	 * stored as mapped addresses, we need to check for mapped
18451 	 * INADDR_ANY also.
18452 	 */
18453 	if (ipif_was_up && !IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
18454 	    !IN6_IS_ADDR_V4MAPPED_ANY(&ipif->ipif_v6lcl_addr) &&
18455 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
18456 		int err;
18457 
18458 		err = ip_srcid_remove(&ipif->ipif_v6lcl_addr,
18459 		    ipif->ipif_zoneid);
18460 		if (err != 0) {
18461 			ip0dbg(("ipif_down: srcid_remove %d\n", err));
18462 		}
18463 	}
18464 
18465 	/*
18466 	 * Before we delete the ill from the group (if any), we need
18467 	 * to make sure that we delete all the routes dependent on
18468 	 * this and also any ipifs dependent on this ipif for
18469 	 * source address. We need to do before we delete from
18470 	 * the group because
18471 	 *
18472 	 * 1) ipif_down_delete_ire de-references ill->ill_group.
18473 	 *
18474 	 * 2) ipif_update_other_ipifs needs to walk the whole group
18475 	 *    for re-doing source address selection. Note that
18476 	 *    ipif_select_source[_v6] called from
18477 	 *    ipif_update_other_ipifs[_v6] will not pick this ipif
18478 	 *    because we have already marked down here i.e cleared
18479 	 *    IPIF_UP.
18480 	 */
18481 	if (ipif->ipif_isv6)
18482 		ire_walk_v6(ipif_down_delete_ire, (char *)ipif, ALL_ZONES);
18483 	else
18484 		ire_walk_v4(ipif_down_delete_ire, (char *)ipif, ALL_ZONES);
18485 
18486 	/*
18487 	 * Need to add these also to be saved and restored when the
18488 	 * ipif is brought down and up
18489 	 */
18490 	mutex_enter(&ire_mrtun_lock);
18491 	if (ire_mrtun_count != 0) {
18492 		mutex_exit(&ire_mrtun_lock);
18493 		ire_walk_ill_mrtun(0, 0, ipif_down_delete_ire,
18494 		    (char *)ipif, NULL);
18495 	} else {
18496 		mutex_exit(&ire_mrtun_lock);
18497 	}
18498 
18499 	mutex_enter(&ire_srcif_table_lock);
18500 	if (ire_srcif_table_count > 0) {
18501 		mutex_exit(&ire_srcif_table_lock);
18502 		ire_walk_srcif_table_v4(ipif_down_delete_ire, (char *)ipif);
18503 	} else {
18504 		mutex_exit(&ire_srcif_table_lock);
18505 	}
18506 
18507 	/*
18508 	 * Cleaning up the conn_ire_cache or conns must be done only after the
18509 	 * ires have been deleted above. Otherwise a thread could end up
18510 	 * caching an ire in a conn after we have finished the cleanup of the
18511 	 * conn. The caching is done after making sure that the ire is not yet
18512 	 * condemned. Also documented in the block comment above ip_output
18513 	 */
18514 	ipcl_walk(conn_cleanup_stale_ire, NULL);
18515 	/* Also, delete the ires cached in SCTP */
18516 	sctp_ire_cache_flush(ipif);
18517 
18518 	/* Resolve any IPsec/IKE NAT-T instances that depend on this ipif. */
18519 	nattymod_clean_ipif(ipif);
18520 
18521 	/*
18522 	 * Update any other ipifs which have used "our" local address as
18523 	 * a source address. This entails removing and recreating IRE_INTERFACE
18524 	 * entries for such ipifs.
18525 	 */
18526 	if (ipif->ipif_isv6)
18527 		ipif_update_other_ipifs_v6(ipif, ill->ill_group);
18528 	else
18529 		ipif_update_other_ipifs(ipif, ill->ill_group);
18530 
18531 	if (ipif_was_up) {
18532 		/*
18533 		 * Check whether it is last ipif to leave this group.
18534 		 * If this is the last ipif to leave, we should remove
18535 		 * this ill from the group as ipif_select_source will not
18536 		 * be able to find any useful ipifs if this ill is selected
18537 		 * for load balancing.
18538 		 *
18539 		 * For nameless groups, we should call ifgrp_delete if this
18540 		 * belongs to some group. As this ipif is going down, we may
18541 		 * need to reconstruct groups.
18542 		 */
18543 		phyi = ill->ill_phyint;
18544 		/*
18545 		 * If the phyint_groupname_len is 0, it may or may not
18546 		 * be in the nameless group. If the phyint_groupname_len is
18547 		 * not 0, then this ill should be part of some group.
18548 		 * As we always insert this ill in the group if
18549 		 * phyint_groupname_len is not zero when the first ipif
18550 		 * comes up (in ipif_up_done), it should be in a group
18551 		 * when the namelen is not 0.
18552 		 *
18553 		 * NOTE : When we delete the ill from the group,it will
18554 		 * blow away all the IRE_CACHES pointing either at this ipif or
18555 		 * ill_wq (illgrp_cache_delete does this). Thus, no IRES
18556 		 * should be pointing at this ill.
18557 		 */
18558 		ASSERT(phyi->phyint_groupname_len == 0 ||
18559 		    (phyi->phyint_groupname != NULL && ill->ill_group != NULL));
18560 
18561 		if (phyi->phyint_groupname_len != 0) {
18562 			if (ill->ill_ipif_up_count == 0)
18563 				illgrp_delete(ill);
18564 		}
18565 
18566 		/*
18567 		 * If we have deleted some of the broadcast ires associated
18568 		 * with this ipif, we need to re-nominate somebody else if
18569 		 * the ires that we deleted were the nominated ones.
18570 		 */
18571 		if (ill->ill_group != NULL && !ill->ill_isv6)
18572 			ipif_renominate_bcast(ipif);
18573 	}
18574 
18575 	/*
18576 	 * neighbor-discovery or arp entries for this interface.
18577 	 */
18578 	ipif_ndp_down(ipif);
18579 
18580 	/*
18581 	 * If mp is NULL the caller will wait for the appropriate refcnt.
18582 	 * Eg. ip_sioctl_removeif -> ipif_free  -> ipif_down
18583 	 * and ill_delete -> ipif_free -> ipif_down
18584 	 */
18585 	if (mp == NULL) {
18586 		ASSERT(q == NULL);
18587 		return (0);
18588 	}
18589 
18590 	if (CONN_Q(q)) {
18591 		connp = Q_TO_CONN(q);
18592 		mutex_enter(&connp->conn_lock);
18593 	} else {
18594 		connp = NULL;
18595 	}
18596 	mutex_enter(&ill->ill_lock);
18597 	/*
18598 	 * Are there any ire's pointing to this ipif that are still active ?
18599 	 * If this is the last ipif going down, are there any ire's pointing
18600 	 * to this ill that are still active ?
18601 	 */
18602 	if (ipif_is_quiescent(ipif)) {
18603 		mutex_exit(&ill->ill_lock);
18604 		if (connp != NULL)
18605 			mutex_exit(&connp->conn_lock);
18606 		return (0);
18607 	}
18608 
18609 	ip1dbg(("ipif_down: need to wait, adding pending mp %s ill %p",
18610 	    ill->ill_name, (void *)ill));
18611 	/*
18612 	 * Enqueue the mp atomically in ipsq_pending_mp. When the refcount
18613 	 * drops down, the operation will be restarted by ipif_ill_refrele_tail
18614 	 * which in turn is called by the last refrele on the ipif/ill/ire.
18615 	 */
18616 	success = ipsq_pending_mp_add(connp, ipif, q, mp, IPIF_DOWN);
18617 	if (!success) {
18618 		/* The conn is closing. So just return */
18619 		ASSERT(connp != NULL);
18620 		mutex_exit(&ill->ill_lock);
18621 		mutex_exit(&connp->conn_lock);
18622 		return (EINTR);
18623 	}
18624 
18625 	mutex_exit(&ill->ill_lock);
18626 	if (connp != NULL)
18627 		mutex_exit(&connp->conn_lock);
18628 	return (EINPROGRESS);
18629 }
18630 
18631 void
18632 ipif_down_tail(ipif_t *ipif)
18633 {
18634 	ill_t	*ill = ipif->ipif_ill;
18635 
18636 	/*
18637 	 * Skip any loopback interface (null wq).
18638 	 * If this is the last logical interface on the ill
18639 	 * have ill_dl_down tell the driver we are gone (unbind)
18640 	 * Note that lun 0 can ipif_down even though
18641 	 * there are other logical units that are up.
18642 	 * This occurs e.g. when we change a "significant" IFF_ flag.
18643 	 */
18644 	if (ill->ill_wq != NULL && !ill->ill_logical_down &&
18645 	    ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
18646 	    ill->ill_dl_up) {
18647 		ill_dl_down(ill);
18648 	}
18649 	ill->ill_logical_down = 0;
18650 
18651 	/*
18652 	 * Have to be after removing the routes in ipif_down_delete_ire.
18653 	 */
18654 	if (ipif->ipif_isv6) {
18655 		if (ill->ill_flags & ILLF_XRESOLV)
18656 			ipif_arp_down(ipif);
18657 	} else {
18658 		ipif_arp_down(ipif);
18659 	}
18660 
18661 	ip_rts_ifmsg(ipif);
18662 	ip_rts_newaddrmsg(RTM_DELETE, 0, ipif);
18663 }
18664 
18665 /*
18666  * Bring interface logically down without bringing the physical interface
18667  * down e.g. when the netmask is changed. This avoids long lasting link
18668  * negotiations between an ethernet interface and a certain switches.
18669  */
18670 static int
18671 ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
18672 {
18673 	/*
18674 	 * The ill_logical_down flag is a transient flag. It is set here
18675 	 * and is cleared once the down has completed in ipif_down_tail.
18676 	 * This flag does not indicate whether the ill stream is in the
18677 	 * DL_BOUND state with the driver. Instead this flag is used by
18678 	 * ipif_down_tail to determine whether to DL_UNBIND the stream with
18679 	 * the driver. The state of the ill stream i.e. whether it is
18680 	 * DL_BOUND with the driver or not is indicated by the ill_dl_up flag.
18681 	 */
18682 	ipif->ipif_ill->ill_logical_down = 1;
18683 	return (ipif_down(ipif, q, mp));
18684 }
18685 
18686 /*
18687  * This is called when the SIOCSLIFUSESRC ioctl is processed in IP.
18688  * If the usesrc client ILL is already part of a usesrc group or not,
18689  * in either case a ire_stq with the matching usesrc client ILL will
18690  * locate the IRE's that need to be deleted. We want IREs to be created
18691  * with the new source address.
18692  */
18693 static void
18694 ipif_delete_cache_ire(ire_t *ire, char *ill_arg)
18695 {
18696 	ill_t	*ucill = (ill_t *)ill_arg;
18697 
18698 	ASSERT(IAM_WRITER_ILL(ucill));
18699 
18700 	if (ire->ire_stq == NULL)
18701 		return;
18702 
18703 	if ((ire->ire_type == IRE_CACHE) &&
18704 	    ((ill_t *)ire->ire_stq->q_ptr == ucill))
18705 		ire_delete(ire);
18706 }
18707 
18708 /*
18709  * ire_walk routine to delete every IRE dependent on the interface
18710  * address that is going down.	(Always called as writer.)
18711  * Works for both v4 and v6.
18712  * In addition for checking for ire_ipif matches it also checks for
18713  * IRE_CACHE entries which have the same source address as the
18714  * disappearing ipif since ipif_select_source might have picked
18715  * that source. Note that ipif_down/ipif_update_other_ipifs takes
18716  * care of any IRE_INTERFACE with the disappearing source address.
18717  */
18718 static void
18719 ipif_down_delete_ire(ire_t *ire, char *ipif_arg)
18720 {
18721 	ipif_t	*ipif = (ipif_t *)ipif_arg;
18722 	ill_t *ire_ill;
18723 	ill_t *ipif_ill;
18724 
18725 	ASSERT(IAM_WRITER_IPIF(ipif));
18726 	if (ire->ire_ipif == NULL)
18727 		return;
18728 
18729 	/*
18730 	 * For IPv4, we derive source addresses for an IRE from ipif's
18731 	 * belonging to the same IPMP group as the IRE's outgoing
18732 	 * interface.  If an IRE's outgoing interface isn't in the
18733 	 * same IPMP group as a particular ipif, then that ipif
18734 	 * couldn't have been used as a source address for this IRE.
18735 	 *
18736 	 * For IPv6, source addresses are only restricted to the IPMP group
18737 	 * if the IRE is for a link-local address or a multicast address.
18738 	 * Otherwise, source addresses for an IRE can be chosen from
18739 	 * interfaces other than the the outgoing interface for that IRE.
18740 	 *
18741 	 * For source address selection details, see ipif_select_source()
18742 	 * and ipif_select_source_v6().
18743 	 */
18744 	if (ire->ire_ipversion == IPV4_VERSION ||
18745 	    IN6_IS_ADDR_LINKLOCAL(&ire->ire_addr_v6) ||
18746 	    IN6_IS_ADDR_MULTICAST(&ire->ire_addr_v6)) {
18747 		ire_ill = ire->ire_ipif->ipif_ill;
18748 		ipif_ill = ipif->ipif_ill;
18749 
18750 		if (ire_ill->ill_group != ipif_ill->ill_group) {
18751 			return;
18752 		}
18753 	}
18754 
18755 
18756 	if (ire->ire_ipif != ipif) {
18757 		/*
18758 		 * Look for a matching source address.
18759 		 */
18760 		if (ire->ire_type != IRE_CACHE)
18761 			return;
18762 		if (ipif->ipif_flags & IPIF_NOLOCAL)
18763 			return;
18764 
18765 		if (ire->ire_ipversion == IPV4_VERSION) {
18766 			if (ire->ire_src_addr != ipif->ipif_src_addr)
18767 				return;
18768 		} else {
18769 			if (!IN6_ARE_ADDR_EQUAL(&ire->ire_src_addr_v6,
18770 			    &ipif->ipif_v6lcl_addr))
18771 				return;
18772 		}
18773 		ire_delete(ire);
18774 		return;
18775 	}
18776 	/*
18777 	 * ire_delete() will do an ire_flush_cache which will delete
18778 	 * all ire_ipif matches
18779 	 */
18780 	ire_delete(ire);
18781 }
18782 
18783 /*
18784  * ire_walk_ill function for deleting all IRE_CACHE entries for an ill when
18785  * 1) an ipif (on that ill) changes the IPIF_DEPRECATED flags, or
18786  * 2) when an interface is brought up or down (on that ill).
18787  * This ensures that the IRE_CACHE entries don't retain stale source
18788  * address selection results.
18789  */
18790 void
18791 ill_ipif_cache_delete(ire_t *ire, char *ill_arg)
18792 {
18793 	ill_t	*ill = (ill_t *)ill_arg;
18794 	ill_t	*ipif_ill;
18795 
18796 	ASSERT(IAM_WRITER_ILL(ill));
18797 	/*
18798 	 * We use MATCH_IRE_TYPE/IRE_CACHE while calling ire_walk_ill_v4.
18799 	 * Hence this should be IRE_CACHE.
18800 	 */
18801 	ASSERT(ire->ire_type == IRE_CACHE);
18802 
18803 	/*
18804 	 * We are called for IRE_CACHES whose ire_ipif matches ill.
18805 	 * We are only interested in IRE_CACHES that has borrowed
18806 	 * the source address from ill_arg e.g. ipif_up_done[_v6]
18807 	 * for which we need to look at ire_ipif->ipif_ill match
18808 	 * with ill.
18809 	 */
18810 	ASSERT(ire->ire_ipif != NULL);
18811 	ipif_ill = ire->ire_ipif->ipif_ill;
18812 	if (ipif_ill == ill || (ill->ill_group != NULL &&
18813 	    ipif_ill->ill_group == ill->ill_group)) {
18814 		ire_delete(ire);
18815 	}
18816 }
18817 
18818 /*
18819  * Delete all the ire whose stq references ill_arg.
18820  */
18821 static void
18822 ill_stq_cache_delete(ire_t *ire, char *ill_arg)
18823 {
18824 	ill_t	*ill = (ill_t *)ill_arg;
18825 	ill_t	*ire_ill;
18826 
18827 	ASSERT(IAM_WRITER_ILL(ill));
18828 	/*
18829 	 * We use MATCH_IRE_TYPE/IRE_CACHE while calling ire_walk_ill_v4.
18830 	 * Hence this should be IRE_CACHE.
18831 	 */
18832 	ASSERT(ire->ire_type == IRE_CACHE);
18833 
18834 	/*
18835 	 * We are called for IRE_CACHES whose ire_stq and ire_ipif
18836 	 * matches ill. We are only interested in IRE_CACHES that
18837 	 * has ire_stq->q_ptr pointing at ill_arg. Thus we do the
18838 	 * filtering here.
18839 	 */
18840 	ire_ill = (ill_t *)ire->ire_stq->q_ptr;
18841 
18842 	if (ire_ill == ill)
18843 		ire_delete(ire);
18844 }
18845 
18846 /*
18847  * This is called when an ill leaves the group. We want to delete
18848  * all IRE_CACHES whose stq is pointing at ill_wq or ire_ipif is
18849  * pointing at ill.
18850  */
18851 static void
18852 illgrp_cache_delete(ire_t *ire, char *ill_arg)
18853 {
18854 	ill_t	*ill = (ill_t *)ill_arg;
18855 
18856 	ASSERT(IAM_WRITER_ILL(ill));
18857 	ASSERT(ill->ill_group == NULL);
18858 	/*
18859 	 * We use MATCH_IRE_TYPE/IRE_CACHE while calling ire_walk_ill_v4.
18860 	 * Hence this should be IRE_CACHE.
18861 	 */
18862 	ASSERT(ire->ire_type == IRE_CACHE);
18863 	/*
18864 	 * We are called for IRE_CACHES whose ire_stq and ire_ipif
18865 	 * matches ill. We are interested in both.
18866 	 */
18867 	ASSERT((ill == (ill_t *)ire->ire_stq->q_ptr) ||
18868 	    (ire->ire_ipif->ipif_ill == ill));
18869 
18870 	ire_delete(ire);
18871 }
18872 
18873 /*
18874  * Initiate deallocate of an IPIF. Always called as writer. Called by
18875  * ill_delete or ip_sioctl_removeif.
18876  */
18877 static void
18878 ipif_free(ipif_t *ipif)
18879 {
18880 	ASSERT(IAM_WRITER_IPIF(ipif));
18881 
18882 	if (ipif->ipif_recovery_id != 0)
18883 		(void) untimeout(ipif->ipif_recovery_id);
18884 	ipif->ipif_recovery_id = 0;
18885 
18886 	/* Remove conn references */
18887 	reset_conn_ipif(ipif);
18888 
18889 	/*
18890 	 * Make sure we have valid net and subnet broadcast ire's for the
18891 	 * other ipif's which share them with this ipif.
18892 	 */
18893 	if (!ipif->ipif_isv6)
18894 		ipif_check_bcast_ires(ipif);
18895 
18896 	/*
18897 	 * Take down the interface. We can be called either from ill_delete
18898 	 * or from ip_sioctl_removeif.
18899 	 */
18900 	(void) ipif_down(ipif, NULL, NULL);
18901 
18902 	rw_enter(&ill_g_lock, RW_WRITER);
18903 	/* Remove pointers to this ill in the multicast routing tables */
18904 	reset_mrt_vif_ipif(ipif);
18905 	rw_exit(&ill_g_lock);
18906 }
18907 
18908 static void
18909 ipif_free_tail(ipif_t *ipif)
18910 {
18911 	mblk_t	*mp;
18912 	ipif_t	**ipifp;
18913 
18914 	/*
18915 	 * Free state for addition IRE_IF_[NO]RESOLVER ire's.
18916 	 */
18917 	mutex_enter(&ipif->ipif_saved_ire_lock);
18918 	mp = ipif->ipif_saved_ire_mp;
18919 	ipif->ipif_saved_ire_mp = NULL;
18920 	mutex_exit(&ipif->ipif_saved_ire_lock);
18921 	freemsg(mp);
18922 
18923 	/*
18924 	 * Need to hold both ill_g_lock and ill_lock while
18925 	 * inserting or removing an ipif from the linked list
18926 	 * of ipifs hanging off the ill.
18927 	 */
18928 	rw_enter(&ill_g_lock, RW_WRITER);
18929 	/*
18930 	 * Remove all multicast memberships on the interface now.
18931 	 * This removes IPv4 multicast memberships joined within
18932 	 * the kernel as ipif_down does not do ipif_multicast_down
18933 	 * for IPv4. IPv6 is not handled here as the multicast memberships
18934 	 * are based on ill and not on ipif.
18935 	 */
18936 	ilm_free(ipif);
18937 
18938 	/*
18939 	 * Since we held the ill_g_lock while doing the ilm_free above,
18940 	 * we can assert the ilms were really deleted and not just marked
18941 	 * ILM_DELETED.
18942 	 */
18943 	ASSERT(ilm_walk_ipif(ipif) == 0);
18944 
18945 
18946 	IPIF_TRACE_CLEANUP(ipif);
18947 
18948 	/* Ask SCTP to take it out of it list */
18949 	sctp_update_ipif(ipif, SCTP_IPIF_REMOVE);
18950 
18951 	mutex_enter(&ipif->ipif_ill->ill_lock);
18952 	/* Get it out of the ILL interface list. */
18953 	ipifp = &ipif->ipif_ill->ill_ipif;
18954 	for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
18955 		if (*ipifp == ipif) {
18956 			*ipifp = ipif->ipif_next;
18957 			break;
18958 		}
18959 	}
18960 
18961 	mutex_exit(&ipif->ipif_ill->ill_lock);
18962 	rw_exit(&ill_g_lock);
18963 
18964 	mutex_destroy(&ipif->ipif_saved_ire_lock);
18965 
18966 	ASSERT(!(ipif->ipif_flags & (IPIF_UP | IPIF_DUPLICATE)));
18967 
18968 	/* Free the memory. */
18969 	mi_free((char *)ipif);
18970 }
18971 
18972 /*
18973  * Returns an ipif name in the form "ill_name/unit" if ipif_id is not zero,
18974  * "ill_name" otherwise.
18975  */
18976 char *
18977 ipif_get_name(const ipif_t *ipif, char *buf, int len)
18978 {
18979 	char	lbuf[32];
18980 	char	*name;
18981 	size_t	name_len;
18982 
18983 	buf[0] = '\0';
18984 	if (!ipif)
18985 		return (buf);
18986 	name = ipif->ipif_ill->ill_name;
18987 	name_len = ipif->ipif_ill->ill_name_length;
18988 	if (ipif->ipif_id != 0) {
18989 		(void) sprintf(lbuf, "%s%c%d", name, IPIF_SEPARATOR_CHAR,
18990 		    ipif->ipif_id);
18991 		name = lbuf;
18992 		name_len = mi_strlen(name) + 1;
18993 	}
18994 	len -= 1;
18995 	buf[len] = '\0';
18996 	len = MIN(len, name_len);
18997 	bcopy(name, buf, len);
18998 	return (buf);
18999 }
19000 
19001 /*
19002  * Find an IPIF based on the name passed in.  Names can be of the
19003  * form <phys> (e.g., le0), <phys>:<#> (e.g., le0:1),
19004  * The <phys> string can have forms like <dev><#> (e.g., le0),
19005  * <dev><#>.<module> (e.g. le0.foo), or <dev>.<module><#> (e.g. ip.tun3).
19006  * When there is no colon, the implied unit id is zero. <phys> must
19007  * correspond to the name of an ILL.  (May be called as writer.)
19008  */
19009 static ipif_t *
19010 ipif_lookup_on_name(char *name, size_t namelen, boolean_t do_alloc,
19011     boolean_t *exists, boolean_t isv6, zoneid_t zoneid, queue_t *q,
19012     mblk_t *mp, ipsq_func_t func, int *error)
19013 {
19014 	char	*cp;
19015 	char	*endp;
19016 	long	id;
19017 	ill_t	*ill;
19018 	ipif_t	*ipif;
19019 	uint_t	ire_type;
19020 	boolean_t did_alloc = B_FALSE;
19021 	ipsq_t	*ipsq;
19022 
19023 	if (error != NULL)
19024 		*error = 0;
19025 
19026 	/*
19027 	 * If the caller wants to us to create the ipif, make sure we have a
19028 	 * valid zoneid
19029 	 */
19030 	ASSERT(!do_alloc || zoneid != ALL_ZONES);
19031 
19032 	if (namelen == 0) {
19033 		if (error != NULL)
19034 			*error = ENXIO;
19035 		return (NULL);
19036 	}
19037 
19038 	*exists = B_FALSE;
19039 	/* Look for a colon in the name. */
19040 	endp = &name[namelen];
19041 	for (cp = endp; --cp > name; ) {
19042 		if (*cp == IPIF_SEPARATOR_CHAR)
19043 			break;
19044 	}
19045 
19046 	if (*cp == IPIF_SEPARATOR_CHAR) {
19047 		/*
19048 		 * Reject any non-decimal aliases for logical
19049 		 * interfaces. Aliases with leading zeroes
19050 		 * are also rejected as they introduce ambiguity
19051 		 * in the naming of the interfaces.
19052 		 * In order to confirm with existing semantics,
19053 		 * and to not break any programs/script relying
19054 		 * on that behaviour, if<0>:0 is considered to be
19055 		 * a valid interface.
19056 		 *
19057 		 * If alias has two or more digits and the first
19058 		 * is zero, fail.
19059 		 */
19060 		if (&cp[2] < endp && cp[1] == '0')
19061 			return (NULL);
19062 	}
19063 
19064 	if (cp <= name) {
19065 		cp = endp;
19066 	} else {
19067 		*cp = '\0';
19068 	}
19069 
19070 	/*
19071 	 * Look up the ILL, based on the portion of the name
19072 	 * before the slash. ill_lookup_on_name returns a held ill.
19073 	 * Temporary to check whether ill exists already. If so
19074 	 * ill_lookup_on_name will clear it.
19075 	 */
19076 	ill = ill_lookup_on_name(name, do_alloc, isv6,
19077 	    q, mp, func, error, &did_alloc);
19078 	if (cp != endp)
19079 		*cp = IPIF_SEPARATOR_CHAR;
19080 	if (ill == NULL)
19081 		return (NULL);
19082 
19083 	/* Establish the unit number in the name. */
19084 	id = 0;
19085 	if (cp < endp && *endp == '\0') {
19086 		/* If there was a colon, the unit number follows. */
19087 		cp++;
19088 		if (ddi_strtol(cp, NULL, 0, &id) != 0) {
19089 			ill_refrele(ill);
19090 			if (error != NULL)
19091 				*error = ENXIO;
19092 			return (NULL);
19093 		}
19094 	}
19095 
19096 	GRAB_CONN_LOCK(q);
19097 	mutex_enter(&ill->ill_lock);
19098 	/* Now see if there is an IPIF with this unit number. */
19099 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
19100 		if (ipif->ipif_id == id) {
19101 			if (zoneid != ALL_ZONES &&
19102 			    zoneid != ipif->ipif_zoneid &&
19103 			    ipif->ipif_zoneid != ALL_ZONES) {
19104 				mutex_exit(&ill->ill_lock);
19105 				RELEASE_CONN_LOCK(q);
19106 				ill_refrele(ill);
19107 				if (error != NULL)
19108 					*error = ENXIO;
19109 				return (NULL);
19110 			}
19111 			/*
19112 			 * The block comment at the start of ipif_down
19113 			 * explains the use of the macros used below
19114 			 */
19115 			if (IPIF_CAN_LOOKUP(ipif)) {
19116 				ipif_refhold_locked(ipif);
19117 				mutex_exit(&ill->ill_lock);
19118 				if (!did_alloc)
19119 					*exists = B_TRUE;
19120 				/*
19121 				 * Drop locks before calling ill_refrele
19122 				 * since it can potentially call into
19123 				 * ipif_ill_refrele_tail which can end up
19124 				 * in trying to acquire any lock.
19125 				 */
19126 				RELEASE_CONN_LOCK(q);
19127 				ill_refrele(ill);
19128 				return (ipif);
19129 			} else if (IPIF_CAN_WAIT(ipif, q)) {
19130 				ipsq = ill->ill_phyint->phyint_ipsq;
19131 				mutex_enter(&ipsq->ipsq_lock);
19132 				mutex_exit(&ill->ill_lock);
19133 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
19134 				mutex_exit(&ipsq->ipsq_lock);
19135 				RELEASE_CONN_LOCK(q);
19136 				ill_refrele(ill);
19137 				*error = EINPROGRESS;
19138 				return (NULL);
19139 			}
19140 		}
19141 	}
19142 	RELEASE_CONN_LOCK(q);
19143 
19144 	if (!do_alloc) {
19145 		mutex_exit(&ill->ill_lock);
19146 		ill_refrele(ill);
19147 		if (error != NULL)
19148 			*error = ENXIO;
19149 		return (NULL);
19150 	}
19151 
19152 	/*
19153 	 * If none found, atomically allocate and return a new one.
19154 	 * Historically, we used IRE_LOOPBACK only for lun 0, and IRE_LOCAL
19155 	 * to support "receive only" use of lo0:1 etc. as is still done
19156 	 * below as an initial guess.
19157 	 * However, this is now likely to be overriden later in ipif_up_done()
19158 	 * when we know for sure what address has been configured on the
19159 	 * interface, since we might have more than one loopback interface
19160 	 * with a loopback address, e.g. in the case of zones, and all the
19161 	 * interfaces with loopback addresses need to be marked IRE_LOOPBACK.
19162 	 */
19163 	if (ill->ill_net_type == IRE_LOOPBACK && id == 0)
19164 		ire_type = IRE_LOOPBACK;
19165 	else
19166 		ire_type = IRE_LOCAL;
19167 	ipif = ipif_allocate(ill, id, ire_type, B_TRUE);
19168 	if (ipif != NULL)
19169 		ipif_refhold_locked(ipif);
19170 	else if (error != NULL)
19171 		*error = ENOMEM;
19172 	mutex_exit(&ill->ill_lock);
19173 	ill_refrele(ill);
19174 	return (ipif);
19175 }
19176 
19177 /*
19178  * This routine is called whenever a new address comes up on an ipif.  If
19179  * we are configured to respond to address mask requests, then we are supposed
19180  * to broadcast an address mask reply at this time.  This routine is also
19181  * called if we are already up, but a netmask change is made.  This is legal
19182  * but might not make the system manager very popular.	(May be called
19183  * as writer.)
19184  */
19185 void
19186 ipif_mask_reply(ipif_t *ipif)
19187 {
19188 	icmph_t	*icmph;
19189 	ipha_t	*ipha;
19190 	mblk_t	*mp;
19191 
19192 #define	REPLY_LEN	(sizeof (icmp_ipha) + sizeof (icmph_t) + IP_ADDR_LEN)
19193 
19194 	if (!ip_respond_to_address_mask_broadcast)
19195 		return;
19196 
19197 	/* ICMP mask reply is IPv4 only */
19198 	ASSERT(!ipif->ipif_isv6);
19199 	/* ICMP mask reply is not for a loopback interface */
19200 	ASSERT(ipif->ipif_ill->ill_wq != NULL);
19201 
19202 	mp = allocb(REPLY_LEN, BPRI_HI);
19203 	if (mp == NULL)
19204 		return;
19205 	mp->b_wptr = mp->b_rptr + REPLY_LEN;
19206 
19207 	ipha = (ipha_t *)mp->b_rptr;
19208 	bzero(ipha, REPLY_LEN);
19209 	*ipha = icmp_ipha;
19210 	ipha->ipha_ttl = ip_broadcast_ttl;
19211 	ipha->ipha_src = ipif->ipif_src_addr;
19212 	ipha->ipha_dst = ipif->ipif_brd_addr;
19213 	ipha->ipha_length = htons(REPLY_LEN);
19214 	ipha->ipha_ident = 0;
19215 
19216 	icmph = (icmph_t *)&ipha[1];
19217 	icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY;
19218 	bcopy(&ipif->ipif_net_mask, &icmph[1], IP_ADDR_LEN);
19219 	icmph->icmph_checksum = IP_CSUM(mp, sizeof (ipha_t), 0);
19220 	if (icmph->icmph_checksum == 0)
19221 		icmph->icmph_checksum = 0xffff;
19222 
19223 	put(ipif->ipif_wq, mp);
19224 
19225 #undef	REPLY_LEN
19226 }
19227 
19228 /*
19229  * When the mtu in the ipif changes, we call this routine through ire_walk
19230  * to update all the relevant IREs.
19231  * Skip IRE_LOCAL and "loopback" IRE_BROADCAST by checking ire_stq.
19232  */
19233 static void
19234 ipif_mtu_change(ire_t *ire, char *ipif_arg)
19235 {
19236 	ipif_t *ipif = (ipif_t *)ipif_arg;
19237 
19238 	if (ire->ire_stq == NULL || ire->ire_ipif != ipif)
19239 		return;
19240 	ire->ire_max_frag = MIN(ipif->ipif_mtu, IP_MAXPACKET);
19241 }
19242 
19243 /*
19244  * When the mtu in the ill changes, we call this routine through ire_walk
19245  * to update all the relevant IREs.
19246  * Skip IRE_LOCAL and "loopback" IRE_BROADCAST by checking ire_stq.
19247  */
19248 void
19249 ill_mtu_change(ire_t *ire, char *ill_arg)
19250 {
19251 	ill_t	*ill = (ill_t *)ill_arg;
19252 
19253 	if (ire->ire_stq == NULL || ire->ire_ipif->ipif_ill != ill)
19254 		return;
19255 	ire->ire_max_frag = ire->ire_ipif->ipif_mtu;
19256 }
19257 
19258 /*
19259  * Join the ipif specific multicast groups.
19260  * Must be called after a mapping has been set up in the resolver.  (Always
19261  * called as writer.)
19262  */
19263 void
19264 ipif_multicast_up(ipif_t *ipif)
19265 {
19266 	int err, index;
19267 	ill_t *ill;
19268 
19269 	ASSERT(IAM_WRITER_IPIF(ipif));
19270 
19271 	ill = ipif->ipif_ill;
19272 	index = ill->ill_phyint->phyint_ifindex;
19273 
19274 	ip1dbg(("ipif_multicast_up\n"));
19275 	if (!(ill->ill_flags & ILLF_MULTICAST) || ipif->ipif_multicast_up)
19276 		return;
19277 
19278 	if (ipif->ipif_isv6) {
19279 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
19280 			return;
19281 
19282 		/* Join the all hosts multicast address */
19283 		ip1dbg(("ipif_multicast_up - addmulti\n"));
19284 		/*
19285 		 * Passing B_TRUE means we have to join the multicast
19286 		 * membership on this interface even though this is
19287 		 * FAILED. If we join on a different one in the group,
19288 		 * we will not be able to delete the membership later
19289 		 * as we currently don't track where we join when we
19290 		 * join within the kernel unlike applications where
19291 		 * we have ilg/ilg_orig_index. See ip_addmulti_v6
19292 		 * for more on this.
19293 		 */
19294 		err = ip_addmulti_v6(&ipv6_all_hosts_mcast, ill, index,
19295 		    ipif->ipif_zoneid, ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
19296 		if (err != 0) {
19297 			ip0dbg(("ipif_multicast_up: "
19298 			    "all_hosts_mcast failed %d\n",
19299 			    err));
19300 			return;
19301 		}
19302 		/*
19303 		 * Enable multicast for the solicited node multicast address
19304 		 */
19305 		if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
19306 			in6_addr_t ipv6_multi = ipv6_solicited_node_mcast;
19307 
19308 			ipv6_multi.s6_addr32[3] |=
19309 			    ipif->ipif_v6lcl_addr.s6_addr32[3];
19310 
19311 			err = ip_addmulti_v6(&ipv6_multi, ill, index,
19312 			    ipif->ipif_zoneid, ILGSTAT_NONE, MODE_IS_EXCLUDE,
19313 			    NULL);
19314 			if (err != 0) {
19315 				ip0dbg(("ipif_multicast_up: solicited MC"
19316 				    " failed %d\n", err));
19317 				(void) ip_delmulti_v6(&ipv6_all_hosts_mcast,
19318 				    ill, ill->ill_phyint->phyint_ifindex,
19319 				    ipif->ipif_zoneid, B_TRUE, B_TRUE);
19320 				return;
19321 			}
19322 		}
19323 	} else {
19324 		if (ipif->ipif_lcl_addr == INADDR_ANY)
19325 			return;
19326 
19327 		/* Join the all hosts multicast address */
19328 		ip1dbg(("ipif_multicast_up - addmulti\n"));
19329 		err = ip_addmulti(htonl(INADDR_ALLHOSTS_GROUP), ipif,
19330 		    ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
19331 		if (err) {
19332 			ip0dbg(("ipif_multicast_up: failed %d\n", err));
19333 			return;
19334 		}
19335 	}
19336 	ipif->ipif_multicast_up = 1;
19337 }
19338 
19339 /*
19340  * Blow away any IPv6 multicast groups that we joined in ipif_multicast_up();
19341  * any explicit memberships are blown away in ill_leave_multicast() when the
19342  * ill is brought down.
19343  */
19344 static void
19345 ipif_multicast_down(ipif_t *ipif)
19346 {
19347 	int err;
19348 
19349 	ASSERT(IAM_WRITER_IPIF(ipif));
19350 
19351 	ip1dbg(("ipif_multicast_down\n"));
19352 	if (!ipif->ipif_multicast_up)
19353 		return;
19354 
19355 	ASSERT(ipif->ipif_isv6);
19356 
19357 	ip1dbg(("ipif_multicast_down - delmulti\n"));
19358 
19359 	/*
19360 	 * Leave the all hosts multicast address. Similar to ip_addmulti_v6,
19361 	 * we should look for ilms on this ill rather than the ones that have
19362 	 * been failed over here.  They are here temporarily. As
19363 	 * ipif_multicast_up has joined on this ill, we should delete only
19364 	 * from this ill.
19365 	 */
19366 	err = ip_delmulti_v6(&ipv6_all_hosts_mcast, ipif->ipif_ill,
19367 	    ipif->ipif_ill->ill_phyint->phyint_ifindex, ipif->ipif_zoneid,
19368 	    B_TRUE, B_TRUE);
19369 	if (err != 0) {
19370 		ip0dbg(("ipif_multicast_down: all_hosts_mcast failed %d\n",
19371 		    err));
19372 	}
19373 	/*
19374 	 * Disable multicast for the solicited node multicast address
19375 	 */
19376 	if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
19377 		in6_addr_t ipv6_multi = ipv6_solicited_node_mcast;
19378 
19379 		ipv6_multi.s6_addr32[3] |=
19380 		    ipif->ipif_v6lcl_addr.s6_addr32[3];
19381 
19382 		err = ip_delmulti_v6(&ipv6_multi, ipif->ipif_ill,
19383 		    ipif->ipif_ill->ill_phyint->phyint_ifindex,
19384 		    ipif->ipif_zoneid, B_TRUE, B_TRUE);
19385 
19386 		if (err != 0) {
19387 			ip0dbg(("ipif_multicast_down: sol MC failed %d\n",
19388 			    err));
19389 		}
19390 	}
19391 
19392 	ipif->ipif_multicast_up = 0;
19393 }
19394 
19395 /*
19396  * Used when an interface comes up to recreate any extra routes on this
19397  * interface.
19398  */
19399 static ire_t **
19400 ipif_recover_ire(ipif_t *ipif)
19401 {
19402 	mblk_t	*mp;
19403 	ire_t	**ipif_saved_irep;
19404 	ire_t	**irep;
19405 
19406 	ip1dbg(("ipif_recover_ire(%s:%u)", ipif->ipif_ill->ill_name,
19407 	    ipif->ipif_id));
19408 
19409 	mutex_enter(&ipif->ipif_saved_ire_lock);
19410 	ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) *
19411 	    ipif->ipif_saved_ire_cnt, KM_NOSLEEP);
19412 	if (ipif_saved_irep == NULL) {
19413 		mutex_exit(&ipif->ipif_saved_ire_lock);
19414 		return (NULL);
19415 	}
19416 
19417 	irep = ipif_saved_irep;
19418 	for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
19419 		ire_t		*ire;
19420 		queue_t		*rfq;
19421 		queue_t		*stq;
19422 		ifrt_t		*ifrt;
19423 		uchar_t		*src_addr;
19424 		uchar_t		*gateway_addr;
19425 		mblk_t		*resolver_mp;
19426 		ushort_t	type;
19427 
19428 		/*
19429 		 * When the ire was initially created and then added in
19430 		 * ip_rt_add(), it was created either using ipif->ipif_net_type
19431 		 * in the case of a traditional interface route, or as one of
19432 		 * the IRE_OFFSUBNET types (with the exception of
19433 		 * IRE_HOST types ire which is created by icmp_redirect() and
19434 		 * which we don't need to save or recover).  In the case where
19435 		 * ipif->ipif_net_type was IRE_LOOPBACK, ip_rt_add() will update
19436 		 * the ire_type to IRE_IF_NORESOLVER before calling ire_add()
19437 		 * to satisfy software like GateD and Sun Cluster which creates
19438 		 * routes using the the loopback interface's address as a
19439 		 * gateway.
19440 		 *
19441 		 * As ifrt->ifrt_type reflects the already updated ire_type and
19442 		 * since ire_create() expects that IRE_IF_NORESOLVER will have
19443 		 * a valid nce_res_mp field (which doesn't make sense for a
19444 		 * IRE_LOOPBACK), ire_create() will be called in the same way
19445 		 * here as in ip_rt_add(), namely using ipif->ipif_net_type when
19446 		 * the route looks like a traditional interface route (where
19447 		 * ifrt->ifrt_type & IRE_INTERFACE is true) and otherwise using
19448 		 * the saved ifrt->ifrt_type.  This means that in the case where
19449 		 * ipif->ipif_net_type is IRE_LOOPBACK, the ire created by
19450 		 * ire_create() will be an IRE_LOOPBACK, it will then be turned
19451 		 * into an IRE_IF_NORESOLVER and then added by ire_add().
19452 		 */
19453 		ifrt = (ifrt_t *)mp->b_rptr;
19454 		if (ifrt->ifrt_type & IRE_INTERFACE) {
19455 			rfq = NULL;
19456 			stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
19457 			    ? ipif->ipif_rq : ipif->ipif_wq;
19458 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
19459 			    ? (uint8_t *)&ifrt->ifrt_src_addr
19460 			    : (uint8_t *)&ipif->ipif_src_addr;
19461 			gateway_addr = NULL;
19462 			resolver_mp = ipif->ipif_resolver_mp;
19463 			type = ipif->ipif_net_type;
19464 		} else if (ifrt->ifrt_type & IRE_BROADCAST) {
19465 			/* Recover multiroute broadcast IRE. */
19466 			rfq = ipif->ipif_rq;
19467 			stq = ipif->ipif_wq;
19468 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
19469 			    ? (uint8_t *)&ifrt->ifrt_src_addr
19470 			    : (uint8_t *)&ipif->ipif_src_addr;
19471 			gateway_addr = (uint8_t *)&ifrt->ifrt_gateway_addr;
19472 			resolver_mp = ipif->ipif_bcast_mp;
19473 			type = ifrt->ifrt_type;
19474 		} else {
19475 			rfq = NULL;
19476 			stq = NULL;
19477 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
19478 			    ? (uint8_t *)&ifrt->ifrt_src_addr : NULL;
19479 			gateway_addr = (uint8_t *)&ifrt->ifrt_gateway_addr;
19480 			resolver_mp = NULL;
19481 			type = ifrt->ifrt_type;
19482 		}
19483 
19484 		/*
19485 		 * Create a copy of the IRE with the saved address and netmask.
19486 		 */
19487 		ip1dbg(("ipif_recover_ire: creating IRE %s (%d) for "
19488 		    "0x%x/0x%x\n",
19489 		    ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type,
19490 		    ntohl(ifrt->ifrt_addr),
19491 		    ntohl(ifrt->ifrt_mask)));
19492 		ire = ire_create(
19493 		    (uint8_t *)&ifrt->ifrt_addr,
19494 		    (uint8_t *)&ifrt->ifrt_mask,
19495 		    src_addr,
19496 		    gateway_addr,
19497 		    NULL,
19498 		    &ifrt->ifrt_max_frag,
19499 		    NULL,
19500 		    rfq,
19501 		    stq,
19502 		    type,
19503 		    resolver_mp,
19504 		    ipif,
19505 		    NULL,
19506 		    0,
19507 		    0,
19508 		    0,
19509 		    ifrt->ifrt_flags,
19510 		    &ifrt->ifrt_iulp_info,
19511 		    NULL,
19512 		    NULL);
19513 
19514 		if (ire == NULL) {
19515 			mutex_exit(&ipif->ipif_saved_ire_lock);
19516 			kmem_free(ipif_saved_irep,
19517 			    ipif->ipif_saved_ire_cnt * sizeof (ire_t *));
19518 			return (NULL);
19519 		}
19520 
19521 		/*
19522 		 * Some software (for example, GateD and Sun Cluster) attempts
19523 		 * to create (what amount to) IRE_PREFIX routes with the
19524 		 * loopback address as the gateway.  This is primarily done to
19525 		 * set up prefixes with the RTF_REJECT flag set (for example,
19526 		 * when generating aggregate routes.)
19527 		 *
19528 		 * If the IRE type (as defined by ipif->ipif_net_type) is
19529 		 * IRE_LOOPBACK, then we map the request into a
19530 		 * IRE_IF_NORESOLVER.
19531 		 */
19532 		if (ipif->ipif_net_type == IRE_LOOPBACK)
19533 			ire->ire_type = IRE_IF_NORESOLVER;
19534 		/*
19535 		 * ire held by ire_add, will be refreled' towards the
19536 		 * the end of ipif_up_done
19537 		 */
19538 		(void) ire_add(&ire, NULL, NULL, NULL, B_FALSE);
19539 		*irep = ire;
19540 		irep++;
19541 		ip1dbg(("ipif_recover_ire: added ire %p\n", (void *)ire));
19542 	}
19543 	mutex_exit(&ipif->ipif_saved_ire_lock);
19544 	return (ipif_saved_irep);
19545 }
19546 
19547 /*
19548  * Used to set the netmask and broadcast address to default values when the
19549  * interface is brought up.  (Always called as writer.)
19550  */
19551 static void
19552 ipif_set_default(ipif_t *ipif)
19553 {
19554 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
19555 
19556 	if (!ipif->ipif_isv6) {
19557 		/*
19558 		 * Interface holds an IPv4 address. Default
19559 		 * mask is the natural netmask.
19560 		 */
19561 		if (!ipif->ipif_net_mask) {
19562 			ipaddr_t	v4mask;
19563 
19564 			v4mask = ip_net_mask(ipif->ipif_lcl_addr);
19565 			V4MASK_TO_V6(v4mask, ipif->ipif_v6net_mask);
19566 		}
19567 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
19568 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
19569 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
19570 		} else {
19571 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
19572 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
19573 		}
19574 		/*
19575 		 * NOTE: SunOS 4.X does this even if the broadcast address
19576 		 * has been already set thus we do the same here.
19577 		 */
19578 		if (ipif->ipif_flags & IPIF_BROADCAST) {
19579 			ipaddr_t	v4addr;
19580 
19581 			v4addr = ipif->ipif_subnet | ~ipif->ipif_net_mask;
19582 			IN6_IPADDR_TO_V4MAPPED(v4addr, &ipif->ipif_v6brd_addr);
19583 		}
19584 	} else {
19585 		/*
19586 		 * Interface holds an IPv6-only address.  Default
19587 		 * mask is all-ones.
19588 		 */
19589 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
19590 			ipif->ipif_v6net_mask = ipv6_all_ones;
19591 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
19592 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
19593 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
19594 		} else {
19595 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
19596 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
19597 		}
19598 	}
19599 }
19600 
19601 /*
19602  * Return 0 if this address can be used as local address without causing
19603  * duplicate address problems. Otherwise, return EADDRNOTAVAIL if the address
19604  * is already up on a different ill, and EADDRINUSE if it's up on the same ill.
19605  * Special checks are needed to allow the same IPv6 link-local address
19606  * on different ills.
19607  * TODO: allowing the same site-local address on different ill's.
19608  */
19609 int
19610 ip_addr_availability_check(ipif_t *new_ipif)
19611 {
19612 	in6_addr_t our_v6addr;
19613 	ill_t *ill;
19614 	ipif_t *ipif;
19615 	ill_walk_context_t ctx;
19616 
19617 	ASSERT(IAM_WRITER_IPIF(new_ipif));
19618 	ASSERT(MUTEX_HELD(&ip_addr_avail_lock));
19619 	ASSERT(RW_READ_HELD(&ill_g_lock));
19620 
19621 	new_ipif->ipif_flags &= ~IPIF_UNNUMBERED;
19622 	if (IN6_IS_ADDR_UNSPECIFIED(&new_ipif->ipif_v6lcl_addr) ||
19623 	    IN6_IS_ADDR_V4MAPPED_ANY(&new_ipif->ipif_v6lcl_addr))
19624 		return (0);
19625 
19626 	our_v6addr = new_ipif->ipif_v6lcl_addr;
19627 
19628 	if (new_ipif->ipif_isv6)
19629 		ill = ILL_START_WALK_V6(&ctx);
19630 	else
19631 		ill = ILL_START_WALK_V4(&ctx);
19632 
19633 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
19634 		for (ipif = ill->ill_ipif; ipif != NULL;
19635 		    ipif = ipif->ipif_next) {
19636 			if ((ipif == new_ipif) ||
19637 			    !(ipif->ipif_flags & IPIF_UP) ||
19638 			    (ipif->ipif_flags & IPIF_UNNUMBERED))
19639 				continue;
19640 			if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
19641 			    &our_v6addr)) {
19642 				if (new_ipif->ipif_flags & IPIF_POINTOPOINT)
19643 				    new_ipif->ipif_flags |= IPIF_UNNUMBERED;
19644 				else if (ipif->ipif_flags & IPIF_POINTOPOINT)
19645 				    ipif->ipif_flags |= IPIF_UNNUMBERED;
19646 				else if (IN6_IS_ADDR_LINKLOCAL(&our_v6addr) &&
19647 				    new_ipif->ipif_ill != ill)
19648 					continue;
19649 				else if (IN6_IS_ADDR_SITELOCAL(&our_v6addr) &&
19650 				    new_ipif->ipif_ill != ill)
19651 					continue;
19652 				else if (new_ipif->ipif_zoneid !=
19653 				    ipif->ipif_zoneid &&
19654 				    ipif->ipif_zoneid != ALL_ZONES &&
19655 				    (ill->ill_phyint->phyint_flags &
19656 				    PHYI_LOOPBACK))
19657 					continue;
19658 				else if (new_ipif->ipif_ill == ill)
19659 					return (EADDRINUSE);
19660 				else
19661 					return (EADDRNOTAVAIL);
19662 			}
19663 		}
19664 	}
19665 
19666 	return (0);
19667 }
19668 
19669 /*
19670  * Bring up an ipif: bring up arp/ndp, bring up the DLPI stream, and add
19671  * IREs for the ipif.
19672  * When the routine returns EINPROGRESS then mp has been consumed and
19673  * the ioctl will be acked from ip_rput_dlpi.
19674  */
19675 static int
19676 ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp)
19677 {
19678 	ill_t	*ill = ipif->ipif_ill;
19679 	boolean_t isv6 = ipif->ipif_isv6;
19680 	int	err = 0;
19681 	boolean_t success;
19682 
19683 	ASSERT(IAM_WRITER_IPIF(ipif));
19684 
19685 	ip1dbg(("ipif_up(%s:%u)\n", ill->ill_name, ipif->ipif_id));
19686 
19687 	/* Shouldn't get here if it is already up. */
19688 	if (ipif->ipif_flags & IPIF_UP)
19689 		return (EALREADY);
19690 
19691 	/* Skip arp/ndp for any loopback interface. */
19692 	if (ill->ill_wq != NULL) {
19693 		conn_t *connp = Q_TO_CONN(q);
19694 		ipsq_t	*ipsq = ill->ill_phyint->phyint_ipsq;
19695 
19696 		if (!ill->ill_dl_up) {
19697 			/*
19698 			 * ill_dl_up is not yet set. i.e. we are yet to
19699 			 * DL_BIND with the driver and this is the first
19700 			 * logical interface on the ill to become "up".
19701 			 * Tell the driver to get going (via DL_BIND_REQ).
19702 			 * Note that changing "significant" IFF_ flags
19703 			 * address/netmask etc cause a down/up dance, but
19704 			 * does not cause an unbind (DL_UNBIND) with the driver
19705 			 */
19706 			return (ill_dl_up(ill, ipif, mp, q));
19707 		}
19708 
19709 		/*
19710 		 * ipif_resolver_up may end up sending an
19711 		 * AR_INTERFACE_UP message to ARP, which would, in
19712 		 * turn send a DLPI message to the driver. ioctls are
19713 		 * serialized and so we cannot send more than one
19714 		 * interface up message at a time. If ipif_resolver_up
19715 		 * does send an interface up message to ARP, we get
19716 		 * EINPROGRESS and we will complete in ip_arp_done.
19717 		 */
19718 
19719 		ASSERT(connp != NULL);
19720 		ASSERT(ipsq->ipsq_pending_mp == NULL);
19721 		mutex_enter(&connp->conn_lock);
19722 		mutex_enter(&ill->ill_lock);
19723 		success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
19724 		mutex_exit(&ill->ill_lock);
19725 		mutex_exit(&connp->conn_lock);
19726 		if (!success)
19727 			return (EINTR);
19728 
19729 		/*
19730 		 * Crank up IPv6 neighbor discovery
19731 		 * Unlike ARP, this should complete when
19732 		 * ipif_ndp_up returns. However, for
19733 		 * ILLF_XRESOLV interfaces we also send a
19734 		 * AR_INTERFACE_UP to the external resolver.
19735 		 * That ioctl will complete in ip_rput.
19736 		 */
19737 		if (isv6) {
19738 			err = ipif_ndp_up(ipif, &ipif->ipif_v6lcl_addr,
19739 			    B_FALSE);
19740 			if (err != 0) {
19741 				if (err != EINPROGRESS)
19742 					mp = ipsq_pending_mp_get(ipsq, &connp);
19743 				return (err);
19744 			}
19745 		}
19746 		/* Now, ARP */
19747 		err = ipif_resolver_up(ipif, Res_act_initial);
19748 		if (err == EINPROGRESS) {
19749 			/* We will complete it in ip_arp_done */
19750 			return (err);
19751 		}
19752 		mp = ipsq_pending_mp_get(ipsq, &connp);
19753 		ASSERT(mp != NULL);
19754 		if (err != 0)
19755 			return (err);
19756 	} else {
19757 		/*
19758 		 * Interfaces without underlying hardware don't do duplicate
19759 		 * address detection.
19760 		 */
19761 		ASSERT(!(ipif->ipif_flags & IPIF_DUPLICATE));
19762 		ipif->ipif_addr_ready = 1;
19763 	}
19764 	return (isv6 ? ipif_up_done_v6(ipif) : ipif_up_done(ipif));
19765 }
19766 
19767 /*
19768  * Perform a bind for the physical device.
19769  * When the routine returns EINPROGRESS then mp has been consumed and
19770  * the ioctl will be acked from ip_rput_dlpi.
19771  * Allocate an unbind message and save it until ipif_down.
19772  */
19773 static int
19774 ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
19775 {
19776 	mblk_t	*areq_mp = NULL;
19777 	mblk_t	*bind_mp = NULL;
19778 	mblk_t	*unbind_mp = NULL;
19779 	conn_t	*connp;
19780 	boolean_t success;
19781 
19782 	ip1dbg(("ill_dl_up(%s)\n", ill->ill_name));
19783 	ASSERT(IAM_WRITER_ILL(ill));
19784 
19785 	ASSERT(mp != NULL);
19786 
19787 	/* Create a resolver cookie for ARP */
19788 	if (!ill->ill_isv6 && ill->ill_net_type == IRE_IF_RESOLVER) {
19789 		areq_t		*areq;
19790 		uint16_t	sap_addr;
19791 
19792 		areq_mp = ill_arp_alloc(ill,
19793 			(uchar_t *)&ip_areq_template, 0);
19794 		if (areq_mp == NULL) {
19795 			return (ENOMEM);
19796 		}
19797 		freemsg(ill->ill_resolver_mp);
19798 		ill->ill_resolver_mp = areq_mp;
19799 		areq = (areq_t *)areq_mp->b_rptr;
19800 		sap_addr = ill->ill_sap;
19801 		bcopy(&sap_addr, areq->areq_sap, sizeof (sap_addr));
19802 		/*
19803 		 * Wait till we call ill_pending_mp_add to determine
19804 		 * the success before we free the ill_resolver_mp and
19805 		 * attach areq_mp in it's place.
19806 		 */
19807 	}
19808 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
19809 	    DL_BIND_REQ);
19810 	if (bind_mp == NULL)
19811 		goto bad;
19812 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
19813 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
19814 
19815 	unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ);
19816 	if (unbind_mp == NULL)
19817 		goto bad;
19818 
19819 	/*
19820 	 * Record state needed to complete this operation when the
19821 	 * DL_BIND_ACK shows up.  Also remember the pre-allocated mblks.
19822 	 */
19823 	if (WR(q)->q_next == NULL) {
19824 		connp = Q_TO_CONN(q);
19825 		mutex_enter(&connp->conn_lock);
19826 	} else {
19827 		connp = NULL;
19828 	}
19829 	mutex_enter(&ipif->ipif_ill->ill_lock);
19830 	success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
19831 	mutex_exit(&ipif->ipif_ill->ill_lock);
19832 	if (connp != NULL)
19833 		mutex_exit(&connp->conn_lock);
19834 	if (!success)
19835 		goto bad;
19836 
19837 	/*
19838 	 * Save the unbind message for ill_dl_down(); it will be consumed when
19839 	 * the interface goes down.
19840 	 */
19841 	ASSERT(ill->ill_unbind_mp == NULL);
19842 	ill->ill_unbind_mp = unbind_mp;
19843 
19844 	ill_dlpi_send(ill, bind_mp);
19845 	/* Send down link-layer capabilities probe if not already done. */
19846 	ill_capability_probe(ill);
19847 
19848 	/*
19849 	 * Sysid used to rely on the fact that netboots set domainname
19850 	 * and the like. Now that miniroot boots aren't strictly netboots
19851 	 * and miniroot network configuration is driven from userland
19852 	 * these things still need to be set. This situation can be detected
19853 	 * by comparing the interface being configured here to the one
19854 	 * dhcack was set to reference by the boot loader. Once sysid is
19855 	 * converted to use dhcp_ipc_getinfo() this call can go away.
19856 	 */
19857 	if ((ipif->ipif_flags & IPIF_DHCPRUNNING) && (dhcack != NULL) &&
19858 	    (strcmp(ill->ill_name, dhcack) == 0) &&
19859 	    (strlen(srpc_domain) == 0)) {
19860 		if (dhcpinit() != 0)
19861 			cmn_err(CE_WARN, "no cached dhcp response");
19862 	}
19863 
19864 	/*
19865 	 * This operation will complete in ip_rput_dlpi with either
19866 	 * a DL_BIND_ACK or DL_ERROR_ACK.
19867 	 */
19868 	return (EINPROGRESS);
19869 bad:
19870 	ip1dbg(("ill_dl_up(%s) FAILED\n", ill->ill_name));
19871 	/*
19872 	 * We don't have to check for possible removal from illgrp
19873 	 * as we have not yet inserted in illgrp. For groups
19874 	 * without names, this ipif is still not UP and hence
19875 	 * this could not have possibly had any influence in forming
19876 	 * groups.
19877 	 */
19878 
19879 	if (bind_mp != NULL)
19880 		freemsg(bind_mp);
19881 	if (unbind_mp != NULL)
19882 		freemsg(unbind_mp);
19883 	return (ENOMEM);
19884 }
19885 
19886 uint_t ip_loopback_mtuplus = IP_LOOPBACK_MTU + IP_SIMPLE_HDR_LENGTH + 20;
19887 
19888 /*
19889  * DLPI and ARP is up.
19890  * Create all the IREs associated with an interface bring up multicast.
19891  * Set the interface flag and finish other initialization
19892  * that potentially had to be differed to after DL_BIND_ACK.
19893  */
19894 int
19895 ipif_up_done(ipif_t *ipif)
19896 {
19897 	ire_t	*ire_array[20];
19898 	ire_t	**irep = ire_array;
19899 	ire_t	**irep1;
19900 	ipaddr_t net_mask = 0;
19901 	ipaddr_t subnet_mask, route_mask;
19902 	ill_t	*ill = ipif->ipif_ill;
19903 	queue_t	*stq;
19904 	ipif_t	 *src_ipif;
19905 	ipif_t   *tmp_ipif;
19906 	boolean_t	flush_ire_cache = B_TRUE;
19907 	int	err = 0;
19908 	phyint_t *phyi;
19909 	ire_t	**ipif_saved_irep = NULL;
19910 	int ipif_saved_ire_cnt;
19911 	int	cnt;
19912 	boolean_t	src_ipif_held = B_FALSE;
19913 	boolean_t	ire_added = B_FALSE;
19914 	boolean_t	loopback = B_FALSE;
19915 
19916 	ip1dbg(("ipif_up_done(%s:%u)\n",
19917 		ipif->ipif_ill->ill_name, ipif->ipif_id));
19918 	/* Check if this is a loopback interface */
19919 	if (ipif->ipif_ill->ill_wq == NULL)
19920 		loopback = B_TRUE;
19921 
19922 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
19923 	/*
19924 	 * If all other interfaces for this ill are down or DEPRECATED,
19925 	 * or otherwise unsuitable for source address selection, remove
19926 	 * any IRE_CACHE entries for this ill to make sure source
19927 	 * address selection gets to take this new ipif into account.
19928 	 * No need to hold ill_lock while traversing the ipif list since
19929 	 * we are writer
19930 	 */
19931 	for (tmp_ipif = ill->ill_ipif; tmp_ipif;
19932 		tmp_ipif = tmp_ipif->ipif_next) {
19933 		if (((tmp_ipif->ipif_flags &
19934 		    (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
19935 		    !(tmp_ipif->ipif_flags & IPIF_UP)) ||
19936 		    (tmp_ipif == ipif))
19937 			continue;
19938 		/* first useable pre-existing interface */
19939 		flush_ire_cache = B_FALSE;
19940 		break;
19941 	}
19942 	if (flush_ire_cache)
19943 		ire_walk_ill_v4(MATCH_IRE_ILL_GROUP | MATCH_IRE_TYPE,
19944 		    IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill);
19945 
19946 	/*
19947 	 * Figure out which way the send-to queue should go.  Only
19948 	 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER or IRE_LOOPBACK
19949 	 * should show up here.
19950 	 */
19951 	switch (ill->ill_net_type) {
19952 	case IRE_IF_RESOLVER:
19953 		stq = ill->ill_rq;
19954 		break;
19955 	case IRE_IF_NORESOLVER:
19956 	case IRE_LOOPBACK:
19957 		stq = ill->ill_wq;
19958 		break;
19959 	default:
19960 		return (EINVAL);
19961 	}
19962 
19963 	if (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK) {
19964 		/*
19965 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
19966 		 * ipif_lookup_on_name(), but in the case of zones we can have
19967 		 * several loopback addresses on lo0. So all the interfaces with
19968 		 * loopback addresses need to be marked IRE_LOOPBACK.
19969 		 */
19970 		if (V4_PART_OF_V6(ipif->ipif_v6lcl_addr) ==
19971 		    htonl(INADDR_LOOPBACK))
19972 			ipif->ipif_ire_type = IRE_LOOPBACK;
19973 		else
19974 			ipif->ipif_ire_type = IRE_LOCAL;
19975 	}
19976 
19977 	if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)) {
19978 		/*
19979 		 * Can't use our source address. Select a different
19980 		 * source address for the IRE_INTERFACE and IRE_LOCAL
19981 		 */
19982 		src_ipif = ipif_select_source(ipif->ipif_ill,
19983 		    ipif->ipif_subnet, ipif->ipif_zoneid);
19984 		if (src_ipif == NULL)
19985 			src_ipif = ipif;	/* Last resort */
19986 		else
19987 			src_ipif_held = B_TRUE;
19988 	} else {
19989 		src_ipif = ipif;
19990 	}
19991 
19992 	/* Create all the IREs associated with this interface */
19993 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
19994 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
19995 
19996 		/*
19997 		 * If we're on a labeled system then make sure that zone-
19998 		 * private addresses have proper remote host database entries.
19999 		 */
20000 		if (is_system_labeled() &&
20001 		    ipif->ipif_ire_type != IRE_LOOPBACK &&
20002 		    !tsol_check_interface_address(ipif))
20003 			return (EINVAL);
20004 
20005 		/* Register the source address for __sin6_src_id */
20006 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
20007 		    ipif->ipif_zoneid);
20008 		if (err != 0) {
20009 			ip0dbg(("ipif_up_done: srcid_insert %d\n", err));
20010 			return (err);
20011 		}
20012 
20013 		/* If the interface address is set, create the local IRE. */
20014 		ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x for 0x%x\n",
20015 			(void *)ipif,
20016 			ipif->ipif_ire_type,
20017 			ntohl(ipif->ipif_lcl_addr)));
20018 		*irep++ = ire_create(
20019 		    (uchar_t *)&ipif->ipif_lcl_addr,	/* dest address */
20020 		    (uchar_t *)&ip_g_all_ones,		/* mask */
20021 		    (uchar_t *)&src_ipif->ipif_src_addr, /* source address */
20022 		    NULL,				/* no gateway */
20023 		    NULL,
20024 		    &ip_loopback_mtuplus,		/* max frag size */
20025 		    NULL,
20026 		    ipif->ipif_rq,			/* recv-from queue */
20027 		    NULL,				/* no send-to queue */
20028 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
20029 		    NULL,
20030 		    ipif,
20031 		    NULL,
20032 		    0,
20033 		    0,
20034 		    0,
20035 		    (ipif->ipif_flags & IPIF_PRIVATE) ?
20036 		    RTF_PRIVATE : 0,
20037 		    &ire_uinfo_null,
20038 		    NULL,
20039 		    NULL);
20040 	} else {
20041 		ip1dbg((
20042 		    "ipif_up_done: not creating IRE %d for 0x%x: flags 0x%x\n",
20043 		    ipif->ipif_ire_type,
20044 		    ntohl(ipif->ipif_lcl_addr),
20045 		    (uint_t)ipif->ipif_flags));
20046 	}
20047 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
20048 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
20049 		net_mask = ip_net_mask(ipif->ipif_lcl_addr);
20050 	} else {
20051 		net_mask = htonl(IN_CLASSA_NET);	/* fallback */
20052 	}
20053 
20054 	subnet_mask = ipif->ipif_net_mask;
20055 
20056 	/*
20057 	 * If mask was not specified, use natural netmask of
20058 	 * interface address. Also, store this mask back into the
20059 	 * ipif struct.
20060 	 */
20061 	if (subnet_mask == 0) {
20062 		subnet_mask = net_mask;
20063 		V4MASK_TO_V6(subnet_mask, ipif->ipif_v6net_mask);
20064 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
20065 		    ipif->ipif_v6subnet);
20066 	}
20067 
20068 	/* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */
20069 	if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) &&
20070 	    ipif->ipif_subnet != INADDR_ANY) {
20071 		/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
20072 
20073 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
20074 			route_mask = IP_HOST_MASK;
20075 		} else {
20076 			route_mask = subnet_mask;
20077 		}
20078 
20079 		ip1dbg(("ipif_up_done: ipif 0x%p ill 0x%p "
20080 		    "creating if IRE ill_net_type 0x%x for 0x%x\n",
20081 			(void *)ipif, (void *)ill,
20082 			ill->ill_net_type,
20083 			ntohl(ipif->ipif_subnet)));
20084 		*irep++ = ire_create(
20085 		    (uchar_t *)&ipif->ipif_subnet,	/* dest address */
20086 		    (uchar_t *)&route_mask,		/* mask */
20087 		    (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */
20088 		    NULL,				/* no gateway */
20089 		    NULL,
20090 		    &ipif->ipif_mtu,			/* max frag */
20091 		    NULL,
20092 		    NULL,				/* no recv queue */
20093 		    stq,				/* send-to queue */
20094 		    ill->ill_net_type,			/* IF_[NO]RESOLVER */
20095 		    ill->ill_resolver_mp,		/* xmit header */
20096 		    ipif,
20097 		    NULL,
20098 		    0,
20099 		    0,
20100 		    0,
20101 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE: 0,
20102 		    &ire_uinfo_null,
20103 		    NULL,
20104 		    NULL);
20105 	}
20106 
20107 	/*
20108 	 * If the interface address is set, create the broadcast IREs.
20109 	 *
20110 	 * ire_create_bcast checks if the proposed new IRE matches
20111 	 * any existing IRE's with the same physical interface (ILL).
20112 	 * This should get rid of duplicates.
20113 	 * ire_create_bcast also check IPIF_NOXMIT and does not create
20114 	 * any broadcast ires.
20115 	 */
20116 	if ((ipif->ipif_subnet != INADDR_ANY) &&
20117 	    (ipif->ipif_flags & IPIF_BROADCAST)) {
20118 		ipaddr_t addr;
20119 
20120 		ip1dbg(("ipif_up_done: creating broadcast IRE\n"));
20121 		irep = ire_check_and_create_bcast(ipif, 0, irep,
20122 		    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
20123 		irep = ire_check_and_create_bcast(ipif, INADDR_BROADCAST, irep,
20124 		    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
20125 
20126 		/*
20127 		 * For backward compatibility, we need to create net
20128 		 * broadcast ire's based on the old "IP address class
20129 		 * system."  The reason is that some old machines only
20130 		 * respond to these class derived net broadcast.
20131 		 *
20132 		 * But we should not create these net broadcast ire's if
20133 		 * the subnet_mask is shorter than the IP address class based
20134 		 * derived netmask.  Otherwise, we may create a net
20135 		 * broadcast address which is the same as an IP address
20136 		 * on the subnet.  Then TCP will refuse to talk to that
20137 		 * address.
20138 		 *
20139 		 * Nor do we need IRE_BROADCAST ire's for the interface
20140 		 * with the netmask as 0xFFFFFFFF, as IRE_LOCAL for that
20141 		 * interface is already created.  Creating these broadcast
20142 		 * ire's will only create confusion as the "addr" is going
20143 		 * to be same as that of the IP address of the interface.
20144 		 */
20145 		if (net_mask < subnet_mask) {
20146 			addr = net_mask & ipif->ipif_subnet;
20147 			irep = ire_check_and_create_bcast(ipif, addr, irep,
20148 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
20149 			irep = ire_check_and_create_bcast(ipif,
20150 			    ~net_mask | addr, irep,
20151 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
20152 		}
20153 
20154 		if (subnet_mask != 0xFFFFFFFF) {
20155 			addr = ipif->ipif_subnet;
20156 			irep = ire_check_and_create_bcast(ipif, addr, irep,
20157 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
20158 			irep = ire_check_and_create_bcast(ipif,
20159 			    ~subnet_mask|addr, irep,
20160 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
20161 		}
20162 	}
20163 
20164 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
20165 
20166 	/* If an earlier ire_create failed, get out now */
20167 	for (irep1 = irep; irep1 > ire_array; ) {
20168 		irep1--;
20169 		if (*irep1 == NULL) {
20170 			ip1dbg(("ipif_up_done: NULL ire found in ire_array\n"));
20171 			err = ENOMEM;
20172 			goto bad;
20173 		}
20174 	}
20175 
20176 	/*
20177 	 * Need to atomically check for ip_addr_availablity_check
20178 	 * under ip_addr_avail_lock, and if it fails got bad, and remove
20179 	 * from group also.The ill_g_lock is grabbed as reader
20180 	 * just to make sure no new ills or new ipifs are being added
20181 	 * to the system while we are checking the uniqueness of addresses.
20182 	 */
20183 	rw_enter(&ill_g_lock, RW_READER);
20184 	mutex_enter(&ip_addr_avail_lock);
20185 	/* Mark it up, and increment counters. */
20186 	ipif->ipif_flags |= IPIF_UP;
20187 	ill->ill_ipif_up_count++;
20188 	err = ip_addr_availability_check(ipif);
20189 	mutex_exit(&ip_addr_avail_lock);
20190 	rw_exit(&ill_g_lock);
20191 
20192 	if (err != 0) {
20193 		/*
20194 		 * Our address may already be up on the same ill. In this case,
20195 		 * the ARP entry for our ipif replaced the one for the other
20196 		 * ipif. So we don't want to delete it (otherwise the other ipif
20197 		 * would be unable to send packets).
20198 		 * ip_addr_availability_check() identifies this case for us and
20199 		 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL
20200 		 * which is the expected error code.
20201 		 */
20202 		if (err == EADDRINUSE) {
20203 			freemsg(ipif->ipif_arp_del_mp);
20204 			ipif->ipif_arp_del_mp = NULL;
20205 			err = EADDRNOTAVAIL;
20206 		}
20207 		ill->ill_ipif_up_count--;
20208 		ipif->ipif_flags &= ~IPIF_UP;
20209 		goto bad;
20210 	}
20211 
20212 	/*
20213 	 * Add in all newly created IREs.  ire_create_bcast() has
20214 	 * already checked for duplicates of the IRE_BROADCAST type.
20215 	 * We want to add before we call ifgrp_insert which wants
20216 	 * to know whether IRE_IF_RESOLVER exists or not.
20217 	 *
20218 	 * NOTE : We refrele the ire though we may branch to "bad"
20219 	 *	  later on where we do ire_delete. This is okay
20220 	 *	  because nobody can delete it as we are running
20221 	 *	  exclusively.
20222 	 */
20223 	for (irep1 = irep; irep1 > ire_array; ) {
20224 		irep1--;
20225 		ASSERT(!MUTEX_HELD(&((*irep1)->ire_ipif->ipif_ill->ill_lock)));
20226 		/*
20227 		 * refheld by ire_add. refele towards the end of the func
20228 		 */
20229 		(void) ire_add(irep1, NULL, NULL, NULL, B_FALSE);
20230 	}
20231 	ire_added = B_TRUE;
20232 	/*
20233 	 * Form groups if possible.
20234 	 *
20235 	 * If we are supposed to be in a ill_group with a name, insert it
20236 	 * now as we know that at least one ipif is UP. Otherwise form
20237 	 * nameless groups.
20238 	 *
20239 	 * If ip_enable_group_ifs is set and ipif address is not 0, insert
20240 	 * this ipif into the appropriate interface group, or create a
20241 	 * new one. If this is already in a nameless group, we try to form
20242 	 * a bigger group looking at other ills potentially sharing this
20243 	 * ipif's prefix.
20244 	 */
20245 	phyi = ill->ill_phyint;
20246 	if (phyi->phyint_groupname_len != 0) {
20247 		ASSERT(phyi->phyint_groupname != NULL);
20248 		if (ill->ill_ipif_up_count == 1) {
20249 			ASSERT(ill->ill_group == NULL);
20250 			err = illgrp_insert(&illgrp_head_v4, ill,
20251 			    phyi->phyint_groupname, NULL, B_TRUE);
20252 			if (err != 0) {
20253 				ip1dbg(("ipif_up_done: illgrp allocation "
20254 				    "failed, error %d\n", err));
20255 				goto bad;
20256 			}
20257 		}
20258 		ASSERT(ill->ill_group != NULL);
20259 	}
20260 
20261 	/*
20262 	 * When this is part of group, we need to make sure that
20263 	 * any broadcast ires created because of this ipif coming
20264 	 * UP gets marked/cleared with IRE_MARK_NORECV appropriately
20265 	 * so that we don't receive duplicate broadcast packets.
20266 	 */
20267 	if (ill->ill_group != NULL && ill->ill_ipif_up_count != 0)
20268 		ipif_renominate_bcast(ipif);
20269 
20270 	/* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */
20271 	ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt;
20272 	ipif_saved_irep = ipif_recover_ire(ipif);
20273 
20274 	if (!loopback) {
20275 		/*
20276 		 * If the broadcast address has been set, make sure it makes
20277 		 * sense based on the interface address.
20278 		 * Only match on ill since we are sharing broadcast addresses.
20279 		 */
20280 		if ((ipif->ipif_brd_addr != INADDR_ANY) &&
20281 		    (ipif->ipif_flags & IPIF_BROADCAST)) {
20282 			ire_t	*ire;
20283 
20284 			ire = ire_ctable_lookup(ipif->ipif_brd_addr, 0,
20285 			    IRE_BROADCAST, ipif, ALL_ZONES,
20286 			    NULL, (MATCH_IRE_TYPE | MATCH_IRE_ILL));
20287 
20288 			if (ire == NULL) {
20289 				/*
20290 				 * If there isn't a matching broadcast IRE,
20291 				 * revert to the default for this netmask.
20292 				 */
20293 				ipif->ipif_v6brd_addr = ipv6_all_zeros;
20294 				mutex_enter(&ipif->ipif_ill->ill_lock);
20295 				ipif_set_default(ipif);
20296 				mutex_exit(&ipif->ipif_ill->ill_lock);
20297 			} else {
20298 				ire_refrele(ire);
20299 			}
20300 		}
20301 
20302 	}
20303 
20304 	/* This is the first interface on this ill */
20305 	if (ipif->ipif_ipif_up_count == 1 && !loopback) {
20306 		/*
20307 		 * Need to recover all multicast memberships in the driver.
20308 		 * This had to be deferred until we had attached.
20309 		 */
20310 		ill_recover_multicast(ill);
20311 	}
20312 	/* Join the allhosts multicast address */
20313 	ipif_multicast_up(ipif);
20314 
20315 	if (!loopback) {
20316 		/*
20317 		 * See whether anybody else would benefit from the
20318 		 * new ipif that we added. We call this always rather
20319 		 * than while adding a non-IPIF_NOLOCAL/DEPRECATED/ANYCAST
20320 		 * ipif is for the benefit of illgrp_insert (done above)
20321 		 * which does not do source address selection as it does
20322 		 * not want to re-create interface routes that we are
20323 		 * having reference to it here.
20324 		 */
20325 		ill_update_source_selection(ill);
20326 	}
20327 
20328 	for (irep1 = irep; irep1 > ire_array; ) {
20329 		irep1--;
20330 		if (*irep1 != NULL) {
20331 			/* was held in ire_add */
20332 			ire_refrele(*irep1);
20333 		}
20334 	}
20335 
20336 	cnt = ipif_saved_ire_cnt;
20337 	for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) {
20338 		if (*irep1 != NULL) {
20339 			/* was held in ire_add */
20340 			ire_refrele(*irep1);
20341 		}
20342 	}
20343 
20344 	if (!loopback && ipif->ipif_addr_ready) {
20345 		/* Broadcast an address mask reply. */
20346 		ipif_mask_reply(ipif);
20347 	}
20348 	if (ipif_saved_irep != NULL) {
20349 		kmem_free(ipif_saved_irep,
20350 		    ipif_saved_ire_cnt * sizeof (ire_t *));
20351 	}
20352 	if (src_ipif_held)
20353 		ipif_refrele(src_ipif);
20354 
20355 	/*
20356 	 * This had to be deferred until we had bound.  Tell routing sockets and
20357 	 * others that this interface is up if it looks like the address has
20358 	 * been validated.  Otherwise, if it isn't ready yet, wait for
20359 	 * duplicate address detection to do its thing.
20360 	 */
20361 	if (ipif->ipif_addr_ready) {
20362 		ip_rts_ifmsg(ipif);
20363 		ip_rts_newaddrmsg(RTM_ADD, 0, ipif);
20364 		/* Let SCTP update the status for this ipif */
20365 		sctp_update_ipif(ipif, SCTP_IPIF_UP);
20366 	}
20367 	return (0);
20368 
20369 bad:
20370 	ip1dbg(("ipif_up_done: FAILED \n"));
20371 	/*
20372 	 * We don't have to bother removing from ill groups because
20373 	 *
20374 	 * 1) For groups with names, we insert only when the first ipif
20375 	 *    comes up. In that case if it fails, it will not be in any
20376 	 *    group. So, we need not try to remove for that case.
20377 	 *
20378 	 * 2) For groups without names, either we tried to insert ipif_ill
20379 	 *    in a group as singleton or found some other group to become
20380 	 *    a bigger group. For the former, if it fails we don't have
20381 	 *    anything to do as ipif_ill is not in the group and for the
20382 	 *    latter, there are no failures in illgrp_insert/illgrp_delete
20383 	 *    (ENOMEM can't occur for this. Check ifgrp_insert).
20384 	 */
20385 	while (irep > ire_array) {
20386 		irep--;
20387 		if (*irep != NULL) {
20388 			ire_delete(*irep);
20389 			if (ire_added)
20390 				ire_refrele(*irep);
20391 		}
20392 	}
20393 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid);
20394 
20395 	if (ipif_saved_irep != NULL) {
20396 		kmem_free(ipif_saved_irep,
20397 		    ipif_saved_ire_cnt * sizeof (ire_t *));
20398 	}
20399 	if (src_ipif_held)
20400 		ipif_refrele(src_ipif);
20401 
20402 	ipif_arp_down(ipif);
20403 	return (err);
20404 }
20405 
20406 /*
20407  * Turn off the ARP with the ILLF_NOARP flag.
20408  */
20409 static int
20410 ill_arp_off(ill_t *ill)
20411 {
20412 	mblk_t	*arp_off_mp = NULL;
20413 	mblk_t	*arp_on_mp = NULL;
20414 
20415 	ip1dbg(("ill_arp_off(%s)\n", ill->ill_name));
20416 
20417 	ASSERT(IAM_WRITER_ILL(ill));
20418 	ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
20419 
20420 	/*
20421 	 * If the on message is still around we've already done
20422 	 * an arp_off without doing an arp_on thus there is no
20423 	 * work needed.
20424 	 */
20425 	if (ill->ill_arp_on_mp != NULL)
20426 		return (0);
20427 
20428 	/*
20429 	 * Allocate an ARP on message (to be saved) and an ARP off message
20430 	 */
20431 	arp_off_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aroff_template, 0);
20432 	if (!arp_off_mp)
20433 		return (ENOMEM);
20434 
20435 	arp_on_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aron_template, 0);
20436 	if (!arp_on_mp)
20437 		goto failed;
20438 
20439 	ASSERT(ill->ill_arp_on_mp == NULL);
20440 	ill->ill_arp_on_mp = arp_on_mp;
20441 
20442 	/* Send an AR_INTERFACE_OFF request */
20443 	putnext(ill->ill_rq, arp_off_mp);
20444 	return (0);
20445 failed:
20446 
20447 	if (arp_off_mp)
20448 		freemsg(arp_off_mp);
20449 	return (ENOMEM);
20450 }
20451 
20452 /*
20453  * Turn on ARP by turning off the ILLF_NOARP flag.
20454  */
20455 static int
20456 ill_arp_on(ill_t *ill)
20457 {
20458 	mblk_t	*mp;
20459 
20460 	ip1dbg(("ipif_arp_on(%s)\n", ill->ill_name));
20461 
20462 	ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
20463 
20464 	ASSERT(IAM_WRITER_ILL(ill));
20465 	/*
20466 	 * Send an AR_INTERFACE_ON request if we have already done
20467 	 * an arp_off (which allocated the message).
20468 	 */
20469 	if (ill->ill_arp_on_mp != NULL) {
20470 		mp = ill->ill_arp_on_mp;
20471 		ill->ill_arp_on_mp = NULL;
20472 		putnext(ill->ill_rq, mp);
20473 	}
20474 	return (0);
20475 }
20476 
20477 /*
20478  * Called after either deleting ill from the group or when setting
20479  * FAILED or STANDBY on the interface.
20480  */
20481 static void
20482 illgrp_reset_schednext(ill_t *ill)
20483 {
20484 	ill_group_t *illgrp;
20485 	ill_t *save_ill;
20486 
20487 	ASSERT(IAM_WRITER_ILL(ill));
20488 	/*
20489 	 * When called from illgrp_delete, ill_group will be non-NULL.
20490 	 * But when called from ip_sioctl_flags, it could be NULL if
20491 	 * somebody is setting FAILED/INACTIVE on some interface which
20492 	 * is not part of a group.
20493 	 */
20494 	illgrp = ill->ill_group;
20495 	if (illgrp == NULL)
20496 		return;
20497 	if (illgrp->illgrp_ill_schednext != ill)
20498 		return;
20499 
20500 	illgrp->illgrp_ill_schednext = NULL;
20501 	save_ill = ill;
20502 	/*
20503 	 * Choose a good ill to be the next one for
20504 	 * outbound traffic. As the flags FAILED/STANDBY is
20505 	 * not yet marked when called from ip_sioctl_flags,
20506 	 * we check for ill separately.
20507 	 */
20508 	for (ill = illgrp->illgrp_ill; ill != NULL;
20509 	    ill = ill->ill_group_next) {
20510 		if ((ill != save_ill) &&
20511 		    !(ill->ill_phyint->phyint_flags &
20512 		    (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE))) {
20513 			illgrp->illgrp_ill_schednext = ill;
20514 			return;
20515 		}
20516 	}
20517 }
20518 
20519 /*
20520  * Given an ill, find the next ill in the group to be scheduled.
20521  * (This should be called by ip_newroute() before ire_create().)
20522  * The passed in ill may be pulled out of the group, after we have picked
20523  * up a different outgoing ill from the same group. However ire add will
20524  * atomically check this.
20525  */
20526 ill_t *
20527 illgrp_scheduler(ill_t *ill)
20528 {
20529 	ill_t *retill;
20530 	ill_group_t *illgrp;
20531 	int illcnt;
20532 	int i;
20533 	uint64_t flags;
20534 
20535 	/*
20536 	 * We don't use a lock to check for the ill_group. If this ill
20537 	 * is currently being inserted we may end up just returning this
20538 	 * ill itself. That is ok.
20539 	 */
20540 	if (ill->ill_group == NULL) {
20541 		ill_refhold(ill);
20542 		return (ill);
20543 	}
20544 
20545 	/*
20546 	 * Grab the ill_g_lock as reader to make sure we are dealing with
20547 	 * a set of stable ills. No ill can be added or deleted or change
20548 	 * group while we hold the reader lock.
20549 	 */
20550 	rw_enter(&ill_g_lock, RW_READER);
20551 	if ((illgrp = ill->ill_group) == NULL) {
20552 		rw_exit(&ill_g_lock);
20553 		ill_refhold(ill);
20554 		return (ill);
20555 	}
20556 
20557 	illcnt = illgrp->illgrp_ill_count;
20558 	mutex_enter(&illgrp->illgrp_lock);
20559 	retill = illgrp->illgrp_ill_schednext;
20560 
20561 	if (retill == NULL)
20562 		retill = illgrp->illgrp_ill;
20563 
20564 	/*
20565 	 * We do a circular search beginning at illgrp_ill_schednext
20566 	 * or illgrp_ill. We don't check the flags against the ill lock
20567 	 * since it can change anytime. The ire creation will be atomic
20568 	 * and will fail if the ill is FAILED or OFFLINE.
20569 	 */
20570 	for (i = 0; i < illcnt; i++) {
20571 		flags = retill->ill_phyint->phyint_flags;
20572 
20573 		if (!(flags & (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) &&
20574 		    ILL_CAN_LOOKUP(retill)) {
20575 			illgrp->illgrp_ill_schednext = retill->ill_group_next;
20576 			ill_refhold(retill);
20577 			break;
20578 		}
20579 		retill = retill->ill_group_next;
20580 		if (retill == NULL)
20581 			retill = illgrp->illgrp_ill;
20582 	}
20583 	mutex_exit(&illgrp->illgrp_lock);
20584 	rw_exit(&ill_g_lock);
20585 
20586 	return (i == illcnt ? NULL : retill);
20587 }
20588 
20589 /*
20590  * Checks for availbility of a usable source address (if there is one) when the
20591  * destination ILL has the ill_usesrc_ifindex pointing to another ILL. Note
20592  * this selection is done regardless of the destination.
20593  */
20594 boolean_t
20595 ipif_usesrc_avail(ill_t *ill, zoneid_t zoneid)
20596 {
20597 	uint_t	ifindex;
20598 	ipif_t	*ipif = NULL;
20599 	ill_t	*uill;
20600 	boolean_t isv6;
20601 
20602 	ASSERT(ill != NULL);
20603 
20604 	isv6 = ill->ill_isv6;
20605 	ifindex = ill->ill_usesrc_ifindex;
20606 	if (ifindex != 0) {
20607 		uill = ill_lookup_on_ifindex(ifindex, isv6, NULL, NULL, NULL,
20608 		    NULL);
20609 		if (uill == NULL)
20610 			return (NULL);
20611 		mutex_enter(&uill->ill_lock);
20612 		for (ipif = uill->ill_ipif; ipif != NULL;
20613 		    ipif = ipif->ipif_next) {
20614 			if (!IPIF_CAN_LOOKUP(ipif))
20615 				continue;
20616 			if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
20617 				continue;
20618 			if (!(ipif->ipif_flags & IPIF_UP))
20619 				continue;
20620 			if (ipif->ipif_zoneid != zoneid)
20621 				continue;
20622 			if ((isv6 &&
20623 			    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) ||
20624 			    (ipif->ipif_lcl_addr == INADDR_ANY))
20625 				continue;
20626 			mutex_exit(&uill->ill_lock);
20627 			ill_refrele(uill);
20628 			return (B_TRUE);
20629 		}
20630 		mutex_exit(&uill->ill_lock);
20631 		ill_refrele(uill);
20632 	}
20633 	return (B_FALSE);
20634 }
20635 
20636 /*
20637  * Determine the best source address given a destination address and an ill.
20638  * Prefers non-deprecated over deprecated but will return a deprecated
20639  * address if there is no other choice. If there is a usable source address
20640  * on the interface pointed to by ill_usesrc_ifindex then that is given
20641  * first preference.
20642  *
20643  * Returns NULL if there is no suitable source address for the ill.
20644  * This only occurs when there is no valid source address for the ill.
20645  */
20646 ipif_t *
20647 ipif_select_source(ill_t *ill, ipaddr_t dst, zoneid_t zoneid)
20648 {
20649 	ipif_t *ipif;
20650 	ipif_t *ipif_dep = NULL;	/* Fallback to deprecated */
20651 	ipif_t *ipif_arr[MAX_IPIF_SELECT_SOURCE];
20652 	int index = 0;
20653 	boolean_t wrapped = B_FALSE;
20654 	boolean_t same_subnet_only = B_FALSE;
20655 	boolean_t ipif_same_found, ipif_other_found;
20656 	boolean_t specific_found;
20657 	ill_t	*till, *usill = NULL;
20658 	tsol_tpc_t *src_rhtp, *dst_rhtp;
20659 
20660 	if (ill->ill_usesrc_ifindex != 0) {
20661 		usill = ill_lookup_on_ifindex(ill->ill_usesrc_ifindex, B_FALSE,
20662 		    NULL, NULL, NULL, NULL);
20663 		if (usill != NULL)
20664 			ill = usill;	/* Select source from usesrc ILL */
20665 		else
20666 			return (NULL);
20667 	}
20668 
20669 	/*
20670 	 * If we're dealing with an unlabeled destination on a labeled system,
20671 	 * make sure that we ignore source addresses that are incompatible with
20672 	 * the destination's default label.  That destination's default label
20673 	 * must dominate the minimum label on the source address.
20674 	 */
20675 	dst_rhtp = NULL;
20676 	if (is_system_labeled()) {
20677 		dst_rhtp = find_tpc(&dst, IPV4_VERSION, B_FALSE);
20678 		if (dst_rhtp == NULL)
20679 			return (NULL);
20680 		if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
20681 			TPC_RELE(dst_rhtp);
20682 			dst_rhtp = NULL;
20683 		}
20684 	}
20685 
20686 	/*
20687 	 * Holds the ill_g_lock as reader. This makes sure that no ipif/ill
20688 	 * can be deleted. But an ipif/ill can get CONDEMNED any time.
20689 	 * After selecting the right ipif, under ill_lock make sure ipif is
20690 	 * not condemned, and increment refcnt. If ipif is CONDEMNED,
20691 	 * we retry. Inside the loop we still need to check for CONDEMNED,
20692 	 * but not under a lock.
20693 	 */
20694 	rw_enter(&ill_g_lock, RW_READER);
20695 
20696 retry:
20697 	till = ill;
20698 	ipif_arr[0] = NULL;
20699 
20700 	if (till->ill_group != NULL)
20701 		till = till->ill_group->illgrp_ill;
20702 
20703 	/*
20704 	 * Choose one good source address from each ill across the group.
20705 	 * If possible choose a source address in the same subnet as
20706 	 * the destination address.
20707 	 *
20708 	 * We don't check for PHYI_FAILED or PHYI_INACTIVE or PHYI_OFFLINE
20709 	 * This is okay because of the following.
20710 	 *
20711 	 *    If PHYI_FAILED is set and we still have non-deprecated
20712 	 *    addresses, it means the addresses have not yet been
20713 	 *    failed over to a different interface. We potentially
20714 	 *    select them to create IRE_CACHES, which will be later
20715 	 *    flushed when the addresses move over.
20716 	 *
20717 	 *    If PHYI_INACTIVE is set and we still have non-deprecated
20718 	 *    addresses, it means either the user has configured them
20719 	 *    or PHYI_INACTIVE has not been cleared after the addresses
20720 	 *    been moved over. For the former, in.mpathd does a failover
20721 	 *    when the interface becomes INACTIVE and hence we should
20722 	 *    not find them. Once INACTIVE is set, we don't allow them
20723 	 *    to create logical interfaces anymore. For the latter, a
20724 	 *    flush will happen when INACTIVE is cleared which will
20725 	 *    flush the IRE_CACHES.
20726 	 *
20727 	 *    If PHYI_OFFLINE is set, all the addresses will be failed
20728 	 *    over soon. We potentially select them to create IRE_CACHEs,
20729 	 *    which will be later flushed when the addresses move over.
20730 	 *
20731 	 * NOTE : As ipif_select_source is called to borrow source address
20732 	 * for an ipif that is part of a group, source address selection
20733 	 * will be re-done whenever the group changes i.e either an
20734 	 * insertion/deletion in the group.
20735 	 *
20736 	 * Fill ipif_arr[] with source addresses, using these rules:
20737 	 *
20738 	 *	1. At most one source address from a given ill ends up
20739 	 *	   in ipif_arr[] -- that is, at most one of the ipif's
20740 	 *	   associated with a given ill ends up in ipif_arr[].
20741 	 *
20742 	 *	2. If there is at least one non-deprecated ipif in the
20743 	 *	   IPMP group with a source address on the same subnet as
20744 	 *	   our destination, then fill ipif_arr[] only with
20745 	 *	   source addresses on the same subnet as our destination.
20746 	 *	   Note that because of (1), only the first
20747 	 *	   non-deprecated ipif found with a source address
20748 	 *	   matching the destination ends up in ipif_arr[].
20749 	 *
20750 	 *	3. Otherwise, fill ipif_arr[] with non-deprecated source
20751 	 *	   addresses not in the same subnet as our destination.
20752 	 *	   Again, because of (1), only the first off-subnet source
20753 	 *	   address will be chosen.
20754 	 *
20755 	 *	4. If there are no non-deprecated ipifs, then just use
20756 	 *	   the source address associated with the last deprecated
20757 	 *	   one we find that happens to be on the same subnet,
20758 	 *	   otherwise the first one not in the same subnet.
20759 	 */
20760 	specific_found = B_FALSE;
20761 	for (; till != NULL; till = till->ill_group_next) {
20762 		ipif_same_found = B_FALSE;
20763 		ipif_other_found = B_FALSE;
20764 		for (ipif = till->ill_ipif; ipif != NULL;
20765 		    ipif = ipif->ipif_next) {
20766 			if (!IPIF_CAN_LOOKUP(ipif))
20767 				continue;
20768 			/* Always skip NOLOCAL and ANYCAST interfaces */
20769 			if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
20770 				continue;
20771 			if (!(ipif->ipif_flags & IPIF_UP) ||
20772 			    !ipif->ipif_addr_ready)
20773 				continue;
20774 			if (ipif->ipif_zoneid != zoneid &&
20775 			    ipif->ipif_zoneid != ALL_ZONES)
20776 				continue;
20777 			/*
20778 			 * Interfaces with 0.0.0.0 address are allowed to be UP,
20779 			 * but are not valid as source addresses.
20780 			 */
20781 			if (ipif->ipif_lcl_addr == INADDR_ANY)
20782 				continue;
20783 
20784 			/*
20785 			 * Check compatibility of local address for
20786 			 * destination's default label if we're on a labeled
20787 			 * system.  Incompatible addresses can't be used at
20788 			 * all.
20789 			 */
20790 			if (dst_rhtp != NULL) {
20791 				boolean_t incompat;
20792 
20793 				src_rhtp = find_tpc(&ipif->ipif_lcl_addr,
20794 				    IPV4_VERSION, B_FALSE);
20795 				if (src_rhtp == NULL)
20796 					continue;
20797 				incompat =
20798 				    src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
20799 				    src_rhtp->tpc_tp.tp_doi !=
20800 				    dst_rhtp->tpc_tp.tp_doi ||
20801 				    (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
20802 				    &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
20803 				    !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
20804 				    src_rhtp->tpc_tp.tp_sl_set_cipso));
20805 				TPC_RELE(src_rhtp);
20806 				if (incompat)
20807 					continue;
20808 			}
20809 
20810 			/*
20811 			 * We prefer not to use all all-zones addresses, if we
20812 			 * can avoid it, as they pose problems with unlabeled
20813 			 * destinations.
20814 			 */
20815 			if (ipif->ipif_zoneid != ALL_ZONES) {
20816 				if (!specific_found &&
20817 				    (!same_subnet_only ||
20818 				    (ipif->ipif_net_mask & dst) ==
20819 				    ipif->ipif_subnet)) {
20820 					index = 0;
20821 					specific_found = B_TRUE;
20822 					ipif_other_found = B_FALSE;
20823 				}
20824 			} else {
20825 				if (specific_found)
20826 					continue;
20827 			}
20828 			if (ipif->ipif_flags & IPIF_DEPRECATED) {
20829 				if (ipif_dep == NULL ||
20830 				    (ipif->ipif_net_mask & dst) ==
20831 				    ipif->ipif_subnet)
20832 					ipif_dep = ipif;
20833 				continue;
20834 			}
20835 			if ((ipif->ipif_net_mask & dst) == ipif->ipif_subnet) {
20836 				/* found a source address in the same subnet */
20837 				if (!same_subnet_only) {
20838 					same_subnet_only = B_TRUE;
20839 					index = 0;
20840 				}
20841 				ipif_same_found = B_TRUE;
20842 			} else {
20843 				if (same_subnet_only || ipif_other_found)
20844 					continue;
20845 				ipif_other_found = B_TRUE;
20846 			}
20847 			ipif_arr[index++] = ipif;
20848 			if (index == MAX_IPIF_SELECT_SOURCE) {
20849 				wrapped = B_TRUE;
20850 				index = 0;
20851 			}
20852 			if (ipif_same_found)
20853 				break;
20854 		}
20855 	}
20856 
20857 	if (ipif_arr[0] == NULL) {
20858 		ipif = ipif_dep;
20859 	} else {
20860 		if (wrapped)
20861 			index = MAX_IPIF_SELECT_SOURCE;
20862 		ipif = ipif_arr[ipif_rand() % index];
20863 		ASSERT(ipif != NULL);
20864 	}
20865 
20866 	if (ipif != NULL) {
20867 		mutex_enter(&ipif->ipif_ill->ill_lock);
20868 		if (!IPIF_CAN_LOOKUP(ipif)) {
20869 			mutex_exit(&ipif->ipif_ill->ill_lock);
20870 			goto retry;
20871 		}
20872 		ipif_refhold_locked(ipif);
20873 		mutex_exit(&ipif->ipif_ill->ill_lock);
20874 	}
20875 
20876 	rw_exit(&ill_g_lock);
20877 	if (usill != NULL)
20878 		ill_refrele(usill);
20879 	if (dst_rhtp != NULL)
20880 		TPC_RELE(dst_rhtp);
20881 
20882 #ifdef DEBUG
20883 	if (ipif == NULL) {
20884 		char buf1[INET6_ADDRSTRLEN];
20885 
20886 		ip1dbg(("ipif_select_source(%s, %s) -> NULL\n",
20887 		    ill->ill_name,
20888 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1))));
20889 	} else {
20890 		char buf1[INET6_ADDRSTRLEN];
20891 		char buf2[INET6_ADDRSTRLEN];
20892 
20893 		ip1dbg(("ipif_select_source(%s, %s) -> %s\n",
20894 		    ipif->ipif_ill->ill_name,
20895 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1)),
20896 		    inet_ntop(AF_INET, &ipif->ipif_lcl_addr,
20897 		    buf2, sizeof (buf2))));
20898 	}
20899 #endif /* DEBUG */
20900 	return (ipif);
20901 }
20902 
20903 
20904 /*
20905  * If old_ipif is not NULL, see if ipif was derived from old
20906  * ipif and if so, recreate the interface route by re-doing
20907  * source address selection. This happens when ipif_down ->
20908  * ipif_update_other_ipifs calls us.
20909  *
20910  * If old_ipif is NULL, just redo the source address selection
20911  * if needed. This happens when illgrp_insert or ipif_up_done
20912  * calls us.
20913  */
20914 static void
20915 ipif_recreate_interface_routes(ipif_t *old_ipif, ipif_t *ipif)
20916 {
20917 	ire_t *ire;
20918 	ire_t *ipif_ire;
20919 	queue_t *stq;
20920 	ipif_t *nipif;
20921 	ill_t *ill;
20922 	boolean_t need_rele = B_FALSE;
20923 
20924 	ASSERT(old_ipif == NULL || IAM_WRITER_IPIF(old_ipif));
20925 	ASSERT(IAM_WRITER_IPIF(ipif));
20926 
20927 	ill = ipif->ipif_ill;
20928 	if (!(ipif->ipif_flags &
20929 	    (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) {
20930 		/*
20931 		 * Can't possibly have borrowed the source
20932 		 * from old_ipif.
20933 		 */
20934 		return;
20935 	}
20936 
20937 	/*
20938 	 * Is there any work to be done? No work if the address
20939 	 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST (
20940 	 * ipif_select_source() does not borrow addresses from
20941 	 * NOLOCAL and ANYCAST interfaces).
20942 	 */
20943 	if ((old_ipif != NULL) &&
20944 	    ((old_ipif->ipif_lcl_addr == INADDR_ANY) ||
20945 	    (old_ipif->ipif_ill->ill_wq == NULL) ||
20946 	    (old_ipif->ipif_flags &
20947 	    (IPIF_NOLOCAL|IPIF_ANYCAST)))) {
20948 		return;
20949 	}
20950 
20951 	/*
20952 	 * Perform the same checks as when creating the
20953 	 * IRE_INTERFACE in ipif_up_done.
20954 	 */
20955 	if (!(ipif->ipif_flags & IPIF_UP))
20956 		return;
20957 
20958 	if ((ipif->ipif_flags & IPIF_NOXMIT) ||
20959 	    (ipif->ipif_subnet == INADDR_ANY))
20960 		return;
20961 
20962 	ipif_ire = ipif_to_ire(ipif);
20963 	if (ipif_ire == NULL)
20964 		return;
20965 
20966 	/*
20967 	 * We know that ipif uses some other source for its
20968 	 * IRE_INTERFACE. Is it using the source of this
20969 	 * old_ipif?
20970 	 */
20971 	if (old_ipif != NULL &&
20972 	    old_ipif->ipif_lcl_addr != ipif_ire->ire_src_addr) {
20973 		ire_refrele(ipif_ire);
20974 		return;
20975 	}
20976 	if (ip_debug > 2) {
20977 		/* ip1dbg */
20978 		pr_addr_dbg("ipif_recreate_interface_routes: deleting IRE for"
20979 		    " src %s\n", AF_INET, &ipif_ire->ire_src_addr);
20980 	}
20981 
20982 	stq = ipif_ire->ire_stq;
20983 
20984 	/*
20985 	 * Can't use our source address. Select a different
20986 	 * source address for the IRE_INTERFACE.
20987 	 */
20988 	nipif = ipif_select_source(ill, ipif->ipif_subnet, ipif->ipif_zoneid);
20989 	if (nipif == NULL) {
20990 		/* Last resort - all ipif's have IPIF_NOLOCAL */
20991 		nipif = ipif;
20992 	} else {
20993 		need_rele = B_TRUE;
20994 	}
20995 
20996 	ire = ire_create(
20997 	    (uchar_t *)&ipif->ipif_subnet,	/* dest pref */
20998 	    (uchar_t *)&ipif->ipif_net_mask,	/* mask */
20999 	    (uchar_t *)&nipif->ipif_src_addr,	/* src addr */
21000 	    NULL,				/* no gateway */
21001 	    NULL,
21002 	    &ipif->ipif_mtu,			/* max frag */
21003 	    NULL,				/* fast path header */
21004 	    NULL,				/* no recv from queue */
21005 	    stq,				/* send-to queue */
21006 	    ill->ill_net_type,			/* IF_[NO]RESOLVER */
21007 	    ill->ill_resolver_mp,		/* xmit header */
21008 	    ipif,
21009 	    NULL,
21010 	    0,
21011 	    0,
21012 	    0,
21013 	    0,
21014 	    &ire_uinfo_null,
21015 	    NULL,
21016 	    NULL);
21017 
21018 	if (ire != NULL) {
21019 		ire_t *ret_ire;
21020 		int error;
21021 
21022 		/*
21023 		 * We don't need ipif_ire anymore. We need to delete
21024 		 * before we add so that ire_add does not detect
21025 		 * duplicates.
21026 		 */
21027 		ire_delete(ipif_ire);
21028 		ret_ire = ire;
21029 		error = ire_add(&ret_ire, NULL, NULL, NULL, B_FALSE);
21030 		ASSERT(error == 0);
21031 		ASSERT(ire == ret_ire);
21032 		/* Held in ire_add */
21033 		ire_refrele(ret_ire);
21034 	}
21035 	/*
21036 	 * Either we are falling through from above or could not
21037 	 * allocate a replacement.
21038 	 */
21039 	ire_refrele(ipif_ire);
21040 	if (need_rele)
21041 		ipif_refrele(nipif);
21042 }
21043 
21044 /*
21045  * This old_ipif is going away.
21046  *
21047  * Determine if any other ipif's is using our address as
21048  * ipif_lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or
21049  * IPIF_DEPRECATED).
21050  * Find the IRE_INTERFACE for such ipifs and recreate them
21051  * to use an different source address following the rules in
21052  * ipif_up_done.
21053  *
21054  * This function takes an illgrp as an argument so that illgrp_delete
21055  * can call this to update source address even after deleting the
21056  * old_ipif->ipif_ill from the ill group.
21057  */
21058 static void
21059 ipif_update_other_ipifs(ipif_t *old_ipif, ill_group_t *illgrp)
21060 {
21061 	ipif_t *ipif;
21062 	ill_t *ill;
21063 	char	buf[INET6_ADDRSTRLEN];
21064 
21065 	ASSERT(IAM_WRITER_IPIF(old_ipif));
21066 	ASSERT(illgrp == NULL || IAM_WRITER_IPIF(old_ipif));
21067 
21068 	ill = old_ipif->ipif_ill;
21069 
21070 	ip1dbg(("ipif_update_other_ipifs(%s, %s)\n",
21071 	    ill->ill_name,
21072 	    inet_ntop(AF_INET, &old_ipif->ipif_lcl_addr,
21073 	    buf, sizeof (buf))));
21074 	/*
21075 	 * If this part of a group, look at all ills as ipif_select_source
21076 	 * borrows source address across all the ills in the group.
21077 	 */
21078 	if (illgrp != NULL)
21079 		ill = illgrp->illgrp_ill;
21080 
21081 	for (; ill != NULL; ill = ill->ill_group_next) {
21082 		for (ipif = ill->ill_ipif; ipif != NULL;
21083 		    ipif = ipif->ipif_next) {
21084 
21085 			if (ipif == old_ipif)
21086 				continue;
21087 
21088 			ipif_recreate_interface_routes(old_ipif, ipif);
21089 		}
21090 	}
21091 }
21092 
21093 /* ARGSUSED */
21094 int
21095 if_unitsel_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
21096 	ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
21097 {
21098 	/*
21099 	 * ill_phyint_reinit merged the v4 and v6 into a single
21100 	 * ipsq. Could also have become part of a ipmp group in the
21101 	 * process, and we might not have been able to complete the
21102 	 * operation in ipif_set_values, if we could not become
21103 	 * exclusive.  If so restart it here.
21104 	 */
21105 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
21106 }
21107 
21108 
21109 /* ARGSUSED */
21110 int
21111 if_unitsel(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
21112     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
21113 {
21114 	queue_t		*q1 = q;
21115 	char 		*cp;
21116 	char		interf_name[LIFNAMSIZ];
21117 	uint_t		ppa = *(uint_t *)mp->b_cont->b_cont->b_rptr;
21118 
21119 	if (!q->q_next) {
21120 		ip1dbg((
21121 		    "if_unitsel: IF_UNITSEL: no q_next\n"));
21122 		return (EINVAL);
21123 	}
21124 
21125 	if (((ill_t *)(q->q_ptr))->ill_name[0] != '\0')
21126 		return (EALREADY);
21127 
21128 	do {
21129 		q1 = q1->q_next;
21130 	} while (q1->q_next);
21131 	cp = q1->q_qinfo->qi_minfo->mi_idname;
21132 	(void) sprintf(interf_name, "%s%d", cp, ppa);
21133 
21134 	/*
21135 	 * Here we are not going to delay the ioack until after
21136 	 * ACKs from DL_ATTACH_REQ/DL_BIND_REQ. So no need to save the
21137 	 * original ioctl message before sending the requests.
21138 	 */
21139 	return (ipif_set_values(q, mp, interf_name, &ppa));
21140 }
21141 
21142 /* ARGSUSED */
21143 int
21144 ip_sioctl_sifname(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
21145     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
21146 {
21147 	return (ENXIO);
21148 }
21149 
21150 /*
21151  * Net and subnet broadcast ire's are now specific to the particular
21152  * physical interface (ill) and not to any one locigal interface (ipif).
21153  * However, if a particular logical interface is being taken down, it's
21154  * associated ire's will be taken down as well.  Hence, when we go to
21155  * take down or change the local address, broadcast address or netmask
21156  * of a specific logical interface, we must check to make sure that we
21157  * have valid net and subnet broadcast ire's for the other logical
21158  * interfaces which may have been shared with the logical interface
21159  * being brought down or changed.
21160  *
21161  * There is one set of 0.0.0.0 and 255.255.255.255 per ill. Usually it
21162  * is tied to the first interface coming UP. If that ipif is going down,
21163  * we need to recreate them on the next valid ipif.
21164  *
21165  * Note: assume that the ipif passed in is still up so that it's IRE
21166  * entries are still valid.
21167  */
21168 static void
21169 ipif_check_bcast_ires(ipif_t *test_ipif)
21170 {
21171 	ipif_t	*ipif;
21172 	ire_t	*test_subnet_ire, *test_net_ire;
21173 	ire_t	*test_allzero_ire, *test_allone_ire;
21174 	ire_t	*ire_array[12];
21175 	ire_t	**irep = &ire_array[0];
21176 	ire_t	**irep1;
21177 
21178 	ipaddr_t net_addr, subnet_addr, net_mask, subnet_mask;
21179 	ipaddr_t test_net_addr, test_subnet_addr;
21180 	ipaddr_t test_net_mask, test_subnet_mask;
21181 	boolean_t need_net_bcast_ire = B_FALSE;
21182 	boolean_t need_subnet_bcast_ire = B_FALSE;
21183 	boolean_t allzero_bcast_ire_created = B_FALSE;
21184 	boolean_t allone_bcast_ire_created = B_FALSE;
21185 	boolean_t net_bcast_ire_created = B_FALSE;
21186 	boolean_t subnet_bcast_ire_created = B_FALSE;
21187 
21188 	ipif_t  *backup_ipif_net = (ipif_t *)NULL;
21189 	ipif_t  *backup_ipif_subnet = (ipif_t *)NULL;
21190 	ipif_t  *backup_ipif_allzeros = (ipif_t *)NULL;
21191 	ipif_t  *backup_ipif_allones = (ipif_t *)NULL;
21192 	uint64_t check_flags = IPIF_DEPRECATED | IPIF_NOLOCAL | IPIF_ANYCAST;
21193 
21194 	ASSERT(!test_ipif->ipif_isv6);
21195 	ASSERT(IAM_WRITER_IPIF(test_ipif));
21196 
21197 	/*
21198 	 * No broadcast IREs for the LOOPBACK interface
21199 	 * or others such as point to point and IPIF_NOXMIT.
21200 	 */
21201 	if (!(test_ipif->ipif_flags & IPIF_BROADCAST) ||
21202 	    (test_ipif->ipif_flags & IPIF_NOXMIT))
21203 		return;
21204 
21205 	test_allzero_ire = ire_ctable_lookup(0, 0, IRE_BROADCAST,
21206 	    test_ipif, ALL_ZONES, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
21207 
21208 	test_allone_ire = ire_ctable_lookup(INADDR_BROADCAST, 0, IRE_BROADCAST,
21209 	    test_ipif, ALL_ZONES, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
21210 
21211 	test_net_mask = ip_net_mask(test_ipif->ipif_subnet);
21212 	test_subnet_mask = test_ipif->ipif_net_mask;
21213 
21214 	/*
21215 	 * If no net mask set, assume the default based on net class.
21216 	 */
21217 	if (test_subnet_mask == 0)
21218 		test_subnet_mask = test_net_mask;
21219 
21220 	/*
21221 	 * Check if there is a network broadcast ire associated with this ipif
21222 	 */
21223 	test_net_addr = test_net_mask  & test_ipif->ipif_subnet;
21224 	test_net_ire = ire_ctable_lookup(test_net_addr, 0, IRE_BROADCAST,
21225 	    test_ipif, ALL_ZONES, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
21226 
21227 	/*
21228 	 * Check if there is a subnet broadcast IRE associated with this ipif
21229 	 */
21230 	test_subnet_addr = test_subnet_mask  & test_ipif->ipif_subnet;
21231 	test_subnet_ire = ire_ctable_lookup(test_subnet_addr, 0, IRE_BROADCAST,
21232 	    test_ipif, ALL_ZONES, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
21233 
21234 	/*
21235 	 * No broadcast ire's associated with this ipif.
21236 	 */
21237 	if ((test_subnet_ire == NULL) && (test_net_ire == NULL) &&
21238 	    (test_allzero_ire == NULL) && (test_allone_ire == NULL)) {
21239 		return;
21240 	}
21241 
21242 	/*
21243 	 * We have established which bcast ires have to be replaced.
21244 	 * Next we try to locate ipifs that match there ires.
21245 	 * The rules are simple: If we find an ipif that matches on the subnet
21246 	 * address it will also match on the net address, the allzeros and
21247 	 * allones address. Any ipif that matches only on the net address will
21248 	 * also match the allzeros and allones addresses.
21249 	 * The other criterion is the ipif_flags. We look for non-deprecated
21250 	 * (and non-anycast and non-nolocal) ipifs as the best choice.
21251 	 * ipifs with check_flags matching (deprecated, etc) are used only
21252 	 * if good ipifs are not available. While looping, we save existing
21253 	 * deprecated ipifs as backup_ipif.
21254 	 * We loop through all the ipifs for this ill looking for ipifs
21255 	 * whose broadcast addr match the ipif passed in, but do not have
21256 	 * their own broadcast ires. For creating 0.0.0.0 and
21257 	 * 255.255.255.255 we just need an ipif on this ill to create.
21258 	 */
21259 	for (ipif = test_ipif->ipif_ill->ill_ipif; ipif != NULL;
21260 	    ipif = ipif->ipif_next) {
21261 
21262 		ASSERT(!ipif->ipif_isv6);
21263 		/*
21264 		 * Already checked the ipif passed in.
21265 		 */
21266 		if (ipif == test_ipif) {
21267 			continue;
21268 		}
21269 
21270 		/*
21271 		 * We only need to recreate broadcast ires if another ipif in
21272 		 * the same zone uses them. The new ires must be created in the
21273 		 * same zone.
21274 		 */
21275 		if (ipif->ipif_zoneid != test_ipif->ipif_zoneid) {
21276 			continue;
21277 		}
21278 
21279 		/*
21280 		 * Only interested in logical interfaces with valid local
21281 		 * addresses or with the ability to broadcast.
21282 		 */
21283 		if ((ipif->ipif_subnet == 0) ||
21284 		    !(ipif->ipif_flags & IPIF_BROADCAST) ||
21285 		    (ipif->ipif_flags & IPIF_NOXMIT) ||
21286 		    !(ipif->ipif_flags & IPIF_UP)) {
21287 			continue;
21288 		}
21289 		/*
21290 		 * Check if there is a net broadcast ire for this
21291 		 * net address.  If it turns out that the ipif we are
21292 		 * about to take down owns this ire, we must make a
21293 		 * new one because it is potentially going away.
21294 		 */
21295 		if (test_net_ire && (!net_bcast_ire_created)) {
21296 			net_mask = ip_net_mask(ipif->ipif_subnet);
21297 			net_addr = net_mask & ipif->ipif_subnet;
21298 			if (net_addr == test_net_addr) {
21299 				need_net_bcast_ire = B_TRUE;
21300 				/*
21301 				 * Use DEPRECATED ipif only if no good
21302 				 * ires are available. subnet_addr is
21303 				 * a better match than net_addr.
21304 				 */
21305 				if ((ipif->ipif_flags & check_flags) &&
21306 				    (backup_ipif_net == NULL)) {
21307 					backup_ipif_net = ipif;
21308 				}
21309 			}
21310 		}
21311 		/*
21312 		 * Check if there is a subnet broadcast ire for this
21313 		 * net address.  If it turns out that the ipif we are
21314 		 * about to take down owns this ire, we must make a
21315 		 * new one because it is potentially going away.
21316 		 */
21317 		if (test_subnet_ire && (!subnet_bcast_ire_created)) {
21318 			subnet_mask = ipif->ipif_net_mask;
21319 			subnet_addr = ipif->ipif_subnet;
21320 			if (subnet_addr == test_subnet_addr) {
21321 				need_subnet_bcast_ire = B_TRUE;
21322 				if ((ipif->ipif_flags & check_flags) &&
21323 				    (backup_ipif_subnet == NULL)) {
21324 					backup_ipif_subnet = ipif;
21325 				}
21326 			}
21327 		}
21328 
21329 
21330 		/* Short circuit here if this ipif is deprecated */
21331 		if (ipif->ipif_flags & check_flags) {
21332 			if ((test_allzero_ire != NULL) &&
21333 			    (!allzero_bcast_ire_created) &&
21334 			    (backup_ipif_allzeros == NULL)) {
21335 				backup_ipif_allzeros = ipif;
21336 			}
21337 			if ((test_allone_ire != NULL) &&
21338 			    (!allone_bcast_ire_created) &&
21339 			    (backup_ipif_allones == NULL)) {
21340 				backup_ipif_allones = ipif;
21341 			}
21342 			continue;
21343 		}
21344 
21345 		/*
21346 		 * Found an ipif which has the same broadcast ire as the
21347 		 * ipif passed in and the ipif passed in "owns" the ire.
21348 		 * Create new broadcast ire's for this broadcast addr.
21349 		 */
21350 		if (need_net_bcast_ire && !net_bcast_ire_created) {
21351 			irep = ire_create_bcast(ipif, net_addr, irep);
21352 			irep = ire_create_bcast(ipif,
21353 			    ~net_mask | net_addr, irep);
21354 			net_bcast_ire_created = B_TRUE;
21355 		}
21356 		if (need_subnet_bcast_ire && !subnet_bcast_ire_created) {
21357 			irep = ire_create_bcast(ipif, subnet_addr, irep);
21358 			irep = ire_create_bcast(ipif,
21359 			    ~subnet_mask | subnet_addr, irep);
21360 			subnet_bcast_ire_created = B_TRUE;
21361 		}
21362 		if (test_allzero_ire != NULL && !allzero_bcast_ire_created) {
21363 			irep = ire_create_bcast(ipif, 0, irep);
21364 			allzero_bcast_ire_created = B_TRUE;
21365 		}
21366 		if (test_allone_ire != NULL && !allone_bcast_ire_created) {
21367 			irep = ire_create_bcast(ipif, INADDR_BROADCAST, irep);
21368 			allone_bcast_ire_created = B_TRUE;
21369 		}
21370 		/*
21371 		 * Once we have created all the appropriate ires, we
21372 		 * just break out of this loop to add what we have created.
21373 		 * This has been indented similar to ire_match_args for
21374 		 * readability.
21375 		 */
21376 		if (((test_net_ire == NULL) ||
21377 			(net_bcast_ire_created)) &&
21378 		    ((test_subnet_ire == NULL) ||
21379 			(subnet_bcast_ire_created)) &&
21380 		    ((test_allzero_ire == NULL) ||
21381 			(allzero_bcast_ire_created)) &&
21382 		    ((test_allone_ire == NULL) ||
21383 			(allone_bcast_ire_created))) {
21384 			break;
21385 		}
21386 	}
21387 
21388 	/*
21389 	 * Create bcast ires on deprecated ipifs if no non-deprecated ipifs
21390 	 * exist. 6 pairs of bcast ires are needed.
21391 	 * Note - the old ires are deleted in ipif_down.
21392 	 */
21393 	if (need_net_bcast_ire && !net_bcast_ire_created && backup_ipif_net) {
21394 		ipif = backup_ipif_net;
21395 		irep = ire_create_bcast(ipif, net_addr, irep);
21396 		irep = ire_create_bcast(ipif, ~net_mask | net_addr, irep);
21397 		net_bcast_ire_created = B_TRUE;
21398 	}
21399 	if (need_subnet_bcast_ire && !subnet_bcast_ire_created &&
21400 	    backup_ipif_subnet) {
21401 		ipif = backup_ipif_subnet;
21402 		irep = ire_create_bcast(ipif, subnet_addr, irep);
21403 		irep = ire_create_bcast(ipif,
21404 		    ~subnet_mask | subnet_addr, irep);
21405 		subnet_bcast_ire_created = B_TRUE;
21406 	}
21407 	if (test_allzero_ire != NULL && !allzero_bcast_ire_created &&
21408 	    backup_ipif_allzeros) {
21409 		irep = ire_create_bcast(backup_ipif_allzeros, 0, irep);
21410 		allzero_bcast_ire_created = B_TRUE;
21411 	}
21412 	if (test_allone_ire != NULL && !allone_bcast_ire_created &&
21413 	    backup_ipif_allones) {
21414 		irep = ire_create_bcast(backup_ipif_allones,
21415 		    INADDR_BROADCAST, irep);
21416 		allone_bcast_ire_created = B_TRUE;
21417 	}
21418 
21419 	/*
21420 	 * If we can't create all of them, don't add any of them.
21421 	 * Code in ip_wput_ire and ire_to_ill assumes that we
21422 	 * always have a non-loopback copy and loopback copy
21423 	 * for a given address.
21424 	 */
21425 	for (irep1 = irep; irep1 > ire_array; ) {
21426 		irep1--;
21427 		if (*irep1 == NULL) {
21428 			ip0dbg(("ipif_check_bcast_ires: can't create "
21429 			    "IRE_BROADCAST, memory allocation failure\n"));
21430 			while (irep > ire_array) {
21431 				irep--;
21432 				if (*irep != NULL)
21433 					ire_delete(*irep);
21434 			}
21435 			goto bad;
21436 		}
21437 	}
21438 	for (irep1 = irep; irep1 > ire_array; ) {
21439 		int error;
21440 
21441 		irep1--;
21442 		error = ire_add(irep1, NULL, NULL, NULL, B_FALSE);
21443 		if (error == 0) {
21444 			ire_refrele(*irep1);		/* Held in ire_add */
21445 		}
21446 	}
21447 bad:
21448 	if (test_allzero_ire != NULL)
21449 		ire_refrele(test_allzero_ire);
21450 	if (test_allone_ire != NULL)
21451 		ire_refrele(test_allone_ire);
21452 	if (test_net_ire != NULL)
21453 		ire_refrele(test_net_ire);
21454 	if (test_subnet_ire != NULL)
21455 		ire_refrele(test_subnet_ire);
21456 }
21457 
21458 /*
21459  * Extract both the flags (including IFF_CANTCHANGE) such as IFF_IPV*
21460  * from lifr_flags and the name from lifr_name.
21461  * Set IFF_IPV* and ill_isv6 prior to doing the lookup
21462  * since ipif_lookup_on_name uses the _isv6 flags when matching.
21463  * Returns EINPROGRESS when mp has been consumed by queueing it on
21464  * ill_pending_mp and the ioctl will complete in ip_rput.
21465  */
21466 /* ARGSUSED */
21467 int
21468 ip_sioctl_slifname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21469     ip_ioctl_cmd_t *ipip, void *if_req)
21470 {
21471 	int	err;
21472 	ill_t	*ill;
21473 	struct lifreq *lifr = (struct lifreq *)if_req;
21474 
21475 	ASSERT(ipif != NULL);
21476 	ip1dbg(("ip_sioctl_slifname %s\n", lifr->lifr_name));
21477 	ASSERT(q->q_next != NULL);
21478 
21479 	ill = (ill_t *)q->q_ptr;
21480 	/*
21481 	 * If we are not writer on 'q' then this interface exists already
21482 	 * and previous lookups (ipif_extract_lifreq_cmn) found this ipif.
21483 	 * So return EALREADY
21484 	 */
21485 	if (ill != ipif->ipif_ill)
21486 		return (EALREADY);
21487 
21488 	if (ill->ill_name[0] != '\0')
21489 		return (EALREADY);
21490 
21491 	/*
21492 	 * Set all the flags. Allows all kinds of override. Provide some
21493 	 * sanity checking by not allowing IFF_BROADCAST and IFF_MULTICAST
21494 	 * unless there is either multicast/broadcast support in the driver
21495 	 * or it is a pt-pt link.
21496 	 */
21497 	if (lifr->lifr_flags & (IFF_PROMISC|IFF_ALLMULTI)) {
21498 		/* Meaningless to IP thus don't allow them to be set. */
21499 		ip1dbg(("ip_setname: EINVAL 1\n"));
21500 		return (EINVAL);
21501 	}
21502 	/*
21503 	 * For a DL_STYLE2 driver (ill_needs_attach), we would not have the
21504 	 * ill_bcast_addr_length info.
21505 	 */
21506 	if (!ill->ill_needs_attach &&
21507 	    ((lifr->lifr_flags & IFF_MULTICAST) &&
21508 	    !(lifr->lifr_flags & IFF_POINTOPOINT) &&
21509 	    ill->ill_bcast_addr_length == 0)) {
21510 		/* Link not broadcast/pt-pt capable i.e. no multicast */
21511 		ip1dbg(("ip_setname: EINVAL 2\n"));
21512 		return (EINVAL);
21513 	}
21514 	if ((lifr->lifr_flags & IFF_BROADCAST) &&
21515 	    ((lifr->lifr_flags & IFF_IPV6) ||
21516 	    (!ill->ill_needs_attach && ill->ill_bcast_addr_length == 0))) {
21517 		/* Link not broadcast capable or IPv6 i.e. no broadcast */
21518 		ip1dbg(("ip_setname: EINVAL 3\n"));
21519 		return (EINVAL);
21520 	}
21521 	if (lifr->lifr_flags & IFF_UP) {
21522 		/* Can only be set with SIOCSLIFFLAGS */
21523 		ip1dbg(("ip_setname: EINVAL 4\n"));
21524 		return (EINVAL);
21525 	}
21526 	if ((lifr->lifr_flags & (IFF_IPV6|IFF_IPV4)) != IFF_IPV6 &&
21527 	    (lifr->lifr_flags & (IFF_IPV6|IFF_IPV4)) != IFF_IPV4) {
21528 		ip1dbg(("ip_setname: EINVAL 5\n"));
21529 		return (EINVAL);
21530 	}
21531 	/*
21532 	 * Only allow the IFF_XRESOLV flag to be set on IPv6 interfaces.
21533 	 */
21534 	if ((lifr->lifr_flags & IFF_XRESOLV) &&
21535 	    !(lifr->lifr_flags & IFF_IPV6) &&
21536 	    !(ipif->ipif_isv6)) {
21537 		ip1dbg(("ip_setname: EINVAL 6\n"));
21538 		return (EINVAL);
21539 	}
21540 
21541 	/*
21542 	 * The user has done SIOCGLIFFLAGS prior to this ioctl and hence
21543 	 * we have all the flags here. So, we assign rather than we OR.
21544 	 * We can't OR the flags here because we don't want to set
21545 	 * both IFF_IPV4 and IFF_IPV6. We start off as IFF_IPV4 in
21546 	 * ipif_allocate and become IFF_IPV4 or IFF_IPV6 here depending
21547 	 * on lifr_flags value here.
21548 	 */
21549 	/*
21550 	 * This ill has not been inserted into the global list.
21551 	 * So we are still single threaded and don't need any lock
21552 	 */
21553 	ipif->ipif_flags = lifr->lifr_flags & IFF_LOGINT_FLAGS &
21554 	    ~IFF_DUPLICATE;
21555 	ill->ill_flags = lifr->lifr_flags & IFF_PHYINTINST_FLAGS;
21556 	ill->ill_phyint->phyint_flags = lifr->lifr_flags & IFF_PHYINT_FLAGS;
21557 
21558 	/* We started off as V4. */
21559 	if (ill->ill_flags & ILLF_IPV6) {
21560 		ill->ill_phyint->phyint_illv6 = ill;
21561 		ill->ill_phyint->phyint_illv4 = NULL;
21562 	}
21563 	err = ipif_set_values(q, mp, lifr->lifr_name, &lifr->lifr_ppa);
21564 	return (err);
21565 }
21566 
21567 /* ARGSUSED */
21568 int
21569 ip_sioctl_slifname_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21570     ip_ioctl_cmd_t *ipip, void *if_req)
21571 {
21572 	/*
21573 	 * ill_phyint_reinit merged the v4 and v6 into a single
21574 	 * ipsq. Could also have become part of a ipmp group in the
21575 	 * process, and we might not have been able to complete the
21576 	 * slifname in ipif_set_values, if we could not become
21577 	 * exclusive.  If so restart it here
21578 	 */
21579 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
21580 }
21581 
21582 /*
21583  * Return a pointer to the ipif which matches the index, IP version type and
21584  * zoneid.
21585  */
21586 ipif_t *
21587 ipif_lookup_on_ifindex(uint_t index, boolean_t isv6, zoneid_t zoneid,
21588     queue_t *q, mblk_t *mp, ipsq_func_t func, int *err)
21589 {
21590 	ill_t	*ill;
21591 	ipsq_t  *ipsq;
21592 	phyint_t *phyi;
21593 	ipif_t	*ipif;
21594 
21595 	ASSERT((q == NULL && mp == NULL && func == NULL && err == NULL) ||
21596 	    (q != NULL && mp != NULL && func != NULL && err != NULL));
21597 
21598 	if (err != NULL)
21599 		*err = 0;
21600 
21601 	/*
21602 	 * Indexes are stored in the phyint - a common structure
21603 	 * to both IPv4 and IPv6.
21604 	 */
21605 
21606 	rw_enter(&ill_g_lock, RW_READER);
21607 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_index,
21608 	    (void *) &index, NULL);
21609 	if (phyi != NULL) {
21610 		ill = isv6 ? phyi->phyint_illv6 : phyi->phyint_illv4;
21611 		if (ill == NULL) {
21612 			rw_exit(&ill_g_lock);
21613 			if (err != NULL)
21614 				*err = ENXIO;
21615 			return (NULL);
21616 		}
21617 		GRAB_CONN_LOCK(q);
21618 		mutex_enter(&ill->ill_lock);
21619 		if (ILL_CAN_LOOKUP(ill)) {
21620 			for (ipif = ill->ill_ipif; ipif != NULL;
21621 			    ipif = ipif->ipif_next) {
21622 				if (IPIF_CAN_LOOKUP(ipif) &&
21623 				    (zoneid == ALL_ZONES ||
21624 				    zoneid == ipif->ipif_zoneid ||
21625 				    ipif->ipif_zoneid == ALL_ZONES)) {
21626 					ipif_refhold_locked(ipif);
21627 					mutex_exit(&ill->ill_lock);
21628 					RELEASE_CONN_LOCK(q);
21629 					rw_exit(&ill_g_lock);
21630 					return (ipif);
21631 				}
21632 			}
21633 		} else if (ILL_CAN_WAIT(ill, q)) {
21634 			ipsq = ill->ill_phyint->phyint_ipsq;
21635 			mutex_enter(&ipsq->ipsq_lock);
21636 			rw_exit(&ill_g_lock);
21637 			mutex_exit(&ill->ill_lock);
21638 			ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
21639 			mutex_exit(&ipsq->ipsq_lock);
21640 			RELEASE_CONN_LOCK(q);
21641 			*err = EINPROGRESS;
21642 			return (NULL);
21643 		}
21644 		mutex_exit(&ill->ill_lock);
21645 		RELEASE_CONN_LOCK(q);
21646 	}
21647 	rw_exit(&ill_g_lock);
21648 	if (err != NULL)
21649 		*err = ENXIO;
21650 	return (NULL);
21651 }
21652 
21653 typedef struct conn_change_s {
21654 	uint_t cc_old_ifindex;
21655 	uint_t cc_new_ifindex;
21656 } conn_change_t;
21657 
21658 /*
21659  * ipcl_walk function for changing interface index.
21660  */
21661 static void
21662 conn_change_ifindex(conn_t *connp, caddr_t arg)
21663 {
21664 	conn_change_t *connc;
21665 	uint_t old_ifindex;
21666 	uint_t new_ifindex;
21667 	int i;
21668 	ilg_t *ilg;
21669 
21670 	connc = (conn_change_t *)arg;
21671 	old_ifindex = connc->cc_old_ifindex;
21672 	new_ifindex = connc->cc_new_ifindex;
21673 
21674 	if (connp->conn_orig_bound_ifindex == old_ifindex)
21675 		connp->conn_orig_bound_ifindex = new_ifindex;
21676 
21677 	if (connp->conn_orig_multicast_ifindex == old_ifindex)
21678 		connp->conn_orig_multicast_ifindex = new_ifindex;
21679 
21680 	if (connp->conn_orig_xmit_ifindex == old_ifindex)
21681 		connp->conn_orig_xmit_ifindex = new_ifindex;
21682 
21683 	for (i = connp->conn_ilg_inuse - 1; i >= 0; i--) {
21684 		ilg = &connp->conn_ilg[i];
21685 		if (ilg->ilg_orig_ifindex == old_ifindex)
21686 			ilg->ilg_orig_ifindex = new_ifindex;
21687 	}
21688 }
21689 
21690 /*
21691  * Walk all the ipifs and ilms on this ill and change the orig_ifindex
21692  * to new_index if it matches the old_index.
21693  *
21694  * Failovers typically happen within a group of ills. But somebody
21695  * can remove an ill from the group after a failover happened. If
21696  * we are setting the ifindex after this, we potentially need to
21697  * look at all the ills rather than just the ones in the group.
21698  * We cut down the work by looking at matching ill_net_types
21699  * and ill_types as we could not possibly grouped them together.
21700  */
21701 static void
21702 ip_change_ifindex(ill_t *ill_orig, conn_change_t *connc)
21703 {
21704 	ill_t *ill;
21705 	ipif_t *ipif;
21706 	uint_t old_ifindex;
21707 	uint_t new_ifindex;
21708 	ilm_t *ilm;
21709 	ill_walk_context_t ctx;
21710 
21711 	old_ifindex = connc->cc_old_ifindex;
21712 	new_ifindex = connc->cc_new_ifindex;
21713 
21714 	rw_enter(&ill_g_lock, RW_READER);
21715 	ill = ILL_START_WALK_ALL(&ctx);
21716 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
21717 		if ((ill_orig->ill_net_type != ill->ill_net_type) ||
21718 			(ill_orig->ill_type != ill->ill_type)) {
21719 			continue;
21720 		}
21721 		for (ipif = ill->ill_ipif; ipif != NULL;
21722 				ipif = ipif->ipif_next) {
21723 			if (ipif->ipif_orig_ifindex == old_ifindex)
21724 				ipif->ipif_orig_ifindex = new_ifindex;
21725 		}
21726 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
21727 			if (ilm->ilm_orig_ifindex == old_ifindex)
21728 				ilm->ilm_orig_ifindex = new_ifindex;
21729 		}
21730 	}
21731 	rw_exit(&ill_g_lock);
21732 }
21733 
21734 /*
21735  * We first need to ensure that the new index is unique, and
21736  * then carry the change across both v4 and v6 ill representation
21737  * of the physical interface.
21738  */
21739 /* ARGSUSED */
21740 int
21741 ip_sioctl_slifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21742     ip_ioctl_cmd_t *ipip, void *ifreq)
21743 {
21744 	ill_t		*ill;
21745 	ill_t		*ill_other;
21746 	phyint_t	*phyi;
21747 	int		old_index;
21748 	conn_change_t	connc;
21749 	struct ifreq	*ifr = (struct ifreq *)ifreq;
21750 	struct lifreq	*lifr = (struct lifreq *)ifreq;
21751 	uint_t	index;
21752 	ill_t	*ill_v4;
21753 	ill_t	*ill_v6;
21754 
21755 	if (ipip->ipi_cmd_type == IF_CMD)
21756 		index = ifr->ifr_index;
21757 	else
21758 		index = lifr->lifr_index;
21759 
21760 	/*
21761 	 * Only allow on physical interface. Also, index zero is illegal.
21762 	 *
21763 	 * Need to check for PHYI_FAILED and PHYI_INACTIVE
21764 	 *
21765 	 * 1) If PHYI_FAILED is set, a failover could have happened which
21766 	 *    implies a possible failback might have to happen. As failback
21767 	 *    depends on the old index, we should fail setting the index.
21768 	 *
21769 	 * 2) If PHYI_INACTIVE is set, in.mpathd does a failover so that
21770 	 *    any addresses or multicast memberships are failed over to
21771 	 *    a non-STANDBY interface. As failback depends on the old
21772 	 *    index, we should fail setting the index for this case also.
21773 	 *
21774 	 * 3) If PHYI_OFFLINE is set, a possible failover has happened.
21775 	 *    Be consistent with PHYI_FAILED and fail the ioctl.
21776 	 */
21777 	ill = ipif->ipif_ill;
21778 	phyi = ill->ill_phyint;
21779 	if ((phyi->phyint_flags & (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) ||
21780 	    ipif->ipif_id != 0 || index == 0) {
21781 		return (EINVAL);
21782 	}
21783 	old_index = phyi->phyint_ifindex;
21784 
21785 	/* If the index is not changing, no work to do */
21786 	if (old_index == index)
21787 		return (0);
21788 
21789 	/*
21790 	 * Use ill_lookup_on_ifindex to determine if the
21791 	 * new index is unused and if so allow the change.
21792 	 */
21793 	ill_v6 = ill_lookup_on_ifindex(index, B_TRUE, NULL, NULL, NULL, NULL);
21794 	ill_v4 = ill_lookup_on_ifindex(index, B_FALSE, NULL, NULL, NULL, NULL);
21795 	if (ill_v6 != NULL || ill_v4 != NULL) {
21796 		if (ill_v4 != NULL)
21797 			ill_refrele(ill_v4);
21798 		if (ill_v6 != NULL)
21799 			ill_refrele(ill_v6);
21800 		return (EBUSY);
21801 	}
21802 
21803 	/*
21804 	 * The new index is unused. Set it in the phyint.
21805 	 * Locate the other ill so that we can send a routing
21806 	 * sockets message.
21807 	 */
21808 	if (ill->ill_isv6) {
21809 		ill_other = phyi->phyint_illv4;
21810 	} else {
21811 		ill_other = phyi->phyint_illv6;
21812 	}
21813 
21814 	phyi->phyint_ifindex = index;
21815 
21816 	connc.cc_old_ifindex = old_index;
21817 	connc.cc_new_ifindex = index;
21818 	ip_change_ifindex(ill, &connc);
21819 	ipcl_walk(conn_change_ifindex, (caddr_t)&connc);
21820 
21821 	/* Send the routing sockets message */
21822 	ip_rts_ifmsg(ipif);
21823 	if (ill_other != NULL)
21824 		ip_rts_ifmsg(ill_other->ill_ipif);
21825 
21826 	return (0);
21827 }
21828 
21829 /* ARGSUSED */
21830 int
21831 ip_sioctl_get_lifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21832     ip_ioctl_cmd_t *ipip, void *ifreq)
21833 {
21834 	struct ifreq	*ifr = (struct ifreq *)ifreq;
21835 	struct lifreq	*lifr = (struct lifreq *)ifreq;
21836 
21837 	ip1dbg(("ip_sioctl_get_lifindex(%s:%u %p)\n",
21838 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
21839 	/* Get the interface index */
21840 	if (ipip->ipi_cmd_type == IF_CMD) {
21841 		ifr->ifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
21842 	} else {
21843 		lifr->lifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
21844 	}
21845 	return (0);
21846 }
21847 
21848 /* ARGSUSED */
21849 int
21850 ip_sioctl_get_lifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21851     ip_ioctl_cmd_t *ipip, void *ifreq)
21852 {
21853 	struct lifreq	*lifr = (struct lifreq *)ifreq;
21854 
21855 	ip1dbg(("ip_sioctl_get_lifzone(%s:%u %p)\n",
21856 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
21857 	/* Get the interface zone */
21858 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
21859 	lifr->lifr_zoneid = ipif->ipif_zoneid;
21860 	return (0);
21861 }
21862 
21863 /*
21864  * Set the zoneid of an interface.
21865  */
21866 /* ARGSUSED */
21867 int
21868 ip_sioctl_slifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21869     ip_ioctl_cmd_t *ipip, void *ifreq)
21870 {
21871 	struct lifreq	*lifr = (struct lifreq *)ifreq;
21872 	int err = 0;
21873 	boolean_t need_up = B_FALSE;
21874 	zone_t *zptr;
21875 	zone_status_t status;
21876 	zoneid_t zoneid;
21877 
21878 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
21879 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES) {
21880 		if (!is_system_labeled())
21881 			return (ENOTSUP);
21882 		zoneid = GLOBAL_ZONEID;
21883 	}
21884 
21885 	/* cannot assign instance zero to a non-global zone */
21886 	if (ipif->ipif_id == 0 && zoneid != GLOBAL_ZONEID)
21887 		return (ENOTSUP);
21888 
21889 	/*
21890 	 * Cannot assign to a zone that doesn't exist or is shutting down.  In
21891 	 * the event of a race with the zone shutdown processing, since IP
21892 	 * serializes this ioctl and SIOCGLIFCONF/SIOCLIFREMOVEIF, we know the
21893 	 * interface will be cleaned up even if the zone is shut down
21894 	 * immediately after the status check. If the interface can't be brought
21895 	 * down right away, and the zone is shut down before the restart
21896 	 * function is called, we resolve the possible races by rechecking the
21897 	 * zone status in the restart function.
21898 	 */
21899 	if ((zptr = zone_find_by_id(zoneid)) == NULL)
21900 		return (EINVAL);
21901 	status = zone_status_get(zptr);
21902 	zone_rele(zptr);
21903 
21904 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING)
21905 		return (EINVAL);
21906 
21907 	if (ipif->ipif_flags & IPIF_UP) {
21908 		/*
21909 		 * If the interface is already marked up,
21910 		 * we call ipif_down which will take care
21911 		 * of ditching any IREs that have been set
21912 		 * up based on the old interface address.
21913 		 */
21914 		err = ipif_logical_down(ipif, q, mp);
21915 		if (err == EINPROGRESS)
21916 			return (err);
21917 		ipif_down_tail(ipif);
21918 		need_up = B_TRUE;
21919 	}
21920 
21921 	err = ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp, need_up);
21922 	return (err);
21923 }
21924 
21925 static int
21926 ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
21927     queue_t *q, mblk_t *mp, boolean_t need_up)
21928 {
21929 	int	err = 0;
21930 
21931 	ip1dbg(("ip_sioctl_zoneid_tail(%s:%u %p)\n",
21932 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
21933 
21934 	/* Set the new zone id. */
21935 	ipif->ipif_zoneid = zoneid;
21936 
21937 	/* Update sctp list */
21938 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
21939 
21940 	if (need_up) {
21941 		/*
21942 		 * Now bring the interface back up.  If this
21943 		 * is the only IPIF for the ILL, ipif_up
21944 		 * will have to re-bind to the device, so
21945 		 * we may get back EINPROGRESS, in which
21946 		 * case, this IOCTL will get completed in
21947 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
21948 		 */
21949 		err = ipif_up(ipif, q, mp);
21950 	}
21951 	return (err);
21952 }
21953 
21954 /* ARGSUSED */
21955 int
21956 ip_sioctl_slifzone_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21957     ip_ioctl_cmd_t *ipip, void *if_req)
21958 {
21959 	struct lifreq *lifr = (struct lifreq *)if_req;
21960 	zoneid_t zoneid;
21961 	zone_t *zptr;
21962 	zone_status_t status;
21963 
21964 	ASSERT(ipif->ipif_id != 0);
21965 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
21966 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES)
21967 		zoneid = GLOBAL_ZONEID;
21968 
21969 	ip1dbg(("ip_sioctl_slifzone_restart(%s:%u %p)\n",
21970 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
21971 
21972 	/*
21973 	 * We recheck the zone status to resolve the following race condition:
21974 	 * 1) process sends SIOCSLIFZONE to put hme0:1 in zone "myzone";
21975 	 * 2) hme0:1 is up and can't be brought down right away;
21976 	 * ip_sioctl_slifzone() returns EINPROGRESS and the request is queued;
21977 	 * 3) zone "myzone" is halted; the zone status switches to
21978 	 * 'shutting_down' and the zones framework sends SIOCGLIFCONF to list
21979 	 * the interfaces to remove - hme0:1 is not returned because it's not
21980 	 * yet in "myzone", so it won't be removed;
21981 	 * 4) the restart function for SIOCSLIFZONE is called; without the
21982 	 * status check here, we would have hme0:1 in "myzone" after it's been
21983 	 * destroyed.
21984 	 * Note that if the status check fails, we need to bring the interface
21985 	 * back to its state prior to ip_sioctl_slifzone(), hence the call to
21986 	 * ipif_up_done[_v6]().
21987 	 */
21988 	status = ZONE_IS_UNINITIALIZED;
21989 	if ((zptr = zone_find_by_id(zoneid)) != NULL) {
21990 		status = zone_status_get(zptr);
21991 		zone_rele(zptr);
21992 	}
21993 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING) {
21994 		if (ipif->ipif_isv6) {
21995 			(void) ipif_up_done_v6(ipif);
21996 		} else {
21997 			(void) ipif_up_done(ipif);
21998 		}
21999 		return (EINVAL);
22000 	}
22001 
22002 	ipif_down_tail(ipif);
22003 
22004 	return (ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp,
22005 	    B_TRUE));
22006 }
22007 
22008 /* ARGSUSED */
22009 int
22010 ip_sioctl_get_lifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
22011 	ip_ioctl_cmd_t *ipip, void *ifreq)
22012 {
22013 	struct lifreq	*lifr = ifreq;
22014 
22015 	ASSERT(q->q_next == NULL);
22016 	ASSERT(CONN_Q(q));
22017 
22018 	ip1dbg(("ip_sioctl_get_lifusesrc(%s:%u %p)\n",
22019 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
22020 	lifr->lifr_index = ipif->ipif_ill->ill_usesrc_ifindex;
22021 	ip1dbg(("ip_sioctl_get_lifusesrc:lifr_index = %d\n", lifr->lifr_index));
22022 
22023 	return (0);
22024 }
22025 
22026 
22027 /* Find the previous ILL in this usesrc group */
22028 static ill_t *
22029 ill_prev_usesrc(ill_t *uill)
22030 {
22031 	ill_t *ill;
22032 
22033 	for (ill = uill->ill_usesrc_grp_next;
22034 	    ASSERT(ill), ill->ill_usesrc_grp_next != uill;
22035 	    ill = ill->ill_usesrc_grp_next)
22036 		/* do nothing */;
22037 	return (ill);
22038 }
22039 
22040 /*
22041  * Release all members of the usesrc group. This routine is called
22042  * from ill_delete when the interface being unplumbed is the
22043  * group head.
22044  */
22045 static void
22046 ill_disband_usesrc_group(ill_t *uill)
22047 {
22048 	ill_t *next_ill, *tmp_ill;
22049 	ASSERT(RW_WRITE_HELD(&ill_g_usesrc_lock));
22050 	next_ill = uill->ill_usesrc_grp_next;
22051 
22052 	do {
22053 		ASSERT(next_ill != NULL);
22054 		tmp_ill = next_ill->ill_usesrc_grp_next;
22055 		ASSERT(tmp_ill != NULL);
22056 		next_ill->ill_usesrc_grp_next = NULL;
22057 		next_ill->ill_usesrc_ifindex = 0;
22058 		next_ill = tmp_ill;
22059 	} while (next_ill->ill_usesrc_ifindex != 0);
22060 	uill->ill_usesrc_grp_next = NULL;
22061 }
22062 
22063 /*
22064  * Remove the client usesrc ILL from the list and relink to a new list
22065  */
22066 int
22067 ill_relink_usesrc_ills(ill_t *ucill, ill_t *uill, uint_t ifindex)
22068 {
22069 	ill_t *ill, *tmp_ill;
22070 
22071 	ASSERT((ucill != NULL) && (ucill->ill_usesrc_grp_next != NULL) &&
22072 	    (uill != NULL) && RW_WRITE_HELD(&ill_g_usesrc_lock));
22073 
22074 	/*
22075 	 * Check if the usesrc client ILL passed in is not already
22076 	 * in use as a usesrc ILL i.e one whose source address is
22077 	 * in use OR a usesrc ILL is not already in use as a usesrc
22078 	 * client ILL
22079 	 */
22080 	if ((ucill->ill_usesrc_ifindex == 0) ||
22081 	    (uill->ill_usesrc_ifindex != 0)) {
22082 		return (-1);
22083 	}
22084 
22085 	ill = ill_prev_usesrc(ucill);
22086 	ASSERT(ill->ill_usesrc_grp_next != NULL);
22087 
22088 	/* Remove from the current list */
22089 	if (ill->ill_usesrc_grp_next->ill_usesrc_grp_next == ill) {
22090 		/* Only two elements in the list */
22091 		ASSERT(ill->ill_usesrc_ifindex == 0);
22092 		ill->ill_usesrc_grp_next = NULL;
22093 	} else {
22094 		ill->ill_usesrc_grp_next = ucill->ill_usesrc_grp_next;
22095 	}
22096 
22097 	if (ifindex == 0) {
22098 		ucill->ill_usesrc_ifindex = 0;
22099 		ucill->ill_usesrc_grp_next = NULL;
22100 		return (0);
22101 	}
22102 
22103 	ucill->ill_usesrc_ifindex = ifindex;
22104 	tmp_ill = uill->ill_usesrc_grp_next;
22105 	uill->ill_usesrc_grp_next = ucill;
22106 	ucill->ill_usesrc_grp_next =
22107 	    (tmp_ill != NULL) ? tmp_ill : uill;
22108 	return (0);
22109 }
22110 
22111 /*
22112  * Set the ill_usesrc and ill_usesrc_head fields. See synchronization notes in
22113  * ip.c for locking details.
22114  */
22115 /* ARGSUSED */
22116 int
22117 ip_sioctl_slifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
22118     ip_ioctl_cmd_t *ipip, void *ifreq)
22119 {
22120 	struct lifreq *lifr = (struct lifreq *)ifreq;
22121 	boolean_t isv6 = B_FALSE, reset_flg = B_FALSE,
22122 	    ill_flag_changed = B_FALSE;
22123 	ill_t *usesrc_ill, *usesrc_cli_ill = ipif->ipif_ill;
22124 	int err = 0, ret;
22125 	uint_t ifindex;
22126 	phyint_t *us_phyint, *us_cli_phyint;
22127 	ipsq_t *ipsq = NULL;
22128 
22129 	ASSERT(IAM_WRITER_IPIF(ipif));
22130 	ASSERT(q->q_next == NULL);
22131 	ASSERT(CONN_Q(q));
22132 
22133 	isv6 = (Q_TO_CONN(q))->conn_af_isv6;
22134 	us_cli_phyint = usesrc_cli_ill->ill_phyint;
22135 
22136 	ASSERT(us_cli_phyint != NULL);
22137 
22138 	/*
22139 	 * If the client ILL is being used for IPMP, abort.
22140 	 * Note, this can be done before ipsq_try_enter since we are already
22141 	 * exclusive on this ILL
22142 	 */
22143 	if ((us_cli_phyint->phyint_groupname != NULL) ||
22144 	    (us_cli_phyint->phyint_flags & PHYI_STANDBY)) {
22145 		return (EINVAL);
22146 	}
22147 
22148 	ifindex = lifr->lifr_index;
22149 	if (ifindex == 0) {
22150 		if (usesrc_cli_ill->ill_usesrc_grp_next == NULL) {
22151 			/* non usesrc group interface, nothing to reset */
22152 			return (0);
22153 		}
22154 		ifindex = usesrc_cli_ill->ill_usesrc_ifindex;
22155 		/* valid reset request */
22156 		reset_flg = B_TRUE;
22157 	}
22158 
22159 	usesrc_ill = ill_lookup_on_ifindex(ifindex, isv6, q, mp,
22160 	    ip_process_ioctl, &err);
22161 
22162 	if (usesrc_ill == NULL) {
22163 		return (err);
22164 	}
22165 
22166 	/*
22167 	 * The usesrc_cli_ill or the usesrc_ill cannot be part of an IPMP
22168 	 * group nor can either of the interfaces be used for standy. So
22169 	 * to guarantee mutual exclusion with ip_sioctl_flags (which sets
22170 	 * PHYI_STANDBY) and ip_sioctl_groupname (which sets the groupname)
22171 	 * we need to be exclusive on the ipsq belonging to the usesrc_ill.
22172 	 * We are already exlusive on this ipsq i.e ipsq corresponding to
22173 	 * the usesrc_cli_ill
22174 	 */
22175 	ipsq = ipsq_try_enter(NULL, usesrc_ill, q, mp, ip_process_ioctl,
22176 	    NEW_OP, B_TRUE);
22177 	if (ipsq == NULL) {
22178 		err = EINPROGRESS;
22179 		/* Operation enqueued on the ipsq of the usesrc ILL */
22180 		goto done;
22181 	}
22182 
22183 	/* Check if the usesrc_ill is used for IPMP */
22184 	us_phyint = usesrc_ill->ill_phyint;
22185 	if ((us_phyint->phyint_groupname != NULL) ||
22186 	    (us_phyint->phyint_flags & PHYI_STANDBY)) {
22187 		err = EINVAL;
22188 		goto done;
22189 	}
22190 
22191 	/*
22192 	 * If the client is already in use as a usesrc_ill or a usesrc_ill is
22193 	 * already a client then return EINVAL
22194 	 */
22195 	if (IS_USESRC_ILL(usesrc_cli_ill) || IS_USESRC_CLI_ILL(usesrc_ill)) {
22196 		err = EINVAL;
22197 		goto done;
22198 	}
22199 
22200 	/*
22201 	 * If the ill_usesrc_ifindex field is already set to what it needs to
22202 	 * be then this is a duplicate operation.
22203 	 */
22204 	if (!reset_flg && usesrc_cli_ill->ill_usesrc_ifindex == ifindex) {
22205 		err = 0;
22206 		goto done;
22207 	}
22208 
22209 	ip1dbg(("ip_sioctl_slifusesrc: usesrc_cli_ill %s, usesrc_ill %s,"
22210 	    " v6 = %d", usesrc_cli_ill->ill_name, usesrc_ill->ill_name,
22211 	    usesrc_ill->ill_isv6));
22212 
22213 	/*
22214 	 * The next step ensures that no new ires will be created referencing
22215 	 * the client ill, until the ILL_CHANGING flag is cleared. Then
22216 	 * we go through an ire walk deleting all ire caches that reference
22217 	 * the client ill. New ires referencing the client ill that are added
22218 	 * to the ire table before the ILL_CHANGING flag is set, will be
22219 	 * cleaned up by the ire walk below. Attempt to add new ires referencing
22220 	 * the client ill while the ILL_CHANGING flag is set will be failed
22221 	 * during the ire_add in ire_atomic_start. ire_atomic_start atomically
22222 	 * checks (under the ill_g_usesrc_lock) that the ire being added
22223 	 * is not stale, i.e the ire_stq and ire_ipif are consistent and
22224 	 * belong to the same usesrc group.
22225 	 */
22226 	mutex_enter(&usesrc_cli_ill->ill_lock);
22227 	usesrc_cli_ill->ill_state_flags |= ILL_CHANGING;
22228 	mutex_exit(&usesrc_cli_ill->ill_lock);
22229 	ill_flag_changed = B_TRUE;
22230 
22231 	if (ipif->ipif_isv6)
22232 		ire_walk_v6(ipif_delete_cache_ire, (char *)usesrc_cli_ill,
22233 		    ALL_ZONES);
22234 	else
22235 		ire_walk_v4(ipif_delete_cache_ire, (char *)usesrc_cli_ill,
22236 		    ALL_ZONES);
22237 
22238 	/*
22239 	 * ill_g_usesrc_lock global lock protects the ill_usesrc_grp_next
22240 	 * and the ill_usesrc_ifindex fields
22241 	 */
22242 	rw_enter(&ill_g_usesrc_lock, RW_WRITER);
22243 
22244 	if (reset_flg) {
22245 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill, 0);
22246 		if (ret != 0) {
22247 			err = EINVAL;
22248 		}
22249 		rw_exit(&ill_g_usesrc_lock);
22250 		goto done;
22251 	}
22252 
22253 	/*
22254 	 * Four possibilities to consider:
22255 	 * 1. Both usesrc_ill and usesrc_cli_ill are not part of any usesrc grp
22256 	 * 2. usesrc_ill is part of a group but usesrc_cli_ill isn't
22257 	 * 3. usesrc_cli_ill is part of a group but usesrc_ill isn't
22258 	 * 4. Both are part of their respective usesrc groups
22259 	 */
22260 	if ((usesrc_ill->ill_usesrc_grp_next == NULL) &&
22261 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
22262 		ASSERT(usesrc_ill->ill_usesrc_ifindex == 0);
22263 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
22264 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
22265 		usesrc_cli_ill->ill_usesrc_grp_next = usesrc_ill;
22266 	} else if ((usesrc_ill->ill_usesrc_grp_next != NULL) &&
22267 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
22268 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
22269 		/* Insert at head of list */
22270 		usesrc_cli_ill->ill_usesrc_grp_next =
22271 		    usesrc_ill->ill_usesrc_grp_next;
22272 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
22273 	} else {
22274 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill,
22275 		    ifindex);
22276 		if (ret != 0)
22277 			err = EINVAL;
22278 	}
22279 	rw_exit(&ill_g_usesrc_lock);
22280 
22281 done:
22282 	if (ill_flag_changed) {
22283 		mutex_enter(&usesrc_cli_ill->ill_lock);
22284 		usesrc_cli_ill->ill_state_flags &= ~ILL_CHANGING;
22285 		mutex_exit(&usesrc_cli_ill->ill_lock);
22286 	}
22287 	if (ipsq != NULL)
22288 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
22289 	/* The refrele on the lifr_name ipif is done by ip_process_ioctl */
22290 	ill_refrele(usesrc_ill);
22291 	return (err);
22292 }
22293 
22294 /*
22295  * comparison function used by avl.
22296  */
22297 static int
22298 ill_phyint_compare_index(const void *index_ptr, const void *phyip)
22299 {
22300 
22301 	uint_t index;
22302 
22303 	ASSERT(phyip != NULL && index_ptr != NULL);
22304 
22305 	index = *((uint_t *)index_ptr);
22306 	/*
22307 	 * let the phyint with the lowest index be on top.
22308 	 */
22309 	if (((phyint_t *)phyip)->phyint_ifindex < index)
22310 		return (1);
22311 	if (((phyint_t *)phyip)->phyint_ifindex > index)
22312 		return (-1);
22313 	return (0);
22314 }
22315 
22316 /*
22317  * comparison function used by avl.
22318  */
22319 static int
22320 ill_phyint_compare_name(const void *name_ptr, const void *phyip)
22321 {
22322 	ill_t *ill;
22323 	int res = 0;
22324 
22325 	ASSERT(phyip != NULL && name_ptr != NULL);
22326 
22327 	if (((phyint_t *)phyip)->phyint_illv4)
22328 		ill = ((phyint_t *)phyip)->phyint_illv4;
22329 	else
22330 		ill = ((phyint_t *)phyip)->phyint_illv6;
22331 	ASSERT(ill != NULL);
22332 
22333 	res = strcmp(ill->ill_name, (char *)name_ptr);
22334 	if (res > 0)
22335 		return (1);
22336 	else if (res < 0)
22337 		return (-1);
22338 	return (0);
22339 }
22340 /*
22341  * This function is called from ill_delete when the ill is being
22342  * unplumbed. We remove the reference from the phyint and we also
22343  * free the phyint when there are no more references to it.
22344  */
22345 static void
22346 ill_phyint_free(ill_t *ill)
22347 {
22348 	phyint_t *phyi;
22349 	phyint_t *next_phyint;
22350 	ipsq_t *cur_ipsq;
22351 
22352 	ASSERT(ill->ill_phyint != NULL);
22353 
22354 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
22355 	phyi = ill->ill_phyint;
22356 	ill->ill_phyint = NULL;
22357 	/*
22358 	 * ill_init allocates a phyint always to store the copy
22359 	 * of flags relevant to phyint. At that point in time, we could
22360 	 * not assign the name and hence phyint_illv4/v6 could not be
22361 	 * initialized. Later in ipif_set_values, we assign the name to
22362 	 * the ill, at which point in time we assign phyint_illv4/v6.
22363 	 * Thus we don't rely on phyint_illv6 to be initialized always.
22364 	 */
22365 	if (ill->ill_flags & ILLF_IPV6) {
22366 		phyi->phyint_illv6 = NULL;
22367 	} else {
22368 		phyi->phyint_illv4 = NULL;
22369 	}
22370 	/*
22371 	 * ipif_down removes it from the group when the last ipif goes
22372 	 * down.
22373 	 */
22374 	ASSERT(ill->ill_group == NULL);
22375 
22376 	if (phyi->phyint_illv4 != NULL || phyi->phyint_illv6 != NULL)
22377 		return;
22378 
22379 	/*
22380 	 * Make sure this phyint was put in the list.
22381 	 */
22382 	if (phyi->phyint_ifindex > 0) {
22383 		avl_remove(&phyint_g_list.phyint_list_avl_by_index,
22384 		    phyi);
22385 		avl_remove(&phyint_g_list.phyint_list_avl_by_name,
22386 		    phyi);
22387 	}
22388 	/*
22389 	 * remove phyint from the ipsq list.
22390 	 */
22391 	cur_ipsq = phyi->phyint_ipsq;
22392 	if (phyi == cur_ipsq->ipsq_phyint_list) {
22393 		cur_ipsq->ipsq_phyint_list = phyi->phyint_ipsq_next;
22394 	} else {
22395 		next_phyint = cur_ipsq->ipsq_phyint_list;
22396 		while (next_phyint != NULL) {
22397 			if (next_phyint->phyint_ipsq_next == phyi) {
22398 				next_phyint->phyint_ipsq_next =
22399 					phyi->phyint_ipsq_next;
22400 				break;
22401 			}
22402 			next_phyint = next_phyint->phyint_ipsq_next;
22403 		}
22404 		ASSERT(next_phyint != NULL);
22405 	}
22406 	IPSQ_DEC_REF(cur_ipsq);
22407 
22408 	if (phyi->phyint_groupname_len != 0) {
22409 		ASSERT(phyi->phyint_groupname != NULL);
22410 		mi_free(phyi->phyint_groupname);
22411 	}
22412 	mi_free(phyi);
22413 }
22414 
22415 /*
22416  * Attach the ill to the phyint structure which can be shared by both
22417  * IPv4 and IPv6 ill. ill_init allocates a phyint to just hold flags. This
22418  * function is called from ipif_set_values and ill_lookup_on_name (for
22419  * loopback) where we know the name of the ill. We lookup the ill and if
22420  * there is one present already with the name use that phyint. Otherwise
22421  * reuse the one allocated by ill_init.
22422  */
22423 static void
22424 ill_phyint_reinit(ill_t *ill)
22425 {
22426 	boolean_t isv6 = ill->ill_isv6;
22427 	phyint_t *phyi_old;
22428 	phyint_t *phyi;
22429 	avl_index_t where = 0;
22430 	ill_t	*ill_other = NULL;
22431 	ipsq_t	*ipsq;
22432 
22433 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
22434 
22435 	phyi_old = ill->ill_phyint;
22436 	ASSERT(isv6 || (phyi_old->phyint_illv4 == ill &&
22437 	    phyi_old->phyint_illv6 == NULL));
22438 	ASSERT(!isv6 || (phyi_old->phyint_illv6 == ill &&
22439 	    phyi_old->phyint_illv4 == NULL));
22440 	ASSERT(phyi_old->phyint_ifindex == 0);
22441 
22442 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_name,
22443 	    ill->ill_name, &where);
22444 
22445 	/*
22446 	 * 1. We grabbed the ill_g_lock before inserting this ill into
22447 	 *    the global list of ills. So no other thread could have located
22448 	 *    this ill and hence the ipsq of this ill is guaranteed to be empty.
22449 	 * 2. Now locate the other protocol instance of this ill.
22450 	 * 3. Now grab both ill locks in the right order, and the phyint lock of
22451 	 *    the new ipsq. Holding ill locks + ill_g_lock ensures that the ipsq
22452 	 *    of neither ill can change.
22453 	 * 4. Merge the phyint and thus the ipsq as well of this ill onto the
22454 	 *    other ill.
22455 	 * 5. Release all locks.
22456 	 */
22457 
22458 	/*
22459 	 * Look for IPv4 if we are initializing IPv6 or look for IPv6 if
22460 	 * we are initializing IPv4.
22461 	 */
22462 	if (phyi != NULL) {
22463 		ill_other = (isv6) ? phyi->phyint_illv4 :
22464 		    phyi->phyint_illv6;
22465 		ASSERT(ill_other->ill_phyint != NULL);
22466 		ASSERT((isv6 && !ill_other->ill_isv6) ||
22467 		    (!isv6 && ill_other->ill_isv6));
22468 		GRAB_ILL_LOCKS(ill, ill_other);
22469 		/*
22470 		 * We are potentially throwing away phyint_flags which
22471 		 * could be different from the one that we obtain from
22472 		 * ill_other->ill_phyint. But it is okay as we are assuming
22473 		 * that the state maintained within IP is correct.
22474 		 */
22475 		mutex_enter(&phyi->phyint_lock);
22476 		if (isv6) {
22477 			ASSERT(phyi->phyint_illv6 == NULL);
22478 			phyi->phyint_illv6 = ill;
22479 		} else {
22480 			ASSERT(phyi->phyint_illv4 == NULL);
22481 			phyi->phyint_illv4 = ill;
22482 		}
22483 		/*
22484 		 * This is a new ill, currently undergoing SLIFNAME
22485 		 * So we could not have joined an IPMP group until now.
22486 		 */
22487 		ASSERT(phyi_old->phyint_ipsq_next == NULL &&
22488 		    phyi_old->phyint_groupname == NULL);
22489 
22490 		/*
22491 		 * This phyi_old is going away. Decref ipsq_refs and
22492 		 * assert it is zero. The ipsq itself will be freed in
22493 		 * ipsq_exit
22494 		 */
22495 		ipsq = phyi_old->phyint_ipsq;
22496 		IPSQ_DEC_REF(ipsq);
22497 		ASSERT(ipsq->ipsq_refs == 0);
22498 		/* Get the singleton phyint out of the ipsq list */
22499 		ASSERT(phyi_old->phyint_ipsq_next == NULL);
22500 		ipsq->ipsq_phyint_list = NULL;
22501 		phyi_old->phyint_illv4 = NULL;
22502 		phyi_old->phyint_illv6 = NULL;
22503 		mi_free(phyi_old);
22504 	} else {
22505 		mutex_enter(&ill->ill_lock);
22506 		/*
22507 		 * We don't need to acquire any lock, since
22508 		 * the ill is not yet visible globally  and we
22509 		 * have not yet released the ill_g_lock.
22510 		 */
22511 		phyi = phyi_old;
22512 		mutex_enter(&phyi->phyint_lock);
22513 		/* XXX We need a recovery strategy here. */
22514 		if (!phyint_assign_ifindex(phyi))
22515 			cmn_err(CE_PANIC, "phyint_assign_ifindex() failed");
22516 
22517 		avl_insert(&phyint_g_list.phyint_list_avl_by_name,
22518 		    (void *)phyi, where);
22519 
22520 		(void) avl_find(&phyint_g_list.phyint_list_avl_by_index,
22521 		    &phyi->phyint_ifindex, &where);
22522 		avl_insert(&phyint_g_list.phyint_list_avl_by_index,
22523 		    (void *)phyi, where);
22524 	}
22525 
22526 	/*
22527 	 * Reassigning ill_phyint automatically reassigns the ipsq also.
22528 	 * pending mp is not affected because that is per ill basis.
22529 	 */
22530 	ill->ill_phyint = phyi;
22531 
22532 	/*
22533 	 * Keep the index on ipif_orig_index to be used by FAILOVER.
22534 	 * We do this here as when the first ipif was allocated,
22535 	 * ipif_allocate does not know the right interface index.
22536 	 */
22537 
22538 	ill->ill_ipif->ipif_orig_ifindex = ill->ill_phyint->phyint_ifindex;
22539 	/*
22540 	 * Now that the phyint's ifindex has been assigned, complete the
22541 	 * remaining
22542 	 */
22543 	if (ill->ill_isv6) {
22544 		ill->ill_ip6_mib->ipv6IfIndex =
22545 		    ill->ill_phyint->phyint_ifindex;
22546 		ill->ill_icmp6_mib->ipv6IfIcmpIfIndex =
22547 		    ill->ill_phyint->phyint_ifindex;
22548 	}
22549 
22550 	/*
22551 	 * Generate an event within the hooks framework to indicate that
22552 	 * a new interface has just been added to IP.  For this event to
22553 	 * be generated, the network interface must, at least, have an
22554 	 * ifindex assigned to it.
22555 	 *
22556 	 * This needs to be run inside the ill_g_lock perimeter to ensure
22557 	 * that the ordering of delivered events to listeners matches the
22558 	 * order of them in the kernel.
22559 	 *
22560 	 * This function could be called from ill_lookup_on_name. In that case
22561 	 * the interface is loopback "lo", which will not generate a NIC event.
22562 	 */
22563 	if (ill->ill_name_length <= 2 ||
22564 	    ill->ill_name[0] != 'l' || ill->ill_name[1] != 'o') {
22565 		hook_nic_event_t *info;
22566 		if ((info = ill->ill_nic_event_info) != NULL) {
22567 			ip2dbg(("ill_phyint_reinit: unexpected nic event %d "
22568 			    "attached for %s\n", info->hne_event,
22569 			    ill->ill_name));
22570 			if (info->hne_data != NULL)
22571 				kmem_free(info->hne_data, info->hne_datalen);
22572 			kmem_free(info, sizeof (hook_nic_event_t));
22573 		}
22574 
22575 		info = kmem_alloc(sizeof (hook_nic_event_t), KM_NOSLEEP);
22576 		if (info != NULL) {
22577 			info->hne_nic = ill->ill_phyint->phyint_ifindex;
22578 			info->hne_lif = 0;
22579 			info->hne_event = NE_PLUMB;
22580 			info->hne_family = ill->ill_isv6 ? ipv6 : ipv4;
22581 			info->hne_data = kmem_alloc(ill->ill_name_length,
22582 			    KM_NOSLEEP);
22583 			if (info->hne_data != NULL) {
22584 				info->hne_datalen = ill->ill_name_length;
22585 				bcopy(ill->ill_name, info->hne_data,
22586 				    info->hne_datalen);
22587 			} else {
22588 				ip2dbg(("ill_phyint_reinit: could not attach "
22589 				    "ill_name information for PLUMB nic event "
22590 				    "of %s (ENOMEM)\n", ill->ill_name));
22591 				kmem_free(info, sizeof (hook_nic_event_t));
22592 			}
22593 		} else
22594 			ip2dbg(("ill_phyint_reinit: could not attach PLUMB nic "
22595 			    "event information for %s (ENOMEM)\n",
22596 			    ill->ill_name));
22597 
22598 		ill->ill_nic_event_info = info;
22599 	}
22600 
22601 	RELEASE_ILL_LOCKS(ill, ill_other);
22602 	mutex_exit(&phyi->phyint_lock);
22603 }
22604 
22605 /*
22606  * Notify any downstream modules of the name of this interface.
22607  * An M_IOCTL is used even though we don't expect a successful reply.
22608  * Any reply message from the driver (presumably an M_IOCNAK) will
22609  * eventually get discarded somewhere upstream.  The message format is
22610  * simply an SIOCSLIFNAME ioctl just as might be sent from ifconfig
22611  * to IP.
22612  */
22613 static void
22614 ip_ifname_notify(ill_t *ill, queue_t *q)
22615 {
22616 	mblk_t *mp1, *mp2;
22617 	struct iocblk *iocp;
22618 	struct lifreq *lifr;
22619 
22620 	mp1 = mkiocb(SIOCSLIFNAME);
22621 	if (mp1 == NULL)
22622 		return;
22623 	mp2 = allocb(sizeof (struct lifreq), BPRI_HI);
22624 	if (mp2 == NULL) {
22625 		freeb(mp1);
22626 		return;
22627 	}
22628 
22629 	mp1->b_cont = mp2;
22630 	iocp = (struct iocblk *)mp1->b_rptr;
22631 	iocp->ioc_count = sizeof (struct lifreq);
22632 
22633 	lifr = (struct lifreq *)mp2->b_rptr;
22634 	mp2->b_wptr += sizeof (struct lifreq);
22635 	bzero(lifr, sizeof (struct lifreq));
22636 
22637 	(void) strncpy(lifr->lifr_name, ill->ill_name, LIFNAMSIZ);
22638 	lifr->lifr_ppa = ill->ill_ppa;
22639 	lifr->lifr_flags = (ill->ill_flags & (ILLF_IPV4|ILLF_IPV6));
22640 
22641 	putnext(q, mp1);
22642 }
22643 
22644 static boolean_t ip_trash_timer_started = B_FALSE;
22645 
22646 static int
22647 ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
22648 {
22649 	int err;
22650 
22651 	/* Set the obsolete NDD per-interface forwarding name. */
22652 	err = ill_set_ndd_name(ill);
22653 	if (err != 0) {
22654 		cmn_err(CE_WARN, "ipif_set_values: ill_set_ndd_name (%d)\n",
22655 		    err);
22656 	}
22657 
22658 	/* Tell downstream modules where they are. */
22659 	ip_ifname_notify(ill, q);
22660 
22661 	/*
22662 	 * ill_dl_phys returns EINPROGRESS in the usual case.
22663 	 * Error cases are ENOMEM ...
22664 	 */
22665 	err = ill_dl_phys(ill, ipif, mp, q);
22666 
22667 	/*
22668 	 * If there is no IRE expiration timer running, get one started.
22669 	 * igmp and mld timers will be triggered by the first multicast
22670 	 */
22671 	if (!ip_trash_timer_started) {
22672 		/*
22673 		 * acquire the lock and check again.
22674 		 */
22675 		mutex_enter(&ip_trash_timer_lock);
22676 		if (!ip_trash_timer_started) {
22677 			ip_ire_expire_id = timeout(ip_trash_timer_expire, NULL,
22678 			    MSEC_TO_TICK(ip_timer_interval));
22679 			ip_trash_timer_started = B_TRUE;
22680 		}
22681 		mutex_exit(&ip_trash_timer_lock);
22682 	}
22683 
22684 	if (ill->ill_isv6) {
22685 		mutex_enter(&mld_slowtimeout_lock);
22686 		if (mld_slowtimeout_id == 0) {
22687 			mld_slowtimeout_id = timeout(mld_slowtimo, NULL,
22688 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
22689 		}
22690 		mutex_exit(&mld_slowtimeout_lock);
22691 	} else {
22692 		mutex_enter(&igmp_slowtimeout_lock);
22693 		if (igmp_slowtimeout_id == 0) {
22694 			igmp_slowtimeout_id = timeout(igmp_slowtimo, NULL,
22695 				MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
22696 		}
22697 		mutex_exit(&igmp_slowtimeout_lock);
22698 	}
22699 
22700 	return (err);
22701 }
22702 
22703 /*
22704  * Common routine for ppa and ifname setting. Should be called exclusive.
22705  *
22706  * Returns EINPROGRESS when mp has been consumed by queueing it on
22707  * ill_pending_mp and the ioctl will complete in ip_rput.
22708  *
22709  * NOTE : If ppa is UNIT_MAX, we assign the next valid ppa and return
22710  * the new name and new ppa in lifr_name and lifr_ppa respectively.
22711  * For SLIFNAME, we pass these values back to the userland.
22712  */
22713 static int
22714 ipif_set_values(queue_t *q, mblk_t *mp, char *interf_name, uint_t *new_ppa_ptr)
22715 {
22716 	ill_t	*ill;
22717 	ipif_t	*ipif;
22718 	ipsq_t	*ipsq;
22719 	char	*ppa_ptr;
22720 	char	*old_ptr;
22721 	char	old_char;
22722 	int	error;
22723 
22724 	ip1dbg(("ipif_set_values: interface %s\n", interf_name));
22725 	ASSERT(q->q_next != NULL);
22726 	ASSERT(interf_name != NULL);
22727 
22728 	ill = (ill_t *)q->q_ptr;
22729 
22730 	ASSERT(ill->ill_name[0] == '\0');
22731 	ASSERT(IAM_WRITER_ILL(ill));
22732 	ASSERT((mi_strlen(interf_name) + 1) <= LIFNAMSIZ);
22733 	ASSERT(ill->ill_ppa == UINT_MAX);
22734 
22735 	/* The ppa is sent down by ifconfig or is chosen */
22736 	if ((ppa_ptr = ill_get_ppa_ptr(interf_name)) == NULL) {
22737 		return (EINVAL);
22738 	}
22739 
22740 	/*
22741 	 * make sure ppa passed in is same as ppa in the name.
22742 	 * This check is not made when ppa == UINT_MAX in that case ppa
22743 	 * in the name could be anything. System will choose a ppa and
22744 	 * update new_ppa_ptr and inter_name to contain the choosen ppa.
22745 	 */
22746 	if (*new_ppa_ptr != UINT_MAX) {
22747 		/* stoi changes the pointer */
22748 		old_ptr = ppa_ptr;
22749 		/*
22750 		 * ifconfig passed in 0 for the ppa for DLPI 1 style devices
22751 		 * (they don't have an externally visible ppa).  We assign one
22752 		 * here so that we can manage the interface.  Note that in
22753 		 * the past this value was always 0 for DLPI 1 drivers.
22754 		 */
22755 		if (*new_ppa_ptr == 0)
22756 			*new_ppa_ptr = stoi(&old_ptr);
22757 		else if (*new_ppa_ptr != (uint_t)stoi(&old_ptr))
22758 			return (EINVAL);
22759 	}
22760 	/*
22761 	 * terminate string before ppa
22762 	 * save char at that location.
22763 	 */
22764 	old_char = ppa_ptr[0];
22765 	ppa_ptr[0] = '\0';
22766 
22767 	ill->ill_ppa = *new_ppa_ptr;
22768 	/*
22769 	 * Finish as much work now as possible before calling ill_glist_insert
22770 	 * which makes the ill globally visible and also merges it with the
22771 	 * other protocol instance of this phyint. The remaining work is
22772 	 * done after entering the ipsq which may happen sometime later.
22773 	 * ill_set_ndd_name occurs after the ill has been made globally visible.
22774 	 */
22775 	ipif = ill->ill_ipif;
22776 
22777 	/* We didn't do this when we allocated ipif in ip_ll_subnet_defaults */
22778 	ipif_assign_seqid(ipif);
22779 
22780 	if (!(ill->ill_flags & (ILLF_IPV4|ILLF_IPV6)))
22781 		ill->ill_flags |= ILLF_IPV4;
22782 
22783 	ASSERT(ipif->ipif_next == NULL);	/* Only one ipif on ill */
22784 	ASSERT((ipif->ipif_flags & IPIF_UP) == 0);
22785 
22786 	if (ill->ill_flags & ILLF_IPV6) {
22787 
22788 		ill->ill_isv6 = B_TRUE;
22789 		if (ill->ill_rq != NULL) {
22790 			ill->ill_rq->q_qinfo = &rinit_ipv6;
22791 			ill->ill_wq->q_qinfo = &winit_ipv6;
22792 		}
22793 
22794 		/* Keep the !IN6_IS_ADDR_V4MAPPED assertions happy */
22795 		ipif->ipif_v6lcl_addr = ipv6_all_zeros;
22796 		ipif->ipif_v6src_addr = ipv6_all_zeros;
22797 		ipif->ipif_v6subnet = ipv6_all_zeros;
22798 		ipif->ipif_v6net_mask = ipv6_all_zeros;
22799 		ipif->ipif_v6brd_addr = ipv6_all_zeros;
22800 		ipif->ipif_v6pp_dst_addr = ipv6_all_zeros;
22801 		/*
22802 		 * point-to-point or Non-mulicast capable
22803 		 * interfaces won't do NUD unless explicitly
22804 		 * configured to do so.
22805 		 */
22806 		if (ipif->ipif_flags & IPIF_POINTOPOINT ||
22807 		    !(ill->ill_flags & ILLF_MULTICAST)) {
22808 			ill->ill_flags |= ILLF_NONUD;
22809 		}
22810 		/* Make sure IPv4 specific flag is not set on IPv6 if */
22811 		if (ill->ill_flags & ILLF_NOARP) {
22812 			/*
22813 			 * Note: xresolv interfaces will eventually need
22814 			 * NOARP set here as well, but that will require
22815 			 * those external resolvers to have some
22816 			 * knowledge of that flag and act appropriately.
22817 			 * Not to be changed at present.
22818 			 */
22819 			ill->ill_flags &= ~ILLF_NOARP;
22820 		}
22821 		/*
22822 		 * Set the ILLF_ROUTER flag according to the global
22823 		 * IPv6 forwarding policy.
22824 		 */
22825 		if (ipv6_forward != 0)
22826 			ill->ill_flags |= ILLF_ROUTER;
22827 	} else if (ill->ill_flags & ILLF_IPV4) {
22828 		ill->ill_isv6 = B_FALSE;
22829 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6lcl_addr);
22830 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6src_addr);
22831 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6subnet);
22832 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6net_mask);
22833 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6brd_addr);
22834 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6pp_dst_addr);
22835 		/*
22836 		 * Set the ILLF_ROUTER flag according to the global
22837 		 * IPv4 forwarding policy.
22838 		 */
22839 		if (ip_g_forward != 0)
22840 			ill->ill_flags |= ILLF_ROUTER;
22841 	}
22842 
22843 	ASSERT(ill->ill_phyint != NULL);
22844 
22845 	/*
22846 	 * The ipv6Ifindex and ipv6IfIcmpIfIndex assignments will
22847 	 * be completed in ill_glist_insert -> ill_phyint_reinit
22848 	 */
22849 	if (ill->ill_isv6) {
22850 		/* allocate v6 mib */
22851 		if (!ill_allocate_mibs(ill))
22852 			return (ENOMEM);
22853 	}
22854 
22855 	/*
22856 	 * Pick a default sap until we get the DL_INFO_ACK back from
22857 	 * the driver.
22858 	 */
22859 	if (ill->ill_sap == 0) {
22860 		if (ill->ill_isv6)
22861 			ill->ill_sap  = IP6_DL_SAP;
22862 		else
22863 			ill->ill_sap  = IP_DL_SAP;
22864 	}
22865 
22866 	ill->ill_ifname_pending = 1;
22867 	ill->ill_ifname_pending_err = 0;
22868 
22869 	ill_refhold(ill);
22870 	rw_enter(&ill_g_lock, RW_WRITER);
22871 	if ((error = ill_glist_insert(ill, interf_name,
22872 	    (ill->ill_flags & ILLF_IPV6) == ILLF_IPV6)) > 0) {
22873 		ill->ill_ppa = UINT_MAX;
22874 		ill->ill_name[0] = '\0';
22875 		/*
22876 		 * undo null termination done above.
22877 		 */
22878 		ppa_ptr[0] = old_char;
22879 		rw_exit(&ill_g_lock);
22880 		ill_refrele(ill);
22881 		return (error);
22882 	}
22883 
22884 	ASSERT(ill->ill_name_length <= LIFNAMSIZ);
22885 
22886 	/*
22887 	 * When we return the buffer pointed to by interf_name should contain
22888 	 * the same name as in ill_name.
22889 	 * If a ppa was choosen by the system (ppa passed in was UINT_MAX)
22890 	 * the buffer pointed to by new_ppa_ptr would not contain the right ppa
22891 	 * so copy full name and update the ppa ptr.
22892 	 * When ppa passed in != UINT_MAX all values are correct just undo
22893 	 * null termination, this saves a bcopy.
22894 	 */
22895 	if (*new_ppa_ptr == UINT_MAX) {
22896 		bcopy(ill->ill_name, interf_name, ill->ill_name_length);
22897 		*new_ppa_ptr = ill->ill_ppa;
22898 	} else {
22899 		/*
22900 		 * undo null termination done above.
22901 		 */
22902 		ppa_ptr[0] = old_char;
22903 	}
22904 
22905 	/* Let SCTP know about this ILL */
22906 	sctp_update_ill(ill, SCTP_ILL_INSERT);
22907 
22908 	/* and also about the first ipif */
22909 	sctp_update_ipif(ipif, SCTP_IPIF_INSERT);
22910 
22911 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_reprocess_ioctl, NEW_OP,
22912 	    B_TRUE);
22913 
22914 	rw_exit(&ill_g_lock);
22915 	ill_refrele(ill);
22916 	if (ipsq == NULL)
22917 		return (EINPROGRESS);
22918 
22919 	/*
22920 	 * Need to set the ipsq_current_ipif now, if we have changed ipsq
22921 	 * due to the phyint merge in ill_phyint_reinit.
22922 	 */
22923 	ASSERT(ipsq->ipsq_current_ipif == NULL ||
22924 		ipsq->ipsq_current_ipif == ipif);
22925 	ipsq->ipsq_current_ipif = ipif;
22926 	ipsq->ipsq_last_cmd = SIOCSLIFNAME;
22927 	error = ipif_set_values_tail(ill, ipif, mp, q);
22928 	ipsq_exit(ipsq, B_TRUE, B_TRUE);
22929 	if (error != 0 && error != EINPROGRESS) {
22930 		/*
22931 		 * restore previous values
22932 		 */
22933 		ill->ill_isv6 = B_FALSE;
22934 	}
22935 	return (error);
22936 }
22937 
22938 
22939 extern void (*ip_cleanup_func)(void);
22940 
22941 void
22942 ipif_init(void)
22943 {
22944 	hrtime_t hrt;
22945 	int i;
22946 
22947 	/*
22948 	 * Can't call drv_getparm here as it is too early in the boot.
22949 	 * As we use ipif_src_random just for picking a different
22950 	 * source address everytime, this need not be really random.
22951 	 */
22952 	hrt = gethrtime();
22953 	ipif_src_random = ((hrt >> 32) & 0xffffffff) * (hrt & 0xffffffff);
22954 
22955 	for (i = 0; i < MAX_G_HEADS; i++) {
22956 		ill_g_heads[i].ill_g_list_head = (ill_if_t *)&ill_g_heads[i];
22957 		ill_g_heads[i].ill_g_list_tail = (ill_if_t *)&ill_g_heads[i];
22958 	}
22959 
22960 	avl_create(&phyint_g_list.phyint_list_avl_by_index,
22961 	    ill_phyint_compare_index,
22962 	    sizeof (phyint_t),
22963 	    offsetof(struct phyint, phyint_avl_by_index));
22964 	avl_create(&phyint_g_list.phyint_list_avl_by_name,
22965 	    ill_phyint_compare_name,
22966 	    sizeof (phyint_t),
22967 	    offsetof(struct phyint, phyint_avl_by_name));
22968 
22969 	ip_cleanup_func = ip_thread_exit;
22970 }
22971 
22972 /*
22973  * This is called by ip_rt_add when src_addr value is other than zero.
22974  * src_addr signifies the source address of the incoming packet. For
22975  * reverse tunnel route we need to create a source addr based routing
22976  * table. This routine creates ip_mrtun_table if it's empty and then
22977  * it adds the route entry hashed by source address. It verifies that
22978  * the outgoing interface is always a non-resolver interface (tunnel).
22979  */
22980 int
22981 ip_mrtun_rt_add(ipaddr_t in_src_addr, int flags, ipif_t *ipif_arg,
22982     ipif_t *src_ipif, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func)
22983 {
22984 	ire_t   *ire;
22985 	ire_t	*save_ire;
22986 	ipif_t  *ipif;
22987 	ill_t   *in_ill = NULL;
22988 	ill_t	*out_ill;
22989 	queue_t	*stq;
22990 	mblk_t	*dlureq_mp;
22991 	int	error;
22992 
22993 	if (ire_arg != NULL)
22994 		*ire_arg = NULL;
22995 	ASSERT(in_src_addr != INADDR_ANY);
22996 
22997 	ipif = ipif_arg;
22998 	if (ipif != NULL) {
22999 		out_ill = ipif->ipif_ill;
23000 	} else {
23001 		ip1dbg(("ip_mrtun_rt_add: ipif is NULL\n"));
23002 		return (EINVAL);
23003 	}
23004 
23005 	if (src_ipif == NULL) {
23006 		ip1dbg(("ip_mrtun_rt_add: src_ipif is NULL\n"));
23007 		return (EINVAL);
23008 	}
23009 	in_ill = src_ipif->ipif_ill;
23010 
23011 	/*
23012 	 * Check for duplicates. We don't need to
23013 	 * match out_ill, because the uniqueness of
23014 	 * a route is only dependent on src_addr and
23015 	 * in_ill.
23016 	 */
23017 	ire = ire_mrtun_lookup(in_src_addr, in_ill);
23018 	if (ire != NULL) {
23019 		ire_refrele(ire);
23020 		return (EEXIST);
23021 	}
23022 	if (ipif->ipif_net_type != IRE_IF_NORESOLVER) {
23023 		ip2dbg(("ip_mrtun_rt_add: outgoing interface is type %d\n",
23024 		    ipif->ipif_net_type));
23025 		return (EINVAL);
23026 	}
23027 
23028 	stq = ipif->ipif_wq;
23029 	ASSERT(stq != NULL);
23030 
23031 	/*
23032 	 * The outgoing interface must be non-resolver
23033 	 * interface.
23034 	 */
23035 	dlureq_mp = ill_dlur_gen(NULL,
23036 	    out_ill->ill_phys_addr_length, out_ill->ill_sap,
23037 	    out_ill->ill_sap_length);
23038 
23039 	if (dlureq_mp == NULL) {
23040 		ip1dbg(("ip_newroute: dlureq_mp NULL\n"));
23041 		return (ENOMEM);
23042 	}
23043 
23044 	/* Create the IRE. */
23045 
23046 	ire = ire_create(
23047 	    NULL,				/* Zero dst addr */
23048 	    NULL,				/* Zero mask */
23049 	    NULL,				/* Zero gateway addr */
23050 	    NULL,				/* Zero ipif_src addr */
23051 	    (uint8_t *)&in_src_addr,		/* in_src-addr */
23052 	    &ipif->ipif_mtu,
23053 	    NULL,
23054 	    NULL,				/* rfq */
23055 	    stq,
23056 	    IRE_MIPRTUN,
23057 	    dlureq_mp,
23058 	    ipif,
23059 	    in_ill,
23060 	    0,
23061 	    0,
23062 	    0,
23063 	    flags,
23064 	    &ire_uinfo_null,
23065 	    NULL,
23066 	    NULL);
23067 
23068 	if (ire == NULL) {
23069 		freeb(dlureq_mp);
23070 		return (ENOMEM);
23071 	}
23072 	ip2dbg(("ip_mrtun_rt_add: mrtun route is created with type %d\n",
23073 	    ire->ire_type));
23074 	save_ire = ire;
23075 	ASSERT(save_ire != NULL);
23076 	error = ire_add_mrtun(&ire, q, mp, func);
23077 	/*
23078 	 * If ire_add_mrtun() failed, the ire passed in was freed
23079 	 * so there is no need to do so here.
23080 	 */
23081 	if (error != 0) {
23082 		return (error);
23083 	}
23084 
23085 	/* Duplicate check */
23086 	if (ire != save_ire) {
23087 		/* route already exists by now */
23088 		ire_refrele(ire);
23089 		return (EEXIST);
23090 	}
23091 
23092 	if (ire_arg != NULL) {
23093 		/*
23094 		 * Store the ire that was just added. the caller
23095 		 * ip_rts_request responsible for doing ire_refrele()
23096 		 * on it.
23097 		 */
23098 		*ire_arg = ire;
23099 	} else {
23100 		ire_refrele(ire);	/* held in ire_add_mrtun */
23101 	}
23102 
23103 	return (0);
23104 }
23105 
23106 /*
23107  * It is called by ip_rt_delete() only when mipagent requests to delete
23108  * a reverse tunnel route that was added by ip_mrtun_rt_add() before.
23109  */
23110 
23111 int
23112 ip_mrtun_rt_delete(ipaddr_t in_src_addr, ipif_t *src_ipif)
23113 {
23114 	ire_t   *ire = NULL;
23115 
23116 	if (in_src_addr == INADDR_ANY)
23117 		return (EINVAL);
23118 	if (src_ipif == NULL)
23119 		return (EINVAL);
23120 
23121 	/* search if this route exists in the ip_mrtun_table */
23122 	ire = ire_mrtun_lookup(in_src_addr, src_ipif->ipif_ill);
23123 	if (ire == NULL) {
23124 		ip2dbg(("ip_mrtun_rt_delete: ire not found\n"));
23125 		return (ESRCH);
23126 	}
23127 	ire_delete(ire);
23128 	ire_refrele(ire);
23129 	return (0);
23130 }
23131 
23132 /*
23133  * Lookup the ipif corresponding to the onlink destination address. For
23134  * point-to-point interfaces, it matches with remote endpoint destination
23135  * address. For point-to-multipoint interfaces it only tries to match the
23136  * destination with the interface's subnet address. The longest, most specific
23137  * match is found to take care of such rare network configurations like -
23138  * le0: 129.146.1.1/16
23139  * le1: 129.146.2.2/24
23140  * It is used only by SO_DONTROUTE at the moment.
23141  */
23142 ipif_t *
23143 ipif_lookup_onlink_addr(ipaddr_t addr, zoneid_t zoneid)
23144 {
23145 	ipif_t	*ipif, *best_ipif;
23146 	ill_t	*ill;
23147 	ill_walk_context_t ctx;
23148 
23149 	ASSERT(zoneid != ALL_ZONES);
23150 	best_ipif = NULL;
23151 
23152 	rw_enter(&ill_g_lock, RW_READER);
23153 	ill = ILL_START_WALK_V4(&ctx);
23154 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
23155 		mutex_enter(&ill->ill_lock);
23156 		for (ipif = ill->ill_ipif; ipif != NULL;
23157 		    ipif = ipif->ipif_next) {
23158 			if (!IPIF_CAN_LOOKUP(ipif))
23159 				continue;
23160 			if (ipif->ipif_zoneid != zoneid &&
23161 			    ipif->ipif_zoneid != ALL_ZONES)
23162 				continue;
23163 			/*
23164 			 * Point-to-point case. Look for exact match with
23165 			 * destination address.
23166 			 */
23167 			if (ipif->ipif_flags & IPIF_POINTOPOINT) {
23168 				if (ipif->ipif_pp_dst_addr == addr) {
23169 					ipif_refhold_locked(ipif);
23170 					mutex_exit(&ill->ill_lock);
23171 					rw_exit(&ill_g_lock);
23172 					if (best_ipif != NULL)
23173 						ipif_refrele(best_ipif);
23174 					return (ipif);
23175 				}
23176 			} else if (ipif->ipif_subnet == (addr &
23177 			    ipif->ipif_net_mask)) {
23178 				/*
23179 				 * Point-to-multipoint case. Looping through to
23180 				 * find the most specific match. If there are
23181 				 * multiple best match ipif's then prefer ipif's
23182 				 * that are UP. If there is only one best match
23183 				 * ipif and it is DOWN we must still return it.
23184 				 */
23185 				if ((best_ipif == NULL) ||
23186 				    (ipif->ipif_net_mask >
23187 				    best_ipif->ipif_net_mask) ||
23188 				    ((ipif->ipif_net_mask ==
23189 				    best_ipif->ipif_net_mask) &&
23190 				    ((ipif->ipif_flags & IPIF_UP) &&
23191 				    (!(best_ipif->ipif_flags & IPIF_UP))))) {
23192 					ipif_refhold_locked(ipif);
23193 					mutex_exit(&ill->ill_lock);
23194 					rw_exit(&ill_g_lock);
23195 					if (best_ipif != NULL)
23196 						ipif_refrele(best_ipif);
23197 					best_ipif = ipif;
23198 					rw_enter(&ill_g_lock, RW_READER);
23199 					mutex_enter(&ill->ill_lock);
23200 				}
23201 			}
23202 		}
23203 		mutex_exit(&ill->ill_lock);
23204 	}
23205 	rw_exit(&ill_g_lock);
23206 	return (best_ipif);
23207 }
23208 
23209 
23210 /*
23211  * Save enough information so that we can recreate the IRE if
23212  * the interface goes down and then up.
23213  */
23214 static void
23215 ipif_save_ire(ipif_t *ipif, ire_t *ire)
23216 {
23217 	mblk_t	*save_mp;
23218 
23219 	save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
23220 	if (save_mp != NULL) {
23221 		ifrt_t	*ifrt;
23222 
23223 		save_mp->b_wptr += sizeof (ifrt_t);
23224 		ifrt = (ifrt_t *)save_mp->b_rptr;
23225 		bzero(ifrt, sizeof (ifrt_t));
23226 		ifrt->ifrt_type = ire->ire_type;
23227 		ifrt->ifrt_addr = ire->ire_addr;
23228 		ifrt->ifrt_gateway_addr = ire->ire_gateway_addr;
23229 		ifrt->ifrt_src_addr = ire->ire_src_addr;
23230 		ifrt->ifrt_mask = ire->ire_mask;
23231 		ifrt->ifrt_flags = ire->ire_flags;
23232 		ifrt->ifrt_max_frag = ire->ire_max_frag;
23233 		mutex_enter(&ipif->ipif_saved_ire_lock);
23234 		save_mp->b_cont = ipif->ipif_saved_ire_mp;
23235 		ipif->ipif_saved_ire_mp = save_mp;
23236 		ipif->ipif_saved_ire_cnt++;
23237 		mutex_exit(&ipif->ipif_saved_ire_lock);
23238 	}
23239 }
23240 
23241 
23242 static void
23243 ipif_remove_ire(ipif_t *ipif, ire_t *ire)
23244 {
23245 	mblk_t	**mpp;
23246 	mblk_t	*mp;
23247 	ifrt_t	*ifrt;
23248 
23249 	/* Remove from ipif_saved_ire_mp list if it is there */
23250 	mutex_enter(&ipif->ipif_saved_ire_lock);
23251 	for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL;
23252 	    mpp = &(*mpp)->b_cont) {
23253 		/*
23254 		 * On a given ipif, the triple of address, gateway and
23255 		 * mask is unique for each saved IRE (in the case of
23256 		 * ordinary interface routes, the gateway address is
23257 		 * all-zeroes).
23258 		 */
23259 		mp = *mpp;
23260 		ifrt = (ifrt_t *)mp->b_rptr;
23261 		if (ifrt->ifrt_addr == ire->ire_addr &&
23262 		    ifrt->ifrt_gateway_addr == ire->ire_gateway_addr &&
23263 		    ifrt->ifrt_mask == ire->ire_mask) {
23264 			*mpp = mp->b_cont;
23265 			ipif->ipif_saved_ire_cnt--;
23266 			freeb(mp);
23267 			break;
23268 		}
23269 	}
23270 	mutex_exit(&ipif->ipif_saved_ire_lock);
23271 }
23272 
23273 
23274 /*
23275  * IP multirouting broadcast routes handling
23276  * Append CGTP broadcast IREs to regular ones created
23277  * at ifconfig time.
23278  */
23279 static void
23280 ip_cgtp_bcast_add(ire_t *ire, ire_t *ire_dst)
23281 {
23282 	ire_t *ire_prim;
23283 
23284 	ASSERT(ire != NULL);
23285 	ASSERT(ire_dst != NULL);
23286 
23287 	ire_prim = ire_ctable_lookup(ire->ire_gateway_addr, 0,
23288 	    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE);
23289 	if (ire_prim != NULL) {
23290 		/*
23291 		 * We are in the special case of broadcasts for
23292 		 * CGTP. We add an IRE_BROADCAST that holds
23293 		 * the RTF_MULTIRT flag, the destination
23294 		 * address of ire_dst and the low level
23295 		 * info of ire_prim. In other words, CGTP
23296 		 * broadcast is added to the redundant ipif.
23297 		 */
23298 		ipif_t *ipif_prim;
23299 		ire_t  *bcast_ire;
23300 
23301 		ipif_prim = ire_prim->ire_ipif;
23302 
23303 		ip2dbg(("ip_cgtp_filter_bcast_add: "
23304 		    "ire_dst %p, ire_prim %p, ipif_prim %p\n",
23305 		    (void *)ire_dst, (void *)ire_prim,
23306 		    (void *)ipif_prim));
23307 
23308 		bcast_ire = ire_create(
23309 		    (uchar_t *)&ire->ire_addr,
23310 		    (uchar_t *)&ip_g_all_ones,
23311 		    (uchar_t *)&ire_dst->ire_src_addr,
23312 		    (uchar_t *)&ire->ire_gateway_addr,
23313 		    NULL,
23314 		    &ipif_prim->ipif_mtu,
23315 		    NULL,
23316 		    ipif_prim->ipif_rq,
23317 		    ipif_prim->ipif_wq,
23318 		    IRE_BROADCAST,
23319 		    ipif_prim->ipif_bcast_mp,
23320 		    ipif_prim,
23321 		    NULL,
23322 		    0,
23323 		    0,
23324 		    0,
23325 		    ire->ire_flags,
23326 		    &ire_uinfo_null,
23327 		    NULL,
23328 		    NULL);
23329 
23330 		if (bcast_ire != NULL) {
23331 
23332 			if (ire_add(&bcast_ire, NULL, NULL, NULL,
23333 			    B_FALSE) == 0) {
23334 				ip2dbg(("ip_cgtp_filter_bcast_add: "
23335 				    "added bcast_ire %p\n",
23336 				    (void *)bcast_ire));
23337 
23338 				ipif_save_ire(bcast_ire->ire_ipif,
23339 				    bcast_ire);
23340 				ire_refrele(bcast_ire);
23341 			}
23342 		}
23343 		ire_refrele(ire_prim);
23344 	}
23345 }
23346 
23347 
23348 /*
23349  * IP multirouting broadcast routes handling
23350  * Remove the broadcast ire
23351  */
23352 static void
23353 ip_cgtp_bcast_delete(ire_t *ire)
23354 {
23355 	ire_t *ire_dst;
23356 
23357 	ASSERT(ire != NULL);
23358 	ire_dst = ire_ctable_lookup(ire->ire_addr, 0, IRE_BROADCAST,
23359 	    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE);
23360 	if (ire_dst != NULL) {
23361 		ire_t *ire_prim;
23362 
23363 		ire_prim = ire_ctable_lookup(ire->ire_gateway_addr, 0,
23364 		    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE);
23365 		if (ire_prim != NULL) {
23366 			ipif_t *ipif_prim;
23367 			ire_t  *bcast_ire;
23368 
23369 			ipif_prim = ire_prim->ire_ipif;
23370 
23371 			ip2dbg(("ip_cgtp_filter_bcast_delete: "
23372 			    "ire_dst %p, ire_prim %p, ipif_prim %p\n",
23373 			    (void *)ire_dst, (void *)ire_prim,
23374 			    (void *)ipif_prim));
23375 
23376 			bcast_ire = ire_ctable_lookup(ire->ire_addr,
23377 			    ire->ire_gateway_addr,
23378 			    IRE_BROADCAST,
23379 			    ipif_prim, ALL_ZONES,
23380 			    NULL,
23381 			    MATCH_IRE_TYPE | MATCH_IRE_GW | MATCH_IRE_IPIF |
23382 			    MATCH_IRE_MASK);
23383 
23384 			if (bcast_ire != NULL) {
23385 				ip2dbg(("ip_cgtp_filter_bcast_delete: "
23386 				    "looked up bcast_ire %p\n",
23387 				    (void *)bcast_ire));
23388 				ipif_remove_ire(bcast_ire->ire_ipif,
23389 					bcast_ire);
23390 				ire_delete(bcast_ire);
23391 			}
23392 			ire_refrele(ire_prim);
23393 		}
23394 		ire_refrele(ire_dst);
23395 	}
23396 }
23397 
23398 /*
23399  * IPsec hardware acceleration capabilities related functions.
23400  */
23401 
23402 /*
23403  * Free a per-ill IPsec capabilities structure.
23404  */
23405 static void
23406 ill_ipsec_capab_free(ill_ipsec_capab_t *capab)
23407 {
23408 	if (capab->auth_hw_algs != NULL)
23409 		kmem_free(capab->auth_hw_algs, capab->algs_size);
23410 	if (capab->encr_hw_algs != NULL)
23411 		kmem_free(capab->encr_hw_algs, capab->algs_size);
23412 	if (capab->encr_algparm != NULL)
23413 		kmem_free(capab->encr_algparm, capab->encr_algparm_size);
23414 	kmem_free(capab, sizeof (ill_ipsec_capab_t));
23415 }
23416 
23417 /*
23418  * Allocate a new per-ill IPsec capabilities structure. This structure
23419  * is specific to an IPsec protocol (AH or ESP). It is implemented as
23420  * an array which specifies, for each algorithm, whether this algorithm
23421  * is supported by the ill or not.
23422  */
23423 static ill_ipsec_capab_t *
23424 ill_ipsec_capab_alloc(void)
23425 {
23426 	ill_ipsec_capab_t *capab;
23427 	uint_t nelems;
23428 
23429 	capab = kmem_zalloc(sizeof (ill_ipsec_capab_t), KM_NOSLEEP);
23430 	if (capab == NULL)
23431 		return (NULL);
23432 
23433 	/* we need one bit per algorithm */
23434 	nelems = MAX_IPSEC_ALGS / BITS(ipsec_capab_elem_t);
23435 	capab->algs_size = nelems * sizeof (ipsec_capab_elem_t);
23436 
23437 	/* allocate memory to store algorithm flags */
23438 	capab->encr_hw_algs = kmem_zalloc(capab->algs_size, KM_NOSLEEP);
23439 	if (capab->encr_hw_algs == NULL)
23440 		goto nomem;
23441 	capab->auth_hw_algs = kmem_zalloc(capab->algs_size, KM_NOSLEEP);
23442 	if (capab->auth_hw_algs == NULL)
23443 		goto nomem;
23444 	/*
23445 	 * Leave encr_algparm NULL for now since we won't need it half
23446 	 * the time
23447 	 */
23448 	return (capab);
23449 
23450 nomem:
23451 	ill_ipsec_capab_free(capab);
23452 	return (NULL);
23453 }
23454 
23455 /*
23456  * Resize capability array.  Since we're exclusive, this is OK.
23457  */
23458 static boolean_t
23459 ill_ipsec_capab_resize_algparm(ill_ipsec_capab_t *capab, int algid)
23460 {
23461 	ipsec_capab_algparm_t *nalp, *oalp;
23462 	uint32_t olen, nlen;
23463 
23464 	oalp = capab->encr_algparm;
23465 	olen = capab->encr_algparm_size;
23466 
23467 	if (oalp != NULL) {
23468 		if (algid < capab->encr_algparm_end)
23469 			return (B_TRUE);
23470 	}
23471 
23472 	nlen = (algid + 1) * sizeof (*nalp);
23473 	nalp = kmem_zalloc(nlen, KM_NOSLEEP);
23474 	if (nalp == NULL)
23475 		return (B_FALSE);
23476 
23477 	if (oalp != NULL) {
23478 		bcopy(oalp, nalp, olen);
23479 		kmem_free(oalp, olen);
23480 	}
23481 	capab->encr_algparm = nalp;
23482 	capab->encr_algparm_size = nlen;
23483 	capab->encr_algparm_end = algid + 1;
23484 
23485 	return (B_TRUE);
23486 }
23487 
23488 /*
23489  * Compare the capabilities of the specified ill with the protocol
23490  * and algorithms specified by the SA passed as argument.
23491  * If they match, returns B_TRUE, B_FALSE if they do not match.
23492  *
23493  * The ill can be passed as a pointer to it, or by specifying its index
23494  * and whether it is an IPv6 ill (ill_index and ill_isv6 arguments).
23495  *
23496  * Called by ipsec_out_is_accelerated() do decide whether an outbound
23497  * packet is eligible for hardware acceleration, and by
23498  * ill_ipsec_capab_send_all() to decide whether a SA must be sent down
23499  * to a particular ill.
23500  */
23501 boolean_t
23502 ipsec_capab_match(ill_t *ill, uint_t ill_index, boolean_t ill_isv6,
23503     ipsa_t *sa)
23504 {
23505 	boolean_t sa_isv6;
23506 	uint_t algid;
23507 	struct ill_ipsec_capab_s *cpp;
23508 	boolean_t need_refrele = B_FALSE;
23509 
23510 	if (ill == NULL) {
23511 		ill = ill_lookup_on_ifindex(ill_index, ill_isv6, NULL,
23512 		    NULL, NULL, NULL);
23513 		if (ill == NULL) {
23514 			ip0dbg(("ipsec_capab_match: ill doesn't exist\n"));
23515 			return (B_FALSE);
23516 		}
23517 		need_refrele = B_TRUE;
23518 	}
23519 
23520 	/*
23521 	 * Use the address length specified by the SA to determine
23522 	 * if it corresponds to a IPv6 address, and fail the matching
23523 	 * if the isv6 flag passed as argument does not match.
23524 	 * Note: this check is used for SADB capability checking before
23525 	 * sending SA information to an ill.
23526 	 */
23527 	sa_isv6 = (sa->ipsa_addrfam == AF_INET6);
23528 	if (sa_isv6 != ill_isv6)
23529 		/* protocol mismatch */
23530 		goto done;
23531 
23532 	/*
23533 	 * Check if the ill supports the protocol, algorithm(s) and
23534 	 * key size(s) specified by the SA, and get the pointers to
23535 	 * the algorithms supported by the ill.
23536 	 */
23537 	switch (sa->ipsa_type) {
23538 
23539 	case SADB_SATYPE_ESP:
23540 		if (!(ill->ill_capabilities & ILL_CAPAB_ESP))
23541 			/* ill does not support ESP acceleration */
23542 			goto done;
23543 		cpp = ill->ill_ipsec_capab_esp;
23544 		algid = sa->ipsa_auth_alg;
23545 		if (!IPSEC_ALG_IS_ENABLED(algid, cpp->auth_hw_algs))
23546 			goto done;
23547 		algid = sa->ipsa_encr_alg;
23548 		if (!IPSEC_ALG_IS_ENABLED(algid, cpp->encr_hw_algs))
23549 			goto done;
23550 		if (algid < cpp->encr_algparm_end) {
23551 			ipsec_capab_algparm_t *alp = &cpp->encr_algparm[algid];
23552 			if (sa->ipsa_encrkeybits < alp->minkeylen)
23553 				goto done;
23554 			if (sa->ipsa_encrkeybits > alp->maxkeylen)
23555 				goto done;
23556 		}
23557 		break;
23558 
23559 	case SADB_SATYPE_AH:
23560 		if (!(ill->ill_capabilities & ILL_CAPAB_AH))
23561 			/* ill does not support AH acceleration */
23562 			goto done;
23563 		if (!IPSEC_ALG_IS_ENABLED(sa->ipsa_auth_alg,
23564 		    ill->ill_ipsec_capab_ah->auth_hw_algs))
23565 			goto done;
23566 		break;
23567 	}
23568 
23569 	if (need_refrele)
23570 		ill_refrele(ill);
23571 	return (B_TRUE);
23572 done:
23573 	if (need_refrele)
23574 		ill_refrele(ill);
23575 	return (B_FALSE);
23576 }
23577 
23578 
23579 /*
23580  * Add a new ill to the list of IPsec capable ills.
23581  * Called from ill_capability_ipsec_ack() when an ACK was received
23582  * indicating that IPsec hardware processing was enabled for an ill.
23583  *
23584  * ill must point to the ill for which acceleration was enabled.
23585  * dl_cap must be set to DL_CAPAB_IPSEC_AH or DL_CAPAB_IPSEC_ESP.
23586  */
23587 static void
23588 ill_ipsec_capab_add(ill_t *ill, uint_t dl_cap, boolean_t sadb_resync)
23589 {
23590 	ipsec_capab_ill_t **ills, *cur_ill, *new_ill;
23591 	uint_t sa_type;
23592 	uint_t ipproto;
23593 
23594 	ASSERT((dl_cap == DL_CAPAB_IPSEC_AH) ||
23595 	    (dl_cap == DL_CAPAB_IPSEC_ESP));
23596 
23597 	switch (dl_cap) {
23598 	case DL_CAPAB_IPSEC_AH:
23599 		sa_type = SADB_SATYPE_AH;
23600 		ills = &ipsec_capab_ills_ah;
23601 		ipproto = IPPROTO_AH;
23602 		break;
23603 	case DL_CAPAB_IPSEC_ESP:
23604 		sa_type = SADB_SATYPE_ESP;
23605 		ills = &ipsec_capab_ills_esp;
23606 		ipproto = IPPROTO_ESP;
23607 		break;
23608 	}
23609 
23610 	rw_enter(&ipsec_capab_ills_lock, RW_WRITER);
23611 
23612 	/*
23613 	 * Add ill index to list of hardware accelerators. If
23614 	 * already in list, do nothing.
23615 	 */
23616 	for (cur_ill = *ills; cur_ill != NULL &&
23617 	    (cur_ill->ill_index != ill->ill_phyint->phyint_ifindex ||
23618 	    cur_ill->ill_isv6 != ill->ill_isv6); cur_ill = cur_ill->next)
23619 		;
23620 
23621 	if (cur_ill == NULL) {
23622 		/* if this is a new entry for this ill */
23623 		new_ill = kmem_zalloc(sizeof (ipsec_capab_ill_t), KM_NOSLEEP);
23624 		if (new_ill == NULL) {
23625 			rw_exit(&ipsec_capab_ills_lock);
23626 			return;
23627 		}
23628 
23629 		new_ill->ill_index = ill->ill_phyint->phyint_ifindex;
23630 		new_ill->ill_isv6 = ill->ill_isv6;
23631 		new_ill->next = *ills;
23632 		*ills = new_ill;
23633 	} else if (!sadb_resync) {
23634 		/* not resync'ing SADB and an entry exists for this ill */
23635 		rw_exit(&ipsec_capab_ills_lock);
23636 		return;
23637 	}
23638 
23639 	rw_exit(&ipsec_capab_ills_lock);
23640 
23641 	if (ipcl_proto_fanout_v6[ipproto].connf_head != NULL)
23642 		/*
23643 		 * IPsec module for protocol loaded, initiate dump
23644 		 * of the SADB to this ill.
23645 		 */
23646 		sadb_ill_download(ill, sa_type);
23647 }
23648 
23649 /*
23650  * Remove an ill from the list of IPsec capable ills.
23651  */
23652 static void
23653 ill_ipsec_capab_delete(ill_t *ill, uint_t dl_cap)
23654 {
23655 	ipsec_capab_ill_t **ills, *cur_ill, *prev_ill;
23656 
23657 	ASSERT(dl_cap == DL_CAPAB_IPSEC_AH ||
23658 	    dl_cap == DL_CAPAB_IPSEC_ESP);
23659 
23660 	ills = (dl_cap == DL_CAPAB_IPSEC_AH) ? &ipsec_capab_ills_ah :
23661 	    &ipsec_capab_ills_esp;
23662 
23663 	rw_enter(&ipsec_capab_ills_lock, RW_WRITER);
23664 
23665 	prev_ill = NULL;
23666 	for (cur_ill = *ills; cur_ill != NULL && (cur_ill->ill_index !=
23667 	    ill->ill_phyint->phyint_ifindex || cur_ill->ill_isv6 !=
23668 	    ill->ill_isv6); prev_ill = cur_ill, cur_ill = cur_ill->next)
23669 		;
23670 	if (cur_ill == NULL) {
23671 		/* entry not found */
23672 		rw_exit(&ipsec_capab_ills_lock);
23673 		return;
23674 	}
23675 	if (prev_ill == NULL) {
23676 		/* entry at front of list */
23677 		*ills = NULL;
23678 	} else {
23679 		prev_ill->next = cur_ill->next;
23680 	}
23681 	kmem_free(cur_ill, sizeof (ipsec_capab_ill_t));
23682 	rw_exit(&ipsec_capab_ills_lock);
23683 }
23684 
23685 
23686 /*
23687  * Handling of DL_CONTROL_REQ messages that must be sent down to
23688  * an ill while having exclusive access.
23689  */
23690 /* ARGSUSED */
23691 static void
23692 ill_ipsec_capab_send_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
23693 {
23694 	ill_t *ill = (ill_t *)q->q_ptr;
23695 
23696 	ill_dlpi_send(ill, mp);
23697 }
23698 
23699 
23700 /*
23701  * Called by SADB to send a DL_CONTROL_REQ message to every ill
23702  * supporting the specified IPsec protocol acceleration.
23703  * sa_type must be SADB_SATYPE_AH or SADB_SATYPE_ESP.
23704  * We free the mblk and, if sa is non-null, release the held referece.
23705  */
23706 void
23707 ill_ipsec_capab_send_all(uint_t sa_type, mblk_t *mp, ipsa_t *sa)
23708 {
23709 	ipsec_capab_ill_t *ici, *cur_ici;
23710 	ill_t *ill;
23711 	mblk_t *nmp, *mp_ship_list = NULL, *next_mp;
23712 
23713 	ici = (sa_type == SADB_SATYPE_AH) ? ipsec_capab_ills_ah :
23714 	    ipsec_capab_ills_esp;
23715 
23716 	rw_enter(&ipsec_capab_ills_lock, RW_READER);
23717 
23718 	for (cur_ici = ici; cur_ici != NULL; cur_ici = cur_ici->next) {
23719 		ill = ill_lookup_on_ifindex(cur_ici->ill_index,
23720 		    cur_ici->ill_isv6, NULL, NULL, NULL, NULL);
23721 
23722 		/*
23723 		 * Handle the case where the ill goes away while the SADB is
23724 		 * attempting to send messages.  If it's going away, it's
23725 		 * nuking its shadow SADB, so we don't care..
23726 		 */
23727 
23728 		if (ill == NULL)
23729 			continue;
23730 
23731 		if (sa != NULL) {
23732 			/*
23733 			 * Make sure capabilities match before
23734 			 * sending SA to ill.
23735 			 */
23736 			if (!ipsec_capab_match(ill, cur_ici->ill_index,
23737 			    cur_ici->ill_isv6, sa)) {
23738 				ill_refrele(ill);
23739 				continue;
23740 			}
23741 
23742 			mutex_enter(&sa->ipsa_lock);
23743 			sa->ipsa_flags |= IPSA_F_HW;
23744 			mutex_exit(&sa->ipsa_lock);
23745 		}
23746 
23747 		/*
23748 		 * Copy template message, and add it to the front
23749 		 * of the mblk ship list. We want to avoid holding
23750 		 * the ipsec_capab_ills_lock while sending the
23751 		 * message to the ills.
23752 		 *
23753 		 * The b_next and b_prev are temporarily used
23754 		 * to build a list of mblks to be sent down, and to
23755 		 * save the ill to which they must be sent.
23756 		 */
23757 		nmp = copymsg(mp);
23758 		if (nmp == NULL) {
23759 			ill_refrele(ill);
23760 			continue;
23761 		}
23762 		ASSERT(nmp->b_next == NULL && nmp->b_prev == NULL);
23763 		nmp->b_next = mp_ship_list;
23764 		mp_ship_list = nmp;
23765 		nmp->b_prev = (mblk_t *)ill;
23766 	}
23767 
23768 	rw_exit(&ipsec_capab_ills_lock);
23769 
23770 	nmp = mp_ship_list;
23771 	while (nmp != NULL) {
23772 		/* restore the mblk to a sane state */
23773 		next_mp = nmp->b_next;
23774 		nmp->b_next = NULL;
23775 		ill = (ill_t *)nmp->b_prev;
23776 		nmp->b_prev = NULL;
23777 
23778 		/*
23779 		 * Ship the mblk to the ill, must be exclusive. Keep the
23780 		 * reference to the ill as qwriter_ip() does a ill_referele().
23781 		 */
23782 		(void) qwriter_ip(NULL, ill, ill->ill_wq, nmp,
23783 		    ill_ipsec_capab_send_writer, NEW_OP, B_TRUE);
23784 
23785 		nmp = next_mp;
23786 	}
23787 
23788 	if (sa != NULL)
23789 		IPSA_REFRELE(sa);
23790 	freemsg(mp);
23791 }
23792 
23793 
23794 /*
23795  * Derive an interface id from the link layer address.
23796  * Knows about IEEE 802 and IEEE EUI-64 mappings.
23797  */
23798 static boolean_t
23799 ip_ether_v6intfid(uint_t phys_length, uint8_t *phys_addr, in6_addr_t *v6addr)
23800 {
23801 	char		*addr;
23802 
23803 	if (phys_length != ETHERADDRL)
23804 		return (B_FALSE);
23805 
23806 	/* Form EUI-64 like address */
23807 	addr = (char *)&v6addr->s6_addr32[2];
23808 	bcopy((char *)phys_addr, addr, 3);
23809 	addr[0] ^= 0x2;		/* Toggle Universal/Local bit */
23810 	addr[3] = (char)0xff;
23811 	addr[4] = (char)0xfe;
23812 	bcopy((char *)phys_addr + 3, addr + 5, 3);
23813 	return (B_TRUE);
23814 }
23815 
23816 /* ARGSUSED */
23817 static boolean_t
23818 ip_nodef_v6intfid(uint_t phys_length, uint8_t *phys_addr, in6_addr_t *v6addr)
23819 {
23820 	return (B_FALSE);
23821 }
23822 
23823 /* ARGSUSED */
23824 static boolean_t
23825 ip_ether_v6mapinfo(uint_t lla_length, uint8_t *bphys_addr, uint8_t *maddr,
23826     uint32_t *hw_start, in6_addr_t *v6_extract_mask)
23827 {
23828 	/*
23829 	 * Multicast address mappings used over Ethernet/802.X.
23830 	 * This address is used as a base for mappings.
23831 	 */
23832 	static uint8_t ipv6_g_phys_multi_addr[] = {0x33, 0x33, 0x00,
23833 	    0x00, 0x00, 0x00};
23834 
23835 	/*
23836 	 * Extract low order 32 bits from IPv6 multicast address.
23837 	 * Or that into the link layer address, starting from the
23838 	 * second byte.
23839 	 */
23840 	*hw_start = 2;
23841 	v6_extract_mask->s6_addr32[0] = 0;
23842 	v6_extract_mask->s6_addr32[1] = 0;
23843 	v6_extract_mask->s6_addr32[2] = 0;
23844 	v6_extract_mask->s6_addr32[3] = 0xffffffffU;
23845 	bcopy(ipv6_g_phys_multi_addr, maddr, lla_length);
23846 	return (B_TRUE);
23847 }
23848 
23849 /*
23850  * Indicate by return value whether multicast is supported. If not,
23851  * this code should not touch/change any parameters.
23852  */
23853 /* ARGSUSED */
23854 static boolean_t
23855 ip_ether_v4mapinfo(uint_t phys_length, uint8_t *bphys_addr, uint8_t *maddr,
23856     uint32_t *hw_start, ipaddr_t *extract_mask)
23857 {
23858 	/*
23859 	 * Multicast address mappings used over Ethernet/802.X.
23860 	 * This address is used as a base for mappings.
23861 	 */
23862 	static uint8_t ip_g_phys_multi_addr[] = { 0x01, 0x00, 0x5e,
23863 	    0x00, 0x00, 0x00 };
23864 
23865 	if (phys_length != ETHERADDRL)
23866 		return (B_FALSE);
23867 
23868 	*extract_mask = htonl(0x007fffff);
23869 	*hw_start = 2;
23870 	bcopy(ip_g_phys_multi_addr, maddr, ETHERADDRL);
23871 	return (B_TRUE);
23872 }
23873 
23874 /*
23875  * Derive IPoIB interface id from the link layer address.
23876  */
23877 static boolean_t
23878 ip_ib_v6intfid(uint_t phys_length, uint8_t *phys_addr, in6_addr_t *v6addr)
23879 {
23880 	char		*addr;
23881 
23882 	if (phys_length != 20)
23883 		return (B_FALSE);
23884 	addr = (char *)&v6addr->s6_addr32[2];
23885 	bcopy(phys_addr + 12, addr, 8);
23886 	/*
23887 	 * In IBA 1.1 timeframe, some vendors erroneously set the u/l bit
23888 	 * in the globally assigned EUI-64 GUID to 1, in violation of IEEE
23889 	 * rules. In these cases, the IBA considers these GUIDs to be in
23890 	 * "Modified EUI-64" format, and thus toggling the u/l bit is not
23891 	 * required; vendors are required not to assign global EUI-64's
23892 	 * that differ only in u/l bit values, thus guaranteeing uniqueness
23893 	 * of the interface identifier. Whether the GUID is in modified
23894 	 * or proper EUI-64 format, the ipv6 identifier must have the u/l
23895 	 * bit set to 1.
23896 	 */
23897 	addr[0] |= 2;			/* Set Universal/Local bit to 1 */
23898 	return (B_TRUE);
23899 }
23900 
23901 /*
23902  * Note on mapping from multicast IP addresses to IPoIB multicast link
23903  * addresses. IPoIB multicast link addresses are based on IBA link addresses.
23904  * The format of an IPoIB multicast address is:
23905  *
23906  *  4 byte QPN      Scope Sign.  Pkey
23907  * +--------------------------------------------+
23908  * | 00FFFFFF | FF | 1X | X01B | Pkey | GroupID |
23909  * +--------------------------------------------+
23910  *
23911  * The Scope and Pkey components are properties of the IBA port and
23912  * network interface. They can be ascertained from the broadcast address.
23913  * The Sign. part is the signature, and is 401B for IPv4 and 601B for IPv6.
23914  */
23915 
23916 static boolean_t
23917 ip_ib_v6mapinfo(uint_t lla_length, uint8_t *bphys_addr, uint8_t *maddr,
23918     uint32_t *hw_start, in6_addr_t *v6_extract_mask)
23919 {
23920 	/*
23921 	 * Base IPoIB IPv6 multicast address used for mappings.
23922 	 * Does not contain the IBA scope/Pkey values.
23923 	 */
23924 	static uint8_t ipv6_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
23925 	    0xff, 0x10, 0x60, 0x1b, 0x00, 0x00, 0x00, 0x00,
23926 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
23927 
23928 	/*
23929 	 * Extract low order 80 bits from IPv6 multicast address.
23930 	 * Or that into the link layer address, starting from the
23931 	 * sixth byte.
23932 	 */
23933 	*hw_start = 6;
23934 	bcopy(ipv6_g_phys_ibmulti_addr, maddr, lla_length);
23935 
23936 	/*
23937 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
23938 	 */
23939 	*(maddr + 5) = *(bphys_addr + 5);
23940 	*(maddr + 8) = *(bphys_addr + 8);
23941 	*(maddr + 9) = *(bphys_addr + 9);
23942 
23943 	v6_extract_mask->s6_addr32[0] = 0;
23944 	v6_extract_mask->s6_addr32[1] = htonl(0x0000ffff);
23945 	v6_extract_mask->s6_addr32[2] = 0xffffffffU;
23946 	v6_extract_mask->s6_addr32[3] = 0xffffffffU;
23947 	return (B_TRUE);
23948 }
23949 
23950 static boolean_t
23951 ip_ib_v4mapinfo(uint_t phys_length, uint8_t *bphys_addr, uint8_t *maddr,
23952     uint32_t *hw_start, ipaddr_t *extract_mask)
23953 {
23954 	/*
23955 	 * Base IPoIB IPv4 multicast address used for mappings.
23956 	 * Does not contain the IBA scope/Pkey values.
23957 	 */
23958 	static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
23959 	    0xff, 0x10, 0x40, 0x1b, 0x00, 0x00, 0x00, 0x00,
23960 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
23961 
23962 	if (phys_length != sizeof (ipv4_g_phys_ibmulti_addr))
23963 		return (B_FALSE);
23964 
23965 	/*
23966 	 * Extract low order 28 bits from IPv4 multicast address.
23967 	 * Or that into the link layer address, starting from the
23968 	 * sixteenth byte.
23969 	 */
23970 	*extract_mask = htonl(0x0fffffff);
23971 	*hw_start = 16;
23972 	bcopy(ipv4_g_phys_ibmulti_addr, maddr, phys_length);
23973 
23974 	/*
23975 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
23976 	 */
23977 	*(maddr + 5) = *(bphys_addr + 5);
23978 	*(maddr + 8) = *(bphys_addr + 8);
23979 	*(maddr + 9) = *(bphys_addr + 9);
23980 	return (B_TRUE);
23981 }
23982 
23983 /*
23984  * Returns B_TRUE if an ipif is present in the given zone, matching some flags
23985  * (typically IPIF_UP). If ipifp is non-null, the held ipif is returned there.
23986  * This works for both IPv4 and IPv6; if the passed-in ill is v6, the ipif with
23987  * the link-local address is preferred.
23988  */
23989 boolean_t
23990 ipif_lookup_zoneid(ill_t *ill, zoneid_t zoneid, int flags, ipif_t **ipifp)
23991 {
23992 	ipif_t	*ipif;
23993 	ipif_t	*maybe_ipif = NULL;
23994 
23995 	mutex_enter(&ill->ill_lock);
23996 	if (ill->ill_state_flags & ILL_CONDEMNED) {
23997 		mutex_exit(&ill->ill_lock);
23998 		if (ipifp != NULL)
23999 			*ipifp = NULL;
24000 		return (B_FALSE);
24001 	}
24002 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
24003 		if (!IPIF_CAN_LOOKUP(ipif))
24004 			continue;
24005 		if (zoneid != ALL_ZONES && ipif->ipif_zoneid != zoneid &&
24006 		    ipif->ipif_zoneid != ALL_ZONES)
24007 			continue;
24008 		if ((ipif->ipif_flags & flags) != flags)
24009 			continue;
24010 
24011 		if (ipifp == NULL) {
24012 			mutex_exit(&ill->ill_lock);
24013 			ASSERT(maybe_ipif == NULL);
24014 			return (B_TRUE);
24015 		}
24016 		if (!ill->ill_isv6 ||
24017 		    IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6src_addr)) {
24018 			ipif_refhold_locked(ipif);
24019 			mutex_exit(&ill->ill_lock);
24020 			*ipifp = ipif;
24021 			return (B_TRUE);
24022 		}
24023 		if (maybe_ipif == NULL)
24024 			maybe_ipif = ipif;
24025 	}
24026 	if (ipifp != NULL) {
24027 		if (maybe_ipif != NULL)
24028 			ipif_refhold_locked(maybe_ipif);
24029 		*ipifp = maybe_ipif;
24030 	}
24031 	mutex_exit(&ill->ill_lock);
24032 	return (maybe_ipif != NULL);
24033 }
24034 
24035 /*
24036  * Same as ipif_lookup_zoneid() but looks at all the ills in the same group.
24037  */
24038 boolean_t
24039 ipif_lookup_zoneid_group(ill_t *ill, zoneid_t zoneid, int flags, ipif_t **ipifp)
24040 {
24041 	ill_t *illg;
24042 
24043 	/*
24044 	 * We look at the passed-in ill first without grabbing ill_g_lock.
24045 	 */
24046 	if (ipif_lookup_zoneid(ill, zoneid, flags, ipifp)) {
24047 		return (B_TRUE);
24048 	}
24049 	rw_enter(&ill_g_lock, RW_READER);
24050 	if (ill->ill_group == NULL) {
24051 		/* ill not in a group */
24052 		rw_exit(&ill_g_lock);
24053 		return (B_FALSE);
24054 	}
24055 
24056 	/*
24057 	 * There's no ipif in the zone on ill, however ill is part of an IPMP
24058 	 * group. We need to look for an ipif in the zone on all the ills in the
24059 	 * group.
24060 	 */
24061 	illg = ill->ill_group->illgrp_ill;
24062 	do {
24063 		/*
24064 		 * We don't call ipif_lookup_zoneid() on ill as we already know
24065 		 * that it's not there.
24066 		 */
24067 		if (illg != ill &&
24068 		    ipif_lookup_zoneid(illg, zoneid, flags, ipifp)) {
24069 			break;
24070 		}
24071 	} while ((illg = illg->ill_group_next) != NULL);
24072 	rw_exit(&ill_g_lock);
24073 	return (illg != NULL);
24074 }
24075 
24076 /*
24077  * Check if this ill is only being used to send ICMP probes for IPMP
24078  */
24079 boolean_t
24080 ill_is_probeonly(ill_t *ill)
24081 {
24082 	/*
24083 	 * Check if the interface is FAILED, or INACTIVE
24084 	 */
24085 	if (ill->ill_phyint->phyint_flags & (PHYI_FAILED|PHYI_INACTIVE))
24086 		return (B_TRUE);
24087 
24088 	return (B_FALSE);
24089 }
24090 
24091 /*
24092  * Return a pointer to an ipif_t given a combination of (ill_idx,ipif_id)
24093  * If a pointer to an ipif_t is returned then the caller will need to do
24094  * an ill_refrele().
24095  */
24096 ipif_t *
24097 ipif_getby_indexes(uint_t ifindex, uint_t lifidx, boolean_t isv6)
24098 {
24099 	ipif_t *ipif;
24100 	ill_t *ill;
24101 
24102 	ill = ill_lookup_on_ifindex(ifindex, isv6, NULL, NULL, NULL, NULL);
24103 
24104 	if (ill == NULL)
24105 		return (NULL);
24106 
24107 	mutex_enter(&ill->ill_lock);
24108 	if (ill->ill_state_flags & ILL_CONDEMNED) {
24109 		mutex_exit(&ill->ill_lock);
24110 		ill_refrele(ill);
24111 		return (NULL);
24112 	}
24113 
24114 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
24115 		if (!IPIF_CAN_LOOKUP(ipif))
24116 			continue;
24117 		if (lifidx == ipif->ipif_id) {
24118 			ipif_refhold_locked(ipif);
24119 			break;
24120 		}
24121 	}
24122 
24123 	mutex_exit(&ill->ill_lock);
24124 	ill_refrele(ill);
24125 	return (ipif);
24126 }
24127