xref: /titanic_50/usr/src/uts/common/inet/ip/ip_if.c (revision 69bb4bb45c98da60d21839c4dc3c01ea1be60585)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /* Copyright (c) 1990 Mentat Inc. */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 /*
30  * This file contains the interface control functions for IP.
31  */
32 
33 #include <sys/types.h>
34 #include <sys/stream.h>
35 #include <sys/dlpi.h>
36 #include <sys/stropts.h>
37 #include <sys/strsun.h>
38 #include <sys/sysmacros.h>
39 #include <sys/strlog.h>
40 #include <sys/ddi.h>
41 #include <sys/sunddi.h>
42 #include <sys/cmn_err.h>
43 #include <sys/kstat.h>
44 #include <sys/debug.h>
45 #include <sys/zone.h>
46 
47 #include <sys/kmem.h>
48 #include <sys/systm.h>
49 #include <sys/param.h>
50 #include <sys/socket.h>
51 #include <sys/isa_defs.h>
52 #include <net/if.h>
53 #include <net/if_arp.h>
54 #include <net/if_types.h>
55 #include <net/if_dl.h>
56 #include <net/route.h>
57 #include <sys/sockio.h>
58 #include <netinet/in.h>
59 #include <netinet/ip6.h>
60 #include <netinet/icmp6.h>
61 #include <netinet/igmp_var.h>
62 #include <sys/strsun.h>
63 #include <sys/policy.h>
64 #include <sys/ethernet.h>
65 
66 #include <inet/common.h>   /* for various inet/mi.h and inet/nd.h needs */
67 #include <inet/mi.h>
68 #include <inet/nd.h>
69 #include <inet/arp.h>
70 #include <inet/mib2.h>
71 #include <inet/ip.h>
72 #include <inet/ip6.h>
73 #include <inet/ip6_asp.h>
74 #include <inet/tcp.h>
75 #include <inet/ip_multi.h>
76 #include <inet/ip_ire.h>
77 #include <inet/ip_ftable.h>
78 #include <inet/ip_rts.h>
79 #include <inet/ip_ndp.h>
80 #include <inet/ip_if.h>
81 #include <inet/ip_impl.h>
82 #include <inet/tun.h>
83 #include <inet/sctp_ip.h>
84 
85 #include <net/pfkeyv2.h>
86 #include <inet/ipsec_info.h>
87 #include <inet/sadb.h>
88 #include <inet/ipsec_impl.h>
89 #include <sys/iphada.h>
90 
91 
92 #include <netinet/igmp.h>
93 #include <inet/ip_listutils.h>
94 #include <inet/ipclassifier.h>
95 #include <sys/mac.h>
96 
97 #include <sys/systeminfo.h>
98 #include <sys/bootconf.h>
99 
100 #include <sys/tsol/tndb.h>
101 #include <sys/tsol/tnet.h>
102 
103 /* The character which tells where the ill_name ends */
104 #define	IPIF_SEPARATOR_CHAR	':'
105 
106 /* IP ioctl function table entry */
107 typedef struct ipft_s {
108 	int	ipft_cmd;
109 	pfi_t	ipft_pfi;
110 	int	ipft_min_size;
111 	int	ipft_flags;
112 } ipft_t;
113 #define	IPFT_F_NO_REPLY		0x1	/* IP ioctl does not expect any reply */
114 #define	IPFT_F_SELF_REPLY	0x2	/* ioctl callee does the ioctl reply */
115 
116 typedef struct ip_sock_ar_s {
117 	union {
118 		area_t	ip_sock_area;
119 		ared_t	ip_sock_ared;
120 		areq_t	ip_sock_areq;
121 	} ip_sock_ar_u;
122 	queue_t	*ip_sock_ar_q;
123 } ip_sock_ar_t;
124 
125 static int	nd_ill_forward_get(queue_t *, mblk_t *, caddr_t, cred_t *);
126 static int	nd_ill_forward_set(queue_t *q, mblk_t *mp,
127 		    char *value, caddr_t cp, cred_t *ioc_cr);
128 
129 static boolean_t ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask);
130 static ip_m_t	*ip_m_lookup(t_uscalar_t mac_type);
131 static int	ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
132     mblk_t *mp, boolean_t need_up);
133 static int	ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
134     mblk_t *mp, boolean_t need_up);
135 static int	ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
136     queue_t *q, mblk_t *mp, boolean_t need_up);
137 static int	ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q,
138     mblk_t *mp, boolean_t need_up);
139 static int	ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
140     mblk_t *mp);
141 static int	ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t, in6_addr_t,
142     queue_t *q, mblk_t *mp, boolean_t need_up);
143 static int	ip_sioctl_arp_common(ill_t *ill, queue_t *q, mblk_t *mp,
144     sin_t *sin, boolean_t x_arp_ioctl, boolean_t if_arp_ioctl);
145 static ipaddr_t	ip_subnet_mask(ipaddr_t addr, ipif_t **);
146 static void	ip_wput_ioctl(queue_t *q, mblk_t *mp);
147 static void	ipsq_flush(ill_t *ill);
148 static void	ipsq_clean_all(ill_t *ill);
149 static void	ipsq_clean_ring(ill_t *ill, ill_rx_ring_t *rx_ring);
150 static	int	ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen,
151     queue_t *q, mblk_t *mp, boolean_t need_up);
152 static void	ipsq_delete(ipsq_t *);
153 
154 static ipif_t	*ipif_allocate(ill_t *ill, int id, uint_t ire_type,
155 		    boolean_t initialize);
156 static void	ipif_check_bcast_ires(ipif_t *test_ipif);
157 static void	ipif_down_delete_ire(ire_t *ire, char *ipif);
158 static void	ipif_delete_cache_ire(ire_t *, char *);
159 static int	ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp);
160 static void	ipif_free(ipif_t *ipif);
161 static void	ipif_free_tail(ipif_t *ipif);
162 static void	ipif_mtu_change(ire_t *ire, char *ipif_arg);
163 static void	ipif_multicast_down(ipif_t *ipif);
164 static void	ipif_recreate_interface_routes(ipif_t *old_ipif, ipif_t *ipif);
165 static void	ipif_set_default(ipif_t *ipif);
166 static int	ipif_set_values(queue_t *q, mblk_t *mp,
167     char *interf_name, uint_t *ppa);
168 static int	ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp,
169     queue_t *q);
170 static ipif_t	*ipif_lookup_on_name(char *name, size_t namelen,
171     boolean_t do_alloc, boolean_t *exists, boolean_t isv6, zoneid_t zoneid,
172     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error);
173 static int	ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp);
174 static void	ipif_update_other_ipifs(ipif_t *old_ipif, ill_group_t *illgrp);
175 
176 static int	ill_alloc_ppa(ill_if_t *, ill_t *);
177 static int	ill_arp_off(ill_t *ill);
178 static int	ill_arp_on(ill_t *ill);
179 static void	ill_delete_interface_type(ill_if_t *);
180 static int	ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q);
181 static void	ill_dl_down(ill_t *ill);
182 static void	ill_down(ill_t *ill);
183 static void	ill_downi(ire_t *ire, char *ill_arg);
184 static void	ill_downi_mrtun_srcif(ire_t *ire, char *ill_arg);
185 static void	ill_down_tail(ill_t *ill);
186 static void	ill_free_mib(ill_t *ill);
187 static void	ill_glist_delete(ill_t *);
188 static boolean_t ill_has_usable_ipif(ill_t *);
189 static int	ill_lock_ipsq_ills(ipsq_t *sq, ill_t **list, int);
190 static void	ill_nominate_bcast_rcv(ill_group_t *illgrp);
191 static void	ill_phyint_free(ill_t *ill);
192 static void	ill_phyint_reinit(ill_t *ill);
193 static void	ill_set_nce_router_flags(ill_t *, boolean_t);
194 static void	ill_signal_ipsq_ills(ipsq_t *, boolean_t);
195 static boolean_t ill_split_ipsq(ipsq_t *cur_sq);
196 static void	ill_stq_cache_delete(ire_t *, char *);
197 
198 static boolean_t ip_ether_v6intfid(uint_t, uint8_t *, in6_addr_t *);
199 static boolean_t ip_nodef_v6intfid(uint_t, uint8_t *, in6_addr_t *);
200 static boolean_t ip_ether_v6mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
201     in6_addr_t *);
202 static boolean_t ip_ether_v4mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
203     ipaddr_t *);
204 static boolean_t ip_ib_v6intfid(uint_t, uint8_t *, in6_addr_t *);
205 static boolean_t ip_ib_v6mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
206     in6_addr_t *);
207 static boolean_t ip_ib_v4mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
208     ipaddr_t *);
209 
210 static void	ipif_save_ire(ipif_t *, ire_t *);
211 static void	ipif_remove_ire(ipif_t *, ire_t *);
212 static void 	ip_cgtp_bcast_add(ire_t *, ire_t *);
213 static void 	ip_cgtp_bcast_delete(ire_t *);
214 
215 /*
216  * Per-ill IPsec capabilities management.
217  */
218 static ill_ipsec_capab_t *ill_ipsec_capab_alloc(void);
219 static void	ill_ipsec_capab_free(ill_ipsec_capab_t *);
220 static void	ill_ipsec_capab_add(ill_t *, uint_t, boolean_t);
221 static void	ill_ipsec_capab_delete(ill_t *, uint_t);
222 static boolean_t ill_ipsec_capab_resize_algparm(ill_ipsec_capab_t *, int);
223 static void ill_capability_proto(ill_t *, int, mblk_t *);
224 static void ill_capability_dispatch(ill_t *, mblk_t *, dl_capability_sub_t *,
225     boolean_t);
226 static void ill_capability_id_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
227 static void ill_capability_mdt_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
228 static void ill_capability_mdt_reset(ill_t *, mblk_t **);
229 static void ill_capability_ipsec_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
230 static void ill_capability_ipsec_reset(ill_t *, mblk_t **);
231 static void ill_capability_hcksum_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
232 static void ill_capability_hcksum_reset(ill_t *, mblk_t **);
233 static void ill_capability_zerocopy_ack(ill_t *, mblk_t *,
234     dl_capability_sub_t *);
235 static void ill_capability_zerocopy_reset(ill_t *, mblk_t **);
236 
237 static void ill_capability_dls_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
238 static mac_resource_handle_t ill_ring_add(void *, mac_resource_t *);
239 static void ill_capability_dls_reset(ill_t *, mblk_t **);
240 static void ill_capability_dls_disable(ill_t *);
241 
242 static void	illgrp_cache_delete(ire_t *, char *);
243 static void	illgrp_delete(ill_t *ill);
244 static void	illgrp_reset_schednext(ill_t *ill);
245 
246 static ill_t	*ill_prev_usesrc(ill_t *);
247 static int	ill_relink_usesrc_ills(ill_t *, ill_t *, uint_t);
248 static void	ill_disband_usesrc_group(ill_t *);
249 
250 static void	conn_cleanup_stale_ire(conn_t *, caddr_t);
251 
252 /*
253  * if we go over the memory footprint limit more than once in this msec
254  * interval, we'll start pruning aggressively.
255  */
256 int ip_min_frag_prune_time = 0;
257 
258 /*
259  * max # of IPsec algorithms supported.  Limited to 1 byte by PF_KEY
260  * and the IPsec DOI
261  */
262 #define	MAX_IPSEC_ALGS	256
263 
264 #define	BITSPERBYTE	8
265 #define	BITS(type)	(BITSPERBYTE * (long)sizeof (type))
266 
267 #define	IPSEC_ALG_ENABLE(algs, algid) \
268 		((algs)[(algid) / BITS(ipsec_capab_elem_t)] |= \
269 		(1 << ((algid) % BITS(ipsec_capab_elem_t))))
270 
271 #define	IPSEC_ALG_IS_ENABLED(algid, algs) \
272 		((algs)[(algid) / BITS(ipsec_capab_elem_t)] & \
273 		(1 << ((algid) % BITS(ipsec_capab_elem_t))))
274 
275 typedef uint8_t ipsec_capab_elem_t;
276 
277 /*
278  * Per-algorithm parameters.  Note that at present, only encryption
279  * algorithms have variable keysize (IKE does not provide a way to negotiate
280  * auth algorithm keysize).
281  *
282  * All sizes here are in bits.
283  */
284 typedef struct
285 {
286 	uint16_t	minkeylen;
287 	uint16_t	maxkeylen;
288 } ipsec_capab_algparm_t;
289 
290 /*
291  * Per-ill capabilities.
292  */
293 struct ill_ipsec_capab_s {
294 	ipsec_capab_elem_t *encr_hw_algs;
295 	ipsec_capab_elem_t *auth_hw_algs;
296 	uint32_t algs_size;	/* size of _hw_algs in bytes */
297 	/* algorithm key lengths */
298 	ipsec_capab_algparm_t *encr_algparm;
299 	uint32_t encr_algparm_size;
300 	uint32_t encr_algparm_end;
301 };
302 
303 /*
304  * List of AH and ESP IPsec acceleration capable ills
305  */
306 typedef struct ipsec_capab_ill_s {
307 	uint_t ill_index;
308 	boolean_t ill_isv6;
309 	struct ipsec_capab_ill_s *next;
310 } ipsec_capab_ill_t;
311 
312 static ipsec_capab_ill_t *ipsec_capab_ills_ah;
313 static ipsec_capab_ill_t *ipsec_capab_ills_esp;
314 krwlock_t ipsec_capab_ills_lock;
315 
316 /*
317  * The field values are larger than strictly necessary for simple
318  * AR_ENTRY_ADDs but the padding lets us accomodate the socket ioctls.
319  */
320 static area_t	ip_area_template = {
321 	AR_ENTRY_ADD,			/* area_cmd */
322 	sizeof (ip_sock_ar_t) + (IP_ADDR_LEN*2) + sizeof (struct sockaddr_dl),
323 					/* area_name_offset */
324 	/* area_name_length temporarily holds this structure length */
325 	sizeof (area_t),			/* area_name_length */
326 	IP_ARP_PROTO_TYPE,		/* area_proto */
327 	sizeof (ip_sock_ar_t),		/* area_proto_addr_offset */
328 	IP_ADDR_LEN,			/* area_proto_addr_length */
329 	sizeof (ip_sock_ar_t) + IP_ADDR_LEN,
330 					/* area_proto_mask_offset */
331 	0,				/* area_flags */
332 	sizeof (ip_sock_ar_t) + IP_ADDR_LEN + IP_ADDR_LEN,
333 					/* area_hw_addr_offset */
334 	/* Zero length hw_addr_length means 'use your idea of the address' */
335 	0				/* area_hw_addr_length */
336 };
337 
338 /*
339  * AR_ENTRY_ADD/DELETE templates have been added for IPv6 external resolver
340  * support
341  */
342 static area_t	ip6_area_template = {
343 	AR_ENTRY_ADD,			/* area_cmd */
344 	sizeof (ip_sock_ar_t) + (IPV6_ADDR_LEN*2) + sizeof (sin6_t),
345 					/* area_name_offset */
346 	/* area_name_length temporarily holds this structure length */
347 	sizeof (area_t),			/* area_name_length */
348 	IP_ARP_PROTO_TYPE,		/* area_proto */
349 	sizeof (ip_sock_ar_t),		/* area_proto_addr_offset */
350 	IPV6_ADDR_LEN,			/* area_proto_addr_length */
351 	sizeof (ip_sock_ar_t) + IPV6_ADDR_LEN,
352 					/* area_proto_mask_offset */
353 	0,				/* area_flags */
354 	sizeof (ip_sock_ar_t) + IPV6_ADDR_LEN + IPV6_ADDR_LEN,
355 					/* area_hw_addr_offset */
356 	/* Zero length hw_addr_length means 'use your idea of the address' */
357 	0				/* area_hw_addr_length */
358 };
359 
360 static ared_t	ip_ared_template = {
361 	AR_ENTRY_DELETE,
362 	sizeof (ared_t) + IP_ADDR_LEN,
363 	sizeof (ared_t),
364 	IP_ARP_PROTO_TYPE,
365 	sizeof (ared_t),
366 	IP_ADDR_LEN
367 };
368 
369 static ared_t	ip6_ared_template = {
370 	AR_ENTRY_DELETE,
371 	sizeof (ared_t) + IPV6_ADDR_LEN,
372 	sizeof (ared_t),
373 	IP_ARP_PROTO_TYPE,
374 	sizeof (ared_t),
375 	IPV6_ADDR_LEN
376 };
377 
378 /*
379  * A template for an IPv6 AR_ENTRY_QUERY template has not been created, as
380  * as the areq doesn't include an IP address in ill_dl_up() (the only place a
381  * areq is used).
382  */
383 static areq_t	ip_areq_template = {
384 	AR_ENTRY_QUERY,			/* cmd */
385 	sizeof (areq_t)+(2*IP_ADDR_LEN),	/* name offset */
386 	sizeof (areq_t),	/* name len (filled by ill_arp_alloc) */
387 	IP_ARP_PROTO_TYPE,		/* protocol, from arps perspective */
388 	sizeof (areq_t),			/* target addr offset */
389 	IP_ADDR_LEN,			/* target addr_length */
390 	0,				/* flags */
391 	sizeof (areq_t) + IP_ADDR_LEN,	/* sender addr offset */
392 	IP_ADDR_LEN,			/* sender addr length */
393 	6,				/* xmit_count */
394 	1000,				/* (re)xmit_interval in milliseconds */
395 	4				/* max # of requests to buffer */
396 	/* anything else filled in by the code */
397 };
398 
399 static arc_t	ip_aru_template = {
400 	AR_INTERFACE_UP,
401 	sizeof (arc_t),		/* Name offset */
402 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
403 };
404 
405 static arc_t	ip_ard_template = {
406 	AR_INTERFACE_DOWN,
407 	sizeof (arc_t),		/* Name offset */
408 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
409 };
410 
411 static arc_t	ip_aron_template = {
412 	AR_INTERFACE_ON,
413 	sizeof (arc_t),		/* Name offset */
414 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
415 };
416 
417 static arc_t	ip_aroff_template = {
418 	AR_INTERFACE_OFF,
419 	sizeof (arc_t),		/* Name offset */
420 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
421 };
422 
423 
424 static arma_t	ip_arma_multi_template = {
425 	AR_MAPPING_ADD,
426 	sizeof (arma_t) + 3*IP_ADDR_LEN + IP_MAX_HW_LEN,
427 				/* Name offset */
428 	sizeof (arma_t),	/* Name length (set by ill_arp_alloc) */
429 	IP_ARP_PROTO_TYPE,
430 	sizeof (arma_t),			/* proto_addr_offset */
431 	IP_ADDR_LEN,				/* proto_addr_length */
432 	sizeof (arma_t) + IP_ADDR_LEN,		/* proto_mask_offset */
433 	sizeof (arma_t) + 2*IP_ADDR_LEN,	/* proto_extract_mask_offset */
434 	ACE_F_PERMANENT | ACE_F_MAPPING,	/* flags */
435 	sizeof (arma_t) + 3*IP_ADDR_LEN,	/* hw_addr_offset */
436 	IP_MAX_HW_LEN,				/* hw_addr_length */
437 	0,					/* hw_mapping_start */
438 };
439 
440 static ipft_t	ip_ioctl_ftbl[] = {
441 	{ IP_IOC_IRE_DELETE, ip_ire_delete, sizeof (ipid_t), 0 },
442 	{ IP_IOC_IRE_DELETE_NO_REPLY, ip_ire_delete, sizeof (ipid_t),
443 		IPFT_F_NO_REPLY },
444 	{ IP_IOC_IRE_ADVISE_NO_REPLY, ip_ire_advise, sizeof (ipic_t),
445 		IPFT_F_NO_REPLY },
446 	{ IP_IOC_RTS_REQUEST, ip_rts_request, 0, IPFT_F_SELF_REPLY },
447 	{ 0 }
448 };
449 
450 /* Simple ICMP IP Header Template */
451 static ipha_t icmp_ipha = {
452 	IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
453 };
454 
455 /* Flag descriptors for ip_ipif_report */
456 static nv_t	ipif_nv_tbl[] = {
457 	{ IPIF_UP,		"UP" },
458 	{ IPIF_BROADCAST,	"BROADCAST" },
459 	{ ILLF_DEBUG,		"DEBUG" },
460 	{ PHYI_LOOPBACK,	"LOOPBACK" },
461 	{ IPIF_POINTOPOINT,	"POINTOPOINT" },
462 	{ ILLF_NOTRAILERS,	"NOTRAILERS" },
463 	{ PHYI_RUNNING,		"RUNNING" },
464 	{ ILLF_NOARP,		"NOARP" },
465 	{ PHYI_PROMISC,		"PROMISC" },
466 	{ PHYI_ALLMULTI,	"ALLMULTI" },
467 	{ PHYI_INTELLIGENT,	"INTELLIGENT" },
468 	{ ILLF_MULTICAST,	"MULTICAST" },
469 	{ PHYI_MULTI_BCAST,	"MULTI_BCAST" },
470 	{ IPIF_UNNUMBERED,	"UNNUMBERED" },
471 	{ IPIF_DHCPRUNNING,	"DHCP" },
472 	{ IPIF_PRIVATE,		"PRIVATE" },
473 	{ IPIF_NOXMIT,		"NOXMIT" },
474 	{ IPIF_NOLOCAL,		"NOLOCAL" },
475 	{ IPIF_DEPRECATED,	"DEPRECATED" },
476 	{ IPIF_PREFERRED,	"PREFERRED" },
477 	{ IPIF_TEMPORARY,	"TEMPORARY" },
478 	{ IPIF_ADDRCONF,	"ADDRCONF" },
479 	{ PHYI_VIRTUAL,		"VIRTUAL" },
480 	{ ILLF_ROUTER,		"ROUTER" },
481 	{ ILLF_NONUD,		"NONUD" },
482 	{ IPIF_ANYCAST,		"ANYCAST" },
483 	{ ILLF_NORTEXCH,	"NORTEXCH" },
484 	{ ILLF_IPV4,		"IPV4" },
485 	{ ILLF_IPV6,		"IPV6" },
486 	{ IPIF_MIPRUNNING,	"MIP" },
487 	{ IPIF_NOFAILOVER,	"NOFAILOVER" },
488 	{ PHYI_FAILED,		"FAILED" },
489 	{ PHYI_STANDBY,		"STANDBY" },
490 	{ PHYI_INACTIVE,	"INACTIVE" },
491 	{ PHYI_OFFLINE,		"OFFLINE" },
492 };
493 
494 static uchar_t	ip_six_byte_all_ones[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
495 
496 static ip_m_t	ip_m_tbl[] = {
497 	{ DL_ETHER, IFT_ETHER, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
498 	    ip_ether_v6intfid },
499 	{ DL_CSMACD, IFT_ISO88023, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
500 	    ip_nodef_v6intfid },
501 	{ DL_TPB, IFT_ISO88024, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
502 	    ip_nodef_v6intfid },
503 	{ DL_TPR, IFT_ISO88025, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
504 	    ip_nodef_v6intfid },
505 	{ DL_FDDI, IFT_FDDI, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
506 	    ip_ether_v6intfid },
507 	{ DL_IB, IFT_IB, ip_ib_v4mapinfo, ip_ib_v6mapinfo,
508 	    ip_ib_v6intfid },
509 	{ SUNW_DL_VNI, IFT_OTHER, NULL, NULL, NULL},
510 	{ DL_OTHER, IFT_OTHER, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
511 	    ip_nodef_v6intfid }
512 };
513 
514 static ill_t	ill_null;		/* Empty ILL for init. */
515 char	ipif_loopback_name[] = "lo0";
516 static char *ipv4_forward_suffix = ":ip_forwarding";
517 static char *ipv6_forward_suffix = ":ip6_forwarding";
518 static kstat_t *loopback_ksp = NULL;
519 static	sin6_t	sin6_null;	/* Zero address for quick clears */
520 static	sin_t	sin_null;	/* Zero address for quick clears */
521 static	uint_t	ill_index = 1;	/* Used to assign interface indicies */
522 /* When set search for unused index */
523 static boolean_t ill_index_wrap = B_FALSE;
524 /* When set search for unused ipif_seqid */
525 static ipif_t	ipif_zero;
526 uint_t	ipif_src_random;
527 
528 /*
529  * For details on the protection offered by these locks please refer
530  * to the notes under the Synchronization section at the start of ip.c
531  */
532 krwlock_t	ill_g_lock;		/* The global ill_g_lock */
533 kmutex_t	ip_addr_avail_lock;	/* Address availability check lock */
534 ipsq_t		*ipsq_g_head;		/* List of all ipsq's on the system */
535 
536 krwlock_t	ill_g_usesrc_lock;	/* Protects usesrc related fields */
537 
538 /*
539  * illgrp_head/ifgrp_head is protected by IP's perimeter.
540  */
541 static  ill_group_t *illgrp_head_v4;	/* Head of IPv4 ill groups */
542 ill_group_t *illgrp_head_v6;		/* Head of IPv6 ill groups */
543 
544 ill_g_head_t	ill_g_heads[MAX_G_HEADS];   /* ILL List Head */
545 
546 /*
547  * ppa arena is created after these many
548  * interfaces have been plumbed.
549  */
550 uint_t	ill_no_arena = 12;
551 
552 #pragma align CACHE_ALIGN_SIZE(phyint_g_list)
553 static phyint_list_t phyint_g_list;	/* start of phyint list */
554 
555 /*
556  * Reflects value of FAILBACK variable in IPMP config file
557  * /etc/default/mpathd. Default value is B_TRUE.
558  * Set to B_FALSE if user disabled failback by configuring "FAILBACK=no"
559  * in.mpathd uses SIOCSIPMPFAILBACK ioctl to pass this information to kernel.
560  */
561 static boolean_t ipmp_enable_failback = B_TRUE;
562 
563 /*
564  * Enable soft rings if ip_squeue_soft_ring or ip_squeue_fanout
565  * is set and ip_soft_rings_cnt > 0. ip_squeue_soft_ring is
566  * set through platform specific code (Niagara/Ontario).
567  */
568 #define	SOFT_RINGS_ENABLED()	(ip_soft_rings_cnt ? \
569 		(ip_squeue_soft_ring || ip_squeue_fanout) : B_FALSE)
570 
571 #define	ILL_CAPAB_DLS	(ILL_CAPAB_SOFT_RING | ILL_CAPAB_POLL)
572 
573 static uint_t
574 ipif_rand(void)
575 {
576 	ipif_src_random = ipif_src_random * 1103515245 + 12345;
577 	return ((ipif_src_random >> 16) & 0x7fff);
578 }
579 
580 /*
581  * Allocate per-interface mibs. Only used for ipv6.
582  * Returns true if ok. False otherwise.
583  *  ipsq  may not yet be allocated (loopback case ).
584  */
585 static boolean_t
586 ill_allocate_mibs(ill_t *ill)
587 {
588 	ASSERT(ill->ill_isv6);
589 
590 	/* Already allocated? */
591 	if (ill->ill_ip6_mib != NULL) {
592 		ASSERT(ill->ill_icmp6_mib != NULL);
593 		return (B_TRUE);
594 	}
595 
596 	ill->ill_ip6_mib = kmem_zalloc(sizeof (*ill->ill_ip6_mib),
597 	    KM_NOSLEEP);
598 	if (ill->ill_ip6_mib == NULL) {
599 		return (B_FALSE);
600 	}
601 	ill->ill_icmp6_mib = kmem_zalloc(sizeof (*ill->ill_icmp6_mib),
602 	    KM_NOSLEEP);
603 	if (ill->ill_icmp6_mib == NULL) {
604 		kmem_free(ill->ill_ip6_mib, sizeof (*ill->ill_ip6_mib));
605 		ill->ill_ip6_mib = NULL;
606 		return (B_FALSE);
607 	}
608 	/*
609 	 * The ipv6Ifindex and ipv6IfIcmpIndex will be assigned later
610 	 * after the phyint merge occurs in ipif_set_values -> ill_glist_insert
611 	 * -> ill_phyint_reinit
612 	 */
613 	return (B_TRUE);
614 }
615 
616 /*
617  * Common code for preparation of ARP commands.  Two points to remember:
618  * 	1) The ill_name is tacked on at the end of the allocated space so
619  *	   the templates name_offset field must contain the total space
620  *	   to allocate less the name length.
621  *
622  *	2) The templates name_length field should contain the *template*
623  *	   length.  We use it as a parameter to bcopy() and then write
624  *	   the real ill_name_length into the name_length field of the copy.
625  * (Always called as writer.)
626  */
627 mblk_t *
628 ill_arp_alloc(ill_t *ill, uchar_t *template, caddr_t addr)
629 {
630 	arc_t	*arc = (arc_t *)template;
631 	char	*cp;
632 	int	len;
633 	mblk_t	*mp;
634 	uint_t	name_length = ill->ill_name_length;
635 	uint_t	template_len = arc->arc_name_length;
636 
637 	len = arc->arc_name_offset + name_length;
638 	mp = allocb(len, BPRI_HI);
639 	if (mp == NULL)
640 		return (NULL);
641 	cp = (char *)mp->b_rptr;
642 	mp->b_wptr = (uchar_t *)&cp[len];
643 	if (template_len)
644 		bcopy(template, cp, template_len);
645 	if (len > template_len)
646 		bzero(&cp[template_len], len - template_len);
647 	mp->b_datap->db_type = M_PROTO;
648 
649 	arc = (arc_t *)cp;
650 	arc->arc_name_length = name_length;
651 	cp = (char *)arc + arc->arc_name_offset;
652 	bcopy(ill->ill_name, cp, name_length);
653 
654 	if (addr) {
655 		area_t	*area = (area_t *)mp->b_rptr;
656 
657 		cp = (char *)area + area->area_proto_addr_offset;
658 		bcopy(addr, cp, area->area_proto_addr_length);
659 		if (area->area_cmd == AR_ENTRY_ADD) {
660 			cp = (char *)area;
661 			len = area->area_proto_addr_length;
662 			if (area->area_proto_mask_offset)
663 				cp += area->area_proto_mask_offset;
664 			else
665 				cp += area->area_proto_addr_offset + len;
666 			while (len-- > 0)
667 				*cp++ = (char)~0;
668 		}
669 	}
670 	return (mp);
671 }
672 
673 mblk_t *
674 ipif_area_alloc(ipif_t *ipif)
675 {
676 	return (ill_arp_alloc(ipif->ipif_ill, (uchar_t *)&ip_area_template,
677 	    (char *)&ipif->ipif_lcl_addr));
678 }
679 
680 mblk_t *
681 ipif_ared_alloc(ipif_t *ipif)
682 {
683 	return (ill_arp_alloc(ipif->ipif_ill, (uchar_t *)&ip_ared_template,
684 	    (char *)&ipif->ipif_lcl_addr));
685 }
686 
687 /*
688  * Completely vaporize a lower level tap and all associated interfaces.
689  * ill_delete is called only out of ip_close when the device control
690  * stream is being closed.
691  */
692 void
693 ill_delete(ill_t *ill)
694 {
695 	ipif_t	*ipif;
696 	ill_t	*prev_ill;
697 
698 	/*
699 	 * ill_delete may be forcibly entering the ipsq. The previous
700 	 * ioctl may not have completed and may need to be aborted.
701 	 * ipsq_flush takes care of it. If we don't need to enter the
702 	 * the ipsq forcibly, the 2nd invocation of ipsq_flush in
703 	 * ill_delete_tail is sufficient.
704 	 */
705 	ipsq_flush(ill);
706 
707 	/*
708 	 * Nuke all interfaces.  ipif_free will take down the interface,
709 	 * remove it from the list, and free the data structure.
710 	 * Walk down the ipif list and remove the logical interfaces
711 	 * first before removing the main ipif. We can't unplumb
712 	 * zeroth interface first in the case of IPv6 as reset_conn_ill
713 	 * -> ip_ll_delmulti_v6 de-references ill_ipif for checking
714 	 * POINTOPOINT.
715 	 *
716 	 * If ill_ipif was not properly initialized (i.e low on memory),
717 	 * then no interfaces to clean up. In this case just clean up the
718 	 * ill.
719 	 */
720 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
721 		ipif_free(ipif);
722 
723 	/*
724 	 * Used only by ill_arp_on and ill_arp_off, which are writers.
725 	 * So nobody can be using this mp now. Free the mp allocated for
726 	 * honoring ILLF_NOARP
727 	 */
728 	freemsg(ill->ill_arp_on_mp);
729 	ill->ill_arp_on_mp = NULL;
730 
731 	/* Clean up msgs on pending upcalls for mrouted */
732 	reset_mrt_ill(ill);
733 
734 	/*
735 	 * ipif_free -> reset_conn_ipif will remove all multicast
736 	 * references for IPv4. For IPv6, we need to do it here as
737 	 * it points only at ills.
738 	 */
739 	reset_conn_ill(ill);
740 
741 	/*
742 	 * ill_down will arrange to blow off any IRE's dependent on this
743 	 * ILL, and shut down fragmentation reassembly.
744 	 */
745 	ill_down(ill);
746 
747 	/* Let SCTP know, so that it can remove this from its list. */
748 	sctp_update_ill(ill, SCTP_ILL_REMOVE);
749 
750 	/*
751 	 * If an address on this ILL is being used as a source address then
752 	 * clear out the pointers in other ILLs that point to this ILL.
753 	 */
754 	rw_enter(&ill_g_usesrc_lock, RW_WRITER);
755 	if (ill->ill_usesrc_grp_next != NULL) {
756 		if (ill->ill_usesrc_ifindex == 0) { /* usesrc ILL ? */
757 			ill_disband_usesrc_group(ill);
758 		} else {	/* consumer of the usesrc ILL */
759 			prev_ill = ill_prev_usesrc(ill);
760 			prev_ill->ill_usesrc_grp_next =
761 			    ill->ill_usesrc_grp_next;
762 		}
763 	}
764 	rw_exit(&ill_g_usesrc_lock);
765 }
766 
767 static void
768 ipif_non_duplicate(ipif_t *ipif)
769 {
770 	ill_t *ill = ipif->ipif_ill;
771 	mutex_enter(&ill->ill_lock);
772 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
773 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
774 		ASSERT(ill->ill_ipif_dup_count > 0);
775 		ill->ill_ipif_dup_count--;
776 	}
777 	mutex_exit(&ill->ill_lock);
778 }
779 
780 /*
781  * ill_delete_tail is called from ip_modclose after all references
782  * to the closing ill are gone. The wait is done in ip_modclose
783  */
784 void
785 ill_delete_tail(ill_t *ill)
786 {
787 	mblk_t	**mpp;
788 	ipif_t	*ipif;
789 
790 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
791 		ipif_non_duplicate(ipif);
792 		ipif_down_tail(ipif);
793 	}
794 
795 	ASSERT(ill->ill_ipif_dup_count == 0 &&
796 	    ill->ill_arp_down_mp == NULL &&
797 	    ill->ill_arp_del_mapping_mp == NULL);
798 
799 	/*
800 	 * If polling capability is enabled (which signifies direct
801 	 * upcall into IP and driver has ill saved as a handle),
802 	 * we need to make sure that unbind has completed before we
803 	 * let the ill disappear and driver no longer has any reference
804 	 * to this ill.
805 	 */
806 	mutex_enter(&ill->ill_lock);
807 	while (ill->ill_state_flags & ILL_DL_UNBIND_IN_PROGRESS)
808 		cv_wait(&ill->ill_cv, &ill->ill_lock);
809 	mutex_exit(&ill->ill_lock);
810 
811 	/*
812 	 * Clean up polling and soft ring capabilities
813 	 */
814 	if (ill->ill_capabilities & (ILL_CAPAB_POLL|ILL_CAPAB_SOFT_RING))
815 		ill_capability_dls_disable(ill);
816 
817 	/*
818 	 * Send the detach if there's one to send (i.e., if we're above a
819 	 * style 2 DLPI driver).
820 	 */
821 	if (ill->ill_detach_mp != NULL) {
822 		ill_dlpi_send(ill, ill->ill_detach_mp);
823 		ill->ill_detach_mp = NULL;
824 	}
825 
826 	if (ill->ill_net_type != IRE_LOOPBACK)
827 		qprocsoff(ill->ill_rq);
828 
829 	/*
830 	 * We do an ipsq_flush once again now. New messages could have
831 	 * landed up from below (M_ERROR or M_HANGUP). Similarly ioctls
832 	 * could also have landed up if an ioctl thread had looked up
833 	 * the ill before we set the ILL_CONDEMNED flag, but not yet
834 	 * enqueued the ioctl when we did the ipsq_flush last time.
835 	 */
836 	ipsq_flush(ill);
837 
838 	/*
839 	 * Free capabilities.
840 	 */
841 	if (ill->ill_ipsec_capab_ah != NULL) {
842 		ill_ipsec_capab_delete(ill, DL_CAPAB_IPSEC_AH);
843 		ill_ipsec_capab_free(ill->ill_ipsec_capab_ah);
844 		ill->ill_ipsec_capab_ah = NULL;
845 	}
846 
847 	if (ill->ill_ipsec_capab_esp != NULL) {
848 		ill_ipsec_capab_delete(ill, DL_CAPAB_IPSEC_ESP);
849 		ill_ipsec_capab_free(ill->ill_ipsec_capab_esp);
850 		ill->ill_ipsec_capab_esp = NULL;
851 	}
852 
853 	if (ill->ill_mdt_capab != NULL) {
854 		kmem_free(ill->ill_mdt_capab, sizeof (ill_mdt_capab_t));
855 		ill->ill_mdt_capab = NULL;
856 	}
857 
858 	if (ill->ill_hcksum_capab != NULL) {
859 		kmem_free(ill->ill_hcksum_capab, sizeof (ill_hcksum_capab_t));
860 		ill->ill_hcksum_capab = NULL;
861 	}
862 
863 	if (ill->ill_zerocopy_capab != NULL) {
864 		kmem_free(ill->ill_zerocopy_capab,
865 		    sizeof (ill_zerocopy_capab_t));
866 		ill->ill_zerocopy_capab = NULL;
867 	}
868 
869 	if (ill->ill_dls_capab != NULL) {
870 		CONN_DEC_REF(ill->ill_dls_capab->ill_unbind_conn);
871 		ill->ill_dls_capab->ill_unbind_conn = NULL;
872 		kmem_free(ill->ill_dls_capab,
873 		    sizeof (ill_dls_capab_t) +
874 		    (sizeof (ill_rx_ring_t) * ILL_MAX_RINGS));
875 		ill->ill_dls_capab = NULL;
876 	}
877 
878 	ASSERT(!(ill->ill_capabilities & ILL_CAPAB_POLL));
879 
880 	while (ill->ill_ipif != NULL)
881 		ipif_free_tail(ill->ill_ipif);
882 
883 	ill_down_tail(ill);
884 
885 	/*
886 	 * We have removed all references to ilm from conn and the ones joined
887 	 * within the kernel.
888 	 *
889 	 * We don't walk conns, mrts and ires because
890 	 *
891 	 * 1) reset_conn_ill and reset_mrt_ill cleans up conns and mrts.
892 	 * 2) ill_down ->ill_downi walks all the ires and cleans up
893 	 *    ill references.
894 	 */
895 	ASSERT(ilm_walk_ill(ill) == 0);
896 	/*
897 	 * Take us out of the list of ILLs. ill_glist_delete -> ill_phyint_free
898 	 * could free the phyint. No more reference to the phyint after this
899 	 * point.
900 	 */
901 	(void) ill_glist_delete(ill);
902 
903 	rw_enter(&ip_g_nd_lock, RW_WRITER);
904 	if (ill->ill_ndd_name != NULL)
905 		nd_unload(&ip_g_nd, ill->ill_ndd_name);
906 	rw_exit(&ip_g_nd_lock);
907 
908 
909 	if (ill->ill_frag_ptr != NULL) {
910 		uint_t count;
911 
912 		for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
913 			mutex_destroy(&ill->ill_frag_hash_tbl[count].ipfb_lock);
914 		}
915 		mi_free(ill->ill_frag_ptr);
916 		ill->ill_frag_ptr = NULL;
917 		ill->ill_frag_hash_tbl = NULL;
918 	}
919 	if (ill->ill_nd_lla_mp != NULL)
920 		freemsg(ill->ill_nd_lla_mp);
921 	/* Free all retained control messages. */
922 	mpp = &ill->ill_first_mp_to_free;
923 	do {
924 		while (mpp[0]) {
925 			mblk_t  *mp;
926 			mblk_t  *mp1;
927 
928 			mp = mpp[0];
929 			mpp[0] = mp->b_next;
930 			for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont) {
931 				mp1->b_next = NULL;
932 				mp1->b_prev = NULL;
933 			}
934 			freemsg(mp);
935 		}
936 	} while (mpp++ != &ill->ill_last_mp_to_free);
937 
938 	ill_free_mib(ill);
939 	ILL_TRACE_CLEANUP(ill);
940 }
941 
942 static void
943 ill_free_mib(ill_t *ill)
944 {
945 	if (ill->ill_ip6_mib != NULL) {
946 		kmem_free(ill->ill_ip6_mib, sizeof (*ill->ill_ip6_mib));
947 		ill->ill_ip6_mib = NULL;
948 	}
949 	if (ill->ill_icmp6_mib != NULL) {
950 		kmem_free(ill->ill_icmp6_mib, sizeof (*ill->ill_icmp6_mib));
951 		ill->ill_icmp6_mib = NULL;
952 	}
953 }
954 
955 /*
956  * Concatenate together a physical address and a sap.
957  *
958  * Sap_lengths are interpreted as follows:
959  *   sap_length == 0	==>	no sap
960  *   sap_length > 0	==>	sap is at the head of the dlpi address
961  *   sap_length < 0	==>	sap is at the tail of the dlpi address
962  */
963 static void
964 ill_dlur_copy_address(uchar_t *phys_src, uint_t phys_length,
965     t_scalar_t sap_src, t_scalar_t sap_length, uchar_t *dst)
966 {
967 	uint16_t sap_addr = (uint16_t)sap_src;
968 
969 	if (sap_length == 0) {
970 		if (phys_src == NULL)
971 			bzero(dst, phys_length);
972 		else
973 			bcopy(phys_src, dst, phys_length);
974 	} else if (sap_length < 0) {
975 		if (phys_src == NULL)
976 			bzero(dst, phys_length);
977 		else
978 			bcopy(phys_src, dst, phys_length);
979 		bcopy(&sap_addr, (char *)dst + phys_length, sizeof (sap_addr));
980 	} else {
981 		bcopy(&sap_addr, dst, sizeof (sap_addr));
982 		if (phys_src == NULL)
983 			bzero((char *)dst + sap_length, phys_length);
984 		else
985 			bcopy(phys_src, (char *)dst + sap_length, phys_length);
986 	}
987 }
988 
989 /*
990  * Generate a dl_unitdata_req mblk for the device and address given.
991  * addr_length is the length of the physical portion of the address.
992  * If addr is NULL include an all zero address of the specified length.
993  * TRUE? In any case, addr_length is taken to be the entire length of the
994  * dlpi address, including the absolute value of sap_length.
995  */
996 mblk_t *
997 ill_dlur_gen(uchar_t *addr, uint_t addr_length, t_uscalar_t sap,
998 		t_scalar_t sap_length)
999 {
1000 	dl_unitdata_req_t *dlur;
1001 	mblk_t	*mp;
1002 	t_scalar_t	abs_sap_length;		/* absolute value */
1003 
1004 	abs_sap_length = ABS(sap_length);
1005 	mp = ip_dlpi_alloc(sizeof (*dlur) + addr_length + abs_sap_length,
1006 		DL_UNITDATA_REQ);
1007 	if (mp == NULL)
1008 		return (NULL);
1009 	dlur = (dl_unitdata_req_t *)mp->b_rptr;
1010 	/* HACK: accomodate incompatible DLPI drivers */
1011 	if (addr_length == 8)
1012 		addr_length = 6;
1013 	dlur->dl_dest_addr_length = addr_length + abs_sap_length;
1014 	dlur->dl_dest_addr_offset = sizeof (*dlur);
1015 	dlur->dl_priority.dl_min = 0;
1016 	dlur->dl_priority.dl_max = 0;
1017 	ill_dlur_copy_address(addr, addr_length, sap, sap_length,
1018 	    (uchar_t *)&dlur[1]);
1019 	return (mp);
1020 }
1021 
1022 /*
1023  * Add the 'mp' to the list of pending mp's headed by ill_pending_mp
1024  * Return an error if we already have 1 or more ioctls in progress.
1025  * This is used only for non-exclusive ioctls. Currently this is used
1026  * for SIOC*ARP and SIOCGTUNPARAM ioctls. Most set ioctls are exclusive
1027  * and thus need to use ipsq_pending_mp_add.
1028  */
1029 boolean_t
1030 ill_pending_mp_add(ill_t *ill, conn_t *connp, mblk_t *add_mp)
1031 {
1032 	ASSERT(MUTEX_HELD(&ill->ill_lock));
1033 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
1034 	/*
1035 	 * M_IOCDATA from ioctls, M_IOCTL from tunnel ioctls.
1036 	 */
1037 	ASSERT((add_mp->b_datap->db_type == M_IOCDATA) ||
1038 	    (add_mp->b_datap->db_type == M_IOCTL));
1039 
1040 	ASSERT(MUTEX_HELD(&connp->conn_lock));
1041 	/*
1042 	 * Return error if the conn has started closing. The conn
1043 	 * could have finished cleaning up the pending mp list,
1044 	 * If so we should not add another mp to the list negating
1045 	 * the cleanup.
1046 	 */
1047 	if (connp->conn_state_flags & CONN_CLOSING)
1048 		return (B_FALSE);
1049 	/*
1050 	 * Add the pending mp to the head of the list, chained by b_next.
1051 	 * Note down the conn on which the ioctl request came, in b_prev.
1052 	 * This will be used to later get the conn, when we get a response
1053 	 * on the ill queue, from some other module (typically arp)
1054 	 */
1055 	add_mp->b_next = (void *)ill->ill_pending_mp;
1056 	add_mp->b_queue = CONNP_TO_WQ(connp);
1057 	ill->ill_pending_mp = add_mp;
1058 	if (connp != NULL)
1059 		connp->conn_oper_pending_ill = ill;
1060 	return (B_TRUE);
1061 }
1062 
1063 /*
1064  * Retrieve the ill_pending_mp and return it. We have to walk the list
1065  * of mblks starting at ill_pending_mp, and match based on the ioc_id.
1066  */
1067 mblk_t *
1068 ill_pending_mp_get(ill_t *ill, conn_t **connpp, uint_t ioc_id)
1069 {
1070 	mblk_t	*prev = NULL;
1071 	mblk_t	*curr = NULL;
1072 	uint_t	id;
1073 	conn_t	*connp;
1074 
1075 	/*
1076 	 * When the conn closes, conn_ioctl_cleanup needs to clean
1077 	 * up the pending mp, but it does not know the ioc_id and
1078 	 * passes in a zero for it.
1079 	 */
1080 	mutex_enter(&ill->ill_lock);
1081 	if (ioc_id != 0)
1082 		*connpp = NULL;
1083 
1084 	/* Search the list for the appropriate ioctl based on ioc_id */
1085 	for (prev = NULL, curr = ill->ill_pending_mp; curr != NULL;
1086 	    prev = curr, curr = curr->b_next) {
1087 		id = ((struct iocblk *)curr->b_rptr)->ioc_id;
1088 		connp = Q_TO_CONN(curr->b_queue);
1089 		/* Match based on the ioc_id or based on the conn */
1090 		if ((id == ioc_id) || (ioc_id == 0 && connp == *connpp))
1091 			break;
1092 	}
1093 
1094 	if (curr != NULL) {
1095 		/* Unlink the mblk from the pending mp list */
1096 		if (prev != NULL) {
1097 			prev->b_next = curr->b_next;
1098 		} else {
1099 			ASSERT(ill->ill_pending_mp == curr);
1100 			ill->ill_pending_mp = curr->b_next;
1101 		}
1102 
1103 		/*
1104 		 * conn refcnt must have been bumped up at the start of
1105 		 * the ioctl. So we can safely access the conn.
1106 		 */
1107 		ASSERT(CONN_Q(curr->b_queue));
1108 		*connpp = Q_TO_CONN(curr->b_queue);
1109 		curr->b_next = NULL;
1110 		curr->b_queue = NULL;
1111 	}
1112 
1113 	mutex_exit(&ill->ill_lock);
1114 
1115 	return (curr);
1116 }
1117 
1118 /*
1119  * Add the pending mp to the list. There can be only 1 pending mp
1120  * in the list. Any exclusive ioctl that needs to wait for a response
1121  * from another module or driver needs to use this function to set
1122  * the ipsq_pending_mp to the ioctl mblk and wait for the response from
1123  * the other module/driver. This is also used while waiting for the
1124  * ipif/ill/ire refcnts to drop to zero in bringing down an ipif.
1125  */
1126 boolean_t
1127 ipsq_pending_mp_add(conn_t *connp, ipif_t *ipif, queue_t *q, mblk_t *add_mp,
1128     int waitfor)
1129 {
1130 	ipsq_t	*ipsq;
1131 
1132 	ASSERT(IAM_WRITER_IPIF(ipif));
1133 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
1134 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
1135 	/*
1136 	 * M_IOCDATA from ioctls, M_IOCTL from tunnel ioctls,
1137 	 * M_ERROR/M_HANGUP from driver
1138 	 */
1139 	ASSERT((DB_TYPE(add_mp) == M_IOCDATA) || (DB_TYPE(add_mp) == M_IOCTL) ||
1140 	    (DB_TYPE(add_mp) == M_ERROR) || (DB_TYPE(add_mp) == M_HANGUP));
1141 
1142 	ipsq = ipif->ipif_ill->ill_phyint->phyint_ipsq;
1143 	if (connp != NULL) {
1144 		ASSERT(MUTEX_HELD(&connp->conn_lock));
1145 		/*
1146 		 * Return error if the conn has started closing. The conn
1147 		 * could have finished cleaning up the pending mp list,
1148 		 * If so we should not add another mp to the list negating
1149 		 * the cleanup.
1150 		 */
1151 		if (connp->conn_state_flags & CONN_CLOSING)
1152 			return (B_FALSE);
1153 	}
1154 	mutex_enter(&ipsq->ipsq_lock);
1155 	ipsq->ipsq_pending_ipif = ipif;
1156 	/*
1157 	 * Note down the queue in b_queue. This will be returned by
1158 	 * ipsq_pending_mp_get. Caller will then use these values to restart
1159 	 * the processing
1160 	 */
1161 	add_mp->b_next = NULL;
1162 	add_mp->b_queue = q;
1163 	ipsq->ipsq_pending_mp = add_mp;
1164 	ipsq->ipsq_waitfor = waitfor;
1165 	/*
1166 	 * ipsq_current_ipif is needed to restart the operation from
1167 	 * ipif_ill_refrele_tail when the last reference to the ipi/ill
1168 	 * is gone. Since this is not an ioctl ipsq_current_ipif has not
1169 	 * been set until now.
1170 	 */
1171 	if (DB_TYPE(add_mp) == M_ERROR || DB_TYPE(add_mp) == M_HANGUP) {
1172 		ASSERT(ipsq->ipsq_current_ipif == NULL);
1173 		ipsq->ipsq_current_ipif = ipif;
1174 		ipsq->ipsq_last_cmd = DB_TYPE(add_mp);
1175 	}
1176 	if (connp != NULL)
1177 		connp->conn_oper_pending_ill = ipif->ipif_ill;
1178 	mutex_exit(&ipsq->ipsq_lock);
1179 	return (B_TRUE);
1180 }
1181 
1182 /*
1183  * Retrieve the ipsq_pending_mp and return it. There can be only 1 mp
1184  * queued in the list.
1185  */
1186 mblk_t *
1187 ipsq_pending_mp_get(ipsq_t *ipsq, conn_t **connpp)
1188 {
1189 	mblk_t	*curr = NULL;
1190 
1191 	mutex_enter(&ipsq->ipsq_lock);
1192 	*connpp = NULL;
1193 	if (ipsq->ipsq_pending_mp == NULL) {
1194 		mutex_exit(&ipsq->ipsq_lock);
1195 		return (NULL);
1196 	}
1197 
1198 	/* There can be only 1 such excl message */
1199 	curr = ipsq->ipsq_pending_mp;
1200 	ASSERT(curr != NULL && curr->b_next == NULL);
1201 	ipsq->ipsq_pending_ipif = NULL;
1202 	ipsq->ipsq_pending_mp = NULL;
1203 	ipsq->ipsq_waitfor = 0;
1204 	mutex_exit(&ipsq->ipsq_lock);
1205 
1206 	if (CONN_Q(curr->b_queue)) {
1207 		/*
1208 		 * This mp did a refhold on the conn, at the start of the ioctl.
1209 		 * So we can safely return a pointer to the conn to the caller.
1210 		 */
1211 		*connpp = Q_TO_CONN(curr->b_queue);
1212 	} else {
1213 		*connpp = NULL;
1214 	}
1215 	curr->b_next = NULL;
1216 	curr->b_prev = NULL;
1217 	return (curr);
1218 }
1219 
1220 /*
1221  * Cleanup the ioctl mp queued in ipsq_pending_mp
1222  * - Called in the ill_delete path
1223  * - Called in the M_ERROR or M_HANGUP path on the ill.
1224  * - Called in the conn close path.
1225  */
1226 boolean_t
1227 ipsq_pending_mp_cleanup(ill_t *ill, conn_t *connp)
1228 {
1229 	mblk_t	*mp;
1230 	ipsq_t	*ipsq;
1231 	queue_t	*q;
1232 	ipif_t	*ipif;
1233 
1234 	ASSERT(IAM_WRITER_ILL(ill));
1235 	ipsq = ill->ill_phyint->phyint_ipsq;
1236 	mutex_enter(&ipsq->ipsq_lock);
1237 	/*
1238 	 * If connp is null, unconditionally clean up the ipsq_pending_mp.
1239 	 * This happens in M_ERROR/M_HANGUP. We need to abort the current ioctl
1240 	 * even if it is meant for another ill, since we have to enqueue
1241 	 * a new mp now in ipsq_pending_mp to complete the ipif_down.
1242 	 * If connp is non-null we are called from the conn close path.
1243 	 */
1244 	mp = ipsq->ipsq_pending_mp;
1245 	if (mp == NULL || (connp != NULL &&
1246 	    mp->b_queue != CONNP_TO_WQ(connp))) {
1247 		mutex_exit(&ipsq->ipsq_lock);
1248 		return (B_FALSE);
1249 	}
1250 	/* Now remove from the ipsq_pending_mp */
1251 	ipsq->ipsq_pending_mp = NULL;
1252 	q = mp->b_queue;
1253 	mp->b_next = NULL;
1254 	mp->b_prev = NULL;
1255 	mp->b_queue = NULL;
1256 
1257 	/* If MOVE was in progress, clear the move_in_progress fields also. */
1258 	ill = ipsq->ipsq_pending_ipif->ipif_ill;
1259 	if (ill->ill_move_in_progress) {
1260 		ILL_CLEAR_MOVE(ill);
1261 	} else if (ill->ill_up_ipifs) {
1262 		ill_group_cleanup(ill);
1263 	}
1264 
1265 	ipif = ipsq->ipsq_pending_ipif;
1266 	ipsq->ipsq_pending_ipif = NULL;
1267 	ipsq->ipsq_waitfor = 0;
1268 	ipsq->ipsq_current_ipif = NULL;
1269 	mutex_exit(&ipsq->ipsq_lock);
1270 
1271 	if (DB_TYPE(mp) == M_IOCTL || DB_TYPE(mp) == M_IOCDATA) {
1272 		ip_ioctl_finish(q, mp, ENXIO, connp != NULL ? CONN_CLOSE :
1273 		    NO_COPYOUT, connp != NULL ? ipif : NULL, NULL);
1274 	} else {
1275 		/*
1276 		 * IP-MT XXX In the case of TLI/XTI bind / optmgmt this can't
1277 		 * be just inet_freemsg. we have to restart it
1278 		 * otherwise the thread will be stuck.
1279 		 */
1280 		inet_freemsg(mp);
1281 	}
1282 	return (B_TRUE);
1283 }
1284 
1285 /*
1286  * The ill is closing. Cleanup all the pending mps. Called exclusively
1287  * towards the end of ill_delete. The refcount has gone to 0. So nobody
1288  * knows this ill, and hence nobody can add an mp to this list
1289  */
1290 static void
1291 ill_pending_mp_cleanup(ill_t *ill)
1292 {
1293 	mblk_t	*mp;
1294 	queue_t	*q;
1295 
1296 	ASSERT(IAM_WRITER_ILL(ill));
1297 
1298 	mutex_enter(&ill->ill_lock);
1299 	/*
1300 	 * Every mp on the pending mp list originating from an ioctl
1301 	 * added 1 to the conn refcnt, at the start of the ioctl.
1302 	 * So bump it down now.  See comments in ip_wput_nondata()
1303 	 */
1304 	while (ill->ill_pending_mp != NULL) {
1305 		mp = ill->ill_pending_mp;
1306 		ill->ill_pending_mp = mp->b_next;
1307 		mutex_exit(&ill->ill_lock);
1308 
1309 		q = mp->b_queue;
1310 		ASSERT(CONN_Q(q));
1311 		mp->b_next = NULL;
1312 		mp->b_prev = NULL;
1313 		mp->b_queue = NULL;
1314 		ip_ioctl_finish(q, mp, ENXIO, NO_COPYOUT, NULL, NULL);
1315 		mutex_enter(&ill->ill_lock);
1316 	}
1317 	ill->ill_pending_ipif = NULL;
1318 
1319 	mutex_exit(&ill->ill_lock);
1320 }
1321 
1322 /*
1323  * Called in the conn close path and ill delete path
1324  */
1325 static void
1326 ipsq_xopq_mp_cleanup(ill_t *ill, conn_t *connp)
1327 {
1328 	ipsq_t	*ipsq;
1329 	mblk_t	*prev;
1330 	mblk_t	*curr;
1331 	mblk_t	*next;
1332 	queue_t	*q;
1333 	mblk_t	*tmp_list = NULL;
1334 
1335 	ASSERT(IAM_WRITER_ILL(ill));
1336 	if (connp != NULL)
1337 		q = CONNP_TO_WQ(connp);
1338 	else
1339 		q = ill->ill_wq;
1340 
1341 	ipsq = ill->ill_phyint->phyint_ipsq;
1342 	/*
1343 	 * Cleanup the ioctl mp's queued in ipsq_xopq_pending_mp if any.
1344 	 * In the case of ioctl from a conn, there can be only 1 mp
1345 	 * queued on the ipsq. If an ill is being unplumbed, only messages
1346 	 * related to this ill are flushed, like M_ERROR or M_HANGUP message.
1347 	 * ioctls meant for this ill form conn's are not flushed. They will
1348 	 * be processed during ipsq_exit and will not find the ill and will
1349 	 * return error.
1350 	 */
1351 	mutex_enter(&ipsq->ipsq_lock);
1352 	for (prev = NULL, curr = ipsq->ipsq_xopq_mphead; curr != NULL;
1353 	    curr = next) {
1354 		next = curr->b_next;
1355 		if (curr->b_queue == q || curr->b_queue == RD(q)) {
1356 			/* Unlink the mblk from the pending mp list */
1357 			if (prev != NULL) {
1358 				prev->b_next = curr->b_next;
1359 			} else {
1360 				ASSERT(ipsq->ipsq_xopq_mphead == curr);
1361 				ipsq->ipsq_xopq_mphead = curr->b_next;
1362 			}
1363 			if (ipsq->ipsq_xopq_mptail == curr)
1364 				ipsq->ipsq_xopq_mptail = prev;
1365 			/*
1366 			 * Create a temporary list and release the ipsq lock
1367 			 * New elements are added to the head of the tmp_list
1368 			 */
1369 			curr->b_next = tmp_list;
1370 			tmp_list = curr;
1371 		} else {
1372 			prev = curr;
1373 		}
1374 	}
1375 	mutex_exit(&ipsq->ipsq_lock);
1376 
1377 	while (tmp_list != NULL) {
1378 		curr = tmp_list;
1379 		tmp_list = curr->b_next;
1380 		curr->b_next = NULL;
1381 		curr->b_prev = NULL;
1382 		curr->b_queue = NULL;
1383 		if (DB_TYPE(curr) == M_IOCTL || DB_TYPE(curr) == M_IOCDATA) {
1384 			ip_ioctl_finish(q, curr, ENXIO, connp != NULL ?
1385 			    CONN_CLOSE : NO_COPYOUT, NULL, NULL);
1386 		} else {
1387 			/*
1388 			 * IP-MT XXX In the case of TLI/XTI bind / optmgmt
1389 			 * this can't be just inet_freemsg. we have to
1390 			 * restart it otherwise the thread will be stuck.
1391 			 */
1392 			inet_freemsg(curr);
1393 		}
1394 	}
1395 }
1396 
1397 /*
1398  * This conn has started closing. Cleanup any pending ioctl from this conn.
1399  * STREAMS ensures that there can be at most 1 ioctl pending on a stream.
1400  */
1401 void
1402 conn_ioctl_cleanup(conn_t *connp)
1403 {
1404 	mblk_t *curr;
1405 	ipsq_t	*ipsq;
1406 	ill_t	*ill;
1407 	boolean_t refheld;
1408 
1409 	/*
1410 	 * Is any exclusive ioctl pending ? If so clean it up. If the
1411 	 * ioctl has not yet started, the mp is pending in the list headed by
1412 	 * ipsq_xopq_head. If the ioctl has started the mp could be present in
1413 	 * ipsq_pending_mp. If the ioctl timed out in the streamhead but
1414 	 * is currently executing now the mp is not queued anywhere but
1415 	 * conn_oper_pending_ill is null. The conn close will wait
1416 	 * till the conn_ref drops to zero.
1417 	 */
1418 	mutex_enter(&connp->conn_lock);
1419 	ill = connp->conn_oper_pending_ill;
1420 	if (ill == NULL) {
1421 		mutex_exit(&connp->conn_lock);
1422 		return;
1423 	}
1424 
1425 	curr = ill_pending_mp_get(ill, &connp, 0);
1426 	if (curr != NULL) {
1427 		mutex_exit(&connp->conn_lock);
1428 		CONN_DEC_REF(connp);
1429 		inet_freemsg(curr);
1430 		return;
1431 	}
1432 	/*
1433 	 * We may not be able to refhold the ill if the ill/ipif
1434 	 * is changing. But we need to make sure that the ill will
1435 	 * not vanish. So we just bump up the ill_waiter count.
1436 	 */
1437 	refheld = ill_waiter_inc(ill);
1438 	mutex_exit(&connp->conn_lock);
1439 	if (refheld) {
1440 		if (ipsq_enter(ill, B_TRUE)) {
1441 			ill_waiter_dcr(ill);
1442 			/*
1443 			 * Check whether this ioctl has started and is
1444 			 * pending now in ipsq_pending_mp. If it is not
1445 			 * found there then check whether this ioctl has
1446 			 * not even started and is in the ipsq_xopq list.
1447 			 */
1448 			if (!ipsq_pending_mp_cleanup(ill, connp))
1449 				ipsq_xopq_mp_cleanup(ill, connp);
1450 			ipsq = ill->ill_phyint->phyint_ipsq;
1451 			ipsq_exit(ipsq, B_TRUE, B_TRUE);
1452 			return;
1453 		}
1454 	}
1455 
1456 	/*
1457 	 * The ill is also closing and we could not bump up the
1458 	 * ill_waiter_count or we could not enter the ipsq. Leave
1459 	 * the cleanup to ill_delete
1460 	 */
1461 	mutex_enter(&connp->conn_lock);
1462 	while (connp->conn_oper_pending_ill != NULL)
1463 		cv_wait(&connp->conn_refcv, &connp->conn_lock);
1464 	mutex_exit(&connp->conn_lock);
1465 	if (refheld)
1466 		ill_waiter_dcr(ill);
1467 }
1468 
1469 /*
1470  * ipcl_walk function for cleaning up conn_*_ill fields.
1471  */
1472 static void
1473 conn_cleanup_ill(conn_t *connp, caddr_t arg)
1474 {
1475 	ill_t	*ill = (ill_t *)arg;
1476 	ire_t	*ire;
1477 
1478 	mutex_enter(&connp->conn_lock);
1479 	if (connp->conn_multicast_ill == ill) {
1480 		/* Revert to late binding */
1481 		connp->conn_multicast_ill = NULL;
1482 		connp->conn_orig_multicast_ifindex = 0;
1483 	}
1484 	if (connp->conn_incoming_ill == ill)
1485 		connp->conn_incoming_ill = NULL;
1486 	if (connp->conn_outgoing_ill == ill)
1487 		connp->conn_outgoing_ill = NULL;
1488 	if (connp->conn_outgoing_pill == ill)
1489 		connp->conn_outgoing_pill = NULL;
1490 	if (connp->conn_nofailover_ill == ill)
1491 		connp->conn_nofailover_ill = NULL;
1492 	if (connp->conn_xmit_if_ill == ill)
1493 		connp->conn_xmit_if_ill = NULL;
1494 	if (connp->conn_ire_cache != NULL) {
1495 		ire = connp->conn_ire_cache;
1496 		/*
1497 		 * ip_newroute creates IRE_CACHE with ire_stq coming from
1498 		 * interface X and ipif coming from interface Y, if interface
1499 		 * X and Y are part of the same IPMPgroup. Thus whenever
1500 		 * interface X goes down, remove all references to it by
1501 		 * checking both on ire_ipif and ire_stq.
1502 		 */
1503 		if ((ire->ire_ipif != NULL && ire->ire_ipif->ipif_ill == ill) ||
1504 		    (ire->ire_type == IRE_CACHE &&
1505 		    ire->ire_stq == ill->ill_wq)) {
1506 			connp->conn_ire_cache = NULL;
1507 			mutex_exit(&connp->conn_lock);
1508 			ire_refrele_notr(ire);
1509 			return;
1510 		}
1511 	}
1512 	mutex_exit(&connp->conn_lock);
1513 
1514 }
1515 
1516 /* ARGSUSED */
1517 void
1518 ipif_all_down_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
1519 {
1520 	ill_t	*ill = q->q_ptr;
1521 	ipif_t	*ipif;
1522 
1523 	ASSERT(IAM_WRITER_IPSQ(ipsq));
1524 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
1525 		ipif_non_duplicate(ipif);
1526 		ipif_down_tail(ipif);
1527 	}
1528 	ill_down_tail(ill);
1529 	freemsg(mp);
1530 	ipsq->ipsq_current_ipif = NULL;
1531 }
1532 
1533 /*
1534  * ill_down_start is called when we want to down this ill and bring it up again
1535  * It is called when we receive an M_ERROR / M_HANGUP. In this case we shut down
1536  * all interfaces, but don't tear down any plumbing.
1537  */
1538 boolean_t
1539 ill_down_start(queue_t *q, mblk_t *mp)
1540 {
1541 	ill_t	*ill;
1542 	ipif_t	*ipif;
1543 
1544 	ill = q->q_ptr;
1545 
1546 	ASSERT(IAM_WRITER_ILL(ill));
1547 
1548 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
1549 		(void) ipif_down(ipif, NULL, NULL);
1550 
1551 	ill_down(ill);
1552 
1553 	(void) ipsq_pending_mp_cleanup(ill, NULL);
1554 	mutex_enter(&ill->ill_lock);
1555 	/*
1556 	 * Atomically test and add the pending mp if references are
1557 	 * still active.
1558 	 */
1559 	if (!ill_is_quiescent(ill)) {
1560 		/*
1561 		 * Get rid of any pending mps and cleanup. Call will
1562 		 * not fail since we are passing a null connp.
1563 		 */
1564 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
1565 		    mp, ILL_DOWN);
1566 		mutex_exit(&ill->ill_lock);
1567 		return (B_FALSE);
1568 	}
1569 	mutex_exit(&ill->ill_lock);
1570 	return (B_TRUE);
1571 }
1572 
1573 static void
1574 ill_down(ill_t *ill)
1575 {
1576 	/* Blow off any IREs dependent on this ILL. */
1577 	ire_walk(ill_downi, (char *)ill);
1578 
1579 	mutex_enter(&ire_mrtun_lock);
1580 	if (ire_mrtun_count != 0) {
1581 		mutex_exit(&ire_mrtun_lock);
1582 		ire_walk_ill_mrtun(0, 0, ill_downi_mrtun_srcif,
1583 		    (char *)ill, NULL);
1584 	} else {
1585 		mutex_exit(&ire_mrtun_lock);
1586 	}
1587 
1588 	/*
1589 	 * If any interface based forwarding table exists
1590 	 * Blow off the ires there dependent on this ill
1591 	 */
1592 	mutex_enter(&ire_srcif_table_lock);
1593 	if (ire_srcif_table_count > 0) {
1594 		mutex_exit(&ire_srcif_table_lock);
1595 		ire_walk_srcif_table_v4(ill_downi_mrtun_srcif, (char *)ill);
1596 	} else {
1597 		mutex_exit(&ire_srcif_table_lock);
1598 	}
1599 
1600 	/* Remove any conn_*_ill depending on this ill */
1601 	ipcl_walk(conn_cleanup_ill, (caddr_t)ill);
1602 
1603 	if (ill->ill_group != NULL) {
1604 		illgrp_delete(ill);
1605 	}
1606 
1607 }
1608 
1609 static void
1610 ill_down_tail(ill_t *ill)
1611 {
1612 	int	i;
1613 
1614 	/* Destroy ill_srcif_table if it exists */
1615 	/* Lock not reqd really because nobody should be able to access */
1616 	mutex_enter(&ill->ill_lock);
1617 	if (ill->ill_srcif_table != NULL) {
1618 		ill->ill_srcif_refcnt = 0;
1619 		for (i = 0; i < IP_SRCIF_TABLE_SIZE; i++) {
1620 			rw_destroy(&ill->ill_srcif_table[i].irb_lock);
1621 		}
1622 		kmem_free(ill->ill_srcif_table,
1623 		    IP_SRCIF_TABLE_SIZE * sizeof (irb_t));
1624 		ill->ill_srcif_table = NULL;
1625 		ill->ill_srcif_refcnt = 0;
1626 		ill->ill_mrtun_refcnt = 0;
1627 	}
1628 	mutex_exit(&ill->ill_lock);
1629 }
1630 
1631 /*
1632  * ire_walk routine used to delete every IRE that depends on queues
1633  * associated with 'ill'.  (Always called as writer.)
1634  */
1635 static void
1636 ill_downi(ire_t *ire, char *ill_arg)
1637 {
1638 	ill_t	*ill = (ill_t *)ill_arg;
1639 
1640 	/*
1641 	 * ip_newroute creates IRE_CACHE with ire_stq coming from
1642 	 * interface X and ipif coming from interface Y, if interface
1643 	 * X and Y are part of the same IPMP group. Thus whenever interface
1644 	 * X goes down, remove all references to it by checking both
1645 	 * on ire_ipif and ire_stq.
1646 	 */
1647 	if ((ire->ire_ipif != NULL && ire->ire_ipif->ipif_ill == ill) ||
1648 	    (ire->ire_type == IRE_CACHE && ire->ire_stq == ill->ill_wq)) {
1649 		ire_delete(ire);
1650 	}
1651 }
1652 
1653 /*
1654  * A seperate routine for deleting revtun and srcif based routes
1655  * are needed because the ires only deleted when the interface
1656  * is unplumbed. Also these ires have ire_in_ill non-null as well.
1657  * we want to keep mobile IP specific code separate.
1658  */
1659 static void
1660 ill_downi_mrtun_srcif(ire_t *ire, char *ill_arg)
1661 {
1662 	ill_t   *ill = (ill_t *)ill_arg;
1663 
1664 	ASSERT(ire->ire_in_ill != NULL);
1665 
1666 	if ((ire->ire_in_ill != NULL && ire->ire_in_ill == ill) ||
1667 	    (ire->ire_stq == ill->ill_wq) || (ire->ire_stq == ill->ill_rq)) {
1668 		ire_delete(ire);
1669 	}
1670 }
1671 
1672 /*
1673  * Remove ire/nce from the fastpath list.
1674  */
1675 void
1676 ill_fastpath_nack(ill_t *ill)
1677 {
1678 	if (ill->ill_isv6) {
1679 		nce_fastpath_list_dispatch(ill, NULL, NULL);
1680 	} else {
1681 		ire_fastpath_list_dispatch(ill, NULL, NULL);
1682 	}
1683 }
1684 
1685 /* Consume an M_IOCACK of the fastpath probe. */
1686 void
1687 ill_fastpath_ack(ill_t *ill, mblk_t *mp)
1688 {
1689 	mblk_t	*mp1 = mp;
1690 
1691 	/*
1692 	 * If this was the first attempt turn on the fastpath probing.
1693 	 */
1694 	mutex_enter(&ill->ill_lock);
1695 	if (ill->ill_dlpi_fastpath_state == IDMS_INPROGRESS)
1696 		ill->ill_dlpi_fastpath_state = IDMS_OK;
1697 	mutex_exit(&ill->ill_lock);
1698 
1699 	/* Free the M_IOCACK mblk, hold on to the data */
1700 	mp = mp->b_cont;
1701 	freeb(mp1);
1702 	if (mp == NULL)
1703 		return;
1704 	if (mp->b_cont != NULL) {
1705 		/*
1706 		 * Update all IRE's or NCE's that are waiting for
1707 		 * fastpath update.
1708 		 */
1709 		if (ill->ill_isv6) {
1710 			/*
1711 			 * update nce's in the fastpath list.
1712 			 */
1713 			nce_fastpath_list_dispatch(ill,
1714 			    ndp_fastpath_update, mp);
1715 		} else {
1716 
1717 			/*
1718 			 * update ire's in the fastpath list.
1719 			 */
1720 			ire_fastpath_list_dispatch(ill,
1721 			    ire_fastpath_update, mp);
1722 			/*
1723 			 * Check if we need to traverse reverse tunnel table.
1724 			 * Since there is only single ire_type (IRE_MIPRTUN)
1725 			 * in the table, we don't need to match on ire_type.
1726 			 * We have to check ire_mrtun_count and not the
1727 			 * ill_mrtun_refcnt since ill_mrtun_refcnt is set
1728 			 * on the incoming ill and here we are dealing with
1729 			 * outgoing ill.
1730 			 */
1731 			mutex_enter(&ire_mrtun_lock);
1732 			if (ire_mrtun_count != 0) {
1733 				mutex_exit(&ire_mrtun_lock);
1734 				ire_walk_ill_mrtun(MATCH_IRE_WQ, IRE_MIPRTUN,
1735 				    (void (*)(ire_t *, void *))
1736 					ire_fastpath_update, mp, ill);
1737 			} else {
1738 				mutex_exit(&ire_mrtun_lock);
1739 			}
1740 		}
1741 		mp1 = mp->b_cont;
1742 		freeb(mp);
1743 		mp = mp1;
1744 	} else {
1745 		ip0dbg(("ill_fastpath_ack:  no b_cont\n"));
1746 	}
1747 
1748 	freeb(mp);
1749 }
1750 
1751 /*
1752  * Throw an M_IOCTL message downstream asking "do you know fastpath?"
1753  * The data portion of the request is a dl_unitdata_req_t template for
1754  * what we would send downstream in the absence of a fastpath confirmation.
1755  */
1756 int
1757 ill_fastpath_probe(ill_t *ill, mblk_t *dlur_mp)
1758 {
1759 	struct iocblk	*ioc;
1760 	mblk_t	*mp;
1761 
1762 	if (dlur_mp == NULL)
1763 		return (EINVAL);
1764 
1765 	mutex_enter(&ill->ill_lock);
1766 	switch (ill->ill_dlpi_fastpath_state) {
1767 	case IDMS_FAILED:
1768 		/*
1769 		 * Driver NAKed the first fastpath ioctl - assume it doesn't
1770 		 * support it.
1771 		 */
1772 		mutex_exit(&ill->ill_lock);
1773 		return (ENOTSUP);
1774 	case IDMS_UNKNOWN:
1775 		/* This is the first probe */
1776 		ill->ill_dlpi_fastpath_state = IDMS_INPROGRESS;
1777 		break;
1778 	default:
1779 		break;
1780 	}
1781 	mutex_exit(&ill->ill_lock);
1782 
1783 	if ((mp = mkiocb(DL_IOC_HDR_INFO)) == NULL)
1784 		return (EAGAIN);
1785 
1786 	mp->b_cont = copyb(dlur_mp);
1787 	if (mp->b_cont == NULL) {
1788 		freeb(mp);
1789 		return (EAGAIN);
1790 	}
1791 
1792 	ioc = (struct iocblk *)mp->b_rptr;
1793 	ioc->ioc_count = msgdsize(mp->b_cont);
1794 
1795 	putnext(ill->ill_wq, mp);
1796 	return (0);
1797 }
1798 
1799 void
1800 ill_capability_probe(ill_t *ill)
1801 {
1802 	/*
1803 	 * Do so only if negotiation is enabled, capabilities are unknown,
1804 	 * and a capability negotiation is not already in progress.
1805 	 */
1806 	if (ill->ill_capab_state != IDMS_UNKNOWN &&
1807 	    ill->ill_capab_state != IDMS_RENEG)
1808 		return;
1809 
1810 	ill->ill_capab_state = IDMS_INPROGRESS;
1811 	ip1dbg(("ill_capability_probe: starting capability negotiation\n"));
1812 	ill_capability_proto(ill, DL_CAPABILITY_REQ, NULL);
1813 }
1814 
1815 void
1816 ill_capability_reset(ill_t *ill)
1817 {
1818 	mblk_t *sc_mp = NULL;
1819 	mblk_t *tmp;
1820 
1821 	/*
1822 	 * Note here that we reset the state to UNKNOWN, and later send
1823 	 * down the DL_CAPABILITY_REQ without first setting the state to
1824 	 * INPROGRESS.  We do this in order to distinguish the
1825 	 * DL_CAPABILITY_ACK response which may come back in response to
1826 	 * a "reset" apart from the "probe" DL_CAPABILITY_REQ.  This would
1827 	 * also handle the case where the driver doesn't send us back
1828 	 * a DL_CAPABILITY_ACK in response, since the "probe" routine
1829 	 * requires the state to be in UNKNOWN anyway.  In any case, all
1830 	 * features are turned off until the state reaches IDMS_OK.
1831 	 */
1832 	ill->ill_capab_state = IDMS_UNKNOWN;
1833 
1834 	/*
1835 	 * Disable sub-capabilities and request a list of sub-capability
1836 	 * messages which will be sent down to the driver.  Each handler
1837 	 * allocates the corresponding dl_capability_sub_t inside an
1838 	 * mblk, and links it to the existing sc_mp mblk, or return it
1839 	 * as sc_mp if it's the first sub-capability (the passed in
1840 	 * sc_mp is NULL).  Upon returning from all capability handlers,
1841 	 * sc_mp will be pulled-up, before passing it downstream.
1842 	 */
1843 	ill_capability_mdt_reset(ill, &sc_mp);
1844 	ill_capability_hcksum_reset(ill, &sc_mp);
1845 	ill_capability_zerocopy_reset(ill, &sc_mp);
1846 	ill_capability_ipsec_reset(ill, &sc_mp);
1847 	ill_capability_dls_reset(ill, &sc_mp);
1848 
1849 	/* Nothing to send down in order to disable the capabilities? */
1850 	if (sc_mp == NULL)
1851 		return;
1852 
1853 	tmp = msgpullup(sc_mp, -1);
1854 	freemsg(sc_mp);
1855 	if ((sc_mp = tmp) == NULL) {
1856 		cmn_err(CE_WARN, "ill_capability_reset: unable to send down "
1857 		    "DL_CAPABILITY_REQ (ENOMEM)\n");
1858 		return;
1859 	}
1860 
1861 	ip1dbg(("ill_capability_reset: resetting negotiated capabilities\n"));
1862 	ill_capability_proto(ill, DL_CAPABILITY_REQ, sc_mp);
1863 }
1864 
1865 /*
1866  * Request or set new-style hardware capabilities supported by DLS provider.
1867  */
1868 static void
1869 ill_capability_proto(ill_t *ill, int type, mblk_t *reqp)
1870 {
1871 	mblk_t *mp;
1872 	dl_capability_req_t *capb;
1873 	size_t size = 0;
1874 	uint8_t *ptr;
1875 
1876 	if (reqp != NULL)
1877 		size = MBLKL(reqp);
1878 
1879 	mp = ip_dlpi_alloc(sizeof (dl_capability_req_t) + size, type);
1880 	if (mp == NULL) {
1881 		freemsg(reqp);
1882 		return;
1883 	}
1884 	ptr = mp->b_rptr;
1885 
1886 	capb = (dl_capability_req_t *)ptr;
1887 	ptr += sizeof (dl_capability_req_t);
1888 
1889 	if (reqp != NULL) {
1890 		capb->dl_sub_offset = sizeof (dl_capability_req_t);
1891 		capb->dl_sub_length = size;
1892 		bcopy(reqp->b_rptr, ptr, size);
1893 		ptr += size;
1894 		mp->b_cont = reqp->b_cont;
1895 		freeb(reqp);
1896 	}
1897 	ASSERT(ptr == mp->b_wptr);
1898 
1899 	ill_dlpi_send(ill, mp);
1900 }
1901 
1902 static void
1903 ill_capability_id_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *outers)
1904 {
1905 	dl_capab_id_t *id_ic;
1906 	uint_t sub_dl_cap = outers->dl_cap;
1907 	dl_capability_sub_t *inners;
1908 	uint8_t *capend;
1909 
1910 	ASSERT(sub_dl_cap == DL_CAPAB_ID_WRAPPER);
1911 
1912 	/*
1913 	 * Note: range checks here are not absolutely sufficient to
1914 	 * make us robust against malformed messages sent by drivers;
1915 	 * this is in keeping with the rest of IP's dlpi handling.
1916 	 * (Remember, it's coming from something else in the kernel
1917 	 * address space)
1918 	 */
1919 
1920 	capend = (uint8_t *)(outers + 1) + outers->dl_length;
1921 	if (capend > mp->b_wptr) {
1922 		cmn_err(CE_WARN, "ill_capability_id_ack: "
1923 		    "malformed sub-capability too long for mblk");
1924 		return;
1925 	}
1926 
1927 	id_ic = (dl_capab_id_t *)(outers + 1);
1928 
1929 	if (outers->dl_length < sizeof (*id_ic) ||
1930 	    (inners = &id_ic->id_subcap,
1931 	    inners->dl_length > (outers->dl_length - sizeof (*inners)))) {
1932 		cmn_err(CE_WARN, "ill_capability_id_ack: malformed "
1933 		    "encapsulated capab type %d too long for mblk",
1934 		    inners->dl_cap);
1935 		return;
1936 	}
1937 
1938 	if (!dlcapabcheckqid(&id_ic->id_mid, ill->ill_lmod_rq)) {
1939 		ip1dbg(("ill_capability_id_ack: mid token for capab type %d "
1940 		    "isn't as expected; pass-thru module(s) detected, "
1941 		    "discarding capability\n", inners->dl_cap));
1942 		return;
1943 	}
1944 
1945 	/* Process the encapsulated sub-capability */
1946 	ill_capability_dispatch(ill, mp, inners, B_TRUE);
1947 }
1948 
1949 /*
1950  * Process Multidata Transmit capability negotiation ack received from a
1951  * DLS Provider.  isub must point to the sub-capability (DL_CAPAB_MDT) of a
1952  * DL_CAPABILITY_ACK message.
1953  */
1954 static void
1955 ill_capability_mdt_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1956 {
1957 	mblk_t *nmp = NULL;
1958 	dl_capability_req_t *oc;
1959 	dl_capab_mdt_t *mdt_ic, *mdt_oc;
1960 	ill_mdt_capab_t **ill_mdt_capab;
1961 	uint_t sub_dl_cap = isub->dl_cap;
1962 	uint8_t *capend;
1963 
1964 	ASSERT(sub_dl_cap == DL_CAPAB_MDT);
1965 
1966 	ill_mdt_capab = (ill_mdt_capab_t **)&ill->ill_mdt_capab;
1967 
1968 	/*
1969 	 * Note: range checks here are not absolutely sufficient to
1970 	 * make us robust against malformed messages sent by drivers;
1971 	 * this is in keeping with the rest of IP's dlpi handling.
1972 	 * (Remember, it's coming from something else in the kernel
1973 	 * address space)
1974 	 */
1975 
1976 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1977 	if (capend > mp->b_wptr) {
1978 		cmn_err(CE_WARN, "ill_capability_mdt_ack: "
1979 		    "malformed sub-capability too long for mblk");
1980 		return;
1981 	}
1982 
1983 	mdt_ic = (dl_capab_mdt_t *)(isub + 1);
1984 
1985 	if (mdt_ic->mdt_version != MDT_VERSION_2) {
1986 		cmn_err(CE_CONT, "ill_capability_mdt_ack: "
1987 		    "unsupported MDT sub-capability (version %d, expected %d)",
1988 		    mdt_ic->mdt_version, MDT_VERSION_2);
1989 		return;
1990 	}
1991 
1992 	if (!dlcapabcheckqid(&mdt_ic->mdt_mid, ill->ill_lmod_rq)) {
1993 		ip1dbg(("ill_capability_mdt_ack: mid token for MDT "
1994 		    "capability isn't as expected; pass-thru module(s) "
1995 		    "detected, discarding capability\n"));
1996 		return;
1997 	}
1998 
1999 	if (mdt_ic->mdt_flags & DL_CAPAB_MDT_ENABLE) {
2000 
2001 		if (*ill_mdt_capab == NULL) {
2002 			*ill_mdt_capab = kmem_zalloc(sizeof (ill_mdt_capab_t),
2003 			    KM_NOSLEEP);
2004 
2005 			if (*ill_mdt_capab == NULL) {
2006 				cmn_err(CE_WARN, "ill_capability_mdt_ack: "
2007 				    "could not enable MDT version %d "
2008 				    "for %s (ENOMEM)\n", MDT_VERSION_2,
2009 				    ill->ill_name);
2010 				return;
2011 			}
2012 		}
2013 
2014 		ip1dbg(("ill_capability_mdt_ack: interface %s supports "
2015 		    "MDT version %d (%d bytes leading, %d bytes trailing "
2016 		    "header spaces, %d max pld bufs, %d span limit)\n",
2017 		    ill->ill_name, MDT_VERSION_2,
2018 		    mdt_ic->mdt_hdr_head, mdt_ic->mdt_hdr_tail,
2019 		    mdt_ic->mdt_max_pld, mdt_ic->mdt_span_limit));
2020 
2021 		(*ill_mdt_capab)->ill_mdt_version = MDT_VERSION_2;
2022 		(*ill_mdt_capab)->ill_mdt_on = 1;
2023 		/*
2024 		 * Round the following values to the nearest 32-bit; ULP
2025 		 * may further adjust them to accomodate for additional
2026 		 * protocol headers.  We pass these values to ULP during
2027 		 * bind time.
2028 		 */
2029 		(*ill_mdt_capab)->ill_mdt_hdr_head =
2030 		    roundup(mdt_ic->mdt_hdr_head, 4);
2031 		(*ill_mdt_capab)->ill_mdt_hdr_tail =
2032 		    roundup(mdt_ic->mdt_hdr_tail, 4);
2033 		(*ill_mdt_capab)->ill_mdt_max_pld = mdt_ic->mdt_max_pld;
2034 		(*ill_mdt_capab)->ill_mdt_span_limit = mdt_ic->mdt_span_limit;
2035 
2036 		ill->ill_capabilities |= ILL_CAPAB_MDT;
2037 	} else {
2038 		uint_t size;
2039 		uchar_t *rptr;
2040 
2041 		size = sizeof (dl_capability_req_t) +
2042 		    sizeof (dl_capability_sub_t) + sizeof (dl_capab_mdt_t);
2043 
2044 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2045 			cmn_err(CE_WARN, "ill_capability_mdt_ack: "
2046 			    "could not enable MDT for %s (ENOMEM)\n",
2047 			    ill->ill_name);
2048 			return;
2049 		}
2050 
2051 		rptr = nmp->b_rptr;
2052 		/* initialize dl_capability_req_t */
2053 		oc = (dl_capability_req_t *)nmp->b_rptr;
2054 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
2055 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
2056 		    sizeof (dl_capab_mdt_t);
2057 		nmp->b_rptr += sizeof (dl_capability_req_t);
2058 
2059 		/* initialize dl_capability_sub_t */
2060 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
2061 		nmp->b_rptr += sizeof (*isub);
2062 
2063 		/* initialize dl_capab_mdt_t */
2064 		mdt_oc = (dl_capab_mdt_t *)nmp->b_rptr;
2065 		bcopy(mdt_ic, mdt_oc, sizeof (*mdt_ic));
2066 
2067 		nmp->b_rptr = rptr;
2068 
2069 		ip1dbg(("ill_capability_mdt_ack: asking interface %s "
2070 		    "to enable MDT version %d\n", ill->ill_name,
2071 		    MDT_VERSION_2));
2072 
2073 		/* set ENABLE flag */
2074 		mdt_oc->mdt_flags |= DL_CAPAB_MDT_ENABLE;
2075 
2076 		/* nmp points to a DL_CAPABILITY_REQ message to enable MDT */
2077 		ill_dlpi_send(ill, nmp);
2078 	}
2079 }
2080 
2081 static void
2082 ill_capability_mdt_reset(ill_t *ill, mblk_t **sc_mp)
2083 {
2084 	mblk_t *mp;
2085 	dl_capab_mdt_t *mdt_subcap;
2086 	dl_capability_sub_t *dl_subcap;
2087 	int size;
2088 
2089 	if (!ILL_MDT_CAPABLE(ill))
2090 		return;
2091 
2092 	ASSERT(ill->ill_mdt_capab != NULL);
2093 	/*
2094 	 * Clear the capability flag for MDT but retain the ill_mdt_capab
2095 	 * structure since it's possible that another thread is still
2096 	 * referring to it.  The structure only gets deallocated when
2097 	 * we destroy the ill.
2098 	 */
2099 	ill->ill_capabilities &= ~ILL_CAPAB_MDT;
2100 
2101 	size = sizeof (*dl_subcap) + sizeof (*mdt_subcap);
2102 
2103 	mp = allocb(size, BPRI_HI);
2104 	if (mp == NULL) {
2105 		ip1dbg(("ill_capability_mdt_reset: unable to allocate "
2106 		    "request to disable MDT\n"));
2107 		return;
2108 	}
2109 
2110 	mp->b_wptr = mp->b_rptr + size;
2111 
2112 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
2113 	dl_subcap->dl_cap = DL_CAPAB_MDT;
2114 	dl_subcap->dl_length = sizeof (*mdt_subcap);
2115 
2116 	mdt_subcap = (dl_capab_mdt_t *)(dl_subcap + 1);
2117 	mdt_subcap->mdt_version = ill->ill_mdt_capab->ill_mdt_version;
2118 	mdt_subcap->mdt_flags = 0;
2119 	mdt_subcap->mdt_hdr_head = 0;
2120 	mdt_subcap->mdt_hdr_tail = 0;
2121 
2122 	if (*sc_mp != NULL)
2123 		linkb(*sc_mp, mp);
2124 	else
2125 		*sc_mp = mp;
2126 }
2127 
2128 /*
2129  * Send a DL_NOTIFY_REQ to the specified ill to enable
2130  * DL_NOTE_PROMISC_ON/OFF_PHYS notifications.
2131  * Invoked by ill_capability_ipsec_ack() before enabling IPsec hardware
2132  * acceleration.
2133  * Returns B_TRUE on success, B_FALSE if the message could not be sent.
2134  */
2135 static boolean_t
2136 ill_enable_promisc_notify(ill_t *ill)
2137 {
2138 	mblk_t *mp;
2139 	dl_notify_req_t *req;
2140 
2141 	IPSECHW_DEBUG(IPSECHW_PKT, ("ill_enable_promisc_notify:\n"));
2142 
2143 	mp = ip_dlpi_alloc(sizeof (dl_notify_req_t), DL_NOTIFY_REQ);
2144 	if (mp == NULL)
2145 		return (B_FALSE);
2146 
2147 	req = (dl_notify_req_t *)mp->b_rptr;
2148 	req->dl_notifications = DL_NOTE_PROMISC_ON_PHYS |
2149 	    DL_NOTE_PROMISC_OFF_PHYS;
2150 
2151 	ill_dlpi_send(ill, mp);
2152 
2153 	return (B_TRUE);
2154 }
2155 
2156 
2157 /*
2158  * Allocate an IPsec capability request which will be filled by our
2159  * caller to turn on support for one or more algorithms.
2160  */
2161 static mblk_t *
2162 ill_alloc_ipsec_cap_req(ill_t *ill, dl_capability_sub_t *isub)
2163 {
2164 	mblk_t *nmp;
2165 	dl_capability_req_t	*ocap;
2166 	dl_capab_ipsec_t	*ocip;
2167 	dl_capab_ipsec_t	*icip;
2168 	uint8_t			*ptr;
2169 	icip = (dl_capab_ipsec_t *)(isub + 1);
2170 
2171 	/*
2172 	 * The first time around, we send a DL_NOTIFY_REQ to enable
2173 	 * PROMISC_ON/OFF notification from the provider. We need to
2174 	 * do this before enabling the algorithms to avoid leakage of
2175 	 * cleartext packets.
2176 	 */
2177 
2178 	if (!ill_enable_promisc_notify(ill))
2179 		return (NULL);
2180 
2181 	/*
2182 	 * Allocate new mblk which will contain a new capability
2183 	 * request to enable the capabilities.
2184 	 */
2185 
2186 	nmp = ip_dlpi_alloc(sizeof (dl_capability_req_t) +
2187 	    sizeof (dl_capability_sub_t) + isub->dl_length, DL_CAPABILITY_REQ);
2188 	if (nmp == NULL)
2189 		return (NULL);
2190 
2191 	ptr = nmp->b_rptr;
2192 
2193 	/* initialize dl_capability_req_t */
2194 	ocap = (dl_capability_req_t *)ptr;
2195 	ocap->dl_sub_offset = sizeof (dl_capability_req_t);
2196 	ocap->dl_sub_length = sizeof (dl_capability_sub_t) + isub->dl_length;
2197 	ptr += sizeof (dl_capability_req_t);
2198 
2199 	/* initialize dl_capability_sub_t */
2200 	bcopy(isub, ptr, sizeof (*isub));
2201 	ptr += sizeof (*isub);
2202 
2203 	/* initialize dl_capab_ipsec_t */
2204 	ocip = (dl_capab_ipsec_t *)ptr;
2205 	bcopy(icip, ocip, sizeof (*icip));
2206 
2207 	nmp->b_wptr = (uchar_t *)(&ocip->cip_data[0]);
2208 	return (nmp);
2209 }
2210 
2211 /*
2212  * Process an IPsec capability negotiation ack received from a DLS Provider.
2213  * isub must point to the sub-capability (DL_CAPAB_IPSEC_AH or
2214  * DL_CAPAB_IPSEC_ESP) of a DL_CAPABILITY_ACK message.
2215  */
2216 static void
2217 ill_capability_ipsec_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2218 {
2219 	dl_capab_ipsec_t	*icip;
2220 	dl_capab_ipsec_alg_t	*ialg;	/* ptr to input alg spec. */
2221 	dl_capab_ipsec_alg_t	*oalg;	/* ptr to output alg spec. */
2222 	uint_t cipher, nciphers;
2223 	mblk_t *nmp;
2224 	uint_t alg_len;
2225 	boolean_t need_sadb_dump;
2226 	uint_t sub_dl_cap = isub->dl_cap;
2227 	ill_ipsec_capab_t **ill_capab;
2228 	uint64_t ill_capab_flag;
2229 	uint8_t *capend, *ciphend;
2230 	boolean_t sadb_resync;
2231 
2232 	ASSERT(sub_dl_cap == DL_CAPAB_IPSEC_AH ||
2233 	    sub_dl_cap == DL_CAPAB_IPSEC_ESP);
2234 
2235 	if (sub_dl_cap == DL_CAPAB_IPSEC_AH) {
2236 		ill_capab = (ill_ipsec_capab_t **)&ill->ill_ipsec_capab_ah;
2237 		ill_capab_flag = ILL_CAPAB_AH;
2238 	} else {
2239 		ill_capab = (ill_ipsec_capab_t **)&ill->ill_ipsec_capab_esp;
2240 		ill_capab_flag = ILL_CAPAB_ESP;
2241 	}
2242 
2243 	/*
2244 	 * If the ill capability structure exists, then this incoming
2245 	 * DL_CAPABILITY_ACK is a response to a "renegotiation" cycle.
2246 	 * If this is so, then we'd need to resynchronize the SADB
2247 	 * after re-enabling the offloaded ciphers.
2248 	 */
2249 	sadb_resync = (*ill_capab != NULL);
2250 
2251 	/*
2252 	 * Note: range checks here are not absolutely sufficient to
2253 	 * make us robust against malformed messages sent by drivers;
2254 	 * this is in keeping with the rest of IP's dlpi handling.
2255 	 * (Remember, it's coming from something else in the kernel
2256 	 * address space)
2257 	 */
2258 
2259 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2260 	if (capend > mp->b_wptr) {
2261 		cmn_err(CE_WARN, "ill_capability_ipsec_ack: "
2262 		    "malformed sub-capability too long for mblk");
2263 		return;
2264 	}
2265 
2266 	/*
2267 	 * There are two types of acks we process here:
2268 	 * 1. acks in reply to a (first form) generic capability req
2269 	 *    (no ENABLE flag set)
2270 	 * 2. acks in reply to a ENABLE capability req.
2271 	 *    (ENABLE flag set)
2272 	 *
2273 	 * We process the subcapability passed as argument as follows:
2274 	 * 1 do initializations
2275 	 *   1.1 initialize nmp = NULL
2276 	 *   1.2 set need_sadb_dump to B_FALSE
2277 	 * 2 for each cipher in subcapability:
2278 	 *   2.1 if ENABLE flag is set:
2279 	 *	2.1.1 update per-ill ipsec capabilities info
2280 	 *	2.1.2 set need_sadb_dump to B_TRUE
2281 	 *   2.2 if ENABLE flag is not set:
2282 	 *	2.2.1 if nmp is NULL:
2283 	 *		2.2.1.1 allocate and initialize nmp
2284 	 *		2.2.1.2 init current pos in nmp
2285 	 *	2.2.2 copy current cipher to current pos in nmp
2286 	 *	2.2.3 set ENABLE flag in nmp
2287 	 *	2.2.4 update current pos
2288 	 * 3 if nmp is not equal to NULL, send enable request
2289 	 *   3.1 send capability request
2290 	 * 4 if need_sadb_dump is B_TRUE
2291 	 *   4.1 enable promiscuous on/off notifications
2292 	 *   4.2 call ill_dlpi_send(isub->dlcap) to send all
2293 	 *	AH or ESP SA's to interface.
2294 	 */
2295 
2296 	nmp = NULL;
2297 	oalg = NULL;
2298 	need_sadb_dump = B_FALSE;
2299 	icip = (dl_capab_ipsec_t *)(isub + 1);
2300 	ialg = (dl_capab_ipsec_alg_t *)(&icip->cip_data[0]);
2301 
2302 	nciphers = icip->cip_nciphers;
2303 	ciphend = (uint8_t *)(ialg + icip->cip_nciphers);
2304 
2305 	if (ciphend > capend) {
2306 		cmn_err(CE_WARN, "ill_capability_ipsec_ack: "
2307 		    "too many ciphers for sub-capability len");
2308 		return;
2309 	}
2310 
2311 	for (cipher = 0; cipher < nciphers; cipher++) {
2312 		alg_len = sizeof (dl_capab_ipsec_alg_t);
2313 
2314 		if (ialg->alg_flag & DL_CAPAB_ALG_ENABLE) {
2315 			/*
2316 			 * TBD: when we provide a way to disable capabilities
2317 			 * from above, need to manage the request-pending state
2318 			 * and fail if we were not expecting this ACK.
2319 			 */
2320 			IPSECHW_DEBUG(IPSECHW_CAPAB,
2321 			    ("ill_capability_ipsec_ack: got ENABLE ACK\n"));
2322 
2323 			/*
2324 			 * Update IPsec capabilities for this ill
2325 			 */
2326 
2327 			if (*ill_capab == NULL) {
2328 				IPSECHW_DEBUG(IPSECHW_CAPAB,
2329 				    ("ill_capability_ipsec_ack: "
2330 					"allocating ipsec_capab for ill\n"));
2331 				*ill_capab = ill_ipsec_capab_alloc();
2332 
2333 				if (*ill_capab == NULL) {
2334 					cmn_err(CE_WARN,
2335 					    "ill_capability_ipsec_ack: "
2336 					    "could not enable IPsec Hardware "
2337 					    "acceleration for %s (ENOMEM)\n",
2338 					    ill->ill_name);
2339 					return;
2340 				}
2341 			}
2342 
2343 			ASSERT(ialg->alg_type == DL_CAPAB_IPSEC_ALG_AUTH ||
2344 			    ialg->alg_type == DL_CAPAB_IPSEC_ALG_ENCR);
2345 
2346 			if (ialg->alg_prim >= MAX_IPSEC_ALGS) {
2347 				cmn_err(CE_WARN,
2348 				    "ill_capability_ipsec_ack: "
2349 				    "malformed IPsec algorithm id %d",
2350 				    ialg->alg_prim);
2351 				continue;
2352 			}
2353 
2354 			if (ialg->alg_type == DL_CAPAB_IPSEC_ALG_AUTH) {
2355 				IPSEC_ALG_ENABLE((*ill_capab)->auth_hw_algs,
2356 				    ialg->alg_prim);
2357 			} else {
2358 				ipsec_capab_algparm_t *alp;
2359 
2360 				IPSEC_ALG_ENABLE((*ill_capab)->encr_hw_algs,
2361 				    ialg->alg_prim);
2362 				if (!ill_ipsec_capab_resize_algparm(*ill_capab,
2363 				    ialg->alg_prim)) {
2364 					cmn_err(CE_WARN,
2365 					    "ill_capability_ipsec_ack: "
2366 					    "no space for IPsec alg id %d",
2367 					    ialg->alg_prim);
2368 					continue;
2369 				}
2370 				alp = &((*ill_capab)->encr_algparm[
2371 						ialg->alg_prim]);
2372 				alp->minkeylen = ialg->alg_minbits;
2373 				alp->maxkeylen = ialg->alg_maxbits;
2374 			}
2375 			ill->ill_capabilities |= ill_capab_flag;
2376 			/*
2377 			 * indicate that a capability was enabled, which
2378 			 * will be used below to kick off a SADB dump
2379 			 * to the ill.
2380 			 */
2381 			need_sadb_dump = B_TRUE;
2382 		} else {
2383 			IPSECHW_DEBUG(IPSECHW_CAPAB,
2384 			    ("ill_capability_ipsec_ack: enabling alg 0x%x\n",
2385 				ialg->alg_prim));
2386 
2387 			if (nmp == NULL) {
2388 				nmp = ill_alloc_ipsec_cap_req(ill, isub);
2389 				if (nmp == NULL) {
2390 					/*
2391 					 * Sending the PROMISC_ON/OFF
2392 					 * notification request failed.
2393 					 * We cannot enable the algorithms
2394 					 * since the Provider will not
2395 					 * notify IP of promiscous mode
2396 					 * changes, which could lead
2397 					 * to leakage of packets.
2398 					 */
2399 					cmn_err(CE_WARN,
2400 					    "ill_capability_ipsec_ack: "
2401 					    "could not enable IPsec Hardware "
2402 					    "acceleration for %s (ENOMEM)\n",
2403 					    ill->ill_name);
2404 					return;
2405 				}
2406 				/* ptr to current output alg specifier */
2407 				oalg = (dl_capab_ipsec_alg_t *)nmp->b_wptr;
2408 			}
2409 
2410 			/*
2411 			 * Copy current alg specifier, set ENABLE
2412 			 * flag, and advance to next output alg.
2413 			 * For now we enable all IPsec capabilities.
2414 			 */
2415 			ASSERT(oalg != NULL);
2416 			bcopy(ialg, oalg, alg_len);
2417 			oalg->alg_flag |= DL_CAPAB_ALG_ENABLE;
2418 			nmp->b_wptr += alg_len;
2419 			oalg = (dl_capab_ipsec_alg_t *)nmp->b_wptr;
2420 		}
2421 
2422 		/* move to next input algorithm specifier */
2423 		ialg = (dl_capab_ipsec_alg_t *)
2424 		    ((char *)ialg + alg_len);
2425 	}
2426 
2427 	if (nmp != NULL)
2428 		/*
2429 		 * nmp points to a DL_CAPABILITY_REQ message to enable
2430 		 * IPsec hardware acceleration.
2431 		 */
2432 		ill_dlpi_send(ill, nmp);
2433 
2434 	if (need_sadb_dump)
2435 		/*
2436 		 * An acknowledgement corresponding to a request to
2437 		 * enable acceleration was received, notify SADB.
2438 		 */
2439 		ill_ipsec_capab_add(ill, sub_dl_cap, sadb_resync);
2440 }
2441 
2442 /*
2443  * Given an mblk with enough space in it, create sub-capability entries for
2444  * DL_CAPAB_IPSEC_{AH,ESP} types which consist of previously-advertised
2445  * offloaded ciphers (both AUTH and ENCR) with their enable flags cleared,
2446  * in preparation for the reset the DL_CAPABILITY_REQ message.
2447  */
2448 static void
2449 ill_fill_ipsec_reset(uint_t nciphers, int stype, uint_t slen,
2450     ill_ipsec_capab_t *ill_cap, mblk_t *mp)
2451 {
2452 	dl_capab_ipsec_t *oipsec;
2453 	dl_capab_ipsec_alg_t *oalg;
2454 	dl_capability_sub_t *dl_subcap;
2455 	int i, k;
2456 
2457 	ASSERT(nciphers > 0);
2458 	ASSERT(ill_cap != NULL);
2459 	ASSERT(mp != NULL);
2460 	ASSERT(MBLKTAIL(mp) >= sizeof (*dl_subcap) + sizeof (*oipsec) + slen);
2461 
2462 	/* dl_capability_sub_t for "stype" */
2463 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2464 	dl_subcap->dl_cap = stype;
2465 	dl_subcap->dl_length = sizeof (dl_capab_ipsec_t) + slen;
2466 	mp->b_wptr += sizeof (dl_capability_sub_t);
2467 
2468 	/* dl_capab_ipsec_t for "stype" */
2469 	oipsec = (dl_capab_ipsec_t *)mp->b_wptr;
2470 	oipsec->cip_version = 1;
2471 	oipsec->cip_nciphers = nciphers;
2472 	mp->b_wptr = (uchar_t *)&oipsec->cip_data[0];
2473 
2474 	/* create entries for "stype" AUTH ciphers */
2475 	for (i = 0; i < ill_cap->algs_size; i++) {
2476 		for (k = 0; k < BITSPERBYTE; k++) {
2477 			if ((ill_cap->auth_hw_algs[i] & (1 << k)) == 0)
2478 				continue;
2479 
2480 			oalg = (dl_capab_ipsec_alg_t *)mp->b_wptr;
2481 			bzero((void *)oalg, sizeof (*oalg));
2482 			oalg->alg_type = DL_CAPAB_IPSEC_ALG_AUTH;
2483 			oalg->alg_prim = k + (BITSPERBYTE * i);
2484 			mp->b_wptr += sizeof (dl_capab_ipsec_alg_t);
2485 		}
2486 	}
2487 	/* create entries for "stype" ENCR ciphers */
2488 	for (i = 0; i < ill_cap->algs_size; i++) {
2489 		for (k = 0; k < BITSPERBYTE; k++) {
2490 			if ((ill_cap->encr_hw_algs[i] & (1 << k)) == 0)
2491 				continue;
2492 
2493 			oalg = (dl_capab_ipsec_alg_t *)mp->b_wptr;
2494 			bzero((void *)oalg, sizeof (*oalg));
2495 			oalg->alg_type = DL_CAPAB_IPSEC_ALG_ENCR;
2496 			oalg->alg_prim = k + (BITSPERBYTE * i);
2497 			mp->b_wptr += sizeof (dl_capab_ipsec_alg_t);
2498 		}
2499 	}
2500 }
2501 
2502 /*
2503  * Macro to count number of 1s in a byte (8-bit word).  The total count is
2504  * accumulated into the passed-in argument (sum).  We could use SPARCv9's
2505  * POPC instruction, but our macro is more flexible for an arbitrary length
2506  * of bytes, such as {auth,encr}_hw_algs.  These variables are currently
2507  * 256-bits long (MAX_IPSEC_ALGS), so if we know for sure that the length
2508  * stays that way, we can reduce the number of iterations required.
2509  */
2510 #define	COUNT_1S(val, sum) {					\
2511 	uint8_t x = val & 0xff;					\
2512 	x = (x & 0x55) + ((x >> 1) & 0x55);			\
2513 	x = (x & 0x33) + ((x >> 2) & 0x33);			\
2514 	sum += (x & 0xf) + ((x >> 4) & 0xf);			\
2515 }
2516 
2517 /* ARGSUSED */
2518 static void
2519 ill_capability_ipsec_reset(ill_t *ill, mblk_t **sc_mp)
2520 {
2521 	mblk_t *mp;
2522 	ill_ipsec_capab_t *cap_ah = ill->ill_ipsec_capab_ah;
2523 	ill_ipsec_capab_t *cap_esp = ill->ill_ipsec_capab_esp;
2524 	uint64_t ill_capabilities = ill->ill_capabilities;
2525 	int ah_cnt = 0, esp_cnt = 0;
2526 	int ah_len = 0, esp_len = 0;
2527 	int i, size = 0;
2528 
2529 	if (!(ill_capabilities & (ILL_CAPAB_AH | ILL_CAPAB_ESP)))
2530 		return;
2531 
2532 	ASSERT(cap_ah != NULL || !(ill_capabilities & ILL_CAPAB_AH));
2533 	ASSERT(cap_esp != NULL || !(ill_capabilities & ILL_CAPAB_ESP));
2534 
2535 	/* Find out the number of ciphers for AH */
2536 	if (cap_ah != NULL) {
2537 		for (i = 0; i < cap_ah->algs_size; i++) {
2538 			COUNT_1S(cap_ah->auth_hw_algs[i], ah_cnt);
2539 			COUNT_1S(cap_ah->encr_hw_algs[i], ah_cnt);
2540 		}
2541 		if (ah_cnt > 0) {
2542 			size += sizeof (dl_capability_sub_t) +
2543 			    sizeof (dl_capab_ipsec_t);
2544 			/* dl_capab_ipsec_t contains one dl_capab_ipsec_alg_t */
2545 			ah_len = (ah_cnt - 1) * sizeof (dl_capab_ipsec_alg_t);
2546 			size += ah_len;
2547 		}
2548 	}
2549 
2550 	/* Find out the number of ciphers for ESP */
2551 	if (cap_esp != NULL) {
2552 		for (i = 0; i < cap_esp->algs_size; i++) {
2553 			COUNT_1S(cap_esp->auth_hw_algs[i], esp_cnt);
2554 			COUNT_1S(cap_esp->encr_hw_algs[i], esp_cnt);
2555 		}
2556 		if (esp_cnt > 0) {
2557 			size += sizeof (dl_capability_sub_t) +
2558 			    sizeof (dl_capab_ipsec_t);
2559 			/* dl_capab_ipsec_t contains one dl_capab_ipsec_alg_t */
2560 			esp_len = (esp_cnt - 1) * sizeof (dl_capab_ipsec_alg_t);
2561 			size += esp_len;
2562 		}
2563 	}
2564 
2565 	if (size == 0) {
2566 		ip1dbg(("ill_capability_ipsec_reset: capabilities exist but "
2567 		    "there's nothing to reset\n"));
2568 		return;
2569 	}
2570 
2571 	mp = allocb(size, BPRI_HI);
2572 	if (mp == NULL) {
2573 		ip1dbg(("ill_capability_ipsec_reset: unable to allocate "
2574 		    "request to disable IPSEC Hardware Acceleration\n"));
2575 		return;
2576 	}
2577 
2578 	/*
2579 	 * Clear the capability flags for IPSec HA but retain the ill
2580 	 * capability structures since it's possible that another thread
2581 	 * is still referring to them.  The structures only get deallocated
2582 	 * when we destroy the ill.
2583 	 *
2584 	 * Various places check the flags to see if the ill is capable of
2585 	 * hardware acceleration, and by clearing them we ensure that new
2586 	 * outbound IPSec packets are sent down encrypted.
2587 	 */
2588 	ill->ill_capabilities &= ~(ILL_CAPAB_AH | ILL_CAPAB_ESP);
2589 
2590 	/* Fill in DL_CAPAB_IPSEC_AH sub-capability entries */
2591 	if (ah_cnt > 0) {
2592 		ill_fill_ipsec_reset(ah_cnt, DL_CAPAB_IPSEC_AH, ah_len,
2593 		    cap_ah, mp);
2594 		ASSERT(mp->b_rptr + size >= mp->b_wptr);
2595 	}
2596 
2597 	/* Fill in DL_CAPAB_IPSEC_ESP sub-capability entries */
2598 	if (esp_cnt > 0) {
2599 		ill_fill_ipsec_reset(esp_cnt, DL_CAPAB_IPSEC_ESP, esp_len,
2600 		    cap_esp, mp);
2601 		ASSERT(mp->b_rptr + size >= mp->b_wptr);
2602 	}
2603 
2604 	/*
2605 	 * At this point we've composed a bunch of sub-capabilities to be
2606 	 * encapsulated in a DL_CAPABILITY_REQ and later sent downstream
2607 	 * by the caller.  Upon receiving this reset message, the driver
2608 	 * must stop inbound decryption (by destroying all inbound SAs)
2609 	 * and let the corresponding packets come in encrypted.
2610 	 */
2611 
2612 	if (*sc_mp != NULL)
2613 		linkb(*sc_mp, mp);
2614 	else
2615 		*sc_mp = mp;
2616 }
2617 
2618 static void
2619 ill_capability_dispatch(ill_t *ill, mblk_t *mp, dl_capability_sub_t *subp,
2620     boolean_t encapsulated)
2621 {
2622 	boolean_t legacy = B_FALSE;
2623 
2624 	/*
2625 	 * If this DL_CAPABILITY_ACK came in as a response to our "reset"
2626 	 * DL_CAPABILITY_REQ, ignore it during this cycle.  We've just
2627 	 * instructed the driver to disable its advertised capabilities,
2628 	 * so there's no point in accepting any response at this moment.
2629 	 */
2630 	if (ill->ill_capab_state == IDMS_UNKNOWN)
2631 		return;
2632 
2633 	/*
2634 	 * Note that only the following two sub-capabilities may be
2635 	 * considered as "legacy", since their original definitions
2636 	 * do not incorporate the dl_mid_t module ID token, and hence
2637 	 * may require the use of the wrapper sub-capability.
2638 	 */
2639 	switch (subp->dl_cap) {
2640 	case DL_CAPAB_IPSEC_AH:
2641 	case DL_CAPAB_IPSEC_ESP:
2642 		legacy = B_TRUE;
2643 		break;
2644 	}
2645 
2646 	/*
2647 	 * For legacy sub-capabilities which don't incorporate a queue_t
2648 	 * pointer in their structures, discard them if we detect that
2649 	 * there are intermediate modules in between IP and the driver.
2650 	 */
2651 	if (!encapsulated && legacy && ill->ill_lmod_cnt > 1) {
2652 		ip1dbg(("ill_capability_dispatch: unencapsulated capab type "
2653 		    "%d discarded; %d module(s) present below IP\n",
2654 		    subp->dl_cap, ill->ill_lmod_cnt));
2655 		return;
2656 	}
2657 
2658 	switch (subp->dl_cap) {
2659 	case DL_CAPAB_IPSEC_AH:
2660 	case DL_CAPAB_IPSEC_ESP:
2661 		ill_capability_ipsec_ack(ill, mp, subp);
2662 		break;
2663 	case DL_CAPAB_MDT:
2664 		ill_capability_mdt_ack(ill, mp, subp);
2665 		break;
2666 	case DL_CAPAB_HCKSUM:
2667 		ill_capability_hcksum_ack(ill, mp, subp);
2668 		break;
2669 	case DL_CAPAB_ZEROCOPY:
2670 		ill_capability_zerocopy_ack(ill, mp, subp);
2671 		break;
2672 	case DL_CAPAB_POLL:
2673 		if (!SOFT_RINGS_ENABLED())
2674 			ill_capability_dls_ack(ill, mp, subp);
2675 		break;
2676 	case DL_CAPAB_SOFT_RING:
2677 		if (SOFT_RINGS_ENABLED())
2678 			ill_capability_dls_ack(ill, mp, subp);
2679 		break;
2680 	default:
2681 		ip1dbg(("ill_capability_dispatch: unknown capab type %d\n",
2682 		    subp->dl_cap));
2683 	}
2684 }
2685 
2686 /*
2687  * As part of negotiating polling capability, the driver tells us
2688  * the default (or normal) blanking interval and packet threshold
2689  * (the receive timer fires if blanking interval is reached or
2690  * the packet threshold is reached).
2691  *
2692  * As part of manipulating the polling interval, we always use our
2693  * estimated interval (avg service time * number of packets queued
2694  * on the squeue) but we try to blank for a minimum of
2695  * rr_normal_blank_time * rr_max_blank_ratio. We disable the
2696  * packet threshold during this time. When we are not in polling mode
2697  * we set the blank interval typically lower, rr_normal_pkt_cnt *
2698  * rr_min_blank_ratio but up the packet cnt by a ratio of
2699  * rr_min_pkt_cnt_ratio so that we are still getting chains if
2700  * possible although for a shorter interval.
2701  */
2702 #define	RR_MAX_BLANK_RATIO	20
2703 #define	RR_MIN_BLANK_RATIO	10
2704 #define	RR_MAX_PKT_CNT_RATIO	3
2705 #define	RR_MIN_PKT_CNT_RATIO	3
2706 
2707 /*
2708  * These can be tuned via /etc/system.
2709  */
2710 int rr_max_blank_ratio = RR_MAX_BLANK_RATIO;
2711 int rr_min_blank_ratio = RR_MIN_BLANK_RATIO;
2712 int rr_max_pkt_cnt_ratio = RR_MAX_PKT_CNT_RATIO;
2713 int rr_min_pkt_cnt_ratio = RR_MIN_PKT_CNT_RATIO;
2714 
2715 static mac_resource_handle_t
2716 ill_ring_add(void *arg, mac_resource_t *mrp)
2717 {
2718 	ill_t			*ill = (ill_t *)arg;
2719 	mac_rx_fifo_t		*mrfp = (mac_rx_fifo_t *)mrp;
2720 	ill_rx_ring_t		*rx_ring;
2721 	int			ip_rx_index;
2722 
2723 	ASSERT(mrp != NULL);
2724 	if (mrp->mr_type != MAC_RX_FIFO) {
2725 		return (NULL);
2726 	}
2727 	ASSERT(ill != NULL);
2728 	ASSERT(ill->ill_dls_capab != NULL);
2729 
2730 	mutex_enter(&ill->ill_lock);
2731 	for (ip_rx_index = 0; ip_rx_index < ILL_MAX_RINGS; ip_rx_index++) {
2732 		rx_ring = &ill->ill_dls_capab->ill_ring_tbl[ip_rx_index];
2733 		ASSERT(rx_ring != NULL);
2734 
2735 		if (rx_ring->rr_ring_state == ILL_RING_FREE) {
2736 			time_t normal_blank_time =
2737 			    mrfp->mrf_normal_blank_time;
2738 			uint_t normal_pkt_cnt =
2739 			    mrfp->mrf_normal_pkt_count;
2740 
2741 			bzero(rx_ring, sizeof (ill_rx_ring_t));
2742 
2743 			rx_ring->rr_blank = mrfp->mrf_blank;
2744 			rx_ring->rr_handle = mrfp->mrf_arg;
2745 			rx_ring->rr_ill = ill;
2746 			rx_ring->rr_normal_blank_time = normal_blank_time;
2747 			rx_ring->rr_normal_pkt_cnt = normal_pkt_cnt;
2748 
2749 			rx_ring->rr_max_blank_time =
2750 			    normal_blank_time * rr_max_blank_ratio;
2751 			rx_ring->rr_min_blank_time =
2752 			    normal_blank_time * rr_min_blank_ratio;
2753 			rx_ring->rr_max_pkt_cnt =
2754 			    normal_pkt_cnt * rr_max_pkt_cnt_ratio;
2755 			rx_ring->rr_min_pkt_cnt =
2756 			    normal_pkt_cnt * rr_min_pkt_cnt_ratio;
2757 
2758 			rx_ring->rr_ring_state = ILL_RING_INUSE;
2759 			mutex_exit(&ill->ill_lock);
2760 
2761 			DTRACE_PROBE2(ill__ring__add, (void *), ill,
2762 			    (int), ip_rx_index);
2763 			return ((mac_resource_handle_t)rx_ring);
2764 		}
2765 	}
2766 
2767 	/*
2768 	 * We ran out of ILL_MAX_RINGS worth rx_ring structures. If
2769 	 * we have devices which can overwhelm this limit, ILL_MAX_RING
2770 	 * should be made configurable. Meanwhile it cause no panic because
2771 	 * driver will pass ip_input a NULL handle which will make
2772 	 * IP allocate the default squeue and Polling mode will not
2773 	 * be used for this ring.
2774 	 */
2775 	cmn_err(CE_NOTE, "Reached maximum number of receiving rings (%d) "
2776 	    "for %s\n", ILL_MAX_RINGS, ill->ill_name);
2777 
2778 	mutex_exit(&ill->ill_lock);
2779 	return (NULL);
2780 }
2781 
2782 static boolean_t
2783 ill_capability_dls_init(ill_t *ill)
2784 {
2785 	ill_dls_capab_t	*ill_dls = ill->ill_dls_capab;
2786 	conn_t 			*connp;
2787 	size_t			sz;
2788 
2789 	if (ill->ill_capabilities & ILL_CAPAB_SOFT_RING) {
2790 		if (ill_dls == NULL) {
2791 			cmn_err(CE_PANIC, "ill_capability_dls_init: "
2792 			    "soft_ring enabled for ill=%s (%p) but data "
2793 			    "structs uninitialized\n", ill->ill_name,
2794 			    (void *)ill);
2795 		}
2796 		return (B_TRUE);
2797 	} else if (ill->ill_capabilities & ILL_CAPAB_POLL) {
2798 		if (ill_dls == NULL) {
2799 			cmn_err(CE_PANIC, "ill_capability_dls_init: "
2800 			    "polling enabled for ill=%s (%p) but data "
2801 			    "structs uninitialized\n", ill->ill_name,
2802 			(void *)ill);
2803 		}
2804 		return (B_TRUE);
2805 	}
2806 
2807 	if (ill_dls != NULL) {
2808 		ill_rx_ring_t 	*rx_ring = ill_dls->ill_ring_tbl;
2809 		/* Soft_Ring or polling is being re-enabled */
2810 
2811 		connp = ill_dls->ill_unbind_conn;
2812 		ASSERT(rx_ring != NULL);
2813 		bzero((void *)ill_dls, sizeof (ill_dls_capab_t));
2814 		bzero((void *)rx_ring,
2815 		    sizeof (ill_rx_ring_t) * ILL_MAX_RINGS);
2816 		ill_dls->ill_ring_tbl = rx_ring;
2817 		ill_dls->ill_unbind_conn = connp;
2818 		return (B_TRUE);
2819 	}
2820 
2821 	if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP)) == NULL)
2822 		return (B_FALSE);
2823 
2824 	sz = sizeof (ill_dls_capab_t);
2825 	sz += sizeof (ill_rx_ring_t) * ILL_MAX_RINGS;
2826 
2827 	ill_dls = kmem_zalloc(sz, KM_NOSLEEP);
2828 	if (ill_dls == NULL) {
2829 		cmn_err(CE_WARN, "ill_capability_dls_init: could not "
2830 		    "allocate dls_capab for %s (%p)\n", ill->ill_name,
2831 		    (void *)ill);
2832 		CONN_DEC_REF(connp);
2833 		return (B_FALSE);
2834 	}
2835 
2836 	/* Allocate space to hold ring table */
2837 	ill_dls->ill_ring_tbl = (ill_rx_ring_t *)&ill_dls[1];
2838 	ill->ill_dls_capab = ill_dls;
2839 	ill_dls->ill_unbind_conn = connp;
2840 	return (B_TRUE);
2841 }
2842 
2843 /*
2844  * ill_capability_dls_disable: disable soft_ring and/or polling
2845  * capability. Since any of the rings might already be in use, need
2846  * to call ipsq_clean_all() which gets behind the squeue to disable
2847  * direct calls if necessary.
2848  */
2849 static void
2850 ill_capability_dls_disable(ill_t *ill)
2851 {
2852 	ill_dls_capab_t	*ill_dls = ill->ill_dls_capab;
2853 
2854 	if (ill->ill_capabilities & ILL_CAPAB_DLS) {
2855 		ipsq_clean_all(ill);
2856 		ill_dls->ill_tx = NULL;
2857 		ill_dls->ill_tx_handle = NULL;
2858 		ill_dls->ill_dls_change_status = NULL;
2859 		ill_dls->ill_dls_bind = NULL;
2860 		ill_dls->ill_dls_unbind = NULL;
2861 	}
2862 
2863 	ASSERT(!(ill->ill_capabilities & ILL_CAPAB_DLS));
2864 }
2865 
2866 static void
2867 ill_capability_dls_capable(ill_t *ill, dl_capab_dls_t *idls,
2868     dl_capability_sub_t *isub)
2869 {
2870 	uint_t			size;
2871 	uchar_t			*rptr;
2872 	dl_capab_dls_t	dls, *odls;
2873 	ill_dls_capab_t	*ill_dls;
2874 	mblk_t			*nmp = NULL;
2875 	dl_capability_req_t	*ocap;
2876 	uint_t			sub_dl_cap = isub->dl_cap;
2877 
2878 	if (!ill_capability_dls_init(ill))
2879 		return;
2880 	ill_dls = ill->ill_dls_capab;
2881 
2882 	/* Copy locally to get the members aligned */
2883 	bcopy((void *)idls, (void *)&dls,
2884 	    sizeof (dl_capab_dls_t));
2885 
2886 	/* Get the tx function and handle from dld */
2887 	ill_dls->ill_tx = (ip_dld_tx_t)dls.dls_tx;
2888 	ill_dls->ill_tx_handle = (void *)dls.dls_tx_handle;
2889 
2890 	if (sub_dl_cap == DL_CAPAB_SOFT_RING) {
2891 		ill_dls->ill_dls_change_status =
2892 		    (ip_dls_chg_soft_ring_t)dls.dls_ring_change_status;
2893 		ill_dls->ill_dls_bind = (ip_dls_bind_t)dls.dls_ring_bind;
2894 		ill_dls->ill_dls_unbind =
2895 		    (ip_dls_unbind_t)dls.dls_ring_unbind;
2896 		ill_dls->ill_dls_soft_ring_cnt = ip_soft_rings_cnt;
2897 	}
2898 
2899 	size = sizeof (dl_capability_req_t) + sizeof (dl_capability_sub_t) +
2900 	    isub->dl_length;
2901 
2902 	if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2903 		cmn_err(CE_WARN, "ill_capability_dls_capable: could "
2904 		    "not allocate memory for CAPAB_REQ for %s (%p)\n",
2905 		    ill->ill_name, (void *)ill);
2906 		return;
2907 	}
2908 
2909 	/* initialize dl_capability_req_t */
2910 	rptr = nmp->b_rptr;
2911 	ocap = (dl_capability_req_t *)rptr;
2912 	ocap->dl_sub_offset = sizeof (dl_capability_req_t);
2913 	ocap->dl_sub_length = sizeof (dl_capability_sub_t) + isub->dl_length;
2914 	rptr += sizeof (dl_capability_req_t);
2915 
2916 	/* initialize dl_capability_sub_t */
2917 	bcopy(isub, rptr, sizeof (*isub));
2918 	rptr += sizeof (*isub);
2919 
2920 	odls = (dl_capab_dls_t *)rptr;
2921 	rptr += sizeof (dl_capab_dls_t);
2922 
2923 	/* initialize dl_capab_dls_t to be sent down */
2924 	dls.dls_rx_handle = (uintptr_t)ill;
2925 	dls.dls_rx = (uintptr_t)ip_input;
2926 	dls.dls_ring_add = (uintptr_t)ill_ring_add;
2927 
2928 	if (sub_dl_cap == DL_CAPAB_SOFT_RING) {
2929 		dls.dls_ring_cnt = ip_soft_rings_cnt;
2930 		dls.dls_ring_assign = (uintptr_t)ip_soft_ring_assignment;
2931 		dls.dls_flags = SOFT_RING_ENABLE;
2932 	} else {
2933 		dls.dls_flags = POLL_ENABLE;
2934 		ip1dbg(("ill_capability_dls_capable: asking interface %s "
2935 		    "to enable polling\n", ill->ill_name));
2936 	}
2937 	bcopy((void *)&dls, (void *)odls,
2938 	    sizeof (dl_capab_dls_t));
2939 	ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
2940 	/*
2941 	 * nmp points to a DL_CAPABILITY_REQ message to
2942 	 * enable either soft_ring or polling
2943 	 */
2944 	ill_dlpi_send(ill, nmp);
2945 }
2946 
2947 static void
2948 ill_capability_dls_reset(ill_t *ill, mblk_t **sc_mp)
2949 {
2950 	mblk_t *mp;
2951 	dl_capab_dls_t *idls;
2952 	dl_capability_sub_t *dl_subcap;
2953 	int size;
2954 
2955 	if (!(ill->ill_capabilities & ILL_CAPAB_DLS))
2956 		return;
2957 
2958 	ASSERT(ill->ill_dls_capab != NULL);
2959 
2960 	size = sizeof (*dl_subcap) + sizeof (*idls);
2961 
2962 	mp = allocb(size, BPRI_HI);
2963 	if (mp == NULL) {
2964 		ip1dbg(("ill_capability_dls_reset: unable to allocate "
2965 		    "request to disable soft_ring\n"));
2966 		return;
2967 	}
2968 
2969 	mp->b_wptr = mp->b_rptr + size;
2970 
2971 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
2972 	dl_subcap->dl_length = sizeof (*idls);
2973 	if (ill->ill_capabilities & ILL_CAPAB_SOFT_RING)
2974 		dl_subcap->dl_cap = DL_CAPAB_SOFT_RING;
2975 	else
2976 		dl_subcap->dl_cap = DL_CAPAB_POLL;
2977 
2978 	idls = (dl_capab_dls_t *)(dl_subcap + 1);
2979 	if (ill->ill_capabilities & ILL_CAPAB_SOFT_RING)
2980 		idls->dls_flags = SOFT_RING_DISABLE;
2981 	else
2982 		idls->dls_flags = POLL_DISABLE;
2983 
2984 	if (*sc_mp != NULL)
2985 		linkb(*sc_mp, mp);
2986 	else
2987 		*sc_mp = mp;
2988 }
2989 
2990 /*
2991  * Process a soft_ring/poll capability negotiation ack received
2992  * from a DLS Provider.isub must point to the sub-capability
2993  * (DL_CAPAB_SOFT_RING/DL_CAPAB_POLL) of a DL_CAPABILITY_ACK message.
2994  */
2995 static void
2996 ill_capability_dls_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2997 {
2998 	dl_capab_dls_t		*idls;
2999 	uint_t			sub_dl_cap = isub->dl_cap;
3000 	uint8_t			*capend;
3001 
3002 	ASSERT(sub_dl_cap == DL_CAPAB_SOFT_RING ||
3003 	    sub_dl_cap == DL_CAPAB_POLL);
3004 
3005 	if (ill->ill_isv6)
3006 		return;
3007 
3008 	/*
3009 	 * Note: range checks here are not absolutely sufficient to
3010 	 * make us robust against malformed messages sent by drivers;
3011 	 * this is in keeping with the rest of IP's dlpi handling.
3012 	 * (Remember, it's coming from something else in the kernel
3013 	 * address space)
3014 	 */
3015 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
3016 	if (capend > mp->b_wptr) {
3017 		cmn_err(CE_WARN, "ill_capability_dls_ack: "
3018 		    "malformed sub-capability too long for mblk");
3019 		return;
3020 	}
3021 
3022 	/*
3023 	 * There are two types of acks we process here:
3024 	 * 1. acks in reply to a (first form) generic capability req
3025 	 *    (dls_flag will be set to SOFT_RING_CAPABLE or POLL_CAPABLE)
3026 	 * 2. acks in reply to a SOFT_RING_ENABLE or POLL_ENABLE
3027 	 *    capability req.
3028 	 */
3029 	idls = (dl_capab_dls_t *)(isub + 1);
3030 
3031 	if (!dlcapabcheckqid(&idls->dls_mid, ill->ill_lmod_rq)) {
3032 		ip1dbg(("ill_capability_dls_ack: mid token for dls "
3033 		    "capability isn't as expected; pass-thru "
3034 		    "module(s) detected, discarding capability\n"));
3035 		if (ill->ill_capabilities & ILL_CAPAB_DLS) {
3036 			/*
3037 			 * This is a capability renegotitation case.
3038 			 * The interface better be unusable at this
3039 			 * point other wise bad things will happen
3040 			 * if we disable direct calls on a running
3041 			 * and up interface.
3042 			 */
3043 			ill_capability_dls_disable(ill);
3044 		}
3045 		return;
3046 	}
3047 
3048 	switch (idls->dls_flags) {
3049 	default:
3050 		/* Disable if unknown flag */
3051 	case SOFT_RING_DISABLE:
3052 	case POLL_DISABLE:
3053 		ill_capability_dls_disable(ill);
3054 		break;
3055 	case SOFT_RING_CAPABLE:
3056 	case POLL_CAPABLE:
3057 		/*
3058 		 * If the capability was already enabled, its safe
3059 		 * to disable it first to get rid of stale information
3060 		 * and then start enabling it again.
3061 		 */
3062 		ill_capability_dls_disable(ill);
3063 		ill_capability_dls_capable(ill, idls, isub);
3064 		break;
3065 	case SOFT_RING_ENABLE:
3066 	case POLL_ENABLE:
3067 		mutex_enter(&ill->ill_lock);
3068 		if (sub_dl_cap == DL_CAPAB_SOFT_RING &&
3069 		    !(ill->ill_capabilities & ILL_CAPAB_SOFT_RING)) {
3070 			ASSERT(ill->ill_dls_capab != NULL);
3071 			ill->ill_capabilities |= ILL_CAPAB_SOFT_RING;
3072 		}
3073 		if (sub_dl_cap == DL_CAPAB_POLL &&
3074 		    !(ill->ill_capabilities & ILL_CAPAB_POLL)) {
3075 			ASSERT(ill->ill_dls_capab != NULL);
3076 			ill->ill_capabilities |= ILL_CAPAB_POLL;
3077 			ip1dbg(("ill_capability_dls_ack: interface %s "
3078 			    "has enabled polling\n", ill->ill_name));
3079 		}
3080 		mutex_exit(&ill->ill_lock);
3081 		break;
3082 	}
3083 }
3084 
3085 /*
3086  * Process a hardware checksum offload capability negotiation ack received
3087  * from a DLS Provider.isub must point to the sub-capability (DL_CAPAB_HCKSUM)
3088  * of a DL_CAPABILITY_ACK message.
3089  */
3090 static void
3091 ill_capability_hcksum_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
3092 {
3093 	dl_capability_req_t	*ocap;
3094 	dl_capab_hcksum_t	*ihck, *ohck;
3095 	ill_hcksum_capab_t	**ill_hcksum;
3096 	mblk_t			*nmp = NULL;
3097 	uint_t			sub_dl_cap = isub->dl_cap;
3098 	uint8_t			*capend;
3099 
3100 	ASSERT(sub_dl_cap == DL_CAPAB_HCKSUM);
3101 
3102 	ill_hcksum = (ill_hcksum_capab_t **)&ill->ill_hcksum_capab;
3103 
3104 	/*
3105 	 * Note: range checks here are not absolutely sufficient to
3106 	 * make us robust against malformed messages sent by drivers;
3107 	 * this is in keeping with the rest of IP's dlpi handling.
3108 	 * (Remember, it's coming from something else in the kernel
3109 	 * address space)
3110 	 */
3111 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
3112 	if (capend > mp->b_wptr) {
3113 		cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
3114 		    "malformed sub-capability too long for mblk");
3115 		return;
3116 	}
3117 
3118 	/*
3119 	 * There are two types of acks we process here:
3120 	 * 1. acks in reply to a (first form) generic capability req
3121 	 *    (no ENABLE flag set)
3122 	 * 2. acks in reply to a ENABLE capability req.
3123 	 *    (ENABLE flag set)
3124 	 */
3125 	ihck = (dl_capab_hcksum_t *)(isub + 1);
3126 
3127 	if (ihck->hcksum_version != HCKSUM_VERSION_1) {
3128 		cmn_err(CE_CONT, "ill_capability_hcksum_ack: "
3129 		    "unsupported hardware checksum "
3130 		    "sub-capability (version %d, expected %d)",
3131 		    ihck->hcksum_version, HCKSUM_VERSION_1);
3132 		return;
3133 	}
3134 
3135 	if (!dlcapabcheckqid(&ihck->hcksum_mid, ill->ill_lmod_rq)) {
3136 		ip1dbg(("ill_capability_hcksum_ack: mid token for hardware "
3137 		    "checksum capability isn't as expected; pass-thru "
3138 		    "module(s) detected, discarding capability\n"));
3139 		return;
3140 	}
3141 
3142 #define	CURR_HCKSUM_CAPAB				\
3143 	(HCKSUM_INET_PARTIAL | HCKSUM_INET_FULL_V4 |	\
3144 	HCKSUM_INET_FULL_V6 | HCKSUM_IPHDRCKSUM)
3145 
3146 	if ((ihck->hcksum_txflags & HCKSUM_ENABLE) &&
3147 	    (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB)) {
3148 		/* do ENABLE processing */
3149 		if (*ill_hcksum == NULL) {
3150 			*ill_hcksum = kmem_zalloc(sizeof (ill_hcksum_capab_t),
3151 			    KM_NOSLEEP);
3152 
3153 			if (*ill_hcksum == NULL) {
3154 				cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
3155 				    "could not enable hcksum version %d "
3156 				    "for %s (ENOMEM)\n", HCKSUM_CURRENT_VERSION,
3157 				    ill->ill_name);
3158 				return;
3159 			}
3160 		}
3161 
3162 		(*ill_hcksum)->ill_hcksum_version = ihck->hcksum_version;
3163 		(*ill_hcksum)->ill_hcksum_txflags = ihck->hcksum_txflags;
3164 		ill->ill_capabilities |= ILL_CAPAB_HCKSUM;
3165 		ip1dbg(("ill_capability_hcksum_ack: interface %s "
3166 		    "has enabled hardware checksumming\n ",
3167 		    ill->ill_name));
3168 	} else if (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB) {
3169 		/*
3170 		 * Enabling hardware checksum offload
3171 		 * Currently IP supports {TCP,UDP}/IPv4
3172 		 * partial and full cksum offload and
3173 		 * IPv4 header checksum offload.
3174 		 * Allocate new mblk which will
3175 		 * contain a new capability request
3176 		 * to enable hardware checksum offload.
3177 		 */
3178 		uint_t	size;
3179 		uchar_t	*rptr;
3180 
3181 		size = sizeof (dl_capability_req_t) +
3182 		    sizeof (dl_capability_sub_t) + isub->dl_length;
3183 
3184 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
3185 			cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
3186 			    "could not enable hardware cksum for %s (ENOMEM)\n",
3187 			    ill->ill_name);
3188 			return;
3189 		}
3190 
3191 		rptr = nmp->b_rptr;
3192 		/* initialize dl_capability_req_t */
3193 		ocap = (dl_capability_req_t *)nmp->b_rptr;
3194 		ocap->dl_sub_offset =
3195 		    sizeof (dl_capability_req_t);
3196 		ocap->dl_sub_length =
3197 		    sizeof (dl_capability_sub_t) +
3198 		    isub->dl_length;
3199 		nmp->b_rptr += sizeof (dl_capability_req_t);
3200 
3201 		/* initialize dl_capability_sub_t */
3202 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
3203 		nmp->b_rptr += sizeof (*isub);
3204 
3205 		/* initialize dl_capab_hcksum_t */
3206 		ohck = (dl_capab_hcksum_t *)nmp->b_rptr;
3207 		bcopy(ihck, ohck, sizeof (*ihck));
3208 
3209 		nmp->b_rptr = rptr;
3210 		ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
3211 
3212 		/* Set ENABLE flag */
3213 		ohck->hcksum_txflags &= CURR_HCKSUM_CAPAB;
3214 		ohck->hcksum_txflags |= HCKSUM_ENABLE;
3215 
3216 		/*
3217 		 * nmp points to a DL_CAPABILITY_REQ message to enable
3218 		 * hardware checksum acceleration.
3219 		 */
3220 		ill_dlpi_send(ill, nmp);
3221 	} else {
3222 		ip1dbg(("ill_capability_hcksum_ack: interface %s has "
3223 		    "advertised %x hardware checksum capability flags\n",
3224 		    ill->ill_name, ihck->hcksum_txflags));
3225 	}
3226 }
3227 
3228 static void
3229 ill_capability_hcksum_reset(ill_t *ill, mblk_t **sc_mp)
3230 {
3231 	mblk_t *mp;
3232 	dl_capab_hcksum_t *hck_subcap;
3233 	dl_capability_sub_t *dl_subcap;
3234 	int size;
3235 
3236 	if (!ILL_HCKSUM_CAPABLE(ill))
3237 		return;
3238 
3239 	ASSERT(ill->ill_hcksum_capab != NULL);
3240 	/*
3241 	 * Clear the capability flag for hardware checksum offload but
3242 	 * retain the ill_hcksum_capab structure since it's possible that
3243 	 * another thread is still referring to it.  The structure only
3244 	 * gets deallocated when we destroy the ill.
3245 	 */
3246 	ill->ill_capabilities &= ~ILL_CAPAB_HCKSUM;
3247 
3248 	size = sizeof (*dl_subcap) + sizeof (*hck_subcap);
3249 
3250 	mp = allocb(size, BPRI_HI);
3251 	if (mp == NULL) {
3252 		ip1dbg(("ill_capability_hcksum_reset: unable to allocate "
3253 		    "request to disable hardware checksum offload\n"));
3254 		return;
3255 	}
3256 
3257 	mp->b_wptr = mp->b_rptr + size;
3258 
3259 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
3260 	dl_subcap->dl_cap = DL_CAPAB_HCKSUM;
3261 	dl_subcap->dl_length = sizeof (*hck_subcap);
3262 
3263 	hck_subcap = (dl_capab_hcksum_t *)(dl_subcap + 1);
3264 	hck_subcap->hcksum_version = ill->ill_hcksum_capab->ill_hcksum_version;
3265 	hck_subcap->hcksum_txflags = 0;
3266 
3267 	if (*sc_mp != NULL)
3268 		linkb(*sc_mp, mp);
3269 	else
3270 		*sc_mp = mp;
3271 }
3272 
3273 static void
3274 ill_capability_zerocopy_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
3275 {
3276 	mblk_t *nmp = NULL;
3277 	dl_capability_req_t *oc;
3278 	dl_capab_zerocopy_t *zc_ic, *zc_oc;
3279 	ill_zerocopy_capab_t **ill_zerocopy_capab;
3280 	uint_t sub_dl_cap = isub->dl_cap;
3281 	uint8_t *capend;
3282 
3283 	ASSERT(sub_dl_cap == DL_CAPAB_ZEROCOPY);
3284 
3285 	ill_zerocopy_capab = (ill_zerocopy_capab_t **)&ill->ill_zerocopy_capab;
3286 
3287 	/*
3288 	 * Note: range checks here are not absolutely sufficient to
3289 	 * make us robust against malformed messages sent by drivers;
3290 	 * this is in keeping with the rest of IP's dlpi handling.
3291 	 * (Remember, it's coming from something else in the kernel
3292 	 * address space)
3293 	 */
3294 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
3295 	if (capend > mp->b_wptr) {
3296 		cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
3297 		    "malformed sub-capability too long for mblk");
3298 		return;
3299 	}
3300 
3301 	zc_ic = (dl_capab_zerocopy_t *)(isub + 1);
3302 	if (zc_ic->zerocopy_version != ZEROCOPY_VERSION_1) {
3303 		cmn_err(CE_CONT, "ill_capability_zerocopy_ack: "
3304 		    "unsupported ZEROCOPY sub-capability (version %d, "
3305 		    "expected %d)", zc_ic->zerocopy_version,
3306 		    ZEROCOPY_VERSION_1);
3307 		return;
3308 	}
3309 
3310 	if (!dlcapabcheckqid(&zc_ic->zerocopy_mid, ill->ill_lmod_rq)) {
3311 		ip1dbg(("ill_capability_zerocopy_ack: mid token for zerocopy "
3312 		    "capability isn't as expected; pass-thru module(s) "
3313 		    "detected, discarding capability\n"));
3314 		return;
3315 	}
3316 
3317 	if ((zc_ic->zerocopy_flags & DL_CAPAB_VMSAFE_MEM) != 0) {
3318 		if (*ill_zerocopy_capab == NULL) {
3319 			*ill_zerocopy_capab =
3320 			    kmem_zalloc(sizeof (ill_zerocopy_capab_t),
3321 			    KM_NOSLEEP);
3322 
3323 			if (*ill_zerocopy_capab == NULL) {
3324 				cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
3325 				    "could not enable Zero-copy version %d "
3326 				    "for %s (ENOMEM)\n", ZEROCOPY_VERSION_1,
3327 				    ill->ill_name);
3328 				return;
3329 			}
3330 		}
3331 
3332 		ip1dbg(("ill_capability_zerocopy_ack: interface %s "
3333 		    "supports Zero-copy version %d\n", ill->ill_name,
3334 		    ZEROCOPY_VERSION_1));
3335 
3336 		(*ill_zerocopy_capab)->ill_zerocopy_version =
3337 		    zc_ic->zerocopy_version;
3338 		(*ill_zerocopy_capab)->ill_zerocopy_flags =
3339 		    zc_ic->zerocopy_flags;
3340 
3341 		ill->ill_capabilities |= ILL_CAPAB_ZEROCOPY;
3342 	} else {
3343 		uint_t size;
3344 		uchar_t *rptr;
3345 
3346 		size = sizeof (dl_capability_req_t) +
3347 		    sizeof (dl_capability_sub_t) +
3348 		    sizeof (dl_capab_zerocopy_t);
3349 
3350 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
3351 			cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
3352 			    "could not enable zerocopy for %s (ENOMEM)\n",
3353 			    ill->ill_name);
3354 			return;
3355 		}
3356 
3357 		rptr = nmp->b_rptr;
3358 		/* initialize dl_capability_req_t */
3359 		oc = (dl_capability_req_t *)rptr;
3360 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
3361 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
3362 		    sizeof (dl_capab_zerocopy_t);
3363 		rptr += sizeof (dl_capability_req_t);
3364 
3365 		/* initialize dl_capability_sub_t */
3366 		bcopy(isub, rptr, sizeof (*isub));
3367 		rptr += sizeof (*isub);
3368 
3369 		/* initialize dl_capab_zerocopy_t */
3370 		zc_oc = (dl_capab_zerocopy_t *)rptr;
3371 		*zc_oc = *zc_ic;
3372 
3373 		ip1dbg(("ill_capability_zerocopy_ack: asking interface %s "
3374 		    "to enable zero-copy version %d\n", ill->ill_name,
3375 		    ZEROCOPY_VERSION_1));
3376 
3377 		/* set VMSAFE_MEM flag */
3378 		zc_oc->zerocopy_flags |= DL_CAPAB_VMSAFE_MEM;
3379 
3380 		/* nmp points to a DL_CAPABILITY_REQ message to enable zcopy */
3381 		ill_dlpi_send(ill, nmp);
3382 	}
3383 }
3384 
3385 static void
3386 ill_capability_zerocopy_reset(ill_t *ill, mblk_t **sc_mp)
3387 {
3388 	mblk_t *mp;
3389 	dl_capab_zerocopy_t *zerocopy_subcap;
3390 	dl_capability_sub_t *dl_subcap;
3391 	int size;
3392 
3393 	if (!(ill->ill_capabilities & ILL_CAPAB_ZEROCOPY))
3394 		return;
3395 
3396 	ASSERT(ill->ill_zerocopy_capab != NULL);
3397 	/*
3398 	 * Clear the capability flag for Zero-copy but retain the
3399 	 * ill_zerocopy_capab structure since it's possible that another
3400 	 * thread is still referring to it.  The structure only gets
3401 	 * deallocated when we destroy the ill.
3402 	 */
3403 	ill->ill_capabilities &= ~ILL_CAPAB_ZEROCOPY;
3404 
3405 	size = sizeof (*dl_subcap) + sizeof (*zerocopy_subcap);
3406 
3407 	mp = allocb(size, BPRI_HI);
3408 	if (mp == NULL) {
3409 		ip1dbg(("ill_capability_zerocopy_reset: unable to allocate "
3410 		    "request to disable Zero-copy\n"));
3411 		return;
3412 	}
3413 
3414 	mp->b_wptr = mp->b_rptr + size;
3415 
3416 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
3417 	dl_subcap->dl_cap = DL_CAPAB_ZEROCOPY;
3418 	dl_subcap->dl_length = sizeof (*zerocopy_subcap);
3419 
3420 	zerocopy_subcap = (dl_capab_zerocopy_t *)(dl_subcap + 1);
3421 	zerocopy_subcap->zerocopy_version =
3422 	    ill->ill_zerocopy_capab->ill_zerocopy_version;
3423 	zerocopy_subcap->zerocopy_flags = 0;
3424 
3425 	if (*sc_mp != NULL)
3426 		linkb(*sc_mp, mp);
3427 	else
3428 		*sc_mp = mp;
3429 }
3430 
3431 /*
3432  * Consume a new-style hardware capabilities negotiation ack.
3433  * Called from ip_rput_dlpi_writer().
3434  */
3435 void
3436 ill_capability_ack(ill_t *ill, mblk_t *mp)
3437 {
3438 	dl_capability_ack_t *capp;
3439 	dl_capability_sub_t *subp, *endp;
3440 
3441 	if (ill->ill_capab_state == IDMS_INPROGRESS)
3442 		ill->ill_capab_state = IDMS_OK;
3443 
3444 	capp = (dl_capability_ack_t *)mp->b_rptr;
3445 
3446 	if (capp->dl_sub_length == 0)
3447 		/* no new-style capabilities */
3448 		return;
3449 
3450 	/* make sure the driver supplied correct dl_sub_length */
3451 	if ((sizeof (*capp) + capp->dl_sub_length) > MBLKL(mp)) {
3452 		ip0dbg(("ill_capability_ack: bad DL_CAPABILITY_ACK, "
3453 		    "invalid dl_sub_length (%d)\n", capp->dl_sub_length));
3454 		return;
3455 	}
3456 
3457 #define	SC(base, offset) (dl_capability_sub_t *)(((uchar_t *)(base))+(offset))
3458 	/*
3459 	 * There are sub-capabilities. Process the ones we know about.
3460 	 * Loop until we don't have room for another sub-cap header..
3461 	 */
3462 	for (subp = SC(capp, capp->dl_sub_offset),
3463 	    endp = SC(subp, capp->dl_sub_length - sizeof (*subp));
3464 	    subp <= endp;
3465 	    subp = SC(subp, sizeof (dl_capability_sub_t) + subp->dl_length)) {
3466 
3467 		switch (subp->dl_cap) {
3468 		case DL_CAPAB_ID_WRAPPER:
3469 			ill_capability_id_ack(ill, mp, subp);
3470 			break;
3471 		default:
3472 			ill_capability_dispatch(ill, mp, subp, B_FALSE);
3473 			break;
3474 		}
3475 	}
3476 #undef SC
3477 }
3478 
3479 /*
3480  * This routine is called to scan the fragmentation reassembly table for
3481  * the specified ILL for any packets that are starting to smell.
3482  * dead_interval is the maximum time in seconds that will be tolerated.  It
3483  * will either be the value specified in ip_g_frag_timeout, or zero if the
3484  * ILL is shutting down and it is time to blow everything off.
3485  *
3486  * It returns the number of seconds (as a time_t) that the next frag timer
3487  * should be scheduled for, 0 meaning that the timer doesn't need to be
3488  * re-started.  Note that the method of calculating next_timeout isn't
3489  * entirely accurate since time will flow between the time we grab
3490  * current_time and the time we schedule the next timeout.  This isn't a
3491  * big problem since this is the timer for sending an ICMP reassembly time
3492  * exceeded messages, and it doesn't have to be exactly accurate.
3493  *
3494  * This function is
3495  * sometimes called as writer, although this is not required.
3496  */
3497 time_t
3498 ill_frag_timeout(ill_t *ill, time_t dead_interval)
3499 {
3500 	ipfb_t	*ipfb;
3501 	ipfb_t	*endp;
3502 	ipf_t	*ipf;
3503 	ipf_t	*ipfnext;
3504 	mblk_t	*mp;
3505 	time_t	current_time = gethrestime_sec();
3506 	time_t	next_timeout = 0;
3507 	uint32_t	hdr_length;
3508 	mblk_t	*send_icmp_head;
3509 	mblk_t	*send_icmp_head_v6;
3510 
3511 	ipfb = ill->ill_frag_hash_tbl;
3512 	if (ipfb == NULL)
3513 		return (B_FALSE);
3514 	endp = &ipfb[ILL_FRAG_HASH_TBL_COUNT];
3515 	/* Walk the frag hash table. */
3516 	for (; ipfb < endp; ipfb++) {
3517 		send_icmp_head = NULL;
3518 		send_icmp_head_v6 = NULL;
3519 		mutex_enter(&ipfb->ipfb_lock);
3520 		while ((ipf = ipfb->ipfb_ipf) != 0) {
3521 			time_t frag_time = current_time - ipf->ipf_timestamp;
3522 			time_t frag_timeout;
3523 
3524 			if (frag_time < dead_interval) {
3525 				/*
3526 				 * There are some outstanding fragments
3527 				 * that will timeout later.  Make note of
3528 				 * the time so that we can reschedule the
3529 				 * next timeout appropriately.
3530 				 */
3531 				frag_timeout = dead_interval - frag_time;
3532 				if (next_timeout == 0 ||
3533 				    frag_timeout < next_timeout) {
3534 					next_timeout = frag_timeout;
3535 				}
3536 				break;
3537 			}
3538 			/* Time's up.  Get it out of here. */
3539 			hdr_length = ipf->ipf_nf_hdr_len;
3540 			ipfnext = ipf->ipf_hash_next;
3541 			if (ipfnext)
3542 				ipfnext->ipf_ptphn = ipf->ipf_ptphn;
3543 			*ipf->ipf_ptphn = ipfnext;
3544 			mp = ipf->ipf_mp->b_cont;
3545 			for (; mp; mp = mp->b_cont) {
3546 				/* Extra points for neatness. */
3547 				IP_REASS_SET_START(mp, 0);
3548 				IP_REASS_SET_END(mp, 0);
3549 			}
3550 			mp = ipf->ipf_mp->b_cont;
3551 			ill->ill_frag_count -= ipf->ipf_count;
3552 			ASSERT(ipfb->ipfb_count >= ipf->ipf_count);
3553 			ipfb->ipfb_count -= ipf->ipf_count;
3554 			ASSERT(ipfb->ipfb_frag_pkts > 0);
3555 			ipfb->ipfb_frag_pkts--;
3556 			/*
3557 			 * We do not send any icmp message from here because
3558 			 * we currently are holding the ipfb_lock for this
3559 			 * hash chain. If we try and send any icmp messages
3560 			 * from here we may end up via a put back into ip
3561 			 * trying to get the same lock, causing a recursive
3562 			 * mutex panic. Instead we build a list and send all
3563 			 * the icmp messages after we have dropped the lock.
3564 			 */
3565 			if (ill->ill_isv6) {
3566 				BUMP_MIB(ill->ill_ip6_mib, ipv6ReasmFails);
3567 				if (hdr_length != 0) {
3568 					mp->b_next = send_icmp_head_v6;
3569 					send_icmp_head_v6 = mp;
3570 				} else {
3571 					freemsg(mp);
3572 				}
3573 			} else {
3574 				BUMP_MIB(&ip_mib, ipReasmFails);
3575 				if (hdr_length != 0) {
3576 					mp->b_next = send_icmp_head;
3577 					send_icmp_head = mp;
3578 				} else {
3579 					freemsg(mp);
3580 				}
3581 			}
3582 			freeb(ipf->ipf_mp);
3583 		}
3584 		mutex_exit(&ipfb->ipfb_lock);
3585 		/*
3586 		 * Now need to send any icmp messages that we delayed from
3587 		 * above.
3588 		 */
3589 		while (send_icmp_head_v6 != NULL) {
3590 			mp = send_icmp_head_v6;
3591 			send_icmp_head_v6 = send_icmp_head_v6->b_next;
3592 			mp->b_next = NULL;
3593 			icmp_time_exceeded_v6(ill->ill_wq, mp,
3594 			    ICMP_REASSEMBLY_TIME_EXCEEDED, B_FALSE, B_FALSE);
3595 		}
3596 		while (send_icmp_head != NULL) {
3597 			mp = send_icmp_head;
3598 			send_icmp_head = send_icmp_head->b_next;
3599 			mp->b_next = NULL;
3600 			icmp_time_exceeded(ill->ill_wq, mp,
3601 			    ICMP_REASSEMBLY_TIME_EXCEEDED);
3602 		}
3603 	}
3604 	/*
3605 	 * A non-dying ILL will use the return value to decide whether to
3606 	 * restart the frag timer, and for how long.
3607 	 */
3608 	return (next_timeout);
3609 }
3610 
3611 /*
3612  * This routine is called when the approximate count of mblk memory used
3613  * for the specified ILL has exceeded max_count.
3614  */
3615 void
3616 ill_frag_prune(ill_t *ill, uint_t max_count)
3617 {
3618 	ipfb_t	*ipfb;
3619 	ipf_t	*ipf;
3620 	size_t	count;
3621 
3622 	/*
3623 	 * If we are here within ip_min_frag_prune_time msecs remove
3624 	 * ill_frag_free_num_pkts oldest packets from each bucket and increment
3625 	 * ill_frag_free_num_pkts.
3626 	 */
3627 	mutex_enter(&ill->ill_lock);
3628 	if (TICK_TO_MSEC(lbolt - ill->ill_last_frag_clean_time) <=
3629 	    (ip_min_frag_prune_time != 0 ?
3630 	    ip_min_frag_prune_time : msec_per_tick)) {
3631 
3632 		ill->ill_frag_free_num_pkts++;
3633 
3634 	} else {
3635 		ill->ill_frag_free_num_pkts = 0;
3636 	}
3637 	ill->ill_last_frag_clean_time = lbolt;
3638 	mutex_exit(&ill->ill_lock);
3639 
3640 	/*
3641 	 * free ill_frag_free_num_pkts oldest packets from each bucket.
3642 	 */
3643 	if (ill->ill_frag_free_num_pkts != 0) {
3644 		int ix;
3645 
3646 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
3647 			ipfb = &ill->ill_frag_hash_tbl[ix];
3648 			mutex_enter(&ipfb->ipfb_lock);
3649 			if (ipfb->ipfb_ipf != NULL) {
3650 				ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf,
3651 				    ill->ill_frag_free_num_pkts);
3652 			}
3653 			mutex_exit(&ipfb->ipfb_lock);
3654 		}
3655 	}
3656 	/*
3657 	 * While the reassembly list for this ILL is too big, prune a fragment
3658 	 * queue by age, oldest first.  Note that the per ILL count is
3659 	 * approximate, while the per frag hash bucket counts are accurate.
3660 	 */
3661 	while (ill->ill_frag_count > max_count) {
3662 		int	ix;
3663 		ipfb_t	*oipfb = NULL;
3664 		uint_t	oldest = UINT_MAX;
3665 
3666 		count = 0;
3667 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
3668 			ipfb = &ill->ill_frag_hash_tbl[ix];
3669 			mutex_enter(&ipfb->ipfb_lock);
3670 			ipf = ipfb->ipfb_ipf;
3671 			if (ipf != NULL && ipf->ipf_gen < oldest) {
3672 				oldest = ipf->ipf_gen;
3673 				oipfb = ipfb;
3674 			}
3675 			count += ipfb->ipfb_count;
3676 			mutex_exit(&ipfb->ipfb_lock);
3677 		}
3678 		/* Refresh the per ILL count */
3679 		ill->ill_frag_count = count;
3680 		if (oipfb == NULL) {
3681 			ill->ill_frag_count = 0;
3682 			break;
3683 		}
3684 		if (count <= max_count)
3685 			return;	/* Somebody beat us to it, nothing to do */
3686 		mutex_enter(&oipfb->ipfb_lock);
3687 		ipf = oipfb->ipfb_ipf;
3688 		if (ipf != NULL) {
3689 			ill_frag_free_pkts(ill, oipfb, ipf, 1);
3690 		}
3691 		mutex_exit(&oipfb->ipfb_lock);
3692 	}
3693 }
3694 
3695 /*
3696  * free 'free_cnt' fragmented packets starting at ipf.
3697  */
3698 void
3699 ill_frag_free_pkts(ill_t *ill, ipfb_t *ipfb, ipf_t *ipf, int free_cnt)
3700 {
3701 	size_t	count;
3702 	mblk_t	*mp;
3703 	mblk_t	*tmp;
3704 	ipf_t **ipfp = ipf->ipf_ptphn;
3705 
3706 	ASSERT(MUTEX_HELD(&ipfb->ipfb_lock));
3707 	ASSERT(ipfp != NULL);
3708 	ASSERT(ipf != NULL);
3709 
3710 	while (ipf != NULL && free_cnt-- > 0) {
3711 		count = ipf->ipf_count;
3712 		mp = ipf->ipf_mp;
3713 		ipf = ipf->ipf_hash_next;
3714 		for (tmp = mp; tmp; tmp = tmp->b_cont) {
3715 			IP_REASS_SET_START(tmp, 0);
3716 			IP_REASS_SET_END(tmp, 0);
3717 		}
3718 		ill->ill_frag_count -= count;
3719 		ASSERT(ipfb->ipfb_count >= count);
3720 		ipfb->ipfb_count -= count;
3721 		ASSERT(ipfb->ipfb_frag_pkts > 0);
3722 		ipfb->ipfb_frag_pkts--;
3723 		freemsg(mp);
3724 		BUMP_MIB(&ip_mib, ipReasmFails);
3725 	}
3726 
3727 	if (ipf)
3728 		ipf->ipf_ptphn = ipfp;
3729 	ipfp[0] = ipf;
3730 }
3731 
3732 #define	ND_FORWARD_WARNING	"The <if>:ip*_forwarding ndd variables are " \
3733 	"obsolete and may be removed in a future release of Solaris.  Use " \
3734 	"ifconfig(1M) to manipulate the forwarding status of an interface."
3735 
3736 /*
3737  * For obsolete per-interface forwarding configuration;
3738  * called in response to ND_GET.
3739  */
3740 /* ARGSUSED */
3741 static int
3742 nd_ill_forward_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *ioc_cr)
3743 {
3744 	ill_t *ill = (ill_t *)cp;
3745 
3746 	cmn_err(CE_WARN, ND_FORWARD_WARNING);
3747 
3748 	(void) mi_mpprintf(mp, "%d", (ill->ill_flags & ILLF_ROUTER) != 0);
3749 	return (0);
3750 }
3751 
3752 /*
3753  * For obsolete per-interface forwarding configuration;
3754  * called in response to ND_SET.
3755  */
3756 /* ARGSUSED */
3757 static int
3758 nd_ill_forward_set(queue_t *q, mblk_t *mp, char *valuestr, caddr_t cp,
3759     cred_t *ioc_cr)
3760 {
3761 	long value;
3762 	int retval;
3763 
3764 	cmn_err(CE_WARN, ND_FORWARD_WARNING);
3765 
3766 	if (ddi_strtol(valuestr, NULL, 10, &value) != 0 ||
3767 	    value < 0 || value > 1) {
3768 		return (EINVAL);
3769 	}
3770 
3771 	rw_enter(&ill_g_lock, RW_READER);
3772 	retval = ill_forward_set(q, mp, (value != 0), cp);
3773 	rw_exit(&ill_g_lock);
3774 	return (retval);
3775 }
3776 
3777 /*
3778  * Set an ill's ILLF_ROUTER flag appropriately.  If the ill is part of an
3779  * IPMP group, make sure all ill's in the group adopt the new policy.  Send
3780  * up RTS_IFINFO routing socket messages for each interface whose flags we
3781  * change.
3782  */
3783 /* ARGSUSED */
3784 int
3785 ill_forward_set(queue_t *q, mblk_t *mp, boolean_t enable, caddr_t cp)
3786 {
3787 	ill_t *ill = (ill_t *)cp;
3788 	ill_group_t *illgrp;
3789 
3790 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ill_g_lock));
3791 
3792 	if ((enable && (ill->ill_flags & ILLF_ROUTER)) ||
3793 	    (!enable && !(ill->ill_flags & ILLF_ROUTER)) ||
3794 	    (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK))
3795 		return (EINVAL);
3796 
3797 	/*
3798 	 * If the ill is in an IPMP group, set the forwarding policy on all
3799 	 * members of the group to the same value.
3800 	 */
3801 	illgrp = ill->ill_group;
3802 	if (illgrp != NULL) {
3803 		ill_t *tmp_ill;
3804 
3805 		for (tmp_ill = illgrp->illgrp_ill; tmp_ill != NULL;
3806 		    tmp_ill = tmp_ill->ill_group_next) {
3807 			ip1dbg(("ill_forward_set: %s %s forwarding on %s",
3808 			    (enable ? "Enabling" : "Disabling"),
3809 			    (tmp_ill->ill_isv6 ? "IPv6" : "IPv4"),
3810 			    tmp_ill->ill_name));
3811 			mutex_enter(&tmp_ill->ill_lock);
3812 			if (enable)
3813 				tmp_ill->ill_flags |= ILLF_ROUTER;
3814 			else
3815 				tmp_ill->ill_flags &= ~ILLF_ROUTER;
3816 			mutex_exit(&tmp_ill->ill_lock);
3817 			if (tmp_ill->ill_isv6)
3818 				ill_set_nce_router_flags(tmp_ill, enable);
3819 			/* Notify routing socket listeners of this change. */
3820 			ip_rts_ifmsg(tmp_ill->ill_ipif);
3821 		}
3822 	} else {
3823 		ip1dbg(("ill_forward_set: %s %s forwarding on %s",
3824 		    (enable ? "Enabling" : "Disabling"),
3825 		    (ill->ill_isv6 ? "IPv6" : "IPv4"), ill->ill_name));
3826 		mutex_enter(&ill->ill_lock);
3827 		if (enable)
3828 			ill->ill_flags |= ILLF_ROUTER;
3829 		else
3830 			ill->ill_flags &= ~ILLF_ROUTER;
3831 		mutex_exit(&ill->ill_lock);
3832 		if (ill->ill_isv6)
3833 			ill_set_nce_router_flags(ill, enable);
3834 		/* Notify routing socket listeners of this change. */
3835 		ip_rts_ifmsg(ill->ill_ipif);
3836 	}
3837 
3838 	return (0);
3839 }
3840 
3841 /*
3842  * Based on the ILLF_ROUTER flag of an ill, make sure all local nce's for
3843  * addresses assigned to the ill have the NCE_F_ISROUTER flag appropriately
3844  * set or clear.
3845  */
3846 static void
3847 ill_set_nce_router_flags(ill_t *ill, boolean_t enable)
3848 {
3849 	ipif_t *ipif;
3850 	nce_t *nce;
3851 
3852 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
3853 		nce = ndp_lookup_v6(ill, &ipif->ipif_v6lcl_addr, B_FALSE);
3854 		if (nce != NULL) {
3855 			mutex_enter(&nce->nce_lock);
3856 			if (enable)
3857 				nce->nce_flags |= NCE_F_ISROUTER;
3858 			else
3859 				nce->nce_flags &= ~NCE_F_ISROUTER;
3860 			mutex_exit(&nce->nce_lock);
3861 			NCE_REFRELE(nce);
3862 		}
3863 	}
3864 }
3865 
3866 /*
3867  * Given an ill with a _valid_ name, add the ip_forwarding ndd variable
3868  * for this ill.  Make sure the v6/v4 question has been answered about this
3869  * ill.  The creation of this ndd variable is only for backwards compatibility.
3870  * The preferred way to control per-interface IP forwarding is through the
3871  * ILLF_ROUTER interface flag.
3872  */
3873 static int
3874 ill_set_ndd_name(ill_t *ill)
3875 {
3876 	char *suffix;
3877 
3878 	ASSERT(IAM_WRITER_ILL(ill));
3879 
3880 	if (ill->ill_isv6)
3881 		suffix = ipv6_forward_suffix;
3882 	else
3883 		suffix = ipv4_forward_suffix;
3884 
3885 	ill->ill_ndd_name = ill->ill_name + ill->ill_name_length;
3886 	bcopy(ill->ill_name, ill->ill_ndd_name, ill->ill_name_length - 1);
3887 	/*
3888 	 * Copies over the '\0'.
3889 	 * Note that strlen(suffix) is always bounded.
3890 	 */
3891 	bcopy(suffix, ill->ill_ndd_name + ill->ill_name_length - 1,
3892 	    strlen(suffix) + 1);
3893 
3894 	/*
3895 	 * Use of the nd table requires holding the reader lock.
3896 	 * Modifying the nd table thru nd_load/nd_unload requires
3897 	 * the writer lock.
3898 	 */
3899 	rw_enter(&ip_g_nd_lock, RW_WRITER);
3900 	if (!nd_load(&ip_g_nd, ill->ill_ndd_name, nd_ill_forward_get,
3901 	    nd_ill_forward_set, (caddr_t)ill)) {
3902 		/*
3903 		 * If the nd_load failed, it only meant that it could not
3904 		 * allocate a new bunch of room for further NDD expansion.
3905 		 * Because of that, the ill_ndd_name will be set to 0, and
3906 		 * this interface is at the mercy of the global ip_forwarding
3907 		 * variable.
3908 		 */
3909 		rw_exit(&ip_g_nd_lock);
3910 		ill->ill_ndd_name = NULL;
3911 		return (ENOMEM);
3912 	}
3913 	rw_exit(&ip_g_nd_lock);
3914 	return (0);
3915 }
3916 
3917 /*
3918  * Intializes the context structure and returns the first ill in the list
3919  * cuurently start_list and end_list can have values:
3920  * MAX_G_HEADS		Traverse both IPV4 and IPV6 lists.
3921  * IP_V4_G_HEAD		Traverse IPV4 list only.
3922  * IP_V6_G_HEAD		Traverse IPV6 list only.
3923  */
3924 
3925 /*
3926  * We don't check for CONDEMNED ills here. Caller must do that if
3927  * necessary under the ill lock.
3928  */
3929 ill_t *
3930 ill_first(int start_list, int end_list, ill_walk_context_t *ctx)
3931 {
3932 	ill_if_t *ifp;
3933 	ill_t *ill;
3934 	avl_tree_t *avl_tree;
3935 
3936 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
3937 	ASSERT(end_list <= MAX_G_HEADS && start_list >= 0);
3938 
3939 	/*
3940 	 * setup the lists to search
3941 	 */
3942 	if (end_list != MAX_G_HEADS) {
3943 		ctx->ctx_current_list = start_list;
3944 		ctx->ctx_last_list = end_list;
3945 	} else {
3946 		ctx->ctx_last_list = MAX_G_HEADS - 1;
3947 		ctx->ctx_current_list = 0;
3948 	}
3949 
3950 	while (ctx->ctx_current_list <= ctx->ctx_last_list) {
3951 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list);
3952 		if (ifp != (ill_if_t *)
3953 		    &IP_VX_ILL_G_LIST(ctx->ctx_current_list)) {
3954 			avl_tree = &ifp->illif_avl_by_ppa;
3955 			ill = avl_first(avl_tree);
3956 			/*
3957 			 * ill is guaranteed to be non NULL or ifp should have
3958 			 * not existed.
3959 			 */
3960 			ASSERT(ill != NULL);
3961 			return (ill);
3962 		}
3963 		ctx->ctx_current_list++;
3964 	}
3965 
3966 	return (NULL);
3967 }
3968 
3969 /*
3970  * returns the next ill in the list. ill_first() must have been called
3971  * before calling ill_next() or bad things will happen.
3972  */
3973 
3974 /*
3975  * We don't check for CONDEMNED ills here. Caller must do that if
3976  * necessary under the ill lock.
3977  */
3978 ill_t *
3979 ill_next(ill_walk_context_t *ctx, ill_t *lastill)
3980 {
3981 	ill_if_t *ifp;
3982 	ill_t *ill;
3983 
3984 
3985 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
3986 	ASSERT(lastill->ill_ifptr != (ill_if_t *)
3987 	    &IP_VX_ILL_G_LIST(ctx->ctx_current_list));
3988 	if ((ill = avl_walk(&lastill->ill_ifptr->illif_avl_by_ppa, lastill,
3989 	    AVL_AFTER)) != NULL) {
3990 		return (ill);
3991 	}
3992 
3993 	/* goto next ill_ifp in the list. */
3994 	ifp = lastill->ill_ifptr->illif_next;
3995 
3996 	/* make sure not at end of circular list */
3997 	while (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(ctx->ctx_current_list)) {
3998 		if (++ctx->ctx_current_list > ctx->ctx_last_list)
3999 			return (NULL);
4000 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list);
4001 	}
4002 
4003 	return (avl_first(&ifp->illif_avl_by_ppa));
4004 }
4005 
4006 /*
4007  * Check interface name for correct format which is name+ppa.
4008  * name can contain characters and digits, the right most digits
4009  * make up the ppa number. use of octal is not allowed, name must contain
4010  * a ppa, return pointer to the start of ppa.
4011  * In case of error return NULL.
4012  */
4013 static char *
4014 ill_get_ppa_ptr(char *name)
4015 {
4016 	int namelen = mi_strlen(name);
4017 
4018 	int len = namelen;
4019 
4020 	name += len;
4021 	while (len > 0) {
4022 		name--;
4023 		if (*name < '0' || *name > '9')
4024 			break;
4025 		len--;
4026 	}
4027 
4028 	/* empty string, all digits, or no trailing digits */
4029 	if (len == 0 || len == (int)namelen)
4030 		return (NULL);
4031 
4032 	name++;
4033 	/* check for attempted use of octal */
4034 	if (*name == '0' && len != (int)namelen - 1)
4035 		return (NULL);
4036 	return (name);
4037 }
4038 
4039 /*
4040  * use avl tree to locate the ill.
4041  */
4042 static ill_t *
4043 ill_find_by_name(char *name, boolean_t isv6, queue_t *q, mblk_t *mp,
4044     ipsq_func_t func, int *error)
4045 {
4046 	char *ppa_ptr = NULL;
4047 	int len;
4048 	uint_t ppa;
4049 	ill_t *ill = NULL;
4050 	ill_if_t *ifp;
4051 	int list;
4052 	ipsq_t *ipsq;
4053 
4054 	if (error != NULL)
4055 		*error = 0;
4056 
4057 	/*
4058 	 * get ppa ptr
4059 	 */
4060 	if (isv6)
4061 		list = IP_V6_G_HEAD;
4062 	else
4063 		list = IP_V4_G_HEAD;
4064 
4065 	if ((ppa_ptr = ill_get_ppa_ptr(name)) == NULL) {
4066 		if (error != NULL)
4067 			*error = ENXIO;
4068 		return (NULL);
4069 	}
4070 
4071 	len = ppa_ptr - name + 1;
4072 
4073 	ppa = stoi(&ppa_ptr);
4074 
4075 	ifp = IP_VX_ILL_G_LIST(list);
4076 
4077 	while (ifp != (ill_if_t *)&IP_VX_ILL_G_LIST(list)) {
4078 		/*
4079 		 * match is done on len - 1 as the name is not null
4080 		 * terminated it contains ppa in addition to the interface
4081 		 * name.
4082 		 */
4083 		if ((ifp->illif_name_len == len) &&
4084 		    bcmp(ifp->illif_name, name, len - 1) == 0) {
4085 			break;
4086 		} else {
4087 			ifp = ifp->illif_next;
4088 		}
4089 	}
4090 
4091 
4092 	if (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(list)) {
4093 		/*
4094 		 * Even the interface type does not exist.
4095 		 */
4096 		if (error != NULL)
4097 			*error = ENXIO;
4098 		return (NULL);
4099 	}
4100 
4101 	ill = avl_find(&ifp->illif_avl_by_ppa, (void *) &ppa, NULL);
4102 	if (ill != NULL) {
4103 		/*
4104 		 * The block comment at the start of ipif_down
4105 		 * explains the use of the macros used below
4106 		 */
4107 		GRAB_CONN_LOCK(q);
4108 		mutex_enter(&ill->ill_lock);
4109 		if (ILL_CAN_LOOKUP(ill)) {
4110 			ill_refhold_locked(ill);
4111 			mutex_exit(&ill->ill_lock);
4112 			RELEASE_CONN_LOCK(q);
4113 			return (ill);
4114 		} else if (ILL_CAN_WAIT(ill, q)) {
4115 			ipsq = ill->ill_phyint->phyint_ipsq;
4116 			mutex_enter(&ipsq->ipsq_lock);
4117 			mutex_exit(&ill->ill_lock);
4118 			ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
4119 			mutex_exit(&ipsq->ipsq_lock);
4120 			RELEASE_CONN_LOCK(q);
4121 			*error = EINPROGRESS;
4122 			return (NULL);
4123 		}
4124 		mutex_exit(&ill->ill_lock);
4125 		RELEASE_CONN_LOCK(q);
4126 	}
4127 	if (error != NULL)
4128 		*error = ENXIO;
4129 	return (NULL);
4130 }
4131 
4132 /*
4133  * comparison function for use with avl.
4134  */
4135 static int
4136 ill_compare_ppa(const void *ppa_ptr, const void *ill_ptr)
4137 {
4138 	uint_t ppa;
4139 	uint_t ill_ppa;
4140 
4141 	ASSERT(ppa_ptr != NULL && ill_ptr != NULL);
4142 
4143 	ppa = *((uint_t *)ppa_ptr);
4144 	ill_ppa = ((const ill_t *)ill_ptr)->ill_ppa;
4145 	/*
4146 	 * We want the ill with the lowest ppa to be on the
4147 	 * top.
4148 	 */
4149 	if (ill_ppa < ppa)
4150 		return (1);
4151 	if (ill_ppa > ppa)
4152 		return (-1);
4153 	return (0);
4154 }
4155 
4156 /*
4157  * remove an interface type from the global list.
4158  */
4159 static void
4160 ill_delete_interface_type(ill_if_t *interface)
4161 {
4162 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
4163 
4164 	ASSERT(interface != NULL);
4165 	ASSERT(avl_numnodes(&interface->illif_avl_by_ppa) == 0);
4166 
4167 	avl_destroy(&interface->illif_avl_by_ppa);
4168 	if (interface->illif_ppa_arena != NULL)
4169 		vmem_destroy(interface->illif_ppa_arena);
4170 
4171 	remque(interface);
4172 
4173 	mi_free(interface);
4174 }
4175 
4176 /*
4177  * remove ill from the global list.
4178  */
4179 static void
4180 ill_glist_delete(ill_t *ill)
4181 {
4182 	if (ill == NULL)
4183 		return;
4184 
4185 	rw_enter(&ill_g_lock, RW_WRITER);
4186 	/*
4187 	 * If the ill was never inserted into the AVL tree
4188 	 * we skip the if branch.
4189 	 */
4190 	if (ill->ill_ifptr != NULL) {
4191 		/*
4192 		 * remove from AVL tree and free ppa number
4193 		 */
4194 		avl_remove(&ill->ill_ifptr->illif_avl_by_ppa, ill);
4195 
4196 		if (ill->ill_ifptr->illif_ppa_arena != NULL) {
4197 			vmem_free(ill->ill_ifptr->illif_ppa_arena,
4198 			    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
4199 		}
4200 		if (avl_numnodes(&ill->ill_ifptr->illif_avl_by_ppa) == 0) {
4201 			ill_delete_interface_type(ill->ill_ifptr);
4202 		}
4203 
4204 		/*
4205 		 * Indicate ill is no longer in the list.
4206 		 */
4207 		ill->ill_ifptr = NULL;
4208 		ill->ill_name_length = 0;
4209 		ill->ill_name[0] = '\0';
4210 		ill->ill_ppa = UINT_MAX;
4211 	}
4212 	ill_phyint_free(ill);
4213 	rw_exit(&ill_g_lock);
4214 }
4215 
4216 /*
4217  * allocate a ppa, if the number of plumbed interfaces of this type are
4218  * less than ill_no_arena do a linear search to find a unused ppa.
4219  * When the number goes beyond ill_no_arena switch to using an arena.
4220  * Note: ppa value of zero cannot be allocated from vmem_arena as it
4221  * is the return value for an error condition, so allocation starts at one
4222  * and is decremented by one.
4223  */
4224 static int
4225 ill_alloc_ppa(ill_if_t *ifp, ill_t *ill)
4226 {
4227 	ill_t *tmp_ill;
4228 	uint_t start, end;
4229 	int ppa;
4230 
4231 	if (ifp->illif_ppa_arena == NULL &&
4232 	    (avl_numnodes(&ifp->illif_avl_by_ppa) + 1 > ill_no_arena)) {
4233 		/*
4234 		 * Create an arena.
4235 		 */
4236 		ifp->illif_ppa_arena = vmem_create(ifp->illif_name,
4237 		    (void *)1, UINT_MAX - 1, 1, NULL, NULL,
4238 		    NULL, 0, VM_SLEEP | VMC_IDENTIFIER);
4239 			/* allocate what has already been assigned */
4240 		for (tmp_ill = avl_first(&ifp->illif_avl_by_ppa);
4241 		    tmp_ill != NULL; tmp_ill = avl_walk(&ifp->illif_avl_by_ppa,
4242 		    tmp_ill, AVL_AFTER)) {
4243 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
4244 			    1,		/* size */
4245 			    1,		/* align/quantum */
4246 			    0,		/* phase */
4247 			    0,		/* nocross */
4248 		(void *)((uintptr_t)tmp_ill->ill_ppa + 1), /* minaddr */
4249 		(void *)((uintptr_t)tmp_ill->ill_ppa + 2), /* maxaddr */
4250 			    VM_NOSLEEP|VM_FIRSTFIT);
4251 			if (ppa == 0) {
4252 				ip1dbg(("ill_alloc_ppa: ppa allocation"
4253 				    " failed while switching"));
4254 				vmem_destroy(ifp->illif_ppa_arena);
4255 				ifp->illif_ppa_arena = NULL;
4256 				break;
4257 			}
4258 		}
4259 	}
4260 
4261 	if (ifp->illif_ppa_arena != NULL) {
4262 		if (ill->ill_ppa == UINT_MAX) {
4263 			ppa = (int)(uintptr_t)vmem_alloc(ifp->illif_ppa_arena,
4264 			    1, VM_NOSLEEP|VM_FIRSTFIT);
4265 			if (ppa == 0)
4266 				return (EAGAIN);
4267 			ill->ill_ppa = --ppa;
4268 		} else {
4269 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
4270 			    1, 		/* size */
4271 			    1, 		/* align/quantum */
4272 			    0, 		/* phase */
4273 			    0, 		/* nocross */
4274 			    (void *)(uintptr_t)(ill->ill_ppa + 1), /* minaddr */
4275 			    (void *)(uintptr_t)(ill->ill_ppa + 2), /* maxaddr */
4276 			    VM_NOSLEEP|VM_FIRSTFIT);
4277 			/*
4278 			 * Most likely the allocation failed because
4279 			 * the requested ppa was in use.
4280 			 */
4281 			if (ppa == 0)
4282 				return (EEXIST);
4283 		}
4284 		return (0);
4285 	}
4286 
4287 	/*
4288 	 * No arena is in use and not enough (>ill_no_arena) interfaces have
4289 	 * been plumbed to create one. Do a linear search to get a unused ppa.
4290 	 */
4291 	if (ill->ill_ppa == UINT_MAX) {
4292 		end = UINT_MAX - 1;
4293 		start = 0;
4294 	} else {
4295 		end = start = ill->ill_ppa;
4296 	}
4297 
4298 	tmp_ill = avl_find(&ifp->illif_avl_by_ppa, (void *)&start, NULL);
4299 	while (tmp_ill != NULL && tmp_ill->ill_ppa == start) {
4300 		if (start++ >= end) {
4301 			if (ill->ill_ppa == UINT_MAX)
4302 				return (EAGAIN);
4303 			else
4304 				return (EEXIST);
4305 		}
4306 		tmp_ill = avl_walk(&ifp->illif_avl_by_ppa, tmp_ill, AVL_AFTER);
4307 	}
4308 	ill->ill_ppa = start;
4309 	return (0);
4310 }
4311 
4312 /*
4313  * Insert ill into the list of configured ill's. Once this function completes,
4314  * the ill is globally visible and is available through lookups. More precisely
4315  * this happens after the caller drops the ill_g_lock.
4316  */
4317 static int
4318 ill_glist_insert(ill_t *ill, char *name, boolean_t isv6)
4319 {
4320 	ill_if_t *ill_interface;
4321 	avl_index_t where = 0;
4322 	int error;
4323 	int name_length;
4324 	int index;
4325 	boolean_t check_length = B_FALSE;
4326 
4327 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
4328 
4329 	name_length = mi_strlen(name) + 1;
4330 
4331 	if (isv6)
4332 		index = IP_V6_G_HEAD;
4333 	else
4334 		index = IP_V4_G_HEAD;
4335 
4336 	ill_interface = IP_VX_ILL_G_LIST(index);
4337 	/*
4338 	 * Search for interface type based on name
4339 	 */
4340 	while (ill_interface != (ill_if_t *)&IP_VX_ILL_G_LIST(index)) {
4341 		if ((ill_interface->illif_name_len == name_length) &&
4342 		    (strcmp(ill_interface->illif_name, name) == 0)) {
4343 			break;
4344 		}
4345 		ill_interface = ill_interface->illif_next;
4346 	}
4347 
4348 	/*
4349 	 * Interface type not found, create one.
4350 	 */
4351 	if (ill_interface == (ill_if_t *)&IP_VX_ILL_G_LIST(index)) {
4352 
4353 		ill_g_head_t ghead;
4354 
4355 		/*
4356 		 * allocate ill_if_t structure
4357 		 */
4358 
4359 		ill_interface = (ill_if_t *)mi_zalloc(sizeof (ill_if_t));
4360 		if (ill_interface == NULL) {
4361 			return (ENOMEM);
4362 		}
4363 
4364 
4365 
4366 		(void) strcpy(ill_interface->illif_name, name);
4367 		ill_interface->illif_name_len = name_length;
4368 
4369 		avl_create(&ill_interface->illif_avl_by_ppa,
4370 		    ill_compare_ppa, sizeof (ill_t),
4371 		    offsetof(struct ill_s, ill_avl_byppa));
4372 
4373 		/*
4374 		 * link the structure in the back to maintain order
4375 		 * of configuration for ifconfig output.
4376 		 */
4377 		ghead = ill_g_heads[index];
4378 		insque(ill_interface, ghead.ill_g_list_tail);
4379 
4380 	}
4381 
4382 	if (ill->ill_ppa == UINT_MAX)
4383 		check_length = B_TRUE;
4384 
4385 	error = ill_alloc_ppa(ill_interface, ill);
4386 	if (error != 0) {
4387 		if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
4388 			ill_delete_interface_type(ill->ill_ifptr);
4389 		return (error);
4390 	}
4391 
4392 	/*
4393 	 * When the ppa is choosen by the system, check that there is
4394 	 * enough space to insert ppa. if a specific ppa was passed in this
4395 	 * check is not required as the interface name passed in will have
4396 	 * the right ppa in it.
4397 	 */
4398 	if (check_length) {
4399 		/*
4400 		 * UINT_MAX - 1 should fit in 10 chars, alloc 12 chars.
4401 		 */
4402 		char buf[sizeof (uint_t) * 3];
4403 
4404 		/*
4405 		 * convert ppa to string to calculate the amount of space
4406 		 * required for it in the name.
4407 		 */
4408 		numtos(ill->ill_ppa, buf);
4409 
4410 		/* Do we have enough space to insert ppa ? */
4411 
4412 		if ((mi_strlen(name) + mi_strlen(buf) + 1) > LIFNAMSIZ) {
4413 			/* Free ppa and interface type struct */
4414 			if (ill_interface->illif_ppa_arena != NULL) {
4415 				vmem_free(ill_interface->illif_ppa_arena,
4416 				    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
4417 			}
4418 			if (avl_numnodes(&ill_interface->illif_avl_by_ppa) ==
4419 			    0) {
4420 				ill_delete_interface_type(ill->ill_ifptr);
4421 			}
4422 
4423 			return (EINVAL);
4424 		}
4425 	}
4426 
4427 	(void) sprintf(ill->ill_name, "%s%u", name, ill->ill_ppa);
4428 	ill->ill_name_length = mi_strlen(ill->ill_name) + 1;
4429 
4430 	(void) avl_find(&ill_interface->illif_avl_by_ppa, &ill->ill_ppa,
4431 	    &where);
4432 	ill->ill_ifptr = ill_interface;
4433 	avl_insert(&ill_interface->illif_avl_by_ppa, ill, where);
4434 
4435 	ill_phyint_reinit(ill);
4436 	return (0);
4437 }
4438 
4439 /* Initialize the per phyint (per IPMP group) ipsq used for serialization */
4440 static boolean_t
4441 ipsq_init(ill_t *ill)
4442 {
4443 	ipsq_t  *ipsq;
4444 
4445 	/* Init the ipsq and impicitly enter as writer */
4446 	ill->ill_phyint->phyint_ipsq =
4447 	    kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP);
4448 	if (ill->ill_phyint->phyint_ipsq == NULL)
4449 		return (B_FALSE);
4450 	ipsq = ill->ill_phyint->phyint_ipsq;
4451 	ipsq->ipsq_phyint_list = ill->ill_phyint;
4452 	ill->ill_phyint->phyint_ipsq_next = NULL;
4453 	mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, 0);
4454 	ipsq->ipsq_refs = 1;
4455 	ipsq->ipsq_writer = curthread;
4456 	ipsq->ipsq_reentry_cnt = 1;
4457 #ifdef ILL_DEBUG
4458 	ipsq->ipsq_depth = getpcstack((pc_t *)ipsq->ipsq_stack, IP_STACK_DEPTH);
4459 #endif
4460 	(void) strcpy(ipsq->ipsq_name, ill->ill_name);
4461 	return (B_TRUE);
4462 }
4463 
4464 /*
4465  * ill_init is called by ip_open when a device control stream is opened.
4466  * It does a few initializations, and shoots a DL_INFO_REQ message down
4467  * to the driver.  The response is later picked up in ip_rput_dlpi and
4468  * used to set up default mechanisms for talking to the driver.  (Always
4469  * called as writer.)
4470  *
4471  * If this function returns error, ip_open will call ip_close which in
4472  * turn will call ill_delete to clean up any memory allocated here that
4473  * is not yet freed.
4474  */
4475 int
4476 ill_init(queue_t *q, ill_t *ill)
4477 {
4478 	int	count;
4479 	dl_info_req_t	*dlir;
4480 	mblk_t	*info_mp;
4481 	uchar_t *frag_ptr;
4482 
4483 	/*
4484 	 * The ill is initialized to zero by mi_alloc*(). In addition
4485 	 * some fields already contain valid values, initialized in
4486 	 * ip_open(), before we reach here.
4487 	 */
4488 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, 0);
4489 
4490 	ill->ill_rq = q;
4491 	ill->ill_wq = WR(q);
4492 
4493 	info_mp = allocb(MAX(sizeof (dl_info_req_t), sizeof (dl_info_ack_t)),
4494 	    BPRI_HI);
4495 	if (info_mp == NULL)
4496 		return (ENOMEM);
4497 
4498 	/*
4499 	 * Allocate sufficient space to contain our fragment hash table and
4500 	 * the device name.
4501 	 */
4502 	frag_ptr = (uchar_t *)mi_zalloc(ILL_FRAG_HASH_TBL_SIZE +
4503 	    2 * LIFNAMSIZ + 5 + strlen(ipv6_forward_suffix));
4504 	if (frag_ptr == NULL) {
4505 		freemsg(info_mp);
4506 		return (ENOMEM);
4507 	}
4508 	ill->ill_frag_ptr = frag_ptr;
4509 	ill->ill_frag_free_num_pkts = 0;
4510 	ill->ill_last_frag_clean_time = 0;
4511 	ill->ill_frag_hash_tbl = (ipfb_t *)frag_ptr;
4512 	ill->ill_name = (char *)(frag_ptr + ILL_FRAG_HASH_TBL_SIZE);
4513 	for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
4514 		mutex_init(&ill->ill_frag_hash_tbl[count].ipfb_lock,
4515 		    NULL, MUTEX_DEFAULT, NULL);
4516 	}
4517 
4518 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
4519 	if (ill->ill_phyint == NULL) {
4520 		freemsg(info_mp);
4521 		mi_free(frag_ptr);
4522 		return (ENOMEM);
4523 	}
4524 
4525 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
4526 	/*
4527 	 * For now pretend this is a v4 ill. We need to set phyint_ill*
4528 	 * at this point because of the following reason. If we can't
4529 	 * enter the ipsq at some point and cv_wait, the writer that
4530 	 * wakes us up tries to locate us using the list of all phyints
4531 	 * in an ipsq and the ills from the phyint thru the phyint_ill*.
4532 	 * If we don't set it now, we risk a missed wakeup.
4533 	 */
4534 	ill->ill_phyint->phyint_illv4 = ill;
4535 	ill->ill_ppa = UINT_MAX;
4536 	ill->ill_fastpath_list = &ill->ill_fastpath_list;
4537 
4538 	if (!ipsq_init(ill)) {
4539 		freemsg(info_mp);
4540 		mi_free(frag_ptr);
4541 		mi_free(ill->ill_phyint);
4542 		return (ENOMEM);
4543 	}
4544 
4545 	ill->ill_state_flags |= ILL_LL_SUBNET_PENDING;
4546 
4547 
4548 	/* Frag queue limit stuff */
4549 	ill->ill_frag_count = 0;
4550 	ill->ill_ipf_gen = 0;
4551 
4552 	ill->ill_global_timer = INFINITY;
4553 	ill->ill_mcast_type = IGMP_V3_ROUTER;	/* == MLD_V2_ROUTER */
4554 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
4555 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
4556 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
4557 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
4558 
4559 	/*
4560 	 * Initialize IPv6 configuration variables.  The IP module is always
4561 	 * opened as an IPv4 module.  Instead tracking down the cases where
4562 	 * it switches to do ipv6, we'll just initialize the IPv6 configuration
4563 	 * here for convenience, this has no effect until the ill is set to do
4564 	 * IPv6.
4565 	 */
4566 	ill->ill_reachable_time = ND_REACHABLE_TIME;
4567 	ill->ill_reachable_retrans_time = ND_RETRANS_TIMER;
4568 	ill->ill_xmit_count = ND_MAX_MULTICAST_SOLICIT;
4569 	ill->ill_max_buf = ND_MAX_Q;
4570 	ill->ill_refcnt = 0;
4571 
4572 	/* Send down the Info Request to the driver. */
4573 	info_mp->b_datap->db_type = M_PCPROTO;
4574 	dlir = (dl_info_req_t *)info_mp->b_rptr;
4575 	info_mp->b_wptr = (uchar_t *)&dlir[1];
4576 	dlir->dl_primitive = DL_INFO_REQ;
4577 
4578 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
4579 
4580 	qprocson(q);
4581 	ill_dlpi_send(ill, info_mp);
4582 
4583 	return (0);
4584 }
4585 
4586 /*
4587  * ill_dls_info
4588  * creates datalink socket info from the device.
4589  */
4590 int
4591 ill_dls_info(struct sockaddr_dl *sdl, const ipif_t *ipif)
4592 {
4593 	size_t	length;
4594 	ill_t	*ill = ipif->ipif_ill;
4595 
4596 	sdl->sdl_family = AF_LINK;
4597 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
4598 	sdl->sdl_type = ipif->ipif_type;
4599 	(void) ipif_get_name(ipif, sdl->sdl_data, sizeof (sdl->sdl_data));
4600 	length = mi_strlen(sdl->sdl_data);
4601 	ASSERT(length < 256);
4602 	sdl->sdl_nlen = (uchar_t)length;
4603 	sdl->sdl_alen = ill->ill_phys_addr_length;
4604 	mutex_enter(&ill->ill_lock);
4605 	if (ill->ill_phys_addr_length != 0 && ill->ill_phys_addr != NULL) {
4606 		bcopy(ill->ill_phys_addr, &sdl->sdl_data[length],
4607 		    ill->ill_phys_addr_length);
4608 	}
4609 	mutex_exit(&ill->ill_lock);
4610 	sdl->sdl_slen = 0;
4611 	return (sizeof (struct sockaddr_dl));
4612 }
4613 
4614 /*
4615  * ill_xarp_info
4616  * creates xarp info from the device.
4617  */
4618 static int
4619 ill_xarp_info(struct sockaddr_dl *sdl, ill_t *ill)
4620 {
4621 	sdl->sdl_family = AF_LINK;
4622 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
4623 	sdl->sdl_type = ill->ill_type;
4624 	(void) ipif_get_name(ill->ill_ipif, sdl->sdl_data,
4625 	    sizeof (sdl->sdl_data));
4626 	sdl->sdl_nlen = (uchar_t)mi_strlen(sdl->sdl_data);
4627 	sdl->sdl_alen = ill->ill_phys_addr_length;
4628 	sdl->sdl_slen = 0;
4629 	return (sdl->sdl_nlen);
4630 }
4631 
4632 static int
4633 loopback_kstat_update(kstat_t *ksp, int rw)
4634 {
4635 	kstat_named_t *kn = KSTAT_NAMED_PTR(ksp);
4636 
4637 	if (rw == KSTAT_WRITE)
4638 		return (EACCES);
4639 	kn[0].value.ui32 = loopback_packets;
4640 	kn[1].value.ui32 = loopback_packets;
4641 	return (0);
4642 }
4643 
4644 
4645 /*
4646  * Has ifindex been plumbed already.
4647  */
4648 static boolean_t
4649 phyint_exists(uint_t index)
4650 {
4651 	phyint_t *phyi;
4652 
4653 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
4654 	/*
4655 	 * Indexes are stored in the phyint - a common structure
4656 	 * to both IPv4 and IPv6.
4657 	 */
4658 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_index,
4659 	    (void *) &index, NULL);
4660 	return (phyi != NULL);
4661 }
4662 
4663 /*
4664  * Assign a unique interface index for the phyint.
4665  */
4666 static boolean_t
4667 phyint_assign_ifindex(phyint_t *phyi)
4668 {
4669 	uint_t starting_index;
4670 
4671 	ASSERT(phyi->phyint_ifindex == 0);
4672 	if (!ill_index_wrap) {
4673 		phyi->phyint_ifindex = ill_index++;
4674 		if (ill_index == 0) {
4675 			/* Reached the uint_t limit Next time wrap  */
4676 			ill_index_wrap = B_TRUE;
4677 		}
4678 		return (B_TRUE);
4679 	}
4680 
4681 	/*
4682 	 * Start reusing unused indexes. Note that we hold the ill_g_lock
4683 	 * at this point and don't want to call any function that attempts
4684 	 * to get the lock again.
4685 	 */
4686 	starting_index = ill_index++;
4687 	for (; ill_index != starting_index; ill_index++) {
4688 		if (ill_index != 0 && !phyint_exists(ill_index)) {
4689 			/* found unused index - use it */
4690 			phyi->phyint_ifindex = ill_index;
4691 			return (B_TRUE);
4692 		}
4693 	}
4694 
4695 	/*
4696 	 * all interface indicies are inuse.
4697 	 */
4698 	return (B_FALSE);
4699 }
4700 
4701 /*
4702  * Return a pointer to the ill which matches the supplied name.  Note that
4703  * the ill name length includes the null termination character.  (May be
4704  * called as writer.)
4705  * If do_alloc and the interface is "lo0" it will be automatically created.
4706  * Cannot bump up reference on condemned ills. So dup detect can't be done
4707  * using this func.
4708  */
4709 ill_t *
4710 ill_lookup_on_name(char *name, boolean_t do_alloc, boolean_t isv6,
4711     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, boolean_t *did_alloc)
4712 {
4713 	ill_t	*ill;
4714 	ipif_t	*ipif;
4715 	kstat_named_t	*kn;
4716 	boolean_t isloopback;
4717 	ipsq_t *old_ipsq;
4718 
4719 	isloopback = mi_strcmp(name, ipif_loopback_name) == 0;
4720 
4721 	rw_enter(&ill_g_lock, RW_READER);
4722 	ill = ill_find_by_name(name, isv6, q, mp, func, error);
4723 	rw_exit(&ill_g_lock);
4724 	if (ill != NULL || (error != NULL && *error == EINPROGRESS))
4725 		return (ill);
4726 
4727 	/*
4728 	 * Couldn't find it.  Does this happen to be a lookup for the
4729 	 * loopback device and are we allowed to allocate it?
4730 	 */
4731 	if (!isloopback || !do_alloc)
4732 		return (NULL);
4733 
4734 	rw_enter(&ill_g_lock, RW_WRITER);
4735 
4736 	ill = ill_find_by_name(name, isv6, q, mp, func, error);
4737 	if (ill != NULL || (error != NULL && *error == EINPROGRESS)) {
4738 		rw_exit(&ill_g_lock);
4739 		return (ill);
4740 	}
4741 
4742 	/* Create the loopback device on demand */
4743 	ill = (ill_t *)(mi_alloc(sizeof (ill_t) +
4744 	    sizeof (ipif_loopback_name), BPRI_MED));
4745 	if (ill == NULL)
4746 		goto done;
4747 
4748 	*ill = ill_null;
4749 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, NULL);
4750 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
4751 	if (ill->ill_phyint == NULL)
4752 		goto done;
4753 
4754 	if (isv6)
4755 		ill->ill_phyint->phyint_illv6 = ill;
4756 	else
4757 		ill->ill_phyint->phyint_illv4 = ill;
4758 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
4759 	ill->ill_max_frag = IP_LOOPBACK_MTU;
4760 	/* Add room for tcp+ip headers */
4761 	if (isv6) {
4762 		ill->ill_isv6 = B_TRUE;
4763 		ill->ill_max_frag += IPV6_HDR_LEN + 20;	/* for TCP */
4764 		if (!ill_allocate_mibs(ill))
4765 			goto done;
4766 	} else {
4767 		ill->ill_max_frag += IP_SIMPLE_HDR_LENGTH + 20;
4768 	}
4769 	ill->ill_max_mtu = ill->ill_max_frag;
4770 	/*
4771 	 * ipif_loopback_name can't be pointed at directly because its used
4772 	 * by both the ipv4 and ipv6 interfaces.  When the ill is removed
4773 	 * from the glist, ill_glist_delete() sets the first character of
4774 	 * ill_name to '\0'.
4775 	 */
4776 	ill->ill_name = (char *)ill + sizeof (*ill);
4777 	(void) strcpy(ill->ill_name, ipif_loopback_name);
4778 	ill->ill_name_length = sizeof (ipif_loopback_name);
4779 	/* Set ill_name_set for ill_phyint_reinit to work properly */
4780 
4781 	ill->ill_global_timer = INFINITY;
4782 	ill->ill_mcast_type = IGMP_V3_ROUTER;	/* == MLD_V2_ROUTER */
4783 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
4784 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
4785 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
4786 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
4787 
4788 	/* No resolver here. */
4789 	ill->ill_net_type = IRE_LOOPBACK;
4790 
4791 	/* Initialize the ipsq */
4792 	if (!ipsq_init(ill))
4793 		goto done;
4794 
4795 	ill->ill_phyint->phyint_ipsq->ipsq_writer = NULL;
4796 	ill->ill_phyint->phyint_ipsq->ipsq_reentry_cnt--;
4797 	ASSERT(ill->ill_phyint->phyint_ipsq->ipsq_reentry_cnt == 0);
4798 #ifdef ILL_DEBUG
4799 	ill->ill_phyint->phyint_ipsq->ipsq_depth = 0;
4800 #endif
4801 	ipif = ipif_allocate(ill, 0L, IRE_LOOPBACK, B_TRUE);
4802 	if (ipif == NULL)
4803 		goto done;
4804 
4805 	ill->ill_flags = ILLF_MULTICAST;
4806 
4807 	/* Set up default loopback address and mask. */
4808 	if (!isv6) {
4809 		ipaddr_t inaddr_loopback = htonl(INADDR_LOOPBACK);
4810 
4811 		IN6_IPADDR_TO_V4MAPPED(inaddr_loopback, &ipif->ipif_v6lcl_addr);
4812 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
4813 		V4MASK_TO_V6(htonl(IN_CLASSA_NET), ipif->ipif_v6net_mask);
4814 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
4815 		    ipif->ipif_v6subnet);
4816 		ill->ill_flags |= ILLF_IPV4;
4817 	} else {
4818 		ipif->ipif_v6lcl_addr = ipv6_loopback;
4819 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
4820 		ipif->ipif_v6net_mask = ipv6_all_ones;
4821 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
4822 		    ipif->ipif_v6subnet);
4823 		ill->ill_flags |= ILLF_IPV6;
4824 	}
4825 
4826 	/*
4827 	 * Chain us in at the end of the ill list. hold the ill
4828 	 * before we make it globally visible. 1 for the lookup.
4829 	 */
4830 	ill->ill_refcnt = 0;
4831 	ill_refhold(ill);
4832 
4833 	ill->ill_frag_count = 0;
4834 	ill->ill_frag_free_num_pkts = 0;
4835 	ill->ill_last_frag_clean_time = 0;
4836 
4837 	old_ipsq = ill->ill_phyint->phyint_ipsq;
4838 
4839 	if (ill_glist_insert(ill, "lo", isv6) != 0)
4840 		cmn_err(CE_PANIC, "cannot insert loopback interface");
4841 
4842 	/* Let SCTP know so that it can add this to its list */
4843 	sctp_update_ill(ill, SCTP_ILL_INSERT);
4844 
4845 	/* Let SCTP know about this IPIF, so that it can add it to its list */
4846 	sctp_update_ipif(ipif, SCTP_IPIF_INSERT);
4847 
4848 	/*
4849 	 * If the ipsq was changed in ill_phyint_reinit free the old ipsq.
4850 	 */
4851 	if (old_ipsq != ill->ill_phyint->phyint_ipsq) {
4852 		/* Loopback ills aren't in any IPMP group */
4853 		ASSERT(!(old_ipsq->ipsq_flags & IPSQ_GROUP));
4854 		ipsq_delete(old_ipsq);
4855 	}
4856 
4857 	/*
4858 	 * Delay this till the ipif is allocated as ipif_allocate
4859 	 * de-references ill_phyint for getting the ifindex. We
4860 	 * can't do this before ipif_allocate because ill_phyint_reinit
4861 	 * -> phyint_assign_ifindex expects ipif to be present.
4862 	 */
4863 	mutex_enter(&ill->ill_phyint->phyint_lock);
4864 	ill->ill_phyint->phyint_flags |= PHYI_LOOPBACK | PHYI_VIRTUAL;
4865 	mutex_exit(&ill->ill_phyint->phyint_lock);
4866 
4867 	if (loopback_ksp == NULL) {
4868 		/* Export loopback interface statistics */
4869 		loopback_ksp = kstat_create("lo", 0, ipif_loopback_name, "net",
4870 		    KSTAT_TYPE_NAMED, 2, 0);
4871 		if (loopback_ksp != NULL) {
4872 			loopback_ksp->ks_update = loopback_kstat_update;
4873 			kn = KSTAT_NAMED_PTR(loopback_ksp);
4874 			kstat_named_init(&kn[0], "ipackets", KSTAT_DATA_UINT32);
4875 			kstat_named_init(&kn[1], "opackets", KSTAT_DATA_UINT32);
4876 			kstat_install(loopback_ksp);
4877 		}
4878 	}
4879 
4880 	if (error != NULL)
4881 		*error = 0;
4882 	*did_alloc = B_TRUE;
4883 	rw_exit(&ill_g_lock);
4884 	return (ill);
4885 done:
4886 	if (ill != NULL) {
4887 		if (ill->ill_phyint != NULL) {
4888 			ipsq_t	*ipsq;
4889 
4890 			ipsq = ill->ill_phyint->phyint_ipsq;
4891 			if (ipsq != NULL)
4892 				kmem_free(ipsq, sizeof (ipsq_t));
4893 			mi_free(ill->ill_phyint);
4894 		}
4895 		ill_free_mib(ill);
4896 		mi_free(ill);
4897 	}
4898 	rw_exit(&ill_g_lock);
4899 	if (error != NULL)
4900 		*error = ENOMEM;
4901 	return (NULL);
4902 }
4903 
4904 /*
4905  * Return a pointer to the ill which matches the index and IP version type.
4906  */
4907 ill_t *
4908 ill_lookup_on_ifindex(uint_t index, boolean_t isv6, queue_t *q, mblk_t *mp,
4909     ipsq_func_t func, int *err)
4910 {
4911 	ill_t	*ill;
4912 	ipsq_t  *ipsq;
4913 	phyint_t *phyi;
4914 
4915 	ASSERT((q == NULL && mp == NULL && func == NULL && err == NULL) ||
4916 	    (q != NULL && mp != NULL && func != NULL && err != NULL));
4917 
4918 	if (err != NULL)
4919 		*err = 0;
4920 
4921 	/*
4922 	 * Indexes are stored in the phyint - a common structure
4923 	 * to both IPv4 and IPv6.
4924 	 */
4925 	rw_enter(&ill_g_lock, RW_READER);
4926 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_index,
4927 	    (void *) &index, NULL);
4928 	if (phyi != NULL) {
4929 		ill = isv6 ? phyi->phyint_illv6: phyi->phyint_illv4;
4930 		if (ill != NULL) {
4931 			/*
4932 			 * The block comment at the start of ipif_down
4933 			 * explains the use of the macros used below
4934 			 */
4935 			GRAB_CONN_LOCK(q);
4936 			mutex_enter(&ill->ill_lock);
4937 			if (ILL_CAN_LOOKUP(ill)) {
4938 				ill_refhold_locked(ill);
4939 				mutex_exit(&ill->ill_lock);
4940 				RELEASE_CONN_LOCK(q);
4941 				rw_exit(&ill_g_lock);
4942 				return (ill);
4943 			} else if (ILL_CAN_WAIT(ill, q)) {
4944 				ipsq = ill->ill_phyint->phyint_ipsq;
4945 				mutex_enter(&ipsq->ipsq_lock);
4946 				rw_exit(&ill_g_lock);
4947 				mutex_exit(&ill->ill_lock);
4948 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
4949 				mutex_exit(&ipsq->ipsq_lock);
4950 				RELEASE_CONN_LOCK(q);
4951 				*err = EINPROGRESS;
4952 				return (NULL);
4953 			}
4954 			RELEASE_CONN_LOCK(q);
4955 			mutex_exit(&ill->ill_lock);
4956 		}
4957 	}
4958 	rw_exit(&ill_g_lock);
4959 	if (err != NULL)
4960 		*err = ENXIO;
4961 	return (NULL);
4962 }
4963 
4964 /*
4965  * Obtain a reference to the ill. The ill_refcnt is a dynamic refcnt
4966  * that gives a running thread a reference to the ill. This reference must be
4967  * released by the thread when it is done accessing the ill and related
4968  * objects. ill_refcnt can not be used to account for static references
4969  * such as other structures pointing to an ill. Callers must generally
4970  * check whether an ill can be refheld by using ILL_CAN_LOOKUP macros
4971  * or be sure that the ill is not being deleted or changing state before
4972  * calling the refhold functions. A non-zero ill_refcnt ensures that the
4973  * ill won't change any of its critical state such as address, netmask etc.
4974  */
4975 void
4976 ill_refhold(ill_t *ill)
4977 {
4978 	mutex_enter(&ill->ill_lock);
4979 	ill->ill_refcnt++;
4980 	ILL_TRACE_REF(ill);
4981 	mutex_exit(&ill->ill_lock);
4982 }
4983 
4984 void
4985 ill_refhold_locked(ill_t *ill)
4986 {
4987 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4988 	ill->ill_refcnt++;
4989 	ILL_TRACE_REF(ill);
4990 }
4991 
4992 int
4993 ill_check_and_refhold(ill_t *ill)
4994 {
4995 	mutex_enter(&ill->ill_lock);
4996 	if (ILL_CAN_LOOKUP(ill)) {
4997 		ill_refhold_locked(ill);
4998 		mutex_exit(&ill->ill_lock);
4999 		return (0);
5000 	}
5001 	mutex_exit(&ill->ill_lock);
5002 	return (ILL_LOOKUP_FAILED);
5003 }
5004 
5005 /*
5006  * Must not be called while holding any locks. Otherwise if this is
5007  * the last reference to be released, there is a chance of recursive mutex
5008  * panic due to ill_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
5009  * to restart an ioctl.
5010  */
5011 void
5012 ill_refrele(ill_t *ill)
5013 {
5014 	mutex_enter(&ill->ill_lock);
5015 	ASSERT(ill->ill_refcnt != 0);
5016 	ill->ill_refcnt--;
5017 	ILL_UNTRACE_REF(ill);
5018 	if (ill->ill_refcnt != 0) {
5019 		/* Every ire pointing to the ill adds 1 to ill_refcnt */
5020 		mutex_exit(&ill->ill_lock);
5021 		return;
5022 	}
5023 
5024 	/* Drops the ill_lock */
5025 	ipif_ill_refrele_tail(ill);
5026 }
5027 
5028 /*
5029  * Obtain a weak reference count on the ill. This reference ensures the
5030  * ill won't be freed, but the ill may change any of its critical state
5031  * such as netmask, address etc. Returns an error if the ill has started
5032  * closing.
5033  */
5034 boolean_t
5035 ill_waiter_inc(ill_t *ill)
5036 {
5037 	mutex_enter(&ill->ill_lock);
5038 	if (ill->ill_state_flags & ILL_CONDEMNED) {
5039 		mutex_exit(&ill->ill_lock);
5040 		return (B_FALSE);
5041 	}
5042 	ill->ill_waiters++;
5043 	mutex_exit(&ill->ill_lock);
5044 	return (B_TRUE);
5045 }
5046 
5047 void
5048 ill_waiter_dcr(ill_t *ill)
5049 {
5050 	mutex_enter(&ill->ill_lock);
5051 	ill->ill_waiters--;
5052 	if (ill->ill_waiters == 0)
5053 		cv_broadcast(&ill->ill_cv);
5054 	mutex_exit(&ill->ill_lock);
5055 }
5056 
5057 /*
5058  * Named Dispatch routine to produce a formatted report on all ILLs.
5059  * This report is accessed by using the ndd utility to "get" ND variable
5060  * "ip_ill_status".
5061  */
5062 /* ARGSUSED */
5063 int
5064 ip_ill_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
5065 {
5066 	ill_t		*ill;
5067 	ill_walk_context_t ctx;
5068 
5069 	(void) mi_mpprintf(mp,
5070 	    "ILL      " MI_COL_HDRPAD_STR
5071 	/*   01234567[89ABCDEF] */
5072 	    "rq       " MI_COL_HDRPAD_STR
5073 	/*   01234567[89ABCDEF] */
5074 	    "wq       " MI_COL_HDRPAD_STR
5075 	/*   01234567[89ABCDEF] */
5076 	    "upcnt mxfrg err name");
5077 	/*   12345 12345 123 xxxxxxxx  */
5078 
5079 	rw_enter(&ill_g_lock, RW_READER);
5080 	ill = ILL_START_WALK_ALL(&ctx);
5081 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5082 		(void) mi_mpprintf(mp,
5083 		    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR
5084 		    "%05u %05u %03d %s",
5085 		    (void *)ill, (void *)ill->ill_rq, (void *)ill->ill_wq,
5086 		    ill->ill_ipif_up_count,
5087 		    ill->ill_max_frag, ill->ill_error, ill->ill_name);
5088 	}
5089 	rw_exit(&ill_g_lock);
5090 
5091 	return (0);
5092 }
5093 
5094 /*
5095  * Named Dispatch routine to produce a formatted report on all IPIFs.
5096  * This report is accessed by using the ndd utility to "get" ND variable
5097  * "ip_ipif_status".
5098  */
5099 /* ARGSUSED */
5100 int
5101 ip_ipif_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
5102 {
5103 	char	buf1[INET6_ADDRSTRLEN];
5104 	char	buf2[INET6_ADDRSTRLEN];
5105 	char	buf3[INET6_ADDRSTRLEN];
5106 	char	buf4[INET6_ADDRSTRLEN];
5107 	char	buf5[INET6_ADDRSTRLEN];
5108 	char	buf6[INET6_ADDRSTRLEN];
5109 	char	buf[LIFNAMSIZ];
5110 	ill_t	*ill;
5111 	ipif_t	*ipif;
5112 	nv_t	*nvp;
5113 	uint64_t flags;
5114 	zoneid_t zoneid;
5115 	ill_walk_context_t ctx;
5116 
5117 	(void) mi_mpprintf(mp,
5118 	    "IPIF metric mtu in/out/forward name zone flags...\n"
5119 	    "\tlocal address\n"
5120 	    "\tsrc address\n"
5121 	    "\tsubnet\n"
5122 	    "\tmask\n"
5123 	    "\tbroadcast\n"
5124 	    "\tp-p-dst");
5125 
5126 	ASSERT(q->q_next == NULL);
5127 	zoneid = Q_TO_CONN(q)->conn_zoneid;	/* IP is a driver */
5128 
5129 	rw_enter(&ill_g_lock, RW_READER);
5130 	ill = ILL_START_WALK_ALL(&ctx);
5131 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5132 		for (ipif = ill->ill_ipif; ipif; ipif = ipif->ipif_next) {
5133 			if (zoneid != GLOBAL_ZONEID &&
5134 			    zoneid != ipif->ipif_zoneid &&
5135 			    ipif->ipif_zoneid != ALL_ZONES)
5136 				continue;
5137 			(void) mi_mpprintf(mp,
5138 			    MI_COL_PTRFMT_STR
5139 			    "%04u %05u %u/%u/%u %s %d",
5140 			    (void *)ipif,
5141 			    ipif->ipif_metric, ipif->ipif_mtu,
5142 			    ipif->ipif_ib_pkt_count,
5143 			    ipif->ipif_ob_pkt_count,
5144 			    ipif->ipif_fo_pkt_count,
5145 			    ipif_get_name(ipif, buf, sizeof (buf)),
5146 			    ipif->ipif_zoneid);
5147 
5148 		flags = ipif->ipif_flags | ipif->ipif_ill->ill_flags |
5149 		    ipif->ipif_ill->ill_phyint->phyint_flags;
5150 
5151 		/* Tack on text strings for any flags. */
5152 		nvp = ipif_nv_tbl;
5153 		for (; nvp < A_END(ipif_nv_tbl); nvp++) {
5154 			if (nvp->nv_value & flags)
5155 				(void) mi_mpprintf_nr(mp, " %s",
5156 				    nvp->nv_name);
5157 		}
5158 		(void) mi_mpprintf(mp,
5159 		    "\t%s\n\t%s\n\t%s\n\t%s\n\t%s\n\t%s",
5160 		    inet_ntop(AF_INET6,
5161 			&ipif->ipif_v6lcl_addr, buf1, sizeof (buf1)),
5162 		    inet_ntop(AF_INET6,
5163 			&ipif->ipif_v6src_addr, buf2, sizeof (buf2)),
5164 		    inet_ntop(AF_INET6,
5165 			&ipif->ipif_v6subnet, buf3, sizeof (buf3)),
5166 		    inet_ntop(AF_INET6,
5167 			&ipif->ipif_v6net_mask, buf4, sizeof (buf4)),
5168 		    inet_ntop(AF_INET6,
5169 			&ipif->ipif_v6brd_addr, buf5, sizeof (buf5)),
5170 		    inet_ntop(AF_INET6,
5171 			&ipif->ipif_v6pp_dst_addr,
5172 			buf6, sizeof (buf6)));
5173 		}
5174 	}
5175 	rw_exit(&ill_g_lock);
5176 	return (0);
5177 }
5178 
5179 /*
5180  * ip_ll_subnet_defaults is called when we get the DL_INFO_ACK back from the
5181  * driver.  We construct best guess defaults for lower level information that
5182  * we need.  If an interface is brought up without injection of any overriding
5183  * information from outside, we have to be ready to go with these defaults.
5184  * When we get the first DL_INFO_ACK (from ip_open() sending a DL_INFO_REQ)
5185  * we primarely want the dl_provider_style.
5186  * The subsequent DL_INFO_ACK is received after doing a DL_ATTACH and DL_BIND
5187  * at which point we assume the other part of the information is valid.
5188  */
5189 void
5190 ip_ll_subnet_defaults(ill_t *ill, mblk_t *mp)
5191 {
5192 	uchar_t		*brdcst_addr;
5193 	uint_t		brdcst_addr_length, phys_addr_length;
5194 	t_scalar_t	sap_length;
5195 	dl_info_ack_t	*dlia;
5196 	ip_m_t		*ipm;
5197 	dl_qos_cl_sel1_t *sel1;
5198 
5199 	ASSERT(IAM_WRITER_ILL(ill));
5200 
5201 	/*
5202 	 * Till the ill is fully up ILL_CHANGING will be set and
5203 	 * the ill is not globally visible. So no need for a lock.
5204 	 */
5205 	dlia = (dl_info_ack_t *)mp->b_rptr;
5206 	ill->ill_mactype = dlia->dl_mac_type;
5207 
5208 	ipm = ip_m_lookup(dlia->dl_mac_type);
5209 	if (ipm == NULL) {
5210 		ipm = ip_m_lookup(DL_OTHER);
5211 		ASSERT(ipm != NULL);
5212 	}
5213 	ill->ill_media = ipm;
5214 
5215 	/*
5216 	 * When the new DLPI stuff is ready we'll pull lengths
5217 	 * from dlia.
5218 	 */
5219 	if (dlia->dl_version == DL_VERSION_2) {
5220 		brdcst_addr_length = dlia->dl_brdcst_addr_length;
5221 		brdcst_addr = mi_offset_param(mp, dlia->dl_brdcst_addr_offset,
5222 		    brdcst_addr_length);
5223 		if (brdcst_addr == NULL) {
5224 			brdcst_addr_length = 0;
5225 		}
5226 		sap_length = dlia->dl_sap_length;
5227 		phys_addr_length = dlia->dl_addr_length - ABS(sap_length);
5228 		ip1dbg(("ip: bcast_len %d, sap_len %d, phys_len %d\n",
5229 		    brdcst_addr_length, sap_length, phys_addr_length));
5230 	} else {
5231 		brdcst_addr_length = 6;
5232 		brdcst_addr = ip_six_byte_all_ones;
5233 		sap_length = -2;
5234 		phys_addr_length = brdcst_addr_length;
5235 	}
5236 
5237 	ill->ill_bcast_addr_length = brdcst_addr_length;
5238 	ill->ill_phys_addr_length = phys_addr_length;
5239 	ill->ill_sap_length = sap_length;
5240 	ill->ill_max_frag = dlia->dl_max_sdu;
5241 	ill->ill_max_mtu = ill->ill_max_frag;
5242 
5243 	ill->ill_type = ipm->ip_m_type;
5244 
5245 	if (!ill->ill_dlpi_style_set) {
5246 		if (dlia->dl_provider_style == DL_STYLE2)
5247 			ill->ill_needs_attach = 1;
5248 
5249 		/*
5250 		 * Allocate the first ipif on this ill. We don't delay it
5251 		 * further as ioctl handling assumes atleast one ipif to
5252 		 * be present.
5253 		 *
5254 		 * At this point we don't know whether the ill is v4 or v6.
5255 		 * We will know this whan the SIOCSLIFNAME happens and
5256 		 * the correct value for ill_isv6 will be assigned in
5257 		 * ipif_set_values(). We need to hold the ill lock and
5258 		 * clear the ILL_LL_SUBNET_PENDING flag and atomically do
5259 		 * the wakeup.
5260 		 */
5261 		(void) ipif_allocate(ill, 0, IRE_LOCAL,
5262 		    dlia->dl_provider_style == DL_STYLE2 ? B_FALSE : B_TRUE);
5263 		mutex_enter(&ill->ill_lock);
5264 		ASSERT(ill->ill_dlpi_style_set == 0);
5265 		ill->ill_dlpi_style_set = 1;
5266 		ill->ill_state_flags &= ~ILL_LL_SUBNET_PENDING;
5267 		cv_broadcast(&ill->ill_cv);
5268 		mutex_exit(&ill->ill_lock);
5269 		freemsg(mp);
5270 		return;
5271 	}
5272 	ASSERT(ill->ill_ipif != NULL);
5273 	/*
5274 	 * We know whether it is IPv4 or IPv6 now, as this is the
5275 	 * second DL_INFO_ACK we are recieving in response to the
5276 	 * DL_INFO_REQ sent in ipif_set_values.
5277 	 */
5278 	if (ill->ill_isv6)
5279 		ill->ill_sap = IP6_DL_SAP;
5280 	else
5281 		ill->ill_sap = IP_DL_SAP;
5282 	/*
5283 	 * Set ipif_mtu which is used to set the IRE's
5284 	 * ire_max_frag value. The driver could have sent
5285 	 * a different mtu from what it sent last time. No
5286 	 * need to call ipif_mtu_change because IREs have
5287 	 * not yet been created.
5288 	 */
5289 	ill->ill_ipif->ipif_mtu = ill->ill_max_mtu;
5290 	/*
5291 	 * Clear all the flags that were set based on ill_bcast_addr_length
5292 	 * and ill_phys_addr_length (in ipif_set_values) as these could have
5293 	 * changed now and we need to re-evaluate.
5294 	 */
5295 	ill->ill_flags &= ~(ILLF_MULTICAST | ILLF_NONUD | ILLF_NOARP);
5296 	ill->ill_ipif->ipif_flags &= ~(IPIF_BROADCAST | IPIF_POINTOPOINT);
5297 
5298 	/*
5299 	 * Free ill_resolver_mp and ill_bcast_mp as things could have
5300 	 * changed now.
5301 	 */
5302 	if (ill->ill_bcast_addr_length == 0) {
5303 		if (ill->ill_resolver_mp != NULL)
5304 			freemsg(ill->ill_resolver_mp);
5305 		if (ill->ill_bcast_mp != NULL)
5306 			freemsg(ill->ill_bcast_mp);
5307 		if (ill->ill_flags & ILLF_XRESOLV)
5308 			ill->ill_net_type = IRE_IF_RESOLVER;
5309 		else
5310 			ill->ill_net_type = IRE_IF_NORESOLVER;
5311 		ill->ill_resolver_mp = ill_dlur_gen(NULL,
5312 		    ill->ill_phys_addr_length,
5313 		    ill->ill_sap,
5314 		    ill->ill_sap_length);
5315 		ill->ill_bcast_mp = copymsg(ill->ill_resolver_mp);
5316 
5317 		if (ill->ill_isv6)
5318 			/*
5319 			 * Note: xresolv interfaces will eventually need NOARP
5320 			 * set here as well, but that will require those
5321 			 * external resolvers to have some knowledge of
5322 			 * that flag and act appropriately. Not to be changed
5323 			 * at present.
5324 			 */
5325 			ill->ill_flags |= ILLF_NONUD;
5326 		else
5327 			ill->ill_flags |= ILLF_NOARP;
5328 
5329 		if (ill->ill_phys_addr_length == 0) {
5330 			if (ill->ill_media->ip_m_mac_type == SUNW_DL_VNI) {
5331 				ill->ill_ipif->ipif_flags |= IPIF_NOXMIT;
5332 				ill->ill_phyint->phyint_flags |= PHYI_VIRTUAL;
5333 			} else {
5334 				/* pt-pt supports multicast. */
5335 				ill->ill_flags |= ILLF_MULTICAST;
5336 				ill->ill_ipif->ipif_flags |= IPIF_POINTOPOINT;
5337 			}
5338 		}
5339 	} else {
5340 		ill->ill_net_type = IRE_IF_RESOLVER;
5341 		if (ill->ill_bcast_mp != NULL)
5342 			freemsg(ill->ill_bcast_mp);
5343 		ill->ill_bcast_mp = ill_dlur_gen(brdcst_addr,
5344 		    ill->ill_bcast_addr_length, ill->ill_sap,
5345 		    ill->ill_sap_length);
5346 		/*
5347 		 * Later detect lack of DLPI driver multicast
5348 		 * capability by catching DL_ENABMULTI errors in
5349 		 * ip_rput_dlpi.
5350 		 */
5351 		ill->ill_flags |= ILLF_MULTICAST;
5352 		if (!ill->ill_isv6)
5353 			ill->ill_ipif->ipif_flags |= IPIF_BROADCAST;
5354 	}
5355 	/* By default an interface does not support any CoS marking */
5356 	ill->ill_flags &= ~ILLF_COS_ENABLED;
5357 
5358 	/*
5359 	 * If we get QoS information in DL_INFO_ACK, the device supports
5360 	 * some form of CoS marking, set ILLF_COS_ENABLED.
5361 	 */
5362 	sel1 = (dl_qos_cl_sel1_t *)mi_offset_param(mp, dlia->dl_qos_offset,
5363 	    dlia->dl_qos_length);
5364 	if ((sel1 != NULL) && (sel1->dl_qos_type == DL_QOS_CL_SEL1)) {
5365 		ill->ill_flags |= ILLF_COS_ENABLED;
5366 	}
5367 
5368 	/* Clear any previous error indication. */
5369 	ill->ill_error = 0;
5370 	freemsg(mp);
5371 }
5372 
5373 /*
5374  * Perform various checks to verify that an address would make sense as a
5375  * local, remote, or subnet interface address.
5376  */
5377 static boolean_t
5378 ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask)
5379 {
5380 	ipaddr_t	net_mask;
5381 
5382 	/*
5383 	 * Don't allow all zeroes, all ones or experimental address, but allow
5384 	 * all ones netmask.
5385 	 */
5386 	if ((net_mask = ip_net_mask(addr)) == 0)
5387 		return (B_FALSE);
5388 	/* A given netmask overrides the "guess" netmask */
5389 	if (subnet_mask != 0)
5390 		net_mask = subnet_mask;
5391 	if ((net_mask != ~(ipaddr_t)0) && ((addr == (addr & net_mask)) ||
5392 	    (addr == (addr | ~net_mask)))) {
5393 		return (B_FALSE);
5394 	}
5395 	if (CLASSD(addr))
5396 		return (B_FALSE);
5397 
5398 	return (B_TRUE);
5399 }
5400 
5401 /*
5402  * ipif_lookup_group
5403  * Returns held ipif
5404  */
5405 ipif_t *
5406 ipif_lookup_group(ipaddr_t group, zoneid_t zoneid)
5407 {
5408 	ire_t	*ire;
5409 	ipif_t	*ipif;
5410 
5411 	ire = ire_lookup_multi(group, zoneid);
5412 	if (ire == NULL)
5413 		return (NULL);
5414 	ipif = ire->ire_ipif;
5415 	ipif_refhold(ipif);
5416 	ire_refrele(ire);
5417 	return (ipif);
5418 }
5419 
5420 /*
5421  * Look for an ipif with the specified interface address and destination.
5422  * The destination address is used only for matching point-to-point interfaces.
5423  */
5424 ipif_t *
5425 ipif_lookup_interface(ipaddr_t if_addr, ipaddr_t dst, queue_t *q, mblk_t *mp,
5426     ipsq_func_t func, int *error)
5427 {
5428 	ipif_t	*ipif;
5429 	ill_t	*ill;
5430 	ill_walk_context_t ctx;
5431 	ipsq_t	*ipsq;
5432 
5433 	if (error != NULL)
5434 		*error = 0;
5435 
5436 	/*
5437 	 * First match all the point-to-point interfaces
5438 	 * before looking at non-point-to-point interfaces.
5439 	 * This is done to avoid returning non-point-to-point
5440 	 * ipif instead of unnumbered point-to-point ipif.
5441 	 */
5442 	rw_enter(&ill_g_lock, RW_READER);
5443 	ill = ILL_START_WALK_V4(&ctx);
5444 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5445 		GRAB_CONN_LOCK(q);
5446 		mutex_enter(&ill->ill_lock);
5447 		for (ipif = ill->ill_ipif; ipif != NULL;
5448 		    ipif = ipif->ipif_next) {
5449 			/* Allow the ipif to be down */
5450 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
5451 			    (ipif->ipif_lcl_addr == if_addr) &&
5452 			    (ipif->ipif_pp_dst_addr == dst)) {
5453 				/*
5454 				 * The block comment at the start of ipif_down
5455 				 * explains the use of the macros used below
5456 				 */
5457 				if (IPIF_CAN_LOOKUP(ipif)) {
5458 					ipif_refhold_locked(ipif);
5459 					mutex_exit(&ill->ill_lock);
5460 					RELEASE_CONN_LOCK(q);
5461 					rw_exit(&ill_g_lock);
5462 					return (ipif);
5463 				} else if (IPIF_CAN_WAIT(ipif, q)) {
5464 					ipsq = ill->ill_phyint->phyint_ipsq;
5465 					mutex_enter(&ipsq->ipsq_lock);
5466 					mutex_exit(&ill->ill_lock);
5467 					rw_exit(&ill_g_lock);
5468 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
5469 						ill);
5470 					mutex_exit(&ipsq->ipsq_lock);
5471 					RELEASE_CONN_LOCK(q);
5472 					*error = EINPROGRESS;
5473 					return (NULL);
5474 				}
5475 			}
5476 		}
5477 		mutex_exit(&ill->ill_lock);
5478 		RELEASE_CONN_LOCK(q);
5479 	}
5480 	rw_exit(&ill_g_lock);
5481 
5482 	/* lookup the ipif based on interface address */
5483 	ipif = ipif_lookup_addr(if_addr, NULL, ALL_ZONES, q, mp, func, error);
5484 	ASSERT(ipif == NULL || !ipif->ipif_isv6);
5485 	return (ipif);
5486 }
5487 
5488 /*
5489  * Look for an ipif with the specified address. For point-point links
5490  * we look for matches on either the destination address and the local
5491  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
5492  * is set.
5493  * Matches on a specific ill if match_ill is set.
5494  */
5495 ipif_t *
5496 ipif_lookup_addr(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid, queue_t *q,
5497     mblk_t *mp, ipsq_func_t func, int *error)
5498 {
5499 	ipif_t  *ipif;
5500 	ill_t   *ill;
5501 	boolean_t ptp = B_FALSE;
5502 	ipsq_t	*ipsq;
5503 	ill_walk_context_t	ctx;
5504 
5505 	if (error != NULL)
5506 		*error = 0;
5507 
5508 	rw_enter(&ill_g_lock, RW_READER);
5509 	/*
5510 	 * Repeat twice, first based on local addresses and
5511 	 * next time for pointopoint.
5512 	 */
5513 repeat:
5514 	ill = ILL_START_WALK_V4(&ctx);
5515 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5516 		if (match_ill != NULL && ill != match_ill) {
5517 			continue;
5518 		}
5519 		GRAB_CONN_LOCK(q);
5520 		mutex_enter(&ill->ill_lock);
5521 		for (ipif = ill->ill_ipif; ipif != NULL;
5522 		    ipif = ipif->ipif_next) {
5523 			if (zoneid != ALL_ZONES &&
5524 			    zoneid != ipif->ipif_zoneid &&
5525 			    ipif->ipif_zoneid != ALL_ZONES)
5526 				continue;
5527 			/* Allow the ipif to be down */
5528 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
5529 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
5530 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
5531 			    (ipif->ipif_pp_dst_addr == addr))) {
5532 				/*
5533 				 * The block comment at the start of ipif_down
5534 				 * explains the use of the macros used below
5535 				 */
5536 				if (IPIF_CAN_LOOKUP(ipif)) {
5537 					ipif_refhold_locked(ipif);
5538 					mutex_exit(&ill->ill_lock);
5539 					RELEASE_CONN_LOCK(q);
5540 					rw_exit(&ill_g_lock);
5541 					return (ipif);
5542 				} else if (IPIF_CAN_WAIT(ipif, q)) {
5543 					ipsq = ill->ill_phyint->phyint_ipsq;
5544 					mutex_enter(&ipsq->ipsq_lock);
5545 					mutex_exit(&ill->ill_lock);
5546 					rw_exit(&ill_g_lock);
5547 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
5548 						ill);
5549 					mutex_exit(&ipsq->ipsq_lock);
5550 					RELEASE_CONN_LOCK(q);
5551 					*error = EINPROGRESS;
5552 					return (NULL);
5553 				}
5554 			}
5555 		}
5556 		mutex_exit(&ill->ill_lock);
5557 		RELEASE_CONN_LOCK(q);
5558 	}
5559 
5560 	/* Now try the ptp case */
5561 	if (ptp) {
5562 		rw_exit(&ill_g_lock);
5563 		if (error != NULL)
5564 			*error = ENXIO;
5565 		return (NULL);
5566 	}
5567 	ptp = B_TRUE;
5568 	goto repeat;
5569 }
5570 
5571 /*
5572  * Look for an ipif that matches the specified remote address i.e. the
5573  * ipif that would receive the specified packet.
5574  * First look for directly connected interfaces and then do a recursive
5575  * IRE lookup and pick the first ipif corresponding to the source address in the
5576  * ire.
5577  * Returns: held ipif
5578  */
5579 ipif_t *
5580 ipif_lookup_remote(ill_t *ill, ipaddr_t addr, zoneid_t zoneid)
5581 {
5582 	ipif_t	*ipif;
5583 	ire_t	*ire;
5584 
5585 	ASSERT(!ill->ill_isv6);
5586 
5587 	/*
5588 	 * Someone could be changing this ipif currently or change it
5589 	 * after we return this. Thus  a few packets could use the old
5590 	 * old values. However structure updates/creates (ire, ilg, ilm etc)
5591 	 * will atomically be updated or cleaned up with the new value
5592 	 * Thus we don't need a lock to check the flags or other attrs below.
5593 	 */
5594 	mutex_enter(&ill->ill_lock);
5595 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
5596 		if (!IPIF_CAN_LOOKUP(ipif))
5597 			continue;
5598 		if (zoneid != ALL_ZONES && zoneid != ipif->ipif_zoneid &&
5599 		    ipif->ipif_zoneid != ALL_ZONES)
5600 			continue;
5601 		/* Allow the ipif to be down */
5602 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
5603 			if ((ipif->ipif_pp_dst_addr == addr) ||
5604 			    (!(ipif->ipif_flags & IPIF_UNNUMBERED) &&
5605 			    ipif->ipif_lcl_addr == addr)) {
5606 				ipif_refhold_locked(ipif);
5607 				mutex_exit(&ill->ill_lock);
5608 				return (ipif);
5609 			}
5610 		} else if (ipif->ipif_subnet == (addr & ipif->ipif_net_mask)) {
5611 			ipif_refhold_locked(ipif);
5612 			mutex_exit(&ill->ill_lock);
5613 			return (ipif);
5614 		}
5615 	}
5616 	mutex_exit(&ill->ill_lock);
5617 	ire = ire_route_lookup(addr, 0, 0, 0, NULL, NULL, zoneid,
5618 	    NULL, MATCH_IRE_RECURSIVE);
5619 	if (ire != NULL) {
5620 		/*
5621 		 * The callers of this function wants to know the
5622 		 * interface on which they have to send the replies
5623 		 * back. For IRE_CACHES that have ire_stq and ire_ipif
5624 		 * derived from different ills, we really don't care
5625 		 * what we return here.
5626 		 */
5627 		ipif = ire->ire_ipif;
5628 		if (ipif != NULL) {
5629 			ipif_refhold(ipif);
5630 			ire_refrele(ire);
5631 			return (ipif);
5632 		}
5633 		ire_refrele(ire);
5634 	}
5635 	/* Pick the first interface */
5636 	ipif = ipif_get_next_ipif(NULL, ill);
5637 	return (ipif);
5638 }
5639 
5640 /*
5641  * This func does not prevent refcnt from increasing. But if
5642  * the caller has taken steps to that effect, then this func
5643  * can be used to determine whether the ill has become quiescent
5644  */
5645 boolean_t
5646 ill_is_quiescent(ill_t *ill)
5647 {
5648 	ipif_t	*ipif;
5649 
5650 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5651 
5652 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
5653 		if (ipif->ipif_refcnt != 0 || ipif->ipif_ire_cnt != 0) {
5654 			return (B_FALSE);
5655 		}
5656 	}
5657 	if (ill->ill_ire_cnt != 0 || ill->ill_refcnt != 0 ||
5658 	    ill->ill_nce_cnt != 0 || ill->ill_srcif_refcnt != 0 ||
5659 	    ill->ill_mrtun_refcnt != 0) {
5660 		return (B_FALSE);
5661 	}
5662 	return (B_TRUE);
5663 }
5664 
5665 /*
5666  * This func does not prevent refcnt from increasing. But if
5667  * the caller has taken steps to that effect, then this func
5668  * can be used to determine whether the ipif has become quiescent
5669  */
5670 static boolean_t
5671 ipif_is_quiescent(ipif_t *ipif)
5672 {
5673 	ill_t *ill;
5674 
5675 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5676 
5677 	if (ipif->ipif_refcnt != 0 || ipif->ipif_ire_cnt != 0) {
5678 		return (B_FALSE);
5679 	}
5680 
5681 	ill = ipif->ipif_ill;
5682 	if (ill->ill_ipif_up_count != 0 || ill->ill_ipif_dup_count != 0 ||
5683 	    ill->ill_logical_down) {
5684 		return (B_TRUE);
5685 	}
5686 
5687 	/* This is the last ipif going down or being deleted on this ill */
5688 	if (ill->ill_ire_cnt != 0 || ill->ill_refcnt != 0) {
5689 		return (B_FALSE);
5690 	}
5691 
5692 	return (B_TRUE);
5693 }
5694 
5695 /*
5696  * This func does not prevent refcnt from increasing. But if
5697  * the caller has taken steps to that effect, then this func
5698  * can be used to determine whether the ipifs marked with IPIF_MOVING
5699  * have become quiescent and can be moved in a failover/failback.
5700  */
5701 static ipif_t *
5702 ill_quiescent_to_move(ill_t *ill)
5703 {
5704 	ipif_t  *ipif;
5705 
5706 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5707 
5708 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
5709 		if (ipif->ipif_state_flags & IPIF_MOVING) {
5710 			if (ipif->ipif_refcnt != 0 || ipif->ipif_ire_cnt != 0) {
5711 				return (ipif);
5712 			}
5713 		}
5714 	}
5715 	return (NULL);
5716 }
5717 
5718 /*
5719  * The ipif/ill/ire has been refreled. Do the tail processing.
5720  * Determine if the ipif or ill in question has become quiescent and if so
5721  * wakeup close and/or restart any queued pending ioctl that is waiting
5722  * for the ipif_down (or ill_down)
5723  */
5724 void
5725 ipif_ill_refrele_tail(ill_t *ill)
5726 {
5727 	mblk_t	*mp;
5728 	conn_t	*connp;
5729 	ipsq_t	*ipsq;
5730 	ipif_t	*ipif;
5731 
5732 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5733 
5734 	if ((ill->ill_state_flags & ILL_CONDEMNED) &&
5735 	    ill_is_quiescent(ill)) {
5736 		/* ill_close may be waiting */
5737 		cv_broadcast(&ill->ill_cv);
5738 	}
5739 
5740 	/* ipsq can't change because ill_lock  is held */
5741 	ipsq = ill->ill_phyint->phyint_ipsq;
5742 	if (ipsq->ipsq_waitfor == 0) {
5743 		/* Not waiting for anything, just return. */
5744 		mutex_exit(&ill->ill_lock);
5745 		return;
5746 	}
5747 	ASSERT(ipsq->ipsq_pending_mp != NULL &&
5748 		ipsq->ipsq_pending_ipif != NULL);
5749 	/*
5750 	 * ipif->ipif_refcnt must go down to zero for restarting REMOVEIF.
5751 	 * Last ipif going down needs to down the ill, so ill_ire_cnt must
5752 	 * be zero for restarting an ioctl that ends up downing the ill.
5753 	 */
5754 	ipif = ipsq->ipsq_pending_ipif;
5755 	if (ipif->ipif_ill != ill) {
5756 		/* The ioctl is pending on some other ill. */
5757 		mutex_exit(&ill->ill_lock);
5758 		return;
5759 	}
5760 
5761 	switch (ipsq->ipsq_waitfor) {
5762 	case IPIF_DOWN:
5763 	case IPIF_FREE:
5764 		if (!ipif_is_quiescent(ipif)) {
5765 			mutex_exit(&ill->ill_lock);
5766 			return;
5767 		}
5768 		break;
5769 
5770 	case ILL_DOWN:
5771 	case ILL_FREE:
5772 		/*
5773 		 * case ILL_FREE arises only for loopback. otherwise ill_delete
5774 		 * waits synchronously in ip_close, and no message is queued in
5775 		 * ipsq_pending_mp at all in this case
5776 		 */
5777 		if (!ill_is_quiescent(ill)) {
5778 			mutex_exit(&ill->ill_lock);
5779 			return;
5780 		}
5781 
5782 		break;
5783 
5784 	case ILL_MOVE_OK:
5785 		if (ill_quiescent_to_move(ill) != NULL) {
5786 			mutex_exit(&ill->ill_lock);
5787 			return;
5788 		}
5789 
5790 		break;
5791 	default:
5792 		cmn_err(CE_PANIC, "ipsq: %p unknown ipsq_waitfor %d\n",
5793 		    (void *)ipsq, ipsq->ipsq_waitfor);
5794 	}
5795 
5796 	/*
5797 	 * Incr refcnt for the qwriter_ip call below which
5798 	 * does a refrele
5799 	 */
5800 	ill_refhold_locked(ill);
5801 	mutex_exit(&ill->ill_lock);
5802 
5803 	mp = ipsq_pending_mp_get(ipsq, &connp);
5804 	ASSERT(mp != NULL);
5805 
5806 	switch (mp->b_datap->db_type) {
5807 	case M_ERROR:
5808 	case M_HANGUP:
5809 		(void) qwriter_ip(NULL, ill, ill->ill_rq, mp,
5810 		    ipif_all_down_tail, CUR_OP, B_TRUE);
5811 		return;
5812 
5813 	case M_IOCTL:
5814 	case M_IOCDATA:
5815 		(void) qwriter_ip(NULL, ill,
5816 		    (connp != NULL ? CONNP_TO_WQ(connp) : ill->ill_wq), mp,
5817 		    ip_reprocess_ioctl, CUR_OP, B_TRUE);
5818 		return;
5819 
5820 	default:
5821 		cmn_err(CE_PANIC, "ipif_ill_refrele_tail mp %p "
5822 		    "db_type %d\n", (void *)mp, mp->b_datap->db_type);
5823 	}
5824 }
5825 
5826 #ifdef ILL_DEBUG
5827 /* Reuse trace buffer from beginning (if reached the end) and record trace */
5828 void
5829 th_trace_rrecord(th_trace_t *th_trace)
5830 {
5831 	tr_buf_t *tr_buf;
5832 	uint_t lastref;
5833 
5834 	lastref = th_trace->th_trace_lastref;
5835 	lastref++;
5836 	if (lastref == TR_BUF_MAX)
5837 		lastref = 0;
5838 	th_trace->th_trace_lastref = lastref;
5839 	tr_buf = &th_trace->th_trbuf[lastref];
5840 	tr_buf->tr_depth = getpcstack(tr_buf->tr_stack, IP_STACK_DEPTH);
5841 }
5842 
5843 th_trace_t *
5844 th_trace_ipif_lookup(ipif_t *ipif)
5845 {
5846 	int bucket_id;
5847 	th_trace_t *th_trace;
5848 
5849 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5850 
5851 	bucket_id = IP_TR_HASH(curthread);
5852 	ASSERT(bucket_id < IP_TR_HASH_MAX);
5853 
5854 	for (th_trace = ipif->ipif_trace[bucket_id]; th_trace != NULL;
5855 	    th_trace = th_trace->th_next) {
5856 		if (th_trace->th_id == curthread)
5857 			return (th_trace);
5858 	}
5859 	return (NULL);
5860 }
5861 
5862 void
5863 ipif_trace_ref(ipif_t *ipif)
5864 {
5865 	int bucket_id;
5866 	th_trace_t *th_trace;
5867 
5868 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5869 
5870 	if (ipif->ipif_trace_disable)
5871 		return;
5872 
5873 	/*
5874 	 * Attempt to locate the trace buffer for the curthread.
5875 	 * If it does not exist, then allocate a new trace buffer
5876 	 * and link it in list of trace bufs for this ipif, at the head
5877 	 */
5878 	th_trace = th_trace_ipif_lookup(ipif);
5879 	if (th_trace == NULL) {
5880 		bucket_id = IP_TR_HASH(curthread);
5881 		th_trace = (th_trace_t *)kmem_zalloc(sizeof (th_trace_t),
5882 		    KM_NOSLEEP);
5883 		if (th_trace == NULL) {
5884 			ipif->ipif_trace_disable = B_TRUE;
5885 			ipif_trace_cleanup(ipif);
5886 			return;
5887 		}
5888 		th_trace->th_id = curthread;
5889 		th_trace->th_next = ipif->ipif_trace[bucket_id];
5890 		th_trace->th_prev = &ipif->ipif_trace[bucket_id];
5891 		if (th_trace->th_next != NULL)
5892 			th_trace->th_next->th_prev = &th_trace->th_next;
5893 		ipif->ipif_trace[bucket_id] = th_trace;
5894 	}
5895 	ASSERT(th_trace->th_refcnt >= 0 &&
5896 		th_trace->th_refcnt < TR_BUF_MAX -1);
5897 	th_trace->th_refcnt++;
5898 	th_trace_rrecord(th_trace);
5899 }
5900 
5901 void
5902 ipif_untrace_ref(ipif_t *ipif)
5903 {
5904 	th_trace_t *th_trace;
5905 
5906 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5907 
5908 	if (ipif->ipif_trace_disable)
5909 		return;
5910 	th_trace = th_trace_ipif_lookup(ipif);
5911 	ASSERT(th_trace != NULL);
5912 	ASSERT(th_trace->th_refcnt > 0);
5913 
5914 	th_trace->th_refcnt--;
5915 	th_trace_rrecord(th_trace);
5916 }
5917 
5918 th_trace_t *
5919 th_trace_ill_lookup(ill_t *ill)
5920 {
5921 	th_trace_t *th_trace;
5922 	int bucket_id;
5923 
5924 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5925 
5926 	bucket_id = IP_TR_HASH(curthread);
5927 	ASSERT(bucket_id < IP_TR_HASH_MAX);
5928 
5929 	for (th_trace = ill->ill_trace[bucket_id]; th_trace != NULL;
5930 	    th_trace = th_trace->th_next) {
5931 		if (th_trace->th_id == curthread)
5932 			return (th_trace);
5933 	}
5934 	return (NULL);
5935 }
5936 
5937 void
5938 ill_trace_ref(ill_t *ill)
5939 {
5940 	int bucket_id;
5941 	th_trace_t *th_trace;
5942 
5943 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5944 	if (ill->ill_trace_disable)
5945 		return;
5946 	/*
5947 	 * Attempt to locate the trace buffer for the curthread.
5948 	 * If it does not exist, then allocate a new trace buffer
5949 	 * and link it in list of trace bufs for this ill, at the head
5950 	 */
5951 	th_trace = th_trace_ill_lookup(ill);
5952 	if (th_trace == NULL) {
5953 		bucket_id = IP_TR_HASH(curthread);
5954 		th_trace = (th_trace_t *)kmem_zalloc(sizeof (th_trace_t),
5955 		    KM_NOSLEEP);
5956 		if (th_trace == NULL) {
5957 			ill->ill_trace_disable = B_TRUE;
5958 			ill_trace_cleanup(ill);
5959 			return;
5960 		}
5961 		th_trace->th_id = curthread;
5962 		th_trace->th_next = ill->ill_trace[bucket_id];
5963 		th_trace->th_prev = &ill->ill_trace[bucket_id];
5964 		if (th_trace->th_next != NULL)
5965 			th_trace->th_next->th_prev = &th_trace->th_next;
5966 		ill->ill_trace[bucket_id] = th_trace;
5967 	}
5968 	ASSERT(th_trace->th_refcnt >= 0 &&
5969 		th_trace->th_refcnt < TR_BUF_MAX - 1);
5970 
5971 	th_trace->th_refcnt++;
5972 	th_trace_rrecord(th_trace);
5973 }
5974 
5975 void
5976 ill_untrace_ref(ill_t *ill)
5977 {
5978 	th_trace_t *th_trace;
5979 
5980 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5981 
5982 	if (ill->ill_trace_disable)
5983 		return;
5984 	th_trace = th_trace_ill_lookup(ill);
5985 	ASSERT(th_trace != NULL);
5986 	ASSERT(th_trace->th_refcnt > 0);
5987 
5988 	th_trace->th_refcnt--;
5989 	th_trace_rrecord(th_trace);
5990 }
5991 
5992 /*
5993  * Verify that this thread has no refs to the ipif and free
5994  * the trace buffers
5995  */
5996 /* ARGSUSED */
5997 void
5998 ipif_thread_exit(ipif_t *ipif, void *dummy)
5999 {
6000 	th_trace_t *th_trace;
6001 
6002 	mutex_enter(&ipif->ipif_ill->ill_lock);
6003 
6004 	th_trace = th_trace_ipif_lookup(ipif);
6005 	if (th_trace == NULL) {
6006 		mutex_exit(&ipif->ipif_ill->ill_lock);
6007 		return;
6008 	}
6009 	ASSERT(th_trace->th_refcnt == 0);
6010 	/* unlink th_trace and free it */
6011 	*th_trace->th_prev = th_trace->th_next;
6012 	if (th_trace->th_next != NULL)
6013 		th_trace->th_next->th_prev = th_trace->th_prev;
6014 	th_trace->th_next = NULL;
6015 	th_trace->th_prev = NULL;
6016 	kmem_free(th_trace, sizeof (th_trace_t));
6017 
6018 	mutex_exit(&ipif->ipif_ill->ill_lock);
6019 }
6020 
6021 /*
6022  * Verify that this thread has no refs to the ill and free
6023  * the trace buffers
6024  */
6025 /* ARGSUSED */
6026 void
6027 ill_thread_exit(ill_t *ill, void *dummy)
6028 {
6029 	th_trace_t *th_trace;
6030 
6031 	mutex_enter(&ill->ill_lock);
6032 
6033 	th_trace = th_trace_ill_lookup(ill);
6034 	if (th_trace == NULL) {
6035 		mutex_exit(&ill->ill_lock);
6036 		return;
6037 	}
6038 	ASSERT(th_trace->th_refcnt == 0);
6039 	/* unlink th_trace and free it */
6040 	*th_trace->th_prev = th_trace->th_next;
6041 	if (th_trace->th_next != NULL)
6042 		th_trace->th_next->th_prev = th_trace->th_prev;
6043 	th_trace->th_next = NULL;
6044 	th_trace->th_prev = NULL;
6045 	kmem_free(th_trace, sizeof (th_trace_t));
6046 
6047 	mutex_exit(&ill->ill_lock);
6048 }
6049 #endif
6050 
6051 #ifdef ILL_DEBUG
6052 void
6053 ip_thread_exit(void)
6054 {
6055 	ill_t	*ill;
6056 	ipif_t	*ipif;
6057 	ill_walk_context_t	ctx;
6058 
6059 	rw_enter(&ill_g_lock, RW_READER);
6060 	ill = ILL_START_WALK_ALL(&ctx);
6061 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
6062 		for (ipif = ill->ill_ipif; ipif != NULL;
6063 		    ipif = ipif->ipif_next) {
6064 			ipif_thread_exit(ipif, NULL);
6065 		}
6066 		ill_thread_exit(ill, NULL);
6067 	}
6068 	rw_exit(&ill_g_lock);
6069 
6070 	ire_walk(ire_thread_exit, NULL);
6071 	ndp_walk_common(&ndp4, NULL, nce_thread_exit, NULL, B_FALSE);
6072 	ndp_walk_common(&ndp6, NULL, nce_thread_exit, NULL, B_FALSE);
6073 }
6074 
6075 /*
6076  * Called when ipif is unplumbed or when memory alloc fails
6077  */
6078 void
6079 ipif_trace_cleanup(ipif_t *ipif)
6080 {
6081 	int	i;
6082 	th_trace_t	*th_trace;
6083 	th_trace_t	*th_trace_next;
6084 
6085 	for (i = 0; i < IP_TR_HASH_MAX; i++) {
6086 		for (th_trace = ipif->ipif_trace[i]; th_trace != NULL;
6087 		    th_trace = th_trace_next) {
6088 			th_trace_next = th_trace->th_next;
6089 			kmem_free(th_trace, sizeof (th_trace_t));
6090 		}
6091 		ipif->ipif_trace[i] = NULL;
6092 	}
6093 }
6094 
6095 /*
6096  * Called when ill is unplumbed or when memory alloc fails
6097  */
6098 void
6099 ill_trace_cleanup(ill_t *ill)
6100 {
6101 	int	i;
6102 	th_trace_t	*th_trace;
6103 	th_trace_t	*th_trace_next;
6104 
6105 	for (i = 0; i < IP_TR_HASH_MAX; i++) {
6106 		for (th_trace = ill->ill_trace[i]; th_trace != NULL;
6107 		    th_trace = th_trace_next) {
6108 			th_trace_next = th_trace->th_next;
6109 			kmem_free(th_trace, sizeof (th_trace_t));
6110 		}
6111 		ill->ill_trace[i] = NULL;
6112 	}
6113 }
6114 
6115 #else
6116 void ip_thread_exit(void) {}
6117 #endif
6118 
6119 void
6120 ipif_refhold_locked(ipif_t *ipif)
6121 {
6122 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6123 	ipif->ipif_refcnt++;
6124 	IPIF_TRACE_REF(ipif);
6125 }
6126 
6127 void
6128 ipif_refhold(ipif_t *ipif)
6129 {
6130 	ill_t	*ill;
6131 
6132 	ill = ipif->ipif_ill;
6133 	mutex_enter(&ill->ill_lock);
6134 	ipif->ipif_refcnt++;
6135 	IPIF_TRACE_REF(ipif);
6136 	mutex_exit(&ill->ill_lock);
6137 }
6138 
6139 /*
6140  * Must not be called while holding any locks. Otherwise if this is
6141  * the last reference to be released there is a chance of recursive mutex
6142  * panic due to ipif_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
6143  * to restart an ioctl.
6144  */
6145 void
6146 ipif_refrele(ipif_t *ipif)
6147 {
6148 	ill_t	*ill;
6149 
6150 	ill = ipif->ipif_ill;
6151 
6152 	mutex_enter(&ill->ill_lock);
6153 	ASSERT(ipif->ipif_refcnt != 0);
6154 	ipif->ipif_refcnt--;
6155 	IPIF_UNTRACE_REF(ipif);
6156 	if (ipif->ipif_refcnt != 0) {
6157 		mutex_exit(&ill->ill_lock);
6158 		return;
6159 	}
6160 
6161 	/* Drops the ill_lock */
6162 	ipif_ill_refrele_tail(ill);
6163 }
6164 
6165 ipif_t *
6166 ipif_get_next_ipif(ipif_t *curr, ill_t *ill)
6167 {
6168 	ipif_t	*ipif;
6169 
6170 	mutex_enter(&ill->ill_lock);
6171 	for (ipif = (curr == NULL ? ill->ill_ipif : curr->ipif_next);
6172 	    ipif != NULL; ipif = ipif->ipif_next) {
6173 		if (!IPIF_CAN_LOOKUP(ipif))
6174 			continue;
6175 		ipif_refhold_locked(ipif);
6176 		mutex_exit(&ill->ill_lock);
6177 		return (ipif);
6178 	}
6179 	mutex_exit(&ill->ill_lock);
6180 	return (NULL);
6181 }
6182 
6183 /*
6184  * TODO: make this table extendible at run time
6185  * Return a pointer to the mac type info for 'mac_type'
6186  */
6187 static ip_m_t *
6188 ip_m_lookup(t_uscalar_t mac_type)
6189 {
6190 	ip_m_t	*ipm;
6191 
6192 	for (ipm = ip_m_tbl; ipm < A_END(ip_m_tbl); ipm++)
6193 		if (ipm->ip_m_mac_type == mac_type)
6194 			return (ipm);
6195 	return (NULL);
6196 }
6197 
6198 /*
6199  * ip_rt_add is called to add an IPv4 route to the forwarding table.
6200  * ipif_arg is passed in to associate it with the correct interface.
6201  * We may need to restart this operation if the ipif cannot be looked up
6202  * due to an exclusive operation that is currently in progress. The restart
6203  * entry point is specified by 'func'
6204  */
6205 int
6206 ip_rt_add(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
6207     ipaddr_t src_addr, int flags, ipif_t *ipif_arg, ipif_t *src_ipif,
6208     ire_t **ire_arg, boolean_t ioctl_msg, queue_t *q, mblk_t *mp,
6209     ipsq_func_t func, struct rtsa_s *sp)
6210 {
6211 	ire_t	*ire;
6212 	ire_t	*gw_ire = NULL;
6213 	ipif_t	*ipif = NULL;
6214 	boolean_t ipif_refheld = B_FALSE;
6215 	uint_t	type;
6216 	int	match_flags = MATCH_IRE_TYPE;
6217 	int	error;
6218 	tsol_gc_t *gc = NULL;
6219 	tsol_gcgrp_t *gcgrp = NULL;
6220 	boolean_t gcgrp_xtraref = B_FALSE;
6221 
6222 	ip1dbg(("ip_rt_add:"));
6223 
6224 	if (ire_arg != NULL)
6225 		*ire_arg = NULL;
6226 
6227 	/*
6228 	 * If this is the case of RTF_HOST being set, then we set the netmask
6229 	 * to all ones (regardless if one was supplied).
6230 	 */
6231 	if (flags & RTF_HOST)
6232 		mask = IP_HOST_MASK;
6233 
6234 	/*
6235 	 * Prevent routes with a zero gateway from being created (since
6236 	 * interfaces can currently be plumbed and brought up no assigned
6237 	 * address).
6238 	 * For routes with RTA_SRCIFP, the gateway address can be 0.0.0.0.
6239 	 */
6240 	if (gw_addr == 0 && src_ipif == NULL)
6241 		return (ENETUNREACH);
6242 	/*
6243 	 * Get the ipif, if any, corresponding to the gw_addr
6244 	 */
6245 	if (gw_addr != 0) {
6246 		ipif = ipif_lookup_interface(gw_addr, dst_addr, q, mp, func,
6247 		    &error);
6248 		if (ipif != NULL) {
6249 			if (IS_VNI(ipif->ipif_ill)) {
6250 				ipif_refrele(ipif);
6251 				return (EINVAL);
6252 			}
6253 			ipif_refheld = B_TRUE;
6254 		} else if (error == EINPROGRESS) {
6255 			ip1dbg(("ip_rt_add: null and EINPROGRESS"));
6256 			return (EINPROGRESS);
6257 		} else {
6258 			error = 0;
6259 		}
6260 	}
6261 
6262 	if (ipif != NULL) {
6263 		ip1dbg(("ip_rt_add: ipif_lookup_interface done ipif nonnull"));
6264 		ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6265 	} else {
6266 		ip1dbg(("ip_rt_add: ipif_lookup_interface done ipif is null"));
6267 	}
6268 
6269 	/*
6270 	 * GateD will attempt to create routes with a loopback interface
6271 	 * address as the gateway and with RTF_GATEWAY set.  We allow
6272 	 * these routes to be added, but create them as interface routes
6273 	 * since the gateway is an interface address.
6274 	 */
6275 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
6276 		flags &= ~RTF_GATEWAY;
6277 		if (gw_addr == INADDR_LOOPBACK && dst_addr == INADDR_LOOPBACK &&
6278 		    mask == IP_HOST_MASK) {
6279 			ire = ire_ctable_lookup(dst_addr, 0, IRE_LOOPBACK, ipif,
6280 			    ALL_ZONES, NULL, match_flags);
6281 			if (ire != NULL) {
6282 				ire_refrele(ire);
6283 				if (ipif_refheld)
6284 					ipif_refrele(ipif);
6285 				return (EEXIST);
6286 			}
6287 			ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x"
6288 			    "for 0x%x\n", (void *)ipif,
6289 			    ipif->ipif_ire_type,
6290 			    ntohl(ipif->ipif_lcl_addr)));
6291 			ire = ire_create(
6292 			    (uchar_t *)&dst_addr,	/* dest address */
6293 			    (uchar_t *)&mask,		/* mask */
6294 			    (uchar_t *)&ipif->ipif_src_addr,
6295 			    NULL,			/* no gateway */
6296 			    NULL,
6297 			    &ipif->ipif_mtu,
6298 			    NULL,
6299 			    ipif->ipif_rq,		/* recv-from queue */
6300 			    NULL,			/* no send-to queue */
6301 			    ipif->ipif_ire_type,	/* LOOPBACK */
6302 			    NULL,
6303 			    ipif,
6304 			    NULL,
6305 			    0,
6306 			    0,
6307 			    0,
6308 			    (ipif->ipif_flags & IPIF_PRIVATE) ?
6309 			    RTF_PRIVATE : 0,
6310 			    &ire_uinfo_null,
6311 			    NULL,
6312 			    NULL);
6313 
6314 			if (ire == NULL) {
6315 				if (ipif_refheld)
6316 					ipif_refrele(ipif);
6317 				return (ENOMEM);
6318 			}
6319 			error = ire_add(&ire, q, mp, func, B_FALSE);
6320 			if (error == 0)
6321 				goto save_ire;
6322 			if (ipif_refheld)
6323 				ipif_refrele(ipif);
6324 			return (error);
6325 
6326 		}
6327 	}
6328 
6329 	/*
6330 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
6331 	 * and the gateway address provided is one of the system's interface
6332 	 * addresses.  By using the routing socket interface and supplying an
6333 	 * RTA_IFP sockaddr with an interface index, an alternate method of
6334 	 * specifying an interface route to be created is available which uses
6335 	 * the interface index that specifies the outgoing interface rather than
6336 	 * the address of an outgoing interface (which may not be able to
6337 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
6338 	 * flag, routes can be specified which not only specify the next-hop to
6339 	 * be used when routing to a certain prefix, but also which outgoing
6340 	 * interface should be used.
6341 	 *
6342 	 * Previously, interfaces would have unique addresses assigned to them
6343 	 * and so the address assigned to a particular interface could be used
6344 	 * to identify a particular interface.  One exception to this was the
6345 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
6346 	 *
6347 	 * With the advent of IPv6 and its link-local addresses, this
6348 	 * restriction was relaxed and interfaces could share addresses between
6349 	 * themselves.  In fact, typically all of the link-local interfaces on
6350 	 * an IPv6 node or router will have the same link-local address.  In
6351 	 * order to differentiate between these interfaces, the use of an
6352 	 * interface index is necessary and this index can be carried inside a
6353 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
6354 	 * of using the interface index, however, is that all of the ipif's that
6355 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
6356 	 * cannot be used to differentiate between ipif's (or logical
6357 	 * interfaces) that belong to the same ill (physical interface).
6358 	 *
6359 	 * For example, in the following case involving IPv4 interfaces and
6360 	 * logical interfaces
6361 	 *
6362 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
6363 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0:1
6364 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0:2
6365 	 *
6366 	 * the ipif's corresponding to each of these interface routes can be
6367 	 * uniquely identified by the "gateway" (actually interface address).
6368 	 *
6369 	 * In this case involving multiple IPv6 default routes to a particular
6370 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
6371 	 * default route is of interest:
6372 	 *
6373 	 *	default		fe80::123:4567:89ab:cdef	U	if0
6374 	 *	default		fe80::123:4567:89ab:cdef	U	if1
6375 	 */
6376 
6377 	/* RTF_GATEWAY not set */
6378 	if (!(flags & RTF_GATEWAY)) {
6379 		queue_t	*stq;
6380 		queue_t	*rfq = NULL;
6381 		ill_t	*in_ill = NULL;
6382 
6383 		if (sp != NULL) {
6384 			ip2dbg(("ip_rt_add: gateway security attributes "
6385 			    "cannot be set with interface route\n"));
6386 			if (ipif_refheld)
6387 				ipif_refrele(ipif);
6388 			return (EINVAL);
6389 		}
6390 
6391 		/*
6392 		 * As the interface index specified with the RTA_IFP sockaddr is
6393 		 * the same for all ipif's off of an ill, the matching logic
6394 		 * below uses MATCH_IRE_ILL if such an index was specified.
6395 		 * This means that routes sharing the same prefix when added
6396 		 * using a RTA_IFP sockaddr must have distinct interface
6397 		 * indices (namely, they must be on distinct ill's).
6398 		 *
6399 		 * On the other hand, since the gateway address will usually be
6400 		 * different for each ipif on the system, the matching logic
6401 		 * uses MATCH_IRE_IPIF in the case of a traditional interface
6402 		 * route.  This means that interface routes for the same prefix
6403 		 * can be created if they belong to distinct ipif's and if a
6404 		 * RTA_IFP sockaddr is not present.
6405 		 */
6406 		if (ipif_arg != NULL) {
6407 			if (ipif_refheld)  {
6408 				ipif_refrele(ipif);
6409 				ipif_refheld = B_FALSE;
6410 			}
6411 			ipif = ipif_arg;
6412 			match_flags |= MATCH_IRE_ILL;
6413 		} else {
6414 			/*
6415 			 * Check the ipif corresponding to the gw_addr
6416 			 */
6417 			if (ipif == NULL)
6418 				return (ENETUNREACH);
6419 			match_flags |= MATCH_IRE_IPIF;
6420 		}
6421 		ASSERT(ipif != NULL);
6422 		/*
6423 		 * If src_ipif is not NULL, we have to create
6424 		 * an ire with non-null ire_in_ill value
6425 		 */
6426 		if (src_ipif != NULL) {
6427 			in_ill = src_ipif->ipif_ill;
6428 		}
6429 
6430 		/*
6431 		 * We check for an existing entry at this point.
6432 		 *
6433 		 * Since a netmask isn't passed in via the ioctl interface
6434 		 * (SIOCADDRT), we don't check for a matching netmask in that
6435 		 * case.
6436 		 */
6437 		if (!ioctl_msg)
6438 			match_flags |= MATCH_IRE_MASK;
6439 		if (src_ipif != NULL) {
6440 			/* Look up in the special table */
6441 			ire = ire_srcif_table_lookup(dst_addr, IRE_INTERFACE,
6442 			    ipif, src_ipif->ipif_ill, match_flags);
6443 		} else {
6444 			ire = ire_ftable_lookup(dst_addr, mask, 0,
6445 			    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0,
6446 			    NULL, match_flags);
6447 		}
6448 		if (ire != NULL) {
6449 			ire_refrele(ire);
6450 			if (ipif_refheld)
6451 				ipif_refrele(ipif);
6452 			return (EEXIST);
6453 		}
6454 
6455 		if (src_ipif != NULL) {
6456 			/*
6457 			 * Create the special ire for the IRE table
6458 			 * which hangs out of ire_in_ill. This ire
6459 			 * is in-between IRE_CACHE and IRE_INTERFACE.
6460 			 * Thus rfq is non-NULL.
6461 			 */
6462 			rfq = ipif->ipif_rq;
6463 		}
6464 		/* Create the usual interface ires */
6465 
6466 		stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
6467 		    ? ipif->ipif_rq : ipif->ipif_wq;
6468 
6469 		/*
6470 		 * Create a copy of the IRE_LOOPBACK,
6471 		 * IRE_IF_NORESOLVER or IRE_IF_RESOLVER with
6472 		 * the modified address and netmask.
6473 		 */
6474 		ire = ire_create(
6475 		    (uchar_t *)&dst_addr,
6476 		    (uint8_t *)&mask,
6477 		    (uint8_t *)&ipif->ipif_src_addr,
6478 		    NULL,
6479 		    NULL,
6480 		    &ipif->ipif_mtu,
6481 		    NULL,
6482 		    rfq,
6483 		    stq,
6484 		    ipif->ipif_net_type,
6485 		    ipif->ipif_resolver_mp,
6486 		    ipif,
6487 		    in_ill,
6488 		    0,
6489 		    0,
6490 		    0,
6491 		    flags,
6492 		    &ire_uinfo_null,
6493 		    NULL,
6494 		    NULL);
6495 		if (ire == NULL) {
6496 			if (ipif_refheld)
6497 				ipif_refrele(ipif);
6498 			return (ENOMEM);
6499 		}
6500 
6501 		/*
6502 		 * Some software (for example, GateD and Sun Cluster) attempts
6503 		 * to create (what amount to) IRE_PREFIX routes with the
6504 		 * loopback address as the gateway.  This is primarily done to
6505 		 * set up prefixes with the RTF_REJECT flag set (for example,
6506 		 * when generating aggregate routes.)
6507 		 *
6508 		 * If the IRE type (as defined by ipif->ipif_net_type) is
6509 		 * IRE_LOOPBACK, then we map the request into a
6510 		 * IRE_IF_NORESOLVER.
6511 		 *
6512 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
6513 		 * routine, but rather using ire_create() directly.
6514 		 *
6515 		 */
6516 		if (ipif->ipif_net_type == IRE_LOOPBACK)
6517 			ire->ire_type = IRE_IF_NORESOLVER;
6518 
6519 		error = ire_add(&ire, q, mp, func, B_FALSE);
6520 		if (error == 0)
6521 			goto save_ire;
6522 
6523 		/*
6524 		 * In the result of failure, ire_add() will have already
6525 		 * deleted the ire in question, so there is no need to
6526 		 * do that here.
6527 		 */
6528 		if (ipif_refheld)
6529 			ipif_refrele(ipif);
6530 		return (error);
6531 	}
6532 	if (ipif_refheld) {
6533 		ipif_refrele(ipif);
6534 		ipif_refheld = B_FALSE;
6535 	}
6536 
6537 	if (src_ipif != NULL) {
6538 		/* RTA_SRCIFP is not supported on RTF_GATEWAY */
6539 		ip2dbg(("ip_rt_add: SRCIF cannot be set with gateway route\n"));
6540 		return (EINVAL);
6541 	}
6542 	/*
6543 	 * Get an interface IRE for the specified gateway.
6544 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
6545 	 * gateway, it is currently unreachable and we fail the request
6546 	 * accordingly.
6547 	 */
6548 	ipif = ipif_arg;
6549 	if (ipif_arg != NULL)
6550 		match_flags |= MATCH_IRE_ILL;
6551 	gw_ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg, NULL,
6552 	    ALL_ZONES, 0, NULL, match_flags);
6553 	if (gw_ire == NULL)
6554 		return (ENETUNREACH);
6555 
6556 	/*
6557 	 * We create one of three types of IREs as a result of this request
6558 	 * based on the netmask.  A netmask of all ones (which is automatically
6559 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
6560 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
6561 	 * created.  Otherwise, an IRE_PREFIX route is created for the
6562 	 * destination prefix.
6563 	 */
6564 	if (mask == IP_HOST_MASK)
6565 		type = IRE_HOST;
6566 	else if (mask == 0)
6567 		type = IRE_DEFAULT;
6568 	else
6569 		type = IRE_PREFIX;
6570 
6571 	/* check for a duplicate entry */
6572 	ire = ire_ftable_lookup(dst_addr, mask, gw_addr, type, ipif_arg,
6573 	    NULL, ALL_ZONES, 0, NULL,
6574 	    match_flags | MATCH_IRE_MASK | MATCH_IRE_GW);
6575 	if (ire != NULL) {
6576 		ire_refrele(gw_ire);
6577 		ire_refrele(ire);
6578 		return (EEXIST);
6579 	}
6580 
6581 	/* Security attribute exists */
6582 	if (sp != NULL) {
6583 		tsol_gcgrp_addr_t ga;
6584 
6585 		/* find or create the gateway credentials group */
6586 		ga.ga_af = AF_INET;
6587 		IN6_IPADDR_TO_V4MAPPED(gw_addr, &ga.ga_addr);
6588 
6589 		/* we hold reference to it upon success */
6590 		gcgrp = gcgrp_lookup(&ga, B_TRUE);
6591 		if (gcgrp == NULL) {
6592 			ire_refrele(gw_ire);
6593 			return (ENOMEM);
6594 		}
6595 
6596 		/*
6597 		 * Create and add the security attribute to the group; a
6598 		 * reference to the group is made upon allocating a new
6599 		 * entry successfully.  If it finds an already-existing
6600 		 * entry for the security attribute in the group, it simply
6601 		 * returns it and no new reference is made to the group.
6602 		 */
6603 		gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
6604 		if (gc == NULL) {
6605 			/* release reference held by gcgrp_lookup */
6606 			GCGRP_REFRELE(gcgrp);
6607 			ire_refrele(gw_ire);
6608 			return (ENOMEM);
6609 		}
6610 	}
6611 
6612 	/* Create the IRE. */
6613 	ire = ire_create(
6614 	    (uchar_t *)&dst_addr,		/* dest address */
6615 	    (uchar_t *)&mask,			/* mask */
6616 	    /* src address assigned by the caller? */
6617 	    (uchar_t *)(((src_addr != INADDR_ANY) &&
6618 		(flags & RTF_SETSRC)) ?  &src_addr : NULL),
6619 	    (uchar_t *)&gw_addr,		/* gateway address */
6620 	    NULL,				/* no in-srcaddress */
6621 	    &gw_ire->ire_max_frag,
6622 	    NULL,				/* no Fast Path header */
6623 	    NULL,				/* no recv-from queue */
6624 	    NULL,				/* no send-to queue */
6625 	    (ushort_t)type,			/* IRE type */
6626 	    NULL,
6627 	    ipif_arg,
6628 	    NULL,
6629 	    0,
6630 	    0,
6631 	    0,
6632 	    flags,
6633 	    &gw_ire->ire_uinfo,			/* Inherit ULP info from gw */
6634 	    gc,					/* security attribute */
6635 	    NULL);
6636 	/*
6637 	 * The ire holds a reference to the 'gc' and the 'gc' holds a
6638 	 * reference to the 'gcgrp'. We can now release the extra reference
6639 	 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
6640 	 */
6641 	if (gcgrp_xtraref)
6642 		GCGRP_REFRELE(gcgrp);
6643 	if (ire == NULL) {
6644 		if (gc != NULL)
6645 			GC_REFRELE(gc);
6646 		ire_refrele(gw_ire);
6647 		return (ENOMEM);
6648 	}
6649 
6650 	/*
6651 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
6652 	 * SUN/OS socket stuff does but do we really want to allow 0.0.0.0?
6653 	 */
6654 
6655 	/* Add the new IRE. */
6656 	error = ire_add(&ire, q, mp, func, B_FALSE);
6657 	if (error != 0) {
6658 		/*
6659 		 * In the result of failure, ire_add() will have already
6660 		 * deleted the ire in question, so there is no need to
6661 		 * do that here.
6662 		 */
6663 		ire_refrele(gw_ire);
6664 		return (error);
6665 	}
6666 
6667 	if (flags & RTF_MULTIRT) {
6668 		/*
6669 		 * Invoke the CGTP (multirouting) filtering module
6670 		 * to add the dst address in the filtering database.
6671 		 * Replicated inbound packets coming from that address
6672 		 * will be filtered to discard the duplicates.
6673 		 * It is not necessary to call the CGTP filter hook
6674 		 * when the dst address is a broadcast or multicast,
6675 		 * because an IP source address cannot be a broadcast
6676 		 * or a multicast.
6677 		 */
6678 		ire_t *ire_dst = ire_ctable_lookup(ire->ire_addr, 0,
6679 		    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE);
6680 		if (ire_dst != NULL) {
6681 			ip_cgtp_bcast_add(ire, ire_dst);
6682 			ire_refrele(ire_dst);
6683 			goto save_ire;
6684 		}
6685 		if ((ip_cgtp_filter_ops != NULL) && !CLASSD(ire->ire_addr)) {
6686 			int res = ip_cgtp_filter_ops->cfo_add_dest_v4(
6687 			    ire->ire_addr,
6688 			    ire->ire_gateway_addr,
6689 			    ire->ire_src_addr,
6690 			    gw_ire->ire_src_addr);
6691 			if (res != 0) {
6692 				ire_refrele(gw_ire);
6693 				ire_delete(ire);
6694 				return (res);
6695 			}
6696 		}
6697 	}
6698 
6699 	/*
6700 	 * Now that the prefix IRE entry has been created, delete any
6701 	 * existing gateway IRE cache entries as well as any IRE caches
6702 	 * using the gateway, and force them to be created through
6703 	 * ip_newroute.
6704 	 */
6705 	if (gc != NULL) {
6706 		ASSERT(gcgrp != NULL);
6707 		ire_clookup_delete_cache_gw(gw_addr, ALL_ZONES);
6708 	}
6709 
6710 save_ire:
6711 	if (gw_ire != NULL) {
6712 		ire_refrele(gw_ire);
6713 	}
6714 	/*
6715 	 * We do not do save_ire for the routes added with RTA_SRCIFP
6716 	 * flag. This route is only added and deleted by mipagent.
6717 	 * So, for simplicity of design, we refrain from saving
6718 	 * ires that are created with srcif value. This may change
6719 	 * in future if we find more usage of srcifp feature.
6720 	 */
6721 	if (ipif != NULL && src_ipif == NULL) {
6722 		/*
6723 		 * Save enough information so that we can recreate the IRE if
6724 		 * the interface goes down and then up.  The metrics associated
6725 		 * with the route will be saved as well when rts_setmetrics() is
6726 		 * called after the IRE has been created.  In the case where
6727 		 * memory cannot be allocated, none of this information will be
6728 		 * saved.
6729 		 */
6730 		ipif_save_ire(ipif, ire);
6731 	}
6732 	if (ioctl_msg)
6733 		ip_rts_rtmsg(RTM_OLDADD, ire, 0);
6734 	if (ire_arg != NULL) {
6735 		/*
6736 		 * Store the ire that was successfully added into where ire_arg
6737 		 * points to so that callers don't have to look it up
6738 		 * themselves (but they are responsible for ire_refrele()ing
6739 		 * the ire when they are finished with it).
6740 		 */
6741 		*ire_arg = ire;
6742 	} else {
6743 		ire_refrele(ire);		/* Held in ire_add */
6744 	}
6745 	if (ipif_refheld)
6746 		ipif_refrele(ipif);
6747 	return (0);
6748 }
6749 
6750 /*
6751  * ip_rt_delete is called to delete an IPv4 route.
6752  * ipif_arg is passed in to associate it with the correct interface.
6753  * src_ipif is passed to associate the incoming interface of the packet.
6754  * We may need to restart this operation if the ipif cannot be looked up
6755  * due to an exclusive operation that is currently in progress. The restart
6756  * entry point is specified by 'func'
6757  */
6758 /* ARGSUSED4 */
6759 int
6760 ip_rt_delete(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
6761     uint_t rtm_addrs, int flags, ipif_t *ipif_arg, ipif_t *src_ipif,
6762     boolean_t ioctl_msg, queue_t *q, mblk_t *mp, ipsq_func_t func)
6763 {
6764 	ire_t	*ire = NULL;
6765 	ipif_t	*ipif;
6766 	boolean_t ipif_refheld = B_FALSE;
6767 	uint_t	type;
6768 	uint_t	match_flags = MATCH_IRE_TYPE;
6769 	int	err = 0;
6770 
6771 	ip1dbg(("ip_rt_delete:"));
6772 	/*
6773 	 * If this is the case of RTF_HOST being set, then we set the netmask
6774 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
6775 	 */
6776 	if (flags & RTF_HOST) {
6777 		mask = IP_HOST_MASK;
6778 		match_flags |= MATCH_IRE_MASK;
6779 	} else if (rtm_addrs & RTA_NETMASK) {
6780 		match_flags |= MATCH_IRE_MASK;
6781 	}
6782 
6783 	/*
6784 	 * Note that RTF_GATEWAY is never set on a delete, therefore
6785 	 * we check if the gateway address is one of our interfaces first,
6786 	 * and fall back on RTF_GATEWAY routes.
6787 	 *
6788 	 * This makes it possible to delete an original
6789 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
6790 	 *
6791 	 * As the interface index specified with the RTA_IFP sockaddr is the
6792 	 * same for all ipif's off of an ill, the matching logic below uses
6793 	 * MATCH_IRE_ILL if such an index was specified.  This means a route
6794 	 * sharing the same prefix and interface index as the the route
6795 	 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr
6796 	 * is specified in the request.
6797 	 *
6798 	 * On the other hand, since the gateway address will usually be
6799 	 * different for each ipif on the system, the matching logic
6800 	 * uses MATCH_IRE_IPIF in the case of a traditional interface
6801 	 * route.  This means that interface routes for the same prefix can be
6802 	 * uniquely identified if they belong to distinct ipif's and if a
6803 	 * RTA_IFP sockaddr is not present.
6804 	 *
6805 	 * For more detail on specifying routes by gateway address and by
6806 	 * interface index, see the comments in ip_rt_add().
6807 	 * gw_addr could be zero in some cases when both RTA_SRCIFP and
6808 	 * RTA_IFP are specified. If RTA_SRCIFP is specified and  both
6809 	 * RTA_IFP and gateway_addr are NULL/zero, then delete will not
6810 	 * succeed.
6811 	 */
6812 	if (src_ipif != NULL) {
6813 		if (ipif_arg == NULL && gw_addr != 0) {
6814 			ipif_arg = ipif_lookup_interface(gw_addr, dst_addr,
6815 			    q, mp, func, &err);
6816 			if (ipif_arg != NULL)
6817 				ipif_refheld = B_TRUE;
6818 		}
6819 		if (ipif_arg == NULL) {
6820 			err = (err == EINPROGRESS) ? err : ESRCH;
6821 			return (err);
6822 		}
6823 		ipif = ipif_arg;
6824 	} else {
6825 		ipif = ipif_lookup_interface(gw_addr, dst_addr,
6826 			    q, mp, func, &err);
6827 		if (ipif != NULL)
6828 			ipif_refheld = B_TRUE;
6829 		else if (err == EINPROGRESS)
6830 			return (err);
6831 		else
6832 			err = 0;
6833 	}
6834 	if (ipif != NULL) {
6835 		if (ipif_arg != NULL) {
6836 			if (ipif_refheld) {
6837 				ipif_refrele(ipif);
6838 				ipif_refheld = B_FALSE;
6839 			}
6840 			ipif = ipif_arg;
6841 			match_flags |= MATCH_IRE_ILL;
6842 		} else {
6843 			match_flags |= MATCH_IRE_IPIF;
6844 		}
6845 		if (src_ipif != NULL) {
6846 			ire = ire_srcif_table_lookup(dst_addr, IRE_INTERFACE,
6847 			    ipif, src_ipif->ipif_ill, match_flags);
6848 		} else {
6849 			if (ipif->ipif_ire_type == IRE_LOOPBACK) {
6850 				ire = ire_ctable_lookup(dst_addr, 0,
6851 				    IRE_LOOPBACK, ipif, ALL_ZONES, NULL,
6852 				    match_flags);
6853 			}
6854 			if (ire == NULL) {
6855 				ire = ire_ftable_lookup(dst_addr, mask, 0,
6856 				    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0,
6857 				    NULL, match_flags);
6858 			}
6859 		}
6860 	}
6861 
6862 	if (ire == NULL) {
6863 		/*
6864 		 * At this point, the gateway address is not one of our own
6865 		 * addresses or a matching interface route was not found.  We
6866 		 * set the IRE type to lookup based on whether
6867 		 * this is a host route, a default route or just a prefix.
6868 		 *
6869 		 * If an ipif_arg was passed in, then the lookup is based on an
6870 		 * interface index so MATCH_IRE_ILL is added to match_flags.
6871 		 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is
6872 		 * set as the route being looked up is not a traditional
6873 		 * interface route.
6874 		 * Since we do not add gateway route with srcipif, we don't
6875 		 * expect to find it either.
6876 		 */
6877 		if (src_ipif != NULL) {
6878 			if (ipif_refheld)
6879 				ipif_refrele(ipif);
6880 			return (ESRCH);
6881 		} else {
6882 			match_flags &= ~MATCH_IRE_IPIF;
6883 			match_flags |= MATCH_IRE_GW;
6884 			if (ipif_arg != NULL)
6885 				match_flags |= MATCH_IRE_ILL;
6886 			if (mask == IP_HOST_MASK)
6887 				type = IRE_HOST;
6888 			else if (mask == 0)
6889 				type = IRE_DEFAULT;
6890 			else
6891 				type = IRE_PREFIX;
6892 			ire = ire_ftable_lookup(dst_addr, mask, gw_addr, type,
6893 			    ipif_arg, NULL, ALL_ZONES, 0, NULL, match_flags);
6894 			if (ire == NULL && type == IRE_HOST) {
6895 				ire = ire_ftable_lookup(dst_addr, mask, gw_addr,
6896 				    IRE_HOST_REDIRECT, ipif_arg, NULL,
6897 				    ALL_ZONES, 0, NULL, match_flags);
6898 			}
6899 		}
6900 	}
6901 
6902 	if (ipif_refheld)
6903 		ipif_refrele(ipif);
6904 
6905 	/* ipif is not refheld anymore */
6906 	if (ire == NULL)
6907 		return (ESRCH);
6908 
6909 	if (ire->ire_flags & RTF_MULTIRT) {
6910 		/*
6911 		 * Invoke the CGTP (multirouting) filtering module
6912 		 * to remove the dst address from the filtering database.
6913 		 * Packets coming from that address will no longer be
6914 		 * filtered to remove duplicates.
6915 		 */
6916 		if (ip_cgtp_filter_ops != NULL) {
6917 			err = ip_cgtp_filter_ops->cfo_del_dest_v4(ire->ire_addr,
6918 			    ire->ire_gateway_addr);
6919 		}
6920 		ip_cgtp_bcast_delete(ire);
6921 	}
6922 
6923 	ipif = ire->ire_ipif;
6924 	/*
6925 	 * Removing from ipif_saved_ire_mp is not necessary
6926 	 * when src_ipif being non-NULL. ip_rt_add does not
6927 	 * save the ires which src_ipif being non-NULL.
6928 	 */
6929 	if (ipif != NULL && src_ipif == NULL) {
6930 		ipif_remove_ire(ipif, ire);
6931 	}
6932 	if (ioctl_msg)
6933 		ip_rts_rtmsg(RTM_OLDDEL, ire, 0);
6934 	ire_delete(ire);
6935 	ire_refrele(ire);
6936 	return (err);
6937 }
6938 
6939 /*
6940  * ip_siocaddrt is called to complete processing of an SIOCADDRT IOCTL.
6941  */
6942 /* ARGSUSED */
6943 int
6944 ip_siocaddrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
6945     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
6946 {
6947 	ipaddr_t dst_addr;
6948 	ipaddr_t gw_addr;
6949 	ipaddr_t mask;
6950 	int error = 0;
6951 	mblk_t *mp1;
6952 	struct rtentry *rt;
6953 	ipif_t *ipif = NULL;
6954 
6955 	ip1dbg(("ip_siocaddrt:"));
6956 	/* Existence of mp1 verified in ip_wput_nondata */
6957 	mp1 = mp->b_cont->b_cont;
6958 	rt = (struct rtentry *)mp1->b_rptr;
6959 
6960 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
6961 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
6962 
6963 	/*
6964 	 * If the RTF_HOST flag is on, this is a request to assign a gateway
6965 	 * to a particular host address.  In this case, we set the netmask to
6966 	 * all ones for the particular destination address.  Otherwise,
6967 	 * determine the netmask to be used based on dst_addr and the interfaces
6968 	 * in use.
6969 	 */
6970 	if (rt->rt_flags & RTF_HOST) {
6971 		mask = IP_HOST_MASK;
6972 	} else {
6973 		/*
6974 		 * Note that ip_subnet_mask returns a zero mask in the case of
6975 		 * default (an all-zeroes address).
6976 		 */
6977 		mask = ip_subnet_mask(dst_addr, &ipif);
6978 	}
6979 
6980 	error = ip_rt_add(dst_addr, mask, gw_addr, 0, rt->rt_flags, NULL, NULL,
6981 	    NULL, B_TRUE, q, mp, ip_process_ioctl, NULL);
6982 	if (ipif != NULL)
6983 		ipif_refrele(ipif);
6984 	return (error);
6985 }
6986 
6987 /*
6988  * ip_siocdelrt is called to complete processing of an SIOCDELRT IOCTL.
6989  */
6990 /* ARGSUSED */
6991 int
6992 ip_siocdelrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
6993     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
6994 {
6995 	ipaddr_t dst_addr;
6996 	ipaddr_t gw_addr;
6997 	ipaddr_t mask;
6998 	int error;
6999 	mblk_t *mp1;
7000 	struct rtentry *rt;
7001 	ipif_t *ipif = NULL;
7002 
7003 	ip1dbg(("ip_siocdelrt:"));
7004 	/* Existence of mp1 verified in ip_wput_nondata */
7005 	mp1 = mp->b_cont->b_cont;
7006 	rt = (struct rtentry *)mp1->b_rptr;
7007 
7008 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
7009 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
7010 
7011 	/*
7012 	 * If the RTF_HOST flag is on, this is a request to delete a gateway
7013 	 * to a particular host address.  In this case, we set the netmask to
7014 	 * all ones for the particular destination address.  Otherwise,
7015 	 * determine the netmask to be used based on dst_addr and the interfaces
7016 	 * in use.
7017 	 */
7018 	if (rt->rt_flags & RTF_HOST) {
7019 		mask = IP_HOST_MASK;
7020 	} else {
7021 		/*
7022 		 * Note that ip_subnet_mask returns a zero mask in the case of
7023 		 * default (an all-zeroes address).
7024 		 */
7025 		mask = ip_subnet_mask(dst_addr, &ipif);
7026 	}
7027 
7028 	error = ip_rt_delete(dst_addr, mask, gw_addr,
7029 	    RTA_DST | RTA_GATEWAY | RTA_NETMASK, rt->rt_flags, NULL, NULL,
7030 	    B_TRUE, q, mp, ip_process_ioctl);
7031 	if (ipif != NULL)
7032 		ipif_refrele(ipif);
7033 	return (error);
7034 }
7035 
7036 /*
7037  * Enqueue the mp onto the ipsq, chained by b_next.
7038  * b_prev stores the function to be executed later, and b_queue the queue
7039  * where this mp originated.
7040  */
7041 void
7042 ipsq_enq(ipsq_t *ipsq, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
7043     ill_t *pending_ill)
7044 {
7045 	conn_t	*connp = NULL;
7046 
7047 	ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
7048 	ASSERT(func != NULL);
7049 
7050 	mp->b_queue = q;
7051 	mp->b_prev = (void *)func;
7052 	mp->b_next = NULL;
7053 
7054 	switch (type) {
7055 	case CUR_OP:
7056 		if (ipsq->ipsq_mptail != NULL) {
7057 			ASSERT(ipsq->ipsq_mphead != NULL);
7058 			ipsq->ipsq_mptail->b_next = mp;
7059 		} else {
7060 			ASSERT(ipsq->ipsq_mphead == NULL);
7061 			ipsq->ipsq_mphead = mp;
7062 		}
7063 		ipsq->ipsq_mptail = mp;
7064 		break;
7065 
7066 	case NEW_OP:
7067 		if (ipsq->ipsq_xopq_mptail != NULL) {
7068 			ASSERT(ipsq->ipsq_xopq_mphead != NULL);
7069 			ipsq->ipsq_xopq_mptail->b_next = mp;
7070 		} else {
7071 			ASSERT(ipsq->ipsq_xopq_mphead == NULL);
7072 			ipsq->ipsq_xopq_mphead = mp;
7073 		}
7074 		ipsq->ipsq_xopq_mptail = mp;
7075 		break;
7076 	default:
7077 		cmn_err(CE_PANIC, "ipsq_enq %d type \n", type);
7078 	}
7079 
7080 	if (CONN_Q(q) && pending_ill != NULL) {
7081 		connp = Q_TO_CONN(q);
7082 
7083 		ASSERT(MUTEX_HELD(&connp->conn_lock));
7084 		connp->conn_oper_pending_ill = pending_ill;
7085 	}
7086 }
7087 
7088 /*
7089  * Return the mp at the head of the ipsq. After emptying the ipsq
7090  * look at the next ioctl, if this ioctl is complete. Otherwise
7091  * return, we will resume when we complete the current ioctl.
7092  * The current ioctl will wait till it gets a response from the
7093  * driver below.
7094  */
7095 static mblk_t *
7096 ipsq_dq(ipsq_t *ipsq)
7097 {
7098 	mblk_t	*mp;
7099 
7100 	ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
7101 
7102 	mp = ipsq->ipsq_mphead;
7103 	if (mp != NULL) {
7104 		ipsq->ipsq_mphead = mp->b_next;
7105 		if (ipsq->ipsq_mphead == NULL)
7106 			ipsq->ipsq_mptail = NULL;
7107 		mp->b_next = NULL;
7108 		return (mp);
7109 	}
7110 	if (ipsq->ipsq_current_ipif != NULL)
7111 		return (NULL);
7112 	mp = ipsq->ipsq_xopq_mphead;
7113 	if (mp != NULL) {
7114 		ipsq->ipsq_xopq_mphead = mp->b_next;
7115 		if (ipsq->ipsq_xopq_mphead == NULL)
7116 			ipsq->ipsq_xopq_mptail = NULL;
7117 		mp->b_next = NULL;
7118 		return (mp);
7119 	}
7120 	return (NULL);
7121 }
7122 
7123 /*
7124  * Enter the ipsq corresponding to ill, by waiting synchronously till
7125  * we can enter the ipsq exclusively. Unless 'force' is used, the ipsq
7126  * will have to drain completely before ipsq_enter returns success.
7127  * ipsq_current_ipif will be set if some exclusive ioctl is in progress,
7128  * and the ipsq_exit logic will start the next enqueued ioctl after
7129  * completion of the current ioctl. If 'force' is used, we don't wait
7130  * for the enqueued ioctls. This is needed when a conn_close wants to
7131  * enter the ipsq and abort an ioctl that is somehow stuck. Unplumb
7132  * of an ill can also use this option. But we dont' use it currently.
7133  */
7134 #define	ENTER_SQ_WAIT_TICKS 100
7135 boolean_t
7136 ipsq_enter(ill_t *ill, boolean_t force)
7137 {
7138 	ipsq_t	*ipsq;
7139 	boolean_t waited_enough = B_FALSE;
7140 
7141 	/*
7142 	 * Holding the ill_lock prevents <ill-ipsq> assocs from changing.
7143 	 * Since the <ill-ipsq> assocs could change while we wait for the
7144 	 * writer, it is easier to wait on a fixed global rather than try to
7145 	 * cv_wait on a changing ipsq.
7146 	 */
7147 	mutex_enter(&ill->ill_lock);
7148 	for (;;) {
7149 		if (ill->ill_state_flags & ILL_CONDEMNED) {
7150 			mutex_exit(&ill->ill_lock);
7151 			return (B_FALSE);
7152 		}
7153 
7154 		ipsq = ill->ill_phyint->phyint_ipsq;
7155 		mutex_enter(&ipsq->ipsq_lock);
7156 		if (ipsq->ipsq_writer == NULL &&
7157 		    (ipsq->ipsq_current_ipif == NULL || waited_enough)) {
7158 			break;
7159 		} else if (ipsq->ipsq_writer != NULL) {
7160 			mutex_exit(&ipsq->ipsq_lock);
7161 			cv_wait(&ill->ill_cv, &ill->ill_lock);
7162 		} else {
7163 			mutex_exit(&ipsq->ipsq_lock);
7164 			if (force) {
7165 				(void) cv_timedwait(&ill->ill_cv,
7166 				    &ill->ill_lock,
7167 				    lbolt + ENTER_SQ_WAIT_TICKS);
7168 				waited_enough = B_TRUE;
7169 				continue;
7170 			} else {
7171 				cv_wait(&ill->ill_cv, &ill->ill_lock);
7172 			}
7173 		}
7174 	}
7175 
7176 	ASSERT(ipsq->ipsq_mphead == NULL && ipsq->ipsq_mptail == NULL);
7177 	ASSERT(ipsq->ipsq_reentry_cnt == 0);
7178 	ipsq->ipsq_writer = curthread;
7179 	ipsq->ipsq_reentry_cnt++;
7180 #ifdef ILL_DEBUG
7181 	ipsq->ipsq_depth = getpcstack(ipsq->ipsq_stack, IP_STACK_DEPTH);
7182 #endif
7183 	mutex_exit(&ipsq->ipsq_lock);
7184 	mutex_exit(&ill->ill_lock);
7185 	return (B_TRUE);
7186 }
7187 
7188 /*
7189  * The ipsq_t (ipsq) is the synchronization data structure used to serialize
7190  * certain critical operations like plumbing (i.e. most set ioctls),
7191  * multicast joins, igmp/mld timers, IPMP operations etc. On a non-IPMP
7192  * system there is 1 ipsq per phyint. On an IPMP system there is 1 ipsq per
7193  * IPMP group. The ipsq serializes exclusive ioctls issued by applications
7194  * on a per ipsq basis in ipsq_xopq_mphead. It also protects against multiple
7195  * threads executing in the ipsq. Responses from the driver pertain to the
7196  * current ioctl (say a DL_BIND_ACK in response to a DL_BIND_REQUEST initiated
7197  * as part of bringing up the interface) and are enqueued in ipsq_mphead.
7198  *
7199  * If a thread does not want to reenter the ipsq when it is already writer,
7200  * it must make sure that the specified reentry point to be called later
7201  * when the ipsq is empty, nor any code path starting from the specified reentry
7202  * point must never ever try to enter the ipsq again. Otherwise it can lead
7203  * to an infinite loop. The reentry point ip_rput_dlpi_writer is an example.
7204  * When the thread that is currently exclusive finishes, it (ipsq_exit)
7205  * dequeues the requests waiting to become exclusive in ipsq_mphead and calls
7206  * the reentry point. When the list at ipsq_mphead becomes empty ipsq_exit
7207  * proceeds to dequeue the next ioctl in ipsq_xopq_mphead and start the next
7208  * ioctl if the current ioctl has completed. If the current ioctl is still
7209  * in progress it simply returns. The current ioctl could be waiting for
7210  * a response from another module (arp_ or the driver or could be waiting for
7211  * the ipif/ill/ire refcnts to drop to zero. In such a case the ipsq_pending_mp
7212  * and ipsq_pending_ipif are set. ipsq_current_ipif is set throughout the
7213  * execution of the ioctl and ipsq_exit does not start the next ioctl unless
7214  * ipsq_current_ipif is clear which happens only on ioctl completion.
7215  */
7216 
7217 /*
7218  * Try to enter the ipsq exclusively, corresponding to ipif or ill. (only 1 of
7219  * ipif or ill can be specified). The caller ensures ipif or ill is valid by
7220  * ref-holding it if necessary. If the ipsq cannot be entered, the mp is queued
7221  * completion.
7222  */
7223 ipsq_t *
7224 ipsq_try_enter(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
7225     ipsq_func_t func, int type, boolean_t reentry_ok)
7226 {
7227 	ipsq_t	*ipsq;
7228 
7229 	/* Only 1 of ipif or ill can be specified */
7230 	ASSERT((ipif != NULL) ^ (ill != NULL));
7231 	if (ipif != NULL)
7232 		ill = ipif->ipif_ill;
7233 
7234 	/*
7235 	 * lock ordering ill_g_lock -> conn_lock -> ill_lock -> ipsq_lock
7236 	 * ipsq of an ill can't change when ill_lock is held.
7237 	 */
7238 	GRAB_CONN_LOCK(q);
7239 	mutex_enter(&ill->ill_lock);
7240 	ipsq = ill->ill_phyint->phyint_ipsq;
7241 	mutex_enter(&ipsq->ipsq_lock);
7242 
7243 	/*
7244 	 * 1. Enter the ipsq if we are already writer and reentry is ok.
7245 	 *    (Note: If the caller does not specify reentry_ok then neither
7246 	 *    'func' nor any of its callees must ever attempt to enter the ipsq
7247 	 *    again. Otherwise it can lead to an infinite loop
7248 	 * 2. Enter the ipsq if there is no current writer and this attempted
7249 	 *    entry is part of the current ioctl or operation
7250 	 * 3. Enter the ipsq if there is no current writer and this is a new
7251 	 *    ioctl (or operation) and the ioctl (or operation) queue is
7252 	 *    empty and there is no ioctl (or operation) currently in progress
7253 	 */
7254 	if ((ipsq->ipsq_writer == NULL && ((type == CUR_OP) ||
7255 	    (type == NEW_OP && ipsq->ipsq_xopq_mphead == NULL &&
7256 	    ipsq->ipsq_current_ipif == NULL))) ||
7257 	    (ipsq->ipsq_writer == curthread && reentry_ok)) {
7258 		/* Success. */
7259 		ipsq->ipsq_reentry_cnt++;
7260 		ipsq->ipsq_writer = curthread;
7261 		mutex_exit(&ipsq->ipsq_lock);
7262 		mutex_exit(&ill->ill_lock);
7263 		RELEASE_CONN_LOCK(q);
7264 #ifdef ILL_DEBUG
7265 		ipsq->ipsq_depth = getpcstack(ipsq->ipsq_stack, IP_STACK_DEPTH);
7266 #endif
7267 		return (ipsq);
7268 	}
7269 
7270 	ipsq_enq(ipsq, q, mp, func, type, ill);
7271 
7272 	mutex_exit(&ipsq->ipsq_lock);
7273 	mutex_exit(&ill->ill_lock);
7274 	RELEASE_CONN_LOCK(q);
7275 	return (NULL);
7276 }
7277 
7278 /*
7279  * Try to enter the ipsq exclusively, corresponding to ipif or ill. (only 1 of
7280  * ipif or ill can be specified). The caller ensures ipif or ill is valid by
7281  * ref-holding it if necessary. If the ipsq cannot be entered, the mp is queued
7282  * completion.
7283  *
7284  * This function does a refrele on the ipif/ill.
7285  */
7286 void
7287 qwriter_ip(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
7288     ipsq_func_t func, int type, boolean_t reentry_ok)
7289 {
7290 	ipsq_t	*ipsq;
7291 
7292 	ipsq = ipsq_try_enter(ipif, ill, q, mp, func, type, reentry_ok);
7293 	/*
7294 	 * Caller must have done a refhold on the ipif. ipif_refrele
7295 	 * happens on the passed ipif. We can do this since we are
7296 	 * already exclusive, or we won't access ipif henceforth, Both
7297 	 * this func and caller will just return if we ipsq_try_enter
7298 	 * fails above. This is needed because func needs to
7299 	 * see the correct refcount. Eg. removeif can work only then.
7300 	 */
7301 	if (ipif != NULL)
7302 		ipif_refrele(ipif);
7303 	else
7304 		ill_refrele(ill);
7305 	if (ipsq != NULL) {
7306 		(*func)(ipsq, q, mp, NULL);
7307 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
7308 	}
7309 }
7310 
7311 /*
7312  * If there are more than ILL_GRP_CNT ills in a group,
7313  * we use kmem alloc'd buffers, else use the stack
7314  */
7315 #define	ILL_GRP_CNT	14
7316 /*
7317  * Drain the ipsq, if there are messages on it, and then leave the ipsq.
7318  * Called by a thread that is currently exclusive on this ipsq.
7319  */
7320 void
7321 ipsq_exit(ipsq_t *ipsq, boolean_t start_igmp_timer, boolean_t start_mld_timer)
7322 {
7323 	queue_t	*q;
7324 	mblk_t	*mp;
7325 	ipsq_func_t	func;
7326 	int	next;
7327 	ill_t	**ill_list = NULL;
7328 	size_t	ill_list_size = 0;
7329 	int	cnt = 0;
7330 	boolean_t need_ipsq_free = B_FALSE;
7331 
7332 	ASSERT(IAM_WRITER_IPSQ(ipsq));
7333 	mutex_enter(&ipsq->ipsq_lock);
7334 	ASSERT(ipsq->ipsq_reentry_cnt >= 1);
7335 	if (ipsq->ipsq_reentry_cnt != 1) {
7336 		ipsq->ipsq_reentry_cnt--;
7337 		mutex_exit(&ipsq->ipsq_lock);
7338 		return;
7339 	}
7340 
7341 	mp = ipsq_dq(ipsq);
7342 	while (mp != NULL) {
7343 again:
7344 		mutex_exit(&ipsq->ipsq_lock);
7345 		func = (ipsq_func_t)mp->b_prev;
7346 		q = (queue_t *)mp->b_queue;
7347 		mp->b_prev = NULL;
7348 		mp->b_queue = NULL;
7349 
7350 		/*
7351 		 * If 'q' is an conn queue, it is valid, since we did a
7352 		 * a refhold on the connp, at the start of the ioctl.
7353 		 * If 'q' is an ill queue, it is valid, since close of an
7354 		 * ill will clean up the 'ipsq'.
7355 		 */
7356 		(*func)(ipsq, q, mp, NULL);
7357 
7358 		mutex_enter(&ipsq->ipsq_lock);
7359 		mp = ipsq_dq(ipsq);
7360 	}
7361 
7362 	mutex_exit(&ipsq->ipsq_lock);
7363 
7364 	/*
7365 	 * Need to grab the locks in the right order. Need to
7366 	 * atomically check (under ipsq_lock) that there are no
7367 	 * messages before relinquishing the ipsq. Also need to
7368 	 * atomically wakeup waiters on ill_cv while holding ill_lock.
7369 	 * Holding ill_g_lock ensures that ipsq list of ills is stable.
7370 	 * If we need to call ill_split_ipsq and change <ill-ipsq> we need
7371 	 * to grab ill_g_lock as writer.
7372 	 */
7373 	rw_enter(&ill_g_lock, ipsq->ipsq_split ? RW_WRITER : RW_READER);
7374 
7375 	/* ipsq_refs can't change while ill_g_lock is held as reader */
7376 	if (ipsq->ipsq_refs != 0) {
7377 		/* At most 2 ills v4/v6 per phyint */
7378 		cnt = ipsq->ipsq_refs << 1;
7379 		ill_list_size = cnt * sizeof (ill_t *);
7380 		/*
7381 		 * If memory allocation fails, we will do the split
7382 		 * the next time ipsq_exit is called for whatever reason.
7383 		 * As long as the ipsq_split flag is set the need to
7384 		 * split is remembered.
7385 		 */
7386 		ill_list = kmem_zalloc(ill_list_size, KM_NOSLEEP);
7387 		if (ill_list != NULL)
7388 			cnt = ill_lock_ipsq_ills(ipsq, ill_list, cnt);
7389 	}
7390 	mutex_enter(&ipsq->ipsq_lock);
7391 	mp = ipsq_dq(ipsq);
7392 	if (mp != NULL) {
7393 		/* oops, some message has landed up, we can't get out */
7394 		if (ill_list != NULL)
7395 			ill_unlock_ills(ill_list, cnt);
7396 		rw_exit(&ill_g_lock);
7397 		if (ill_list != NULL)
7398 			kmem_free(ill_list, ill_list_size);
7399 		ill_list = NULL;
7400 		ill_list_size = 0;
7401 		cnt = 0;
7402 		goto again;
7403 	}
7404 
7405 	/*
7406 	 * Split only if no ioctl is pending and if memory alloc succeeded
7407 	 * above.
7408 	 */
7409 	if (ipsq->ipsq_split && ipsq->ipsq_current_ipif == NULL &&
7410 		ill_list != NULL) {
7411 		/*
7412 		 * No new ill can join this ipsq since we are holding the
7413 		 * ill_g_lock. Hence ill_split_ipsq can safely traverse the
7414 		 * ipsq. ill_split_ipsq may fail due to memory shortage.
7415 		 * If so we will retry on the next ipsq_exit.
7416 		 */
7417 		ipsq->ipsq_split = ill_split_ipsq(ipsq);
7418 	}
7419 
7420 	/*
7421 	 * We are holding the ipsq lock, hence no new messages can
7422 	 * land up on the ipsq, and there are no messages currently.
7423 	 * Now safe to get out. Wake up waiters and relinquish ipsq
7424 	 * atomically while holding ill locks.
7425 	 */
7426 	ipsq->ipsq_writer = NULL;
7427 	ipsq->ipsq_reentry_cnt--;
7428 	ASSERT(ipsq->ipsq_reentry_cnt == 0);
7429 #ifdef ILL_DEBUG
7430 	ipsq->ipsq_depth = 0;
7431 #endif
7432 	mutex_exit(&ipsq->ipsq_lock);
7433 	/*
7434 	 * For IPMP this should wake up all ills in this ipsq.
7435 	 * We need to hold the ill_lock while waking up waiters to
7436 	 * avoid missed wakeups. But there is no need to acquire all
7437 	 * the ill locks and then wakeup. If we have not acquired all
7438 	 * the locks (due to memory failure above) ill_signal_ipsq_ills
7439 	 * wakes up ills one at a time after getting the right ill_lock
7440 	 */
7441 	ill_signal_ipsq_ills(ipsq, ill_list != NULL);
7442 	if (ill_list != NULL)
7443 		ill_unlock_ills(ill_list, cnt);
7444 	if (ipsq->ipsq_refs == 0)
7445 		need_ipsq_free = B_TRUE;
7446 	rw_exit(&ill_g_lock);
7447 	if (ill_list != 0)
7448 		kmem_free(ill_list, ill_list_size);
7449 
7450 	if (need_ipsq_free) {
7451 		/*
7452 		 * Free the ipsq. ipsq_refs can't increase because ipsq can't be
7453 		 * looked up. ipsq can be looked up only thru ill or phyint
7454 		 * and there are no ills/phyint on this ipsq.
7455 		 */
7456 		ipsq_delete(ipsq);
7457 	}
7458 	/*
7459 	 * Now start any igmp or mld timers that could not be started
7460 	 * while inside the ipsq. The timers can't be started while inside
7461 	 * the ipsq, since igmp_start_timers may need to call untimeout()
7462 	 * which can't be done while holding a lock i.e. the ipsq. Otherwise
7463 	 * there could be a deadlock since the timeout handlers
7464 	 * mld_timeout_handler / igmp_timeout_handler also synchronously
7465 	 * wait in ipsq_enter() trying to get the ipsq.
7466 	 *
7467 	 * However there is one exception to the above. If this thread is
7468 	 * itself the igmp/mld timeout handler thread, then we don't want
7469 	 * to start any new timer until the current handler is done. The
7470 	 * handler thread passes in B_FALSE for start_igmp/mld_timers, while
7471 	 * all others pass B_TRUE.
7472 	 */
7473 	if (start_igmp_timer) {
7474 		mutex_enter(&igmp_timer_lock);
7475 		next = igmp_deferred_next;
7476 		igmp_deferred_next = INFINITY;
7477 		mutex_exit(&igmp_timer_lock);
7478 
7479 		if (next != INFINITY)
7480 			igmp_start_timers(next);
7481 	}
7482 
7483 	if (start_mld_timer) {
7484 		mutex_enter(&mld_timer_lock);
7485 		next = mld_deferred_next;
7486 		mld_deferred_next = INFINITY;
7487 		mutex_exit(&mld_timer_lock);
7488 
7489 		if (next != INFINITY)
7490 			mld_start_timers(next);
7491 	}
7492 }
7493 
7494 /*
7495  * The ill is closing. Flush all messages on the ipsq that originated
7496  * from this ill. Usually there wont' be any messages on the ipsq_xopq_mphead
7497  * for this ill since ipsq_enter could not have entered until then.
7498  * New messages can't be queued since the CONDEMNED flag is set.
7499  */
7500 static void
7501 ipsq_flush(ill_t *ill)
7502 {
7503 	queue_t	*q;
7504 	mblk_t	*prev;
7505 	mblk_t	*mp;
7506 	mblk_t	*mp_next;
7507 	ipsq_t	*ipsq;
7508 
7509 	ASSERT(IAM_WRITER_ILL(ill));
7510 	ipsq = ill->ill_phyint->phyint_ipsq;
7511 	/*
7512 	 * Flush any messages sent up by the driver.
7513 	 */
7514 	mutex_enter(&ipsq->ipsq_lock);
7515 	for (prev = NULL, mp = ipsq->ipsq_mphead; mp != NULL; mp = mp_next) {
7516 		mp_next = mp->b_next;
7517 		q = mp->b_queue;
7518 		if (q == ill->ill_rq || q == ill->ill_wq) {
7519 			/* Remove the mp from the ipsq */
7520 			if (prev == NULL)
7521 				ipsq->ipsq_mphead = mp->b_next;
7522 			else
7523 				prev->b_next = mp->b_next;
7524 			if (ipsq->ipsq_mptail == mp) {
7525 				ASSERT(mp_next == NULL);
7526 				ipsq->ipsq_mptail = prev;
7527 			}
7528 			inet_freemsg(mp);
7529 		} else {
7530 			prev = mp;
7531 		}
7532 	}
7533 	mutex_exit(&ipsq->ipsq_lock);
7534 	(void) ipsq_pending_mp_cleanup(ill, NULL);
7535 	ipsq_xopq_mp_cleanup(ill, NULL);
7536 	ill_pending_mp_cleanup(ill);
7537 }
7538 
7539 /*
7540  * Clean up one squeue element. ill_inuse_ref is protected by ill_lock.
7541  * The real cleanup happens behind the squeue via ip_squeue_clean function but
7542  * we need to protect ourselfs from 2 threads trying to cleanup at the same
7543  * time (possible with one port going down for aggr and someone tearing down the
7544  * entire aggr simultaneously. So we use ill_inuse_ref protected by ill_lock
7545  * to indicate when the cleanup has started (1 ref) and when the cleanup
7546  * is done (0 ref). When a new ring gets assigned to squeue, we start by
7547  * putting 2 ref on ill_inuse_ref.
7548  */
7549 static void
7550 ipsq_clean_ring(ill_t *ill, ill_rx_ring_t *rx_ring)
7551 {
7552 	conn_t *connp;
7553 	squeue_t *sqp;
7554 	mblk_t *mp;
7555 
7556 	ASSERT(rx_ring != NULL);
7557 
7558 	/* Just clean one squeue */
7559 	mutex_enter(&ill->ill_lock);
7560 	/*
7561 	 * Reset the ILL_SOFT_RING_ASSIGN bit so that
7562 	 * ip_squeue_soft_ring_affinty() will not go
7563 	 * ahead with assigning rings.
7564 	 */
7565 	ill->ill_state_flags &= ~ILL_SOFT_RING_ASSIGN;
7566 	while (rx_ring->rr_ring_state == ILL_RING_INPROC)
7567 		/* Some operations pending on the ring. Wait */
7568 		cv_wait(&ill->ill_cv, &ill->ill_lock);
7569 
7570 	if (rx_ring->rr_ring_state != ILL_RING_INUSE) {
7571 		/*
7572 		 * Someone already trying to clean
7573 		 * this squeue or its already been cleaned.
7574 		 */
7575 		mutex_exit(&ill->ill_lock);
7576 		return;
7577 	}
7578 	sqp = rx_ring->rr_sqp;
7579 
7580 	if (sqp == NULL) {
7581 		/*
7582 		 * The rx_ring never had a squeue assigned to it.
7583 		 * We are under ill_lock so we can clean it up
7584 		 * here itself since no one can get to it.
7585 		 */
7586 		rx_ring->rr_blank = NULL;
7587 		rx_ring->rr_handle = NULL;
7588 		rx_ring->rr_sqp = NULL;
7589 		rx_ring->rr_ring_state = ILL_RING_FREE;
7590 		mutex_exit(&ill->ill_lock);
7591 		return;
7592 	}
7593 
7594 	/* Set the state that its being cleaned */
7595 	rx_ring->rr_ring_state = ILL_RING_BEING_FREED;
7596 	ASSERT(sqp != NULL);
7597 	mutex_exit(&ill->ill_lock);
7598 
7599 	/*
7600 	 * Use the preallocated ill_unbind_conn for this purpose
7601 	 */
7602 	connp = ill->ill_dls_capab->ill_unbind_conn;
7603 	mp = &connp->conn_tcp->tcp_closemp;
7604 	CONN_INC_REF(connp);
7605 	squeue_enter(sqp, mp, ip_squeue_clean, connp, NULL);
7606 
7607 	mutex_enter(&ill->ill_lock);
7608 	while (rx_ring->rr_ring_state != ILL_RING_FREE)
7609 		cv_wait(&ill->ill_cv, &ill->ill_lock);
7610 
7611 	mutex_exit(&ill->ill_lock);
7612 }
7613 
7614 static void
7615 ipsq_clean_all(ill_t *ill)
7616 {
7617 	int idx;
7618 
7619 	/*
7620 	 * No need to clean if poll_capab isn't set for this ill
7621 	 */
7622 	if (!(ill->ill_capabilities & (ILL_CAPAB_POLL|ILL_CAPAB_SOFT_RING)))
7623 		return;
7624 
7625 	for (idx = 0; idx < ILL_MAX_RINGS; idx++) {
7626 		ill_rx_ring_t *ipr = &ill->ill_dls_capab->ill_ring_tbl[idx];
7627 		ipsq_clean_ring(ill, ipr);
7628 	}
7629 
7630 	ill->ill_capabilities &= ~(ILL_CAPAB_POLL|ILL_CAPAB_SOFT_RING);
7631 }
7632 
7633 /* ARGSUSED */
7634 int
7635 ip_sioctl_slifoindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
7636     ip_ioctl_cmd_t *ipip, void *ifreq)
7637 {
7638 	ill_t	*ill;
7639 	struct lifreq	*lifr = (struct lifreq *)ifreq;
7640 	boolean_t isv6;
7641 	conn_t	*connp;
7642 
7643 	connp = Q_TO_CONN(q);
7644 	isv6 = connp->conn_af_isv6;
7645 	/*
7646 	 * Set original index.
7647 	 * Failover and failback move logical interfaces
7648 	 * from one physical interface to another.  The
7649 	 * original index indicates the parent of a logical
7650 	 * interface, in other words, the physical interface
7651 	 * the logical interface will be moved back to on
7652 	 * failback.
7653 	 */
7654 
7655 	/*
7656 	 * Don't allow the original index to be changed
7657 	 * for non-failover addresses, autoconfigured
7658 	 * addresses, or IPv6 link local addresses.
7659 	 */
7660 	if (((ipif->ipif_flags & (IPIF_NOFAILOVER | IPIF_ADDRCONF)) != NULL) ||
7661 	    (isv6 && IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6lcl_addr))) {
7662 		return (EINVAL);
7663 	}
7664 	/*
7665 	 * The new original index must be in use by some
7666 	 * physical interface.
7667 	 */
7668 	ill = ill_lookup_on_ifindex(lifr->lifr_index, isv6, NULL, NULL,
7669 	    NULL, NULL);
7670 	if (ill == NULL)
7671 		return (ENXIO);
7672 	ill_refrele(ill);
7673 
7674 	ipif->ipif_orig_ifindex = lifr->lifr_index;
7675 	/*
7676 	 * When this ipif gets failed back, don't
7677 	 * preserve the original id, as it is no
7678 	 * longer applicable.
7679 	 */
7680 	ipif->ipif_orig_ipifid = 0;
7681 	/*
7682 	 * For IPv4, change the original index of any
7683 	 * multicast addresses associated with the
7684 	 * ipif to the new value.
7685 	 */
7686 	if (!isv6) {
7687 		ilm_t *ilm;
7688 
7689 		mutex_enter(&ipif->ipif_ill->ill_lock);
7690 		for (ilm = ipif->ipif_ill->ill_ilm; ilm != NULL;
7691 		    ilm = ilm->ilm_next) {
7692 			if (ilm->ilm_ipif == ipif) {
7693 				ilm->ilm_orig_ifindex = lifr->lifr_index;
7694 			}
7695 		}
7696 		mutex_exit(&ipif->ipif_ill->ill_lock);
7697 	}
7698 	return (0);
7699 }
7700 
7701 /* ARGSUSED */
7702 int
7703 ip_sioctl_get_oindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
7704     ip_ioctl_cmd_t *ipip, void *ifreq)
7705 {
7706 	struct lifreq *lifr = (struct lifreq *)ifreq;
7707 
7708 	/*
7709 	 * Get the original interface index i.e the one
7710 	 * before FAILOVER if it ever happened.
7711 	 */
7712 	lifr->lifr_index = ipif->ipif_orig_ifindex;
7713 	return (0);
7714 }
7715 
7716 /*
7717  * Parse an iftun_req structure coming down SIOC[GS]TUNPARAM ioctls,
7718  * refhold and return the associated ipif
7719  */
7720 int
7721 ip_extract_tunreq(queue_t *q, mblk_t *mp, ipif_t **ipifp, ipsq_func_t func)
7722 {
7723 	boolean_t exists;
7724 	struct iftun_req *ta;
7725 	ipif_t	*ipif;
7726 	ill_t	*ill;
7727 	boolean_t isv6;
7728 	mblk_t	*mp1;
7729 	int	error;
7730 	conn_t	*connp;
7731 
7732 	/* Existence verified in ip_wput_nondata */
7733 	mp1 = mp->b_cont->b_cont;
7734 	ta = (struct iftun_req *)mp1->b_rptr;
7735 	/*
7736 	 * Null terminate the string to protect against buffer
7737 	 * overrun. String was generated by user code and may not
7738 	 * be trusted.
7739 	 */
7740 	ta->ifta_lifr_name[LIFNAMSIZ - 1] = '\0';
7741 
7742 	connp = Q_TO_CONN(q);
7743 	isv6 = connp->conn_af_isv6;
7744 
7745 	/* Disallows implicit create */
7746 	ipif = ipif_lookup_on_name(ta->ifta_lifr_name,
7747 	    mi_strlen(ta->ifta_lifr_name), B_FALSE, &exists, isv6,
7748 	    connp->conn_zoneid, CONNP_TO_WQ(connp), mp, func, &error);
7749 	if (ipif == NULL)
7750 		return (error);
7751 
7752 	if (ipif->ipif_id != 0) {
7753 		/*
7754 		 * We really don't want to set/get tunnel parameters
7755 		 * on virtual tunnel interfaces.  Only allow the
7756 		 * base tunnel to do these.
7757 		 */
7758 		ipif_refrele(ipif);
7759 		return (EINVAL);
7760 	}
7761 
7762 	/*
7763 	 * Send down to tunnel mod for ioctl processing.
7764 	 * Will finish ioctl in ip_rput_other().
7765 	 */
7766 	ill = ipif->ipif_ill;
7767 	if (ill->ill_net_type == IRE_LOOPBACK) {
7768 		ipif_refrele(ipif);
7769 		return (EOPNOTSUPP);
7770 	}
7771 
7772 	if (ill->ill_wq == NULL) {
7773 		ipif_refrele(ipif);
7774 		return (ENXIO);
7775 	}
7776 	/*
7777 	 * Mark the ioctl as coming from an IPv6 interface for
7778 	 * tun's convenience.
7779 	 */
7780 	if (ill->ill_isv6)
7781 		ta->ifta_flags |= 0x80000000;
7782 	*ipifp = ipif;
7783 	return (0);
7784 }
7785 
7786 /*
7787  * Parse an ifreq or lifreq struct coming down ioctls and refhold
7788  * and return the associated ipif.
7789  * Return value:
7790  *	Non zero: An error has occurred. ci may not be filled out.
7791  *	zero : ci is filled out with the ioctl cmd in ci.ci_name, and
7792  *	a held ipif in ci.ci_ipif.
7793  */
7794 int
7795 ip_extract_lifreq_cmn(queue_t *q, mblk_t *mp, int cmd_type, int flags,
7796     cmd_info_t *ci, ipsq_func_t func)
7797 {
7798 	sin_t		*sin;
7799 	sin6_t		*sin6;
7800 	char		*name;
7801 	struct ifreq    *ifr;
7802 	struct lifreq    *lifr;
7803 	ipif_t		*ipif = NULL;
7804 	ill_t		*ill;
7805 	conn_t		*connp;
7806 	boolean_t	isv6;
7807 	struct iocblk   *iocp = (struct iocblk *)mp->b_rptr;
7808 	boolean_t	exists;
7809 	int		err;
7810 	mblk_t		*mp1;
7811 	zoneid_t	zoneid;
7812 
7813 	if (q->q_next != NULL) {
7814 		ill = (ill_t *)q->q_ptr;
7815 		isv6 = ill->ill_isv6;
7816 		connp = NULL;
7817 		zoneid = ALL_ZONES;
7818 	} else {
7819 		ill = NULL;
7820 		connp = Q_TO_CONN(q);
7821 		isv6 = connp->conn_af_isv6;
7822 		zoneid = connp->conn_zoneid;
7823 		if (zoneid == GLOBAL_ZONEID) {
7824 			/* global zone can access ipifs in all zones */
7825 			zoneid = ALL_ZONES;
7826 		}
7827 	}
7828 
7829 	/* Has been checked in ip_wput_nondata */
7830 	mp1 = mp->b_cont->b_cont;
7831 
7832 
7833 	if (cmd_type == IF_CMD) {
7834 		/* This a old style SIOC[GS]IF* command */
7835 		ifr = (struct ifreq *)mp1->b_rptr;
7836 		/*
7837 		 * Null terminate the string to protect against buffer
7838 		 * overrun. String was generated by user code and may not
7839 		 * be trusted.
7840 		 */
7841 		ifr->ifr_name[IFNAMSIZ - 1] = '\0';
7842 		sin = (sin_t *)&ifr->ifr_addr;
7843 		name = ifr->ifr_name;
7844 		ci->ci_sin = sin;
7845 		ci->ci_sin6 = NULL;
7846 		ci->ci_lifr = (struct lifreq *)ifr;
7847 	} else {
7848 		/* This a new style SIOC[GS]LIF* command */
7849 		ASSERT(cmd_type == LIF_CMD);
7850 		lifr = (struct lifreq *)mp1->b_rptr;
7851 		/*
7852 		 * Null terminate the string to protect against buffer
7853 		 * overrun. String was generated by user code and may not
7854 		 * be trusted.
7855 		 */
7856 		lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
7857 		name = lifr->lifr_name;
7858 		sin = (sin_t *)&lifr->lifr_addr;
7859 		sin6 = (sin6_t *)&lifr->lifr_addr;
7860 		if (iocp->ioc_cmd == SIOCSLIFGROUPNAME) {
7861 			(void) strncpy(ci->ci_groupname, lifr->lifr_groupname,
7862 			    LIFNAMSIZ);
7863 		}
7864 		ci->ci_sin = sin;
7865 		ci->ci_sin6 = sin6;
7866 		ci->ci_lifr = lifr;
7867 	}
7868 
7869 
7870 	if (iocp->ioc_cmd == SIOCSLIFNAME) {
7871 		/*
7872 		 * The ioctl will be failed if the ioctl comes down
7873 		 * an conn stream
7874 		 */
7875 		if (ill == NULL) {
7876 			/*
7877 			 * Not an ill queue, return EINVAL same as the
7878 			 * old error code.
7879 			 */
7880 			return (ENXIO);
7881 		}
7882 		ipif = ill->ill_ipif;
7883 		ipif_refhold(ipif);
7884 	} else {
7885 		ipif = ipif_lookup_on_name(name, mi_strlen(name), B_FALSE,
7886 		    &exists, isv6, zoneid,
7887 		    (connp == NULL) ? q : CONNP_TO_WQ(connp), mp, func, &err);
7888 		if (ipif == NULL) {
7889 			if (err == EINPROGRESS)
7890 				return (err);
7891 			if (iocp->ioc_cmd == SIOCLIFFAILOVER ||
7892 			    iocp->ioc_cmd == SIOCLIFFAILBACK) {
7893 				/*
7894 				 * Need to try both v4 and v6 since this
7895 				 * ioctl can come down either v4 or v6
7896 				 * socket. The lifreq.lifr_family passed
7897 				 * down by this ioctl is AF_UNSPEC.
7898 				 */
7899 				ipif = ipif_lookup_on_name(name,
7900 				    mi_strlen(name), B_FALSE, &exists, !isv6,
7901 				    zoneid, (connp == NULL) ? q :
7902 				    CONNP_TO_WQ(connp), mp, func, &err);
7903 				if (err == EINPROGRESS)
7904 					return (err);
7905 			}
7906 			err = 0;	/* Ensure we don't use it below */
7907 		}
7908 	}
7909 
7910 	/*
7911 	 * Old style [GS]IFCMD does not admit IPv6 ipif
7912 	 */
7913 	if (ipif != NULL && ipif->ipif_isv6 && cmd_type == IF_CMD) {
7914 		ipif_refrele(ipif);
7915 		return (ENXIO);
7916 	}
7917 
7918 	if (ipif == NULL && ill != NULL && ill->ill_ipif != NULL &&
7919 	    name[0] == '\0') {
7920 		/*
7921 		 * Handle a or a SIOC?IF* with a null name
7922 		 * during plumb (on the ill queue before the I_PLINK).
7923 		 */
7924 		ipif = ill->ill_ipif;
7925 		ipif_refhold(ipif);
7926 	}
7927 
7928 	if (ipif == NULL)
7929 		return (ENXIO);
7930 
7931 	/*
7932 	 * Allow only GET operations if this ipif has been created
7933 	 * temporarily due to a MOVE operation.
7934 	 */
7935 	if (ipif->ipif_replace_zero && !(flags & IPI_REPL)) {
7936 		ipif_refrele(ipif);
7937 		return (EINVAL);
7938 	}
7939 
7940 	ci->ci_ipif = ipif;
7941 	return (0);
7942 }
7943 
7944 /*
7945  * Return the total number of ipifs.
7946  */
7947 static uint_t
7948 ip_get_numifs(zoneid_t zoneid)
7949 {
7950 	uint_t numifs = 0;
7951 	ill_t	*ill;
7952 	ill_walk_context_t	ctx;
7953 	ipif_t	*ipif;
7954 
7955 	rw_enter(&ill_g_lock, RW_READER);
7956 	ill = ILL_START_WALK_V4(&ctx);
7957 
7958 	while (ill != NULL) {
7959 		for (ipif = ill->ill_ipif; ipif != NULL;
7960 		    ipif = ipif->ipif_next) {
7961 			if (ipif->ipif_zoneid == zoneid ||
7962 			    ipif->ipif_zoneid == ALL_ZONES)
7963 				numifs++;
7964 		}
7965 		ill = ill_next(&ctx, ill);
7966 	}
7967 	rw_exit(&ill_g_lock);
7968 	return (numifs);
7969 }
7970 
7971 /*
7972  * Return the total number of ipifs.
7973  */
7974 static uint_t
7975 ip_get_numlifs(int family, int lifn_flags, zoneid_t zoneid)
7976 {
7977 	uint_t numifs = 0;
7978 	ill_t	*ill;
7979 	ipif_t	*ipif;
7980 	ill_walk_context_t	ctx;
7981 
7982 	ip1dbg(("ip_get_numlifs(%d %u %d)\n", family, lifn_flags, (int)zoneid));
7983 
7984 	rw_enter(&ill_g_lock, RW_READER);
7985 	if (family == AF_INET)
7986 		ill = ILL_START_WALK_V4(&ctx);
7987 	else if (family == AF_INET6)
7988 		ill = ILL_START_WALK_V6(&ctx);
7989 	else
7990 		ill = ILL_START_WALK_ALL(&ctx);
7991 
7992 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7993 		for (ipif = ill->ill_ipif; ipif != NULL;
7994 		    ipif = ipif->ipif_next) {
7995 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
7996 			    !(lifn_flags & LIFC_NOXMIT))
7997 				continue;
7998 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
7999 			    !(lifn_flags & LIFC_TEMPORARY))
8000 				continue;
8001 			if (((ipif->ipif_flags &
8002 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
8003 			    IPIF_DEPRECATED)) ||
8004 			    (ill->ill_phyint->phyint_flags &
8005 			    PHYI_LOOPBACK) ||
8006 			    !(ipif->ipif_flags & IPIF_UP)) &&
8007 			    (lifn_flags & LIFC_EXTERNAL_SOURCE))
8008 				continue;
8009 
8010 			if (zoneid != ipif->ipif_zoneid &&
8011 			    ipif->ipif_zoneid != ALL_ZONES &&
8012 			    (zoneid != GLOBAL_ZONEID ||
8013 			    !(lifn_flags & LIFC_ALLZONES)))
8014 				continue;
8015 
8016 			numifs++;
8017 		}
8018 	}
8019 	rw_exit(&ill_g_lock);
8020 	return (numifs);
8021 }
8022 
8023 uint_t
8024 ip_get_lifsrcofnum(ill_t *ill)
8025 {
8026 	uint_t numifs = 0;
8027 	ill_t	*ill_head = ill;
8028 
8029 	/*
8030 	 * ill_g_usesrc_lock protects ill_usesrc_grp_next, for example, some
8031 	 * other thread may be trying to relink the ILLs in this usesrc group
8032 	 * and adjusting the ill_usesrc_grp_next pointers
8033 	 */
8034 	rw_enter(&ill_g_usesrc_lock, RW_READER);
8035 	if ((ill->ill_usesrc_ifindex == 0) &&
8036 	    (ill->ill_usesrc_grp_next != NULL)) {
8037 		for (; (ill != NULL) && (ill->ill_usesrc_grp_next != ill_head);
8038 		    ill = ill->ill_usesrc_grp_next)
8039 			numifs++;
8040 	}
8041 	rw_exit(&ill_g_usesrc_lock);
8042 
8043 	return (numifs);
8044 }
8045 
8046 /* Null values are passed in for ipif, sin, and ifreq */
8047 /* ARGSUSED */
8048 int
8049 ip_sioctl_get_ifnum(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8050     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8051 {
8052 	int *nump;
8053 
8054 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
8055 
8056 	/* Existence of b_cont->b_cont checked in ip_wput_nondata */
8057 	nump = (int *)mp->b_cont->b_cont->b_rptr;
8058 
8059 	*nump = ip_get_numifs(Q_TO_CONN(q)->conn_zoneid);
8060 	ip1dbg(("ip_sioctl_get_ifnum numifs %d", *nump));
8061 	return (0);
8062 }
8063 
8064 /* Null values are passed in for ipif, sin, and ifreq */
8065 /* ARGSUSED */
8066 int
8067 ip_sioctl_get_lifnum(ipif_t *dummy_ipif, sin_t *dummy_sin,
8068     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8069 {
8070 	struct lifnum *lifn;
8071 	mblk_t	*mp1;
8072 
8073 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
8074 
8075 	/* Existence checked in ip_wput_nondata */
8076 	mp1 = mp->b_cont->b_cont;
8077 
8078 	lifn = (struct lifnum *)mp1->b_rptr;
8079 	switch (lifn->lifn_family) {
8080 	case AF_UNSPEC:
8081 	case AF_INET:
8082 	case AF_INET6:
8083 		break;
8084 	default:
8085 		return (EAFNOSUPPORT);
8086 	}
8087 
8088 	lifn->lifn_count = ip_get_numlifs(lifn->lifn_family, lifn->lifn_flags,
8089 	    Q_TO_CONN(q)->conn_zoneid);
8090 	ip1dbg(("ip_sioctl_get_lifnum numifs %d", lifn->lifn_count));
8091 	return (0);
8092 }
8093 
8094 /* ARGSUSED */
8095 int
8096 ip_sioctl_get_ifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8097     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8098 {
8099 	STRUCT_HANDLE(ifconf, ifc);
8100 	mblk_t *mp1;
8101 	struct iocblk *iocp;
8102 	struct ifreq *ifr;
8103 	ill_walk_context_t	ctx;
8104 	ill_t	*ill;
8105 	ipif_t	*ipif;
8106 	struct sockaddr_in *sin;
8107 	int32_t	ifclen;
8108 	zoneid_t zoneid;
8109 
8110 	ASSERT(q->q_next == NULL); /* not valid ioctls for ip as a module */
8111 
8112 	ip1dbg(("ip_sioctl_get_ifconf"));
8113 	/* Existence verified in ip_wput_nondata */
8114 	mp1 = mp->b_cont->b_cont;
8115 	iocp = (struct iocblk *)mp->b_rptr;
8116 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8117 
8118 	/*
8119 	 * The original SIOCGIFCONF passed in a struct ifconf which specified
8120 	 * the user buffer address and length into which the list of struct
8121 	 * ifreqs was to be copied.  Since AT&T Streams does not seem to
8122 	 * allow M_COPYOUT to be used in conjunction with I_STR IOCTLS,
8123 	 * the SIOCGIFCONF operation was redefined to simply provide
8124 	 * a large output buffer into which we are supposed to jam the ifreq
8125 	 * array.  The same ioctl command code was used, despite the fact that
8126 	 * both the applications and the kernel code had to change, thus making
8127 	 * it impossible to support both interfaces.
8128 	 *
8129 	 * For reasons not good enough to try to explain, the following
8130 	 * algorithm is used for deciding what to do with one of these:
8131 	 * If the IOCTL comes in as an I_STR, it is assumed to be of the new
8132 	 * form with the output buffer coming down as the continuation message.
8133 	 * If it arrives as a TRANSPARENT IOCTL, it is assumed to be old style,
8134 	 * and we have to copy in the ifconf structure to find out how big the
8135 	 * output buffer is and where to copy out to.  Sure no problem...
8136 	 *
8137 	 */
8138 	STRUCT_SET_HANDLE(ifc, iocp->ioc_flag, NULL);
8139 	if ((mp1->b_wptr - mp1->b_rptr) == STRUCT_SIZE(ifc)) {
8140 		int numifs = 0;
8141 		size_t ifc_bufsize;
8142 
8143 		/*
8144 		 * Must be (better be!) continuation of a TRANSPARENT
8145 		 * IOCTL.  We just copied in the ifconf structure.
8146 		 */
8147 		STRUCT_SET_HANDLE(ifc, iocp->ioc_flag,
8148 		    (struct ifconf *)mp1->b_rptr);
8149 
8150 		/*
8151 		 * Allocate a buffer to hold requested information.
8152 		 *
8153 		 * If ifc_len is larger than what is needed, we only
8154 		 * allocate what we will use.
8155 		 *
8156 		 * If ifc_len is smaller than what is needed, return
8157 		 * EINVAL.
8158 		 *
8159 		 * XXX: the ill_t structure can hava 2 counters, for
8160 		 * v4 and v6 (not just ill_ipif_up_count) to store the
8161 		 * number of interfaces for a device, so we don't need
8162 		 * to count them here...
8163 		 */
8164 		numifs = ip_get_numifs(zoneid);
8165 
8166 		ifclen = STRUCT_FGET(ifc, ifc_len);
8167 		ifc_bufsize = numifs * sizeof (struct ifreq);
8168 		if (ifc_bufsize > ifclen) {
8169 			if (iocp->ioc_cmd == O_SIOCGIFCONF) {
8170 				/* old behaviour */
8171 				return (EINVAL);
8172 			} else {
8173 				ifc_bufsize = ifclen;
8174 			}
8175 		}
8176 
8177 		mp1 = mi_copyout_alloc(q, mp,
8178 		    STRUCT_FGETP(ifc, ifc_buf), ifc_bufsize, B_FALSE);
8179 		if (mp1 == NULL)
8180 			return (ENOMEM);
8181 
8182 		mp1->b_wptr = mp1->b_rptr + ifc_bufsize;
8183 	}
8184 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
8185 	/*
8186 	 * the SIOCGIFCONF ioctl only knows about
8187 	 * IPv4 addresses, so don't try to tell
8188 	 * it about interfaces with IPv6-only
8189 	 * addresses. (Last parm 'isv6' is B_FALSE)
8190 	 */
8191 
8192 	ifr = (struct ifreq *)mp1->b_rptr;
8193 
8194 	rw_enter(&ill_g_lock, RW_READER);
8195 	ill = ILL_START_WALK_V4(&ctx);
8196 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8197 		for (ipif = ill->ill_ipif; ipif;
8198 		    ipif = ipif->ipif_next) {
8199 			if (zoneid != ipif->ipif_zoneid &&
8200 			    ipif->ipif_zoneid != ALL_ZONES)
8201 				continue;
8202 			if ((uchar_t *)&ifr[1] > mp1->b_wptr) {
8203 				if (iocp->ioc_cmd == O_SIOCGIFCONF) {
8204 					/* old behaviour */
8205 					rw_exit(&ill_g_lock);
8206 					return (EINVAL);
8207 				} else {
8208 					goto if_copydone;
8209 				}
8210 			}
8211 			(void) ipif_get_name(ipif,
8212 			    ifr->ifr_name,
8213 			    sizeof (ifr->ifr_name));
8214 			sin = (sin_t *)&ifr->ifr_addr;
8215 			*sin = sin_null;
8216 			sin->sin_family = AF_INET;
8217 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
8218 			ifr++;
8219 		}
8220 	}
8221 if_copydone:
8222 	rw_exit(&ill_g_lock);
8223 	mp1->b_wptr = (uchar_t *)ifr;
8224 
8225 	if (STRUCT_BUF(ifc) != NULL) {
8226 		STRUCT_FSET(ifc, ifc_len,
8227 			(int)((uchar_t *)ifr - mp1->b_rptr));
8228 	}
8229 	return (0);
8230 }
8231 
8232 /*
8233  * Get the interfaces using the address hosted on the interface passed in,
8234  * as a source adddress
8235  */
8236 /* ARGSUSED */
8237 int
8238 ip_sioctl_get_lifsrcof(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8239     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8240 {
8241 	mblk_t *mp1;
8242 	ill_t	*ill, *ill_head;
8243 	ipif_t	*ipif, *orig_ipif;
8244 	int	numlifs = 0;
8245 	size_t	lifs_bufsize, lifsmaxlen;
8246 	struct	lifreq *lifr;
8247 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8248 	uint_t	ifindex;
8249 	zoneid_t zoneid;
8250 	int err = 0;
8251 	boolean_t isv6 = B_FALSE;
8252 	struct	sockaddr_in	*sin;
8253 	struct	sockaddr_in6	*sin6;
8254 
8255 	STRUCT_HANDLE(lifsrcof, lifs);
8256 
8257 	ASSERT(q->q_next == NULL);
8258 
8259 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8260 
8261 	/* Existence verified in ip_wput_nondata */
8262 	mp1 = mp->b_cont->b_cont;
8263 
8264 	/*
8265 	 * Must be (better be!) continuation of a TRANSPARENT
8266 	 * IOCTL.  We just copied in the lifsrcof structure.
8267 	 */
8268 	STRUCT_SET_HANDLE(lifs, iocp->ioc_flag,
8269 	    (struct lifsrcof *)mp1->b_rptr);
8270 
8271 	if (MBLKL(mp1) != STRUCT_SIZE(lifs))
8272 		return (EINVAL);
8273 
8274 	ifindex = STRUCT_FGET(lifs, lifs_ifindex);
8275 	isv6 = (Q_TO_CONN(q))->conn_af_isv6;
8276 	ipif = ipif_lookup_on_ifindex(ifindex, isv6, zoneid, q, mp,
8277 	    ip_process_ioctl, &err);
8278 	if (ipif == NULL) {
8279 		ip1dbg(("ip_sioctl_get_lifsrcof: no ipif for ifindex %d\n",
8280 		    ifindex));
8281 		return (err);
8282 	}
8283 
8284 
8285 	/* Allocate a buffer to hold requested information */
8286 	numlifs = ip_get_lifsrcofnum(ipif->ipif_ill);
8287 	lifs_bufsize = numlifs * sizeof (struct lifreq);
8288 	lifsmaxlen =  STRUCT_FGET(lifs, lifs_maxlen);
8289 	/* The actual size needed is always returned in lifs_len */
8290 	STRUCT_FSET(lifs, lifs_len, lifs_bufsize);
8291 
8292 	/* If the amount we need is more than what is passed in, abort */
8293 	if (lifs_bufsize > lifsmaxlen || lifs_bufsize == 0) {
8294 		ipif_refrele(ipif);
8295 		return (0);
8296 	}
8297 
8298 	mp1 = mi_copyout_alloc(q, mp,
8299 	    STRUCT_FGETP(lifs, lifs_buf), lifs_bufsize, B_FALSE);
8300 	if (mp1 == NULL) {
8301 		ipif_refrele(ipif);
8302 		return (ENOMEM);
8303 	}
8304 
8305 	mp1->b_wptr = mp1->b_rptr + lifs_bufsize;
8306 	bzero(mp1->b_rptr, lifs_bufsize);
8307 
8308 	lifr = (struct lifreq *)mp1->b_rptr;
8309 
8310 	ill = ill_head = ipif->ipif_ill;
8311 	orig_ipif = ipif;
8312 
8313 	/* ill_g_usesrc_lock protects ill_usesrc_grp_next */
8314 	rw_enter(&ill_g_usesrc_lock, RW_READER);
8315 	rw_enter(&ill_g_lock, RW_READER);
8316 
8317 	ill = ill->ill_usesrc_grp_next; /* start from next ill */
8318 	for (; (ill != NULL) && (ill != ill_head);
8319 	    ill = ill->ill_usesrc_grp_next) {
8320 
8321 		if ((uchar_t *)&lifr[1] > mp1->b_wptr)
8322 			break;
8323 
8324 		ipif = ill->ill_ipif;
8325 		(void) ipif_get_name(ipif,
8326 		    lifr->lifr_name, sizeof (lifr->lifr_name));
8327 		if (ipif->ipif_isv6) {
8328 			sin6 = (sin6_t *)&lifr->lifr_addr;
8329 			*sin6 = sin6_null;
8330 			sin6->sin6_family = AF_INET6;
8331 			sin6->sin6_addr = ipif->ipif_v6lcl_addr;
8332 			lifr->lifr_addrlen = ip_mask_to_plen_v6(
8333 			    &ipif->ipif_v6net_mask);
8334 		} else {
8335 			sin = (sin_t *)&lifr->lifr_addr;
8336 			*sin = sin_null;
8337 			sin->sin_family = AF_INET;
8338 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
8339 			lifr->lifr_addrlen = ip_mask_to_plen(
8340 			    ipif->ipif_net_mask);
8341 		}
8342 		lifr++;
8343 	}
8344 	rw_exit(&ill_g_usesrc_lock);
8345 	rw_exit(&ill_g_lock);
8346 	ipif_refrele(orig_ipif);
8347 	mp1->b_wptr = (uchar_t *)lifr;
8348 	STRUCT_FSET(lifs, lifs_len, (int)((uchar_t *)lifr - mp1->b_rptr));
8349 
8350 	return (0);
8351 }
8352 
8353 /* ARGSUSED */
8354 int
8355 ip_sioctl_get_lifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8356     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8357 {
8358 	mblk_t *mp1;
8359 	int	list;
8360 	ill_t	*ill;
8361 	ipif_t	*ipif;
8362 	int	flags;
8363 	int	numlifs = 0;
8364 	size_t	lifc_bufsize;
8365 	struct	lifreq *lifr;
8366 	sa_family_t	family;
8367 	struct	sockaddr_in	*sin;
8368 	struct	sockaddr_in6	*sin6;
8369 	ill_walk_context_t	ctx;
8370 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8371 	int32_t	lifclen;
8372 	zoneid_t zoneid;
8373 	STRUCT_HANDLE(lifconf, lifc);
8374 
8375 	ip1dbg(("ip_sioctl_get_lifconf"));
8376 
8377 	ASSERT(q->q_next == NULL);
8378 
8379 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8380 
8381 	/* Existence verified in ip_wput_nondata */
8382 	mp1 = mp->b_cont->b_cont;
8383 
8384 	/*
8385 	 * An extended version of SIOCGIFCONF that takes an
8386 	 * additional address family and flags field.
8387 	 * AF_UNSPEC retrieve both IPv4 and IPv6.
8388 	 * Unless LIFC_NOXMIT is specified the IPIF_NOXMIT
8389 	 * interfaces are omitted.
8390 	 * Similarly, IPIF_TEMPORARY interfaces are omitted
8391 	 * unless LIFC_TEMPORARY is specified.
8392 	 * If LIFC_EXTERNAL_SOURCE is specified, IPIF_NOXMIT,
8393 	 * IPIF_NOLOCAL, PHYI_LOOPBACK, IPIF_DEPRECATED and
8394 	 * not IPIF_UP interfaces are omitted. LIFC_EXTERNAL_SOURCE
8395 	 * has priority over LIFC_NOXMIT.
8396 	 */
8397 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, NULL);
8398 
8399 	if ((mp1->b_wptr - mp1->b_rptr) != STRUCT_SIZE(lifc))
8400 		return (EINVAL);
8401 
8402 	/*
8403 	 * Must be (better be!) continuation of a TRANSPARENT
8404 	 * IOCTL.  We just copied in the lifconf structure.
8405 	 */
8406 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, (struct lifconf *)mp1->b_rptr);
8407 
8408 	family = STRUCT_FGET(lifc, lifc_family);
8409 	flags = STRUCT_FGET(lifc, lifc_flags);
8410 
8411 	switch (family) {
8412 	case AF_UNSPEC:
8413 		/*
8414 		 * walk all ILL's.
8415 		 */
8416 		list = MAX_G_HEADS;
8417 		break;
8418 	case AF_INET:
8419 		/*
8420 		 * walk only IPV4 ILL's.
8421 		 */
8422 		list = IP_V4_G_HEAD;
8423 		break;
8424 	case AF_INET6:
8425 		/*
8426 		 * walk only IPV6 ILL's.
8427 		 */
8428 		list = IP_V6_G_HEAD;
8429 		break;
8430 	default:
8431 		return (EAFNOSUPPORT);
8432 	}
8433 
8434 	/*
8435 	 * Allocate a buffer to hold requested information.
8436 	 *
8437 	 * If lifc_len is larger than what is needed, we only
8438 	 * allocate what we will use.
8439 	 *
8440 	 * If lifc_len is smaller than what is needed, return
8441 	 * EINVAL.
8442 	 */
8443 	numlifs = ip_get_numlifs(family, flags, zoneid);
8444 	lifc_bufsize = numlifs * sizeof (struct lifreq);
8445 	lifclen = STRUCT_FGET(lifc, lifc_len);
8446 	if (lifc_bufsize > lifclen) {
8447 		if (iocp->ioc_cmd == O_SIOCGLIFCONF)
8448 			return (EINVAL);
8449 		else
8450 			lifc_bufsize = lifclen;
8451 	}
8452 
8453 	mp1 = mi_copyout_alloc(q, mp,
8454 	    STRUCT_FGETP(lifc, lifc_buf), lifc_bufsize, B_FALSE);
8455 	if (mp1 == NULL)
8456 		return (ENOMEM);
8457 
8458 	mp1->b_wptr = mp1->b_rptr + lifc_bufsize;
8459 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
8460 
8461 	lifr = (struct lifreq *)mp1->b_rptr;
8462 
8463 	rw_enter(&ill_g_lock, RW_READER);
8464 	ill = ill_first(list, list, &ctx);
8465 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8466 		for (ipif = ill->ill_ipif; ipif != NULL;
8467 		    ipif = ipif->ipif_next) {
8468 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
8469 			    !(flags & LIFC_NOXMIT))
8470 				continue;
8471 
8472 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
8473 			    !(flags & LIFC_TEMPORARY))
8474 				continue;
8475 
8476 			if (((ipif->ipif_flags &
8477 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
8478 			    IPIF_DEPRECATED)) ||
8479 			    (ill->ill_phyint->phyint_flags &
8480 			    PHYI_LOOPBACK) ||
8481 			    !(ipif->ipif_flags & IPIF_UP)) &&
8482 			    (flags & LIFC_EXTERNAL_SOURCE))
8483 				continue;
8484 
8485 			if (zoneid != ipif->ipif_zoneid &&
8486 			    ipif->ipif_zoneid != ALL_ZONES &&
8487 			    (zoneid != GLOBAL_ZONEID ||
8488 			    !(flags & LIFC_ALLZONES)))
8489 				continue;
8490 
8491 			if ((uchar_t *)&lifr[1] > mp1->b_wptr) {
8492 				if (iocp->ioc_cmd == O_SIOCGLIFCONF) {
8493 					rw_exit(&ill_g_lock);
8494 					return (EINVAL);
8495 				} else {
8496 					goto lif_copydone;
8497 				}
8498 			}
8499 
8500 			(void) ipif_get_name(ipif,
8501 				lifr->lifr_name,
8502 				sizeof (lifr->lifr_name));
8503 			if (ipif->ipif_isv6) {
8504 				sin6 = (sin6_t *)&lifr->lifr_addr;
8505 				*sin6 = sin6_null;
8506 				sin6->sin6_family = AF_INET6;
8507 				sin6->sin6_addr =
8508 				ipif->ipif_v6lcl_addr;
8509 				lifr->lifr_addrlen =
8510 				ip_mask_to_plen_v6(
8511 				    &ipif->ipif_v6net_mask);
8512 			} else {
8513 				sin = (sin_t *)&lifr->lifr_addr;
8514 				*sin = sin_null;
8515 				sin->sin_family = AF_INET;
8516 				sin->sin_addr.s_addr =
8517 				    ipif->ipif_lcl_addr;
8518 				lifr->lifr_addrlen =
8519 				    ip_mask_to_plen(
8520 				    ipif->ipif_net_mask);
8521 			}
8522 			lifr++;
8523 		}
8524 	}
8525 lif_copydone:
8526 	rw_exit(&ill_g_lock);
8527 
8528 	mp1->b_wptr = (uchar_t *)lifr;
8529 	if (STRUCT_BUF(lifc) != NULL) {
8530 		STRUCT_FSET(lifc, lifc_len,
8531 			(int)((uchar_t *)lifr - mp1->b_rptr));
8532 	}
8533 	return (0);
8534 }
8535 
8536 /* ARGSUSED */
8537 int
8538 ip_sioctl_set_ipmpfailback(ipif_t *dummy_ipif, sin_t *dummy_sin,
8539     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8540 {
8541 	/* Existence of b_cont->b_cont checked in ip_wput_nondata */
8542 	ipmp_enable_failback = *(int *)mp->b_cont->b_cont->b_rptr;
8543 	return (0);
8544 }
8545 
8546 static void
8547 ip_sioctl_ip6addrpolicy(queue_t *q, mblk_t *mp)
8548 {
8549 	ip6_asp_t *table;
8550 	size_t table_size;
8551 	mblk_t *data_mp;
8552 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8553 
8554 	/* These two ioctls are I_STR only */
8555 	if (iocp->ioc_count == TRANSPARENT) {
8556 		miocnak(q, mp, 0, EINVAL);
8557 		return;
8558 	}
8559 
8560 	data_mp = mp->b_cont;
8561 	if (data_mp == NULL) {
8562 		/* The user passed us a NULL argument */
8563 		table = NULL;
8564 		table_size = iocp->ioc_count;
8565 	} else {
8566 		/*
8567 		 * The user provided a table.  The stream head
8568 		 * may have copied in the user data in chunks,
8569 		 * so make sure everything is pulled up
8570 		 * properly.
8571 		 */
8572 		if (MBLKL(data_mp) < iocp->ioc_count) {
8573 			mblk_t *new_data_mp;
8574 			if ((new_data_mp = msgpullup(data_mp, -1)) ==
8575 			    NULL) {
8576 				miocnak(q, mp, 0, ENOMEM);
8577 				return;
8578 			}
8579 			freemsg(data_mp);
8580 			data_mp = new_data_mp;
8581 			mp->b_cont = data_mp;
8582 		}
8583 		table = (ip6_asp_t *)data_mp->b_rptr;
8584 		table_size = iocp->ioc_count;
8585 	}
8586 
8587 	switch (iocp->ioc_cmd) {
8588 	case SIOCGIP6ADDRPOLICY:
8589 		iocp->ioc_rval = ip6_asp_get(table, table_size);
8590 		if (iocp->ioc_rval == -1)
8591 			iocp->ioc_error = EINVAL;
8592 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
8593 		else if (table != NULL &&
8594 		    (iocp->ioc_flag & IOC_MODELS) == IOC_ILP32) {
8595 			ip6_asp_t *src = table;
8596 			ip6_asp32_t *dst = (void *)table;
8597 			int count = table_size / sizeof (ip6_asp_t);
8598 			int i;
8599 
8600 			/*
8601 			 * We need to do an in-place shrink of the array
8602 			 * to match the alignment attributes of the
8603 			 * 32-bit ABI looking at it.
8604 			 */
8605 			/* LINTED: logical expression always true: op "||" */
8606 			ASSERT(sizeof (*src) > sizeof (*dst));
8607 			for (i = 1; i < count; i++)
8608 				bcopy(src + i, dst + i, sizeof (*dst));
8609 		}
8610 #endif
8611 		break;
8612 
8613 	case SIOCSIP6ADDRPOLICY:
8614 		ASSERT(mp->b_prev == NULL);
8615 		mp->b_prev = (void *)q;
8616 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
8617 		/*
8618 		 * We pass in the datamodel here so that the ip6_asp_replace()
8619 		 * routine can handle converting from 32-bit to native formats
8620 		 * where necessary.
8621 		 *
8622 		 * A better way to handle this might be to convert the inbound
8623 		 * data structure here, and hang it off a new 'mp'; thus the
8624 		 * ip6_asp_replace() logic would always be dealing with native
8625 		 * format data structures..
8626 		 *
8627 		 * (An even simpler way to handle these ioctls is to just
8628 		 * add a 32-bit trailing 'pad' field to the ip6_asp_t structure
8629 		 * and just recompile everything that depends on it.)
8630 		 */
8631 #endif
8632 		ip6_asp_replace(mp, table, table_size, B_FALSE,
8633 		    iocp->ioc_flag & IOC_MODELS);
8634 		return;
8635 	}
8636 
8637 	DB_TYPE(mp) =  (iocp->ioc_error == 0) ? M_IOCACK : M_IOCNAK;
8638 	qreply(q, mp);
8639 }
8640 
8641 static void
8642 ip_sioctl_dstinfo(queue_t *q, mblk_t *mp)
8643 {
8644 	mblk_t 		*data_mp;
8645 	struct dstinforeq	*dir;
8646 	uint8_t		*end, *cur;
8647 	in6_addr_t	*daddr, *saddr;
8648 	ipaddr_t	v4daddr;
8649 	ire_t		*ire;
8650 	char		*slabel, *dlabel;
8651 	boolean_t	isipv4;
8652 	int		match_ire;
8653 	ill_t		*dst_ill;
8654 	ipif_t		*src_ipif, *ire_ipif;
8655 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8656 	zoneid_t	zoneid;
8657 
8658 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8659 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8660 
8661 	/*
8662 	 * This ioctl is I_STR only, and must have a
8663 	 * data mblk following the M_IOCTL mblk.
8664 	 */
8665 	data_mp = mp->b_cont;
8666 	if (iocp->ioc_count == TRANSPARENT || data_mp == NULL) {
8667 		miocnak(q, mp, 0, EINVAL);
8668 		return;
8669 	}
8670 
8671 	if (MBLKL(data_mp) < iocp->ioc_count) {
8672 		mblk_t *new_data_mp;
8673 
8674 		if ((new_data_mp = msgpullup(data_mp, -1)) == NULL) {
8675 			miocnak(q, mp, 0, ENOMEM);
8676 			return;
8677 		}
8678 		freemsg(data_mp);
8679 		data_mp = new_data_mp;
8680 		mp->b_cont = data_mp;
8681 	}
8682 	match_ire = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | MATCH_IRE_PARENT;
8683 
8684 	for (cur = data_mp->b_rptr, end = data_mp->b_wptr;
8685 	    end - cur >= sizeof (struct dstinforeq);
8686 	    cur += sizeof (struct dstinforeq)) {
8687 		dir = (struct dstinforeq *)cur;
8688 		daddr = &dir->dir_daddr;
8689 		saddr = &dir->dir_saddr;
8690 
8691 		/*
8692 		 * ip_addr_scope_v6() and ip6_asp_lookup() handle
8693 		 * v4 mapped addresses; ire_ftable_lookup[_v6]()
8694 		 * and ipif_select_source[_v6]() do not.
8695 		 */
8696 		dir->dir_dscope = ip_addr_scope_v6(daddr);
8697 		dlabel = ip6_asp_lookup(daddr, &dir->dir_precedence);
8698 
8699 		isipv4 = IN6_IS_ADDR_V4MAPPED(daddr);
8700 		if (isipv4) {
8701 			IN6_V4MAPPED_TO_IPADDR(daddr, v4daddr);
8702 			ire = ire_ftable_lookup(v4daddr, NULL, NULL,
8703 			    0, NULL, NULL, zoneid, 0, NULL, match_ire);
8704 		} else {
8705 			ire = ire_ftable_lookup_v6(daddr, NULL, NULL,
8706 			    0, NULL, NULL, zoneid, 0, NULL, match_ire);
8707 		}
8708 		if (ire == NULL) {
8709 			dir->dir_dreachable = 0;
8710 
8711 			/* move on to next dst addr */
8712 			continue;
8713 		}
8714 		dir->dir_dreachable = 1;
8715 
8716 		ire_ipif = ire->ire_ipif;
8717 		if (ire_ipif == NULL)
8718 			goto next_dst;
8719 
8720 		/*
8721 		 * We expect to get back an interface ire or a
8722 		 * gateway ire cache entry.  For both types, the
8723 		 * output interface is ire_ipif->ipif_ill.
8724 		 */
8725 		dst_ill = ire_ipif->ipif_ill;
8726 		dir->dir_dmactype = dst_ill->ill_mactype;
8727 
8728 		if (isipv4) {
8729 			src_ipif = ipif_select_source(dst_ill, v4daddr, zoneid);
8730 		} else {
8731 			src_ipif = ipif_select_source_v6(dst_ill,
8732 			    daddr, RESTRICT_TO_NONE, IPV6_PREFER_SRC_DEFAULT,
8733 			    zoneid);
8734 		}
8735 		if (src_ipif == NULL)
8736 			goto next_dst;
8737 
8738 		*saddr = src_ipif->ipif_v6lcl_addr;
8739 		dir->dir_sscope = ip_addr_scope_v6(saddr);
8740 		slabel = ip6_asp_lookup(saddr, NULL);
8741 		dir->dir_labelmatch = ip6_asp_labelcmp(dlabel, slabel);
8742 		dir->dir_sdeprecated =
8743 		    (src_ipif->ipif_flags & IPIF_DEPRECATED) ? 1 : 0;
8744 		ipif_refrele(src_ipif);
8745 next_dst:
8746 		ire_refrele(ire);
8747 	}
8748 	miocack(q, mp, iocp->ioc_count, 0);
8749 }
8750 
8751 
8752 /*
8753  * Check if this is an address assigned to this machine.
8754  * Skips interfaces that are down by using ire checks.
8755  * Translates mapped addresses to v4 addresses and then
8756  * treats them as such, returning true if the v4 address
8757  * associated with this mapped address is configured.
8758  * Note: Applications will have to be careful what they do
8759  * with the response; use of mapped addresses limits
8760  * what can be done with the socket, especially with
8761  * respect to socket options and ioctls - neither IPv4
8762  * options nor IPv6 sticky options/ancillary data options
8763  * may be used.
8764  */
8765 /* ARGSUSED */
8766 int
8767 ip_sioctl_tmyaddr(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8768     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
8769 {
8770 	struct sioc_addrreq *sia;
8771 	sin_t *sin;
8772 	ire_t *ire;
8773 	mblk_t *mp1;
8774 	zoneid_t zoneid;
8775 
8776 	ip1dbg(("ip_sioctl_tmyaddr"));
8777 
8778 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8779 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8780 
8781 	/* Existence verified in ip_wput_nondata */
8782 	mp1 = mp->b_cont->b_cont;
8783 	sia = (struct sioc_addrreq *)mp1->b_rptr;
8784 	sin = (sin_t *)&sia->sa_addr;
8785 	switch (sin->sin_family) {
8786 	case AF_INET6: {
8787 		sin6_t *sin6 = (sin6_t *)sin;
8788 
8789 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
8790 			ipaddr_t v4_addr;
8791 
8792 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
8793 			    v4_addr);
8794 			ire = ire_ctable_lookup(v4_addr, 0,
8795 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
8796 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY);
8797 		} else {
8798 			in6_addr_t v6addr;
8799 
8800 			v6addr = sin6->sin6_addr;
8801 			ire = ire_ctable_lookup_v6(&v6addr, 0,
8802 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
8803 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY);
8804 		}
8805 		break;
8806 	}
8807 	case AF_INET: {
8808 		ipaddr_t v4addr;
8809 
8810 		v4addr = sin->sin_addr.s_addr;
8811 		ire = ire_ctable_lookup(v4addr, 0,
8812 		    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
8813 		    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY);
8814 		break;
8815 	}
8816 	default:
8817 		return (EAFNOSUPPORT);
8818 	}
8819 	if (ire != NULL) {
8820 		sia->sa_res = 1;
8821 		ire_refrele(ire);
8822 	} else {
8823 		sia->sa_res = 0;
8824 	}
8825 	return (0);
8826 }
8827 
8828 /*
8829  * Check if this is an address assigned on-link i.e. neighbor,
8830  * and makes sure it's reachable from the current zone.
8831  * Returns true for my addresses as well.
8832  * Translates mapped addresses to v4 addresses and then
8833  * treats them as such, returning true if the v4 address
8834  * associated with this mapped address is configured.
8835  * Note: Applications will have to be careful what they do
8836  * with the response; use of mapped addresses limits
8837  * what can be done with the socket, especially with
8838  * respect to socket options and ioctls - neither IPv4
8839  * options nor IPv6 sticky options/ancillary data options
8840  * may be used.
8841  */
8842 /* ARGSUSED */
8843 int
8844 ip_sioctl_tonlink(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8845     ip_ioctl_cmd_t *ipip, void *duymmy_ifreq)
8846 {
8847 	struct sioc_addrreq *sia;
8848 	sin_t *sin;
8849 	mblk_t	*mp1;
8850 	ire_t *ire = NULL;
8851 	zoneid_t zoneid;
8852 
8853 	ip1dbg(("ip_sioctl_tonlink"));
8854 
8855 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8856 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8857 
8858 	/* Existence verified in ip_wput_nondata */
8859 	mp1 = mp->b_cont->b_cont;
8860 	sia = (struct sioc_addrreq *)mp1->b_rptr;
8861 	sin = (sin_t *)&sia->sa_addr;
8862 
8863 	/*
8864 	 * Match addresses with a zero gateway field to avoid
8865 	 * routes going through a router.
8866 	 * Exclude broadcast and multicast addresses.
8867 	 */
8868 	switch (sin->sin_family) {
8869 	case AF_INET6: {
8870 		sin6_t *sin6 = (sin6_t *)sin;
8871 
8872 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
8873 			ipaddr_t v4_addr;
8874 
8875 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
8876 			    v4_addr);
8877 			if (!CLASSD(v4_addr)) {
8878 				ire = ire_route_lookup(v4_addr, 0, 0, 0,
8879 				    NULL, NULL, zoneid, NULL,
8880 				    MATCH_IRE_GW);
8881 			}
8882 		} else {
8883 			in6_addr_t v6addr;
8884 			in6_addr_t v6gw;
8885 
8886 			v6addr = sin6->sin6_addr;
8887 			v6gw = ipv6_all_zeros;
8888 			if (!IN6_IS_ADDR_MULTICAST(&v6addr)) {
8889 				ire = ire_route_lookup_v6(&v6addr, 0,
8890 				    &v6gw, 0, NULL, NULL, zoneid,
8891 				    NULL, MATCH_IRE_GW);
8892 			}
8893 		}
8894 		break;
8895 	}
8896 	case AF_INET: {
8897 		ipaddr_t v4addr;
8898 
8899 		v4addr = sin->sin_addr.s_addr;
8900 		if (!CLASSD(v4addr)) {
8901 			ire = ire_route_lookup(v4addr, 0, 0, 0,
8902 			    NULL, NULL, zoneid, NULL,
8903 			    MATCH_IRE_GW);
8904 		}
8905 		break;
8906 	}
8907 	default:
8908 		return (EAFNOSUPPORT);
8909 	}
8910 	sia->sa_res = 0;
8911 	if (ire != NULL) {
8912 		if (ire->ire_type & (IRE_INTERFACE|IRE_CACHE|
8913 		    IRE_LOCAL|IRE_LOOPBACK)) {
8914 			sia->sa_res = 1;
8915 		}
8916 		ire_refrele(ire);
8917 	}
8918 	return (0);
8919 }
8920 
8921 /*
8922  * TBD: implement when kernel maintaines a list of site prefixes.
8923  */
8924 /* ARGSUSED */
8925 int
8926 ip_sioctl_tmysite(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
8927     ip_ioctl_cmd_t *ipip, void *ifreq)
8928 {
8929 	return (ENXIO);
8930 }
8931 
8932 /* ARGSUSED */
8933 int
8934 ip_sioctl_tunparam(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8935     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
8936 {
8937 	ill_t  		*ill;
8938 	mblk_t		*mp1;
8939 	conn_t		*connp;
8940 	boolean_t	success;
8941 
8942 	ip1dbg(("ip_sioctl_tunparam(%s:%u %p)\n",
8943 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
8944 	/* ioctl comes down on an conn */
8945 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
8946 	connp = Q_TO_CONN(q);
8947 
8948 	mp->b_datap->db_type = M_IOCTL;
8949 
8950 	/*
8951 	 * Send down a copy. (copymsg does not copy b_next/b_prev).
8952 	 * The original mp contains contaminated b_next values due to 'mi',
8953 	 * which is needed to do the mi_copy_done. Unfortunately if we
8954 	 * send down the original mblk itself and if we are popped due to an
8955 	 * an unplumb before the response comes back from tunnel,
8956 	 * the streamhead (which does a freemsg) will see this contaminated
8957 	 * message and the assertion in freemsg about non-null b_next/b_prev
8958 	 * will panic a DEBUG kernel.
8959 	 */
8960 	mp1 = copymsg(mp);
8961 	if (mp1 == NULL)
8962 		return (ENOMEM);
8963 
8964 	ill = ipif->ipif_ill;
8965 	mutex_enter(&connp->conn_lock);
8966 	mutex_enter(&ill->ill_lock);
8967 	if (ipip->ipi_cmd == SIOCSTUNPARAM || ipip->ipi_cmd == OSIOCSTUNPARAM) {
8968 		success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp),
8969 		    mp, 0);
8970 	} else {
8971 		success = ill_pending_mp_add(ill, connp, mp);
8972 	}
8973 	mutex_exit(&ill->ill_lock);
8974 	mutex_exit(&connp->conn_lock);
8975 
8976 	if (success) {
8977 		ip1dbg(("sending down tunparam request "));
8978 		putnext(ill->ill_wq, mp1);
8979 		return (EINPROGRESS);
8980 	} else {
8981 		/* The conn has started closing */
8982 		freemsg(mp1);
8983 		return (EINTR);
8984 	}
8985 }
8986 
8987 static int
8988 ip_sioctl_arp_common(ill_t *ill, queue_t *q, mblk_t *mp, sin_t *sin,
8989     boolean_t x_arp_ioctl, boolean_t if_arp_ioctl)
8990 {
8991 	mblk_t *mp1;
8992 	mblk_t *mp2;
8993 	mblk_t *pending_mp;
8994 	ipaddr_t ipaddr;
8995 	area_t *area;
8996 	struct iocblk *iocp;
8997 	conn_t *connp;
8998 	struct arpreq *ar;
8999 	struct xarpreq *xar;
9000 	boolean_t success;
9001 	int flags, alength;
9002 	char *lladdr;
9003 
9004 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9005 	connp = Q_TO_CONN(q);
9006 
9007 	iocp = (struct iocblk *)mp->b_rptr;
9008 	/*
9009 	 * ill has already been set depending on whether
9010 	 * bsd style or interface style ioctl.
9011 	 */
9012 	ASSERT(ill != NULL);
9013 
9014 	/*
9015 	 * Is this one of the new SIOC*XARP ioctls?
9016 	 */
9017 	if (x_arp_ioctl) {
9018 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->XARPREQ_MBLK */
9019 		xar = (struct xarpreq *)mp->b_cont->b_cont->b_rptr;
9020 		ar = NULL;
9021 
9022 		flags = xar->xarp_flags;
9023 		lladdr = LLADDR(&xar->xarp_ha);
9024 		/*
9025 		 * Validate against user's link layer address length
9026 		 * input and name and addr length limits.
9027 		 */
9028 		alength = ill->ill_phys_addr_length;
9029 		if (iocp->ioc_cmd == SIOCSXARP) {
9030 			if (alength != xar->xarp_ha.sdl_alen ||
9031 			    (alength + xar->xarp_ha.sdl_nlen >
9032 			    sizeof (xar->xarp_ha.sdl_data)))
9033 				return (EINVAL);
9034 		}
9035 	} else {
9036 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->ARPREQ_MBLK */
9037 		ar = (struct arpreq *)mp->b_cont->b_cont->b_rptr;
9038 		xar = NULL;
9039 
9040 		flags = ar->arp_flags;
9041 		lladdr = ar->arp_ha.sa_data;
9042 		/*
9043 		 * Theoretically, the sa_family could tell us what link
9044 		 * layer type this operation is trying to deal with. By
9045 		 * common usage AF_UNSPEC means ethernet. We'll assume
9046 		 * any attempt to use the SIOC?ARP ioctls is for ethernet,
9047 		 * for now. Our new SIOC*XARP ioctls can be used more
9048 		 * generally.
9049 		 *
9050 		 * If the underlying media happens to have a non 6 byte
9051 		 * address, arp module will fail set/get, but the del
9052 		 * operation will succeed.
9053 		 */
9054 		alength = 6;
9055 		if ((iocp->ioc_cmd != SIOCDARP) &&
9056 		    (alength != ill->ill_phys_addr_length)) {
9057 			return (EINVAL);
9058 		}
9059 	}
9060 
9061 	/*
9062 	 * We are going to pass up to ARP a packet chain that looks
9063 	 * like:
9064 	 *
9065 	 * M_IOCTL-->ARP_op_MBLK-->ORIG_M_IOCTL-->MI_COPY_MBLK-->[X]ARPREQ_MBLK
9066 	 *
9067 	 * Get a copy of the original IOCTL mblk to head the chain,
9068 	 * to be sent up (in mp1). Also get another copy to store
9069 	 * in the ill_pending_mp list, for matching the response
9070 	 * when it comes back from ARP.
9071 	 */
9072 	mp1 = copyb(mp);
9073 	pending_mp = copymsg(mp);
9074 	if (mp1 == NULL || pending_mp == NULL) {
9075 		if (mp1 != NULL)
9076 			freeb(mp1);
9077 		if (pending_mp != NULL)
9078 			inet_freemsg(pending_mp);
9079 		return (ENOMEM);
9080 	}
9081 
9082 	ipaddr = sin->sin_addr.s_addr;
9083 
9084 	mp2 = ill_arp_alloc(ill, (uchar_t *)&ip_area_template,
9085 	    (caddr_t)&ipaddr);
9086 	if (mp2 == NULL) {
9087 		freeb(mp1);
9088 		inet_freemsg(pending_mp);
9089 		return (ENOMEM);
9090 	}
9091 	/* Put together the chain. */
9092 	mp1->b_cont = mp2;
9093 	mp1->b_datap->db_type = M_IOCTL;
9094 	mp2->b_cont = mp;
9095 	mp2->b_datap->db_type = M_DATA;
9096 
9097 	iocp = (struct iocblk *)mp1->b_rptr;
9098 
9099 	/*
9100 	 * An M_IOCDATA's payload (struct copyresp) is mostly the same as an
9101 	 * M_IOCTL's payload (struct iocblk), but 'struct copyresp' has a
9102 	 * cp_private field (or cp_rval on 32-bit systems) in place of the
9103 	 * ioc_count field; set ioc_count to be correct.
9104 	 */
9105 	iocp->ioc_count = MBLKL(mp1->b_cont);
9106 
9107 	/*
9108 	 * Set the proper command in the ARP message.
9109 	 * Convert the SIOC{G|S|D}ARP calls into our
9110 	 * AR_ENTRY_xxx calls.
9111 	 */
9112 	area = (area_t *)mp2->b_rptr;
9113 	switch (iocp->ioc_cmd) {
9114 	case SIOCDARP:
9115 	case SIOCDXARP:
9116 		/*
9117 		 * We defer deleting the corresponding IRE until
9118 		 * we return from arp.
9119 		 */
9120 		area->area_cmd = AR_ENTRY_DELETE;
9121 		area->area_proto_mask_offset = 0;
9122 		break;
9123 	case SIOCGARP:
9124 	case SIOCGXARP:
9125 		area->area_cmd = AR_ENTRY_SQUERY;
9126 		area->area_proto_mask_offset = 0;
9127 		break;
9128 	case SIOCSARP:
9129 	case SIOCSXARP: {
9130 		/*
9131 		 * Delete the corresponding ire to make sure IP will
9132 		 * pick up any change from arp.
9133 		 */
9134 		if (!if_arp_ioctl) {
9135 			(void) ip_ire_clookup_and_delete(ipaddr, NULL);
9136 			break;
9137 		} else {
9138 			ipif_t *ipif = ipif_get_next_ipif(NULL, ill);
9139 			if (ipif != NULL) {
9140 				(void) ip_ire_clookup_and_delete(ipaddr, ipif);
9141 				ipif_refrele(ipif);
9142 			}
9143 			break;
9144 		}
9145 	}
9146 	}
9147 	iocp->ioc_cmd = area->area_cmd;
9148 
9149 	/*
9150 	 * Before sending 'mp' to ARP, we have to clear the b_next
9151 	 * and b_prev. Otherwise if STREAMS encounters such a message
9152 	 * in freemsg(), (because ARP can close any time) it can cause
9153 	 * a panic. But mi code needs the b_next and b_prev values of
9154 	 * mp->b_cont, to complete the ioctl. So we store it here
9155 	 * in pending_mp->bcont, and restore it in ip_sioctl_iocack()
9156 	 * when the response comes down from ARP.
9157 	 */
9158 	pending_mp->b_cont->b_next = mp->b_cont->b_next;
9159 	pending_mp->b_cont->b_prev = mp->b_cont->b_prev;
9160 	mp->b_cont->b_next = NULL;
9161 	mp->b_cont->b_prev = NULL;
9162 
9163 	mutex_enter(&connp->conn_lock);
9164 	mutex_enter(&ill->ill_lock);
9165 	/* conn has not yet started closing, hence this can't fail */
9166 	success = ill_pending_mp_add(ill, connp, pending_mp);
9167 	ASSERT(success);
9168 	mutex_exit(&ill->ill_lock);
9169 	mutex_exit(&connp->conn_lock);
9170 
9171 	/*
9172 	 * Fill in the rest of the ARP operation fields.
9173 	 */
9174 	area->area_hw_addr_length = alength;
9175 	bcopy(lladdr,
9176 	    (char *)area + area->area_hw_addr_offset,
9177 	    area->area_hw_addr_length);
9178 	/* Translate the flags. */
9179 	if (flags & ATF_PERM)
9180 		area->area_flags |= ACE_F_PERMANENT;
9181 	if (flags & ATF_PUBL)
9182 		area->area_flags |= ACE_F_PUBLISH;
9183 	if (flags & ATF_AUTHORITY)
9184 		area->area_flags |= ACE_F_AUTHORITY;
9185 
9186 	/*
9187 	 * Up to ARP it goes.  The response will come
9188 	 * back in ip_wput as an M_IOCACK message, and
9189 	 * will be handed to ip_sioctl_iocack for
9190 	 * completion.
9191 	 */
9192 	putnext(ill->ill_rq, mp1);
9193 	return (EINPROGRESS);
9194 }
9195 
9196 /* ARGSUSED */
9197 int
9198 ip_sioctl_xarp(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9199     ip_ioctl_cmd_t *ipip, void *ifreq)
9200 {
9201 	struct xarpreq *xar;
9202 	boolean_t isv6;
9203 	mblk_t	*mp1;
9204 	int	err;
9205 	conn_t	*connp;
9206 	int ifnamelen;
9207 	ire_t	*ire = NULL;
9208 	ill_t	*ill = NULL;
9209 	struct sockaddr_in *sin;
9210 	boolean_t if_arp_ioctl = B_FALSE;
9211 
9212 	/* ioctl comes down on an conn */
9213 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9214 	connp = Q_TO_CONN(q);
9215 	isv6 = connp->conn_af_isv6;
9216 
9217 	/* Existance verified in ip_wput_nondata */
9218 	mp1 = mp->b_cont->b_cont;
9219 
9220 	ASSERT(MBLKL(mp1) >= sizeof (*xar));
9221 	xar = (struct xarpreq *)mp1->b_rptr;
9222 	sin = (sin_t *)&xar->xarp_pa;
9223 
9224 	if (isv6 || (xar->xarp_ha.sdl_family != AF_LINK) ||
9225 	    (xar->xarp_pa.ss_family != AF_INET))
9226 		return (ENXIO);
9227 
9228 	ifnamelen = xar->xarp_ha.sdl_nlen;
9229 	if (ifnamelen != 0) {
9230 		char	*cptr, cval;
9231 
9232 		if (ifnamelen >= LIFNAMSIZ)
9233 			return (EINVAL);
9234 
9235 		/*
9236 		 * Instead of bcopying a bunch of bytes,
9237 		 * null-terminate the string in-situ.
9238 		 */
9239 		cptr = xar->xarp_ha.sdl_data + ifnamelen;
9240 		cval = *cptr;
9241 		*cptr = '\0';
9242 		ill = ill_lookup_on_name(xar->xarp_ha.sdl_data,
9243 		    B_FALSE, isv6, CONNP_TO_WQ(connp), mp, ip_process_ioctl,
9244 		    &err, NULL);
9245 		*cptr = cval;
9246 		if (ill == NULL)
9247 			return (err);
9248 		if (ill->ill_net_type != IRE_IF_RESOLVER) {
9249 			ill_refrele(ill);
9250 			return (ENXIO);
9251 		}
9252 
9253 		if_arp_ioctl = B_TRUE;
9254 	} else {
9255 		/*
9256 		 * PSARC 2003/088 states that if sdl_nlen == 0, it behaves
9257 		 * as an extended BSD ioctl. The kernel uses the IP address
9258 		 * to figure out the network interface.
9259 		 */
9260 		ire = ire_cache_lookup(sin->sin_addr.s_addr, ALL_ZONES, NULL);
9261 		if ((ire == NULL) || (ire->ire_type == IRE_LOOPBACK) ||
9262 		    ((ill = ire_to_ill(ire)) == NULL) ||
9263 		    (ill->ill_net_type != IRE_IF_RESOLVER)) {
9264 			if (ire != NULL)
9265 				ire_refrele(ire);
9266 			ire = ire_ftable_lookup(sin->sin_addr.s_addr,
9267 			    0, 0, IRE_IF_RESOLVER, NULL, NULL, ALL_ZONES, 0,
9268 			    NULL, MATCH_IRE_TYPE);
9269 			if ((ire == NULL) ||
9270 			    ((ill = ire_to_ill(ire)) == NULL)) {
9271 				if (ire != NULL)
9272 					ire_refrele(ire);
9273 				return (ENXIO);
9274 			}
9275 		}
9276 		ASSERT(ire != NULL && ill != NULL);
9277 	}
9278 
9279 	err = ip_sioctl_arp_common(ill, q, mp, sin, B_TRUE, if_arp_ioctl);
9280 	if (if_arp_ioctl)
9281 		ill_refrele(ill);
9282 	if (ire != NULL)
9283 		ire_refrele(ire);
9284 
9285 	return (err);
9286 }
9287 
9288 /*
9289  * ARP IOCTLs.
9290  * How does IP get in the business of fronting ARP configuration/queries?
9291  * Well its like this, the Berkeley ARP IOCTLs (SIOCGARP, SIOCDARP, SIOCSARP)
9292  * are by tradition passed in through a datagram socket.  That lands in IP.
9293  * As it happens, this is just as well since the interface is quite crude in
9294  * that it passes in no information about protocol or hardware types, or
9295  * interface association.  After making the protocol assumption, IP is in
9296  * the position to look up the name of the ILL, which ARP will need, and
9297  * format a request that can be handled by ARP.	 The request is passed up
9298  * stream to ARP, and the original IOCTL is completed by IP when ARP passes
9299  * back a response.  ARP supports its own set of more general IOCTLs, in
9300  * case anyone is interested.
9301  */
9302 /* ARGSUSED */
9303 int
9304 ip_sioctl_arp(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9305     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9306 {
9307 	struct arpreq *ar;
9308 	struct sockaddr_in *sin;
9309 	ire_t	*ire;
9310 	boolean_t isv6;
9311 	mblk_t	*mp1;
9312 	int	err;
9313 	conn_t	*connp;
9314 	ill_t	*ill;
9315 
9316 	/* ioctl comes down on an conn */
9317 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9318 	connp = Q_TO_CONN(q);
9319 	isv6 = connp->conn_af_isv6;
9320 	if (isv6)
9321 		return (ENXIO);
9322 
9323 	/* Existance verified in ip_wput_nondata */
9324 	mp1 = mp->b_cont->b_cont;
9325 
9326 	ar = (struct arpreq *)mp1->b_rptr;
9327 	sin = (sin_t *)&ar->arp_pa;
9328 
9329 	/*
9330 	 * We need to let ARP know on which interface the IP
9331 	 * address has an ARP mapping. In the IPMP case, a
9332 	 * simple forwarding table lookup will return the
9333 	 * IRE_IF_RESOLVER for the first interface in the group,
9334 	 * which might not be the interface on which the
9335 	 * requested IP address was resolved due to the ill
9336 	 * selection algorithm (see ip_newroute_get_dst_ill()).
9337 	 * So we do a cache table lookup first: if the IRE cache
9338 	 * entry for the IP address is still there, it will
9339 	 * contain the ill pointer for the right interface, so
9340 	 * we use that. If the cache entry has been flushed, we
9341 	 * fall back to the forwarding table lookup. This should
9342 	 * be rare enough since IRE cache entries have a longer
9343 	 * life expectancy than ARP cache entries.
9344 	 */
9345 	ire = ire_cache_lookup(sin->sin_addr.s_addr, ALL_ZONES, NULL);
9346 	if ((ire == NULL) || (ire->ire_type == IRE_LOOPBACK) ||
9347 	    ((ill = ire_to_ill(ire)) == NULL)) {
9348 		if (ire != NULL)
9349 			ire_refrele(ire);
9350 		ire = ire_ftable_lookup(sin->sin_addr.s_addr,
9351 		    0, 0, IRE_IF_RESOLVER, NULL, NULL, ALL_ZONES, 0,
9352 		    NULL, MATCH_IRE_TYPE);
9353 		if ((ire == NULL) || ((ill = ire_to_ill(ire)) == NULL)) {
9354 			if (ire != NULL)
9355 				ire_refrele(ire);
9356 			return (ENXIO);
9357 		}
9358 	}
9359 	ASSERT(ire != NULL && ill != NULL);
9360 
9361 	err = ip_sioctl_arp_common(ill, q, mp, sin, B_FALSE, B_FALSE);
9362 	ire_refrele(ire);
9363 	return (err);
9364 }
9365 
9366 /*
9367  * Do I_PLINK/I_LINK or I_PUNLINK/I_UNLINK with consistency checks and also
9368  * atomically set/clear the muxids. Also complete the ioctl by acking or
9369  * naking it.  Note that the code is structured such that the link type,
9370  * whether it's persistent or not, is treated equally.  ifconfig(1M) and
9371  * its clones use the persistent link, while pppd(1M) and perhaps many
9372  * other daemons may use non-persistent link.  When combined with some
9373  * ill_t states, linking and unlinking lower streams may be used as
9374  * indicators of dynamic re-plumbing events [see PSARC/1999/348].
9375  */
9376 /* ARGSUSED */
9377 void
9378 ip_sioctl_plink(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
9379 {
9380 	mblk_t *mp1;
9381 	mblk_t *mp2;
9382 	struct linkblk *li;
9383 	queue_t	*ipwq;
9384 	char	*name;
9385 	struct qinit *qinfo;
9386 	struct ipmx_s *ipmxp;
9387 	ill_t	*ill = NULL;
9388 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
9389 	int	err = 0;
9390 	boolean_t	entered_ipsq = B_FALSE;
9391 	boolean_t islink;
9392 	queue_t *dwq = NULL;
9393 
9394 	ASSERT(iocp->ioc_cmd == I_PLINK || iocp->ioc_cmd == I_PUNLINK ||
9395 	    iocp->ioc_cmd == I_LINK || iocp->ioc_cmd == I_UNLINK);
9396 
9397 	islink = (iocp->ioc_cmd == I_PLINK || iocp->ioc_cmd == I_LINK) ?
9398 	    B_TRUE : B_FALSE;
9399 
9400 	mp1 = mp->b_cont;	/* This is the linkblk info */
9401 	li = (struct linkblk *)mp1->b_rptr;
9402 
9403 	/*
9404 	 * ARP has added this special mblk, and the utility is asking us
9405 	 * to perform consistency checks, and also atomically set the
9406 	 * muxid. Ifconfig is an example.  It achieves this by using
9407 	 * /dev/arp as the mux to plink the arp stream, and pushes arp on
9408 	 * to /dev/udp[6] stream for use as the mux when plinking the IP
9409 	 * stream. SIOCSLIFMUXID is not required.  See ifconfig.c, arp.c
9410 	 * and other comments in this routine for more details.
9411 	 */
9412 	mp2 = mp1->b_cont;	/* This is added by ARP */
9413 
9414 	/*
9415 	 * If I_{P}LINK/I_{P}UNLINK is issued by a utility other than
9416 	 * ifconfig which didn't push ARP on top of the dummy mux, we won't
9417 	 * get the special mblk above.  For backward compatibility, we just
9418 	 * return success.  The utility will use SIOCSLIFMUXID to store
9419 	 * the muxids.  This is not atomic, and can leave the streams
9420 	 * unplumbable if the utility is interrrupted, before it does the
9421 	 * SIOCSLIFMUXID.
9422 	 */
9423 	if (mp2 == NULL) {
9424 		/*
9425 		 * At this point we don't know whether or not this is the
9426 		 * IP module stream or the ARP device stream.  We need to
9427 		 * walk the lower stream in order to find this out, since
9428 		 * the capability negotiation is done only on the IP module
9429 		 * stream.  IP module instance is identified by the module
9430 		 * name IP, non-null q_next, and it's wput not being ip_lwput.
9431 		 * STREAMS ensures that the lower stream (l_qbot) will not
9432 		 * vanish until this ioctl completes. So we can safely walk
9433 		 * the stream or refer to the q_ptr.
9434 		 */
9435 		ipwq = li->l_qbot;
9436 		while (ipwq != NULL) {
9437 			qinfo = ipwq->q_qinfo;
9438 			name = qinfo->qi_minfo->mi_idname;
9439 			if (name != NULL && name[0] != NULL &&
9440 			    (strcmp(name, ip_mod_info.mi_idname) == 0) &&
9441 			    ((void *)(qinfo->qi_putp) != (void *)ip_lwput) &&
9442 			    (ipwq->q_next != NULL)) {
9443 				break;
9444 			}
9445 			ipwq = ipwq->q_next;
9446 		}
9447 		/*
9448 		 * This looks like an IP module stream, so trigger
9449 		 * the capability reset or re-negotiation if necessary.
9450 		 */
9451 		if (ipwq != NULL) {
9452 			ill = ipwq->q_ptr;
9453 			ASSERT(ill != NULL);
9454 
9455 			if (ipsq == NULL) {
9456 				ipsq = ipsq_try_enter(NULL, ill, q, mp,
9457 				    ip_sioctl_plink, NEW_OP, B_TRUE);
9458 				if (ipsq == NULL)
9459 					return;
9460 				entered_ipsq = B_TRUE;
9461 			}
9462 			ASSERT(IAM_WRITER_ILL(ill));
9463 			/*
9464 			 * Store the upper read queue of the module
9465 			 * immediately below IP, and count the total
9466 			 * number of lower modules.  Do this only
9467 			 * for I_PLINK or I_LINK event.
9468 			 */
9469 			ill->ill_lmod_rq = NULL;
9470 			ill->ill_lmod_cnt = 0;
9471 			if (islink && (dwq = ipwq->q_next) != NULL) {
9472 				ill->ill_lmod_rq = RD(dwq);
9473 
9474 				while (dwq != NULL) {
9475 					ill->ill_lmod_cnt++;
9476 					dwq = dwq->q_next;
9477 				}
9478 			}
9479 			/*
9480 			 * There's no point in resetting or re-negotiating if
9481 			 * we are not bound to the driver, so only do this if
9482 			 * the DLPI state is idle (up); we assume such state
9483 			 * since ill_ipif_up_count gets incremented in
9484 			 * ipif_up_done(), which is after we are bound to the
9485 			 * driver.  Note that in the case of logical
9486 			 * interfaces, IP won't rebind to the driver unless
9487 			 * the ill_ipif_up_count is 0, meaning that all other
9488 			 * IP interfaces (including the main ipif) are in the
9489 			 * down state.  Because of this, we use such counter
9490 			 * as an indicator, instead of relying on the IPIF_UP
9491 			 * flag, which is per ipif instance.
9492 			 */
9493 			if (ill->ill_ipif_up_count > 0) {
9494 				if (islink)
9495 					ill_capability_probe(ill);
9496 				else
9497 					ill_capability_reset(ill);
9498 			}
9499 		}
9500 		goto done;
9501 	}
9502 
9503 	/*
9504 	 * This is an I_{P}LINK sent down by ifconfig on
9505 	 * /dev/arp. ARP has appended this last (3rd) mblk,
9506 	 * giving more info. STREAMS ensures that the lower
9507 	 * stream (l_qbot) will not vanish until this ioctl
9508 	 * completes. So we can safely walk the stream or refer
9509 	 * to the q_ptr.
9510 	 */
9511 	ipmxp = (struct ipmx_s *)mp2->b_rptr;
9512 	if (ipmxp->ipmx_arpdev_stream) {
9513 		/*
9514 		 * The operation is occuring on the arp-device
9515 		 * stream.
9516 		 */
9517 		ill = ill_lookup_on_name(ipmxp->ipmx_name, B_FALSE, B_FALSE,
9518 		    q, mp, ip_sioctl_plink, &err, NULL);
9519 		if (ill == NULL) {
9520 			if (err == EINPROGRESS) {
9521 				return;
9522 			} else {
9523 				err = EINVAL;
9524 				goto done;
9525 			}
9526 		}
9527 
9528 		if (ipsq == NULL) {
9529 			ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_sioctl_plink,
9530 			    NEW_OP, B_TRUE);
9531 			if (ipsq == NULL) {
9532 				ill_refrele(ill);
9533 				return;
9534 			}
9535 			entered_ipsq = B_TRUE;
9536 		}
9537 		ASSERT(IAM_WRITER_ILL(ill));
9538 		ill_refrele(ill);
9539 		/*
9540 		 * To ensure consistency between IP and ARP,
9541 		 * the following LIFO scheme is used in
9542 		 * plink/punlink. (IP first, ARP last).
9543 		 * This is because the muxid's are stored
9544 		 * in the IP stream on the ill.
9545 		 *
9546 		 * I_{P}LINK: ifconfig plinks the IP stream before
9547 		 * plinking the ARP stream. On an arp-dev
9548 		 * stream, IP checks that it is not yet
9549 		 * plinked, and it also checks that the
9550 		 * corresponding IP stream is already plinked.
9551 		 *
9552 		 * I_{P}UNLINK: ifconfig punlinks the ARP stream
9553 		 * before punlinking the IP stream. IP does
9554 		 * not allow punlink of the IP stream unless
9555 		 * the arp stream has been punlinked.
9556 		 *
9557 		 */
9558 		if ((islink &&
9559 		    (ill->ill_arp_muxid != 0 || ill->ill_ip_muxid == 0)) ||
9560 		    (!islink &&
9561 		    ill->ill_arp_muxid != li->l_index)) {
9562 			err = EINVAL;
9563 			goto done;
9564 		}
9565 		if (islink) {
9566 			ill->ill_arp_muxid = li->l_index;
9567 		} else {
9568 			ill->ill_arp_muxid = 0;
9569 		}
9570 	} else {
9571 		/*
9572 		 * This must be the IP module stream with or
9573 		 * without arp. Walk the stream and locate the
9574 		 * IP module. An IP module instance is
9575 		 * identified by the module name IP, non-null
9576 		 * q_next, and it's wput not being ip_lwput.
9577 		 */
9578 		ipwq = li->l_qbot;
9579 		while (ipwq != NULL) {
9580 			qinfo = ipwq->q_qinfo;
9581 			name = qinfo->qi_minfo->mi_idname;
9582 			if (name != NULL && name[0] != NULL &&
9583 			    (strcmp(name, ip_mod_info.mi_idname) == 0) &&
9584 			    ((void *)(qinfo->qi_putp) != (void *)ip_lwput) &&
9585 			    (ipwq->q_next != NULL)) {
9586 				break;
9587 			}
9588 			ipwq = ipwq->q_next;
9589 		}
9590 		if (ipwq != NULL) {
9591 			ill = ipwq->q_ptr;
9592 			ASSERT(ill != NULL);
9593 
9594 			if (ipsq == NULL) {
9595 				ipsq = ipsq_try_enter(NULL, ill, q, mp,
9596 				    ip_sioctl_plink, NEW_OP, B_TRUE);
9597 				if (ipsq == NULL)
9598 					return;
9599 				entered_ipsq = B_TRUE;
9600 			}
9601 			ASSERT(IAM_WRITER_ILL(ill));
9602 			/*
9603 			 * Return error if the ip_mux_id is
9604 			 * non-zero and command is I_{P}LINK.
9605 			 * If command is I_{P}UNLINK, return
9606 			 * error if the arp-devstr is not
9607 			 * yet punlinked.
9608 			 */
9609 			if ((islink && ill->ill_ip_muxid != 0) ||
9610 			    (!islink && ill->ill_arp_muxid != 0)) {
9611 				err = EINVAL;
9612 				goto done;
9613 			}
9614 			ill->ill_lmod_rq = NULL;
9615 			ill->ill_lmod_cnt = 0;
9616 			if (islink) {
9617 				/*
9618 				 * Store the upper read queue of the module
9619 				 * immediately below IP, and count the total
9620 				 * number of lower modules.
9621 				 */
9622 				if ((dwq = ipwq->q_next) != NULL) {
9623 					ill->ill_lmod_rq = RD(dwq);
9624 
9625 					while (dwq != NULL) {
9626 						ill->ill_lmod_cnt++;
9627 						dwq = dwq->q_next;
9628 					}
9629 				}
9630 				ill->ill_ip_muxid = li->l_index;
9631 			} else {
9632 				ill->ill_ip_muxid = 0;
9633 			}
9634 
9635 			/*
9636 			 * See comments above about resetting/re-
9637 			 * negotiating driver sub-capabilities.
9638 			 */
9639 			if (ill->ill_ipif_up_count > 0) {
9640 				if (islink)
9641 					ill_capability_probe(ill);
9642 				else
9643 					ill_capability_reset(ill);
9644 			}
9645 		}
9646 	}
9647 done:
9648 	iocp->ioc_count = 0;
9649 	iocp->ioc_error = err;
9650 	if (err == 0)
9651 		mp->b_datap->db_type = M_IOCACK;
9652 	else
9653 		mp->b_datap->db_type = M_IOCNAK;
9654 	qreply(q, mp);
9655 
9656 	/* Conn was refheld in ip_sioctl_copyin_setup */
9657 	if (CONN_Q(q))
9658 		CONN_OPER_PENDING_DONE(Q_TO_CONN(q));
9659 	if (entered_ipsq)
9660 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
9661 }
9662 
9663 /*
9664  * Search the ioctl command in the ioctl tables and return a pointer
9665  * to the ioctl command information. The ioctl command tables are
9666  * static and fully populated at compile time.
9667  */
9668 ip_ioctl_cmd_t *
9669 ip_sioctl_lookup(int ioc_cmd)
9670 {
9671 	int index;
9672 	ip_ioctl_cmd_t *ipip;
9673 	ip_ioctl_cmd_t *ipip_end;
9674 
9675 	if (ioc_cmd == IPI_DONTCARE)
9676 		return (NULL);
9677 
9678 	/*
9679 	 * Do a 2 step search. First search the indexed table
9680 	 * based on the least significant byte of the ioctl cmd.
9681 	 * If we don't find a match, then search the misc table
9682 	 * serially.
9683 	 */
9684 	index = ioc_cmd & 0xFF;
9685 	if (index < ip_ndx_ioctl_count) {
9686 		ipip = &ip_ndx_ioctl_table[index];
9687 		if (ipip->ipi_cmd == ioc_cmd) {
9688 			/* Found a match in the ndx table */
9689 			return (ipip);
9690 		}
9691 	}
9692 
9693 	/* Search the misc table */
9694 	ipip_end = &ip_misc_ioctl_table[ip_misc_ioctl_count];
9695 	for (ipip = ip_misc_ioctl_table; ipip < ipip_end; ipip++) {
9696 		if (ipip->ipi_cmd == ioc_cmd)
9697 			/* Found a match in the misc table */
9698 			return (ipip);
9699 	}
9700 
9701 	return (NULL);
9702 }
9703 
9704 /*
9705  * Wrapper function for resuming deferred ioctl processing
9706  * Used for SIOCGDSTINFO, SIOCGIP6ADDRPOLICY, SIOCGMSFILTER,
9707  * SIOCSMSFILTER, SIOCGIPMSFILTER, and SIOCSIPMSFILTER currently.
9708  */
9709 /* ARGSUSED */
9710 void
9711 ip_sioctl_copyin_resume(ipsq_t *dummy_ipsq, queue_t *q, mblk_t *mp,
9712     void *dummy_arg)
9713 {
9714 	ip_sioctl_copyin_setup(q, mp);
9715 }
9716 
9717 /*
9718  * ip_sioctl_copyin_setup is called by ip_wput with any M_IOCTL message
9719  * that arrives.  Most of the IOCTLs are "socket" IOCTLs which we handle
9720  * in either I_STR or TRANSPARENT form, using the mi_copy facility.
9721  * We establish here the size of the block to be copied in.  mi_copyin
9722  * arranges for this to happen, an processing continues in ip_wput with
9723  * an M_IOCDATA message.
9724  */
9725 void
9726 ip_sioctl_copyin_setup(queue_t *q, mblk_t *mp)
9727 {
9728 	int	copyin_size;
9729 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
9730 	ip_ioctl_cmd_t *ipip;
9731 	cred_t *cr;
9732 
9733 	ipip = ip_sioctl_lookup(iocp->ioc_cmd);
9734 	if (ipip == NULL) {
9735 		/*
9736 		 * The ioctl is not one we understand or own.
9737 		 * Pass it along to be processed down stream,
9738 		 * if this is a module instance of IP, else nak
9739 		 * the ioctl.
9740 		 */
9741 		if (q->q_next == NULL) {
9742 			goto nak;
9743 		} else {
9744 			putnext(q, mp);
9745 			return;
9746 		}
9747 	}
9748 
9749 	/*
9750 	 * If this is deferred, then we will do all the checks when we
9751 	 * come back.
9752 	 */
9753 	if ((iocp->ioc_cmd == SIOCGDSTINFO ||
9754 	    iocp->ioc_cmd == SIOCGIP6ADDRPOLICY) && !ip6_asp_can_lookup()) {
9755 		ip6_asp_pending_op(q, mp, ip_sioctl_copyin_resume);
9756 		return;
9757 	}
9758 
9759 	/*
9760 	 * Only allow a very small subset of IP ioctls on this stream if
9761 	 * IP is a module and not a driver. Allowing ioctls to be processed
9762 	 * in this case may cause assert failures or data corruption.
9763 	 * Typically G[L]IFFLAGS, SLIFNAME/IF_UNITSEL are the only few
9764 	 * ioctls allowed on an IP module stream, after which this stream
9765 	 * normally becomes a multiplexor (at which time the stream head
9766 	 * will fail all ioctls).
9767 	 */
9768 	if ((q->q_next != NULL) && !(ipip->ipi_flags & IPI_MODOK)) {
9769 		if (ipip->ipi_flags & IPI_PASS_DOWN) {
9770 			/*
9771 			 * Pass common Streams ioctls which the IP
9772 			 * module does not own or consume along to
9773 			 * be processed down stream.
9774 			 */
9775 			putnext(q, mp);
9776 			return;
9777 		} else {
9778 			goto nak;
9779 		}
9780 	}
9781 
9782 	/* Make sure we have ioctl data to process. */
9783 	if (mp->b_cont == NULL && !(ipip->ipi_flags & IPI_NULL_BCONT))
9784 		goto nak;
9785 
9786 	/*
9787 	 * Prefer dblk credential over ioctl credential; some synthesized
9788 	 * ioctls have kcred set because there's no way to crhold()
9789 	 * a credential in some contexts.  (ioc_cr is not crfree() by
9790 	 * the framework; the caller of ioctl needs to hold the reference
9791 	 * for the duration of the call).
9792 	 */
9793 	cr = DB_CREDDEF(mp, iocp->ioc_cr);
9794 
9795 	/* Make sure normal users don't send down privileged ioctls */
9796 	if ((ipip->ipi_flags & IPI_PRIV) &&
9797 	    (cr != NULL) && secpolicy_net_config(cr, B_TRUE) != 0) {
9798 		/* We checked the privilege earlier but log it here */
9799 		miocnak(q, mp, 0, secpolicy_net_config(cr, B_FALSE));
9800 		return;
9801 	}
9802 
9803 	/*
9804 	 * The ioctl command tables can only encode fixed length
9805 	 * ioctl data. If the length is variable, the table will
9806 	 * encode the length as zero. Such special cases are handled
9807 	 * below in the switch.
9808 	 */
9809 	if (ipip->ipi_copyin_size != 0) {
9810 		mi_copyin(q, mp, NULL, ipip->ipi_copyin_size);
9811 		return;
9812 	}
9813 
9814 	switch (iocp->ioc_cmd) {
9815 	case O_SIOCGIFCONF:
9816 	case SIOCGIFCONF:
9817 		/*
9818 		 * This IOCTL is hilarious.  See comments in
9819 		 * ip_sioctl_get_ifconf for the story.
9820 		 */
9821 		if (iocp->ioc_count == TRANSPARENT)
9822 			copyin_size = SIZEOF_STRUCT(ifconf,
9823 			    iocp->ioc_flag);
9824 		else
9825 			copyin_size = iocp->ioc_count;
9826 		mi_copyin(q, mp, NULL, copyin_size);
9827 		return;
9828 
9829 	case O_SIOCGLIFCONF:
9830 	case SIOCGLIFCONF:
9831 		copyin_size = SIZEOF_STRUCT(lifconf, iocp->ioc_flag);
9832 		mi_copyin(q, mp, NULL, copyin_size);
9833 		return;
9834 
9835 	case SIOCGLIFSRCOF:
9836 		copyin_size = SIZEOF_STRUCT(lifsrcof, iocp->ioc_flag);
9837 		mi_copyin(q, mp, NULL, copyin_size);
9838 		return;
9839 	case SIOCGIP6ADDRPOLICY:
9840 		ip_sioctl_ip6addrpolicy(q, mp);
9841 		ip6_asp_table_refrele();
9842 		return;
9843 
9844 	case SIOCSIP6ADDRPOLICY:
9845 		ip_sioctl_ip6addrpolicy(q, mp);
9846 		return;
9847 
9848 	case SIOCGDSTINFO:
9849 		ip_sioctl_dstinfo(q, mp);
9850 		ip6_asp_table_refrele();
9851 		return;
9852 
9853 	case I_PLINK:
9854 	case I_PUNLINK:
9855 	case I_LINK:
9856 	case I_UNLINK:
9857 		/*
9858 		 * We treat non-persistent link similarly as the persistent
9859 		 * link case, in terms of plumbing/unplumbing, as well as
9860 		 * dynamic re-plumbing events indicator.  See comments
9861 		 * in ip_sioctl_plink() for more.
9862 		 *
9863 		 * Request can be enqueued in the 'ipsq' while waiting
9864 		 * to become exclusive. So bump up the conn ref.
9865 		 */
9866 		if (CONN_Q(q))
9867 			CONN_INC_REF(Q_TO_CONN(q));
9868 		ip_sioctl_plink(NULL, q, mp, NULL);
9869 		return;
9870 
9871 	case ND_GET:
9872 	case ND_SET:
9873 		/*
9874 		 * Use of the nd table requires holding the reader lock.
9875 		 * Modifying the nd table thru nd_load/nd_unload requires
9876 		 * the writer lock.
9877 		 */
9878 		rw_enter(&ip_g_nd_lock, RW_READER);
9879 		if (nd_getset(q, ip_g_nd, mp)) {
9880 			rw_exit(&ip_g_nd_lock);
9881 
9882 			if (iocp->ioc_error)
9883 				iocp->ioc_count = 0;
9884 			mp->b_datap->db_type = M_IOCACK;
9885 			qreply(q, mp);
9886 			return;
9887 		}
9888 		rw_exit(&ip_g_nd_lock);
9889 		/*
9890 		 * We don't understand this subioctl of ND_GET / ND_SET.
9891 		 * Maybe intended for some driver / module below us
9892 		 */
9893 		if (q->q_next) {
9894 			putnext(q, mp);
9895 		} else {
9896 			iocp->ioc_error = ENOENT;
9897 			mp->b_datap->db_type = M_IOCNAK;
9898 			iocp->ioc_count = 0;
9899 			qreply(q, mp);
9900 		}
9901 		return;
9902 
9903 	case IP_IOCTL:
9904 		ip_wput_ioctl(q, mp);
9905 		return;
9906 	default:
9907 		cmn_err(CE_PANIC, "should not happen ");
9908 	}
9909 nak:
9910 	if (mp->b_cont != NULL) {
9911 		freemsg(mp->b_cont);
9912 		mp->b_cont = NULL;
9913 	}
9914 	iocp->ioc_error = EINVAL;
9915 	mp->b_datap->db_type = M_IOCNAK;
9916 	iocp->ioc_count = 0;
9917 	qreply(q, mp);
9918 }
9919 
9920 /* ip_wput hands off ARP IOCTL responses to us */
9921 void
9922 ip_sioctl_iocack(queue_t *q, mblk_t *mp)
9923 {
9924 	struct arpreq *ar;
9925 	struct xarpreq *xar;
9926 	area_t	*area;
9927 	mblk_t	*area_mp;
9928 	struct iocblk *iocp;
9929 	mblk_t	*orig_ioc_mp, *tmp;
9930 	struct iocblk	*orig_iocp;
9931 	ill_t *ill;
9932 	conn_t *connp = NULL;
9933 	uint_t ioc_id;
9934 	mblk_t *pending_mp;
9935 	int x_arp_ioctl = B_FALSE, ifx_arp_ioctl = B_FALSE;
9936 	int *flagsp;
9937 	char *storage = NULL;
9938 	sin_t *sin;
9939 	ipaddr_t addr;
9940 	int err;
9941 
9942 	ill = q->q_ptr;
9943 	ASSERT(ill != NULL);
9944 
9945 	/*
9946 	 * We should get back from ARP a packet chain that looks like:
9947 	 * M_IOCACK-->ARP_op_MBLK-->ORIG_M_IOCTL-->MI_COPY_MBLK-->[X]ARPREQ_MBLK
9948 	 */
9949 	if (!(area_mp = mp->b_cont) ||
9950 	    (area_mp->b_wptr - area_mp->b_rptr) < sizeof (ip_sock_ar_t) ||
9951 	    !(orig_ioc_mp = area_mp->b_cont) ||
9952 	    !orig_ioc_mp->b_cont || !orig_ioc_mp->b_cont->b_cont) {
9953 		freemsg(mp);
9954 		return;
9955 	}
9956 
9957 	orig_iocp = (struct iocblk *)orig_ioc_mp->b_rptr;
9958 
9959 	tmp = (orig_ioc_mp->b_cont)->b_cont;
9960 	if ((orig_iocp->ioc_cmd == SIOCGXARP) ||
9961 	    (orig_iocp->ioc_cmd == SIOCSXARP) ||
9962 	    (orig_iocp->ioc_cmd == SIOCDXARP)) {
9963 		x_arp_ioctl = B_TRUE;
9964 		xar = (struct xarpreq *)tmp->b_rptr;
9965 		sin = (sin_t *)&xar->xarp_pa;
9966 		flagsp = &xar->xarp_flags;
9967 		storage = xar->xarp_ha.sdl_data;
9968 		if (xar->xarp_ha.sdl_nlen != 0)
9969 			ifx_arp_ioctl = B_TRUE;
9970 	} else {
9971 		ar = (struct arpreq *)tmp->b_rptr;
9972 		sin = (sin_t *)&ar->arp_pa;
9973 		flagsp = &ar->arp_flags;
9974 		storage = ar->arp_ha.sa_data;
9975 	}
9976 
9977 	iocp = (struct iocblk *)mp->b_rptr;
9978 
9979 	/*
9980 	 * Pick out the originating queue based on the ioc_id.
9981 	 */
9982 	ioc_id = iocp->ioc_id;
9983 	pending_mp = ill_pending_mp_get(ill, &connp, ioc_id);
9984 	if (pending_mp == NULL) {
9985 		ASSERT(connp == NULL);
9986 		inet_freemsg(mp);
9987 		return;
9988 	}
9989 	ASSERT(connp != NULL);
9990 	q = CONNP_TO_WQ(connp);
9991 
9992 	/* Uncouple the internally generated IOCTL from the original one */
9993 	area = (area_t *)area_mp->b_rptr;
9994 	area_mp->b_cont = NULL;
9995 
9996 	/*
9997 	 * Restore the b_next and b_prev used by mi code. This is needed
9998 	 * to complete the ioctl using mi* functions. We stored them in
9999 	 * the pending mp prior to sending the request to ARP.
10000 	 */
10001 	orig_ioc_mp->b_cont->b_next = pending_mp->b_cont->b_next;
10002 	orig_ioc_mp->b_cont->b_prev = pending_mp->b_cont->b_prev;
10003 	inet_freemsg(pending_mp);
10004 
10005 	/*
10006 	 * We're done if there was an error or if this is not an SIOCG{X}ARP
10007 	 * Catch the case where there is an IRE_CACHE by no entry in the
10008 	 * arp table.
10009 	 */
10010 	addr = sin->sin_addr.s_addr;
10011 	if (iocp->ioc_error && iocp->ioc_cmd == AR_ENTRY_SQUERY) {
10012 		ire_t			*ire;
10013 		dl_unitdata_req_t	*dlup;
10014 		mblk_t			*llmp;
10015 		int			addr_len;
10016 		ill_t			*ipsqill = NULL;
10017 
10018 		if (ifx_arp_ioctl) {
10019 			/*
10020 			 * There's no need to lookup the ill, since
10021 			 * we've already done that when we started
10022 			 * processing the ioctl and sent the message
10023 			 * to ARP on that ill.  So use the ill that
10024 			 * is stored in q->q_ptr.
10025 			 */
10026 			ipsqill = ill;
10027 			ire = ire_ctable_lookup(addr, 0, IRE_CACHE,
10028 			    ipsqill->ill_ipif, ALL_ZONES,
10029 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ILL);
10030 		} else {
10031 			ire = ire_ctable_lookup(addr, 0, IRE_CACHE,
10032 			    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE);
10033 			if (ire != NULL)
10034 				ipsqill = ire_to_ill(ire);
10035 		}
10036 
10037 		if ((x_arp_ioctl) && (ipsqill != NULL))
10038 			storage += ill_xarp_info(&xar->xarp_ha, ipsqill);
10039 
10040 		if (ire != NULL) {
10041 			/*
10042 			 * Since the ire obtained from cachetable is used for
10043 			 * mac addr copying below, treat an incomplete ire as if
10044 			 * as if we never found it.
10045 			 */
10046 			if (ire->ire_nce != NULL &&
10047 			    ire->ire_nce->nce_state != ND_REACHABLE) {
10048 				ire_refrele(ire);
10049 				ire = NULL;
10050 				ipsqill = NULL;
10051 				goto errack;
10052 			}
10053 			*flagsp = ATF_INUSE;
10054 			llmp = (ire->ire_nce != NULL ?
10055 			    ire->ire_nce->nce_res_mp : NULL);
10056 			if (llmp != NULL && ipsqill != NULL) {
10057 				uchar_t *macaddr;
10058 
10059 				addr_len = ipsqill->ill_phys_addr_length;
10060 				if (x_arp_ioctl && ((addr_len +
10061 				    ipsqill->ill_name_length) >
10062 				    sizeof (xar->xarp_ha.sdl_data))) {
10063 					ire_refrele(ire);
10064 					freemsg(mp);
10065 					ip_ioctl_finish(q, orig_ioc_mp,
10066 					    EINVAL, NO_COPYOUT, NULL, NULL);
10067 					return;
10068 				}
10069 				*flagsp |= ATF_COM;
10070 				dlup = (dl_unitdata_req_t *)llmp->b_rptr;
10071 				if (ipsqill->ill_sap_length < 0)
10072 					macaddr = llmp->b_rptr +
10073 					    dlup->dl_dest_addr_offset;
10074 				else
10075 					macaddr = llmp->b_rptr +
10076 					    dlup->dl_dest_addr_offset +
10077 					    ipsqill->ill_sap_length;
10078 				/*
10079 				 * For SIOCGARP, MAC address length
10080 				 * validation has already been done
10081 				 * before the ioctl was issued to ARP to
10082 				 * allow it to progress only on 6 byte
10083 				 * addressable (ethernet like) media. Thus
10084 				 * the mac address copying can not overwrite
10085 				 * the sa_data area below.
10086 				 */
10087 				bcopy(macaddr, storage, addr_len);
10088 			}
10089 			/* Ditch the internal IOCTL. */
10090 			freemsg(mp);
10091 			ire_refrele(ire);
10092 			ip_ioctl_finish(q, orig_ioc_mp, 0, COPYOUT, NULL, NULL);
10093 			return;
10094 		}
10095 	}
10096 
10097 	/*
10098 	 * Delete the coresponding IRE_CACHE if any.
10099 	 * Reset the error if there was one (in case there was no entry
10100 	 * in arp.)
10101 	 */
10102 	if (iocp->ioc_cmd == AR_ENTRY_DELETE) {
10103 		ipif_t *ipintf = NULL;
10104 
10105 		if (ifx_arp_ioctl) {
10106 			/*
10107 			 * There's no need to lookup the ill, since
10108 			 * we've already done that when we started
10109 			 * processing the ioctl and sent the message
10110 			 * to ARP on that ill.  So use the ill that
10111 			 * is stored in q->q_ptr.
10112 			 */
10113 			ipintf = ill->ill_ipif;
10114 		}
10115 		if (ip_ire_clookup_and_delete(addr, ipintf)) {
10116 			/*
10117 			 * The address in "addr" may be an entry for a
10118 			 * router. If that's true, then any off-net
10119 			 * IRE_CACHE entries that go through the router
10120 			 * with address "addr" must be clobbered. Use
10121 			 * ire_walk to achieve this goal.
10122 			 */
10123 			if (ifx_arp_ioctl)
10124 				ire_walk_ill_v4(MATCH_IRE_ILL, 0,
10125 				    ire_delete_cache_gw, (char *)&addr, ill);
10126 			else
10127 				ire_walk_v4(ire_delete_cache_gw, (char *)&addr,
10128 				    ALL_ZONES);
10129 			iocp->ioc_error = 0;
10130 		}
10131 	}
10132 errack:
10133 	if (iocp->ioc_error || iocp->ioc_cmd != AR_ENTRY_SQUERY) {
10134 		err = iocp->ioc_error;
10135 		freemsg(mp);
10136 		ip_ioctl_finish(q, orig_ioc_mp, err, NO_COPYOUT, NULL, NULL);
10137 		return;
10138 	}
10139 
10140 	/*
10141 	 * Completion of an SIOCG{X}ARP.  Translate the information from
10142 	 * the area_t into the struct {x}arpreq.
10143 	 */
10144 	if (x_arp_ioctl) {
10145 		storage += ill_xarp_info(&xar->xarp_ha, ill);
10146 		if ((ill->ill_phys_addr_length + ill->ill_name_length) >
10147 		    sizeof (xar->xarp_ha.sdl_data)) {
10148 			freemsg(mp);
10149 			ip_ioctl_finish(q, orig_ioc_mp, EINVAL,
10150 			    NO_COPYOUT, NULL, NULL);
10151 			return;
10152 		}
10153 	}
10154 	*flagsp = ATF_INUSE;
10155 	if (area->area_flags & ACE_F_PERMANENT)
10156 		*flagsp |= ATF_PERM;
10157 	if (area->area_flags & ACE_F_PUBLISH)
10158 		*flagsp |= ATF_PUBL;
10159 	if (area->area_flags & ACE_F_AUTHORITY)
10160 		*flagsp |= ATF_AUTHORITY;
10161 	if (area->area_hw_addr_length != 0) {
10162 		*flagsp |= ATF_COM;
10163 		/*
10164 		 * For SIOCGARP, MAC address length validation has
10165 		 * already been done before the ioctl was issued to ARP
10166 		 * to allow it to progress only on 6 byte addressable
10167 		 * (ethernet like) media. Thus the mac address copying
10168 		 * can not overwrite the sa_data area below.
10169 		 */
10170 		bcopy((char *)area + area->area_hw_addr_offset,
10171 		    storage, area->area_hw_addr_length);
10172 	}
10173 
10174 	/* Ditch the internal IOCTL. */
10175 	freemsg(mp);
10176 	/* Complete the original. */
10177 	ip_ioctl_finish(q, orig_ioc_mp, 0, COPYOUT, NULL, NULL);
10178 }
10179 
10180 /*
10181  * Create a new logical interface. If ipif_id is zero (i.e. not a logical
10182  * interface) create the next available logical interface for this
10183  * physical interface.
10184  * If ipif is NULL (i.e. the lookup didn't find one) attempt to create an
10185  * ipif with the specified name.
10186  *
10187  * If the address family is not AF_UNSPEC then set the address as well.
10188  *
10189  * If ip_sioctl_addr returns EINPROGRESS then the ioctl (the copyout)
10190  * is completed when the DL_BIND_ACK arrive in ip_rput_dlpi_writer.
10191  *
10192  * Executed as a writer on the ill or ill group.
10193  * So no lock is needed to traverse the ipif chain, or examine the
10194  * phyint flags.
10195  */
10196 /* ARGSUSED */
10197 int
10198 ip_sioctl_addif(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
10199     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
10200 {
10201 	mblk_t	*mp1;
10202 	struct lifreq *lifr;
10203 	boolean_t	isv6;
10204 	boolean_t	exists;
10205 	char 	*name;
10206 	char	*endp;
10207 	char	*cp;
10208 	int	namelen;
10209 	ipif_t	*ipif;
10210 	long	id;
10211 	ipsq_t	*ipsq;
10212 	ill_t	*ill;
10213 	sin_t	*sin;
10214 	int	err = 0;
10215 	boolean_t found_sep = B_FALSE;
10216 	conn_t	*connp;
10217 	zoneid_t zoneid;
10218 	int	orig_ifindex = 0;
10219 
10220 	ip1dbg(("ip_sioctl_addif\n"));
10221 	/* Existence of mp1 has been checked in ip_wput_nondata */
10222 	mp1 = mp->b_cont->b_cont;
10223 	/*
10224 	 * Null terminate the string to protect against buffer
10225 	 * overrun. String was generated by user code and may not
10226 	 * be trusted.
10227 	 */
10228 	lifr = (struct lifreq *)mp1->b_rptr;
10229 	lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
10230 	name = lifr->lifr_name;
10231 	ASSERT(CONN_Q(q));
10232 	connp = Q_TO_CONN(q);
10233 	isv6 = connp->conn_af_isv6;
10234 	zoneid = connp->conn_zoneid;
10235 	namelen = mi_strlen(name);
10236 	if (namelen == 0)
10237 		return (EINVAL);
10238 
10239 	exists = B_FALSE;
10240 	if ((namelen + 1 == sizeof (ipif_loopback_name)) &&
10241 	    (mi_strcmp(name, ipif_loopback_name) == 0)) {
10242 		/*
10243 		 * Allow creating lo0 using SIOCLIFADDIF.
10244 		 * can't be any other writer thread. So can pass null below
10245 		 * for the last 4 args to ipif_lookup_name.
10246 		 */
10247 		ipif = ipif_lookup_on_name(lifr->lifr_name, namelen,
10248 		    B_TRUE, &exists, isv6, zoneid, NULL, NULL, NULL, NULL);
10249 		/* Prevent any further action */
10250 		if (ipif == NULL) {
10251 			return (ENOBUFS);
10252 		} else if (!exists) {
10253 			/* We created the ipif now and as writer */
10254 			ipif_refrele(ipif);
10255 			return (0);
10256 		} else {
10257 			ill = ipif->ipif_ill;
10258 			ill_refhold(ill);
10259 			ipif_refrele(ipif);
10260 		}
10261 	} else {
10262 		/* Look for a colon in the name. */
10263 		endp = &name[namelen];
10264 		for (cp = endp; --cp > name; ) {
10265 			if (*cp == IPIF_SEPARATOR_CHAR) {
10266 				found_sep = B_TRUE;
10267 				/*
10268 				 * Reject any non-decimal aliases for plumbing
10269 				 * of logical interfaces. Aliases with leading
10270 				 * zeroes are also rejected as they introduce
10271 				 * ambiguity in the naming of the interfaces.
10272 				 * Comparing with "0" takes care of all such
10273 				 * cases.
10274 				 */
10275 				if ((strncmp("0", cp+1, 1)) == 0)
10276 					return (EINVAL);
10277 
10278 				if (ddi_strtol(cp+1, &endp, 10, &id) != 0 ||
10279 				    id <= 0 || *endp != '\0') {
10280 					return (EINVAL);
10281 				}
10282 				*cp = '\0';
10283 				break;
10284 			}
10285 		}
10286 		ill = ill_lookup_on_name(name, B_FALSE, isv6,
10287 		    CONNP_TO_WQ(connp), mp, ip_process_ioctl, &err, NULL);
10288 		if (found_sep)
10289 			*cp = IPIF_SEPARATOR_CHAR;
10290 		if (ill == NULL)
10291 			return (err);
10292 	}
10293 
10294 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_process_ioctl, NEW_OP,
10295 	    B_TRUE);
10296 
10297 	/*
10298 	 * Release the refhold due to the lookup, now that we are excl
10299 	 * or we are just returning
10300 	 */
10301 	ill_refrele(ill);
10302 
10303 	if (ipsq == NULL)
10304 		return (EINPROGRESS);
10305 
10306 	/*
10307 	 * If the interface is failed, inactive or offlined, look for a working
10308 	 * interface in the ill group and create the ipif there. If we can't
10309 	 * find a good interface, create the ipif anyway so that in.mpathd can
10310 	 * move it to the first repaired interface.
10311 	 */
10312 	if ((ill->ill_phyint->phyint_flags &
10313 	    (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) &&
10314 	    ill->ill_phyint->phyint_groupname_len != 0) {
10315 		phyint_t *phyi;
10316 		char *groupname = ill->ill_phyint->phyint_groupname;
10317 
10318 		/*
10319 		 * We're looking for a working interface, but it doesn't matter
10320 		 * if it's up or down; so instead of following the group lists,
10321 		 * we look at each physical interface and compare the groupname.
10322 		 * We're only interested in interfaces with IPv4 (resp. IPv6)
10323 		 * plumbed when we're adding an IPv4 (resp. IPv6) ipif.
10324 		 * Otherwise we create the ipif on the failed interface.
10325 		 */
10326 		rw_enter(&ill_g_lock, RW_READER);
10327 		phyi = avl_first(&phyint_g_list.phyint_list_avl_by_index);
10328 		for (; phyi != NULL;
10329 		    phyi = avl_walk(&phyint_g_list.phyint_list_avl_by_index,
10330 		    phyi, AVL_AFTER)) {
10331 			if (phyi->phyint_groupname_len == 0)
10332 				continue;
10333 			ASSERT(phyi->phyint_groupname != NULL);
10334 			if (mi_strcmp(groupname, phyi->phyint_groupname) == 0 &&
10335 			    !(phyi->phyint_flags &
10336 			    (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) &&
10337 			    (ill->ill_isv6 ? (phyi->phyint_illv6 != NULL) :
10338 			    (phyi->phyint_illv4 != NULL))) {
10339 				break;
10340 			}
10341 		}
10342 		rw_exit(&ill_g_lock);
10343 
10344 		if (phyi != NULL) {
10345 			orig_ifindex = ill->ill_phyint->phyint_ifindex;
10346 			ill = (ill->ill_isv6 ? phyi->phyint_illv6 :
10347 			    phyi->phyint_illv4);
10348 		}
10349 	}
10350 
10351 	/*
10352 	 * We are now exclusive on the ipsq, so an ill move will be serialized
10353 	 * before or after us.
10354 	 */
10355 	ASSERT(IAM_WRITER_ILL(ill));
10356 	ASSERT(ill->ill_move_in_progress == B_FALSE);
10357 
10358 	if (found_sep && orig_ifindex == 0) {
10359 		/* Now see if there is an IPIF with this unit number. */
10360 		for (ipif = ill->ill_ipif; ipif; ipif = ipif->ipif_next) {
10361 			if (ipif->ipif_id == id) {
10362 				err = EEXIST;
10363 				goto done;
10364 			}
10365 		}
10366 	}
10367 
10368 	/*
10369 	 * We use IRE_LOCAL for lo0:1 etc. for "receive only" use
10370 	 * of lo0. We never come here when we plumb lo0:0. It
10371 	 * happens in ipif_lookup_on_name.
10372 	 * The specified unit number is ignored when we create the ipif on a
10373 	 * different interface. However, we save it in ipif_orig_ipifid below so
10374 	 * that the ipif fails back to the right position.
10375 	 */
10376 	if ((ipif = ipif_allocate(ill, (found_sep && orig_ifindex == 0) ?
10377 	    id : -1, IRE_LOCAL, B_TRUE)) == NULL) {
10378 		err = ENOBUFS;
10379 		goto done;
10380 	}
10381 
10382 	/* Return created name with ioctl */
10383 	(void) sprintf(lifr->lifr_name, "%s%c%d", ill->ill_name,
10384 	    IPIF_SEPARATOR_CHAR, ipif->ipif_id);
10385 	ip1dbg(("created %s\n", lifr->lifr_name));
10386 
10387 	/* Set address */
10388 	sin = (sin_t *)&lifr->lifr_addr;
10389 	if (sin->sin_family != AF_UNSPEC) {
10390 		err = ip_sioctl_addr(ipif, sin, q, mp,
10391 		    &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], lifr);
10392 	}
10393 
10394 	/* Set ifindex and unit number for failback */
10395 	if (err == 0 && orig_ifindex != 0) {
10396 		ipif->ipif_orig_ifindex = orig_ifindex;
10397 		if (found_sep) {
10398 			ipif->ipif_orig_ipifid = id;
10399 		}
10400 	}
10401 
10402 done:
10403 	ipsq_exit(ipsq, B_TRUE, B_TRUE);
10404 	return (err);
10405 }
10406 
10407 /*
10408  * Remove an existing logical interface. If ipif_id is zero (i.e. not a logical
10409  * interface) delete it based on the IP address (on this physical interface).
10410  * Otherwise delete it based on the ipif_id.
10411  * Also, special handling to allow a removeif of lo0.
10412  */
10413 /* ARGSUSED */
10414 int
10415 ip_sioctl_removeif(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10416     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
10417 {
10418 	conn_t		*connp;
10419 	ill_t		*ill = ipif->ipif_ill;
10420 	boolean_t	 success;
10421 
10422 	ip1dbg(("ip_sioctl_remove_if(%s:%u %p)\n",
10423 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10424 	ASSERT(IAM_WRITER_IPIF(ipif));
10425 
10426 	connp = Q_TO_CONN(q);
10427 	/*
10428 	 * Special case for unplumbing lo0 (the loopback physical interface).
10429 	 * If unplumbing lo0, the incoming address structure has been
10430 	 * initialized to all zeros. When unplumbing lo0, all its logical
10431 	 * interfaces must be removed too.
10432 	 *
10433 	 * Note that this interface may be called to remove a specific
10434 	 * loopback logical interface (eg, lo0:1). But in that case
10435 	 * ipif->ipif_id != 0 so that the code path for that case is the
10436 	 * same as any other interface (meaning it skips the code directly
10437 	 * below).
10438 	 */
10439 	if (ipif->ipif_id == 0 && ipif->ipif_net_type == IRE_LOOPBACK) {
10440 		if (sin->sin_family == AF_UNSPEC &&
10441 		    (IN6_IS_ADDR_UNSPECIFIED(&((sin6_t *)sin)->sin6_addr))) {
10442 			/*
10443 			 * Mark it condemned. No new ref. will be made to ill.
10444 			 */
10445 			mutex_enter(&ill->ill_lock);
10446 			ill->ill_state_flags |= ILL_CONDEMNED;
10447 			for (ipif = ill->ill_ipif; ipif != NULL;
10448 			    ipif = ipif->ipif_next) {
10449 				ipif->ipif_state_flags |= IPIF_CONDEMNED;
10450 			}
10451 			mutex_exit(&ill->ill_lock);
10452 
10453 			ipif = ill->ill_ipif;
10454 			/* unplumb the loopback interface */
10455 			ill_delete(ill);
10456 			mutex_enter(&connp->conn_lock);
10457 			mutex_enter(&ill->ill_lock);
10458 			ASSERT(ill->ill_group == NULL);
10459 
10460 			/* Are any references to this ill active */
10461 			if (ill_is_quiescent(ill)) {
10462 				mutex_exit(&ill->ill_lock);
10463 				mutex_exit(&connp->conn_lock);
10464 				ill_delete_tail(ill);
10465 				mi_free(ill);
10466 				return (0);
10467 			}
10468 			success = ipsq_pending_mp_add(connp, ipif,
10469 			    CONNP_TO_WQ(connp), mp, ILL_FREE);
10470 			mutex_exit(&connp->conn_lock);
10471 			mutex_exit(&ill->ill_lock);
10472 			if (success)
10473 				return (EINPROGRESS);
10474 			else
10475 				return (EINTR);
10476 		}
10477 	}
10478 
10479 	/*
10480 	 * We are exclusive on the ipsq, so an ill move will be serialized
10481 	 * before or after us.
10482 	 */
10483 	ASSERT(ill->ill_move_in_progress == B_FALSE);
10484 
10485 	if (ipif->ipif_id == 0) {
10486 		/* Find based on address */
10487 		if (ipif->ipif_isv6) {
10488 			sin6_t *sin6;
10489 
10490 			if (sin->sin_family != AF_INET6)
10491 				return (EAFNOSUPPORT);
10492 
10493 			sin6 = (sin6_t *)sin;
10494 			/* We are a writer, so we should be able to lookup */
10495 			ipif = ipif_lookup_addr_v6(&sin6->sin6_addr,
10496 			    ill, ALL_ZONES, NULL, NULL, NULL, NULL);
10497 			if (ipif == NULL) {
10498 				/*
10499 				 * Maybe the address in on another interface in
10500 				 * the same IPMP group? We check this below.
10501 				 */
10502 				ipif = ipif_lookup_addr_v6(&sin6->sin6_addr,
10503 				    NULL, ALL_ZONES, NULL, NULL, NULL, NULL);
10504 			}
10505 		} else {
10506 			ipaddr_t addr;
10507 
10508 			if (sin->sin_family != AF_INET)
10509 				return (EAFNOSUPPORT);
10510 
10511 			addr = sin->sin_addr.s_addr;
10512 			/* We are a writer, so we should be able to lookup */
10513 			ipif = ipif_lookup_addr(addr, ill, ALL_ZONES, NULL,
10514 			    NULL, NULL, NULL);
10515 			if (ipif == NULL) {
10516 				/*
10517 				 * Maybe the address in on another interface in
10518 				 * the same IPMP group? We check this below.
10519 				 */
10520 				ipif = ipif_lookup_addr(addr, NULL, ALL_ZONES,
10521 				    NULL, NULL, NULL, NULL);
10522 			}
10523 		}
10524 		if (ipif == NULL) {
10525 			return (EADDRNOTAVAIL);
10526 		}
10527 		/*
10528 		 * When the address to be removed is hosted on a different
10529 		 * interface, we check if the interface is in the same IPMP
10530 		 * group as the specified one; if so we proceed with the
10531 		 * removal.
10532 		 * ill->ill_group is NULL when the ill is down, so we have to
10533 		 * compare the group names instead.
10534 		 */
10535 		if (ipif->ipif_ill != ill &&
10536 		    (ipif->ipif_ill->ill_phyint->phyint_groupname_len == 0 ||
10537 		    ill->ill_phyint->phyint_groupname_len == 0 ||
10538 		    mi_strcmp(ipif->ipif_ill->ill_phyint->phyint_groupname,
10539 		    ill->ill_phyint->phyint_groupname) != 0)) {
10540 			ipif_refrele(ipif);
10541 			return (EADDRNOTAVAIL);
10542 		}
10543 
10544 		/* This is a writer */
10545 		ipif_refrele(ipif);
10546 	}
10547 
10548 	/*
10549 	 * Can not delete instance zero since it is tied to the ill.
10550 	 */
10551 	if (ipif->ipif_id == 0)
10552 		return (EBUSY);
10553 
10554 	mutex_enter(&ill->ill_lock);
10555 	ipif->ipif_state_flags |= IPIF_CONDEMNED;
10556 	mutex_exit(&ill->ill_lock);
10557 
10558 	ipif_free(ipif);
10559 
10560 	mutex_enter(&connp->conn_lock);
10561 	mutex_enter(&ill->ill_lock);
10562 
10563 	/* Are any references to this ipif active */
10564 	if (ipif->ipif_refcnt == 0 && ipif->ipif_ire_cnt == 0) {
10565 		mutex_exit(&ill->ill_lock);
10566 		mutex_exit(&connp->conn_lock);
10567 		ipif_non_duplicate(ipif);
10568 		ipif_down_tail(ipif);
10569 		ipif_free_tail(ipif);
10570 		return (0);
10571 	}
10572 	success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp), mp,
10573 	    IPIF_FREE);
10574 	mutex_exit(&ill->ill_lock);
10575 	mutex_exit(&connp->conn_lock);
10576 	if (success)
10577 		return (EINPROGRESS);
10578 	else
10579 		return (EINTR);
10580 }
10581 
10582 /*
10583  * Restart the removeif ioctl. The refcnt has gone down to 0.
10584  * The ipif is already condemned. So can't find it thru lookups.
10585  */
10586 /* ARGSUSED */
10587 int
10588 ip_sioctl_removeif_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
10589     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_if_req)
10590 {
10591 	ill_t *ill;
10592 
10593 	ip1dbg(("ip_sioctl_removeif_restart(%s:%u %p)\n",
10594 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10595 	if (ipif->ipif_id == 0 && ipif->ipif_net_type == IRE_LOOPBACK) {
10596 		ill = ipif->ipif_ill;
10597 		ASSERT(IAM_WRITER_ILL(ill));
10598 		ASSERT((ipif->ipif_state_flags & IPIF_CONDEMNED) &&
10599 		    (ill->ill_state_flags & IPIF_CONDEMNED));
10600 		ill_delete_tail(ill);
10601 		mi_free(ill);
10602 		return (0);
10603 	}
10604 
10605 	ill = ipif->ipif_ill;
10606 	ASSERT(IAM_WRITER_IPIF(ipif));
10607 	ASSERT(ipif->ipif_state_flags & IPIF_CONDEMNED);
10608 
10609 	ipif_non_duplicate(ipif);
10610 	ipif_down_tail(ipif);
10611 	ipif_free_tail(ipif);
10612 
10613 	ILL_UNMARK_CHANGING(ill);
10614 	return (0);
10615 }
10616 
10617 /*
10618  * Set the local interface address.
10619  * Allow an address of all zero when the interface is down.
10620  */
10621 /* ARGSUSED */
10622 int
10623 ip_sioctl_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10624     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
10625 {
10626 	int err = 0;
10627 	in6_addr_t v6addr;
10628 	boolean_t need_up = B_FALSE;
10629 
10630 	ip1dbg(("ip_sioctl_addr(%s:%u %p)\n",
10631 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10632 
10633 	ASSERT(IAM_WRITER_IPIF(ipif));
10634 
10635 	if (ipif->ipif_isv6) {
10636 		sin6_t *sin6;
10637 		ill_t *ill;
10638 		phyint_t *phyi;
10639 
10640 		if (sin->sin_family != AF_INET6)
10641 			return (EAFNOSUPPORT);
10642 
10643 		sin6 = (sin6_t *)sin;
10644 		v6addr = sin6->sin6_addr;
10645 		ill = ipif->ipif_ill;
10646 		phyi = ill->ill_phyint;
10647 
10648 		/*
10649 		 * Enforce that true multicast interfaces have a link-local
10650 		 * address for logical unit 0.
10651 		 */
10652 		if (ipif->ipif_id == 0 &&
10653 		    (ill->ill_flags & ILLF_MULTICAST) &&
10654 		    !(ipif->ipif_flags & (IPIF_POINTOPOINT)) &&
10655 		    !(phyi->phyint_flags & (PHYI_LOOPBACK)) &&
10656 		    !IN6_IS_ADDR_LINKLOCAL(&v6addr)) {
10657 			return (EADDRNOTAVAIL);
10658 		}
10659 
10660 		/*
10661 		 * up interfaces shouldn't have the unspecified address
10662 		 * unless they also have the IPIF_NOLOCAL flags set and
10663 		 * have a subnet assigned.
10664 		 */
10665 		if ((ipif->ipif_flags & IPIF_UP) &&
10666 		    IN6_IS_ADDR_UNSPECIFIED(&v6addr) &&
10667 		    (!(ipif->ipif_flags & IPIF_NOLOCAL) ||
10668 		    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) {
10669 			return (EADDRNOTAVAIL);
10670 		}
10671 
10672 		if (!ip_local_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
10673 			return (EADDRNOTAVAIL);
10674 	} else {
10675 		ipaddr_t addr;
10676 
10677 		if (sin->sin_family != AF_INET)
10678 			return (EAFNOSUPPORT);
10679 
10680 		addr = sin->sin_addr.s_addr;
10681 
10682 		/* Allow 0 as the local address. */
10683 		if (addr != 0 && !ip_addr_ok_v4(addr, ipif->ipif_net_mask))
10684 			return (EADDRNOTAVAIL);
10685 
10686 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10687 	}
10688 
10689 
10690 	/*
10691 	 * Even if there is no change we redo things just to rerun
10692 	 * ipif_set_default.
10693 	 */
10694 	if (ipif->ipif_flags & IPIF_UP) {
10695 		/*
10696 		 * Setting a new local address, make sure
10697 		 * we have net and subnet bcast ire's for
10698 		 * the old address if we need them.
10699 		 */
10700 		if (!ipif->ipif_isv6)
10701 			ipif_check_bcast_ires(ipif);
10702 		/*
10703 		 * If the interface is already marked up,
10704 		 * we call ipif_down which will take care
10705 		 * of ditching any IREs that have been set
10706 		 * up based on the old interface address.
10707 		 */
10708 		err = ipif_logical_down(ipif, q, mp);
10709 		if (err == EINPROGRESS)
10710 			return (err);
10711 		ipif_down_tail(ipif);
10712 		need_up = 1;
10713 	}
10714 
10715 	err = ip_sioctl_addr_tail(ipif, sin, q, mp, need_up);
10716 	return (err);
10717 }
10718 
10719 int
10720 ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10721     boolean_t need_up)
10722 {
10723 	in6_addr_t v6addr;
10724 	ipaddr_t addr;
10725 	sin6_t	*sin6;
10726 	int	err = 0;
10727 	ill_t	*ill = ipif->ipif_ill;
10728 	boolean_t need_dl_down;
10729 	boolean_t need_arp_down;
10730 
10731 	ip1dbg(("ip_sioctl_addr_tail(%s:%u %p)\n",
10732 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
10733 	ASSERT(IAM_WRITER_IPIF(ipif));
10734 
10735 	/* Must cancel any pending timer before taking the ill_lock */
10736 	if (ipif->ipif_recovery_id != 0)
10737 		(void) untimeout(ipif->ipif_recovery_id);
10738 	ipif->ipif_recovery_id = 0;
10739 
10740 	if (ipif->ipif_isv6) {
10741 		sin6 = (sin6_t *)sin;
10742 		v6addr = sin6->sin6_addr;
10743 	} else {
10744 		addr = sin->sin_addr.s_addr;
10745 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10746 	}
10747 	mutex_enter(&ill->ill_lock);
10748 	ipif->ipif_v6lcl_addr = v6addr;
10749 	if (ipif->ipif_flags & (IPIF_ANYCAST | IPIF_NOLOCAL)) {
10750 		ipif->ipif_v6src_addr = ipv6_all_zeros;
10751 	} else {
10752 		ipif->ipif_v6src_addr = v6addr;
10753 	}
10754 	ipif->ipif_addr_ready = 0;
10755 
10756 	/*
10757 	 * If the interface was previously marked as a duplicate, then since
10758 	 * we've now got a "new" address, it should no longer be considered a
10759 	 * duplicate -- even if the "new" address is the same as the old one.
10760 	 * Note that if all ipifs are down, we may have a pending ARP down
10761 	 * event to handle.  This is because we want to recover from duplicates
10762 	 * and thus delay tearing down ARP until the duplicates have been
10763 	 * removed or disabled.
10764 	 */
10765 	need_dl_down = need_arp_down = B_FALSE;
10766 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
10767 		need_arp_down = !need_up;
10768 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
10769 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
10770 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
10771 			need_dl_down = B_TRUE;
10772 		}
10773 	}
10774 
10775 	if (ipif->ipif_isv6 && IN6_IS_ADDR_6TO4(&v6addr) &&
10776 	    !ill->ill_is_6to4tun) {
10777 		queue_t *wqp = ill->ill_wq;
10778 
10779 		/*
10780 		 * The local address of this interface is a 6to4 address,
10781 		 * check if this interface is in fact a 6to4 tunnel or just
10782 		 * an interface configured with a 6to4 address.  We are only
10783 		 * interested in the former.
10784 		 */
10785 		if (wqp != NULL) {
10786 			while ((wqp->q_next != NULL) &&
10787 			    (wqp->q_next->q_qinfo != NULL) &&
10788 			    (wqp->q_next->q_qinfo->qi_minfo != NULL)) {
10789 
10790 				if (wqp->q_next->q_qinfo->qi_minfo->mi_idnum
10791 				    == TUN6TO4_MODID) {
10792 					/* set for use in IP */
10793 					ill->ill_is_6to4tun = 1;
10794 					break;
10795 				}
10796 				wqp = wqp->q_next;
10797 			}
10798 		}
10799 	}
10800 
10801 	ipif_set_default(ipif);
10802 	mutex_exit(&ill->ill_lock);
10803 
10804 	if (need_up) {
10805 		/*
10806 		 * Now bring the interface back up.  If this
10807 		 * is the only IPIF for the ILL, ipif_up
10808 		 * will have to re-bind to the device, so
10809 		 * we may get back EINPROGRESS, in which
10810 		 * case, this IOCTL will get completed in
10811 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
10812 		 */
10813 		err = ipif_up(ipif, q, mp);
10814 	} else {
10815 		/*
10816 		 * Update the IPIF list in SCTP, ipif_up_done() will do it
10817 		 * if need_up is true.
10818 		 */
10819 		sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
10820 	}
10821 
10822 	if (need_dl_down)
10823 		ill_dl_down(ill);
10824 	if (need_arp_down)
10825 		ipif_arp_down(ipif);
10826 
10827 	return (err);
10828 }
10829 
10830 
10831 /*
10832  * Restart entry point to restart the address set operation after the
10833  * refcounts have dropped to zero.
10834  */
10835 /* ARGSUSED */
10836 int
10837 ip_sioctl_addr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10838     ip_ioctl_cmd_t *ipip, void *ifreq)
10839 {
10840 	ip1dbg(("ip_sioctl_addr_restart(%s:%u %p)\n",
10841 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10842 	ASSERT(IAM_WRITER_IPIF(ipif));
10843 	ipif_down_tail(ipif);
10844 	return (ip_sioctl_addr_tail(ipif, sin, q, mp, B_TRUE));
10845 }
10846 
10847 /* ARGSUSED */
10848 int
10849 ip_sioctl_get_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10850     ip_ioctl_cmd_t *ipip, void *if_req)
10851 {
10852 	sin6_t *sin6 = (struct sockaddr_in6 *)sin;
10853 	struct lifreq *lifr = (struct lifreq *)if_req;
10854 
10855 	ip1dbg(("ip_sioctl_get_addr(%s:%u %p)\n",
10856 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10857 	/*
10858 	 * The net mask and address can't change since we have a
10859 	 * reference to the ipif. So no lock is necessary.
10860 	 */
10861 	if (ipif->ipif_isv6) {
10862 		*sin6 = sin6_null;
10863 		sin6->sin6_family = AF_INET6;
10864 		sin6->sin6_addr = ipif->ipif_v6lcl_addr;
10865 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
10866 		lifr->lifr_addrlen =
10867 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
10868 	} else {
10869 		*sin = sin_null;
10870 		sin->sin_family = AF_INET;
10871 		sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
10872 		if (ipip->ipi_cmd_type == LIF_CMD) {
10873 			lifr->lifr_addrlen =
10874 			    ip_mask_to_plen(ipif->ipif_net_mask);
10875 		}
10876 	}
10877 	return (0);
10878 }
10879 
10880 /*
10881  * Set the destination address for a pt-pt interface.
10882  */
10883 /* ARGSUSED */
10884 int
10885 ip_sioctl_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10886     ip_ioctl_cmd_t *ipip, void *if_req)
10887 {
10888 	int err = 0;
10889 	in6_addr_t v6addr;
10890 	boolean_t need_up = B_FALSE;
10891 
10892 	ip1dbg(("ip_sioctl_dstaddr(%s:%u %p)\n",
10893 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10894 	ASSERT(IAM_WRITER_IPIF(ipif));
10895 
10896 	if (ipif->ipif_isv6) {
10897 		sin6_t *sin6;
10898 
10899 		if (sin->sin_family != AF_INET6)
10900 			return (EAFNOSUPPORT);
10901 
10902 		sin6 = (sin6_t *)sin;
10903 		v6addr = sin6->sin6_addr;
10904 
10905 		if (!ip_remote_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
10906 			return (EADDRNOTAVAIL);
10907 	} else {
10908 		ipaddr_t addr;
10909 
10910 		if (sin->sin_family != AF_INET)
10911 			return (EAFNOSUPPORT);
10912 
10913 		addr = sin->sin_addr.s_addr;
10914 		if (!ip_addr_ok_v4(addr, ipif->ipif_net_mask))
10915 			return (EADDRNOTAVAIL);
10916 
10917 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10918 	}
10919 
10920 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, &v6addr))
10921 		return (0);	/* No change */
10922 
10923 	if (ipif->ipif_flags & IPIF_UP) {
10924 		/*
10925 		 * If the interface is already marked up,
10926 		 * we call ipif_down which will take care
10927 		 * of ditching any IREs that have been set
10928 		 * up based on the old pp dst address.
10929 		 */
10930 		err = ipif_logical_down(ipif, q, mp);
10931 		if (err == EINPROGRESS)
10932 			return (err);
10933 		ipif_down_tail(ipif);
10934 		need_up = B_TRUE;
10935 	}
10936 	/*
10937 	 * could return EINPROGRESS. If so ioctl will complete in
10938 	 * ip_rput_dlpi_writer
10939 	 */
10940 	err = ip_sioctl_dstaddr_tail(ipif, sin, q, mp, need_up);
10941 	return (err);
10942 }
10943 
10944 static int
10945 ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10946     boolean_t need_up)
10947 {
10948 	in6_addr_t v6addr;
10949 	ill_t	*ill = ipif->ipif_ill;
10950 	int	err = 0;
10951 	boolean_t need_dl_down;
10952 	boolean_t need_arp_down;
10953 
10954 	ip1dbg(("ip_sioctl_dstaddr_tail(%s:%u %p)\n", ill->ill_name,
10955 	    ipif->ipif_id, (void *)ipif));
10956 
10957 	/* Must cancel any pending timer before taking the ill_lock */
10958 	if (ipif->ipif_recovery_id != 0)
10959 		(void) untimeout(ipif->ipif_recovery_id);
10960 	ipif->ipif_recovery_id = 0;
10961 
10962 	if (ipif->ipif_isv6) {
10963 		sin6_t *sin6;
10964 
10965 		sin6 = (sin6_t *)sin;
10966 		v6addr = sin6->sin6_addr;
10967 	} else {
10968 		ipaddr_t addr;
10969 
10970 		addr = sin->sin_addr.s_addr;
10971 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10972 	}
10973 	mutex_enter(&ill->ill_lock);
10974 	/* Set point to point destination address. */
10975 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
10976 		/*
10977 		 * Allow this as a means of creating logical
10978 		 * pt-pt interfaces on top of e.g. an Ethernet.
10979 		 * XXX Undocumented HACK for testing.
10980 		 * pt-pt interfaces are created with NUD disabled.
10981 		 */
10982 		ipif->ipif_flags |= IPIF_POINTOPOINT;
10983 		ipif->ipif_flags &= ~IPIF_BROADCAST;
10984 		if (ipif->ipif_isv6)
10985 			ill->ill_flags |= ILLF_NONUD;
10986 	}
10987 
10988 	/*
10989 	 * If the interface was previously marked as a duplicate, then since
10990 	 * we've now got a "new" address, it should no longer be considered a
10991 	 * duplicate -- even if the "new" address is the same as the old one.
10992 	 * Note that if all ipifs are down, we may have a pending ARP down
10993 	 * event to handle.
10994 	 */
10995 	need_dl_down = need_arp_down = B_FALSE;
10996 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
10997 		need_arp_down = !need_up;
10998 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
10999 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
11000 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
11001 			need_dl_down = B_TRUE;
11002 		}
11003 	}
11004 
11005 	/* Set the new address. */
11006 	ipif->ipif_v6pp_dst_addr = v6addr;
11007 	/* Make sure subnet tracks pp_dst */
11008 	ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
11009 	mutex_exit(&ill->ill_lock);
11010 
11011 	if (need_up) {
11012 		/*
11013 		 * Now bring the interface back up.  If this
11014 		 * is the only IPIF for the ILL, ipif_up
11015 		 * will have to re-bind to the device, so
11016 		 * we may get back EINPROGRESS, in which
11017 		 * case, this IOCTL will get completed in
11018 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11019 		 */
11020 		err = ipif_up(ipif, q, mp);
11021 	}
11022 
11023 	if (need_dl_down)
11024 		ill_dl_down(ill);
11025 
11026 	if (need_arp_down)
11027 		ipif_arp_down(ipif);
11028 	return (err);
11029 }
11030 
11031 /*
11032  * Restart entry point to restart the dstaddress set operation after the
11033  * refcounts have dropped to zero.
11034  */
11035 /* ARGSUSED */
11036 int
11037 ip_sioctl_dstaddr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11038     ip_ioctl_cmd_t *ipip, void *ifreq)
11039 {
11040 	ip1dbg(("ip_sioctl_dstaddr_restart(%s:%u %p)\n",
11041 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11042 	ipif_down_tail(ipif);
11043 	return (ip_sioctl_dstaddr_tail(ipif, sin, q, mp, B_TRUE));
11044 }
11045 
11046 /* ARGSUSED */
11047 int
11048 ip_sioctl_get_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11049     ip_ioctl_cmd_t *ipip, void *if_req)
11050 {
11051 	sin6_t	*sin6 = (struct sockaddr_in6 *)sin;
11052 
11053 	ip1dbg(("ip_sioctl_get_dstaddr(%s:%u %p)\n",
11054 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11055 	/*
11056 	 * Get point to point destination address. The addresses can't
11057 	 * change since we hold a reference to the ipif.
11058 	 */
11059 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0)
11060 		return (EADDRNOTAVAIL);
11061 
11062 	if (ipif->ipif_isv6) {
11063 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11064 		*sin6 = sin6_null;
11065 		sin6->sin6_family = AF_INET6;
11066 		sin6->sin6_addr = ipif->ipif_v6pp_dst_addr;
11067 	} else {
11068 		*sin = sin_null;
11069 		sin->sin_family = AF_INET;
11070 		sin->sin_addr.s_addr = ipif->ipif_pp_dst_addr;
11071 	}
11072 	return (0);
11073 }
11074 
11075 /*
11076  * part of ipmp, make this func return the active/inactive state and
11077  * caller can set once atomically instead of multiple mutex_enter/mutex_exit
11078  */
11079 /*
11080  * This function either sets or clears the IFF_INACTIVE flag.
11081  *
11082  * As long as there are some addresses or multicast memberships on the
11083  * IPv4 or IPv6 interface of the "phyi" that does not belong in here, we
11084  * will consider it to be ACTIVE (clear IFF_INACTIVE) i.e the interface
11085  * will be used for outbound packets.
11086  *
11087  * Caller needs to verify the validity of setting IFF_INACTIVE.
11088  */
11089 static void
11090 phyint_inactive(phyint_t *phyi)
11091 {
11092 	ill_t *ill_v4;
11093 	ill_t *ill_v6;
11094 	ipif_t *ipif;
11095 	ilm_t *ilm;
11096 
11097 	ill_v4 = phyi->phyint_illv4;
11098 	ill_v6 = phyi->phyint_illv6;
11099 
11100 	/*
11101 	 * No need for a lock while traversing the list since iam
11102 	 * a writer
11103 	 */
11104 	if (ill_v4 != NULL) {
11105 		ASSERT(IAM_WRITER_ILL(ill_v4));
11106 		for (ipif = ill_v4->ill_ipif; ipif != NULL;
11107 		    ipif = ipif->ipif_next) {
11108 			if (ipif->ipif_orig_ifindex != phyi->phyint_ifindex) {
11109 				mutex_enter(&phyi->phyint_lock);
11110 				phyi->phyint_flags &= ~PHYI_INACTIVE;
11111 				mutex_exit(&phyi->phyint_lock);
11112 				return;
11113 			}
11114 		}
11115 		for (ilm = ill_v4->ill_ilm; ilm != NULL;
11116 		    ilm = ilm->ilm_next) {
11117 			if (ilm->ilm_orig_ifindex != phyi->phyint_ifindex) {
11118 				mutex_enter(&phyi->phyint_lock);
11119 				phyi->phyint_flags &= ~PHYI_INACTIVE;
11120 				mutex_exit(&phyi->phyint_lock);
11121 				return;
11122 			}
11123 		}
11124 	}
11125 	if (ill_v6 != NULL) {
11126 		ill_v6 = phyi->phyint_illv6;
11127 		for (ipif = ill_v6->ill_ipif; ipif != NULL;
11128 		    ipif = ipif->ipif_next) {
11129 			if (ipif->ipif_orig_ifindex != phyi->phyint_ifindex) {
11130 				mutex_enter(&phyi->phyint_lock);
11131 				phyi->phyint_flags &= ~PHYI_INACTIVE;
11132 				mutex_exit(&phyi->phyint_lock);
11133 				return;
11134 			}
11135 		}
11136 		for (ilm = ill_v6->ill_ilm; ilm != NULL;
11137 		    ilm = ilm->ilm_next) {
11138 			if (ilm->ilm_orig_ifindex != phyi->phyint_ifindex) {
11139 				mutex_enter(&phyi->phyint_lock);
11140 				phyi->phyint_flags &= ~PHYI_INACTIVE;
11141 				mutex_exit(&phyi->phyint_lock);
11142 				return;
11143 			}
11144 		}
11145 	}
11146 	mutex_enter(&phyi->phyint_lock);
11147 	phyi->phyint_flags |= PHYI_INACTIVE;
11148 	mutex_exit(&phyi->phyint_lock);
11149 }
11150 
11151 /*
11152  * This function is called only when the phyint flags change. Currently
11153  * called from ip_sioctl_flags. We re-do the broadcast nomination so
11154  * that we can select a good ill.
11155  */
11156 static void
11157 ip_redo_nomination(phyint_t *phyi)
11158 {
11159 	ill_t *ill_v4;
11160 
11161 	ill_v4 = phyi->phyint_illv4;
11162 
11163 	if (ill_v4 != NULL && ill_v4->ill_group != NULL) {
11164 		ASSERT(IAM_WRITER_ILL(ill_v4));
11165 		if (ill_v4->ill_group->illgrp_ill_count > 1)
11166 			ill_nominate_bcast_rcv(ill_v4->ill_group);
11167 	}
11168 }
11169 
11170 /*
11171  * Heuristic to check if ill is INACTIVE.
11172  * Checks if ill has an ipif with an usable ip address.
11173  *
11174  * Return values:
11175  *	B_TRUE	- ill is INACTIVE; has no usable ipif
11176  *	B_FALSE - ill is not INACTIVE; ill has at least one usable ipif
11177  */
11178 static boolean_t
11179 ill_is_inactive(ill_t *ill)
11180 {
11181 	ipif_t *ipif;
11182 
11183 	/* Check whether it is in an IPMP group */
11184 	if (ill->ill_phyint->phyint_groupname == NULL)
11185 		return (B_FALSE);
11186 
11187 	if (ill->ill_ipif_up_count == 0)
11188 		return (B_TRUE);
11189 
11190 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
11191 		uint64_t flags = ipif->ipif_flags;
11192 
11193 		/*
11194 		 * This ipif is usable if it is IPIF_UP and not a
11195 		 * dedicated test address.  A dedicated test address
11196 		 * is marked IPIF_NOFAILOVER *and* IPIF_DEPRECATED
11197 		 * (note in particular that V6 test addresses are
11198 		 * link-local data addresses and thus are marked
11199 		 * IPIF_NOFAILOVER but not IPIF_DEPRECATED).
11200 		 */
11201 		if ((flags & IPIF_UP) &&
11202 		    ((flags & (IPIF_DEPRECATED|IPIF_NOFAILOVER)) !=
11203 		    (IPIF_DEPRECATED|IPIF_NOFAILOVER)))
11204 			return (B_FALSE);
11205 	}
11206 	return (B_TRUE);
11207 }
11208 
11209 /*
11210  * Set interface flags.
11211  * Need to do special action for IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT,
11212  * IPIF_NOLOCAL, ILLF_NONUD, ILLF_NOARP, IPIF_PRIVATE, IPIF_ANYCAST,
11213  * IPIF_PREFERRED, PHYI_STANDBY, PHYI_FAILED and PHYI_OFFLINE.
11214  *
11215  * NOTE : We really don't enforce that ipif_id zero should be used
11216  *	  for setting any flags other than IFF_LOGINT_FLAGS. This
11217  *	  is because applications generally does SICGLIFFLAGS and
11218  *	  ORs in the new flags (that affects the logical) and does a
11219  *	  SIOCSLIFFLAGS. Thus, "flags" below could contain bits other
11220  *	  than IFF_LOGINT_FLAGS. One could check whether "turn_on" - the
11221  *	  flags that will be turned on is correct with respect to
11222  *	  ipif_id 0. For backward compatibility reasons, it is not done.
11223  */
11224 /* ARGSUSED */
11225 int
11226 ip_sioctl_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11227     ip_ioctl_cmd_t *ipip, void *if_req)
11228 {
11229 	uint64_t turn_on;
11230 	uint64_t turn_off;
11231 	int	err;
11232 	boolean_t need_up = B_FALSE;
11233 	phyint_t *phyi;
11234 	ill_t *ill;
11235 	uint64_t intf_flags;
11236 	boolean_t phyint_flags_modified = B_FALSE;
11237 	uint64_t flags;
11238 	struct ifreq *ifr;
11239 	struct lifreq *lifr;
11240 	boolean_t set_linklocal = B_FALSE;
11241 	boolean_t zero_source = B_FALSE;
11242 
11243 	ip1dbg(("ip_sioctl_flags(%s:%u %p)\n",
11244 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11245 
11246 	ASSERT(IAM_WRITER_IPIF(ipif));
11247 
11248 	ill = ipif->ipif_ill;
11249 	phyi = ill->ill_phyint;
11250 
11251 	if (ipip->ipi_cmd_type == IF_CMD) {
11252 		ifr = (struct ifreq *)if_req;
11253 		flags =  (uint64_t)(ifr->ifr_flags & 0x0000ffff);
11254 	} else {
11255 		lifr = (struct lifreq *)if_req;
11256 		flags = lifr->lifr_flags;
11257 	}
11258 
11259 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
11260 
11261 	/*
11262 	 * Has the flags been set correctly till now ?
11263 	 */
11264 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
11265 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
11266 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
11267 	/*
11268 	 * Compare the new flags to the old, and partition
11269 	 * into those coming on and those going off.
11270 	 * For the 16 bit command keep the bits above bit 16 unchanged.
11271 	 */
11272 	if (ipip->ipi_cmd == SIOCSIFFLAGS)
11273 		flags |= intf_flags & ~0xFFFF;
11274 
11275 	/*
11276 	 * First check which bits will change and then which will
11277 	 * go on and off
11278 	 */
11279 	turn_on = (flags ^ intf_flags) & ~IFF_CANTCHANGE;
11280 	if (!turn_on)
11281 		return (0);	/* No change */
11282 
11283 	turn_off = intf_flags & turn_on;
11284 	turn_on ^= turn_off;
11285 	err = 0;
11286 
11287 	/*
11288 	 * Don't allow any bits belonging to the logical interface
11289 	 * to be set or cleared on the replacement ipif that was
11290 	 * created temporarily during a MOVE.
11291 	 */
11292 	if (ipif->ipif_replace_zero &&
11293 	    ((turn_on|turn_off) & IFF_LOGINT_FLAGS) != 0) {
11294 		return (EINVAL);
11295 	}
11296 
11297 	/*
11298 	 * Only allow the IFF_XRESOLV and IFF_TEMPORARY flags to be set on
11299 	 * IPv6 interfaces.
11300 	 */
11301 	if ((turn_on & (IFF_XRESOLV|IFF_TEMPORARY)) && !(ipif->ipif_isv6))
11302 		return (EINVAL);
11303 
11304 	/*
11305 	 * Don't allow the IFF_ROUTER flag to be turned on on loopback
11306 	 * interfaces.  It makes no sense in that context.
11307 	 */
11308 	if ((turn_on & IFF_ROUTER) && (phyi->phyint_flags & PHYI_LOOPBACK))
11309 		return (EINVAL);
11310 
11311 	if (flags & (IFF_NOLOCAL|IFF_ANYCAST))
11312 		zero_source = B_TRUE;
11313 
11314 	/*
11315 	 * For IPv6 ipif_id 0, don't allow the interface to be up without
11316 	 * a link local address if IFF_NOLOCAL or IFF_ANYCAST are not set.
11317 	 * If the link local address isn't set, and can be set, it will get
11318 	 * set later on in this function.
11319 	 */
11320 	if (ipif->ipif_id == 0 && ipif->ipif_isv6 &&
11321 	    (flags & IFF_UP) && !zero_source &&
11322 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
11323 		if (ipif_cant_setlinklocal(ipif))
11324 			return (EINVAL);
11325 		set_linklocal = B_TRUE;
11326 	}
11327 
11328 	/*
11329 	 * ILL cannot be part of a usesrc group and and IPMP group at the
11330 	 * same time. No need to grab ill_g_usesrc_lock here, see
11331 	 * synchronization notes in ip.c
11332 	 */
11333 	if (turn_on & PHYI_STANDBY &&
11334 	    ipif->ipif_ill->ill_usesrc_grp_next != NULL) {
11335 		return (EINVAL);
11336 	}
11337 
11338 	/*
11339 	 * If we modify physical interface flags, we'll potentially need to
11340 	 * send up two routing socket messages for the changes (one for the
11341 	 * IPv4 ill, and another for the IPv6 ill).  Note that here.
11342 	 */
11343 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
11344 		phyint_flags_modified = B_TRUE;
11345 
11346 	/*
11347 	 * If we are setting or clearing FAILED or STANDBY or OFFLINE,
11348 	 * we need to flush the IRE_CACHES belonging to this ill.
11349 	 * We handle this case here without doing the DOWN/UP dance
11350 	 * like it is done for other flags. If some other flags are
11351 	 * being turned on/off with FAILED/STANDBY/OFFLINE, the code
11352 	 * below will handle it by bringing it down and then
11353 	 * bringing it UP.
11354 	 */
11355 	if ((turn_on|turn_off) & (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE)) {
11356 		ill_t *ill_v4, *ill_v6;
11357 
11358 		ill_v4 = phyi->phyint_illv4;
11359 		ill_v6 = phyi->phyint_illv6;
11360 
11361 		/*
11362 		 * First set the INACTIVE flag if needed. Then delete the ires.
11363 		 * ire_add will atomically prevent creating new IRE_CACHEs
11364 		 * unless hidden flag is set.
11365 		 * PHYI_FAILED and PHYI_INACTIVE are exclusive
11366 		 */
11367 		if ((turn_on & PHYI_FAILED) &&
11368 		    ((intf_flags & PHYI_STANDBY) || !ipmp_enable_failback)) {
11369 			/* Reset PHYI_INACTIVE when PHYI_FAILED is being set */
11370 			phyi->phyint_flags &= ~PHYI_INACTIVE;
11371 		}
11372 		if ((turn_off & PHYI_FAILED) &&
11373 		    ((intf_flags & PHYI_STANDBY) ||
11374 		    (!ipmp_enable_failback && ill_is_inactive(ill)))) {
11375 			phyint_inactive(phyi);
11376 		}
11377 
11378 		if (turn_on & PHYI_STANDBY) {
11379 			/*
11380 			 * We implicitly set INACTIVE only when STANDBY is set.
11381 			 * INACTIVE is also set on non-STANDBY phyint when user
11382 			 * disables FAILBACK using configuration file.
11383 			 * Do not allow STANDBY to be set on such INACTIVE
11384 			 * phyint
11385 			 */
11386 			if (phyi->phyint_flags & PHYI_INACTIVE)
11387 				return (EINVAL);
11388 			if (!(phyi->phyint_flags & PHYI_FAILED))
11389 				phyint_inactive(phyi);
11390 		}
11391 		if (turn_off & PHYI_STANDBY) {
11392 			if (ipmp_enable_failback) {
11393 				/*
11394 				 * Reset PHYI_INACTIVE.
11395 				 */
11396 				phyi->phyint_flags &= ~PHYI_INACTIVE;
11397 			} else if (ill_is_inactive(ill) &&
11398 			    !(phyi->phyint_flags & PHYI_FAILED)) {
11399 				/*
11400 				 * Need to set INACTIVE, when user sets
11401 				 * STANDBY on a non-STANDBY phyint and
11402 				 * later resets STANDBY
11403 				 */
11404 				phyint_inactive(phyi);
11405 			}
11406 		}
11407 		/*
11408 		 * We should always send up a message so that the
11409 		 * daemons come to know of it. Note that the zeroth
11410 		 * interface can be down and the check below for IPIF_UP
11411 		 * will not make sense as we are actually setting
11412 		 * a phyint flag here. We assume that the ipif used
11413 		 * is always the zeroth ipif. (ip_rts_ifmsg does not
11414 		 * send up any message for non-zero ipifs).
11415 		 */
11416 		phyint_flags_modified = B_TRUE;
11417 
11418 		if (ill_v4 != NULL) {
11419 			ire_walk_ill_v4(MATCH_IRE_ILL | MATCH_IRE_TYPE,
11420 			    IRE_CACHE, ill_stq_cache_delete,
11421 			    (char *)ill_v4, ill_v4);
11422 			illgrp_reset_schednext(ill_v4);
11423 		}
11424 		if (ill_v6 != NULL) {
11425 			ire_walk_ill_v6(MATCH_IRE_ILL | MATCH_IRE_TYPE,
11426 			    IRE_CACHE, ill_stq_cache_delete,
11427 			    (char *)ill_v6, ill_v6);
11428 			illgrp_reset_schednext(ill_v6);
11429 		}
11430 	}
11431 
11432 	/*
11433 	 * If ILLF_ROUTER changes, we need to change the ip forwarding
11434 	 * status of the interface and, if the interface is part of an IPMP
11435 	 * group, all other interfaces that are part of the same IPMP
11436 	 * group.
11437 	 */
11438 	if ((turn_on | turn_off) & ILLF_ROUTER) {
11439 		(void) ill_forward_set(q, mp, ((turn_on & ILLF_ROUTER) != 0),
11440 		    (caddr_t)ill);
11441 	}
11442 
11443 	/*
11444 	 * If the interface is not UP and we are not going to
11445 	 * bring it UP, record the flags and return. When the
11446 	 * interface comes UP later, the right actions will be
11447 	 * taken.
11448 	 */
11449 	if (!(ipif->ipif_flags & IPIF_UP) &&
11450 	    !(turn_on & IPIF_UP)) {
11451 		/* Record new flags in their respective places. */
11452 		mutex_enter(&ill->ill_lock);
11453 		mutex_enter(&ill->ill_phyint->phyint_lock);
11454 		ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
11455 		ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
11456 		ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
11457 		ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
11458 		phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
11459 		phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
11460 		mutex_exit(&ill->ill_lock);
11461 		mutex_exit(&ill->ill_phyint->phyint_lock);
11462 
11463 		/*
11464 		 * We do the broadcast and nomination here rather
11465 		 * than waiting for a FAILOVER/FAILBACK to happen. In
11466 		 * the case of FAILBACK from INACTIVE standby to the
11467 		 * interface that has been repaired, PHYI_FAILED has not
11468 		 * been cleared yet. If there are only two interfaces in
11469 		 * that group, all we have is a FAILED and INACTIVE
11470 		 * interface. If we do the nomination soon after a failback,
11471 		 * the broadcast nomination code would select the
11472 		 * INACTIVE interface for receiving broadcasts as FAILED is
11473 		 * not yet cleared. As we don't want STANDBY/INACTIVE to
11474 		 * receive broadcast packets, we need to redo nomination
11475 		 * when the FAILED is cleared here. Thus, in general we
11476 		 * always do the nomination here for FAILED, STANDBY
11477 		 * and OFFLINE.
11478 		 */
11479 		if (((turn_on | turn_off) &
11480 		    (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE))) {
11481 			ip_redo_nomination(phyi);
11482 		}
11483 		if (phyint_flags_modified) {
11484 			if (phyi->phyint_illv4 != NULL) {
11485 				ip_rts_ifmsg(phyi->phyint_illv4->
11486 				    ill_ipif);
11487 			}
11488 			if (phyi->phyint_illv6 != NULL) {
11489 				ip_rts_ifmsg(phyi->phyint_illv6->
11490 				    ill_ipif);
11491 			}
11492 		}
11493 		return (0);
11494 	} else if (set_linklocal || zero_source) {
11495 		mutex_enter(&ill->ill_lock);
11496 		if (set_linklocal)
11497 			ipif->ipif_state_flags |= IPIF_SET_LINKLOCAL;
11498 		if (zero_source)
11499 			ipif->ipif_state_flags |= IPIF_ZERO_SOURCE;
11500 		mutex_exit(&ill->ill_lock);
11501 	}
11502 
11503 	/*
11504 	 * Disallow IPv6 interfaces coming up that have the unspecified address,
11505 	 * or point-to-point interfaces with an unspecified destination. We do
11506 	 * allow the address to be unspecified for IPIF_NOLOCAL interfaces that
11507 	 * have a subnet assigned, which is how in.ndpd currently manages its
11508 	 * onlink prefix list when no addresses are configured with those
11509 	 * prefixes.
11510 	 */
11511 	if (ipif->ipif_isv6 &&
11512 	    ((IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
11513 	    (!(ipif->ipif_flags & IPIF_NOLOCAL) && !(turn_on & IPIF_NOLOCAL) ||
11514 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) ||
11515 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
11516 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)))) {
11517 		return (EINVAL);
11518 	}
11519 
11520 	/*
11521 	 * Prevent IPv4 point-to-point interfaces with a 0.0.0.0 destination
11522 	 * from being brought up.
11523 	 */
11524 	if (!ipif->ipif_isv6 &&
11525 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
11526 	    ipif->ipif_pp_dst_addr == INADDR_ANY)) {
11527 		return (EINVAL);
11528 	}
11529 
11530 	/*
11531 	 * The only flag changes that we currently take specific action on
11532 	 * is IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT, IPIF_NOLOCAL,
11533 	 * ILLF_NOARP, ILLF_NONUD, IPIF_PRIVATE, IPIF_ANYCAST, and
11534 	 * IPIF_PREFERRED.  This is done by bring the ipif down, changing
11535 	 * the flags and bringing it back up again.
11536 	 */
11537 	if ((turn_on|turn_off) &
11538 	    (IPIF_UP|IPIF_DEPRECATED|IPIF_NOXMIT|IPIF_NOLOCAL|ILLF_NOARP|
11539 	    ILLF_NONUD|IPIF_PRIVATE|IPIF_ANYCAST|IPIF_PREFERRED)) {
11540 		/*
11541 		 * Taking this ipif down, make sure we have
11542 		 * valid net and subnet bcast ire's for other
11543 		 * logical interfaces, if we need them.
11544 		 */
11545 		if (!ipif->ipif_isv6)
11546 			ipif_check_bcast_ires(ipif);
11547 
11548 		if (((ipif->ipif_flags | turn_on) & IPIF_UP) &&
11549 		    !(turn_off & IPIF_UP)) {
11550 			need_up = B_TRUE;
11551 			if (ipif->ipif_flags & IPIF_UP)
11552 				ill->ill_logical_down = 1;
11553 			turn_on &= ~IPIF_UP;
11554 		}
11555 		err = ipif_down(ipif, q, mp);
11556 		ip1dbg(("ipif_down returns %d err ", err));
11557 		if (err == EINPROGRESS)
11558 			return (err);
11559 		ipif_down_tail(ipif);
11560 	}
11561 	return (ip_sioctl_flags_tail(ipif, flags, q, mp, need_up));
11562 }
11563 
11564 static int
11565 ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q, mblk_t *mp,
11566     boolean_t need_up)
11567 {
11568 	ill_t	*ill;
11569 	phyint_t *phyi;
11570 	uint64_t turn_on;
11571 	uint64_t turn_off;
11572 	uint64_t intf_flags;
11573 	boolean_t phyint_flags_modified = B_FALSE;
11574 	int	err = 0;
11575 	boolean_t set_linklocal = B_FALSE;
11576 	boolean_t zero_source = B_FALSE;
11577 
11578 	ip1dbg(("ip_sioctl_flags_tail(%s:%u)\n",
11579 		ipif->ipif_ill->ill_name, ipif->ipif_id));
11580 
11581 	ASSERT(IAM_WRITER_IPIF(ipif));
11582 
11583 	ill = ipif->ipif_ill;
11584 	phyi = ill->ill_phyint;
11585 
11586 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
11587 	turn_on = (flags ^ intf_flags) & ~(IFF_CANTCHANGE | IFF_UP);
11588 
11589 	turn_off = intf_flags & turn_on;
11590 	turn_on ^= turn_off;
11591 
11592 	if ((turn_on|turn_off) & (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE))
11593 		phyint_flags_modified = B_TRUE;
11594 
11595 	/*
11596 	 * Now we change the flags. Track current value of
11597 	 * other flags in their respective places.
11598 	 */
11599 	mutex_enter(&ill->ill_lock);
11600 	mutex_enter(&phyi->phyint_lock);
11601 	ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
11602 	ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
11603 	ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
11604 	ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
11605 	phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
11606 	phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
11607 	if (ipif->ipif_state_flags & IPIF_SET_LINKLOCAL) {
11608 		set_linklocal = B_TRUE;
11609 		ipif->ipif_state_flags &= ~IPIF_SET_LINKLOCAL;
11610 	}
11611 	if (ipif->ipif_state_flags & IPIF_ZERO_SOURCE) {
11612 		zero_source = B_TRUE;
11613 		ipif->ipif_state_flags &= ~IPIF_ZERO_SOURCE;
11614 	}
11615 	mutex_exit(&ill->ill_lock);
11616 	mutex_exit(&phyi->phyint_lock);
11617 
11618 	if (((turn_on | turn_off) & (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE)))
11619 		ip_redo_nomination(phyi);
11620 
11621 	if (set_linklocal)
11622 		(void) ipif_setlinklocal(ipif);
11623 
11624 	if (zero_source)
11625 		ipif->ipif_v6src_addr = ipv6_all_zeros;
11626 	else
11627 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
11628 
11629 	if (need_up) {
11630 		/*
11631 		 * XXX ipif_up really does not know whether a phyint flags
11632 		 * was modified or not. So, it sends up information on
11633 		 * only one routing sockets message. As we don't bring up
11634 		 * the interface and also set STANDBY/FAILED simultaneously
11635 		 * it should be okay.
11636 		 */
11637 		err = ipif_up(ipif, q, mp);
11638 	} else {
11639 		/*
11640 		 * Make sure routing socket sees all changes to the flags.
11641 		 * ipif_up_done* handles this when we use ipif_up.
11642 		 */
11643 		if (phyint_flags_modified) {
11644 			if (phyi->phyint_illv4 != NULL) {
11645 				ip_rts_ifmsg(phyi->phyint_illv4->
11646 				    ill_ipif);
11647 			}
11648 			if (phyi->phyint_illv6 != NULL) {
11649 				ip_rts_ifmsg(phyi->phyint_illv6->
11650 				    ill_ipif);
11651 			}
11652 		} else {
11653 			ip_rts_ifmsg(ipif);
11654 		}
11655 	}
11656 	return (err);
11657 }
11658 
11659 /*
11660  * Restart entry point to restart the flags restart operation after the
11661  * refcounts have dropped to zero.
11662  */
11663 /* ARGSUSED */
11664 int
11665 ip_sioctl_flags_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11666     ip_ioctl_cmd_t *ipip, void *if_req)
11667 {
11668 	int	err;
11669 	struct ifreq *ifr = (struct ifreq *)if_req;
11670 	struct lifreq *lifr = (struct lifreq *)if_req;
11671 
11672 	ip1dbg(("ip_sioctl_flags_restart(%s:%u %p)\n",
11673 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11674 
11675 	ipif_down_tail(ipif);
11676 	if (ipip->ipi_cmd_type == IF_CMD) {
11677 		/*
11678 		 * Since ip_sioctl_flags expects an int and ifr_flags
11679 		 * is a short we need to cast ifr_flags into an int
11680 		 * to avoid having sign extension cause bits to get
11681 		 * set that should not be.
11682 		 */
11683 		err = ip_sioctl_flags_tail(ipif,
11684 		    (uint64_t)(ifr->ifr_flags & 0x0000ffff),
11685 		    q, mp, B_TRUE);
11686 	} else {
11687 		err = ip_sioctl_flags_tail(ipif, lifr->lifr_flags,
11688 		    q, mp, B_TRUE);
11689 	}
11690 	return (err);
11691 }
11692 
11693 /* ARGSUSED */
11694 int
11695 ip_sioctl_get_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11696     ip_ioctl_cmd_t *ipip, void *if_req)
11697 {
11698 	/*
11699 	 * Has the flags been set correctly till now ?
11700 	 */
11701 	ill_t *ill = ipif->ipif_ill;
11702 	phyint_t *phyi = ill->ill_phyint;
11703 
11704 	ip1dbg(("ip_sioctl_get_flags(%s:%u %p)\n",
11705 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11706 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
11707 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
11708 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
11709 
11710 	/*
11711 	 * Need a lock since some flags can be set even when there are
11712 	 * references to the ipif.
11713 	 */
11714 	mutex_enter(&ill->ill_lock);
11715 	if (ipip->ipi_cmd_type == IF_CMD) {
11716 		struct ifreq *ifr = (struct ifreq *)if_req;
11717 
11718 		/* Get interface flags (low 16 only). */
11719 		ifr->ifr_flags = ((ipif->ipif_flags |
11720 		    ill->ill_flags | phyi->phyint_flags) & 0xffff);
11721 	} else {
11722 		struct lifreq *lifr = (struct lifreq *)if_req;
11723 
11724 		/* Get interface flags. */
11725 		lifr->lifr_flags = ipif->ipif_flags |
11726 		    ill->ill_flags | phyi->phyint_flags;
11727 	}
11728 	mutex_exit(&ill->ill_lock);
11729 	return (0);
11730 }
11731 
11732 /* ARGSUSED */
11733 int
11734 ip_sioctl_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11735     ip_ioctl_cmd_t *ipip, void *if_req)
11736 {
11737 	int mtu;
11738 	int ip_min_mtu;
11739 	struct ifreq	*ifr;
11740 	struct lifreq *lifr;
11741 	ire_t	*ire;
11742 
11743 	ip1dbg(("ip_sioctl_mtu(%s:%u %p)\n", ipif->ipif_ill->ill_name,
11744 	    ipif->ipif_id, (void *)ipif));
11745 	if (ipip->ipi_cmd_type == IF_CMD) {
11746 		ifr = (struct ifreq *)if_req;
11747 		mtu = ifr->ifr_metric;
11748 	} else {
11749 		lifr = (struct lifreq *)if_req;
11750 		mtu = lifr->lifr_mtu;
11751 	}
11752 
11753 	if (ipif->ipif_isv6)
11754 		ip_min_mtu = IPV6_MIN_MTU;
11755 	else
11756 		ip_min_mtu = IP_MIN_MTU;
11757 
11758 	if (mtu > ipif->ipif_ill->ill_max_frag || mtu < ip_min_mtu)
11759 		return (EINVAL);
11760 
11761 	/*
11762 	 * Change the MTU size in all relevant ire's.
11763 	 * Mtu change Vs. new ire creation - protocol below.
11764 	 * First change ipif_mtu and the ire_max_frag of the
11765 	 * interface ire. Then do an ire walk and change the
11766 	 * ire_max_frag of all affected ires. During ire_add
11767 	 * under the bucket lock, set the ire_max_frag of the
11768 	 * new ire being created from the ipif/ire from which
11769 	 * it is being derived. If an mtu change happens after
11770 	 * the ire is added, the new ire will be cleaned up.
11771 	 * Conversely if the mtu change happens before the ire
11772 	 * is added, ire_add will see the new value of the mtu.
11773 	 */
11774 	ipif->ipif_mtu = mtu;
11775 	ipif->ipif_flags |= IPIF_FIXEDMTU;
11776 
11777 	if (ipif->ipif_isv6)
11778 		ire = ipif_to_ire_v6(ipif);
11779 	else
11780 		ire = ipif_to_ire(ipif);
11781 	if (ire != NULL) {
11782 		ire->ire_max_frag = ipif->ipif_mtu;
11783 		ire_refrele(ire);
11784 	}
11785 	if (ipif->ipif_flags & IPIF_UP) {
11786 		if (ipif->ipif_isv6)
11787 			ire_walk_v6(ipif_mtu_change, (char *)ipif, ALL_ZONES);
11788 		else
11789 			ire_walk_v4(ipif_mtu_change, (char *)ipif, ALL_ZONES);
11790 	}
11791 	/* Update the MTU in SCTP's list */
11792 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
11793 	return (0);
11794 }
11795 
11796 /* Get interface MTU. */
11797 /* ARGSUSED */
11798 int
11799 ip_sioctl_get_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11800 	ip_ioctl_cmd_t *ipip, void *if_req)
11801 {
11802 	struct ifreq	*ifr;
11803 	struct lifreq	*lifr;
11804 
11805 	ip1dbg(("ip_sioctl_get_mtu(%s:%u %p)\n",
11806 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11807 	if (ipip->ipi_cmd_type == IF_CMD) {
11808 		ifr = (struct ifreq *)if_req;
11809 		ifr->ifr_metric = ipif->ipif_mtu;
11810 	} else {
11811 		lifr = (struct lifreq *)if_req;
11812 		lifr->lifr_mtu = ipif->ipif_mtu;
11813 	}
11814 	return (0);
11815 }
11816 
11817 /* Set interface broadcast address. */
11818 /* ARGSUSED2 */
11819 int
11820 ip_sioctl_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11821 	ip_ioctl_cmd_t *ipip, void *if_req)
11822 {
11823 	ipaddr_t addr;
11824 	ire_t	*ire;
11825 
11826 	ip1dbg(("ip_sioctl_brdaddr(%s:%u)\n", ipif->ipif_ill->ill_name,
11827 	    ipif->ipif_id));
11828 
11829 	ASSERT(IAM_WRITER_IPIF(ipif));
11830 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
11831 		return (EADDRNOTAVAIL);
11832 
11833 	ASSERT(!(ipif->ipif_isv6));	/* No IPv6 broadcast */
11834 
11835 	if (sin->sin_family != AF_INET)
11836 		return (EAFNOSUPPORT);
11837 
11838 	addr = sin->sin_addr.s_addr;
11839 	if (ipif->ipif_flags & IPIF_UP) {
11840 		/*
11841 		 * If we are already up, make sure the new
11842 		 * broadcast address makes sense.  If it does,
11843 		 * there should be an IRE for it already.
11844 		 * Don't match on ipif, only on the ill
11845 		 * since we are sharing these now. Don't use
11846 		 * MATCH_IRE_ILL_GROUP as we are looking for
11847 		 * the broadcast ire on this ill and each ill
11848 		 * in the group has its own broadcast ire.
11849 		 */
11850 		ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST,
11851 		    ipif, ALL_ZONES, NULL,
11852 		    (MATCH_IRE_ILL | MATCH_IRE_TYPE));
11853 		if (ire == NULL) {
11854 			return (EINVAL);
11855 		} else {
11856 			ire_refrele(ire);
11857 		}
11858 	}
11859 	/*
11860 	 * Changing the broadcast addr for this ipif.
11861 	 * Make sure we have valid net and subnet bcast
11862 	 * ire's for other logical interfaces, if needed.
11863 	 */
11864 	if (addr != ipif->ipif_brd_addr)
11865 		ipif_check_bcast_ires(ipif);
11866 	IN6_IPADDR_TO_V4MAPPED(addr, &ipif->ipif_v6brd_addr);
11867 	return (0);
11868 }
11869 
11870 /* Get interface broadcast address. */
11871 /* ARGSUSED */
11872 int
11873 ip_sioctl_get_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11874     ip_ioctl_cmd_t *ipip, void *if_req)
11875 {
11876 	ip1dbg(("ip_sioctl_get_brdaddr(%s:%u %p)\n",
11877 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11878 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
11879 		return (EADDRNOTAVAIL);
11880 
11881 	/* IPIF_BROADCAST not possible with IPv6 */
11882 	ASSERT(!ipif->ipif_isv6);
11883 	*sin = sin_null;
11884 	sin->sin_family = AF_INET;
11885 	sin->sin_addr.s_addr = ipif->ipif_brd_addr;
11886 	return (0);
11887 }
11888 
11889 /*
11890  * This routine is called to handle the SIOCS*IFNETMASK IOCTL.
11891  */
11892 /* ARGSUSED */
11893 int
11894 ip_sioctl_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11895     ip_ioctl_cmd_t *ipip, void *if_req)
11896 {
11897 	int err = 0;
11898 	in6_addr_t v6mask;
11899 
11900 	ip1dbg(("ip_sioctl_netmask(%s:%u %p)\n",
11901 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11902 
11903 	ASSERT(IAM_WRITER_IPIF(ipif));
11904 
11905 	if (ipif->ipif_isv6) {
11906 		sin6_t *sin6;
11907 
11908 		if (sin->sin_family != AF_INET6)
11909 			return (EAFNOSUPPORT);
11910 
11911 		sin6 = (sin6_t *)sin;
11912 		v6mask = sin6->sin6_addr;
11913 	} else {
11914 		ipaddr_t mask;
11915 
11916 		if (sin->sin_family != AF_INET)
11917 			return (EAFNOSUPPORT);
11918 
11919 		mask = sin->sin_addr.s_addr;
11920 		V4MASK_TO_V6(mask, v6mask);
11921 	}
11922 
11923 	/*
11924 	 * No big deal if the interface isn't already up, or the mask
11925 	 * isn't really changing, or this is pt-pt.
11926 	 */
11927 	if (!(ipif->ipif_flags & IPIF_UP) ||
11928 	    IN6_ARE_ADDR_EQUAL(&v6mask, &ipif->ipif_v6net_mask) ||
11929 	    (ipif->ipif_flags & IPIF_POINTOPOINT)) {
11930 		ipif->ipif_v6net_mask = v6mask;
11931 		if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11932 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
11933 			    ipif->ipif_v6net_mask,
11934 			    ipif->ipif_v6subnet);
11935 		}
11936 		return (0);
11937 	}
11938 	/*
11939 	 * Make sure we have valid net and subnet broadcast ire's
11940 	 * for the old netmask, if needed by other logical interfaces.
11941 	 */
11942 	if (!ipif->ipif_isv6)
11943 		ipif_check_bcast_ires(ipif);
11944 
11945 	err = ipif_logical_down(ipif, q, mp);
11946 	if (err == EINPROGRESS)
11947 		return (err);
11948 	ipif_down_tail(ipif);
11949 	err = ip_sioctl_netmask_tail(ipif, sin, q, mp);
11950 	return (err);
11951 }
11952 
11953 static int
11954 ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp)
11955 {
11956 	in6_addr_t v6mask;
11957 	int err = 0;
11958 
11959 	ip1dbg(("ip_sioctl_netmask_tail(%s:%u %p)\n",
11960 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11961 
11962 	if (ipif->ipif_isv6) {
11963 		sin6_t *sin6;
11964 
11965 		sin6 = (sin6_t *)sin;
11966 		v6mask = sin6->sin6_addr;
11967 	} else {
11968 		ipaddr_t mask;
11969 
11970 		mask = sin->sin_addr.s_addr;
11971 		V4MASK_TO_V6(mask, v6mask);
11972 	}
11973 
11974 	ipif->ipif_v6net_mask = v6mask;
11975 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11976 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
11977 		    ipif->ipif_v6subnet);
11978 	}
11979 	err = ipif_up(ipif, q, mp);
11980 
11981 	if (err == 0 || err == EINPROGRESS) {
11982 		/*
11983 		 * The interface must be DL_BOUND if this packet has to
11984 		 * go out on the wire. Since we only go through a logical
11985 		 * down and are bound with the driver during an internal
11986 		 * down/up that is satisfied.
11987 		 */
11988 		if (!ipif->ipif_isv6 && ipif->ipif_ill->ill_wq != NULL) {
11989 			/* Potentially broadcast an address mask reply. */
11990 			ipif_mask_reply(ipif);
11991 		}
11992 	}
11993 	return (err);
11994 }
11995 
11996 /* ARGSUSED */
11997 int
11998 ip_sioctl_netmask_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11999     ip_ioctl_cmd_t *ipip, void *if_req)
12000 {
12001 	ip1dbg(("ip_sioctl_netmask_restart(%s:%u %p)\n",
12002 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12003 	ipif_down_tail(ipif);
12004 	return (ip_sioctl_netmask_tail(ipif, sin, q, mp));
12005 }
12006 
12007 /* Get interface net mask. */
12008 /* ARGSUSED */
12009 int
12010 ip_sioctl_get_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12011     ip_ioctl_cmd_t *ipip, void *if_req)
12012 {
12013 	struct lifreq *lifr = (struct lifreq *)if_req;
12014 	struct sockaddr_in6 *sin6 = (sin6_t *)sin;
12015 
12016 	ip1dbg(("ip_sioctl_get_netmask(%s:%u %p)\n",
12017 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12018 
12019 	/*
12020 	 * net mask can't change since we have a reference to the ipif.
12021 	 */
12022 	if (ipif->ipif_isv6) {
12023 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
12024 		*sin6 = sin6_null;
12025 		sin6->sin6_family = AF_INET6;
12026 		sin6->sin6_addr = ipif->ipif_v6net_mask;
12027 		lifr->lifr_addrlen =
12028 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
12029 	} else {
12030 		*sin = sin_null;
12031 		sin->sin_family = AF_INET;
12032 		sin->sin_addr.s_addr = ipif->ipif_net_mask;
12033 		if (ipip->ipi_cmd_type == LIF_CMD) {
12034 			lifr->lifr_addrlen =
12035 			    ip_mask_to_plen(ipif->ipif_net_mask);
12036 		}
12037 	}
12038 	return (0);
12039 }
12040 
12041 /* ARGSUSED */
12042 int
12043 ip_sioctl_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12044     ip_ioctl_cmd_t *ipip, void *if_req)
12045 {
12046 
12047 	ip1dbg(("ip_sioctl_metric(%s:%u %p)\n",
12048 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12049 	/*
12050 	 * Set interface metric.  We don't use this for
12051 	 * anything but we keep track of it in case it is
12052 	 * important to routing applications or such.
12053 	 */
12054 	if (ipip->ipi_cmd_type == IF_CMD) {
12055 		struct ifreq    *ifr;
12056 
12057 		ifr = (struct ifreq *)if_req;
12058 		ipif->ipif_metric = ifr->ifr_metric;
12059 	} else {
12060 		struct lifreq   *lifr;
12061 
12062 		lifr = (struct lifreq *)if_req;
12063 		ipif->ipif_metric = lifr->lifr_metric;
12064 	}
12065 	return (0);
12066 }
12067 
12068 
12069 /* ARGSUSED */
12070 int
12071 ip_sioctl_get_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12072     ip_ioctl_cmd_t *ipip, void *if_req)
12073 {
12074 
12075 	/* Get interface metric. */
12076 	ip1dbg(("ip_sioctl_get_metric(%s:%u %p)\n",
12077 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12078 	if (ipip->ipi_cmd_type == IF_CMD) {
12079 		struct ifreq    *ifr;
12080 
12081 		ifr = (struct ifreq *)if_req;
12082 		ifr->ifr_metric = ipif->ipif_metric;
12083 	} else {
12084 		struct lifreq   *lifr;
12085 
12086 		lifr = (struct lifreq *)if_req;
12087 		lifr->lifr_metric = ipif->ipif_metric;
12088 	}
12089 
12090 	return (0);
12091 }
12092 
12093 /* ARGSUSED */
12094 int
12095 ip_sioctl_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12096     ip_ioctl_cmd_t *ipip, void *if_req)
12097 {
12098 
12099 	ip1dbg(("ip_sioctl_muxid(%s:%u %p)\n",
12100 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12101 	/*
12102 	 * Set the muxid returned from I_PLINK.
12103 	 */
12104 	if (ipip->ipi_cmd_type == IF_CMD) {
12105 		struct ifreq *ifr = (struct ifreq *)if_req;
12106 
12107 		ipif->ipif_ill->ill_ip_muxid = ifr->ifr_ip_muxid;
12108 		ipif->ipif_ill->ill_arp_muxid = ifr->ifr_arp_muxid;
12109 	} else {
12110 		struct lifreq *lifr = (struct lifreq *)if_req;
12111 
12112 		ipif->ipif_ill->ill_ip_muxid = lifr->lifr_ip_muxid;
12113 		ipif->ipif_ill->ill_arp_muxid = lifr->lifr_arp_muxid;
12114 	}
12115 	return (0);
12116 }
12117 
12118 /* ARGSUSED */
12119 int
12120 ip_sioctl_get_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12121     ip_ioctl_cmd_t *ipip, void *if_req)
12122 {
12123 
12124 	ip1dbg(("ip_sioctl_get_muxid(%s:%u %p)\n",
12125 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12126 	/*
12127 	 * Get the muxid saved in ill for I_PUNLINK.
12128 	 */
12129 	if (ipip->ipi_cmd_type == IF_CMD) {
12130 		struct ifreq *ifr = (struct ifreq *)if_req;
12131 
12132 		ifr->ifr_ip_muxid = ipif->ipif_ill->ill_ip_muxid;
12133 		ifr->ifr_arp_muxid = ipif->ipif_ill->ill_arp_muxid;
12134 	} else {
12135 		struct lifreq *lifr = (struct lifreq *)if_req;
12136 
12137 		lifr->lifr_ip_muxid = ipif->ipif_ill->ill_ip_muxid;
12138 		lifr->lifr_arp_muxid = ipif->ipif_ill->ill_arp_muxid;
12139 	}
12140 	return (0);
12141 }
12142 
12143 /*
12144  * Set the subnet prefix. Does not modify the broadcast address.
12145  */
12146 /* ARGSUSED */
12147 int
12148 ip_sioctl_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12149     ip_ioctl_cmd_t *ipip, void *if_req)
12150 {
12151 	int err = 0;
12152 	in6_addr_t v6addr;
12153 	in6_addr_t v6mask;
12154 	boolean_t need_up = B_FALSE;
12155 	int addrlen;
12156 
12157 	ip1dbg(("ip_sioctl_subnet(%s:%u %p)\n",
12158 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12159 
12160 	ASSERT(IAM_WRITER_IPIF(ipif));
12161 	addrlen = ((struct lifreq *)if_req)->lifr_addrlen;
12162 
12163 	if (ipif->ipif_isv6) {
12164 		sin6_t *sin6;
12165 
12166 		if (sin->sin_family != AF_INET6)
12167 			return (EAFNOSUPPORT);
12168 
12169 		sin6 = (sin6_t *)sin;
12170 		v6addr = sin6->sin6_addr;
12171 		if (!ip_remote_addr_ok_v6(&v6addr, &ipv6_all_ones))
12172 			return (EADDRNOTAVAIL);
12173 	} else {
12174 		ipaddr_t addr;
12175 
12176 		if (sin->sin_family != AF_INET)
12177 			return (EAFNOSUPPORT);
12178 
12179 		addr = sin->sin_addr.s_addr;
12180 		if (!ip_addr_ok_v4(addr, 0xFFFFFFFF))
12181 			return (EADDRNOTAVAIL);
12182 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
12183 		/* Add 96 bits */
12184 		addrlen += IPV6_ABITS - IP_ABITS;
12185 	}
12186 
12187 	if (ip_plen_to_mask_v6(addrlen, &v6mask) == NULL)
12188 		return (EINVAL);
12189 
12190 	/* Check if bits in the address is set past the mask */
12191 	if (!V6_MASK_EQ(v6addr, v6mask, v6addr))
12192 		return (EINVAL);
12193 
12194 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6subnet, &v6addr) &&
12195 	    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6net_mask, &v6mask))
12196 		return (0);	/* No change */
12197 
12198 	if (ipif->ipif_flags & IPIF_UP) {
12199 		/*
12200 		 * If the interface is already marked up,
12201 		 * we call ipif_down which will take care
12202 		 * of ditching any IREs that have been set
12203 		 * up based on the old interface address.
12204 		 */
12205 		err = ipif_logical_down(ipif, q, mp);
12206 		if (err == EINPROGRESS)
12207 			return (err);
12208 		ipif_down_tail(ipif);
12209 		need_up = B_TRUE;
12210 	}
12211 
12212 	err = ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, need_up);
12213 	return (err);
12214 }
12215 
12216 static int
12217 ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t v6addr, in6_addr_t v6mask,
12218     queue_t *q, mblk_t *mp, boolean_t need_up)
12219 {
12220 	ill_t	*ill = ipif->ipif_ill;
12221 	int	err = 0;
12222 
12223 	ip1dbg(("ip_sioctl_subnet_tail(%s:%u %p)\n",
12224 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12225 
12226 	/* Set the new address. */
12227 	mutex_enter(&ill->ill_lock);
12228 	ipif->ipif_v6net_mask = v6mask;
12229 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
12230 		V6_MASK_COPY(v6addr, ipif->ipif_v6net_mask,
12231 		    ipif->ipif_v6subnet);
12232 	}
12233 	mutex_exit(&ill->ill_lock);
12234 
12235 	if (need_up) {
12236 		/*
12237 		 * Now bring the interface back up.  If this
12238 		 * is the only IPIF for the ILL, ipif_up
12239 		 * will have to re-bind to the device, so
12240 		 * we may get back EINPROGRESS, in which
12241 		 * case, this IOCTL will get completed in
12242 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
12243 		 */
12244 		err = ipif_up(ipif, q, mp);
12245 		if (err == EINPROGRESS)
12246 			return (err);
12247 	}
12248 	return (err);
12249 }
12250 
12251 /* ARGSUSED */
12252 int
12253 ip_sioctl_subnet_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12254     ip_ioctl_cmd_t *ipip, void *if_req)
12255 {
12256 	int	addrlen;
12257 	in6_addr_t v6addr;
12258 	in6_addr_t v6mask;
12259 	struct lifreq *lifr = (struct lifreq *)if_req;
12260 
12261 	ip1dbg(("ip_sioctl_subnet_restart(%s:%u %p)\n",
12262 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12263 	ipif_down_tail(ipif);
12264 
12265 	addrlen = lifr->lifr_addrlen;
12266 	if (ipif->ipif_isv6) {
12267 		sin6_t *sin6;
12268 
12269 		sin6 = (sin6_t *)sin;
12270 		v6addr = sin6->sin6_addr;
12271 	} else {
12272 		ipaddr_t addr;
12273 
12274 		addr = sin->sin_addr.s_addr;
12275 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
12276 		addrlen += IPV6_ABITS - IP_ABITS;
12277 	}
12278 	(void) ip_plen_to_mask_v6(addrlen, &v6mask);
12279 
12280 	return (ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, B_TRUE));
12281 }
12282 
12283 /* ARGSUSED */
12284 int
12285 ip_sioctl_get_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12286     ip_ioctl_cmd_t *ipip, void *if_req)
12287 {
12288 	struct lifreq *lifr = (struct lifreq *)if_req;
12289 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sin;
12290 
12291 	ip1dbg(("ip_sioctl_get_subnet(%s:%u %p)\n",
12292 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12293 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
12294 
12295 	if (ipif->ipif_isv6) {
12296 		*sin6 = sin6_null;
12297 		sin6->sin6_family = AF_INET6;
12298 		sin6->sin6_addr = ipif->ipif_v6subnet;
12299 		lifr->lifr_addrlen =
12300 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
12301 	} else {
12302 		*sin = sin_null;
12303 		sin->sin_family = AF_INET;
12304 		sin->sin_addr.s_addr = ipif->ipif_subnet;
12305 		lifr->lifr_addrlen = ip_mask_to_plen(ipif->ipif_net_mask);
12306 	}
12307 	return (0);
12308 }
12309 
12310 /*
12311  * Set the IPv6 address token.
12312  */
12313 /* ARGSUSED */
12314 int
12315 ip_sioctl_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12316     ip_ioctl_cmd_t *ipi, void *if_req)
12317 {
12318 	ill_t *ill = ipif->ipif_ill;
12319 	int err;
12320 	in6_addr_t v6addr;
12321 	in6_addr_t v6mask;
12322 	boolean_t need_up = B_FALSE;
12323 	int i;
12324 	sin6_t *sin6 = (sin6_t *)sin;
12325 	struct lifreq *lifr = (struct lifreq *)if_req;
12326 	int addrlen;
12327 
12328 	ip1dbg(("ip_sioctl_token(%s:%u %p)\n",
12329 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12330 	ASSERT(IAM_WRITER_IPIF(ipif));
12331 
12332 	addrlen = lifr->lifr_addrlen;
12333 	/* Only allow for logical unit zero i.e. not on "le0:17" */
12334 	if (ipif->ipif_id != 0)
12335 		return (EINVAL);
12336 
12337 	if (!ipif->ipif_isv6)
12338 		return (EINVAL);
12339 
12340 	if (addrlen > IPV6_ABITS)
12341 		return (EINVAL);
12342 
12343 	v6addr = sin6->sin6_addr;
12344 
12345 	/*
12346 	 * The length of the token is the length from the end.  To get
12347 	 * the proper mask for this, compute the mask of the bits not
12348 	 * in the token; ie. the prefix, and then xor to get the mask.
12349 	 */
12350 	if (ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask) == NULL)
12351 		return (EINVAL);
12352 	for (i = 0; i < 4; i++) {
12353 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
12354 	}
12355 
12356 	if (V6_MASK_EQ(v6addr, v6mask, ill->ill_token) &&
12357 	    ill->ill_token_length == addrlen)
12358 		return (0);	/* No change */
12359 
12360 	if (ipif->ipif_flags & IPIF_UP) {
12361 		err = ipif_logical_down(ipif, q, mp);
12362 		if (err == EINPROGRESS)
12363 			return (err);
12364 		ipif_down_tail(ipif);
12365 		need_up = B_TRUE;
12366 	}
12367 	err = ip_sioctl_token_tail(ipif, sin6, addrlen, q, mp, need_up);
12368 	return (err);
12369 }
12370 
12371 static int
12372 ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen, queue_t *q,
12373     mblk_t *mp, boolean_t need_up)
12374 {
12375 	in6_addr_t v6addr;
12376 	in6_addr_t v6mask;
12377 	ill_t	*ill = ipif->ipif_ill;
12378 	int	i;
12379 	int	err = 0;
12380 
12381 	ip1dbg(("ip_sioctl_token_tail(%s:%u %p)\n",
12382 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12383 	v6addr = sin6->sin6_addr;
12384 	/*
12385 	 * The length of the token is the length from the end.  To get
12386 	 * the proper mask for this, compute the mask of the bits not
12387 	 * in the token; ie. the prefix, and then xor to get the mask.
12388 	 */
12389 	(void) ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask);
12390 	for (i = 0; i < 4; i++)
12391 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
12392 
12393 	mutex_enter(&ill->ill_lock);
12394 	V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
12395 	ill->ill_token_length = addrlen;
12396 	mutex_exit(&ill->ill_lock);
12397 
12398 	if (need_up) {
12399 		/*
12400 		 * Now bring the interface back up.  If this
12401 		 * is the only IPIF for the ILL, ipif_up
12402 		 * will have to re-bind to the device, so
12403 		 * we may get back EINPROGRESS, in which
12404 		 * case, this IOCTL will get completed in
12405 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
12406 		 */
12407 		err = ipif_up(ipif, q, mp);
12408 		if (err == EINPROGRESS)
12409 			return (err);
12410 	}
12411 	return (err);
12412 }
12413 
12414 /* ARGSUSED */
12415 int
12416 ip_sioctl_get_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12417     ip_ioctl_cmd_t *ipi, void *if_req)
12418 {
12419 	ill_t *ill;
12420 	sin6_t *sin6 = (sin6_t *)sin;
12421 	struct lifreq *lifr = (struct lifreq *)if_req;
12422 
12423 	ip1dbg(("ip_sioctl_get_token(%s:%u %p)\n",
12424 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12425 	if (ipif->ipif_id != 0)
12426 		return (EINVAL);
12427 
12428 	ill = ipif->ipif_ill;
12429 	if (!ill->ill_isv6)
12430 		return (ENXIO);
12431 
12432 	*sin6 = sin6_null;
12433 	sin6->sin6_family = AF_INET6;
12434 	ASSERT(!IN6_IS_ADDR_V4MAPPED(&ill->ill_token));
12435 	sin6->sin6_addr = ill->ill_token;
12436 	lifr->lifr_addrlen = ill->ill_token_length;
12437 	return (0);
12438 }
12439 
12440 /*
12441  * Set (hardware) link specific information that might override
12442  * what was acquired through the DL_INFO_ACK.
12443  * The logic is as follows.
12444  *
12445  * become exclusive
12446  * set CHANGING flag
12447  * change mtu on affected IREs
12448  * clear CHANGING flag
12449  *
12450  * An ire add that occurs before the CHANGING flag is set will have its mtu
12451  * changed by the ip_sioctl_lnkinfo.
12452  *
12453  * During the time the CHANGING flag is set, no new ires will be added to the
12454  * bucket, and ire add will fail (due the CHANGING flag).
12455  *
12456  * An ire add that occurs after the CHANGING flag is set will have the right mtu
12457  * before it is added to the bucket.
12458  *
12459  * Obviously only 1 thread can set the CHANGING flag and we need to become
12460  * exclusive to set the flag.
12461  */
12462 /* ARGSUSED */
12463 int
12464 ip_sioctl_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12465     ip_ioctl_cmd_t *ipi, void *if_req)
12466 {
12467 	ill_t		*ill = ipif->ipif_ill;
12468 	ipif_t		*nipif;
12469 	int		ip_min_mtu;
12470 	boolean_t	mtu_walk = B_FALSE;
12471 	struct lifreq	*lifr = (struct lifreq *)if_req;
12472 	lif_ifinfo_req_t *lir;
12473 	ire_t		*ire;
12474 
12475 	ip1dbg(("ip_sioctl_lnkinfo(%s:%u %p)\n",
12476 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12477 	lir = &lifr->lifr_ifinfo;
12478 	ASSERT(IAM_WRITER_IPIF(ipif));
12479 
12480 	/* Only allow for logical unit zero i.e. not on "le0:17" */
12481 	if (ipif->ipif_id != 0)
12482 		return (EINVAL);
12483 
12484 	/* Set interface MTU. */
12485 	if (ipif->ipif_isv6)
12486 		ip_min_mtu = IPV6_MIN_MTU;
12487 	else
12488 		ip_min_mtu = IP_MIN_MTU;
12489 
12490 	/*
12491 	 * Verify values before we set anything. Allow zero to
12492 	 * mean unspecified.
12493 	 */
12494 	if (lir->lir_maxmtu != 0 &&
12495 	    (lir->lir_maxmtu > ill->ill_max_frag ||
12496 	    lir->lir_maxmtu < ip_min_mtu))
12497 		return (EINVAL);
12498 	if (lir->lir_reachtime != 0 &&
12499 	    lir->lir_reachtime > ND_MAX_REACHTIME)
12500 		return (EINVAL);
12501 	if (lir->lir_reachretrans != 0 &&
12502 	    lir->lir_reachretrans > ND_MAX_REACHRETRANSTIME)
12503 		return (EINVAL);
12504 
12505 	mutex_enter(&ill->ill_lock);
12506 	ill->ill_state_flags |= ILL_CHANGING;
12507 	for (nipif = ill->ill_ipif; nipif != NULL;
12508 	    nipif = nipif->ipif_next) {
12509 		nipif->ipif_state_flags |= IPIF_CHANGING;
12510 	}
12511 
12512 	mutex_exit(&ill->ill_lock);
12513 
12514 	if (lir->lir_maxmtu != 0) {
12515 		ill->ill_max_mtu = lir->lir_maxmtu;
12516 		ill->ill_mtu_userspecified = 1;
12517 		mtu_walk = B_TRUE;
12518 	}
12519 
12520 	if (lir->lir_reachtime != 0)
12521 		ill->ill_reachable_time = lir->lir_reachtime;
12522 
12523 	if (lir->lir_reachretrans != 0)
12524 		ill->ill_reachable_retrans_time = lir->lir_reachretrans;
12525 
12526 	ill->ill_max_hops = lir->lir_maxhops;
12527 
12528 	ill->ill_max_buf = ND_MAX_Q;
12529 
12530 	if (mtu_walk) {
12531 		/*
12532 		 * Set the MTU on all ipifs associated with this ill except
12533 		 * for those whose MTU was fixed via SIOCSLIFMTU.
12534 		 */
12535 		for (nipif = ill->ill_ipif; nipif != NULL;
12536 		    nipif = nipif->ipif_next) {
12537 			if (nipif->ipif_flags & IPIF_FIXEDMTU)
12538 				continue;
12539 
12540 			nipif->ipif_mtu = ill->ill_max_mtu;
12541 
12542 			if (!(nipif->ipif_flags & IPIF_UP))
12543 				continue;
12544 
12545 			if (nipif->ipif_isv6)
12546 				ire = ipif_to_ire_v6(nipif);
12547 			else
12548 				ire = ipif_to_ire(nipif);
12549 			if (ire != NULL) {
12550 				ire->ire_max_frag = ipif->ipif_mtu;
12551 				ire_refrele(ire);
12552 			}
12553 			if (ill->ill_isv6) {
12554 				ire_walk_ill_v6(MATCH_IRE_ILL, 0,
12555 				    ipif_mtu_change, (char *)nipif,
12556 				    ill);
12557 			} else {
12558 				ire_walk_ill_v4(MATCH_IRE_ILL, 0,
12559 				    ipif_mtu_change, (char *)nipif,
12560 				    ill);
12561 			}
12562 		}
12563 	}
12564 
12565 	mutex_enter(&ill->ill_lock);
12566 	for (nipif = ill->ill_ipif; nipif != NULL;
12567 	    nipif = nipif->ipif_next) {
12568 		nipif->ipif_state_flags &= ~IPIF_CHANGING;
12569 	}
12570 	ILL_UNMARK_CHANGING(ill);
12571 	mutex_exit(&ill->ill_lock);
12572 
12573 	return (0);
12574 }
12575 
12576 /* ARGSUSED */
12577 int
12578 ip_sioctl_get_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12579     ip_ioctl_cmd_t *ipi, void *if_req)
12580 {
12581 	struct lif_ifinfo_req *lir;
12582 	ill_t *ill = ipif->ipif_ill;
12583 
12584 	ip1dbg(("ip_sioctl_get_lnkinfo(%s:%u %p)\n",
12585 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12586 	if (ipif->ipif_id != 0)
12587 		return (EINVAL);
12588 
12589 	lir = &((struct lifreq *)if_req)->lifr_ifinfo;
12590 	lir->lir_maxhops = ill->ill_max_hops;
12591 	lir->lir_reachtime = ill->ill_reachable_time;
12592 	lir->lir_reachretrans = ill->ill_reachable_retrans_time;
12593 	lir->lir_maxmtu = ill->ill_max_mtu;
12594 
12595 	return (0);
12596 }
12597 
12598 /*
12599  * Return best guess as to the subnet mask for the specified address.
12600  * Based on the subnet masks for all the configured interfaces.
12601  *
12602  * We end up returning a zero mask in the case of default, multicast or
12603  * experimental.
12604  */
12605 static ipaddr_t
12606 ip_subnet_mask(ipaddr_t addr, ipif_t **ipifp)
12607 {
12608 	ipaddr_t net_mask;
12609 	ill_t	*ill;
12610 	ipif_t	*ipif;
12611 	ill_walk_context_t ctx;
12612 	ipif_t	*fallback_ipif = NULL;
12613 
12614 	net_mask = ip_net_mask(addr);
12615 	if (net_mask == 0) {
12616 		*ipifp = NULL;
12617 		return (0);
12618 	}
12619 
12620 	/* Let's check to see if this is maybe a local subnet route. */
12621 	/* this function only applies to IPv4 interfaces */
12622 	rw_enter(&ill_g_lock, RW_READER);
12623 	ill = ILL_START_WALK_V4(&ctx);
12624 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
12625 		mutex_enter(&ill->ill_lock);
12626 		for (ipif = ill->ill_ipif; ipif != NULL;
12627 		    ipif = ipif->ipif_next) {
12628 			if (!IPIF_CAN_LOOKUP(ipif))
12629 				continue;
12630 			if (!(ipif->ipif_flags & IPIF_UP))
12631 				continue;
12632 			if ((ipif->ipif_subnet & net_mask) ==
12633 			    (addr & net_mask)) {
12634 				/*
12635 				 * Don't trust pt-pt interfaces if there are
12636 				 * other interfaces.
12637 				 */
12638 				if (ipif->ipif_flags & IPIF_POINTOPOINT) {
12639 					if (fallback_ipif == NULL) {
12640 						ipif_refhold_locked(ipif);
12641 						fallback_ipif = ipif;
12642 					}
12643 					continue;
12644 				}
12645 
12646 				/*
12647 				 * Fine. Just assume the same net mask as the
12648 				 * directly attached subnet interface is using.
12649 				 */
12650 				ipif_refhold_locked(ipif);
12651 				mutex_exit(&ill->ill_lock);
12652 				rw_exit(&ill_g_lock);
12653 				if (fallback_ipif != NULL)
12654 					ipif_refrele(fallback_ipif);
12655 				*ipifp = ipif;
12656 				return (ipif->ipif_net_mask);
12657 			}
12658 		}
12659 		mutex_exit(&ill->ill_lock);
12660 	}
12661 	rw_exit(&ill_g_lock);
12662 
12663 	*ipifp = fallback_ipif;
12664 	return ((fallback_ipif != NULL) ?
12665 	    fallback_ipif->ipif_net_mask : net_mask);
12666 }
12667 
12668 /*
12669  * ip_sioctl_copyin_setup calls ip_wput_ioctl to process the IP_IOCTL ioctl.
12670  */
12671 static void
12672 ip_wput_ioctl(queue_t *q, mblk_t *mp)
12673 {
12674 	IOCP	iocp;
12675 	ipft_t	*ipft;
12676 	ipllc_t	*ipllc;
12677 	mblk_t	*mp1;
12678 	cred_t	*cr;
12679 	int	error = 0;
12680 	conn_t	*connp;
12681 
12682 	ip1dbg(("ip_wput_ioctl"));
12683 	iocp = (IOCP)mp->b_rptr;
12684 	mp1 = mp->b_cont;
12685 	if (mp1 == NULL) {
12686 		iocp->ioc_error = EINVAL;
12687 		mp->b_datap->db_type = M_IOCNAK;
12688 		iocp->ioc_count = 0;
12689 		qreply(q, mp);
12690 		return;
12691 	}
12692 
12693 	/*
12694 	 * These IOCTLs provide various control capabilities to
12695 	 * upstream agents such as ULPs and processes.	There
12696 	 * are currently two such IOCTLs implemented.  They
12697 	 * are used by TCP to provide update information for
12698 	 * existing IREs and to forcibly delete an IRE for a
12699 	 * host that is not responding, thereby forcing an
12700 	 * attempt at a new route.
12701 	 */
12702 	iocp->ioc_error = EINVAL;
12703 	if (!pullupmsg(mp1, sizeof (ipllc->ipllc_cmd)))
12704 		goto done;
12705 
12706 	ipllc = (ipllc_t *)mp1->b_rptr;
12707 	for (ipft = ip_ioctl_ftbl; ipft->ipft_pfi; ipft++) {
12708 		if (ipllc->ipllc_cmd == ipft->ipft_cmd)
12709 			break;
12710 	}
12711 	/*
12712 	 * prefer credential from mblk over ioctl;
12713 	 * see ip_sioctl_copyin_setup
12714 	 */
12715 	cr = DB_CREDDEF(mp, iocp->ioc_cr);
12716 
12717 	/*
12718 	 * Refhold the conn in case the request gets queued up in some lookup
12719 	 */
12720 	ASSERT(CONN_Q(q));
12721 	connp = Q_TO_CONN(q);
12722 	CONN_INC_REF(connp);
12723 	if (ipft->ipft_pfi &&
12724 	    ((mp1->b_wptr - mp1->b_rptr) >= ipft->ipft_min_size ||
12725 		pullupmsg(mp1, ipft->ipft_min_size))) {
12726 		error = (*ipft->ipft_pfi)(q,
12727 		    (ipft->ipft_flags & IPFT_F_SELF_REPLY) ? mp : mp1, cr);
12728 	}
12729 	if (ipft->ipft_flags & IPFT_F_SELF_REPLY) {
12730 		/*
12731 		 * CONN_OPER_PENDING_DONE happens in the function called
12732 		 * through ipft_pfi above.
12733 		 */
12734 		return;
12735 	}
12736 
12737 	CONN_OPER_PENDING_DONE(connp);
12738 	if (ipft->ipft_flags & IPFT_F_NO_REPLY) {
12739 		freemsg(mp);
12740 		return;
12741 	}
12742 	iocp->ioc_error = error;
12743 
12744 done:
12745 	mp->b_datap->db_type = M_IOCACK;
12746 	if (iocp->ioc_error)
12747 		iocp->ioc_count = 0;
12748 	qreply(q, mp);
12749 }
12750 
12751 /*
12752  * Lookup an ipif using the sequence id (ipif_seqid)
12753  */
12754 ipif_t *
12755 ipif_lookup_seqid(ill_t *ill, uint_t seqid)
12756 {
12757 	ipif_t *ipif;
12758 
12759 	ASSERT(MUTEX_HELD(&ill->ill_lock));
12760 
12761 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12762 		if (ipif->ipif_seqid == seqid && IPIF_CAN_LOOKUP(ipif))
12763 			return (ipif);
12764 	}
12765 	return (NULL);
12766 }
12767 
12768 uint64_t ipif_g_seqid;
12769 
12770 /*
12771  * Assign a unique id for the ipif. This is used later when we send
12772  * IRES to ARP for resolution where we initialize ire_ipif_seqid
12773  * to the value pointed by ire_ipif->ipif_seqid. Later when the
12774  * IRE is added, we verify that ipif has not disappeared.
12775  */
12776 
12777 static void
12778 ipif_assign_seqid(ipif_t *ipif)
12779 {
12780 	ipif->ipif_seqid = atomic_add_64_nv(&ipif_g_seqid, 1);
12781 }
12782 
12783 /*
12784  * Insert the ipif, so that the list of ipifs on the ill will be sorted
12785  * with respect to ipif_id. Note that an ipif with an ipif_id of -1 will
12786  * be inserted into the first space available in the list. The value of
12787  * ipif_id will then be set to the appropriate value for its position.
12788  */
12789 static int
12790 ipif_insert(ipif_t *ipif, boolean_t acquire_g_lock, boolean_t acquire_ill_lock)
12791 {
12792 	ill_t *ill;
12793 	ipif_t *tipif;
12794 	ipif_t **tipifp;
12795 	int id;
12796 
12797 	ASSERT(ipif->ipif_ill->ill_net_type == IRE_LOOPBACK ||
12798 	    IAM_WRITER_IPIF(ipif));
12799 
12800 	ill = ipif->ipif_ill;
12801 	ASSERT(ill != NULL);
12802 
12803 	/*
12804 	 * In the case of lo0:0 we already hold the ill_g_lock.
12805 	 * ill_lookup_on_name (acquires ill_g_lock) -> ipif_allocate ->
12806 	 * ipif_insert. Another such caller is ipif_move.
12807 	 */
12808 	if (acquire_g_lock)
12809 		rw_enter(&ill_g_lock, RW_WRITER);
12810 	if (acquire_ill_lock)
12811 		mutex_enter(&ill->ill_lock);
12812 	id = ipif->ipif_id;
12813 	tipifp = &(ill->ill_ipif);
12814 	if (id == -1) {	/* need to find a real id */
12815 		id = 0;
12816 		while ((tipif = *tipifp) != NULL) {
12817 			ASSERT(tipif->ipif_id >= id);
12818 			if (tipif->ipif_id != id)
12819 				break; /* non-consecutive id */
12820 			id++;
12821 			tipifp = &(tipif->ipif_next);
12822 		}
12823 		/* limit number of logical interfaces */
12824 		if (id >= ip_addrs_per_if) {
12825 			if (acquire_ill_lock)
12826 				mutex_exit(&ill->ill_lock);
12827 			if (acquire_g_lock)
12828 				rw_exit(&ill_g_lock);
12829 			return (-1);
12830 		}
12831 		ipif->ipif_id = id; /* assign new id */
12832 	} else if (id < ip_addrs_per_if) {
12833 		/* we have a real id; insert ipif in the right place */
12834 		while ((tipif = *tipifp) != NULL) {
12835 			ASSERT(tipif->ipif_id != id);
12836 			if (tipif->ipif_id > id)
12837 				break; /* found correct location */
12838 			tipifp = &(tipif->ipif_next);
12839 		}
12840 	} else {
12841 		if (acquire_ill_lock)
12842 			mutex_exit(&ill->ill_lock);
12843 		if (acquire_g_lock)
12844 			rw_exit(&ill_g_lock);
12845 		return (-1);
12846 	}
12847 
12848 	ASSERT(tipifp != &(ill->ill_ipif) || id == 0);
12849 
12850 	ipif->ipif_next = tipif;
12851 	*tipifp = ipif;
12852 	if (acquire_ill_lock)
12853 		mutex_exit(&ill->ill_lock);
12854 	if (acquire_g_lock)
12855 		rw_exit(&ill_g_lock);
12856 	return (0);
12857 }
12858 
12859 /*
12860  * Allocate and initialize a new interface control structure.  (Always
12861  * called as writer.)
12862  * When ipif_allocate() is called from ip_ll_subnet_defaults, the ill
12863  * is not part of the global linked list of ills. ipif_seqid is unique
12864  * in the system and to preserve the uniqueness, it is assigned only
12865  * when ill becomes part of the global list. At that point ill will
12866  * have a name. If it doesn't get assigned here, it will get assigned
12867  * in ipif_set_values() as part of SIOCSLIFNAME processing.
12868  * Aditionally, if we come here from ip_ll_subnet_defaults, we don't set
12869  * the interface flags or any other information from the DL_INFO_ACK for
12870  * DL_STYLE2 drivers (initialize == B_FALSE), since we won't have them at
12871  * this point. The flags etc. will be set in ip_ll_subnet_defaults when the
12872  * second DL_INFO_ACK comes in from the driver.
12873  */
12874 static ipif_t *
12875 ipif_allocate(ill_t *ill, int id, uint_t ire_type, boolean_t initialize)
12876 {
12877 	ipif_t	*ipif;
12878 	phyint_t *phyi;
12879 
12880 	ip1dbg(("ipif_allocate(%s:%d ill %p)\n",
12881 	    ill->ill_name, id, (void *)ill));
12882 	ASSERT(ire_type == IRE_LOOPBACK || IAM_WRITER_ILL(ill));
12883 
12884 	if ((ipif = (ipif_t *)mi_alloc(sizeof (ipif_t), BPRI_MED)) == NULL)
12885 		return (NULL);
12886 	*ipif = ipif_zero;	/* start clean */
12887 
12888 	ipif->ipif_ill = ill;
12889 	ipif->ipif_id = id;	/* could be -1 */
12890 	ipif->ipif_zoneid = GLOBAL_ZONEID;
12891 
12892 	mutex_init(&ipif->ipif_saved_ire_lock, NULL, MUTEX_DEFAULT, NULL);
12893 
12894 	ipif->ipif_refcnt = 0;
12895 	ipif->ipif_saved_ire_cnt = 0;
12896 
12897 	if (ipif_insert(ipif, ire_type != IRE_LOOPBACK, B_TRUE)) {
12898 		mi_free(ipif);
12899 		return (NULL);
12900 	}
12901 	/* -1 id should have been replaced by real id */
12902 	id = ipif->ipif_id;
12903 	ASSERT(id >= 0);
12904 
12905 	if (ill->ill_name[0] != '\0') {
12906 		ipif_assign_seqid(ipif);
12907 		if (ill->ill_phyint->phyint_ifindex != 0)
12908 			sctp_update_ipif(ipif, SCTP_IPIF_INSERT);
12909 	}
12910 	/*
12911 	 * Keep a copy of original id in ipif_orig_ipifid.  Failback
12912 	 * will attempt to restore the original id.  The SIOCSLIFOINDEX
12913 	 * ioctl sets ipif_orig_ipifid to zero.
12914 	 */
12915 	ipif->ipif_orig_ipifid = id;
12916 
12917 	/*
12918 	 * We grab the ill_lock and phyint_lock to protect the flag changes.
12919 	 * The ipif is still not up and can't be looked up until the
12920 	 * ioctl completes and the IPIF_CHANGING flag is cleared.
12921 	 */
12922 	mutex_enter(&ill->ill_lock);
12923 	mutex_enter(&ill->ill_phyint->phyint_lock);
12924 	/*
12925 	 * Set the running flag when logical interface zero is created.
12926 	 * For subsequent logical interfaces, a DLPI link down
12927 	 * notification message may have cleared the running flag to
12928 	 * indicate the link is down, so we shouldn't just blindly set it.
12929 	 */
12930 	if (id == 0)
12931 		ill->ill_phyint->phyint_flags |= PHYI_RUNNING;
12932 	ipif->ipif_ire_type = ire_type;
12933 	phyi = ill->ill_phyint;
12934 	ipif->ipif_orig_ifindex = phyi->phyint_ifindex;
12935 
12936 	if (ipif->ipif_isv6) {
12937 		ill->ill_flags |= ILLF_IPV6;
12938 	} else {
12939 		ipaddr_t inaddr_any = INADDR_ANY;
12940 
12941 		ill->ill_flags |= ILLF_IPV4;
12942 
12943 		/* Keep the IN6_IS_ADDR_V4MAPPED assertions happy */
12944 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12945 		    &ipif->ipif_v6lcl_addr);
12946 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12947 		    &ipif->ipif_v6src_addr);
12948 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12949 		    &ipif->ipif_v6subnet);
12950 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12951 		    &ipif->ipif_v6net_mask);
12952 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12953 		    &ipif->ipif_v6brd_addr);
12954 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12955 		    &ipif->ipif_v6pp_dst_addr);
12956 	}
12957 
12958 	/*
12959 	 * Don't set the interface flags etc. now, will do it in
12960 	 * ip_ll_subnet_defaults.
12961 	 */
12962 	if (!initialize) {
12963 		mutex_exit(&ill->ill_lock);
12964 		mutex_exit(&ill->ill_phyint->phyint_lock);
12965 		return (ipif);
12966 	}
12967 	ipif->ipif_mtu = ill->ill_max_mtu;
12968 
12969 	if (ill->ill_bcast_addr_length != 0) {
12970 		/*
12971 		 * Later detect lack of DLPI driver multicast
12972 		 * capability by catching DL_ENABMULTI errors in
12973 		 * ip_rput_dlpi.
12974 		 */
12975 		ill->ill_flags |= ILLF_MULTICAST;
12976 		if (!ipif->ipif_isv6)
12977 			ipif->ipif_flags |= IPIF_BROADCAST;
12978 	} else {
12979 		if (ill->ill_net_type != IRE_LOOPBACK) {
12980 			if (ipif->ipif_isv6)
12981 				/*
12982 				 * Note: xresolv interfaces will eventually need
12983 				 * NOARP set here as well, but that will require
12984 				 * those external resolvers to have some
12985 				 * knowledge of that flag and act appropriately.
12986 				 * Not to be changed at present.
12987 				 */
12988 				ill->ill_flags |= ILLF_NONUD;
12989 			else
12990 				ill->ill_flags |= ILLF_NOARP;
12991 		}
12992 		if (ill->ill_phys_addr_length == 0) {
12993 			if (ill->ill_media &&
12994 			    ill->ill_media->ip_m_mac_type == SUNW_DL_VNI) {
12995 				ipif->ipif_flags |= IPIF_NOXMIT;
12996 				phyi->phyint_flags |= PHYI_VIRTUAL;
12997 			} else {
12998 				/* pt-pt supports multicast. */
12999 				ill->ill_flags |= ILLF_MULTICAST;
13000 				if (ill->ill_net_type == IRE_LOOPBACK) {
13001 					phyi->phyint_flags |=
13002 					    (PHYI_LOOPBACK | PHYI_VIRTUAL);
13003 				} else {
13004 					ipif->ipif_flags |= IPIF_POINTOPOINT;
13005 				}
13006 			}
13007 		}
13008 	}
13009 	mutex_exit(&ill->ill_lock);
13010 	mutex_exit(&ill->ill_phyint->phyint_lock);
13011 	return (ipif);
13012 }
13013 
13014 /*
13015  * If appropriate, send a message up to the resolver delete the entry
13016  * for the address of this interface which is going out of business.
13017  * (Always called as writer).
13018  *
13019  * NOTE : We need to check for NULL mps as some of the fields are
13020  *	  initialized only for some interface types. See ipif_resolver_up()
13021  *	  for details.
13022  */
13023 void
13024 ipif_arp_down(ipif_t *ipif)
13025 {
13026 	mblk_t	*mp;
13027 	ill_t	*ill = ipif->ipif_ill;
13028 
13029 	ip1dbg(("ipif_arp_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
13030 	ASSERT(IAM_WRITER_IPIF(ipif));
13031 
13032 	/* Delete the mapping for the local address */
13033 	mp = ipif->ipif_arp_del_mp;
13034 	if (mp != NULL) {
13035 		ip1dbg(("ipif_arp_down: arp cmd %x for %s:%u\n",
13036 		    *(unsigned *)mp->b_rptr, ill->ill_name, ipif->ipif_id));
13037 		putnext(ill->ill_rq, mp);
13038 		ipif->ipif_arp_del_mp = NULL;
13039 	}
13040 
13041 	/*
13042 	 * If this is the last ipif that is going down and there are no
13043 	 * duplicate addresses we may yet attempt to re-probe, then we need to
13044 	 * clean up ARP completely.
13045 	 */
13046 	if (ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0) {
13047 
13048 		/* Send up AR_INTERFACE_DOWN message */
13049 		mp = ill->ill_arp_down_mp;
13050 		if (mp != NULL) {
13051 			ip1dbg(("ipif_arp_down: arp cmd %x for %s:%u\n",
13052 			    *(unsigned *)mp->b_rptr, ill->ill_name,
13053 			    ipif->ipif_id));
13054 			putnext(ill->ill_rq, mp);
13055 			ill->ill_arp_down_mp = NULL;
13056 		}
13057 
13058 		/* Tell ARP to delete the multicast mappings */
13059 		mp = ill->ill_arp_del_mapping_mp;
13060 		if (mp != NULL) {
13061 			ip1dbg(("ipif_arp_down: arp cmd %x for %s:%u\n",
13062 			    *(unsigned *)mp->b_rptr, ill->ill_name,
13063 			    ipif->ipif_id));
13064 			putnext(ill->ill_rq, mp);
13065 			ill->ill_arp_del_mapping_mp = NULL;
13066 		}
13067 	}
13068 }
13069 
13070 /*
13071  * This function sets up the multicast mappings in ARP. When ipif_resolver_up
13072  * calls this function, it passes a non-NULL arp_add_mapping_mp indicating
13073  * that it wants the add_mp allocated in this function to be returned
13074  * wihtout sending it to arp. When ip_rput_dlpi_writer calls this to
13075  * just re-do the multicast, it wants us to send the add_mp to ARP also.
13076  * ipif_resolver_up does not want us to do the "add" i.e sending to ARP,
13077  * as it does a ipif_arp_down after calling this function - which will
13078  * remove what we add here.
13079  *
13080  * Returns -1 on failures and 0 on success.
13081  */
13082 int
13083 ipif_arp_setup_multicast(ipif_t *ipif, mblk_t **arp_add_mapping_mp)
13084 {
13085 	mblk_t	*del_mp = NULL;
13086 	mblk_t *add_mp = NULL;
13087 	mblk_t *mp;
13088 	ill_t	*ill = ipif->ipif_ill;
13089 	phyint_t *phyi = ill->ill_phyint;
13090 	ipaddr_t addr, mask, extract_mask = 0;
13091 	arma_t	*arma;
13092 	uint8_t *maddr, *bphys_addr;
13093 	uint32_t hw_start;
13094 	dl_unitdata_req_t *dlur;
13095 
13096 	ASSERT(IAM_WRITER_IPIF(ipif));
13097 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
13098 		return (0);
13099 
13100 	/*
13101 	 * Delete the existing mapping from ARP. Normally ipif_down
13102 	 * -> ipif_arp_down should send this up to ARP. The only
13103 	 * reason we would find this when we are switching from
13104 	 * Multicast to Broadcast where we did not do a down.
13105 	 */
13106 	mp = ill->ill_arp_del_mapping_mp;
13107 	if (mp != NULL) {
13108 		ip1dbg(("ipif_arp_down: arp cmd %x for %s:%u\n",
13109 		    *(unsigned *)mp->b_rptr, ill->ill_name, ipif->ipif_id));
13110 		putnext(ill->ill_rq, mp);
13111 		ill->ill_arp_del_mapping_mp = NULL;
13112 	}
13113 
13114 	if (arp_add_mapping_mp != NULL)
13115 		*arp_add_mapping_mp = NULL;
13116 
13117 	/*
13118 	 * Check that the address is not to long for the constant
13119 	 * length reserved in the template arma_t.
13120 	 */
13121 	if (ill->ill_phys_addr_length > IP_MAX_HW_LEN)
13122 		return (-1);
13123 
13124 	/* Add mapping mblk */
13125 	addr = (ipaddr_t)htonl(INADDR_UNSPEC_GROUP);
13126 	mask = (ipaddr_t)htonl(IN_CLASSD_NET);
13127 	add_mp = ill_arp_alloc(ill, (uchar_t *)&ip_arma_multi_template,
13128 	    (caddr_t)&addr);
13129 	if (add_mp == NULL)
13130 		return (-1);
13131 	arma = (arma_t *)add_mp->b_rptr;
13132 	maddr = (uint8_t *)arma + arma->arma_hw_addr_offset;
13133 	bcopy(&mask, (char *)arma + arma->arma_proto_mask_offset, IP_ADDR_LEN);
13134 	arma->arma_hw_addr_length = ill->ill_phys_addr_length;
13135 
13136 	/*
13137 	 * Determine the broadcast address.
13138 	 */
13139 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
13140 	if (ill->ill_sap_length < 0)
13141 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
13142 	else
13143 		bphys_addr = (uchar_t *)dlur +
13144 		    dlur->dl_dest_addr_offset + ill->ill_sap_length;
13145 	/*
13146 	 * Check PHYI_MULTI_BCAST and length of physical
13147 	 * address to determine if we use the mapping or the
13148 	 * broadcast address.
13149 	 */
13150 	if (!(phyi->phyint_flags & PHYI_MULTI_BCAST))
13151 		if (!MEDIA_V4MINFO(ill->ill_media, ill->ill_phys_addr_length,
13152 		    bphys_addr, maddr, &hw_start, &extract_mask))
13153 			phyi->phyint_flags |= PHYI_MULTI_BCAST;
13154 
13155 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) ||
13156 	    (ill->ill_flags & ILLF_MULTICAST)) {
13157 		/* Make sure this will not match the "exact" entry. */
13158 		addr = (ipaddr_t)htonl(INADDR_ALLHOSTS_GROUP);
13159 		del_mp = ill_arp_alloc(ill, (uchar_t *)&ip_ared_template,
13160 		    (caddr_t)&addr);
13161 		if (del_mp == NULL) {
13162 			freemsg(add_mp);
13163 			return (-1);
13164 		}
13165 		bcopy(&extract_mask, (char *)arma +
13166 		    arma->arma_proto_extract_mask_offset, IP_ADDR_LEN);
13167 		if (phyi->phyint_flags & PHYI_MULTI_BCAST) {
13168 			/* Use link-layer broadcast address for MULTI_BCAST */
13169 			bcopy(bphys_addr, maddr, ill->ill_phys_addr_length);
13170 			ip2dbg(("ipif_arp_setup_multicast: adding"
13171 			    " MULTI_BCAST ARP setup for %s\n", ill->ill_name));
13172 		} else {
13173 			arma->arma_hw_mapping_start = hw_start;
13174 			ip2dbg(("ipif_arp_setup_multicast: adding multicast"
13175 			    " ARP setup for %s\n", ill->ill_name));
13176 		}
13177 	} else {
13178 		freemsg(add_mp);
13179 		ASSERT(del_mp == NULL);
13180 		/* It is neither MULTICAST nor MULTI_BCAST */
13181 		return (0);
13182 	}
13183 	ASSERT(add_mp != NULL && del_mp != NULL);
13184 	ASSERT(ill->ill_arp_del_mapping_mp == NULL);
13185 	ill->ill_arp_del_mapping_mp = del_mp;
13186 	if (arp_add_mapping_mp != NULL) {
13187 		/* The caller just wants the mblks allocated */
13188 		*arp_add_mapping_mp = add_mp;
13189 	} else {
13190 		/* The caller wants us to send it to arp */
13191 		putnext(ill->ill_rq, add_mp);
13192 	}
13193 	return (0);
13194 }
13195 
13196 /*
13197  * Get the resolver set up for a new interface address.
13198  * (Always called as writer.)
13199  * Called both for IPv4 and IPv6 interfaces,
13200  * though it only sets up the resolver for v6
13201  * if it's an xresolv interface (one using an external resolver).
13202  * Honors ILLF_NOARP.
13203  * The enumerated value res_act is used to tune the behavior.
13204  * If set to Res_act_initial, then we set up all the resolver
13205  * structures for a new interface.  If set to Res_act_move, then
13206  * we just send an AR_ENTRY_ADD message up to ARP for IPv4
13207  * interfaces; this is called by ip_rput_dlpi_writer() to handle
13208  * asynchronous hardware address change notification.  If set to
13209  * Res_act_defend, then we tell ARP that it needs to send a single
13210  * gratuitous message in defense of the address.
13211  * Returns error on failure.
13212  */
13213 int
13214 ipif_resolver_up(ipif_t *ipif, enum ip_resolver_action res_act)
13215 {
13216 	caddr_t	addr;
13217 	mblk_t	*arp_up_mp = NULL;
13218 	mblk_t	*arp_down_mp = NULL;
13219 	mblk_t	*arp_add_mp = NULL;
13220 	mblk_t	*arp_del_mp = NULL;
13221 	mblk_t	*arp_add_mapping_mp = NULL;
13222 	mblk_t	*arp_del_mapping_mp = NULL;
13223 	ill_t	*ill = ipif->ipif_ill;
13224 	uchar_t	*area_p = NULL;
13225 	uchar_t	*ared_p = NULL;
13226 	int	err = ENOMEM;
13227 	boolean_t was_dup;
13228 
13229 	ip1dbg(("ipif_resolver_up(%s:%u) flags 0x%x\n",
13230 	    ill->ill_name, ipif->ipif_id, (uint_t)ipif->ipif_flags));
13231 	ASSERT(IAM_WRITER_IPIF(ipif));
13232 
13233 	was_dup = B_FALSE;
13234 	if (res_act == Res_act_initial) {
13235 		ipif->ipif_addr_ready = 0;
13236 		/*
13237 		 * We're bringing an interface up here.  There's no way that we
13238 		 * should need to shut down ARP now.
13239 		 */
13240 		mutex_enter(&ill->ill_lock);
13241 		if (ipif->ipif_flags & IPIF_DUPLICATE) {
13242 			ipif->ipif_flags &= ~IPIF_DUPLICATE;
13243 			ill->ill_ipif_dup_count--;
13244 			was_dup = B_TRUE;
13245 		}
13246 		mutex_exit(&ill->ill_lock);
13247 	}
13248 	if (ipif->ipif_recovery_id != 0)
13249 		(void) untimeout(ipif->ipif_recovery_id);
13250 	ipif->ipif_recovery_id = 0;
13251 	if (ill->ill_net_type != IRE_IF_RESOLVER) {
13252 		ipif->ipif_addr_ready = 1;
13253 		return (0);
13254 	}
13255 	/* NDP will set the ipif_addr_ready flag when it's ready */
13256 	if (ill->ill_isv6 && !(ill->ill_flags & ILLF_XRESOLV))
13257 		return (0);
13258 
13259 	if (ill->ill_isv6) {
13260 		/*
13261 		 * External resolver for IPv6
13262 		 */
13263 		ASSERT(res_act == Res_act_initial);
13264 		if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
13265 			addr = (caddr_t)&ipif->ipif_v6lcl_addr;
13266 			area_p = (uchar_t *)&ip6_area_template;
13267 			ared_p = (uchar_t *)&ip6_ared_template;
13268 		}
13269 	} else {
13270 		/*
13271 		 * IPv4 arp case. If the ARP stream has already started
13272 		 * closing, fail this request for ARP bringup. Else
13273 		 * record the fact that an ARP bringup is pending.
13274 		 */
13275 		mutex_enter(&ill->ill_lock);
13276 		if (ill->ill_arp_closing) {
13277 			mutex_exit(&ill->ill_lock);
13278 			err = EINVAL;
13279 			goto failed;
13280 		} else {
13281 			if (ill->ill_ipif_up_count == 0 &&
13282 			    ill->ill_ipif_dup_count == 0 && !was_dup)
13283 				ill->ill_arp_bringup_pending = 1;
13284 			mutex_exit(&ill->ill_lock);
13285 		}
13286 		if (ipif->ipif_lcl_addr != INADDR_ANY) {
13287 			addr = (caddr_t)&ipif->ipif_lcl_addr;
13288 			area_p = (uchar_t *)&ip_area_template;
13289 			ared_p = (uchar_t *)&ip_ared_template;
13290 		}
13291 	}
13292 
13293 	/*
13294 	 * Add an entry for the local address in ARP only if it
13295 	 * is not UNNUMBERED and the address is not INADDR_ANY.
13296 	 */
13297 	if (!(ipif->ipif_flags & IPIF_UNNUMBERED) && area_p != NULL) {
13298 		area_t *area;
13299 
13300 		/* Now ask ARP to publish our address. */
13301 		arp_add_mp = ill_arp_alloc(ill, area_p, addr);
13302 		if (arp_add_mp == NULL)
13303 			goto failed;
13304 		area = (area_t *)arp_add_mp->b_rptr;
13305 		if (res_act != Res_act_initial) {
13306 			/*
13307 			 * Copy the new hardware address and length into
13308 			 * arp_add_mp to be sent to ARP.
13309 			 */
13310 			area->area_hw_addr_length =
13311 			    ill->ill_phys_addr_length;
13312 			bcopy((char *)ill->ill_phys_addr,
13313 			    ((char *)area + area->area_hw_addr_offset),
13314 			    area->area_hw_addr_length);
13315 		}
13316 
13317 		area->area_flags = ACE_F_PERMANENT | ACE_F_PUBLISH |
13318 		    ACE_F_MYADDR;
13319 
13320 		if (res_act == Res_act_defend) {
13321 			area->area_flags |= ACE_F_DEFEND;
13322 			/*
13323 			 * If we're just defending our address now, then
13324 			 * there's no need to set up ARP multicast mappings.
13325 			 * The publish command is enough.
13326 			 */
13327 			goto done;
13328 		}
13329 
13330 		if (res_act != Res_act_initial)
13331 			goto arp_setup_multicast;
13332 
13333 		/*
13334 		 * Allocate an ARP deletion message so we know we can tell ARP
13335 		 * when the interface goes down.
13336 		 */
13337 		arp_del_mp = ill_arp_alloc(ill, ared_p, addr);
13338 		if (arp_del_mp == NULL)
13339 			goto failed;
13340 
13341 	} else {
13342 		if (res_act != Res_act_initial)
13343 			goto done;
13344 	}
13345 	/*
13346 	 * Need to bring up ARP or setup multicast mapping only
13347 	 * when the first interface is coming UP.
13348 	 */
13349 	if (ill->ill_ipif_up_count != 0 || ill->ill_ipif_dup_count != 0 ||
13350 	    was_dup) {
13351 		goto done;
13352 	}
13353 
13354 	/*
13355 	 * Allocate an ARP down message (to be saved) and an ARP up
13356 	 * message.
13357 	 */
13358 	arp_down_mp = ill_arp_alloc(ill, (uchar_t *)&ip_ard_template, 0);
13359 	if (arp_down_mp == NULL)
13360 		goto failed;
13361 
13362 	arp_up_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aru_template, 0);
13363 	if (arp_up_mp == NULL)
13364 		goto failed;
13365 
13366 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
13367 		goto done;
13368 
13369 arp_setup_multicast:
13370 	/*
13371 	 * Setup the multicast mappings. This function initializes
13372 	 * ill_arp_del_mapping_mp also. This does not need to be done for
13373 	 * IPv6.
13374 	 */
13375 	if (!ill->ill_isv6) {
13376 		err = ipif_arp_setup_multicast(ipif, &arp_add_mapping_mp);
13377 		if (err != 0)
13378 			goto failed;
13379 		ASSERT(ill->ill_arp_del_mapping_mp != NULL);
13380 		ASSERT(arp_add_mapping_mp != NULL);
13381 	}
13382 
13383 done:
13384 	if (arp_del_mp != NULL) {
13385 		ASSERT(ipif->ipif_arp_del_mp == NULL);
13386 		ipif->ipif_arp_del_mp = arp_del_mp;
13387 	}
13388 	if (arp_down_mp != NULL) {
13389 		ASSERT(ill->ill_arp_down_mp == NULL);
13390 		ill->ill_arp_down_mp = arp_down_mp;
13391 	}
13392 	if (arp_del_mapping_mp != NULL) {
13393 		ASSERT(ill->ill_arp_del_mapping_mp == NULL);
13394 		ill->ill_arp_del_mapping_mp = arp_del_mapping_mp;
13395 	}
13396 	if (arp_up_mp != NULL) {
13397 		ip1dbg(("ipif_resolver_up: ARP_UP for %s:%u\n",
13398 		    ill->ill_name, ipif->ipif_id));
13399 		putnext(ill->ill_rq, arp_up_mp);
13400 	}
13401 	if (arp_add_mp != NULL) {
13402 		ip1dbg(("ipif_resolver_up: ARP_ADD for %s:%u\n",
13403 		    ill->ill_name, ipif->ipif_id));
13404 		/*
13405 		 * If it's an extended ARP implementation, then we'll wait to
13406 		 * hear that DAD has finished before using the interface.
13407 		 */
13408 		if (!ill->ill_arp_extend)
13409 			ipif->ipif_addr_ready = 1;
13410 		putnext(ill->ill_rq, arp_add_mp);
13411 	} else {
13412 		ipif->ipif_addr_ready = 1;
13413 	}
13414 	if (arp_add_mapping_mp != NULL) {
13415 		ip1dbg(("ipif_resolver_up: MAPPING_ADD for %s:%u\n",
13416 		    ill->ill_name, ipif->ipif_id));
13417 		putnext(ill->ill_rq, arp_add_mapping_mp);
13418 	}
13419 	if (res_act != Res_act_initial)
13420 		return (0);
13421 
13422 	if (ill->ill_flags & ILLF_NOARP)
13423 		err = ill_arp_off(ill);
13424 	else
13425 		err = ill_arp_on(ill);
13426 	if (err != 0) {
13427 		ip0dbg(("ipif_resolver_up: arp_on/off failed %d\n", err));
13428 		freemsg(ipif->ipif_arp_del_mp);
13429 		freemsg(ill->ill_arp_down_mp);
13430 		freemsg(ill->ill_arp_del_mapping_mp);
13431 		ipif->ipif_arp_del_mp = NULL;
13432 		ill->ill_arp_down_mp = NULL;
13433 		ill->ill_arp_del_mapping_mp = NULL;
13434 		return (err);
13435 	}
13436 	return ((ill->ill_ipif_up_count != 0 || was_dup ||
13437 	    ill->ill_ipif_dup_count != 0) ? 0 : EINPROGRESS);
13438 
13439 failed:
13440 	ip1dbg(("ipif_resolver_up: FAILED\n"));
13441 	freemsg(arp_add_mp);
13442 	freemsg(arp_del_mp);
13443 	freemsg(arp_add_mapping_mp);
13444 	freemsg(arp_up_mp);
13445 	freemsg(arp_down_mp);
13446 	ill->ill_arp_bringup_pending = 0;
13447 	return (err);
13448 }
13449 
13450 /*
13451  * This routine restarts IPv4 duplicate address detection (DAD) when a link has
13452  * just gone back up.
13453  */
13454 static void
13455 ipif_arp_start_dad(ipif_t *ipif)
13456 {
13457 	ill_t *ill = ipif->ipif_ill;
13458 	mblk_t *arp_add_mp;
13459 	area_t *area;
13460 
13461 	if (ill->ill_net_type != IRE_IF_RESOLVER || ill->ill_arp_closing ||
13462 	    (ipif->ipif_flags & IPIF_UNNUMBERED) ||
13463 	    ipif->ipif_lcl_addr == INADDR_ANY ||
13464 	    (arp_add_mp = ill_arp_alloc(ill, (uchar_t *)&ip_area_template,
13465 	    (char *)&ipif->ipif_lcl_addr)) == NULL) {
13466 		/*
13467 		 * If we can't contact ARP for some reason, that's not really a
13468 		 * problem.  Just send out the routing socket notification that
13469 		 * DAD completion would have done, and continue.
13470 		 */
13471 		ipif_mask_reply(ipif);
13472 		ip_rts_ifmsg(ipif);
13473 		ip_rts_newaddrmsg(RTM_ADD, 0, ipif);
13474 		sctp_update_ipif(ipif, SCTP_IPIF_UP);
13475 		ipif->ipif_addr_ready = 1;
13476 		return;
13477 	}
13478 
13479 	/* Setting the 'unverified' flag restarts DAD */
13480 	area = (area_t *)arp_add_mp->b_rptr;
13481 	area->area_flags = ACE_F_PERMANENT | ACE_F_PUBLISH | ACE_F_MYADDR |
13482 	    ACE_F_UNVERIFIED;
13483 	putnext(ill->ill_rq, arp_add_mp);
13484 }
13485 
13486 static void
13487 ipif_ndp_start_dad(ipif_t *ipif)
13488 {
13489 	nce_t *nce;
13490 
13491 	nce = ndp_lookup_v6(ipif->ipif_ill, &ipif->ipif_v6lcl_addr, B_FALSE);
13492 	if (nce == NULL)
13493 		return;
13494 
13495 	if (!ndp_restart_dad(nce)) {
13496 		/*
13497 		 * If we can't restart DAD for some reason, that's not really a
13498 		 * problem.  Just send out the routing socket notification that
13499 		 * DAD completion would have done, and continue.
13500 		 */
13501 		ip_rts_ifmsg(ipif);
13502 		ip_rts_newaddrmsg(RTM_ADD, 0, ipif);
13503 		sctp_update_ipif(ipif, SCTP_IPIF_UP);
13504 		ipif->ipif_addr_ready = 1;
13505 	}
13506 	NCE_REFRELE(nce);
13507 }
13508 
13509 /*
13510  * Restart duplicate address detection on all interfaces on the given ill.
13511  *
13512  * This is called when an interface transitions from down to up
13513  * (DL_NOTE_LINK_UP) or up to down (DL_NOTE_LINK_DOWN).
13514  *
13515  * Note that since the underlying physical link has transitioned, we must cause
13516  * at least one routing socket message to be sent here, either via DAD
13517  * completion or just by default on the first ipif.  (If we don't do this, then
13518  * in.mpathd will see long delays when doing link-based failure recovery.)
13519  */
13520 void
13521 ill_restart_dad(ill_t *ill, boolean_t went_up)
13522 {
13523 	ipif_t *ipif;
13524 
13525 	if (ill == NULL)
13526 		return;
13527 
13528 	/*
13529 	 * If layer two doesn't support duplicate address detection, then just
13530 	 * send the routing socket message now and be done with it.
13531 	 */
13532 	if ((ill->ill_isv6 && (ill->ill_flags & ILLF_XRESOLV)) ||
13533 	    (!ill->ill_isv6 && !ill->ill_arp_extend)) {
13534 		ip_rts_ifmsg(ill->ill_ipif);
13535 		return;
13536 	}
13537 
13538 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13539 		if (went_up) {
13540 			if (ipif->ipif_flags & IPIF_UP) {
13541 				if (ill->ill_isv6)
13542 					ipif_ndp_start_dad(ipif);
13543 				else
13544 					ipif_arp_start_dad(ipif);
13545 			} else if (ill->ill_isv6 &&
13546 			    (ipif->ipif_flags & IPIF_DUPLICATE)) {
13547 				/*
13548 				 * For IPv4, the ARP module itself will
13549 				 * automatically start the DAD process when it
13550 				 * sees DL_NOTE_LINK_UP.  We respond to the
13551 				 * AR_CN_READY at the completion of that task.
13552 				 * For IPv6, we must kick off the bring-up
13553 				 * process now.
13554 				 */
13555 				ndp_do_recovery(ipif);
13556 			} else {
13557 				/*
13558 				 * Unfortunately, the first ipif is "special"
13559 				 * and represents the underlying ill in the
13560 				 * routing socket messages.  Thus, when this
13561 				 * one ipif is down, we must still notify so
13562 				 * that the user knows the IFF_RUNNING status
13563 				 * change.  (If the first ipif is up, then
13564 				 * we'll handle eventual routing socket
13565 				 * notification via DAD completion.)
13566 				 */
13567 				if (ipif == ill->ill_ipif)
13568 					ip_rts_ifmsg(ill->ill_ipif);
13569 			}
13570 		} else {
13571 			/*
13572 			 * After link down, we'll need to send a new routing
13573 			 * message when the link comes back, so clear
13574 			 * ipif_addr_ready.
13575 			 */
13576 			ipif->ipif_addr_ready = 0;
13577 		}
13578 	}
13579 
13580 	/*
13581 	 * If we've torn down links, then notify the user right away.
13582 	 */
13583 	if (!went_up)
13584 		ip_rts_ifmsg(ill->ill_ipif);
13585 }
13586 
13587 /*
13588  * Wakeup all threads waiting to enter the ipsq, and sleeping
13589  * on any of the ills in this ipsq. The ill_lock of the ill
13590  * must be held so that waiters don't miss wakeups
13591  */
13592 static void
13593 ill_signal_ipsq_ills(ipsq_t *ipsq, boolean_t caller_holds_lock)
13594 {
13595 	phyint_t *phyint;
13596 
13597 	phyint = ipsq->ipsq_phyint_list;
13598 	while (phyint != NULL) {
13599 		if (phyint->phyint_illv4) {
13600 			if (!caller_holds_lock)
13601 				mutex_enter(&phyint->phyint_illv4->ill_lock);
13602 			ASSERT(MUTEX_HELD(&phyint->phyint_illv4->ill_lock));
13603 			cv_broadcast(&phyint->phyint_illv4->ill_cv);
13604 			if (!caller_holds_lock)
13605 				mutex_exit(&phyint->phyint_illv4->ill_lock);
13606 		}
13607 		if (phyint->phyint_illv6) {
13608 			if (!caller_holds_lock)
13609 				mutex_enter(&phyint->phyint_illv6->ill_lock);
13610 			ASSERT(MUTEX_HELD(&phyint->phyint_illv6->ill_lock));
13611 			cv_broadcast(&phyint->phyint_illv6->ill_cv);
13612 			if (!caller_holds_lock)
13613 				mutex_exit(&phyint->phyint_illv6->ill_lock);
13614 		}
13615 		phyint = phyint->phyint_ipsq_next;
13616 	}
13617 }
13618 
13619 static ipsq_t *
13620 ipsq_create(char *groupname)
13621 {
13622 	ipsq_t	*ipsq;
13623 
13624 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
13625 	ipsq = kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP);
13626 	if (ipsq == NULL) {
13627 		return (NULL);
13628 	}
13629 
13630 	if (groupname != NULL)
13631 		(void) strcpy(ipsq->ipsq_name, groupname);
13632 	else
13633 		ipsq->ipsq_name[0] = '\0';
13634 
13635 	mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, NULL);
13636 	ipsq->ipsq_flags |= IPSQ_GROUP;
13637 	ipsq->ipsq_next = ipsq_g_head;
13638 	ipsq_g_head = ipsq;
13639 	return (ipsq);
13640 }
13641 
13642 /*
13643  * Return an ipsq correspoding to the groupname. If 'create' is true
13644  * allocate a new ipsq if one does not exist. Usually an ipsq is associated
13645  * uniquely with an IPMP group. However during IPMP groupname operations,
13646  * multiple IPMP groups may be associated with a single ipsq. But no
13647  * IPMP group can be associated with more than 1 ipsq at any time.
13648  * For example
13649  *	Interfaces		IPMP grpname	ipsq	ipsq_name      ipsq_refs
13650  * 	hme1, hme2		mpk17-84	ipsq1	mpk17-84	2
13651  *	hme3, hme4		mpk17-85	ipsq2	mpk17-85	2
13652  *
13653  * Now the command ifconfig hme3 group mpk17-84 results in the temporary
13654  * status shown below during the execution of the above command.
13655  * 	hme1, hme2, hme3, hme4	mpk17-84, mpk17-85	ipsq1	mpk17-84  4
13656  *
13657  * After the completion of the above groupname command we return to the stable
13658  * state shown below.
13659  * 	hme1, hme2, hme3	mpk17-84	ipsq1	mpk17-84	3
13660  *	hme4			mpk17-85	ipsq2	mpk17-85	1
13661  *
13662  * Because of the above, we don't search based on the ipsq_name since that
13663  * would miss the correct ipsq during certain windows as shown above.
13664  * The ipsq_name is only used during split of an ipsq to return the ipsq to its
13665  * natural state.
13666  */
13667 static ipsq_t *
13668 ip_ipsq_lookup(char *groupname, boolean_t create, ipsq_t *exclude_ipsq)
13669 {
13670 	ipsq_t	*ipsq;
13671 	int	group_len;
13672 	phyint_t *phyint;
13673 
13674 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
13675 
13676 	group_len = strlen(groupname);
13677 	ASSERT(group_len != 0);
13678 	group_len++;
13679 
13680 	for (ipsq = ipsq_g_head; ipsq != NULL; ipsq = ipsq->ipsq_next) {
13681 		/*
13682 		 * When an ipsq is being split, and ill_split_ipsq
13683 		 * calls this function, we exclude it from being considered.
13684 		 */
13685 		if (ipsq == exclude_ipsq)
13686 			continue;
13687 
13688 		/*
13689 		 * Compare against the ipsq_name. The groupname change happens
13690 		 * in 2 phases. The 1st phase merges the from group into
13691 		 * the to group's ipsq, by calling ill_merge_groups and restarts
13692 		 * the ioctl. The 2nd phase then locates the ipsq again thru
13693 		 * ipsq_name. At this point the phyint_groupname has not been
13694 		 * updated.
13695 		 */
13696 		if ((group_len == strlen(ipsq->ipsq_name) + 1) &&
13697 		    (bcmp(ipsq->ipsq_name, groupname, group_len) == 0)) {
13698 			/*
13699 			 * Verify that an ipmp groupname is exactly
13700 			 * part of 1 ipsq and is not found in any other
13701 			 * ipsq.
13702 			 */
13703 			ASSERT(ip_ipsq_lookup(groupname, B_FALSE, ipsq) ==
13704 			    NULL);
13705 			return (ipsq);
13706 		}
13707 
13708 		/*
13709 		 * Comparison against ipsq_name alone is not sufficient.
13710 		 * In the case when groups are currently being
13711 		 * merged, the ipsq could hold other IPMP groups temporarily.
13712 		 * so we walk the phyint list and compare against the
13713 		 * phyint_groupname as well.
13714 		 */
13715 		phyint = ipsq->ipsq_phyint_list;
13716 		while (phyint != NULL) {
13717 			if ((group_len == phyint->phyint_groupname_len) &&
13718 			    (bcmp(phyint->phyint_groupname, groupname,
13719 			    group_len) == 0)) {
13720 				/*
13721 				 * Verify that an ipmp groupname is exactly
13722 				 * part of 1 ipsq and is not found in any other
13723 				 * ipsq.
13724 				 */
13725 				ASSERT(ip_ipsq_lookup(groupname, B_FALSE, ipsq)
13726 					== NULL);
13727 				return (ipsq);
13728 			}
13729 			phyint = phyint->phyint_ipsq_next;
13730 		}
13731 	}
13732 	if (create)
13733 		ipsq = ipsq_create(groupname);
13734 	return (ipsq);
13735 }
13736 
13737 static void
13738 ipsq_delete(ipsq_t *ipsq)
13739 {
13740 	ipsq_t *nipsq;
13741 	ipsq_t *pipsq = NULL;
13742 
13743 	/*
13744 	 * We don't hold the ipsq lock, but we are sure no new
13745 	 * messages can land up, since the ipsq_refs is zero.
13746 	 * i.e. this ipsq is unnamed and no phyint or phyint group
13747 	 * is associated with this ipsq. (Lookups are based on ill_name
13748 	 * or phyint_group_name)
13749 	 */
13750 	ASSERT(ipsq->ipsq_refs == 0);
13751 	ASSERT(ipsq->ipsq_xopq_mphead == NULL && ipsq->ipsq_mphead == NULL);
13752 	ASSERT(ipsq->ipsq_pending_mp == NULL);
13753 	if (!(ipsq->ipsq_flags & IPSQ_GROUP)) {
13754 		/*
13755 		 * This is not the ipsq of an IPMP group.
13756 		 */
13757 		kmem_free(ipsq, sizeof (ipsq_t));
13758 		return;
13759 	}
13760 
13761 	rw_enter(&ill_g_lock, RW_WRITER);
13762 
13763 	/*
13764 	 * Locate the ipsq  before we can remove it from
13765 	 * the singly linked list of ipsq's.
13766 	 */
13767 	for (nipsq = ipsq_g_head; nipsq != NULL; nipsq = nipsq->ipsq_next) {
13768 		if (nipsq == ipsq) {
13769 			break;
13770 		}
13771 		pipsq = nipsq;
13772 	}
13773 
13774 	ASSERT(nipsq == ipsq);
13775 
13776 	/* unlink ipsq from the list */
13777 	if (pipsq != NULL)
13778 		pipsq->ipsq_next = ipsq->ipsq_next;
13779 	else
13780 		ipsq_g_head = ipsq->ipsq_next;
13781 	kmem_free(ipsq, sizeof (ipsq_t));
13782 	rw_exit(&ill_g_lock);
13783 }
13784 
13785 static void
13786 ill_move_to_new_ipsq(ipsq_t *old_ipsq, ipsq_t *new_ipsq, mblk_t *current_mp,
13787     queue_t *q)
13788 
13789 {
13790 
13791 	ASSERT(MUTEX_HELD(&new_ipsq->ipsq_lock));
13792 	ASSERT(old_ipsq->ipsq_mphead == NULL && old_ipsq->ipsq_mptail == NULL);
13793 	ASSERT(old_ipsq->ipsq_pending_ipif == NULL);
13794 	ASSERT(old_ipsq->ipsq_pending_mp == NULL);
13795 	ASSERT(current_mp != NULL);
13796 
13797 	ipsq_enq(new_ipsq, q, current_mp, (ipsq_func_t)ip_process_ioctl,
13798 		NEW_OP, NULL);
13799 
13800 	ASSERT(new_ipsq->ipsq_xopq_mptail != NULL &&
13801 	    new_ipsq->ipsq_xopq_mphead != NULL);
13802 
13803 	/*
13804 	 * move from old ipsq to the new ipsq.
13805 	 */
13806 	new_ipsq->ipsq_xopq_mptail->b_next = old_ipsq->ipsq_xopq_mphead;
13807 	if (old_ipsq->ipsq_xopq_mphead != NULL)
13808 		new_ipsq->ipsq_xopq_mptail = old_ipsq->ipsq_xopq_mptail;
13809 
13810 	old_ipsq->ipsq_xopq_mphead = old_ipsq->ipsq_xopq_mptail = NULL;
13811 }
13812 
13813 void
13814 ill_group_cleanup(ill_t *ill)
13815 {
13816 	ill_t *ill_v4;
13817 	ill_t *ill_v6;
13818 	ipif_t *ipif;
13819 
13820 	ill_v4 = ill->ill_phyint->phyint_illv4;
13821 	ill_v6 = ill->ill_phyint->phyint_illv6;
13822 
13823 	if (ill_v4 != NULL) {
13824 		mutex_enter(&ill_v4->ill_lock);
13825 		for (ipif = ill_v4->ill_ipif; ipif != NULL;
13826 		    ipif = ipif->ipif_next) {
13827 			IPIF_UNMARK_MOVING(ipif);
13828 		}
13829 		ill_v4->ill_up_ipifs = B_FALSE;
13830 		mutex_exit(&ill_v4->ill_lock);
13831 	}
13832 
13833 	if (ill_v6 != NULL) {
13834 		mutex_enter(&ill_v6->ill_lock);
13835 		for (ipif = ill_v6->ill_ipif; ipif != NULL;
13836 		    ipif = ipif->ipif_next) {
13837 			IPIF_UNMARK_MOVING(ipif);
13838 		}
13839 		ill_v6->ill_up_ipifs = B_FALSE;
13840 		mutex_exit(&ill_v6->ill_lock);
13841 	}
13842 }
13843 /*
13844  * This function is called when an ill has had a change in its group status
13845  * to bring up all the ipifs that were up before the change.
13846  */
13847 int
13848 ill_up_ipifs(ill_t *ill, queue_t *q, mblk_t *mp)
13849 {
13850 	ipif_t *ipif;
13851 	ill_t *ill_v4;
13852 	ill_t *ill_v6;
13853 	ill_t *from_ill;
13854 	int err = 0;
13855 
13856 
13857 	ASSERT(IAM_WRITER_ILL(ill));
13858 
13859 	/*
13860 	 * Except for ipif_state_flags and ill_state_flags the other
13861 	 * fields of the ipif/ill that are modified below are protected
13862 	 * implicitly since we are a writer. We would have tried to down
13863 	 * even an ipif that was already down, in ill_down_ipifs. So we
13864 	 * just blindly clear the IPIF_CHANGING flag here on all ipifs.
13865 	 */
13866 	ill_v4 = ill->ill_phyint->phyint_illv4;
13867 	ill_v6 = ill->ill_phyint->phyint_illv6;
13868 	if (ill_v4 != NULL) {
13869 		ill_v4->ill_up_ipifs = B_TRUE;
13870 		for (ipif = ill_v4->ill_ipif; ipif != NULL;
13871 		    ipif = ipif->ipif_next) {
13872 			mutex_enter(&ill_v4->ill_lock);
13873 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
13874 			IPIF_UNMARK_MOVING(ipif);
13875 			mutex_exit(&ill_v4->ill_lock);
13876 			if (ipif->ipif_was_up) {
13877 				if (!(ipif->ipif_flags & IPIF_UP))
13878 					err = ipif_up(ipif, q, mp);
13879 				ipif->ipif_was_up = B_FALSE;
13880 				if (err != 0) {
13881 					/*
13882 					 * Can there be any other error ?
13883 					 */
13884 					ASSERT(err == EINPROGRESS);
13885 					return (err);
13886 				}
13887 			}
13888 		}
13889 		mutex_enter(&ill_v4->ill_lock);
13890 		ill_v4->ill_state_flags &= ~ILL_CHANGING;
13891 		mutex_exit(&ill_v4->ill_lock);
13892 		ill_v4->ill_up_ipifs = B_FALSE;
13893 		if (ill_v4->ill_move_in_progress) {
13894 			ASSERT(ill_v4->ill_move_peer != NULL);
13895 			ill_v4->ill_move_in_progress = B_FALSE;
13896 			from_ill = ill_v4->ill_move_peer;
13897 			from_ill->ill_move_in_progress = B_FALSE;
13898 			from_ill->ill_move_peer = NULL;
13899 			mutex_enter(&from_ill->ill_lock);
13900 			from_ill->ill_state_flags &= ~ILL_CHANGING;
13901 			mutex_exit(&from_ill->ill_lock);
13902 			if (ill_v6 == NULL) {
13903 				if (from_ill->ill_phyint->phyint_flags &
13904 				    PHYI_STANDBY) {
13905 					phyint_inactive(from_ill->ill_phyint);
13906 				}
13907 				if (ill_v4->ill_phyint->phyint_flags &
13908 				    PHYI_STANDBY) {
13909 					phyint_inactive(ill_v4->ill_phyint);
13910 				}
13911 			}
13912 			ill_v4->ill_move_peer = NULL;
13913 		}
13914 	}
13915 
13916 	if (ill_v6 != NULL) {
13917 		ill_v6->ill_up_ipifs = B_TRUE;
13918 		for (ipif = ill_v6->ill_ipif; ipif != NULL;
13919 		    ipif = ipif->ipif_next) {
13920 			mutex_enter(&ill_v6->ill_lock);
13921 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
13922 			IPIF_UNMARK_MOVING(ipif);
13923 			mutex_exit(&ill_v6->ill_lock);
13924 			if (ipif->ipif_was_up) {
13925 				if (!(ipif->ipif_flags & IPIF_UP))
13926 					err = ipif_up(ipif, q, mp);
13927 				ipif->ipif_was_up = B_FALSE;
13928 				if (err != 0) {
13929 					/*
13930 					 * Can there be any other error ?
13931 					 */
13932 					ASSERT(err == EINPROGRESS);
13933 					return (err);
13934 				}
13935 			}
13936 		}
13937 		mutex_enter(&ill_v6->ill_lock);
13938 		ill_v6->ill_state_flags &= ~ILL_CHANGING;
13939 		mutex_exit(&ill_v6->ill_lock);
13940 		ill_v6->ill_up_ipifs = B_FALSE;
13941 		if (ill_v6->ill_move_in_progress) {
13942 			ASSERT(ill_v6->ill_move_peer != NULL);
13943 			ill_v6->ill_move_in_progress = B_FALSE;
13944 			from_ill = ill_v6->ill_move_peer;
13945 			from_ill->ill_move_in_progress = B_FALSE;
13946 			from_ill->ill_move_peer = NULL;
13947 			mutex_enter(&from_ill->ill_lock);
13948 			from_ill->ill_state_flags &= ~ILL_CHANGING;
13949 			mutex_exit(&from_ill->ill_lock);
13950 			if (from_ill->ill_phyint->phyint_flags & PHYI_STANDBY) {
13951 				phyint_inactive(from_ill->ill_phyint);
13952 			}
13953 			if (ill_v6->ill_phyint->phyint_flags & PHYI_STANDBY) {
13954 				phyint_inactive(ill_v6->ill_phyint);
13955 			}
13956 			ill_v6->ill_move_peer = NULL;
13957 		}
13958 	}
13959 	return (0);
13960 }
13961 
13962 /*
13963  * bring down all the approriate ipifs.
13964  */
13965 /* ARGSUSED */
13966 static void
13967 ill_down_ipifs(ill_t *ill, mblk_t *mp, int index, boolean_t chk_nofailover)
13968 {
13969 	ipif_t *ipif;
13970 
13971 	ASSERT(IAM_WRITER_ILL(ill));
13972 
13973 	/*
13974 	 * Except for ipif_state_flags the other fields of the ipif/ill that
13975 	 * are modified below are protected implicitly since we are a writer
13976 	 */
13977 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13978 		if (chk_nofailover && (ipif->ipif_flags & IPIF_NOFAILOVER))
13979 			continue;
13980 		if (index == 0 || index == ipif->ipif_orig_ifindex) {
13981 			/*
13982 			 * We go through the ipif_down logic even if the ipif
13983 			 * is already down, since routes can be added based
13984 			 * on down ipifs. Going through ipif_down once again
13985 			 * will delete any IREs created based on these routes.
13986 			 */
13987 			if (ipif->ipif_flags & IPIF_UP)
13988 				ipif->ipif_was_up = B_TRUE;
13989 			/*
13990 			 * If called with chk_nofailover true ipif is moving.
13991 			 */
13992 			mutex_enter(&ill->ill_lock);
13993 			if (chk_nofailover) {
13994 				ipif->ipif_state_flags |=
13995 					IPIF_MOVING | IPIF_CHANGING;
13996 			} else {
13997 				ipif->ipif_state_flags |= IPIF_CHANGING;
13998 			}
13999 			mutex_exit(&ill->ill_lock);
14000 			/*
14001 			 * Need to re-create net/subnet bcast ires if
14002 			 * they are dependent on ipif.
14003 			 */
14004 			if (!ipif->ipif_isv6)
14005 				ipif_check_bcast_ires(ipif);
14006 			(void) ipif_logical_down(ipif, NULL, NULL);
14007 			ipif_non_duplicate(ipif);
14008 			ipif_down_tail(ipif);
14009 			/*
14010 			 * We don't do ipif_multicast_down for IPv4 in
14011 			 * ipif_down. We need to set this so that
14012 			 * ipif_multicast_up will join the
14013 			 * ALLHOSTS_GROUP on to_ill.
14014 			 */
14015 			ipif->ipif_multicast_up = B_FALSE;
14016 		}
14017 	}
14018 }
14019 
14020 #define	IPSQ_INC_REF(ipsq)	{			\
14021 	ASSERT(RW_WRITE_HELD(&ill_g_lock));		\
14022 	(ipsq)->ipsq_refs++;				\
14023 }
14024 
14025 #define	IPSQ_DEC_REF(ipsq)	{			\
14026 	ASSERT(RW_WRITE_HELD(&ill_g_lock));		\
14027 	(ipsq)->ipsq_refs--;				\
14028 	if ((ipsq)->ipsq_refs == 0)				\
14029 		(ipsq)->ipsq_name[0] = '\0'; 		\
14030 }
14031 
14032 /*
14033  * Change the ipsq of all the ill's whose current ipsq is 'cur_ipsq' to
14034  * new_ipsq.
14035  */
14036 static void
14037 ill_merge_ipsq(ipsq_t *cur_ipsq, ipsq_t *new_ipsq)
14038 {
14039 	phyint_t *phyint;
14040 	phyint_t *next_phyint;
14041 
14042 	/*
14043 	 * To change the ipsq of an ill, we need to hold the ill_g_lock as
14044 	 * writer and the ill_lock of the ill in question. Also the dest
14045 	 * ipsq can't vanish while we hold the ill_g_lock as writer.
14046 	 */
14047 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
14048 
14049 	phyint = cur_ipsq->ipsq_phyint_list;
14050 	cur_ipsq->ipsq_phyint_list = NULL;
14051 	while (phyint != NULL) {
14052 		next_phyint = phyint->phyint_ipsq_next;
14053 		IPSQ_DEC_REF(cur_ipsq);
14054 		phyint->phyint_ipsq_next = new_ipsq->ipsq_phyint_list;
14055 		new_ipsq->ipsq_phyint_list = phyint;
14056 		IPSQ_INC_REF(new_ipsq);
14057 		phyint->phyint_ipsq = new_ipsq;
14058 		phyint = next_phyint;
14059 	}
14060 }
14061 
14062 #define	SPLIT_SUCCESS		0
14063 #define	SPLIT_NOT_NEEDED	1
14064 #define	SPLIT_FAILED		2
14065 
14066 int
14067 ill_split_to_grp_ipsq(phyint_t *phyint, ipsq_t *cur_ipsq, boolean_t need_retry)
14068 {
14069 	ipsq_t *newipsq = NULL;
14070 
14071 	/*
14072 	 * Assertions denote pre-requisites for changing the ipsq of
14073 	 * a phyint
14074 	 */
14075 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
14076 	/*
14077 	 * <ill-phyint> assocs can't change while ill_g_lock
14078 	 * is held as writer. See ill_phyint_reinit()
14079 	 */
14080 	ASSERT(phyint->phyint_illv4 == NULL ||
14081 	    MUTEX_HELD(&phyint->phyint_illv4->ill_lock));
14082 	ASSERT(phyint->phyint_illv6 == NULL ||
14083 	    MUTEX_HELD(&phyint->phyint_illv6->ill_lock));
14084 
14085 	if ((phyint->phyint_groupname_len !=
14086 	    (strlen(cur_ipsq->ipsq_name) + 1) ||
14087 	    bcmp(phyint->phyint_groupname, cur_ipsq->ipsq_name,
14088 	    phyint->phyint_groupname_len) != 0)) {
14089 		/*
14090 		 * Once we fail in creating a new ipsq due to memory shortage,
14091 		 * don't attempt to create new ipsq again, based on another
14092 		 * phyint, since we want all phyints belonging to an IPMP group
14093 		 * to be in the same ipsq even in the event of mem alloc fails.
14094 		 */
14095 		newipsq = ip_ipsq_lookup(phyint->phyint_groupname, !need_retry,
14096 		    cur_ipsq);
14097 		if (newipsq == NULL) {
14098 			/* Memory allocation failure */
14099 			return (SPLIT_FAILED);
14100 		} else {
14101 			/* ipsq_refs protected by ill_g_lock (writer) */
14102 			IPSQ_DEC_REF(cur_ipsq);
14103 			phyint->phyint_ipsq = newipsq;
14104 			phyint->phyint_ipsq_next = newipsq->ipsq_phyint_list;
14105 			newipsq->ipsq_phyint_list = phyint;
14106 			IPSQ_INC_REF(newipsq);
14107 			return (SPLIT_SUCCESS);
14108 		}
14109 	}
14110 	return (SPLIT_NOT_NEEDED);
14111 }
14112 
14113 /*
14114  * The ill locks of the phyint and the ill_g_lock (writer) must be held
14115  * to do this split
14116  */
14117 static int
14118 ill_split_to_own_ipsq(phyint_t *phyint, ipsq_t *cur_ipsq)
14119 {
14120 	ipsq_t *newipsq;
14121 
14122 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
14123 	/*
14124 	 * <ill-phyint> assocs can't change while ill_g_lock
14125 	 * is held as writer. See ill_phyint_reinit()
14126 	 */
14127 
14128 	ASSERT(phyint->phyint_illv4 == NULL ||
14129 	    MUTEX_HELD(&phyint->phyint_illv4->ill_lock));
14130 	ASSERT(phyint->phyint_illv6 == NULL ||
14131 	    MUTEX_HELD(&phyint->phyint_illv6->ill_lock));
14132 
14133 	if (!ipsq_init((phyint->phyint_illv4 != NULL) ?
14134 	    phyint->phyint_illv4: phyint->phyint_illv6)) {
14135 		/*
14136 		 * ipsq_init failed due to no memory
14137 		 * caller will use the same ipsq
14138 		 */
14139 		return (SPLIT_FAILED);
14140 	}
14141 
14142 	/* ipsq_ref is protected by ill_g_lock (writer) */
14143 	IPSQ_DEC_REF(cur_ipsq);
14144 
14145 	/*
14146 	 * This is a new ipsq that is unknown to the world.
14147 	 * So we don't need to hold ipsq_lock,
14148 	 */
14149 	newipsq = phyint->phyint_ipsq;
14150 	newipsq->ipsq_writer = NULL;
14151 	newipsq->ipsq_reentry_cnt--;
14152 	ASSERT(newipsq->ipsq_reentry_cnt == 0);
14153 #ifdef ILL_DEBUG
14154 	newipsq->ipsq_depth = 0;
14155 #endif
14156 
14157 	return (SPLIT_SUCCESS);
14158 }
14159 
14160 /*
14161  * Change the ipsq of all the ill's whose current ipsq is 'cur_ipsq' to
14162  * ipsq's representing their individual groups or themselves. Return
14163  * whether split needs to be retried again later.
14164  */
14165 static boolean_t
14166 ill_split_ipsq(ipsq_t *cur_ipsq)
14167 {
14168 	phyint_t *phyint;
14169 	phyint_t *next_phyint;
14170 	int	error;
14171 	boolean_t need_retry = B_FALSE;
14172 
14173 	phyint = cur_ipsq->ipsq_phyint_list;
14174 	cur_ipsq->ipsq_phyint_list = NULL;
14175 	while (phyint != NULL) {
14176 		next_phyint = phyint->phyint_ipsq_next;
14177 		/*
14178 		 * 'created' will tell us whether the callee actually
14179 		 * created an ipsq. Lack of memory may force the callee
14180 		 * to return without creating an ipsq.
14181 		 */
14182 		if (phyint->phyint_groupname == NULL) {
14183 			error = ill_split_to_own_ipsq(phyint, cur_ipsq);
14184 		} else {
14185 			error = ill_split_to_grp_ipsq(phyint, cur_ipsq,
14186 					need_retry);
14187 		}
14188 
14189 		switch (error) {
14190 		case SPLIT_FAILED:
14191 			need_retry = B_TRUE;
14192 			/* FALLTHRU */
14193 		case SPLIT_NOT_NEEDED:
14194 			/*
14195 			 * Keep it on the list.
14196 			 */
14197 			phyint->phyint_ipsq_next = cur_ipsq->ipsq_phyint_list;
14198 			cur_ipsq->ipsq_phyint_list = phyint;
14199 			break;
14200 		case SPLIT_SUCCESS:
14201 			break;
14202 		default:
14203 			ASSERT(0);
14204 		}
14205 
14206 		phyint = next_phyint;
14207 	}
14208 	return (need_retry);
14209 }
14210 
14211 /*
14212  * given an ipsq 'ipsq' lock all ills associated with this ipsq.
14213  * and return the ills in the list. This list will be
14214  * needed to unlock all the ills later on by the caller.
14215  * The <ill-ipsq> associations could change between the
14216  * lock and unlock. Hence the unlock can't traverse the
14217  * ipsq to get the list of ills.
14218  */
14219 static int
14220 ill_lock_ipsq_ills(ipsq_t *ipsq, ill_t **list, int list_max)
14221 {
14222 	int	cnt = 0;
14223 	phyint_t	*phyint;
14224 
14225 	/*
14226 	 * The caller holds ill_g_lock to ensure that the ill memberships
14227 	 * of the ipsq don't change
14228 	 */
14229 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
14230 
14231 	phyint = ipsq->ipsq_phyint_list;
14232 	while (phyint != NULL) {
14233 		if (phyint->phyint_illv4 != NULL) {
14234 			ASSERT(cnt < list_max);
14235 			list[cnt++] = phyint->phyint_illv4;
14236 		}
14237 		if (phyint->phyint_illv6 != NULL) {
14238 			ASSERT(cnt < list_max);
14239 			list[cnt++] = phyint->phyint_illv6;
14240 		}
14241 		phyint = phyint->phyint_ipsq_next;
14242 	}
14243 	ill_lock_ills(list, cnt);
14244 	return (cnt);
14245 }
14246 
14247 void
14248 ill_lock_ills(ill_t **list, int cnt)
14249 {
14250 	int	i;
14251 
14252 	if (cnt > 1) {
14253 		boolean_t try_again;
14254 		do {
14255 			try_again = B_FALSE;
14256 			for (i = 0; i < cnt - 1; i++) {
14257 				if (list[i] < list[i + 1]) {
14258 					ill_t	*tmp;
14259 
14260 					/* swap the elements */
14261 					tmp = list[i];
14262 					list[i] = list[i + 1];
14263 					list[i + 1] = tmp;
14264 					try_again = B_TRUE;
14265 				}
14266 			}
14267 		} while (try_again);
14268 	}
14269 
14270 	for (i = 0; i < cnt; i++) {
14271 		if (i == 0) {
14272 			if (list[i] != NULL)
14273 				mutex_enter(&list[i]->ill_lock);
14274 			else
14275 				return;
14276 		} else if ((list[i-1] != list[i]) && (list[i] != NULL)) {
14277 			mutex_enter(&list[i]->ill_lock);
14278 		}
14279 	}
14280 }
14281 
14282 void
14283 ill_unlock_ills(ill_t **list, int cnt)
14284 {
14285 	int	i;
14286 
14287 	for (i = 0; i < cnt; i++) {
14288 		if ((i == 0) && (list[i] != NULL)) {
14289 			mutex_exit(&list[i]->ill_lock);
14290 		} else if ((list[i-1] != list[i]) && (list[i] != NULL)) {
14291 			mutex_exit(&list[i]->ill_lock);
14292 		}
14293 	}
14294 }
14295 
14296 /*
14297  * Merge all the ills from 1 ipsq group into another ipsq group.
14298  * The source ipsq group is specified by the ipsq associated with
14299  * 'from_ill'. The destination ipsq group is specified by the ipsq
14300  * associated with 'to_ill' or 'groupname' respectively.
14301  * Note that ipsq itself does not have a reference count mechanism
14302  * and functions don't look up an ipsq and pass it around. Instead
14303  * functions pass around an ill or groupname, and the ipsq is looked
14304  * up from the ill or groupname and the required operation performed
14305  * atomically with the lookup on the ipsq.
14306  */
14307 static int
14308 ill_merge_groups(ill_t *from_ill, ill_t *to_ill, char *groupname, mblk_t *mp,
14309     queue_t *q)
14310 {
14311 	ipsq_t *old_ipsq;
14312 	ipsq_t *new_ipsq;
14313 	ill_t	**ill_list;
14314 	int	cnt;
14315 	size_t	ill_list_size;
14316 	boolean_t became_writer_on_new_sq = B_FALSE;
14317 
14318 	/* Exactly 1 of 'to_ill' and groupname can be specified. */
14319 	ASSERT((to_ill != NULL) ^ (groupname != NULL));
14320 
14321 	/*
14322 	 * Need to hold ill_g_lock as writer and also the ill_lock to
14323 	 * change the <ill-ipsq> assoc of an ill. Need to hold the
14324 	 * ipsq_lock to prevent new messages from landing on an ipsq.
14325 	 */
14326 	rw_enter(&ill_g_lock, RW_WRITER);
14327 
14328 	old_ipsq = from_ill->ill_phyint->phyint_ipsq;
14329 	if (groupname != NULL)
14330 		new_ipsq = ip_ipsq_lookup(groupname, B_TRUE, NULL);
14331 	else {
14332 		new_ipsq = to_ill->ill_phyint->phyint_ipsq;
14333 	}
14334 
14335 	ASSERT(old_ipsq != NULL && new_ipsq != NULL);
14336 
14337 	/*
14338 	 * both groups are on the same ipsq.
14339 	 */
14340 	if (old_ipsq == new_ipsq) {
14341 		rw_exit(&ill_g_lock);
14342 		return (0);
14343 	}
14344 
14345 	cnt = old_ipsq->ipsq_refs << 1;
14346 	ill_list_size = cnt * sizeof (ill_t *);
14347 	ill_list = kmem_zalloc(ill_list_size, KM_NOSLEEP);
14348 	if (ill_list == NULL) {
14349 		rw_exit(&ill_g_lock);
14350 		return (ENOMEM);
14351 	}
14352 	cnt = ill_lock_ipsq_ills(old_ipsq, ill_list, cnt);
14353 
14354 	/* Need ipsq lock to enque messages on new ipsq or to become writer */
14355 	mutex_enter(&new_ipsq->ipsq_lock);
14356 	if ((new_ipsq->ipsq_writer == NULL &&
14357 		new_ipsq->ipsq_current_ipif == NULL) ||
14358 	    (new_ipsq->ipsq_writer == curthread)) {
14359 		new_ipsq->ipsq_writer = curthread;
14360 		new_ipsq->ipsq_reentry_cnt++;
14361 		became_writer_on_new_sq = B_TRUE;
14362 	}
14363 
14364 	/*
14365 	 * We are holding ill_g_lock as writer and all the ill locks of
14366 	 * the old ipsq. So the old_ipsq can't be looked up, and hence no new
14367 	 * message can land up on the old ipsq even though we don't hold the
14368 	 * ipsq_lock of the old_ipsq. Now move all messages to the newipsq.
14369 	 */
14370 	ill_move_to_new_ipsq(old_ipsq, new_ipsq, mp, q);
14371 
14372 	/*
14373 	 * now change the ipsq of all ills in the 'old_ipsq' to 'new_ipsq'.
14374 	 * 'new_ipsq' has been looked up, and it can't change its <ill-ipsq>
14375 	 * assocs. till we release the ill_g_lock, and hence it can't vanish.
14376 	 */
14377 	ill_merge_ipsq(old_ipsq, new_ipsq);
14378 
14379 	/*
14380 	 * Mark the new ipsq as needing a split since it is currently
14381 	 * being shared by more than 1 IPMP group. The split will
14382 	 * occur at the end of ipsq_exit
14383 	 */
14384 	new_ipsq->ipsq_split = B_TRUE;
14385 
14386 	/* Now release all the locks */
14387 	mutex_exit(&new_ipsq->ipsq_lock);
14388 	ill_unlock_ills(ill_list, cnt);
14389 	rw_exit(&ill_g_lock);
14390 
14391 	kmem_free(ill_list, ill_list_size);
14392 
14393 	/*
14394 	 * If we succeeded in becoming writer on the new ipsq, then
14395 	 * drain the new ipsq and start processing  all enqueued messages
14396 	 * including the current ioctl we are processing which is either
14397 	 * a set groupname or failover/failback.
14398 	 */
14399 	if (became_writer_on_new_sq)
14400 		ipsq_exit(new_ipsq, B_TRUE, B_TRUE);
14401 
14402 	/*
14403 	 * syncq has been changed and all the messages have been moved.
14404 	 */
14405 	mutex_enter(&old_ipsq->ipsq_lock);
14406 	old_ipsq->ipsq_current_ipif = NULL;
14407 	mutex_exit(&old_ipsq->ipsq_lock);
14408 	return (EINPROGRESS);
14409 }
14410 
14411 /*
14412  * Delete and add the loopback copy and non-loopback copy of
14413  * the BROADCAST ire corresponding to ill and addr. Used to
14414  * group broadcast ires together when ill becomes part of
14415  * a group.
14416  *
14417  * This function is also called when ill is leaving the group
14418  * so that the ires belonging to the group gets re-grouped.
14419  */
14420 static void
14421 ill_bcast_delete_and_add(ill_t *ill, ipaddr_t addr)
14422 {
14423 	ire_t *ire, *nire, *nire_next, *ire_head = NULL;
14424 	ire_t **ire_ptpn = &ire_head;
14425 
14426 	/*
14427 	 * The loopback and non-loopback IREs are inserted in the order in which
14428 	 * they're found, on the basis that they are correctly ordered (loopback
14429 	 * first).
14430 	 */
14431 	for (;;) {
14432 		ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, ill->ill_ipif,
14433 		    ALL_ZONES, NULL, MATCH_IRE_TYPE | MATCH_IRE_ILL);
14434 		if (ire == NULL)
14435 			break;
14436 
14437 		/*
14438 		 * we are passing in KM_SLEEP because it is not easy to
14439 		 * go back to a sane state in case of memory failure.
14440 		 */
14441 		nire = kmem_cache_alloc(ire_cache, KM_SLEEP);
14442 		ASSERT(nire != NULL);
14443 		bzero(nire, sizeof (ire_t));
14444 		/*
14445 		 * Don't use ire_max_frag directly since we don't
14446 		 * hold on to 'ire' until we add the new ire 'nire' and
14447 		 * we don't want the new ire to have a dangling reference
14448 		 * to 'ire'. The ire_max_frag of a broadcast ire must
14449 		 * be in sync with the ipif_mtu of the associate ipif.
14450 		 * For eg. this happens as a result of SIOCSLIFNAME,
14451 		 * SIOCSLIFLNKINFO or a DL_NOTE_SDU_SIZE inititated by
14452 		 * the driver. A change in ire_max_frag triggered as
14453 		 * as a result of path mtu discovery, or due to an
14454 		 * IP_IOC_IRE_ADVISE_NOREPLY from the transport or due a
14455 		 * route change -mtu command does not apply to broadcast ires.
14456 		 *
14457 		 * XXX We need a recovery strategy here if ire_init fails
14458 		 */
14459 		if (ire_init(nire,
14460 		    (uchar_t *)&ire->ire_addr,
14461 		    (uchar_t *)&ire->ire_mask,
14462 		    (uchar_t *)&ire->ire_src_addr,
14463 		    (uchar_t *)&ire->ire_gateway_addr,
14464 		    (uchar_t *)&ire->ire_in_src_addr,
14465 		    ire->ire_stq == NULL ? &ip_loopback_mtu :
14466 			&ire->ire_ipif->ipif_mtu,
14467 		    (ire->ire_nce != NULL ? ire->ire_nce->nce_fp_mp : NULL),
14468 		    ire->ire_rfq,
14469 		    ire->ire_stq,
14470 		    ire->ire_type,
14471 		    (ire->ire_nce != NULL? ire->ire_nce->nce_res_mp : NULL),
14472 		    ire->ire_ipif,
14473 		    ire->ire_in_ill,
14474 		    ire->ire_cmask,
14475 		    ire->ire_phandle,
14476 		    ire->ire_ihandle,
14477 		    ire->ire_flags,
14478 		    &ire->ire_uinfo,
14479 		    NULL,
14480 		    NULL) == NULL) {
14481 			cmn_err(CE_PANIC, "ire_init() failed");
14482 		}
14483 		ire_delete(ire);
14484 		ire_refrele(ire);
14485 
14486 		/*
14487 		 * The newly created IREs are inserted at the tail of the list
14488 		 * starting with ire_head. As we've just allocated them no one
14489 		 * knows about them so it's safe.
14490 		 */
14491 		*ire_ptpn = nire;
14492 		ire_ptpn = &nire->ire_next;
14493 	}
14494 
14495 	for (nire = ire_head; nire != NULL; nire = nire_next) {
14496 		int error;
14497 		ire_t *oire;
14498 		/* unlink the IRE from our list before calling ire_add() */
14499 		nire_next = nire->ire_next;
14500 		nire->ire_next = NULL;
14501 
14502 		/* ire_add adds the ire at the right place in the list */
14503 		oire = nire;
14504 		error = ire_add(&nire, NULL, NULL, NULL, B_FALSE);
14505 		ASSERT(error == 0);
14506 		ASSERT(oire == nire);
14507 		ire_refrele(nire);	/* Held in ire_add */
14508 	}
14509 }
14510 
14511 /*
14512  * This function is usually called when an ill is inserted in
14513  * a group and all the ipifs are already UP. As all the ipifs
14514  * are already UP, the broadcast ires have already been created
14515  * and been inserted. But, ire_add_v4 would not have grouped properly.
14516  * We need to re-group for the benefit of ip_wput_ire which
14517  * expects BROADCAST ires to be grouped properly to avoid sending
14518  * more than one copy of the broadcast packet per group.
14519  *
14520  * NOTE : We don't check for ill_ipif_up_count to be non-zero here
14521  *	  because when ipif_up_done ends up calling this, ires have
14522  *        already been added before illgrp_insert i.e before ill_group
14523  *	  has been initialized.
14524  */
14525 static void
14526 ill_group_bcast_for_xmit(ill_t *ill)
14527 {
14528 	ill_group_t *illgrp;
14529 	ipif_t *ipif;
14530 	ipaddr_t addr;
14531 	ipaddr_t net_mask;
14532 	ipaddr_t subnet_netmask;
14533 
14534 	illgrp = ill->ill_group;
14535 
14536 	/*
14537 	 * This function is called even when an ill is deleted from
14538 	 * the group. Hence, illgrp could be null.
14539 	 */
14540 	if (illgrp != NULL && illgrp->illgrp_ill_count == 1)
14541 		return;
14542 
14543 	/*
14544 	 * Delete all the BROADCAST ires matching this ill and add
14545 	 * them back. This time, ire_add_v4 should take care of
14546 	 * grouping them with others because ill is part of the
14547 	 * group.
14548 	 */
14549 	ill_bcast_delete_and_add(ill, 0);
14550 	ill_bcast_delete_and_add(ill, INADDR_BROADCAST);
14551 
14552 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
14553 
14554 		if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14555 		    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14556 			net_mask = ip_net_mask(ipif->ipif_lcl_addr);
14557 		} else {
14558 			net_mask = htonl(IN_CLASSA_NET);
14559 		}
14560 		addr = net_mask & ipif->ipif_subnet;
14561 		ill_bcast_delete_and_add(ill, addr);
14562 		ill_bcast_delete_and_add(ill, ~net_mask | addr);
14563 
14564 		subnet_netmask = ipif->ipif_net_mask;
14565 		addr = ipif->ipif_subnet;
14566 		ill_bcast_delete_and_add(ill, addr);
14567 		ill_bcast_delete_and_add(ill, ~subnet_netmask | addr);
14568 	}
14569 }
14570 
14571 /*
14572  * This function is called from illgrp_delete when ill is being deleted
14573  * from the group.
14574  *
14575  * As ill is not there in the group anymore, any address belonging
14576  * to this ill should be cleared of IRE_MARK_NORECV.
14577  */
14578 static void
14579 ill_clear_bcast_mark(ill_t *ill, ipaddr_t addr)
14580 {
14581 	ire_t *ire;
14582 	irb_t *irb;
14583 
14584 	ASSERT(ill->ill_group == NULL);
14585 
14586 	ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, ill->ill_ipif,
14587 	    ALL_ZONES, NULL, MATCH_IRE_TYPE | MATCH_IRE_ILL);
14588 
14589 	if (ire != NULL) {
14590 		/*
14591 		 * IPMP and plumbing operations are serialized on the ipsq, so
14592 		 * no one will insert or delete a broadcast ire under our feet.
14593 		 */
14594 		irb = ire->ire_bucket;
14595 		rw_enter(&irb->irb_lock, RW_READER);
14596 		ire_refrele(ire);
14597 
14598 		for (; ire != NULL; ire = ire->ire_next) {
14599 			if (ire->ire_addr != addr)
14600 				break;
14601 			if (ire_to_ill(ire) != ill)
14602 				continue;
14603 
14604 			ASSERT(!(ire->ire_marks & IRE_MARK_CONDEMNED));
14605 			ire->ire_marks &= ~IRE_MARK_NORECV;
14606 		}
14607 		rw_exit(&irb->irb_lock);
14608 	}
14609 }
14610 
14611 /*
14612  * This function must be called only after the broadcast ires
14613  * have been grouped together. For a given address addr, nominate
14614  * only one of the ires whose interface is not FAILED or OFFLINE.
14615  *
14616  * This is also called when an ipif goes down, so that we can nominate
14617  * a different ire with the same address for receiving.
14618  */
14619 static void
14620 ill_mark_bcast(ill_group_t *illgrp, ipaddr_t addr)
14621 {
14622 	irb_t *irb;
14623 	ire_t *ire;
14624 	ire_t *ire1;
14625 	ire_t *save_ire;
14626 	ire_t **irep = NULL;
14627 	boolean_t first = B_TRUE;
14628 	ire_t *clear_ire = NULL;
14629 	ire_t *start_ire = NULL;
14630 	ire_t	*new_lb_ire;
14631 	ire_t	*new_nlb_ire;
14632 	boolean_t new_lb_ire_used = B_FALSE;
14633 	boolean_t new_nlb_ire_used = B_FALSE;
14634 	uint64_t match_flags;
14635 	uint64_t phyi_flags;
14636 	boolean_t fallback = B_FALSE;
14637 
14638 	ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, NULL, ALL_ZONES,
14639 	    NULL, MATCH_IRE_TYPE);
14640 	/*
14641 	 * We may not be able to find some ires if a previous
14642 	 * ire_create failed. This happens when an ipif goes
14643 	 * down and we are unable to create BROADCAST ires due
14644 	 * to memory failure. Thus, we have to check for NULL
14645 	 * below. This should handle the case for LOOPBACK,
14646 	 * POINTOPOINT and interfaces with some POINTOPOINT
14647 	 * logicals for which there are no BROADCAST ires.
14648 	 */
14649 	if (ire == NULL)
14650 		return;
14651 	/*
14652 	 * Currently IRE_BROADCASTS are deleted when an ipif
14653 	 * goes down which runs exclusively. Thus, setting
14654 	 * IRE_MARK_RCVD should not race with ire_delete marking
14655 	 * IRE_MARK_CONDEMNED. We grab the lock below just to
14656 	 * be consistent with other parts of the code that walks
14657 	 * a given bucket.
14658 	 */
14659 	save_ire = ire;
14660 	irb = ire->ire_bucket;
14661 	new_lb_ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
14662 	if (new_lb_ire == NULL) {
14663 		ire_refrele(ire);
14664 		return;
14665 	}
14666 	new_nlb_ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
14667 	if (new_nlb_ire == NULL) {
14668 		ire_refrele(ire);
14669 		kmem_cache_free(ire_cache, new_lb_ire);
14670 		return;
14671 	}
14672 	IRB_REFHOLD(irb);
14673 	rw_enter(&irb->irb_lock, RW_WRITER);
14674 	/*
14675 	 * Get to the first ire matching the address and the
14676 	 * group. If the address does not match we are done
14677 	 * as we could not find the IRE. If the address matches
14678 	 * we should get to the first one matching the group.
14679 	 */
14680 	while (ire != NULL) {
14681 		if (ire->ire_addr != addr ||
14682 		    ire->ire_ipif->ipif_ill->ill_group == illgrp) {
14683 			break;
14684 		}
14685 		ire = ire->ire_next;
14686 	}
14687 	match_flags = PHYI_FAILED | PHYI_INACTIVE;
14688 	start_ire = ire;
14689 redo:
14690 	while (ire != NULL && ire->ire_addr == addr &&
14691 	    ire->ire_ipif->ipif_ill->ill_group == illgrp) {
14692 		/*
14693 		 * The first ire for any address within a group
14694 		 * should always be the one with IRE_MARK_NORECV cleared
14695 		 * so that ip_wput_ire can avoid searching for one.
14696 		 * Note down the insertion point which will be used
14697 		 * later.
14698 		 */
14699 		if (first && (irep == NULL))
14700 			irep = ire->ire_ptpn;
14701 		/*
14702 		 * PHYI_FAILED is set when the interface fails.
14703 		 * This interface might have become good, but the
14704 		 * daemon has not yet detected. We should still
14705 		 * not receive on this. PHYI_OFFLINE should never
14706 		 * be picked as this has been offlined and soon
14707 		 * be removed.
14708 		 */
14709 		phyi_flags = ire->ire_ipif->ipif_ill->ill_phyint->phyint_flags;
14710 		if (phyi_flags & PHYI_OFFLINE) {
14711 			ire->ire_marks |= IRE_MARK_NORECV;
14712 			ire = ire->ire_next;
14713 			continue;
14714 		}
14715 		if (phyi_flags & match_flags) {
14716 			ire->ire_marks |= IRE_MARK_NORECV;
14717 			ire = ire->ire_next;
14718 			if ((phyi_flags & (PHYI_FAILED | PHYI_INACTIVE)) ==
14719 			    PHYI_INACTIVE) {
14720 				fallback = B_TRUE;
14721 			}
14722 			continue;
14723 		}
14724 		if (first) {
14725 			/*
14726 			 * We will move this to the front of the list later
14727 			 * on.
14728 			 */
14729 			clear_ire = ire;
14730 			ire->ire_marks &= ~IRE_MARK_NORECV;
14731 		} else {
14732 			ire->ire_marks |= IRE_MARK_NORECV;
14733 		}
14734 		first = B_FALSE;
14735 		ire = ire->ire_next;
14736 	}
14737 	/*
14738 	 * If we never nominated anybody, try nominating at least
14739 	 * an INACTIVE, if we found one. Do it only once though.
14740 	 */
14741 	if (first && (match_flags == (PHYI_FAILED | PHYI_INACTIVE)) &&
14742 	    fallback) {
14743 		match_flags = PHYI_FAILED;
14744 		ire = start_ire;
14745 		irep = NULL;
14746 		goto redo;
14747 	}
14748 	ire_refrele(save_ire);
14749 
14750 	/*
14751 	 * irep non-NULL indicates that we entered the while loop
14752 	 * above. If clear_ire is at the insertion point, we don't
14753 	 * have to do anything. clear_ire will be NULL if all the
14754 	 * interfaces are failed.
14755 	 *
14756 	 * We cannot unlink and reinsert the ire at the right place
14757 	 * in the list since there can be other walkers of this bucket.
14758 	 * Instead we delete and recreate the ire
14759 	 */
14760 	if (clear_ire != NULL && irep != NULL && *irep != clear_ire) {
14761 		ire_t *clear_ire_stq = NULL;
14762 		mblk_t *fp_mp = NULL, *res_mp = NULL;
14763 
14764 		bzero(new_lb_ire, sizeof (ire_t));
14765 		if (clear_ire->ire_nce != NULL) {
14766 			fp_mp = clear_ire->ire_nce->nce_fp_mp;
14767 			res_mp = clear_ire->ire_nce->nce_res_mp;
14768 		}
14769 		/* XXX We need a recovery strategy here. */
14770 		if (ire_init(new_lb_ire,
14771 		    (uchar_t *)&clear_ire->ire_addr,
14772 		    (uchar_t *)&clear_ire->ire_mask,
14773 		    (uchar_t *)&clear_ire->ire_src_addr,
14774 		    (uchar_t *)&clear_ire->ire_gateway_addr,
14775 		    (uchar_t *)&clear_ire->ire_in_src_addr,
14776 		    &clear_ire->ire_max_frag,
14777 		    fp_mp,
14778 		    clear_ire->ire_rfq,
14779 		    clear_ire->ire_stq,
14780 		    clear_ire->ire_type,
14781 		    res_mp,
14782 		    clear_ire->ire_ipif,
14783 		    clear_ire->ire_in_ill,
14784 		    clear_ire->ire_cmask,
14785 		    clear_ire->ire_phandle,
14786 		    clear_ire->ire_ihandle,
14787 		    clear_ire->ire_flags,
14788 		    &clear_ire->ire_uinfo,
14789 		    NULL,
14790 		    NULL) == NULL)
14791 			cmn_err(CE_PANIC, "ire_init() failed");
14792 		if (clear_ire->ire_stq == NULL) {
14793 			ire_t *ire_next = clear_ire->ire_next;
14794 			if (ire_next != NULL &&
14795 			    ire_next->ire_stq != NULL &&
14796 			    ire_next->ire_addr == clear_ire->ire_addr &&
14797 			    ire_next->ire_ipif->ipif_ill ==
14798 			    clear_ire->ire_ipif->ipif_ill) {
14799 				clear_ire_stq = ire_next;
14800 
14801 				bzero(new_nlb_ire, sizeof (ire_t));
14802 				if (clear_ire_stq->ire_nce != NULL) {
14803 					fp_mp =
14804 					    clear_ire_stq->ire_nce->nce_fp_mp;
14805 					res_mp =
14806 					    clear_ire_stq->ire_nce->nce_res_mp;
14807 				} else {
14808 					fp_mp = res_mp = NULL;
14809 				}
14810 				/* XXX We need a recovery strategy here. */
14811 				if (ire_init(new_nlb_ire,
14812 				    (uchar_t *)&clear_ire_stq->ire_addr,
14813 				    (uchar_t *)&clear_ire_stq->ire_mask,
14814 				    (uchar_t *)&clear_ire_stq->ire_src_addr,
14815 				    (uchar_t *)&clear_ire_stq->ire_gateway_addr,
14816 				    (uchar_t *)&clear_ire_stq->ire_in_src_addr,
14817 				    &clear_ire_stq->ire_max_frag,
14818 				    fp_mp,
14819 				    clear_ire_stq->ire_rfq,
14820 				    clear_ire_stq->ire_stq,
14821 				    clear_ire_stq->ire_type,
14822 				    res_mp,
14823 				    clear_ire_stq->ire_ipif,
14824 				    clear_ire_stq->ire_in_ill,
14825 				    clear_ire_stq->ire_cmask,
14826 				    clear_ire_stq->ire_phandle,
14827 				    clear_ire_stq->ire_ihandle,
14828 				    clear_ire_stq->ire_flags,
14829 				    &clear_ire_stq->ire_uinfo,
14830 				    NULL,
14831 				    NULL) == NULL)
14832 					cmn_err(CE_PANIC, "ire_init() failed");
14833 			}
14834 		}
14835 
14836 		/*
14837 		 * Delete the ire. We can't call ire_delete() since
14838 		 * we are holding the bucket lock. We can't release the
14839 		 * bucket lock since we can't allow irep to change. So just
14840 		 * mark it CONDEMNED. The IRB_REFRELE will delete the
14841 		 * ire from the list and do the refrele.
14842 		 */
14843 		clear_ire->ire_marks |= IRE_MARK_CONDEMNED;
14844 		irb->irb_marks |= IRB_MARK_CONDEMNED;
14845 
14846 		if (clear_ire_stq != NULL) {
14847 			ire_fastpath_list_delete(
14848 			    (ill_t *)clear_ire_stq->ire_stq->q_ptr,
14849 			    clear_ire_stq);
14850 			clear_ire_stq->ire_marks |= IRE_MARK_CONDEMNED;
14851 		}
14852 
14853 		/*
14854 		 * Also take care of otherfields like ib/ob pkt count
14855 		 * etc. Need to dup them. ditto in ill_bcast_delete_and_add
14856 		 */
14857 
14858 		/* Add the new ire's. Insert at *irep */
14859 		new_lb_ire->ire_bucket = clear_ire->ire_bucket;
14860 		ire1 = *irep;
14861 		if (ire1 != NULL)
14862 			ire1->ire_ptpn = &new_lb_ire->ire_next;
14863 		new_lb_ire->ire_next = ire1;
14864 		/* Link the new one in. */
14865 		new_lb_ire->ire_ptpn = irep;
14866 		membar_producer();
14867 		*irep = new_lb_ire;
14868 		new_lb_ire_used = B_TRUE;
14869 		BUMP_IRE_STATS(ire_stats_v4, ire_stats_inserted);
14870 		new_lb_ire->ire_bucket->irb_ire_cnt++;
14871 		new_lb_ire->ire_ipif->ipif_ire_cnt++;
14872 
14873 		if (clear_ire_stq != NULL) {
14874 			new_nlb_ire->ire_bucket = clear_ire->ire_bucket;
14875 			irep = &new_lb_ire->ire_next;
14876 			/* Add the new ire. Insert at *irep */
14877 			ire1 = *irep;
14878 			if (ire1 != NULL)
14879 				ire1->ire_ptpn = &new_nlb_ire->ire_next;
14880 			new_nlb_ire->ire_next = ire1;
14881 			/* Link the new one in. */
14882 			new_nlb_ire->ire_ptpn = irep;
14883 			membar_producer();
14884 			*irep = new_nlb_ire;
14885 			new_nlb_ire_used = B_TRUE;
14886 			BUMP_IRE_STATS(ire_stats_v4, ire_stats_inserted);
14887 			new_nlb_ire->ire_bucket->irb_ire_cnt++;
14888 			new_nlb_ire->ire_ipif->ipif_ire_cnt++;
14889 			((ill_t *)new_nlb_ire->ire_stq->q_ptr)->ill_ire_cnt++;
14890 		}
14891 	}
14892 	rw_exit(&irb->irb_lock);
14893 	if (!new_lb_ire_used)
14894 		kmem_cache_free(ire_cache, new_lb_ire);
14895 	if (!new_nlb_ire_used)
14896 		kmem_cache_free(ire_cache, new_nlb_ire);
14897 	IRB_REFRELE(irb);
14898 }
14899 
14900 /*
14901  * Whenever an ipif goes down we have to renominate a different
14902  * broadcast ire to receive. Whenever an ipif comes up, we need
14903  * to make sure that we have only one nominated to receive.
14904  */
14905 static void
14906 ipif_renominate_bcast(ipif_t *ipif)
14907 {
14908 	ill_t *ill = ipif->ipif_ill;
14909 	ipaddr_t subnet_addr;
14910 	ipaddr_t net_addr;
14911 	ipaddr_t net_mask = 0;
14912 	ipaddr_t subnet_netmask;
14913 	ipaddr_t addr;
14914 	ill_group_t *illgrp;
14915 
14916 	illgrp = ill->ill_group;
14917 	/*
14918 	 * If this is the last ipif going down, it might take
14919 	 * the ill out of the group. In that case ipif_down ->
14920 	 * illgrp_delete takes care of doing the nomination.
14921 	 * ipif_down does not call for this case.
14922 	 */
14923 	ASSERT(illgrp != NULL);
14924 
14925 	/* There could not have been any ires associated with this */
14926 	if (ipif->ipif_subnet == 0)
14927 		return;
14928 
14929 	ill_mark_bcast(illgrp, 0);
14930 	ill_mark_bcast(illgrp, INADDR_BROADCAST);
14931 
14932 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14933 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14934 		net_mask = ip_net_mask(ipif->ipif_lcl_addr);
14935 	} else {
14936 		net_mask = htonl(IN_CLASSA_NET);
14937 	}
14938 	addr = net_mask & ipif->ipif_subnet;
14939 	ill_mark_bcast(illgrp, addr);
14940 
14941 	net_addr = ~net_mask | addr;
14942 	ill_mark_bcast(illgrp, net_addr);
14943 
14944 	subnet_netmask = ipif->ipif_net_mask;
14945 	addr = ipif->ipif_subnet;
14946 	ill_mark_bcast(illgrp, addr);
14947 
14948 	subnet_addr = ~subnet_netmask | addr;
14949 	ill_mark_bcast(illgrp, subnet_addr);
14950 }
14951 
14952 /*
14953  * Whenever we form or delete ill groups, we need to nominate one set of
14954  * BROADCAST ires for receiving in the group.
14955  *
14956  * 1) When ipif_up_done -> ilgrp_insert calls this function, BROADCAST ires
14957  *    have been added, but ill_ipif_up_count is 0. Thus, we don't assert
14958  *    for ill_ipif_up_count to be non-zero. This is the only case where
14959  *    ill_ipif_up_count is zero and we would still find the ires.
14960  *
14961  * 2) ip_sioctl_group_name/ifgrp_insert calls this function, at least one
14962  *    ipif is UP and we just have to do the nomination.
14963  *
14964  * 3) When ill_handoff_responsibility calls us, some ill has been removed
14965  *    from the group. So, we have to do the nomination.
14966  *
14967  * Because of (3), there could be just one ill in the group. But we have
14968  * to nominate still as IRE_MARK_NORCV may have been marked on this.
14969  * Thus, this function does not optimize when there is only one ill as
14970  * it is not correct for (3).
14971  */
14972 static void
14973 ill_nominate_bcast_rcv(ill_group_t *illgrp)
14974 {
14975 	ill_t *ill;
14976 	ipif_t *ipif;
14977 	ipaddr_t subnet_addr;
14978 	ipaddr_t prev_subnet_addr = 0;
14979 	ipaddr_t net_addr;
14980 	ipaddr_t prev_net_addr = 0;
14981 	ipaddr_t net_mask = 0;
14982 	ipaddr_t subnet_netmask;
14983 	ipaddr_t addr;
14984 
14985 	/*
14986 	 * When the last memeber is leaving, there is nothing to
14987 	 * nominate.
14988 	 */
14989 	if (illgrp->illgrp_ill_count == 0) {
14990 		ASSERT(illgrp->illgrp_ill == NULL);
14991 		return;
14992 	}
14993 
14994 	ill = illgrp->illgrp_ill;
14995 	ASSERT(!ill->ill_isv6);
14996 	/*
14997 	 * We assume that ires with same address and belonging to the
14998 	 * same group, has been grouped together. Nominating a *single*
14999 	 * ill in the group for sending and receiving broadcast is done
15000 	 * by making sure that the first BROADCAST ire (which will be
15001 	 * the one returned by ire_ctable_lookup for ip_rput and the
15002 	 * one that will be used in ip_wput_ire) will be the one that
15003 	 * will not have IRE_MARK_NORECV set.
15004 	 *
15005 	 * 1) ip_rput checks and discards packets received on ires marked
15006 	 *    with IRE_MARK_NORECV. Thus, we don't send up duplicate
15007 	 *    broadcast packets. We need to clear IRE_MARK_NORECV on the
15008 	 *    first ire in the group for every broadcast address in the group.
15009 	 *    ip_rput will accept packets only on the first ire i.e only
15010 	 *    one copy of the ill.
15011 	 *
15012 	 * 2) ip_wput_ire needs to send out just one copy of the broadcast
15013 	 *    packet for the whole group. It needs to send out on the ill
15014 	 *    whose ire has not been marked with IRE_MARK_NORECV. If it sends
15015 	 *    on the one marked with IRE_MARK_NORECV, ip_rput will accept
15016 	 *    the copy echoed back on other port where the ire is not marked
15017 	 *    with IRE_MARK_NORECV.
15018 	 *
15019 	 * Note that we just need to have the first IRE either loopback or
15020 	 * non-loopback (either of them may not exist if ire_create failed
15021 	 * during ipif_down) with IRE_MARK_NORECV not set. ip_rput will
15022 	 * always hit the first one and hence will always accept one copy.
15023 	 *
15024 	 * We have a broadcast ire per ill for all the unique prefixes
15025 	 * hosted on that ill. As we don't have a way of knowing the
15026 	 * unique prefixes on a given ill and hence in the whole group,
15027 	 * we just call ill_mark_bcast on all the prefixes that exist
15028 	 * in the group. For the common case of one prefix, the code
15029 	 * below optimizes by remebering the last address used for
15030 	 * markng. In the case of multiple prefixes, this will still
15031 	 * optimize depending the order of prefixes.
15032 	 *
15033 	 * The only unique address across the whole group is 0.0.0.0 and
15034 	 * 255.255.255.255 and thus we call only once. ill_mark_bcast enables
15035 	 * the first ire in the bucket for receiving and disables the
15036 	 * others.
15037 	 */
15038 	ill_mark_bcast(illgrp, 0);
15039 	ill_mark_bcast(illgrp, INADDR_BROADCAST);
15040 	for (; ill != NULL; ill = ill->ill_group_next) {
15041 
15042 		for (ipif = ill->ill_ipif; ipif != NULL;
15043 		    ipif = ipif->ipif_next) {
15044 
15045 			if (!(ipif->ipif_flags & IPIF_UP) ||
15046 			    ipif->ipif_subnet == 0) {
15047 				continue;
15048 			}
15049 			if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
15050 			    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
15051 				net_mask = ip_net_mask(ipif->ipif_lcl_addr);
15052 			} else {
15053 				net_mask = htonl(IN_CLASSA_NET);
15054 			}
15055 			addr = net_mask & ipif->ipif_subnet;
15056 			if (prev_net_addr == 0 || prev_net_addr != addr) {
15057 				ill_mark_bcast(illgrp, addr);
15058 				net_addr = ~net_mask | addr;
15059 				ill_mark_bcast(illgrp, net_addr);
15060 			}
15061 			prev_net_addr = addr;
15062 
15063 			subnet_netmask = ipif->ipif_net_mask;
15064 			addr = ipif->ipif_subnet;
15065 			if (prev_subnet_addr == 0 ||
15066 			    prev_subnet_addr != addr) {
15067 				ill_mark_bcast(illgrp, addr);
15068 				subnet_addr = ~subnet_netmask | addr;
15069 				ill_mark_bcast(illgrp, subnet_addr);
15070 			}
15071 			prev_subnet_addr = addr;
15072 		}
15073 	}
15074 }
15075 
15076 /*
15077  * This function is called while forming ill groups.
15078  *
15079  * Currently, we handle only allmulti groups. We want to join
15080  * allmulti on only one of the ills in the groups. In future,
15081  * when we have link aggregation, we may have to join normal
15082  * multicast groups on multiple ills as switch does inbound load
15083  * balancing. Following are the functions that calls this
15084  * function :
15085  *
15086  * 1) ill_recover_multicast : Interface is coming back UP.
15087  *    When the first ipif comes back UP, ipif_up_done/ipif_up_done_v6
15088  *    will call ill_recover_multicast to recover all the multicast
15089  *    groups. We need to make sure that only one member is joined
15090  *    in the ill group.
15091  *
15092  * 2) ip_addmulti/ip_addmulti_v6 : ill groups has already been formed.
15093  *    Somebody is joining allmulti. We need to make sure that only one
15094  *    member is joined in the group.
15095  *
15096  * 3) illgrp_insert : If allmulti has already joined, we need to make
15097  *    sure that only one member is joined in the group.
15098  *
15099  * 4) ip_delmulti/ip_delmulti_v6 : Somebody in the group is leaving
15100  *    allmulti who we have nominated. We need to pick someother ill.
15101  *
15102  * 5) illgrp_delete : The ill we nominated is leaving the group,
15103  *    we need to pick a new ill to join the group.
15104  *
15105  * For (1), (2), (5) - we just have to check whether there is
15106  * a good ill joined in the group. If we could not find any ills
15107  * joined the group, we should join.
15108  *
15109  * For (4), the one that was nominated to receive, left the group.
15110  * There could be nobody joined in the group when this function is
15111  * called.
15112  *
15113  * For (3) - we need to explicitly check whether there are multiple
15114  * ills joined in the group.
15115  *
15116  * For simplicity, we don't differentiate any of the above cases. We
15117  * just leave the group if it is joined on any of them and join on
15118  * the first good ill.
15119  */
15120 int
15121 ill_nominate_mcast_rcv(ill_group_t *illgrp)
15122 {
15123 	ilm_t *ilm;
15124 	ill_t *ill;
15125 	ill_t *fallback_inactive_ill = NULL;
15126 	ill_t *fallback_failed_ill = NULL;
15127 	int ret = 0;
15128 
15129 	/*
15130 	 * Leave the allmulti on all the ills and start fresh.
15131 	 */
15132 	for (ill = illgrp->illgrp_ill; ill != NULL;
15133 	    ill = ill->ill_group_next) {
15134 		if (ill->ill_join_allmulti)
15135 			(void) ip_leave_allmulti(ill->ill_ipif);
15136 	}
15137 
15138 	/*
15139 	 * Choose a good ill. Fallback to inactive or failed if
15140 	 * none available. We need to fallback to FAILED in the
15141 	 * case where we have 2 interfaces in a group - where
15142 	 * one of them is failed and another is a good one and
15143 	 * the good one (not marked inactive) is leaving the group.
15144 	 */
15145 	ret = 0;
15146 	for (ill = illgrp->illgrp_ill; ill != NULL;
15147 	    ill = ill->ill_group_next) {
15148 		/* Never pick an offline interface */
15149 		if (ill->ill_phyint->phyint_flags & PHYI_OFFLINE)
15150 			continue;
15151 
15152 		if (ill->ill_phyint->phyint_flags & PHYI_FAILED) {
15153 			fallback_failed_ill = ill;
15154 			continue;
15155 		}
15156 		if (ill->ill_phyint->phyint_flags & PHYI_INACTIVE) {
15157 			fallback_inactive_ill = ill;
15158 			continue;
15159 		}
15160 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
15161 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
15162 				ret = ip_join_allmulti(ill->ill_ipif);
15163 				/*
15164 				 * ip_join_allmulti can fail because of memory
15165 				 * failures. So, make sure we join at least
15166 				 * on one ill.
15167 				 */
15168 				if (ill->ill_join_allmulti)
15169 					return (0);
15170 			}
15171 		}
15172 	}
15173 	if (ret != 0) {
15174 		/*
15175 		 * If we tried nominating above and failed to do so,
15176 		 * return error. We might have tried multiple times.
15177 		 * But, return the latest error.
15178 		 */
15179 		return (ret);
15180 	}
15181 	if ((ill = fallback_inactive_ill) != NULL) {
15182 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
15183 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
15184 				ret = ip_join_allmulti(ill->ill_ipif);
15185 				return (ret);
15186 			}
15187 		}
15188 	} else if ((ill = fallback_failed_ill) != NULL) {
15189 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
15190 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
15191 				ret = ip_join_allmulti(ill->ill_ipif);
15192 				return (ret);
15193 			}
15194 		}
15195 	}
15196 	return (0);
15197 }
15198 
15199 /*
15200  * This function is called from illgrp_delete after it is
15201  * deleted from the group to reschedule responsibilities
15202  * to a different ill.
15203  */
15204 static void
15205 ill_handoff_responsibility(ill_t *ill, ill_group_t *illgrp)
15206 {
15207 	ilm_t	*ilm;
15208 	ipif_t	*ipif;
15209 	ipaddr_t subnet_addr;
15210 	ipaddr_t net_addr;
15211 	ipaddr_t net_mask = 0;
15212 	ipaddr_t subnet_netmask;
15213 	ipaddr_t addr;
15214 
15215 	ASSERT(ill->ill_group == NULL);
15216 	/*
15217 	 * Broadcast Responsibility:
15218 	 *
15219 	 * 1. If this ill has been nominated for receiving broadcast
15220 	 * packets, we need to find a new one. Before we find a new
15221 	 * one, we need to re-group the ires that are part of this new
15222 	 * group (assumed by ill_nominate_bcast_rcv). We do this by
15223 	 * calling ill_group_bcast_for_xmit(ill) which will do the right
15224 	 * thing for us.
15225 	 *
15226 	 * 2. If this ill was not nominated for receiving broadcast
15227 	 * packets, we need to clear the IRE_MARK_NORECV flag
15228 	 * so that we continue to send up broadcast packets.
15229 	 */
15230 	if (!ill->ill_isv6) {
15231 		/*
15232 		 * Case 1 above : No optimization here. Just redo the
15233 		 * nomination.
15234 		 */
15235 		ill_group_bcast_for_xmit(ill);
15236 		ill_nominate_bcast_rcv(illgrp);
15237 
15238 		/*
15239 		 * Case 2 above : Lookup and clear IRE_MARK_NORECV.
15240 		 */
15241 		ill_clear_bcast_mark(ill, 0);
15242 		ill_clear_bcast_mark(ill, INADDR_BROADCAST);
15243 
15244 		for (ipif = ill->ill_ipif; ipif != NULL;
15245 		    ipif = ipif->ipif_next) {
15246 
15247 			if (!(ipif->ipif_flags & IPIF_UP) ||
15248 			    ipif->ipif_subnet == 0) {
15249 				continue;
15250 			}
15251 			if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
15252 			    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
15253 				net_mask = ip_net_mask(ipif->ipif_lcl_addr);
15254 			} else {
15255 				net_mask = htonl(IN_CLASSA_NET);
15256 			}
15257 			addr = net_mask & ipif->ipif_subnet;
15258 			ill_clear_bcast_mark(ill, addr);
15259 
15260 			net_addr = ~net_mask | addr;
15261 			ill_clear_bcast_mark(ill, net_addr);
15262 
15263 			subnet_netmask = ipif->ipif_net_mask;
15264 			addr = ipif->ipif_subnet;
15265 			ill_clear_bcast_mark(ill, addr);
15266 
15267 			subnet_addr = ~subnet_netmask | addr;
15268 			ill_clear_bcast_mark(ill, subnet_addr);
15269 		}
15270 	}
15271 
15272 	/*
15273 	 * Multicast Responsibility.
15274 	 *
15275 	 * If we have joined allmulti on this one, find a new member
15276 	 * in the group to join allmulti. As this ill is already part
15277 	 * of allmulti, we don't have to join on this one.
15278 	 *
15279 	 * If we have not joined allmulti on this one, there is no
15280 	 * responsibility to handoff. But we need to take new
15281 	 * responsibility i.e, join allmulti on this one if we need
15282 	 * to.
15283 	 */
15284 	if (ill->ill_join_allmulti) {
15285 		(void) ill_nominate_mcast_rcv(illgrp);
15286 	} else {
15287 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
15288 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
15289 				(void) ip_join_allmulti(ill->ill_ipif);
15290 				break;
15291 			}
15292 		}
15293 	}
15294 
15295 	/*
15296 	 * We intentionally do the flushing of IRE_CACHES only matching
15297 	 * on the ill and not on groups. Note that we are already deleted
15298 	 * from the group.
15299 	 *
15300 	 * This will make sure that all IRE_CACHES whose stq is pointing
15301 	 * at ill_wq or ire_ipif->ipif_ill pointing at this ill will get
15302 	 * deleted and IRE_CACHES that are not pointing at this ill will
15303 	 * be left alone.
15304 	 */
15305 	if (ill->ill_isv6) {
15306 		ire_walk_ill_v6(MATCH_IRE_ILL | MATCH_IRE_TYPE,
15307 		    IRE_CACHE, illgrp_cache_delete, (char *)ill, ill);
15308 	} else {
15309 		ire_walk_ill_v4(MATCH_IRE_ILL | MATCH_IRE_TYPE,
15310 		    IRE_CACHE, illgrp_cache_delete, (char *)ill, ill);
15311 	}
15312 
15313 	/*
15314 	 * Some conn may have cached one of the IREs deleted above. By removing
15315 	 * the ire reference, we clean up the extra reference to the ill held in
15316 	 * ire->ire_stq.
15317 	 */
15318 	ipcl_walk(conn_cleanup_stale_ire, NULL);
15319 
15320 	/*
15321 	 * Re-do source address selection for all the members in the
15322 	 * group, if they borrowed source address from one of the ipifs
15323 	 * in this ill.
15324 	 */
15325 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
15326 		if (ill->ill_isv6) {
15327 			ipif_update_other_ipifs_v6(ipif, illgrp);
15328 		} else {
15329 			ipif_update_other_ipifs(ipif, illgrp);
15330 		}
15331 	}
15332 }
15333 
15334 /*
15335  * Delete the ill from the group. The caller makes sure that it is
15336  * in a group and it okay to delete from the group. So, we always
15337  * delete here.
15338  */
15339 static void
15340 illgrp_delete(ill_t *ill)
15341 {
15342 	ill_group_t *illgrp;
15343 	ill_group_t *tmpg;
15344 	ill_t *tmp_ill;
15345 
15346 	/*
15347 	 * Reset illgrp_ill_schednext if it was pointing at us.
15348 	 * We need to do this before we set ill_group to NULL.
15349 	 */
15350 	rw_enter(&ill_g_lock, RW_WRITER);
15351 	mutex_enter(&ill->ill_lock);
15352 
15353 	illgrp_reset_schednext(ill);
15354 
15355 	illgrp = ill->ill_group;
15356 
15357 	/* Delete the ill from illgrp. */
15358 	if (illgrp->illgrp_ill == ill) {
15359 		illgrp->illgrp_ill = ill->ill_group_next;
15360 	} else {
15361 		tmp_ill = illgrp->illgrp_ill;
15362 		while (tmp_ill->ill_group_next != ill) {
15363 			tmp_ill = tmp_ill->ill_group_next;
15364 			ASSERT(tmp_ill != NULL);
15365 		}
15366 		tmp_ill->ill_group_next = ill->ill_group_next;
15367 	}
15368 	ill->ill_group = NULL;
15369 	ill->ill_group_next = NULL;
15370 
15371 	illgrp->illgrp_ill_count--;
15372 	mutex_exit(&ill->ill_lock);
15373 	rw_exit(&ill_g_lock);
15374 
15375 	/*
15376 	 * As this ill is leaving the group, we need to hand off
15377 	 * the responsibilities to the other ills in the group, if
15378 	 * this ill had some responsibilities.
15379 	 */
15380 
15381 	ill_handoff_responsibility(ill, illgrp);
15382 
15383 	rw_enter(&ill_g_lock, RW_WRITER);
15384 
15385 	if (illgrp->illgrp_ill_count == 0) {
15386 
15387 		ASSERT(illgrp->illgrp_ill == NULL);
15388 		if (ill->ill_isv6) {
15389 			if (illgrp == illgrp_head_v6) {
15390 				illgrp_head_v6 = illgrp->illgrp_next;
15391 			} else {
15392 				tmpg = illgrp_head_v6;
15393 				while (tmpg->illgrp_next != illgrp) {
15394 					tmpg = tmpg->illgrp_next;
15395 					ASSERT(tmpg != NULL);
15396 				}
15397 				tmpg->illgrp_next = illgrp->illgrp_next;
15398 			}
15399 		} else {
15400 			if (illgrp == illgrp_head_v4) {
15401 				illgrp_head_v4 = illgrp->illgrp_next;
15402 			} else {
15403 				tmpg = illgrp_head_v4;
15404 				while (tmpg->illgrp_next != illgrp) {
15405 					tmpg = tmpg->illgrp_next;
15406 					ASSERT(tmpg != NULL);
15407 				}
15408 				tmpg->illgrp_next = illgrp->illgrp_next;
15409 			}
15410 		}
15411 		mutex_destroy(&illgrp->illgrp_lock);
15412 		mi_free(illgrp);
15413 	}
15414 	rw_exit(&ill_g_lock);
15415 
15416 	/*
15417 	 * Even though the ill is out of the group its not necessary
15418 	 * to set ipsq_split as TRUE as the ipifs could be down temporarily
15419 	 * We will split the ipsq when phyint_groupname is set to NULL.
15420 	 */
15421 
15422 	/*
15423 	 * Send a routing sockets message if we are deleting from
15424 	 * groups with names.
15425 	 */
15426 	if (ill->ill_phyint->phyint_groupname_len != 0)
15427 		ip_rts_ifmsg(ill->ill_ipif);
15428 }
15429 
15430 /*
15431  * Re-do source address selection. This is normally called when
15432  * an ill joins the group or when a non-NOLOCAL/DEPRECATED/ANYCAST
15433  * ipif comes up.
15434  */
15435 void
15436 ill_update_source_selection(ill_t *ill)
15437 {
15438 	ipif_t *ipif;
15439 
15440 	ASSERT(IAM_WRITER_ILL(ill));
15441 
15442 	if (ill->ill_group != NULL)
15443 		ill = ill->ill_group->illgrp_ill;
15444 
15445 	for (; ill != NULL; ill = ill->ill_group_next) {
15446 		for (ipif = ill->ill_ipif; ipif != NULL;
15447 		    ipif = ipif->ipif_next) {
15448 			if (ill->ill_isv6)
15449 				ipif_recreate_interface_routes_v6(NULL, ipif);
15450 			else
15451 				ipif_recreate_interface_routes(NULL, ipif);
15452 		}
15453 	}
15454 }
15455 
15456 /*
15457  * Insert ill in a group headed by illgrp_head. The caller can either
15458  * pass a groupname in which case we search for a group with the
15459  * same name to insert in or pass a group to insert in. This function
15460  * would only search groups with names.
15461  *
15462  * NOTE : The caller should make sure that there is at least one ipif
15463  *	  UP on this ill so that illgrp_scheduler can pick this ill
15464  *	  for outbound packets. If ill_ipif_up_count is zero, we have
15465  *	  already sent a DL_UNBIND to the driver and we don't want to
15466  *	  send anymore packets. We don't assert for ipif_up_count
15467  *	  to be greater than zero, because ipif_up_done wants to call
15468  *	  this function before bumping up the ipif_up_count. See
15469  *	  ipif_up_done() for details.
15470  */
15471 int
15472 illgrp_insert(ill_group_t **illgrp_head, ill_t *ill, char *groupname,
15473     ill_group_t *grp_to_insert, boolean_t ipif_is_coming_up)
15474 {
15475 	ill_group_t *illgrp;
15476 	ill_t *prev_ill;
15477 	phyint_t *phyi;
15478 
15479 	ASSERT(ill->ill_group == NULL);
15480 
15481 	rw_enter(&ill_g_lock, RW_WRITER);
15482 	mutex_enter(&ill->ill_lock);
15483 
15484 	if (groupname != NULL) {
15485 		/*
15486 		 * Look for a group with a matching groupname to insert.
15487 		 */
15488 		for (illgrp = *illgrp_head; illgrp != NULL;
15489 		    illgrp = illgrp->illgrp_next) {
15490 
15491 			ill_t *tmp_ill;
15492 
15493 			/*
15494 			 * If we have an ill_group_t in the list which has
15495 			 * no ill_t assigned then we must be in the process of
15496 			 * removing this group. We skip this as illgrp_delete()
15497 			 * will remove it from the list.
15498 			 */
15499 			if ((tmp_ill = illgrp->illgrp_ill) == NULL) {
15500 				ASSERT(illgrp->illgrp_ill_count == 0);
15501 				continue;
15502 			}
15503 
15504 			ASSERT(tmp_ill->ill_phyint != NULL);
15505 			phyi = tmp_ill->ill_phyint;
15506 			/*
15507 			 * Look at groups which has names only.
15508 			 */
15509 			if (phyi->phyint_groupname_len == 0)
15510 				continue;
15511 			/*
15512 			 * Names are stored in the phyint common to both
15513 			 * IPv4 and IPv6.
15514 			 */
15515 			if (mi_strcmp(phyi->phyint_groupname,
15516 			    groupname) == 0) {
15517 				break;
15518 			}
15519 		}
15520 	} else {
15521 		/*
15522 		 * If the caller passes in a NULL "grp_to_insert", we
15523 		 * allocate one below and insert this singleton.
15524 		 */
15525 		illgrp = grp_to_insert;
15526 	}
15527 
15528 	ill->ill_group_next = NULL;
15529 
15530 	if (illgrp == NULL) {
15531 		illgrp = (ill_group_t *)mi_zalloc(sizeof (ill_group_t));
15532 		if (illgrp == NULL) {
15533 			return (ENOMEM);
15534 		}
15535 		illgrp->illgrp_next = *illgrp_head;
15536 		*illgrp_head = illgrp;
15537 		illgrp->illgrp_ill = ill;
15538 		illgrp->illgrp_ill_count = 1;
15539 		ill->ill_group = illgrp;
15540 		/*
15541 		 * Used in illgrp_scheduler to protect multiple threads
15542 		 * from traversing the list.
15543 		 */
15544 		mutex_init(&illgrp->illgrp_lock, NULL, MUTEX_DEFAULT, 0);
15545 	} else {
15546 		ASSERT(ill->ill_net_type ==
15547 		    illgrp->illgrp_ill->ill_net_type);
15548 		ASSERT(ill->ill_type == illgrp->illgrp_ill->ill_type);
15549 
15550 		/* Insert ill at tail of this group */
15551 		prev_ill = illgrp->illgrp_ill;
15552 		while (prev_ill->ill_group_next != NULL)
15553 			prev_ill = prev_ill->ill_group_next;
15554 		prev_ill->ill_group_next = ill;
15555 		ill->ill_group = illgrp;
15556 		illgrp->illgrp_ill_count++;
15557 		/*
15558 		 * Inherit group properties. Currently only forwarding
15559 		 * is the property we try to keep the same with all the
15560 		 * ills. When there are more, we will abstract this into
15561 		 * a function.
15562 		 */
15563 		ill->ill_flags &= ~ILLF_ROUTER;
15564 		ill->ill_flags |= (illgrp->illgrp_ill->ill_flags & ILLF_ROUTER);
15565 	}
15566 	mutex_exit(&ill->ill_lock);
15567 	rw_exit(&ill_g_lock);
15568 
15569 	/*
15570 	 * 1) When ipif_up_done() calls this function, ipif_up_count
15571 	 *    may be zero as it has not yet been bumped. But the ires
15572 	 *    have already been added. So, we do the nomination here
15573 	 *    itself. But, when ip_sioctl_groupname calls this, it checks
15574 	 *    for ill_ipif_up_count != 0. Thus we don't check for
15575 	 *    ill_ipif_up_count here while nominating broadcast ires for
15576 	 *    receive.
15577 	 *
15578 	 * 2) Similarly, we need to call ill_group_bcast_for_xmit here
15579 	 *    to group them properly as ire_add() has already happened
15580 	 *    in the ipif_up_done() case. For ip_sioctl_groupname/ifgrp_insert
15581 	 *    case, we need to do it here anyway.
15582 	 */
15583 	if (!ill->ill_isv6) {
15584 		ill_group_bcast_for_xmit(ill);
15585 		ill_nominate_bcast_rcv(illgrp);
15586 	}
15587 
15588 	if (!ipif_is_coming_up) {
15589 		/*
15590 		 * When ipif_up_done() calls this function, the multicast
15591 		 * groups have not been joined yet. So, there is no point in
15592 		 * nomination. ip_join_allmulti will handle groups when
15593 		 * ill_recover_multicast is called from ipif_up_done() later.
15594 		 */
15595 		(void) ill_nominate_mcast_rcv(illgrp);
15596 		/*
15597 		 * ipif_up_done calls ill_update_source_selection
15598 		 * anyway. Moreover, we don't want to re-create
15599 		 * interface routes while ipif_up_done() still has reference
15600 		 * to them. Refer to ipif_up_done() for more details.
15601 		 */
15602 		ill_update_source_selection(ill);
15603 	}
15604 
15605 	/*
15606 	 * Send a routing sockets message if we are inserting into
15607 	 * groups with names.
15608 	 */
15609 	if (groupname != NULL)
15610 		ip_rts_ifmsg(ill->ill_ipif);
15611 	return (0);
15612 }
15613 
15614 /*
15615  * Return the first phyint matching the groupname. There could
15616  * be more than one when there are ill groups.
15617  *
15618  * Needs work: called only from ip_sioctl_groupname
15619  */
15620 static phyint_t *
15621 phyint_lookup_group(char *groupname)
15622 {
15623 	phyint_t *phyi;
15624 
15625 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
15626 	/*
15627 	 * Group names are stored in the phyint - a common structure
15628 	 * to both IPv4 and IPv6.
15629 	 */
15630 	phyi = avl_first(&phyint_g_list.phyint_list_avl_by_index);
15631 	for (; phyi != NULL;
15632 	    phyi = avl_walk(&phyint_g_list.phyint_list_avl_by_index,
15633 	    phyi, AVL_AFTER)) {
15634 		if (phyi->phyint_groupname_len == 0)
15635 			continue;
15636 		ASSERT(phyi->phyint_groupname != NULL);
15637 		if (mi_strcmp(groupname, phyi->phyint_groupname) == 0)
15638 			return (phyi);
15639 	}
15640 	return (NULL);
15641 }
15642 
15643 
15644 
15645 /*
15646  * MT notes on creation and deletion of IPMP groups
15647  *
15648  * Creation and deletion of IPMP groups introduce the need to merge or
15649  * split the associated serialization objects i.e the ipsq's. Normally all
15650  * the ills in an IPMP group would map to a single ipsq. If IPMP is not enabled
15651  * an ill-pair(v4, v6) i.e. phyint would map to a single ipsq. However during
15652  * the execution of the SIOCSLIFGROUPNAME command the picture changes. There
15653  * is a need to change the <ill-ipsq> association and we have to operate on both
15654  * the source and destination IPMP groups. For eg. attempting to set the
15655  * groupname of hme0 to mpk17-85 when it already belongs to mpk17-84 has to
15656  * handle 2 IPMP groups and 2 ipsqs. All the ills belonging to either of the
15657  * source or destination IPMP group are mapped to a single ipsq for executing
15658  * the SIOCSLIFGROUPNAME command. This is termed as a merge of the ipsq's.
15659  * The <ill-ipsq> mapping is restored back to normal at a later point. This is
15660  * termed as a split of the ipsq. The converse of the merge i.e. a split of the
15661  * ipsq happens while unwinding from ipsq_exit. If at least 1 set groupname
15662  * occurred on the ipsq, then the ipsq_split flag is set. This indicates the
15663  * ipsq has to be examined for redoing the <ill-ipsq> associations.
15664  *
15665  * In the above example the ioctl handling code locates the current ipsq of hme0
15666  * which is ipsq(mpk17-84). It then enters the above ipsq immediately or
15667  * eventually (after queueing the ioctl in ipsq(mpk17-84)). Then it locates
15668  * the destination ipsq which is ipsq(mpk17-85) and merges the source ipsq into
15669  * the destination ipsq. If the destination ipsq is not busy, it also enters
15670  * the destination ipsq exclusively. Now the actual groupname setting operation
15671  * can proceed. If the destination ipsq is busy, the operation is enqueued
15672  * on the destination (merged) ipsq and will be handled in the unwind from
15673  * ipsq_exit.
15674  *
15675  * To prevent other threads accessing the ill while the group name change is
15676  * in progres, we bring down the ipifs which also removes the ill from the
15677  * group. The group is changed in phyint and when the first ipif on the ill
15678  * is brought up, the ill is inserted into the right IPMP group by
15679  * illgrp_insert.
15680  */
15681 /* ARGSUSED */
15682 int
15683 ip_sioctl_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15684     ip_ioctl_cmd_t *ipip, void *ifreq)
15685 {
15686 	int i;
15687 	char *tmp;
15688 	int namelen;
15689 	ill_t *ill = ipif->ipif_ill;
15690 	ill_t *ill_v4, *ill_v6;
15691 	int err = 0;
15692 	phyint_t *phyi;
15693 	phyint_t *phyi_tmp;
15694 	struct lifreq *lifr;
15695 	mblk_t	*mp1;
15696 	char *groupname;
15697 	ipsq_t *ipsq;
15698 
15699 	ASSERT(IAM_WRITER_IPIF(ipif));
15700 
15701 	/* Existance verified in ip_wput_nondata */
15702 	mp1 = mp->b_cont->b_cont;
15703 	lifr = (struct lifreq *)mp1->b_rptr;
15704 	groupname = lifr->lifr_groupname;
15705 
15706 	if (ipif->ipif_id != 0)
15707 		return (EINVAL);
15708 
15709 	phyi = ill->ill_phyint;
15710 	ASSERT(phyi != NULL);
15711 
15712 	if (phyi->phyint_flags & PHYI_VIRTUAL)
15713 		return (EINVAL);
15714 
15715 	tmp = groupname;
15716 	for (i = 0; i < LIFNAMSIZ && *tmp != '\0'; tmp++, i++)
15717 		;
15718 
15719 	if (i == LIFNAMSIZ) {
15720 		/* no null termination */
15721 		return (EINVAL);
15722 	}
15723 
15724 	/*
15725 	 * Calculate the namelen exclusive of the null
15726 	 * termination character.
15727 	 */
15728 	namelen = tmp - groupname;
15729 
15730 	ill_v4 = phyi->phyint_illv4;
15731 	ill_v6 = phyi->phyint_illv6;
15732 
15733 	/*
15734 	 * ILL cannot be part of a usesrc group and and IPMP group at the
15735 	 * same time. No need to grab the ill_g_usesrc_lock here, see
15736 	 * synchronization notes in ip.c
15737 	 */
15738 	if (ipif->ipif_ill->ill_usesrc_grp_next != NULL) {
15739 		return (EINVAL);
15740 	}
15741 
15742 	/*
15743 	 * mark the ill as changing.
15744 	 * this should queue all new requests on the syncq.
15745 	 */
15746 	GRAB_ILL_LOCKS(ill_v4, ill_v6);
15747 
15748 	if (ill_v4 != NULL)
15749 		ill_v4->ill_state_flags |= ILL_CHANGING;
15750 	if (ill_v6 != NULL)
15751 		ill_v6->ill_state_flags |= ILL_CHANGING;
15752 	RELEASE_ILL_LOCKS(ill_v4, ill_v6);
15753 
15754 	if (namelen == 0) {
15755 		/*
15756 		 * Null string means remove this interface from the
15757 		 * existing group.
15758 		 */
15759 		if (phyi->phyint_groupname_len == 0) {
15760 			/*
15761 			 * Never was in a group.
15762 			 */
15763 			err = 0;
15764 			goto done;
15765 		}
15766 
15767 		/*
15768 		 * IPv4 or IPv6 may be temporarily out of the group when all
15769 		 * the ipifs are down. Thus, we need to check for ill_group to
15770 		 * be non-NULL.
15771 		 */
15772 		if (ill_v4 != NULL && ill_v4->ill_group != NULL) {
15773 			ill_down_ipifs(ill_v4, mp, 0, B_FALSE);
15774 			mutex_enter(&ill_v4->ill_lock);
15775 			if (!ill_is_quiescent(ill_v4)) {
15776 				/*
15777 				 * ipsq_pending_mp_add will not fail since
15778 				 * connp is NULL
15779 				 */
15780 				(void) ipsq_pending_mp_add(NULL,
15781 				    ill_v4->ill_ipif, q, mp, ILL_DOWN);
15782 				mutex_exit(&ill_v4->ill_lock);
15783 				err = EINPROGRESS;
15784 				goto done;
15785 			}
15786 			mutex_exit(&ill_v4->ill_lock);
15787 		}
15788 
15789 		if (ill_v6 != NULL && ill_v6->ill_group != NULL) {
15790 			ill_down_ipifs(ill_v6, mp, 0, B_FALSE);
15791 			mutex_enter(&ill_v6->ill_lock);
15792 			if (!ill_is_quiescent(ill_v6)) {
15793 				(void) ipsq_pending_mp_add(NULL,
15794 				    ill_v6->ill_ipif, q, mp, ILL_DOWN);
15795 				mutex_exit(&ill_v6->ill_lock);
15796 				err = EINPROGRESS;
15797 				goto done;
15798 			}
15799 			mutex_exit(&ill_v6->ill_lock);
15800 		}
15801 
15802 		rw_enter(&ill_g_lock, RW_WRITER);
15803 		GRAB_ILL_LOCKS(ill_v4, ill_v6);
15804 		mutex_enter(&phyi->phyint_lock);
15805 		ASSERT(phyi->phyint_groupname != NULL);
15806 		mi_free(phyi->phyint_groupname);
15807 		phyi->phyint_groupname = NULL;
15808 		phyi->phyint_groupname_len = 0;
15809 		mutex_exit(&phyi->phyint_lock);
15810 		RELEASE_ILL_LOCKS(ill_v4, ill_v6);
15811 		rw_exit(&ill_g_lock);
15812 		err = ill_up_ipifs(ill, q, mp);
15813 
15814 		/*
15815 		 * set the split flag so that the ipsq can be split
15816 		 */
15817 		mutex_enter(&phyi->phyint_ipsq->ipsq_lock);
15818 		phyi->phyint_ipsq->ipsq_split = B_TRUE;
15819 		mutex_exit(&phyi->phyint_ipsq->ipsq_lock);
15820 
15821 	} else {
15822 		if (phyi->phyint_groupname_len != 0) {
15823 			ASSERT(phyi->phyint_groupname != NULL);
15824 			/* Are we inserting in the same group ? */
15825 			if (mi_strcmp(groupname,
15826 			    phyi->phyint_groupname) == 0) {
15827 				err = 0;
15828 				goto done;
15829 			}
15830 		}
15831 
15832 		rw_enter(&ill_g_lock, RW_READER);
15833 		/*
15834 		 * Merge ipsq for the group's.
15835 		 * This check is here as multiple groups/ills might be
15836 		 * sharing the same ipsq.
15837 		 * If we have to merege than the operation is restarted
15838 		 * on the new ipsq.
15839 		 */
15840 		ipsq = ip_ipsq_lookup(groupname, B_FALSE, NULL);
15841 		if (phyi->phyint_ipsq != ipsq) {
15842 			rw_exit(&ill_g_lock);
15843 			err = ill_merge_groups(ill, NULL, groupname, mp, q);
15844 			goto done;
15845 		}
15846 		/*
15847 		 * Running exclusive on new ipsq.
15848 		 */
15849 
15850 		ASSERT(ipsq != NULL);
15851 		ASSERT(ipsq->ipsq_writer == curthread);
15852 
15853 		/*
15854 		 * Check whether the ill_type and ill_net_type matches before
15855 		 * we allocate any memory so that the cleanup is easier.
15856 		 *
15857 		 * We can't group dissimilar ones as we can't load spread
15858 		 * packets across the group because of potential link-level
15859 		 * header differences.
15860 		 */
15861 		phyi_tmp = phyint_lookup_group(groupname);
15862 		if (phyi_tmp != NULL) {
15863 			if ((ill_v4 != NULL &&
15864 			    phyi_tmp->phyint_illv4 != NULL) &&
15865 			    ((ill_v4->ill_net_type !=
15866 			    phyi_tmp->phyint_illv4->ill_net_type) ||
15867 			    (ill_v4->ill_type !=
15868 			    phyi_tmp->phyint_illv4->ill_type))) {
15869 				mutex_enter(&phyi->phyint_ipsq->ipsq_lock);
15870 				phyi->phyint_ipsq->ipsq_split = B_TRUE;
15871 				mutex_exit(&phyi->phyint_ipsq->ipsq_lock);
15872 				rw_exit(&ill_g_lock);
15873 				return (EINVAL);
15874 			}
15875 			if ((ill_v6 != NULL &&
15876 			    phyi_tmp->phyint_illv6 != NULL) &&
15877 			    ((ill_v6->ill_net_type !=
15878 			    phyi_tmp->phyint_illv6->ill_net_type) ||
15879 			    (ill_v6->ill_type !=
15880 			    phyi_tmp->phyint_illv6->ill_type))) {
15881 				mutex_enter(&phyi->phyint_ipsq->ipsq_lock);
15882 				phyi->phyint_ipsq->ipsq_split = B_TRUE;
15883 				mutex_exit(&phyi->phyint_ipsq->ipsq_lock);
15884 				rw_exit(&ill_g_lock);
15885 				return (EINVAL);
15886 			}
15887 		}
15888 
15889 		rw_exit(&ill_g_lock);
15890 
15891 		/*
15892 		 * bring down all v4 ipifs.
15893 		 */
15894 		if (ill_v4 != NULL) {
15895 			ill_down_ipifs(ill_v4, mp, 0, B_FALSE);
15896 		}
15897 
15898 		/*
15899 		 * bring down all v6 ipifs.
15900 		 */
15901 		if (ill_v6 != NULL) {
15902 			ill_down_ipifs(ill_v6, mp, 0, B_FALSE);
15903 		}
15904 
15905 		/*
15906 		 * make sure all ipifs are down and there are no active
15907 		 * references. Call to ipsq_pending_mp_add will not fail
15908 		 * since connp is NULL.
15909 		 */
15910 		if (ill_v4 != NULL) {
15911 			mutex_enter(&ill_v4->ill_lock);
15912 			if (!ill_is_quiescent(ill_v4)) {
15913 				(void) ipsq_pending_mp_add(NULL,
15914 				    ill_v4->ill_ipif, q, mp, ILL_DOWN);
15915 				mutex_exit(&ill_v4->ill_lock);
15916 				err = EINPROGRESS;
15917 				goto done;
15918 			}
15919 			mutex_exit(&ill_v4->ill_lock);
15920 		}
15921 
15922 		if (ill_v6 != NULL) {
15923 			mutex_enter(&ill_v6->ill_lock);
15924 			if (!ill_is_quiescent(ill_v6)) {
15925 				(void) ipsq_pending_mp_add(NULL,
15926 				    ill_v6->ill_ipif, q, mp, ILL_DOWN);
15927 				mutex_exit(&ill_v6->ill_lock);
15928 				err = EINPROGRESS;
15929 				goto done;
15930 			}
15931 			mutex_exit(&ill_v6->ill_lock);
15932 		}
15933 
15934 		/*
15935 		 * allocate including space for null terminator
15936 		 * before we insert.
15937 		 */
15938 		tmp = (char *)mi_alloc(namelen + 1, BPRI_MED);
15939 		if (tmp == NULL)
15940 			return (ENOMEM);
15941 
15942 		rw_enter(&ill_g_lock, RW_WRITER);
15943 		GRAB_ILL_LOCKS(ill_v4, ill_v6);
15944 		mutex_enter(&phyi->phyint_lock);
15945 		if (phyi->phyint_groupname_len != 0) {
15946 			ASSERT(phyi->phyint_groupname != NULL);
15947 			mi_free(phyi->phyint_groupname);
15948 		}
15949 
15950 		/*
15951 		 * setup the new group name.
15952 		 */
15953 		phyi->phyint_groupname = tmp;
15954 		bcopy(groupname, phyi->phyint_groupname, namelen + 1);
15955 		phyi->phyint_groupname_len = namelen + 1;
15956 		mutex_exit(&phyi->phyint_lock);
15957 		RELEASE_ILL_LOCKS(ill_v4, ill_v6);
15958 		rw_exit(&ill_g_lock);
15959 
15960 		err = ill_up_ipifs(ill, q, mp);
15961 	}
15962 
15963 done:
15964 	/*
15965 	 *  normally ILL_CHANGING is cleared in ill_up_ipifs.
15966 	 */
15967 	if (err != EINPROGRESS) {
15968 		GRAB_ILL_LOCKS(ill_v4, ill_v6);
15969 		if (ill_v4 != NULL)
15970 			ill_v4->ill_state_flags &= ~ILL_CHANGING;
15971 		if (ill_v6 != NULL)
15972 			ill_v6->ill_state_flags &= ~ILL_CHANGING;
15973 		RELEASE_ILL_LOCKS(ill_v4, ill_v6);
15974 	}
15975 	return (err);
15976 }
15977 
15978 /* ARGSUSED */
15979 int
15980 ip_sioctl_get_groupname(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
15981     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15982 {
15983 	ill_t *ill;
15984 	phyint_t *phyi;
15985 	struct lifreq *lifr;
15986 	mblk_t	*mp1;
15987 
15988 	/* Existence verified in ip_wput_nondata */
15989 	mp1 = mp->b_cont->b_cont;
15990 	lifr = (struct lifreq *)mp1->b_rptr;
15991 	ill = ipif->ipif_ill;
15992 	phyi = ill->ill_phyint;
15993 
15994 	lifr->lifr_groupname[0] = '\0';
15995 	/*
15996 	 * ill_group may be null if all the interfaces
15997 	 * are down. But still, the phyint should always
15998 	 * hold the name.
15999 	 */
16000 	if (phyi->phyint_groupname_len != 0) {
16001 		bcopy(phyi->phyint_groupname, lifr->lifr_groupname,
16002 		    phyi->phyint_groupname_len);
16003 	}
16004 
16005 	return (0);
16006 }
16007 
16008 
16009 typedef struct conn_move_s {
16010 	ill_t	*cm_from_ill;
16011 	ill_t	*cm_to_ill;
16012 	int	cm_ifindex;
16013 } conn_move_t;
16014 
16015 /*
16016  * ipcl_walk function for moving conn_multicast_ill for a given ill.
16017  */
16018 static void
16019 conn_move(conn_t *connp, caddr_t arg)
16020 {
16021 	conn_move_t *connm;
16022 	int ifindex;
16023 	int i;
16024 	ill_t *from_ill;
16025 	ill_t *to_ill;
16026 	ilg_t *ilg;
16027 	ilm_t *ret_ilm;
16028 
16029 	connm = (conn_move_t *)arg;
16030 	ifindex = connm->cm_ifindex;
16031 	from_ill = connm->cm_from_ill;
16032 	to_ill = connm->cm_to_ill;
16033 
16034 	/* Change IP_BOUND_IF/IPV6_BOUND_IF associations. */
16035 
16036 	/* All multicast fields protected by conn_lock */
16037 	mutex_enter(&connp->conn_lock);
16038 	ASSERT(connp->conn_outgoing_ill == connp->conn_incoming_ill);
16039 	if ((connp->conn_outgoing_ill == from_ill) &&
16040 	    (ifindex == 0 || connp->conn_orig_bound_ifindex == ifindex)) {
16041 		connp->conn_outgoing_ill = to_ill;
16042 		connp->conn_incoming_ill = to_ill;
16043 	}
16044 
16045 	/* Change IP_MULTICAST_IF/IPV6_MULTICAST_IF associations */
16046 
16047 	if ((connp->conn_multicast_ill == from_ill) &&
16048 	    (ifindex == 0 || connp->conn_orig_multicast_ifindex == ifindex)) {
16049 		connp->conn_multicast_ill = connm->cm_to_ill;
16050 	}
16051 
16052 	/* Change IP_XMIT_IF associations */
16053 	if ((connp->conn_xmit_if_ill == from_ill) &&
16054 	    (ifindex == 0 || connp->conn_orig_xmit_ifindex == ifindex)) {
16055 		connp->conn_xmit_if_ill = to_ill;
16056 	}
16057 	/*
16058 	 * Change the ilg_ill to point to the new one. This assumes
16059 	 * ilm_move_v6 has moved the ilms to new_ill and the driver
16060 	 * has been told to receive packets on this interface.
16061 	 * ilm_move_v6 FAILBACKS all the ilms successfully always.
16062 	 * But when doing a FAILOVER, it might fail with ENOMEM and so
16063 	 * some ilms may not have moved. We check to see whether
16064 	 * the ilms have moved to to_ill. We can't check on from_ill
16065 	 * as in the process of moving, we could have split an ilm
16066 	 * in to two - which has the same orig_ifindex and v6group.
16067 	 *
16068 	 * For IPv4, ilg_ipif moves implicitly. The code below really
16069 	 * does not do anything for IPv4 as ilg_ill is NULL for IPv4.
16070 	 */
16071 	for (i = connp->conn_ilg_inuse - 1; i >= 0; i--) {
16072 		ilg = &connp->conn_ilg[i];
16073 		if ((ilg->ilg_ill == from_ill) &&
16074 		    (ifindex == 0 || ilg->ilg_orig_ifindex == ifindex)) {
16075 			/* ifindex != 0 indicates failback */
16076 			if (ifindex != 0) {
16077 				connp->conn_ilg[i].ilg_ill = to_ill;
16078 				continue;
16079 			}
16080 
16081 			ret_ilm = ilm_lookup_ill_index_v6(to_ill,
16082 			    &ilg->ilg_v6group, ilg->ilg_orig_ifindex,
16083 			    connp->conn_zoneid);
16084 
16085 			if (ret_ilm != NULL)
16086 				connp->conn_ilg[i].ilg_ill = to_ill;
16087 		}
16088 	}
16089 	mutex_exit(&connp->conn_lock);
16090 }
16091 
16092 static void
16093 conn_move_ill(ill_t *from_ill, ill_t *to_ill, int ifindex)
16094 {
16095 	conn_move_t connm;
16096 
16097 	connm.cm_from_ill = from_ill;
16098 	connm.cm_to_ill = to_ill;
16099 	connm.cm_ifindex = ifindex;
16100 
16101 	ipcl_walk(conn_move, (caddr_t)&connm);
16102 }
16103 
16104 /*
16105  * ilm has been moved from from_ill to to_ill.
16106  * Send DL_DISABMULTI_REQ to ill and DL_ENABMULTI_REQ on to_ill.
16107  * appropriately.
16108  *
16109  * NOTE : We can't reuse the code in ip_ll_addmulti/delmulti because
16110  *	  the code there de-references ipif_ill to get the ill to
16111  *	  send multicast requests. It does not work as ipif is on its
16112  *	  move and already moved when this function is called.
16113  *	  Thus, we need to use from_ill and to_ill send down multicast
16114  *	  requests.
16115  */
16116 static void
16117 ilm_send_multicast_reqs(ill_t *from_ill, ill_t *to_ill)
16118 {
16119 	ipif_t *ipif;
16120 	ilm_t *ilm;
16121 
16122 	/*
16123 	 * See whether we need to send down DL_ENABMULTI_REQ on
16124 	 * to_ill as ilm has just been added.
16125 	 */
16126 	ASSERT(IAM_WRITER_ILL(to_ill));
16127 	ASSERT(IAM_WRITER_ILL(from_ill));
16128 
16129 	ILM_WALKER_HOLD(to_ill);
16130 	for (ilm = to_ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
16131 
16132 		if (!ilm->ilm_is_new || (ilm->ilm_flags & ILM_DELETED))
16133 			continue;
16134 		/*
16135 		 * no locks held, ill/ipif cannot dissappear as long
16136 		 * as we are writer.
16137 		 */
16138 		ipif = to_ill->ill_ipif;
16139 		/*
16140 		 * No need to hold any lock as we are the writer and this
16141 		 * can only be changed by a writer.
16142 		 */
16143 		ilm->ilm_is_new = B_FALSE;
16144 
16145 		if (to_ill->ill_net_type != IRE_IF_RESOLVER ||
16146 		    ipif->ipif_flags & IPIF_POINTOPOINT) {
16147 			ip1dbg(("ilm_send_multicast_reqs: to_ill not "
16148 			    "resolver\n"));
16149 			continue;		/* Must be IRE_IF_NORESOLVER */
16150 		}
16151 
16152 
16153 		if (to_ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST) {
16154 			ip1dbg(("ilm_send_multicast_reqs: "
16155 			    "to_ill MULTI_BCAST\n"));
16156 			goto from;
16157 		}
16158 
16159 		if (to_ill->ill_isv6)
16160 			mld_joingroup(ilm);
16161 		else
16162 			igmp_joingroup(ilm);
16163 
16164 		if (to_ill->ill_ipif_up_count == 0) {
16165 			/*
16166 			 * Nobody there. All multicast addresses will be
16167 			 * re-joined when we get the DL_BIND_ACK bringing the
16168 			 * interface up.
16169 			 */
16170 			ilm->ilm_notify_driver = B_FALSE;
16171 			ip1dbg(("ilm_send_multicast_reqs: to_ill nobody up\n"));
16172 			goto from;
16173 		}
16174 
16175 		/*
16176 		 * For allmulti address, we want to join on only one interface.
16177 		 * Checking for ilm_numentries_v6 is not correct as you may
16178 		 * find an ilm with zero address on to_ill, but we may not
16179 		 * have nominated to_ill for receiving. Thus, if we have
16180 		 * nominated from_ill (ill_join_allmulti is set), nominate
16181 		 * only if to_ill is not already nominated (to_ill normally
16182 		 * should not have been nominated if "from_ill" has already
16183 		 * been nominated. As we don't prevent failovers from happening
16184 		 * across groups, we don't assert).
16185 		 */
16186 		if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
16187 			/*
16188 			 * There is no need to hold ill locks as we are
16189 			 * writer on both ills and when ill_join_allmulti
16190 			 * is changed the thread is always a writer.
16191 			 */
16192 			if (from_ill->ill_join_allmulti &&
16193 			    !to_ill->ill_join_allmulti) {
16194 				(void) ip_join_allmulti(to_ill->ill_ipif);
16195 			}
16196 		} else if (ilm->ilm_notify_driver) {
16197 
16198 			/*
16199 			 * This is a newly moved ilm so we need to tell the
16200 			 * driver about the new group. There can be more than
16201 			 * one ilm's for the same group in the list each with a
16202 			 * different orig_ifindex. We have to inform the driver
16203 			 * once. In ilm_move_v[4,6] we only set the flag
16204 			 * ilm_notify_driver for the first ilm.
16205 			 */
16206 
16207 			(void) ip_ll_send_enabmulti_req(to_ill,
16208 			    &ilm->ilm_v6addr);
16209 		}
16210 
16211 		ilm->ilm_notify_driver = B_FALSE;
16212 
16213 		/*
16214 		 * See whether we need to send down DL_DISABMULTI_REQ on
16215 		 * from_ill as ilm has just been removed.
16216 		 */
16217 from:
16218 		ipif = from_ill->ill_ipif;
16219 		if (from_ill->ill_net_type != IRE_IF_RESOLVER ||
16220 		    ipif->ipif_flags & IPIF_POINTOPOINT) {
16221 			ip1dbg(("ilm_send_multicast_reqs: "
16222 			    "from_ill not resolver\n"));
16223 			continue;		/* Must be IRE_IF_NORESOLVER */
16224 		}
16225 
16226 		if (from_ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST) {
16227 			ip1dbg(("ilm_send_multicast_reqs: "
16228 			    "from_ill MULTI_BCAST\n"));
16229 			continue;
16230 		}
16231 
16232 		if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
16233 			if (from_ill->ill_join_allmulti)
16234 			    (void) ip_leave_allmulti(from_ill->ill_ipif);
16235 		} else if (ilm_numentries_v6(from_ill, &ilm->ilm_v6addr) == 0) {
16236 			(void) ip_ll_send_disabmulti_req(from_ill,
16237 		    &ilm->ilm_v6addr);
16238 		}
16239 	}
16240 	ILM_WALKER_RELE(to_ill);
16241 }
16242 
16243 /*
16244  * This function is called when all multicast memberships needs
16245  * to be moved from "from_ill" to "to_ill" for IPv6. This function is
16246  * called only once unlike the IPv4 counterpart where it is called after
16247  * every logical interface is moved. The reason is due to multicast
16248  * memberships are joined using an interface address in IPv4 while in
16249  * IPv6, interface index is used.
16250  */
16251 static void
16252 ilm_move_v6(ill_t *from_ill, ill_t *to_ill, int ifindex)
16253 {
16254 	ilm_t	*ilm;
16255 	ilm_t	*ilm_next;
16256 	ilm_t	*new_ilm;
16257 	ilm_t	**ilmp;
16258 	int	count;
16259 	char buf[INET6_ADDRSTRLEN];
16260 	in6_addr_t ipv6_snm = ipv6_solicited_node_mcast;
16261 
16262 	ASSERT(MUTEX_HELD(&to_ill->ill_lock));
16263 	ASSERT(MUTEX_HELD(&from_ill->ill_lock));
16264 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
16265 
16266 	if (ifindex == 0) {
16267 		/*
16268 		 * Form the solicited node mcast address which is used later.
16269 		 */
16270 		ipif_t *ipif;
16271 
16272 		ipif = from_ill->ill_ipif;
16273 		ASSERT(ipif->ipif_id == 0);
16274 
16275 		ipv6_snm.s6_addr32[3] |= ipif->ipif_v6lcl_addr.s6_addr32[3];
16276 	}
16277 
16278 	ilmp = &from_ill->ill_ilm;
16279 	for (ilm = from_ill->ill_ilm; ilm != NULL; ilm = ilm_next) {
16280 		ilm_next = ilm->ilm_next;
16281 
16282 		if (ilm->ilm_flags & ILM_DELETED) {
16283 			ilmp = &ilm->ilm_next;
16284 			continue;
16285 		}
16286 
16287 		new_ilm = ilm_lookup_ill_index_v6(to_ill, &ilm->ilm_v6addr,
16288 		    ilm->ilm_orig_ifindex, ilm->ilm_zoneid);
16289 		ASSERT(ilm->ilm_orig_ifindex != 0);
16290 		if (ilm->ilm_orig_ifindex == ifindex) {
16291 			/*
16292 			 * We are failing back multicast memberships.
16293 			 * If the same ilm exists in to_ill, it means somebody
16294 			 * has joined the same group there e.g. ff02::1
16295 			 * is joined within the kernel when the interfaces
16296 			 * came UP.
16297 			 */
16298 			ASSERT(ilm->ilm_ipif == NULL);
16299 			if (new_ilm != NULL) {
16300 				new_ilm->ilm_refcnt += ilm->ilm_refcnt;
16301 				if (new_ilm->ilm_fmode != MODE_IS_EXCLUDE ||
16302 				    !SLIST_IS_EMPTY(new_ilm->ilm_filter)) {
16303 					new_ilm->ilm_is_new = B_TRUE;
16304 				}
16305 			} else {
16306 				/*
16307 				 * check if we can just move the ilm
16308 				 */
16309 				if (from_ill->ill_ilm_walker_cnt != 0) {
16310 					/*
16311 					 * We have walkers we cannot move
16312 					 * the ilm, so allocate a new ilm,
16313 					 * this (old) ilm will be marked
16314 					 * ILM_DELETED at the end of the loop
16315 					 * and will be freed when the
16316 					 * last walker exits.
16317 					 */
16318 					new_ilm = (ilm_t *)mi_zalloc
16319 					    (sizeof (ilm_t));
16320 					if (new_ilm == NULL) {
16321 						ip0dbg(("ilm_move_v6: "
16322 						    "FAILBACK of IPv6"
16323 						    " multicast address %s : "
16324 						    "from %s to"
16325 						    " %s failed : ENOMEM \n",
16326 						    inet_ntop(AF_INET6,
16327 						    &ilm->ilm_v6addr, buf,
16328 						    sizeof (buf)),
16329 						    from_ill->ill_name,
16330 						    to_ill->ill_name));
16331 
16332 							ilmp = &ilm->ilm_next;
16333 							continue;
16334 					}
16335 					*new_ilm = *ilm;
16336 					/*
16337 					 * we don't want new_ilm linked to
16338 					 * ilm's filter list.
16339 					 */
16340 					new_ilm->ilm_filter = NULL;
16341 				} else {
16342 					/*
16343 					 * No walkers we can move the ilm.
16344 					 * lets take it out of the list.
16345 					 */
16346 					*ilmp = ilm->ilm_next;
16347 					ilm->ilm_next = NULL;
16348 					new_ilm = ilm;
16349 				}
16350 
16351 				/*
16352 				 * if this is the first ilm for the group
16353 				 * set ilm_notify_driver so that we notify the
16354 				 * driver in ilm_send_multicast_reqs.
16355 				 */
16356 				if (ilm_lookup_ill_v6(to_ill,
16357 				    &new_ilm->ilm_v6addr, ALL_ZONES) == NULL)
16358 					new_ilm->ilm_notify_driver = B_TRUE;
16359 
16360 				new_ilm->ilm_ill = to_ill;
16361 				/* Add to the to_ill's list */
16362 				new_ilm->ilm_next = to_ill->ill_ilm;
16363 				to_ill->ill_ilm = new_ilm;
16364 				/*
16365 				 * set the flag so that mld_joingroup is
16366 				 * called in ilm_send_multicast_reqs().
16367 				 */
16368 				new_ilm->ilm_is_new = B_TRUE;
16369 			}
16370 			goto bottom;
16371 		} else if (ifindex != 0) {
16372 			/*
16373 			 * If this is FAILBACK (ifindex != 0) and the ifindex
16374 			 * has not matched above, look at the next ilm.
16375 			 */
16376 			ilmp = &ilm->ilm_next;
16377 			continue;
16378 		}
16379 		/*
16380 		 * If we are here, it means ifindex is 0. Failover
16381 		 * everything.
16382 		 *
16383 		 * We need to handle solicited node mcast address
16384 		 * and all_nodes mcast address differently as they
16385 		 * are joined witin the kenrel (ipif_multicast_up)
16386 		 * and potentially from the userland. We are called
16387 		 * after the ipifs of from_ill has been moved.
16388 		 * If we still find ilms on ill with solicited node
16389 		 * mcast address or all_nodes mcast address, it must
16390 		 * belong to the UP interface that has not moved e.g.
16391 		 * ipif_id 0 with the link local prefix does not move.
16392 		 * We join this on the new ill accounting for all the
16393 		 * userland memberships so that applications don't
16394 		 * see any failure.
16395 		 *
16396 		 * We need to make sure that we account only for the
16397 		 * solicited node and all node multicast addresses
16398 		 * that was brought UP on these. In the case of
16399 		 * a failover from A to B, we might have ilms belonging
16400 		 * to A (ilm_orig_ifindex pointing at A) on B accounting
16401 		 * for the membership from the userland. If we are failing
16402 		 * over from B to C now, we will find the ones belonging
16403 		 * to A on B. These don't account for the ill_ipif_up_count.
16404 		 * They just move from B to C. The check below on
16405 		 * ilm_orig_ifindex ensures that.
16406 		 */
16407 		if ((ilm->ilm_orig_ifindex ==
16408 		    from_ill->ill_phyint->phyint_ifindex) &&
16409 		    (IN6_ARE_ADDR_EQUAL(&ipv6_snm, &ilm->ilm_v6addr) ||
16410 		    IN6_ARE_ADDR_EQUAL(&ipv6_all_hosts_mcast,
16411 		    &ilm->ilm_v6addr))) {
16412 			ASSERT(ilm->ilm_refcnt > 0);
16413 			count = ilm->ilm_refcnt - from_ill->ill_ipif_up_count;
16414 			/*
16415 			 * For indentation reasons, we are not using a
16416 			 * "else" here.
16417 			 */
16418 			if (count == 0) {
16419 				ilmp = &ilm->ilm_next;
16420 				continue;
16421 			}
16422 			ilm->ilm_refcnt -= count;
16423 			if (new_ilm != NULL) {
16424 				/*
16425 				 * Can find one with the same
16426 				 * ilm_orig_ifindex, if we are failing
16427 				 * over to a STANDBY. This happens
16428 				 * when somebody wants to join a group
16429 				 * on a STANDBY interface and we
16430 				 * internally join on a different one.
16431 				 * If we had joined on from_ill then, a
16432 				 * failover now will find a new ilm
16433 				 * with this index.
16434 				 */
16435 				ip1dbg(("ilm_move_v6: FAILOVER, found"
16436 				    " new ilm on %s, group address %s\n",
16437 				    to_ill->ill_name,
16438 				    inet_ntop(AF_INET6,
16439 				    &ilm->ilm_v6addr, buf,
16440 				    sizeof (buf))));
16441 				new_ilm->ilm_refcnt += count;
16442 				if (new_ilm->ilm_fmode != MODE_IS_EXCLUDE ||
16443 				    !SLIST_IS_EMPTY(new_ilm->ilm_filter)) {
16444 					new_ilm->ilm_is_new = B_TRUE;
16445 				}
16446 			} else {
16447 				new_ilm = (ilm_t *)mi_zalloc(sizeof (ilm_t));
16448 				if (new_ilm == NULL) {
16449 					ip0dbg(("ilm_move_v6: FAILOVER of IPv6"
16450 					    " multicast address %s : from %s to"
16451 					    " %s failed : ENOMEM \n",
16452 					    inet_ntop(AF_INET6,
16453 					    &ilm->ilm_v6addr, buf,
16454 					    sizeof (buf)), from_ill->ill_name,
16455 					    to_ill->ill_name));
16456 					ilmp = &ilm->ilm_next;
16457 					continue;
16458 				}
16459 				*new_ilm = *ilm;
16460 				new_ilm->ilm_filter = NULL;
16461 				new_ilm->ilm_refcnt = count;
16462 				new_ilm->ilm_timer = INFINITY;
16463 				new_ilm->ilm_rtx.rtx_timer = INFINITY;
16464 				new_ilm->ilm_is_new = B_TRUE;
16465 				/*
16466 				 * If the to_ill has not joined this
16467 				 * group we need to tell the driver in
16468 				 * ill_send_multicast_reqs.
16469 				 */
16470 				if (ilm_lookup_ill_v6(to_ill,
16471 				    &new_ilm->ilm_v6addr, ALL_ZONES) == NULL)
16472 					new_ilm->ilm_notify_driver = B_TRUE;
16473 
16474 				new_ilm->ilm_ill = to_ill;
16475 				/* Add to the to_ill's list */
16476 				new_ilm->ilm_next = to_ill->ill_ilm;
16477 				to_ill->ill_ilm = new_ilm;
16478 				ASSERT(new_ilm->ilm_ipif == NULL);
16479 			}
16480 			if (ilm->ilm_refcnt == 0) {
16481 				goto bottom;
16482 			} else {
16483 				new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
16484 				CLEAR_SLIST(new_ilm->ilm_filter);
16485 				ilmp = &ilm->ilm_next;
16486 			}
16487 			continue;
16488 		} else {
16489 			/*
16490 			 * ifindex = 0 means, move everything pointing at
16491 			 * from_ill. We are doing this becuase ill has
16492 			 * either FAILED or became INACTIVE.
16493 			 *
16494 			 * As we would like to move things later back to
16495 			 * from_ill, we want to retain the identity of this
16496 			 * ilm. Thus, we don't blindly increment the reference
16497 			 * count on the ilms matching the address alone. We
16498 			 * need to match on the ilm_orig_index also. new_ilm
16499 			 * was obtained by matching ilm_orig_index also.
16500 			 */
16501 			if (new_ilm != NULL) {
16502 				/*
16503 				 * This is possible only if a previous restore
16504 				 * was incomplete i.e restore to
16505 				 * ilm_orig_ifindex left some ilms because
16506 				 * of some failures. Thus when we are failing
16507 				 * again, we might find our old friends there.
16508 				 */
16509 				ip1dbg(("ilm_move_v6: FAILOVER, found new ilm"
16510 				    " on %s, group address %s\n",
16511 				    to_ill->ill_name,
16512 				    inet_ntop(AF_INET6,
16513 				    &ilm->ilm_v6addr, buf,
16514 				    sizeof (buf))));
16515 				new_ilm->ilm_refcnt += ilm->ilm_refcnt;
16516 				if (new_ilm->ilm_fmode != MODE_IS_EXCLUDE ||
16517 				    !SLIST_IS_EMPTY(new_ilm->ilm_filter)) {
16518 					new_ilm->ilm_is_new = B_TRUE;
16519 				}
16520 			} else {
16521 				if (from_ill->ill_ilm_walker_cnt != 0) {
16522 					new_ilm = (ilm_t *)
16523 					    mi_zalloc(sizeof (ilm_t));
16524 					if (new_ilm == NULL) {
16525 						ip0dbg(("ilm_move_v6: "
16526 						    "FAILOVER of IPv6"
16527 						    " multicast address %s : "
16528 						    "from %s to"
16529 						    " %s failed : ENOMEM \n",
16530 						    inet_ntop(AF_INET6,
16531 						    &ilm->ilm_v6addr, buf,
16532 						    sizeof (buf)),
16533 						    from_ill->ill_name,
16534 						    to_ill->ill_name));
16535 
16536 							ilmp = &ilm->ilm_next;
16537 							continue;
16538 					}
16539 					*new_ilm = *ilm;
16540 					new_ilm->ilm_filter = NULL;
16541 				} else {
16542 					*ilmp = ilm->ilm_next;
16543 					new_ilm = ilm;
16544 				}
16545 				/*
16546 				 * If the to_ill has not joined this
16547 				 * group we need to tell the driver in
16548 				 * ill_send_multicast_reqs.
16549 				 */
16550 				if (ilm_lookup_ill_v6(to_ill,
16551 				    &new_ilm->ilm_v6addr, ALL_ZONES) == NULL)
16552 					new_ilm->ilm_notify_driver = B_TRUE;
16553 
16554 				/* Add to the to_ill's list */
16555 				new_ilm->ilm_next = to_ill->ill_ilm;
16556 				to_ill->ill_ilm = new_ilm;
16557 				ASSERT(ilm->ilm_ipif == NULL);
16558 				new_ilm->ilm_ill = to_ill;
16559 				new_ilm->ilm_is_new = B_TRUE;
16560 			}
16561 
16562 		}
16563 
16564 bottom:
16565 		/*
16566 		 * Revert multicast filter state to (EXCLUDE, NULL).
16567 		 * new_ilm->ilm_is_new should already be set if needed.
16568 		 */
16569 		new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
16570 		CLEAR_SLIST(new_ilm->ilm_filter);
16571 		/*
16572 		 * We allocated/got a new ilm, free the old one.
16573 		 */
16574 		if (new_ilm != ilm) {
16575 			if (from_ill->ill_ilm_walker_cnt == 0) {
16576 				*ilmp = ilm->ilm_next;
16577 				ilm->ilm_next = NULL;
16578 				FREE_SLIST(ilm->ilm_filter);
16579 				FREE_SLIST(ilm->ilm_pendsrcs);
16580 				FREE_SLIST(ilm->ilm_rtx.rtx_allow);
16581 				FREE_SLIST(ilm->ilm_rtx.rtx_block);
16582 				mi_free((char *)ilm);
16583 			} else {
16584 				ilm->ilm_flags |= ILM_DELETED;
16585 				from_ill->ill_ilm_cleanup_reqd = 1;
16586 				ilmp = &ilm->ilm_next;
16587 			}
16588 		}
16589 	}
16590 }
16591 
16592 /*
16593  * Move all the multicast memberships to to_ill. Called when
16594  * an ipif moves from "from_ill" to "to_ill". This function is slightly
16595  * different from IPv6 counterpart as multicast memberships are associated
16596  * with ills in IPv6. This function is called after every ipif is moved
16597  * unlike IPv6, where it is moved only once.
16598  */
16599 static void
16600 ilm_move_v4(ill_t *from_ill, ill_t *to_ill, ipif_t *ipif)
16601 {
16602 	ilm_t	*ilm;
16603 	ilm_t	*ilm_next;
16604 	ilm_t	*new_ilm;
16605 	ilm_t	**ilmp;
16606 
16607 	ASSERT(MUTEX_HELD(&to_ill->ill_lock));
16608 	ASSERT(MUTEX_HELD(&from_ill->ill_lock));
16609 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
16610 
16611 	ilmp = &from_ill->ill_ilm;
16612 	for (ilm = from_ill->ill_ilm; ilm != NULL; ilm = ilm_next) {
16613 		ilm_next = ilm->ilm_next;
16614 
16615 		if (ilm->ilm_flags & ILM_DELETED) {
16616 			ilmp = &ilm->ilm_next;
16617 			continue;
16618 		}
16619 
16620 		ASSERT(ilm->ilm_ipif != NULL);
16621 
16622 		if (ilm->ilm_ipif != ipif) {
16623 			ilmp = &ilm->ilm_next;
16624 			continue;
16625 		}
16626 
16627 		if (V4_PART_OF_V6(ilm->ilm_v6addr) ==
16628 		    htonl(INADDR_ALLHOSTS_GROUP)) {
16629 			/*
16630 			 * We joined this in ipif_multicast_up
16631 			 * and we never did an ipif_multicast_down
16632 			 * for IPv4. If nobody else from the userland
16633 			 * has reference, we free the ilm, and later
16634 			 * when this ipif comes up on the new ill,
16635 			 * we will join this again.
16636 			 */
16637 			if (--ilm->ilm_refcnt == 0)
16638 				goto delete_ilm;
16639 
16640 			new_ilm = ilm_lookup_ipif(ipif,
16641 			    V4_PART_OF_V6(ilm->ilm_v6addr));
16642 			if (new_ilm != NULL) {
16643 				new_ilm->ilm_refcnt += ilm->ilm_refcnt;
16644 				/*
16645 				 * We still need to deal with the from_ill.
16646 				 */
16647 				new_ilm->ilm_is_new = B_TRUE;
16648 				new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
16649 				CLEAR_SLIST(new_ilm->ilm_filter);
16650 				goto delete_ilm;
16651 			}
16652 			/*
16653 			 * If we could not find one e.g. ipif is
16654 			 * still down on to_ill, we add this ilm
16655 			 * on ill_new to preserve the reference
16656 			 * count.
16657 			 */
16658 		}
16659 		/*
16660 		 * When ipifs move, ilms always move with it
16661 		 * to the NEW ill. Thus we should never be
16662 		 * able to find ilm till we really move it here.
16663 		 */
16664 		ASSERT(ilm_lookup_ipif(ipif,
16665 		    V4_PART_OF_V6(ilm->ilm_v6addr)) == NULL);
16666 
16667 		if (from_ill->ill_ilm_walker_cnt != 0) {
16668 			new_ilm = (ilm_t *)mi_zalloc(sizeof (ilm_t));
16669 			if (new_ilm == NULL) {
16670 				char buf[INET6_ADDRSTRLEN];
16671 				ip0dbg(("ilm_move_v4: FAILBACK of IPv4"
16672 				    " multicast address %s : "
16673 				    "from %s to"
16674 				    " %s failed : ENOMEM \n",
16675 				    inet_ntop(AF_INET,
16676 				    &ilm->ilm_v6addr, buf,
16677 				    sizeof (buf)),
16678 				    from_ill->ill_name,
16679 				    to_ill->ill_name));
16680 
16681 				ilmp = &ilm->ilm_next;
16682 				continue;
16683 			}
16684 			*new_ilm = *ilm;
16685 			/* We don't want new_ilm linked to ilm's filter list */
16686 			new_ilm->ilm_filter = NULL;
16687 		} else {
16688 			/* Remove from the list */
16689 			*ilmp = ilm->ilm_next;
16690 			new_ilm = ilm;
16691 		}
16692 
16693 		/*
16694 		 * If we have never joined this group on the to_ill
16695 		 * make sure we tell the driver.
16696 		 */
16697 		if (ilm_lookup_ill_v6(to_ill, &new_ilm->ilm_v6addr,
16698 		    ALL_ZONES) == NULL)
16699 			new_ilm->ilm_notify_driver = B_TRUE;
16700 
16701 		/* Add to the to_ill's list */
16702 		new_ilm->ilm_next = to_ill->ill_ilm;
16703 		to_ill->ill_ilm = new_ilm;
16704 		new_ilm->ilm_is_new = B_TRUE;
16705 
16706 		/*
16707 		 * Revert multicast filter state to (EXCLUDE, NULL)
16708 		 */
16709 		new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
16710 		CLEAR_SLIST(new_ilm->ilm_filter);
16711 
16712 		/*
16713 		 * Delete only if we have allocated a new ilm.
16714 		 */
16715 		if (new_ilm != ilm) {
16716 delete_ilm:
16717 			if (from_ill->ill_ilm_walker_cnt == 0) {
16718 				/* Remove from the list */
16719 				*ilmp = ilm->ilm_next;
16720 				ilm->ilm_next = NULL;
16721 				FREE_SLIST(ilm->ilm_filter);
16722 				FREE_SLIST(ilm->ilm_pendsrcs);
16723 				FREE_SLIST(ilm->ilm_rtx.rtx_allow);
16724 				FREE_SLIST(ilm->ilm_rtx.rtx_block);
16725 				mi_free((char *)ilm);
16726 			} else {
16727 				ilm->ilm_flags |= ILM_DELETED;
16728 				from_ill->ill_ilm_cleanup_reqd = 1;
16729 				ilmp = &ilm->ilm_next;
16730 			}
16731 		}
16732 	}
16733 }
16734 
16735 static uint_t
16736 ipif_get_id(ill_t *ill, uint_t id)
16737 {
16738 	uint_t	unit;
16739 	ipif_t	*tipif;
16740 	boolean_t found = B_FALSE;
16741 
16742 	/*
16743 	 * During failback, we want to go back to the same id
16744 	 * instead of the smallest id so that the original
16745 	 * configuration is maintained. id is non-zero in that
16746 	 * case.
16747 	 */
16748 	if (id != 0) {
16749 		/*
16750 		 * While failing back, if we still have an ipif with
16751 		 * MAX_ADDRS_PER_IF, it means this will be replaced
16752 		 * as soon as we return from this function. It was
16753 		 * to set to MAX_ADDRS_PER_IF by the caller so that
16754 		 * we can choose the smallest id. Thus we return zero
16755 		 * in that case ignoring the hint.
16756 		 */
16757 		if (ill->ill_ipif->ipif_id == MAX_ADDRS_PER_IF)
16758 			return (0);
16759 		for (tipif = ill->ill_ipif; tipif != NULL;
16760 		    tipif = tipif->ipif_next) {
16761 			if (tipif->ipif_id == id) {
16762 				found = B_TRUE;
16763 				break;
16764 			}
16765 		}
16766 		/*
16767 		 * If somebody already plumbed another logical
16768 		 * with the same id, we won't be able to find it.
16769 		 */
16770 		if (!found)
16771 			return (id);
16772 	}
16773 	for (unit = 0; unit <= ip_addrs_per_if; unit++) {
16774 		found = B_FALSE;
16775 		for (tipif = ill->ill_ipif; tipif != NULL;
16776 		    tipif = tipif->ipif_next) {
16777 			if (tipif->ipif_id == unit) {
16778 				found = B_TRUE;
16779 				break;
16780 			}
16781 		}
16782 		if (!found)
16783 			break;
16784 	}
16785 	return (unit);
16786 }
16787 
16788 /* ARGSUSED */
16789 static int
16790 ipif_move(ipif_t *ipif, ill_t *to_ill, queue_t *q, mblk_t *mp,
16791     ipif_t **rep_ipif_ptr)
16792 {
16793 	ill_t	*from_ill;
16794 	ipif_t	*rep_ipif;
16795 	ipif_t	**ipifp;
16796 	uint_t	unit;
16797 	int err = 0;
16798 	ipif_t	*to_ipif;
16799 	struct iocblk	*iocp;
16800 	boolean_t failback_cmd;
16801 	boolean_t remove_ipif;
16802 	int	rc;
16803 
16804 	ASSERT(IAM_WRITER_ILL(to_ill));
16805 	ASSERT(IAM_WRITER_IPIF(ipif));
16806 
16807 	iocp = (struct iocblk *)mp->b_rptr;
16808 	failback_cmd = (iocp->ioc_cmd == SIOCLIFFAILBACK);
16809 	remove_ipif = B_FALSE;
16810 
16811 	from_ill = ipif->ipif_ill;
16812 
16813 	ASSERT(MUTEX_HELD(&to_ill->ill_lock));
16814 	ASSERT(MUTEX_HELD(&from_ill->ill_lock));
16815 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
16816 
16817 	/*
16818 	 * Don't move LINK LOCAL addresses as they are tied to
16819 	 * physical interface.
16820 	 */
16821 	if (from_ill->ill_isv6 &&
16822 	    IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6lcl_addr)) {
16823 		ipif->ipif_was_up = B_FALSE;
16824 		IPIF_UNMARK_MOVING(ipif);
16825 		return (0);
16826 	}
16827 
16828 	/*
16829 	 * We set the ipif_id to maximum so that the search for
16830 	 * ipif_id will pick the lowest number i.e 0 in the
16831 	 * following 2 cases :
16832 	 *
16833 	 * 1) We have a replacement ipif at the head of to_ill.
16834 	 *    We can't remove it yet as we can exceed ip_addrs_per_if
16835 	 *    on to_ill and hence the MOVE might fail. We want to
16836 	 *    remove it only if we could move the ipif. Thus, by
16837 	 *    setting it to the MAX value, we make the search in
16838 	 *    ipif_get_id return the zeroth id.
16839 	 *
16840 	 * 2) When DR pulls out the NIC and re-plumbs the interface,
16841 	 *    we might just have a zero address plumbed on the ipif
16842 	 *    with zero id in the case of IPv4. We remove that while
16843 	 *    doing the failback. We want to remove it only if we
16844 	 *    could move the ipif. Thus, by setting it to the MAX
16845 	 *    value, we make the search in ipif_get_id return the
16846 	 *    zeroth id.
16847 	 *
16848 	 * Both (1) and (2) are done only when when we are moving
16849 	 * an ipif (either due to failover/failback) which originally
16850 	 * belonged to this interface i.e the ipif_orig_ifindex is
16851 	 * the same as to_ill's ifindex. This is needed so that
16852 	 * FAILOVER from A -> B ( A failed) followed by FAILOVER
16853 	 * from B -> A (B is being removed from the group) and
16854 	 * FAILBACK from A -> B restores the original configuration.
16855 	 * Without the check for orig_ifindex, the second FAILOVER
16856 	 * could make the ipif belonging to B replace the A's zeroth
16857 	 * ipif and the subsequent failback re-creating the replacement
16858 	 * ipif again.
16859 	 *
16860 	 * NOTE : We created the replacement ipif when we did a
16861 	 * FAILOVER (See below). We could check for FAILBACK and
16862 	 * then look for replacement ipif to be removed. But we don't
16863 	 * want to do that because we wan't to allow the possibility
16864 	 * of a FAILOVER from A -> B (which creates the replacement ipif),
16865 	 * followed by a *FAILOVER* from B -> A instead of a FAILBACK
16866 	 * from B -> A.
16867 	 */
16868 	to_ipif = to_ill->ill_ipif;
16869 	if ((to_ill->ill_phyint->phyint_ifindex ==
16870 	    ipif->ipif_orig_ifindex) &&
16871 	    IPIF_REPL_CHECK(to_ipif, failback_cmd)) {
16872 		ASSERT(to_ipif->ipif_id == 0);
16873 		remove_ipif = B_TRUE;
16874 		to_ipif->ipif_id = MAX_ADDRS_PER_IF;
16875 	}
16876 	/*
16877 	 * Find the lowest logical unit number on the to_ill.
16878 	 * If we are failing back, try to get the original id
16879 	 * rather than the lowest one so that the original
16880 	 * configuration is maintained.
16881 	 *
16882 	 * XXX need a better scheme for this.
16883 	 */
16884 	if (failback_cmd) {
16885 		unit = ipif_get_id(to_ill, ipif->ipif_orig_ipifid);
16886 	} else {
16887 		unit = ipif_get_id(to_ill, 0);
16888 	}
16889 
16890 	/* Reset back to zero in case we fail below */
16891 	if (to_ipif->ipif_id == MAX_ADDRS_PER_IF)
16892 		to_ipif->ipif_id = 0;
16893 
16894 	if (unit == ip_addrs_per_if) {
16895 		ipif->ipif_was_up = B_FALSE;
16896 		IPIF_UNMARK_MOVING(ipif);
16897 		return (EINVAL);
16898 	}
16899 
16900 	/*
16901 	 * ipif is ready to move from "from_ill" to "to_ill".
16902 	 *
16903 	 * 1) If we are moving ipif with id zero, create a
16904 	 *    replacement ipif for this ipif on from_ill. If this fails
16905 	 *    fail the MOVE operation.
16906 	 *
16907 	 * 2) Remove the replacement ipif on to_ill if any.
16908 	 *    We could remove the replacement ipif when we are moving
16909 	 *    the ipif with id zero. But what if somebody already
16910 	 *    unplumbed it ? Thus we always remove it if it is present.
16911 	 *    We want to do it only if we are sure we are going to
16912 	 *    move the ipif to to_ill which is why there are no
16913 	 *    returns due to error till ipif is linked to to_ill.
16914 	 *    Note that the first ipif that we failback will always
16915 	 *    be zero if it is present.
16916 	 */
16917 	if (ipif->ipif_id == 0) {
16918 		ipaddr_t inaddr_any = INADDR_ANY;
16919 
16920 		rep_ipif = (ipif_t *)mi_alloc(sizeof (ipif_t), BPRI_MED);
16921 		if (rep_ipif == NULL) {
16922 			ipif->ipif_was_up = B_FALSE;
16923 			IPIF_UNMARK_MOVING(ipif);
16924 			return (ENOMEM);
16925 		}
16926 		*rep_ipif = ipif_zero;
16927 		/*
16928 		 * Before we put the ipif on the list, store the addresses
16929 		 * as mapped addresses as some of the ioctls e.g SIOCGIFADDR
16930 		 * assumes so. This logic is not any different from what
16931 		 * ipif_allocate does.
16932 		 */
16933 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16934 		    &rep_ipif->ipif_v6lcl_addr);
16935 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16936 		    &rep_ipif->ipif_v6src_addr);
16937 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16938 		    &rep_ipif->ipif_v6subnet);
16939 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16940 		    &rep_ipif->ipif_v6net_mask);
16941 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16942 		    &rep_ipif->ipif_v6brd_addr);
16943 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16944 		    &rep_ipif->ipif_v6pp_dst_addr);
16945 		/*
16946 		 * We mark IPIF_NOFAILOVER so that this can never
16947 		 * move.
16948 		 */
16949 		rep_ipif->ipif_flags = ipif->ipif_flags | IPIF_NOFAILOVER;
16950 		rep_ipif->ipif_flags &= ~IPIF_UP & ~IPIF_DUPLICATE;
16951 		rep_ipif->ipif_replace_zero = B_TRUE;
16952 		mutex_init(&rep_ipif->ipif_saved_ire_lock, NULL,
16953 		    MUTEX_DEFAULT, NULL);
16954 		rep_ipif->ipif_id = 0;
16955 		rep_ipif->ipif_ire_type = ipif->ipif_ire_type;
16956 		rep_ipif->ipif_ill = from_ill;
16957 		rep_ipif->ipif_orig_ifindex =
16958 		    from_ill->ill_phyint->phyint_ifindex;
16959 		/* Insert at head */
16960 		rep_ipif->ipif_next = from_ill->ill_ipif;
16961 		from_ill->ill_ipif = rep_ipif;
16962 		/*
16963 		 * We don't really care to let apps know about
16964 		 * this interface.
16965 		 */
16966 	}
16967 
16968 	if (remove_ipif) {
16969 		/*
16970 		 * We set to a max value above for this case to get
16971 		 * id zero. ASSERT that we did get one.
16972 		 */
16973 		ASSERT((to_ipif->ipif_id == 0) && (unit == 0));
16974 		rep_ipif = to_ipif;
16975 		to_ill->ill_ipif = rep_ipif->ipif_next;
16976 		rep_ipif->ipif_next = NULL;
16977 		/*
16978 		 * If some apps scanned and find this interface,
16979 		 * it is time to let them know, so that they can
16980 		 * delete it.
16981 		 */
16982 
16983 		*rep_ipif_ptr = rep_ipif;
16984 	}
16985 
16986 	/* Get it out of the ILL interface list. */
16987 	ipifp = &ipif->ipif_ill->ill_ipif;
16988 	for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
16989 		if (*ipifp == ipif) {
16990 			*ipifp = ipif->ipif_next;
16991 			break;
16992 		}
16993 	}
16994 
16995 	/* Assign the new ill */
16996 	ipif->ipif_ill = to_ill;
16997 	ipif->ipif_id = unit;
16998 	/* id has already been checked */
16999 	rc = ipif_insert(ipif, B_FALSE, B_FALSE);
17000 	ASSERT(rc == 0);
17001 	/* Let SCTP update its list */
17002 	sctp_move_ipif(ipif, from_ill, to_ill);
17003 	/*
17004 	 * Handle the failover and failback of ipif_t between
17005 	 * ill_t that have differing maximum mtu values.
17006 	 */
17007 	if (ipif->ipif_mtu > to_ill->ill_max_mtu) {
17008 		if (ipif->ipif_saved_mtu == 0) {
17009 			/*
17010 			 * As this ipif_t is moving to an ill_t
17011 			 * that has a lower ill_max_mtu, its
17012 			 * ipif_mtu needs to be saved so it can
17013 			 * be restored during failback or during
17014 			 * failover to an ill_t which has a
17015 			 * higher ill_max_mtu.
17016 			 */
17017 			ipif->ipif_saved_mtu = ipif->ipif_mtu;
17018 			ipif->ipif_mtu = to_ill->ill_max_mtu;
17019 		} else {
17020 			/*
17021 			 * The ipif_t is, once again, moving to
17022 			 * an ill_t that has a lower maximum mtu
17023 			 * value.
17024 			 */
17025 			ipif->ipif_mtu = to_ill->ill_max_mtu;
17026 		}
17027 	} else if (ipif->ipif_mtu < to_ill->ill_max_mtu &&
17028 	    ipif->ipif_saved_mtu != 0) {
17029 		/*
17030 		 * The mtu of this ipif_t had to be reduced
17031 		 * during an earlier failover; this is an
17032 		 * opportunity for it to be increased (either as
17033 		 * part of another failover or a failback).
17034 		 */
17035 		if (ipif->ipif_saved_mtu <= to_ill->ill_max_mtu) {
17036 			ipif->ipif_mtu = ipif->ipif_saved_mtu;
17037 			ipif->ipif_saved_mtu = 0;
17038 		} else {
17039 			ipif->ipif_mtu = to_ill->ill_max_mtu;
17040 		}
17041 	}
17042 
17043 	/*
17044 	 * We preserve all the other fields of the ipif including
17045 	 * ipif_saved_ire_mp. The routes that are saved here will
17046 	 * be recreated on the new interface and back on the old
17047 	 * interface when we move back.
17048 	 */
17049 	ASSERT(ipif->ipif_arp_del_mp == NULL);
17050 
17051 	return (err);
17052 }
17053 
17054 static int
17055 ipif_move_all(ill_t *from_ill, ill_t *to_ill, queue_t *q, mblk_t *mp,
17056     int ifindex, ipif_t **rep_ipif_ptr)
17057 {
17058 	ipif_t *mipif;
17059 	ipif_t *ipif_next;
17060 	int err;
17061 
17062 	/*
17063 	 * We don't really try to MOVE back things if some of the
17064 	 * operations fail. The daemon will take care of moving again
17065 	 * later on.
17066 	 */
17067 	for (mipif = from_ill->ill_ipif; mipif != NULL; mipif = ipif_next) {
17068 		ipif_next = mipif->ipif_next;
17069 		if (!(mipif->ipif_flags & IPIF_NOFAILOVER) &&
17070 		    (ifindex == 0 || ifindex == mipif->ipif_orig_ifindex)) {
17071 
17072 			err = ipif_move(mipif, to_ill, q, mp, rep_ipif_ptr);
17073 
17074 			/*
17075 			 * When the MOVE fails, it is the job of the
17076 			 * application to take care of this properly
17077 			 * i.e try again if it is ENOMEM.
17078 			 */
17079 			if (mipif->ipif_ill != from_ill) {
17080 				/*
17081 				 * ipif has moved.
17082 				 *
17083 				 * Move the multicast memberships associated
17084 				 * with this ipif to the new ill. For IPv6, we
17085 				 * do it once after all the ipifs are moved
17086 				 * (in ill_move) as they are not associated
17087 				 * with ipifs.
17088 				 *
17089 				 * We need to move the ilms as the ipif has
17090 				 * already been moved to a new ill even
17091 				 * in the case of errors. Neither
17092 				 * ilm_free(ipif) will find the ilm
17093 				 * when somebody unplumbs this ipif nor
17094 				 * ilm_delete(ilm) will be able to find the
17095 				 * ilm, if we don't move now.
17096 				 */
17097 				if (!from_ill->ill_isv6)
17098 					ilm_move_v4(from_ill, to_ill, mipif);
17099 			}
17100 
17101 			if (err != 0)
17102 				return (err);
17103 		}
17104 	}
17105 	return (0);
17106 }
17107 
17108 static int
17109 ill_move(ill_t *from_ill, ill_t *to_ill, queue_t *q, mblk_t *mp)
17110 {
17111 	int ifindex;
17112 	int err;
17113 	struct iocblk	*iocp;
17114 	ipif_t	*ipif;
17115 	ipif_t *rep_ipif_ptr = NULL;
17116 	ipif_t	*from_ipif = NULL;
17117 	boolean_t check_rep_if = B_FALSE;
17118 
17119 	iocp = (struct iocblk *)mp->b_rptr;
17120 	if (iocp->ioc_cmd == SIOCLIFFAILOVER) {
17121 		/*
17122 		 * Move everything pointing at from_ill to to_ill.
17123 		 * We acheive this by passing in 0 as ifindex.
17124 		 */
17125 		ifindex = 0;
17126 	} else {
17127 		/*
17128 		 * Move everything pointing at from_ill whose original
17129 		 * ifindex of connp, ipif, ilm points at to_ill->ill_index.
17130 		 * We acheive this by passing in ifindex rather than 0.
17131 		 * Multicast vifs, ilgs move implicitly because ipifs move.
17132 		 */
17133 		ASSERT(iocp->ioc_cmd == SIOCLIFFAILBACK);
17134 		ifindex = to_ill->ill_phyint->phyint_ifindex;
17135 	}
17136 
17137 	/*
17138 	 * Determine if there is at least one ipif that would move from
17139 	 * 'from_ill' to 'to_ill'. If so, it is possible that the replacement
17140 	 * ipif (if it exists) on the to_ill would be consumed as a result of
17141 	 * the move, in which case we need to quiesce the replacement ipif also.
17142 	 */
17143 	for (from_ipif = from_ill->ill_ipif; from_ipif != NULL;
17144 	    from_ipif = from_ipif->ipif_next) {
17145 		if (((ifindex == 0) ||
17146 		    (ifindex == from_ipif->ipif_orig_ifindex)) &&
17147 		    !(from_ipif->ipif_flags & IPIF_NOFAILOVER)) {
17148 			check_rep_if = B_TRUE;
17149 			break;
17150 		}
17151 	}
17152 
17153 
17154 	ill_down_ipifs(from_ill, mp, ifindex, B_TRUE);
17155 
17156 	GRAB_ILL_LOCKS(from_ill, to_ill);
17157 	if ((ipif = ill_quiescent_to_move(from_ill)) != NULL) {
17158 		(void) ipsq_pending_mp_add(NULL, ipif, q,
17159 		    mp, ILL_MOVE_OK);
17160 		RELEASE_ILL_LOCKS(from_ill, to_ill);
17161 		return (EINPROGRESS);
17162 	}
17163 
17164 	/* Check if the replacement ipif is quiescent to delete */
17165 	if (check_rep_if && IPIF_REPL_CHECK(to_ill->ill_ipif,
17166 	    (iocp->ioc_cmd == SIOCLIFFAILBACK))) {
17167 		to_ill->ill_ipif->ipif_state_flags |=
17168 		    IPIF_MOVING | IPIF_CHANGING;
17169 		if ((ipif = ill_quiescent_to_move(to_ill)) != NULL) {
17170 			(void) ipsq_pending_mp_add(NULL, ipif, q,
17171 			    mp, ILL_MOVE_OK);
17172 			RELEASE_ILL_LOCKS(from_ill, to_ill);
17173 			return (EINPROGRESS);
17174 		}
17175 	}
17176 	RELEASE_ILL_LOCKS(from_ill, to_ill);
17177 
17178 	ASSERT(!MUTEX_HELD(&to_ill->ill_lock));
17179 	rw_enter(&ill_g_lock, RW_WRITER);
17180 	GRAB_ILL_LOCKS(from_ill, to_ill);
17181 	err = ipif_move_all(from_ill, to_ill, q, mp, ifindex, &rep_ipif_ptr);
17182 
17183 	/* ilm_move is done inside ipif_move for IPv4 */
17184 	if (err == 0 && from_ill->ill_isv6)
17185 		ilm_move_v6(from_ill, to_ill, ifindex);
17186 
17187 	RELEASE_ILL_LOCKS(from_ill, to_ill);
17188 	rw_exit(&ill_g_lock);
17189 
17190 	/*
17191 	 * send rts messages and multicast messages.
17192 	 */
17193 	if (rep_ipif_ptr != NULL) {
17194 		ip_rts_ifmsg(rep_ipif_ptr);
17195 		ip_rts_newaddrmsg(RTM_DELETE, 0, rep_ipif_ptr);
17196 		IPIF_TRACE_CLEANUP(rep_ipif_ptr);
17197 		mi_free(rep_ipif_ptr);
17198 	}
17199 
17200 	conn_move_ill(from_ill, to_ill, ifindex);
17201 
17202 	return (err);
17203 }
17204 
17205 /*
17206  * Used to extract arguments for FAILOVER/FAILBACK ioctls.
17207  * Also checks for the validity of the arguments.
17208  * Note: We are already exclusive inside the from group.
17209  * It is upto the caller to release refcnt on the to_ill's.
17210  */
17211 static int
17212 ip_extract_move_args(queue_t *q, mblk_t *mp, ill_t **ill_from_v4,
17213     ill_t **ill_from_v6, ill_t **ill_to_v4, ill_t **ill_to_v6)
17214 {
17215 	int dst_index;
17216 	ipif_t *ipif_v4, *ipif_v6;
17217 	struct lifreq *lifr;
17218 	mblk_t *mp1;
17219 	boolean_t exists;
17220 	sin_t	*sin;
17221 	int	err = 0;
17222 
17223 	if ((mp1 = mp->b_cont) == NULL)
17224 		return (EPROTO);
17225 
17226 	if ((mp1 = mp1->b_cont) == NULL)
17227 		return (EPROTO);
17228 
17229 	lifr = (struct lifreq *)mp1->b_rptr;
17230 	sin = (sin_t *)&lifr->lifr_addr;
17231 
17232 	/*
17233 	 * We operate on both IPv4 and IPv6. Thus, we don't allow IPv4/IPv6
17234 	 * specific operations.
17235 	 */
17236 	if (sin->sin_family != AF_UNSPEC)
17237 		return (EINVAL);
17238 
17239 	/*
17240 	 * Get ipif with id 0. We are writer on the from ill. So we can pass
17241 	 * NULLs for the last 4 args and we know the lookup won't fail
17242 	 * with EINPROGRESS.
17243 	 */
17244 	ipif_v4 = ipif_lookup_on_name(lifr->lifr_name,
17245 	    mi_strlen(lifr->lifr_name), B_FALSE, &exists, B_FALSE,
17246 	    ALL_ZONES, NULL, NULL, NULL, NULL);
17247 	ipif_v6 = ipif_lookup_on_name(lifr->lifr_name,
17248 	    mi_strlen(lifr->lifr_name), B_FALSE, &exists, B_TRUE,
17249 	    ALL_ZONES, NULL, NULL, NULL, NULL);
17250 
17251 	if (ipif_v4 == NULL && ipif_v6 == NULL)
17252 		return (ENXIO);
17253 
17254 	if (ipif_v4 != NULL) {
17255 		ASSERT(ipif_v4->ipif_refcnt != 0);
17256 		if (ipif_v4->ipif_id != 0) {
17257 			err = EINVAL;
17258 			goto done;
17259 		}
17260 
17261 		ASSERT(IAM_WRITER_IPIF(ipif_v4));
17262 		*ill_from_v4 = ipif_v4->ipif_ill;
17263 	}
17264 
17265 	if (ipif_v6 != NULL) {
17266 		ASSERT(ipif_v6->ipif_refcnt != 0);
17267 		if (ipif_v6->ipif_id != 0) {
17268 			err = EINVAL;
17269 			goto done;
17270 		}
17271 
17272 		ASSERT(IAM_WRITER_IPIF(ipif_v6));
17273 		*ill_from_v6 = ipif_v6->ipif_ill;
17274 	}
17275 
17276 	err = 0;
17277 	dst_index = lifr->lifr_movetoindex;
17278 	*ill_to_v4 = ill_lookup_on_ifindex(dst_index, B_FALSE,
17279 	    q, mp, ip_process_ioctl, &err);
17280 	if (err != 0) {
17281 		/*
17282 		 * There could be only v6.
17283 		 */
17284 		if (err != ENXIO)
17285 			goto done;
17286 		err = 0;
17287 	}
17288 
17289 	*ill_to_v6 = ill_lookup_on_ifindex(dst_index, B_TRUE,
17290 	    q, mp, ip_process_ioctl, &err);
17291 	if (err != 0) {
17292 		if (err != ENXIO)
17293 			goto done;
17294 		if (*ill_to_v4 == NULL) {
17295 			err = ENXIO;
17296 			goto done;
17297 		}
17298 		err = 0;
17299 	}
17300 
17301 	/*
17302 	 * If we have something to MOVE i.e "from" not NULL,
17303 	 * "to" should be non-NULL.
17304 	 */
17305 	if ((*ill_from_v4 != NULL && *ill_to_v4 == NULL) ||
17306 	    (*ill_from_v6 != NULL && *ill_to_v6 == NULL)) {
17307 		err = EINVAL;
17308 	}
17309 
17310 done:
17311 	if (ipif_v4 != NULL)
17312 		ipif_refrele(ipif_v4);
17313 	if (ipif_v6 != NULL)
17314 		ipif_refrele(ipif_v6);
17315 	return (err);
17316 }
17317 
17318 /*
17319  * FAILOVER and FAILBACK are modelled as MOVE operations.
17320  *
17321  * We don't check whether the MOVE is within the same group or
17322  * not, because this ioctl can be used as a generic mechanism
17323  * to failover from interface A to B, though things will function
17324  * only if they are really part of the same group. Moreover,
17325  * all ipifs may be down and hence temporarily out of the group.
17326  *
17327  * ipif's that need to be moved are first brought down; V4 ipifs are brought
17328  * down first and then V6.  For each we wait for the ipif's to become quiescent.
17329  * Bringing down the ipifs ensures that all ires pointing to these ipifs's
17330  * have been deleted and there are no active references. Once quiescent the
17331  * ipif's are moved and brought up on the new ill.
17332  *
17333  * Normally the source ill and destination ill belong to the same IPMP group
17334  * and hence the same ipsq_t. In the event they don't belong to the same
17335  * same group the two ipsq's are first merged into one ipsq - that of the
17336  * to_ill. The multicast memberships on the source and destination ill cannot
17337  * change during the move operation since multicast joins/leaves also have to
17338  * execute on the same ipsq and are hence serialized.
17339  */
17340 /* ARGSUSED */
17341 int
17342 ip_sioctl_move(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17343     ip_ioctl_cmd_t *ipip, void *ifreq)
17344 {
17345 	ill_t *ill_to_v4 = NULL;
17346 	ill_t *ill_to_v6 = NULL;
17347 	ill_t *ill_from_v4 = NULL;
17348 	ill_t *ill_from_v6 = NULL;
17349 	int err = 0;
17350 
17351 	/*
17352 	 * setup from and to ill's, we can get EINPROGRESS only for
17353 	 * to_ill's.
17354 	 */
17355 	err = ip_extract_move_args(q, mp, &ill_from_v4, &ill_from_v6,
17356 	    &ill_to_v4, &ill_to_v6);
17357 
17358 	if (err != 0) {
17359 		ip0dbg(("ip_sioctl_move: extract args failed\n"));
17360 		goto done;
17361 	}
17362 
17363 	/*
17364 	 * nothing to do.
17365 	 */
17366 	if ((ill_from_v4 != NULL) && (ill_from_v4 == ill_to_v4)) {
17367 		goto done;
17368 	}
17369 
17370 	/*
17371 	 * nothing to do.
17372 	 */
17373 	if ((ill_from_v6 != NULL) && (ill_from_v6 == ill_to_v6)) {
17374 		goto done;
17375 	}
17376 
17377 	/*
17378 	 * Mark the ill as changing.
17379 	 * ILL_CHANGING flag is cleared when the ipif's are brought up
17380 	 * in ill_up_ipifs in case of error they are cleared below.
17381 	 */
17382 
17383 	GRAB_ILL_LOCKS(ill_from_v4, ill_from_v6);
17384 	if (ill_from_v4 != NULL)
17385 		ill_from_v4->ill_state_flags |= ILL_CHANGING;
17386 	if (ill_from_v6 != NULL)
17387 		ill_from_v6->ill_state_flags |= ILL_CHANGING;
17388 	RELEASE_ILL_LOCKS(ill_from_v4, ill_from_v6);
17389 
17390 	/*
17391 	 * Make sure that both src and dst are
17392 	 * in the same syncq group. If not make it happen.
17393 	 * We are not holding any locks because we are the writer
17394 	 * on the from_ipsq and we will hold locks in ill_merge_groups
17395 	 * to protect to_ipsq against changing.
17396 	 */
17397 	if (ill_from_v4 != NULL) {
17398 		if (ill_from_v4->ill_phyint->phyint_ipsq !=
17399 		    ill_to_v4->ill_phyint->phyint_ipsq) {
17400 			err = ill_merge_groups(ill_from_v4, ill_to_v4,
17401 			    NULL, mp, q);
17402 			goto err_ret;
17403 
17404 		}
17405 		ASSERT(!MUTEX_HELD(&ill_to_v4->ill_lock));
17406 	} else {
17407 
17408 		if (ill_from_v6->ill_phyint->phyint_ipsq !=
17409 		    ill_to_v6->ill_phyint->phyint_ipsq) {
17410 			err = ill_merge_groups(ill_from_v6, ill_to_v6,
17411 			    NULL, mp, q);
17412 			goto err_ret;
17413 
17414 		}
17415 		ASSERT(!MUTEX_HELD(&ill_to_v6->ill_lock));
17416 	}
17417 
17418 	/*
17419 	 * Now that the ipsq's have been merged and we are the writer
17420 	 * lets mark to_ill as changing as well.
17421 	 */
17422 
17423 	GRAB_ILL_LOCKS(ill_to_v4, ill_to_v6);
17424 	if (ill_to_v4 != NULL)
17425 		ill_to_v4->ill_state_flags |= ILL_CHANGING;
17426 	if (ill_to_v6 != NULL)
17427 		ill_to_v6->ill_state_flags |= ILL_CHANGING;
17428 	RELEASE_ILL_LOCKS(ill_to_v4, ill_to_v6);
17429 
17430 	/*
17431 	 * Its ok for us to proceed with the move even if
17432 	 * ill_pending_mp is non null on one of the from ill's as the reply
17433 	 * should not be looking at the ipif, it should only care about the
17434 	 * ill itself.
17435 	 */
17436 
17437 	/*
17438 	 * lets move ipv4 first.
17439 	 */
17440 	if (ill_from_v4 != NULL) {
17441 		ASSERT(IAM_WRITER_ILL(ill_to_v4));
17442 		ill_from_v4->ill_move_in_progress = B_TRUE;
17443 		ill_to_v4->ill_move_in_progress = B_TRUE;
17444 		ill_to_v4->ill_move_peer = ill_from_v4;
17445 		ill_from_v4->ill_move_peer = ill_to_v4;
17446 		err = ill_move(ill_from_v4, ill_to_v4, q, mp);
17447 	}
17448 
17449 	/*
17450 	 * Now lets move ipv6.
17451 	 */
17452 	if (err == 0 && ill_from_v6 != NULL) {
17453 		ASSERT(IAM_WRITER_ILL(ill_to_v6));
17454 		ill_from_v6->ill_move_in_progress = B_TRUE;
17455 		ill_to_v6->ill_move_in_progress = B_TRUE;
17456 		ill_to_v6->ill_move_peer = ill_from_v6;
17457 		ill_from_v6->ill_move_peer = ill_to_v6;
17458 		err = ill_move(ill_from_v6, ill_to_v6, q, mp);
17459 	}
17460 
17461 err_ret:
17462 	/*
17463 	 * EINPROGRESS means we are waiting for the ipif's that need to be
17464 	 * moved to become quiescent.
17465 	 */
17466 	if (err == EINPROGRESS) {
17467 		goto done;
17468 	}
17469 
17470 	/*
17471 	 * if err is set ill_up_ipifs will not be called
17472 	 * lets clear the flags.
17473 	 */
17474 
17475 	GRAB_ILL_LOCKS(ill_to_v4, ill_to_v6);
17476 	GRAB_ILL_LOCKS(ill_from_v4, ill_from_v6);
17477 	/*
17478 	 * Some of the clearing may be redundant. But it is simple
17479 	 * not making any extra checks.
17480 	 */
17481 	if (ill_from_v6 != NULL) {
17482 		ill_from_v6->ill_move_in_progress = B_FALSE;
17483 		ill_from_v6->ill_move_peer = NULL;
17484 		ill_from_v6->ill_state_flags &= ~ILL_CHANGING;
17485 	}
17486 	if (ill_from_v4 != NULL) {
17487 		ill_from_v4->ill_move_in_progress = B_FALSE;
17488 		ill_from_v4->ill_move_peer = NULL;
17489 		ill_from_v4->ill_state_flags &= ~ILL_CHANGING;
17490 	}
17491 	if (ill_to_v6 != NULL) {
17492 		ill_to_v6->ill_move_in_progress = B_FALSE;
17493 		ill_to_v6->ill_move_peer = NULL;
17494 		ill_to_v6->ill_state_flags &= ~ILL_CHANGING;
17495 	}
17496 	if (ill_to_v4 != NULL) {
17497 		ill_to_v4->ill_move_in_progress = B_FALSE;
17498 		ill_to_v4->ill_move_peer = NULL;
17499 		ill_to_v4->ill_state_flags &= ~ILL_CHANGING;
17500 	}
17501 
17502 	/*
17503 	 * Check for setting INACTIVE, if STANDBY is set and FAILED is not set.
17504 	 * Do this always to maintain proper state i.e even in case of errors.
17505 	 * As phyint_inactive looks at both v4 and v6 interfaces,
17506 	 * we need not call on both v4 and v6 interfaces.
17507 	 */
17508 	if (ill_from_v4 != NULL) {
17509 		if ((ill_from_v4->ill_phyint->phyint_flags &
17510 		    (PHYI_STANDBY | PHYI_FAILED)) == PHYI_STANDBY) {
17511 			phyint_inactive(ill_from_v4->ill_phyint);
17512 		}
17513 	} else if (ill_from_v6 != NULL) {
17514 		if ((ill_from_v6->ill_phyint->phyint_flags &
17515 		    (PHYI_STANDBY | PHYI_FAILED)) == PHYI_STANDBY) {
17516 			phyint_inactive(ill_from_v6->ill_phyint);
17517 		}
17518 	}
17519 
17520 	if (ill_to_v4 != NULL) {
17521 		if (ill_to_v4->ill_phyint->phyint_flags & PHYI_INACTIVE) {
17522 			ill_to_v4->ill_phyint->phyint_flags &= ~PHYI_INACTIVE;
17523 		}
17524 	} else if (ill_to_v6 != NULL) {
17525 		if (ill_to_v6->ill_phyint->phyint_flags & PHYI_INACTIVE) {
17526 			ill_to_v6->ill_phyint->phyint_flags &= ~PHYI_INACTIVE;
17527 		}
17528 	}
17529 
17530 	RELEASE_ILL_LOCKS(ill_to_v4, ill_to_v6);
17531 	RELEASE_ILL_LOCKS(ill_from_v4, ill_from_v6);
17532 
17533 no_err:
17534 	/*
17535 	 * lets bring the interfaces up on the to_ill.
17536 	 */
17537 	if (err == 0) {
17538 		err = ill_up_ipifs(ill_to_v4 == NULL ? ill_to_v6:ill_to_v4,
17539 		    q, mp);
17540 	}
17541 
17542 	if (err == 0) {
17543 		if (ill_from_v4 != NULL && ill_to_v4 != NULL)
17544 			ilm_send_multicast_reqs(ill_from_v4, ill_to_v4);
17545 
17546 		if (ill_from_v6 != NULL && ill_to_v6 != NULL)
17547 			ilm_send_multicast_reqs(ill_from_v6, ill_to_v6);
17548 	}
17549 done:
17550 
17551 	if (ill_to_v4 != NULL) {
17552 		ill_refrele(ill_to_v4);
17553 	}
17554 	if (ill_to_v6 != NULL) {
17555 		ill_refrele(ill_to_v6);
17556 	}
17557 
17558 	return (err);
17559 }
17560 
17561 static void
17562 ill_dl_down(ill_t *ill)
17563 {
17564 	/*
17565 	 * The ill is down; unbind but stay attached since we're still
17566 	 * associated with a PPA.
17567 	 */
17568 	mblk_t	*mp = ill->ill_unbind_mp;
17569 
17570 	ill->ill_unbind_mp = NULL;
17571 	ip1dbg(("ill_dl_down(%s)\n", ill->ill_name));
17572 	if (mp != NULL) {
17573 		ip1dbg(("ill_dl_down: %s (%u) for %s\n",
17574 		    dlpi_prim_str(*(int *)mp->b_rptr), *(int *)mp->b_rptr,
17575 		    ill->ill_name));
17576 		mutex_enter(&ill->ill_lock);
17577 		ill->ill_state_flags |= ILL_DL_UNBIND_IN_PROGRESS;
17578 		mutex_exit(&ill->ill_lock);
17579 		ill_dlpi_send(ill, mp);
17580 	}
17581 
17582 	/*
17583 	 * Toss all of our multicast memberships.  We could keep them, but
17584 	 * then we'd have to do bookkeeping of any joins and leaves performed
17585 	 * by the application while the the interface is down (we can't just
17586 	 * issue them because arp cannot currently process AR_ENTRY_SQUERY's
17587 	 * on a downed interface).
17588 	 */
17589 	ill_leave_multicast(ill);
17590 
17591 	mutex_enter(&ill->ill_lock);
17592 	ill->ill_dl_up = 0;
17593 	mutex_exit(&ill->ill_lock);
17594 }
17595 
17596 void
17597 ill_dlpi_dispatch(ill_t *ill, mblk_t *mp)
17598 {
17599 	union DL_primitives *dlp;
17600 	t_uscalar_t prim;
17601 
17602 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
17603 
17604 	dlp = (union DL_primitives *)mp->b_rptr;
17605 	prim = dlp->dl_primitive;
17606 
17607 	ip1dbg(("ill_dlpi_dispatch: sending %s (%u) to %s\n",
17608 		dlpi_prim_str(prim), prim, ill->ill_name));
17609 
17610 	switch (prim) {
17611 	case DL_PHYS_ADDR_REQ:
17612 	{
17613 		dl_phys_addr_req_t *dlpap = (dl_phys_addr_req_t *)mp->b_rptr;
17614 		ill->ill_phys_addr_pend = dlpap->dl_addr_type;
17615 		break;
17616 	}
17617 	case DL_BIND_REQ:
17618 		mutex_enter(&ill->ill_lock);
17619 		ill->ill_state_flags &= ~ILL_DL_UNBIND_IN_PROGRESS;
17620 		mutex_exit(&ill->ill_lock);
17621 		break;
17622 	}
17623 
17624 	ill->ill_dlpi_pending = prim;
17625 
17626 	/*
17627 	 * Some drivers send M_FLUSH up to IP as part of unbind
17628 	 * request.  When this M_FLUSH is sent back to the driver,
17629 	 * this can go after we send the detach request if the
17630 	 * M_FLUSH ends up in IP's syncq. To avoid that, we reply
17631 	 * to the M_FLUSH in ip_rput and locally generate another
17632 	 * M_FLUSH for the correctness.  This will get freed in
17633 	 * ip_wput_nondata.
17634 	 */
17635 	if (prim == DL_UNBIND_REQ)
17636 		(void) putnextctl1(ill->ill_rq, M_FLUSH, FLUSHRW);
17637 
17638 	putnext(ill->ill_wq, mp);
17639 }
17640 
17641 /*
17642  * Send a DLPI control message to the driver but make sure there
17643  * is only one outstanding message. Uses ill_dlpi_pending to tell
17644  * when it must queue. ip_rput_dlpi_writer calls ill_dlpi_done()
17645  * when an ACK or a NAK is received to process the next queued message.
17646  *
17647  * We don't protect ill_dlpi_pending with any lock. This is okay as
17648  * every place where its accessed, ip is exclusive while accessing
17649  * ill_dlpi_pending except when this function is called from ill_init()
17650  */
17651 void
17652 ill_dlpi_send(ill_t *ill, mblk_t *mp)
17653 {
17654 	mblk_t **mpp;
17655 
17656 	ASSERT(IAM_WRITER_ILL(ill));
17657 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
17658 
17659 	if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
17660 		/* Must queue message. Tail insertion */
17661 		mpp = &ill->ill_dlpi_deferred;
17662 		while (*mpp != NULL)
17663 			mpp = &((*mpp)->b_next);
17664 
17665 		ip1dbg(("ill_dlpi_send: deferring request for %s\n",
17666 		    ill->ill_name));
17667 
17668 		*mpp = mp;
17669 		return;
17670 	}
17671 
17672 	ill_dlpi_dispatch(ill, mp);
17673 }
17674 
17675 /*
17676  * Called when an DLPI control message has been acked or nacked to
17677  * send down the next queued message (if any).
17678  */
17679 void
17680 ill_dlpi_done(ill_t *ill, t_uscalar_t prim)
17681 {
17682 	mblk_t *mp;
17683 
17684 	ASSERT(IAM_WRITER_ILL(ill));
17685 
17686 	ASSERT(prim != DL_PRIM_INVAL);
17687 	if (ill->ill_dlpi_pending != prim) {
17688 		if (ill->ill_dlpi_pending == DL_PRIM_INVAL) {
17689 			(void) mi_strlog(ill->ill_rq, 1,
17690 			    SL_CONSOLE|SL_ERROR|SL_TRACE,
17691 			    "ill_dlpi_done: unsolicited ack for %s from %s\n",
17692 			    dlpi_prim_str(prim), ill->ill_name);
17693 		} else {
17694 			(void) mi_strlog(ill->ill_rq, 1,
17695 			    SL_CONSOLE|SL_ERROR|SL_TRACE,
17696 			    "ill_dlpi_done: unexpected ack for %s from %s "
17697 			    "(expecting ack for %s)\n",
17698 			    dlpi_prim_str(prim), ill->ill_name,
17699 			    dlpi_prim_str(ill->ill_dlpi_pending));
17700 		}
17701 		return;
17702 	}
17703 
17704 	ip1dbg(("ill_dlpi_done: %s has completed %s (%u)\n", ill->ill_name,
17705 	    dlpi_prim_str(ill->ill_dlpi_pending), ill->ill_dlpi_pending));
17706 
17707 	if ((mp = ill->ill_dlpi_deferred) == NULL) {
17708 		ill->ill_dlpi_pending = DL_PRIM_INVAL;
17709 		return;
17710 	}
17711 
17712 	ill->ill_dlpi_deferred = mp->b_next;
17713 	mp->b_next = NULL;
17714 
17715 	ill_dlpi_dispatch(ill, mp);
17716 }
17717 
17718 void
17719 conn_delete_ire(conn_t *connp, caddr_t arg)
17720 {
17721 	ipif_t	*ipif = (ipif_t *)arg;
17722 	ire_t	*ire;
17723 
17724 	/*
17725 	 * Look at the cached ires on conns which has pointers to ipifs.
17726 	 * We just call ire_refrele which clears up the reference
17727 	 * to ire. Called when a conn closes. Also called from ipif_free
17728 	 * to cleanup indirect references to the stale ipif via the cached ire.
17729 	 */
17730 	mutex_enter(&connp->conn_lock);
17731 	ire = connp->conn_ire_cache;
17732 	if (ire != NULL && (ipif == NULL || ire->ire_ipif == ipif)) {
17733 		connp->conn_ire_cache = NULL;
17734 		mutex_exit(&connp->conn_lock);
17735 		IRE_REFRELE_NOTR(ire);
17736 		return;
17737 	}
17738 	mutex_exit(&connp->conn_lock);
17739 
17740 }
17741 
17742 /*
17743  * Some operations (illgrp_delete(), ipif_down()) conditionally delete a number
17744  * of IREs. Those IREs may have been previously cached in the conn structure.
17745  * This ipcl_walk() walker function releases all references to such IREs based
17746  * on the condemned flag.
17747  */
17748 /* ARGSUSED */
17749 void
17750 conn_cleanup_stale_ire(conn_t *connp, caddr_t arg)
17751 {
17752 	ire_t	*ire;
17753 
17754 	mutex_enter(&connp->conn_lock);
17755 	ire = connp->conn_ire_cache;
17756 	if (ire != NULL && (ire->ire_marks & IRE_MARK_CONDEMNED)) {
17757 		connp->conn_ire_cache = NULL;
17758 		mutex_exit(&connp->conn_lock);
17759 		IRE_REFRELE_NOTR(ire);
17760 		return;
17761 	}
17762 	mutex_exit(&connp->conn_lock);
17763 }
17764 
17765 /*
17766  * Take down a specific interface, but don't lose any information about it.
17767  * Also delete interface from its interface group (ifgrp).
17768  * (Always called as writer.)
17769  * This function goes through the down sequence even if the interface is
17770  * already down. There are 2 reasons.
17771  * a. Currently we permit interface routes that depend on down interfaces
17772  *    to be added. This behaviour itself is questionable. However it appears
17773  *    that both Solaris and 4.3 BSD have exhibited this behaviour for a long
17774  *    time. We go thru the cleanup in order to remove these routes.
17775  * b. The bringup of the interface could fail in ill_dl_up i.e. we get
17776  *    DL_ERROR_ACK in response to the the DL_BIND request. The interface is
17777  *    down, but we need to cleanup i.e. do ill_dl_down and
17778  *    ip_rput_dlpi_writer (DL_ERROR_ACK) -> ipif_down.
17779  *
17780  * IP-MT notes:
17781  *
17782  * Model of reference to interfaces.
17783  *
17784  * The following members in ipif_t track references to the ipif.
17785  *	int     ipif_refcnt;    Active reference count
17786  *	uint_t  ipif_ire_cnt;   Number of ire's referencing this ipif
17787  * The following members in ill_t track references to the ill.
17788  *	int             ill_refcnt;     active refcnt
17789  *	uint_t          ill_ire_cnt;	Number of ires referencing ill
17790  *	uint_t          ill_nce_cnt;	Number of nces referencing ill
17791  *
17792  * Reference to an ipif or ill can be obtained in any of the following ways.
17793  *
17794  * Through the lookup functions ipif_lookup_* / ill_lookup_* functions
17795  * Pointers to ipif / ill from other data structures viz ire and conn.
17796  * Implicit reference to the ipif / ill by holding a reference to the ire.
17797  *
17798  * The ipif/ill lookup functions return a reference held ipif / ill.
17799  * ipif_refcnt and ill_refcnt track the reference counts respectively.
17800  * This is a purely dynamic reference count associated with threads holding
17801  * references to the ipif / ill. Pointers from other structures do not
17802  * count towards this reference count.
17803  *
17804  * ipif_ire_cnt/ill_ire_cnt is the number of ire's associated with the
17805  * ipif/ill. This is incremented whenever a new ire is created referencing the
17806  * ipif/ill. This is done atomically inside ire_add_v[46] where the ire is
17807  * actually added to the ire hash table. The count is decremented in
17808  * ire_inactive where the ire is destroyed.
17809  *
17810  * nce's reference ill's thru nce_ill and the count of nce's associated with
17811  * an ill is recorded in ill_nce_cnt. This is incremented atomically in
17812  * ndp_add() where the nce is actually added to the table. Similarly it is
17813  * decremented in ndp_inactive where the nce is destroyed.
17814  *
17815  * Flow of ioctls involving interface down/up
17816  *
17817  * The following is the sequence of an attempt to set some critical flags on an
17818  * up interface.
17819  * ip_sioctl_flags
17820  * ipif_down
17821  * wait for ipif to be quiescent
17822  * ipif_down_tail
17823  * ip_sioctl_flags_tail
17824  *
17825  * All set ioctls that involve down/up sequence would have a skeleton similar
17826  * to the above. All the *tail functions are called after the refcounts have
17827  * dropped to the appropriate values.
17828  *
17829  * The mechanism to quiesce an ipif is as follows.
17830  *
17831  * Mark the ipif as IPIF_CHANGING. No more lookups will be allowed
17832  * on the ipif. Callers either pass a flag requesting wait or the lookup
17833  *  functions will return NULL.
17834  *
17835  * Delete all ires referencing this ipif
17836  *
17837  * Any thread attempting to do an ipif_refhold on an ipif that has been
17838  * obtained thru a cached pointer will first make sure that
17839  * the ipif can be refheld using the macro IPIF_CAN_LOOKUP and only then
17840  * increment the refcount.
17841  *
17842  * The above guarantees that the ipif refcount will eventually come down to
17843  * zero and the ipif will quiesce, once all threads that currently hold a
17844  * reference to the ipif refrelease the ipif. The ipif is quiescent after the
17845  * ipif_refcount has dropped to zero and all ire's associated with this ipif
17846  * have also been ire_inactive'd. i.e. when ipif_ire_cnt and ipif_refcnt both
17847  * drop to zero.
17848  *
17849  * Lookups during the IPIF_CHANGING/ILL_CHANGING interval.
17850  *
17851  * Threads trying to lookup an ipif or ill can pass a flag requesting
17852  * wait and restart if the ipif / ill cannot be looked up currently.
17853  * For eg. bind, and route operations (Eg. route add / delete) cannot return
17854  * failure if the ipif is currently undergoing an exclusive operation, and
17855  * hence pass the flag. The mblk is then enqueued in the ipsq and the operation
17856  * is restarted by ipsq_exit() when the currently exclusive ioctl completes.
17857  * The lookup and enqueue is atomic using the ill_lock and ipsq_lock. The
17858  * lookup is done holding the ill_lock. Hence the ill/ipif state flags can't
17859  * change while the ill_lock is held. Before dropping the ill_lock we acquire
17860  * the ipsq_lock and call ipsq_enq. This ensures that ipsq_exit can't finish
17861  * until we release the ipsq_lock, even though the the ill/ipif state flags
17862  * can change after we drop the ill_lock.
17863  *
17864  * An attempt to send out a packet using an ipif that is currently
17865  * IPIF_CHANGING will fail. No attempt is made in this case to enqueue this
17866  * operation and restart it later when the exclusive condition on the ipif ends.
17867  * This is an example of not passing the wait flag to the lookup functions. For
17868  * example an attempt to refhold and use conn->conn_multicast_ipif and send
17869  * out a multicast packet on that ipif will fail while the ipif is
17870  * IPIF_CHANGING. An attempt to create an IRE_CACHE using an ipif that is
17871  * currently IPIF_CHANGING will also fail.
17872  */
17873 int
17874 ipif_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
17875 {
17876 	ill_t		*ill = ipif->ipif_ill;
17877 	phyint_t	*phyi;
17878 	conn_t		*connp;
17879 	boolean_t	success;
17880 	boolean_t	ipif_was_up = B_FALSE;
17881 
17882 	ASSERT(IAM_WRITER_IPIF(ipif));
17883 
17884 	ip1dbg(("ipif_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
17885 
17886 	if (ipif->ipif_flags & IPIF_UP) {
17887 		mutex_enter(&ill->ill_lock);
17888 		ipif->ipif_flags &= ~IPIF_UP;
17889 		ASSERT(ill->ill_ipif_up_count > 0);
17890 		--ill->ill_ipif_up_count;
17891 		mutex_exit(&ill->ill_lock);
17892 		ipif_was_up = B_TRUE;
17893 		/* Update status in SCTP's list */
17894 		sctp_update_ipif(ipif, SCTP_IPIF_DOWN);
17895 	}
17896 
17897 	/*
17898 	 * Blow away v6 memberships we established in ipif_multicast_up(); the
17899 	 * v4 ones are left alone (as is the ipif_multicast_up flag, so we
17900 	 * know not to rejoin when the interface is brought back up).
17901 	 */
17902 	if (ipif->ipif_isv6)
17903 		ipif_multicast_down(ipif);
17904 	/*
17905 	 * Remove from the mapping for __sin6_src_id. We insert only
17906 	 * when the address is not INADDR_ANY. As IPv4 addresses are
17907 	 * stored as mapped addresses, we need to check for mapped
17908 	 * INADDR_ANY also.
17909 	 */
17910 	if (ipif_was_up && !IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
17911 	    !IN6_IS_ADDR_V4MAPPED_ANY(&ipif->ipif_v6lcl_addr) &&
17912 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
17913 		int err;
17914 
17915 		err = ip_srcid_remove(&ipif->ipif_v6lcl_addr,
17916 		    ipif->ipif_zoneid);
17917 		if (err != 0) {
17918 			ip0dbg(("ipif_down: srcid_remove %d\n", err));
17919 		}
17920 	}
17921 
17922 	/*
17923 	 * Before we delete the ill from the group (if any), we need
17924 	 * to make sure that we delete all the routes dependent on
17925 	 * this and also any ipifs dependent on this ipif for
17926 	 * source address. We need to do before we delete from
17927 	 * the group because
17928 	 *
17929 	 * 1) ipif_down_delete_ire de-references ill->ill_group.
17930 	 *
17931 	 * 2) ipif_update_other_ipifs needs to walk the whole group
17932 	 *    for re-doing source address selection. Note that
17933 	 *    ipif_select_source[_v6] called from
17934 	 *    ipif_update_other_ipifs[_v6] will not pick this ipif
17935 	 *    because we have already marked down here i.e cleared
17936 	 *    IPIF_UP.
17937 	 */
17938 	if (ipif->ipif_isv6)
17939 		ire_walk_v6(ipif_down_delete_ire, (char *)ipif, ALL_ZONES);
17940 	else
17941 		ire_walk_v4(ipif_down_delete_ire, (char *)ipif, ALL_ZONES);
17942 
17943 	/*
17944 	 * Need to add these also to be saved and restored when the
17945 	 * ipif is brought down and up
17946 	 */
17947 	mutex_enter(&ire_mrtun_lock);
17948 	if (ire_mrtun_count != 0) {
17949 		mutex_exit(&ire_mrtun_lock);
17950 		ire_walk_ill_mrtun(0, 0, ipif_down_delete_ire,
17951 		    (char *)ipif, NULL);
17952 	} else {
17953 		mutex_exit(&ire_mrtun_lock);
17954 	}
17955 
17956 	mutex_enter(&ire_srcif_table_lock);
17957 	if (ire_srcif_table_count > 0) {
17958 		mutex_exit(&ire_srcif_table_lock);
17959 		ire_walk_srcif_table_v4(ipif_down_delete_ire, (char *)ipif);
17960 	} else {
17961 		mutex_exit(&ire_srcif_table_lock);
17962 	}
17963 
17964 	/*
17965 	 * Cleaning up the conn_ire_cache or conns must be done only after the
17966 	 * ires have been deleted above. Otherwise a thread could end up
17967 	 * caching an ire in a conn after we have finished the cleanup of the
17968 	 * conn. The caching is done after making sure that the ire is not yet
17969 	 * condemned. Also documented in the block comment above ip_output
17970 	 */
17971 	ipcl_walk(conn_cleanup_stale_ire, NULL);
17972 	/* Also, delete the ires cached in SCTP */
17973 	sctp_ire_cache_flush(ipif);
17974 
17975 	/* Resolve any IPsec/IKE NAT-T instances that depend on this ipif. */
17976 	nattymod_clean_ipif(ipif);
17977 
17978 	/*
17979 	 * Update any other ipifs which have used "our" local address as
17980 	 * a source address. This entails removing and recreating IRE_INTERFACE
17981 	 * entries for such ipifs.
17982 	 */
17983 	if (ipif->ipif_isv6)
17984 		ipif_update_other_ipifs_v6(ipif, ill->ill_group);
17985 	else
17986 		ipif_update_other_ipifs(ipif, ill->ill_group);
17987 
17988 	if (ipif_was_up) {
17989 		/*
17990 		 * Check whether it is last ipif to leave this group.
17991 		 * If this is the last ipif to leave, we should remove
17992 		 * this ill from the group as ipif_select_source will not
17993 		 * be able to find any useful ipifs if this ill is selected
17994 		 * for load balancing.
17995 		 *
17996 		 * For nameless groups, we should call ifgrp_delete if this
17997 		 * belongs to some group. As this ipif is going down, we may
17998 		 * need to reconstruct groups.
17999 		 */
18000 		phyi = ill->ill_phyint;
18001 		/*
18002 		 * If the phyint_groupname_len is 0, it may or may not
18003 		 * be in the nameless group. If the phyint_groupname_len is
18004 		 * not 0, then this ill should be part of some group.
18005 		 * As we always insert this ill in the group if
18006 		 * phyint_groupname_len is not zero when the first ipif
18007 		 * comes up (in ipif_up_done), it should be in a group
18008 		 * when the namelen is not 0.
18009 		 *
18010 		 * NOTE : When we delete the ill from the group,it will
18011 		 * blow away all the IRE_CACHES pointing either at this ipif or
18012 		 * ill_wq (illgrp_cache_delete does this). Thus, no IRES
18013 		 * should be pointing at this ill.
18014 		 */
18015 		ASSERT(phyi->phyint_groupname_len == 0 ||
18016 		    (phyi->phyint_groupname != NULL && ill->ill_group != NULL));
18017 
18018 		if (phyi->phyint_groupname_len != 0) {
18019 			if (ill->ill_ipif_up_count == 0)
18020 				illgrp_delete(ill);
18021 		}
18022 
18023 		/*
18024 		 * If we have deleted some of the broadcast ires associated
18025 		 * with this ipif, we need to re-nominate somebody else if
18026 		 * the ires that we deleted were the nominated ones.
18027 		 */
18028 		if (ill->ill_group != NULL && !ill->ill_isv6)
18029 			ipif_renominate_bcast(ipif);
18030 	}
18031 
18032 	/*
18033 	 * neighbor-discovery or arp entries for this interface.
18034 	 */
18035 	ipif_ndp_down(ipif);
18036 
18037 	/*
18038 	 * If mp is NULL the caller will wait for the appropriate refcnt.
18039 	 * Eg. ip_sioctl_removeif -> ipif_free  -> ipif_down
18040 	 * and ill_delete -> ipif_free -> ipif_down
18041 	 */
18042 	if (mp == NULL) {
18043 		ASSERT(q == NULL);
18044 		return (0);
18045 	}
18046 
18047 	if (CONN_Q(q)) {
18048 		connp = Q_TO_CONN(q);
18049 		mutex_enter(&connp->conn_lock);
18050 	} else {
18051 		connp = NULL;
18052 	}
18053 	mutex_enter(&ill->ill_lock);
18054 	/*
18055 	 * Are there any ire's pointing to this ipif that are still active ?
18056 	 * If this is the last ipif going down, are there any ire's pointing
18057 	 * to this ill that are still active ?
18058 	 */
18059 	if (ipif_is_quiescent(ipif)) {
18060 		mutex_exit(&ill->ill_lock);
18061 		if (connp != NULL)
18062 			mutex_exit(&connp->conn_lock);
18063 		return (0);
18064 	}
18065 
18066 	ip1dbg(("ipif_down: need to wait, adding pending mp %s ill %p",
18067 	    ill->ill_name, (void *)ill));
18068 	/*
18069 	 * Enqueue the mp atomically in ipsq_pending_mp. When the refcount
18070 	 * drops down, the operation will be restarted by ipif_ill_refrele_tail
18071 	 * which in turn is called by the last refrele on the ipif/ill/ire.
18072 	 */
18073 	success = ipsq_pending_mp_add(connp, ipif, q, mp, IPIF_DOWN);
18074 	if (!success) {
18075 		/* The conn is closing. So just return */
18076 		ASSERT(connp != NULL);
18077 		mutex_exit(&ill->ill_lock);
18078 		mutex_exit(&connp->conn_lock);
18079 		return (EINTR);
18080 	}
18081 
18082 	mutex_exit(&ill->ill_lock);
18083 	if (connp != NULL)
18084 		mutex_exit(&connp->conn_lock);
18085 	return (EINPROGRESS);
18086 }
18087 
18088 void
18089 ipif_down_tail(ipif_t *ipif)
18090 {
18091 	ill_t	*ill = ipif->ipif_ill;
18092 
18093 	/*
18094 	 * Skip any loopback interface (null wq).
18095 	 * If this is the last logical interface on the ill
18096 	 * have ill_dl_down tell the driver we are gone (unbind)
18097 	 * Note that lun 0 can ipif_down even though
18098 	 * there are other logical units that are up.
18099 	 * This occurs e.g. when we change a "significant" IFF_ flag.
18100 	 */
18101 	if (ill->ill_wq != NULL && !ill->ill_logical_down &&
18102 	    ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
18103 	    ill->ill_dl_up) {
18104 		ill_dl_down(ill);
18105 	}
18106 	ill->ill_logical_down = 0;
18107 
18108 	/*
18109 	 * Have to be after removing the routes in ipif_down_delete_ire.
18110 	 */
18111 	if (ipif->ipif_isv6) {
18112 		if (ill->ill_flags & ILLF_XRESOLV)
18113 			ipif_arp_down(ipif);
18114 	} else {
18115 		ipif_arp_down(ipif);
18116 	}
18117 
18118 	ip_rts_ifmsg(ipif);
18119 	ip_rts_newaddrmsg(RTM_DELETE, 0, ipif);
18120 }
18121 
18122 /*
18123  * Bring interface logically down without bringing the physical interface
18124  * down e.g. when the netmask is changed. This avoids long lasting link
18125  * negotiations between an ethernet interface and a certain switches.
18126  */
18127 static int
18128 ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
18129 {
18130 	/*
18131 	 * The ill_logical_down flag is a transient flag. It is set here
18132 	 * and is cleared once the down has completed in ipif_down_tail.
18133 	 * This flag does not indicate whether the ill stream is in the
18134 	 * DL_BOUND state with the driver. Instead this flag is used by
18135 	 * ipif_down_tail to determine whether to DL_UNBIND the stream with
18136 	 * the driver. The state of the ill stream i.e. whether it is
18137 	 * DL_BOUND with the driver or not is indicated by the ill_dl_up flag.
18138 	 */
18139 	ipif->ipif_ill->ill_logical_down = 1;
18140 	return (ipif_down(ipif, q, mp));
18141 }
18142 
18143 /*
18144  * This is called when the SIOCSLIFUSESRC ioctl is processed in IP.
18145  * If the usesrc client ILL is already part of a usesrc group or not,
18146  * in either case a ire_stq with the matching usesrc client ILL will
18147  * locate the IRE's that need to be deleted. We want IREs to be created
18148  * with the new source address.
18149  */
18150 static void
18151 ipif_delete_cache_ire(ire_t *ire, char *ill_arg)
18152 {
18153 	ill_t	*ucill = (ill_t *)ill_arg;
18154 
18155 	ASSERT(IAM_WRITER_ILL(ucill));
18156 
18157 	if (ire->ire_stq == NULL)
18158 		return;
18159 
18160 	if ((ire->ire_type == IRE_CACHE) &&
18161 	    ((ill_t *)ire->ire_stq->q_ptr == ucill))
18162 		ire_delete(ire);
18163 }
18164 
18165 /*
18166  * ire_walk routine to delete every IRE dependent on the interface
18167  * address that is going down.	(Always called as writer.)
18168  * Works for both v4 and v6.
18169  * In addition for checking for ire_ipif matches it also checks for
18170  * IRE_CACHE entries which have the same source address as the
18171  * disappearing ipif since ipif_select_source might have picked
18172  * that source. Note that ipif_down/ipif_update_other_ipifs takes
18173  * care of any IRE_INTERFACE with the disappearing source address.
18174  */
18175 static void
18176 ipif_down_delete_ire(ire_t *ire, char *ipif_arg)
18177 {
18178 	ipif_t	*ipif = (ipif_t *)ipif_arg;
18179 	ill_t *ire_ill;
18180 	ill_t *ipif_ill;
18181 
18182 	ASSERT(IAM_WRITER_IPIF(ipif));
18183 	if (ire->ire_ipif == NULL)
18184 		return;
18185 
18186 	/*
18187 	 * For IPv4, we derive source addresses for an IRE from ipif's
18188 	 * belonging to the same IPMP group as the IRE's outgoing
18189 	 * interface.  If an IRE's outgoing interface isn't in the
18190 	 * same IPMP group as a particular ipif, then that ipif
18191 	 * couldn't have been used as a source address for this IRE.
18192 	 *
18193 	 * For IPv6, source addresses are only restricted to the IPMP group
18194 	 * if the IRE is for a link-local address or a multicast address.
18195 	 * Otherwise, source addresses for an IRE can be chosen from
18196 	 * interfaces other than the the outgoing interface for that IRE.
18197 	 *
18198 	 * For source address selection details, see ipif_select_source()
18199 	 * and ipif_select_source_v6().
18200 	 */
18201 	if (ire->ire_ipversion == IPV4_VERSION ||
18202 	    IN6_IS_ADDR_LINKLOCAL(&ire->ire_addr_v6) ||
18203 	    IN6_IS_ADDR_MULTICAST(&ire->ire_addr_v6)) {
18204 		ire_ill = ire->ire_ipif->ipif_ill;
18205 		ipif_ill = ipif->ipif_ill;
18206 
18207 		if (ire_ill->ill_group != ipif_ill->ill_group) {
18208 			return;
18209 		}
18210 	}
18211 
18212 
18213 	if (ire->ire_ipif != ipif) {
18214 		/*
18215 		 * Look for a matching source address.
18216 		 */
18217 		if (ire->ire_type != IRE_CACHE)
18218 			return;
18219 		if (ipif->ipif_flags & IPIF_NOLOCAL)
18220 			return;
18221 
18222 		if (ire->ire_ipversion == IPV4_VERSION) {
18223 			if (ire->ire_src_addr != ipif->ipif_src_addr)
18224 				return;
18225 		} else {
18226 			if (!IN6_ARE_ADDR_EQUAL(&ire->ire_src_addr_v6,
18227 			    &ipif->ipif_v6lcl_addr))
18228 				return;
18229 		}
18230 		ire_delete(ire);
18231 		return;
18232 	}
18233 	/*
18234 	 * ire_delete() will do an ire_flush_cache which will delete
18235 	 * all ire_ipif matches
18236 	 */
18237 	ire_delete(ire);
18238 }
18239 
18240 /*
18241  * ire_walk_ill function for deleting all IRE_CACHE entries for an ill when
18242  * 1) an ipif (on that ill) changes the IPIF_DEPRECATED flags, or
18243  * 2) when an interface is brought up or down (on that ill).
18244  * This ensures that the IRE_CACHE entries don't retain stale source
18245  * address selection results.
18246  */
18247 void
18248 ill_ipif_cache_delete(ire_t *ire, char *ill_arg)
18249 {
18250 	ill_t	*ill = (ill_t *)ill_arg;
18251 	ill_t	*ipif_ill;
18252 
18253 	ASSERT(IAM_WRITER_ILL(ill));
18254 	/*
18255 	 * We use MATCH_IRE_TYPE/IRE_CACHE while calling ire_walk_ill_v4.
18256 	 * Hence this should be IRE_CACHE.
18257 	 */
18258 	ASSERT(ire->ire_type == IRE_CACHE);
18259 
18260 	/*
18261 	 * We are called for IRE_CACHES whose ire_ipif matches ill.
18262 	 * We are only interested in IRE_CACHES that has borrowed
18263 	 * the source address from ill_arg e.g. ipif_up_done[_v6]
18264 	 * for which we need to look at ire_ipif->ipif_ill match
18265 	 * with ill.
18266 	 */
18267 	ASSERT(ire->ire_ipif != NULL);
18268 	ipif_ill = ire->ire_ipif->ipif_ill;
18269 	if (ipif_ill == ill || (ill->ill_group != NULL &&
18270 	    ipif_ill->ill_group == ill->ill_group)) {
18271 		ire_delete(ire);
18272 	}
18273 }
18274 
18275 /*
18276  * Delete all the ire whose stq references ill_arg.
18277  */
18278 static void
18279 ill_stq_cache_delete(ire_t *ire, char *ill_arg)
18280 {
18281 	ill_t	*ill = (ill_t *)ill_arg;
18282 	ill_t	*ire_ill;
18283 
18284 	ASSERT(IAM_WRITER_ILL(ill));
18285 	/*
18286 	 * We use MATCH_IRE_TYPE/IRE_CACHE while calling ire_walk_ill_v4.
18287 	 * Hence this should be IRE_CACHE.
18288 	 */
18289 	ASSERT(ire->ire_type == IRE_CACHE);
18290 
18291 	/*
18292 	 * We are called for IRE_CACHES whose ire_stq and ire_ipif
18293 	 * matches ill. We are only interested in IRE_CACHES that
18294 	 * has ire_stq->q_ptr pointing at ill_arg. Thus we do the
18295 	 * filtering here.
18296 	 */
18297 	ire_ill = (ill_t *)ire->ire_stq->q_ptr;
18298 
18299 	if (ire_ill == ill)
18300 		ire_delete(ire);
18301 }
18302 
18303 /*
18304  * This is called when an ill leaves the group. We want to delete
18305  * all IRE_CACHES whose stq is pointing at ill_wq or ire_ipif is
18306  * pointing at ill.
18307  */
18308 static void
18309 illgrp_cache_delete(ire_t *ire, char *ill_arg)
18310 {
18311 	ill_t	*ill = (ill_t *)ill_arg;
18312 
18313 	ASSERT(IAM_WRITER_ILL(ill));
18314 	ASSERT(ill->ill_group == NULL);
18315 	/*
18316 	 * We use MATCH_IRE_TYPE/IRE_CACHE while calling ire_walk_ill_v4.
18317 	 * Hence this should be IRE_CACHE.
18318 	 */
18319 	ASSERT(ire->ire_type == IRE_CACHE);
18320 	/*
18321 	 * We are called for IRE_CACHES whose ire_stq and ire_ipif
18322 	 * matches ill. We are interested in both.
18323 	 */
18324 	ASSERT((ill == (ill_t *)ire->ire_stq->q_ptr) ||
18325 	    (ire->ire_ipif->ipif_ill == ill));
18326 
18327 	ire_delete(ire);
18328 }
18329 
18330 /*
18331  * Initiate deallocate of an IPIF. Always called as writer. Called by
18332  * ill_delete or ip_sioctl_removeif.
18333  */
18334 static void
18335 ipif_free(ipif_t *ipif)
18336 {
18337 	ASSERT(IAM_WRITER_IPIF(ipif));
18338 
18339 	if (ipif->ipif_recovery_id != 0)
18340 		(void) untimeout(ipif->ipif_recovery_id);
18341 	ipif->ipif_recovery_id = 0;
18342 
18343 	/* Remove conn references */
18344 	reset_conn_ipif(ipif);
18345 
18346 	/*
18347 	 * Make sure we have valid net and subnet broadcast ire's for the
18348 	 * other ipif's which share them with this ipif.
18349 	 */
18350 	if (!ipif->ipif_isv6)
18351 		ipif_check_bcast_ires(ipif);
18352 
18353 	/*
18354 	 * Take down the interface. We can be called either from ill_delete
18355 	 * or from ip_sioctl_removeif.
18356 	 */
18357 	(void) ipif_down(ipif, NULL, NULL);
18358 
18359 	rw_enter(&ill_g_lock, RW_WRITER);
18360 	/* Remove pointers to this ill in the multicast routing tables */
18361 	reset_mrt_vif_ipif(ipif);
18362 	rw_exit(&ill_g_lock);
18363 }
18364 
18365 static void
18366 ipif_free_tail(ipif_t *ipif)
18367 {
18368 	mblk_t	*mp;
18369 	ipif_t	**ipifp;
18370 
18371 	/*
18372 	 * Free state for addition IRE_IF_[NO]RESOLVER ire's.
18373 	 */
18374 	mutex_enter(&ipif->ipif_saved_ire_lock);
18375 	mp = ipif->ipif_saved_ire_mp;
18376 	ipif->ipif_saved_ire_mp = NULL;
18377 	mutex_exit(&ipif->ipif_saved_ire_lock);
18378 	freemsg(mp);
18379 
18380 	/*
18381 	 * Need to hold both ill_g_lock and ill_lock while
18382 	 * inserting or removing an ipif from the linked list
18383 	 * of ipifs hanging off the ill.
18384 	 */
18385 	rw_enter(&ill_g_lock, RW_WRITER);
18386 	/*
18387 	 * Remove all multicast memberships on the interface now.
18388 	 * This removes IPv4 multicast memberships joined within
18389 	 * the kernel as ipif_down does not do ipif_multicast_down
18390 	 * for IPv4. IPv6 is not handled here as the multicast memberships
18391 	 * are based on ill and not on ipif.
18392 	 */
18393 	ilm_free(ipif);
18394 
18395 	/*
18396 	 * Since we held the ill_g_lock while doing the ilm_free above,
18397 	 * we can assert the ilms were really deleted and not just marked
18398 	 * ILM_DELETED.
18399 	 */
18400 	ASSERT(ilm_walk_ipif(ipif) == 0);
18401 
18402 
18403 	IPIF_TRACE_CLEANUP(ipif);
18404 
18405 	/* Ask SCTP to take it out of it list */
18406 	sctp_update_ipif(ipif, SCTP_IPIF_REMOVE);
18407 
18408 	mutex_enter(&ipif->ipif_ill->ill_lock);
18409 	/* Get it out of the ILL interface list. */
18410 	ipifp = &ipif->ipif_ill->ill_ipif;
18411 	for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
18412 		if (*ipifp == ipif) {
18413 			*ipifp = ipif->ipif_next;
18414 			break;
18415 		}
18416 	}
18417 
18418 	mutex_exit(&ipif->ipif_ill->ill_lock);
18419 	rw_exit(&ill_g_lock);
18420 
18421 	mutex_destroy(&ipif->ipif_saved_ire_lock);
18422 
18423 	ASSERT(!(ipif->ipif_flags & (IPIF_UP | IPIF_DUPLICATE)));
18424 
18425 	/* Free the memory. */
18426 	mi_free((char *)ipif);
18427 }
18428 
18429 /*
18430  * Returns an ipif name in the form "ill_name/unit" if ipif_id is not zero,
18431  * "ill_name" otherwise.
18432  */
18433 char *
18434 ipif_get_name(const ipif_t *ipif, char *buf, int len)
18435 {
18436 	char	lbuf[32];
18437 	char	*name;
18438 	size_t	name_len;
18439 
18440 	buf[0] = '\0';
18441 	if (!ipif)
18442 		return (buf);
18443 	name = ipif->ipif_ill->ill_name;
18444 	name_len = ipif->ipif_ill->ill_name_length;
18445 	if (ipif->ipif_id != 0) {
18446 		(void) sprintf(lbuf, "%s%c%d", name, IPIF_SEPARATOR_CHAR,
18447 		    ipif->ipif_id);
18448 		name = lbuf;
18449 		name_len = mi_strlen(name) + 1;
18450 	}
18451 	len -= 1;
18452 	buf[len] = '\0';
18453 	len = MIN(len, name_len);
18454 	bcopy(name, buf, len);
18455 	return (buf);
18456 }
18457 
18458 /*
18459  * Find an IPIF based on the name passed in.  Names can be of the
18460  * form <phys> (e.g., le0), <phys>:<#> (e.g., le0:1),
18461  * The <phys> string can have forms like <dev><#> (e.g., le0),
18462  * <dev><#>.<module> (e.g. le0.foo), or <dev>.<module><#> (e.g. ip.tun3).
18463  * When there is no colon, the implied unit id is zero. <phys> must
18464  * correspond to the name of an ILL.  (May be called as writer.)
18465  */
18466 static ipif_t *
18467 ipif_lookup_on_name(char *name, size_t namelen, boolean_t do_alloc,
18468     boolean_t *exists, boolean_t isv6, zoneid_t zoneid, queue_t *q,
18469     mblk_t *mp, ipsq_func_t func, int *error)
18470 {
18471 	char	*cp;
18472 	char	*endp;
18473 	long	id;
18474 	ill_t	*ill;
18475 	ipif_t	*ipif;
18476 	uint_t	ire_type;
18477 	boolean_t did_alloc = B_FALSE;
18478 	ipsq_t	*ipsq;
18479 
18480 	if (error != NULL)
18481 		*error = 0;
18482 
18483 	/*
18484 	 * If the caller wants to us to create the ipif, make sure we have a
18485 	 * valid zoneid
18486 	 */
18487 	ASSERT(!do_alloc || zoneid != ALL_ZONES);
18488 
18489 	if (namelen == 0) {
18490 		if (error != NULL)
18491 			*error = ENXIO;
18492 		return (NULL);
18493 	}
18494 
18495 	*exists = B_FALSE;
18496 	/* Look for a colon in the name. */
18497 	endp = &name[namelen];
18498 	for (cp = endp; --cp > name; ) {
18499 		if (*cp == IPIF_SEPARATOR_CHAR)
18500 			break;
18501 	}
18502 
18503 	if (*cp == IPIF_SEPARATOR_CHAR) {
18504 		/*
18505 		 * Reject any non-decimal aliases for logical
18506 		 * interfaces. Aliases with leading zeroes
18507 		 * are also rejected as they introduce ambiguity
18508 		 * in the naming of the interfaces.
18509 		 * In order to confirm with existing semantics,
18510 		 * and to not break any programs/script relying
18511 		 * on that behaviour, if<0>:0 is considered to be
18512 		 * a valid interface.
18513 		 *
18514 		 * If alias has two or more digits and the first
18515 		 * is zero, fail.
18516 		 */
18517 		if (&cp[2] < endp && cp[1] == '0')
18518 			return (NULL);
18519 	}
18520 
18521 	if (cp <= name) {
18522 		cp = endp;
18523 	} else {
18524 		*cp = '\0';
18525 	}
18526 
18527 	/*
18528 	 * Look up the ILL, based on the portion of the name
18529 	 * before the slash. ill_lookup_on_name returns a held ill.
18530 	 * Temporary to check whether ill exists already. If so
18531 	 * ill_lookup_on_name will clear it.
18532 	 */
18533 	ill = ill_lookup_on_name(name, do_alloc, isv6,
18534 	    q, mp, func, error, &did_alloc);
18535 	if (cp != endp)
18536 		*cp = IPIF_SEPARATOR_CHAR;
18537 	if (ill == NULL)
18538 		return (NULL);
18539 
18540 	/* Establish the unit number in the name. */
18541 	id = 0;
18542 	if (cp < endp && *endp == '\0') {
18543 		/* If there was a colon, the unit number follows. */
18544 		cp++;
18545 		if (ddi_strtol(cp, NULL, 0, &id) != 0) {
18546 			ill_refrele(ill);
18547 			if (error != NULL)
18548 				*error = ENXIO;
18549 			return (NULL);
18550 		}
18551 	}
18552 
18553 	GRAB_CONN_LOCK(q);
18554 	mutex_enter(&ill->ill_lock);
18555 	/* Now see if there is an IPIF with this unit number. */
18556 	for (ipif = ill->ill_ipif; ipif; ipif = ipif->ipif_next) {
18557 		if (ipif->ipif_id == id) {
18558 			if (zoneid != ALL_ZONES &&
18559 			    zoneid != ipif->ipif_zoneid &&
18560 			    ipif->ipif_zoneid != ALL_ZONES) {
18561 				mutex_exit(&ill->ill_lock);
18562 				RELEASE_CONN_LOCK(q);
18563 				ill_refrele(ill);
18564 				if (error != NULL)
18565 					*error = ENXIO;
18566 				return (NULL);
18567 			}
18568 			/*
18569 			 * The block comment at the start of ipif_down
18570 			 * explains the use of the macros used below
18571 			 */
18572 			if (IPIF_CAN_LOOKUP(ipif)) {
18573 				ipif_refhold_locked(ipif);
18574 				mutex_exit(&ill->ill_lock);
18575 				if (!did_alloc)
18576 					*exists = B_TRUE;
18577 				/*
18578 				 * Drop locks before calling ill_refrele
18579 				 * since it can potentially call into
18580 				 * ipif_ill_refrele_tail which can end up
18581 				 * in trying to acquire any lock.
18582 				 */
18583 				RELEASE_CONN_LOCK(q);
18584 				ill_refrele(ill);
18585 				return (ipif);
18586 			} else if (IPIF_CAN_WAIT(ipif, q)) {
18587 				ipsq = ill->ill_phyint->phyint_ipsq;
18588 				mutex_enter(&ipsq->ipsq_lock);
18589 				mutex_exit(&ill->ill_lock);
18590 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
18591 				mutex_exit(&ipsq->ipsq_lock);
18592 				RELEASE_CONN_LOCK(q);
18593 				ill_refrele(ill);
18594 				*error = EINPROGRESS;
18595 				return (NULL);
18596 			}
18597 		}
18598 	}
18599 	RELEASE_CONN_LOCK(q);
18600 
18601 	if (!do_alloc) {
18602 		mutex_exit(&ill->ill_lock);
18603 		ill_refrele(ill);
18604 		if (error != NULL)
18605 			*error = ENXIO;
18606 		return (NULL);
18607 	}
18608 
18609 	/*
18610 	 * If none found, atomically allocate and return a new one.
18611 	 * Historically, we used IRE_LOOPBACK only for lun 0, and IRE_LOCAL
18612 	 * to support "receive only" use of lo0:1 etc. as is still done
18613 	 * below as an initial guess.
18614 	 * However, this is now likely to be overriden later in ipif_up_done()
18615 	 * when we know for sure what address has been configured on the
18616 	 * interface, since we might have more than one loopback interface
18617 	 * with a loopback address, e.g. in the case of zones, and all the
18618 	 * interfaces with loopback addresses need to be marked IRE_LOOPBACK.
18619 	 */
18620 	if (ill->ill_net_type == IRE_LOOPBACK && id == 0)
18621 		ire_type = IRE_LOOPBACK;
18622 	else
18623 		ire_type = IRE_LOCAL;
18624 	ipif = ipif_allocate(ill, id, ire_type, B_TRUE);
18625 	if (ipif != NULL)
18626 		ipif_refhold_locked(ipif);
18627 	else if (error != NULL)
18628 		*error = ENOMEM;
18629 	mutex_exit(&ill->ill_lock);
18630 	ill_refrele(ill);
18631 	return (ipif);
18632 }
18633 
18634 /*
18635  * This routine is called whenever a new address comes up on an ipif.  If
18636  * we are configured to respond to address mask requests, then we are supposed
18637  * to broadcast an address mask reply at this time.  This routine is also
18638  * called if we are already up, but a netmask change is made.  This is legal
18639  * but might not make the system manager very popular.	(May be called
18640  * as writer.)
18641  */
18642 void
18643 ipif_mask_reply(ipif_t *ipif)
18644 {
18645 	icmph_t	*icmph;
18646 	ipha_t	*ipha;
18647 	mblk_t	*mp;
18648 
18649 #define	REPLY_LEN	(sizeof (icmp_ipha) + sizeof (icmph_t) + IP_ADDR_LEN)
18650 
18651 	if (!ip_respond_to_address_mask_broadcast)
18652 		return;
18653 
18654 	/* ICMP mask reply is IPv4 only */
18655 	ASSERT(!ipif->ipif_isv6);
18656 	/* ICMP mask reply is not for a loopback interface */
18657 	ASSERT(ipif->ipif_ill->ill_wq != NULL);
18658 
18659 	mp = allocb(REPLY_LEN, BPRI_HI);
18660 	if (mp == NULL)
18661 		return;
18662 	mp->b_wptr = mp->b_rptr + REPLY_LEN;
18663 
18664 	ipha = (ipha_t *)mp->b_rptr;
18665 	bzero(ipha, REPLY_LEN);
18666 	*ipha = icmp_ipha;
18667 	ipha->ipha_ttl = ip_broadcast_ttl;
18668 	ipha->ipha_src = ipif->ipif_src_addr;
18669 	ipha->ipha_dst = ipif->ipif_brd_addr;
18670 	ipha->ipha_length = htons(REPLY_LEN);
18671 	ipha->ipha_ident = 0;
18672 
18673 	icmph = (icmph_t *)&ipha[1];
18674 	icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY;
18675 	bcopy(&ipif->ipif_net_mask, &icmph[1], IP_ADDR_LEN);
18676 	icmph->icmph_checksum = IP_CSUM(mp, sizeof (ipha_t), 0);
18677 	if (icmph->icmph_checksum == 0)
18678 		icmph->icmph_checksum = 0xffff;
18679 
18680 	put(ipif->ipif_wq, mp);
18681 
18682 #undef	REPLY_LEN
18683 }
18684 
18685 /*
18686  * When the mtu in the ipif changes, we call this routine through ire_walk
18687  * to update all the relevant IREs.
18688  * Skip IRE_LOCAL and "loopback" IRE_BROADCAST by checking ire_stq.
18689  */
18690 static void
18691 ipif_mtu_change(ire_t *ire, char *ipif_arg)
18692 {
18693 	ipif_t *ipif = (ipif_t *)ipif_arg;
18694 
18695 	if (ire->ire_stq == NULL || ire->ire_ipif != ipif)
18696 		return;
18697 	ire->ire_max_frag = MIN(ipif->ipif_mtu, IP_MAXPACKET);
18698 }
18699 
18700 /*
18701  * When the mtu in the ill changes, we call this routine through ire_walk
18702  * to update all the relevant IREs.
18703  * Skip IRE_LOCAL and "loopback" IRE_BROADCAST by checking ire_stq.
18704  */
18705 void
18706 ill_mtu_change(ire_t *ire, char *ill_arg)
18707 {
18708 	ill_t	*ill = (ill_t *)ill_arg;
18709 
18710 	if (ire->ire_stq == NULL || ire->ire_ipif->ipif_ill != ill)
18711 		return;
18712 	ire->ire_max_frag = ire->ire_ipif->ipif_mtu;
18713 }
18714 
18715 /*
18716  * Join the ipif specific multicast groups.
18717  * Must be called after a mapping has been set up in the resolver.  (Always
18718  * called as writer.)
18719  */
18720 void
18721 ipif_multicast_up(ipif_t *ipif)
18722 {
18723 	int err, index;
18724 	ill_t *ill;
18725 
18726 	ASSERT(IAM_WRITER_IPIF(ipif));
18727 
18728 	ill = ipif->ipif_ill;
18729 	index = ill->ill_phyint->phyint_ifindex;
18730 
18731 	ip1dbg(("ipif_multicast_up\n"));
18732 	if (!(ill->ill_flags & ILLF_MULTICAST) || ipif->ipif_multicast_up)
18733 		return;
18734 
18735 	if (ipif->ipif_isv6) {
18736 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
18737 			return;
18738 
18739 		/* Join the all hosts multicast address */
18740 		ip1dbg(("ipif_multicast_up - addmulti\n"));
18741 		/*
18742 		 * Passing B_TRUE means we have to join the multicast
18743 		 * membership on this interface even though this is
18744 		 * FAILED. If we join on a different one in the group,
18745 		 * we will not be able to delete the membership later
18746 		 * as we currently don't track where we join when we
18747 		 * join within the kernel unlike applications where
18748 		 * we have ilg/ilg_orig_index. See ip_addmulti_v6
18749 		 * for more on this.
18750 		 */
18751 		err = ip_addmulti_v6(&ipv6_all_hosts_mcast, ill, index,
18752 		    ipif->ipif_zoneid, ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
18753 		if (err != 0) {
18754 			ip0dbg(("ipif_multicast_up: "
18755 			    "all_hosts_mcast failed %d\n",
18756 			    err));
18757 			return;
18758 		}
18759 		/*
18760 		 * Enable multicast for the solicited node multicast address
18761 		 */
18762 		if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
18763 			in6_addr_t ipv6_multi = ipv6_solicited_node_mcast;
18764 
18765 			ipv6_multi.s6_addr32[3] |=
18766 			    ipif->ipif_v6lcl_addr.s6_addr32[3];
18767 
18768 			err = ip_addmulti_v6(&ipv6_multi, ill, index,
18769 			    ipif->ipif_zoneid, ILGSTAT_NONE, MODE_IS_EXCLUDE,
18770 			    NULL);
18771 			if (err != 0) {
18772 				ip0dbg(("ipif_multicast_up: solicited MC"
18773 				    " failed %d\n", err));
18774 				(void) ip_delmulti_v6(&ipv6_all_hosts_mcast,
18775 				    ill, ill->ill_phyint->phyint_ifindex,
18776 				    ipif->ipif_zoneid, B_TRUE, B_TRUE);
18777 				return;
18778 			}
18779 		}
18780 	} else {
18781 		if (ipif->ipif_lcl_addr == INADDR_ANY)
18782 			return;
18783 
18784 		/* Join the all hosts multicast address */
18785 		ip1dbg(("ipif_multicast_up - addmulti\n"));
18786 		err = ip_addmulti(htonl(INADDR_ALLHOSTS_GROUP), ipif,
18787 		    ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
18788 		if (err) {
18789 			ip0dbg(("ipif_multicast_up: failed %d\n", err));
18790 			return;
18791 		}
18792 	}
18793 	ipif->ipif_multicast_up = 1;
18794 }
18795 
18796 /*
18797  * Blow away any IPv6 multicast groups that we joined in ipif_multicast_up();
18798  * any explicit memberships are blown away in ill_leave_multicast() when the
18799  * ill is brought down.
18800  */
18801 static void
18802 ipif_multicast_down(ipif_t *ipif)
18803 {
18804 	int err;
18805 
18806 	ASSERT(IAM_WRITER_IPIF(ipif));
18807 
18808 	ip1dbg(("ipif_multicast_down\n"));
18809 	if (!ipif->ipif_multicast_up)
18810 		return;
18811 
18812 	ASSERT(ipif->ipif_isv6);
18813 
18814 	ip1dbg(("ipif_multicast_down - delmulti\n"));
18815 
18816 	/*
18817 	 * Leave the all hosts multicast address. Similar to ip_addmulti_v6,
18818 	 * we should look for ilms on this ill rather than the ones that have
18819 	 * been failed over here.  They are here temporarily. As
18820 	 * ipif_multicast_up has joined on this ill, we should delete only
18821 	 * from this ill.
18822 	 */
18823 	err = ip_delmulti_v6(&ipv6_all_hosts_mcast, ipif->ipif_ill,
18824 	    ipif->ipif_ill->ill_phyint->phyint_ifindex, ipif->ipif_zoneid,
18825 	    B_TRUE, B_TRUE);
18826 	if (err != 0) {
18827 		ip0dbg(("ipif_multicast_down: all_hosts_mcast failed %d\n",
18828 		    err));
18829 	}
18830 	/*
18831 	 * Disable multicast for the solicited node multicast address
18832 	 */
18833 	if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
18834 		in6_addr_t ipv6_multi = ipv6_solicited_node_mcast;
18835 
18836 		ipv6_multi.s6_addr32[3] |=
18837 		    ipif->ipif_v6lcl_addr.s6_addr32[3];
18838 
18839 		err = ip_delmulti_v6(&ipv6_multi, ipif->ipif_ill,
18840 		    ipif->ipif_ill->ill_phyint->phyint_ifindex,
18841 		    ipif->ipif_zoneid, B_TRUE, B_TRUE);
18842 
18843 		if (err != 0) {
18844 			ip0dbg(("ipif_multicast_down: sol MC failed %d\n",
18845 			    err));
18846 		}
18847 	}
18848 
18849 	ipif->ipif_multicast_up = 0;
18850 }
18851 
18852 /*
18853  * Used when an interface comes up to recreate any extra routes on this
18854  * interface.
18855  */
18856 static ire_t **
18857 ipif_recover_ire(ipif_t *ipif)
18858 {
18859 	mblk_t	*mp;
18860 	ire_t	**ipif_saved_irep;
18861 	ire_t	**irep;
18862 
18863 	ip1dbg(("ipif_recover_ire(%s:%u)", ipif->ipif_ill->ill_name,
18864 	    ipif->ipif_id));
18865 
18866 	mutex_enter(&ipif->ipif_saved_ire_lock);
18867 	ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) *
18868 	    ipif->ipif_saved_ire_cnt, KM_NOSLEEP);
18869 	if (ipif_saved_irep == NULL) {
18870 		mutex_exit(&ipif->ipif_saved_ire_lock);
18871 		return (NULL);
18872 	}
18873 
18874 	irep = ipif_saved_irep;
18875 	for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
18876 		ire_t		*ire;
18877 		queue_t		*rfq;
18878 		queue_t		*stq;
18879 		ifrt_t		*ifrt;
18880 		uchar_t		*src_addr;
18881 		uchar_t		*gateway_addr;
18882 		mblk_t		*resolver_mp;
18883 		ushort_t	type;
18884 
18885 		/*
18886 		 * When the ire was initially created and then added in
18887 		 * ip_rt_add(), it was created either using ipif->ipif_net_type
18888 		 * in the case of a traditional interface route, or as one of
18889 		 * the IRE_OFFSUBNET types (with the exception of
18890 		 * IRE_HOST_REDIRECT which is created by icmp_redirect() and
18891 		 * which we don't need to save or recover).  In the case where
18892 		 * ipif->ipif_net_type was IRE_LOOPBACK, ip_rt_add() will update
18893 		 * the ire_type to IRE_IF_NORESOLVER before calling ire_add()
18894 		 * to satisfy software like GateD and Sun Cluster which creates
18895 		 * routes using the the loopback interface's address as a
18896 		 * gateway.
18897 		 *
18898 		 * As ifrt->ifrt_type reflects the already updated ire_type and
18899 		 * since ire_create() expects that IRE_IF_NORESOLVER will have
18900 		 * a valid nce_res_mp field (which doesn't make sense for a
18901 		 * IRE_LOOPBACK), ire_create() will be called in the same way
18902 		 * here as in ip_rt_add(), namely using ipif->ipif_net_type when
18903 		 * the route looks like a traditional interface route (where
18904 		 * ifrt->ifrt_type & IRE_INTERFACE is true) and otherwise using
18905 		 * the saved ifrt->ifrt_type.  This means that in the case where
18906 		 * ipif->ipif_net_type is IRE_LOOPBACK, the ire created by
18907 		 * ire_create() will be an IRE_LOOPBACK, it will then be turned
18908 		 * into an IRE_IF_NORESOLVER and then added by ire_add().
18909 		 */
18910 		ifrt = (ifrt_t *)mp->b_rptr;
18911 		if (ifrt->ifrt_type & IRE_INTERFACE) {
18912 			rfq = NULL;
18913 			stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
18914 			    ? ipif->ipif_rq : ipif->ipif_wq;
18915 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
18916 			    ? (uint8_t *)&ifrt->ifrt_src_addr
18917 			    : (uint8_t *)&ipif->ipif_src_addr;
18918 			gateway_addr = NULL;
18919 			resolver_mp = ipif->ipif_resolver_mp;
18920 			type = ipif->ipif_net_type;
18921 		} else if (ifrt->ifrt_type & IRE_BROADCAST) {
18922 			/* Recover multiroute broadcast IRE. */
18923 			rfq = ipif->ipif_rq;
18924 			stq = ipif->ipif_wq;
18925 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
18926 			    ? (uint8_t *)&ifrt->ifrt_src_addr
18927 			    : (uint8_t *)&ipif->ipif_src_addr;
18928 			gateway_addr = (uint8_t *)&ifrt->ifrt_gateway_addr;
18929 			resolver_mp = ipif->ipif_bcast_mp;
18930 			type = ifrt->ifrt_type;
18931 		} else {
18932 			rfq = NULL;
18933 			stq = NULL;
18934 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
18935 			    ? (uint8_t *)&ifrt->ifrt_src_addr : NULL;
18936 			gateway_addr = (uint8_t *)&ifrt->ifrt_gateway_addr;
18937 			resolver_mp = NULL;
18938 			type = ifrt->ifrt_type;
18939 		}
18940 
18941 		/*
18942 		 * Create a copy of the IRE with the saved address and netmask.
18943 		 */
18944 		ip1dbg(("ipif_recover_ire: creating IRE %s (%d) for "
18945 		    "0x%x/0x%x\n",
18946 		    ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type,
18947 		    ntohl(ifrt->ifrt_addr),
18948 		    ntohl(ifrt->ifrt_mask)));
18949 		ire = ire_create(
18950 		    (uint8_t *)&ifrt->ifrt_addr,
18951 		    (uint8_t *)&ifrt->ifrt_mask,
18952 		    src_addr,
18953 		    gateway_addr,
18954 		    NULL,
18955 		    &ifrt->ifrt_max_frag,
18956 		    NULL,
18957 		    rfq,
18958 		    stq,
18959 		    type,
18960 		    resolver_mp,
18961 		    ipif,
18962 		    NULL,
18963 		    0,
18964 		    0,
18965 		    0,
18966 		    ifrt->ifrt_flags,
18967 		    &ifrt->ifrt_iulp_info,
18968 		    NULL,
18969 		    NULL);
18970 
18971 		if (ire == NULL) {
18972 			mutex_exit(&ipif->ipif_saved_ire_lock);
18973 			kmem_free(ipif_saved_irep,
18974 			    ipif->ipif_saved_ire_cnt * sizeof (ire_t *));
18975 			return (NULL);
18976 		}
18977 
18978 		/*
18979 		 * Some software (for example, GateD and Sun Cluster) attempts
18980 		 * to create (what amount to) IRE_PREFIX routes with the
18981 		 * loopback address as the gateway.  This is primarily done to
18982 		 * set up prefixes with the RTF_REJECT flag set (for example,
18983 		 * when generating aggregate routes.)
18984 		 *
18985 		 * If the IRE type (as defined by ipif->ipif_net_type) is
18986 		 * IRE_LOOPBACK, then we map the request into a
18987 		 * IRE_IF_NORESOLVER.
18988 		 */
18989 		if (ipif->ipif_net_type == IRE_LOOPBACK)
18990 			ire->ire_type = IRE_IF_NORESOLVER;
18991 		/*
18992 		 * ire held by ire_add, will be refreled' towards the
18993 		 * the end of ipif_up_done
18994 		 */
18995 		(void) ire_add(&ire, NULL, NULL, NULL, B_FALSE);
18996 		*irep = ire;
18997 		irep++;
18998 		ip1dbg(("ipif_recover_ire: added ire %p\n", (void *)ire));
18999 	}
19000 	mutex_exit(&ipif->ipif_saved_ire_lock);
19001 	return (ipif_saved_irep);
19002 }
19003 
19004 /*
19005  * Used to set the netmask and broadcast address to default values when the
19006  * interface is brought up.  (Always called as writer.)
19007  */
19008 static void
19009 ipif_set_default(ipif_t *ipif)
19010 {
19011 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
19012 
19013 	if (!ipif->ipif_isv6) {
19014 		/*
19015 		 * Interface holds an IPv4 address. Default
19016 		 * mask is the natural netmask.
19017 		 */
19018 		if (!ipif->ipif_net_mask) {
19019 			ipaddr_t	v4mask;
19020 
19021 			v4mask = ip_net_mask(ipif->ipif_lcl_addr);
19022 			V4MASK_TO_V6(v4mask, ipif->ipif_v6net_mask);
19023 		}
19024 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
19025 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
19026 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
19027 		} else {
19028 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
19029 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
19030 		}
19031 		/*
19032 		 * NOTE: SunOS 4.X does this even if the broadcast address
19033 		 * has been already set thus we do the same here.
19034 		 */
19035 		if (ipif->ipif_flags & IPIF_BROADCAST) {
19036 			ipaddr_t	v4addr;
19037 
19038 			v4addr = ipif->ipif_subnet | ~ipif->ipif_net_mask;
19039 			IN6_IPADDR_TO_V4MAPPED(v4addr, &ipif->ipif_v6brd_addr);
19040 		}
19041 	} else {
19042 		/*
19043 		 * Interface holds an IPv6-only address.  Default
19044 		 * mask is all-ones.
19045 		 */
19046 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
19047 			ipif->ipif_v6net_mask = ipv6_all_ones;
19048 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
19049 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
19050 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
19051 		} else {
19052 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
19053 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
19054 		}
19055 	}
19056 }
19057 
19058 /*
19059  * Return 0 if this address can be used as local address without causing
19060  * duplicate address problems. Otherwise, return EADDRNOTAVAIL if the address
19061  * is already up on a different ill, and EADDRINUSE if it's up on the same ill.
19062  * Special checks are needed to allow the same IPv6 link-local address
19063  * on different ills.
19064  * TODO: allowing the same site-local address on different ill's.
19065  */
19066 int
19067 ip_addr_availability_check(ipif_t *new_ipif)
19068 {
19069 	in6_addr_t our_v6addr;
19070 	ill_t *ill;
19071 	ipif_t *ipif;
19072 	ill_walk_context_t ctx;
19073 
19074 	ASSERT(IAM_WRITER_IPIF(new_ipif));
19075 	ASSERT(MUTEX_HELD(&ip_addr_avail_lock));
19076 	ASSERT(RW_READ_HELD(&ill_g_lock));
19077 
19078 	new_ipif->ipif_flags &= ~IPIF_UNNUMBERED;
19079 	if (IN6_IS_ADDR_UNSPECIFIED(&new_ipif->ipif_v6lcl_addr) ||
19080 	    IN6_IS_ADDR_V4MAPPED_ANY(&new_ipif->ipif_v6lcl_addr))
19081 		return (0);
19082 
19083 	our_v6addr = new_ipif->ipif_v6lcl_addr;
19084 
19085 	if (new_ipif->ipif_isv6)
19086 		ill = ILL_START_WALK_V6(&ctx);
19087 	else
19088 		ill = ILL_START_WALK_V4(&ctx);
19089 
19090 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
19091 		for (ipif = ill->ill_ipif; ipif != NULL;
19092 		    ipif = ipif->ipif_next) {
19093 			if ((ipif == new_ipif) ||
19094 			    !(ipif->ipif_flags & IPIF_UP) ||
19095 			    (ipif->ipif_flags & IPIF_UNNUMBERED))
19096 				continue;
19097 			if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
19098 			    &our_v6addr)) {
19099 				if (new_ipif->ipif_flags & IPIF_POINTOPOINT)
19100 				    new_ipif->ipif_flags |= IPIF_UNNUMBERED;
19101 				else if (ipif->ipif_flags & IPIF_POINTOPOINT)
19102 				    ipif->ipif_flags |= IPIF_UNNUMBERED;
19103 				else if (IN6_IS_ADDR_LINKLOCAL(&our_v6addr) &&
19104 				    new_ipif->ipif_ill != ill)
19105 					continue;
19106 				else if (IN6_IS_ADDR_SITELOCAL(&our_v6addr) &&
19107 				    new_ipif->ipif_ill != ill)
19108 					continue;
19109 				else if (new_ipif->ipif_zoneid !=
19110 				    ipif->ipif_zoneid &&
19111 				    ipif->ipif_zoneid != ALL_ZONES &&
19112 				    (ill->ill_phyint->phyint_flags &
19113 				    PHYI_LOOPBACK))
19114 					continue;
19115 				else if (new_ipif->ipif_ill == ill)
19116 					return (EADDRINUSE);
19117 				else
19118 					return (EADDRNOTAVAIL);
19119 			}
19120 		}
19121 	}
19122 
19123 	return (0);
19124 }
19125 
19126 /*
19127  * Bring up an ipif: bring up arp/ndp, bring up the DLPI stream, and add
19128  * IREs for the ipif.
19129  * When the routine returns EINPROGRESS then mp has been consumed and
19130  * the ioctl will be acked from ip_rput_dlpi.
19131  */
19132 static int
19133 ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp)
19134 {
19135 	ill_t	*ill = ipif->ipif_ill;
19136 	boolean_t isv6 = ipif->ipif_isv6;
19137 	int	err = 0;
19138 	boolean_t success;
19139 
19140 	ASSERT(IAM_WRITER_IPIF(ipif));
19141 
19142 	ip1dbg(("ipif_up(%s:%u)\n", ill->ill_name, ipif->ipif_id));
19143 
19144 	/* Shouldn't get here if it is already up. */
19145 	if (ipif->ipif_flags & IPIF_UP)
19146 		return (EALREADY);
19147 
19148 	/* Skip arp/ndp for any loopback interface. */
19149 	if (ill->ill_wq != NULL) {
19150 		conn_t *connp = Q_TO_CONN(q);
19151 		ipsq_t	*ipsq = ill->ill_phyint->phyint_ipsq;
19152 
19153 		if (!ill->ill_dl_up) {
19154 			/*
19155 			 * ill_dl_up is not yet set. i.e. we are yet to
19156 			 * DL_BIND with the driver and this is the first
19157 			 * logical interface on the ill to become "up".
19158 			 * Tell the driver to get going (via DL_BIND_REQ).
19159 			 * Note that changing "significant" IFF_ flags
19160 			 * address/netmask etc cause a down/up dance, but
19161 			 * does not cause an unbind (DL_UNBIND) with the driver
19162 			 */
19163 			return (ill_dl_up(ill, ipif, mp, q));
19164 		}
19165 
19166 		/*
19167 		 * ipif_resolver_up may end up sending an
19168 		 * AR_INTERFACE_UP message to ARP, which would, in
19169 		 * turn send a DLPI message to the driver. ioctls are
19170 		 * serialized and so we cannot send more than one
19171 		 * interface up message at a time. If ipif_resolver_up
19172 		 * does send an interface up message to ARP, we get
19173 		 * EINPROGRESS and we will complete in ip_arp_done.
19174 		 */
19175 
19176 		ASSERT(connp != NULL);
19177 		ASSERT(ipsq->ipsq_pending_mp == NULL);
19178 		mutex_enter(&connp->conn_lock);
19179 		mutex_enter(&ill->ill_lock);
19180 		success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
19181 		mutex_exit(&ill->ill_lock);
19182 		mutex_exit(&connp->conn_lock);
19183 		if (!success)
19184 			return (EINTR);
19185 
19186 		/*
19187 		 * Crank up IPv6 neighbor discovery
19188 		 * Unlike ARP, this should complete when
19189 		 * ipif_ndp_up returns. However, for
19190 		 * ILLF_XRESOLV interfaces we also send a
19191 		 * AR_INTERFACE_UP to the external resolver.
19192 		 * That ioctl will complete in ip_rput.
19193 		 */
19194 		if (isv6) {
19195 			err = ipif_ndp_up(ipif, &ipif->ipif_v6lcl_addr,
19196 			    B_FALSE);
19197 			if (err != 0) {
19198 				if (err != EINPROGRESS)
19199 					mp = ipsq_pending_mp_get(ipsq, &connp);
19200 				return (err);
19201 			}
19202 		}
19203 		/* Now, ARP */
19204 		err = ipif_resolver_up(ipif, Res_act_initial);
19205 		if (err == EINPROGRESS) {
19206 			/* We will complete it in ip_arp_done */
19207 			return (err);
19208 		}
19209 		mp = ipsq_pending_mp_get(ipsq, &connp);
19210 		ASSERT(mp != NULL);
19211 		if (err != 0)
19212 			return (err);
19213 	}
19214 	return (isv6 ? ipif_up_done_v6(ipif) : ipif_up_done(ipif));
19215 }
19216 
19217 /*
19218  * Perform a bind for the physical device.
19219  * When the routine returns EINPROGRESS then mp has been consumed and
19220  * the ioctl will be acked from ip_rput_dlpi.
19221  * Allocate an unbind message and save it until ipif_down.
19222  */
19223 static int
19224 ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
19225 {
19226 	mblk_t	*areq_mp = NULL;
19227 	mblk_t	*bind_mp = NULL;
19228 	mblk_t	*unbind_mp = NULL;
19229 	conn_t	*connp;
19230 	boolean_t success;
19231 
19232 	ip1dbg(("ill_dl_up(%s)\n", ill->ill_name));
19233 	ASSERT(IAM_WRITER_ILL(ill));
19234 
19235 	ASSERT(mp != NULL);
19236 
19237 	/* Create a resolver cookie for ARP */
19238 	if (!ill->ill_isv6 && ill->ill_net_type == IRE_IF_RESOLVER) {
19239 		areq_t		*areq;
19240 		uint16_t	sap_addr;
19241 
19242 		areq_mp = ill_arp_alloc(ill,
19243 			(uchar_t *)&ip_areq_template, 0);
19244 		if (areq_mp == NULL) {
19245 			return (ENOMEM);
19246 		}
19247 		freemsg(ill->ill_resolver_mp);
19248 		ill->ill_resolver_mp = areq_mp;
19249 		areq = (areq_t *)areq_mp->b_rptr;
19250 		sap_addr = ill->ill_sap;
19251 		bcopy(&sap_addr, areq->areq_sap, sizeof (sap_addr));
19252 		/*
19253 		 * Wait till we call ill_pending_mp_add to determine
19254 		 * the success before we free the ill_resolver_mp and
19255 		 * attach areq_mp in it's place.
19256 		 */
19257 	}
19258 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
19259 	    DL_BIND_REQ);
19260 	if (bind_mp == NULL)
19261 		goto bad;
19262 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
19263 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
19264 
19265 	unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ);
19266 	if (unbind_mp == NULL)
19267 		goto bad;
19268 
19269 	/*
19270 	 * Record state needed to complete this operation when the
19271 	 * DL_BIND_ACK shows up.  Also remember the pre-allocated mblks.
19272 	 */
19273 	if (WR(q)->q_next == NULL) {
19274 		connp = Q_TO_CONN(q);
19275 		mutex_enter(&connp->conn_lock);
19276 	} else {
19277 		connp = NULL;
19278 	}
19279 	mutex_enter(&ipif->ipif_ill->ill_lock);
19280 	success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
19281 	mutex_exit(&ipif->ipif_ill->ill_lock);
19282 	if (connp != NULL)
19283 		mutex_exit(&connp->conn_lock);
19284 	if (!success)
19285 		goto bad;
19286 
19287 	/*
19288 	 * Save the unbind message for ill_dl_down(); it will be consumed when
19289 	 * the interface goes down.
19290 	 */
19291 	ASSERT(ill->ill_unbind_mp == NULL);
19292 	ill->ill_unbind_mp = unbind_mp;
19293 
19294 	ill_dlpi_send(ill, bind_mp);
19295 	/* Send down link-layer capabilities probe if not already done. */
19296 	ill_capability_probe(ill);
19297 
19298 	/*
19299 	 * Sysid used to rely on the fact that netboots set domainname
19300 	 * and the like. Now that miniroot boots aren't strictly netboots
19301 	 * and miniroot network configuration is driven from userland
19302 	 * these things still need to be set. This situation can be detected
19303 	 * by comparing the interface being configured here to the one
19304 	 * dhcack was set to reference by the boot loader. Once sysid is
19305 	 * converted to use dhcp_ipc_getinfo() this call can go away.
19306 	 */
19307 	if ((ipif->ipif_flags & IPIF_DHCPRUNNING) && (dhcack != NULL) &&
19308 	    (strcmp(ill->ill_name, dhcack) == 0) &&
19309 	    (strlen(srpc_domain) == 0)) {
19310 		if (dhcpinit() != 0)
19311 			cmn_err(CE_WARN, "no cached dhcp response");
19312 	}
19313 
19314 	/*
19315 	 * This operation will complete in ip_rput_dlpi with either
19316 	 * a DL_BIND_ACK or DL_ERROR_ACK.
19317 	 */
19318 	return (EINPROGRESS);
19319 bad:
19320 	ip1dbg(("ill_dl_up(%s) FAILED\n", ill->ill_name));
19321 	/*
19322 	 * We don't have to check for possible removal from illgrp
19323 	 * as we have not yet inserted in illgrp. For groups
19324 	 * without names, this ipif is still not UP and hence
19325 	 * this could not have possibly had any influence in forming
19326 	 * groups.
19327 	 */
19328 
19329 	if (bind_mp != NULL)
19330 		freemsg(bind_mp);
19331 	if (unbind_mp != NULL)
19332 		freemsg(unbind_mp);
19333 	return (ENOMEM);
19334 }
19335 
19336 uint_t ip_loopback_mtuplus = IP_LOOPBACK_MTU + IP_SIMPLE_HDR_LENGTH + 20;
19337 
19338 /*
19339  * DLPI and ARP is up.
19340  * Create all the IREs associated with an interface bring up multicast.
19341  * Set the interface flag and finish other initialization
19342  * that potentially had to be differed to after DL_BIND_ACK.
19343  */
19344 int
19345 ipif_up_done(ipif_t *ipif)
19346 {
19347 	ire_t	*ire_array[20];
19348 	ire_t	**irep = ire_array;
19349 	ire_t	**irep1;
19350 	ipaddr_t net_mask = 0;
19351 	ipaddr_t subnet_mask, route_mask;
19352 	ill_t	*ill = ipif->ipif_ill;
19353 	queue_t	*stq;
19354 	ipif_t	 *src_ipif;
19355 	ipif_t   *tmp_ipif;
19356 	boolean_t	flush_ire_cache = B_TRUE;
19357 	int	err = 0;
19358 	phyint_t *phyi;
19359 	ire_t	**ipif_saved_irep = NULL;
19360 	int ipif_saved_ire_cnt;
19361 	int	cnt;
19362 	boolean_t	src_ipif_held = B_FALSE;
19363 	boolean_t	ire_added = B_FALSE;
19364 	boolean_t	loopback = B_FALSE;
19365 
19366 	ip1dbg(("ipif_up_done(%s:%u)\n",
19367 		ipif->ipif_ill->ill_name, ipif->ipif_id));
19368 	/* Check if this is a loopback interface */
19369 	if (ipif->ipif_ill->ill_wq == NULL)
19370 		loopback = B_TRUE;
19371 
19372 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
19373 	/*
19374 	 * If all other interfaces for this ill are down or DEPRECATED,
19375 	 * or otherwise unsuitable for source address selection, remove
19376 	 * any IRE_CACHE entries for this ill to make sure source
19377 	 * address selection gets to take this new ipif into account.
19378 	 * No need to hold ill_lock while traversing the ipif list since
19379 	 * we are writer
19380 	 */
19381 	for (tmp_ipif = ill->ill_ipif; tmp_ipif;
19382 		tmp_ipif = tmp_ipif->ipif_next) {
19383 		if (((tmp_ipif->ipif_flags &
19384 		    (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
19385 		    !(tmp_ipif->ipif_flags & IPIF_UP)) ||
19386 		    (tmp_ipif == ipif))
19387 			continue;
19388 		/* first useable pre-existing interface */
19389 		flush_ire_cache = B_FALSE;
19390 		break;
19391 	}
19392 	if (flush_ire_cache)
19393 		ire_walk_ill_v4(MATCH_IRE_ILL_GROUP | MATCH_IRE_TYPE,
19394 		    IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill);
19395 
19396 	/*
19397 	 * Figure out which way the send-to queue should go.  Only
19398 	 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER or IRE_LOOPBACK
19399 	 * should show up here.
19400 	 */
19401 	switch (ill->ill_net_type) {
19402 	case IRE_IF_RESOLVER:
19403 		stq = ill->ill_rq;
19404 		break;
19405 	case IRE_IF_NORESOLVER:
19406 	case IRE_LOOPBACK:
19407 		stq = ill->ill_wq;
19408 		break;
19409 	default:
19410 		return (EINVAL);
19411 	}
19412 
19413 	if (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK) {
19414 		/*
19415 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
19416 		 * ipif_lookup_on_name(), but in the case of zones we can have
19417 		 * several loopback addresses on lo0. So all the interfaces with
19418 		 * loopback addresses need to be marked IRE_LOOPBACK.
19419 		 */
19420 		if (V4_PART_OF_V6(ipif->ipif_v6lcl_addr) ==
19421 		    htonl(INADDR_LOOPBACK))
19422 			ipif->ipif_ire_type = IRE_LOOPBACK;
19423 		else
19424 			ipif->ipif_ire_type = IRE_LOCAL;
19425 	}
19426 
19427 	if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)) {
19428 		/*
19429 		 * Can't use our source address. Select a different
19430 		 * source address for the IRE_INTERFACE and IRE_LOCAL
19431 		 */
19432 		src_ipif = ipif_select_source(ipif->ipif_ill,
19433 		    ipif->ipif_subnet, ipif->ipif_zoneid);
19434 		if (src_ipif == NULL)
19435 			src_ipif = ipif;	/* Last resort */
19436 		else
19437 			src_ipif_held = B_TRUE;
19438 	} else {
19439 		src_ipif = ipif;
19440 	}
19441 
19442 	/* Create all the IREs associated with this interface */
19443 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
19444 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
19445 
19446 		/*
19447 		 * If we're on a labeled system then make sure that zone-
19448 		 * private addresses have proper remote host database entries.
19449 		 */
19450 		if (is_system_labeled() &&
19451 		    ipif->ipif_ire_type != IRE_LOOPBACK &&
19452 		    !tsol_check_interface_address(ipif))
19453 			return (EINVAL);
19454 
19455 		/* Register the source address for __sin6_src_id */
19456 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
19457 		    ipif->ipif_zoneid);
19458 		if (err != 0) {
19459 			ip0dbg(("ipif_up_done: srcid_insert %d\n", err));
19460 			return (err);
19461 		}
19462 
19463 		/* If the interface address is set, create the local IRE. */
19464 		ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x for 0x%x\n",
19465 			(void *)ipif,
19466 			ipif->ipif_ire_type,
19467 			ntohl(ipif->ipif_lcl_addr)));
19468 		*irep++ = ire_create(
19469 		    (uchar_t *)&ipif->ipif_lcl_addr,	/* dest address */
19470 		    (uchar_t *)&ip_g_all_ones,		/* mask */
19471 		    (uchar_t *)&src_ipif->ipif_src_addr, /* source address */
19472 		    NULL,				/* no gateway */
19473 		    NULL,
19474 		    &ip_loopback_mtuplus,		/* max frag size */
19475 		    NULL,
19476 		    ipif->ipif_rq,			/* recv-from queue */
19477 		    NULL,				/* no send-to queue */
19478 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
19479 		    NULL,
19480 		    ipif,
19481 		    NULL,
19482 		    0,
19483 		    0,
19484 		    0,
19485 		    (ipif->ipif_flags & IPIF_PRIVATE) ?
19486 		    RTF_PRIVATE : 0,
19487 		    &ire_uinfo_null,
19488 		    NULL,
19489 		    NULL);
19490 	} else {
19491 		ip1dbg((
19492 		    "ipif_up_done: not creating IRE %d for 0x%x: flags 0x%x\n",
19493 		    ipif->ipif_ire_type,
19494 		    ntohl(ipif->ipif_lcl_addr),
19495 		    (uint_t)ipif->ipif_flags));
19496 	}
19497 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
19498 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
19499 		net_mask = ip_net_mask(ipif->ipif_lcl_addr);
19500 	} else {
19501 		net_mask = htonl(IN_CLASSA_NET);	/* fallback */
19502 	}
19503 
19504 	subnet_mask = ipif->ipif_net_mask;
19505 
19506 	/*
19507 	 * If mask was not specified, use natural netmask of
19508 	 * interface address. Also, store this mask back into the
19509 	 * ipif struct.
19510 	 */
19511 	if (subnet_mask == 0) {
19512 		subnet_mask = net_mask;
19513 		V4MASK_TO_V6(subnet_mask, ipif->ipif_v6net_mask);
19514 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
19515 		    ipif->ipif_v6subnet);
19516 	}
19517 
19518 	/* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */
19519 	if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) &&
19520 	    ipif->ipif_subnet != INADDR_ANY) {
19521 		/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
19522 
19523 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
19524 			route_mask = IP_HOST_MASK;
19525 		} else {
19526 			route_mask = subnet_mask;
19527 		}
19528 
19529 		ip1dbg(("ipif_up_done: ipif 0x%p ill 0x%p "
19530 		    "creating if IRE ill_net_type 0x%x for 0x%x\n",
19531 			(void *)ipif, (void *)ill,
19532 			ill->ill_net_type,
19533 			ntohl(ipif->ipif_subnet)));
19534 		*irep++ = ire_create(
19535 		    (uchar_t *)&ipif->ipif_subnet,	/* dest address */
19536 		    (uchar_t *)&route_mask,		/* mask */
19537 		    (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */
19538 		    NULL,				/* no gateway */
19539 		    NULL,
19540 		    &ipif->ipif_mtu,			/* max frag */
19541 		    NULL,
19542 		    NULL,				/* no recv queue */
19543 		    stq,				/* send-to queue */
19544 		    ill->ill_net_type,			/* IF_[NO]RESOLVER */
19545 		    ill->ill_resolver_mp,		/* xmit header */
19546 		    ipif,
19547 		    NULL,
19548 		    0,
19549 		    0,
19550 		    0,
19551 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE: 0,
19552 		    &ire_uinfo_null,
19553 		    NULL,
19554 		    NULL);
19555 	}
19556 
19557 	/*
19558 	 * If the interface address is set, create the broadcast IREs.
19559 	 *
19560 	 * ire_create_bcast checks if the proposed new IRE matches
19561 	 * any existing IRE's with the same physical interface (ILL).
19562 	 * This should get rid of duplicates.
19563 	 * ire_create_bcast also check IPIF_NOXMIT and does not create
19564 	 * any broadcast ires.
19565 	 */
19566 	if ((ipif->ipif_subnet != INADDR_ANY) &&
19567 	    (ipif->ipif_flags & IPIF_BROADCAST)) {
19568 		ipaddr_t addr;
19569 
19570 		ip1dbg(("ipif_up_done: creating broadcast IRE\n"));
19571 		irep = ire_check_and_create_bcast(ipif, 0, irep,
19572 		    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19573 		irep = ire_check_and_create_bcast(ipif, INADDR_BROADCAST, irep,
19574 		    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19575 
19576 		/*
19577 		 * For backward compatibility, we need to create net
19578 		 * broadcast ire's based on the old "IP address class
19579 		 * system."  The reason is that some old machines only
19580 		 * respond to these class derived net broadcast.
19581 		 *
19582 		 * But we should not create these net broadcast ire's if
19583 		 * the subnet_mask is shorter than the IP address class based
19584 		 * derived netmask.  Otherwise, we may create a net
19585 		 * broadcast address which is the same as an IP address
19586 		 * on the subnet.  Then TCP will refuse to talk to that
19587 		 * address.
19588 		 *
19589 		 * Nor do we need IRE_BROADCAST ire's for the interface
19590 		 * with the netmask as 0xFFFFFFFF, as IRE_LOCAL for that
19591 		 * interface is already created.  Creating these broadcast
19592 		 * ire's will only create confusion as the "addr" is going
19593 		 * to be same as that of the IP address of the interface.
19594 		 */
19595 		if (net_mask < subnet_mask) {
19596 			addr = net_mask & ipif->ipif_subnet;
19597 			irep = ire_check_and_create_bcast(ipif, addr, irep,
19598 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19599 			irep = ire_check_and_create_bcast(ipif,
19600 			    ~net_mask | addr, irep,
19601 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19602 		}
19603 
19604 		if (subnet_mask != 0xFFFFFFFF) {
19605 			addr = ipif->ipif_subnet;
19606 			irep = ire_check_and_create_bcast(ipif, addr, irep,
19607 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19608 			irep = ire_check_and_create_bcast(ipif,
19609 			    ~subnet_mask|addr, irep,
19610 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19611 		}
19612 	}
19613 
19614 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
19615 
19616 	/* If an earlier ire_create failed, get out now */
19617 	for (irep1 = irep; irep1 > ire_array; ) {
19618 		irep1--;
19619 		if (*irep1 == NULL) {
19620 			ip1dbg(("ipif_up_done: NULL ire found in ire_array\n"));
19621 			err = ENOMEM;
19622 			goto bad;
19623 		}
19624 	}
19625 
19626 	/*
19627 	 * Need to atomically check for ip_addr_availablity_check
19628 	 * under ip_addr_avail_lock, and if it fails got bad, and remove
19629 	 * from group also.The ill_g_lock is grabbed as reader
19630 	 * just to make sure no new ills or new ipifs are being added
19631 	 * to the system while we are checking the uniqueness of addresses.
19632 	 */
19633 	rw_enter(&ill_g_lock, RW_READER);
19634 	mutex_enter(&ip_addr_avail_lock);
19635 	/* Mark it up, and increment counters. */
19636 	ill->ill_ipif_up_count++;
19637 	ipif->ipif_flags |= IPIF_UP;
19638 	err = ip_addr_availability_check(ipif);
19639 	mutex_exit(&ip_addr_avail_lock);
19640 	rw_exit(&ill_g_lock);
19641 
19642 	if (err != 0) {
19643 		/*
19644 		 * Our address may already be up on the same ill. In this case,
19645 		 * the ARP entry for our ipif replaced the one for the other
19646 		 * ipif. So we don't want to delete it (otherwise the other ipif
19647 		 * would be unable to send packets).
19648 		 * ip_addr_availability_check() identifies this case for us and
19649 		 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL
19650 		 * which is the expected error code.
19651 		 */
19652 		if (err == EADDRINUSE) {
19653 			freemsg(ipif->ipif_arp_del_mp);
19654 			ipif->ipif_arp_del_mp = NULL;
19655 			err = EADDRNOTAVAIL;
19656 		}
19657 		ill->ill_ipif_up_count--;
19658 		ipif->ipif_flags &= ~IPIF_UP;
19659 		goto bad;
19660 	}
19661 
19662 	/*
19663 	 * Add in all newly created IREs.  ire_create_bcast() has
19664 	 * already checked for duplicates of the IRE_BROADCAST type.
19665 	 * We want to add before we call ifgrp_insert which wants
19666 	 * to know whether IRE_IF_RESOLVER exists or not.
19667 	 *
19668 	 * NOTE : We refrele the ire though we may branch to "bad"
19669 	 *	  later on where we do ire_delete. This is okay
19670 	 *	  because nobody can delete it as we are running
19671 	 *	  exclusively.
19672 	 */
19673 	for (irep1 = irep; irep1 > ire_array; ) {
19674 		irep1--;
19675 		ASSERT(!MUTEX_HELD(&((*irep1)->ire_ipif->ipif_ill->ill_lock)));
19676 		/*
19677 		 * refheld by ire_add. refele towards the end of the func
19678 		 */
19679 		(void) ire_add(irep1, NULL, NULL, NULL, B_FALSE);
19680 	}
19681 	ire_added = B_TRUE;
19682 	/*
19683 	 * Form groups if possible.
19684 	 *
19685 	 * If we are supposed to be in a ill_group with a name, insert it
19686 	 * now as we know that at least one ipif is UP. Otherwise form
19687 	 * nameless groups.
19688 	 *
19689 	 * If ip_enable_group_ifs is set and ipif address is not 0, insert
19690 	 * this ipif into the appropriate interface group, or create a
19691 	 * new one. If this is already in a nameless group, we try to form
19692 	 * a bigger group looking at other ills potentially sharing this
19693 	 * ipif's prefix.
19694 	 */
19695 	phyi = ill->ill_phyint;
19696 	if (phyi->phyint_groupname_len != 0) {
19697 		ASSERT(phyi->phyint_groupname != NULL);
19698 		if (ill->ill_ipif_up_count == 1) {
19699 			ASSERT(ill->ill_group == NULL);
19700 			err = illgrp_insert(&illgrp_head_v4, ill,
19701 			    phyi->phyint_groupname, NULL, B_TRUE);
19702 			if (err != 0) {
19703 				ip1dbg(("ipif_up_done: illgrp allocation "
19704 				    "failed, error %d\n", err));
19705 				goto bad;
19706 			}
19707 		}
19708 		ASSERT(ill->ill_group != NULL);
19709 	}
19710 
19711 	/*
19712 	 * When this is part of group, we need to make sure that
19713 	 * any broadcast ires created because of this ipif coming
19714 	 * UP gets marked/cleared with IRE_MARK_NORECV appropriately
19715 	 * so that we don't receive duplicate broadcast packets.
19716 	 */
19717 	if (ill->ill_group != NULL && ill->ill_ipif_up_count != 0)
19718 		ipif_renominate_bcast(ipif);
19719 
19720 	/* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */
19721 	ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt;
19722 	ipif_saved_irep = ipif_recover_ire(ipif);
19723 
19724 	if (!loopback) {
19725 		/*
19726 		 * If the broadcast address has been set, make sure it makes
19727 		 * sense based on the interface address.
19728 		 * Only match on ill since we are sharing broadcast addresses.
19729 		 */
19730 		if ((ipif->ipif_brd_addr != INADDR_ANY) &&
19731 		    (ipif->ipif_flags & IPIF_BROADCAST)) {
19732 			ire_t	*ire;
19733 
19734 			ire = ire_ctable_lookup(ipif->ipif_brd_addr, 0,
19735 			    IRE_BROADCAST, ipif, ALL_ZONES,
19736 			    NULL, (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19737 
19738 			if (ire == NULL) {
19739 				/*
19740 				 * If there isn't a matching broadcast IRE,
19741 				 * revert to the default for this netmask.
19742 				 */
19743 				ipif->ipif_v6brd_addr = ipv6_all_zeros;
19744 				mutex_enter(&ipif->ipif_ill->ill_lock);
19745 				ipif_set_default(ipif);
19746 				mutex_exit(&ipif->ipif_ill->ill_lock);
19747 			} else {
19748 				ire_refrele(ire);
19749 			}
19750 		}
19751 
19752 	}
19753 
19754 	/* This is the first interface on this ill */
19755 	if (ipif->ipif_ipif_up_count == 1 && !loopback) {
19756 		/*
19757 		 * Need to recover all multicast memberships in the driver.
19758 		 * This had to be deferred until we had attached.
19759 		 */
19760 		ill_recover_multicast(ill);
19761 	}
19762 	/* Join the allhosts multicast address */
19763 	ipif_multicast_up(ipif);
19764 
19765 	if (!loopback) {
19766 		/*
19767 		 * See whether anybody else would benefit from the
19768 		 * new ipif that we added. We call this always rather
19769 		 * than while adding a non-IPIF_NOLOCAL/DEPRECATED/ANYCAST
19770 		 * ipif is for the benefit of illgrp_insert (done above)
19771 		 * which does not do source address selection as it does
19772 		 * not want to re-create interface routes that we are
19773 		 * having reference to it here.
19774 		 */
19775 		ill_update_source_selection(ill);
19776 	}
19777 
19778 	for (irep1 = irep; irep1 > ire_array; ) {
19779 		irep1--;
19780 		if (*irep1 != NULL) {
19781 			/* was held in ire_add */
19782 			ire_refrele(*irep1);
19783 		}
19784 	}
19785 
19786 	cnt = ipif_saved_ire_cnt;
19787 	for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) {
19788 		if (*irep1 != NULL) {
19789 			/* was held in ire_add */
19790 			ire_refrele(*irep1);
19791 		}
19792 	}
19793 
19794 	if (!loopback && ipif->ipif_addr_ready) {
19795 		/* Broadcast an address mask reply. */
19796 		ipif_mask_reply(ipif);
19797 	}
19798 	if (ipif_saved_irep != NULL) {
19799 		kmem_free(ipif_saved_irep,
19800 		    ipif_saved_ire_cnt * sizeof (ire_t *));
19801 	}
19802 	if (src_ipif_held)
19803 		ipif_refrele(src_ipif);
19804 
19805 	/*
19806 	 * This had to be deferred until we had bound.  Tell routing sockets and
19807 	 * others that this interface is up if it looks like the address has
19808 	 * been validated.  Otherwise, if it isn't ready yet, wait for
19809 	 * duplicate address detection to do its thing.
19810 	 */
19811 	if (ipif->ipif_addr_ready) {
19812 		ip_rts_ifmsg(ipif);
19813 		ip_rts_newaddrmsg(RTM_ADD, 0, ipif);
19814 		/* Let SCTP update the status for this ipif */
19815 		sctp_update_ipif(ipif, SCTP_IPIF_UP);
19816 	}
19817 	return (0);
19818 
19819 bad:
19820 	ip1dbg(("ipif_up_done: FAILED \n"));
19821 	/*
19822 	 * We don't have to bother removing from ill groups because
19823 	 *
19824 	 * 1) For groups with names, we insert only when the first ipif
19825 	 *    comes up. In that case if it fails, it will not be in any
19826 	 *    group. So, we need not try to remove for that case.
19827 	 *
19828 	 * 2) For groups without names, either we tried to insert ipif_ill
19829 	 *    in a group as singleton or found some other group to become
19830 	 *    a bigger group. For the former, if it fails we don't have
19831 	 *    anything to do as ipif_ill is not in the group and for the
19832 	 *    latter, there are no failures in illgrp_insert/illgrp_delete
19833 	 *    (ENOMEM can't occur for this. Check ifgrp_insert).
19834 	 */
19835 	while (irep > ire_array) {
19836 		irep--;
19837 		if (*irep != NULL) {
19838 			ire_delete(*irep);
19839 			if (ire_added)
19840 				ire_refrele(*irep);
19841 		}
19842 	}
19843 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid);
19844 
19845 	if (ipif_saved_irep != NULL) {
19846 		kmem_free(ipif_saved_irep,
19847 		    ipif_saved_ire_cnt * sizeof (ire_t *));
19848 	}
19849 	if (src_ipif_held)
19850 		ipif_refrele(src_ipif);
19851 
19852 	ipif_arp_down(ipif);
19853 	return (err);
19854 }
19855 
19856 /*
19857  * Turn off the ARP with the ILLF_NOARP flag.
19858  */
19859 static int
19860 ill_arp_off(ill_t *ill)
19861 {
19862 	mblk_t	*arp_off_mp = NULL;
19863 	mblk_t	*arp_on_mp = NULL;
19864 
19865 	ip1dbg(("ill_arp_off(%s)\n", ill->ill_name));
19866 
19867 	ASSERT(IAM_WRITER_ILL(ill));
19868 	ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
19869 
19870 	/*
19871 	 * If the on message is still around we've already done
19872 	 * an arp_off without doing an arp_on thus there is no
19873 	 * work needed.
19874 	 */
19875 	if (ill->ill_arp_on_mp != NULL)
19876 		return (0);
19877 
19878 	/*
19879 	 * Allocate an ARP on message (to be saved) and an ARP off message
19880 	 */
19881 	arp_off_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aroff_template, 0);
19882 	if (!arp_off_mp)
19883 		return (ENOMEM);
19884 
19885 	arp_on_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aron_template, 0);
19886 	if (!arp_on_mp)
19887 		goto failed;
19888 
19889 	ASSERT(ill->ill_arp_on_mp == NULL);
19890 	ill->ill_arp_on_mp = arp_on_mp;
19891 
19892 	/* Send an AR_INTERFACE_OFF request */
19893 	putnext(ill->ill_rq, arp_off_mp);
19894 	return (0);
19895 failed:
19896 
19897 	if (arp_off_mp)
19898 		freemsg(arp_off_mp);
19899 	return (ENOMEM);
19900 }
19901 
19902 /*
19903  * Turn on ARP by turning off the ILLF_NOARP flag.
19904  */
19905 static int
19906 ill_arp_on(ill_t *ill)
19907 {
19908 	mblk_t	*mp;
19909 
19910 	ip1dbg(("ipif_arp_on(%s)\n", ill->ill_name));
19911 
19912 	ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
19913 
19914 	ASSERT(IAM_WRITER_ILL(ill));
19915 	/*
19916 	 * Send an AR_INTERFACE_ON request if we have already done
19917 	 * an arp_off (which allocated the message).
19918 	 */
19919 	if (ill->ill_arp_on_mp != NULL) {
19920 		mp = ill->ill_arp_on_mp;
19921 		ill->ill_arp_on_mp = NULL;
19922 		putnext(ill->ill_rq, mp);
19923 	}
19924 	return (0);
19925 }
19926 
19927 /*
19928  * Called after either deleting ill from the group or when setting
19929  * FAILED or STANDBY on the interface.
19930  */
19931 static void
19932 illgrp_reset_schednext(ill_t *ill)
19933 {
19934 	ill_group_t *illgrp;
19935 	ill_t *save_ill;
19936 
19937 	ASSERT(IAM_WRITER_ILL(ill));
19938 	/*
19939 	 * When called from illgrp_delete, ill_group will be non-NULL.
19940 	 * But when called from ip_sioctl_flags, it could be NULL if
19941 	 * somebody is setting FAILED/INACTIVE on some interface which
19942 	 * is not part of a group.
19943 	 */
19944 	illgrp = ill->ill_group;
19945 	if (illgrp == NULL)
19946 		return;
19947 	if (illgrp->illgrp_ill_schednext != ill)
19948 		return;
19949 
19950 	illgrp->illgrp_ill_schednext = NULL;
19951 	save_ill = ill;
19952 	/*
19953 	 * Choose a good ill to be the next one for
19954 	 * outbound traffic. As the flags FAILED/STANDBY is
19955 	 * not yet marked when called from ip_sioctl_flags,
19956 	 * we check for ill separately.
19957 	 */
19958 	for (ill = illgrp->illgrp_ill; ill != NULL;
19959 	    ill = ill->ill_group_next) {
19960 		if ((ill != save_ill) &&
19961 		    !(ill->ill_phyint->phyint_flags &
19962 		    (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE))) {
19963 			illgrp->illgrp_ill_schednext = ill;
19964 			return;
19965 		}
19966 	}
19967 }
19968 
19969 /*
19970  * Given an ill, find the next ill in the group to be scheduled.
19971  * (This should be called by ip_newroute() before ire_create().)
19972  * The passed in ill may be pulled out of the group, after we have picked
19973  * up a different outgoing ill from the same group. However ire add will
19974  * atomically check this.
19975  */
19976 ill_t *
19977 illgrp_scheduler(ill_t *ill)
19978 {
19979 	ill_t *retill;
19980 	ill_group_t *illgrp;
19981 	int illcnt;
19982 	int i;
19983 	uint64_t flags;
19984 
19985 	/*
19986 	 * We don't use a lock to check for the ill_group. If this ill
19987 	 * is currently being inserted we may end up just returning this
19988 	 * ill itself. That is ok.
19989 	 */
19990 	if (ill->ill_group == NULL) {
19991 		ill_refhold(ill);
19992 		return (ill);
19993 	}
19994 
19995 	/*
19996 	 * Grab the ill_g_lock as reader to make sure we are dealing with
19997 	 * a set of stable ills. No ill can be added or deleted or change
19998 	 * group while we hold the reader lock.
19999 	 */
20000 	rw_enter(&ill_g_lock, RW_READER);
20001 	if ((illgrp = ill->ill_group) == NULL) {
20002 		rw_exit(&ill_g_lock);
20003 		ill_refhold(ill);
20004 		return (ill);
20005 	}
20006 
20007 	illcnt = illgrp->illgrp_ill_count;
20008 	mutex_enter(&illgrp->illgrp_lock);
20009 	retill = illgrp->illgrp_ill_schednext;
20010 
20011 	if (retill == NULL)
20012 		retill = illgrp->illgrp_ill;
20013 
20014 	/*
20015 	 * We do a circular search beginning at illgrp_ill_schednext
20016 	 * or illgrp_ill. We don't check the flags against the ill lock
20017 	 * since it can change anytime. The ire creation will be atomic
20018 	 * and will fail if the ill is FAILED or OFFLINE.
20019 	 */
20020 	for (i = 0; i < illcnt; i++) {
20021 		flags = retill->ill_phyint->phyint_flags;
20022 
20023 		if (!(flags & (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) &&
20024 		    ILL_CAN_LOOKUP(retill)) {
20025 			illgrp->illgrp_ill_schednext = retill->ill_group_next;
20026 			ill_refhold(retill);
20027 			break;
20028 		}
20029 		retill = retill->ill_group_next;
20030 		if (retill == NULL)
20031 			retill = illgrp->illgrp_ill;
20032 	}
20033 	mutex_exit(&illgrp->illgrp_lock);
20034 	rw_exit(&ill_g_lock);
20035 
20036 	return (i == illcnt ? NULL : retill);
20037 }
20038 
20039 /*
20040  * Checks for availbility of a usable source address (if there is one) when the
20041  * destination ILL has the ill_usesrc_ifindex pointing to another ILL. Note
20042  * this selection is done regardless of the destination.
20043  */
20044 boolean_t
20045 ipif_usesrc_avail(ill_t *ill, zoneid_t zoneid)
20046 {
20047 	uint_t	ifindex;
20048 	ipif_t	*ipif = NULL;
20049 	ill_t	*uill;
20050 	boolean_t isv6;
20051 
20052 	ASSERT(ill != NULL);
20053 
20054 	isv6 = ill->ill_isv6;
20055 	ifindex = ill->ill_usesrc_ifindex;
20056 	if (ifindex != 0) {
20057 		uill = ill_lookup_on_ifindex(ifindex, isv6, NULL, NULL, NULL,
20058 		    NULL);
20059 		if (uill == NULL)
20060 			return (NULL);
20061 		mutex_enter(&uill->ill_lock);
20062 		for (ipif = uill->ill_ipif; ipif != NULL;
20063 		    ipif = ipif->ipif_next) {
20064 			if (!IPIF_CAN_LOOKUP(ipif))
20065 				continue;
20066 			if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
20067 				continue;
20068 			if (!(ipif->ipif_flags & IPIF_UP))
20069 				continue;
20070 			if (ipif->ipif_zoneid != zoneid)
20071 				continue;
20072 			if ((isv6 &&
20073 			    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) ||
20074 			    (ipif->ipif_lcl_addr == INADDR_ANY))
20075 				continue;
20076 			mutex_exit(&uill->ill_lock);
20077 			ill_refrele(uill);
20078 			return (B_TRUE);
20079 		}
20080 		mutex_exit(&uill->ill_lock);
20081 		ill_refrele(uill);
20082 	}
20083 	return (B_FALSE);
20084 }
20085 
20086 /*
20087  * Determine the best source address given a destination address and an ill.
20088  * Prefers non-deprecated over deprecated but will return a deprecated
20089  * address if there is no other choice. If there is a usable source address
20090  * on the interface pointed to by ill_usesrc_ifindex then that is given
20091  * first preference.
20092  *
20093  * Returns NULL if there is no suitable source address for the ill.
20094  * This only occurs when there is no valid source address for the ill.
20095  */
20096 ipif_t *
20097 ipif_select_source(ill_t *ill, ipaddr_t dst, zoneid_t zoneid)
20098 {
20099 	ipif_t *ipif;
20100 	ipif_t *ipif_dep = NULL;	/* Fallback to deprecated */
20101 	ipif_t *ipif_arr[MAX_IPIF_SELECT_SOURCE];
20102 	int index = 0;
20103 	boolean_t wrapped = B_FALSE;
20104 	boolean_t same_subnet_only = B_FALSE;
20105 	boolean_t ipif_same_found, ipif_other_found;
20106 	boolean_t specific_found;
20107 	ill_t	*till, *usill = NULL;
20108 	tsol_tpc_t *src_rhtp, *dst_rhtp;
20109 
20110 	if (ill->ill_usesrc_ifindex != 0) {
20111 		usill = ill_lookup_on_ifindex(ill->ill_usesrc_ifindex, B_FALSE,
20112 		    NULL, NULL, NULL, NULL);
20113 		if (usill != NULL)
20114 			ill = usill;	/* Select source from usesrc ILL */
20115 		else
20116 			return (NULL);
20117 	}
20118 
20119 	/*
20120 	 * If we're dealing with an unlabeled destination on a labeled system,
20121 	 * make sure that we ignore source addresses that are incompatible with
20122 	 * the destination's default label.  That destination's default label
20123 	 * must dominate the minimum label on the source address.
20124 	 */
20125 	dst_rhtp = NULL;
20126 	if (is_system_labeled()) {
20127 		dst_rhtp = find_tpc(&dst, IPV4_VERSION, B_FALSE);
20128 		if (dst_rhtp == NULL)
20129 			return (NULL);
20130 		if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
20131 			TPC_RELE(dst_rhtp);
20132 			dst_rhtp = NULL;
20133 		}
20134 	}
20135 
20136 	/*
20137 	 * Holds the ill_g_lock as reader. This makes sure that no ipif/ill
20138 	 * can be deleted. But an ipif/ill can get CONDEMNED any time.
20139 	 * After selecting the right ipif, under ill_lock make sure ipif is
20140 	 * not condemned, and increment refcnt. If ipif is CONDEMNED,
20141 	 * we retry. Inside the loop we still need to check for CONDEMNED,
20142 	 * but not under a lock.
20143 	 */
20144 	rw_enter(&ill_g_lock, RW_READER);
20145 
20146 retry:
20147 	till = ill;
20148 	ipif_arr[0] = NULL;
20149 
20150 	if (till->ill_group != NULL)
20151 		till = till->ill_group->illgrp_ill;
20152 
20153 	/*
20154 	 * Choose one good source address from each ill across the group.
20155 	 * If possible choose a source address in the same subnet as
20156 	 * the destination address.
20157 	 *
20158 	 * We don't check for PHYI_FAILED or PHYI_INACTIVE or PHYI_OFFLINE
20159 	 * This is okay because of the following.
20160 	 *
20161 	 *    If PHYI_FAILED is set and we still have non-deprecated
20162 	 *    addresses, it means the addresses have not yet been
20163 	 *    failed over to a different interface. We potentially
20164 	 *    select them to create IRE_CACHES, which will be later
20165 	 *    flushed when the addresses move over.
20166 	 *
20167 	 *    If PHYI_INACTIVE is set and we still have non-deprecated
20168 	 *    addresses, it means either the user has configured them
20169 	 *    or PHYI_INACTIVE has not been cleared after the addresses
20170 	 *    been moved over. For the former, in.mpathd does a failover
20171 	 *    when the interface becomes INACTIVE and hence we should
20172 	 *    not find them. Once INACTIVE is set, we don't allow them
20173 	 *    to create logical interfaces anymore. For the latter, a
20174 	 *    flush will happen when INACTIVE is cleared which will
20175 	 *    flush the IRE_CACHES.
20176 	 *
20177 	 *    If PHYI_OFFLINE is set, all the addresses will be failed
20178 	 *    over soon. We potentially select them to create IRE_CACHEs,
20179 	 *    which will be later flushed when the addresses move over.
20180 	 *
20181 	 * NOTE : As ipif_select_source is called to borrow source address
20182 	 * for an ipif that is part of a group, source address selection
20183 	 * will be re-done whenever the group changes i.e either an
20184 	 * insertion/deletion in the group.
20185 	 *
20186 	 * Fill ipif_arr[] with source addresses, using these rules:
20187 	 *
20188 	 *	1. At most one source address from a given ill ends up
20189 	 *	   in ipif_arr[] -- that is, at most one of the ipif's
20190 	 *	   associated with a given ill ends up in ipif_arr[].
20191 	 *
20192 	 *	2. If there is at least one non-deprecated ipif in the
20193 	 *	   IPMP group with a source address on the same subnet as
20194 	 *	   our destination, then fill ipif_arr[] only with
20195 	 *	   source addresses on the same subnet as our destination.
20196 	 *	   Note that because of (1), only the first
20197 	 *	   non-deprecated ipif found with a source address
20198 	 *	   matching the destination ends up in ipif_arr[].
20199 	 *
20200 	 *	3. Otherwise, fill ipif_arr[] with non-deprecated source
20201 	 *	   addresses not in the same subnet as our destination.
20202 	 *	   Again, because of (1), only the first off-subnet source
20203 	 *	   address will be chosen.
20204 	 *
20205 	 *	4. If there are no non-deprecated ipifs, then just use
20206 	 *	   the source address associated with the last deprecated
20207 	 *	   one we find that happens to be on the same subnet,
20208 	 *	   otherwise the first one not in the same subnet.
20209 	 */
20210 	specific_found = B_FALSE;
20211 	for (; till != NULL; till = till->ill_group_next) {
20212 		ipif_same_found = B_FALSE;
20213 		ipif_other_found = B_FALSE;
20214 		for (ipif = till->ill_ipif; ipif != NULL;
20215 		    ipif = ipif->ipif_next) {
20216 			if (!IPIF_CAN_LOOKUP(ipif))
20217 				continue;
20218 			/* Always skip NOLOCAL and ANYCAST interfaces */
20219 			if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
20220 				continue;
20221 			if (!(ipif->ipif_flags & IPIF_UP) ||
20222 			    !ipif->ipif_addr_ready)
20223 				continue;
20224 			if (ipif->ipif_zoneid != zoneid &&
20225 			    ipif->ipif_zoneid != ALL_ZONES)
20226 				continue;
20227 			/*
20228 			 * Interfaces with 0.0.0.0 address are allowed to be UP,
20229 			 * but are not valid as source addresses.
20230 			 */
20231 			if (ipif->ipif_lcl_addr == INADDR_ANY)
20232 				continue;
20233 
20234 			/*
20235 			 * Check compatibility of local address for
20236 			 * destination's default label if we're on a labeled
20237 			 * system.  Incompatible addresses can't be used at
20238 			 * all.
20239 			 */
20240 			if (dst_rhtp != NULL) {
20241 				boolean_t incompat;
20242 
20243 				src_rhtp = find_tpc(&ipif->ipif_lcl_addr,
20244 				    IPV4_VERSION, B_FALSE);
20245 				if (src_rhtp == NULL)
20246 					continue;
20247 				incompat =
20248 				    src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
20249 				    src_rhtp->tpc_tp.tp_doi !=
20250 				    dst_rhtp->tpc_tp.tp_doi ||
20251 				    (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
20252 				    &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
20253 				    !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
20254 				    src_rhtp->tpc_tp.tp_sl_set_cipso));
20255 				TPC_RELE(src_rhtp);
20256 				if (incompat)
20257 					continue;
20258 			}
20259 
20260 			/*
20261 			 * We prefer not to use all all-zones addresses, if we
20262 			 * can avoid it, as they pose problems with unlabeled
20263 			 * destinations.
20264 			 */
20265 			if (ipif->ipif_zoneid != ALL_ZONES) {
20266 				if (!specific_found &&
20267 				    (!same_subnet_only ||
20268 				    (ipif->ipif_net_mask & dst) ==
20269 				    ipif->ipif_subnet)) {
20270 					index = 0;
20271 					specific_found = B_TRUE;
20272 					ipif_other_found = B_FALSE;
20273 				}
20274 			} else {
20275 				if (specific_found)
20276 					continue;
20277 			}
20278 			if (ipif->ipif_flags & IPIF_DEPRECATED) {
20279 				if (ipif_dep == NULL ||
20280 				    (ipif->ipif_net_mask & dst) ==
20281 				    ipif->ipif_subnet)
20282 					ipif_dep = ipif;
20283 				continue;
20284 			}
20285 			if ((ipif->ipif_net_mask & dst) == ipif->ipif_subnet) {
20286 				/* found a source address in the same subnet */
20287 				if (!same_subnet_only) {
20288 					same_subnet_only = B_TRUE;
20289 					index = 0;
20290 				}
20291 				ipif_same_found = B_TRUE;
20292 			} else {
20293 				if (same_subnet_only || ipif_other_found)
20294 					continue;
20295 				ipif_other_found = B_TRUE;
20296 			}
20297 			ipif_arr[index++] = ipif;
20298 			if (index == MAX_IPIF_SELECT_SOURCE) {
20299 				wrapped = B_TRUE;
20300 				index = 0;
20301 			}
20302 			if (ipif_same_found)
20303 				break;
20304 		}
20305 	}
20306 
20307 	if (ipif_arr[0] == NULL) {
20308 		ipif = ipif_dep;
20309 	} else {
20310 		if (wrapped)
20311 			index = MAX_IPIF_SELECT_SOURCE;
20312 		ipif = ipif_arr[ipif_rand() % index];
20313 		ASSERT(ipif != NULL);
20314 	}
20315 
20316 	if (ipif != NULL) {
20317 		mutex_enter(&ipif->ipif_ill->ill_lock);
20318 		if (!IPIF_CAN_LOOKUP(ipif)) {
20319 			mutex_exit(&ipif->ipif_ill->ill_lock);
20320 			goto retry;
20321 		}
20322 		ipif_refhold_locked(ipif);
20323 		mutex_exit(&ipif->ipif_ill->ill_lock);
20324 	}
20325 
20326 	rw_exit(&ill_g_lock);
20327 	if (usill != NULL)
20328 		ill_refrele(usill);
20329 	if (dst_rhtp != NULL)
20330 		TPC_RELE(dst_rhtp);
20331 
20332 #ifdef DEBUG
20333 	if (ipif == NULL) {
20334 		char buf1[INET6_ADDRSTRLEN];
20335 
20336 		ip1dbg(("ipif_select_source(%s, %s) -> NULL\n",
20337 		    ill->ill_name,
20338 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1))));
20339 	} else {
20340 		char buf1[INET6_ADDRSTRLEN];
20341 		char buf2[INET6_ADDRSTRLEN];
20342 
20343 		ip1dbg(("ipif_select_source(%s, %s) -> %s\n",
20344 		    ipif->ipif_ill->ill_name,
20345 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1)),
20346 		    inet_ntop(AF_INET, &ipif->ipif_lcl_addr,
20347 		    buf2, sizeof (buf2))));
20348 	}
20349 #endif /* DEBUG */
20350 	return (ipif);
20351 }
20352 
20353 
20354 /*
20355  * If old_ipif is not NULL, see if ipif was derived from old
20356  * ipif and if so, recreate the interface route by re-doing
20357  * source address selection. This happens when ipif_down ->
20358  * ipif_update_other_ipifs calls us.
20359  *
20360  * If old_ipif is NULL, just redo the source address selection
20361  * if needed. This happens when illgrp_insert or ipif_up_done
20362  * calls us.
20363  */
20364 static void
20365 ipif_recreate_interface_routes(ipif_t *old_ipif, ipif_t *ipif)
20366 {
20367 	ire_t *ire;
20368 	ire_t *ipif_ire;
20369 	queue_t *stq;
20370 	ipif_t *nipif;
20371 	ill_t *ill;
20372 	boolean_t need_rele = B_FALSE;
20373 
20374 	ASSERT(old_ipif == NULL || IAM_WRITER_IPIF(old_ipif));
20375 	ASSERT(IAM_WRITER_IPIF(ipif));
20376 
20377 	ill = ipif->ipif_ill;
20378 	if (!(ipif->ipif_flags &
20379 	    (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) {
20380 		/*
20381 		 * Can't possibly have borrowed the source
20382 		 * from old_ipif.
20383 		 */
20384 		return;
20385 	}
20386 
20387 	/*
20388 	 * Is there any work to be done? No work if the address
20389 	 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST (
20390 	 * ipif_select_source() does not borrow addresses from
20391 	 * NOLOCAL and ANYCAST interfaces).
20392 	 */
20393 	if ((old_ipif != NULL) &&
20394 	    ((old_ipif->ipif_lcl_addr == INADDR_ANY) ||
20395 	    (old_ipif->ipif_ill->ill_wq == NULL) ||
20396 	    (old_ipif->ipif_flags &
20397 	    (IPIF_NOLOCAL|IPIF_ANYCAST)))) {
20398 		return;
20399 	}
20400 
20401 	/*
20402 	 * Perform the same checks as when creating the
20403 	 * IRE_INTERFACE in ipif_up_done.
20404 	 */
20405 	if (!(ipif->ipif_flags & IPIF_UP))
20406 		return;
20407 
20408 	if ((ipif->ipif_flags & IPIF_NOXMIT) ||
20409 	    (ipif->ipif_subnet == INADDR_ANY))
20410 		return;
20411 
20412 	ipif_ire = ipif_to_ire(ipif);
20413 	if (ipif_ire == NULL)
20414 		return;
20415 
20416 	/*
20417 	 * We know that ipif uses some other source for its
20418 	 * IRE_INTERFACE. Is it using the source of this
20419 	 * old_ipif?
20420 	 */
20421 	if (old_ipif != NULL &&
20422 	    old_ipif->ipif_lcl_addr != ipif_ire->ire_src_addr) {
20423 		ire_refrele(ipif_ire);
20424 		return;
20425 	}
20426 	if (ip_debug > 2) {
20427 		/* ip1dbg */
20428 		pr_addr_dbg("ipif_recreate_interface_routes: deleting IRE for"
20429 		    " src %s\n", AF_INET, &ipif_ire->ire_src_addr);
20430 	}
20431 
20432 	stq = ipif_ire->ire_stq;
20433 
20434 	/*
20435 	 * Can't use our source address. Select a different
20436 	 * source address for the IRE_INTERFACE.
20437 	 */
20438 	nipif = ipif_select_source(ill, ipif->ipif_subnet, ipif->ipif_zoneid);
20439 	if (nipif == NULL) {
20440 		/* Last resort - all ipif's have IPIF_NOLOCAL */
20441 		nipif = ipif;
20442 	} else {
20443 		need_rele = B_TRUE;
20444 	}
20445 
20446 	ire = ire_create(
20447 	    (uchar_t *)&ipif->ipif_subnet,	/* dest pref */
20448 	    (uchar_t *)&ipif->ipif_net_mask,	/* mask */
20449 	    (uchar_t *)&nipif->ipif_src_addr,	/* src addr */
20450 	    NULL,				/* no gateway */
20451 	    NULL,
20452 	    &ipif->ipif_mtu,			/* max frag */
20453 	    NULL,				/* fast path header */
20454 	    NULL,				/* no recv from queue */
20455 	    stq,				/* send-to queue */
20456 	    ill->ill_net_type,			/* IF_[NO]RESOLVER */
20457 	    ill->ill_resolver_mp,		/* xmit header */
20458 	    ipif,
20459 	    NULL,
20460 	    0,
20461 	    0,
20462 	    0,
20463 	    0,
20464 	    &ire_uinfo_null,
20465 	    NULL,
20466 	    NULL);
20467 
20468 	if (ire != NULL) {
20469 		ire_t *ret_ire;
20470 		int error;
20471 
20472 		/*
20473 		 * We don't need ipif_ire anymore. We need to delete
20474 		 * before we add so that ire_add does not detect
20475 		 * duplicates.
20476 		 */
20477 		ire_delete(ipif_ire);
20478 		ret_ire = ire;
20479 		error = ire_add(&ret_ire, NULL, NULL, NULL, B_FALSE);
20480 		ASSERT(error == 0);
20481 		ASSERT(ire == ret_ire);
20482 		/* Held in ire_add */
20483 		ire_refrele(ret_ire);
20484 	}
20485 	/*
20486 	 * Either we are falling through from above or could not
20487 	 * allocate a replacement.
20488 	 */
20489 	ire_refrele(ipif_ire);
20490 	if (need_rele)
20491 		ipif_refrele(nipif);
20492 }
20493 
20494 /*
20495  * This old_ipif is going away.
20496  *
20497  * Determine if any other ipif's is using our address as
20498  * ipif_lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or
20499  * IPIF_DEPRECATED).
20500  * Find the IRE_INTERFACE for such ipifs and recreate them
20501  * to use an different source address following the rules in
20502  * ipif_up_done.
20503  *
20504  * This function takes an illgrp as an argument so that illgrp_delete
20505  * can call this to update source address even after deleting the
20506  * old_ipif->ipif_ill from the ill group.
20507  */
20508 static void
20509 ipif_update_other_ipifs(ipif_t *old_ipif, ill_group_t *illgrp)
20510 {
20511 	ipif_t *ipif;
20512 	ill_t *ill;
20513 	char	buf[INET6_ADDRSTRLEN];
20514 
20515 	ASSERT(IAM_WRITER_IPIF(old_ipif));
20516 	ASSERT(illgrp == NULL || IAM_WRITER_IPIF(old_ipif));
20517 
20518 	ill = old_ipif->ipif_ill;
20519 
20520 	ip1dbg(("ipif_update_other_ipifs(%s, %s)\n",
20521 	    ill->ill_name,
20522 	    inet_ntop(AF_INET, &old_ipif->ipif_lcl_addr,
20523 	    buf, sizeof (buf))));
20524 	/*
20525 	 * If this part of a group, look at all ills as ipif_select_source
20526 	 * borrows source address across all the ills in the group.
20527 	 */
20528 	if (illgrp != NULL)
20529 		ill = illgrp->illgrp_ill;
20530 
20531 	for (; ill != NULL; ill = ill->ill_group_next) {
20532 		for (ipif = ill->ill_ipif; ipif != NULL;
20533 		    ipif = ipif->ipif_next) {
20534 
20535 			if (ipif == old_ipif)
20536 				continue;
20537 
20538 			ipif_recreate_interface_routes(old_ipif, ipif);
20539 		}
20540 	}
20541 }
20542 
20543 /* ARGSUSED */
20544 int
20545 if_unitsel_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
20546 	ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
20547 {
20548 	/*
20549 	 * ill_phyint_reinit merged the v4 and v6 into a single
20550 	 * ipsq. Could also have become part of a ipmp group in the
20551 	 * process, and we might not have been able to complete the
20552 	 * operation in ipif_set_values, if we could not become
20553 	 * exclusive.  If so restart it here.
20554 	 */
20555 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
20556 }
20557 
20558 
20559 /* ARGSUSED */
20560 int
20561 if_unitsel(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
20562     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
20563 {
20564 	queue_t		*q1 = q;
20565 	char 		*cp;
20566 	char		interf_name[LIFNAMSIZ];
20567 	uint_t		ppa = *(uint_t *)mp->b_cont->b_cont->b_rptr;
20568 
20569 	if (!q->q_next) {
20570 		ip1dbg((
20571 		    "if_unitsel: IF_UNITSEL: no q_next\n"));
20572 		return (EINVAL);
20573 	}
20574 
20575 	if (((ill_t *)(q->q_ptr))->ill_name[0] != '\0')
20576 		return (EALREADY);
20577 
20578 	do {
20579 		q1 = q1->q_next;
20580 	} while (q1->q_next);
20581 	cp = q1->q_qinfo->qi_minfo->mi_idname;
20582 	(void) sprintf(interf_name, "%s%d", cp, ppa);
20583 
20584 	/*
20585 	 * Here we are not going to delay the ioack until after
20586 	 * ACKs from DL_ATTACH_REQ/DL_BIND_REQ. So no need to save the
20587 	 * original ioctl message before sending the requests.
20588 	 */
20589 	return (ipif_set_values(q, mp, interf_name, &ppa));
20590 }
20591 
20592 /* ARGSUSED */
20593 int
20594 ip_sioctl_sifname(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
20595     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
20596 {
20597 	return (ENXIO);
20598 }
20599 
20600 /*
20601  * Net and subnet broadcast ire's are now specific to the particular
20602  * physical interface (ill) and not to any one locigal interface (ipif).
20603  * However, if a particular logical interface is being taken down, it's
20604  * associated ire's will be taken down as well.  Hence, when we go to
20605  * take down or change the local address, broadcast address or netmask
20606  * of a specific logical interface, we must check to make sure that we
20607  * have valid net and subnet broadcast ire's for the other logical
20608  * interfaces which may have been shared with the logical interface
20609  * being brought down or changed.
20610  *
20611  * There is one set of 0.0.0.0 and 255.255.255.255 per ill. Usually it
20612  * is tied to the first interface coming UP. If that ipif is going down,
20613  * we need to recreate them on the next valid ipif.
20614  *
20615  * Note: assume that the ipif passed in is still up so that it's IRE
20616  * entries are still valid.
20617  */
20618 static void
20619 ipif_check_bcast_ires(ipif_t *test_ipif)
20620 {
20621 	ipif_t	*ipif;
20622 	ire_t	*test_subnet_ire, *test_net_ire;
20623 	ire_t	*test_allzero_ire, *test_allone_ire;
20624 	ire_t	*ire_array[12];
20625 	ire_t	**irep = &ire_array[0];
20626 	ire_t	**irep1;
20627 
20628 	ipaddr_t net_addr, subnet_addr, net_mask, subnet_mask;
20629 	ipaddr_t test_net_addr, test_subnet_addr;
20630 	ipaddr_t test_net_mask, test_subnet_mask;
20631 	boolean_t need_net_bcast_ire = B_FALSE;
20632 	boolean_t need_subnet_bcast_ire = B_FALSE;
20633 	boolean_t allzero_bcast_ire_created = B_FALSE;
20634 	boolean_t allone_bcast_ire_created = B_FALSE;
20635 	boolean_t net_bcast_ire_created = B_FALSE;
20636 	boolean_t subnet_bcast_ire_created = B_FALSE;
20637 
20638 	ipif_t  *backup_ipif_net = (ipif_t *)NULL;
20639 	ipif_t  *backup_ipif_subnet = (ipif_t *)NULL;
20640 	ipif_t  *backup_ipif_allzeros = (ipif_t *)NULL;
20641 	ipif_t  *backup_ipif_allones = (ipif_t *)NULL;
20642 	uint64_t check_flags = IPIF_DEPRECATED | IPIF_NOLOCAL | IPIF_ANYCAST;
20643 
20644 	ASSERT(!test_ipif->ipif_isv6);
20645 	ASSERT(IAM_WRITER_IPIF(test_ipif));
20646 
20647 	/*
20648 	 * No broadcast IREs for the LOOPBACK interface
20649 	 * or others such as point to point and IPIF_NOXMIT.
20650 	 */
20651 	if (!(test_ipif->ipif_flags & IPIF_BROADCAST) ||
20652 	    (test_ipif->ipif_flags & IPIF_NOXMIT))
20653 		return;
20654 
20655 	test_allzero_ire = ire_ctable_lookup(0, 0, IRE_BROADCAST,
20656 	    test_ipif, ALL_ZONES, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
20657 
20658 	test_allone_ire = ire_ctable_lookup(INADDR_BROADCAST, 0, IRE_BROADCAST,
20659 	    test_ipif, ALL_ZONES, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
20660 
20661 	test_net_mask = ip_net_mask(test_ipif->ipif_subnet);
20662 	test_subnet_mask = test_ipif->ipif_net_mask;
20663 
20664 	/*
20665 	 * If no net mask set, assume the default based on net class.
20666 	 */
20667 	if (test_subnet_mask == 0)
20668 		test_subnet_mask = test_net_mask;
20669 
20670 	/*
20671 	 * Check if there is a network broadcast ire associated with this ipif
20672 	 */
20673 	test_net_addr = test_net_mask  & test_ipif->ipif_subnet;
20674 	test_net_ire = ire_ctable_lookup(test_net_addr, 0, IRE_BROADCAST,
20675 	    test_ipif, ALL_ZONES, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
20676 
20677 	/*
20678 	 * Check if there is a subnet broadcast IRE associated with this ipif
20679 	 */
20680 	test_subnet_addr = test_subnet_mask  & test_ipif->ipif_subnet;
20681 	test_subnet_ire = ire_ctable_lookup(test_subnet_addr, 0, IRE_BROADCAST,
20682 	    test_ipif, ALL_ZONES, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
20683 
20684 	/*
20685 	 * No broadcast ire's associated with this ipif.
20686 	 */
20687 	if ((test_subnet_ire == NULL) && (test_net_ire == NULL) &&
20688 	    (test_allzero_ire == NULL) && (test_allone_ire == NULL)) {
20689 		return;
20690 	}
20691 
20692 	/*
20693 	 * We have established which bcast ires have to be replaced.
20694 	 * Next we try to locate ipifs that match there ires.
20695 	 * The rules are simple: If we find an ipif that matches on the subnet
20696 	 * address it will also match on the net address, the allzeros and
20697 	 * allones address. Any ipif that matches only on the net address will
20698 	 * also match the allzeros and allones addresses.
20699 	 * The other criterion is the ipif_flags. We look for non-deprecated
20700 	 * (and non-anycast and non-nolocal) ipifs as the best choice.
20701 	 * ipifs with check_flags matching (deprecated, etc) are used only
20702 	 * if good ipifs are not available. While looping, we save existing
20703 	 * deprecated ipifs as backup_ipif.
20704 	 * We loop through all the ipifs for this ill looking for ipifs
20705 	 * whose broadcast addr match the ipif passed in, but do not have
20706 	 * their own broadcast ires. For creating 0.0.0.0 and
20707 	 * 255.255.255.255 we just need an ipif on this ill to create.
20708 	 */
20709 	for (ipif = test_ipif->ipif_ill->ill_ipif; ipif != NULL;
20710 	    ipif = ipif->ipif_next) {
20711 
20712 		ASSERT(!ipif->ipif_isv6);
20713 		/*
20714 		 * Already checked the ipif passed in.
20715 		 */
20716 		if (ipif == test_ipif) {
20717 			continue;
20718 		}
20719 
20720 		/*
20721 		 * We only need to recreate broadcast ires if another ipif in
20722 		 * the same zone uses them. The new ires must be created in the
20723 		 * same zone.
20724 		 */
20725 		if (ipif->ipif_zoneid != test_ipif->ipif_zoneid) {
20726 			continue;
20727 		}
20728 
20729 		/*
20730 		 * Only interested in logical interfaces with valid local
20731 		 * addresses or with the ability to broadcast.
20732 		 */
20733 		if ((ipif->ipif_subnet == 0) ||
20734 		    !(ipif->ipif_flags & IPIF_BROADCAST) ||
20735 		    (ipif->ipif_flags & IPIF_NOXMIT) ||
20736 		    !(ipif->ipif_flags & IPIF_UP)) {
20737 			continue;
20738 		}
20739 		/*
20740 		 * Check if there is a net broadcast ire for this
20741 		 * net address.  If it turns out that the ipif we are
20742 		 * about to take down owns this ire, we must make a
20743 		 * new one because it is potentially going away.
20744 		 */
20745 		if (test_net_ire && (!net_bcast_ire_created)) {
20746 			net_mask = ip_net_mask(ipif->ipif_subnet);
20747 			net_addr = net_mask & ipif->ipif_subnet;
20748 			if (net_addr == test_net_addr) {
20749 				need_net_bcast_ire = B_TRUE;
20750 				/*
20751 				 * Use DEPRECATED ipif only if no good
20752 				 * ires are available. subnet_addr is
20753 				 * a better match than net_addr.
20754 				 */
20755 				if ((ipif->ipif_flags & check_flags) &&
20756 				    (backup_ipif_net == NULL)) {
20757 					backup_ipif_net = ipif;
20758 				}
20759 			}
20760 		}
20761 		/*
20762 		 * Check if there is a subnet broadcast ire for this
20763 		 * net address.  If it turns out that the ipif we are
20764 		 * about to take down owns this ire, we must make a
20765 		 * new one because it is potentially going away.
20766 		 */
20767 		if (test_subnet_ire && (!subnet_bcast_ire_created)) {
20768 			subnet_mask = ipif->ipif_net_mask;
20769 			subnet_addr = ipif->ipif_subnet;
20770 			if (subnet_addr == test_subnet_addr) {
20771 				need_subnet_bcast_ire = B_TRUE;
20772 				if ((ipif->ipif_flags & check_flags) &&
20773 				    (backup_ipif_subnet == NULL)) {
20774 					backup_ipif_subnet = ipif;
20775 				}
20776 			}
20777 		}
20778 
20779 
20780 		/* Short circuit here if this ipif is deprecated */
20781 		if (ipif->ipif_flags & check_flags) {
20782 			if ((test_allzero_ire != NULL) &&
20783 			    (!allzero_bcast_ire_created) &&
20784 			    (backup_ipif_allzeros == NULL)) {
20785 				backup_ipif_allzeros = ipif;
20786 			}
20787 			if ((test_allone_ire != NULL) &&
20788 			    (!allone_bcast_ire_created) &&
20789 			    (backup_ipif_allones == NULL)) {
20790 				backup_ipif_allones = ipif;
20791 			}
20792 			continue;
20793 		}
20794 
20795 		/*
20796 		 * Found an ipif which has the same broadcast ire as the
20797 		 * ipif passed in and the ipif passed in "owns" the ire.
20798 		 * Create new broadcast ire's for this broadcast addr.
20799 		 */
20800 		if (need_net_bcast_ire && !net_bcast_ire_created) {
20801 			irep = ire_create_bcast(ipif, net_addr, irep);
20802 			irep = ire_create_bcast(ipif,
20803 			    ~net_mask | net_addr, irep);
20804 			net_bcast_ire_created = B_TRUE;
20805 		}
20806 		if (need_subnet_bcast_ire && !subnet_bcast_ire_created) {
20807 			irep = ire_create_bcast(ipif, subnet_addr, irep);
20808 			irep = ire_create_bcast(ipif,
20809 			    ~subnet_mask | subnet_addr, irep);
20810 			subnet_bcast_ire_created = B_TRUE;
20811 		}
20812 		if (test_allzero_ire != NULL && !allzero_bcast_ire_created) {
20813 			irep = ire_create_bcast(ipif, 0, irep);
20814 			allzero_bcast_ire_created = B_TRUE;
20815 		}
20816 		if (test_allone_ire != NULL && !allone_bcast_ire_created) {
20817 			irep = ire_create_bcast(ipif, INADDR_BROADCAST, irep);
20818 			allone_bcast_ire_created = B_TRUE;
20819 		}
20820 		/*
20821 		 * Once we have created all the appropriate ires, we
20822 		 * just break out of this loop to add what we have created.
20823 		 * This has been indented similar to ire_match_args for
20824 		 * readability.
20825 		 */
20826 		if (((test_net_ire == NULL) ||
20827 			(net_bcast_ire_created)) &&
20828 		    ((test_subnet_ire == NULL) ||
20829 			(subnet_bcast_ire_created)) &&
20830 		    ((test_allzero_ire == NULL) ||
20831 			(allzero_bcast_ire_created)) &&
20832 		    ((test_allone_ire == NULL) ||
20833 			(allone_bcast_ire_created))) {
20834 			break;
20835 		}
20836 	}
20837 
20838 	/*
20839 	 * Create bcast ires on deprecated ipifs if no non-deprecated ipifs
20840 	 * exist. 6 pairs of bcast ires are needed.
20841 	 * Note - the old ires are deleted in ipif_down.
20842 	 */
20843 	if (need_net_bcast_ire && !net_bcast_ire_created && backup_ipif_net) {
20844 		ipif = backup_ipif_net;
20845 		irep = ire_create_bcast(ipif, net_addr, irep);
20846 		irep = ire_create_bcast(ipif, ~net_mask | net_addr, irep);
20847 		net_bcast_ire_created = B_TRUE;
20848 	}
20849 	if (need_subnet_bcast_ire && !subnet_bcast_ire_created &&
20850 	    backup_ipif_subnet) {
20851 		ipif = backup_ipif_subnet;
20852 		irep = ire_create_bcast(ipif, subnet_addr, irep);
20853 		irep = ire_create_bcast(ipif,
20854 		    ~subnet_mask | subnet_addr, irep);
20855 		subnet_bcast_ire_created = B_TRUE;
20856 	}
20857 	if (test_allzero_ire != NULL && !allzero_bcast_ire_created &&
20858 	    backup_ipif_allzeros) {
20859 		irep = ire_create_bcast(backup_ipif_allzeros, 0, irep);
20860 		allzero_bcast_ire_created = B_TRUE;
20861 	}
20862 	if (test_allone_ire != NULL && !allone_bcast_ire_created &&
20863 	    backup_ipif_allones) {
20864 		irep = ire_create_bcast(backup_ipif_allones,
20865 		    INADDR_BROADCAST, irep);
20866 		allone_bcast_ire_created = B_TRUE;
20867 	}
20868 
20869 	/*
20870 	 * If we can't create all of them, don't add any of them.
20871 	 * Code in ip_wput_ire and ire_to_ill assumes that we
20872 	 * always have a non-loopback copy and loopback copy
20873 	 * for a given address.
20874 	 */
20875 	for (irep1 = irep; irep1 > ire_array; ) {
20876 		irep1--;
20877 		if (*irep1 == NULL) {
20878 			ip0dbg(("ipif_check_bcast_ires: can't create "
20879 			    "IRE_BROADCAST, memory allocation failure\n"));
20880 			while (irep > ire_array) {
20881 				irep--;
20882 				if (*irep != NULL)
20883 					ire_delete(*irep);
20884 			}
20885 			goto bad;
20886 		}
20887 	}
20888 	for (irep1 = irep; irep1 > ire_array; ) {
20889 		int error;
20890 
20891 		irep1--;
20892 		error = ire_add(irep1, NULL, NULL, NULL, B_FALSE);
20893 		if (error == 0) {
20894 			ire_refrele(*irep1);		/* Held in ire_add */
20895 		}
20896 	}
20897 bad:
20898 	if (test_allzero_ire != NULL)
20899 		ire_refrele(test_allzero_ire);
20900 	if (test_allone_ire != NULL)
20901 		ire_refrele(test_allone_ire);
20902 	if (test_net_ire != NULL)
20903 		ire_refrele(test_net_ire);
20904 	if (test_subnet_ire != NULL)
20905 		ire_refrele(test_subnet_ire);
20906 }
20907 
20908 /*
20909  * Extract both the flags (including IFF_CANTCHANGE) such as IFF_IPV*
20910  * from lifr_flags and the name from lifr_name.
20911  * Set IFF_IPV* and ill_isv6 prior to doing the lookup
20912  * since ipif_lookup_on_name uses the _isv6 flags when matching.
20913  * Returns EINPROGRESS when mp has been consumed by queueing it on
20914  * ill_pending_mp and the ioctl will complete in ip_rput.
20915  */
20916 /* ARGSUSED */
20917 int
20918 ip_sioctl_slifname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20919     ip_ioctl_cmd_t *ipip, void *if_req)
20920 {
20921 	int	err;
20922 	ill_t	*ill;
20923 	struct lifreq *lifr = (struct lifreq *)if_req;
20924 
20925 	ASSERT(ipif != NULL);
20926 	ip1dbg(("ip_sioctl_slifname %s\n", lifr->lifr_name));
20927 	ASSERT(q->q_next != NULL);
20928 
20929 	ill = (ill_t *)q->q_ptr;
20930 	/*
20931 	 * If we are not writer on 'q' then this interface exists already
20932 	 * and previous lookups (ipif_extract_lifreq_cmn) found this ipif.
20933 	 * So return EALREADY
20934 	 */
20935 	if (ill != ipif->ipif_ill)
20936 		return (EALREADY);
20937 
20938 	if (ill->ill_name[0] != '\0')
20939 		return (EALREADY);
20940 
20941 	/*
20942 	 * Set all the flags. Allows all kinds of override. Provide some
20943 	 * sanity checking by not allowing IFF_BROADCAST and IFF_MULTICAST
20944 	 * unless there is either multicast/broadcast support in the driver
20945 	 * or it is a pt-pt link.
20946 	 */
20947 	if (lifr->lifr_flags & (IFF_PROMISC|IFF_ALLMULTI)) {
20948 		/* Meaningless to IP thus don't allow them to be set. */
20949 		ip1dbg(("ip_setname: EINVAL 1\n"));
20950 		return (EINVAL);
20951 	}
20952 	/*
20953 	 * For a DL_STYLE2 driver (ill_needs_attach), we would not have the
20954 	 * ill_bcast_addr_length info.
20955 	 */
20956 	if (!ill->ill_needs_attach &&
20957 	    ((lifr->lifr_flags & IFF_MULTICAST) &&
20958 	    !(lifr->lifr_flags & IFF_POINTOPOINT) &&
20959 	    ill->ill_bcast_addr_length == 0)) {
20960 		/* Link not broadcast/pt-pt capable i.e. no multicast */
20961 		ip1dbg(("ip_setname: EINVAL 2\n"));
20962 		return (EINVAL);
20963 	}
20964 	if ((lifr->lifr_flags & IFF_BROADCAST) &&
20965 	    ((lifr->lifr_flags & IFF_IPV6) ||
20966 	    (!ill->ill_needs_attach && ill->ill_bcast_addr_length == 0))) {
20967 		/* Link not broadcast capable or IPv6 i.e. no broadcast */
20968 		ip1dbg(("ip_setname: EINVAL 3\n"));
20969 		return (EINVAL);
20970 	}
20971 	if (lifr->lifr_flags & IFF_UP) {
20972 		/* Can only be set with SIOCSLIFFLAGS */
20973 		ip1dbg(("ip_setname: EINVAL 4\n"));
20974 		return (EINVAL);
20975 	}
20976 	if ((lifr->lifr_flags & (IFF_IPV6|IFF_IPV4)) != IFF_IPV6 &&
20977 	    (lifr->lifr_flags & (IFF_IPV6|IFF_IPV4)) != IFF_IPV4) {
20978 		ip1dbg(("ip_setname: EINVAL 5\n"));
20979 		return (EINVAL);
20980 	}
20981 	/*
20982 	 * Only allow the IFF_XRESOLV flag to be set on IPv6 interfaces.
20983 	 */
20984 	if ((lifr->lifr_flags & IFF_XRESOLV) &&
20985 	    !(lifr->lifr_flags & IFF_IPV6) &&
20986 	    !(ipif->ipif_isv6)) {
20987 		ip1dbg(("ip_setname: EINVAL 6\n"));
20988 		return (EINVAL);
20989 	}
20990 
20991 	/*
20992 	 * The user has done SIOCGLIFFLAGS prior to this ioctl and hence
20993 	 * we have all the flags here. So, we assign rather than we OR.
20994 	 * We can't OR the flags here because we don't want to set
20995 	 * both IFF_IPV4 and IFF_IPV6. We start off as IFF_IPV4 in
20996 	 * ipif_allocate and become IFF_IPV4 or IFF_IPV6 here depending
20997 	 * on lifr_flags value here.
20998 	 */
20999 	/*
21000 	 * This ill has not been inserted into the global list.
21001 	 * So we are still single threaded and don't need any lock
21002 	 */
21003 	ipif->ipif_flags = lifr->lifr_flags & IFF_LOGINT_FLAGS &
21004 	    ~IFF_DUPLICATE;
21005 	ill->ill_flags = lifr->lifr_flags & IFF_PHYINTINST_FLAGS;
21006 	ill->ill_phyint->phyint_flags = lifr->lifr_flags & IFF_PHYINT_FLAGS;
21007 
21008 	/* We started off as V4. */
21009 	if (ill->ill_flags & ILLF_IPV6) {
21010 		ill->ill_phyint->phyint_illv6 = ill;
21011 		ill->ill_phyint->phyint_illv4 = NULL;
21012 	}
21013 	err = ipif_set_values(q, mp, lifr->lifr_name, &lifr->lifr_ppa);
21014 	return (err);
21015 }
21016 
21017 /* ARGSUSED */
21018 int
21019 ip_sioctl_slifname_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21020     ip_ioctl_cmd_t *ipip, void *if_req)
21021 {
21022 	/*
21023 	 * ill_phyint_reinit merged the v4 and v6 into a single
21024 	 * ipsq. Could also have become part of a ipmp group in the
21025 	 * process, and we might not have been able to complete the
21026 	 * slifname in ipif_set_values, if we could not become
21027 	 * exclusive.  If so restart it here
21028 	 */
21029 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
21030 }
21031 
21032 /*
21033  * Return a pointer to the ipif which matches the index, IP version type and
21034  * zoneid.
21035  */
21036 ipif_t *
21037 ipif_lookup_on_ifindex(uint_t index, boolean_t isv6, zoneid_t zoneid,
21038     queue_t *q, mblk_t *mp, ipsq_func_t func, int *err)
21039 {
21040 	ill_t	*ill;
21041 	ipsq_t  *ipsq;
21042 	phyint_t *phyi;
21043 	ipif_t	*ipif;
21044 
21045 	ASSERT((q == NULL && mp == NULL && func == NULL && err == NULL) ||
21046 	    (q != NULL && mp != NULL && func != NULL && err != NULL));
21047 
21048 	if (err != NULL)
21049 		*err = 0;
21050 
21051 	/*
21052 	 * Indexes are stored in the phyint - a common structure
21053 	 * to both IPv4 and IPv6.
21054 	 */
21055 
21056 	rw_enter(&ill_g_lock, RW_READER);
21057 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_index,
21058 	    (void *) &index, NULL);
21059 	if (phyi != NULL) {
21060 		ill = isv6 ? phyi->phyint_illv6 : phyi->phyint_illv4;
21061 		if (ill == NULL) {
21062 			rw_exit(&ill_g_lock);
21063 			if (err != NULL)
21064 				*err = ENXIO;
21065 			return (NULL);
21066 		}
21067 		GRAB_CONN_LOCK(q);
21068 		mutex_enter(&ill->ill_lock);
21069 		if (ILL_CAN_LOOKUP(ill)) {
21070 			for (ipif = ill->ill_ipif; ipif != NULL;
21071 			    ipif = ipif->ipif_next) {
21072 				if (IPIF_CAN_LOOKUP(ipif) &&
21073 				    (zoneid == ALL_ZONES ||
21074 				    zoneid == ipif->ipif_zoneid ||
21075 				    ipif->ipif_zoneid == ALL_ZONES)) {
21076 					ipif_refhold_locked(ipif);
21077 					mutex_exit(&ill->ill_lock);
21078 					RELEASE_CONN_LOCK(q);
21079 					rw_exit(&ill_g_lock);
21080 					return (ipif);
21081 				}
21082 			}
21083 		} else if (ILL_CAN_WAIT(ill, q)) {
21084 			ipsq = ill->ill_phyint->phyint_ipsq;
21085 			mutex_enter(&ipsq->ipsq_lock);
21086 			rw_exit(&ill_g_lock);
21087 			mutex_exit(&ill->ill_lock);
21088 			ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
21089 			mutex_exit(&ipsq->ipsq_lock);
21090 			RELEASE_CONN_LOCK(q);
21091 			*err = EINPROGRESS;
21092 			return (NULL);
21093 		}
21094 		mutex_exit(&ill->ill_lock);
21095 		RELEASE_CONN_LOCK(q);
21096 	}
21097 	rw_exit(&ill_g_lock);
21098 	if (err != NULL)
21099 		*err = ENXIO;
21100 	return (NULL);
21101 }
21102 
21103 typedef struct conn_change_s {
21104 	uint_t cc_old_ifindex;
21105 	uint_t cc_new_ifindex;
21106 } conn_change_t;
21107 
21108 /*
21109  * ipcl_walk function for changing interface index.
21110  */
21111 static void
21112 conn_change_ifindex(conn_t *connp, caddr_t arg)
21113 {
21114 	conn_change_t *connc;
21115 	uint_t old_ifindex;
21116 	uint_t new_ifindex;
21117 	int i;
21118 	ilg_t *ilg;
21119 
21120 	connc = (conn_change_t *)arg;
21121 	old_ifindex = connc->cc_old_ifindex;
21122 	new_ifindex = connc->cc_new_ifindex;
21123 
21124 	if (connp->conn_orig_bound_ifindex == old_ifindex)
21125 		connp->conn_orig_bound_ifindex = new_ifindex;
21126 
21127 	if (connp->conn_orig_multicast_ifindex == old_ifindex)
21128 		connp->conn_orig_multicast_ifindex = new_ifindex;
21129 
21130 	if (connp->conn_orig_xmit_ifindex == old_ifindex)
21131 		connp->conn_orig_xmit_ifindex = new_ifindex;
21132 
21133 	for (i = connp->conn_ilg_inuse - 1; i >= 0; i--) {
21134 		ilg = &connp->conn_ilg[i];
21135 		if (ilg->ilg_orig_ifindex == old_ifindex)
21136 			ilg->ilg_orig_ifindex = new_ifindex;
21137 	}
21138 }
21139 
21140 /*
21141  * Walk all the ipifs and ilms on this ill and change the orig_ifindex
21142  * to new_index if it matches the old_index.
21143  *
21144  * Failovers typically happen within a group of ills. But somebody
21145  * can remove an ill from the group after a failover happened. If
21146  * we are setting the ifindex after this, we potentially need to
21147  * look at all the ills rather than just the ones in the group.
21148  * We cut down the work by looking at matching ill_net_types
21149  * and ill_types as we could not possibly grouped them together.
21150  */
21151 static void
21152 ip_change_ifindex(ill_t *ill_orig, conn_change_t *connc)
21153 {
21154 	ill_t *ill;
21155 	ipif_t *ipif;
21156 	uint_t old_ifindex;
21157 	uint_t new_ifindex;
21158 	ilm_t *ilm;
21159 	ill_walk_context_t ctx;
21160 
21161 	old_ifindex = connc->cc_old_ifindex;
21162 	new_ifindex = connc->cc_new_ifindex;
21163 
21164 	rw_enter(&ill_g_lock, RW_READER);
21165 	ill = ILL_START_WALK_ALL(&ctx);
21166 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
21167 		if ((ill_orig->ill_net_type != ill->ill_net_type) ||
21168 			(ill_orig->ill_type != ill->ill_type)) {
21169 			continue;
21170 		}
21171 		for (ipif = ill->ill_ipif; ipif != NULL;
21172 				ipif = ipif->ipif_next) {
21173 			if (ipif->ipif_orig_ifindex == old_ifindex)
21174 				ipif->ipif_orig_ifindex = new_ifindex;
21175 		}
21176 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
21177 			if (ilm->ilm_orig_ifindex == old_ifindex)
21178 				ilm->ilm_orig_ifindex = new_ifindex;
21179 		}
21180 	}
21181 	rw_exit(&ill_g_lock);
21182 }
21183 
21184 /*
21185  * We first need to ensure that the new index is unique, and
21186  * then carry the change across both v4 and v6 ill representation
21187  * of the physical interface.
21188  */
21189 /* ARGSUSED */
21190 int
21191 ip_sioctl_slifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21192     ip_ioctl_cmd_t *ipip, void *ifreq)
21193 {
21194 	ill_t		*ill;
21195 	ill_t		*ill_other;
21196 	phyint_t	*phyi;
21197 	int		old_index;
21198 	conn_change_t	connc;
21199 	struct ifreq	*ifr = (struct ifreq *)ifreq;
21200 	struct lifreq	*lifr = (struct lifreq *)ifreq;
21201 	uint_t	index;
21202 	ill_t	*ill_v4;
21203 	ill_t	*ill_v6;
21204 
21205 	if (ipip->ipi_cmd_type == IF_CMD)
21206 		index = ifr->ifr_index;
21207 	else
21208 		index = lifr->lifr_index;
21209 
21210 	/*
21211 	 * Only allow on physical interface. Also, index zero is illegal.
21212 	 *
21213 	 * Need to check for PHYI_FAILED and PHYI_INACTIVE
21214 	 *
21215 	 * 1) If PHYI_FAILED is set, a failover could have happened which
21216 	 *    implies a possible failback might have to happen. As failback
21217 	 *    depends on the old index, we should fail setting the index.
21218 	 *
21219 	 * 2) If PHYI_INACTIVE is set, in.mpathd does a failover so that
21220 	 *    any addresses or multicast memberships are failed over to
21221 	 *    a non-STANDBY interface. As failback depends on the old
21222 	 *    index, we should fail setting the index for this case also.
21223 	 *
21224 	 * 3) If PHYI_OFFLINE is set, a possible failover has happened.
21225 	 *    Be consistent with PHYI_FAILED and fail the ioctl.
21226 	 */
21227 	ill = ipif->ipif_ill;
21228 	phyi = ill->ill_phyint;
21229 	if ((phyi->phyint_flags & (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) ||
21230 	    ipif->ipif_id != 0 || index == 0) {
21231 		return (EINVAL);
21232 	}
21233 	old_index = phyi->phyint_ifindex;
21234 
21235 	/* If the index is not changing, no work to do */
21236 	if (old_index == index)
21237 		return (0);
21238 
21239 	/*
21240 	 * Use ill_lookup_on_ifindex to determine if the
21241 	 * new index is unused and if so allow the change.
21242 	 */
21243 	ill_v6 = ill_lookup_on_ifindex(index, B_TRUE, NULL, NULL, NULL, NULL);
21244 	ill_v4 = ill_lookup_on_ifindex(index, B_FALSE, NULL, NULL, NULL, NULL);
21245 	if (ill_v6 != NULL || ill_v4 != NULL) {
21246 		if (ill_v4 != NULL)
21247 			ill_refrele(ill_v4);
21248 		if (ill_v6 != NULL)
21249 			ill_refrele(ill_v6);
21250 		return (EBUSY);
21251 	}
21252 
21253 	/*
21254 	 * The new index is unused. Set it in the phyint.
21255 	 * Locate the other ill so that we can send a routing
21256 	 * sockets message.
21257 	 */
21258 	if (ill->ill_isv6) {
21259 		ill_other = phyi->phyint_illv4;
21260 	} else {
21261 		ill_other = phyi->phyint_illv6;
21262 	}
21263 
21264 	phyi->phyint_ifindex = index;
21265 
21266 	connc.cc_old_ifindex = old_index;
21267 	connc.cc_new_ifindex = index;
21268 	ip_change_ifindex(ill, &connc);
21269 	ipcl_walk(conn_change_ifindex, (caddr_t)&connc);
21270 
21271 	/* Send the routing sockets message */
21272 	ip_rts_ifmsg(ipif);
21273 	if (ill_other != NULL)
21274 		ip_rts_ifmsg(ill_other->ill_ipif);
21275 
21276 	return (0);
21277 }
21278 
21279 /* ARGSUSED */
21280 int
21281 ip_sioctl_get_lifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21282     ip_ioctl_cmd_t *ipip, void *ifreq)
21283 {
21284 	struct ifreq	*ifr = (struct ifreq *)ifreq;
21285 	struct lifreq	*lifr = (struct lifreq *)ifreq;
21286 
21287 	ip1dbg(("ip_sioctl_get_lifindex(%s:%u %p)\n",
21288 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
21289 	/* Get the interface index */
21290 	if (ipip->ipi_cmd_type == IF_CMD) {
21291 		ifr->ifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
21292 	} else {
21293 		lifr->lifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
21294 	}
21295 	return (0);
21296 }
21297 
21298 /* ARGSUSED */
21299 int
21300 ip_sioctl_get_lifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21301     ip_ioctl_cmd_t *ipip, void *ifreq)
21302 {
21303 	struct lifreq	*lifr = (struct lifreq *)ifreq;
21304 
21305 	ip1dbg(("ip_sioctl_get_lifzone(%s:%u %p)\n",
21306 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
21307 	/* Get the interface zone */
21308 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
21309 	lifr->lifr_zoneid = ipif->ipif_zoneid;
21310 	return (0);
21311 }
21312 
21313 /*
21314  * Set the zoneid of an interface.
21315  */
21316 /* ARGSUSED */
21317 int
21318 ip_sioctl_slifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21319     ip_ioctl_cmd_t *ipip, void *ifreq)
21320 {
21321 	struct lifreq	*lifr = (struct lifreq *)ifreq;
21322 	int err = 0;
21323 	boolean_t need_up = B_FALSE;
21324 	zone_t *zptr;
21325 	zone_status_t status;
21326 	zoneid_t zoneid;
21327 
21328 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
21329 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES) {
21330 		if (!is_system_labeled())
21331 			return (ENOTSUP);
21332 		zoneid = GLOBAL_ZONEID;
21333 	}
21334 
21335 	/* cannot assign instance zero to a non-global zone */
21336 	if (ipif->ipif_id == 0 && zoneid != GLOBAL_ZONEID)
21337 		return (ENOTSUP);
21338 
21339 	/*
21340 	 * Cannot assign to a zone that doesn't exist or is shutting down.  In
21341 	 * the event of a race with the zone shutdown processing, since IP
21342 	 * serializes this ioctl and SIOCGLIFCONF/SIOCLIFREMOVEIF, we know the
21343 	 * interface will be cleaned up even if the zone is shut down
21344 	 * immediately after the status check. If the interface can't be brought
21345 	 * down right away, and the zone is shut down before the restart
21346 	 * function is called, we resolve the possible races by rechecking the
21347 	 * zone status in the restart function.
21348 	 */
21349 	if ((zptr = zone_find_by_id(zoneid)) == NULL)
21350 		return (EINVAL);
21351 	status = zone_status_get(zptr);
21352 	zone_rele(zptr);
21353 
21354 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING)
21355 		return (EINVAL);
21356 
21357 	if (ipif->ipif_flags & IPIF_UP) {
21358 		/*
21359 		 * If the interface is already marked up,
21360 		 * we call ipif_down which will take care
21361 		 * of ditching any IREs that have been set
21362 		 * up based on the old interface address.
21363 		 */
21364 		err = ipif_logical_down(ipif, q, mp);
21365 		if (err == EINPROGRESS)
21366 			return (err);
21367 		ipif_down_tail(ipif);
21368 		need_up = B_TRUE;
21369 	}
21370 
21371 	err = ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp, need_up);
21372 	return (err);
21373 }
21374 
21375 static int
21376 ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
21377     queue_t *q, mblk_t *mp, boolean_t need_up)
21378 {
21379 	int	err = 0;
21380 
21381 	ip1dbg(("ip_sioctl_zoneid_tail(%s:%u %p)\n",
21382 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
21383 
21384 	/* Set the new zone id. */
21385 	ipif->ipif_zoneid = zoneid;
21386 
21387 	/* Update sctp list */
21388 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
21389 
21390 	if (need_up) {
21391 		/*
21392 		 * Now bring the interface back up.  If this
21393 		 * is the only IPIF for the ILL, ipif_up
21394 		 * will have to re-bind to the device, so
21395 		 * we may get back EINPROGRESS, in which
21396 		 * case, this IOCTL will get completed in
21397 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
21398 		 */
21399 		err = ipif_up(ipif, q, mp);
21400 	}
21401 	return (err);
21402 }
21403 
21404 /* ARGSUSED */
21405 int
21406 ip_sioctl_slifzone_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21407     ip_ioctl_cmd_t *ipip, void *if_req)
21408 {
21409 	struct lifreq *lifr = (struct lifreq *)if_req;
21410 	zoneid_t zoneid;
21411 	zone_t *zptr;
21412 	zone_status_t status;
21413 
21414 	ASSERT(ipif->ipif_id != 0);
21415 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
21416 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES)
21417 		zoneid = GLOBAL_ZONEID;
21418 
21419 	ip1dbg(("ip_sioctl_slifzone_restart(%s:%u %p)\n",
21420 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
21421 
21422 	/*
21423 	 * We recheck the zone status to resolve the following race condition:
21424 	 * 1) process sends SIOCSLIFZONE to put hme0:1 in zone "myzone";
21425 	 * 2) hme0:1 is up and can't be brought down right away;
21426 	 * ip_sioctl_slifzone() returns EINPROGRESS and the request is queued;
21427 	 * 3) zone "myzone" is halted; the zone status switches to
21428 	 * 'shutting_down' and the zones framework sends SIOCGLIFCONF to list
21429 	 * the interfaces to remove - hme0:1 is not returned because it's not
21430 	 * yet in "myzone", so it won't be removed;
21431 	 * 4) the restart function for SIOCSLIFZONE is called; without the
21432 	 * status check here, we would have hme0:1 in "myzone" after it's been
21433 	 * destroyed.
21434 	 * Note that if the status check fails, we need to bring the interface
21435 	 * back to its state prior to ip_sioctl_slifzone(), hence the call to
21436 	 * ipif_up_done[_v6]().
21437 	 */
21438 	status = ZONE_IS_UNINITIALIZED;
21439 	if ((zptr = zone_find_by_id(zoneid)) != NULL) {
21440 		status = zone_status_get(zptr);
21441 		zone_rele(zptr);
21442 	}
21443 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING) {
21444 		if (ipif->ipif_isv6) {
21445 			(void) ipif_up_done_v6(ipif);
21446 		} else {
21447 			(void) ipif_up_done(ipif);
21448 		}
21449 		return (EINVAL);
21450 	}
21451 
21452 	ipif_down_tail(ipif);
21453 
21454 	return (ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp,
21455 	    B_TRUE));
21456 }
21457 
21458 /* ARGSUSED */
21459 int
21460 ip_sioctl_get_lifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21461 	ip_ioctl_cmd_t *ipip, void *ifreq)
21462 {
21463 	struct lifreq	*lifr = ifreq;
21464 
21465 	ASSERT(q->q_next == NULL);
21466 	ASSERT(CONN_Q(q));
21467 
21468 	ip1dbg(("ip_sioctl_get_lifusesrc(%s:%u %p)\n",
21469 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
21470 	lifr->lifr_index = ipif->ipif_ill->ill_usesrc_ifindex;
21471 	ip1dbg(("ip_sioctl_get_lifusesrc:lifr_index = %d\n", lifr->lifr_index));
21472 
21473 	return (0);
21474 }
21475 
21476 
21477 /* Find the previous ILL in this usesrc group */
21478 static ill_t *
21479 ill_prev_usesrc(ill_t *uill)
21480 {
21481 	ill_t *ill;
21482 
21483 	for (ill = uill->ill_usesrc_grp_next;
21484 	    ASSERT(ill), ill->ill_usesrc_grp_next != uill;
21485 	    ill = ill->ill_usesrc_grp_next)
21486 		/* do nothing */;
21487 	return (ill);
21488 }
21489 
21490 /*
21491  * Release all members of the usesrc group. This routine is called
21492  * from ill_delete when the interface being unplumbed is the
21493  * group head.
21494  */
21495 static void
21496 ill_disband_usesrc_group(ill_t *uill)
21497 {
21498 	ill_t *next_ill, *tmp_ill;
21499 	ASSERT(RW_WRITE_HELD(&ill_g_usesrc_lock));
21500 	next_ill = uill->ill_usesrc_grp_next;
21501 
21502 	do {
21503 		ASSERT(next_ill != NULL);
21504 		tmp_ill = next_ill->ill_usesrc_grp_next;
21505 		ASSERT(tmp_ill != NULL);
21506 		next_ill->ill_usesrc_grp_next = NULL;
21507 		next_ill->ill_usesrc_ifindex = 0;
21508 		next_ill = tmp_ill;
21509 	} while (next_ill->ill_usesrc_ifindex != 0);
21510 	uill->ill_usesrc_grp_next = NULL;
21511 }
21512 
21513 /*
21514  * Remove the client usesrc ILL from the list and relink to a new list
21515  */
21516 int
21517 ill_relink_usesrc_ills(ill_t *ucill, ill_t *uill, uint_t ifindex)
21518 {
21519 	ill_t *ill, *tmp_ill;
21520 
21521 	ASSERT((ucill != NULL) && (ucill->ill_usesrc_grp_next != NULL) &&
21522 	    (uill != NULL) && RW_WRITE_HELD(&ill_g_usesrc_lock));
21523 
21524 	/*
21525 	 * Check if the usesrc client ILL passed in is not already
21526 	 * in use as a usesrc ILL i.e one whose source address is
21527 	 * in use OR a usesrc ILL is not already in use as a usesrc
21528 	 * client ILL
21529 	 */
21530 	if ((ucill->ill_usesrc_ifindex == 0) ||
21531 	    (uill->ill_usesrc_ifindex != 0)) {
21532 		return (-1);
21533 	}
21534 
21535 	ill = ill_prev_usesrc(ucill);
21536 	ASSERT(ill->ill_usesrc_grp_next != NULL);
21537 
21538 	/* Remove from the current list */
21539 	if (ill->ill_usesrc_grp_next->ill_usesrc_grp_next == ill) {
21540 		/* Only two elements in the list */
21541 		ASSERT(ill->ill_usesrc_ifindex == 0);
21542 		ill->ill_usesrc_grp_next = NULL;
21543 	} else {
21544 		ill->ill_usesrc_grp_next = ucill->ill_usesrc_grp_next;
21545 	}
21546 
21547 	if (ifindex == 0) {
21548 		ucill->ill_usesrc_ifindex = 0;
21549 		ucill->ill_usesrc_grp_next = NULL;
21550 		return (0);
21551 	}
21552 
21553 	ucill->ill_usesrc_ifindex = ifindex;
21554 	tmp_ill = uill->ill_usesrc_grp_next;
21555 	uill->ill_usesrc_grp_next = ucill;
21556 	ucill->ill_usesrc_grp_next =
21557 	    (tmp_ill != NULL) ? tmp_ill : uill;
21558 	return (0);
21559 }
21560 
21561 /*
21562  * Set the ill_usesrc and ill_usesrc_head fields. See synchronization notes in
21563  * ip.c for locking details.
21564  */
21565 /* ARGSUSED */
21566 int
21567 ip_sioctl_slifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21568     ip_ioctl_cmd_t *ipip, void *ifreq)
21569 {
21570 	struct lifreq *lifr = (struct lifreq *)ifreq;
21571 	boolean_t isv6 = B_FALSE, reset_flg = B_FALSE,
21572 	    ill_flag_changed = B_FALSE;
21573 	ill_t *usesrc_ill, *usesrc_cli_ill = ipif->ipif_ill;
21574 	int err = 0, ret;
21575 	uint_t ifindex;
21576 	phyint_t *us_phyint, *us_cli_phyint;
21577 	ipsq_t *ipsq = NULL;
21578 
21579 	ASSERT(IAM_WRITER_IPIF(ipif));
21580 	ASSERT(q->q_next == NULL);
21581 	ASSERT(CONN_Q(q));
21582 
21583 	isv6 = (Q_TO_CONN(q))->conn_af_isv6;
21584 	us_cli_phyint = usesrc_cli_ill->ill_phyint;
21585 
21586 	ASSERT(us_cli_phyint != NULL);
21587 
21588 	/*
21589 	 * If the client ILL is being used for IPMP, abort.
21590 	 * Note, this can be done before ipsq_try_enter since we are already
21591 	 * exclusive on this ILL
21592 	 */
21593 	if ((us_cli_phyint->phyint_groupname != NULL) ||
21594 	    (us_cli_phyint->phyint_flags & PHYI_STANDBY)) {
21595 		return (EINVAL);
21596 	}
21597 
21598 	ifindex = lifr->lifr_index;
21599 	if (ifindex == 0) {
21600 		if (usesrc_cli_ill->ill_usesrc_grp_next == NULL) {
21601 			/* non usesrc group interface, nothing to reset */
21602 			return (0);
21603 		}
21604 		ifindex = usesrc_cli_ill->ill_usesrc_ifindex;
21605 		/* valid reset request */
21606 		reset_flg = B_TRUE;
21607 	}
21608 
21609 	usesrc_ill = ill_lookup_on_ifindex(ifindex, isv6, q, mp,
21610 	    ip_process_ioctl, &err);
21611 
21612 	if (usesrc_ill == NULL) {
21613 		return (err);
21614 	}
21615 
21616 	/*
21617 	 * The usesrc_cli_ill or the usesrc_ill cannot be part of an IPMP
21618 	 * group nor can either of the interfaces be used for standy. So
21619 	 * to guarantee mutual exclusion with ip_sioctl_flags (which sets
21620 	 * PHYI_STANDBY) and ip_sioctl_groupname (which sets the groupname)
21621 	 * we need to be exclusive on the ipsq belonging to the usesrc_ill.
21622 	 * We are already exlusive on this ipsq i.e ipsq corresponding to
21623 	 * the usesrc_cli_ill
21624 	 */
21625 	ipsq = ipsq_try_enter(NULL, usesrc_ill, q, mp, ip_process_ioctl,
21626 	    NEW_OP, B_TRUE);
21627 	if (ipsq == NULL) {
21628 		err = EINPROGRESS;
21629 		/* Operation enqueued on the ipsq of the usesrc ILL */
21630 		goto done;
21631 	}
21632 
21633 	/* Check if the usesrc_ill is used for IPMP */
21634 	us_phyint = usesrc_ill->ill_phyint;
21635 	if ((us_phyint->phyint_groupname != NULL) ||
21636 	    (us_phyint->phyint_flags & PHYI_STANDBY)) {
21637 		err = EINVAL;
21638 		goto done;
21639 	}
21640 
21641 	/*
21642 	 * If the client is already in use as a usesrc_ill or a usesrc_ill is
21643 	 * already a client then return EINVAL
21644 	 */
21645 	if (IS_USESRC_ILL(usesrc_cli_ill) || IS_USESRC_CLI_ILL(usesrc_ill)) {
21646 		err = EINVAL;
21647 		goto done;
21648 	}
21649 
21650 	/*
21651 	 * If the ill_usesrc_ifindex field is already set to what it needs to
21652 	 * be then this is a duplicate operation.
21653 	 */
21654 	if (!reset_flg && usesrc_cli_ill->ill_usesrc_ifindex == ifindex) {
21655 		err = 0;
21656 		goto done;
21657 	}
21658 
21659 	ip1dbg(("ip_sioctl_slifusesrc: usesrc_cli_ill %s, usesrc_ill %s,"
21660 	    " v6 = %d", usesrc_cli_ill->ill_name, usesrc_ill->ill_name,
21661 	    usesrc_ill->ill_isv6));
21662 
21663 	/*
21664 	 * The next step ensures that no new ires will be created referencing
21665 	 * the client ill, until the ILL_CHANGING flag is cleared. Then
21666 	 * we go through an ire walk deleting all ire caches that reference
21667 	 * the client ill. New ires referencing the client ill that are added
21668 	 * to the ire table before the ILL_CHANGING flag is set, will be
21669 	 * cleaned up by the ire walk below. Attempt to add new ires referencing
21670 	 * the client ill while the ILL_CHANGING flag is set will be failed
21671 	 * during the ire_add in ire_atomic_start. ire_atomic_start atomically
21672 	 * checks (under the ill_g_usesrc_lock) that the ire being added
21673 	 * is not stale, i.e the ire_stq and ire_ipif are consistent and
21674 	 * belong to the same usesrc group.
21675 	 */
21676 	mutex_enter(&usesrc_cli_ill->ill_lock);
21677 	usesrc_cli_ill->ill_state_flags |= ILL_CHANGING;
21678 	mutex_exit(&usesrc_cli_ill->ill_lock);
21679 	ill_flag_changed = B_TRUE;
21680 
21681 	if (ipif->ipif_isv6)
21682 		ire_walk_v6(ipif_delete_cache_ire, (char *)usesrc_cli_ill,
21683 		    ALL_ZONES);
21684 	else
21685 		ire_walk_v4(ipif_delete_cache_ire, (char *)usesrc_cli_ill,
21686 		    ALL_ZONES);
21687 
21688 	/*
21689 	 * ill_g_usesrc_lock global lock protects the ill_usesrc_grp_next
21690 	 * and the ill_usesrc_ifindex fields
21691 	 */
21692 	rw_enter(&ill_g_usesrc_lock, RW_WRITER);
21693 
21694 	if (reset_flg) {
21695 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill, 0);
21696 		if (ret != 0) {
21697 			err = EINVAL;
21698 		}
21699 		rw_exit(&ill_g_usesrc_lock);
21700 		goto done;
21701 	}
21702 
21703 	/*
21704 	 * Four possibilities to consider:
21705 	 * 1. Both usesrc_ill and usesrc_cli_ill are not part of any usesrc grp
21706 	 * 2. usesrc_ill is part of a group but usesrc_cli_ill isn't
21707 	 * 3. usesrc_cli_ill is part of a group but usesrc_ill isn't
21708 	 * 4. Both are part of their respective usesrc groups
21709 	 */
21710 	if ((usesrc_ill->ill_usesrc_grp_next == NULL) &&
21711 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
21712 		ASSERT(usesrc_ill->ill_usesrc_ifindex == 0);
21713 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
21714 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
21715 		usesrc_cli_ill->ill_usesrc_grp_next = usesrc_ill;
21716 	} else if ((usesrc_ill->ill_usesrc_grp_next != NULL) &&
21717 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
21718 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
21719 		/* Insert at head of list */
21720 		usesrc_cli_ill->ill_usesrc_grp_next =
21721 		    usesrc_ill->ill_usesrc_grp_next;
21722 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
21723 	} else {
21724 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill,
21725 		    ifindex);
21726 		if (ret != 0)
21727 			err = EINVAL;
21728 	}
21729 	rw_exit(&ill_g_usesrc_lock);
21730 
21731 done:
21732 	if (ill_flag_changed) {
21733 		mutex_enter(&usesrc_cli_ill->ill_lock);
21734 		usesrc_cli_ill->ill_state_flags &= ~ILL_CHANGING;
21735 		mutex_exit(&usesrc_cli_ill->ill_lock);
21736 	}
21737 	if (ipsq != NULL)
21738 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
21739 	/* The refrele on the lifr_name ipif is done by ip_process_ioctl */
21740 	ill_refrele(usesrc_ill);
21741 	return (err);
21742 }
21743 
21744 /*
21745  * comparison function used by avl.
21746  */
21747 static int
21748 ill_phyint_compare_index(const void *index_ptr, const void *phyip)
21749 {
21750 
21751 	uint_t index;
21752 
21753 	ASSERT(phyip != NULL && index_ptr != NULL);
21754 
21755 	index = *((uint_t *)index_ptr);
21756 	/*
21757 	 * let the phyint with the lowest index be on top.
21758 	 */
21759 	if (((phyint_t *)phyip)->phyint_ifindex < index)
21760 		return (1);
21761 	if (((phyint_t *)phyip)->phyint_ifindex > index)
21762 		return (-1);
21763 	return (0);
21764 }
21765 
21766 /*
21767  * comparison function used by avl.
21768  */
21769 static int
21770 ill_phyint_compare_name(const void *name_ptr, const void *phyip)
21771 {
21772 	ill_t *ill;
21773 	int res = 0;
21774 
21775 	ASSERT(phyip != NULL && name_ptr != NULL);
21776 
21777 	if (((phyint_t *)phyip)->phyint_illv4)
21778 		ill = ((phyint_t *)phyip)->phyint_illv4;
21779 	else
21780 		ill = ((phyint_t *)phyip)->phyint_illv6;
21781 	ASSERT(ill != NULL);
21782 
21783 	res = strcmp(ill->ill_name, (char *)name_ptr);
21784 	if (res > 0)
21785 		return (1);
21786 	else if (res < 0)
21787 		return (-1);
21788 	return (0);
21789 }
21790 /*
21791  * This function is called from ill_delete when the ill is being
21792  * unplumbed. We remove the reference from the phyint and we also
21793  * free the phyint when there are no more references to it.
21794  */
21795 static void
21796 ill_phyint_free(ill_t *ill)
21797 {
21798 	phyint_t *phyi;
21799 	phyint_t *next_phyint;
21800 	ipsq_t *cur_ipsq;
21801 
21802 	ASSERT(ill->ill_phyint != NULL);
21803 
21804 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
21805 	phyi = ill->ill_phyint;
21806 	ill->ill_phyint = NULL;
21807 	/*
21808 	 * ill_init allocates a phyint always to store the copy
21809 	 * of flags relevant to phyint. At that point in time, we could
21810 	 * not assign the name and hence phyint_illv4/v6 could not be
21811 	 * initialized. Later in ipif_set_values, we assign the name to
21812 	 * the ill, at which point in time we assign phyint_illv4/v6.
21813 	 * Thus we don't rely on phyint_illv6 to be initialized always.
21814 	 */
21815 	if (ill->ill_flags & ILLF_IPV6) {
21816 		phyi->phyint_illv6 = NULL;
21817 	} else {
21818 		phyi->phyint_illv4 = NULL;
21819 	}
21820 	/*
21821 	 * ipif_down removes it from the group when the last ipif goes
21822 	 * down.
21823 	 */
21824 	ASSERT(ill->ill_group == NULL);
21825 
21826 	if (phyi->phyint_illv4 != NULL || phyi->phyint_illv6 != NULL)
21827 		return;
21828 
21829 	/*
21830 	 * Make sure this phyint was put in the list.
21831 	 */
21832 	if (phyi->phyint_ifindex > 0) {
21833 		avl_remove(&phyint_g_list.phyint_list_avl_by_index,
21834 		    phyi);
21835 		avl_remove(&phyint_g_list.phyint_list_avl_by_name,
21836 		    phyi);
21837 	}
21838 	/*
21839 	 * remove phyint from the ipsq list.
21840 	 */
21841 	cur_ipsq = phyi->phyint_ipsq;
21842 	if (phyi == cur_ipsq->ipsq_phyint_list) {
21843 		cur_ipsq->ipsq_phyint_list = phyi->phyint_ipsq_next;
21844 	} else {
21845 		next_phyint = cur_ipsq->ipsq_phyint_list;
21846 		while (next_phyint != NULL) {
21847 			if (next_phyint->phyint_ipsq_next == phyi) {
21848 				next_phyint->phyint_ipsq_next =
21849 					phyi->phyint_ipsq_next;
21850 				break;
21851 			}
21852 			next_phyint = next_phyint->phyint_ipsq_next;
21853 		}
21854 		ASSERT(next_phyint != NULL);
21855 	}
21856 	IPSQ_DEC_REF(cur_ipsq);
21857 
21858 	if (phyi->phyint_groupname_len != 0) {
21859 		ASSERT(phyi->phyint_groupname != NULL);
21860 		mi_free(phyi->phyint_groupname);
21861 	}
21862 	mi_free(phyi);
21863 }
21864 
21865 /*
21866  * Attach the ill to the phyint structure which can be shared by both
21867  * IPv4 and IPv6 ill. ill_init allocates a phyint to just hold flags. This
21868  * function is called from ipif_set_values and ill_lookup_on_name (for
21869  * loopback) where we know the name of the ill. We lookup the ill and if
21870  * there is one present already with the name use that phyint. Otherwise
21871  * reuse the one allocated by ill_init.
21872  */
21873 static void
21874 ill_phyint_reinit(ill_t *ill)
21875 {
21876 	boolean_t isv6 = ill->ill_isv6;
21877 	phyint_t *phyi_old;
21878 	phyint_t *phyi;
21879 	avl_index_t where = 0;
21880 	ill_t	*ill_other = NULL;
21881 	ipsq_t	*ipsq;
21882 
21883 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
21884 
21885 	phyi_old = ill->ill_phyint;
21886 	ASSERT(isv6 || (phyi_old->phyint_illv4 == ill &&
21887 	    phyi_old->phyint_illv6 == NULL));
21888 	ASSERT(!isv6 || (phyi_old->phyint_illv6 == ill &&
21889 	    phyi_old->phyint_illv4 == NULL));
21890 	ASSERT(phyi_old->phyint_ifindex == 0);
21891 
21892 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_name,
21893 	    ill->ill_name, &where);
21894 
21895 	/*
21896 	 * 1. We grabbed the ill_g_lock before inserting this ill into
21897 	 *    the global list of ills. So no other thread could have located
21898 	 *    this ill and hence the ipsq of this ill is guaranteed to be empty.
21899 	 * 2. Now locate the other protocol instance of this ill.
21900 	 * 3. Now grab both ill locks in the right order, and the phyint lock of
21901 	 *    the new ipsq. Holding ill locks + ill_g_lock ensures that the ipsq
21902 	 *    of neither ill can change.
21903 	 * 4. Merge the phyint and thus the ipsq as well of this ill onto the
21904 	 *    other ill.
21905 	 * 5. Release all locks.
21906 	 */
21907 
21908 	/*
21909 	 * Look for IPv4 if we are initializing IPv6 or look for IPv6 if
21910 	 * we are initializing IPv4.
21911 	 */
21912 	if (phyi != NULL) {
21913 		ill_other = (isv6) ? phyi->phyint_illv4 :
21914 		    phyi->phyint_illv6;
21915 		ASSERT(ill_other->ill_phyint != NULL);
21916 		ASSERT((isv6 && !ill_other->ill_isv6) ||
21917 		    (!isv6 && ill_other->ill_isv6));
21918 		GRAB_ILL_LOCKS(ill, ill_other);
21919 		/*
21920 		 * We are potentially throwing away phyint_flags which
21921 		 * could be different from the one that we obtain from
21922 		 * ill_other->ill_phyint. But it is okay as we are assuming
21923 		 * that the state maintained within IP is correct.
21924 		 */
21925 		mutex_enter(&phyi->phyint_lock);
21926 		if (isv6) {
21927 			ASSERT(phyi->phyint_illv6 == NULL);
21928 			phyi->phyint_illv6 = ill;
21929 		} else {
21930 			ASSERT(phyi->phyint_illv4 == NULL);
21931 			phyi->phyint_illv4 = ill;
21932 		}
21933 		/*
21934 		 * This is a new ill, currently undergoing SLIFNAME
21935 		 * So we could not have joined an IPMP group until now.
21936 		 */
21937 		ASSERT(phyi_old->phyint_ipsq_next == NULL &&
21938 		    phyi_old->phyint_groupname == NULL);
21939 
21940 		/*
21941 		 * This phyi_old is going away. Decref ipsq_refs and
21942 		 * assert it is zero. The ipsq itself will be freed in
21943 		 * ipsq_exit
21944 		 */
21945 		ipsq = phyi_old->phyint_ipsq;
21946 		IPSQ_DEC_REF(ipsq);
21947 		ASSERT(ipsq->ipsq_refs == 0);
21948 		/* Get the singleton phyint out of the ipsq list */
21949 		ASSERT(phyi_old->phyint_ipsq_next == NULL);
21950 		ipsq->ipsq_phyint_list = NULL;
21951 		phyi_old->phyint_illv4 = NULL;
21952 		phyi_old->phyint_illv6 = NULL;
21953 		mi_free(phyi_old);
21954 	} else {
21955 		mutex_enter(&ill->ill_lock);
21956 		/*
21957 		 * We don't need to acquire any lock, since
21958 		 * the ill is not yet visible globally  and we
21959 		 * have not yet released the ill_g_lock.
21960 		 */
21961 		phyi = phyi_old;
21962 		mutex_enter(&phyi->phyint_lock);
21963 		/* XXX We need a recovery strategy here. */
21964 		if (!phyint_assign_ifindex(phyi))
21965 			cmn_err(CE_PANIC, "phyint_assign_ifindex() failed");
21966 
21967 		avl_insert(&phyint_g_list.phyint_list_avl_by_name,
21968 		    (void *)phyi, where);
21969 
21970 		(void) avl_find(&phyint_g_list.phyint_list_avl_by_index,
21971 		    &phyi->phyint_ifindex, &where);
21972 		avl_insert(&phyint_g_list.phyint_list_avl_by_index,
21973 		    (void *)phyi, where);
21974 	}
21975 
21976 	/*
21977 	 * Reassigning ill_phyint automatically reassigns the ipsq also.
21978 	 * pending mp is not affected because that is per ill basis.
21979 	 */
21980 	ill->ill_phyint = phyi;
21981 
21982 	/*
21983 	 * Keep the index on ipif_orig_index to be used by FAILOVER.
21984 	 * We do this here as when the first ipif was allocated,
21985 	 * ipif_allocate does not know the right interface index.
21986 	 */
21987 
21988 	ill->ill_ipif->ipif_orig_ifindex = ill->ill_phyint->phyint_ifindex;
21989 	/*
21990 	 * Now that the phyint's ifindex has been assigned, complete the
21991 	 * remaining
21992 	 */
21993 	if (ill->ill_isv6) {
21994 		ill->ill_ip6_mib->ipv6IfIndex =
21995 		    ill->ill_phyint->phyint_ifindex;
21996 		ill->ill_icmp6_mib->ipv6IfIcmpIfIndex =
21997 		    ill->ill_phyint->phyint_ifindex;
21998 	}
21999 
22000 	RELEASE_ILL_LOCKS(ill, ill_other);
22001 	mutex_exit(&phyi->phyint_lock);
22002 }
22003 
22004 /*
22005  * Notify any downstream modules of the name of this interface.
22006  * An M_IOCTL is used even though we don't expect a successful reply.
22007  * Any reply message from the driver (presumably an M_IOCNAK) will
22008  * eventually get discarded somewhere upstream.  The message format is
22009  * simply an SIOCSLIFNAME ioctl just as might be sent from ifconfig
22010  * to IP.
22011  */
22012 static void
22013 ip_ifname_notify(ill_t *ill, queue_t *q)
22014 {
22015 	mblk_t *mp1, *mp2;
22016 	struct iocblk *iocp;
22017 	struct lifreq *lifr;
22018 
22019 	mp1 = mkiocb(SIOCSLIFNAME);
22020 	if (mp1 == NULL)
22021 		return;
22022 	mp2 = allocb(sizeof (struct lifreq), BPRI_HI);
22023 	if (mp2 == NULL) {
22024 		freeb(mp1);
22025 		return;
22026 	}
22027 
22028 	mp1->b_cont = mp2;
22029 	iocp = (struct iocblk *)mp1->b_rptr;
22030 	iocp->ioc_count = sizeof (struct lifreq);
22031 
22032 	lifr = (struct lifreq *)mp2->b_rptr;
22033 	mp2->b_wptr += sizeof (struct lifreq);
22034 	bzero(lifr, sizeof (struct lifreq));
22035 
22036 	(void) strncpy(lifr->lifr_name, ill->ill_name, LIFNAMSIZ);
22037 	lifr->lifr_ppa = ill->ill_ppa;
22038 	lifr->lifr_flags = (ill->ill_flags & (ILLF_IPV4|ILLF_IPV6));
22039 
22040 	putnext(q, mp1);
22041 }
22042 
22043 static boolean_t ip_trash_timer_started = B_FALSE;
22044 
22045 static int
22046 ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
22047 {
22048 	int err;
22049 
22050 	/* Set the obsolete NDD per-interface forwarding name. */
22051 	err = ill_set_ndd_name(ill);
22052 	if (err != 0) {
22053 		cmn_err(CE_WARN, "ipif_set_values: ill_set_ndd_name (%d)\n",
22054 		    err);
22055 	}
22056 
22057 	/* Tell downstream modules where they are. */
22058 	ip_ifname_notify(ill, q);
22059 
22060 	/*
22061 	 * ill_dl_phys returns EINPROGRESS in the usual case.
22062 	 * Error cases are ENOMEM ...
22063 	 */
22064 	err = ill_dl_phys(ill, ipif, mp, q);
22065 
22066 	/*
22067 	 * If there is no IRE expiration timer running, get one started.
22068 	 * igmp and mld timers will be triggered by the first multicast
22069 	 */
22070 	if (!ip_trash_timer_started) {
22071 		/*
22072 		 * acquire the lock and check again.
22073 		 */
22074 		mutex_enter(&ip_trash_timer_lock);
22075 		if (!ip_trash_timer_started) {
22076 			ip_ire_expire_id = timeout(ip_trash_timer_expire, NULL,
22077 			    MSEC_TO_TICK(ip_timer_interval));
22078 			ip_trash_timer_started = B_TRUE;
22079 		}
22080 		mutex_exit(&ip_trash_timer_lock);
22081 	}
22082 
22083 	if (ill->ill_isv6) {
22084 		mutex_enter(&mld_slowtimeout_lock);
22085 		if (mld_slowtimeout_id == 0) {
22086 			mld_slowtimeout_id = timeout(mld_slowtimo, NULL,
22087 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
22088 		}
22089 		mutex_exit(&mld_slowtimeout_lock);
22090 	} else {
22091 		mutex_enter(&igmp_slowtimeout_lock);
22092 		if (igmp_slowtimeout_id == 0) {
22093 			igmp_slowtimeout_id = timeout(igmp_slowtimo, NULL,
22094 				MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
22095 		}
22096 		mutex_exit(&igmp_slowtimeout_lock);
22097 	}
22098 
22099 	return (err);
22100 }
22101 
22102 /*
22103  * Common routine for ppa and ifname setting. Should be called exclusive.
22104  *
22105  * Returns EINPROGRESS when mp has been consumed by queueing it on
22106  * ill_pending_mp and the ioctl will complete in ip_rput.
22107  *
22108  * NOTE : If ppa is UNIT_MAX, we assign the next valid ppa and return
22109  * the new name and new ppa in lifr_name and lifr_ppa respectively.
22110  * For SLIFNAME, we pass these values back to the userland.
22111  */
22112 static int
22113 ipif_set_values(queue_t *q, mblk_t *mp, char *interf_name, uint_t *new_ppa_ptr)
22114 {
22115 	ill_t	*ill;
22116 	ipif_t	*ipif;
22117 	ipsq_t	*ipsq;
22118 	char	*ppa_ptr;
22119 	char	*old_ptr;
22120 	char	old_char;
22121 	int	error;
22122 
22123 	ip1dbg(("ipif_set_values: interface %s\n", interf_name));
22124 	ASSERT(q->q_next != NULL);
22125 	ASSERT(interf_name != NULL);
22126 
22127 	ill = (ill_t *)q->q_ptr;
22128 
22129 	ASSERT(ill->ill_name[0] == '\0');
22130 	ASSERT(IAM_WRITER_ILL(ill));
22131 	ASSERT((mi_strlen(interf_name) + 1) <= LIFNAMSIZ);
22132 	ASSERT(ill->ill_ppa == UINT_MAX);
22133 
22134 	/* The ppa is sent down by ifconfig or is chosen */
22135 	if ((ppa_ptr = ill_get_ppa_ptr(interf_name)) == NULL) {
22136 		return (EINVAL);
22137 	}
22138 
22139 	/*
22140 	 * make sure ppa passed in is same as ppa in the name.
22141 	 * This check is not made when ppa == UINT_MAX in that case ppa
22142 	 * in the name could be anything. System will choose a ppa and
22143 	 * update new_ppa_ptr and inter_name to contain the choosen ppa.
22144 	 */
22145 	if (*new_ppa_ptr != UINT_MAX) {
22146 		/* stoi changes the pointer */
22147 		old_ptr = ppa_ptr;
22148 		/*
22149 		 * ifconfig passed in 0 for the ppa for DLPI 1 style devices
22150 		 * (they don't have an externally visible ppa).  We assign one
22151 		 * here so that we can manage the interface.  Note that in
22152 		 * the past this value was always 0 for DLPI 1 drivers.
22153 		 */
22154 		if (*new_ppa_ptr == 0)
22155 			*new_ppa_ptr = stoi(&old_ptr);
22156 		else if (*new_ppa_ptr != (uint_t)stoi(&old_ptr))
22157 			return (EINVAL);
22158 	}
22159 	/*
22160 	 * terminate string before ppa
22161 	 * save char at that location.
22162 	 */
22163 	old_char = ppa_ptr[0];
22164 	ppa_ptr[0] = '\0';
22165 
22166 	ill->ill_ppa = *new_ppa_ptr;
22167 	/*
22168 	 * Finish as much work now as possible before calling ill_glist_insert
22169 	 * which makes the ill globally visible and also merges it with the
22170 	 * other protocol instance of this phyint. The remaining work is
22171 	 * done after entering the ipsq which may happen sometime later.
22172 	 * ill_set_ndd_name occurs after the ill has been made globally visible.
22173 	 */
22174 	ipif = ill->ill_ipif;
22175 
22176 	/* We didn't do this when we allocated ipif in ip_ll_subnet_defaults */
22177 	ipif_assign_seqid(ipif);
22178 
22179 	if (!(ill->ill_flags & (ILLF_IPV4|ILLF_IPV6)))
22180 		ill->ill_flags |= ILLF_IPV4;
22181 
22182 	ASSERT(ipif->ipif_next == NULL);	/* Only one ipif on ill */
22183 	ASSERT((ipif->ipif_flags & IPIF_UP) == 0);
22184 
22185 	if (ill->ill_flags & ILLF_IPV6) {
22186 
22187 		ill->ill_isv6 = B_TRUE;
22188 		if (ill->ill_rq != NULL) {
22189 			ill->ill_rq->q_qinfo = &rinit_ipv6;
22190 			ill->ill_wq->q_qinfo = &winit_ipv6;
22191 		}
22192 
22193 		/* Keep the !IN6_IS_ADDR_V4MAPPED assertions happy */
22194 		ipif->ipif_v6lcl_addr = ipv6_all_zeros;
22195 		ipif->ipif_v6src_addr = ipv6_all_zeros;
22196 		ipif->ipif_v6subnet = ipv6_all_zeros;
22197 		ipif->ipif_v6net_mask = ipv6_all_zeros;
22198 		ipif->ipif_v6brd_addr = ipv6_all_zeros;
22199 		ipif->ipif_v6pp_dst_addr = ipv6_all_zeros;
22200 		/*
22201 		 * point-to-point or Non-mulicast capable
22202 		 * interfaces won't do NUD unless explicitly
22203 		 * configured to do so.
22204 		 */
22205 		if (ipif->ipif_flags & IPIF_POINTOPOINT ||
22206 		    !(ill->ill_flags & ILLF_MULTICAST)) {
22207 			ill->ill_flags |= ILLF_NONUD;
22208 		}
22209 		/* Make sure IPv4 specific flag is not set on IPv6 if */
22210 		if (ill->ill_flags & ILLF_NOARP) {
22211 			/*
22212 			 * Note: xresolv interfaces will eventually need
22213 			 * NOARP set here as well, but that will require
22214 			 * those external resolvers to have some
22215 			 * knowledge of that flag and act appropriately.
22216 			 * Not to be changed at present.
22217 			 */
22218 			ill->ill_flags &= ~ILLF_NOARP;
22219 		}
22220 		/*
22221 		 * Set the ILLF_ROUTER flag according to the global
22222 		 * IPv6 forwarding policy.
22223 		 */
22224 		if (ipv6_forward != 0)
22225 			ill->ill_flags |= ILLF_ROUTER;
22226 	} else if (ill->ill_flags & ILLF_IPV4) {
22227 		ill->ill_isv6 = B_FALSE;
22228 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6lcl_addr);
22229 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6src_addr);
22230 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6subnet);
22231 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6net_mask);
22232 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6brd_addr);
22233 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6pp_dst_addr);
22234 		/*
22235 		 * Set the ILLF_ROUTER flag according to the global
22236 		 * IPv4 forwarding policy.
22237 		 */
22238 		if (ip_g_forward != 0)
22239 			ill->ill_flags |= ILLF_ROUTER;
22240 	}
22241 
22242 	ASSERT(ill->ill_phyint != NULL);
22243 
22244 	/*
22245 	 * The ipv6Ifindex and ipv6IfIcmpIfIndex assignments will
22246 	 * be completed in ill_glist_insert -> ill_phyint_reinit
22247 	 */
22248 	if (ill->ill_isv6) {
22249 		/* allocate v6 mib */
22250 		if (!ill_allocate_mibs(ill))
22251 			return (ENOMEM);
22252 	}
22253 
22254 	/*
22255 	 * Pick a default sap until we get the DL_INFO_ACK back from
22256 	 * the driver.
22257 	 */
22258 	if (ill->ill_sap == 0) {
22259 		if (ill->ill_isv6)
22260 			ill->ill_sap  = IP6_DL_SAP;
22261 		else
22262 			ill->ill_sap  = IP_DL_SAP;
22263 	}
22264 
22265 	ill->ill_ifname_pending = 1;
22266 	ill->ill_ifname_pending_err = 0;
22267 
22268 	ill_refhold(ill);
22269 	rw_enter(&ill_g_lock, RW_WRITER);
22270 	if ((error = ill_glist_insert(ill, interf_name,
22271 	    (ill->ill_flags & ILLF_IPV6) == ILLF_IPV6)) > 0) {
22272 		ill->ill_ppa = UINT_MAX;
22273 		ill->ill_name[0] = '\0';
22274 		/*
22275 		 * undo null termination done above.
22276 		 */
22277 		ppa_ptr[0] = old_char;
22278 		rw_exit(&ill_g_lock);
22279 		ill_refrele(ill);
22280 		return (error);
22281 	}
22282 
22283 	ASSERT(ill->ill_name_length <= LIFNAMSIZ);
22284 
22285 	/*
22286 	 * When we return the buffer pointed to by interf_name should contain
22287 	 * the same name as in ill_name.
22288 	 * If a ppa was choosen by the system (ppa passed in was UINT_MAX)
22289 	 * the buffer pointed to by new_ppa_ptr would not contain the right ppa
22290 	 * so copy full name and update the ppa ptr.
22291 	 * When ppa passed in != UINT_MAX all values are correct just undo
22292 	 * null termination, this saves a bcopy.
22293 	 */
22294 	if (*new_ppa_ptr == UINT_MAX) {
22295 		bcopy(ill->ill_name, interf_name, ill->ill_name_length);
22296 		*new_ppa_ptr = ill->ill_ppa;
22297 	} else {
22298 		/*
22299 		 * undo null termination done above.
22300 		 */
22301 		ppa_ptr[0] = old_char;
22302 	}
22303 
22304 	/* Let SCTP know about this ILL */
22305 	sctp_update_ill(ill, SCTP_ILL_INSERT);
22306 
22307 	/* and also about the first ipif */
22308 	sctp_update_ipif(ipif, SCTP_IPIF_INSERT);
22309 
22310 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_reprocess_ioctl, NEW_OP,
22311 	    B_TRUE);
22312 
22313 	rw_exit(&ill_g_lock);
22314 	ill_refrele(ill);
22315 	if (ipsq == NULL)
22316 		return (EINPROGRESS);
22317 
22318 	/*
22319 	 * Need to set the ipsq_current_ipif now, if we have changed ipsq
22320 	 * due to the phyint merge in ill_phyint_reinit.
22321 	 */
22322 	ASSERT(ipsq->ipsq_current_ipif == NULL ||
22323 		ipsq->ipsq_current_ipif == ipif);
22324 	ipsq->ipsq_current_ipif = ipif;
22325 	ipsq->ipsq_last_cmd = SIOCSLIFNAME;
22326 	error = ipif_set_values_tail(ill, ipif, mp, q);
22327 	ipsq_exit(ipsq, B_TRUE, B_TRUE);
22328 	if (error != 0 && error != EINPROGRESS) {
22329 		/*
22330 		 * restore previous values
22331 		 */
22332 		ill->ill_isv6 = B_FALSE;
22333 	}
22334 	return (error);
22335 }
22336 
22337 
22338 extern void (*ip_cleanup_func)(void);
22339 
22340 void
22341 ipif_init(void)
22342 {
22343 	hrtime_t hrt;
22344 	int i;
22345 
22346 	/*
22347 	 * Can't call drv_getparm here as it is too early in the boot.
22348 	 * As we use ipif_src_random just for picking a different
22349 	 * source address everytime, this need not be really random.
22350 	 */
22351 	hrt = gethrtime();
22352 	ipif_src_random = ((hrt >> 32) & 0xffffffff) * (hrt & 0xffffffff);
22353 
22354 	for (i = 0; i < MAX_G_HEADS; i++) {
22355 		ill_g_heads[i].ill_g_list_head = (ill_if_t *)&ill_g_heads[i];
22356 		ill_g_heads[i].ill_g_list_tail = (ill_if_t *)&ill_g_heads[i];
22357 	}
22358 
22359 	avl_create(&phyint_g_list.phyint_list_avl_by_index,
22360 	    ill_phyint_compare_index,
22361 	    sizeof (phyint_t),
22362 	    offsetof(struct phyint, phyint_avl_by_index));
22363 	avl_create(&phyint_g_list.phyint_list_avl_by_name,
22364 	    ill_phyint_compare_name,
22365 	    sizeof (phyint_t),
22366 	    offsetof(struct phyint, phyint_avl_by_name));
22367 
22368 	ip_cleanup_func = ip_thread_exit;
22369 }
22370 
22371 /*
22372  * This is called by ip_rt_add when src_addr value is other than zero.
22373  * src_addr signifies the source address of the incoming packet. For
22374  * reverse tunnel route we need to create a source addr based routing
22375  * table. This routine creates ip_mrtun_table if it's empty and then
22376  * it adds the route entry hashed by source address. It verifies that
22377  * the outgoing interface is always a non-resolver interface (tunnel).
22378  */
22379 int
22380 ip_mrtun_rt_add(ipaddr_t in_src_addr, int flags, ipif_t *ipif_arg,
22381     ipif_t *src_ipif, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func)
22382 {
22383 	ire_t   *ire;
22384 	ire_t	*save_ire;
22385 	ipif_t  *ipif;
22386 	ill_t   *in_ill = NULL;
22387 	ill_t	*out_ill;
22388 	queue_t	*stq;
22389 	mblk_t	*dlureq_mp;
22390 	int	error;
22391 
22392 	if (ire_arg != NULL)
22393 		*ire_arg = NULL;
22394 	ASSERT(in_src_addr != INADDR_ANY);
22395 
22396 	ipif = ipif_arg;
22397 	if (ipif != NULL) {
22398 		out_ill = ipif->ipif_ill;
22399 	} else {
22400 		ip1dbg(("ip_mrtun_rt_add: ipif is NULL\n"));
22401 		return (EINVAL);
22402 	}
22403 
22404 	if (src_ipif == NULL) {
22405 		ip1dbg(("ip_mrtun_rt_add: src_ipif is NULL\n"));
22406 		return (EINVAL);
22407 	}
22408 	in_ill = src_ipif->ipif_ill;
22409 
22410 	/*
22411 	 * Check for duplicates. We don't need to
22412 	 * match out_ill, because the uniqueness of
22413 	 * a route is only dependent on src_addr and
22414 	 * in_ill.
22415 	 */
22416 	ire = ire_mrtun_lookup(in_src_addr, in_ill);
22417 	if (ire != NULL) {
22418 		ire_refrele(ire);
22419 		return (EEXIST);
22420 	}
22421 	if (ipif->ipif_net_type != IRE_IF_NORESOLVER) {
22422 		ip2dbg(("ip_mrtun_rt_add: outgoing interface is type %d\n",
22423 		    ipif->ipif_net_type));
22424 		return (EINVAL);
22425 	}
22426 
22427 	stq = ipif->ipif_wq;
22428 	ASSERT(stq != NULL);
22429 
22430 	/*
22431 	 * The outgoing interface must be non-resolver
22432 	 * interface.
22433 	 */
22434 	dlureq_mp = ill_dlur_gen(NULL,
22435 	    out_ill->ill_phys_addr_length, out_ill->ill_sap,
22436 	    out_ill->ill_sap_length);
22437 
22438 	if (dlureq_mp == NULL) {
22439 		ip1dbg(("ip_newroute: dlureq_mp NULL\n"));
22440 		return (ENOMEM);
22441 	}
22442 
22443 	/* Create the IRE. */
22444 
22445 	ire = ire_create(
22446 	    NULL,				/* Zero dst addr */
22447 	    NULL,				/* Zero mask */
22448 	    NULL,				/* Zero gateway addr */
22449 	    NULL,				/* Zero ipif_src addr */
22450 	    (uint8_t *)&in_src_addr,		/* in_src-addr */
22451 	    &ipif->ipif_mtu,
22452 	    NULL,
22453 	    NULL,				/* rfq */
22454 	    stq,
22455 	    IRE_MIPRTUN,
22456 	    dlureq_mp,
22457 	    ipif,
22458 	    in_ill,
22459 	    0,
22460 	    0,
22461 	    0,
22462 	    flags,
22463 	    &ire_uinfo_null,
22464 	    NULL,
22465 	    NULL);
22466 
22467 	if (ire == NULL)
22468 		return (ENOMEM);
22469 	ip2dbg(("ip_mrtun_rt_add: mrtun route is created with type %d\n",
22470 	    ire->ire_type));
22471 	save_ire = ire;
22472 	ASSERT(save_ire != NULL);
22473 	error = ire_add_mrtun(&ire, q, mp, func);
22474 	/*
22475 	 * If ire_add_mrtun() failed, the ire passed in was freed
22476 	 * so there is no need to do so here.
22477 	 */
22478 	if (error != 0) {
22479 		return (error);
22480 	}
22481 
22482 	/* Duplicate check */
22483 	if (ire != save_ire) {
22484 		/* route already exists by now */
22485 		ire_refrele(ire);
22486 		return (EEXIST);
22487 	}
22488 
22489 	if (ire_arg != NULL) {
22490 		/*
22491 		 * Store the ire that was just added. the caller
22492 		 * ip_rts_request responsible for doing ire_refrele()
22493 		 * on it.
22494 		 */
22495 		*ire_arg = ire;
22496 	} else {
22497 		ire_refrele(ire);	/* held in ire_add_mrtun */
22498 	}
22499 
22500 	return (0);
22501 }
22502 
22503 /*
22504  * It is called by ip_rt_delete() only when mipagent requests to delete
22505  * a reverse tunnel route that was added by ip_mrtun_rt_add() before.
22506  */
22507 
22508 int
22509 ip_mrtun_rt_delete(ipaddr_t in_src_addr, ipif_t *src_ipif)
22510 {
22511 	ire_t   *ire = NULL;
22512 
22513 	if (in_src_addr == INADDR_ANY)
22514 		return (EINVAL);
22515 	if (src_ipif == NULL)
22516 		return (EINVAL);
22517 
22518 	/* search if this route exists in the ip_mrtun_table */
22519 	ire = ire_mrtun_lookup(in_src_addr, src_ipif->ipif_ill);
22520 	if (ire == NULL) {
22521 		ip2dbg(("ip_mrtun_rt_delete: ire not found\n"));
22522 		return (ESRCH);
22523 	}
22524 	ire_delete(ire);
22525 	ire_refrele(ire);
22526 	return (0);
22527 }
22528 
22529 /*
22530  * Lookup the ipif corresponding to the onlink destination address. For
22531  * point-to-point interfaces, it matches with remote endpoint destination
22532  * address. For point-to-multipoint interfaces it only tries to match the
22533  * destination with the interface's subnet address. The longest, most specific
22534  * match is found to take care of such rare network configurations like -
22535  * le0: 129.146.1.1/16
22536  * le1: 129.146.2.2/24
22537  * It is used only by SO_DONTROUTE at the moment.
22538  */
22539 ipif_t *
22540 ipif_lookup_onlink_addr(ipaddr_t addr, zoneid_t zoneid)
22541 {
22542 	ipif_t	*ipif, *best_ipif;
22543 	ill_t	*ill;
22544 	ill_walk_context_t ctx;
22545 
22546 	ASSERT(zoneid != ALL_ZONES);
22547 	best_ipif = NULL;
22548 
22549 	rw_enter(&ill_g_lock, RW_READER);
22550 	ill = ILL_START_WALK_V4(&ctx);
22551 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
22552 		mutex_enter(&ill->ill_lock);
22553 		for (ipif = ill->ill_ipif; ipif != NULL;
22554 		    ipif = ipif->ipif_next) {
22555 			if (!IPIF_CAN_LOOKUP(ipif))
22556 				continue;
22557 			if (ipif->ipif_zoneid != zoneid &&
22558 			    ipif->ipif_zoneid != ALL_ZONES)
22559 				continue;
22560 			/*
22561 			 * Point-to-point case. Look for exact match with
22562 			 * destination address.
22563 			 */
22564 			if (ipif->ipif_flags & IPIF_POINTOPOINT) {
22565 				if (ipif->ipif_pp_dst_addr == addr) {
22566 					ipif_refhold_locked(ipif);
22567 					mutex_exit(&ill->ill_lock);
22568 					rw_exit(&ill_g_lock);
22569 					if (best_ipif != NULL)
22570 						ipif_refrele(best_ipif);
22571 					return (ipif);
22572 				}
22573 			} else if (ipif->ipif_subnet == (addr &
22574 			    ipif->ipif_net_mask)) {
22575 				/*
22576 				 * Point-to-multipoint case. Looping through to
22577 				 * find the most specific match. If there are
22578 				 * multiple best match ipif's then prefer ipif's
22579 				 * that are UP. If there is only one best match
22580 				 * ipif and it is DOWN we must still return it.
22581 				 */
22582 				if ((best_ipif == NULL) ||
22583 				    (ipif->ipif_net_mask >
22584 				    best_ipif->ipif_net_mask) ||
22585 				    ((ipif->ipif_net_mask ==
22586 				    best_ipif->ipif_net_mask) &&
22587 				    ((ipif->ipif_flags & IPIF_UP) &&
22588 				    (!(best_ipif->ipif_flags & IPIF_UP))))) {
22589 					ipif_refhold_locked(ipif);
22590 					mutex_exit(&ill->ill_lock);
22591 					rw_exit(&ill_g_lock);
22592 					if (best_ipif != NULL)
22593 						ipif_refrele(best_ipif);
22594 					best_ipif = ipif;
22595 					rw_enter(&ill_g_lock, RW_READER);
22596 					mutex_enter(&ill->ill_lock);
22597 				}
22598 			}
22599 		}
22600 		mutex_exit(&ill->ill_lock);
22601 	}
22602 	rw_exit(&ill_g_lock);
22603 	return (best_ipif);
22604 }
22605 
22606 
22607 /*
22608  * Save enough information so that we can recreate the IRE if
22609  * the interface goes down and then up.
22610  */
22611 static void
22612 ipif_save_ire(ipif_t *ipif, ire_t *ire)
22613 {
22614 	mblk_t	*save_mp;
22615 
22616 	save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
22617 	if (save_mp != NULL) {
22618 		ifrt_t	*ifrt;
22619 
22620 		save_mp->b_wptr += sizeof (ifrt_t);
22621 		ifrt = (ifrt_t *)save_mp->b_rptr;
22622 		bzero(ifrt, sizeof (ifrt_t));
22623 		ifrt->ifrt_type = ire->ire_type;
22624 		ifrt->ifrt_addr = ire->ire_addr;
22625 		ifrt->ifrt_gateway_addr = ire->ire_gateway_addr;
22626 		ifrt->ifrt_src_addr = ire->ire_src_addr;
22627 		ifrt->ifrt_mask = ire->ire_mask;
22628 		ifrt->ifrt_flags = ire->ire_flags;
22629 		ifrt->ifrt_max_frag = ire->ire_max_frag;
22630 		mutex_enter(&ipif->ipif_saved_ire_lock);
22631 		save_mp->b_cont = ipif->ipif_saved_ire_mp;
22632 		ipif->ipif_saved_ire_mp = save_mp;
22633 		ipif->ipif_saved_ire_cnt++;
22634 		mutex_exit(&ipif->ipif_saved_ire_lock);
22635 	}
22636 }
22637 
22638 
22639 static void
22640 ipif_remove_ire(ipif_t *ipif, ire_t *ire)
22641 {
22642 	mblk_t	**mpp;
22643 	mblk_t	*mp;
22644 	ifrt_t	*ifrt;
22645 
22646 	/* Remove from ipif_saved_ire_mp list if it is there */
22647 	mutex_enter(&ipif->ipif_saved_ire_lock);
22648 	for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL;
22649 	    mpp = &(*mpp)->b_cont) {
22650 		/*
22651 		 * On a given ipif, the triple of address, gateway and
22652 		 * mask is unique for each saved IRE (in the case of
22653 		 * ordinary interface routes, the gateway address is
22654 		 * all-zeroes).
22655 		 */
22656 		mp = *mpp;
22657 		ifrt = (ifrt_t *)mp->b_rptr;
22658 		if (ifrt->ifrt_addr == ire->ire_addr &&
22659 		    ifrt->ifrt_gateway_addr == ire->ire_gateway_addr &&
22660 		    ifrt->ifrt_mask == ire->ire_mask) {
22661 			*mpp = mp->b_cont;
22662 			ipif->ipif_saved_ire_cnt--;
22663 			freeb(mp);
22664 			break;
22665 		}
22666 	}
22667 	mutex_exit(&ipif->ipif_saved_ire_lock);
22668 }
22669 
22670 
22671 /*
22672  * IP multirouting broadcast routes handling
22673  * Append CGTP broadcast IREs to regular ones created
22674  * at ifconfig time.
22675  */
22676 static void
22677 ip_cgtp_bcast_add(ire_t *ire, ire_t *ire_dst)
22678 {
22679 	ire_t *ire_prim;
22680 
22681 	ASSERT(ire != NULL);
22682 	ASSERT(ire_dst != NULL);
22683 
22684 	ire_prim = ire_ctable_lookup(ire->ire_gateway_addr, 0,
22685 	    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE);
22686 	if (ire_prim != NULL) {
22687 		/*
22688 		 * We are in the special case of broadcasts for
22689 		 * CGTP. We add an IRE_BROADCAST that holds
22690 		 * the RTF_MULTIRT flag, the destination
22691 		 * address of ire_dst and the low level
22692 		 * info of ire_prim. In other words, CGTP
22693 		 * broadcast is added to the redundant ipif.
22694 		 */
22695 		ipif_t *ipif_prim;
22696 		ire_t  *bcast_ire;
22697 
22698 		ipif_prim = ire_prim->ire_ipif;
22699 
22700 		ip2dbg(("ip_cgtp_filter_bcast_add: "
22701 		    "ire_dst %p, ire_prim %p, ipif_prim %p\n",
22702 		    (void *)ire_dst, (void *)ire_prim,
22703 		    (void *)ipif_prim));
22704 
22705 		bcast_ire = ire_create(
22706 		    (uchar_t *)&ire->ire_addr,
22707 		    (uchar_t *)&ip_g_all_ones,
22708 		    (uchar_t *)&ire_dst->ire_src_addr,
22709 		    (uchar_t *)&ire->ire_gateway_addr,
22710 		    NULL,
22711 		    &ipif_prim->ipif_mtu,
22712 		    NULL,
22713 		    ipif_prim->ipif_rq,
22714 		    ipif_prim->ipif_wq,
22715 		    IRE_BROADCAST,
22716 		    ipif_prim->ipif_bcast_mp,
22717 		    ipif_prim,
22718 		    NULL,
22719 		    0,
22720 		    0,
22721 		    0,
22722 		    ire->ire_flags,
22723 		    &ire_uinfo_null,
22724 		    NULL,
22725 		    NULL);
22726 
22727 		if (bcast_ire != NULL) {
22728 
22729 			if (ire_add(&bcast_ire, NULL, NULL, NULL,
22730 			    B_FALSE) == 0) {
22731 				ip2dbg(("ip_cgtp_filter_bcast_add: "
22732 				    "added bcast_ire %p\n",
22733 				    (void *)bcast_ire));
22734 
22735 				ipif_save_ire(bcast_ire->ire_ipif,
22736 				    bcast_ire);
22737 				ire_refrele(bcast_ire);
22738 			}
22739 		}
22740 		ire_refrele(ire_prim);
22741 	}
22742 }
22743 
22744 
22745 /*
22746  * IP multirouting broadcast routes handling
22747  * Remove the broadcast ire
22748  */
22749 static void
22750 ip_cgtp_bcast_delete(ire_t *ire)
22751 {
22752 	ire_t *ire_dst;
22753 
22754 	ASSERT(ire != NULL);
22755 	ire_dst = ire_ctable_lookup(ire->ire_addr, 0, IRE_BROADCAST,
22756 	    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE);
22757 	if (ire_dst != NULL) {
22758 		ire_t *ire_prim;
22759 
22760 		ire_prim = ire_ctable_lookup(ire->ire_gateway_addr, 0,
22761 		    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE);
22762 		if (ire_prim != NULL) {
22763 			ipif_t *ipif_prim;
22764 			ire_t  *bcast_ire;
22765 
22766 			ipif_prim = ire_prim->ire_ipif;
22767 
22768 			ip2dbg(("ip_cgtp_filter_bcast_delete: "
22769 			    "ire_dst %p, ire_prim %p, ipif_prim %p\n",
22770 			    (void *)ire_dst, (void *)ire_prim,
22771 			    (void *)ipif_prim));
22772 
22773 			bcast_ire = ire_ctable_lookup(ire->ire_addr,
22774 			    ire->ire_gateway_addr,
22775 			    IRE_BROADCAST,
22776 			    ipif_prim, ALL_ZONES,
22777 			    NULL,
22778 			    MATCH_IRE_TYPE | MATCH_IRE_GW | MATCH_IRE_IPIF |
22779 			    MATCH_IRE_MASK);
22780 
22781 			if (bcast_ire != NULL) {
22782 				ip2dbg(("ip_cgtp_filter_bcast_delete: "
22783 				    "looked up bcast_ire %p\n",
22784 				    (void *)bcast_ire));
22785 				ipif_remove_ire(bcast_ire->ire_ipif,
22786 					bcast_ire);
22787 				ire_delete(bcast_ire);
22788 			}
22789 			ire_refrele(ire_prim);
22790 		}
22791 		ire_refrele(ire_dst);
22792 	}
22793 }
22794 
22795 /*
22796  * IPsec hardware acceleration capabilities related functions.
22797  */
22798 
22799 /*
22800  * Free a per-ill IPsec capabilities structure.
22801  */
22802 static void
22803 ill_ipsec_capab_free(ill_ipsec_capab_t *capab)
22804 {
22805 	if (capab->auth_hw_algs != NULL)
22806 		kmem_free(capab->auth_hw_algs, capab->algs_size);
22807 	if (capab->encr_hw_algs != NULL)
22808 		kmem_free(capab->encr_hw_algs, capab->algs_size);
22809 	if (capab->encr_algparm != NULL)
22810 		kmem_free(capab->encr_algparm, capab->encr_algparm_size);
22811 	kmem_free(capab, sizeof (ill_ipsec_capab_t));
22812 }
22813 
22814 /*
22815  * Allocate a new per-ill IPsec capabilities structure. This structure
22816  * is specific to an IPsec protocol (AH or ESP). It is implemented as
22817  * an array which specifies, for each algorithm, whether this algorithm
22818  * is supported by the ill or not.
22819  */
22820 static ill_ipsec_capab_t *
22821 ill_ipsec_capab_alloc(void)
22822 {
22823 	ill_ipsec_capab_t *capab;
22824 	uint_t nelems;
22825 
22826 	capab = kmem_zalloc(sizeof (ill_ipsec_capab_t), KM_NOSLEEP);
22827 	if (capab == NULL)
22828 		return (NULL);
22829 
22830 	/* we need one bit per algorithm */
22831 	nelems = MAX_IPSEC_ALGS / BITS(ipsec_capab_elem_t);
22832 	capab->algs_size = nelems * sizeof (ipsec_capab_elem_t);
22833 
22834 	/* allocate memory to store algorithm flags */
22835 	capab->encr_hw_algs = kmem_zalloc(capab->algs_size, KM_NOSLEEP);
22836 	if (capab->encr_hw_algs == NULL)
22837 		goto nomem;
22838 	capab->auth_hw_algs = kmem_zalloc(capab->algs_size, KM_NOSLEEP);
22839 	if (capab->auth_hw_algs == NULL)
22840 		goto nomem;
22841 	/*
22842 	 * Leave encr_algparm NULL for now since we won't need it half
22843 	 * the time
22844 	 */
22845 	return (capab);
22846 
22847 nomem:
22848 	ill_ipsec_capab_free(capab);
22849 	return (NULL);
22850 }
22851 
22852 /*
22853  * Resize capability array.  Since we're exclusive, this is OK.
22854  */
22855 static boolean_t
22856 ill_ipsec_capab_resize_algparm(ill_ipsec_capab_t *capab, int algid)
22857 {
22858 	ipsec_capab_algparm_t *nalp, *oalp;
22859 	uint32_t olen, nlen;
22860 
22861 	oalp = capab->encr_algparm;
22862 	olen = capab->encr_algparm_size;
22863 
22864 	if (oalp != NULL) {
22865 		if (algid < capab->encr_algparm_end)
22866 			return (B_TRUE);
22867 	}
22868 
22869 	nlen = (algid + 1) * sizeof (*nalp);
22870 	nalp = kmem_zalloc(nlen, KM_NOSLEEP);
22871 	if (nalp == NULL)
22872 		return (B_FALSE);
22873 
22874 	if (oalp != NULL) {
22875 		bcopy(oalp, nalp, olen);
22876 		kmem_free(oalp, olen);
22877 	}
22878 	capab->encr_algparm = nalp;
22879 	capab->encr_algparm_size = nlen;
22880 	capab->encr_algparm_end = algid + 1;
22881 
22882 	return (B_TRUE);
22883 }
22884 
22885 /*
22886  * Compare the capabilities of the specified ill with the protocol
22887  * and algorithms specified by the SA passed as argument.
22888  * If they match, returns B_TRUE, B_FALSE if they do not match.
22889  *
22890  * The ill can be passed as a pointer to it, or by specifying its index
22891  * and whether it is an IPv6 ill (ill_index and ill_isv6 arguments).
22892  *
22893  * Called by ipsec_out_is_accelerated() do decide whether an outbound
22894  * packet is eligible for hardware acceleration, and by
22895  * ill_ipsec_capab_send_all() to decide whether a SA must be sent down
22896  * to a particular ill.
22897  */
22898 boolean_t
22899 ipsec_capab_match(ill_t *ill, uint_t ill_index, boolean_t ill_isv6,
22900     ipsa_t *sa)
22901 {
22902 	boolean_t sa_isv6;
22903 	uint_t algid;
22904 	struct ill_ipsec_capab_s *cpp;
22905 	boolean_t need_refrele = B_FALSE;
22906 
22907 	if (ill == NULL) {
22908 		ill = ill_lookup_on_ifindex(ill_index, ill_isv6, NULL,
22909 		    NULL, NULL, NULL);
22910 		if (ill == NULL) {
22911 			ip0dbg(("ipsec_capab_match: ill doesn't exist\n"));
22912 			return (B_FALSE);
22913 		}
22914 		need_refrele = B_TRUE;
22915 	}
22916 
22917 	/*
22918 	 * Use the address length specified by the SA to determine
22919 	 * if it corresponds to a IPv6 address, and fail the matching
22920 	 * if the isv6 flag passed as argument does not match.
22921 	 * Note: this check is used for SADB capability checking before
22922 	 * sending SA information to an ill.
22923 	 */
22924 	sa_isv6 = (sa->ipsa_addrfam == AF_INET6);
22925 	if (sa_isv6 != ill_isv6)
22926 		/* protocol mismatch */
22927 		goto done;
22928 
22929 	/*
22930 	 * Check if the ill supports the protocol, algorithm(s) and
22931 	 * key size(s) specified by the SA, and get the pointers to
22932 	 * the algorithms supported by the ill.
22933 	 */
22934 	switch (sa->ipsa_type) {
22935 
22936 	case SADB_SATYPE_ESP:
22937 		if (!(ill->ill_capabilities & ILL_CAPAB_ESP))
22938 			/* ill does not support ESP acceleration */
22939 			goto done;
22940 		cpp = ill->ill_ipsec_capab_esp;
22941 		algid = sa->ipsa_auth_alg;
22942 		if (!IPSEC_ALG_IS_ENABLED(algid, cpp->auth_hw_algs))
22943 			goto done;
22944 		algid = sa->ipsa_encr_alg;
22945 		if (!IPSEC_ALG_IS_ENABLED(algid, cpp->encr_hw_algs))
22946 			goto done;
22947 		if (algid < cpp->encr_algparm_end) {
22948 			ipsec_capab_algparm_t *alp = &cpp->encr_algparm[algid];
22949 			if (sa->ipsa_encrkeybits < alp->minkeylen)
22950 				goto done;
22951 			if (sa->ipsa_encrkeybits > alp->maxkeylen)
22952 				goto done;
22953 		}
22954 		break;
22955 
22956 	case SADB_SATYPE_AH:
22957 		if (!(ill->ill_capabilities & ILL_CAPAB_AH))
22958 			/* ill does not support AH acceleration */
22959 			goto done;
22960 		if (!IPSEC_ALG_IS_ENABLED(sa->ipsa_auth_alg,
22961 		    ill->ill_ipsec_capab_ah->auth_hw_algs))
22962 			goto done;
22963 		break;
22964 	}
22965 
22966 	if (need_refrele)
22967 		ill_refrele(ill);
22968 	return (B_TRUE);
22969 done:
22970 	if (need_refrele)
22971 		ill_refrele(ill);
22972 	return (B_FALSE);
22973 }
22974 
22975 
22976 /*
22977  * Add a new ill to the list of IPsec capable ills.
22978  * Called from ill_capability_ipsec_ack() when an ACK was received
22979  * indicating that IPsec hardware processing was enabled for an ill.
22980  *
22981  * ill must point to the ill for which acceleration was enabled.
22982  * dl_cap must be set to DL_CAPAB_IPSEC_AH or DL_CAPAB_IPSEC_ESP.
22983  */
22984 static void
22985 ill_ipsec_capab_add(ill_t *ill, uint_t dl_cap, boolean_t sadb_resync)
22986 {
22987 	ipsec_capab_ill_t **ills, *cur_ill, *new_ill;
22988 	uint_t sa_type;
22989 	uint_t ipproto;
22990 
22991 	ASSERT((dl_cap == DL_CAPAB_IPSEC_AH) ||
22992 	    (dl_cap == DL_CAPAB_IPSEC_ESP));
22993 
22994 	switch (dl_cap) {
22995 	case DL_CAPAB_IPSEC_AH:
22996 		sa_type = SADB_SATYPE_AH;
22997 		ills = &ipsec_capab_ills_ah;
22998 		ipproto = IPPROTO_AH;
22999 		break;
23000 	case DL_CAPAB_IPSEC_ESP:
23001 		sa_type = SADB_SATYPE_ESP;
23002 		ills = &ipsec_capab_ills_esp;
23003 		ipproto = IPPROTO_ESP;
23004 		break;
23005 	}
23006 
23007 	rw_enter(&ipsec_capab_ills_lock, RW_WRITER);
23008 
23009 	/*
23010 	 * Add ill index to list of hardware accelerators. If
23011 	 * already in list, do nothing.
23012 	 */
23013 	for (cur_ill = *ills; cur_ill != NULL &&
23014 	    (cur_ill->ill_index != ill->ill_phyint->phyint_ifindex ||
23015 	    cur_ill->ill_isv6 != ill->ill_isv6); cur_ill = cur_ill->next)
23016 		;
23017 
23018 	if (cur_ill == NULL) {
23019 		/* if this is a new entry for this ill */
23020 		new_ill = kmem_zalloc(sizeof (ipsec_capab_ill_t), KM_NOSLEEP);
23021 		if (new_ill == NULL) {
23022 			rw_exit(&ipsec_capab_ills_lock);
23023 			return;
23024 		}
23025 
23026 		new_ill->ill_index = ill->ill_phyint->phyint_ifindex;
23027 		new_ill->ill_isv6 = ill->ill_isv6;
23028 		new_ill->next = *ills;
23029 		*ills = new_ill;
23030 	} else if (!sadb_resync) {
23031 		/* not resync'ing SADB and an entry exists for this ill */
23032 		rw_exit(&ipsec_capab_ills_lock);
23033 		return;
23034 	}
23035 
23036 	rw_exit(&ipsec_capab_ills_lock);
23037 
23038 	if (ipcl_proto_fanout_v6[ipproto].connf_head != NULL)
23039 		/*
23040 		 * IPsec module for protocol loaded, initiate dump
23041 		 * of the SADB to this ill.
23042 		 */
23043 		sadb_ill_download(ill, sa_type);
23044 }
23045 
23046 /*
23047  * Remove an ill from the list of IPsec capable ills.
23048  */
23049 static void
23050 ill_ipsec_capab_delete(ill_t *ill, uint_t dl_cap)
23051 {
23052 	ipsec_capab_ill_t **ills, *cur_ill, *prev_ill;
23053 
23054 	ASSERT(dl_cap == DL_CAPAB_IPSEC_AH ||
23055 	    dl_cap == DL_CAPAB_IPSEC_ESP);
23056 
23057 	ills = (dl_cap == DL_CAPAB_IPSEC_AH) ? &ipsec_capab_ills_ah :
23058 	    &ipsec_capab_ills_esp;
23059 
23060 	rw_enter(&ipsec_capab_ills_lock, RW_WRITER);
23061 
23062 	prev_ill = NULL;
23063 	for (cur_ill = *ills; cur_ill != NULL && (cur_ill->ill_index !=
23064 	    ill->ill_phyint->phyint_ifindex || cur_ill->ill_isv6 !=
23065 	    ill->ill_isv6); prev_ill = cur_ill, cur_ill = cur_ill->next)
23066 		;
23067 	if (cur_ill == NULL) {
23068 		/* entry not found */
23069 		rw_exit(&ipsec_capab_ills_lock);
23070 		return;
23071 	}
23072 	if (prev_ill == NULL) {
23073 		/* entry at front of list */
23074 		*ills = NULL;
23075 	} else {
23076 		prev_ill->next = cur_ill->next;
23077 	}
23078 	kmem_free(cur_ill, sizeof (ipsec_capab_ill_t));
23079 	rw_exit(&ipsec_capab_ills_lock);
23080 }
23081 
23082 
23083 /*
23084  * Handling of DL_CONTROL_REQ messages that must be sent down to
23085  * an ill while having exclusive access.
23086  */
23087 /* ARGSUSED */
23088 static void
23089 ill_ipsec_capab_send_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
23090 {
23091 	ill_t *ill = (ill_t *)q->q_ptr;
23092 
23093 	ill_dlpi_send(ill, mp);
23094 }
23095 
23096 
23097 /*
23098  * Called by SADB to send a DL_CONTROL_REQ message to every ill
23099  * supporting the specified IPsec protocol acceleration.
23100  * sa_type must be SADB_SATYPE_AH or SADB_SATYPE_ESP.
23101  * We free the mblk and, if sa is non-null, release the held referece.
23102  */
23103 void
23104 ill_ipsec_capab_send_all(uint_t sa_type, mblk_t *mp, ipsa_t *sa)
23105 {
23106 	ipsec_capab_ill_t *ici, *cur_ici;
23107 	ill_t *ill;
23108 	mblk_t *nmp, *mp_ship_list = NULL, *next_mp;
23109 
23110 	ici = (sa_type == SADB_SATYPE_AH) ? ipsec_capab_ills_ah :
23111 	    ipsec_capab_ills_esp;
23112 
23113 	rw_enter(&ipsec_capab_ills_lock, RW_READER);
23114 
23115 	for (cur_ici = ici; cur_ici != NULL; cur_ici = cur_ici->next) {
23116 		ill = ill_lookup_on_ifindex(cur_ici->ill_index,
23117 		    cur_ici->ill_isv6, NULL, NULL, NULL, NULL);
23118 
23119 		/*
23120 		 * Handle the case where the ill goes away while the SADB is
23121 		 * attempting to send messages.  If it's going away, it's
23122 		 * nuking its shadow SADB, so we don't care..
23123 		 */
23124 
23125 		if (ill == NULL)
23126 			continue;
23127 
23128 		if (sa != NULL) {
23129 			/*
23130 			 * Make sure capabilities match before
23131 			 * sending SA to ill.
23132 			 */
23133 			if (!ipsec_capab_match(ill, cur_ici->ill_index,
23134 			    cur_ici->ill_isv6, sa)) {
23135 				ill_refrele(ill);
23136 				continue;
23137 			}
23138 
23139 			mutex_enter(&sa->ipsa_lock);
23140 			sa->ipsa_flags |= IPSA_F_HW;
23141 			mutex_exit(&sa->ipsa_lock);
23142 		}
23143 
23144 		/*
23145 		 * Copy template message, and add it to the front
23146 		 * of the mblk ship list. We want to avoid holding
23147 		 * the ipsec_capab_ills_lock while sending the
23148 		 * message to the ills.
23149 		 *
23150 		 * The b_next and b_prev are temporarily used
23151 		 * to build a list of mblks to be sent down, and to
23152 		 * save the ill to which they must be sent.
23153 		 */
23154 		nmp = copymsg(mp);
23155 		if (nmp == NULL) {
23156 			ill_refrele(ill);
23157 			continue;
23158 		}
23159 		ASSERT(nmp->b_next == NULL && nmp->b_prev == NULL);
23160 		nmp->b_next = mp_ship_list;
23161 		mp_ship_list = nmp;
23162 		nmp->b_prev = (mblk_t *)ill;
23163 	}
23164 
23165 	rw_exit(&ipsec_capab_ills_lock);
23166 
23167 	nmp = mp_ship_list;
23168 	while (nmp != NULL) {
23169 		/* restore the mblk to a sane state */
23170 		next_mp = nmp->b_next;
23171 		nmp->b_next = NULL;
23172 		ill = (ill_t *)nmp->b_prev;
23173 		nmp->b_prev = NULL;
23174 
23175 		/*
23176 		 * Ship the mblk to the ill, must be exclusive. Keep the
23177 		 * reference to the ill as qwriter_ip() does a ill_referele().
23178 		 */
23179 		(void) qwriter_ip(NULL, ill, ill->ill_wq, nmp,
23180 		    ill_ipsec_capab_send_writer, NEW_OP, B_TRUE);
23181 
23182 		nmp = next_mp;
23183 	}
23184 
23185 	if (sa != NULL)
23186 		IPSA_REFRELE(sa);
23187 	freemsg(mp);
23188 }
23189 
23190 
23191 /*
23192  * Derive an interface id from the link layer address.
23193  * Knows about IEEE 802 and IEEE EUI-64 mappings.
23194  */
23195 static boolean_t
23196 ip_ether_v6intfid(uint_t phys_length, uint8_t *phys_addr, in6_addr_t *v6addr)
23197 {
23198 	char		*addr;
23199 
23200 	if (phys_length != ETHERADDRL)
23201 		return (B_FALSE);
23202 
23203 	/* Form EUI-64 like address */
23204 	addr = (char *)&v6addr->s6_addr32[2];
23205 	bcopy((char *)phys_addr, addr, 3);
23206 	addr[0] ^= 0x2;		/* Toggle Universal/Local bit */
23207 	addr[3] = (char)0xff;
23208 	addr[4] = (char)0xfe;
23209 	bcopy((char *)phys_addr + 3, addr + 5, 3);
23210 	return (B_TRUE);
23211 }
23212 
23213 /* ARGSUSED */
23214 static boolean_t
23215 ip_nodef_v6intfid(uint_t phys_length, uint8_t *phys_addr, in6_addr_t *v6addr)
23216 {
23217 	return (B_FALSE);
23218 }
23219 
23220 /* ARGSUSED */
23221 static boolean_t
23222 ip_ether_v6mapinfo(uint_t lla_length, uint8_t *bphys_addr, uint8_t *maddr,
23223     uint32_t *hw_start, in6_addr_t *v6_extract_mask)
23224 {
23225 	/*
23226 	 * Multicast address mappings used over Ethernet/802.X.
23227 	 * This address is used as a base for mappings.
23228 	 */
23229 	static uint8_t ipv6_g_phys_multi_addr[] = {0x33, 0x33, 0x00,
23230 	    0x00, 0x00, 0x00};
23231 
23232 	/*
23233 	 * Extract low order 32 bits from IPv6 multicast address.
23234 	 * Or that into the link layer address, starting from the
23235 	 * second byte.
23236 	 */
23237 	*hw_start = 2;
23238 	v6_extract_mask->s6_addr32[0] = 0;
23239 	v6_extract_mask->s6_addr32[1] = 0;
23240 	v6_extract_mask->s6_addr32[2] = 0;
23241 	v6_extract_mask->s6_addr32[3] = 0xffffffffU;
23242 	bcopy(ipv6_g_phys_multi_addr, maddr, lla_length);
23243 	return (B_TRUE);
23244 }
23245 
23246 /*
23247  * Indicate by return value whether multicast is supported. If not,
23248  * this code should not touch/change any parameters.
23249  */
23250 /* ARGSUSED */
23251 static boolean_t
23252 ip_ether_v4mapinfo(uint_t phys_length, uint8_t *bphys_addr, uint8_t *maddr,
23253     uint32_t *hw_start, ipaddr_t *extract_mask)
23254 {
23255 	/*
23256 	 * Multicast address mappings used over Ethernet/802.X.
23257 	 * This address is used as a base for mappings.
23258 	 */
23259 	static uint8_t ip_g_phys_multi_addr[] = { 0x01, 0x00, 0x5e,
23260 	    0x00, 0x00, 0x00 };
23261 
23262 	if (phys_length != ETHERADDRL)
23263 		return (B_FALSE);
23264 
23265 	*extract_mask = htonl(0x007fffff);
23266 	*hw_start = 2;
23267 	bcopy(ip_g_phys_multi_addr, maddr, ETHERADDRL);
23268 	return (B_TRUE);
23269 }
23270 
23271 /*
23272  * Derive IPoIB interface id from the link layer address.
23273  */
23274 static boolean_t
23275 ip_ib_v6intfid(uint_t phys_length, uint8_t *phys_addr, in6_addr_t *v6addr)
23276 {
23277 	char		*addr;
23278 
23279 	if (phys_length != 20)
23280 		return (B_FALSE);
23281 	addr = (char *)&v6addr->s6_addr32[2];
23282 	bcopy(phys_addr + 12, addr, 8);
23283 	/*
23284 	 * In IBA 1.1 timeframe, some vendors erroneously set the u/l bit
23285 	 * in the globally assigned EUI-64 GUID to 1, in violation of IEEE
23286 	 * rules. In these cases, the IBA considers these GUIDs to be in
23287 	 * "Modified EUI-64" format, and thus toggling the u/l bit is not
23288 	 * required; vendors are required not to assign global EUI-64's
23289 	 * that differ only in u/l bit values, thus guaranteeing uniqueness
23290 	 * of the interface identifier. Whether the GUID is in modified
23291 	 * or proper EUI-64 format, the ipv6 identifier must have the u/l
23292 	 * bit set to 1.
23293 	 */
23294 	addr[0] |= 2;			/* Set Universal/Local bit to 1 */
23295 	return (B_TRUE);
23296 }
23297 
23298 /*
23299  * Note on mapping from multicast IP addresses to IPoIB multicast link
23300  * addresses. IPoIB multicast link addresses are based on IBA link addresses.
23301  * The format of an IPoIB multicast address is:
23302  *
23303  *  4 byte QPN      Scope Sign.  Pkey
23304  * +--------------------------------------------+
23305  * | 00FFFFFF | FF | 1X | X01B | Pkey | GroupID |
23306  * +--------------------------------------------+
23307  *
23308  * The Scope and Pkey components are properties of the IBA port and
23309  * network interface. They can be ascertained from the broadcast address.
23310  * The Sign. part is the signature, and is 401B for IPv4 and 601B for IPv6.
23311  */
23312 
23313 static boolean_t
23314 ip_ib_v6mapinfo(uint_t lla_length, uint8_t *bphys_addr, uint8_t *maddr,
23315     uint32_t *hw_start, in6_addr_t *v6_extract_mask)
23316 {
23317 	/*
23318 	 * Base IPoIB IPv6 multicast address used for mappings.
23319 	 * Does not contain the IBA scope/Pkey values.
23320 	 */
23321 	static uint8_t ipv6_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
23322 	    0xff, 0x10, 0x60, 0x1b, 0x00, 0x00, 0x00, 0x00,
23323 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
23324 
23325 	/*
23326 	 * Extract low order 80 bits from IPv6 multicast address.
23327 	 * Or that into the link layer address, starting from the
23328 	 * sixth byte.
23329 	 */
23330 	*hw_start = 6;
23331 	bcopy(ipv6_g_phys_ibmulti_addr, maddr, lla_length);
23332 
23333 	/*
23334 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
23335 	 */
23336 	*(maddr + 5) = *(bphys_addr + 5);
23337 	*(maddr + 8) = *(bphys_addr + 8);
23338 	*(maddr + 9) = *(bphys_addr + 9);
23339 
23340 	v6_extract_mask->s6_addr32[0] = 0;
23341 	v6_extract_mask->s6_addr32[1] = htonl(0x0000ffff);
23342 	v6_extract_mask->s6_addr32[2] = 0xffffffffU;
23343 	v6_extract_mask->s6_addr32[3] = 0xffffffffU;
23344 	return (B_TRUE);
23345 }
23346 
23347 static boolean_t
23348 ip_ib_v4mapinfo(uint_t phys_length, uint8_t *bphys_addr, uint8_t *maddr,
23349     uint32_t *hw_start, ipaddr_t *extract_mask)
23350 {
23351 	/*
23352 	 * Base IPoIB IPv4 multicast address used for mappings.
23353 	 * Does not contain the IBA scope/Pkey values.
23354 	 */
23355 	static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
23356 	    0xff, 0x10, 0x40, 0x1b, 0x00, 0x00, 0x00, 0x00,
23357 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
23358 
23359 	if (phys_length != sizeof (ipv4_g_phys_ibmulti_addr))
23360 		return (B_FALSE);
23361 
23362 	/*
23363 	 * Extract low order 28 bits from IPv4 multicast address.
23364 	 * Or that into the link layer address, starting from the
23365 	 * sixteenth byte.
23366 	 */
23367 	*extract_mask = htonl(0x0fffffff);
23368 	*hw_start = 16;
23369 	bcopy(ipv4_g_phys_ibmulti_addr, maddr, phys_length);
23370 
23371 	/*
23372 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
23373 	 */
23374 	*(maddr + 5) = *(bphys_addr + 5);
23375 	*(maddr + 8) = *(bphys_addr + 8);
23376 	*(maddr + 9) = *(bphys_addr + 9);
23377 	return (B_TRUE);
23378 }
23379 
23380 /*
23381  * Returns B_TRUE if an ipif is present in the given zone, matching some flags
23382  * (typically IPIF_UP). If ipifp is non-null, the held ipif is returned there.
23383  * This works for both IPv4 and IPv6; if the passed-in ill is v6, the ipif with
23384  * the link-local address is preferred.
23385  */
23386 boolean_t
23387 ipif_lookup_zoneid(ill_t *ill, zoneid_t zoneid, int flags, ipif_t **ipifp)
23388 {
23389 	ipif_t	*ipif;
23390 	ipif_t	*maybe_ipif = NULL;
23391 
23392 	mutex_enter(&ill->ill_lock);
23393 	if (ill->ill_state_flags & ILL_CONDEMNED) {
23394 		mutex_exit(&ill->ill_lock);
23395 		if (ipifp != NULL)
23396 			*ipifp = NULL;
23397 		return (B_FALSE);
23398 	}
23399 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
23400 		if (!IPIF_CAN_LOOKUP(ipif))
23401 			continue;
23402 		if (zoneid != ALL_ZONES && ipif->ipif_zoneid != zoneid &&
23403 		    ipif->ipif_zoneid != ALL_ZONES)
23404 			continue;
23405 		if ((ipif->ipif_flags & flags) != flags)
23406 			continue;
23407 
23408 		if (ipifp == NULL) {
23409 			mutex_exit(&ill->ill_lock);
23410 			ASSERT(maybe_ipif == NULL);
23411 			return (B_TRUE);
23412 		}
23413 		if (!ill->ill_isv6 ||
23414 		    IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6src_addr)) {
23415 			ipif_refhold_locked(ipif);
23416 			mutex_exit(&ill->ill_lock);
23417 			*ipifp = ipif;
23418 			return (B_TRUE);
23419 		}
23420 		if (maybe_ipif == NULL)
23421 			maybe_ipif = ipif;
23422 	}
23423 	if (ipifp != NULL) {
23424 		if (maybe_ipif != NULL)
23425 			ipif_refhold_locked(maybe_ipif);
23426 		*ipifp = maybe_ipif;
23427 	}
23428 	mutex_exit(&ill->ill_lock);
23429 	return (maybe_ipif != NULL);
23430 }
23431 
23432 /*
23433  * Same as ipif_lookup_zoneid() but looks at all the ills in the same group.
23434  */
23435 boolean_t
23436 ipif_lookup_zoneid_group(ill_t *ill, zoneid_t zoneid, int flags, ipif_t **ipifp)
23437 {
23438 	ill_t *illg;
23439 
23440 	/*
23441 	 * We look at the passed-in ill first without grabbing ill_g_lock.
23442 	 */
23443 	if (ipif_lookup_zoneid(ill, zoneid, flags, ipifp)) {
23444 		return (B_TRUE);
23445 	}
23446 	rw_enter(&ill_g_lock, RW_READER);
23447 	if (ill->ill_group == NULL) {
23448 		/* ill not in a group */
23449 		rw_exit(&ill_g_lock);
23450 		return (B_FALSE);
23451 	}
23452 
23453 	/*
23454 	 * There's no ipif in the zone on ill, however ill is part of an IPMP
23455 	 * group. We need to look for an ipif in the zone on all the ills in the
23456 	 * group.
23457 	 */
23458 	illg = ill->ill_group->illgrp_ill;
23459 	do {
23460 		/*
23461 		 * We don't call ipif_lookup_zoneid() on ill as we already know
23462 		 * that it's not there.
23463 		 */
23464 		if (illg != ill &&
23465 		    ipif_lookup_zoneid(illg, zoneid, flags, ipifp)) {
23466 			break;
23467 		}
23468 	} while ((illg = illg->ill_group_next) != NULL);
23469 	rw_exit(&ill_g_lock);
23470 	return (illg != NULL);
23471 }
23472 
23473 /*
23474  * Check if this ill is only being used to send ICMP probes for IPMP
23475  */
23476 boolean_t
23477 ill_is_probeonly(ill_t *ill)
23478 {
23479 	/*
23480 	 * Check if the interface is FAILED, or INACTIVE
23481 	 */
23482 	if (ill->ill_phyint->phyint_flags & (PHYI_FAILED|PHYI_INACTIVE))
23483 		return (B_TRUE);
23484 
23485 	return (B_FALSE);
23486 }
23487