xref: /titanic_50/usr/src/uts/common/inet/ip/ip_if.c (revision b657fff74acfeed123d06540dcbf2ebf0f4ebee9)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /* Copyright (c) 1990 Mentat Inc. */
26 
27 /*
28  * This file contains the interface control functions for IP.
29  */
30 
31 #include <sys/types.h>
32 #include <sys/stream.h>
33 #include <sys/dlpi.h>
34 #include <sys/stropts.h>
35 #include <sys/strsun.h>
36 #include <sys/sysmacros.h>
37 #include <sys/strsubr.h>
38 #include <sys/strlog.h>
39 #include <sys/ddi.h>
40 #include <sys/sunddi.h>
41 #include <sys/cmn_err.h>
42 #include <sys/kstat.h>
43 #include <sys/debug.h>
44 #include <sys/zone.h>
45 #include <sys/sunldi.h>
46 #include <sys/file.h>
47 #include <sys/bitmap.h>
48 #include <sys/cpuvar.h>
49 #include <sys/time.h>
50 #include <sys/ctype.h>
51 #include <sys/kmem.h>
52 #include <sys/systm.h>
53 #include <sys/param.h>
54 #include <sys/socket.h>
55 #include <sys/isa_defs.h>
56 #include <net/if.h>
57 #include <net/if_arp.h>
58 #include <net/if_types.h>
59 #include <net/if_dl.h>
60 #include <net/route.h>
61 #include <sys/sockio.h>
62 #include <netinet/in.h>
63 #include <netinet/ip6.h>
64 #include <netinet/icmp6.h>
65 #include <netinet/igmp_var.h>
66 #include <sys/policy.h>
67 #include <sys/ethernet.h>
68 #include <sys/callb.h>
69 #include <sys/md5.h>
70 
71 #include <inet/common.h>   /* for various inet/mi.h and inet/nd.h needs */
72 #include <inet/mi.h>
73 #include <inet/nd.h>
74 #include <inet/arp.h>
75 #include <inet/mib2.h>
76 #include <inet/ip.h>
77 #include <inet/ip6.h>
78 #include <inet/ip6_asp.h>
79 #include <inet/tcp.h>
80 #include <inet/ip_multi.h>
81 #include <inet/ip_ire.h>
82 #include <inet/ip_ftable.h>
83 #include <inet/ip_rts.h>
84 #include <inet/ip_ndp.h>
85 #include <inet/ip_if.h>
86 #include <inet/ip_impl.h>
87 #include <inet/tun.h>
88 #include <inet/sctp_ip.h>
89 #include <inet/ip_netinfo.h>
90 
91 #include <net/pfkeyv2.h>
92 #include <inet/ipsec_info.h>
93 #include <inet/sadb.h>
94 #include <inet/ipsec_impl.h>
95 #include <sys/iphada.h>
96 
97 #include <netinet/igmp.h>
98 #include <inet/ip_listutils.h>
99 #include <inet/ipclassifier.h>
100 #include <sys/mac_client.h>
101 #include <sys/dld.h>
102 
103 #include <sys/systeminfo.h>
104 #include <sys/bootconf.h>
105 
106 #include <sys/tsol/tndb.h>
107 #include <sys/tsol/tnet.h>
108 
109 /* The character which tells where the ill_name ends */
110 #define	IPIF_SEPARATOR_CHAR	':'
111 
112 /* IP ioctl function table entry */
113 typedef struct ipft_s {
114 	int	ipft_cmd;
115 	pfi_t	ipft_pfi;
116 	int	ipft_min_size;
117 	int	ipft_flags;
118 } ipft_t;
119 #define	IPFT_F_NO_REPLY		0x1	/* IP ioctl does not expect any reply */
120 #define	IPFT_F_SELF_REPLY	0x2	/* ioctl callee does the ioctl reply */
121 
122 typedef struct ip_sock_ar_s {
123 	union {
124 		area_t	ip_sock_area;
125 		ared_t	ip_sock_ared;
126 		areq_t	ip_sock_areq;
127 	} ip_sock_ar_u;
128 	queue_t	*ip_sock_ar_q;
129 } ip_sock_ar_t;
130 
131 static int	nd_ill_forward_get(queue_t *, mblk_t *, caddr_t, cred_t *);
132 static int	nd_ill_forward_set(queue_t *q, mblk_t *mp,
133 		    char *value, caddr_t cp, cred_t *ioc_cr);
134 
135 static boolean_t ill_is_quiescent(ill_t *);
136 static boolean_t ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask);
137 static ip_m_t	*ip_m_lookup(t_uscalar_t mac_type);
138 static int	ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
139     mblk_t *mp, boolean_t need_up);
140 static int	ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
141     mblk_t *mp, boolean_t need_up);
142 static int	ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
143     queue_t *q, mblk_t *mp, boolean_t need_up);
144 static int	ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q,
145     mblk_t *mp);
146 static int	ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
147     mblk_t *mp);
148 static int	ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t, in6_addr_t,
149     queue_t *q, mblk_t *mp, boolean_t need_up);
150 static int	ip_sioctl_plink_ipmod(ipsq_t *ipsq, queue_t *q, mblk_t *mp,
151     int ioccmd, struct linkblk *li, boolean_t doconsist);
152 static ipaddr_t	ip_subnet_mask(ipaddr_t addr, ipif_t **, ip_stack_t *);
153 static void	ip_wput_ioctl(queue_t *q, mblk_t *mp);
154 static void	ipsq_flush(ill_t *ill);
155 
156 static	int	ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen,
157     queue_t *q, mblk_t *mp, boolean_t need_up);
158 static void	ipsq_delete(ipsq_t *);
159 
160 static ipif_t	*ipif_allocate(ill_t *ill, int id, uint_t ire_type,
161     boolean_t initialize, boolean_t insert);
162 static void	ipif_check_bcast_ires(ipif_t *test_ipif);
163 static ire_t	**ipif_create_bcast_ires(ipif_t *ipif, ire_t **irep);
164 static boolean_t ipif_comp_multi(ipif_t *old_ipif, ipif_t *new_ipif,
165 		    boolean_t isv6);
166 static void	ipif_down_delete_ire(ire_t *ire, char *ipif);
167 static void	ipif_delete_cache_ire(ire_t *, char *);
168 static int	ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp);
169 static void	ipif_free(ipif_t *ipif);
170 static void	ipif_free_tail(ipif_t *ipif);
171 static void	ipif_mtu_change(ire_t *ire, char *ipif_arg);
172 static void	ipif_recreate_interface_routes(ipif_t *old_ipif, ipif_t *ipif);
173 static void	ipif_set_default(ipif_t *ipif);
174 static int	ipif_set_values(queue_t *q, mblk_t *mp,
175     char *interf_name, uint_t *ppa);
176 static int	ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp,
177     queue_t *q);
178 static ipif_t	*ipif_lookup_on_name(char *name, size_t namelen,
179     boolean_t do_alloc, boolean_t *exists, boolean_t isv6, zoneid_t zoneid,
180     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *);
181 static void	ipif_update_other_ipifs(ipif_t *old_ipif);
182 
183 static int	ill_alloc_ppa(ill_if_t *, ill_t *);
184 static int	ill_arp_off(ill_t *ill);
185 static int	ill_arp_on(ill_t *ill);
186 static void	ill_delete_interface_type(ill_if_t *);
187 static int	ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q);
188 static void	ill_dl_down(ill_t *ill);
189 static void	ill_down(ill_t *ill);
190 static void	ill_downi(ire_t *ire, char *ill_arg);
191 static void	ill_free_mib(ill_t *ill);
192 static void	ill_glist_delete(ill_t *);
193 static void	ill_phyint_reinit(ill_t *ill);
194 static void	ill_set_nce_router_flags(ill_t *, boolean_t);
195 static void	ill_set_phys_addr_tail(ipsq_t *, queue_t *, mblk_t *, void *);
196 static void	ill_replumb_tail(ipsq_t *, queue_t *, mblk_t *, void *);
197 
198 static ip_v6intfid_func_t ip_ether_v6intfid, ip_ib_v6intfid;
199 static ip_v6intfid_func_t ip_ipmp_v6intfid, ip_nodef_v6intfid;
200 static ip_v6mapinfo_func_t ip_ether_v6mapinfo, ip_ib_v6mapinfo;
201 static ip_v4mapinfo_func_t ip_ether_v4mapinfo, ip_ib_v4mapinfo;
202 static void	ipif_save_ire(ipif_t *, ire_t *);
203 static void	ipif_remove_ire(ipif_t *, ire_t *);
204 static void 	ip_cgtp_bcast_add(ire_t *, ire_t *, ip_stack_t *);
205 static void 	ip_cgtp_bcast_delete(ire_t *, ip_stack_t *);
206 static void	phyint_free(phyint_t *);
207 
208 /*
209  * Per-ill IPsec capabilities management.
210  */
211 static ill_ipsec_capab_t *ill_ipsec_capab_alloc(void);
212 static void	ill_ipsec_capab_free(ill_ipsec_capab_t *);
213 static void	ill_ipsec_capab_add(ill_t *, uint_t, boolean_t);
214 static void	ill_ipsec_capab_delete(ill_t *, uint_t);
215 static boolean_t ill_ipsec_capab_resize_algparm(ill_ipsec_capab_t *, int);
216 static void ill_capability_dispatch(ill_t *, mblk_t *, dl_capability_sub_t *,
217     boolean_t);
218 static void ill_capability_id_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
219 static void ill_capability_mdt_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
220 static void ill_capability_mdt_reset_fill(ill_t *, mblk_t *);
221 static void ill_capability_ipsec_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
222 static void ill_capability_ipsec_reset_fill(ill_t *, mblk_t *);
223 static void ill_capability_hcksum_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
224 static void ill_capability_hcksum_reset_fill(ill_t *, mblk_t *);
225 static void ill_capability_zerocopy_ack(ill_t *, mblk_t *,
226     dl_capability_sub_t *);
227 static void ill_capability_zerocopy_reset_fill(ill_t *, mblk_t *);
228 static int  ill_capability_ipsec_reset_size(ill_t *, int *, int *, int *,
229     int *);
230 static void	ill_capability_dld_reset_fill(ill_t *, mblk_t *);
231 static void	ill_capability_dld_ack(ill_t *, mblk_t *,
232 		    dl_capability_sub_t *);
233 static void	ill_capability_dld_enable(ill_t *);
234 static void	ill_capability_ack_thr(void *);
235 static void	ill_capability_lso_enable(ill_t *);
236 static void	ill_capability_send(ill_t *, mblk_t *);
237 
238 static ill_t	*ill_prev_usesrc(ill_t *);
239 static int	ill_relink_usesrc_ills(ill_t *, ill_t *, uint_t);
240 static void	ill_disband_usesrc_group(ill_t *);
241 static void	conn_cleanup_stale_ire(conn_t *, caddr_t);
242 
243 #ifdef DEBUG
244 static  void    ill_trace_cleanup(const ill_t *);
245 static  void    ipif_trace_cleanup(const ipif_t *);
246 #endif
247 
248 /*
249  * if we go over the memory footprint limit more than once in this msec
250  * interval, we'll start pruning aggressively.
251  */
252 int ip_min_frag_prune_time = 0;
253 
254 /*
255  * max # of IPsec algorithms supported.  Limited to 1 byte by PF_KEY
256  * and the IPsec DOI
257  */
258 #define	MAX_IPSEC_ALGS	256
259 
260 #define	BITSPERBYTE	8
261 #define	BITS(type)	(BITSPERBYTE * (long)sizeof (type))
262 
263 #define	IPSEC_ALG_ENABLE(algs, algid) \
264 		((algs)[(algid) / BITS(ipsec_capab_elem_t)] |= \
265 		(1 << ((algid) % BITS(ipsec_capab_elem_t))))
266 
267 #define	IPSEC_ALG_IS_ENABLED(algid, algs) \
268 		((algs)[(algid) / BITS(ipsec_capab_elem_t)] & \
269 		(1 << ((algid) % BITS(ipsec_capab_elem_t))))
270 
271 typedef uint8_t ipsec_capab_elem_t;
272 
273 /*
274  * Per-algorithm parameters.  Note that at present, only encryption
275  * algorithms have variable keysize (IKE does not provide a way to negotiate
276  * auth algorithm keysize).
277  *
278  * All sizes here are in bits.
279  */
280 typedef struct
281 {
282 	uint16_t	minkeylen;
283 	uint16_t	maxkeylen;
284 } ipsec_capab_algparm_t;
285 
286 /*
287  * Per-ill capabilities.
288  */
289 struct ill_ipsec_capab_s {
290 	ipsec_capab_elem_t *encr_hw_algs;
291 	ipsec_capab_elem_t *auth_hw_algs;
292 	uint32_t algs_size;	/* size of _hw_algs in bytes */
293 	/* algorithm key lengths */
294 	ipsec_capab_algparm_t *encr_algparm;
295 	uint32_t encr_algparm_size;
296 	uint32_t encr_algparm_end;
297 };
298 
299 /*
300  * The field values are larger than strictly necessary for simple
301  * AR_ENTRY_ADDs but the padding lets us accomodate the socket ioctls.
302  */
303 static area_t	ip_area_template = {
304 	AR_ENTRY_ADD,			/* area_cmd */
305 	sizeof (ip_sock_ar_t) + (IP_ADDR_LEN*2) + sizeof (struct sockaddr_dl),
306 					/* area_name_offset */
307 	/* area_name_length temporarily holds this structure length */
308 	sizeof (area_t),			/* area_name_length */
309 	IP_ARP_PROTO_TYPE,		/* area_proto */
310 	sizeof (ip_sock_ar_t),		/* area_proto_addr_offset */
311 	IP_ADDR_LEN,			/* area_proto_addr_length */
312 	sizeof (ip_sock_ar_t) + IP_ADDR_LEN,
313 					/* area_proto_mask_offset */
314 	0,				/* area_flags */
315 	sizeof (ip_sock_ar_t) + IP_ADDR_LEN + IP_ADDR_LEN,
316 					/* area_hw_addr_offset */
317 	/* Zero length hw_addr_length means 'use your idea of the address' */
318 	0				/* area_hw_addr_length */
319 };
320 
321 /*
322  * AR_ENTRY_ADD/DELETE templates have been added for IPv6 external resolver
323  * support
324  */
325 static area_t	ip6_area_template = {
326 	AR_ENTRY_ADD,			/* area_cmd */
327 	sizeof (ip_sock_ar_t) + (IPV6_ADDR_LEN*2) + sizeof (sin6_t),
328 					/* area_name_offset */
329 	/* area_name_length temporarily holds this structure length */
330 	sizeof (area_t),			/* area_name_length */
331 	IP_ARP_PROTO_TYPE,		/* area_proto */
332 	sizeof (ip_sock_ar_t),		/* area_proto_addr_offset */
333 	IPV6_ADDR_LEN,			/* area_proto_addr_length */
334 	sizeof (ip_sock_ar_t) + IPV6_ADDR_LEN,
335 					/* area_proto_mask_offset */
336 	0,				/* area_flags */
337 	sizeof (ip_sock_ar_t) + IPV6_ADDR_LEN + IPV6_ADDR_LEN,
338 					/* area_hw_addr_offset */
339 	/* Zero length hw_addr_length means 'use your idea of the address' */
340 	0				/* area_hw_addr_length */
341 };
342 
343 static ared_t	ip_ared_template = {
344 	AR_ENTRY_DELETE,
345 	sizeof (ared_t) + IP_ADDR_LEN,
346 	sizeof (ared_t),
347 	IP_ARP_PROTO_TYPE,
348 	sizeof (ared_t),
349 	IP_ADDR_LEN,
350 	0
351 };
352 
353 static ared_t	ip6_ared_template = {
354 	AR_ENTRY_DELETE,
355 	sizeof (ared_t) + IPV6_ADDR_LEN,
356 	sizeof (ared_t),
357 	IP_ARP_PROTO_TYPE,
358 	sizeof (ared_t),
359 	IPV6_ADDR_LEN,
360 	0
361 };
362 
363 /*
364  * A template for an IPv6 AR_ENTRY_QUERY template has not been created, as
365  * as the areq doesn't include an IP address in ill_dl_up() (the only place a
366  * areq is used).
367  */
368 static areq_t	ip_areq_template = {
369 	AR_ENTRY_QUERY,			/* cmd */
370 	sizeof (areq_t)+(2*IP_ADDR_LEN),	/* name offset */
371 	sizeof (areq_t),	/* name len (filled by ill_arp_alloc) */
372 	IP_ARP_PROTO_TYPE,		/* protocol, from arps perspective */
373 	sizeof (areq_t),			/* target addr offset */
374 	IP_ADDR_LEN,			/* target addr_length */
375 	0,				/* flags */
376 	sizeof (areq_t) + IP_ADDR_LEN,	/* sender addr offset */
377 	IP_ADDR_LEN,			/* sender addr length */
378 	AR_EQ_DEFAULT_XMIT_COUNT,	/* xmit_count */
379 	AR_EQ_DEFAULT_XMIT_INTERVAL,	/* (re)xmit_interval in milliseconds */
380 	AR_EQ_DEFAULT_MAX_BUFFERED	/* max # of requests to buffer */
381 	/* anything else filled in by the code */
382 };
383 
384 static arc_t	ip_aru_template = {
385 	AR_INTERFACE_UP,
386 	sizeof (arc_t),		/* Name offset */
387 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
388 };
389 
390 static arc_t	ip_ard_template = {
391 	AR_INTERFACE_DOWN,
392 	sizeof (arc_t),		/* Name offset */
393 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
394 };
395 
396 static arc_t	ip_aron_template = {
397 	AR_INTERFACE_ON,
398 	sizeof (arc_t),		/* Name offset */
399 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
400 };
401 
402 static arc_t	ip_aroff_template = {
403 	AR_INTERFACE_OFF,
404 	sizeof (arc_t),		/* Name offset */
405 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
406 };
407 
408 static arma_t	ip_arma_multi_template = {
409 	AR_MAPPING_ADD,
410 	sizeof (arma_t) + 3*IP_ADDR_LEN + IP_MAX_HW_LEN,
411 				/* Name offset */
412 	sizeof (arma_t),	/* Name length (set by ill_arp_alloc) */
413 	IP_ARP_PROTO_TYPE,
414 	sizeof (arma_t),			/* proto_addr_offset */
415 	IP_ADDR_LEN,				/* proto_addr_length */
416 	sizeof (arma_t) + IP_ADDR_LEN,		/* proto_mask_offset */
417 	sizeof (arma_t) + 2*IP_ADDR_LEN,	/* proto_extract_mask_offset */
418 	ACE_F_PERMANENT | ACE_F_MAPPING,	/* flags */
419 	sizeof (arma_t) + 3*IP_ADDR_LEN,	/* hw_addr_offset */
420 	IP_MAX_HW_LEN,				/* hw_addr_length */
421 	0,					/* hw_mapping_start */
422 };
423 
424 static ipft_t	ip_ioctl_ftbl[] = {
425 	{ IP_IOC_IRE_DELETE, ip_ire_delete, sizeof (ipid_t), 0 },
426 	{ IP_IOC_IRE_DELETE_NO_REPLY, ip_ire_delete, sizeof (ipid_t),
427 		IPFT_F_NO_REPLY },
428 	{ IP_IOC_IRE_ADVISE_NO_REPLY, ip_ire_advise, sizeof (ipic_t),
429 		IPFT_F_NO_REPLY },
430 	{ IP_IOC_RTS_REQUEST, ip_rts_request, 0, IPFT_F_SELF_REPLY },
431 	{ 0 }
432 };
433 
434 /* Simple ICMP IP Header Template */
435 static ipha_t icmp_ipha = {
436 	IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
437 };
438 
439 /* Flag descriptors for ip_ipif_report */
440 static nv_t	ipif_nv_tbl[] = {
441 	{ IPIF_UP,		"UP" },
442 	{ IPIF_BROADCAST,	"BROADCAST" },
443 	{ ILLF_DEBUG,		"DEBUG" },
444 	{ PHYI_LOOPBACK,	"LOOPBACK" },
445 	{ IPIF_POINTOPOINT,	"POINTOPOINT" },
446 	{ ILLF_NOTRAILERS,	"NOTRAILERS" },
447 	{ PHYI_RUNNING,		"RUNNING" },
448 	{ ILLF_NOARP,		"NOARP" },
449 	{ PHYI_PROMISC,		"PROMISC" },
450 	{ PHYI_ALLMULTI,	"ALLMULTI" },
451 	{ PHYI_INTELLIGENT,	"INTELLIGENT" },
452 	{ ILLF_MULTICAST,	"MULTICAST" },
453 	{ PHYI_MULTI_BCAST,	"MULTI_BCAST" },
454 	{ IPIF_UNNUMBERED,	"UNNUMBERED" },
455 	{ IPIF_DHCPRUNNING,	"DHCP" },
456 	{ IPIF_PRIVATE,		"PRIVATE" },
457 	{ IPIF_NOXMIT,		"NOXMIT" },
458 	{ IPIF_NOLOCAL,		"NOLOCAL" },
459 	{ IPIF_DEPRECATED,	"DEPRECATED" },
460 	{ IPIF_PREFERRED,	"PREFERRED" },
461 	{ IPIF_TEMPORARY,	"TEMPORARY" },
462 	{ IPIF_ADDRCONF,	"ADDRCONF" },
463 	{ PHYI_VIRTUAL,		"VIRTUAL" },
464 	{ ILLF_ROUTER,		"ROUTER" },
465 	{ ILLF_NONUD,		"NONUD" },
466 	{ IPIF_ANYCAST,		"ANYCAST" },
467 	{ ILLF_NORTEXCH,	"NORTEXCH" },
468 	{ ILLF_IPV4,		"IPV4" },
469 	{ ILLF_IPV6,		"IPV6" },
470 	{ IPIF_NOFAILOVER,	"NOFAILOVER" },
471 	{ PHYI_FAILED,		"FAILED" },
472 	{ PHYI_STANDBY,		"STANDBY" },
473 	{ PHYI_INACTIVE,	"INACTIVE" },
474 	{ PHYI_OFFLINE,		"OFFLINE" },
475 	{ PHYI_IPMP,		"IPMP" }
476 };
477 
478 static uchar_t	ip_six_byte_all_ones[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
479 
480 static ip_m_t   ip_m_tbl[] = {
481 	{ DL_ETHER, IFT_ETHER, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
482 	    ip_ether_v6intfid },
483 	{ DL_CSMACD, IFT_ISO88023, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
484 	    ip_nodef_v6intfid },
485 	{ DL_TPB, IFT_ISO88024, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
486 	    ip_nodef_v6intfid },
487 	{ DL_TPR, IFT_ISO88025, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
488 	    ip_nodef_v6intfid },
489 	{ DL_FDDI, IFT_FDDI, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
490 	    ip_ether_v6intfid },
491 	{ DL_IB, IFT_IB, ip_ib_v4mapinfo, ip_ib_v6mapinfo,
492 	    ip_ib_v6intfid },
493 	{ SUNW_DL_VNI, IFT_OTHER, NULL, NULL, NULL },
494 	{ SUNW_DL_IPMP, IFT_OTHER, NULL, NULL, ip_ipmp_v6intfid },
495 	{ DL_OTHER, IFT_OTHER, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
496 	    ip_nodef_v6intfid }
497 };
498 
499 static ill_t	ill_null;		/* Empty ILL for init. */
500 char	ipif_loopback_name[] = "lo0";
501 static char *ipv4_forward_suffix = ":ip_forwarding";
502 static char *ipv6_forward_suffix = ":ip6_forwarding";
503 static	sin6_t	sin6_null;	/* Zero address for quick clears */
504 static	sin_t	sin_null;	/* Zero address for quick clears */
505 
506 /* When set search for unused ipif_seqid */
507 static ipif_t	ipif_zero;
508 
509 /*
510  * ppa arena is created after these many
511  * interfaces have been plumbed.
512  */
513 uint_t	ill_no_arena = 12;	/* Setable in /etc/system */
514 
515 /*
516  * Allocate per-interface mibs.
517  * Returns true if ok. False otherwise.
518  *  ipsq  may not yet be allocated (loopback case ).
519  */
520 static boolean_t
521 ill_allocate_mibs(ill_t *ill)
522 {
523 	/* Already allocated? */
524 	if (ill->ill_ip_mib != NULL) {
525 		if (ill->ill_isv6)
526 			ASSERT(ill->ill_icmp6_mib != NULL);
527 		return (B_TRUE);
528 	}
529 
530 	ill->ill_ip_mib = kmem_zalloc(sizeof (*ill->ill_ip_mib),
531 	    KM_NOSLEEP);
532 	if (ill->ill_ip_mib == NULL) {
533 		return (B_FALSE);
534 	}
535 
536 	/* Setup static information */
537 	SET_MIB(ill->ill_ip_mib->ipIfStatsEntrySize,
538 	    sizeof (mib2_ipIfStatsEntry_t));
539 	if (ill->ill_isv6) {
540 		ill->ill_ip_mib->ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv6;
541 		SET_MIB(ill->ill_ip_mib->ipIfStatsAddrEntrySize,
542 		    sizeof (mib2_ipv6AddrEntry_t));
543 		SET_MIB(ill->ill_ip_mib->ipIfStatsRouteEntrySize,
544 		    sizeof (mib2_ipv6RouteEntry_t));
545 		SET_MIB(ill->ill_ip_mib->ipIfStatsNetToMediaEntrySize,
546 		    sizeof (mib2_ipv6NetToMediaEntry_t));
547 		SET_MIB(ill->ill_ip_mib->ipIfStatsMemberEntrySize,
548 		    sizeof (ipv6_member_t));
549 		SET_MIB(ill->ill_ip_mib->ipIfStatsGroupSourceEntrySize,
550 		    sizeof (ipv6_grpsrc_t));
551 	} else {
552 		ill->ill_ip_mib->ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv4;
553 		SET_MIB(ill->ill_ip_mib->ipIfStatsAddrEntrySize,
554 		    sizeof (mib2_ipAddrEntry_t));
555 		SET_MIB(ill->ill_ip_mib->ipIfStatsRouteEntrySize,
556 		    sizeof (mib2_ipRouteEntry_t));
557 		SET_MIB(ill->ill_ip_mib->ipIfStatsNetToMediaEntrySize,
558 		    sizeof (mib2_ipNetToMediaEntry_t));
559 		SET_MIB(ill->ill_ip_mib->ipIfStatsMemberEntrySize,
560 		    sizeof (ip_member_t));
561 		SET_MIB(ill->ill_ip_mib->ipIfStatsGroupSourceEntrySize,
562 		    sizeof (ip_grpsrc_t));
563 
564 		/*
565 		 * For a v4 ill, we are done at this point, because per ill
566 		 * icmp mibs are only used for v6.
567 		 */
568 		return (B_TRUE);
569 	}
570 
571 	ill->ill_icmp6_mib = kmem_zalloc(sizeof (*ill->ill_icmp6_mib),
572 	    KM_NOSLEEP);
573 	if (ill->ill_icmp6_mib == NULL) {
574 		kmem_free(ill->ill_ip_mib, sizeof (*ill->ill_ip_mib));
575 		ill->ill_ip_mib = NULL;
576 		return (B_FALSE);
577 	}
578 	/* static icmp info */
579 	ill->ill_icmp6_mib->ipv6IfIcmpEntrySize =
580 	    sizeof (mib2_ipv6IfIcmpEntry_t);
581 	/*
582 	 * The ipIfStatsIfindex and ipv6IfIcmpIndex will be assigned later
583 	 * after the phyint merge occurs in ipif_set_values -> ill_glist_insert
584 	 * -> ill_phyint_reinit
585 	 */
586 	return (B_TRUE);
587 }
588 
589 /*
590  * Common code for preparation of ARP commands.  Two points to remember:
591  * 	1) The ill_name is tacked on at the end of the allocated space so
592  *	   the templates name_offset field must contain the total space
593  *	   to allocate less the name length.
594  *
595  *	2) The templates name_length field should contain the *template*
596  *	   length.  We use it as a parameter to bcopy() and then write
597  *	   the real ill_name_length into the name_length field of the copy.
598  * (Always called as writer.)
599  */
600 mblk_t *
601 ill_arp_alloc(ill_t *ill, const uchar_t *template, caddr_t addr)
602 {
603 	arc_t	*arc = (arc_t *)template;
604 	char	*cp;
605 	int	len;
606 	mblk_t	*mp;
607 	uint_t	name_length = ill->ill_name_length;
608 	uint_t	template_len = arc->arc_name_length;
609 
610 	len = arc->arc_name_offset + name_length;
611 	mp = allocb(len, BPRI_HI);
612 	if (mp == NULL)
613 		return (NULL);
614 	cp = (char *)mp->b_rptr;
615 	mp->b_wptr = (uchar_t *)&cp[len];
616 	if (template_len)
617 		bcopy(template, cp, template_len);
618 	if (len > template_len)
619 		bzero(&cp[template_len], len - template_len);
620 	mp->b_datap->db_type = M_PROTO;
621 
622 	arc = (arc_t *)cp;
623 	arc->arc_name_length = name_length;
624 	cp = (char *)arc + arc->arc_name_offset;
625 	bcopy(ill->ill_name, cp, name_length);
626 
627 	if (addr) {
628 		area_t	*area = (area_t *)mp->b_rptr;
629 
630 		cp = (char *)area + area->area_proto_addr_offset;
631 		bcopy(addr, cp, area->area_proto_addr_length);
632 		if (area->area_cmd == AR_ENTRY_ADD) {
633 			cp = (char *)area;
634 			len = area->area_proto_addr_length;
635 			if (area->area_proto_mask_offset)
636 				cp += area->area_proto_mask_offset;
637 			else
638 				cp += area->area_proto_addr_offset + len;
639 			while (len-- > 0)
640 				*cp++ = (char)~0;
641 		}
642 	}
643 	return (mp);
644 }
645 
646 mblk_t *
647 ipif_area_alloc(ipif_t *ipif, uint_t optflags)
648 {
649 	caddr_t	addr;
650 	mblk_t 	*mp;
651 	area_t	*area;
652 	uchar_t	*areap;
653 	ill_t	*ill = ipif->ipif_ill;
654 
655 	if (ill->ill_isv6) {
656 		ASSERT(ill->ill_flags & ILLF_XRESOLV);
657 		addr = (caddr_t)&ipif->ipif_v6lcl_addr;
658 		areap = (uchar_t *)&ip6_area_template;
659 	} else {
660 		addr = (caddr_t)&ipif->ipif_lcl_addr;
661 		areap = (uchar_t *)&ip_area_template;
662 	}
663 
664 	if ((mp = ill_arp_alloc(ill, areap, addr)) == NULL)
665 		return (NULL);
666 
667 	/*
668 	 * IPMP requires that the hardware address be included in all
669 	 * AR_ENTRY_ADD requests so that ARP can deduce the arl to send on.
670 	 * If there are no active underlying ills in the group (and thus no
671 	 * hardware address, DAD will be deferred until an underlying ill
672 	 * becomes active.
673 	 */
674 	if (IS_IPMP(ill)) {
675 		if ((ill = ipmp_ipif_hold_bound_ill(ipif)) == NULL) {
676 			freemsg(mp);
677 			return (NULL);
678 		}
679 	} else {
680 		ill_refhold(ill);
681 	}
682 
683 	area = (area_t *)mp->b_rptr;
684 	area->area_flags = ACE_F_PERMANENT | ACE_F_PUBLISH | ACE_F_MYADDR;
685 	area->area_flags |= optflags;
686 	area->area_hw_addr_length = ill->ill_phys_addr_length;
687 	bcopy(ill->ill_phys_addr, mp->b_rptr + area->area_hw_addr_offset,
688 	    area->area_hw_addr_length);
689 
690 	ill_refrele(ill);
691 	return (mp);
692 }
693 
694 mblk_t *
695 ipif_ared_alloc(ipif_t *ipif)
696 {
697 	caddr_t	addr;
698 	uchar_t	*aredp;
699 
700 	if (ipif->ipif_ill->ill_isv6) {
701 		ASSERT(ipif->ipif_ill->ill_flags & ILLF_XRESOLV);
702 		addr = (caddr_t)&ipif->ipif_v6lcl_addr;
703 		aredp = (uchar_t *)&ip6_ared_template;
704 	} else {
705 		addr = (caddr_t)&ipif->ipif_lcl_addr;
706 		aredp = (uchar_t *)&ip_ared_template;
707 	}
708 
709 	return (ill_arp_alloc(ipif->ipif_ill, aredp, addr));
710 }
711 
712 mblk_t *
713 ill_ared_alloc(ill_t *ill, ipaddr_t addr)
714 {
715 	return (ill_arp_alloc(ill, (uchar_t *)&ip_ared_template,
716 	    (char *)&addr));
717 }
718 
719 mblk_t *
720 ill_arie_alloc(ill_t *ill, const char *grifname, const void *template)
721 {
722 	mblk_t	*mp = ill_arp_alloc(ill, template, 0);
723 	arie_t	*arie;
724 
725 	if (mp != NULL) {
726 		arie = (arie_t *)mp->b_rptr;
727 		(void) strlcpy(arie->arie_grifname, grifname, LIFNAMSIZ);
728 	}
729 	return (mp);
730 }
731 
732 /*
733  * Completely vaporize a lower level tap and all associated interfaces.
734  * ill_delete is called only out of ip_close when the device control
735  * stream is being closed.
736  */
737 void
738 ill_delete(ill_t *ill)
739 {
740 	ipif_t	*ipif;
741 	ill_t	*prev_ill;
742 	ip_stack_t	*ipst = ill->ill_ipst;
743 
744 	/*
745 	 * ill_delete may be forcibly entering the ipsq. The previous
746 	 * ioctl may not have completed and may need to be aborted.
747 	 * ipsq_flush takes care of it. If we don't need to enter the
748 	 * the ipsq forcibly, the 2nd invocation of ipsq_flush in
749 	 * ill_delete_tail is sufficient.
750 	 */
751 	ipsq_flush(ill);
752 
753 	/*
754 	 * Nuke all interfaces.  ipif_free will take down the interface,
755 	 * remove it from the list, and free the data structure.
756 	 * Walk down the ipif list and remove the logical interfaces
757 	 * first before removing the main ipif. We can't unplumb
758 	 * zeroth interface first in the case of IPv6 as reset_conn_ill
759 	 * -> ip_ll_delmulti_v6 de-references ill_ipif for checking
760 	 * POINTOPOINT.
761 	 *
762 	 * If ill_ipif was not properly initialized (i.e low on memory),
763 	 * then no interfaces to clean up. In this case just clean up the
764 	 * ill.
765 	 */
766 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
767 		ipif_free(ipif);
768 
769 	/*
770 	 * Used only by ill_arp_on and ill_arp_off, which are writers.
771 	 * So nobody can be using this mp now. Free the mp allocated for
772 	 * honoring ILLF_NOARP
773 	 */
774 	freemsg(ill->ill_arp_on_mp);
775 	ill->ill_arp_on_mp = NULL;
776 
777 	/* Clean up msgs on pending upcalls for mrouted */
778 	reset_mrt_ill(ill);
779 
780 	/*
781 	 * ipif_free -> reset_conn_ipif will remove all multicast
782 	 * references for IPv4. For IPv6, we need to do it here as
783 	 * it points only at ills.
784 	 */
785 	reset_conn_ill(ill);
786 
787 	/*
788 	 * Remove multicast references added as a result of calls to
789 	 * ip_join_allmulti().
790 	 */
791 	ip_purge_allmulti(ill);
792 
793 	/*
794 	 * If the ill being deleted is under IPMP, boot it out of the illgrp.
795 	 */
796 	if (IS_UNDER_IPMP(ill))
797 		ipmp_ill_leave_illgrp(ill);
798 
799 	/*
800 	 * ill_down will arrange to blow off any IRE's dependent on this
801 	 * ILL, and shut down fragmentation reassembly.
802 	 */
803 	ill_down(ill);
804 
805 	/* Let SCTP know, so that it can remove this from its list. */
806 	sctp_update_ill(ill, SCTP_ILL_REMOVE);
807 
808 	/*
809 	 * If an address on this ILL is being used as a source address then
810 	 * clear out the pointers in other ILLs that point to this ILL.
811 	 */
812 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
813 	if (ill->ill_usesrc_grp_next != NULL) {
814 		if (ill->ill_usesrc_ifindex == 0) { /* usesrc ILL ? */
815 			ill_disband_usesrc_group(ill);
816 		} else {	/* consumer of the usesrc ILL */
817 			prev_ill = ill_prev_usesrc(ill);
818 			prev_ill->ill_usesrc_grp_next =
819 			    ill->ill_usesrc_grp_next;
820 		}
821 	}
822 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
823 }
824 
825 static void
826 ipif_non_duplicate(ipif_t *ipif)
827 {
828 	ill_t *ill = ipif->ipif_ill;
829 	mutex_enter(&ill->ill_lock);
830 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
831 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
832 		ASSERT(ill->ill_ipif_dup_count > 0);
833 		ill->ill_ipif_dup_count--;
834 	}
835 	mutex_exit(&ill->ill_lock);
836 }
837 
838 /*
839  * ill_delete_tail is called from ip_modclose after all references
840  * to the closing ill are gone. The wait is done in ip_modclose
841  */
842 void
843 ill_delete_tail(ill_t *ill)
844 {
845 	mblk_t	**mpp;
846 	ipif_t	*ipif;
847 	ip_stack_t	*ipst = ill->ill_ipst;
848 
849 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
850 		ipif_non_duplicate(ipif);
851 		ipif_down_tail(ipif);
852 	}
853 
854 	ASSERT(ill->ill_ipif_dup_count == 0 &&
855 	    ill->ill_arp_down_mp == NULL &&
856 	    ill->ill_arp_del_mapping_mp == NULL);
857 
858 	/*
859 	 * If polling capability is enabled (which signifies direct
860 	 * upcall into IP and driver has ill saved as a handle),
861 	 * we need to make sure that unbind has completed before we
862 	 * let the ill disappear and driver no longer has any reference
863 	 * to this ill.
864 	 */
865 	mutex_enter(&ill->ill_lock);
866 	while (ill->ill_state_flags & ILL_DL_UNBIND_IN_PROGRESS)
867 		cv_wait(&ill->ill_cv, &ill->ill_lock);
868 	mutex_exit(&ill->ill_lock);
869 	ASSERT(!(ill->ill_capabilities &
870 	    (ILL_CAPAB_DLD | ILL_CAPAB_DLD_POLL | ILL_CAPAB_DLD_DIRECT)));
871 
872 	if (ill->ill_net_type != IRE_LOOPBACK)
873 		qprocsoff(ill->ill_rq);
874 
875 	/*
876 	 * We do an ipsq_flush once again now. New messages could have
877 	 * landed up from below (M_ERROR or M_HANGUP). Similarly ioctls
878 	 * could also have landed up if an ioctl thread had looked up
879 	 * the ill before we set the ILL_CONDEMNED flag, but not yet
880 	 * enqueued the ioctl when we did the ipsq_flush last time.
881 	 */
882 	ipsq_flush(ill);
883 
884 	/*
885 	 * Free capabilities.
886 	 */
887 	if (ill->ill_ipsec_capab_ah != NULL) {
888 		ill_ipsec_capab_delete(ill, DL_CAPAB_IPSEC_AH);
889 		ill_ipsec_capab_free(ill->ill_ipsec_capab_ah);
890 		ill->ill_ipsec_capab_ah = NULL;
891 	}
892 
893 	if (ill->ill_ipsec_capab_esp != NULL) {
894 		ill_ipsec_capab_delete(ill, DL_CAPAB_IPSEC_ESP);
895 		ill_ipsec_capab_free(ill->ill_ipsec_capab_esp);
896 		ill->ill_ipsec_capab_esp = NULL;
897 	}
898 
899 	if (ill->ill_mdt_capab != NULL) {
900 		kmem_free(ill->ill_mdt_capab, sizeof (ill_mdt_capab_t));
901 		ill->ill_mdt_capab = NULL;
902 	}
903 
904 	if (ill->ill_hcksum_capab != NULL) {
905 		kmem_free(ill->ill_hcksum_capab, sizeof (ill_hcksum_capab_t));
906 		ill->ill_hcksum_capab = NULL;
907 	}
908 
909 	if (ill->ill_zerocopy_capab != NULL) {
910 		kmem_free(ill->ill_zerocopy_capab,
911 		    sizeof (ill_zerocopy_capab_t));
912 		ill->ill_zerocopy_capab = NULL;
913 	}
914 
915 	if (ill->ill_lso_capab != NULL) {
916 		kmem_free(ill->ill_lso_capab, sizeof (ill_lso_capab_t));
917 		ill->ill_lso_capab = NULL;
918 	}
919 
920 	if (ill->ill_dld_capab != NULL) {
921 		kmem_free(ill->ill_dld_capab, sizeof (ill_dld_capab_t));
922 		ill->ill_dld_capab = NULL;
923 	}
924 
925 	while (ill->ill_ipif != NULL)
926 		ipif_free_tail(ill->ill_ipif);
927 
928 	/*
929 	 * We have removed all references to ilm from conn and the ones joined
930 	 * within the kernel.
931 	 *
932 	 * We don't walk conns, mrts and ires because
933 	 *
934 	 * 1) reset_conn_ill and reset_mrt_ill cleans up conns and mrts.
935 	 * 2) ill_down ->ill_downi walks all the ires and cleans up
936 	 *    ill references.
937 	 */
938 	ASSERT(ilm_walk_ill(ill) == 0);
939 
940 	/*
941 	 * If this ill is an IPMP meta-interface, blow away the illgrp.  This
942 	 * is safe to do because the illgrp has already been unlinked from the
943 	 * group by I_PUNLINK, and thus SIOCSLIFGROUPNAME cannot find it.
944 	 */
945 	if (IS_IPMP(ill)) {
946 		ipmp_illgrp_destroy(ill->ill_grp);
947 		ill->ill_grp = NULL;
948 	}
949 
950 	/*
951 	 * Take us out of the list of ILLs. ill_glist_delete -> phyint_free
952 	 * could free the phyint. No more reference to the phyint after this
953 	 * point.
954 	 */
955 	(void) ill_glist_delete(ill);
956 
957 	rw_enter(&ipst->ips_ip_g_nd_lock, RW_WRITER);
958 	if (ill->ill_ndd_name != NULL)
959 		nd_unload(&ipst->ips_ip_g_nd, ill->ill_ndd_name);
960 	rw_exit(&ipst->ips_ip_g_nd_lock);
961 
962 	if (ill->ill_frag_ptr != NULL) {
963 		uint_t count;
964 
965 		for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
966 			mutex_destroy(&ill->ill_frag_hash_tbl[count].ipfb_lock);
967 		}
968 		mi_free(ill->ill_frag_ptr);
969 		ill->ill_frag_ptr = NULL;
970 		ill->ill_frag_hash_tbl = NULL;
971 	}
972 
973 	freemsg(ill->ill_nd_lla_mp);
974 	/* Free all retained control messages. */
975 	mpp = &ill->ill_first_mp_to_free;
976 	do {
977 		while (mpp[0]) {
978 			mblk_t  *mp;
979 			mblk_t  *mp1;
980 
981 			mp = mpp[0];
982 			mpp[0] = mp->b_next;
983 			for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont) {
984 				mp1->b_next = NULL;
985 				mp1->b_prev = NULL;
986 			}
987 			freemsg(mp);
988 		}
989 	} while (mpp++ != &ill->ill_last_mp_to_free);
990 
991 	ill_free_mib(ill);
992 
993 #ifdef DEBUG
994 	ill_trace_cleanup(ill);
995 #endif
996 
997 	/* Drop refcnt here */
998 	netstack_rele(ill->ill_ipst->ips_netstack);
999 	ill->ill_ipst = NULL;
1000 }
1001 
1002 static void
1003 ill_free_mib(ill_t *ill)
1004 {
1005 	ip_stack_t *ipst = ill->ill_ipst;
1006 
1007 	/*
1008 	 * MIB statistics must not be lost, so when an interface
1009 	 * goes away the counter values will be added to the global
1010 	 * MIBs.
1011 	 */
1012 	if (ill->ill_ip_mib != NULL) {
1013 		if (ill->ill_isv6) {
1014 			ip_mib2_add_ip_stats(&ipst->ips_ip6_mib,
1015 			    ill->ill_ip_mib);
1016 		} else {
1017 			ip_mib2_add_ip_stats(&ipst->ips_ip_mib,
1018 			    ill->ill_ip_mib);
1019 		}
1020 
1021 		kmem_free(ill->ill_ip_mib, sizeof (*ill->ill_ip_mib));
1022 		ill->ill_ip_mib = NULL;
1023 	}
1024 	if (ill->ill_icmp6_mib != NULL) {
1025 		ip_mib2_add_icmp6_stats(&ipst->ips_icmp6_mib,
1026 		    ill->ill_icmp6_mib);
1027 		kmem_free(ill->ill_icmp6_mib, sizeof (*ill->ill_icmp6_mib));
1028 		ill->ill_icmp6_mib = NULL;
1029 	}
1030 }
1031 
1032 /*
1033  * Concatenate together a physical address and a sap.
1034  *
1035  * Sap_lengths are interpreted as follows:
1036  *   sap_length == 0	==>	no sap
1037  *   sap_length > 0	==>	sap is at the head of the dlpi address
1038  *   sap_length < 0	==>	sap is at the tail of the dlpi address
1039  */
1040 static void
1041 ill_dlur_copy_address(uchar_t *phys_src, uint_t phys_length,
1042     t_scalar_t sap_src, t_scalar_t sap_length, uchar_t *dst)
1043 {
1044 	uint16_t sap_addr = (uint16_t)sap_src;
1045 
1046 	if (sap_length == 0) {
1047 		if (phys_src == NULL)
1048 			bzero(dst, phys_length);
1049 		else
1050 			bcopy(phys_src, dst, phys_length);
1051 	} else if (sap_length < 0) {
1052 		if (phys_src == NULL)
1053 			bzero(dst, phys_length);
1054 		else
1055 			bcopy(phys_src, dst, phys_length);
1056 		bcopy(&sap_addr, (char *)dst + phys_length, sizeof (sap_addr));
1057 	} else {
1058 		bcopy(&sap_addr, dst, sizeof (sap_addr));
1059 		if (phys_src == NULL)
1060 			bzero((char *)dst + sap_length, phys_length);
1061 		else
1062 			bcopy(phys_src, (char *)dst + sap_length, phys_length);
1063 	}
1064 }
1065 
1066 /*
1067  * Generate a dl_unitdata_req mblk for the device and address given.
1068  * addr_length is the length of the physical portion of the address.
1069  * If addr is NULL include an all zero address of the specified length.
1070  * TRUE? In any case, addr_length is taken to be the entire length of the
1071  * dlpi address, including the absolute value of sap_length.
1072  */
1073 mblk_t *
1074 ill_dlur_gen(uchar_t *addr, uint_t addr_length, t_uscalar_t sap,
1075 		t_scalar_t sap_length)
1076 {
1077 	dl_unitdata_req_t *dlur;
1078 	mblk_t	*mp;
1079 	t_scalar_t	abs_sap_length;		/* absolute value */
1080 
1081 	abs_sap_length = ABS(sap_length);
1082 	mp = ip_dlpi_alloc(sizeof (*dlur) + addr_length + abs_sap_length,
1083 	    DL_UNITDATA_REQ);
1084 	if (mp == NULL)
1085 		return (NULL);
1086 	dlur = (dl_unitdata_req_t *)mp->b_rptr;
1087 	/* HACK: accomodate incompatible DLPI drivers */
1088 	if (addr_length == 8)
1089 		addr_length = 6;
1090 	dlur->dl_dest_addr_length = addr_length + abs_sap_length;
1091 	dlur->dl_dest_addr_offset = sizeof (*dlur);
1092 	dlur->dl_priority.dl_min = 0;
1093 	dlur->dl_priority.dl_max = 0;
1094 	ill_dlur_copy_address(addr, addr_length, sap, sap_length,
1095 	    (uchar_t *)&dlur[1]);
1096 	return (mp);
1097 }
1098 
1099 /*
1100  * Add the 'mp' to the list of pending mp's headed by ill_pending_mp
1101  * Return an error if we already have 1 or more ioctls in progress.
1102  * This is used only for non-exclusive ioctls. Currently this is used
1103  * for SIOC*ARP and SIOCGTUNPARAM ioctls. Most set ioctls are exclusive
1104  * and thus need to use ipsq_pending_mp_add.
1105  */
1106 boolean_t
1107 ill_pending_mp_add(ill_t *ill, conn_t *connp, mblk_t *add_mp)
1108 {
1109 	ASSERT(MUTEX_HELD(&ill->ill_lock));
1110 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
1111 	/*
1112 	 * M_IOCDATA from ioctls, M_IOCTL from tunnel ioctls.
1113 	 */
1114 	ASSERT((add_mp->b_datap->db_type == M_IOCDATA) ||
1115 	    (add_mp->b_datap->db_type == M_IOCTL));
1116 
1117 	ASSERT(MUTEX_HELD(&connp->conn_lock));
1118 	/*
1119 	 * Return error if the conn has started closing. The conn
1120 	 * could have finished cleaning up the pending mp list,
1121 	 * If so we should not add another mp to the list negating
1122 	 * the cleanup.
1123 	 */
1124 	if (connp->conn_state_flags & CONN_CLOSING)
1125 		return (B_FALSE);
1126 	/*
1127 	 * Add the pending mp to the head of the list, chained by b_next.
1128 	 * Note down the conn on which the ioctl request came, in b_prev.
1129 	 * This will be used to later get the conn, when we get a response
1130 	 * on the ill queue, from some other module (typically arp)
1131 	 */
1132 	add_mp->b_next = (void *)ill->ill_pending_mp;
1133 	add_mp->b_queue = CONNP_TO_WQ(connp);
1134 	ill->ill_pending_mp = add_mp;
1135 	if (connp != NULL)
1136 		connp->conn_oper_pending_ill = ill;
1137 	return (B_TRUE);
1138 }
1139 
1140 /*
1141  * Retrieve the ill_pending_mp and return it. We have to walk the list
1142  * of mblks starting at ill_pending_mp, and match based on the ioc_id.
1143  */
1144 mblk_t *
1145 ill_pending_mp_get(ill_t *ill, conn_t **connpp, uint_t ioc_id)
1146 {
1147 	mblk_t	*prev = NULL;
1148 	mblk_t	*curr = NULL;
1149 	uint_t	id;
1150 	conn_t	*connp;
1151 
1152 	/*
1153 	 * When the conn closes, conn_ioctl_cleanup needs to clean
1154 	 * up the pending mp, but it does not know the ioc_id and
1155 	 * passes in a zero for it.
1156 	 */
1157 	mutex_enter(&ill->ill_lock);
1158 	if (ioc_id != 0)
1159 		*connpp = NULL;
1160 
1161 	/* Search the list for the appropriate ioctl based on ioc_id */
1162 	for (prev = NULL, curr = ill->ill_pending_mp; curr != NULL;
1163 	    prev = curr, curr = curr->b_next) {
1164 		id = ((struct iocblk *)curr->b_rptr)->ioc_id;
1165 		connp = Q_TO_CONN(curr->b_queue);
1166 		/* Match based on the ioc_id or based on the conn */
1167 		if ((id == ioc_id) || (ioc_id == 0 && connp == *connpp))
1168 			break;
1169 	}
1170 
1171 	if (curr != NULL) {
1172 		/* Unlink the mblk from the pending mp list */
1173 		if (prev != NULL) {
1174 			prev->b_next = curr->b_next;
1175 		} else {
1176 			ASSERT(ill->ill_pending_mp == curr);
1177 			ill->ill_pending_mp = curr->b_next;
1178 		}
1179 
1180 		/*
1181 		 * conn refcnt must have been bumped up at the start of
1182 		 * the ioctl. So we can safely access the conn.
1183 		 */
1184 		ASSERT(CONN_Q(curr->b_queue));
1185 		*connpp = Q_TO_CONN(curr->b_queue);
1186 		curr->b_next = NULL;
1187 		curr->b_queue = NULL;
1188 	}
1189 
1190 	mutex_exit(&ill->ill_lock);
1191 
1192 	return (curr);
1193 }
1194 
1195 /*
1196  * Add the pending mp to the list. There can be only 1 pending mp
1197  * in the list. Any exclusive ioctl that needs to wait for a response
1198  * from another module or driver needs to use this function to set
1199  * the ipx_pending_mp to the ioctl mblk and wait for the response from
1200  * the other module/driver. This is also used while waiting for the
1201  * ipif/ill/ire refcnts to drop to zero in bringing down an ipif.
1202  */
1203 boolean_t
1204 ipsq_pending_mp_add(conn_t *connp, ipif_t *ipif, queue_t *q, mblk_t *add_mp,
1205     int waitfor)
1206 {
1207 	ipxop_t	*ipx = ipif->ipif_ill->ill_phyint->phyint_ipsq->ipsq_xop;
1208 
1209 	ASSERT(IAM_WRITER_IPIF(ipif));
1210 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
1211 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
1212 	ASSERT(ipx->ipx_pending_mp == NULL);
1213 	/*
1214 	 * The caller may be using a different ipif than the one passed into
1215 	 * ipsq_current_start() (e.g., suppose an ioctl that came in on the V4
1216 	 * ill needs to wait for the V6 ill to quiesce).  So we can't ASSERT
1217 	 * that `ipx_current_ipif == ipif'.
1218 	 */
1219 	ASSERT(ipx->ipx_current_ipif != NULL);
1220 
1221 	/*
1222 	 * M_IOCDATA from ioctls, M_IOCTL from tunnel ioctls,
1223 	 * M_ERROR/M_HANGUP/M_PROTO/M_PCPROTO from the driver.
1224 	 */
1225 	ASSERT((DB_TYPE(add_mp) == M_IOCDATA) || (DB_TYPE(add_mp) == M_IOCTL) ||
1226 	    (DB_TYPE(add_mp) == M_ERROR) || (DB_TYPE(add_mp) == M_HANGUP) ||
1227 	    (DB_TYPE(add_mp) == M_PROTO) || (DB_TYPE(add_mp) == M_PCPROTO));
1228 
1229 	if (connp != NULL) {
1230 		ASSERT(MUTEX_HELD(&connp->conn_lock));
1231 		/*
1232 		 * Return error if the conn has started closing. The conn
1233 		 * could have finished cleaning up the pending mp list,
1234 		 * If so we should not add another mp to the list negating
1235 		 * the cleanup.
1236 		 */
1237 		if (connp->conn_state_flags & CONN_CLOSING)
1238 			return (B_FALSE);
1239 	}
1240 	mutex_enter(&ipx->ipx_lock);
1241 	ipx->ipx_pending_ipif = ipif;
1242 	/*
1243 	 * Note down the queue in b_queue. This will be returned by
1244 	 * ipsq_pending_mp_get. Caller will then use these values to restart
1245 	 * the processing
1246 	 */
1247 	add_mp->b_next = NULL;
1248 	add_mp->b_queue = q;
1249 	ipx->ipx_pending_mp = add_mp;
1250 	ipx->ipx_waitfor = waitfor;
1251 	mutex_exit(&ipx->ipx_lock);
1252 
1253 	if (connp != NULL)
1254 		connp->conn_oper_pending_ill = ipif->ipif_ill;
1255 
1256 	return (B_TRUE);
1257 }
1258 
1259 /*
1260  * Retrieve the ipx_pending_mp and return it. There can be only 1 mp
1261  * queued in the list.
1262  */
1263 mblk_t *
1264 ipsq_pending_mp_get(ipsq_t *ipsq, conn_t **connpp)
1265 {
1266 	mblk_t	*curr = NULL;
1267 	ipxop_t	*ipx = ipsq->ipsq_xop;
1268 
1269 	*connpp = NULL;
1270 	mutex_enter(&ipx->ipx_lock);
1271 	if (ipx->ipx_pending_mp == NULL) {
1272 		mutex_exit(&ipx->ipx_lock);
1273 		return (NULL);
1274 	}
1275 
1276 	/* There can be only 1 such excl message */
1277 	curr = ipx->ipx_pending_mp;
1278 	ASSERT(curr->b_next == NULL);
1279 	ipx->ipx_pending_ipif = NULL;
1280 	ipx->ipx_pending_mp = NULL;
1281 	ipx->ipx_waitfor = 0;
1282 	mutex_exit(&ipx->ipx_lock);
1283 
1284 	if (CONN_Q(curr->b_queue)) {
1285 		/*
1286 		 * This mp did a refhold on the conn, at the start of the ioctl.
1287 		 * So we can safely return a pointer to the conn to the caller.
1288 		 */
1289 		*connpp = Q_TO_CONN(curr->b_queue);
1290 	} else {
1291 		*connpp = NULL;
1292 	}
1293 	curr->b_next = NULL;
1294 	curr->b_prev = NULL;
1295 	return (curr);
1296 }
1297 
1298 /*
1299  * Cleanup the ioctl mp queued in ipx_pending_mp
1300  * - Called in the ill_delete path
1301  * - Called in the M_ERROR or M_HANGUP path on the ill.
1302  * - Called in the conn close path.
1303  */
1304 boolean_t
1305 ipsq_pending_mp_cleanup(ill_t *ill, conn_t *connp)
1306 {
1307 	mblk_t	*mp;
1308 	ipxop_t	*ipx;
1309 	queue_t	*q;
1310 	ipif_t	*ipif;
1311 
1312 	ASSERT(IAM_WRITER_ILL(ill));
1313 	ipx = ill->ill_phyint->phyint_ipsq->ipsq_xop;
1314 
1315 	/*
1316 	 * If connp is null, unconditionally clean up the ipx_pending_mp.
1317 	 * This happens in M_ERROR/M_HANGUP. We need to abort the current ioctl
1318 	 * even if it is meant for another ill, since we have to enqueue
1319 	 * a new mp now in ipx_pending_mp to complete the ipif_down.
1320 	 * If connp is non-null we are called from the conn close path.
1321 	 */
1322 	mutex_enter(&ipx->ipx_lock);
1323 	mp = ipx->ipx_pending_mp;
1324 	if (mp == NULL || (connp != NULL &&
1325 	    mp->b_queue != CONNP_TO_WQ(connp))) {
1326 		mutex_exit(&ipx->ipx_lock);
1327 		return (B_FALSE);
1328 	}
1329 	/* Now remove from the ipx_pending_mp */
1330 	ipx->ipx_pending_mp = NULL;
1331 	q = mp->b_queue;
1332 	mp->b_next = NULL;
1333 	mp->b_prev = NULL;
1334 	mp->b_queue = NULL;
1335 
1336 	ipif = ipx->ipx_pending_ipif;
1337 	ipx->ipx_pending_ipif = NULL;
1338 	ipx->ipx_waitfor = 0;
1339 	ipx->ipx_current_ipif = NULL;
1340 	ipx->ipx_current_ioctl = 0;
1341 	ipx->ipx_current_done = B_TRUE;
1342 	mutex_exit(&ipx->ipx_lock);
1343 
1344 	if (DB_TYPE(mp) == M_IOCTL || DB_TYPE(mp) == M_IOCDATA) {
1345 		if (connp == NULL) {
1346 			ip_ioctl_finish(q, mp, ENXIO, NO_COPYOUT, NULL);
1347 		} else {
1348 			ip_ioctl_finish(q, mp, ENXIO, CONN_CLOSE, NULL);
1349 			mutex_enter(&ipif->ipif_ill->ill_lock);
1350 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
1351 			mutex_exit(&ipif->ipif_ill->ill_lock);
1352 		}
1353 	} else {
1354 		/*
1355 		 * IP-MT XXX In the case of TLI/XTI bind / optmgmt this can't
1356 		 * be just inet_freemsg. we have to restart it
1357 		 * otherwise the thread will be stuck.
1358 		 */
1359 		inet_freemsg(mp);
1360 	}
1361 	return (B_TRUE);
1362 }
1363 
1364 /*
1365  * The ill is closing. Cleanup all the pending mps. Called exclusively
1366  * towards the end of ill_delete. The refcount has gone to 0. So nobody
1367  * knows this ill, and hence nobody can add an mp to this list
1368  */
1369 static void
1370 ill_pending_mp_cleanup(ill_t *ill)
1371 {
1372 	mblk_t	*mp;
1373 	queue_t	*q;
1374 
1375 	ASSERT(IAM_WRITER_ILL(ill));
1376 
1377 	mutex_enter(&ill->ill_lock);
1378 	/*
1379 	 * Every mp on the pending mp list originating from an ioctl
1380 	 * added 1 to the conn refcnt, at the start of the ioctl.
1381 	 * So bump it down now.  See comments in ip_wput_nondata()
1382 	 */
1383 	while (ill->ill_pending_mp != NULL) {
1384 		mp = ill->ill_pending_mp;
1385 		ill->ill_pending_mp = mp->b_next;
1386 		mutex_exit(&ill->ill_lock);
1387 
1388 		q = mp->b_queue;
1389 		ASSERT(CONN_Q(q));
1390 		mp->b_next = NULL;
1391 		mp->b_prev = NULL;
1392 		mp->b_queue = NULL;
1393 		ip_ioctl_finish(q, mp, ENXIO, NO_COPYOUT, NULL);
1394 		mutex_enter(&ill->ill_lock);
1395 	}
1396 	ill->ill_pending_ipif = NULL;
1397 
1398 	mutex_exit(&ill->ill_lock);
1399 }
1400 
1401 /*
1402  * Called in the conn close path and ill delete path
1403  */
1404 static void
1405 ipsq_xopq_mp_cleanup(ill_t *ill, conn_t *connp)
1406 {
1407 	ipsq_t	*ipsq;
1408 	mblk_t	*prev;
1409 	mblk_t	*curr;
1410 	mblk_t	*next;
1411 	queue_t	*q;
1412 	mblk_t	*tmp_list = NULL;
1413 
1414 	ASSERT(IAM_WRITER_ILL(ill));
1415 	if (connp != NULL)
1416 		q = CONNP_TO_WQ(connp);
1417 	else
1418 		q = ill->ill_wq;
1419 
1420 	ipsq = ill->ill_phyint->phyint_ipsq;
1421 	/*
1422 	 * Cleanup the ioctl mp's queued in ipsq_xopq_pending_mp if any.
1423 	 * In the case of ioctl from a conn, there can be only 1 mp
1424 	 * queued on the ipsq. If an ill is being unplumbed, only messages
1425 	 * related to this ill are flushed, like M_ERROR or M_HANGUP message.
1426 	 * ioctls meant for this ill form conn's are not flushed. They will
1427 	 * be processed during ipsq_exit and will not find the ill and will
1428 	 * return error.
1429 	 */
1430 	mutex_enter(&ipsq->ipsq_lock);
1431 	for (prev = NULL, curr = ipsq->ipsq_xopq_mphead; curr != NULL;
1432 	    curr = next) {
1433 		next = curr->b_next;
1434 		if (curr->b_queue == q || curr->b_queue == RD(q)) {
1435 			/* Unlink the mblk from the pending mp list */
1436 			if (prev != NULL) {
1437 				prev->b_next = curr->b_next;
1438 			} else {
1439 				ASSERT(ipsq->ipsq_xopq_mphead == curr);
1440 				ipsq->ipsq_xopq_mphead = curr->b_next;
1441 			}
1442 			if (ipsq->ipsq_xopq_mptail == curr)
1443 				ipsq->ipsq_xopq_mptail = prev;
1444 			/*
1445 			 * Create a temporary list and release the ipsq lock
1446 			 * New elements are added to the head of the tmp_list
1447 			 */
1448 			curr->b_next = tmp_list;
1449 			tmp_list = curr;
1450 		} else {
1451 			prev = curr;
1452 		}
1453 	}
1454 	mutex_exit(&ipsq->ipsq_lock);
1455 
1456 	while (tmp_list != NULL) {
1457 		curr = tmp_list;
1458 		tmp_list = curr->b_next;
1459 		curr->b_next = NULL;
1460 		curr->b_prev = NULL;
1461 		curr->b_queue = NULL;
1462 		if (DB_TYPE(curr) == M_IOCTL || DB_TYPE(curr) == M_IOCDATA) {
1463 			ip_ioctl_finish(q, curr, ENXIO, connp != NULL ?
1464 			    CONN_CLOSE : NO_COPYOUT, NULL);
1465 		} else {
1466 			/*
1467 			 * IP-MT XXX In the case of TLI/XTI bind / optmgmt
1468 			 * this can't be just inet_freemsg. we have to
1469 			 * restart it otherwise the thread will be stuck.
1470 			 */
1471 			inet_freemsg(curr);
1472 		}
1473 	}
1474 }
1475 
1476 /*
1477  * This conn has started closing. Cleanup any pending ioctl from this conn.
1478  * STREAMS ensures that there can be at most 1 ioctl pending on a stream.
1479  */
1480 void
1481 conn_ioctl_cleanup(conn_t *connp)
1482 {
1483 	mblk_t *curr;
1484 	ipsq_t	*ipsq;
1485 	ill_t	*ill;
1486 	boolean_t refheld;
1487 
1488 	/*
1489 	 * Is any exclusive ioctl pending ? If so clean it up. If the
1490 	 * ioctl has not yet started, the mp is pending in the list headed by
1491 	 * ipsq_xopq_head. If the ioctl has started the mp could be present in
1492 	 * ipx_pending_mp. If the ioctl timed out in the streamhead but
1493 	 * is currently executing now the mp is not queued anywhere but
1494 	 * conn_oper_pending_ill is null. The conn close will wait
1495 	 * till the conn_ref drops to zero.
1496 	 */
1497 	mutex_enter(&connp->conn_lock);
1498 	ill = connp->conn_oper_pending_ill;
1499 	if (ill == NULL) {
1500 		mutex_exit(&connp->conn_lock);
1501 		return;
1502 	}
1503 
1504 	curr = ill_pending_mp_get(ill, &connp, 0);
1505 	if (curr != NULL) {
1506 		mutex_exit(&connp->conn_lock);
1507 		CONN_DEC_REF(connp);
1508 		inet_freemsg(curr);
1509 		return;
1510 	}
1511 	/*
1512 	 * We may not be able to refhold the ill if the ill/ipif
1513 	 * is changing. But we need to make sure that the ill will
1514 	 * not vanish. So we just bump up the ill_waiter count.
1515 	 */
1516 	refheld = ill_waiter_inc(ill);
1517 	mutex_exit(&connp->conn_lock);
1518 	if (refheld) {
1519 		if (ipsq_enter(ill, B_TRUE, NEW_OP)) {
1520 			ill_waiter_dcr(ill);
1521 			/*
1522 			 * Check whether this ioctl has started and is
1523 			 * pending. If it is not found there then check
1524 			 * whether this ioctl has not even started and is in
1525 			 * the ipsq_xopq list.
1526 			 */
1527 			if (!ipsq_pending_mp_cleanup(ill, connp))
1528 				ipsq_xopq_mp_cleanup(ill, connp);
1529 			ipsq = ill->ill_phyint->phyint_ipsq;
1530 			ipsq_exit(ipsq);
1531 			return;
1532 		}
1533 	}
1534 
1535 	/*
1536 	 * The ill is also closing and we could not bump up the
1537 	 * ill_waiter_count or we could not enter the ipsq. Leave
1538 	 * the cleanup to ill_delete
1539 	 */
1540 	mutex_enter(&connp->conn_lock);
1541 	while (connp->conn_oper_pending_ill != NULL)
1542 		cv_wait(&connp->conn_refcv, &connp->conn_lock);
1543 	mutex_exit(&connp->conn_lock);
1544 	if (refheld)
1545 		ill_waiter_dcr(ill);
1546 }
1547 
1548 /*
1549  * ipcl_walk function for cleaning up conn_*_ill fields.
1550  */
1551 static void
1552 conn_cleanup_ill(conn_t *connp, caddr_t arg)
1553 {
1554 	ill_t	*ill = (ill_t *)arg;
1555 	ire_t	*ire;
1556 
1557 	mutex_enter(&connp->conn_lock);
1558 	if (connp->conn_multicast_ill == ill) {
1559 		/* Revert to late binding */
1560 		connp->conn_multicast_ill = NULL;
1561 	}
1562 	if (connp->conn_incoming_ill == ill)
1563 		connp->conn_incoming_ill = NULL;
1564 	if (connp->conn_outgoing_ill == ill)
1565 		connp->conn_outgoing_ill = NULL;
1566 	if (connp->conn_dhcpinit_ill == ill) {
1567 		connp->conn_dhcpinit_ill = NULL;
1568 		ASSERT(ill->ill_dhcpinit != 0);
1569 		atomic_dec_32(&ill->ill_dhcpinit);
1570 	}
1571 	if (connp->conn_ire_cache != NULL) {
1572 		ire = connp->conn_ire_cache;
1573 		/*
1574 		 * Source address selection makes it possible for IRE_CACHE
1575 		 * entries to be created with ire_stq coming from interface X
1576 		 * and ipif coming from interface Y.  Thus whenever interface
1577 		 * X goes down, remove all references to it by checking both
1578 		 * on ire_ipif and ire_stq.
1579 		 */
1580 		if ((ire->ire_ipif != NULL && ire->ire_ipif->ipif_ill == ill) ||
1581 		    (ire->ire_type == IRE_CACHE &&
1582 		    ire->ire_stq == ill->ill_wq)) {
1583 			connp->conn_ire_cache = NULL;
1584 			mutex_exit(&connp->conn_lock);
1585 			ire_refrele_notr(ire);
1586 			return;
1587 		}
1588 	}
1589 	mutex_exit(&connp->conn_lock);
1590 }
1591 
1592 static void
1593 ill_down_ipifs_tail(ill_t *ill)
1594 {
1595 	ipif_t	*ipif;
1596 
1597 	ASSERT(IAM_WRITER_ILL(ill));
1598 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
1599 		ipif_non_duplicate(ipif);
1600 		ipif_down_tail(ipif);
1601 	}
1602 }
1603 
1604 /* ARGSUSED */
1605 void
1606 ipif_all_down_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
1607 {
1608 	ASSERT(IAM_WRITER_IPSQ(ipsq));
1609 	ill_down_ipifs_tail(q->q_ptr);
1610 	freemsg(mp);
1611 	ipsq_current_finish(ipsq);
1612 }
1613 
1614 /*
1615  * ill_down_start is called when we want to down this ill and bring it up again
1616  * It is called when we receive an M_ERROR / M_HANGUP. In this case we shut down
1617  * all interfaces, but don't tear down any plumbing.
1618  */
1619 boolean_t
1620 ill_down_start(queue_t *q, mblk_t *mp)
1621 {
1622 	ill_t	*ill = q->q_ptr;
1623 	ipif_t	*ipif;
1624 
1625 	ASSERT(IAM_WRITER_ILL(ill));
1626 
1627 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
1628 		(void) ipif_down(ipif, NULL, NULL);
1629 
1630 	ill_down(ill);
1631 
1632 	(void) ipsq_pending_mp_cleanup(ill, NULL);
1633 
1634 	ipsq_current_start(ill->ill_phyint->phyint_ipsq, ill->ill_ipif, 0);
1635 
1636 	/*
1637 	 * Atomically test and add the pending mp if references are active.
1638 	 */
1639 	mutex_enter(&ill->ill_lock);
1640 	if (!ill_is_quiescent(ill)) {
1641 		/* call cannot fail since `conn_t *' argument is NULL */
1642 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
1643 		    mp, ILL_DOWN);
1644 		mutex_exit(&ill->ill_lock);
1645 		return (B_FALSE);
1646 	}
1647 	mutex_exit(&ill->ill_lock);
1648 	return (B_TRUE);
1649 }
1650 
1651 static void
1652 ill_down(ill_t *ill)
1653 {
1654 	ip_stack_t	*ipst = ill->ill_ipst;
1655 
1656 	/* Blow off any IREs dependent on this ILL. */
1657 	ire_walk(ill_downi, ill, ipst);
1658 
1659 	/* Remove any conn_*_ill depending on this ill */
1660 	ipcl_walk(conn_cleanup_ill, (caddr_t)ill, ipst);
1661 }
1662 
1663 /*
1664  * ire_walk routine used to delete every IRE that depends on queues
1665  * associated with 'ill'.  (Always called as writer.)
1666  */
1667 static void
1668 ill_downi(ire_t *ire, char *ill_arg)
1669 {
1670 	ill_t	*ill = (ill_t *)ill_arg;
1671 
1672 	/*
1673 	 * Source address selection makes it possible for IRE_CACHE
1674 	 * entries to be created with ire_stq coming from interface X
1675 	 * and ipif coming from interface Y.  Thus whenever interface
1676 	 * X goes down, remove all references to it by checking both
1677 	 * on ire_ipif and ire_stq.
1678 	 */
1679 	if ((ire->ire_ipif != NULL && ire->ire_ipif->ipif_ill == ill) ||
1680 	    (ire->ire_type == IRE_CACHE && ire->ire_stq == ill->ill_wq)) {
1681 		ire_delete(ire);
1682 	}
1683 }
1684 
1685 /*
1686  * Remove ire/nce from the fastpath list.
1687  */
1688 void
1689 ill_fastpath_nack(ill_t *ill)
1690 {
1691 	nce_fastpath_list_dispatch(ill, NULL, NULL);
1692 }
1693 
1694 /* Consume an M_IOCACK of the fastpath probe. */
1695 void
1696 ill_fastpath_ack(ill_t *ill, mblk_t *mp)
1697 {
1698 	mblk_t	*mp1 = mp;
1699 
1700 	/*
1701 	 * If this was the first attempt turn on the fastpath probing.
1702 	 */
1703 	mutex_enter(&ill->ill_lock);
1704 	if (ill->ill_dlpi_fastpath_state == IDS_INPROGRESS)
1705 		ill->ill_dlpi_fastpath_state = IDS_OK;
1706 	mutex_exit(&ill->ill_lock);
1707 
1708 	/* Free the M_IOCACK mblk, hold on to the data */
1709 	mp = mp->b_cont;
1710 	freeb(mp1);
1711 	if (mp == NULL)
1712 		return;
1713 	if (mp->b_cont != NULL) {
1714 		/*
1715 		 * Update all IRE's or NCE's that are waiting for
1716 		 * fastpath update.
1717 		 */
1718 		nce_fastpath_list_dispatch(ill, ndp_fastpath_update, mp);
1719 		mp1 = mp->b_cont;
1720 		freeb(mp);
1721 		mp = mp1;
1722 	} else {
1723 		ip0dbg(("ill_fastpath_ack:  no b_cont\n"));
1724 	}
1725 
1726 	freeb(mp);
1727 }
1728 
1729 /*
1730  * Throw an M_IOCTL message downstream asking "do you know fastpath?"
1731  * The data portion of the request is a dl_unitdata_req_t template for
1732  * what we would send downstream in the absence of a fastpath confirmation.
1733  */
1734 int
1735 ill_fastpath_probe(ill_t *ill, mblk_t *dlur_mp)
1736 {
1737 	struct iocblk	*ioc;
1738 	mblk_t	*mp;
1739 
1740 	if (dlur_mp == NULL)
1741 		return (EINVAL);
1742 
1743 	mutex_enter(&ill->ill_lock);
1744 	switch (ill->ill_dlpi_fastpath_state) {
1745 	case IDS_FAILED:
1746 		/*
1747 		 * Driver NAKed the first fastpath ioctl - assume it doesn't
1748 		 * support it.
1749 		 */
1750 		mutex_exit(&ill->ill_lock);
1751 		return (ENOTSUP);
1752 	case IDS_UNKNOWN:
1753 		/* This is the first probe */
1754 		ill->ill_dlpi_fastpath_state = IDS_INPROGRESS;
1755 		break;
1756 	default:
1757 		break;
1758 	}
1759 	mutex_exit(&ill->ill_lock);
1760 
1761 	if ((mp = mkiocb(DL_IOC_HDR_INFO)) == NULL)
1762 		return (EAGAIN);
1763 
1764 	mp->b_cont = copyb(dlur_mp);
1765 	if (mp->b_cont == NULL) {
1766 		freeb(mp);
1767 		return (EAGAIN);
1768 	}
1769 
1770 	ioc = (struct iocblk *)mp->b_rptr;
1771 	ioc->ioc_count = msgdsize(mp->b_cont);
1772 
1773 	putnext(ill->ill_wq, mp);
1774 	return (0);
1775 }
1776 
1777 void
1778 ill_capability_probe(ill_t *ill)
1779 {
1780 	mblk_t	*mp;
1781 
1782 	ASSERT(IAM_WRITER_ILL(ill));
1783 
1784 	if (ill->ill_dlpi_capab_state != IDCS_UNKNOWN &&
1785 	    ill->ill_dlpi_capab_state != IDCS_FAILED)
1786 		return;
1787 
1788 	/*
1789 	 * We are starting a new cycle of capability negotiation.
1790 	 * Free up the capab reset messages of any previous incarnation.
1791 	 * We will do a fresh allocation when we get the response to our probe
1792 	 */
1793 	if (ill->ill_capab_reset_mp != NULL) {
1794 		freemsg(ill->ill_capab_reset_mp);
1795 		ill->ill_capab_reset_mp = NULL;
1796 	}
1797 
1798 	ip1dbg(("ill_capability_probe: starting capability negotiation\n"));
1799 
1800 	mp = ip_dlpi_alloc(sizeof (dl_capability_req_t), DL_CAPABILITY_REQ);
1801 	if (mp == NULL)
1802 		return;
1803 
1804 	ill_capability_send(ill, mp);
1805 	ill->ill_dlpi_capab_state = IDCS_PROBE_SENT;
1806 }
1807 
1808 void
1809 ill_capability_reset(ill_t *ill, boolean_t reneg)
1810 {
1811 	ASSERT(IAM_WRITER_ILL(ill));
1812 
1813 	if (ill->ill_dlpi_capab_state != IDCS_OK)
1814 		return;
1815 
1816 	ill->ill_dlpi_capab_state = reneg ? IDCS_RENEG : IDCS_RESET_SENT;
1817 
1818 	ill_capability_send(ill, ill->ill_capab_reset_mp);
1819 	ill->ill_capab_reset_mp = NULL;
1820 	/*
1821 	 * We turn off all capabilities except those pertaining to
1822 	 * direct function call capabilities viz. ILL_CAPAB_DLD*
1823 	 * which will be turned off by the corresponding reset functions.
1824 	 */
1825 	ill->ill_capabilities &= ~(ILL_CAPAB_MDT | ILL_CAPAB_HCKSUM  |
1826 	    ILL_CAPAB_ZEROCOPY | ILL_CAPAB_AH | ILL_CAPAB_ESP);
1827 }
1828 
1829 static void
1830 ill_capability_reset_alloc(ill_t *ill)
1831 {
1832 	mblk_t *mp;
1833 	size_t	size = 0;
1834 	int	err;
1835 	dl_capability_req_t	*capb;
1836 
1837 	ASSERT(IAM_WRITER_ILL(ill));
1838 	ASSERT(ill->ill_capab_reset_mp == NULL);
1839 
1840 	if (ILL_MDT_CAPABLE(ill))
1841 		size += sizeof (dl_capability_sub_t) + sizeof (dl_capab_mdt_t);
1842 
1843 	if (ILL_HCKSUM_CAPABLE(ill)) {
1844 		size += sizeof (dl_capability_sub_t) +
1845 		    sizeof (dl_capab_hcksum_t);
1846 	}
1847 
1848 	if (ill->ill_capabilities & ILL_CAPAB_ZEROCOPY) {
1849 		size += sizeof (dl_capability_sub_t) +
1850 		    sizeof (dl_capab_zerocopy_t);
1851 	}
1852 
1853 	if (ill->ill_capabilities & (ILL_CAPAB_AH | ILL_CAPAB_ESP)) {
1854 		size += sizeof (dl_capability_sub_t);
1855 		size += ill_capability_ipsec_reset_size(ill, NULL, NULL,
1856 		    NULL, NULL);
1857 	}
1858 
1859 	if (ill->ill_capabilities & ILL_CAPAB_DLD) {
1860 		size += sizeof (dl_capability_sub_t) +
1861 		    sizeof (dl_capab_dld_t);
1862 	}
1863 
1864 	mp = allocb_wait(size + sizeof (dl_capability_req_t), BPRI_MED,
1865 	    STR_NOSIG, &err);
1866 
1867 	mp->b_datap->db_type = M_PROTO;
1868 	bzero(mp->b_rptr, size + sizeof (dl_capability_req_t));
1869 
1870 	capb = (dl_capability_req_t *)mp->b_rptr;
1871 	capb->dl_primitive = DL_CAPABILITY_REQ;
1872 	capb->dl_sub_offset = sizeof (dl_capability_req_t);
1873 	capb->dl_sub_length = size;
1874 
1875 	mp->b_wptr += sizeof (dl_capability_req_t);
1876 
1877 	/*
1878 	 * Each handler fills in the corresponding dl_capability_sub_t
1879 	 * inside the mblk,
1880 	 */
1881 	ill_capability_mdt_reset_fill(ill, mp);
1882 	ill_capability_hcksum_reset_fill(ill, mp);
1883 	ill_capability_zerocopy_reset_fill(ill, mp);
1884 	ill_capability_ipsec_reset_fill(ill, mp);
1885 	ill_capability_dld_reset_fill(ill, mp);
1886 
1887 	ill->ill_capab_reset_mp = mp;
1888 }
1889 
1890 static void
1891 ill_capability_id_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *outers)
1892 {
1893 	dl_capab_id_t *id_ic;
1894 	uint_t sub_dl_cap = outers->dl_cap;
1895 	dl_capability_sub_t *inners;
1896 	uint8_t *capend;
1897 
1898 	ASSERT(sub_dl_cap == DL_CAPAB_ID_WRAPPER);
1899 
1900 	/*
1901 	 * Note: range checks here are not absolutely sufficient to
1902 	 * make us robust against malformed messages sent by drivers;
1903 	 * this is in keeping with the rest of IP's dlpi handling.
1904 	 * (Remember, it's coming from something else in the kernel
1905 	 * address space)
1906 	 */
1907 
1908 	capend = (uint8_t *)(outers + 1) + outers->dl_length;
1909 	if (capend > mp->b_wptr) {
1910 		cmn_err(CE_WARN, "ill_capability_id_ack: "
1911 		    "malformed sub-capability too long for mblk");
1912 		return;
1913 	}
1914 
1915 	id_ic = (dl_capab_id_t *)(outers + 1);
1916 
1917 	if (outers->dl_length < sizeof (*id_ic) ||
1918 	    (inners = &id_ic->id_subcap,
1919 	    inners->dl_length > (outers->dl_length - sizeof (*inners)))) {
1920 		cmn_err(CE_WARN, "ill_capability_id_ack: malformed "
1921 		    "encapsulated capab type %d too long for mblk",
1922 		    inners->dl_cap);
1923 		return;
1924 	}
1925 
1926 	if (!dlcapabcheckqid(&id_ic->id_mid, ill->ill_lmod_rq)) {
1927 		ip1dbg(("ill_capability_id_ack: mid token for capab type %d "
1928 		    "isn't as expected; pass-thru module(s) detected, "
1929 		    "discarding capability\n", inners->dl_cap));
1930 		return;
1931 	}
1932 
1933 	/* Process the encapsulated sub-capability */
1934 	ill_capability_dispatch(ill, mp, inners, B_TRUE);
1935 }
1936 
1937 /*
1938  * Process Multidata Transmit capability negotiation ack received from a
1939  * DLS Provider.  isub must point to the sub-capability (DL_CAPAB_MDT) of a
1940  * DL_CAPABILITY_ACK message.
1941  */
1942 static void
1943 ill_capability_mdt_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1944 {
1945 	mblk_t *nmp = NULL;
1946 	dl_capability_req_t *oc;
1947 	dl_capab_mdt_t *mdt_ic, *mdt_oc;
1948 	ill_mdt_capab_t **ill_mdt_capab;
1949 	uint_t sub_dl_cap = isub->dl_cap;
1950 	uint8_t *capend;
1951 
1952 	ASSERT(sub_dl_cap == DL_CAPAB_MDT);
1953 
1954 	ill_mdt_capab = (ill_mdt_capab_t **)&ill->ill_mdt_capab;
1955 
1956 	/*
1957 	 * Note: range checks here are not absolutely sufficient to
1958 	 * make us robust against malformed messages sent by drivers;
1959 	 * this is in keeping with the rest of IP's dlpi handling.
1960 	 * (Remember, it's coming from something else in the kernel
1961 	 * address space)
1962 	 */
1963 
1964 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1965 	if (capend > mp->b_wptr) {
1966 		cmn_err(CE_WARN, "ill_capability_mdt_ack: "
1967 		    "malformed sub-capability too long for mblk");
1968 		return;
1969 	}
1970 
1971 	mdt_ic = (dl_capab_mdt_t *)(isub + 1);
1972 
1973 	if (mdt_ic->mdt_version != MDT_VERSION_2) {
1974 		cmn_err(CE_CONT, "ill_capability_mdt_ack: "
1975 		    "unsupported MDT sub-capability (version %d, expected %d)",
1976 		    mdt_ic->mdt_version, MDT_VERSION_2);
1977 		return;
1978 	}
1979 
1980 	if (!dlcapabcheckqid(&mdt_ic->mdt_mid, ill->ill_lmod_rq)) {
1981 		ip1dbg(("ill_capability_mdt_ack: mid token for MDT "
1982 		    "capability isn't as expected; pass-thru module(s) "
1983 		    "detected, discarding capability\n"));
1984 		return;
1985 	}
1986 
1987 	if (mdt_ic->mdt_flags & DL_CAPAB_MDT_ENABLE) {
1988 
1989 		if (*ill_mdt_capab == NULL) {
1990 			*ill_mdt_capab = kmem_zalloc(sizeof (ill_mdt_capab_t),
1991 			    KM_NOSLEEP);
1992 			if (*ill_mdt_capab == NULL) {
1993 				cmn_err(CE_WARN, "ill_capability_mdt_ack: "
1994 				    "could not enable MDT version %d "
1995 				    "for %s (ENOMEM)\n", MDT_VERSION_2,
1996 				    ill->ill_name);
1997 				return;
1998 			}
1999 		}
2000 
2001 		ip1dbg(("ill_capability_mdt_ack: interface %s supports "
2002 		    "MDT version %d (%d bytes leading, %d bytes trailing "
2003 		    "header spaces, %d max pld bufs, %d span limit)\n",
2004 		    ill->ill_name, MDT_VERSION_2,
2005 		    mdt_ic->mdt_hdr_head, mdt_ic->mdt_hdr_tail,
2006 		    mdt_ic->mdt_max_pld, mdt_ic->mdt_span_limit));
2007 
2008 		(*ill_mdt_capab)->ill_mdt_version = MDT_VERSION_2;
2009 		(*ill_mdt_capab)->ill_mdt_on = 1;
2010 		/*
2011 		 * Round the following values to the nearest 32-bit; ULP
2012 		 * may further adjust them to accomodate for additional
2013 		 * protocol headers.  We pass these values to ULP during
2014 		 * bind time.
2015 		 */
2016 		(*ill_mdt_capab)->ill_mdt_hdr_head =
2017 		    roundup(mdt_ic->mdt_hdr_head, 4);
2018 		(*ill_mdt_capab)->ill_mdt_hdr_tail =
2019 		    roundup(mdt_ic->mdt_hdr_tail, 4);
2020 		(*ill_mdt_capab)->ill_mdt_max_pld = mdt_ic->mdt_max_pld;
2021 		(*ill_mdt_capab)->ill_mdt_span_limit = mdt_ic->mdt_span_limit;
2022 
2023 		ill->ill_capabilities |= ILL_CAPAB_MDT;
2024 	} else {
2025 		uint_t size;
2026 		uchar_t *rptr;
2027 
2028 		size = sizeof (dl_capability_req_t) +
2029 		    sizeof (dl_capability_sub_t) + sizeof (dl_capab_mdt_t);
2030 
2031 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2032 			cmn_err(CE_WARN, "ill_capability_mdt_ack: "
2033 			    "could not enable MDT for %s (ENOMEM)\n",
2034 			    ill->ill_name);
2035 			return;
2036 		}
2037 
2038 		rptr = nmp->b_rptr;
2039 		/* initialize dl_capability_req_t */
2040 		oc = (dl_capability_req_t *)nmp->b_rptr;
2041 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
2042 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
2043 		    sizeof (dl_capab_mdt_t);
2044 		nmp->b_rptr += sizeof (dl_capability_req_t);
2045 
2046 		/* initialize dl_capability_sub_t */
2047 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
2048 		nmp->b_rptr += sizeof (*isub);
2049 
2050 		/* initialize dl_capab_mdt_t */
2051 		mdt_oc = (dl_capab_mdt_t *)nmp->b_rptr;
2052 		bcopy(mdt_ic, mdt_oc, sizeof (*mdt_ic));
2053 
2054 		nmp->b_rptr = rptr;
2055 
2056 		ip1dbg(("ill_capability_mdt_ack: asking interface %s "
2057 		    "to enable MDT version %d\n", ill->ill_name,
2058 		    MDT_VERSION_2));
2059 
2060 		/* set ENABLE flag */
2061 		mdt_oc->mdt_flags |= DL_CAPAB_MDT_ENABLE;
2062 
2063 		/* nmp points to a DL_CAPABILITY_REQ message to enable MDT */
2064 		ill_capability_send(ill, nmp);
2065 	}
2066 }
2067 
2068 static void
2069 ill_capability_mdt_reset_fill(ill_t *ill, mblk_t *mp)
2070 {
2071 	dl_capab_mdt_t *mdt_subcap;
2072 	dl_capability_sub_t *dl_subcap;
2073 
2074 	if (!ILL_MDT_CAPABLE(ill))
2075 		return;
2076 
2077 	ASSERT(ill->ill_mdt_capab != NULL);
2078 
2079 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2080 	dl_subcap->dl_cap = DL_CAPAB_MDT;
2081 	dl_subcap->dl_length = sizeof (*mdt_subcap);
2082 
2083 	mdt_subcap = (dl_capab_mdt_t *)(dl_subcap + 1);
2084 	mdt_subcap->mdt_version = ill->ill_mdt_capab->ill_mdt_version;
2085 	mdt_subcap->mdt_flags = 0;
2086 	mdt_subcap->mdt_hdr_head = 0;
2087 	mdt_subcap->mdt_hdr_tail = 0;
2088 
2089 	mp->b_wptr += sizeof (*dl_subcap) + sizeof (*mdt_subcap);
2090 }
2091 
2092 static void
2093 ill_capability_dld_reset_fill(ill_t *ill, mblk_t *mp)
2094 {
2095 	dl_capability_sub_t *dl_subcap;
2096 
2097 	if (!(ill->ill_capabilities & ILL_CAPAB_DLD))
2098 		return;
2099 
2100 	/*
2101 	 * The dl_capab_dld_t that follows the dl_capability_sub_t is not
2102 	 * initialized below since it is not used by DLD.
2103 	 */
2104 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2105 	dl_subcap->dl_cap = DL_CAPAB_DLD;
2106 	dl_subcap->dl_length = sizeof (dl_capab_dld_t);
2107 
2108 	mp->b_wptr += sizeof (dl_capability_sub_t) + sizeof (dl_capab_dld_t);
2109 }
2110 
2111 /*
2112  * Send a DL_NOTIFY_REQ to the specified ill to enable
2113  * DL_NOTE_PROMISC_ON/OFF_PHYS notifications.
2114  * Invoked by ill_capability_ipsec_ack() before enabling IPsec hardware
2115  * acceleration.
2116  * Returns B_TRUE on success, B_FALSE if the message could not be sent.
2117  */
2118 static boolean_t
2119 ill_enable_promisc_notify(ill_t *ill)
2120 {
2121 	mblk_t *mp;
2122 	dl_notify_req_t *req;
2123 
2124 	IPSECHW_DEBUG(IPSECHW_PKT, ("ill_enable_promisc_notify:\n"));
2125 
2126 	mp = ip_dlpi_alloc(sizeof (dl_notify_req_t), DL_NOTIFY_REQ);
2127 	if (mp == NULL)
2128 		return (B_FALSE);
2129 
2130 	req = (dl_notify_req_t *)mp->b_rptr;
2131 	req->dl_notifications = DL_NOTE_PROMISC_ON_PHYS |
2132 	    DL_NOTE_PROMISC_OFF_PHYS;
2133 
2134 	ill_dlpi_send(ill, mp);
2135 
2136 	return (B_TRUE);
2137 }
2138 
2139 /*
2140  * Allocate an IPsec capability request which will be filled by our
2141  * caller to turn on support for one or more algorithms.
2142  */
2143 static mblk_t *
2144 ill_alloc_ipsec_cap_req(ill_t *ill, dl_capability_sub_t *isub)
2145 {
2146 	mblk_t *nmp;
2147 	dl_capability_req_t	*ocap;
2148 	dl_capab_ipsec_t	*ocip;
2149 	dl_capab_ipsec_t	*icip;
2150 	uint8_t			*ptr;
2151 	icip = (dl_capab_ipsec_t *)(isub + 1);
2152 
2153 	/*
2154 	 * The first time around, we send a DL_NOTIFY_REQ to enable
2155 	 * PROMISC_ON/OFF notification from the provider. We need to
2156 	 * do this before enabling the algorithms to avoid leakage of
2157 	 * cleartext packets.
2158 	 */
2159 
2160 	if (!ill_enable_promisc_notify(ill))
2161 		return (NULL);
2162 
2163 	/*
2164 	 * Allocate new mblk which will contain a new capability
2165 	 * request to enable the capabilities.
2166 	 */
2167 
2168 	nmp = ip_dlpi_alloc(sizeof (dl_capability_req_t) +
2169 	    sizeof (dl_capability_sub_t) + isub->dl_length, DL_CAPABILITY_REQ);
2170 	if (nmp == NULL)
2171 		return (NULL);
2172 
2173 	ptr = nmp->b_rptr;
2174 
2175 	/* initialize dl_capability_req_t */
2176 	ocap = (dl_capability_req_t *)ptr;
2177 	ocap->dl_sub_offset = sizeof (dl_capability_req_t);
2178 	ocap->dl_sub_length = sizeof (dl_capability_sub_t) + isub->dl_length;
2179 	ptr += sizeof (dl_capability_req_t);
2180 
2181 	/* initialize dl_capability_sub_t */
2182 	bcopy(isub, ptr, sizeof (*isub));
2183 	ptr += sizeof (*isub);
2184 
2185 	/* initialize dl_capab_ipsec_t */
2186 	ocip = (dl_capab_ipsec_t *)ptr;
2187 	bcopy(icip, ocip, sizeof (*icip));
2188 
2189 	nmp->b_wptr = (uchar_t *)(&ocip->cip_data[0]);
2190 	return (nmp);
2191 }
2192 
2193 /*
2194  * Process an IPsec capability negotiation ack received from a DLS Provider.
2195  * isub must point to the sub-capability (DL_CAPAB_IPSEC_AH or
2196  * DL_CAPAB_IPSEC_ESP) of a DL_CAPABILITY_ACK message.
2197  */
2198 static void
2199 ill_capability_ipsec_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2200 {
2201 	dl_capab_ipsec_t	*icip;
2202 	dl_capab_ipsec_alg_t	*ialg;	/* ptr to input alg spec. */
2203 	dl_capab_ipsec_alg_t	*oalg;	/* ptr to output alg spec. */
2204 	uint_t cipher, nciphers;
2205 	mblk_t *nmp;
2206 	uint_t alg_len;
2207 	boolean_t need_sadb_dump;
2208 	uint_t sub_dl_cap = isub->dl_cap;
2209 	ill_ipsec_capab_t **ill_capab;
2210 	uint64_t ill_capab_flag;
2211 	uint8_t *capend, *ciphend;
2212 	boolean_t sadb_resync;
2213 
2214 	ASSERT(sub_dl_cap == DL_CAPAB_IPSEC_AH ||
2215 	    sub_dl_cap == DL_CAPAB_IPSEC_ESP);
2216 
2217 	if (sub_dl_cap == DL_CAPAB_IPSEC_AH) {
2218 		ill_capab = (ill_ipsec_capab_t **)&ill->ill_ipsec_capab_ah;
2219 		ill_capab_flag = ILL_CAPAB_AH;
2220 	} else {
2221 		ill_capab = (ill_ipsec_capab_t **)&ill->ill_ipsec_capab_esp;
2222 		ill_capab_flag = ILL_CAPAB_ESP;
2223 	}
2224 
2225 	/*
2226 	 * If the ill capability structure exists, then this incoming
2227 	 * DL_CAPABILITY_ACK is a response to a "renegotiation" cycle.
2228 	 * If this is so, then we'd need to resynchronize the SADB
2229 	 * after re-enabling the offloaded ciphers.
2230 	 */
2231 	sadb_resync = (*ill_capab != NULL);
2232 
2233 	/*
2234 	 * Note: range checks here are not absolutely sufficient to
2235 	 * make us robust against malformed messages sent by drivers;
2236 	 * this is in keeping with the rest of IP's dlpi handling.
2237 	 * (Remember, it's coming from something else in the kernel
2238 	 * address space)
2239 	 */
2240 
2241 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2242 	if (capend > mp->b_wptr) {
2243 		cmn_err(CE_WARN, "ill_capability_ipsec_ack: "
2244 		    "malformed sub-capability too long for mblk");
2245 		return;
2246 	}
2247 
2248 	/*
2249 	 * There are two types of acks we process here:
2250 	 * 1. acks in reply to a (first form) generic capability req
2251 	 *    (no ENABLE flag set)
2252 	 * 2. acks in reply to a ENABLE capability req.
2253 	 *    (ENABLE flag set)
2254 	 *
2255 	 * We process the subcapability passed as argument as follows:
2256 	 * 1 do initializations
2257 	 *   1.1 initialize nmp = NULL
2258 	 *   1.2 set need_sadb_dump to B_FALSE
2259 	 * 2 for each cipher in subcapability:
2260 	 *   2.1 if ENABLE flag is set:
2261 	 *	2.1.1 update per-ill ipsec capabilities info
2262 	 *	2.1.2 set need_sadb_dump to B_TRUE
2263 	 *   2.2 if ENABLE flag is not set:
2264 	 *	2.2.1 if nmp is NULL:
2265 	 *		2.2.1.1 allocate and initialize nmp
2266 	 *		2.2.1.2 init current pos in nmp
2267 	 *	2.2.2 copy current cipher to current pos in nmp
2268 	 *	2.2.3 set ENABLE flag in nmp
2269 	 *	2.2.4 update current pos
2270 	 * 3 if nmp is not equal to NULL, send enable request
2271 	 *   3.1 send capability request
2272 	 * 4 if need_sadb_dump is B_TRUE
2273 	 *   4.1 enable promiscuous on/off notifications
2274 	 *   4.2 call ill_dlpi_send(isub->dlcap) to send all
2275 	 *	AH or ESP SA's to interface.
2276 	 */
2277 
2278 	nmp = NULL;
2279 	oalg = NULL;
2280 	need_sadb_dump = B_FALSE;
2281 	icip = (dl_capab_ipsec_t *)(isub + 1);
2282 	ialg = (dl_capab_ipsec_alg_t *)(&icip->cip_data[0]);
2283 
2284 	nciphers = icip->cip_nciphers;
2285 	ciphend = (uint8_t *)(ialg + icip->cip_nciphers);
2286 
2287 	if (ciphend > capend) {
2288 		cmn_err(CE_WARN, "ill_capability_ipsec_ack: "
2289 		    "too many ciphers for sub-capability len");
2290 		return;
2291 	}
2292 
2293 	for (cipher = 0; cipher < nciphers; cipher++) {
2294 		alg_len = sizeof (dl_capab_ipsec_alg_t);
2295 
2296 		if (ialg->alg_flag & DL_CAPAB_ALG_ENABLE) {
2297 			/*
2298 			 * TBD: when we provide a way to disable capabilities
2299 			 * from above, need to manage the request-pending state
2300 			 * and fail if we were not expecting this ACK.
2301 			 */
2302 			IPSECHW_DEBUG(IPSECHW_CAPAB,
2303 			    ("ill_capability_ipsec_ack: got ENABLE ACK\n"));
2304 
2305 			/*
2306 			 * Update IPsec capabilities for this ill
2307 			 */
2308 
2309 			if (*ill_capab == NULL) {
2310 				IPSECHW_DEBUG(IPSECHW_CAPAB,
2311 				    ("ill_capability_ipsec_ack: "
2312 				    "allocating ipsec_capab for ill\n"));
2313 				*ill_capab = ill_ipsec_capab_alloc();
2314 
2315 				if (*ill_capab == NULL) {
2316 					cmn_err(CE_WARN,
2317 					    "ill_capability_ipsec_ack: "
2318 					    "could not enable IPsec Hardware "
2319 					    "acceleration for %s (ENOMEM)\n",
2320 					    ill->ill_name);
2321 					return;
2322 				}
2323 			}
2324 
2325 			ASSERT(ialg->alg_type == DL_CAPAB_IPSEC_ALG_AUTH ||
2326 			    ialg->alg_type == DL_CAPAB_IPSEC_ALG_ENCR);
2327 
2328 			if (ialg->alg_prim >= MAX_IPSEC_ALGS) {
2329 				cmn_err(CE_WARN,
2330 				    "ill_capability_ipsec_ack: "
2331 				    "malformed IPsec algorithm id %d",
2332 				    ialg->alg_prim);
2333 				continue;
2334 			}
2335 
2336 			if (ialg->alg_type == DL_CAPAB_IPSEC_ALG_AUTH) {
2337 				IPSEC_ALG_ENABLE((*ill_capab)->auth_hw_algs,
2338 				    ialg->alg_prim);
2339 			} else {
2340 				ipsec_capab_algparm_t *alp;
2341 
2342 				IPSEC_ALG_ENABLE((*ill_capab)->encr_hw_algs,
2343 				    ialg->alg_prim);
2344 				if (!ill_ipsec_capab_resize_algparm(*ill_capab,
2345 				    ialg->alg_prim)) {
2346 					cmn_err(CE_WARN,
2347 					    "ill_capability_ipsec_ack: "
2348 					    "no space for IPsec alg id %d",
2349 					    ialg->alg_prim);
2350 					continue;
2351 				}
2352 				alp = &((*ill_capab)->encr_algparm[
2353 				    ialg->alg_prim]);
2354 				alp->minkeylen = ialg->alg_minbits;
2355 				alp->maxkeylen = ialg->alg_maxbits;
2356 			}
2357 			ill->ill_capabilities |= ill_capab_flag;
2358 			/*
2359 			 * indicate that a capability was enabled, which
2360 			 * will be used below to kick off a SADB dump
2361 			 * to the ill.
2362 			 */
2363 			need_sadb_dump = B_TRUE;
2364 		} else {
2365 			IPSECHW_DEBUG(IPSECHW_CAPAB,
2366 			    ("ill_capability_ipsec_ack: enabling alg 0x%x\n",
2367 			    ialg->alg_prim));
2368 
2369 			if (nmp == NULL) {
2370 				nmp = ill_alloc_ipsec_cap_req(ill, isub);
2371 				if (nmp == NULL) {
2372 					/*
2373 					 * Sending the PROMISC_ON/OFF
2374 					 * notification request failed.
2375 					 * We cannot enable the algorithms
2376 					 * since the Provider will not
2377 					 * notify IP of promiscous mode
2378 					 * changes, which could lead
2379 					 * to leakage of packets.
2380 					 */
2381 					cmn_err(CE_WARN,
2382 					    "ill_capability_ipsec_ack: "
2383 					    "could not enable IPsec Hardware "
2384 					    "acceleration for %s (ENOMEM)\n",
2385 					    ill->ill_name);
2386 					return;
2387 				}
2388 				/* ptr to current output alg specifier */
2389 				oalg = (dl_capab_ipsec_alg_t *)nmp->b_wptr;
2390 			}
2391 
2392 			/*
2393 			 * Copy current alg specifier, set ENABLE
2394 			 * flag, and advance to next output alg.
2395 			 * For now we enable all IPsec capabilities.
2396 			 */
2397 			ASSERT(oalg != NULL);
2398 			bcopy(ialg, oalg, alg_len);
2399 			oalg->alg_flag |= DL_CAPAB_ALG_ENABLE;
2400 			nmp->b_wptr += alg_len;
2401 			oalg = (dl_capab_ipsec_alg_t *)nmp->b_wptr;
2402 		}
2403 
2404 		/* move to next input algorithm specifier */
2405 		ialg = (dl_capab_ipsec_alg_t *)
2406 		    ((char *)ialg + alg_len);
2407 	}
2408 
2409 	if (nmp != NULL)
2410 		/*
2411 		 * nmp points to a DL_CAPABILITY_REQ message to enable
2412 		 * IPsec hardware acceleration.
2413 		 */
2414 		ill_capability_send(ill, nmp);
2415 
2416 	if (need_sadb_dump)
2417 		/*
2418 		 * An acknowledgement corresponding to a request to
2419 		 * enable acceleration was received, notify SADB.
2420 		 */
2421 		ill_ipsec_capab_add(ill, sub_dl_cap, sadb_resync);
2422 }
2423 
2424 /*
2425  * Given an mblk with enough space in it, create sub-capability entries for
2426  * DL_CAPAB_IPSEC_{AH,ESP} types which consist of previously-advertised
2427  * offloaded ciphers (both AUTH and ENCR) with their enable flags cleared,
2428  * in preparation for the reset the DL_CAPABILITY_REQ message.
2429  */
2430 static void
2431 ill_fill_ipsec_reset(uint_t nciphers, int stype, uint_t slen,
2432     ill_ipsec_capab_t *ill_cap, mblk_t *mp)
2433 {
2434 	dl_capab_ipsec_t *oipsec;
2435 	dl_capab_ipsec_alg_t *oalg;
2436 	dl_capability_sub_t *dl_subcap;
2437 	int i, k;
2438 
2439 	ASSERT(nciphers > 0);
2440 	ASSERT(ill_cap != NULL);
2441 	ASSERT(mp != NULL);
2442 	ASSERT(MBLKTAIL(mp) >= sizeof (*dl_subcap) + sizeof (*oipsec) + slen);
2443 
2444 	/* dl_capability_sub_t for "stype" */
2445 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2446 	dl_subcap->dl_cap = stype;
2447 	dl_subcap->dl_length = sizeof (dl_capab_ipsec_t) + slen;
2448 	mp->b_wptr += sizeof (dl_capability_sub_t);
2449 
2450 	/* dl_capab_ipsec_t for "stype" */
2451 	oipsec = (dl_capab_ipsec_t *)mp->b_wptr;
2452 	oipsec->cip_version = 1;
2453 	oipsec->cip_nciphers = nciphers;
2454 	mp->b_wptr = (uchar_t *)&oipsec->cip_data[0];
2455 
2456 	/* create entries for "stype" AUTH ciphers */
2457 	for (i = 0; i < ill_cap->algs_size; i++) {
2458 		for (k = 0; k < BITSPERBYTE; k++) {
2459 			if ((ill_cap->auth_hw_algs[i] & (1 << k)) == 0)
2460 				continue;
2461 
2462 			oalg = (dl_capab_ipsec_alg_t *)mp->b_wptr;
2463 			bzero((void *)oalg, sizeof (*oalg));
2464 			oalg->alg_type = DL_CAPAB_IPSEC_ALG_AUTH;
2465 			oalg->alg_prim = k + (BITSPERBYTE * i);
2466 			mp->b_wptr += sizeof (dl_capab_ipsec_alg_t);
2467 		}
2468 	}
2469 	/* create entries for "stype" ENCR ciphers */
2470 	for (i = 0; i < ill_cap->algs_size; i++) {
2471 		for (k = 0; k < BITSPERBYTE; k++) {
2472 			if ((ill_cap->encr_hw_algs[i] & (1 << k)) == 0)
2473 				continue;
2474 
2475 			oalg = (dl_capab_ipsec_alg_t *)mp->b_wptr;
2476 			bzero((void *)oalg, sizeof (*oalg));
2477 			oalg->alg_type = DL_CAPAB_IPSEC_ALG_ENCR;
2478 			oalg->alg_prim = k + (BITSPERBYTE * i);
2479 			mp->b_wptr += sizeof (dl_capab_ipsec_alg_t);
2480 		}
2481 	}
2482 }
2483 
2484 /*
2485  * Macro to count number of 1s in a byte (8-bit word).  The total count is
2486  * accumulated into the passed-in argument (sum).  We could use SPARCv9's
2487  * POPC instruction, but our macro is more flexible for an arbitrary length
2488  * of bytes, such as {auth,encr}_hw_algs.  These variables are currently
2489  * 256-bits long (MAX_IPSEC_ALGS), so if we know for sure that the length
2490  * stays that way, we can reduce the number of iterations required.
2491  */
2492 #define	COUNT_1S(val, sum) {					\
2493 	uint8_t x = val & 0xff;					\
2494 	x = (x & 0x55) + ((x >> 1) & 0x55);			\
2495 	x = (x & 0x33) + ((x >> 2) & 0x33);			\
2496 	sum += (x & 0xf) + ((x >> 4) & 0xf);			\
2497 }
2498 
2499 /* ARGSUSED */
2500 static int
2501 ill_capability_ipsec_reset_size(ill_t *ill, int *ah_cntp, int *ah_lenp,
2502     int *esp_cntp, int *esp_lenp)
2503 {
2504 	ill_ipsec_capab_t *cap_ah = ill->ill_ipsec_capab_ah;
2505 	ill_ipsec_capab_t *cap_esp = ill->ill_ipsec_capab_esp;
2506 	uint64_t ill_capabilities = ill->ill_capabilities;
2507 	int ah_cnt = 0, esp_cnt = 0;
2508 	int ah_len = 0, esp_len = 0;
2509 	int i, size = 0;
2510 
2511 	if (!(ill_capabilities & (ILL_CAPAB_AH | ILL_CAPAB_ESP)))
2512 		return (0);
2513 
2514 	ASSERT(cap_ah != NULL || !(ill_capabilities & ILL_CAPAB_AH));
2515 	ASSERT(cap_esp != NULL || !(ill_capabilities & ILL_CAPAB_ESP));
2516 
2517 	/* Find out the number of ciphers for AH */
2518 	if (cap_ah != NULL) {
2519 		for (i = 0; i < cap_ah->algs_size; i++) {
2520 			COUNT_1S(cap_ah->auth_hw_algs[i], ah_cnt);
2521 			COUNT_1S(cap_ah->encr_hw_algs[i], ah_cnt);
2522 		}
2523 		if (ah_cnt > 0) {
2524 			size += sizeof (dl_capability_sub_t) +
2525 			    sizeof (dl_capab_ipsec_t);
2526 			/* dl_capab_ipsec_t contains one dl_capab_ipsec_alg_t */
2527 			ah_len = (ah_cnt - 1) * sizeof (dl_capab_ipsec_alg_t);
2528 			size += ah_len;
2529 		}
2530 	}
2531 
2532 	/* Find out the number of ciphers for ESP */
2533 	if (cap_esp != NULL) {
2534 		for (i = 0; i < cap_esp->algs_size; i++) {
2535 			COUNT_1S(cap_esp->auth_hw_algs[i], esp_cnt);
2536 			COUNT_1S(cap_esp->encr_hw_algs[i], esp_cnt);
2537 		}
2538 		if (esp_cnt > 0) {
2539 			size += sizeof (dl_capability_sub_t) +
2540 			    sizeof (dl_capab_ipsec_t);
2541 			/* dl_capab_ipsec_t contains one dl_capab_ipsec_alg_t */
2542 			esp_len = (esp_cnt - 1) * sizeof (dl_capab_ipsec_alg_t);
2543 			size += esp_len;
2544 		}
2545 	}
2546 
2547 	if (ah_cntp != NULL)
2548 		*ah_cntp = ah_cnt;
2549 	if (ah_lenp != NULL)
2550 		*ah_lenp = ah_len;
2551 	if (esp_cntp != NULL)
2552 		*esp_cntp = esp_cnt;
2553 	if (esp_lenp != NULL)
2554 		*esp_lenp = esp_len;
2555 
2556 	return (size);
2557 }
2558 
2559 /* ARGSUSED */
2560 static void
2561 ill_capability_ipsec_reset_fill(ill_t *ill, mblk_t *mp)
2562 {
2563 	ill_ipsec_capab_t *cap_ah = ill->ill_ipsec_capab_ah;
2564 	ill_ipsec_capab_t *cap_esp = ill->ill_ipsec_capab_esp;
2565 	int ah_cnt = 0, esp_cnt = 0;
2566 	int ah_len = 0, esp_len = 0;
2567 	int size;
2568 
2569 	size = ill_capability_ipsec_reset_size(ill, &ah_cnt, &ah_len,
2570 	    &esp_cnt, &esp_len);
2571 	if (size == 0)
2572 		return;
2573 
2574 	/*
2575 	 * Clear the capability flags for IPsec HA but retain the ill
2576 	 * capability structures since it's possible that another thread
2577 	 * is still referring to them.  The structures only get deallocated
2578 	 * when we destroy the ill.
2579 	 *
2580 	 * Various places check the flags to see if the ill is capable of
2581 	 * hardware acceleration, and by clearing them we ensure that new
2582 	 * outbound IPsec packets are sent down encrypted.
2583 	 */
2584 
2585 	/* Fill in DL_CAPAB_IPSEC_AH sub-capability entries */
2586 	if (ah_cnt > 0) {
2587 		ill_fill_ipsec_reset(ah_cnt, DL_CAPAB_IPSEC_AH, ah_len,
2588 		    cap_ah, mp);
2589 	}
2590 
2591 	/* Fill in DL_CAPAB_IPSEC_ESP sub-capability entries */
2592 	if (esp_cnt > 0) {
2593 		ill_fill_ipsec_reset(esp_cnt, DL_CAPAB_IPSEC_ESP, esp_len,
2594 		    cap_esp, mp);
2595 	}
2596 
2597 	/*
2598 	 * At this point we've composed a bunch of sub-capabilities to be
2599 	 * encapsulated in a DL_CAPABILITY_REQ and later sent downstream
2600 	 * by the caller.  Upon receiving this reset message, the driver
2601 	 * must stop inbound decryption (by destroying all inbound SAs)
2602 	 * and let the corresponding packets come in encrypted.
2603 	 */
2604 }
2605 
2606 static void
2607 ill_capability_dispatch(ill_t *ill, mblk_t *mp, dl_capability_sub_t *subp,
2608     boolean_t encapsulated)
2609 {
2610 	boolean_t legacy = B_FALSE;
2611 
2612 	/*
2613 	 * Note that only the following two sub-capabilities may be
2614 	 * considered as "legacy", since their original definitions
2615 	 * do not incorporate the dl_mid_t module ID token, and hence
2616 	 * may require the use of the wrapper sub-capability.
2617 	 */
2618 	switch (subp->dl_cap) {
2619 	case DL_CAPAB_IPSEC_AH:
2620 	case DL_CAPAB_IPSEC_ESP:
2621 		legacy = B_TRUE;
2622 		break;
2623 	}
2624 
2625 	/*
2626 	 * For legacy sub-capabilities which don't incorporate a queue_t
2627 	 * pointer in their structures, discard them if we detect that
2628 	 * there are intermediate modules in between IP and the driver.
2629 	 */
2630 	if (!encapsulated && legacy && ill->ill_lmod_cnt > 1) {
2631 		ip1dbg(("ill_capability_dispatch: unencapsulated capab type "
2632 		    "%d discarded; %d module(s) present below IP\n",
2633 		    subp->dl_cap, ill->ill_lmod_cnt));
2634 		return;
2635 	}
2636 
2637 	switch (subp->dl_cap) {
2638 	case DL_CAPAB_IPSEC_AH:
2639 	case DL_CAPAB_IPSEC_ESP:
2640 		ill_capability_ipsec_ack(ill, mp, subp);
2641 		break;
2642 	case DL_CAPAB_MDT:
2643 		ill_capability_mdt_ack(ill, mp, subp);
2644 		break;
2645 	case DL_CAPAB_HCKSUM:
2646 		ill_capability_hcksum_ack(ill, mp, subp);
2647 		break;
2648 	case DL_CAPAB_ZEROCOPY:
2649 		ill_capability_zerocopy_ack(ill, mp, subp);
2650 		break;
2651 	case DL_CAPAB_DLD:
2652 		ill_capability_dld_ack(ill, mp, subp);
2653 		break;
2654 	default:
2655 		ip1dbg(("ill_capability_dispatch: unknown capab type %d\n",
2656 		    subp->dl_cap));
2657 	}
2658 }
2659 
2660 /*
2661  * Process a hardware checksum offload capability negotiation ack received
2662  * from a DLS Provider.isub must point to the sub-capability (DL_CAPAB_HCKSUM)
2663  * of a DL_CAPABILITY_ACK message.
2664  */
2665 static void
2666 ill_capability_hcksum_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2667 {
2668 	dl_capability_req_t	*ocap;
2669 	dl_capab_hcksum_t	*ihck, *ohck;
2670 	ill_hcksum_capab_t	**ill_hcksum;
2671 	mblk_t			*nmp = NULL;
2672 	uint_t			sub_dl_cap = isub->dl_cap;
2673 	uint8_t			*capend;
2674 
2675 	ASSERT(sub_dl_cap == DL_CAPAB_HCKSUM);
2676 
2677 	ill_hcksum = (ill_hcksum_capab_t **)&ill->ill_hcksum_capab;
2678 
2679 	/*
2680 	 * Note: range checks here are not absolutely sufficient to
2681 	 * make us robust against malformed messages sent by drivers;
2682 	 * this is in keeping with the rest of IP's dlpi handling.
2683 	 * (Remember, it's coming from something else in the kernel
2684 	 * address space)
2685 	 */
2686 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2687 	if (capend > mp->b_wptr) {
2688 		cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
2689 		    "malformed sub-capability too long for mblk");
2690 		return;
2691 	}
2692 
2693 	/*
2694 	 * There are two types of acks we process here:
2695 	 * 1. acks in reply to a (first form) generic capability req
2696 	 *    (no ENABLE flag set)
2697 	 * 2. acks in reply to a ENABLE capability req.
2698 	 *    (ENABLE flag set)
2699 	 */
2700 	ihck = (dl_capab_hcksum_t *)(isub + 1);
2701 
2702 	if (ihck->hcksum_version != HCKSUM_VERSION_1) {
2703 		cmn_err(CE_CONT, "ill_capability_hcksum_ack: "
2704 		    "unsupported hardware checksum "
2705 		    "sub-capability (version %d, expected %d)",
2706 		    ihck->hcksum_version, HCKSUM_VERSION_1);
2707 		return;
2708 	}
2709 
2710 	if (!dlcapabcheckqid(&ihck->hcksum_mid, ill->ill_lmod_rq)) {
2711 		ip1dbg(("ill_capability_hcksum_ack: mid token for hardware "
2712 		    "checksum capability isn't as expected; pass-thru "
2713 		    "module(s) detected, discarding capability\n"));
2714 		return;
2715 	}
2716 
2717 #define	CURR_HCKSUM_CAPAB				\
2718 	(HCKSUM_INET_PARTIAL | HCKSUM_INET_FULL_V4 |	\
2719 	HCKSUM_INET_FULL_V6 | HCKSUM_IPHDRCKSUM)
2720 
2721 	if ((ihck->hcksum_txflags & HCKSUM_ENABLE) &&
2722 	    (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB)) {
2723 		/* do ENABLE processing */
2724 		if (*ill_hcksum == NULL) {
2725 			*ill_hcksum = kmem_zalloc(sizeof (ill_hcksum_capab_t),
2726 			    KM_NOSLEEP);
2727 
2728 			if (*ill_hcksum == NULL) {
2729 				cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
2730 				    "could not enable hcksum version %d "
2731 				    "for %s (ENOMEM)\n", HCKSUM_CURRENT_VERSION,
2732 				    ill->ill_name);
2733 				return;
2734 			}
2735 		}
2736 
2737 		(*ill_hcksum)->ill_hcksum_version = ihck->hcksum_version;
2738 		(*ill_hcksum)->ill_hcksum_txflags = ihck->hcksum_txflags;
2739 		ill->ill_capabilities |= ILL_CAPAB_HCKSUM;
2740 		ip1dbg(("ill_capability_hcksum_ack: interface %s "
2741 		    "has enabled hardware checksumming\n ",
2742 		    ill->ill_name));
2743 	} else if (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB) {
2744 		/*
2745 		 * Enabling hardware checksum offload
2746 		 * Currently IP supports {TCP,UDP}/IPv4
2747 		 * partial and full cksum offload and
2748 		 * IPv4 header checksum offload.
2749 		 * Allocate new mblk which will
2750 		 * contain a new capability request
2751 		 * to enable hardware checksum offload.
2752 		 */
2753 		uint_t	size;
2754 		uchar_t	*rptr;
2755 
2756 		size = sizeof (dl_capability_req_t) +
2757 		    sizeof (dl_capability_sub_t) + isub->dl_length;
2758 
2759 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2760 			cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
2761 			    "could not enable hardware cksum for %s (ENOMEM)\n",
2762 			    ill->ill_name);
2763 			return;
2764 		}
2765 
2766 		rptr = nmp->b_rptr;
2767 		/* initialize dl_capability_req_t */
2768 		ocap = (dl_capability_req_t *)nmp->b_rptr;
2769 		ocap->dl_sub_offset =
2770 		    sizeof (dl_capability_req_t);
2771 		ocap->dl_sub_length =
2772 		    sizeof (dl_capability_sub_t) +
2773 		    isub->dl_length;
2774 		nmp->b_rptr += sizeof (dl_capability_req_t);
2775 
2776 		/* initialize dl_capability_sub_t */
2777 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
2778 		nmp->b_rptr += sizeof (*isub);
2779 
2780 		/* initialize dl_capab_hcksum_t */
2781 		ohck = (dl_capab_hcksum_t *)nmp->b_rptr;
2782 		bcopy(ihck, ohck, sizeof (*ihck));
2783 
2784 		nmp->b_rptr = rptr;
2785 		ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
2786 
2787 		/* Set ENABLE flag */
2788 		ohck->hcksum_txflags &= CURR_HCKSUM_CAPAB;
2789 		ohck->hcksum_txflags |= HCKSUM_ENABLE;
2790 
2791 		/*
2792 		 * nmp points to a DL_CAPABILITY_REQ message to enable
2793 		 * hardware checksum acceleration.
2794 		 */
2795 		ill_capability_send(ill, nmp);
2796 	} else {
2797 		ip1dbg(("ill_capability_hcksum_ack: interface %s has "
2798 		    "advertised %x hardware checksum capability flags\n",
2799 		    ill->ill_name, ihck->hcksum_txflags));
2800 	}
2801 }
2802 
2803 static void
2804 ill_capability_hcksum_reset_fill(ill_t *ill, mblk_t *mp)
2805 {
2806 	dl_capab_hcksum_t *hck_subcap;
2807 	dl_capability_sub_t *dl_subcap;
2808 
2809 	if (!ILL_HCKSUM_CAPABLE(ill))
2810 		return;
2811 
2812 	ASSERT(ill->ill_hcksum_capab != NULL);
2813 
2814 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2815 	dl_subcap->dl_cap = DL_CAPAB_HCKSUM;
2816 	dl_subcap->dl_length = sizeof (*hck_subcap);
2817 
2818 	hck_subcap = (dl_capab_hcksum_t *)(dl_subcap + 1);
2819 	hck_subcap->hcksum_version = ill->ill_hcksum_capab->ill_hcksum_version;
2820 	hck_subcap->hcksum_txflags = 0;
2821 
2822 	mp->b_wptr += sizeof (*dl_subcap) + sizeof (*hck_subcap);
2823 }
2824 
2825 static void
2826 ill_capability_zerocopy_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2827 {
2828 	mblk_t *nmp = NULL;
2829 	dl_capability_req_t *oc;
2830 	dl_capab_zerocopy_t *zc_ic, *zc_oc;
2831 	ill_zerocopy_capab_t **ill_zerocopy_capab;
2832 	uint_t sub_dl_cap = isub->dl_cap;
2833 	uint8_t *capend;
2834 
2835 	ASSERT(sub_dl_cap == DL_CAPAB_ZEROCOPY);
2836 
2837 	ill_zerocopy_capab = (ill_zerocopy_capab_t **)&ill->ill_zerocopy_capab;
2838 
2839 	/*
2840 	 * Note: range checks here are not absolutely sufficient to
2841 	 * make us robust against malformed messages sent by drivers;
2842 	 * this is in keeping with the rest of IP's dlpi handling.
2843 	 * (Remember, it's coming from something else in the kernel
2844 	 * address space)
2845 	 */
2846 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2847 	if (capend > mp->b_wptr) {
2848 		cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
2849 		    "malformed sub-capability too long for mblk");
2850 		return;
2851 	}
2852 
2853 	zc_ic = (dl_capab_zerocopy_t *)(isub + 1);
2854 	if (zc_ic->zerocopy_version != ZEROCOPY_VERSION_1) {
2855 		cmn_err(CE_CONT, "ill_capability_zerocopy_ack: "
2856 		    "unsupported ZEROCOPY sub-capability (version %d, "
2857 		    "expected %d)", zc_ic->zerocopy_version,
2858 		    ZEROCOPY_VERSION_1);
2859 		return;
2860 	}
2861 
2862 	if (!dlcapabcheckqid(&zc_ic->zerocopy_mid, ill->ill_lmod_rq)) {
2863 		ip1dbg(("ill_capability_zerocopy_ack: mid token for zerocopy "
2864 		    "capability isn't as expected; pass-thru module(s) "
2865 		    "detected, discarding capability\n"));
2866 		return;
2867 	}
2868 
2869 	if ((zc_ic->zerocopy_flags & DL_CAPAB_VMSAFE_MEM) != 0) {
2870 		if (*ill_zerocopy_capab == NULL) {
2871 			*ill_zerocopy_capab =
2872 			    kmem_zalloc(sizeof (ill_zerocopy_capab_t),
2873 			    KM_NOSLEEP);
2874 
2875 			if (*ill_zerocopy_capab == NULL) {
2876 				cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
2877 				    "could not enable Zero-copy version %d "
2878 				    "for %s (ENOMEM)\n", ZEROCOPY_VERSION_1,
2879 				    ill->ill_name);
2880 				return;
2881 			}
2882 		}
2883 
2884 		ip1dbg(("ill_capability_zerocopy_ack: interface %s "
2885 		    "supports Zero-copy version %d\n", ill->ill_name,
2886 		    ZEROCOPY_VERSION_1));
2887 
2888 		(*ill_zerocopy_capab)->ill_zerocopy_version =
2889 		    zc_ic->zerocopy_version;
2890 		(*ill_zerocopy_capab)->ill_zerocopy_flags =
2891 		    zc_ic->zerocopy_flags;
2892 
2893 		ill->ill_capabilities |= ILL_CAPAB_ZEROCOPY;
2894 	} else {
2895 		uint_t size;
2896 		uchar_t *rptr;
2897 
2898 		size = sizeof (dl_capability_req_t) +
2899 		    sizeof (dl_capability_sub_t) +
2900 		    sizeof (dl_capab_zerocopy_t);
2901 
2902 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2903 			cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
2904 			    "could not enable zerocopy for %s (ENOMEM)\n",
2905 			    ill->ill_name);
2906 			return;
2907 		}
2908 
2909 		rptr = nmp->b_rptr;
2910 		/* initialize dl_capability_req_t */
2911 		oc = (dl_capability_req_t *)rptr;
2912 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
2913 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
2914 		    sizeof (dl_capab_zerocopy_t);
2915 		rptr += sizeof (dl_capability_req_t);
2916 
2917 		/* initialize dl_capability_sub_t */
2918 		bcopy(isub, rptr, sizeof (*isub));
2919 		rptr += sizeof (*isub);
2920 
2921 		/* initialize dl_capab_zerocopy_t */
2922 		zc_oc = (dl_capab_zerocopy_t *)rptr;
2923 		*zc_oc = *zc_ic;
2924 
2925 		ip1dbg(("ill_capability_zerocopy_ack: asking interface %s "
2926 		    "to enable zero-copy version %d\n", ill->ill_name,
2927 		    ZEROCOPY_VERSION_1));
2928 
2929 		/* set VMSAFE_MEM flag */
2930 		zc_oc->zerocopy_flags |= DL_CAPAB_VMSAFE_MEM;
2931 
2932 		/* nmp points to a DL_CAPABILITY_REQ message to enable zcopy */
2933 		ill_capability_send(ill, nmp);
2934 	}
2935 }
2936 
2937 static void
2938 ill_capability_zerocopy_reset_fill(ill_t *ill, mblk_t *mp)
2939 {
2940 	dl_capab_zerocopy_t *zerocopy_subcap;
2941 	dl_capability_sub_t *dl_subcap;
2942 
2943 	if (!(ill->ill_capabilities & ILL_CAPAB_ZEROCOPY))
2944 		return;
2945 
2946 	ASSERT(ill->ill_zerocopy_capab != NULL);
2947 
2948 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2949 	dl_subcap->dl_cap = DL_CAPAB_ZEROCOPY;
2950 	dl_subcap->dl_length = sizeof (*zerocopy_subcap);
2951 
2952 	zerocopy_subcap = (dl_capab_zerocopy_t *)(dl_subcap + 1);
2953 	zerocopy_subcap->zerocopy_version =
2954 	    ill->ill_zerocopy_capab->ill_zerocopy_version;
2955 	zerocopy_subcap->zerocopy_flags = 0;
2956 
2957 	mp->b_wptr += sizeof (*dl_subcap) + sizeof (*zerocopy_subcap);
2958 }
2959 
2960 /*
2961  * DLD capability
2962  * Refer to dld.h for more information regarding the purpose and usage
2963  * of this capability.
2964  */
2965 static void
2966 ill_capability_dld_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2967 {
2968 	dl_capab_dld_t		*dld_ic, dld;
2969 	uint_t			sub_dl_cap = isub->dl_cap;
2970 	uint8_t			*capend;
2971 	ill_dld_capab_t		*idc;
2972 
2973 	ASSERT(IAM_WRITER_ILL(ill));
2974 	ASSERT(sub_dl_cap == DL_CAPAB_DLD);
2975 
2976 	/*
2977 	 * Note: range checks here are not absolutely sufficient to
2978 	 * make us robust against malformed messages sent by drivers;
2979 	 * this is in keeping with the rest of IP's dlpi handling.
2980 	 * (Remember, it's coming from something else in the kernel
2981 	 * address space)
2982 	 */
2983 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2984 	if (capend > mp->b_wptr) {
2985 		cmn_err(CE_WARN, "ill_capability_dld_ack: "
2986 		    "malformed sub-capability too long for mblk");
2987 		return;
2988 	}
2989 	dld_ic = (dl_capab_dld_t *)(isub + 1);
2990 	if (dld_ic->dld_version != DLD_CURRENT_VERSION) {
2991 		cmn_err(CE_CONT, "ill_capability_dld_ack: "
2992 		    "unsupported DLD sub-capability (version %d, "
2993 		    "expected %d)", dld_ic->dld_version,
2994 		    DLD_CURRENT_VERSION);
2995 		return;
2996 	}
2997 	if (!dlcapabcheckqid(&dld_ic->dld_mid, ill->ill_lmod_rq)) {
2998 		ip1dbg(("ill_capability_dld_ack: mid token for dld "
2999 		    "capability isn't as expected; pass-thru module(s) "
3000 		    "detected, discarding capability\n"));
3001 		return;
3002 	}
3003 
3004 	/*
3005 	 * Copy locally to ensure alignment.
3006 	 */
3007 	bcopy(dld_ic, &dld, sizeof (dl_capab_dld_t));
3008 
3009 	if ((idc = ill->ill_dld_capab) == NULL) {
3010 		idc = kmem_zalloc(sizeof (ill_dld_capab_t), KM_NOSLEEP);
3011 		if (idc == NULL) {
3012 			cmn_err(CE_WARN, "ill_capability_dld_ack: "
3013 			    "could not enable DLD version %d "
3014 			    "for %s (ENOMEM)\n", DLD_CURRENT_VERSION,
3015 			    ill->ill_name);
3016 			return;
3017 		}
3018 		ill->ill_dld_capab = idc;
3019 	}
3020 	idc->idc_capab_df = (ip_capab_func_t)dld.dld_capab;
3021 	idc->idc_capab_dh = (void *)dld.dld_capab_handle;
3022 	ip1dbg(("ill_capability_dld_ack: interface %s "
3023 	    "supports DLD version %d\n", ill->ill_name, DLD_CURRENT_VERSION));
3024 
3025 	ill_capability_dld_enable(ill);
3026 }
3027 
3028 /*
3029  * Typically capability negotiation between IP and the driver happens via
3030  * DLPI message exchange. However GLD also offers a direct function call
3031  * mechanism to exchange the DLD_DIRECT_CAPAB and DLD_POLL_CAPAB capabilities,
3032  * But arbitrary function calls into IP or GLD are not permitted, since both
3033  * of them are protected by their own perimeter mechanism. The perimeter can
3034  * be viewed as a coarse lock or serialization mechanism. The hierarchy of
3035  * these perimeters is IP -> MAC. Thus for example to enable the squeue
3036  * polling, IP needs to enter its perimeter, then call ill_mac_perim_enter
3037  * to enter the mac perimeter and then do the direct function calls into
3038  * GLD to enable squeue polling. The ring related callbacks from the mac into
3039  * the stack to add, bind, quiesce, restart or cleanup a ring are all
3040  * protected by the mac perimeter.
3041  */
3042 static void
3043 ill_mac_perim_enter(ill_t *ill, mac_perim_handle_t *mphp)
3044 {
3045 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
3046 	int			err;
3047 
3048 	err = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, mphp,
3049 	    DLD_ENABLE);
3050 	ASSERT(err == 0);
3051 }
3052 
3053 static void
3054 ill_mac_perim_exit(ill_t *ill, mac_perim_handle_t mph)
3055 {
3056 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
3057 	int			err;
3058 
3059 	err = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, mph,
3060 	    DLD_DISABLE);
3061 	ASSERT(err == 0);
3062 }
3063 
3064 boolean_t
3065 ill_mac_perim_held(ill_t *ill)
3066 {
3067 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
3068 
3069 	return (idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, NULL,
3070 	    DLD_QUERY));
3071 }
3072 
3073 static void
3074 ill_capability_direct_enable(ill_t *ill)
3075 {
3076 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
3077 	ill_dld_direct_t	*idd = &idc->idc_direct;
3078 	dld_capab_direct_t	direct;
3079 	int			rc;
3080 
3081 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
3082 
3083 	bzero(&direct, sizeof (direct));
3084 	direct.di_rx_cf = (uintptr_t)ip_input;
3085 	direct.di_rx_ch = ill;
3086 
3087 	rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_DIRECT, &direct,
3088 	    DLD_ENABLE);
3089 	if (rc == 0) {
3090 		idd->idd_tx_df = (ip_dld_tx_t)direct.di_tx_df;
3091 		idd->idd_tx_dh = direct.di_tx_dh;
3092 		idd->idd_tx_cb_df = (ip_dld_callb_t)direct.di_tx_cb_df;
3093 		idd->idd_tx_cb_dh = direct.di_tx_cb_dh;
3094 		idd->idd_tx_fctl_df = (ip_dld_fctl_t)direct.di_tx_fctl_df;
3095 		idd->idd_tx_fctl_dh = direct.di_tx_fctl_dh;
3096 		/*
3097 		 * One time registration of flow enable callback function
3098 		 */
3099 		ill->ill_flownotify_mh = idd->idd_tx_cb_df(idd->idd_tx_cb_dh,
3100 		    ill_flow_enable, ill);
3101 		ill->ill_capabilities |= ILL_CAPAB_DLD_DIRECT;
3102 		DTRACE_PROBE1(direct_on, (ill_t *), ill);
3103 	} else {
3104 		cmn_err(CE_WARN, "warning: could not enable DIRECT "
3105 		    "capability, rc = %d\n", rc);
3106 		DTRACE_PROBE2(direct_off, (ill_t *), ill, (int), rc);
3107 	}
3108 }
3109 
3110 static void
3111 ill_capability_poll_enable(ill_t *ill)
3112 {
3113 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
3114 	dld_capab_poll_t	poll;
3115 	int			rc;
3116 
3117 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
3118 
3119 	bzero(&poll, sizeof (poll));
3120 	poll.poll_ring_add_cf = (uintptr_t)ip_squeue_add_ring;
3121 	poll.poll_ring_remove_cf = (uintptr_t)ip_squeue_clean_ring;
3122 	poll.poll_ring_quiesce_cf = (uintptr_t)ip_squeue_quiesce_ring;
3123 	poll.poll_ring_restart_cf = (uintptr_t)ip_squeue_restart_ring;
3124 	poll.poll_ring_bind_cf = (uintptr_t)ip_squeue_bind_ring;
3125 	poll.poll_ring_ch = ill;
3126 	rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_POLL, &poll,
3127 	    DLD_ENABLE);
3128 	if (rc == 0) {
3129 		ill->ill_capabilities |= ILL_CAPAB_DLD_POLL;
3130 		DTRACE_PROBE1(poll_on, (ill_t *), ill);
3131 	} else {
3132 		ip1dbg(("warning: could not enable POLL "
3133 		    "capability, rc = %d\n", rc));
3134 		DTRACE_PROBE2(poll_off, (ill_t *), ill, (int), rc);
3135 	}
3136 }
3137 
3138 /*
3139  * Enable the LSO capability.
3140  */
3141 static void
3142 ill_capability_lso_enable(ill_t *ill)
3143 {
3144 	ill_dld_capab_t	*idc = ill->ill_dld_capab;
3145 	dld_capab_lso_t	lso;
3146 	int rc;
3147 
3148 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
3149 
3150 	if (ill->ill_lso_capab == NULL) {
3151 		ill->ill_lso_capab = kmem_zalloc(sizeof (ill_lso_capab_t),
3152 		    KM_NOSLEEP);
3153 		if (ill->ill_lso_capab == NULL) {
3154 			cmn_err(CE_WARN, "ill_capability_lso_enable: "
3155 			    "could not enable LSO for %s (ENOMEM)\n",
3156 			    ill->ill_name);
3157 			return;
3158 		}
3159 	}
3160 
3161 	bzero(&lso, sizeof (lso));
3162 	if ((rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_LSO, &lso,
3163 	    DLD_ENABLE)) == 0) {
3164 		ill->ill_lso_capab->ill_lso_flags = lso.lso_flags;
3165 		ill->ill_lso_capab->ill_lso_max = lso.lso_max;
3166 		ill->ill_capabilities |= ILL_CAPAB_DLD_LSO;
3167 		ip1dbg(("ill_capability_lso_enable: interface %s "
3168 		    "has enabled LSO\n ", ill->ill_name));
3169 	} else {
3170 		kmem_free(ill->ill_lso_capab, sizeof (ill_lso_capab_t));
3171 		ill->ill_lso_capab = NULL;
3172 		DTRACE_PROBE2(lso_off, (ill_t *), ill, (int), rc);
3173 	}
3174 }
3175 
3176 static void
3177 ill_capability_dld_enable(ill_t *ill)
3178 {
3179 	mac_perim_handle_t mph;
3180 
3181 	ASSERT(IAM_WRITER_ILL(ill));
3182 
3183 	if (ill->ill_isv6)
3184 		return;
3185 
3186 	ill_mac_perim_enter(ill, &mph);
3187 	if (!ill->ill_isv6) {
3188 		ill_capability_direct_enable(ill);
3189 		ill_capability_poll_enable(ill);
3190 		ill_capability_lso_enable(ill);
3191 	}
3192 	ill->ill_capabilities |= ILL_CAPAB_DLD;
3193 	ill_mac_perim_exit(ill, mph);
3194 }
3195 
3196 static void
3197 ill_capability_dld_disable(ill_t *ill)
3198 {
3199 	ill_dld_capab_t	*idc;
3200 	ill_dld_direct_t *idd;
3201 	mac_perim_handle_t	mph;
3202 
3203 	ASSERT(IAM_WRITER_ILL(ill));
3204 
3205 	if (!(ill->ill_capabilities & ILL_CAPAB_DLD))
3206 		return;
3207 
3208 	ill_mac_perim_enter(ill, &mph);
3209 
3210 	idc = ill->ill_dld_capab;
3211 	if ((ill->ill_capabilities & ILL_CAPAB_DLD_DIRECT) != 0) {
3212 		/*
3213 		 * For performance we avoid locks in the transmit data path
3214 		 * and don't maintain a count of the number of threads using
3215 		 * direct calls. Thus some threads could be using direct
3216 		 * transmit calls to GLD, even after the capability mechanism
3217 		 * turns it off. This is still safe since the handles used in
3218 		 * the direct calls continue to be valid until the unplumb is
3219 		 * completed. Remove the callback that was added (1-time) at
3220 		 * capab enable time.
3221 		 */
3222 		mutex_enter(&ill->ill_lock);
3223 		ill->ill_capabilities &= ~ILL_CAPAB_DLD_DIRECT;
3224 		mutex_exit(&ill->ill_lock);
3225 		if (ill->ill_flownotify_mh != NULL) {
3226 			idd = &idc->idc_direct;
3227 			idd->idd_tx_cb_df(idd->idd_tx_cb_dh, NULL,
3228 			    ill->ill_flownotify_mh);
3229 			ill->ill_flownotify_mh = NULL;
3230 		}
3231 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_DIRECT,
3232 		    NULL, DLD_DISABLE);
3233 	}
3234 
3235 	if ((ill->ill_capabilities & ILL_CAPAB_DLD_POLL) != 0) {
3236 		ill->ill_capabilities &= ~ILL_CAPAB_DLD_POLL;
3237 		ip_squeue_clean_all(ill);
3238 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_POLL,
3239 		    NULL, DLD_DISABLE);
3240 	}
3241 
3242 	if ((ill->ill_capabilities & ILL_CAPAB_DLD_LSO) != 0) {
3243 		ASSERT(ill->ill_lso_capab != NULL);
3244 		/*
3245 		 * Clear the capability flag for LSO but retain the
3246 		 * ill_lso_capab structure since it's possible that another
3247 		 * thread is still referring to it.  The structure only gets
3248 		 * deallocated when we destroy the ill.
3249 		 */
3250 
3251 		ill->ill_capabilities &= ~ILL_CAPAB_DLD_LSO;
3252 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_LSO,
3253 		    NULL, DLD_DISABLE);
3254 	}
3255 
3256 	ill->ill_capabilities &= ~ILL_CAPAB_DLD;
3257 	ill_mac_perim_exit(ill, mph);
3258 }
3259 
3260 /*
3261  * Capability Negotiation protocol
3262  *
3263  * We don't wait for DLPI capability operations to finish during interface
3264  * bringup or teardown. Doing so would introduce more asynchrony and the
3265  * interface up/down operations will need multiple return and restarts.
3266  * Instead the 'ipsq_current_ipif' of the ipsq is not cleared as long as
3267  * the 'ill_dlpi_deferred' chain is non-empty. This ensures that the next
3268  * exclusive operation won't start until the DLPI operations of the previous
3269  * exclusive operation complete.
3270  *
3271  * The capability state machine is shown below.
3272  *
3273  * state		next state		event, action
3274  *
3275  * IDCS_UNKNOWN 	IDCS_PROBE_SENT		ill_capability_probe
3276  * IDCS_PROBE_SENT	IDCS_OK			ill_capability_ack
3277  * IDCS_PROBE_SENT	IDCS_FAILED		ip_rput_dlpi_writer (nack)
3278  * IDCS_OK		IDCS_RENEG		Receipt of DL_NOTE_CAPAB_RENEG
3279  * IDCS_OK		IDCS_RESET_SENT		ill_capability_reset
3280  * IDCS_RESET_SENT	IDCS_UNKNOWN		ill_capability_ack_thr
3281  * IDCS_RENEG		IDCS_PROBE_SENT		ill_capability_ack_thr ->
3282  *						    ill_capability_probe.
3283  */
3284 
3285 /*
3286  * Dedicated thread started from ip_stack_init that handles capability
3287  * disable. This thread ensures the taskq dispatch does not fail by waiting
3288  * for resources using TQ_SLEEP. The taskq mechanism is used to ensure
3289  * that direct calls to DLD are done in a cv_waitable context.
3290  */
3291 void
3292 ill_taskq_dispatch(ip_stack_t *ipst)
3293 {
3294 	callb_cpr_t cprinfo;
3295 	char 	name[64];
3296 	mblk_t	*mp;
3297 
3298 	(void) snprintf(name, sizeof (name), "ill_taskq_dispatch_%d",
3299 	    ipst->ips_netstack->netstack_stackid);
3300 	CALLB_CPR_INIT(&cprinfo, &ipst->ips_capab_taskq_lock, callb_generic_cpr,
3301 	    name);
3302 	mutex_enter(&ipst->ips_capab_taskq_lock);
3303 
3304 	for (;;) {
3305 		mp = list_head(&ipst->ips_capab_taskq_list);
3306 		while (mp != NULL) {
3307 			list_remove(&ipst->ips_capab_taskq_list, mp);
3308 			mutex_exit(&ipst->ips_capab_taskq_lock);
3309 			VERIFY(taskq_dispatch(system_taskq,
3310 			    ill_capability_ack_thr, mp, TQ_SLEEP) != 0);
3311 			mutex_enter(&ipst->ips_capab_taskq_lock);
3312 			mp = list_head(&ipst->ips_capab_taskq_list);
3313 		}
3314 
3315 		if (ipst->ips_capab_taskq_quit)
3316 			break;
3317 		CALLB_CPR_SAFE_BEGIN(&cprinfo);
3318 		cv_wait(&ipst->ips_capab_taskq_cv, &ipst->ips_capab_taskq_lock);
3319 		CALLB_CPR_SAFE_END(&cprinfo, &ipst->ips_capab_taskq_lock);
3320 	}
3321 	VERIFY(list_head(&ipst->ips_capab_taskq_list) == NULL);
3322 	CALLB_CPR_EXIT(&cprinfo);
3323 	thread_exit();
3324 }
3325 
3326 /*
3327  * Consume a new-style hardware capabilities negotiation ack.
3328  * Called via taskq on receipt of DL_CAPABBILITY_ACK.
3329  */
3330 static void
3331 ill_capability_ack_thr(void *arg)
3332 {
3333 	mblk_t	*mp = arg;
3334 	dl_capability_ack_t *capp;
3335 	dl_capability_sub_t *subp, *endp;
3336 	ill_t	*ill;
3337 	boolean_t reneg;
3338 
3339 	ill = (ill_t *)mp->b_prev;
3340 	VERIFY(ipsq_enter(ill, B_FALSE, CUR_OP) == B_TRUE);
3341 
3342 	if (ill->ill_dlpi_capab_state == IDCS_RESET_SENT ||
3343 	    ill->ill_dlpi_capab_state == IDCS_RENEG) {
3344 		/*
3345 		 * We have received the ack for our DL_CAPAB reset request.
3346 		 * There isnt' anything in the message that needs processing.
3347 		 * All message based capabilities have been disabled, now
3348 		 * do the function call based capability disable.
3349 		 */
3350 		reneg = ill->ill_dlpi_capab_state == IDCS_RENEG;
3351 		ill_capability_dld_disable(ill);
3352 		ill->ill_dlpi_capab_state = IDCS_UNKNOWN;
3353 		if (reneg)
3354 			ill_capability_probe(ill);
3355 		goto done;
3356 	}
3357 
3358 	if (ill->ill_dlpi_capab_state == IDCS_PROBE_SENT)
3359 		ill->ill_dlpi_capab_state = IDCS_OK;
3360 
3361 	capp = (dl_capability_ack_t *)mp->b_rptr;
3362 
3363 	if (capp->dl_sub_length == 0) {
3364 		/* no new-style capabilities */
3365 		goto done;
3366 	}
3367 
3368 	/* make sure the driver supplied correct dl_sub_length */
3369 	if ((sizeof (*capp) + capp->dl_sub_length) > MBLKL(mp)) {
3370 		ip0dbg(("ill_capability_ack: bad DL_CAPABILITY_ACK, "
3371 		    "invalid dl_sub_length (%d)\n", capp->dl_sub_length));
3372 		goto done;
3373 	}
3374 
3375 #define	SC(base, offset) (dl_capability_sub_t *)(((uchar_t *)(base))+(offset))
3376 	/*
3377 	 * There are sub-capabilities. Process the ones we know about.
3378 	 * Loop until we don't have room for another sub-cap header..
3379 	 */
3380 	for (subp = SC(capp, capp->dl_sub_offset),
3381 	    endp = SC(subp, capp->dl_sub_length - sizeof (*subp));
3382 	    subp <= endp;
3383 	    subp = SC(subp, sizeof (dl_capability_sub_t) + subp->dl_length)) {
3384 
3385 		switch (subp->dl_cap) {
3386 		case DL_CAPAB_ID_WRAPPER:
3387 			ill_capability_id_ack(ill, mp, subp);
3388 			break;
3389 		default:
3390 			ill_capability_dispatch(ill, mp, subp, B_FALSE);
3391 			break;
3392 		}
3393 	}
3394 #undef SC
3395 done:
3396 	inet_freemsg(mp);
3397 	ill_capability_done(ill);
3398 	ipsq_exit(ill->ill_phyint->phyint_ipsq);
3399 }
3400 
3401 /*
3402  * This needs to be started in a taskq thread to provide a cv_waitable
3403  * context.
3404  */
3405 void
3406 ill_capability_ack(ill_t *ill, mblk_t *mp)
3407 {
3408 	ip_stack_t	*ipst = ill->ill_ipst;
3409 
3410 	mp->b_prev = (mblk_t *)ill;
3411 	if (taskq_dispatch(system_taskq, ill_capability_ack_thr, mp,
3412 	    TQ_NOSLEEP) != 0)
3413 		return;
3414 
3415 	/*
3416 	 * The taskq dispatch failed. Signal the ill_taskq_dispatch thread
3417 	 * which will do the dispatch using TQ_SLEEP to guarantee success.
3418 	 */
3419 	mutex_enter(&ipst->ips_capab_taskq_lock);
3420 	list_insert_tail(&ipst->ips_capab_taskq_list, mp);
3421 	cv_signal(&ipst->ips_capab_taskq_cv);
3422 	mutex_exit(&ipst->ips_capab_taskq_lock);
3423 }
3424 
3425 /*
3426  * This routine is called to scan the fragmentation reassembly table for
3427  * the specified ILL for any packets that are starting to smell.
3428  * dead_interval is the maximum time in seconds that will be tolerated.  It
3429  * will either be the value specified in ip_g_frag_timeout, or zero if the
3430  * ILL is shutting down and it is time to blow everything off.
3431  *
3432  * It returns the number of seconds (as a time_t) that the next frag timer
3433  * should be scheduled for, 0 meaning that the timer doesn't need to be
3434  * re-started.  Note that the method of calculating next_timeout isn't
3435  * entirely accurate since time will flow between the time we grab
3436  * current_time and the time we schedule the next timeout.  This isn't a
3437  * big problem since this is the timer for sending an ICMP reassembly time
3438  * exceeded messages, and it doesn't have to be exactly accurate.
3439  *
3440  * This function is
3441  * sometimes called as writer, although this is not required.
3442  */
3443 time_t
3444 ill_frag_timeout(ill_t *ill, time_t dead_interval)
3445 {
3446 	ipfb_t	*ipfb;
3447 	ipfb_t	*endp;
3448 	ipf_t	*ipf;
3449 	ipf_t	*ipfnext;
3450 	mblk_t	*mp;
3451 	time_t	current_time = gethrestime_sec();
3452 	time_t	next_timeout = 0;
3453 	uint32_t	hdr_length;
3454 	mblk_t	*send_icmp_head;
3455 	mblk_t	*send_icmp_head_v6;
3456 	zoneid_t zoneid;
3457 	ip_stack_t *ipst = ill->ill_ipst;
3458 
3459 	ipfb = ill->ill_frag_hash_tbl;
3460 	if (ipfb == NULL)
3461 		return (B_FALSE);
3462 	endp = &ipfb[ILL_FRAG_HASH_TBL_COUNT];
3463 	/* Walk the frag hash table. */
3464 	for (; ipfb < endp; ipfb++) {
3465 		send_icmp_head = NULL;
3466 		send_icmp_head_v6 = NULL;
3467 		mutex_enter(&ipfb->ipfb_lock);
3468 		while ((ipf = ipfb->ipfb_ipf) != 0) {
3469 			time_t frag_time = current_time - ipf->ipf_timestamp;
3470 			time_t frag_timeout;
3471 
3472 			if (frag_time < dead_interval) {
3473 				/*
3474 				 * There are some outstanding fragments
3475 				 * that will timeout later.  Make note of
3476 				 * the time so that we can reschedule the
3477 				 * next timeout appropriately.
3478 				 */
3479 				frag_timeout = dead_interval - frag_time;
3480 				if (next_timeout == 0 ||
3481 				    frag_timeout < next_timeout) {
3482 					next_timeout = frag_timeout;
3483 				}
3484 				break;
3485 			}
3486 			/* Time's up.  Get it out of here. */
3487 			hdr_length = ipf->ipf_nf_hdr_len;
3488 			ipfnext = ipf->ipf_hash_next;
3489 			if (ipfnext)
3490 				ipfnext->ipf_ptphn = ipf->ipf_ptphn;
3491 			*ipf->ipf_ptphn = ipfnext;
3492 			mp = ipf->ipf_mp->b_cont;
3493 			for (; mp; mp = mp->b_cont) {
3494 				/* Extra points for neatness. */
3495 				IP_REASS_SET_START(mp, 0);
3496 				IP_REASS_SET_END(mp, 0);
3497 			}
3498 			mp = ipf->ipf_mp->b_cont;
3499 			atomic_add_32(&ill->ill_frag_count, -ipf->ipf_count);
3500 			ASSERT(ipfb->ipfb_count >= ipf->ipf_count);
3501 			ipfb->ipfb_count -= ipf->ipf_count;
3502 			ASSERT(ipfb->ipfb_frag_pkts > 0);
3503 			ipfb->ipfb_frag_pkts--;
3504 			/*
3505 			 * We do not send any icmp message from here because
3506 			 * we currently are holding the ipfb_lock for this
3507 			 * hash chain. If we try and send any icmp messages
3508 			 * from here we may end up via a put back into ip
3509 			 * trying to get the same lock, causing a recursive
3510 			 * mutex panic. Instead we build a list and send all
3511 			 * the icmp messages after we have dropped the lock.
3512 			 */
3513 			if (ill->ill_isv6) {
3514 				if (hdr_length != 0) {
3515 					mp->b_next = send_icmp_head_v6;
3516 					send_icmp_head_v6 = mp;
3517 				} else {
3518 					freemsg(mp);
3519 				}
3520 			} else {
3521 				if (hdr_length != 0) {
3522 					mp->b_next = send_icmp_head;
3523 					send_icmp_head = mp;
3524 				} else {
3525 					freemsg(mp);
3526 				}
3527 			}
3528 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmFails);
3529 			freeb(ipf->ipf_mp);
3530 		}
3531 		mutex_exit(&ipfb->ipfb_lock);
3532 		/*
3533 		 * Now need to send any icmp messages that we delayed from
3534 		 * above.
3535 		 */
3536 		while (send_icmp_head_v6 != NULL) {
3537 			ip6_t *ip6h;
3538 
3539 			mp = send_icmp_head_v6;
3540 			send_icmp_head_v6 = send_icmp_head_v6->b_next;
3541 			mp->b_next = NULL;
3542 			if (mp->b_datap->db_type == M_CTL)
3543 				ip6h = (ip6_t *)mp->b_cont->b_rptr;
3544 			else
3545 				ip6h = (ip6_t *)mp->b_rptr;
3546 			zoneid = ipif_lookup_addr_zoneid_v6(&ip6h->ip6_dst,
3547 			    ill, ipst);
3548 			if (zoneid == ALL_ZONES) {
3549 				freemsg(mp);
3550 			} else {
3551 				icmp_time_exceeded_v6(ill->ill_wq, mp,
3552 				    ICMP_REASSEMBLY_TIME_EXCEEDED, B_FALSE,
3553 				    B_FALSE, zoneid, ipst);
3554 			}
3555 		}
3556 		while (send_icmp_head != NULL) {
3557 			ipaddr_t dst;
3558 
3559 			mp = send_icmp_head;
3560 			send_icmp_head = send_icmp_head->b_next;
3561 			mp->b_next = NULL;
3562 
3563 			if (mp->b_datap->db_type == M_CTL)
3564 				dst = ((ipha_t *)mp->b_cont->b_rptr)->ipha_dst;
3565 			else
3566 				dst = ((ipha_t *)mp->b_rptr)->ipha_dst;
3567 
3568 			zoneid = ipif_lookup_addr_zoneid(dst, ill, ipst);
3569 			if (zoneid == ALL_ZONES) {
3570 				freemsg(mp);
3571 			} else {
3572 				icmp_time_exceeded(ill->ill_wq, mp,
3573 				    ICMP_REASSEMBLY_TIME_EXCEEDED, zoneid,
3574 				    ipst);
3575 			}
3576 		}
3577 	}
3578 	/*
3579 	 * A non-dying ILL will use the return value to decide whether to
3580 	 * restart the frag timer, and for how long.
3581 	 */
3582 	return (next_timeout);
3583 }
3584 
3585 /*
3586  * This routine is called when the approximate count of mblk memory used
3587  * for the specified ILL has exceeded max_count.
3588  */
3589 void
3590 ill_frag_prune(ill_t *ill, uint_t max_count)
3591 {
3592 	ipfb_t	*ipfb;
3593 	ipf_t	*ipf;
3594 	size_t	count;
3595 
3596 	/*
3597 	 * If we are here within ip_min_frag_prune_time msecs remove
3598 	 * ill_frag_free_num_pkts oldest packets from each bucket and increment
3599 	 * ill_frag_free_num_pkts.
3600 	 */
3601 	mutex_enter(&ill->ill_lock);
3602 	if (TICK_TO_MSEC(lbolt - ill->ill_last_frag_clean_time) <=
3603 	    (ip_min_frag_prune_time != 0 ?
3604 	    ip_min_frag_prune_time : msec_per_tick)) {
3605 
3606 		ill->ill_frag_free_num_pkts++;
3607 
3608 	} else {
3609 		ill->ill_frag_free_num_pkts = 0;
3610 	}
3611 	ill->ill_last_frag_clean_time = lbolt;
3612 	mutex_exit(&ill->ill_lock);
3613 
3614 	/*
3615 	 * free ill_frag_free_num_pkts oldest packets from each bucket.
3616 	 */
3617 	if (ill->ill_frag_free_num_pkts != 0) {
3618 		int ix;
3619 
3620 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
3621 			ipfb = &ill->ill_frag_hash_tbl[ix];
3622 			mutex_enter(&ipfb->ipfb_lock);
3623 			if (ipfb->ipfb_ipf != NULL) {
3624 				ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf,
3625 				    ill->ill_frag_free_num_pkts);
3626 			}
3627 			mutex_exit(&ipfb->ipfb_lock);
3628 		}
3629 	}
3630 	/*
3631 	 * While the reassembly list for this ILL is too big, prune a fragment
3632 	 * queue by age, oldest first.
3633 	 */
3634 	while (ill->ill_frag_count > max_count) {
3635 		int	ix;
3636 		ipfb_t	*oipfb = NULL;
3637 		uint_t	oldest = UINT_MAX;
3638 
3639 		count = 0;
3640 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
3641 			ipfb = &ill->ill_frag_hash_tbl[ix];
3642 			mutex_enter(&ipfb->ipfb_lock);
3643 			ipf = ipfb->ipfb_ipf;
3644 			if (ipf != NULL && ipf->ipf_gen < oldest) {
3645 				oldest = ipf->ipf_gen;
3646 				oipfb = ipfb;
3647 			}
3648 			count += ipfb->ipfb_count;
3649 			mutex_exit(&ipfb->ipfb_lock);
3650 		}
3651 		if (oipfb == NULL)
3652 			break;
3653 
3654 		if (count <= max_count)
3655 			return;	/* Somebody beat us to it, nothing to do */
3656 		mutex_enter(&oipfb->ipfb_lock);
3657 		ipf = oipfb->ipfb_ipf;
3658 		if (ipf != NULL) {
3659 			ill_frag_free_pkts(ill, oipfb, ipf, 1);
3660 		}
3661 		mutex_exit(&oipfb->ipfb_lock);
3662 	}
3663 }
3664 
3665 /*
3666  * free 'free_cnt' fragmented packets starting at ipf.
3667  */
3668 void
3669 ill_frag_free_pkts(ill_t *ill, ipfb_t *ipfb, ipf_t *ipf, int free_cnt)
3670 {
3671 	size_t	count;
3672 	mblk_t	*mp;
3673 	mblk_t	*tmp;
3674 	ipf_t **ipfp = ipf->ipf_ptphn;
3675 
3676 	ASSERT(MUTEX_HELD(&ipfb->ipfb_lock));
3677 	ASSERT(ipfp != NULL);
3678 	ASSERT(ipf != NULL);
3679 
3680 	while (ipf != NULL && free_cnt-- > 0) {
3681 		count = ipf->ipf_count;
3682 		mp = ipf->ipf_mp;
3683 		ipf = ipf->ipf_hash_next;
3684 		for (tmp = mp; tmp; tmp = tmp->b_cont) {
3685 			IP_REASS_SET_START(tmp, 0);
3686 			IP_REASS_SET_END(tmp, 0);
3687 		}
3688 		atomic_add_32(&ill->ill_frag_count, -count);
3689 		ASSERT(ipfb->ipfb_count >= count);
3690 		ipfb->ipfb_count -= count;
3691 		ASSERT(ipfb->ipfb_frag_pkts > 0);
3692 		ipfb->ipfb_frag_pkts--;
3693 		freemsg(mp);
3694 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmFails);
3695 	}
3696 
3697 	if (ipf)
3698 		ipf->ipf_ptphn = ipfp;
3699 	ipfp[0] = ipf;
3700 }
3701 
3702 #define	ND_FORWARD_WARNING	"The <if>:ip*_forwarding ndd variables are " \
3703 	"obsolete and may be removed in a future release of Solaris.  Use " \
3704 	"ifconfig(1M) to manipulate the forwarding status of an interface."
3705 
3706 /*
3707  * For obsolete per-interface forwarding configuration;
3708  * called in response to ND_GET.
3709  */
3710 /* ARGSUSED */
3711 static int
3712 nd_ill_forward_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *ioc_cr)
3713 {
3714 	ill_t *ill = (ill_t *)cp;
3715 
3716 	cmn_err(CE_WARN, ND_FORWARD_WARNING);
3717 
3718 	(void) mi_mpprintf(mp, "%d", (ill->ill_flags & ILLF_ROUTER) != 0);
3719 	return (0);
3720 }
3721 
3722 /*
3723  * For obsolete per-interface forwarding configuration;
3724  * called in response to ND_SET.
3725  */
3726 /* ARGSUSED */
3727 static int
3728 nd_ill_forward_set(queue_t *q, mblk_t *mp, char *valuestr, caddr_t cp,
3729     cred_t *ioc_cr)
3730 {
3731 	long value;
3732 	int retval;
3733 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
3734 
3735 	cmn_err(CE_WARN, ND_FORWARD_WARNING);
3736 
3737 	if (ddi_strtol(valuestr, NULL, 10, &value) != 0 ||
3738 	    value < 0 || value > 1) {
3739 		return (EINVAL);
3740 	}
3741 
3742 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3743 	retval = ill_forward_set((ill_t *)cp, (value != 0));
3744 	rw_exit(&ipst->ips_ill_g_lock);
3745 	return (retval);
3746 }
3747 
3748 /*
3749  * Helper function for ill_forward_set().
3750  */
3751 static void
3752 ill_forward_set_on_ill(ill_t *ill, boolean_t enable)
3753 {
3754 	ip_stack_t	*ipst = ill->ill_ipst;
3755 
3756 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ipst->ips_ill_g_lock));
3757 
3758 	ip1dbg(("ill_forward_set: %s %s forwarding on %s",
3759 	    (enable ? "Enabling" : "Disabling"),
3760 	    (ill->ill_isv6 ? "IPv6" : "IPv4"), ill->ill_name));
3761 	mutex_enter(&ill->ill_lock);
3762 	if (enable)
3763 		ill->ill_flags |= ILLF_ROUTER;
3764 	else
3765 		ill->ill_flags &= ~ILLF_ROUTER;
3766 	mutex_exit(&ill->ill_lock);
3767 	if (ill->ill_isv6)
3768 		ill_set_nce_router_flags(ill, enable);
3769 	/* Notify routing socket listeners of this change. */
3770 	ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
3771 }
3772 
3773 /*
3774  * Set an ill's ILLF_ROUTER flag appropriately.  Send up RTS_IFINFO routing
3775  * socket messages for each interface whose flags we change.
3776  */
3777 int
3778 ill_forward_set(ill_t *ill, boolean_t enable)
3779 {
3780 	ipmp_illgrp_t *illg;
3781 	ip_stack_t *ipst = ill->ill_ipst;
3782 
3783 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ipst->ips_ill_g_lock));
3784 
3785 	if ((enable && (ill->ill_flags & ILLF_ROUTER)) ||
3786 	    (!enable && !(ill->ill_flags & ILLF_ROUTER)))
3787 		return (0);
3788 
3789 	if (IS_LOOPBACK(ill))
3790 		return (EINVAL);
3791 
3792 	if (IS_IPMP(ill) || IS_UNDER_IPMP(ill)) {
3793 		/*
3794 		 * Update all of the interfaces in the group.
3795 		 */
3796 		illg = ill->ill_grp;
3797 		ill = list_head(&illg->ig_if);
3798 		for (; ill != NULL; ill = list_next(&illg->ig_if, ill))
3799 			ill_forward_set_on_ill(ill, enable);
3800 
3801 		/*
3802 		 * Update the IPMP meta-interface.
3803 		 */
3804 		ill_forward_set_on_ill(ipmp_illgrp_ipmp_ill(illg), enable);
3805 		return (0);
3806 	}
3807 
3808 	ill_forward_set_on_ill(ill, enable);
3809 	return (0);
3810 }
3811 
3812 /*
3813  * Based on the ILLF_ROUTER flag of an ill, make sure all local nce's for
3814  * addresses assigned to the ill have the NCE_F_ISROUTER flag appropriately
3815  * set or clear.
3816  */
3817 static void
3818 ill_set_nce_router_flags(ill_t *ill, boolean_t enable)
3819 {
3820 	ipif_t *ipif;
3821 	nce_t *nce;
3822 
3823 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
3824 		/*
3825 		 * NOTE: we match across the illgrp because nce's for
3826 		 * addresses on IPMP interfaces have an nce_ill that points to
3827 		 * the bound underlying ill.
3828 		 */
3829 		nce = ndp_lookup_v6(ill, B_TRUE, &ipif->ipif_v6lcl_addr,
3830 		    B_FALSE);
3831 		if (nce != NULL) {
3832 			mutex_enter(&nce->nce_lock);
3833 			if (enable)
3834 				nce->nce_flags |= NCE_F_ISROUTER;
3835 			else
3836 				nce->nce_flags &= ~NCE_F_ISROUTER;
3837 			mutex_exit(&nce->nce_lock);
3838 			NCE_REFRELE(nce);
3839 		}
3840 	}
3841 }
3842 
3843 /*
3844  * Given an ill with a _valid_ name, add the ip_forwarding ndd variable
3845  * for this ill.  Make sure the v6/v4 question has been answered about this
3846  * ill.  The creation of this ndd variable is only for backwards compatibility.
3847  * The preferred way to control per-interface IP forwarding is through the
3848  * ILLF_ROUTER interface flag.
3849  */
3850 static int
3851 ill_set_ndd_name(ill_t *ill)
3852 {
3853 	char *suffix;
3854 	ip_stack_t	*ipst = ill->ill_ipst;
3855 
3856 	ASSERT(IAM_WRITER_ILL(ill));
3857 
3858 	if (ill->ill_isv6)
3859 		suffix = ipv6_forward_suffix;
3860 	else
3861 		suffix = ipv4_forward_suffix;
3862 
3863 	ill->ill_ndd_name = ill->ill_name + ill->ill_name_length;
3864 	bcopy(ill->ill_name, ill->ill_ndd_name, ill->ill_name_length - 1);
3865 	/*
3866 	 * Copies over the '\0'.
3867 	 * Note that strlen(suffix) is always bounded.
3868 	 */
3869 	bcopy(suffix, ill->ill_ndd_name + ill->ill_name_length - 1,
3870 	    strlen(suffix) + 1);
3871 
3872 	/*
3873 	 * Use of the nd table requires holding the reader lock.
3874 	 * Modifying the nd table thru nd_load/nd_unload requires
3875 	 * the writer lock.
3876 	 */
3877 	rw_enter(&ipst->ips_ip_g_nd_lock, RW_WRITER);
3878 	if (!nd_load(&ipst->ips_ip_g_nd, ill->ill_ndd_name, nd_ill_forward_get,
3879 	    nd_ill_forward_set, (caddr_t)ill)) {
3880 		/*
3881 		 * If the nd_load failed, it only meant that it could not
3882 		 * allocate a new bunch of room for further NDD expansion.
3883 		 * Because of that, the ill_ndd_name will be set to 0, and
3884 		 * this interface is at the mercy of the global ip_forwarding
3885 		 * variable.
3886 		 */
3887 		rw_exit(&ipst->ips_ip_g_nd_lock);
3888 		ill->ill_ndd_name = NULL;
3889 		return (ENOMEM);
3890 	}
3891 	rw_exit(&ipst->ips_ip_g_nd_lock);
3892 	return (0);
3893 }
3894 
3895 /*
3896  * Intializes the context structure and returns the first ill in the list
3897  * cuurently start_list and end_list can have values:
3898  * MAX_G_HEADS		Traverse both IPV4 and IPV6 lists.
3899  * IP_V4_G_HEAD		Traverse IPV4 list only.
3900  * IP_V6_G_HEAD		Traverse IPV6 list only.
3901  */
3902 
3903 /*
3904  * We don't check for CONDEMNED ills here. Caller must do that if
3905  * necessary under the ill lock.
3906  */
3907 ill_t *
3908 ill_first(int start_list, int end_list, ill_walk_context_t *ctx,
3909     ip_stack_t *ipst)
3910 {
3911 	ill_if_t *ifp;
3912 	ill_t *ill;
3913 	avl_tree_t *avl_tree;
3914 
3915 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
3916 	ASSERT(end_list <= MAX_G_HEADS && start_list >= 0);
3917 
3918 	/*
3919 	 * setup the lists to search
3920 	 */
3921 	if (end_list != MAX_G_HEADS) {
3922 		ctx->ctx_current_list = start_list;
3923 		ctx->ctx_last_list = end_list;
3924 	} else {
3925 		ctx->ctx_last_list = MAX_G_HEADS - 1;
3926 		ctx->ctx_current_list = 0;
3927 	}
3928 
3929 	while (ctx->ctx_current_list <= ctx->ctx_last_list) {
3930 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst);
3931 		if (ifp != (ill_if_t *)
3932 		    &IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst)) {
3933 			avl_tree = &ifp->illif_avl_by_ppa;
3934 			ill = avl_first(avl_tree);
3935 			/*
3936 			 * ill is guaranteed to be non NULL or ifp should have
3937 			 * not existed.
3938 			 */
3939 			ASSERT(ill != NULL);
3940 			return (ill);
3941 		}
3942 		ctx->ctx_current_list++;
3943 	}
3944 
3945 	return (NULL);
3946 }
3947 
3948 /*
3949  * returns the next ill in the list. ill_first() must have been called
3950  * before calling ill_next() or bad things will happen.
3951  */
3952 
3953 /*
3954  * We don't check for CONDEMNED ills here. Caller must do that if
3955  * necessary under the ill lock.
3956  */
3957 ill_t *
3958 ill_next(ill_walk_context_t *ctx, ill_t *lastill)
3959 {
3960 	ill_if_t *ifp;
3961 	ill_t *ill;
3962 	ip_stack_t	*ipst = lastill->ill_ipst;
3963 
3964 	ASSERT(lastill->ill_ifptr != (ill_if_t *)
3965 	    &IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst));
3966 	if ((ill = avl_walk(&lastill->ill_ifptr->illif_avl_by_ppa, lastill,
3967 	    AVL_AFTER)) != NULL) {
3968 		return (ill);
3969 	}
3970 
3971 	/* goto next ill_ifp in the list. */
3972 	ifp = lastill->ill_ifptr->illif_next;
3973 
3974 	/* make sure not at end of circular list */
3975 	while (ifp ==
3976 	    (ill_if_t *)&IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst)) {
3977 		if (++ctx->ctx_current_list > ctx->ctx_last_list)
3978 			return (NULL);
3979 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst);
3980 	}
3981 
3982 	return (avl_first(&ifp->illif_avl_by_ppa));
3983 }
3984 
3985 /*
3986  * Check interface name for correct format: [a-zA-Z]+[a-zA-Z0-9._]*[0-9]+
3987  * The final number (PPA) must not have any leading zeros.  Upon success, a
3988  * pointer to the start of the PPA is returned; otherwise NULL is returned.
3989  */
3990 static char *
3991 ill_get_ppa_ptr(char *name)
3992 {
3993 	int namelen = strlen(name);
3994 	int end_ndx = namelen - 1;
3995 	int ppa_ndx, i;
3996 
3997 	/*
3998 	 * Check that the first character is [a-zA-Z], and that the last
3999 	 * character is [0-9].
4000 	 */
4001 	if (namelen == 0 || !isalpha(name[0]) || !isdigit(name[end_ndx]))
4002 		return (NULL);
4003 
4004 	/*
4005 	 * Set `ppa_ndx' to the PPA start, and check for leading zeroes.
4006 	 */
4007 	for (ppa_ndx = end_ndx; ppa_ndx > 0; ppa_ndx--)
4008 		if (!isdigit(name[ppa_ndx - 1]))
4009 			break;
4010 
4011 	if (name[ppa_ndx] == '0' && ppa_ndx < end_ndx)
4012 		return (NULL);
4013 
4014 	/*
4015 	 * Check that the intermediate characters are [a-z0-9.]
4016 	 */
4017 	for (i = 1; i < ppa_ndx; i++) {
4018 		if (!isalpha(name[i]) && !isdigit(name[i]) &&
4019 		    name[i] != '.' && name[i] != '_') {
4020 			return (NULL);
4021 		}
4022 	}
4023 
4024 	return (name + ppa_ndx);
4025 }
4026 
4027 /*
4028  * use avl tree to locate the ill.
4029  */
4030 static ill_t *
4031 ill_find_by_name(char *name, boolean_t isv6, queue_t *q, mblk_t *mp,
4032     ipsq_func_t func, int *error, ip_stack_t *ipst)
4033 {
4034 	char *ppa_ptr = NULL;
4035 	int len;
4036 	uint_t ppa;
4037 	ill_t *ill = NULL;
4038 	ill_if_t *ifp;
4039 	int list;
4040 	ipsq_t *ipsq;
4041 
4042 	if (error != NULL)
4043 		*error = 0;
4044 
4045 	/*
4046 	 * get ppa ptr
4047 	 */
4048 	if (isv6)
4049 		list = IP_V6_G_HEAD;
4050 	else
4051 		list = IP_V4_G_HEAD;
4052 
4053 	if ((ppa_ptr = ill_get_ppa_ptr(name)) == NULL) {
4054 		if (error != NULL)
4055 			*error = ENXIO;
4056 		return (NULL);
4057 	}
4058 
4059 	len = ppa_ptr - name + 1;
4060 
4061 	ppa = stoi(&ppa_ptr);
4062 
4063 	ifp = IP_VX_ILL_G_LIST(list, ipst);
4064 
4065 	while (ifp != (ill_if_t *)&IP_VX_ILL_G_LIST(list, ipst)) {
4066 		/*
4067 		 * match is done on len - 1 as the name is not null
4068 		 * terminated it contains ppa in addition to the interface
4069 		 * name.
4070 		 */
4071 		if ((ifp->illif_name_len == len) &&
4072 		    bcmp(ifp->illif_name, name, len - 1) == 0) {
4073 			break;
4074 		} else {
4075 			ifp = ifp->illif_next;
4076 		}
4077 	}
4078 
4079 	if (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(list, ipst)) {
4080 		/*
4081 		 * Even the interface type does not exist.
4082 		 */
4083 		if (error != NULL)
4084 			*error = ENXIO;
4085 		return (NULL);
4086 	}
4087 
4088 	ill = avl_find(&ifp->illif_avl_by_ppa, (void *) &ppa, NULL);
4089 	if (ill != NULL) {
4090 		/*
4091 		 * The block comment at the start of ipif_down
4092 		 * explains the use of the macros used below
4093 		 */
4094 		GRAB_CONN_LOCK(q);
4095 		mutex_enter(&ill->ill_lock);
4096 		if (ILL_CAN_LOOKUP(ill)) {
4097 			ill_refhold_locked(ill);
4098 			mutex_exit(&ill->ill_lock);
4099 			RELEASE_CONN_LOCK(q);
4100 			return (ill);
4101 		} else if (ILL_CAN_WAIT(ill, q)) {
4102 			ipsq = ill->ill_phyint->phyint_ipsq;
4103 			mutex_enter(&ipsq->ipsq_lock);
4104 			mutex_enter(&ipsq->ipsq_xop->ipx_lock);
4105 			mutex_exit(&ill->ill_lock);
4106 			ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
4107 			mutex_exit(&ipsq->ipsq_xop->ipx_lock);
4108 			mutex_exit(&ipsq->ipsq_lock);
4109 			RELEASE_CONN_LOCK(q);
4110 			if (error != NULL)
4111 				*error = EINPROGRESS;
4112 			return (NULL);
4113 		}
4114 		mutex_exit(&ill->ill_lock);
4115 		RELEASE_CONN_LOCK(q);
4116 	}
4117 	if (error != NULL)
4118 		*error = ENXIO;
4119 	return (NULL);
4120 }
4121 
4122 /*
4123  * comparison function for use with avl.
4124  */
4125 static int
4126 ill_compare_ppa(const void *ppa_ptr, const void *ill_ptr)
4127 {
4128 	uint_t ppa;
4129 	uint_t ill_ppa;
4130 
4131 	ASSERT(ppa_ptr != NULL && ill_ptr != NULL);
4132 
4133 	ppa = *((uint_t *)ppa_ptr);
4134 	ill_ppa = ((const ill_t *)ill_ptr)->ill_ppa;
4135 	/*
4136 	 * We want the ill with the lowest ppa to be on the
4137 	 * top.
4138 	 */
4139 	if (ill_ppa < ppa)
4140 		return (1);
4141 	if (ill_ppa > ppa)
4142 		return (-1);
4143 	return (0);
4144 }
4145 
4146 /*
4147  * remove an interface type from the global list.
4148  */
4149 static void
4150 ill_delete_interface_type(ill_if_t *interface)
4151 {
4152 	ASSERT(interface != NULL);
4153 	ASSERT(avl_numnodes(&interface->illif_avl_by_ppa) == 0);
4154 
4155 	avl_destroy(&interface->illif_avl_by_ppa);
4156 	if (interface->illif_ppa_arena != NULL)
4157 		vmem_destroy(interface->illif_ppa_arena);
4158 
4159 	remque(interface);
4160 
4161 	mi_free(interface);
4162 }
4163 
4164 /*
4165  * remove ill from the global list.
4166  */
4167 static void
4168 ill_glist_delete(ill_t *ill)
4169 {
4170 	ip_stack_t	*ipst;
4171 	phyint_t	*phyi;
4172 
4173 	if (ill == NULL)
4174 		return;
4175 	ipst = ill->ill_ipst;
4176 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
4177 
4178 	/*
4179 	 * If the ill was never inserted into the AVL tree
4180 	 * we skip the if branch.
4181 	 */
4182 	if (ill->ill_ifptr != NULL) {
4183 		/*
4184 		 * remove from AVL tree and free ppa number
4185 		 */
4186 		avl_remove(&ill->ill_ifptr->illif_avl_by_ppa, ill);
4187 
4188 		if (ill->ill_ifptr->illif_ppa_arena != NULL) {
4189 			vmem_free(ill->ill_ifptr->illif_ppa_arena,
4190 			    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
4191 		}
4192 		if (avl_numnodes(&ill->ill_ifptr->illif_avl_by_ppa) == 0) {
4193 			ill_delete_interface_type(ill->ill_ifptr);
4194 		}
4195 
4196 		/*
4197 		 * Indicate ill is no longer in the list.
4198 		 */
4199 		ill->ill_ifptr = NULL;
4200 		ill->ill_name_length = 0;
4201 		ill->ill_name[0] = '\0';
4202 		ill->ill_ppa = UINT_MAX;
4203 	}
4204 
4205 	/* Generate one last event for this ill. */
4206 	ill_nic_event_dispatch(ill, 0, NE_UNPLUMB, ill->ill_name,
4207 	    ill->ill_name_length);
4208 
4209 	ASSERT(ill->ill_phyint != NULL);
4210 	phyi = ill->ill_phyint;
4211 	ill->ill_phyint = NULL;
4212 
4213 	/*
4214 	 * ill_init allocates a phyint always to store the copy
4215 	 * of flags relevant to phyint. At that point in time, we could
4216 	 * not assign the name and hence phyint_illv4/v6 could not be
4217 	 * initialized. Later in ipif_set_values, we assign the name to
4218 	 * the ill, at which point in time we assign phyint_illv4/v6.
4219 	 * Thus we don't rely on phyint_illv6 to be initialized always.
4220 	 */
4221 	if (ill->ill_flags & ILLF_IPV6)
4222 		phyi->phyint_illv6 = NULL;
4223 	else
4224 		phyi->phyint_illv4 = NULL;
4225 
4226 	if (phyi->phyint_illv4 != NULL || phyi->phyint_illv6 != NULL) {
4227 		rw_exit(&ipst->ips_ill_g_lock);
4228 		return;
4229 	}
4230 
4231 	/*
4232 	 * There are no ills left on this phyint; pull it out of the phyint
4233 	 * avl trees, and free it.
4234 	 */
4235 	if (phyi->phyint_ifindex > 0) {
4236 		avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
4237 		    phyi);
4238 		avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
4239 		    phyi);
4240 	}
4241 	rw_exit(&ipst->ips_ill_g_lock);
4242 
4243 	phyint_free(phyi);
4244 }
4245 
4246 /*
4247  * allocate a ppa, if the number of plumbed interfaces of this type are
4248  * less than ill_no_arena do a linear search to find a unused ppa.
4249  * When the number goes beyond ill_no_arena switch to using an arena.
4250  * Note: ppa value of zero cannot be allocated from vmem_arena as it
4251  * is the return value for an error condition, so allocation starts at one
4252  * and is decremented by one.
4253  */
4254 static int
4255 ill_alloc_ppa(ill_if_t *ifp, ill_t *ill)
4256 {
4257 	ill_t *tmp_ill;
4258 	uint_t start, end;
4259 	int ppa;
4260 
4261 	if (ifp->illif_ppa_arena == NULL &&
4262 	    (avl_numnodes(&ifp->illif_avl_by_ppa) + 1 > ill_no_arena)) {
4263 		/*
4264 		 * Create an arena.
4265 		 */
4266 		ifp->illif_ppa_arena = vmem_create(ifp->illif_name,
4267 		    (void *)1, UINT_MAX - 1, 1, NULL, NULL,
4268 		    NULL, 0, VM_SLEEP | VMC_IDENTIFIER);
4269 			/* allocate what has already been assigned */
4270 		for (tmp_ill = avl_first(&ifp->illif_avl_by_ppa);
4271 		    tmp_ill != NULL; tmp_ill = avl_walk(&ifp->illif_avl_by_ppa,
4272 		    tmp_ill, AVL_AFTER)) {
4273 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
4274 			    1,		/* size */
4275 			    1,		/* align/quantum */
4276 			    0,		/* phase */
4277 			    0,		/* nocross */
4278 			    /* minaddr */
4279 			    (void *)((uintptr_t)tmp_ill->ill_ppa + 1),
4280 			    /* maxaddr */
4281 			    (void *)((uintptr_t)tmp_ill->ill_ppa + 2),
4282 			    VM_NOSLEEP|VM_FIRSTFIT);
4283 			if (ppa == 0) {
4284 				ip1dbg(("ill_alloc_ppa: ppa allocation"
4285 				    " failed while switching"));
4286 				vmem_destroy(ifp->illif_ppa_arena);
4287 				ifp->illif_ppa_arena = NULL;
4288 				break;
4289 			}
4290 		}
4291 	}
4292 
4293 	if (ifp->illif_ppa_arena != NULL) {
4294 		if (ill->ill_ppa == UINT_MAX) {
4295 			ppa = (int)(uintptr_t)vmem_alloc(ifp->illif_ppa_arena,
4296 			    1, VM_NOSLEEP|VM_FIRSTFIT);
4297 			if (ppa == 0)
4298 				return (EAGAIN);
4299 			ill->ill_ppa = --ppa;
4300 		} else {
4301 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
4302 			    1, 		/* size */
4303 			    1, 		/* align/quantum */
4304 			    0, 		/* phase */
4305 			    0, 		/* nocross */
4306 			    (void *)(uintptr_t)(ill->ill_ppa + 1), /* minaddr */
4307 			    (void *)(uintptr_t)(ill->ill_ppa + 2), /* maxaddr */
4308 			    VM_NOSLEEP|VM_FIRSTFIT);
4309 			/*
4310 			 * Most likely the allocation failed because
4311 			 * the requested ppa was in use.
4312 			 */
4313 			if (ppa == 0)
4314 				return (EEXIST);
4315 		}
4316 		return (0);
4317 	}
4318 
4319 	/*
4320 	 * No arena is in use and not enough (>ill_no_arena) interfaces have
4321 	 * been plumbed to create one. Do a linear search to get a unused ppa.
4322 	 */
4323 	if (ill->ill_ppa == UINT_MAX) {
4324 		end = UINT_MAX - 1;
4325 		start = 0;
4326 	} else {
4327 		end = start = ill->ill_ppa;
4328 	}
4329 
4330 	tmp_ill = avl_find(&ifp->illif_avl_by_ppa, (void *)&start, NULL);
4331 	while (tmp_ill != NULL && tmp_ill->ill_ppa == start) {
4332 		if (start++ >= end) {
4333 			if (ill->ill_ppa == UINT_MAX)
4334 				return (EAGAIN);
4335 			else
4336 				return (EEXIST);
4337 		}
4338 		tmp_ill = avl_walk(&ifp->illif_avl_by_ppa, tmp_ill, AVL_AFTER);
4339 	}
4340 	ill->ill_ppa = start;
4341 	return (0);
4342 }
4343 
4344 /*
4345  * Insert ill into the list of configured ill's. Once this function completes,
4346  * the ill is globally visible and is available through lookups. More precisely
4347  * this happens after the caller drops the ill_g_lock.
4348  */
4349 static int
4350 ill_glist_insert(ill_t *ill, char *name, boolean_t isv6)
4351 {
4352 	ill_if_t *ill_interface;
4353 	avl_index_t where = 0;
4354 	int error;
4355 	int name_length;
4356 	int index;
4357 	boolean_t check_length = B_FALSE;
4358 	ip_stack_t	*ipst = ill->ill_ipst;
4359 
4360 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
4361 
4362 	name_length = mi_strlen(name) + 1;
4363 
4364 	if (isv6)
4365 		index = IP_V6_G_HEAD;
4366 	else
4367 		index = IP_V4_G_HEAD;
4368 
4369 	ill_interface = IP_VX_ILL_G_LIST(index, ipst);
4370 	/*
4371 	 * Search for interface type based on name
4372 	 */
4373 	while (ill_interface != (ill_if_t *)&IP_VX_ILL_G_LIST(index, ipst)) {
4374 		if ((ill_interface->illif_name_len == name_length) &&
4375 		    (strcmp(ill_interface->illif_name, name) == 0)) {
4376 			break;
4377 		}
4378 		ill_interface = ill_interface->illif_next;
4379 	}
4380 
4381 	/*
4382 	 * Interface type not found, create one.
4383 	 */
4384 	if (ill_interface == (ill_if_t *)&IP_VX_ILL_G_LIST(index, ipst)) {
4385 		ill_g_head_t ghead;
4386 
4387 		/*
4388 		 * allocate ill_if_t structure
4389 		 */
4390 		ill_interface = (ill_if_t *)mi_zalloc(sizeof (ill_if_t));
4391 		if (ill_interface == NULL) {
4392 			return (ENOMEM);
4393 		}
4394 
4395 		(void) strcpy(ill_interface->illif_name, name);
4396 		ill_interface->illif_name_len = name_length;
4397 
4398 		avl_create(&ill_interface->illif_avl_by_ppa,
4399 		    ill_compare_ppa, sizeof (ill_t),
4400 		    offsetof(struct ill_s, ill_avl_byppa));
4401 
4402 		/*
4403 		 * link the structure in the back to maintain order
4404 		 * of configuration for ifconfig output.
4405 		 */
4406 		ghead = ipst->ips_ill_g_heads[index];
4407 		insque(ill_interface, ghead.ill_g_list_tail);
4408 	}
4409 
4410 	if (ill->ill_ppa == UINT_MAX)
4411 		check_length = B_TRUE;
4412 
4413 	error = ill_alloc_ppa(ill_interface, ill);
4414 	if (error != 0) {
4415 		if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
4416 			ill_delete_interface_type(ill->ill_ifptr);
4417 		return (error);
4418 	}
4419 
4420 	/*
4421 	 * When the ppa is choosen by the system, check that there is
4422 	 * enough space to insert ppa. if a specific ppa was passed in this
4423 	 * check is not required as the interface name passed in will have
4424 	 * the right ppa in it.
4425 	 */
4426 	if (check_length) {
4427 		/*
4428 		 * UINT_MAX - 1 should fit in 10 chars, alloc 12 chars.
4429 		 */
4430 		char buf[sizeof (uint_t) * 3];
4431 
4432 		/*
4433 		 * convert ppa to string to calculate the amount of space
4434 		 * required for it in the name.
4435 		 */
4436 		numtos(ill->ill_ppa, buf);
4437 
4438 		/* Do we have enough space to insert ppa ? */
4439 
4440 		if ((mi_strlen(name) + mi_strlen(buf) + 1) > LIFNAMSIZ) {
4441 			/* Free ppa and interface type struct */
4442 			if (ill_interface->illif_ppa_arena != NULL) {
4443 				vmem_free(ill_interface->illif_ppa_arena,
4444 				    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
4445 			}
4446 			if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
4447 				ill_delete_interface_type(ill->ill_ifptr);
4448 
4449 			return (EINVAL);
4450 		}
4451 	}
4452 
4453 	(void) sprintf(ill->ill_name, "%s%u", name, ill->ill_ppa);
4454 	ill->ill_name_length = mi_strlen(ill->ill_name) + 1;
4455 
4456 	(void) avl_find(&ill_interface->illif_avl_by_ppa, &ill->ill_ppa,
4457 	    &where);
4458 	ill->ill_ifptr = ill_interface;
4459 	avl_insert(&ill_interface->illif_avl_by_ppa, ill, where);
4460 
4461 	ill_phyint_reinit(ill);
4462 	return (0);
4463 }
4464 
4465 /* Initialize the per phyint ipsq used for serialization */
4466 static boolean_t
4467 ipsq_init(ill_t *ill, boolean_t enter)
4468 {
4469 	ipsq_t  *ipsq;
4470 	ipxop_t	*ipx;
4471 
4472 	if ((ipsq = kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP)) == NULL)
4473 		return (B_FALSE);
4474 
4475 	ill->ill_phyint->phyint_ipsq = ipsq;
4476 	ipx = ipsq->ipsq_xop = &ipsq->ipsq_ownxop;
4477 	ipx->ipx_ipsq = ipsq;
4478 	ipsq->ipsq_next = ipsq;
4479 	ipsq->ipsq_phyint = ill->ill_phyint;
4480 	mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, 0);
4481 	mutex_init(&ipx->ipx_lock, NULL, MUTEX_DEFAULT, 0);
4482 	ipsq->ipsq_ipst = ill->ill_ipst;	/* No netstack_hold */
4483 	if (enter) {
4484 		ipx->ipx_writer = curthread;
4485 		ipx->ipx_forced = B_FALSE;
4486 		ipx->ipx_reentry_cnt = 1;
4487 #ifdef DEBUG
4488 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
4489 #endif
4490 	}
4491 	return (B_TRUE);
4492 }
4493 
4494 /*
4495  * ill_init is called by ip_open when a device control stream is opened.
4496  * It does a few initializations, and shoots a DL_INFO_REQ message down
4497  * to the driver.  The response is later picked up in ip_rput_dlpi and
4498  * used to set up default mechanisms for talking to the driver.  (Always
4499  * called as writer.)
4500  *
4501  * If this function returns error, ip_open will call ip_close which in
4502  * turn will call ill_delete to clean up any memory allocated here that
4503  * is not yet freed.
4504  */
4505 int
4506 ill_init(queue_t *q, ill_t *ill)
4507 {
4508 	int	count;
4509 	dl_info_req_t	*dlir;
4510 	mblk_t	*info_mp;
4511 	uchar_t *frag_ptr;
4512 
4513 	/*
4514 	 * The ill is initialized to zero by mi_alloc*(). In addition
4515 	 * some fields already contain valid values, initialized in
4516 	 * ip_open(), before we reach here.
4517 	 */
4518 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, 0);
4519 
4520 	ill->ill_rq = q;
4521 	ill->ill_wq = WR(q);
4522 
4523 	info_mp = allocb(MAX(sizeof (dl_info_req_t), sizeof (dl_info_ack_t)),
4524 	    BPRI_HI);
4525 	if (info_mp == NULL)
4526 		return (ENOMEM);
4527 
4528 	/*
4529 	 * Allocate sufficient space to contain our fragment hash table and
4530 	 * the device name.
4531 	 */
4532 	frag_ptr = (uchar_t *)mi_zalloc(ILL_FRAG_HASH_TBL_SIZE +
4533 	    2 * LIFNAMSIZ + 5 + strlen(ipv6_forward_suffix));
4534 	if (frag_ptr == NULL) {
4535 		freemsg(info_mp);
4536 		return (ENOMEM);
4537 	}
4538 	ill->ill_frag_ptr = frag_ptr;
4539 	ill->ill_frag_free_num_pkts = 0;
4540 	ill->ill_last_frag_clean_time = 0;
4541 	ill->ill_frag_hash_tbl = (ipfb_t *)frag_ptr;
4542 	ill->ill_name = (char *)(frag_ptr + ILL_FRAG_HASH_TBL_SIZE);
4543 	for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
4544 		mutex_init(&ill->ill_frag_hash_tbl[count].ipfb_lock,
4545 		    NULL, MUTEX_DEFAULT, NULL);
4546 	}
4547 
4548 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
4549 	if (ill->ill_phyint == NULL) {
4550 		freemsg(info_mp);
4551 		mi_free(frag_ptr);
4552 		return (ENOMEM);
4553 	}
4554 
4555 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
4556 	/*
4557 	 * For now pretend this is a v4 ill. We need to set phyint_ill*
4558 	 * at this point because of the following reason. If we can't
4559 	 * enter the ipsq at some point and cv_wait, the writer that
4560 	 * wakes us up tries to locate us using the list of all phyints
4561 	 * in an ipsq and the ills from the phyint thru the phyint_ill*.
4562 	 * If we don't set it now, we risk a missed wakeup.
4563 	 */
4564 	ill->ill_phyint->phyint_illv4 = ill;
4565 	ill->ill_ppa = UINT_MAX;
4566 	ill->ill_fastpath_list = &ill->ill_fastpath_list;
4567 
4568 	if (!ipsq_init(ill, B_TRUE)) {
4569 		freemsg(info_mp);
4570 		mi_free(frag_ptr);
4571 		mi_free(ill->ill_phyint);
4572 		return (ENOMEM);
4573 	}
4574 
4575 	ill->ill_state_flags |= ILL_LL_SUBNET_PENDING;
4576 
4577 	/* Frag queue limit stuff */
4578 	ill->ill_frag_count = 0;
4579 	ill->ill_ipf_gen = 0;
4580 
4581 	ill->ill_global_timer = INFINITY;
4582 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
4583 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
4584 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
4585 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
4586 
4587 	/*
4588 	 * Initialize IPv6 configuration variables.  The IP module is always
4589 	 * opened as an IPv4 module.  Instead tracking down the cases where
4590 	 * it switches to do ipv6, we'll just initialize the IPv6 configuration
4591 	 * here for convenience, this has no effect until the ill is set to do
4592 	 * IPv6.
4593 	 */
4594 	ill->ill_reachable_time = ND_REACHABLE_TIME;
4595 	ill->ill_reachable_retrans_time = ND_RETRANS_TIMER;
4596 	ill->ill_xmit_count = ND_MAX_MULTICAST_SOLICIT;
4597 	ill->ill_max_buf = ND_MAX_Q;
4598 	ill->ill_refcnt = 0;
4599 
4600 	/* Send down the Info Request to the driver. */
4601 	info_mp->b_datap->db_type = M_PCPROTO;
4602 	dlir = (dl_info_req_t *)info_mp->b_rptr;
4603 	info_mp->b_wptr = (uchar_t *)&dlir[1];
4604 	dlir->dl_primitive = DL_INFO_REQ;
4605 
4606 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
4607 
4608 	qprocson(q);
4609 	ill_dlpi_send(ill, info_mp);
4610 
4611 	return (0);
4612 }
4613 
4614 /*
4615  * ill_dls_info
4616  * creates datalink socket info from the device.
4617  */
4618 int
4619 ill_dls_info(struct sockaddr_dl *sdl, const ipif_t *ipif)
4620 {
4621 	size_t	len;
4622 	ill_t	*ill = ipif->ipif_ill;
4623 
4624 	sdl->sdl_family = AF_LINK;
4625 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
4626 	sdl->sdl_type = ill->ill_type;
4627 	ipif_get_name(ipif, sdl->sdl_data, sizeof (sdl->sdl_data));
4628 	len = strlen(sdl->sdl_data);
4629 	ASSERT(len < 256);
4630 	sdl->sdl_nlen = (uchar_t)len;
4631 	sdl->sdl_alen = ill->ill_phys_addr_length;
4632 	sdl->sdl_slen = 0;
4633 	if (ill->ill_phys_addr_length != 0 && ill->ill_phys_addr != NULL)
4634 		bcopy(ill->ill_phys_addr, &sdl->sdl_data[len], sdl->sdl_alen);
4635 
4636 	return (sizeof (struct sockaddr_dl));
4637 }
4638 
4639 /*
4640  * ill_xarp_info
4641  * creates xarp info from the device.
4642  */
4643 static int
4644 ill_xarp_info(struct sockaddr_dl *sdl, ill_t *ill)
4645 {
4646 	sdl->sdl_family = AF_LINK;
4647 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
4648 	sdl->sdl_type = ill->ill_type;
4649 	ipif_get_name(ill->ill_ipif, sdl->sdl_data, sizeof (sdl->sdl_data));
4650 	sdl->sdl_nlen = (uchar_t)mi_strlen(sdl->sdl_data);
4651 	sdl->sdl_alen = ill->ill_phys_addr_length;
4652 	sdl->sdl_slen = 0;
4653 	return (sdl->sdl_nlen);
4654 }
4655 
4656 static int
4657 loopback_kstat_update(kstat_t *ksp, int rw)
4658 {
4659 	kstat_named_t *kn;
4660 	netstackid_t	stackid;
4661 	netstack_t	*ns;
4662 	ip_stack_t	*ipst;
4663 
4664 	if (ksp == NULL || ksp->ks_data == NULL)
4665 		return (EIO);
4666 
4667 	if (rw == KSTAT_WRITE)
4668 		return (EACCES);
4669 
4670 	kn = KSTAT_NAMED_PTR(ksp);
4671 	stackid = (zoneid_t)(uintptr_t)ksp->ks_private;
4672 
4673 	ns = netstack_find_by_stackid(stackid);
4674 	if (ns == NULL)
4675 		return (-1);
4676 
4677 	ipst = ns->netstack_ip;
4678 	if (ipst == NULL) {
4679 		netstack_rele(ns);
4680 		return (-1);
4681 	}
4682 	kn[0].value.ui32 = ipst->ips_loopback_packets;
4683 	kn[1].value.ui32 = ipst->ips_loopback_packets;
4684 	netstack_rele(ns);
4685 	return (0);
4686 }
4687 
4688 /*
4689  * Has ifindex been plumbed already?
4690  */
4691 boolean_t
4692 phyint_exists(uint_t index, ip_stack_t *ipst)
4693 {
4694 	ASSERT(index != 0);
4695 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
4696 
4697 	return (avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
4698 	    &index, NULL) != NULL);
4699 }
4700 
4701 /* Pick a unique ifindex */
4702 boolean_t
4703 ip_assign_ifindex(uint_t *indexp, ip_stack_t *ipst)
4704 {
4705 	uint_t starting_index;
4706 
4707 	if (!ipst->ips_ill_index_wrap) {
4708 		*indexp = ipst->ips_ill_index++;
4709 		if (ipst->ips_ill_index == 0) {
4710 			/* Reached the uint_t limit Next time wrap  */
4711 			ipst->ips_ill_index_wrap = B_TRUE;
4712 		}
4713 		return (B_TRUE);
4714 	}
4715 
4716 	/*
4717 	 * Start reusing unused indexes. Note that we hold the ill_g_lock
4718 	 * at this point and don't want to call any function that attempts
4719 	 * to get the lock again.
4720 	 */
4721 	starting_index = ipst->ips_ill_index++;
4722 	for (; ipst->ips_ill_index != starting_index; ipst->ips_ill_index++) {
4723 		if (ipst->ips_ill_index != 0 &&
4724 		    !phyint_exists(ipst->ips_ill_index, ipst)) {
4725 			/* found unused index - use it */
4726 			*indexp = ipst->ips_ill_index;
4727 			return (B_TRUE);
4728 		}
4729 	}
4730 
4731 	/*
4732 	 * all interface indicies are inuse.
4733 	 */
4734 	return (B_FALSE);
4735 }
4736 
4737 /*
4738  * Assign a unique interface index for the phyint.
4739  */
4740 static boolean_t
4741 phyint_assign_ifindex(phyint_t *phyi, ip_stack_t *ipst)
4742 {
4743 	ASSERT(phyi->phyint_ifindex == 0);
4744 	return (ip_assign_ifindex(&phyi->phyint_ifindex, ipst));
4745 }
4746 
4747 /*
4748  * Return a pointer to the ill which matches the supplied name.  Note that
4749  * the ill name length includes the null termination character.  (May be
4750  * called as writer.)
4751  * If do_alloc and the interface is "lo0" it will be automatically created.
4752  * Cannot bump up reference on condemned ills. So dup detect can't be done
4753  * using this func.
4754  */
4755 ill_t *
4756 ill_lookup_on_name(char *name, boolean_t do_alloc, boolean_t isv6,
4757     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, boolean_t *did_alloc,
4758     ip_stack_t *ipst)
4759 {
4760 	ill_t	*ill;
4761 	ipif_t	*ipif;
4762 	ipsq_t	*ipsq;
4763 	kstat_named_t	*kn;
4764 	boolean_t isloopback;
4765 	in6_addr_t ov6addr;
4766 
4767 	isloopback = mi_strcmp(name, ipif_loopback_name) == 0;
4768 
4769 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4770 	ill = ill_find_by_name(name, isv6, q, mp, func, error, ipst);
4771 	rw_exit(&ipst->ips_ill_g_lock);
4772 	if (ill != NULL || (error != NULL && *error == EINPROGRESS))
4773 		return (ill);
4774 
4775 	/*
4776 	 * Couldn't find it.  Does this happen to be a lookup for the
4777 	 * loopback device and are we allowed to allocate it?
4778 	 */
4779 	if (!isloopback || !do_alloc)
4780 		return (NULL);
4781 
4782 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
4783 
4784 	ill = ill_find_by_name(name, isv6, q, mp, func, error, ipst);
4785 	if (ill != NULL || (error != NULL && *error == EINPROGRESS)) {
4786 		rw_exit(&ipst->ips_ill_g_lock);
4787 		return (ill);
4788 	}
4789 
4790 	/* Create the loopback device on demand */
4791 	ill = (ill_t *)(mi_alloc(sizeof (ill_t) +
4792 	    sizeof (ipif_loopback_name), BPRI_MED));
4793 	if (ill == NULL)
4794 		goto done;
4795 
4796 	*ill = ill_null;
4797 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, NULL);
4798 	ill->ill_ipst = ipst;
4799 	netstack_hold(ipst->ips_netstack);
4800 	/*
4801 	 * For exclusive stacks we set the zoneid to zero
4802 	 * to make IP operate as if in the global zone.
4803 	 */
4804 	ill->ill_zoneid = GLOBAL_ZONEID;
4805 
4806 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
4807 	if (ill->ill_phyint == NULL)
4808 		goto done;
4809 
4810 	if (isv6)
4811 		ill->ill_phyint->phyint_illv6 = ill;
4812 	else
4813 		ill->ill_phyint->phyint_illv4 = ill;
4814 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
4815 	ill->ill_max_frag = IP_LOOPBACK_MTU;
4816 	/* Add room for tcp+ip headers */
4817 	if (isv6) {
4818 		ill->ill_isv6 = B_TRUE;
4819 		ill->ill_max_frag += IPV6_HDR_LEN + 20;	/* for TCP */
4820 	} else {
4821 		ill->ill_max_frag += IP_SIMPLE_HDR_LENGTH + 20;
4822 	}
4823 	if (!ill_allocate_mibs(ill))
4824 		goto done;
4825 	ill->ill_max_mtu = ill->ill_max_frag;
4826 	/*
4827 	 * ipif_loopback_name can't be pointed at directly because its used
4828 	 * by both the ipv4 and ipv6 interfaces.  When the ill is removed
4829 	 * from the glist, ill_glist_delete() sets the first character of
4830 	 * ill_name to '\0'.
4831 	 */
4832 	ill->ill_name = (char *)ill + sizeof (*ill);
4833 	(void) strcpy(ill->ill_name, ipif_loopback_name);
4834 	ill->ill_name_length = sizeof (ipif_loopback_name);
4835 	/* Set ill_dlpi_pending for ipsq_current_finish() to work properly */
4836 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
4837 
4838 	ill->ill_global_timer = INFINITY;
4839 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
4840 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
4841 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
4842 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
4843 
4844 	/* No resolver here. */
4845 	ill->ill_net_type = IRE_LOOPBACK;
4846 
4847 	/* Initialize the ipsq */
4848 	if (!ipsq_init(ill, B_FALSE))
4849 		goto done;
4850 
4851 	ipif = ipif_allocate(ill, 0L, IRE_LOOPBACK, B_TRUE, B_TRUE);
4852 	if (ipif == NULL)
4853 		goto done;
4854 
4855 	ill->ill_flags = ILLF_MULTICAST;
4856 
4857 	ov6addr = ipif->ipif_v6lcl_addr;
4858 	/* Set up default loopback address and mask. */
4859 	if (!isv6) {
4860 		ipaddr_t inaddr_loopback = htonl(INADDR_LOOPBACK);
4861 
4862 		IN6_IPADDR_TO_V4MAPPED(inaddr_loopback, &ipif->ipif_v6lcl_addr);
4863 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
4864 		V4MASK_TO_V6(htonl(IN_CLASSA_NET), ipif->ipif_v6net_mask);
4865 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
4866 		    ipif->ipif_v6subnet);
4867 		ill->ill_flags |= ILLF_IPV4;
4868 	} else {
4869 		ipif->ipif_v6lcl_addr = ipv6_loopback;
4870 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
4871 		ipif->ipif_v6net_mask = ipv6_all_ones;
4872 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
4873 		    ipif->ipif_v6subnet);
4874 		ill->ill_flags |= ILLF_IPV6;
4875 	}
4876 
4877 	/*
4878 	 * Chain us in at the end of the ill list. hold the ill
4879 	 * before we make it globally visible. 1 for the lookup.
4880 	 */
4881 	ill->ill_refcnt = 0;
4882 	ill_refhold(ill);
4883 
4884 	ill->ill_frag_count = 0;
4885 	ill->ill_frag_free_num_pkts = 0;
4886 	ill->ill_last_frag_clean_time = 0;
4887 
4888 	ipsq = ill->ill_phyint->phyint_ipsq;
4889 
4890 	if (ill_glist_insert(ill, "lo", isv6) != 0)
4891 		cmn_err(CE_PANIC, "cannot insert loopback interface");
4892 
4893 	/* Let SCTP know so that it can add this to its list */
4894 	sctp_update_ill(ill, SCTP_ILL_INSERT);
4895 
4896 	/*
4897 	 * We have already assigned ipif_v6lcl_addr above, but we need to
4898 	 * call sctp_update_ipif_addr() after SCTP_ILL_INSERT, which
4899 	 * requires to be after ill_glist_insert() since we need the
4900 	 * ill_index set. Pass on ipv6_loopback as the old address.
4901 	 */
4902 	sctp_update_ipif_addr(ipif, ov6addr);
4903 
4904 	/*
4905 	 * ill_glist_insert() -> ill_phyint_reinit() may have merged IPSQs.
4906 	 * If so, free our original one.
4907 	 */
4908 	if (ipsq != ill->ill_phyint->phyint_ipsq)
4909 		ipsq_delete(ipsq);
4910 
4911 	/*
4912 	 * Delay this till the ipif is allocated as ipif_allocate
4913 	 * de-references ill_phyint for getting the ifindex. We
4914 	 * can't do this before ipif_allocate because ill_phyint_reinit
4915 	 * -> phyint_assign_ifindex expects ipif to be present.
4916 	 */
4917 	mutex_enter(&ill->ill_phyint->phyint_lock);
4918 	ill->ill_phyint->phyint_flags |= PHYI_LOOPBACK | PHYI_VIRTUAL;
4919 	mutex_exit(&ill->ill_phyint->phyint_lock);
4920 
4921 	if (ipst->ips_loopback_ksp == NULL) {
4922 		/* Export loopback interface statistics */
4923 		ipst->ips_loopback_ksp = kstat_create_netstack("lo", 0,
4924 		    ipif_loopback_name, "net",
4925 		    KSTAT_TYPE_NAMED, 2, 0,
4926 		    ipst->ips_netstack->netstack_stackid);
4927 		if (ipst->ips_loopback_ksp != NULL) {
4928 			ipst->ips_loopback_ksp->ks_update =
4929 			    loopback_kstat_update;
4930 			kn = KSTAT_NAMED_PTR(ipst->ips_loopback_ksp);
4931 			kstat_named_init(&kn[0], "ipackets", KSTAT_DATA_UINT32);
4932 			kstat_named_init(&kn[1], "opackets", KSTAT_DATA_UINT32);
4933 			ipst->ips_loopback_ksp->ks_private =
4934 			    (void *)(uintptr_t)ipst->ips_netstack->
4935 			    netstack_stackid;
4936 			kstat_install(ipst->ips_loopback_ksp);
4937 		}
4938 	}
4939 
4940 	if (error != NULL)
4941 		*error = 0;
4942 	*did_alloc = B_TRUE;
4943 	rw_exit(&ipst->ips_ill_g_lock);
4944 	ill_nic_event_dispatch(ill, MAP_IPIF_ID(ill->ill_ipif->ipif_id),
4945 	    NE_PLUMB, ill->ill_name, ill->ill_name_length);
4946 	return (ill);
4947 done:
4948 	if (ill != NULL) {
4949 		if (ill->ill_phyint != NULL) {
4950 			ipsq = ill->ill_phyint->phyint_ipsq;
4951 			if (ipsq != NULL) {
4952 				ipsq->ipsq_phyint = NULL;
4953 				ipsq_delete(ipsq);
4954 			}
4955 			mi_free(ill->ill_phyint);
4956 		}
4957 		ill_free_mib(ill);
4958 		if (ill->ill_ipst != NULL)
4959 			netstack_rele(ill->ill_ipst->ips_netstack);
4960 		mi_free(ill);
4961 	}
4962 	rw_exit(&ipst->ips_ill_g_lock);
4963 	if (error != NULL)
4964 		*error = ENOMEM;
4965 	return (NULL);
4966 }
4967 
4968 /*
4969  * For IPP calls - use the ip_stack_t for global stack.
4970  */
4971 ill_t *
4972 ill_lookup_on_ifindex_global_instance(uint_t index, boolean_t isv6,
4973     queue_t *q, mblk_t *mp, ipsq_func_t func, int *err)
4974 {
4975 	ip_stack_t	*ipst;
4976 	ill_t		*ill;
4977 
4978 	ipst = netstack_find_by_stackid(GLOBAL_NETSTACKID)->netstack_ip;
4979 	if (ipst == NULL) {
4980 		cmn_err(CE_WARN, "No ip_stack_t for zoneid zero!\n");
4981 		return (NULL);
4982 	}
4983 
4984 	ill = ill_lookup_on_ifindex(index, isv6, q, mp, func, err, ipst);
4985 	netstack_rele(ipst->ips_netstack);
4986 	return (ill);
4987 }
4988 
4989 /*
4990  * Return a pointer to the ill which matches the index and IP version type.
4991  */
4992 ill_t *
4993 ill_lookup_on_ifindex(uint_t index, boolean_t isv6, queue_t *q, mblk_t *mp,
4994     ipsq_func_t func, int *err, ip_stack_t *ipst)
4995 {
4996 	ill_t	*ill;
4997 	ipsq_t  *ipsq;
4998 	phyint_t *phyi;
4999 
5000 	ASSERT((q == NULL && mp == NULL && func == NULL && err == NULL) ||
5001 	    (q != NULL && mp != NULL && func != NULL && err != NULL));
5002 
5003 	if (err != NULL)
5004 		*err = 0;
5005 
5006 	/*
5007 	 * Indexes are stored in the phyint - a common structure
5008 	 * to both IPv4 and IPv6.
5009 	 */
5010 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5011 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
5012 	    (void *) &index, NULL);
5013 	if (phyi != NULL) {
5014 		ill = isv6 ? phyi->phyint_illv6: phyi->phyint_illv4;
5015 		if (ill != NULL) {
5016 			/*
5017 			 * The block comment at the start of ipif_down
5018 			 * explains the use of the macros used below
5019 			 */
5020 			GRAB_CONN_LOCK(q);
5021 			mutex_enter(&ill->ill_lock);
5022 			if (ILL_CAN_LOOKUP(ill)) {
5023 				ill_refhold_locked(ill);
5024 				mutex_exit(&ill->ill_lock);
5025 				RELEASE_CONN_LOCK(q);
5026 				rw_exit(&ipst->ips_ill_g_lock);
5027 				return (ill);
5028 			} else if (ILL_CAN_WAIT(ill, q)) {
5029 				ipsq = ill->ill_phyint->phyint_ipsq;
5030 				mutex_enter(&ipsq->ipsq_lock);
5031 				mutex_enter(&ipsq->ipsq_xop->ipx_lock);
5032 				rw_exit(&ipst->ips_ill_g_lock);
5033 				mutex_exit(&ill->ill_lock);
5034 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
5035 				mutex_exit(&ipsq->ipsq_xop->ipx_lock);
5036 				mutex_exit(&ipsq->ipsq_lock);
5037 				RELEASE_CONN_LOCK(q);
5038 				if (err != NULL)
5039 					*err = EINPROGRESS;
5040 				return (NULL);
5041 			}
5042 			RELEASE_CONN_LOCK(q);
5043 			mutex_exit(&ill->ill_lock);
5044 		}
5045 	}
5046 	rw_exit(&ipst->ips_ill_g_lock);
5047 	if (err != NULL)
5048 		*err = ENXIO;
5049 	return (NULL);
5050 }
5051 
5052 /*
5053  * Return the ifindex next in sequence after the passed in ifindex.
5054  * If there is no next ifindex for the given protocol, return 0.
5055  */
5056 uint_t
5057 ill_get_next_ifindex(uint_t index, boolean_t isv6, ip_stack_t *ipst)
5058 {
5059 	phyint_t *phyi;
5060 	phyint_t *phyi_initial;
5061 	uint_t   ifindex;
5062 
5063 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5064 
5065 	if (index == 0) {
5066 		phyi = avl_first(
5067 		    &ipst->ips_phyint_g_list->phyint_list_avl_by_index);
5068 	} else {
5069 		phyi = phyi_initial = avl_find(
5070 		    &ipst->ips_phyint_g_list->phyint_list_avl_by_index,
5071 		    (void *) &index, NULL);
5072 	}
5073 
5074 	for (; phyi != NULL;
5075 	    phyi = avl_walk(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
5076 	    phyi, AVL_AFTER)) {
5077 		/*
5078 		 * If we're not returning the first interface in the tree
5079 		 * and we still haven't moved past the phyint_t that
5080 		 * corresponds to index, avl_walk needs to be called again
5081 		 */
5082 		if (!((index != 0) && (phyi == phyi_initial))) {
5083 			if (isv6) {
5084 				if ((phyi->phyint_illv6) &&
5085 				    ILL_CAN_LOOKUP(phyi->phyint_illv6) &&
5086 				    (phyi->phyint_illv6->ill_isv6 == 1))
5087 					break;
5088 			} else {
5089 				if ((phyi->phyint_illv4) &&
5090 				    ILL_CAN_LOOKUP(phyi->phyint_illv4) &&
5091 				    (phyi->phyint_illv4->ill_isv6 == 0))
5092 					break;
5093 			}
5094 		}
5095 	}
5096 
5097 	rw_exit(&ipst->ips_ill_g_lock);
5098 
5099 	if (phyi != NULL)
5100 		ifindex = phyi->phyint_ifindex;
5101 	else
5102 		ifindex = 0;
5103 
5104 	return (ifindex);
5105 }
5106 
5107 /*
5108  * Return the ifindex for the named interface.
5109  * If there is no next ifindex for the interface, return 0.
5110  */
5111 uint_t
5112 ill_get_ifindex_by_name(char *name, ip_stack_t *ipst)
5113 {
5114 	phyint_t	*phyi;
5115 	avl_index_t	where = 0;
5116 	uint_t		ifindex;
5117 
5118 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5119 
5120 	if ((phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
5121 	    name, &where)) == NULL) {
5122 		rw_exit(&ipst->ips_ill_g_lock);
5123 		return (0);
5124 	}
5125 
5126 	ifindex = phyi->phyint_ifindex;
5127 
5128 	rw_exit(&ipst->ips_ill_g_lock);
5129 
5130 	return (ifindex);
5131 }
5132 
5133 /*
5134  * Obtain a reference to the ill. The ill_refcnt is a dynamic refcnt
5135  * that gives a running thread a reference to the ill. This reference must be
5136  * released by the thread when it is done accessing the ill and related
5137  * objects. ill_refcnt can not be used to account for static references
5138  * such as other structures pointing to an ill. Callers must generally
5139  * check whether an ill can be refheld by using ILL_CAN_LOOKUP macros
5140  * or be sure that the ill is not being deleted or changing state before
5141  * calling the refhold functions. A non-zero ill_refcnt ensures that the
5142  * ill won't change any of its critical state such as address, netmask etc.
5143  */
5144 void
5145 ill_refhold(ill_t *ill)
5146 {
5147 	mutex_enter(&ill->ill_lock);
5148 	ill->ill_refcnt++;
5149 	ILL_TRACE_REF(ill);
5150 	mutex_exit(&ill->ill_lock);
5151 }
5152 
5153 void
5154 ill_refhold_locked(ill_t *ill)
5155 {
5156 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5157 	ill->ill_refcnt++;
5158 	ILL_TRACE_REF(ill);
5159 }
5160 
5161 int
5162 ill_check_and_refhold(ill_t *ill)
5163 {
5164 	mutex_enter(&ill->ill_lock);
5165 	if (ILL_CAN_LOOKUP(ill)) {
5166 		ill_refhold_locked(ill);
5167 		mutex_exit(&ill->ill_lock);
5168 		return (0);
5169 	}
5170 	mutex_exit(&ill->ill_lock);
5171 	return (ILL_LOOKUP_FAILED);
5172 }
5173 
5174 /*
5175  * Must not be called while holding any locks. Otherwise if this is
5176  * the last reference to be released, there is a chance of recursive mutex
5177  * panic due to ill_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
5178  * to restart an ioctl.
5179  */
5180 void
5181 ill_refrele(ill_t *ill)
5182 {
5183 	mutex_enter(&ill->ill_lock);
5184 	ASSERT(ill->ill_refcnt != 0);
5185 	ill->ill_refcnt--;
5186 	ILL_UNTRACE_REF(ill);
5187 	if (ill->ill_refcnt != 0) {
5188 		/* Every ire pointing to the ill adds 1 to ill_refcnt */
5189 		mutex_exit(&ill->ill_lock);
5190 		return;
5191 	}
5192 
5193 	/* Drops the ill_lock */
5194 	ipif_ill_refrele_tail(ill);
5195 }
5196 
5197 /*
5198  * Obtain a weak reference count on the ill. This reference ensures the
5199  * ill won't be freed, but the ill may change any of its critical state
5200  * such as netmask, address etc. Returns an error if the ill has started
5201  * closing.
5202  */
5203 boolean_t
5204 ill_waiter_inc(ill_t *ill)
5205 {
5206 	mutex_enter(&ill->ill_lock);
5207 	if (ill->ill_state_flags & ILL_CONDEMNED) {
5208 		mutex_exit(&ill->ill_lock);
5209 		return (B_FALSE);
5210 	}
5211 	ill->ill_waiters++;
5212 	mutex_exit(&ill->ill_lock);
5213 	return (B_TRUE);
5214 }
5215 
5216 void
5217 ill_waiter_dcr(ill_t *ill)
5218 {
5219 	mutex_enter(&ill->ill_lock);
5220 	ill->ill_waiters--;
5221 	if (ill->ill_waiters == 0)
5222 		cv_broadcast(&ill->ill_cv);
5223 	mutex_exit(&ill->ill_lock);
5224 }
5225 
5226 /*
5227  * Named Dispatch routine to produce a formatted report on all ILLs.
5228  * This report is accessed by using the ndd utility to "get" ND variable
5229  * "ip_ill_status".
5230  */
5231 /* ARGSUSED */
5232 int
5233 ip_ill_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
5234 {
5235 	ill_t		*ill;
5236 	ill_walk_context_t ctx;
5237 	ip_stack_t	*ipst;
5238 
5239 	ipst = CONNQ_TO_IPST(q);
5240 
5241 	(void) mi_mpprintf(mp,
5242 	    "ILL      " MI_COL_HDRPAD_STR
5243 	/*   01234567[89ABCDEF] */
5244 	    "rq       " MI_COL_HDRPAD_STR
5245 	/*   01234567[89ABCDEF] */
5246 	    "wq       " MI_COL_HDRPAD_STR
5247 	/*   01234567[89ABCDEF] */
5248 	    "upcnt mxfrg err name");
5249 	/*   12345 12345 123 xxxxxxxx  */
5250 
5251 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5252 	ill = ILL_START_WALK_ALL(&ctx, ipst);
5253 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5254 		(void) mi_mpprintf(mp,
5255 		    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR
5256 		    "%05u %05u %03d %s",
5257 		    (void *)ill, (void *)ill->ill_rq, (void *)ill->ill_wq,
5258 		    ill->ill_ipif_up_count,
5259 		    ill->ill_max_frag, ill->ill_error, ill->ill_name);
5260 	}
5261 	rw_exit(&ipst->ips_ill_g_lock);
5262 
5263 	return (0);
5264 }
5265 
5266 /*
5267  * Named Dispatch routine to produce a formatted report on all IPIFs.
5268  * This report is accessed by using the ndd utility to "get" ND variable
5269  * "ip_ipif_status".
5270  */
5271 /* ARGSUSED */
5272 int
5273 ip_ipif_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
5274 {
5275 	char	buf1[INET6_ADDRSTRLEN];
5276 	char	buf2[INET6_ADDRSTRLEN];
5277 	char	buf3[INET6_ADDRSTRLEN];
5278 	char	buf4[INET6_ADDRSTRLEN];
5279 	char	buf5[INET6_ADDRSTRLEN];
5280 	char	buf6[INET6_ADDRSTRLEN];
5281 	char	buf[LIFNAMSIZ];
5282 	ill_t	*ill;
5283 	ipif_t	*ipif;
5284 	nv_t	*nvp;
5285 	uint64_t flags;
5286 	zoneid_t zoneid;
5287 	ill_walk_context_t ctx;
5288 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
5289 
5290 	(void) mi_mpprintf(mp,
5291 	    "IPIF metric mtu in/out/forward name zone flags...\n"
5292 	    "\tlocal address\n"
5293 	    "\tsrc address\n"
5294 	    "\tsubnet\n"
5295 	    "\tmask\n"
5296 	    "\tbroadcast\n"
5297 	    "\tp-p-dst");
5298 
5299 	ASSERT(q->q_next == NULL);
5300 	zoneid = Q_TO_CONN(q)->conn_zoneid;	/* IP is a driver */
5301 
5302 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5303 	ill = ILL_START_WALK_ALL(&ctx, ipst);
5304 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5305 		for (ipif = ill->ill_ipif; ipif != NULL;
5306 		    ipif = ipif->ipif_next) {
5307 			if (zoneid != GLOBAL_ZONEID &&
5308 			    zoneid != ipif->ipif_zoneid &&
5309 			    ipif->ipif_zoneid != ALL_ZONES)
5310 				continue;
5311 
5312 			ipif_get_name(ipif, buf, sizeof (buf));
5313 			(void) mi_mpprintf(mp,
5314 			    MI_COL_PTRFMT_STR
5315 			    "%04u %05u %u/%u/%u %s %d",
5316 			    (void *)ipif,
5317 			    ipif->ipif_metric, ipif->ipif_mtu,
5318 			    ipif->ipif_ib_pkt_count,
5319 			    ipif->ipif_ob_pkt_count,
5320 			    ipif->ipif_fo_pkt_count,
5321 			    buf,
5322 			    ipif->ipif_zoneid);
5323 
5324 		flags = ipif->ipif_flags | ipif->ipif_ill->ill_flags |
5325 		    ipif->ipif_ill->ill_phyint->phyint_flags;
5326 
5327 		/* Tack on text strings for any flags. */
5328 		nvp = ipif_nv_tbl;
5329 		for (; nvp < A_END(ipif_nv_tbl); nvp++) {
5330 			if (nvp->nv_value & flags)
5331 				(void) mi_mpprintf_nr(mp, " %s",
5332 				    nvp->nv_name);
5333 		}
5334 		(void) mi_mpprintf(mp,
5335 		    "\t%s\n\t%s\n\t%s\n\t%s\n\t%s\n\t%s",
5336 		    inet_ntop(AF_INET6,
5337 		    &ipif->ipif_v6lcl_addr, buf1, sizeof (buf1)),
5338 		    inet_ntop(AF_INET6,
5339 		    &ipif->ipif_v6src_addr, buf2, sizeof (buf2)),
5340 		    inet_ntop(AF_INET6,
5341 		    &ipif->ipif_v6subnet, buf3, sizeof (buf3)),
5342 		    inet_ntop(AF_INET6,
5343 		    &ipif->ipif_v6net_mask, buf4, sizeof (buf4)),
5344 		    inet_ntop(AF_INET6,
5345 		    &ipif->ipif_v6brd_addr, buf5, sizeof (buf5)),
5346 		    inet_ntop(AF_INET6,
5347 		    &ipif->ipif_v6pp_dst_addr, buf6, sizeof (buf6)));
5348 		}
5349 	}
5350 	rw_exit(&ipst->ips_ill_g_lock);
5351 	return (0);
5352 }
5353 
5354 /*
5355  * ip_ll_subnet_defaults is called when we get the DL_INFO_ACK back from the
5356  * driver.  We construct best guess defaults for lower level information that
5357  * we need.  If an interface is brought up without injection of any overriding
5358  * information from outside, we have to be ready to go with these defaults.
5359  * When we get the first DL_INFO_ACK (from ip_open() sending a DL_INFO_REQ)
5360  * we primarely want the dl_provider_style.
5361  * The subsequent DL_INFO_ACK is received after doing a DL_ATTACH and DL_BIND
5362  * at which point we assume the other part of the information is valid.
5363  */
5364 void
5365 ip_ll_subnet_defaults(ill_t *ill, mblk_t *mp)
5366 {
5367 	uchar_t		*brdcst_addr;
5368 	uint_t		brdcst_addr_length, phys_addr_length;
5369 	t_scalar_t	sap_length;
5370 	dl_info_ack_t	*dlia;
5371 	ip_m_t		*ipm;
5372 	dl_qos_cl_sel1_t *sel1;
5373 	int		min_mtu;
5374 
5375 	ASSERT(IAM_WRITER_ILL(ill));
5376 
5377 	/*
5378 	 * Till the ill is fully up ILL_CHANGING will be set and
5379 	 * the ill is not globally visible. So no need for a lock.
5380 	 */
5381 	dlia = (dl_info_ack_t *)mp->b_rptr;
5382 	ill->ill_mactype = dlia->dl_mac_type;
5383 
5384 	ipm = ip_m_lookup(dlia->dl_mac_type);
5385 	if (ipm == NULL) {
5386 		ipm = ip_m_lookup(DL_OTHER);
5387 		ASSERT(ipm != NULL);
5388 	}
5389 	ill->ill_media = ipm;
5390 
5391 	/*
5392 	 * When the new DLPI stuff is ready we'll pull lengths
5393 	 * from dlia.
5394 	 */
5395 	if (dlia->dl_version == DL_VERSION_2) {
5396 		brdcst_addr_length = dlia->dl_brdcst_addr_length;
5397 		brdcst_addr = mi_offset_param(mp, dlia->dl_brdcst_addr_offset,
5398 		    brdcst_addr_length);
5399 		if (brdcst_addr == NULL) {
5400 			brdcst_addr_length = 0;
5401 		}
5402 		sap_length = dlia->dl_sap_length;
5403 		phys_addr_length = dlia->dl_addr_length - ABS(sap_length);
5404 		ip1dbg(("ip: bcast_len %d, sap_len %d, phys_len %d\n",
5405 		    brdcst_addr_length, sap_length, phys_addr_length));
5406 	} else {
5407 		brdcst_addr_length = 6;
5408 		brdcst_addr = ip_six_byte_all_ones;
5409 		sap_length = -2;
5410 		phys_addr_length = brdcst_addr_length;
5411 	}
5412 
5413 	ill->ill_bcast_addr_length = brdcst_addr_length;
5414 	ill->ill_phys_addr_length = phys_addr_length;
5415 	ill->ill_sap_length = sap_length;
5416 
5417 	/*
5418 	 * Synthetic DLPI types such as SUNW_DL_IPMP specify a zero SDU,
5419 	 * but we must ensure a minimum IP MTU is used since other bits of
5420 	 * IP will fly apart otherwise.
5421 	 */
5422 	min_mtu = ill->ill_isv6 ? IPV6_MIN_MTU : IP_MIN_MTU;
5423 	ill->ill_max_frag  = MAX(min_mtu, dlia->dl_max_sdu);
5424 	ill->ill_max_mtu = ill->ill_max_frag;
5425 
5426 	ill->ill_type = ipm->ip_m_type;
5427 
5428 	if (!ill->ill_dlpi_style_set) {
5429 		if (dlia->dl_provider_style == DL_STYLE2)
5430 			ill->ill_needs_attach = 1;
5431 
5432 		/*
5433 		 * Allocate the first ipif on this ill. We don't delay it
5434 		 * further as ioctl handling assumes atleast one ipif to
5435 		 * be present.
5436 		 *
5437 		 * At this point we don't know whether the ill is v4 or v6.
5438 		 * We will know this whan the SIOCSLIFNAME happens and
5439 		 * the correct value for ill_isv6 will be assigned in
5440 		 * ipif_set_values(). We need to hold the ill lock and
5441 		 * clear the ILL_LL_SUBNET_PENDING flag and atomically do
5442 		 * the wakeup.
5443 		 */
5444 		(void) ipif_allocate(ill, 0, IRE_LOCAL,
5445 		    dlia->dl_provider_style != DL_STYLE2, B_TRUE);
5446 		mutex_enter(&ill->ill_lock);
5447 		ASSERT(ill->ill_dlpi_style_set == 0);
5448 		ill->ill_dlpi_style_set = 1;
5449 		ill->ill_state_flags &= ~ILL_LL_SUBNET_PENDING;
5450 		cv_broadcast(&ill->ill_cv);
5451 		mutex_exit(&ill->ill_lock);
5452 		freemsg(mp);
5453 		return;
5454 	}
5455 	ASSERT(ill->ill_ipif != NULL);
5456 	/*
5457 	 * We know whether it is IPv4 or IPv6 now, as this is the
5458 	 * second DL_INFO_ACK we are recieving in response to the
5459 	 * DL_INFO_REQ sent in ipif_set_values.
5460 	 */
5461 	if (ill->ill_isv6)
5462 		ill->ill_sap = IP6_DL_SAP;
5463 	else
5464 		ill->ill_sap = IP_DL_SAP;
5465 	/*
5466 	 * Set ipif_mtu which is used to set the IRE's
5467 	 * ire_max_frag value. The driver could have sent
5468 	 * a different mtu from what it sent last time. No
5469 	 * need to call ipif_mtu_change because IREs have
5470 	 * not yet been created.
5471 	 */
5472 	ill->ill_ipif->ipif_mtu = ill->ill_max_mtu;
5473 	/*
5474 	 * Clear all the flags that were set based on ill_bcast_addr_length
5475 	 * and ill_phys_addr_length (in ipif_set_values) as these could have
5476 	 * changed now and we need to re-evaluate.
5477 	 */
5478 	ill->ill_flags &= ~(ILLF_MULTICAST | ILLF_NONUD | ILLF_NOARP);
5479 	ill->ill_ipif->ipif_flags &= ~(IPIF_BROADCAST | IPIF_POINTOPOINT);
5480 
5481 	/*
5482 	 * Free ill_resolver_mp and ill_bcast_mp as things could have
5483 	 * changed now.
5484 	 *
5485 	 * NOTE: The IPMP meta-interface is special-cased because it starts
5486 	 * with no underlying interfaces (and thus an unknown broadcast
5487 	 * address length), but we enforce that an interface is broadcast-
5488 	 * capable as part of allowing it to join a group.
5489 	 */
5490 	if (ill->ill_bcast_addr_length == 0 && !IS_IPMP(ill)) {
5491 		if (ill->ill_resolver_mp != NULL)
5492 			freemsg(ill->ill_resolver_mp);
5493 		if (ill->ill_bcast_mp != NULL)
5494 			freemsg(ill->ill_bcast_mp);
5495 		if (ill->ill_flags & ILLF_XRESOLV)
5496 			ill->ill_net_type = IRE_IF_RESOLVER;
5497 		else
5498 			ill->ill_net_type = IRE_IF_NORESOLVER;
5499 		ill->ill_resolver_mp = ill_dlur_gen(NULL,
5500 		    ill->ill_phys_addr_length,
5501 		    ill->ill_sap,
5502 		    ill->ill_sap_length);
5503 		ill->ill_bcast_mp = copymsg(ill->ill_resolver_mp);
5504 
5505 		if (ill->ill_isv6)
5506 			/*
5507 			 * Note: xresolv interfaces will eventually need NOARP
5508 			 * set here as well, but that will require those
5509 			 * external resolvers to have some knowledge of
5510 			 * that flag and act appropriately. Not to be changed
5511 			 * at present.
5512 			 */
5513 			ill->ill_flags |= ILLF_NONUD;
5514 		else
5515 			ill->ill_flags |= ILLF_NOARP;
5516 
5517 		if (ill->ill_phys_addr_length == 0) {
5518 			if (ill->ill_media->ip_m_mac_type == SUNW_DL_VNI) {
5519 				ill->ill_ipif->ipif_flags |= IPIF_NOXMIT;
5520 				ill->ill_phyint->phyint_flags |= PHYI_VIRTUAL;
5521 			} else {
5522 				/* pt-pt supports multicast. */
5523 				ill->ill_flags |= ILLF_MULTICAST;
5524 				ill->ill_ipif->ipif_flags |= IPIF_POINTOPOINT;
5525 			}
5526 		}
5527 	} else {
5528 		ill->ill_net_type = IRE_IF_RESOLVER;
5529 		if (ill->ill_bcast_mp != NULL)
5530 			freemsg(ill->ill_bcast_mp);
5531 		ill->ill_bcast_mp = ill_dlur_gen(brdcst_addr,
5532 		    ill->ill_bcast_addr_length, ill->ill_sap,
5533 		    ill->ill_sap_length);
5534 		/*
5535 		 * Later detect lack of DLPI driver multicast
5536 		 * capability by catching DL_ENABMULTI errors in
5537 		 * ip_rput_dlpi.
5538 		 */
5539 		ill->ill_flags |= ILLF_MULTICAST;
5540 		if (!ill->ill_isv6)
5541 			ill->ill_ipif->ipif_flags |= IPIF_BROADCAST;
5542 	}
5543 
5544 	/* For IPMP, PHYI_IPMP should already be set by ipif_allocate() */
5545 	if (ill->ill_mactype == SUNW_DL_IPMP)
5546 		ASSERT(ill->ill_phyint->phyint_flags & PHYI_IPMP);
5547 
5548 	/* By default an interface does not support any CoS marking */
5549 	ill->ill_flags &= ~ILLF_COS_ENABLED;
5550 
5551 	/*
5552 	 * If we get QoS information in DL_INFO_ACK, the device supports
5553 	 * some form of CoS marking, set ILLF_COS_ENABLED.
5554 	 */
5555 	sel1 = (dl_qos_cl_sel1_t *)mi_offset_param(mp, dlia->dl_qos_offset,
5556 	    dlia->dl_qos_length);
5557 	if ((sel1 != NULL) && (sel1->dl_qos_type == DL_QOS_CL_SEL1)) {
5558 		ill->ill_flags |= ILLF_COS_ENABLED;
5559 	}
5560 
5561 	/* Clear any previous error indication. */
5562 	ill->ill_error = 0;
5563 	freemsg(mp);
5564 }
5565 
5566 /*
5567  * Perform various checks to verify that an address would make sense as a
5568  * local, remote, or subnet interface address.
5569  */
5570 static boolean_t
5571 ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask)
5572 {
5573 	ipaddr_t	net_mask;
5574 
5575 	/*
5576 	 * Don't allow all zeroes, or all ones, but allow
5577 	 * all ones netmask.
5578 	 */
5579 	if ((net_mask = ip_net_mask(addr)) == 0)
5580 		return (B_FALSE);
5581 	/* A given netmask overrides the "guess" netmask */
5582 	if (subnet_mask != 0)
5583 		net_mask = subnet_mask;
5584 	if ((net_mask != ~(ipaddr_t)0) && ((addr == (addr & net_mask)) ||
5585 	    (addr == (addr | ~net_mask)))) {
5586 		return (B_FALSE);
5587 	}
5588 
5589 	/*
5590 	 * Even if the netmask is all ones, we do not allow address to be
5591 	 * 255.255.255.255
5592 	 */
5593 	if (addr == INADDR_BROADCAST)
5594 		return (B_FALSE);
5595 
5596 	if (CLASSD(addr))
5597 		return (B_FALSE);
5598 
5599 	return (B_TRUE);
5600 }
5601 
5602 #define	V6_IPIF_LINKLOCAL(p)	\
5603 	IN6_IS_ADDR_LINKLOCAL(&(p)->ipif_v6lcl_addr)
5604 
5605 /*
5606  * Compare two given ipifs and check if the second one is better than
5607  * the first one using the order of preference (not taking deprecated
5608  * into acount) specified in ipif_lookup_multicast().
5609  */
5610 static boolean_t
5611 ipif_comp_multi(ipif_t *old_ipif, ipif_t *new_ipif, boolean_t isv6)
5612 {
5613 	/* Check the least preferred first. */
5614 	if (IS_LOOPBACK(old_ipif->ipif_ill)) {
5615 		/* If both ipifs are the same, use the first one. */
5616 		if (IS_LOOPBACK(new_ipif->ipif_ill))
5617 			return (B_FALSE);
5618 		else
5619 			return (B_TRUE);
5620 	}
5621 
5622 	/* For IPv6, check for link local address. */
5623 	if (isv6 && V6_IPIF_LINKLOCAL(old_ipif)) {
5624 		if (IS_LOOPBACK(new_ipif->ipif_ill) ||
5625 		    V6_IPIF_LINKLOCAL(new_ipif)) {
5626 			/* The second one is equal or less preferred. */
5627 			return (B_FALSE);
5628 		} else {
5629 			return (B_TRUE);
5630 		}
5631 	}
5632 
5633 	/* Then check for point to point interface. */
5634 	if (old_ipif->ipif_flags & IPIF_POINTOPOINT) {
5635 		if (IS_LOOPBACK(new_ipif->ipif_ill) ||
5636 		    (isv6 && V6_IPIF_LINKLOCAL(new_ipif)) ||
5637 		    (new_ipif->ipif_flags & IPIF_POINTOPOINT)) {
5638 			return (B_FALSE);
5639 		} else {
5640 			return (B_TRUE);
5641 		}
5642 	}
5643 
5644 	/* old_ipif is a normal interface, so no need to use the new one. */
5645 	return (B_FALSE);
5646 }
5647 
5648 /*
5649  * Find a mulitcast-capable ipif given an IP instance and zoneid.
5650  * The ipif must be up, and its ill must multicast-capable, not
5651  * condemned, not an underlying interface in an IPMP group, and
5652  * not a VNI interface.  Order of preference:
5653  *
5654  * 	1a. normal
5655  * 	1b. normal, but deprecated
5656  * 	2a. point to point
5657  * 	2b. point to point, but deprecated
5658  * 	3a. link local
5659  * 	3b. link local, but deprecated
5660  * 	4. loopback.
5661  */
5662 ipif_t *
5663 ipif_lookup_multicast(ip_stack_t *ipst, zoneid_t zoneid, boolean_t isv6)
5664 {
5665 	ill_t			*ill;
5666 	ill_walk_context_t	ctx;
5667 	ipif_t			*ipif;
5668 	ipif_t			*saved_ipif = NULL;
5669 	ipif_t			*dep_ipif = NULL;
5670 
5671 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5672 	if (isv6)
5673 		ill = ILL_START_WALK_V6(&ctx, ipst);
5674 	else
5675 		ill = ILL_START_WALK_V4(&ctx, ipst);
5676 
5677 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5678 		mutex_enter(&ill->ill_lock);
5679 		if (IS_VNI(ill) || IS_UNDER_IPMP(ill) || !ILL_CAN_LOOKUP(ill) ||
5680 		    !(ill->ill_flags & ILLF_MULTICAST)) {
5681 			mutex_exit(&ill->ill_lock);
5682 			continue;
5683 		}
5684 		for (ipif = ill->ill_ipif; ipif != NULL;
5685 		    ipif = ipif->ipif_next) {
5686 			if (zoneid != ipif->ipif_zoneid &&
5687 			    zoneid != ALL_ZONES &&
5688 			    ipif->ipif_zoneid != ALL_ZONES) {
5689 				continue;
5690 			}
5691 			if (!(ipif->ipif_flags & IPIF_UP) ||
5692 			    !IPIF_CAN_LOOKUP(ipif)) {
5693 				continue;
5694 			}
5695 
5696 			/*
5697 			 * Found one candidate.  If it is deprecated,
5698 			 * remember it in dep_ipif.  If it is not deprecated,
5699 			 * remember it in saved_ipif.
5700 			 */
5701 			if (ipif->ipif_flags & IPIF_DEPRECATED) {
5702 				if (dep_ipif == NULL) {
5703 					dep_ipif = ipif;
5704 				} else if (ipif_comp_multi(dep_ipif, ipif,
5705 				    isv6)) {
5706 					/*
5707 					 * If the previous dep_ipif does not
5708 					 * belong to the same ill, we've done
5709 					 * a ipif_refhold() on it.  So we need
5710 					 * to release it.
5711 					 */
5712 					if (dep_ipif->ipif_ill != ill)
5713 						ipif_refrele(dep_ipif);
5714 					dep_ipif = ipif;
5715 				}
5716 				continue;
5717 			}
5718 			if (saved_ipif == NULL) {
5719 				saved_ipif = ipif;
5720 			} else {
5721 				if (ipif_comp_multi(saved_ipif, ipif, isv6)) {
5722 					if (saved_ipif->ipif_ill != ill)
5723 						ipif_refrele(saved_ipif);
5724 					saved_ipif = ipif;
5725 				}
5726 			}
5727 		}
5728 		/*
5729 		 * Before going to the next ill, do a ipif_refhold() on the
5730 		 * saved ones.
5731 		 */
5732 		if (saved_ipif != NULL && saved_ipif->ipif_ill == ill)
5733 			ipif_refhold_locked(saved_ipif);
5734 		if (dep_ipif != NULL && dep_ipif->ipif_ill == ill)
5735 			ipif_refhold_locked(dep_ipif);
5736 		mutex_exit(&ill->ill_lock);
5737 	}
5738 	rw_exit(&ipst->ips_ill_g_lock);
5739 
5740 	/*
5741 	 * If we have only the saved_ipif, return it.  But if we have both
5742 	 * saved_ipif and dep_ipif, check to see which one is better.
5743 	 */
5744 	if (saved_ipif != NULL) {
5745 		if (dep_ipif != NULL) {
5746 			if (ipif_comp_multi(saved_ipif, dep_ipif, isv6)) {
5747 				ipif_refrele(saved_ipif);
5748 				return (dep_ipif);
5749 			} else {
5750 				ipif_refrele(dep_ipif);
5751 				return (saved_ipif);
5752 			}
5753 		}
5754 		return (saved_ipif);
5755 	} else {
5756 		return (dep_ipif);
5757 	}
5758 }
5759 
5760 /*
5761  * This function is called when an application does not specify an interface
5762  * to be used for multicast traffic (joining a group/sending data).  It
5763  * calls ire_lookup_multi() to look for an interface route for the
5764  * specified multicast group.  Doing this allows the administrator to add
5765  * prefix routes for multicast to indicate which interface to be used for
5766  * multicast traffic in the above scenario.  The route could be for all
5767  * multicast (224.0/4), for a single multicast group (a /32 route) or
5768  * anything in between.  If there is no such multicast route, we just find
5769  * any multicast capable interface and return it.  The returned ipif
5770  * is refhold'ed.
5771  */
5772 ipif_t *
5773 ipif_lookup_group(ipaddr_t group, zoneid_t zoneid, ip_stack_t *ipst)
5774 {
5775 	ire_t			*ire;
5776 	ipif_t			*ipif;
5777 
5778 	ire = ire_lookup_multi(group, zoneid, ipst);
5779 	if (ire != NULL) {
5780 		ipif = ire->ire_ipif;
5781 		ipif_refhold(ipif);
5782 		ire_refrele(ire);
5783 		return (ipif);
5784 	}
5785 
5786 	return (ipif_lookup_multicast(ipst, zoneid, B_FALSE));
5787 }
5788 
5789 /*
5790  * Look for an ipif with the specified interface address and destination.
5791  * The destination address is used only for matching point-to-point interfaces.
5792  */
5793 ipif_t *
5794 ipif_lookup_interface(ipaddr_t if_addr, ipaddr_t dst, queue_t *q, mblk_t *mp,
5795     ipsq_func_t func, int *error, ip_stack_t *ipst)
5796 {
5797 	ipif_t	*ipif;
5798 	ill_t	*ill;
5799 	ill_walk_context_t ctx;
5800 	ipsq_t	*ipsq;
5801 
5802 	if (error != NULL)
5803 		*error = 0;
5804 
5805 	/*
5806 	 * First match all the point-to-point interfaces
5807 	 * before looking at non-point-to-point interfaces.
5808 	 * This is done to avoid returning non-point-to-point
5809 	 * ipif instead of unnumbered point-to-point ipif.
5810 	 */
5811 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5812 	ill = ILL_START_WALK_V4(&ctx, ipst);
5813 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5814 		GRAB_CONN_LOCK(q);
5815 		mutex_enter(&ill->ill_lock);
5816 		for (ipif = ill->ill_ipif; ipif != NULL;
5817 		    ipif = ipif->ipif_next) {
5818 			/* Allow the ipif to be down */
5819 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
5820 			    (ipif->ipif_lcl_addr == if_addr) &&
5821 			    (ipif->ipif_pp_dst_addr == dst)) {
5822 				/*
5823 				 * The block comment at the start of ipif_down
5824 				 * explains the use of the macros used below
5825 				 */
5826 				if (IPIF_CAN_LOOKUP(ipif)) {
5827 					ipif_refhold_locked(ipif);
5828 					mutex_exit(&ill->ill_lock);
5829 					RELEASE_CONN_LOCK(q);
5830 					rw_exit(&ipst->ips_ill_g_lock);
5831 					return (ipif);
5832 				} else if (IPIF_CAN_WAIT(ipif, q)) {
5833 					ipsq = ill->ill_phyint->phyint_ipsq;
5834 					mutex_enter(&ipsq->ipsq_lock);
5835 					mutex_enter(&ipsq->ipsq_xop->ipx_lock);
5836 					mutex_exit(&ill->ill_lock);
5837 					rw_exit(&ipst->ips_ill_g_lock);
5838 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
5839 					    ill);
5840 					mutex_exit(&ipsq->ipsq_xop->ipx_lock);
5841 					mutex_exit(&ipsq->ipsq_lock);
5842 					RELEASE_CONN_LOCK(q);
5843 					if (error != NULL)
5844 						*error = EINPROGRESS;
5845 					return (NULL);
5846 				}
5847 			}
5848 		}
5849 		mutex_exit(&ill->ill_lock);
5850 		RELEASE_CONN_LOCK(q);
5851 	}
5852 	rw_exit(&ipst->ips_ill_g_lock);
5853 
5854 	/* lookup the ipif based on interface address */
5855 	ipif = ipif_lookup_addr(if_addr, NULL, ALL_ZONES, q, mp, func, error,
5856 	    ipst);
5857 	ASSERT(ipif == NULL || !ipif->ipif_isv6);
5858 	return (ipif);
5859 }
5860 
5861 /*
5862  * Common function for ipif_lookup_addr() and ipif_lookup_addr_exact().
5863  */
5864 static ipif_t *
5865 ipif_lookup_addr_common(ipaddr_t addr, ill_t *match_ill, boolean_t match_illgrp,
5866     zoneid_t zoneid, queue_t *q, mblk_t *mp, ipsq_func_t func, int *error,
5867     ip_stack_t *ipst)
5868 {
5869 	ipif_t  *ipif;
5870 	ill_t   *ill;
5871 	boolean_t ptp = B_FALSE;
5872 	ipsq_t	*ipsq;
5873 	ill_walk_context_t	ctx;
5874 
5875 	if (error != NULL)
5876 		*error = 0;
5877 
5878 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5879 	/*
5880 	 * Repeat twice, first based on local addresses and
5881 	 * next time for pointopoint.
5882 	 */
5883 repeat:
5884 	ill = ILL_START_WALK_V4(&ctx, ipst);
5885 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5886 		if (match_ill != NULL && ill != match_ill &&
5887 		    (!match_illgrp || !IS_IN_SAME_ILLGRP(ill, match_ill))) {
5888 			continue;
5889 		}
5890 		GRAB_CONN_LOCK(q);
5891 		mutex_enter(&ill->ill_lock);
5892 		for (ipif = ill->ill_ipif; ipif != NULL;
5893 		    ipif = ipif->ipif_next) {
5894 			if (zoneid != ALL_ZONES &&
5895 			    zoneid != ipif->ipif_zoneid &&
5896 			    ipif->ipif_zoneid != ALL_ZONES)
5897 				continue;
5898 			/* Allow the ipif to be down */
5899 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
5900 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
5901 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
5902 			    (ipif->ipif_pp_dst_addr == addr))) {
5903 				/*
5904 				 * The block comment at the start of ipif_down
5905 				 * explains the use of the macros used below
5906 				 */
5907 				if (IPIF_CAN_LOOKUP(ipif)) {
5908 					ipif_refhold_locked(ipif);
5909 					mutex_exit(&ill->ill_lock);
5910 					RELEASE_CONN_LOCK(q);
5911 					rw_exit(&ipst->ips_ill_g_lock);
5912 					return (ipif);
5913 				} else if (IPIF_CAN_WAIT(ipif, q)) {
5914 					ipsq = ill->ill_phyint->phyint_ipsq;
5915 					mutex_enter(&ipsq->ipsq_lock);
5916 					mutex_enter(&ipsq->ipsq_xop->ipx_lock);
5917 					mutex_exit(&ill->ill_lock);
5918 					rw_exit(&ipst->ips_ill_g_lock);
5919 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
5920 					    ill);
5921 					mutex_exit(&ipsq->ipsq_xop->ipx_lock);
5922 					mutex_exit(&ipsq->ipsq_lock);
5923 					RELEASE_CONN_LOCK(q);
5924 					if (error != NULL)
5925 						*error = EINPROGRESS;
5926 					return (NULL);
5927 				}
5928 			}
5929 		}
5930 		mutex_exit(&ill->ill_lock);
5931 		RELEASE_CONN_LOCK(q);
5932 	}
5933 
5934 	/* If we already did the ptp case, then we are done */
5935 	if (ptp) {
5936 		rw_exit(&ipst->ips_ill_g_lock);
5937 		if (error != NULL)
5938 			*error = ENXIO;
5939 		return (NULL);
5940 	}
5941 	ptp = B_TRUE;
5942 	goto repeat;
5943 }
5944 
5945 /*
5946  * Check if the address exists in the system.
5947  * We don't hold the conn_lock as we will not perform defered ipsqueue
5948  * operation.
5949  */
5950 boolean_t
5951 ip_addr_exists(ipaddr_t addr, zoneid_t zoneid, ip_stack_t *ipst)
5952 {
5953 	ipif_t  *ipif;
5954 	ill_t   *ill;
5955 	ill_walk_context_t	ctx;
5956 
5957 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5958 
5959 	ill = ILL_START_WALK_V4(&ctx, ipst);
5960 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5961 		mutex_enter(&ill->ill_lock);
5962 		for (ipif = ill->ill_ipif; ipif != NULL;
5963 		    ipif = ipif->ipif_next) {
5964 			if (zoneid != ALL_ZONES &&
5965 			    zoneid != ipif->ipif_zoneid &&
5966 			    ipif->ipif_zoneid != ALL_ZONES)
5967 				continue;
5968 			/* Allow the ipif to be down */
5969 			/*
5970 			 * XXX Different from ipif_lookup_addr(), we don't do
5971 			 * twice lookups. As from bind()'s point of view, we
5972 			 * may return once we find a match.
5973 			 */
5974 			if (((ipif->ipif_lcl_addr == addr) &&
5975 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
5976 			    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
5977 			    (ipif->ipif_pp_dst_addr == addr))) {
5978 				/*
5979 				 * Allow bind() to be successful even if the
5980 				 * ipif is with IPIF_CHANGING bit set.
5981 				 */
5982 				mutex_exit(&ill->ill_lock);
5983 				rw_exit(&ipst->ips_ill_g_lock);
5984 				return (B_TRUE);
5985 			}
5986 		}
5987 		mutex_exit(&ill->ill_lock);
5988 	}
5989 
5990 	rw_exit(&ipst->ips_ill_g_lock);
5991 	return (B_FALSE);
5992 }
5993 
5994 /*
5995  * Lookup an ipif with the specified address.  For point-to-point links we
5996  * look for matches on either the destination address or the local address,
5997  * but we skip the local address check if IPIF_UNNUMBERED is set.  If the
5998  * `match_ill' argument is non-NULL, the lookup is restricted to that ill
5999  * (or illgrp if `match_ill' is in an IPMP group).
6000  */
6001 ipif_t *
6002 ipif_lookup_addr(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid, queue_t *q,
6003     mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst)
6004 {
6005 	return (ipif_lookup_addr_common(addr, match_ill, B_TRUE, zoneid, q, mp,
6006 	    func, error, ipst));
6007 }
6008 
6009 /*
6010  * Special abbreviated version of ipif_lookup_addr() that doesn't match
6011  * `match_ill' across the IPMP group.  This function is only needed in some
6012  * corner-cases; almost everything should use ipif_lookup_addr().
6013  */
6014 static ipif_t *
6015 ipif_lookup_addr_exact(ipaddr_t addr, ill_t *match_ill, ip_stack_t *ipst)
6016 {
6017 	ASSERT(match_ill != NULL);
6018 	return (ipif_lookup_addr_common(addr, match_ill, B_FALSE, ALL_ZONES,
6019 	    NULL, NULL, NULL, NULL, ipst));
6020 }
6021 
6022 /*
6023  * Look for an ipif with the specified address. For point-point links
6024  * we look for matches on either the destination address and the local
6025  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
6026  * is set.
6027  * If the `match_ill' argument is non-NULL, the lookup is restricted to that
6028  * ill (or illgrp if `match_ill' is in an IPMP group).
6029  * Return the zoneid for the ipif which matches. ALL_ZONES if no match.
6030  */
6031 zoneid_t
6032 ipif_lookup_addr_zoneid(ipaddr_t addr, ill_t *match_ill, ip_stack_t *ipst)
6033 {
6034 	zoneid_t zoneid;
6035 	ipif_t  *ipif;
6036 	ill_t   *ill;
6037 	boolean_t ptp = B_FALSE;
6038 	ill_walk_context_t	ctx;
6039 
6040 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
6041 	/*
6042 	 * Repeat twice, first based on local addresses and
6043 	 * next time for pointopoint.
6044 	 */
6045 repeat:
6046 	ill = ILL_START_WALK_V4(&ctx, ipst);
6047 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
6048 		if (match_ill != NULL && ill != match_ill &&
6049 		    !IS_IN_SAME_ILLGRP(ill, match_ill)) {
6050 			continue;
6051 		}
6052 		mutex_enter(&ill->ill_lock);
6053 		for (ipif = ill->ill_ipif; ipif != NULL;
6054 		    ipif = ipif->ipif_next) {
6055 			/* Allow the ipif to be down */
6056 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
6057 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
6058 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
6059 			    (ipif->ipif_pp_dst_addr == addr)) &&
6060 			    !(ipif->ipif_state_flags & IPIF_CONDEMNED)) {
6061 				zoneid = ipif->ipif_zoneid;
6062 				mutex_exit(&ill->ill_lock);
6063 				rw_exit(&ipst->ips_ill_g_lock);
6064 				/*
6065 				 * If ipif_zoneid was ALL_ZONES then we have
6066 				 * a trusted extensions shared IP address.
6067 				 * In that case GLOBAL_ZONEID works to send.
6068 				 */
6069 				if (zoneid == ALL_ZONES)
6070 					zoneid = GLOBAL_ZONEID;
6071 				return (zoneid);
6072 			}
6073 		}
6074 		mutex_exit(&ill->ill_lock);
6075 	}
6076 
6077 	/* If we already did the ptp case, then we are done */
6078 	if (ptp) {
6079 		rw_exit(&ipst->ips_ill_g_lock);
6080 		return (ALL_ZONES);
6081 	}
6082 	ptp = B_TRUE;
6083 	goto repeat;
6084 }
6085 
6086 /*
6087  * Look for an ipif that matches the specified remote address i.e. the
6088  * ipif that would receive the specified packet.
6089  * First look for directly connected interfaces and then do a recursive
6090  * IRE lookup and pick the first ipif corresponding to the source address in the
6091  * ire.
6092  * Returns: held ipif
6093  */
6094 ipif_t *
6095 ipif_lookup_remote(ill_t *ill, ipaddr_t addr, zoneid_t zoneid)
6096 {
6097 	ipif_t	*ipif;
6098 	ire_t	*ire;
6099 	ip_stack_t	*ipst = ill->ill_ipst;
6100 
6101 	ASSERT(!ill->ill_isv6);
6102 
6103 	/*
6104 	 * Someone could be changing this ipif currently or change it
6105 	 * after we return this. Thus  a few packets could use the old
6106 	 * old values. However structure updates/creates (ire, ilg, ilm etc)
6107 	 * will atomically be updated or cleaned up with the new value
6108 	 * Thus we don't need a lock to check the flags or other attrs below.
6109 	 */
6110 	mutex_enter(&ill->ill_lock);
6111 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
6112 		if (!IPIF_CAN_LOOKUP(ipif))
6113 			continue;
6114 		if (zoneid != ALL_ZONES && zoneid != ipif->ipif_zoneid &&
6115 		    ipif->ipif_zoneid != ALL_ZONES)
6116 			continue;
6117 		/* Allow the ipif to be down */
6118 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
6119 			if ((ipif->ipif_pp_dst_addr == addr) ||
6120 			    (!(ipif->ipif_flags & IPIF_UNNUMBERED) &&
6121 			    ipif->ipif_lcl_addr == addr)) {
6122 				ipif_refhold_locked(ipif);
6123 				mutex_exit(&ill->ill_lock);
6124 				return (ipif);
6125 			}
6126 		} else if (ipif->ipif_subnet == (addr & ipif->ipif_net_mask)) {
6127 			ipif_refhold_locked(ipif);
6128 			mutex_exit(&ill->ill_lock);
6129 			return (ipif);
6130 		}
6131 	}
6132 	mutex_exit(&ill->ill_lock);
6133 	ire = ire_route_lookup(addr, 0, 0, 0, NULL, NULL, zoneid,
6134 	    NULL, MATCH_IRE_RECURSIVE, ipst);
6135 	if (ire != NULL) {
6136 		/*
6137 		 * The callers of this function wants to know the
6138 		 * interface on which they have to send the replies
6139 		 * back. For IREs that have ire_stq and ire_ipif
6140 		 * derived from different ills, we really don't care
6141 		 * what we return here.
6142 		 */
6143 		ipif = ire->ire_ipif;
6144 		if (ipif != NULL) {
6145 			ipif_refhold(ipif);
6146 			ire_refrele(ire);
6147 			return (ipif);
6148 		}
6149 		ire_refrele(ire);
6150 	}
6151 	/* Pick the first interface */
6152 	ipif = ipif_get_next_ipif(NULL, ill);
6153 	return (ipif);
6154 }
6155 
6156 /*
6157  * This func does not prevent refcnt from increasing. But if
6158  * the caller has taken steps to that effect, then this func
6159  * can be used to determine whether the ill has become quiescent
6160  */
6161 static boolean_t
6162 ill_is_quiescent(ill_t *ill)
6163 {
6164 	ipif_t	*ipif;
6165 
6166 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6167 
6168 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
6169 		if (ipif->ipif_refcnt != 0 || !IPIF_DOWN_OK(ipif)) {
6170 			return (B_FALSE);
6171 		}
6172 	}
6173 	if (!ILL_DOWN_OK(ill) || ill->ill_refcnt != 0) {
6174 		return (B_FALSE);
6175 	}
6176 	return (B_TRUE);
6177 }
6178 
6179 boolean_t
6180 ill_is_freeable(ill_t *ill)
6181 {
6182 	ipif_t	*ipif;
6183 
6184 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6185 
6186 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
6187 		if (ipif->ipif_refcnt != 0 || !IPIF_FREE_OK(ipif)) {
6188 			return (B_FALSE);
6189 		}
6190 	}
6191 	if (!ILL_FREE_OK(ill) || ill->ill_refcnt != 0) {
6192 		return (B_FALSE);
6193 	}
6194 	return (B_TRUE);
6195 }
6196 
6197 /*
6198  * This func does not prevent refcnt from increasing. But if
6199  * the caller has taken steps to that effect, then this func
6200  * can be used to determine whether the ipif has become quiescent
6201  */
6202 static boolean_t
6203 ipif_is_quiescent(ipif_t *ipif)
6204 {
6205 	ill_t *ill;
6206 
6207 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6208 
6209 	if (ipif->ipif_refcnt != 0 || !IPIF_DOWN_OK(ipif)) {
6210 		return (B_FALSE);
6211 	}
6212 
6213 	ill = ipif->ipif_ill;
6214 	if (ill->ill_ipif_up_count != 0 || ill->ill_ipif_dup_count != 0 ||
6215 	    ill->ill_logical_down) {
6216 		return (B_TRUE);
6217 	}
6218 
6219 	/* This is the last ipif going down or being deleted on this ill */
6220 	if (!ILL_DOWN_OK(ill) || ill->ill_refcnt != 0) {
6221 		return (B_FALSE);
6222 	}
6223 
6224 	return (B_TRUE);
6225 }
6226 
6227 /*
6228  * return true if the ipif can be destroyed: the ipif has to be quiescent
6229  * with zero references from ire/nce/ilm to it.
6230  */
6231 static boolean_t
6232 ipif_is_freeable(ipif_t *ipif)
6233 {
6234 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6235 	ASSERT(ipif->ipif_id != 0);
6236 	return (ipif->ipif_refcnt == 0 && IPIF_FREE_OK(ipif));
6237 }
6238 
6239 /*
6240  * The ipif/ill/ire has been refreled. Do the tail processing.
6241  * Determine if the ipif or ill in question has become quiescent and if so
6242  * wakeup close and/or restart any queued pending ioctl that is waiting
6243  * for the ipif_down (or ill_down)
6244  */
6245 void
6246 ipif_ill_refrele_tail(ill_t *ill)
6247 {
6248 	mblk_t	*mp;
6249 	conn_t	*connp;
6250 	ipsq_t	*ipsq;
6251 	ipxop_t	*ipx;
6252 	ipif_t	*ipif;
6253 	dl_notify_ind_t *dlindp;
6254 
6255 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6256 
6257 	if ((ill->ill_state_flags & ILL_CONDEMNED) && ill_is_freeable(ill)) {
6258 		/* ip_modclose() may be waiting */
6259 		cv_broadcast(&ill->ill_cv);
6260 	}
6261 
6262 	ipsq = ill->ill_phyint->phyint_ipsq;
6263 	mutex_enter(&ipsq->ipsq_lock);
6264 	ipx = ipsq->ipsq_xop;
6265 	mutex_enter(&ipx->ipx_lock);
6266 	if (ipx->ipx_waitfor == 0)	/* no one's waiting; bail */
6267 		goto unlock;
6268 
6269 	ASSERT(ipx->ipx_pending_mp != NULL && ipx->ipx_pending_ipif != NULL);
6270 
6271 	ipif = ipx->ipx_pending_ipif;
6272 	if (ipif->ipif_ill != ill) 	/* wait is for another ill; bail */
6273 		goto unlock;
6274 
6275 	switch (ipx->ipx_waitfor) {
6276 	case IPIF_DOWN:
6277 		if (!ipif_is_quiescent(ipif))
6278 			goto unlock;
6279 		break;
6280 	case IPIF_FREE:
6281 		if (!ipif_is_freeable(ipif))
6282 			goto unlock;
6283 		break;
6284 	case ILL_DOWN:
6285 		if (!ill_is_quiescent(ill))
6286 			goto unlock;
6287 		break;
6288 	case ILL_FREE:
6289 		/*
6290 		 * ILL_FREE is only for loopback; normal ill teardown waits
6291 		 * synchronously in ip_modclose() without using ipx_waitfor,
6292 		 * handled by the cv_broadcast() at the top of this function.
6293 		 */
6294 		if (!ill_is_freeable(ill))
6295 			goto unlock;
6296 		break;
6297 	default:
6298 		cmn_err(CE_PANIC, "ipsq: %p unknown ipx_waitfor %d\n",
6299 		    (void *)ipsq, ipx->ipx_waitfor);
6300 	}
6301 
6302 	ill_refhold_locked(ill);	/* for qwriter_ip() call below */
6303 	mutex_exit(&ipx->ipx_lock);
6304 	mp = ipsq_pending_mp_get(ipsq, &connp);
6305 	mutex_exit(&ipsq->ipsq_lock);
6306 	mutex_exit(&ill->ill_lock);
6307 
6308 	ASSERT(mp != NULL);
6309 	/*
6310 	 * NOTE: all of the qwriter_ip() calls below use CUR_OP since
6311 	 * we can only get here when the current operation decides it
6312 	 * it needs to quiesce via ipsq_pending_mp_add().
6313 	 */
6314 	switch (mp->b_datap->db_type) {
6315 	case M_PCPROTO:
6316 	case M_PROTO:
6317 		/*
6318 		 * For now, only DL_NOTIFY_IND messages can use this facility.
6319 		 */
6320 		dlindp = (dl_notify_ind_t *)mp->b_rptr;
6321 		ASSERT(dlindp->dl_primitive == DL_NOTIFY_IND);
6322 
6323 		switch (dlindp->dl_notification) {
6324 		case DL_NOTE_PHYS_ADDR:
6325 			qwriter_ip(ill, ill->ill_rq, mp,
6326 			    ill_set_phys_addr_tail, CUR_OP, B_TRUE);
6327 			return;
6328 		case DL_NOTE_REPLUMB:
6329 			qwriter_ip(ill, ill->ill_rq, mp,
6330 			    ill_replumb_tail, CUR_OP, B_TRUE);
6331 			return;
6332 		default:
6333 			ASSERT(0);
6334 			ill_refrele(ill);
6335 		}
6336 		break;
6337 
6338 	case M_ERROR:
6339 	case M_HANGUP:
6340 		qwriter_ip(ill, ill->ill_rq, mp, ipif_all_down_tail, CUR_OP,
6341 		    B_TRUE);
6342 		return;
6343 
6344 	case M_IOCTL:
6345 	case M_IOCDATA:
6346 		qwriter_ip(ill, (connp != NULL ? CONNP_TO_WQ(connp) :
6347 		    ill->ill_wq), mp, ip_reprocess_ioctl, CUR_OP, B_TRUE);
6348 		return;
6349 
6350 	default:
6351 		cmn_err(CE_PANIC, "ipif_ill_refrele_tail mp %p "
6352 		    "db_type %d\n", (void *)mp, mp->b_datap->db_type);
6353 	}
6354 	return;
6355 unlock:
6356 	mutex_exit(&ipsq->ipsq_lock);
6357 	mutex_exit(&ipx->ipx_lock);
6358 	mutex_exit(&ill->ill_lock);
6359 }
6360 
6361 #ifdef DEBUG
6362 /* Reuse trace buffer from beginning (if reached the end) and record trace */
6363 static void
6364 th_trace_rrecord(th_trace_t *th_trace)
6365 {
6366 	tr_buf_t *tr_buf;
6367 	uint_t lastref;
6368 
6369 	lastref = th_trace->th_trace_lastref;
6370 	lastref++;
6371 	if (lastref == TR_BUF_MAX)
6372 		lastref = 0;
6373 	th_trace->th_trace_lastref = lastref;
6374 	tr_buf = &th_trace->th_trbuf[lastref];
6375 	tr_buf->tr_time = lbolt;
6376 	tr_buf->tr_depth = getpcstack(tr_buf->tr_stack, TR_STACK_DEPTH);
6377 }
6378 
6379 static void
6380 th_trace_free(void *value)
6381 {
6382 	th_trace_t *th_trace = value;
6383 
6384 	ASSERT(th_trace->th_refcnt == 0);
6385 	kmem_free(th_trace, sizeof (*th_trace));
6386 }
6387 
6388 /*
6389  * Find or create the per-thread hash table used to track object references.
6390  * The ipst argument is NULL if we shouldn't allocate.
6391  *
6392  * Accesses per-thread data, so there's no need to lock here.
6393  */
6394 static mod_hash_t *
6395 th_trace_gethash(ip_stack_t *ipst)
6396 {
6397 	th_hash_t *thh;
6398 
6399 	if ((thh = tsd_get(ip_thread_data)) == NULL && ipst != NULL) {
6400 		mod_hash_t *mh;
6401 		char name[256];
6402 		size_t objsize, rshift;
6403 		int retv;
6404 
6405 		if ((thh = kmem_alloc(sizeof (*thh), KM_NOSLEEP)) == NULL)
6406 			return (NULL);
6407 		(void) snprintf(name, sizeof (name), "th_trace_%p",
6408 		    (void *)curthread);
6409 
6410 		/*
6411 		 * We use mod_hash_create_extended here rather than the more
6412 		 * obvious mod_hash_create_ptrhash because the latter has a
6413 		 * hard-coded KM_SLEEP, and we'd prefer to fail rather than
6414 		 * block.
6415 		 */
6416 		objsize = MAX(MAX(sizeof (ill_t), sizeof (ipif_t)),
6417 		    MAX(sizeof (ire_t), sizeof (nce_t)));
6418 		rshift = highbit(objsize);
6419 		mh = mod_hash_create_extended(name, 64, mod_hash_null_keydtor,
6420 		    th_trace_free, mod_hash_byptr, (void *)rshift,
6421 		    mod_hash_ptrkey_cmp, KM_NOSLEEP);
6422 		if (mh == NULL) {
6423 			kmem_free(thh, sizeof (*thh));
6424 			return (NULL);
6425 		}
6426 		thh->thh_hash = mh;
6427 		thh->thh_ipst = ipst;
6428 		/*
6429 		 * We trace ills, ipifs, ires, and nces.  All of these are
6430 		 * per-IP-stack, so the lock on the thread list is as well.
6431 		 */
6432 		rw_enter(&ip_thread_rwlock, RW_WRITER);
6433 		list_insert_tail(&ip_thread_list, thh);
6434 		rw_exit(&ip_thread_rwlock);
6435 		retv = tsd_set(ip_thread_data, thh);
6436 		ASSERT(retv == 0);
6437 	}
6438 	return (thh != NULL ? thh->thh_hash : NULL);
6439 }
6440 
6441 boolean_t
6442 th_trace_ref(const void *obj, ip_stack_t *ipst)
6443 {
6444 	th_trace_t *th_trace;
6445 	mod_hash_t *mh;
6446 	mod_hash_val_t val;
6447 
6448 	if ((mh = th_trace_gethash(ipst)) == NULL)
6449 		return (B_FALSE);
6450 
6451 	/*
6452 	 * Attempt to locate the trace buffer for this obj and thread.
6453 	 * If it does not exist, then allocate a new trace buffer and
6454 	 * insert into the hash.
6455 	 */
6456 	if (mod_hash_find(mh, (mod_hash_key_t)obj, &val) == MH_ERR_NOTFOUND) {
6457 		th_trace = kmem_zalloc(sizeof (th_trace_t), KM_NOSLEEP);
6458 		if (th_trace == NULL)
6459 			return (B_FALSE);
6460 
6461 		th_trace->th_id = curthread;
6462 		if (mod_hash_insert(mh, (mod_hash_key_t)obj,
6463 		    (mod_hash_val_t)th_trace) != 0) {
6464 			kmem_free(th_trace, sizeof (th_trace_t));
6465 			return (B_FALSE);
6466 		}
6467 	} else {
6468 		th_trace = (th_trace_t *)val;
6469 	}
6470 
6471 	ASSERT(th_trace->th_refcnt >= 0 &&
6472 	    th_trace->th_refcnt < TR_BUF_MAX - 1);
6473 
6474 	th_trace->th_refcnt++;
6475 	th_trace_rrecord(th_trace);
6476 	return (B_TRUE);
6477 }
6478 
6479 /*
6480  * For the purpose of tracing a reference release, we assume that global
6481  * tracing is always on and that the same thread initiated the reference hold
6482  * is releasing.
6483  */
6484 void
6485 th_trace_unref(const void *obj)
6486 {
6487 	int retv;
6488 	mod_hash_t *mh;
6489 	th_trace_t *th_trace;
6490 	mod_hash_val_t val;
6491 
6492 	mh = th_trace_gethash(NULL);
6493 	retv = mod_hash_find(mh, (mod_hash_key_t)obj, &val);
6494 	ASSERT(retv == 0);
6495 	th_trace = (th_trace_t *)val;
6496 
6497 	ASSERT(th_trace->th_refcnt > 0);
6498 	th_trace->th_refcnt--;
6499 	th_trace_rrecord(th_trace);
6500 }
6501 
6502 /*
6503  * If tracing has been disabled, then we assume that the reference counts are
6504  * now useless, and we clear them out before destroying the entries.
6505  */
6506 void
6507 th_trace_cleanup(const void *obj, boolean_t trace_disable)
6508 {
6509 	th_hash_t	*thh;
6510 	mod_hash_t	*mh;
6511 	mod_hash_val_t	val;
6512 	th_trace_t	*th_trace;
6513 	int		retv;
6514 
6515 	rw_enter(&ip_thread_rwlock, RW_READER);
6516 	for (thh = list_head(&ip_thread_list); thh != NULL;
6517 	    thh = list_next(&ip_thread_list, thh)) {
6518 		if (mod_hash_find(mh = thh->thh_hash, (mod_hash_key_t)obj,
6519 		    &val) == 0) {
6520 			th_trace = (th_trace_t *)val;
6521 			if (trace_disable)
6522 				th_trace->th_refcnt = 0;
6523 			retv = mod_hash_destroy(mh, (mod_hash_key_t)obj);
6524 			ASSERT(retv == 0);
6525 		}
6526 	}
6527 	rw_exit(&ip_thread_rwlock);
6528 }
6529 
6530 void
6531 ipif_trace_ref(ipif_t *ipif)
6532 {
6533 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6534 
6535 	if (ipif->ipif_trace_disable)
6536 		return;
6537 
6538 	if (!th_trace_ref(ipif, ipif->ipif_ill->ill_ipst)) {
6539 		ipif->ipif_trace_disable = B_TRUE;
6540 		ipif_trace_cleanup(ipif);
6541 	}
6542 }
6543 
6544 void
6545 ipif_untrace_ref(ipif_t *ipif)
6546 {
6547 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6548 
6549 	if (!ipif->ipif_trace_disable)
6550 		th_trace_unref(ipif);
6551 }
6552 
6553 void
6554 ill_trace_ref(ill_t *ill)
6555 {
6556 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6557 
6558 	if (ill->ill_trace_disable)
6559 		return;
6560 
6561 	if (!th_trace_ref(ill, ill->ill_ipst)) {
6562 		ill->ill_trace_disable = B_TRUE;
6563 		ill_trace_cleanup(ill);
6564 	}
6565 }
6566 
6567 void
6568 ill_untrace_ref(ill_t *ill)
6569 {
6570 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6571 
6572 	if (!ill->ill_trace_disable)
6573 		th_trace_unref(ill);
6574 }
6575 
6576 /*
6577  * Called when ipif is unplumbed or when memory alloc fails.  Note that on
6578  * failure, ipif_trace_disable is set.
6579  */
6580 static void
6581 ipif_trace_cleanup(const ipif_t *ipif)
6582 {
6583 	th_trace_cleanup(ipif, ipif->ipif_trace_disable);
6584 }
6585 
6586 /*
6587  * Called when ill is unplumbed or when memory alloc fails.  Note that on
6588  * failure, ill_trace_disable is set.
6589  */
6590 static void
6591 ill_trace_cleanup(const ill_t *ill)
6592 {
6593 	th_trace_cleanup(ill, ill->ill_trace_disable);
6594 }
6595 #endif /* DEBUG */
6596 
6597 void
6598 ipif_refhold_locked(ipif_t *ipif)
6599 {
6600 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6601 	ipif->ipif_refcnt++;
6602 	IPIF_TRACE_REF(ipif);
6603 }
6604 
6605 void
6606 ipif_refhold(ipif_t *ipif)
6607 {
6608 	ill_t	*ill;
6609 
6610 	ill = ipif->ipif_ill;
6611 	mutex_enter(&ill->ill_lock);
6612 	ipif->ipif_refcnt++;
6613 	IPIF_TRACE_REF(ipif);
6614 	mutex_exit(&ill->ill_lock);
6615 }
6616 
6617 /*
6618  * Must not be called while holding any locks. Otherwise if this is
6619  * the last reference to be released there is a chance of recursive mutex
6620  * panic due to ipif_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
6621  * to restart an ioctl.
6622  */
6623 void
6624 ipif_refrele(ipif_t *ipif)
6625 {
6626 	ill_t	*ill;
6627 
6628 	ill = ipif->ipif_ill;
6629 
6630 	mutex_enter(&ill->ill_lock);
6631 	ASSERT(ipif->ipif_refcnt != 0);
6632 	ipif->ipif_refcnt--;
6633 	IPIF_UNTRACE_REF(ipif);
6634 	if (ipif->ipif_refcnt != 0) {
6635 		mutex_exit(&ill->ill_lock);
6636 		return;
6637 	}
6638 
6639 	/* Drops the ill_lock */
6640 	ipif_ill_refrele_tail(ill);
6641 }
6642 
6643 ipif_t *
6644 ipif_get_next_ipif(ipif_t *curr, ill_t *ill)
6645 {
6646 	ipif_t	*ipif;
6647 
6648 	mutex_enter(&ill->ill_lock);
6649 	for (ipif = (curr == NULL ? ill->ill_ipif : curr->ipif_next);
6650 	    ipif != NULL; ipif = ipif->ipif_next) {
6651 		if (!IPIF_CAN_LOOKUP(ipif))
6652 			continue;
6653 		ipif_refhold_locked(ipif);
6654 		mutex_exit(&ill->ill_lock);
6655 		return (ipif);
6656 	}
6657 	mutex_exit(&ill->ill_lock);
6658 	return (NULL);
6659 }
6660 
6661 /*
6662  * TODO: make this table extendible at run time
6663  * Return a pointer to the mac type info for 'mac_type'
6664  */
6665 static ip_m_t *
6666 ip_m_lookup(t_uscalar_t mac_type)
6667 {
6668 	ip_m_t	*ipm;
6669 
6670 	for (ipm = ip_m_tbl; ipm < A_END(ip_m_tbl); ipm++)
6671 		if (ipm->ip_m_mac_type == mac_type)
6672 			return (ipm);
6673 	return (NULL);
6674 }
6675 
6676 /*
6677  * ip_rt_add is called to add an IPv4 route to the forwarding table.
6678  * ipif_arg is passed in to associate it with the correct interface.
6679  * We may need to restart this operation if the ipif cannot be looked up
6680  * due to an exclusive operation that is currently in progress. The restart
6681  * entry point is specified by 'func'
6682  */
6683 int
6684 ip_rt_add(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
6685     ipaddr_t src_addr, int flags, ipif_t *ipif_arg, ire_t **ire_arg,
6686     boolean_t ioctl_msg, queue_t *q, mblk_t *mp, ipsq_func_t func,
6687     struct rtsa_s *sp, ip_stack_t *ipst)
6688 {
6689 	ire_t	*ire;
6690 	ire_t	*gw_ire = NULL;
6691 	ipif_t	*ipif = NULL;
6692 	boolean_t ipif_refheld = B_FALSE;
6693 	uint_t	type;
6694 	int	match_flags = MATCH_IRE_TYPE;
6695 	int	error;
6696 	tsol_gc_t *gc = NULL;
6697 	tsol_gcgrp_t *gcgrp = NULL;
6698 	boolean_t gcgrp_xtraref = B_FALSE;
6699 
6700 	ip1dbg(("ip_rt_add:"));
6701 
6702 	if (ire_arg != NULL)
6703 		*ire_arg = NULL;
6704 
6705 	/*
6706 	 * If this is the case of RTF_HOST being set, then we set the netmask
6707 	 * to all ones (regardless if one was supplied).
6708 	 */
6709 	if (flags & RTF_HOST)
6710 		mask = IP_HOST_MASK;
6711 
6712 	/*
6713 	 * Prevent routes with a zero gateway from being created (since
6714 	 * interfaces can currently be plumbed and brought up no assigned
6715 	 * address).
6716 	 */
6717 	if (gw_addr == 0)
6718 		return (ENETUNREACH);
6719 	/*
6720 	 * Get the ipif, if any, corresponding to the gw_addr
6721 	 */
6722 	ipif = ipif_lookup_interface(gw_addr, dst_addr, q, mp, func, &error,
6723 	    ipst);
6724 	if (ipif != NULL) {
6725 		if (IS_VNI(ipif->ipif_ill)) {
6726 			ipif_refrele(ipif);
6727 			return (EINVAL);
6728 		}
6729 		ipif_refheld = B_TRUE;
6730 	} else if (error == EINPROGRESS) {
6731 		ip1dbg(("ip_rt_add: null and EINPROGRESS"));
6732 		return (EINPROGRESS);
6733 	} else {
6734 		error = 0;
6735 	}
6736 
6737 	if (ipif != NULL) {
6738 		ip1dbg(("ip_rt_add: ipif_lookup_interface done ipif nonnull"));
6739 		ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6740 	} else {
6741 		ip1dbg(("ip_rt_add: ipif_lookup_interface done ipif is null"));
6742 	}
6743 
6744 	/*
6745 	 * GateD will attempt to create routes with a loopback interface
6746 	 * address as the gateway and with RTF_GATEWAY set.  We allow
6747 	 * these routes to be added, but create them as interface routes
6748 	 * since the gateway is an interface address.
6749 	 */
6750 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
6751 		flags &= ~RTF_GATEWAY;
6752 		if (gw_addr == INADDR_LOOPBACK && dst_addr == INADDR_LOOPBACK &&
6753 		    mask == IP_HOST_MASK) {
6754 			ire = ire_ctable_lookup(dst_addr, 0, IRE_LOOPBACK, ipif,
6755 			    ALL_ZONES, NULL, match_flags, ipst);
6756 			if (ire != NULL) {
6757 				ire_refrele(ire);
6758 				if (ipif_refheld)
6759 					ipif_refrele(ipif);
6760 				return (EEXIST);
6761 			}
6762 			ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x"
6763 			    "for 0x%x\n", (void *)ipif,
6764 			    ipif->ipif_ire_type,
6765 			    ntohl(ipif->ipif_lcl_addr)));
6766 			ire = ire_create(
6767 			    (uchar_t *)&dst_addr,	/* dest address */
6768 			    (uchar_t *)&mask,		/* mask */
6769 			    (uchar_t *)&ipif->ipif_src_addr,
6770 			    NULL,			/* no gateway */
6771 			    &ipif->ipif_mtu,
6772 			    NULL,
6773 			    ipif->ipif_rq,		/* recv-from queue */
6774 			    NULL,			/* no send-to queue */
6775 			    ipif->ipif_ire_type,	/* LOOPBACK */
6776 			    ipif,
6777 			    0,
6778 			    0,
6779 			    0,
6780 			    (ipif->ipif_flags & IPIF_PRIVATE) ?
6781 			    RTF_PRIVATE : 0,
6782 			    &ire_uinfo_null,
6783 			    NULL,
6784 			    NULL,
6785 			    ipst);
6786 
6787 			if (ire == NULL) {
6788 				if (ipif_refheld)
6789 					ipif_refrele(ipif);
6790 				return (ENOMEM);
6791 			}
6792 			error = ire_add(&ire, q, mp, func, B_FALSE);
6793 			if (error == 0)
6794 				goto save_ire;
6795 			if (ipif_refheld)
6796 				ipif_refrele(ipif);
6797 			return (error);
6798 
6799 		}
6800 	}
6801 
6802 	/*
6803 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
6804 	 * and the gateway address provided is one of the system's interface
6805 	 * addresses.  By using the routing socket interface and supplying an
6806 	 * RTA_IFP sockaddr with an interface index, an alternate method of
6807 	 * specifying an interface route to be created is available which uses
6808 	 * the interface index that specifies the outgoing interface rather than
6809 	 * the address of an outgoing interface (which may not be able to
6810 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
6811 	 * flag, routes can be specified which not only specify the next-hop to
6812 	 * be used when routing to a certain prefix, but also which outgoing
6813 	 * interface should be used.
6814 	 *
6815 	 * Previously, interfaces would have unique addresses assigned to them
6816 	 * and so the address assigned to a particular interface could be used
6817 	 * to identify a particular interface.  One exception to this was the
6818 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
6819 	 *
6820 	 * With the advent of IPv6 and its link-local addresses, this
6821 	 * restriction was relaxed and interfaces could share addresses between
6822 	 * themselves.  In fact, typically all of the link-local interfaces on
6823 	 * an IPv6 node or router will have the same link-local address.  In
6824 	 * order to differentiate between these interfaces, the use of an
6825 	 * interface index is necessary and this index can be carried inside a
6826 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
6827 	 * of using the interface index, however, is that all of the ipif's that
6828 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
6829 	 * cannot be used to differentiate between ipif's (or logical
6830 	 * interfaces) that belong to the same ill (physical interface).
6831 	 *
6832 	 * For example, in the following case involving IPv4 interfaces and
6833 	 * logical interfaces
6834 	 *
6835 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
6836 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0:1
6837 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0:2
6838 	 *
6839 	 * the ipif's corresponding to each of these interface routes can be
6840 	 * uniquely identified by the "gateway" (actually interface address).
6841 	 *
6842 	 * In this case involving multiple IPv6 default routes to a particular
6843 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
6844 	 * default route is of interest:
6845 	 *
6846 	 *	default		fe80::123:4567:89ab:cdef	U	if0
6847 	 *	default		fe80::123:4567:89ab:cdef	U	if1
6848 	 */
6849 
6850 	/* RTF_GATEWAY not set */
6851 	if (!(flags & RTF_GATEWAY)) {
6852 		queue_t	*stq;
6853 
6854 		if (sp != NULL) {
6855 			ip2dbg(("ip_rt_add: gateway security attributes "
6856 			    "cannot be set with interface route\n"));
6857 			if (ipif_refheld)
6858 				ipif_refrele(ipif);
6859 			return (EINVAL);
6860 		}
6861 
6862 		/*
6863 		 * As the interface index specified with the RTA_IFP sockaddr is
6864 		 * the same for all ipif's off of an ill, the matching logic
6865 		 * below uses MATCH_IRE_ILL if such an index was specified.
6866 		 * This means that routes sharing the same prefix when added
6867 		 * using a RTA_IFP sockaddr must have distinct interface
6868 		 * indices (namely, they must be on distinct ill's).
6869 		 *
6870 		 * On the other hand, since the gateway address will usually be
6871 		 * different for each ipif on the system, the matching logic
6872 		 * uses MATCH_IRE_IPIF in the case of a traditional interface
6873 		 * route.  This means that interface routes for the same prefix
6874 		 * can be created if they belong to distinct ipif's and if a
6875 		 * RTA_IFP sockaddr is not present.
6876 		 */
6877 		if (ipif_arg != NULL) {
6878 			if (ipif_refheld)  {
6879 				ipif_refrele(ipif);
6880 				ipif_refheld = B_FALSE;
6881 			}
6882 			ipif = ipif_arg;
6883 			match_flags |= MATCH_IRE_ILL;
6884 		} else {
6885 			/*
6886 			 * Check the ipif corresponding to the gw_addr
6887 			 */
6888 			if (ipif == NULL)
6889 				return (ENETUNREACH);
6890 			match_flags |= MATCH_IRE_IPIF;
6891 		}
6892 		ASSERT(ipif != NULL);
6893 
6894 		/*
6895 		 * We check for an existing entry at this point.
6896 		 *
6897 		 * Since a netmask isn't passed in via the ioctl interface
6898 		 * (SIOCADDRT), we don't check for a matching netmask in that
6899 		 * case.
6900 		 */
6901 		if (!ioctl_msg)
6902 			match_flags |= MATCH_IRE_MASK;
6903 		ire = ire_ftable_lookup(dst_addr, mask, 0, IRE_INTERFACE, ipif,
6904 		    NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
6905 		if (ire != NULL) {
6906 			ire_refrele(ire);
6907 			if (ipif_refheld)
6908 				ipif_refrele(ipif);
6909 			return (EEXIST);
6910 		}
6911 
6912 		stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
6913 		    ? ipif->ipif_rq : ipif->ipif_wq;
6914 
6915 		/*
6916 		 * Create a copy of the IRE_LOOPBACK,
6917 		 * IRE_IF_NORESOLVER or IRE_IF_RESOLVER with
6918 		 * the modified address and netmask.
6919 		 */
6920 		ire = ire_create(
6921 		    (uchar_t *)&dst_addr,
6922 		    (uint8_t *)&mask,
6923 		    (uint8_t *)&ipif->ipif_src_addr,
6924 		    NULL,
6925 		    &ipif->ipif_mtu,
6926 		    NULL,
6927 		    NULL,
6928 		    stq,
6929 		    ipif->ipif_net_type,
6930 		    ipif,
6931 		    0,
6932 		    0,
6933 		    0,
6934 		    flags,
6935 		    &ire_uinfo_null,
6936 		    NULL,
6937 		    NULL,
6938 		    ipst);
6939 		if (ire == NULL) {
6940 			if (ipif_refheld)
6941 				ipif_refrele(ipif);
6942 			return (ENOMEM);
6943 		}
6944 
6945 		/*
6946 		 * Some software (for example, GateD and Sun Cluster) attempts
6947 		 * to create (what amount to) IRE_PREFIX routes with the
6948 		 * loopback address as the gateway.  This is primarily done to
6949 		 * set up prefixes with the RTF_REJECT flag set (for example,
6950 		 * when generating aggregate routes.)
6951 		 *
6952 		 * If the IRE type (as defined by ipif->ipif_net_type) is
6953 		 * IRE_LOOPBACK, then we map the request into a
6954 		 * IRE_IF_NORESOLVER. We also OR in the RTF_BLACKHOLE flag as
6955 		 * these interface routes, by definition, can only be that.
6956 		 *
6957 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
6958 		 * routine, but rather using ire_create() directly.
6959 		 *
6960 		 */
6961 		if (ipif->ipif_net_type == IRE_LOOPBACK) {
6962 			ire->ire_type = IRE_IF_NORESOLVER;
6963 			ire->ire_flags |= RTF_BLACKHOLE;
6964 		}
6965 
6966 		error = ire_add(&ire, q, mp, func, B_FALSE);
6967 		if (error == 0)
6968 			goto save_ire;
6969 
6970 		/*
6971 		 * In the result of failure, ire_add() will have already
6972 		 * deleted the ire in question, so there is no need to
6973 		 * do that here.
6974 		 */
6975 		if (ipif_refheld)
6976 			ipif_refrele(ipif);
6977 		return (error);
6978 	}
6979 	if (ipif_refheld) {
6980 		ipif_refrele(ipif);
6981 		ipif_refheld = B_FALSE;
6982 	}
6983 
6984 	/*
6985 	 * Get an interface IRE for the specified gateway.
6986 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
6987 	 * gateway, it is currently unreachable and we fail the request
6988 	 * accordingly.
6989 	 */
6990 	ipif = ipif_arg;
6991 	if (ipif_arg != NULL)
6992 		match_flags |= MATCH_IRE_ILL;
6993 again:
6994 	gw_ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg, NULL,
6995 	    ALL_ZONES, 0, NULL, match_flags, ipst);
6996 	if (gw_ire == NULL) {
6997 		/*
6998 		 * With IPMP, we allow host routes to influence in.mpathd's
6999 		 * target selection.  However, if the test addresses are on
7000 		 * their own network, the above lookup will fail since the
7001 		 * underlying IRE_INTERFACEs are marked hidden.  So allow
7002 		 * hidden test IREs to be found and try again.
7003 		 */
7004 		if (!(match_flags & MATCH_IRE_MARK_TESTHIDDEN))  {
7005 			match_flags |= MATCH_IRE_MARK_TESTHIDDEN;
7006 			goto again;
7007 		}
7008 		return (ENETUNREACH);
7009 	}
7010 
7011 	/*
7012 	 * We create one of three types of IREs as a result of this request
7013 	 * based on the netmask.  A netmask of all ones (which is automatically
7014 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
7015 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
7016 	 * created.  Otherwise, an IRE_PREFIX route is created for the
7017 	 * destination prefix.
7018 	 */
7019 	if (mask == IP_HOST_MASK)
7020 		type = IRE_HOST;
7021 	else if (mask == 0)
7022 		type = IRE_DEFAULT;
7023 	else
7024 		type = IRE_PREFIX;
7025 
7026 	/* check for a duplicate entry */
7027 	ire = ire_ftable_lookup(dst_addr, mask, gw_addr, type, ipif_arg,
7028 	    NULL, ALL_ZONES, 0, NULL,
7029 	    match_flags | MATCH_IRE_MASK | MATCH_IRE_GW, ipst);
7030 	if (ire != NULL) {
7031 		ire_refrele(gw_ire);
7032 		ire_refrele(ire);
7033 		return (EEXIST);
7034 	}
7035 
7036 	/* Security attribute exists */
7037 	if (sp != NULL) {
7038 		tsol_gcgrp_addr_t ga;
7039 
7040 		/* find or create the gateway credentials group */
7041 		ga.ga_af = AF_INET;
7042 		IN6_IPADDR_TO_V4MAPPED(gw_addr, &ga.ga_addr);
7043 
7044 		/* we hold reference to it upon success */
7045 		gcgrp = gcgrp_lookup(&ga, B_TRUE);
7046 		if (gcgrp == NULL) {
7047 			ire_refrele(gw_ire);
7048 			return (ENOMEM);
7049 		}
7050 
7051 		/*
7052 		 * Create and add the security attribute to the group; a
7053 		 * reference to the group is made upon allocating a new
7054 		 * entry successfully.  If it finds an already-existing
7055 		 * entry for the security attribute in the group, it simply
7056 		 * returns it and no new reference is made to the group.
7057 		 */
7058 		gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
7059 		if (gc == NULL) {
7060 			/* release reference held by gcgrp_lookup */
7061 			GCGRP_REFRELE(gcgrp);
7062 			ire_refrele(gw_ire);
7063 			return (ENOMEM);
7064 		}
7065 	}
7066 
7067 	/* Create the IRE. */
7068 	ire = ire_create(
7069 	    (uchar_t *)&dst_addr,		/* dest address */
7070 	    (uchar_t *)&mask,			/* mask */
7071 	    /* src address assigned by the caller? */
7072 	    (uchar_t *)(((src_addr != INADDR_ANY) &&
7073 	    (flags & RTF_SETSRC)) ?  &src_addr : NULL),
7074 	    (uchar_t *)&gw_addr,		/* gateway address */
7075 	    &gw_ire->ire_max_frag,
7076 	    NULL,				/* no src nce */
7077 	    NULL,				/* no recv-from queue */
7078 	    NULL,				/* no send-to queue */
7079 	    (ushort_t)type,			/* IRE type */
7080 	    ipif_arg,
7081 	    0,
7082 	    0,
7083 	    0,
7084 	    flags,
7085 	    &gw_ire->ire_uinfo,			/* Inherit ULP info from gw */
7086 	    gc,					/* security attribute */
7087 	    NULL,
7088 	    ipst);
7089 
7090 	/*
7091 	 * The ire holds a reference to the 'gc' and the 'gc' holds a
7092 	 * reference to the 'gcgrp'. We can now release the extra reference
7093 	 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
7094 	 */
7095 	if (gcgrp_xtraref)
7096 		GCGRP_REFRELE(gcgrp);
7097 	if (ire == NULL) {
7098 		if (gc != NULL)
7099 			GC_REFRELE(gc);
7100 		ire_refrele(gw_ire);
7101 		return (ENOMEM);
7102 	}
7103 
7104 	/*
7105 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
7106 	 * SUN/OS socket stuff does but do we really want to allow 0.0.0.0?
7107 	 */
7108 
7109 	/* Add the new IRE. */
7110 	error = ire_add(&ire, q, mp, func, B_FALSE);
7111 	if (error != 0) {
7112 		/*
7113 		 * In the result of failure, ire_add() will have already
7114 		 * deleted the ire in question, so there is no need to
7115 		 * do that here.
7116 		 */
7117 		ire_refrele(gw_ire);
7118 		return (error);
7119 	}
7120 
7121 	if (flags & RTF_MULTIRT) {
7122 		/*
7123 		 * Invoke the CGTP (multirouting) filtering module
7124 		 * to add the dst address in the filtering database.
7125 		 * Replicated inbound packets coming from that address
7126 		 * will be filtered to discard the duplicates.
7127 		 * It is not necessary to call the CGTP filter hook
7128 		 * when the dst address is a broadcast or multicast,
7129 		 * because an IP source address cannot be a broadcast
7130 		 * or a multicast.
7131 		 */
7132 		ire_t *ire_dst = ire_ctable_lookup(ire->ire_addr, 0,
7133 		    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
7134 		if (ire_dst != NULL) {
7135 			ip_cgtp_bcast_add(ire, ire_dst, ipst);
7136 			ire_refrele(ire_dst);
7137 			goto save_ire;
7138 		}
7139 		if (ipst->ips_ip_cgtp_filter_ops != NULL &&
7140 		    !CLASSD(ire->ire_addr)) {
7141 			int res = ipst->ips_ip_cgtp_filter_ops->cfo_add_dest_v4(
7142 			    ipst->ips_netstack->netstack_stackid,
7143 			    ire->ire_addr,
7144 			    ire->ire_gateway_addr,
7145 			    ire->ire_src_addr,
7146 			    gw_ire->ire_src_addr);
7147 			if (res != 0) {
7148 				ire_refrele(gw_ire);
7149 				ire_delete(ire);
7150 				return (res);
7151 			}
7152 		}
7153 	}
7154 
7155 	/*
7156 	 * Now that the prefix IRE entry has been created, delete any
7157 	 * existing gateway IRE cache entries as well as any IRE caches
7158 	 * using the gateway, and force them to be created through
7159 	 * ip_newroute.
7160 	 */
7161 	if (gc != NULL) {
7162 		ASSERT(gcgrp != NULL);
7163 		ire_clookup_delete_cache_gw(gw_addr, ALL_ZONES, ipst);
7164 	}
7165 
7166 save_ire:
7167 	if (gw_ire != NULL) {
7168 		ire_refrele(gw_ire);
7169 	}
7170 	if (ipif != NULL) {
7171 		/*
7172 		 * Save enough information so that we can recreate the IRE if
7173 		 * the interface goes down and then up.  The metrics associated
7174 		 * with the route will be saved as well when rts_setmetrics() is
7175 		 * called after the IRE has been created.  In the case where
7176 		 * memory cannot be allocated, none of this information will be
7177 		 * saved.
7178 		 */
7179 		ipif_save_ire(ipif, ire);
7180 	}
7181 	if (ioctl_msg)
7182 		ip_rts_rtmsg(RTM_OLDADD, ire, 0, ipst);
7183 	if (ire_arg != NULL) {
7184 		/*
7185 		 * Store the ire that was successfully added into where ire_arg
7186 		 * points to so that callers don't have to look it up
7187 		 * themselves (but they are responsible for ire_refrele()ing
7188 		 * the ire when they are finished with it).
7189 		 */
7190 		*ire_arg = ire;
7191 	} else {
7192 		ire_refrele(ire);		/* Held in ire_add */
7193 	}
7194 	if (ipif_refheld)
7195 		ipif_refrele(ipif);
7196 	return (0);
7197 }
7198 
7199 /*
7200  * ip_rt_delete is called to delete an IPv4 route.
7201  * ipif_arg is passed in to associate it with the correct interface.
7202  * We may need to restart this operation if the ipif cannot be looked up
7203  * due to an exclusive operation that is currently in progress. The restart
7204  * entry point is specified by 'func'
7205  */
7206 /* ARGSUSED4 */
7207 int
7208 ip_rt_delete(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
7209     uint_t rtm_addrs, int flags, ipif_t *ipif_arg, boolean_t ioctl_msg,
7210     queue_t *q, mblk_t *mp, ipsq_func_t func, ip_stack_t *ipst)
7211 {
7212 	ire_t	*ire = NULL;
7213 	ipif_t	*ipif;
7214 	boolean_t ipif_refheld = B_FALSE;
7215 	uint_t	type;
7216 	uint_t	match_flags = MATCH_IRE_TYPE;
7217 	int	err = 0;
7218 
7219 	ip1dbg(("ip_rt_delete:"));
7220 	/*
7221 	 * If this is the case of RTF_HOST being set, then we set the netmask
7222 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
7223 	 */
7224 	if (flags & RTF_HOST) {
7225 		mask = IP_HOST_MASK;
7226 		match_flags |= MATCH_IRE_MASK;
7227 	} else if (rtm_addrs & RTA_NETMASK) {
7228 		match_flags |= MATCH_IRE_MASK;
7229 	}
7230 
7231 	/*
7232 	 * Note that RTF_GATEWAY is never set on a delete, therefore
7233 	 * we check if the gateway address is one of our interfaces first,
7234 	 * and fall back on RTF_GATEWAY routes.
7235 	 *
7236 	 * This makes it possible to delete an original
7237 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
7238 	 *
7239 	 * As the interface index specified with the RTA_IFP sockaddr is the
7240 	 * same for all ipif's off of an ill, the matching logic below uses
7241 	 * MATCH_IRE_ILL if such an index was specified.  This means a route
7242 	 * sharing the same prefix and interface index as the the route
7243 	 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr
7244 	 * is specified in the request.
7245 	 *
7246 	 * On the other hand, since the gateway address will usually be
7247 	 * different for each ipif on the system, the matching logic
7248 	 * uses MATCH_IRE_IPIF in the case of a traditional interface
7249 	 * route.  This means that interface routes for the same prefix can be
7250 	 * uniquely identified if they belong to distinct ipif's and if a
7251 	 * RTA_IFP sockaddr is not present.
7252 	 *
7253 	 * For more detail on specifying routes by gateway address and by
7254 	 * interface index, see the comments in ip_rt_add().
7255 	 */
7256 	ipif = ipif_lookup_interface(gw_addr, dst_addr, q, mp, func, &err,
7257 	    ipst);
7258 	if (ipif != NULL)
7259 		ipif_refheld = B_TRUE;
7260 	else if (err == EINPROGRESS)
7261 		return (err);
7262 	else
7263 		err = 0;
7264 	if (ipif != NULL) {
7265 		if (ipif_arg != NULL) {
7266 			if (ipif_refheld) {
7267 				ipif_refrele(ipif);
7268 				ipif_refheld = B_FALSE;
7269 			}
7270 			ipif = ipif_arg;
7271 			match_flags |= MATCH_IRE_ILL;
7272 		} else {
7273 			match_flags |= MATCH_IRE_IPIF;
7274 		}
7275 		if (ipif->ipif_ire_type == IRE_LOOPBACK) {
7276 			ire = ire_ctable_lookup(dst_addr, 0, IRE_LOOPBACK, ipif,
7277 			    ALL_ZONES, NULL, match_flags, ipst);
7278 		}
7279 		if (ire == NULL) {
7280 			ire = ire_ftable_lookup(dst_addr, mask, 0,
7281 			    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL,
7282 			    match_flags, ipst);
7283 		}
7284 	}
7285 
7286 	if (ire == NULL) {
7287 		/*
7288 		 * At this point, the gateway address is not one of our own
7289 		 * addresses or a matching interface route was not found.  We
7290 		 * set the IRE type to lookup based on whether
7291 		 * this is a host route, a default route or just a prefix.
7292 		 *
7293 		 * If an ipif_arg was passed in, then the lookup is based on an
7294 		 * interface index so MATCH_IRE_ILL is added to match_flags.
7295 		 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is
7296 		 * set as the route being looked up is not a traditional
7297 		 * interface route.
7298 		 */
7299 		match_flags &= ~MATCH_IRE_IPIF;
7300 		match_flags |= MATCH_IRE_GW;
7301 		if (ipif_arg != NULL)
7302 			match_flags |= MATCH_IRE_ILL;
7303 		if (mask == IP_HOST_MASK)
7304 			type = IRE_HOST;
7305 		else if (mask == 0)
7306 			type = IRE_DEFAULT;
7307 		else
7308 			type = IRE_PREFIX;
7309 		ire = ire_ftable_lookup(dst_addr, mask, gw_addr, type, ipif_arg,
7310 		    NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
7311 	}
7312 
7313 	if (ipif_refheld)
7314 		ipif_refrele(ipif);
7315 
7316 	/* ipif is not refheld anymore */
7317 	if (ire == NULL)
7318 		return (ESRCH);
7319 
7320 	if (ire->ire_flags & RTF_MULTIRT) {
7321 		/*
7322 		 * Invoke the CGTP (multirouting) filtering module
7323 		 * to remove the dst address from the filtering database.
7324 		 * Packets coming from that address will no longer be
7325 		 * filtered to remove duplicates.
7326 		 */
7327 		if (ipst->ips_ip_cgtp_filter_ops != NULL) {
7328 			err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v4(
7329 			    ipst->ips_netstack->netstack_stackid,
7330 			    ire->ire_addr, ire->ire_gateway_addr);
7331 		}
7332 		ip_cgtp_bcast_delete(ire, ipst);
7333 	}
7334 
7335 	ipif = ire->ire_ipif;
7336 	if (ipif != NULL)
7337 		ipif_remove_ire(ipif, ire);
7338 	if (ioctl_msg)
7339 		ip_rts_rtmsg(RTM_OLDDEL, ire, 0, ipst);
7340 	ire_delete(ire);
7341 	ire_refrele(ire);
7342 	return (err);
7343 }
7344 
7345 /*
7346  * ip_siocaddrt is called to complete processing of an SIOCADDRT IOCTL.
7347  */
7348 /* ARGSUSED */
7349 int
7350 ip_siocaddrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
7351     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
7352 {
7353 	ipaddr_t dst_addr;
7354 	ipaddr_t gw_addr;
7355 	ipaddr_t mask;
7356 	int error = 0;
7357 	mblk_t *mp1;
7358 	struct rtentry *rt;
7359 	ipif_t *ipif = NULL;
7360 	ip_stack_t	*ipst;
7361 
7362 	ASSERT(q->q_next == NULL);
7363 	ipst = CONNQ_TO_IPST(q);
7364 
7365 	ip1dbg(("ip_siocaddrt:"));
7366 	/* Existence of mp1 verified in ip_wput_nondata */
7367 	mp1 = mp->b_cont->b_cont;
7368 	rt = (struct rtentry *)mp1->b_rptr;
7369 
7370 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
7371 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
7372 
7373 	/*
7374 	 * If the RTF_HOST flag is on, this is a request to assign a gateway
7375 	 * to a particular host address.  In this case, we set the netmask to
7376 	 * all ones for the particular destination address.  Otherwise,
7377 	 * determine the netmask to be used based on dst_addr and the interfaces
7378 	 * in use.
7379 	 */
7380 	if (rt->rt_flags & RTF_HOST) {
7381 		mask = IP_HOST_MASK;
7382 	} else {
7383 		/*
7384 		 * Note that ip_subnet_mask returns a zero mask in the case of
7385 		 * default (an all-zeroes address).
7386 		 */
7387 		mask = ip_subnet_mask(dst_addr, &ipif, ipst);
7388 	}
7389 
7390 	error = ip_rt_add(dst_addr, mask, gw_addr, 0, rt->rt_flags, NULL, NULL,
7391 	    B_TRUE, q, mp, ip_process_ioctl, NULL, ipst);
7392 	if (ipif != NULL)
7393 		ipif_refrele(ipif);
7394 	return (error);
7395 }
7396 
7397 /*
7398  * ip_siocdelrt is called to complete processing of an SIOCDELRT IOCTL.
7399  */
7400 /* ARGSUSED */
7401 int
7402 ip_siocdelrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
7403     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
7404 {
7405 	ipaddr_t dst_addr;
7406 	ipaddr_t gw_addr;
7407 	ipaddr_t mask;
7408 	int error;
7409 	mblk_t *mp1;
7410 	struct rtentry *rt;
7411 	ipif_t *ipif = NULL;
7412 	ip_stack_t	*ipst;
7413 
7414 	ASSERT(q->q_next == NULL);
7415 	ipst = CONNQ_TO_IPST(q);
7416 
7417 	ip1dbg(("ip_siocdelrt:"));
7418 	/* Existence of mp1 verified in ip_wput_nondata */
7419 	mp1 = mp->b_cont->b_cont;
7420 	rt = (struct rtentry *)mp1->b_rptr;
7421 
7422 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
7423 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
7424 
7425 	/*
7426 	 * If the RTF_HOST flag is on, this is a request to delete a gateway
7427 	 * to a particular host address.  In this case, we set the netmask to
7428 	 * all ones for the particular destination address.  Otherwise,
7429 	 * determine the netmask to be used based on dst_addr and the interfaces
7430 	 * in use.
7431 	 */
7432 	if (rt->rt_flags & RTF_HOST) {
7433 		mask = IP_HOST_MASK;
7434 	} else {
7435 		/*
7436 		 * Note that ip_subnet_mask returns a zero mask in the case of
7437 		 * default (an all-zeroes address).
7438 		 */
7439 		mask = ip_subnet_mask(dst_addr, &ipif, ipst);
7440 	}
7441 
7442 	error = ip_rt_delete(dst_addr, mask, gw_addr,
7443 	    RTA_DST | RTA_GATEWAY | RTA_NETMASK, rt->rt_flags, NULL, B_TRUE, q,
7444 	    mp, ip_process_ioctl, ipst);
7445 	if (ipif != NULL)
7446 		ipif_refrele(ipif);
7447 	return (error);
7448 }
7449 
7450 /*
7451  * Enqueue the mp onto the ipsq, chained by b_next.
7452  * b_prev stores the function to be executed later, and b_queue the queue
7453  * where this mp originated.
7454  */
7455 void
7456 ipsq_enq(ipsq_t *ipsq, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
7457     ill_t *pending_ill)
7458 {
7459 	conn_t	*connp;
7460 	ipxop_t *ipx = ipsq->ipsq_xop;
7461 
7462 	ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
7463 	ASSERT(MUTEX_HELD(&ipx->ipx_lock));
7464 	ASSERT(func != NULL);
7465 
7466 	mp->b_queue = q;
7467 	mp->b_prev = (void *)func;
7468 	mp->b_next = NULL;
7469 
7470 	switch (type) {
7471 	case CUR_OP:
7472 		if (ipx->ipx_mptail != NULL) {
7473 			ASSERT(ipx->ipx_mphead != NULL);
7474 			ipx->ipx_mptail->b_next = mp;
7475 		} else {
7476 			ASSERT(ipx->ipx_mphead == NULL);
7477 			ipx->ipx_mphead = mp;
7478 		}
7479 		ipx->ipx_mptail = mp;
7480 		break;
7481 
7482 	case NEW_OP:
7483 		if (ipsq->ipsq_xopq_mptail != NULL) {
7484 			ASSERT(ipsq->ipsq_xopq_mphead != NULL);
7485 			ipsq->ipsq_xopq_mptail->b_next = mp;
7486 		} else {
7487 			ASSERT(ipsq->ipsq_xopq_mphead == NULL);
7488 			ipsq->ipsq_xopq_mphead = mp;
7489 		}
7490 		ipsq->ipsq_xopq_mptail = mp;
7491 		ipx->ipx_ipsq_queued = B_TRUE;
7492 		break;
7493 
7494 	case SWITCH_OP:
7495 		ASSERT(ipsq->ipsq_swxop != NULL);
7496 		/* only one switch operation is currently allowed */
7497 		ASSERT(ipsq->ipsq_switch_mp == NULL);
7498 		ipsq->ipsq_switch_mp = mp;
7499 		ipx->ipx_ipsq_queued = B_TRUE;
7500 		break;
7501 	default:
7502 		cmn_err(CE_PANIC, "ipsq_enq %d type \n", type);
7503 	}
7504 
7505 	if (CONN_Q(q) && pending_ill != NULL) {
7506 		connp = Q_TO_CONN(q);
7507 		ASSERT(MUTEX_HELD(&connp->conn_lock));
7508 		connp->conn_oper_pending_ill = pending_ill;
7509 	}
7510 }
7511 
7512 /*
7513  * Dequeue the next message that requested exclusive access to this IPSQ's
7514  * xop.  Specifically:
7515  *
7516  *  1. If we're still processing the current operation on `ipsq', then
7517  *     dequeue the next message for the operation (from ipx_mphead), or
7518  *     return NULL if there are no queued messages for the operation.
7519  *     These messages are queued via CUR_OP to qwriter_ip() and friends.
7520  *
7521  *  2. If the current operation on `ipsq' has completed (ipx_current_ipif is
7522  *     not set) see if the ipsq has requested an xop switch.  If so, switch
7523  *     `ipsq' to a different xop.  Xop switches only happen when joining or
7524  *     leaving IPMP groups and require a careful dance -- see the comments
7525  *     in-line below for details.  If we're leaving a group xop or if we're
7526  *     joining a group xop and become writer on it, then we proceed to (3).
7527  *     Otherwise, we return NULL and exit the xop.
7528  *
7529  *  3. For each IPSQ in the xop, return any switch operation stored on
7530  *     ipsq_switch_mp (set via SWITCH_OP); these must be processed before
7531  *     any other messages queued on the IPSQ.  Otherwise, dequeue the next
7532  *     exclusive operation (queued via NEW_OP) stored on ipsq_xopq_mphead.
7533  *     Note that if the phyint tied to `ipsq' is not using IPMP there will
7534  *     only be one IPSQ in the xop.  Otherwise, there will be one IPSQ for
7535  *     each phyint in the group, including the IPMP meta-interface phyint.
7536  */
7537 static mblk_t *
7538 ipsq_dq(ipsq_t *ipsq)
7539 {
7540 	ill_t	*illv4, *illv6;
7541 	mblk_t	*mp;
7542 	ipsq_t	*xopipsq;
7543 	ipsq_t	*leftipsq = NULL;
7544 	ipxop_t *ipx;
7545 	phyint_t *phyi = ipsq->ipsq_phyint;
7546 	ip_stack_t *ipst = ipsq->ipsq_ipst;
7547 	boolean_t emptied = B_FALSE;
7548 
7549 	/*
7550 	 * Grab all the locks we need in the defined order (ill_g_lock ->
7551 	 * ipsq_lock -> ipx_lock); ill_g_lock is needed to use ipsq_next.
7552 	 */
7553 	rw_enter(&ipst->ips_ill_g_lock,
7554 	    ipsq->ipsq_swxop != NULL ? RW_WRITER : RW_READER);
7555 	mutex_enter(&ipsq->ipsq_lock);
7556 	ipx = ipsq->ipsq_xop;
7557 	mutex_enter(&ipx->ipx_lock);
7558 
7559 	/*
7560 	 * Dequeue the next message associated with the current exclusive
7561 	 * operation, if any.
7562 	 */
7563 	if ((mp = ipx->ipx_mphead) != NULL) {
7564 		ipx->ipx_mphead = mp->b_next;
7565 		if (ipx->ipx_mphead == NULL)
7566 			ipx->ipx_mptail = NULL;
7567 		mp->b_next = (void *)ipsq;
7568 		goto out;
7569 	}
7570 
7571 	if (ipx->ipx_current_ipif != NULL)
7572 		goto empty;
7573 
7574 	if (ipsq->ipsq_swxop != NULL) {
7575 		/*
7576 		 * The exclusive operation that is now being completed has
7577 		 * requested a switch to a different xop.  This happens
7578 		 * when an interface joins or leaves an IPMP group.  Joins
7579 		 * happen through SIOCSLIFGROUPNAME (ip_sioctl_groupname()).
7580 		 * Leaves happen via SIOCSLIFGROUPNAME, interface unplumb
7581 		 * (phyint_free()), or interface plumb for an ill type
7582 		 * not in the IPMP group (ip_rput_dlpi_writer()).
7583 		 *
7584 		 * Xop switches are not allowed on the IPMP meta-interface.
7585 		 */
7586 		ASSERT(phyi == NULL || !(phyi->phyint_flags & PHYI_IPMP));
7587 		ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
7588 		DTRACE_PROBE1(ipsq__switch, (ipsq_t *), ipsq);
7589 
7590 		if (ipsq->ipsq_swxop == &ipsq->ipsq_ownxop) {
7591 			/*
7592 			 * We're switching back to our own xop, so we have two
7593 			 * xop's to drain/exit: our own, and the group xop
7594 			 * that we are leaving.
7595 			 *
7596 			 * First, pull ourselves out of the group ipsq list.
7597 			 * This is safe since we're writer on ill_g_lock.
7598 			 */
7599 			ASSERT(ipsq->ipsq_xop != &ipsq->ipsq_ownxop);
7600 
7601 			xopipsq = ipx->ipx_ipsq;
7602 			while (xopipsq->ipsq_next != ipsq)
7603 				xopipsq = xopipsq->ipsq_next;
7604 
7605 			xopipsq->ipsq_next = ipsq->ipsq_next;
7606 			ipsq->ipsq_next = ipsq;
7607 			ipsq->ipsq_xop = ipsq->ipsq_swxop;
7608 			ipsq->ipsq_swxop = NULL;
7609 
7610 			/*
7611 			 * Second, prepare to exit the group xop.  The actual
7612 			 * ipsq_exit() is done at the end of this function
7613 			 * since we cannot hold any locks across ipsq_exit().
7614 			 * Note that although we drop the group's ipx_lock, no
7615 			 * threads can proceed since we're still ipx_writer.
7616 			 */
7617 			leftipsq = xopipsq;
7618 			mutex_exit(&ipx->ipx_lock);
7619 
7620 			/*
7621 			 * Third, set ipx to point to our own xop (which was
7622 			 * inactive and therefore can be entered).
7623 			 */
7624 			ipx = ipsq->ipsq_xop;
7625 			mutex_enter(&ipx->ipx_lock);
7626 			ASSERT(ipx->ipx_writer == NULL);
7627 			ASSERT(ipx->ipx_current_ipif == NULL);
7628 		} else {
7629 			/*
7630 			 * We're switching from our own xop to a group xop.
7631 			 * The requestor of the switch must ensure that the
7632 			 * group xop cannot go away (e.g. by ensuring the
7633 			 * phyint associated with the xop cannot go away).
7634 			 *
7635 			 * If we can become writer on our new xop, then we'll
7636 			 * do the drain.  Otherwise, the current writer of our
7637 			 * new xop will do the drain when it exits.
7638 			 *
7639 			 * First, splice ourselves into the group IPSQ list.
7640 			 * This is safe since we're writer on ill_g_lock.
7641 			 */
7642 			ASSERT(ipsq->ipsq_xop == &ipsq->ipsq_ownxop);
7643 
7644 			xopipsq = ipsq->ipsq_swxop->ipx_ipsq;
7645 			while (xopipsq->ipsq_next != ipsq->ipsq_swxop->ipx_ipsq)
7646 				xopipsq = xopipsq->ipsq_next;
7647 
7648 			xopipsq->ipsq_next = ipsq;
7649 			ipsq->ipsq_next = ipsq->ipsq_swxop->ipx_ipsq;
7650 			ipsq->ipsq_xop = ipsq->ipsq_swxop;
7651 			ipsq->ipsq_swxop = NULL;
7652 
7653 			/*
7654 			 * Second, exit our own xop, since it's now unused.
7655 			 * This is safe since we've got the only reference.
7656 			 */
7657 			ASSERT(ipx->ipx_writer == curthread);
7658 			ipx->ipx_writer = NULL;
7659 			VERIFY(--ipx->ipx_reentry_cnt == 0);
7660 			ipx->ipx_ipsq_queued = B_FALSE;
7661 			mutex_exit(&ipx->ipx_lock);
7662 
7663 			/*
7664 			 * Third, set ipx to point to our new xop, and check
7665 			 * if we can become writer on it.  If we cannot, then
7666 			 * the current writer will drain the IPSQ group when
7667 			 * it exits.  Our ipsq_xop is guaranteed to be stable
7668 			 * because we're still holding ipsq_lock.
7669 			 */
7670 			ipx = ipsq->ipsq_xop;
7671 			mutex_enter(&ipx->ipx_lock);
7672 			if (ipx->ipx_writer != NULL ||
7673 			    ipx->ipx_current_ipif != NULL) {
7674 				goto out;
7675 			}
7676 		}
7677 
7678 		/*
7679 		 * Fourth, become writer on our new ipx before we continue
7680 		 * with the drain.  Note that we never dropped ipsq_lock
7681 		 * above, so no other thread could've raced with us to
7682 		 * become writer first.  Also, we're holding ipx_lock, so
7683 		 * no other thread can examine the ipx right now.
7684 		 */
7685 		ASSERT(ipx->ipx_current_ipif == NULL);
7686 		ASSERT(ipx->ipx_mphead == NULL && ipx->ipx_mptail == NULL);
7687 		VERIFY(ipx->ipx_reentry_cnt++ == 0);
7688 		ipx->ipx_writer = curthread;
7689 		ipx->ipx_forced = B_FALSE;
7690 #ifdef DEBUG
7691 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
7692 #endif
7693 	}
7694 
7695 	xopipsq = ipsq;
7696 	do {
7697 		/*
7698 		 * So that other operations operate on a consistent and
7699 		 * complete phyint, a switch message on an IPSQ must be
7700 		 * handled prior to any other operations on that IPSQ.
7701 		 */
7702 		if ((mp = xopipsq->ipsq_switch_mp) != NULL) {
7703 			xopipsq->ipsq_switch_mp = NULL;
7704 			ASSERT(mp->b_next == NULL);
7705 			mp->b_next = (void *)xopipsq;
7706 			goto out;
7707 		}
7708 
7709 		if ((mp = xopipsq->ipsq_xopq_mphead) != NULL) {
7710 			xopipsq->ipsq_xopq_mphead = mp->b_next;
7711 			if (xopipsq->ipsq_xopq_mphead == NULL)
7712 				xopipsq->ipsq_xopq_mptail = NULL;
7713 			mp->b_next = (void *)xopipsq;
7714 			goto out;
7715 		}
7716 	} while ((xopipsq = xopipsq->ipsq_next) != ipsq);
7717 empty:
7718 	/*
7719 	 * There are no messages.  Further, we are holding ipx_lock, hence no
7720 	 * new messages can end up on any IPSQ in the xop.
7721 	 */
7722 	ipx->ipx_writer = NULL;
7723 	ipx->ipx_forced = B_FALSE;
7724 	VERIFY(--ipx->ipx_reentry_cnt == 0);
7725 	ipx->ipx_ipsq_queued = B_FALSE;
7726 	emptied = B_TRUE;
7727 #ifdef	DEBUG
7728 	ipx->ipx_depth = 0;
7729 #endif
7730 out:
7731 	mutex_exit(&ipx->ipx_lock);
7732 	mutex_exit(&ipsq->ipsq_lock);
7733 
7734 	/*
7735 	 * If we completely emptied the xop, then wake up any threads waiting
7736 	 * to enter any of the IPSQ's associated with it.
7737 	 */
7738 	if (emptied) {
7739 		xopipsq = ipsq;
7740 		do {
7741 			if ((phyi = xopipsq->ipsq_phyint) == NULL)
7742 				continue;
7743 
7744 			illv4 = phyi->phyint_illv4;
7745 			illv6 = phyi->phyint_illv6;
7746 
7747 			GRAB_ILL_LOCKS(illv4, illv6);
7748 			if (illv4 != NULL)
7749 				cv_broadcast(&illv4->ill_cv);
7750 			if (illv6 != NULL)
7751 				cv_broadcast(&illv6->ill_cv);
7752 			RELEASE_ILL_LOCKS(illv4, illv6);
7753 		} while ((xopipsq = xopipsq->ipsq_next) != ipsq);
7754 	}
7755 	rw_exit(&ipst->ips_ill_g_lock);
7756 
7757 	/*
7758 	 * Now that all locks are dropped, exit the IPSQ we left.
7759 	 */
7760 	if (leftipsq != NULL)
7761 		ipsq_exit(leftipsq);
7762 
7763 	return (mp);
7764 }
7765 
7766 /*
7767  * Enter the ipsq corresponding to ill, by waiting synchronously till
7768  * we can enter the ipsq exclusively. Unless 'force' is used, the ipsq
7769  * will have to drain completely before ipsq_enter returns success.
7770  * ipx_current_ipif will be set if some exclusive op is in progress,
7771  * and the ipsq_exit logic will start the next enqueued op after
7772  * completion of the current op. If 'force' is used, we don't wait
7773  * for the enqueued ops. This is needed when a conn_close wants to
7774  * enter the ipsq and abort an ioctl that is somehow stuck. Unplumb
7775  * of an ill can also use this option. But we dont' use it currently.
7776  */
7777 #define	ENTER_SQ_WAIT_TICKS 100
7778 boolean_t
7779 ipsq_enter(ill_t *ill, boolean_t force, int type)
7780 {
7781 	ipsq_t	*ipsq;
7782 	ipxop_t *ipx;
7783 	boolean_t waited_enough = B_FALSE;
7784 
7785 	/*
7786 	 * Note that the relationship between ill and ipsq is fixed as long as
7787 	 * the ill is not ILL_CONDEMNED.  Holding ipsq_lock ensures the
7788 	 * relationship between the IPSQ and xop cannot change.  However,
7789 	 * since we cannot hold ipsq_lock across the cv_wait(), it may change
7790 	 * while we're waiting.  We wait on ill_cv and rely on ipsq_exit()
7791 	 * waking up all ills in the xop when it becomes available.
7792 	 */
7793 	mutex_enter(&ill->ill_lock);
7794 	for (;;) {
7795 		if (ill->ill_state_flags & ILL_CONDEMNED) {
7796 			mutex_exit(&ill->ill_lock);
7797 			return (B_FALSE);
7798 		}
7799 
7800 		ipsq = ill->ill_phyint->phyint_ipsq;
7801 		mutex_enter(&ipsq->ipsq_lock);
7802 		ipx = ipsq->ipsq_xop;
7803 		mutex_enter(&ipx->ipx_lock);
7804 
7805 		if (ipx->ipx_writer == NULL && (type == CUR_OP ||
7806 		    ipx->ipx_current_ipif == NULL || waited_enough))
7807 			break;
7808 
7809 		if (!force || ipx->ipx_writer != NULL) {
7810 			mutex_exit(&ipx->ipx_lock);
7811 			mutex_exit(&ipsq->ipsq_lock);
7812 			cv_wait(&ill->ill_cv, &ill->ill_lock);
7813 		} else {
7814 			mutex_exit(&ipx->ipx_lock);
7815 			mutex_exit(&ipsq->ipsq_lock);
7816 			(void) cv_timedwait(&ill->ill_cv,
7817 			    &ill->ill_lock, lbolt + ENTER_SQ_WAIT_TICKS);
7818 			waited_enough = B_TRUE;
7819 		}
7820 	}
7821 
7822 	ASSERT(ipx->ipx_mphead == NULL && ipx->ipx_mptail == NULL);
7823 	ASSERT(ipx->ipx_reentry_cnt == 0);
7824 	ipx->ipx_writer = curthread;
7825 	ipx->ipx_forced = (ipx->ipx_current_ipif != NULL);
7826 	ipx->ipx_reentry_cnt++;
7827 #ifdef DEBUG
7828 	ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
7829 #endif
7830 	mutex_exit(&ipx->ipx_lock);
7831 	mutex_exit(&ipsq->ipsq_lock);
7832 	mutex_exit(&ill->ill_lock);
7833 	return (B_TRUE);
7834 }
7835 
7836 boolean_t
7837 ill_perim_enter(ill_t *ill)
7838 {
7839 	return (ipsq_enter(ill, B_FALSE, CUR_OP));
7840 }
7841 
7842 void
7843 ill_perim_exit(ill_t *ill)
7844 {
7845 	ipsq_exit(ill->ill_phyint->phyint_ipsq);
7846 }
7847 
7848 /*
7849  * The ipsq_t (ipsq) is the synchronization data structure used to serialize
7850  * certain critical operations like plumbing (i.e. most set ioctls), multicast
7851  * joins, igmp/mld timers, etc.  There is one ipsq per phyint. The ipsq
7852  * serializes exclusive ioctls issued by applications on a per ipsq basis in
7853  * ipsq_xopq_mphead. It also protects against multiple threads executing in
7854  * the ipsq. Responses from the driver pertain to the current ioctl (say a
7855  * DL_BIND_ACK in response to a DL_BIND_REQ initiated as part of bringing
7856  * up the interface) and are enqueued in ipx_mphead.
7857  *
7858  * If a thread does not want to reenter the ipsq when it is already writer,
7859  * it must make sure that the specified reentry point to be called later
7860  * when the ipsq is empty, nor any code path starting from the specified reentry
7861  * point must never ever try to enter the ipsq again. Otherwise it can lead
7862  * to an infinite loop. The reentry point ip_rput_dlpi_writer is an example.
7863  * When the thread that is currently exclusive finishes, it (ipsq_exit)
7864  * dequeues the requests waiting to become exclusive in ipx_mphead and calls
7865  * the reentry point. When the list at ipx_mphead becomes empty ipsq_exit
7866  * proceeds to dequeue the next ioctl in ipsq_xopq_mphead and start the next
7867  * ioctl if the current ioctl has completed. If the current ioctl is still
7868  * in progress it simply returns. The current ioctl could be waiting for
7869  * a response from another module (arp or the driver or could be waiting for
7870  * the ipif/ill/ire refcnts to drop to zero. In such a case the ipx_pending_mp
7871  * and ipx_pending_ipif are set. ipx_current_ipif is set throughout the
7872  * execution of the ioctl and ipsq_exit does not start the next ioctl unless
7873  * ipx_current_ipif is NULL which happens only once the ioctl is complete and
7874  * all associated DLPI operations have completed.
7875  */
7876 
7877 /*
7878  * Try to enter the IPSQ corresponding to `ipif' or `ill' exclusively (`ipif'
7879  * and `ill' cannot both be specified).  Returns a pointer to the entered IPSQ
7880  * on success, or NULL on failure.  The caller ensures ipif/ill is valid by
7881  * refholding it as necessary.  If the IPSQ cannot be entered and `func' is
7882  * non-NULL, then `func' will be called back with `q' and `mp' once the IPSQ
7883  * can be entered.  If `func' is NULL, then `q' and `mp' are ignored.
7884  */
7885 ipsq_t *
7886 ipsq_try_enter(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
7887     ipsq_func_t func, int type, boolean_t reentry_ok)
7888 {
7889 	ipsq_t	*ipsq;
7890 	ipxop_t	*ipx;
7891 
7892 	/* Only 1 of ipif or ill can be specified */
7893 	ASSERT((ipif != NULL) ^ (ill != NULL));
7894 	if (ipif != NULL)
7895 		ill = ipif->ipif_ill;
7896 
7897 	/*
7898 	 * lock ordering: conn_lock -> ill_lock -> ipsq_lock -> ipx_lock.
7899 	 * ipx of an ipsq can't change when ipsq_lock is held.
7900 	 */
7901 	GRAB_CONN_LOCK(q);
7902 	mutex_enter(&ill->ill_lock);
7903 	ipsq = ill->ill_phyint->phyint_ipsq;
7904 	mutex_enter(&ipsq->ipsq_lock);
7905 	ipx = ipsq->ipsq_xop;
7906 	mutex_enter(&ipx->ipx_lock);
7907 
7908 	/*
7909 	 * 1. Enter the ipsq if we are already writer and reentry is ok.
7910 	 *    (Note: If the caller does not specify reentry_ok then neither
7911 	 *    'func' nor any of its callees must ever attempt to enter the ipsq
7912 	 *    again. Otherwise it can lead to an infinite loop
7913 	 * 2. Enter the ipsq if there is no current writer and this attempted
7914 	 *    entry is part of the current operation
7915 	 * 3. Enter the ipsq if there is no current writer and this is a new
7916 	 *    operation and the operation queue is empty and there is no
7917 	 *    operation currently in progress
7918 	 */
7919 	if ((ipx->ipx_writer == curthread && reentry_ok) ||
7920 	    (ipx->ipx_writer == NULL && (type == CUR_OP || (type == NEW_OP &&
7921 	    !ipx->ipx_ipsq_queued && ipx->ipx_current_ipif == NULL)))) {
7922 		/* Success. */
7923 		ipx->ipx_reentry_cnt++;
7924 		ipx->ipx_writer = curthread;
7925 		ipx->ipx_forced = B_FALSE;
7926 		mutex_exit(&ipx->ipx_lock);
7927 		mutex_exit(&ipsq->ipsq_lock);
7928 		mutex_exit(&ill->ill_lock);
7929 		RELEASE_CONN_LOCK(q);
7930 #ifdef DEBUG
7931 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
7932 #endif
7933 		return (ipsq);
7934 	}
7935 
7936 	if (func != NULL)
7937 		ipsq_enq(ipsq, q, mp, func, type, ill);
7938 
7939 	mutex_exit(&ipx->ipx_lock);
7940 	mutex_exit(&ipsq->ipsq_lock);
7941 	mutex_exit(&ill->ill_lock);
7942 	RELEASE_CONN_LOCK(q);
7943 	return (NULL);
7944 }
7945 
7946 /*
7947  * Try to enter the IPSQ corresponding to `ill' as writer.  The caller ensures
7948  * ill is valid by refholding it if necessary; we will refrele.  If the IPSQ
7949  * cannot be entered, the mp is queued for completion.
7950  */
7951 void
7952 qwriter_ip(ill_t *ill, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
7953     boolean_t reentry_ok)
7954 {
7955 	ipsq_t	*ipsq;
7956 
7957 	ipsq = ipsq_try_enter(NULL, ill, q, mp, func, type, reentry_ok);
7958 
7959 	/*
7960 	 * Drop the caller's refhold on the ill.  This is safe since we either
7961 	 * entered the IPSQ (and thus are exclusive), or failed to enter the
7962 	 * IPSQ, in which case we return without accessing ill anymore.  This
7963 	 * is needed because func needs to see the correct refcount.
7964 	 * e.g. removeif can work only then.
7965 	 */
7966 	ill_refrele(ill);
7967 	if (ipsq != NULL) {
7968 		(*func)(ipsq, q, mp, NULL);
7969 		ipsq_exit(ipsq);
7970 	}
7971 }
7972 
7973 /*
7974  * Exit the specified IPSQ.  If this is the final exit on it then drain it
7975  * prior to exiting.  Caller must be writer on the specified IPSQ.
7976  */
7977 void
7978 ipsq_exit(ipsq_t *ipsq)
7979 {
7980 	mblk_t *mp;
7981 	ipsq_t *mp_ipsq;
7982 	queue_t	*q;
7983 	phyint_t *phyi;
7984 	ipsq_func_t func;
7985 
7986 	ASSERT(IAM_WRITER_IPSQ(ipsq));
7987 
7988 	ASSERT(ipsq->ipsq_xop->ipx_reentry_cnt >= 1);
7989 	if (ipsq->ipsq_xop->ipx_reentry_cnt != 1) {
7990 		ipsq->ipsq_xop->ipx_reentry_cnt--;
7991 		return;
7992 	}
7993 
7994 	for (;;) {
7995 		phyi = ipsq->ipsq_phyint;
7996 		mp = ipsq_dq(ipsq);
7997 		mp_ipsq = (mp == NULL) ? NULL : (ipsq_t *)mp->b_next;
7998 
7999 		/*
8000 		 * If we've changed to a new IPSQ, and the phyint associated
8001 		 * with the old one has gone away, free the old IPSQ.  Note
8002 		 * that this cannot happen while the IPSQ is in a group.
8003 		 */
8004 		if (mp_ipsq != ipsq && phyi == NULL) {
8005 			ASSERT(ipsq->ipsq_next == ipsq);
8006 			ASSERT(ipsq->ipsq_xop == &ipsq->ipsq_ownxop);
8007 			ipsq_delete(ipsq);
8008 		}
8009 
8010 		if (mp == NULL)
8011 			break;
8012 
8013 		q = mp->b_queue;
8014 		func = (ipsq_func_t)mp->b_prev;
8015 		ipsq = mp_ipsq;
8016 		mp->b_next = mp->b_prev = NULL;
8017 		mp->b_queue = NULL;
8018 
8019 		/*
8020 		 * If 'q' is an conn queue, it is valid, since we did a
8021 		 * a refhold on the conn at the start of the ioctl.
8022 		 * If 'q' is an ill queue, it is valid, since close of an
8023 		 * ill will clean up its IPSQ.
8024 		 */
8025 		(*func)(ipsq, q, mp, NULL);
8026 	}
8027 }
8028 
8029 /*
8030  * Start the current exclusive operation on `ipsq'; associate it with `ipif'
8031  * and `ioccmd'.
8032  */
8033 void
8034 ipsq_current_start(ipsq_t *ipsq, ipif_t *ipif, int ioccmd)
8035 {
8036 	ill_t *ill = ipif->ipif_ill;
8037 	ipxop_t *ipx = ipsq->ipsq_xop;
8038 
8039 	ASSERT(IAM_WRITER_IPSQ(ipsq));
8040 	ASSERT(ipx->ipx_current_ipif == NULL);
8041 	ASSERT(ipx->ipx_current_ioctl == 0);
8042 
8043 	ipx->ipx_current_done = B_FALSE;
8044 	ipx->ipx_current_ioctl = ioccmd;
8045 	mutex_enter(&ipx->ipx_lock);
8046 	ipx->ipx_current_ipif = ipif;
8047 	mutex_exit(&ipx->ipx_lock);
8048 
8049 	/*
8050 	 * Set IPIF_CHANGING on one or more ipifs associated with the
8051 	 * current exclusive operation.  IPIF_CHANGING prevents any new
8052 	 * references to the ipif (so that the references will eventually
8053 	 * drop to zero) and also prevents any "get" operations (e.g.,
8054 	 * SIOCGLIFFLAGS) from being able to access the ipif until the
8055 	 * operation has completed and the ipif is again in a stable state.
8056 	 *
8057 	 * For ioctls, IPIF_CHANGING is set on the ipif associated with the
8058 	 * ioctl.  For internal operations (where ioccmd is zero), all ipifs
8059 	 * on the ill are marked with IPIF_CHANGING since it's unclear which
8060 	 * ipifs will be affected.
8061 	 *
8062 	 * Note that SIOCLIFREMOVEIF is a special case as it sets
8063 	 * IPIF_CONDEMNED internally after identifying the right ipif to
8064 	 * operate on.
8065 	 */
8066 	switch (ioccmd) {
8067 	case SIOCLIFREMOVEIF:
8068 		break;
8069 	case 0:
8070 		mutex_enter(&ill->ill_lock);
8071 		ipif = ipif->ipif_ill->ill_ipif;
8072 		for (; ipif != NULL; ipif = ipif->ipif_next)
8073 			ipif->ipif_state_flags |= IPIF_CHANGING;
8074 		mutex_exit(&ill->ill_lock);
8075 		break;
8076 	default:
8077 		mutex_enter(&ill->ill_lock);
8078 		ipif->ipif_state_flags |= IPIF_CHANGING;
8079 		mutex_exit(&ill->ill_lock);
8080 	}
8081 }
8082 
8083 /*
8084  * Finish the current exclusive operation on `ipsq'.  Usually, this will allow
8085  * the next exclusive operation to begin once we ipsq_exit().  However, if
8086  * pending DLPI operations remain, then we will wait for the queue to drain
8087  * before allowing the next exclusive operation to begin.  This ensures that
8088  * DLPI operations from one exclusive operation are never improperly processed
8089  * as part of a subsequent exclusive operation.
8090  */
8091 void
8092 ipsq_current_finish(ipsq_t *ipsq)
8093 {
8094 	ipxop_t	*ipx = ipsq->ipsq_xop;
8095 	t_uscalar_t dlpi_pending = DL_PRIM_INVAL;
8096 	ipif_t	*ipif = ipx->ipx_current_ipif;
8097 
8098 	ASSERT(IAM_WRITER_IPSQ(ipsq));
8099 
8100 	/*
8101 	 * For SIOCLIFREMOVEIF, the ipif has been already been blown away
8102 	 * (but in that case, IPIF_CHANGING will already be clear and no
8103 	 * pending DLPI messages can remain).
8104 	 */
8105 	if (ipx->ipx_current_ioctl != SIOCLIFREMOVEIF) {
8106 		ill_t *ill = ipif->ipif_ill;
8107 
8108 		mutex_enter(&ill->ill_lock);
8109 		dlpi_pending = ill->ill_dlpi_pending;
8110 		if (ipx->ipx_current_ioctl == 0) {
8111 			ipif = ill->ill_ipif;
8112 			for (; ipif != NULL; ipif = ipif->ipif_next)
8113 				ipif->ipif_state_flags &= ~IPIF_CHANGING;
8114 		} else {
8115 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
8116 		}
8117 		mutex_exit(&ill->ill_lock);
8118 	}
8119 
8120 	ASSERT(!ipx->ipx_current_done);
8121 	ipx->ipx_current_done = B_TRUE;
8122 	ipx->ipx_current_ioctl = 0;
8123 	if (dlpi_pending == DL_PRIM_INVAL) {
8124 		mutex_enter(&ipx->ipx_lock);
8125 		ipx->ipx_current_ipif = NULL;
8126 		mutex_exit(&ipx->ipx_lock);
8127 	}
8128 }
8129 
8130 /*
8131  * The ill is closing. Flush all messages on the ipsq that originated
8132  * from this ill. Usually there wont' be any messages on the ipsq_xopq_mphead
8133  * for this ill since ipsq_enter could not have entered until then.
8134  * New messages can't be queued since the CONDEMNED flag is set.
8135  */
8136 static void
8137 ipsq_flush(ill_t *ill)
8138 {
8139 	queue_t	*q;
8140 	mblk_t	*prev;
8141 	mblk_t	*mp;
8142 	mblk_t	*mp_next;
8143 	ipxop_t	*ipx = ill->ill_phyint->phyint_ipsq->ipsq_xop;
8144 
8145 	ASSERT(IAM_WRITER_ILL(ill));
8146 
8147 	/*
8148 	 * Flush any messages sent up by the driver.
8149 	 */
8150 	mutex_enter(&ipx->ipx_lock);
8151 	for (prev = NULL, mp = ipx->ipx_mphead; mp != NULL; mp = mp_next) {
8152 		mp_next = mp->b_next;
8153 		q = mp->b_queue;
8154 		if (q == ill->ill_rq || q == ill->ill_wq) {
8155 			/* dequeue mp */
8156 			if (prev == NULL)
8157 				ipx->ipx_mphead = mp->b_next;
8158 			else
8159 				prev->b_next = mp->b_next;
8160 			if (ipx->ipx_mptail == mp) {
8161 				ASSERT(mp_next == NULL);
8162 				ipx->ipx_mptail = prev;
8163 			}
8164 			inet_freemsg(mp);
8165 		} else {
8166 			prev = mp;
8167 		}
8168 	}
8169 	mutex_exit(&ipx->ipx_lock);
8170 	(void) ipsq_pending_mp_cleanup(ill, NULL);
8171 	ipsq_xopq_mp_cleanup(ill, NULL);
8172 	ill_pending_mp_cleanup(ill);
8173 }
8174 
8175 /*
8176  * Parse an iftun_req structure coming down SIOC[GS]TUNPARAM ioctls,
8177  * refhold and return the associated ipif
8178  */
8179 /* ARGSUSED */
8180 int
8181 ip_extract_tunreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
8182     cmd_info_t *ci, ipsq_func_t func)
8183 {
8184 	boolean_t exists;
8185 	struct iftun_req *ta;
8186 	ipif_t  *ipif;
8187 	ill_t   *ill;
8188 	boolean_t isv6;
8189 	mblk_t  *mp1;
8190 	int error;
8191 	conn_t  *connp;
8192 	ip_stack_t  *ipst;
8193 
8194 	/* Existence verified in ip_wput_nondata */
8195 	mp1 = mp->b_cont->b_cont;
8196 	ta = (struct iftun_req *)mp1->b_rptr;
8197 	/*
8198 	 * Null terminate the string to protect against buffer
8199 	 * overrun. String was generated by user code and may not
8200 	 * be trusted.
8201 	 */
8202 	ta->ifta_lifr_name[LIFNAMSIZ - 1] = '\0';
8203 
8204 	connp = Q_TO_CONN(q);
8205 	isv6 = connp->conn_af_isv6;
8206 	ipst = connp->conn_netstack->netstack_ip;
8207 
8208 	/* Disallows implicit create */
8209 	ipif = ipif_lookup_on_name(ta->ifta_lifr_name,
8210 	    mi_strlen(ta->ifta_lifr_name), B_FALSE, &exists, isv6,
8211 	    connp->conn_zoneid, CONNP_TO_WQ(connp), mp, func, &error, ipst);
8212 	if (ipif == NULL)
8213 		return (error);
8214 
8215 	if (ipif->ipif_id != 0) {
8216 		/*
8217 		 * We really don't want to set/get tunnel parameters
8218 		 * on virtual tunnel interfaces.  Only allow the
8219 		 * base tunnel to do these.
8220 		 */
8221 		ipif_refrele(ipif);
8222 		return (EINVAL);
8223 	}
8224 
8225 	/*
8226 	 * Send down to tunnel mod for ioctl processing.
8227 	 * Will finish ioctl in ip_rput_other().
8228 	 */
8229 	ill = ipif->ipif_ill;
8230 	if (ill->ill_net_type == IRE_LOOPBACK) {
8231 		ipif_refrele(ipif);
8232 		return (EOPNOTSUPP);
8233 	}
8234 
8235 	if (ill->ill_wq == NULL) {
8236 		ipif_refrele(ipif);
8237 		return (ENXIO);
8238 	}
8239 	/*
8240 	 * Mark the ioctl as coming from an IPv6 interface for
8241 	 * tun's convenience.
8242 	 */
8243 	if (ill->ill_isv6)
8244 		ta->ifta_flags |= 0x80000000;
8245 	ci->ci_ipif = ipif;
8246 	return (0);
8247 }
8248 
8249 /*
8250  * Parse an ifreq or lifreq struct coming down ioctls and refhold
8251  * and return the associated ipif.
8252  * Return value:
8253  *	Non zero: An error has occurred. ci may not be filled out.
8254  *	zero : ci is filled out with the ioctl cmd in ci.ci_name, and
8255  *	a held ipif in ci.ci_ipif.
8256  */
8257 int
8258 ip_extract_lifreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
8259     cmd_info_t *ci, ipsq_func_t func)
8260 {
8261 	char		*name;
8262 	struct ifreq    *ifr;
8263 	struct lifreq    *lifr;
8264 	ipif_t		*ipif = NULL;
8265 	ill_t		*ill;
8266 	conn_t		*connp;
8267 	boolean_t	isv6;
8268 	boolean_t	exists;
8269 	int		err;
8270 	mblk_t		*mp1;
8271 	zoneid_t	zoneid;
8272 	ip_stack_t	*ipst;
8273 
8274 	if (q->q_next != NULL) {
8275 		ill = (ill_t *)q->q_ptr;
8276 		isv6 = ill->ill_isv6;
8277 		connp = NULL;
8278 		zoneid = ALL_ZONES;
8279 		ipst = ill->ill_ipst;
8280 	} else {
8281 		ill = NULL;
8282 		connp = Q_TO_CONN(q);
8283 		isv6 = connp->conn_af_isv6;
8284 		zoneid = connp->conn_zoneid;
8285 		if (zoneid == GLOBAL_ZONEID) {
8286 			/* global zone can access ipifs in all zones */
8287 			zoneid = ALL_ZONES;
8288 		}
8289 		ipst = connp->conn_netstack->netstack_ip;
8290 	}
8291 
8292 	/* Has been checked in ip_wput_nondata */
8293 	mp1 = mp->b_cont->b_cont;
8294 
8295 	if (ipip->ipi_cmd_type == IF_CMD) {
8296 		/* This a old style SIOC[GS]IF* command */
8297 		ifr = (struct ifreq *)mp1->b_rptr;
8298 		/*
8299 		 * Null terminate the string to protect against buffer
8300 		 * overrun. String was generated by user code and may not
8301 		 * be trusted.
8302 		 */
8303 		ifr->ifr_name[IFNAMSIZ - 1] = '\0';
8304 		name = ifr->ifr_name;
8305 		ci->ci_sin = (sin_t *)&ifr->ifr_addr;
8306 		ci->ci_sin6 = NULL;
8307 		ci->ci_lifr = (struct lifreq *)ifr;
8308 	} else {
8309 		/* This a new style SIOC[GS]LIF* command */
8310 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
8311 		lifr = (struct lifreq *)mp1->b_rptr;
8312 		/*
8313 		 * Null terminate the string to protect against buffer
8314 		 * overrun. String was generated by user code and may not
8315 		 * be trusted.
8316 		 */
8317 		lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
8318 		name = lifr->lifr_name;
8319 		ci->ci_sin = (sin_t *)&lifr->lifr_addr;
8320 		ci->ci_sin6 = (sin6_t *)&lifr->lifr_addr;
8321 		ci->ci_lifr = lifr;
8322 	}
8323 
8324 	if (ipip->ipi_cmd == SIOCSLIFNAME) {
8325 		/*
8326 		 * The ioctl will be failed if the ioctl comes down
8327 		 * an conn stream
8328 		 */
8329 		if (ill == NULL) {
8330 			/*
8331 			 * Not an ill queue, return EINVAL same as the
8332 			 * old error code.
8333 			 */
8334 			return (ENXIO);
8335 		}
8336 		ipif = ill->ill_ipif;
8337 		ipif_refhold(ipif);
8338 	} else {
8339 		ipif = ipif_lookup_on_name(name, mi_strlen(name), B_FALSE,
8340 		    &exists, isv6, zoneid,
8341 		    (connp == NULL) ? q : CONNP_TO_WQ(connp), mp, func, &err,
8342 		    ipst);
8343 		if (ipif == NULL) {
8344 			if (err == EINPROGRESS)
8345 				return (err);
8346 			err = 0;	/* Ensure we don't use it below */
8347 		}
8348 	}
8349 
8350 	/*
8351 	 * Old style [GS]IFCMD does not admit IPv6 ipif
8352 	 */
8353 	if (ipif != NULL && ipif->ipif_isv6 && ipip->ipi_cmd_type == IF_CMD) {
8354 		ipif_refrele(ipif);
8355 		return (ENXIO);
8356 	}
8357 
8358 	if (ipif == NULL && ill != NULL && ill->ill_ipif != NULL &&
8359 	    name[0] == '\0') {
8360 		/*
8361 		 * Handle a or a SIOC?IF* with a null name
8362 		 * during plumb (on the ill queue before the I_PLINK).
8363 		 */
8364 		ipif = ill->ill_ipif;
8365 		ipif_refhold(ipif);
8366 	}
8367 
8368 	if (ipif == NULL)
8369 		return (ENXIO);
8370 
8371 	ci->ci_ipif = ipif;
8372 	return (0);
8373 }
8374 
8375 /*
8376  * Return the total number of ipifs.
8377  */
8378 static uint_t
8379 ip_get_numifs(zoneid_t zoneid, ip_stack_t *ipst)
8380 {
8381 	uint_t numifs = 0;
8382 	ill_t	*ill;
8383 	ill_walk_context_t	ctx;
8384 	ipif_t	*ipif;
8385 
8386 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
8387 	ill = ILL_START_WALK_V4(&ctx, ipst);
8388 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8389 		if (IS_UNDER_IPMP(ill))
8390 			continue;
8391 		for (ipif = ill->ill_ipif; ipif != NULL;
8392 		    ipif = ipif->ipif_next) {
8393 			if (ipif->ipif_zoneid == zoneid ||
8394 			    ipif->ipif_zoneid == ALL_ZONES)
8395 				numifs++;
8396 		}
8397 	}
8398 	rw_exit(&ipst->ips_ill_g_lock);
8399 	return (numifs);
8400 }
8401 
8402 /*
8403  * Return the total number of ipifs.
8404  */
8405 static uint_t
8406 ip_get_numlifs(int family, int lifn_flags, zoneid_t zoneid, ip_stack_t *ipst)
8407 {
8408 	uint_t numifs = 0;
8409 	ill_t	*ill;
8410 	ipif_t	*ipif;
8411 	ill_walk_context_t	ctx;
8412 
8413 	ip1dbg(("ip_get_numlifs(%d %u %d)\n", family, lifn_flags, (int)zoneid));
8414 
8415 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
8416 	if (family == AF_INET)
8417 		ill = ILL_START_WALK_V4(&ctx, ipst);
8418 	else if (family == AF_INET6)
8419 		ill = ILL_START_WALK_V6(&ctx, ipst);
8420 	else
8421 		ill = ILL_START_WALK_ALL(&ctx, ipst);
8422 
8423 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8424 		if (IS_UNDER_IPMP(ill) && !(lifn_flags & LIFC_UNDER_IPMP))
8425 			continue;
8426 
8427 		for (ipif = ill->ill_ipif; ipif != NULL;
8428 		    ipif = ipif->ipif_next) {
8429 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
8430 			    !(lifn_flags & LIFC_NOXMIT))
8431 				continue;
8432 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
8433 			    !(lifn_flags & LIFC_TEMPORARY))
8434 				continue;
8435 			if (((ipif->ipif_flags &
8436 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
8437 			    IPIF_DEPRECATED)) ||
8438 			    IS_LOOPBACK(ill) ||
8439 			    !(ipif->ipif_flags & IPIF_UP)) &&
8440 			    (lifn_flags & LIFC_EXTERNAL_SOURCE))
8441 				continue;
8442 
8443 			if (zoneid != ipif->ipif_zoneid &&
8444 			    ipif->ipif_zoneid != ALL_ZONES &&
8445 			    (zoneid != GLOBAL_ZONEID ||
8446 			    !(lifn_flags & LIFC_ALLZONES)))
8447 				continue;
8448 
8449 			numifs++;
8450 		}
8451 	}
8452 	rw_exit(&ipst->ips_ill_g_lock);
8453 	return (numifs);
8454 }
8455 
8456 uint_t
8457 ip_get_lifsrcofnum(ill_t *ill)
8458 {
8459 	uint_t numifs = 0;
8460 	ill_t	*ill_head = ill;
8461 	ip_stack_t	*ipst = ill->ill_ipst;
8462 
8463 	/*
8464 	 * ill_g_usesrc_lock protects ill_usesrc_grp_next, for example, some
8465 	 * other thread may be trying to relink the ILLs in this usesrc group
8466 	 * and adjusting the ill_usesrc_grp_next pointers
8467 	 */
8468 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
8469 	if ((ill->ill_usesrc_ifindex == 0) &&
8470 	    (ill->ill_usesrc_grp_next != NULL)) {
8471 		for (; (ill != NULL) && (ill->ill_usesrc_grp_next != ill_head);
8472 		    ill = ill->ill_usesrc_grp_next)
8473 			numifs++;
8474 	}
8475 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
8476 
8477 	return (numifs);
8478 }
8479 
8480 /* Null values are passed in for ipif, sin, and ifreq */
8481 /* ARGSUSED */
8482 int
8483 ip_sioctl_get_ifnum(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8484     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8485 {
8486 	int *nump;
8487 	conn_t *connp = Q_TO_CONN(q);
8488 
8489 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
8490 
8491 	/* Existence of b_cont->b_cont checked in ip_wput_nondata */
8492 	nump = (int *)mp->b_cont->b_cont->b_rptr;
8493 
8494 	*nump = ip_get_numifs(connp->conn_zoneid,
8495 	    connp->conn_netstack->netstack_ip);
8496 	ip1dbg(("ip_sioctl_get_ifnum numifs %d", *nump));
8497 	return (0);
8498 }
8499 
8500 /* Null values are passed in for ipif, sin, and ifreq */
8501 /* ARGSUSED */
8502 int
8503 ip_sioctl_get_lifnum(ipif_t *dummy_ipif, sin_t *dummy_sin,
8504     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8505 {
8506 	struct lifnum *lifn;
8507 	mblk_t	*mp1;
8508 	conn_t *connp = Q_TO_CONN(q);
8509 
8510 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
8511 
8512 	/* Existence checked in ip_wput_nondata */
8513 	mp1 = mp->b_cont->b_cont;
8514 
8515 	lifn = (struct lifnum *)mp1->b_rptr;
8516 	switch (lifn->lifn_family) {
8517 	case AF_UNSPEC:
8518 	case AF_INET:
8519 	case AF_INET6:
8520 		break;
8521 	default:
8522 		return (EAFNOSUPPORT);
8523 	}
8524 
8525 	lifn->lifn_count = ip_get_numlifs(lifn->lifn_family, lifn->lifn_flags,
8526 	    connp->conn_zoneid, connp->conn_netstack->netstack_ip);
8527 	ip1dbg(("ip_sioctl_get_lifnum numifs %d", lifn->lifn_count));
8528 	return (0);
8529 }
8530 
8531 /* ARGSUSED */
8532 int
8533 ip_sioctl_get_ifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8534     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8535 {
8536 	STRUCT_HANDLE(ifconf, ifc);
8537 	mblk_t *mp1;
8538 	struct iocblk *iocp;
8539 	struct ifreq *ifr;
8540 	ill_walk_context_t	ctx;
8541 	ill_t	*ill;
8542 	ipif_t	*ipif;
8543 	struct sockaddr_in *sin;
8544 	int32_t	ifclen;
8545 	zoneid_t zoneid;
8546 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
8547 
8548 	ASSERT(q->q_next == NULL); /* not valid ioctls for ip as a module */
8549 
8550 	ip1dbg(("ip_sioctl_get_ifconf"));
8551 	/* Existence verified in ip_wput_nondata */
8552 	mp1 = mp->b_cont->b_cont;
8553 	iocp = (struct iocblk *)mp->b_rptr;
8554 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8555 
8556 	/*
8557 	 * The original SIOCGIFCONF passed in a struct ifconf which specified
8558 	 * the user buffer address and length into which the list of struct
8559 	 * ifreqs was to be copied.  Since AT&T Streams does not seem to
8560 	 * allow M_COPYOUT to be used in conjunction with I_STR IOCTLS,
8561 	 * the SIOCGIFCONF operation was redefined to simply provide
8562 	 * a large output buffer into which we are supposed to jam the ifreq
8563 	 * array.  The same ioctl command code was used, despite the fact that
8564 	 * both the applications and the kernel code had to change, thus making
8565 	 * it impossible to support both interfaces.
8566 	 *
8567 	 * For reasons not good enough to try to explain, the following
8568 	 * algorithm is used for deciding what to do with one of these:
8569 	 * If the IOCTL comes in as an I_STR, it is assumed to be of the new
8570 	 * form with the output buffer coming down as the continuation message.
8571 	 * If it arrives as a TRANSPARENT IOCTL, it is assumed to be old style,
8572 	 * and we have to copy in the ifconf structure to find out how big the
8573 	 * output buffer is and where to copy out to.  Sure no problem...
8574 	 *
8575 	 */
8576 	STRUCT_SET_HANDLE(ifc, iocp->ioc_flag, NULL);
8577 	if ((mp1->b_wptr - mp1->b_rptr) == STRUCT_SIZE(ifc)) {
8578 		int numifs = 0;
8579 		size_t ifc_bufsize;
8580 
8581 		/*
8582 		 * Must be (better be!) continuation of a TRANSPARENT
8583 		 * IOCTL.  We just copied in the ifconf structure.
8584 		 */
8585 		STRUCT_SET_HANDLE(ifc, iocp->ioc_flag,
8586 		    (struct ifconf *)mp1->b_rptr);
8587 
8588 		/*
8589 		 * Allocate a buffer to hold requested information.
8590 		 *
8591 		 * If ifc_len is larger than what is needed, we only
8592 		 * allocate what we will use.
8593 		 *
8594 		 * If ifc_len is smaller than what is needed, return
8595 		 * EINVAL.
8596 		 *
8597 		 * XXX: the ill_t structure can hava 2 counters, for
8598 		 * v4 and v6 (not just ill_ipif_up_count) to store the
8599 		 * number of interfaces for a device, so we don't need
8600 		 * to count them here...
8601 		 */
8602 		numifs = ip_get_numifs(zoneid, ipst);
8603 
8604 		ifclen = STRUCT_FGET(ifc, ifc_len);
8605 		ifc_bufsize = numifs * sizeof (struct ifreq);
8606 		if (ifc_bufsize > ifclen) {
8607 			if (iocp->ioc_cmd == O_SIOCGIFCONF) {
8608 				/* old behaviour */
8609 				return (EINVAL);
8610 			} else {
8611 				ifc_bufsize = ifclen;
8612 			}
8613 		}
8614 
8615 		mp1 = mi_copyout_alloc(q, mp,
8616 		    STRUCT_FGETP(ifc, ifc_buf), ifc_bufsize, B_FALSE);
8617 		if (mp1 == NULL)
8618 			return (ENOMEM);
8619 
8620 		mp1->b_wptr = mp1->b_rptr + ifc_bufsize;
8621 	}
8622 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
8623 	/*
8624 	 * the SIOCGIFCONF ioctl only knows about
8625 	 * IPv4 addresses, so don't try to tell
8626 	 * it about interfaces with IPv6-only
8627 	 * addresses. (Last parm 'isv6' is B_FALSE)
8628 	 */
8629 
8630 	ifr = (struct ifreq *)mp1->b_rptr;
8631 
8632 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
8633 	ill = ILL_START_WALK_V4(&ctx, ipst);
8634 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8635 		if (IS_UNDER_IPMP(ill))
8636 			continue;
8637 		for (ipif = ill->ill_ipif; ipif != NULL;
8638 		    ipif = ipif->ipif_next) {
8639 			if (zoneid != ipif->ipif_zoneid &&
8640 			    ipif->ipif_zoneid != ALL_ZONES)
8641 				continue;
8642 			if ((uchar_t *)&ifr[1] > mp1->b_wptr) {
8643 				if (iocp->ioc_cmd == O_SIOCGIFCONF) {
8644 					/* old behaviour */
8645 					rw_exit(&ipst->ips_ill_g_lock);
8646 					return (EINVAL);
8647 				} else {
8648 					goto if_copydone;
8649 				}
8650 			}
8651 			ipif_get_name(ipif, ifr->ifr_name,
8652 			    sizeof (ifr->ifr_name));
8653 			sin = (sin_t *)&ifr->ifr_addr;
8654 			*sin = sin_null;
8655 			sin->sin_family = AF_INET;
8656 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
8657 			ifr++;
8658 		}
8659 	}
8660 if_copydone:
8661 	rw_exit(&ipst->ips_ill_g_lock);
8662 	mp1->b_wptr = (uchar_t *)ifr;
8663 
8664 	if (STRUCT_BUF(ifc) != NULL) {
8665 		STRUCT_FSET(ifc, ifc_len,
8666 		    (int)((uchar_t *)ifr - mp1->b_rptr));
8667 	}
8668 	return (0);
8669 }
8670 
8671 /*
8672  * Get the interfaces using the address hosted on the interface passed in,
8673  * as a source adddress
8674  */
8675 /* ARGSUSED */
8676 int
8677 ip_sioctl_get_lifsrcof(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8678     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8679 {
8680 	mblk_t *mp1;
8681 	ill_t	*ill, *ill_head;
8682 	ipif_t	*ipif, *orig_ipif;
8683 	int	numlifs = 0;
8684 	size_t	lifs_bufsize, lifsmaxlen;
8685 	struct	lifreq *lifr;
8686 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8687 	uint_t	ifindex;
8688 	zoneid_t zoneid;
8689 	int err = 0;
8690 	boolean_t isv6 = B_FALSE;
8691 	struct	sockaddr_in	*sin;
8692 	struct	sockaddr_in6	*sin6;
8693 	STRUCT_HANDLE(lifsrcof, lifs);
8694 	ip_stack_t		*ipst;
8695 
8696 	ipst = CONNQ_TO_IPST(q);
8697 
8698 	ASSERT(q->q_next == NULL);
8699 
8700 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8701 
8702 	/* Existence verified in ip_wput_nondata */
8703 	mp1 = mp->b_cont->b_cont;
8704 
8705 	/*
8706 	 * Must be (better be!) continuation of a TRANSPARENT
8707 	 * IOCTL.  We just copied in the lifsrcof structure.
8708 	 */
8709 	STRUCT_SET_HANDLE(lifs, iocp->ioc_flag,
8710 	    (struct lifsrcof *)mp1->b_rptr);
8711 
8712 	if (MBLKL(mp1) != STRUCT_SIZE(lifs))
8713 		return (EINVAL);
8714 
8715 	ifindex = STRUCT_FGET(lifs, lifs_ifindex);
8716 	isv6 = (Q_TO_CONN(q))->conn_af_isv6;
8717 	ipif = ipif_lookup_on_ifindex(ifindex, isv6, zoneid, q, mp,
8718 	    ip_process_ioctl, &err, ipst);
8719 	if (ipif == NULL) {
8720 		ip1dbg(("ip_sioctl_get_lifsrcof: no ipif for ifindex %d\n",
8721 		    ifindex));
8722 		return (err);
8723 	}
8724 
8725 	/* Allocate a buffer to hold requested information */
8726 	numlifs = ip_get_lifsrcofnum(ipif->ipif_ill);
8727 	lifs_bufsize = numlifs * sizeof (struct lifreq);
8728 	lifsmaxlen =  STRUCT_FGET(lifs, lifs_maxlen);
8729 	/* The actual size needed is always returned in lifs_len */
8730 	STRUCT_FSET(lifs, lifs_len, lifs_bufsize);
8731 
8732 	/* If the amount we need is more than what is passed in, abort */
8733 	if (lifs_bufsize > lifsmaxlen || lifs_bufsize == 0) {
8734 		ipif_refrele(ipif);
8735 		return (0);
8736 	}
8737 
8738 	mp1 = mi_copyout_alloc(q, mp,
8739 	    STRUCT_FGETP(lifs, lifs_buf), lifs_bufsize, B_FALSE);
8740 	if (mp1 == NULL) {
8741 		ipif_refrele(ipif);
8742 		return (ENOMEM);
8743 	}
8744 
8745 	mp1->b_wptr = mp1->b_rptr + lifs_bufsize;
8746 	bzero(mp1->b_rptr, lifs_bufsize);
8747 
8748 	lifr = (struct lifreq *)mp1->b_rptr;
8749 
8750 	ill = ill_head = ipif->ipif_ill;
8751 	orig_ipif = ipif;
8752 
8753 	/* ill_g_usesrc_lock protects ill_usesrc_grp_next */
8754 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
8755 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
8756 
8757 	ill = ill->ill_usesrc_grp_next; /* start from next ill */
8758 	for (; (ill != NULL) && (ill != ill_head);
8759 	    ill = ill->ill_usesrc_grp_next) {
8760 
8761 		if ((uchar_t *)&lifr[1] > mp1->b_wptr)
8762 			break;
8763 
8764 		ipif = ill->ill_ipif;
8765 		ipif_get_name(ipif, lifr->lifr_name, sizeof (lifr->lifr_name));
8766 		if (ipif->ipif_isv6) {
8767 			sin6 = (sin6_t *)&lifr->lifr_addr;
8768 			*sin6 = sin6_null;
8769 			sin6->sin6_family = AF_INET6;
8770 			sin6->sin6_addr = ipif->ipif_v6lcl_addr;
8771 			lifr->lifr_addrlen = ip_mask_to_plen_v6(
8772 			    &ipif->ipif_v6net_mask);
8773 		} else {
8774 			sin = (sin_t *)&lifr->lifr_addr;
8775 			*sin = sin_null;
8776 			sin->sin_family = AF_INET;
8777 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
8778 			lifr->lifr_addrlen = ip_mask_to_plen(
8779 			    ipif->ipif_net_mask);
8780 		}
8781 		lifr++;
8782 	}
8783 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
8784 	rw_exit(&ipst->ips_ill_g_lock);
8785 	ipif_refrele(orig_ipif);
8786 	mp1->b_wptr = (uchar_t *)lifr;
8787 	STRUCT_FSET(lifs, lifs_len, (int)((uchar_t *)lifr - mp1->b_rptr));
8788 
8789 	return (0);
8790 }
8791 
8792 /* ARGSUSED */
8793 int
8794 ip_sioctl_get_lifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8795     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8796 {
8797 	mblk_t *mp1;
8798 	int	list;
8799 	ill_t	*ill;
8800 	ipif_t	*ipif;
8801 	int	flags;
8802 	int	numlifs = 0;
8803 	size_t	lifc_bufsize;
8804 	struct	lifreq *lifr;
8805 	sa_family_t	family;
8806 	struct	sockaddr_in	*sin;
8807 	struct	sockaddr_in6	*sin6;
8808 	ill_walk_context_t	ctx;
8809 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8810 	int32_t	lifclen;
8811 	zoneid_t zoneid;
8812 	STRUCT_HANDLE(lifconf, lifc);
8813 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
8814 
8815 	ip1dbg(("ip_sioctl_get_lifconf"));
8816 
8817 	ASSERT(q->q_next == NULL);
8818 
8819 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8820 
8821 	/* Existence verified in ip_wput_nondata */
8822 	mp1 = mp->b_cont->b_cont;
8823 
8824 	/*
8825 	 * An extended version of SIOCGIFCONF that takes an
8826 	 * additional address family and flags field.
8827 	 * AF_UNSPEC retrieve both IPv4 and IPv6.
8828 	 * Unless LIFC_NOXMIT is specified the IPIF_NOXMIT
8829 	 * interfaces are omitted.
8830 	 * Similarly, IPIF_TEMPORARY interfaces are omitted
8831 	 * unless LIFC_TEMPORARY is specified.
8832 	 * If LIFC_EXTERNAL_SOURCE is specified, IPIF_NOXMIT,
8833 	 * IPIF_NOLOCAL, PHYI_LOOPBACK, IPIF_DEPRECATED and
8834 	 * not IPIF_UP interfaces are omitted. LIFC_EXTERNAL_SOURCE
8835 	 * has priority over LIFC_NOXMIT.
8836 	 */
8837 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, NULL);
8838 
8839 	if ((mp1->b_wptr - mp1->b_rptr) != STRUCT_SIZE(lifc))
8840 		return (EINVAL);
8841 
8842 	/*
8843 	 * Must be (better be!) continuation of a TRANSPARENT
8844 	 * IOCTL.  We just copied in the lifconf structure.
8845 	 */
8846 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, (struct lifconf *)mp1->b_rptr);
8847 
8848 	family = STRUCT_FGET(lifc, lifc_family);
8849 	flags = STRUCT_FGET(lifc, lifc_flags);
8850 
8851 	switch (family) {
8852 	case AF_UNSPEC:
8853 		/*
8854 		 * walk all ILL's.
8855 		 */
8856 		list = MAX_G_HEADS;
8857 		break;
8858 	case AF_INET:
8859 		/*
8860 		 * walk only IPV4 ILL's.
8861 		 */
8862 		list = IP_V4_G_HEAD;
8863 		break;
8864 	case AF_INET6:
8865 		/*
8866 		 * walk only IPV6 ILL's.
8867 		 */
8868 		list = IP_V6_G_HEAD;
8869 		break;
8870 	default:
8871 		return (EAFNOSUPPORT);
8872 	}
8873 
8874 	/*
8875 	 * Allocate a buffer to hold requested information.
8876 	 *
8877 	 * If lifc_len is larger than what is needed, we only
8878 	 * allocate what we will use.
8879 	 *
8880 	 * If lifc_len is smaller than what is needed, return
8881 	 * EINVAL.
8882 	 */
8883 	numlifs = ip_get_numlifs(family, flags, zoneid, ipst);
8884 	lifc_bufsize = numlifs * sizeof (struct lifreq);
8885 	lifclen = STRUCT_FGET(lifc, lifc_len);
8886 	if (lifc_bufsize > lifclen) {
8887 		if (iocp->ioc_cmd == O_SIOCGLIFCONF)
8888 			return (EINVAL);
8889 		else
8890 			lifc_bufsize = lifclen;
8891 	}
8892 
8893 	mp1 = mi_copyout_alloc(q, mp,
8894 	    STRUCT_FGETP(lifc, lifc_buf), lifc_bufsize, B_FALSE);
8895 	if (mp1 == NULL)
8896 		return (ENOMEM);
8897 
8898 	mp1->b_wptr = mp1->b_rptr + lifc_bufsize;
8899 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
8900 
8901 	lifr = (struct lifreq *)mp1->b_rptr;
8902 
8903 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
8904 	ill = ill_first(list, list, &ctx, ipst);
8905 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8906 		if (IS_UNDER_IPMP(ill) && !(flags & LIFC_UNDER_IPMP))
8907 			continue;
8908 
8909 		for (ipif = ill->ill_ipif; ipif != NULL;
8910 		    ipif = ipif->ipif_next) {
8911 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
8912 			    !(flags & LIFC_NOXMIT))
8913 				continue;
8914 
8915 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
8916 			    !(flags & LIFC_TEMPORARY))
8917 				continue;
8918 
8919 			if (((ipif->ipif_flags &
8920 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
8921 			    IPIF_DEPRECATED)) ||
8922 			    IS_LOOPBACK(ill) ||
8923 			    !(ipif->ipif_flags & IPIF_UP)) &&
8924 			    (flags & LIFC_EXTERNAL_SOURCE))
8925 				continue;
8926 
8927 			if (zoneid != ipif->ipif_zoneid &&
8928 			    ipif->ipif_zoneid != ALL_ZONES &&
8929 			    (zoneid != GLOBAL_ZONEID ||
8930 			    !(flags & LIFC_ALLZONES)))
8931 				continue;
8932 
8933 			if ((uchar_t *)&lifr[1] > mp1->b_wptr) {
8934 				if (iocp->ioc_cmd == O_SIOCGLIFCONF) {
8935 					rw_exit(&ipst->ips_ill_g_lock);
8936 					return (EINVAL);
8937 				} else {
8938 					goto lif_copydone;
8939 				}
8940 			}
8941 
8942 			ipif_get_name(ipif, lifr->lifr_name,
8943 			    sizeof (lifr->lifr_name));
8944 			lifr->lifr_type = ill->ill_type;
8945 			if (ipif->ipif_isv6) {
8946 				sin6 = (sin6_t *)&lifr->lifr_addr;
8947 				*sin6 = sin6_null;
8948 				sin6->sin6_family = AF_INET6;
8949 				sin6->sin6_addr =
8950 				    ipif->ipif_v6lcl_addr;
8951 				lifr->lifr_addrlen =
8952 				    ip_mask_to_plen_v6(
8953 				    &ipif->ipif_v6net_mask);
8954 			} else {
8955 				sin = (sin_t *)&lifr->lifr_addr;
8956 				*sin = sin_null;
8957 				sin->sin_family = AF_INET;
8958 				sin->sin_addr.s_addr =
8959 				    ipif->ipif_lcl_addr;
8960 				lifr->lifr_addrlen =
8961 				    ip_mask_to_plen(
8962 				    ipif->ipif_net_mask);
8963 			}
8964 			lifr++;
8965 		}
8966 	}
8967 lif_copydone:
8968 	rw_exit(&ipst->ips_ill_g_lock);
8969 
8970 	mp1->b_wptr = (uchar_t *)lifr;
8971 	if (STRUCT_BUF(lifc) != NULL) {
8972 		STRUCT_FSET(lifc, lifc_len,
8973 		    (int)((uchar_t *)lifr - mp1->b_rptr));
8974 	}
8975 	return (0);
8976 }
8977 
8978 static void
8979 ip_sioctl_ip6addrpolicy(queue_t *q, mblk_t *mp)
8980 {
8981 	ip6_asp_t *table;
8982 	size_t table_size;
8983 	mblk_t *data_mp;
8984 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8985 	ip_stack_t	*ipst;
8986 
8987 	if (q->q_next == NULL)
8988 		ipst = CONNQ_TO_IPST(q);
8989 	else
8990 		ipst = ILLQ_TO_IPST(q);
8991 
8992 	/* These two ioctls are I_STR only */
8993 	if (iocp->ioc_count == TRANSPARENT) {
8994 		miocnak(q, mp, 0, EINVAL);
8995 		return;
8996 	}
8997 
8998 	data_mp = mp->b_cont;
8999 	if (data_mp == NULL) {
9000 		/* The user passed us a NULL argument */
9001 		table = NULL;
9002 		table_size = iocp->ioc_count;
9003 	} else {
9004 		/*
9005 		 * The user provided a table.  The stream head
9006 		 * may have copied in the user data in chunks,
9007 		 * so make sure everything is pulled up
9008 		 * properly.
9009 		 */
9010 		if (MBLKL(data_mp) < iocp->ioc_count) {
9011 			mblk_t *new_data_mp;
9012 			if ((new_data_mp = msgpullup(data_mp, -1)) ==
9013 			    NULL) {
9014 				miocnak(q, mp, 0, ENOMEM);
9015 				return;
9016 			}
9017 			freemsg(data_mp);
9018 			data_mp = new_data_mp;
9019 			mp->b_cont = data_mp;
9020 		}
9021 		table = (ip6_asp_t *)data_mp->b_rptr;
9022 		table_size = iocp->ioc_count;
9023 	}
9024 
9025 	switch (iocp->ioc_cmd) {
9026 	case SIOCGIP6ADDRPOLICY:
9027 		iocp->ioc_rval = ip6_asp_get(table, table_size, ipst);
9028 		if (iocp->ioc_rval == -1)
9029 			iocp->ioc_error = EINVAL;
9030 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
9031 		else if (table != NULL &&
9032 		    (iocp->ioc_flag & IOC_MODELS) == IOC_ILP32) {
9033 			ip6_asp_t *src = table;
9034 			ip6_asp32_t *dst = (void *)table;
9035 			int count = table_size / sizeof (ip6_asp_t);
9036 			int i;
9037 
9038 			/*
9039 			 * We need to do an in-place shrink of the array
9040 			 * to match the alignment attributes of the
9041 			 * 32-bit ABI looking at it.
9042 			 */
9043 			/* LINTED: logical expression always true: op "||" */
9044 			ASSERT(sizeof (*src) > sizeof (*dst));
9045 			for (i = 1; i < count; i++)
9046 				bcopy(src + i, dst + i, sizeof (*dst));
9047 		}
9048 #endif
9049 		break;
9050 
9051 	case SIOCSIP6ADDRPOLICY:
9052 		ASSERT(mp->b_prev == NULL);
9053 		mp->b_prev = (void *)q;
9054 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
9055 		/*
9056 		 * We pass in the datamodel here so that the ip6_asp_replace()
9057 		 * routine can handle converting from 32-bit to native formats
9058 		 * where necessary.
9059 		 *
9060 		 * A better way to handle this might be to convert the inbound
9061 		 * data structure here, and hang it off a new 'mp'; thus the
9062 		 * ip6_asp_replace() logic would always be dealing with native
9063 		 * format data structures..
9064 		 *
9065 		 * (An even simpler way to handle these ioctls is to just
9066 		 * add a 32-bit trailing 'pad' field to the ip6_asp_t structure
9067 		 * and just recompile everything that depends on it.)
9068 		 */
9069 #endif
9070 		ip6_asp_replace(mp, table, table_size, B_FALSE, ipst,
9071 		    iocp->ioc_flag & IOC_MODELS);
9072 		return;
9073 	}
9074 
9075 	DB_TYPE(mp) =  (iocp->ioc_error == 0) ? M_IOCACK : M_IOCNAK;
9076 	qreply(q, mp);
9077 }
9078 
9079 static void
9080 ip_sioctl_dstinfo(queue_t *q, mblk_t *mp)
9081 {
9082 	mblk_t 		*data_mp;
9083 	struct dstinforeq	*dir;
9084 	uint8_t		*end, *cur;
9085 	in6_addr_t	*daddr, *saddr;
9086 	ipaddr_t	v4daddr;
9087 	ire_t		*ire;
9088 	char		*slabel, *dlabel;
9089 	boolean_t	isipv4;
9090 	int		match_ire;
9091 	ill_t		*dst_ill;
9092 	ipif_t		*src_ipif, *ire_ipif;
9093 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
9094 	zoneid_t	zoneid;
9095 	ip_stack_t	*ipst = CONNQ_TO_IPST(q);
9096 
9097 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
9098 	zoneid = Q_TO_CONN(q)->conn_zoneid;
9099 
9100 	/*
9101 	 * This ioctl is I_STR only, and must have a
9102 	 * data mblk following the M_IOCTL mblk.
9103 	 */
9104 	data_mp = mp->b_cont;
9105 	if (iocp->ioc_count == TRANSPARENT || data_mp == NULL) {
9106 		miocnak(q, mp, 0, EINVAL);
9107 		return;
9108 	}
9109 
9110 	if (MBLKL(data_mp) < iocp->ioc_count) {
9111 		mblk_t *new_data_mp;
9112 
9113 		if ((new_data_mp = msgpullup(data_mp, -1)) == NULL) {
9114 			miocnak(q, mp, 0, ENOMEM);
9115 			return;
9116 		}
9117 		freemsg(data_mp);
9118 		data_mp = new_data_mp;
9119 		mp->b_cont = data_mp;
9120 	}
9121 	match_ire = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | MATCH_IRE_PARENT;
9122 
9123 	for (cur = data_mp->b_rptr, end = data_mp->b_wptr;
9124 	    end - cur >= sizeof (struct dstinforeq);
9125 	    cur += sizeof (struct dstinforeq)) {
9126 		dir = (struct dstinforeq *)cur;
9127 		daddr = &dir->dir_daddr;
9128 		saddr = &dir->dir_saddr;
9129 
9130 		/*
9131 		 * ip_addr_scope_v6() and ip6_asp_lookup() handle
9132 		 * v4 mapped addresses; ire_ftable_lookup[_v6]()
9133 		 * and ipif_select_source[_v6]() do not.
9134 		 */
9135 		dir->dir_dscope = ip_addr_scope_v6(daddr);
9136 		dlabel = ip6_asp_lookup(daddr, &dir->dir_precedence, ipst);
9137 
9138 		isipv4 = IN6_IS_ADDR_V4MAPPED(daddr);
9139 		if (isipv4) {
9140 			IN6_V4MAPPED_TO_IPADDR(daddr, v4daddr);
9141 			ire = ire_ftable_lookup(v4daddr, NULL, NULL,
9142 			    0, NULL, NULL, zoneid, 0, NULL, match_ire, ipst);
9143 		} else {
9144 			ire = ire_ftable_lookup_v6(daddr, NULL, NULL,
9145 			    0, NULL, NULL, zoneid, 0, NULL, match_ire, ipst);
9146 		}
9147 		if (ire == NULL) {
9148 			dir->dir_dreachable = 0;
9149 
9150 			/* move on to next dst addr */
9151 			continue;
9152 		}
9153 		dir->dir_dreachable = 1;
9154 
9155 		ire_ipif = ire->ire_ipif;
9156 		if (ire_ipif == NULL)
9157 			goto next_dst;
9158 
9159 		/*
9160 		 * We expect to get back an interface ire or a
9161 		 * gateway ire cache entry.  For both types, the
9162 		 * output interface is ire_ipif->ipif_ill.
9163 		 */
9164 		dst_ill = ire_ipif->ipif_ill;
9165 		dir->dir_dmactype = dst_ill->ill_mactype;
9166 
9167 		if (isipv4) {
9168 			src_ipif = ipif_select_source(dst_ill, v4daddr, zoneid);
9169 		} else {
9170 			src_ipif = ipif_select_source_v6(dst_ill,
9171 			    daddr, B_FALSE, IPV6_PREFER_SRC_DEFAULT, zoneid);
9172 		}
9173 		if (src_ipif == NULL)
9174 			goto next_dst;
9175 
9176 		*saddr = src_ipif->ipif_v6lcl_addr;
9177 		dir->dir_sscope = ip_addr_scope_v6(saddr);
9178 		slabel = ip6_asp_lookup(saddr, NULL, ipst);
9179 		dir->dir_labelmatch = ip6_asp_labelcmp(dlabel, slabel);
9180 		dir->dir_sdeprecated =
9181 		    (src_ipif->ipif_flags & IPIF_DEPRECATED) ? 1 : 0;
9182 		ipif_refrele(src_ipif);
9183 next_dst:
9184 		ire_refrele(ire);
9185 	}
9186 	miocack(q, mp, iocp->ioc_count, 0);
9187 }
9188 
9189 /*
9190  * Check if this is an address assigned to this machine.
9191  * Skips interfaces that are down by using ire checks.
9192  * Translates mapped addresses to v4 addresses and then
9193  * treats them as such, returning true if the v4 address
9194  * associated with this mapped address is configured.
9195  * Note: Applications will have to be careful what they do
9196  * with the response; use of mapped addresses limits
9197  * what can be done with the socket, especially with
9198  * respect to socket options and ioctls - neither IPv4
9199  * options nor IPv6 sticky options/ancillary data options
9200  * may be used.
9201  */
9202 /* ARGSUSED */
9203 int
9204 ip_sioctl_tmyaddr(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9205     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9206 {
9207 	struct sioc_addrreq *sia;
9208 	sin_t *sin;
9209 	ire_t *ire;
9210 	mblk_t *mp1;
9211 	zoneid_t zoneid;
9212 	ip_stack_t	*ipst;
9213 
9214 	ip1dbg(("ip_sioctl_tmyaddr"));
9215 
9216 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
9217 	zoneid = Q_TO_CONN(q)->conn_zoneid;
9218 	ipst = CONNQ_TO_IPST(q);
9219 
9220 	/* Existence verified in ip_wput_nondata */
9221 	mp1 = mp->b_cont->b_cont;
9222 	sia = (struct sioc_addrreq *)mp1->b_rptr;
9223 	sin = (sin_t *)&sia->sa_addr;
9224 	switch (sin->sin_family) {
9225 	case AF_INET6: {
9226 		sin6_t *sin6 = (sin6_t *)sin;
9227 
9228 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
9229 			ipaddr_t v4_addr;
9230 
9231 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
9232 			    v4_addr);
9233 			ire = ire_ctable_lookup(v4_addr, 0,
9234 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
9235 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, ipst);
9236 		} else {
9237 			in6_addr_t v6addr;
9238 
9239 			v6addr = sin6->sin6_addr;
9240 			ire = ire_ctable_lookup_v6(&v6addr, 0,
9241 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
9242 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, ipst);
9243 		}
9244 		break;
9245 	}
9246 	case AF_INET: {
9247 		ipaddr_t v4addr;
9248 
9249 		v4addr = sin->sin_addr.s_addr;
9250 		ire = ire_ctable_lookup(v4addr, 0,
9251 		    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
9252 		    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, ipst);
9253 		break;
9254 	}
9255 	default:
9256 		return (EAFNOSUPPORT);
9257 	}
9258 	if (ire != NULL) {
9259 		sia->sa_res = 1;
9260 		ire_refrele(ire);
9261 	} else {
9262 		sia->sa_res = 0;
9263 	}
9264 	return (0);
9265 }
9266 
9267 /*
9268  * Check if this is an address assigned on-link i.e. neighbor,
9269  * and makes sure it's reachable from the current zone.
9270  * Returns true for my addresses as well.
9271  * Translates mapped addresses to v4 addresses and then
9272  * treats them as such, returning true if the v4 address
9273  * associated with this mapped address is configured.
9274  * Note: Applications will have to be careful what they do
9275  * with the response; use of mapped addresses limits
9276  * what can be done with the socket, especially with
9277  * respect to socket options and ioctls - neither IPv4
9278  * options nor IPv6 sticky options/ancillary data options
9279  * may be used.
9280  */
9281 /* ARGSUSED */
9282 int
9283 ip_sioctl_tonlink(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9284     ip_ioctl_cmd_t *ipip, void *duymmy_ifreq)
9285 {
9286 	struct sioc_addrreq *sia;
9287 	sin_t *sin;
9288 	mblk_t	*mp1;
9289 	ire_t *ire = NULL;
9290 	zoneid_t zoneid;
9291 	ip_stack_t	*ipst;
9292 
9293 	ip1dbg(("ip_sioctl_tonlink"));
9294 
9295 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
9296 	zoneid = Q_TO_CONN(q)->conn_zoneid;
9297 	ipst = CONNQ_TO_IPST(q);
9298 
9299 	/* Existence verified in ip_wput_nondata */
9300 	mp1 = mp->b_cont->b_cont;
9301 	sia = (struct sioc_addrreq *)mp1->b_rptr;
9302 	sin = (sin_t *)&sia->sa_addr;
9303 
9304 	/*
9305 	 * Match addresses with a zero gateway field to avoid
9306 	 * routes going through a router.
9307 	 * Exclude broadcast and multicast addresses.
9308 	 */
9309 	switch (sin->sin_family) {
9310 	case AF_INET6: {
9311 		sin6_t *sin6 = (sin6_t *)sin;
9312 
9313 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
9314 			ipaddr_t v4_addr;
9315 
9316 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
9317 			    v4_addr);
9318 			if (!CLASSD(v4_addr)) {
9319 				ire = ire_route_lookup(v4_addr, 0, 0, 0,
9320 				    NULL, NULL, zoneid, NULL,
9321 				    MATCH_IRE_GW, ipst);
9322 			}
9323 		} else {
9324 			in6_addr_t v6addr;
9325 			in6_addr_t v6gw;
9326 
9327 			v6addr = sin6->sin6_addr;
9328 			v6gw = ipv6_all_zeros;
9329 			if (!IN6_IS_ADDR_MULTICAST(&v6addr)) {
9330 				ire = ire_route_lookup_v6(&v6addr, 0,
9331 				    &v6gw, 0, NULL, NULL, zoneid,
9332 				    NULL, MATCH_IRE_GW, ipst);
9333 			}
9334 		}
9335 		break;
9336 	}
9337 	case AF_INET: {
9338 		ipaddr_t v4addr;
9339 
9340 		v4addr = sin->sin_addr.s_addr;
9341 		if (!CLASSD(v4addr)) {
9342 			ire = ire_route_lookup(v4addr, 0, 0, 0,
9343 			    NULL, NULL, zoneid, NULL,
9344 			    MATCH_IRE_GW, ipst);
9345 		}
9346 		break;
9347 	}
9348 	default:
9349 		return (EAFNOSUPPORT);
9350 	}
9351 	sia->sa_res = 0;
9352 	if (ire != NULL) {
9353 		if (ire->ire_type & (IRE_INTERFACE|IRE_CACHE|
9354 		    IRE_LOCAL|IRE_LOOPBACK)) {
9355 			sia->sa_res = 1;
9356 		}
9357 		ire_refrele(ire);
9358 	}
9359 	return (0);
9360 }
9361 
9362 /*
9363  * TBD: implement when kernel maintaines a list of site prefixes.
9364  */
9365 /* ARGSUSED */
9366 int
9367 ip_sioctl_tmysite(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9368     ip_ioctl_cmd_t *ipip, void *ifreq)
9369 {
9370 	return (ENXIO);
9371 }
9372 
9373 /* ARGSUSED */
9374 int
9375 ip_sioctl_tunparam(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9376     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9377 {
9378 	ill_t		*ill;
9379 	mblk_t		*mp1;
9380 	conn_t		*connp;
9381 	boolean_t	success;
9382 
9383 	ip1dbg(("ip_sioctl_tunparam(%s:%u %p)\n",
9384 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9385 	/* ioctl comes down on an conn */
9386 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9387 	connp = Q_TO_CONN(q);
9388 
9389 	mp->b_datap->db_type = M_IOCTL;
9390 
9391 	/*
9392 	 * Send down a copy. (copymsg does not copy b_next/b_prev).
9393 	 * The original mp contains contaminated b_next values due to 'mi',
9394 	 * which is needed to do the mi_copy_done. Unfortunately if we
9395 	 * send down the original mblk itself and if we are popped due to an
9396 	 * an unplumb before the response comes back from tunnel,
9397 	 * the streamhead (which does a freemsg) will see this contaminated
9398 	 * message and the assertion in freemsg about non-null b_next/b_prev
9399 	 * will panic a DEBUG kernel.
9400 	 */
9401 	mp1 = copymsg(mp);
9402 	if (mp1 == NULL)
9403 		return (ENOMEM);
9404 
9405 	ill = ipif->ipif_ill;
9406 	mutex_enter(&connp->conn_lock);
9407 	mutex_enter(&ill->ill_lock);
9408 	if (ipip->ipi_cmd == SIOCSTUNPARAM || ipip->ipi_cmd == OSIOCSTUNPARAM) {
9409 		success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp),
9410 		    mp, 0);
9411 	} else {
9412 		success = ill_pending_mp_add(ill, connp, mp);
9413 	}
9414 	mutex_exit(&ill->ill_lock);
9415 	mutex_exit(&connp->conn_lock);
9416 
9417 	if (success) {
9418 		ip1dbg(("sending down tunparam request "));
9419 		putnext(ill->ill_wq, mp1);
9420 		return (EINPROGRESS);
9421 	} else {
9422 		/* The conn has started closing */
9423 		freemsg(mp1);
9424 		return (EINTR);
9425 	}
9426 }
9427 
9428 /*
9429  * ARP IOCTLs.
9430  * How does IP get in the business of fronting ARP configuration/queries?
9431  * Well it's like this, the Berkeley ARP IOCTLs (SIOCGARP, SIOCDARP, SIOCSARP)
9432  * are by tradition passed in through a datagram socket.  That lands in IP.
9433  * As it happens, this is just as well since the interface is quite crude in
9434  * that it passes in no information about protocol or hardware types, or
9435  * interface association.  After making the protocol assumption, IP is in
9436  * the position to look up the name of the ILL, which ARP will need, and
9437  * format a request that can be handled by ARP.  The request is passed up
9438  * stream to ARP, and the original IOCTL is completed by IP when ARP passes
9439  * back a response.  ARP supports its own set of more general IOCTLs, in
9440  * case anyone is interested.
9441  */
9442 /* ARGSUSED */
9443 int
9444 ip_sioctl_arp(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9445     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9446 {
9447 	mblk_t *mp1;
9448 	mblk_t *mp2;
9449 	mblk_t *pending_mp;
9450 	ipaddr_t ipaddr;
9451 	area_t *area;
9452 	struct iocblk *iocp;
9453 	conn_t *connp;
9454 	struct arpreq *ar;
9455 	struct xarpreq *xar;
9456 	int flags, alength;
9457 	uchar_t *lladdr;
9458 	ire_t *ire;
9459 	ip_stack_t *ipst;
9460 	ill_t *ill = ipif->ipif_ill;
9461 	ill_t *proxy_ill = NULL;
9462 	ipmp_arpent_t *entp = NULL;
9463 	boolean_t if_arp_ioctl = B_FALSE;
9464 	boolean_t proxyarp = B_FALSE;
9465 
9466 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9467 	connp = Q_TO_CONN(q);
9468 	ipst = connp->conn_netstack->netstack_ip;
9469 
9470 	if (ipip->ipi_cmd_type == XARP_CMD) {
9471 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->XARPREQ_MBLK */
9472 		xar = (struct xarpreq *)mp->b_cont->b_cont->b_rptr;
9473 		ar = NULL;
9474 
9475 		flags = xar->xarp_flags;
9476 		lladdr = (uchar_t *)LLADDR(&xar->xarp_ha);
9477 		if_arp_ioctl = (xar->xarp_ha.sdl_nlen != 0);
9478 		/*
9479 		 * Validate against user's link layer address length
9480 		 * input and name and addr length limits.
9481 		 */
9482 		alength = ill->ill_phys_addr_length;
9483 		if (ipip->ipi_cmd == SIOCSXARP) {
9484 			if (alength != xar->xarp_ha.sdl_alen ||
9485 			    (alength + xar->xarp_ha.sdl_nlen >
9486 			    sizeof (xar->xarp_ha.sdl_data)))
9487 				return (EINVAL);
9488 		}
9489 	} else {
9490 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->ARPREQ_MBLK */
9491 		ar = (struct arpreq *)mp->b_cont->b_cont->b_rptr;
9492 		xar = NULL;
9493 
9494 		flags = ar->arp_flags;
9495 		lladdr = (uchar_t *)ar->arp_ha.sa_data;
9496 		/*
9497 		 * Theoretically, the sa_family could tell us what link
9498 		 * layer type this operation is trying to deal with. By
9499 		 * common usage AF_UNSPEC means ethernet. We'll assume
9500 		 * any attempt to use the SIOC?ARP ioctls is for ethernet,
9501 		 * for now. Our new SIOC*XARP ioctls can be used more
9502 		 * generally.
9503 		 *
9504 		 * If the underlying media happens to have a non 6 byte
9505 		 * address, arp module will fail set/get, but the del
9506 		 * operation will succeed.
9507 		 */
9508 		alength = 6;
9509 		if ((ipip->ipi_cmd != SIOCDARP) &&
9510 		    (alength != ill->ill_phys_addr_length)) {
9511 			return (EINVAL);
9512 		}
9513 	}
9514 
9515 	ipaddr = sin->sin_addr.s_addr;
9516 
9517 	/*
9518 	 * IPMP ARP special handling:
9519 	 *
9520 	 * 1. Since ARP mappings must appear consistent across the group,
9521 	 *    prohibit changing ARP mappings on the underlying interfaces.
9522 	 *
9523 	 * 2. Since ARP mappings for IPMP data addresses are maintained by
9524 	 *    IP itself, prohibit changing them.
9525 	 *
9526 	 * 3. For proxy ARP, use a functioning hardware address in the group,
9527 	 *    provided one exists.  If one doesn't, just add the entry as-is;
9528 	 *    ipmp_illgrp_refresh_arpent() will refresh it if things change.
9529 	 */
9530 	if (IS_UNDER_IPMP(ill)) {
9531 		if (ipip->ipi_cmd != SIOCGARP && ipip->ipi_cmd != SIOCGXARP)
9532 			return (EPERM);
9533 	}
9534 	if (IS_IPMP(ill)) {
9535 		ipmp_illgrp_t *illg = ill->ill_grp;
9536 
9537 		switch (ipip->ipi_cmd) {
9538 		case SIOCSARP:
9539 		case SIOCSXARP:
9540 			proxy_ill = ipmp_illgrp_find_ill(illg, lladdr, alength);
9541 			if (proxy_ill != NULL) {
9542 				proxyarp = B_TRUE;
9543 				if (!ipmp_ill_is_active(proxy_ill))
9544 					proxy_ill = ipmp_illgrp_next_ill(illg);
9545 				if (proxy_ill != NULL)
9546 					lladdr = proxy_ill->ill_phys_addr;
9547 			}
9548 			/* FALLTHRU */
9549 		case SIOCDARP:
9550 		case SIOCDXARP:
9551 			ire = ire_ctable_lookup(ipaddr, 0, IRE_LOCAL, NULL,
9552 			    ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
9553 			if (ire != NULL) {
9554 				ire_refrele(ire);
9555 				return (EPERM);
9556 			}
9557 		}
9558 	}
9559 
9560 	/*
9561 	 * We are going to pass up to ARP a packet chain that looks
9562 	 * like:
9563 	 *
9564 	 * M_IOCTL-->ARP_op_MBLK-->ORIG_M_IOCTL-->MI_COPY_MBLK-->[X]ARPREQ_MBLK
9565 	 *
9566 	 * Get a copy of the original IOCTL mblk to head the chain,
9567 	 * to be sent up (in mp1). Also get another copy to store
9568 	 * in the ill_pending_mp list, for matching the response
9569 	 * when it comes back from ARP.
9570 	 */
9571 	mp1 = copyb(mp);
9572 	pending_mp = copymsg(mp);
9573 	if (mp1 == NULL || pending_mp == NULL) {
9574 		if (mp1 != NULL)
9575 			freeb(mp1);
9576 		if (pending_mp != NULL)
9577 			inet_freemsg(pending_mp);
9578 		return (ENOMEM);
9579 	}
9580 
9581 	mp2 = ill_arp_alloc(ill, (uchar_t *)&ip_area_template,
9582 	    (caddr_t)&ipaddr);
9583 	if (mp2 == NULL) {
9584 		freeb(mp1);
9585 		inet_freemsg(pending_mp);
9586 		return (ENOMEM);
9587 	}
9588 	/* Put together the chain. */
9589 	mp1->b_cont = mp2;
9590 	mp1->b_datap->db_type = M_IOCTL;
9591 	mp2->b_cont = mp;
9592 	mp2->b_datap->db_type = M_DATA;
9593 
9594 	iocp = (struct iocblk *)mp1->b_rptr;
9595 
9596 	/*
9597 	 * An M_IOCDATA's payload (struct copyresp) is mostly the same as an
9598 	 * M_IOCTL's payload (struct iocblk), but 'struct copyresp' has a
9599 	 * cp_private field (or cp_rval on 32-bit systems) in place of the
9600 	 * ioc_count field; set ioc_count to be correct.
9601 	 */
9602 	iocp->ioc_count = MBLKL(mp1->b_cont);
9603 
9604 	/*
9605 	 * Set the proper command in the ARP message.
9606 	 * Convert the SIOC{G|S|D}ARP calls into our
9607 	 * AR_ENTRY_xxx calls.
9608 	 */
9609 	area = (area_t *)mp2->b_rptr;
9610 	switch (iocp->ioc_cmd) {
9611 	case SIOCDARP:
9612 	case SIOCDXARP:
9613 		/*
9614 		 * We defer deleting the corresponding IRE until
9615 		 * we return from arp.
9616 		 */
9617 		area->area_cmd = AR_ENTRY_DELETE;
9618 		area->area_proto_mask_offset = 0;
9619 		break;
9620 	case SIOCGARP:
9621 	case SIOCGXARP:
9622 		area->area_cmd = AR_ENTRY_SQUERY;
9623 		area->area_proto_mask_offset = 0;
9624 		break;
9625 	case SIOCSARP:
9626 	case SIOCSXARP:
9627 		/*
9628 		 * Delete the corresponding ire to make sure IP will
9629 		 * pick up any change from arp.
9630 		 */
9631 		if (!if_arp_ioctl) {
9632 			(void) ip_ire_clookup_and_delete(ipaddr, NULL, ipst);
9633 		} else {
9634 			ipif_t *ipif = ipif_get_next_ipif(NULL, ill);
9635 			if (ipif != NULL) {
9636 				(void) ip_ire_clookup_and_delete(ipaddr, ipif,
9637 				    ipst);
9638 				ipif_refrele(ipif);
9639 			}
9640 		}
9641 		break;
9642 	}
9643 	iocp->ioc_cmd = area->area_cmd;
9644 
9645 	/*
9646 	 * Fill in the rest of the ARP operation fields.
9647 	 */
9648 	area->area_hw_addr_length = alength;
9649 	bcopy(lladdr, (char *)area + area->area_hw_addr_offset, alength);
9650 
9651 	/* Translate the flags. */
9652 	if (flags & ATF_PERM)
9653 		area->area_flags |= ACE_F_PERMANENT;
9654 	if (flags & ATF_PUBL)
9655 		area->area_flags |= ACE_F_PUBLISH;
9656 	if (flags & ATF_AUTHORITY)
9657 		area->area_flags |= ACE_F_AUTHORITY;
9658 
9659 	/*
9660 	 * If this is a permanent AR_ENTRY_ADD on the IPMP interface, track it
9661 	 * so that IP can update ARP as the active ills in the group change.
9662 	 */
9663 	if (IS_IPMP(ill) && area->area_cmd == AR_ENTRY_ADD &&
9664 	    (area->area_flags & ACE_F_PERMANENT)) {
9665 		entp = ipmp_illgrp_create_arpent(ill->ill_grp, mp2, proxyarp);
9666 
9667 		/*
9668 		 * The second part of the conditional below handles a corner
9669 		 * case: if this is proxy ARP and the IPMP group has no active
9670 		 * interfaces, we can't send the request to ARP now since it
9671 		 * won't be able to build an ACE.  So we return success and
9672 		 * notify ARP about the proxy ARP entry once an interface
9673 		 * becomes active.
9674 		 */
9675 		if (entp == NULL || (proxyarp && proxy_ill == NULL)) {
9676 			mp2->b_cont = NULL;
9677 			inet_freemsg(mp1);
9678 			inet_freemsg(pending_mp);
9679 			return (entp == NULL ? ENOMEM : 0);
9680 		}
9681 	}
9682 
9683 	/*
9684 	 * Before sending 'mp' to ARP, we have to clear the b_next
9685 	 * and b_prev. Otherwise if STREAMS encounters such a message
9686 	 * in freemsg(), (because ARP can close any time) it can cause
9687 	 * a panic. But mi code needs the b_next and b_prev values of
9688 	 * mp->b_cont, to complete the ioctl. So we store it here
9689 	 * in pending_mp->bcont, and restore it in ip_sioctl_iocack()
9690 	 * when the response comes down from ARP.
9691 	 */
9692 	pending_mp->b_cont->b_next = mp->b_cont->b_next;
9693 	pending_mp->b_cont->b_prev = mp->b_cont->b_prev;
9694 	mp->b_cont->b_next = NULL;
9695 	mp->b_cont->b_prev = NULL;
9696 
9697 	mutex_enter(&connp->conn_lock);
9698 	mutex_enter(&ill->ill_lock);
9699 	/* conn has not yet started closing, hence this can't fail */
9700 	if (ipip->ipi_flags & IPI_WR) {
9701 		VERIFY(ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp),
9702 		    pending_mp, 0) != 0);
9703 	} else {
9704 		VERIFY(ill_pending_mp_add(ill, connp, pending_mp) != 0);
9705 	}
9706 	mutex_exit(&ill->ill_lock);
9707 	mutex_exit(&connp->conn_lock);
9708 
9709 	/*
9710 	 * Up to ARP it goes.  The response will come back in ip_wput() as an
9711 	 * M_IOCACK, and will be handed to ip_sioctl_iocack() for completion.
9712 	 */
9713 	putnext(ill->ill_rq, mp1);
9714 
9715 	/*
9716 	 * If we created an IPMP ARP entry, mark that we've notified ARP.
9717 	 */
9718 	if (entp != NULL)
9719 		ipmp_illgrp_mark_arpent(ill->ill_grp, entp);
9720 
9721 	return (EINPROGRESS);
9722 }
9723 
9724 /*
9725  * Parse an [x]arpreq structure coming down SIOC[GSD][X]ARP ioctls, identify
9726  * the associated sin and refhold and return the associated ipif via `ci'.
9727  */
9728 int
9729 ip_extract_arpreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
9730     cmd_info_t *ci, ipsq_func_t func)
9731 {
9732 	mblk_t	*mp1;
9733 	int	err;
9734 	sin_t	*sin;
9735 	conn_t	*connp;
9736 	ipif_t	*ipif;
9737 	ire_t	*ire = NULL;
9738 	ill_t	*ill = NULL;
9739 	boolean_t exists;
9740 	ip_stack_t *ipst;
9741 	struct arpreq *ar;
9742 	struct xarpreq *xar;
9743 	struct sockaddr_dl *sdl;
9744 
9745 	/* ioctl comes down on a conn */
9746 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9747 	connp = Q_TO_CONN(q);
9748 	if (connp->conn_af_isv6)
9749 		return (ENXIO);
9750 
9751 	ipst = connp->conn_netstack->netstack_ip;
9752 
9753 	/* Verified in ip_wput_nondata */
9754 	mp1 = mp->b_cont->b_cont;
9755 
9756 	if (ipip->ipi_cmd_type == XARP_CMD) {
9757 		ASSERT(MBLKL(mp1) >= sizeof (struct xarpreq));
9758 		xar = (struct xarpreq *)mp1->b_rptr;
9759 		sin = (sin_t *)&xar->xarp_pa;
9760 		sdl = &xar->xarp_ha;
9761 
9762 		if (sdl->sdl_family != AF_LINK || sin->sin_family != AF_INET)
9763 			return (ENXIO);
9764 		if (sdl->sdl_nlen >= LIFNAMSIZ)
9765 			return (EINVAL);
9766 	} else {
9767 		ASSERT(ipip->ipi_cmd_type == ARP_CMD);
9768 		ASSERT(MBLKL(mp1) >= sizeof (struct arpreq));
9769 		ar = (struct arpreq *)mp1->b_rptr;
9770 		sin = (sin_t *)&ar->arp_pa;
9771 	}
9772 
9773 	if (ipip->ipi_cmd_type == XARP_CMD && sdl->sdl_nlen != 0) {
9774 		ipif = ipif_lookup_on_name(sdl->sdl_data, sdl->sdl_nlen,
9775 		    B_FALSE, &exists, B_FALSE, ALL_ZONES, CONNP_TO_WQ(connp),
9776 		    mp, func, &err, ipst);
9777 		if (ipif == NULL)
9778 			return (err);
9779 		if (ipif->ipif_id != 0) {
9780 			ipif_refrele(ipif);
9781 			return (ENXIO);
9782 		}
9783 	} else {
9784 		/*
9785 		 * Either an SIOC[DGS]ARP or an SIOC[DGS]XARP with an sdl_nlen
9786 		 * of 0: use the IP address to find the ipif.  If the IP
9787 		 * address is an IPMP test address, ire_ftable_lookup() will
9788 		 * find the wrong ill, so we first do an ipif_lookup_addr().
9789 		 */
9790 		ipif = ipif_lookup_addr(sin->sin_addr.s_addr, NULL, ALL_ZONES,
9791 		    CONNP_TO_WQ(connp), mp, func, &err, ipst);
9792 		if (ipif == NULL) {
9793 			ire = ire_ftable_lookup(sin->sin_addr.s_addr, 0, 0,
9794 			    IRE_IF_RESOLVER, NULL, NULL, ALL_ZONES, 0, NULL,
9795 			    MATCH_IRE_TYPE, ipst);
9796 			if (ire == NULL || ((ill = ire_to_ill(ire)) == NULL)) {
9797 				if (ire != NULL)
9798 					ire_refrele(ire);
9799 				return (ENXIO);
9800 			}
9801 			ipif = ill->ill_ipif;
9802 			ipif_refhold(ipif);
9803 			ire_refrele(ire);
9804 		}
9805 	}
9806 
9807 	if (ipif->ipif_net_type != IRE_IF_RESOLVER) {
9808 		ipif_refrele(ipif);
9809 		return (ENXIO);
9810 	}
9811 
9812 	ci->ci_sin = sin;
9813 	ci->ci_ipif = ipif;
9814 	return (0);
9815 }
9816 
9817 /*
9818  * Link or unlink the illgrp on IPMP meta-interface `ill' depending on the
9819  * value of `ioccmd'.  While an illgrp is linked to an ipmp_grp_t, it is
9820  * accessible from that ipmp_grp_t, which means SIOCSLIFGROUPNAME can look it
9821  * up and thus an ill can join that illgrp.
9822  *
9823  * We use I_PLINK/I_PUNLINK to do the link/unlink operations rather than
9824  * open()/close() primarily because close() is not allowed to fail or block
9825  * forever.  On the other hand, I_PUNLINK *can* fail, and there's no reason
9826  * why anyone should ever need to I_PUNLINK an in-use IPMP stream.  To ensure
9827  * symmetric behavior (e.g., doing an I_PLINK after and I_PUNLINK undoes the
9828  * I_PUNLINK) we defer linking to I_PLINK.  Separately, we also fail attempts
9829  * to I_LINK since I_UNLINK is optional and we'd end up in an inconsistent
9830  * state if I_UNLINK didn't occur.
9831  *
9832  * Note that for each plumb/unplumb operation, we may end up here more than
9833  * once because of the way ifconfig works.  However, it's OK to link the same
9834  * illgrp more than once, or unlink an illgrp that's already unlinked.
9835  */
9836 static int
9837 ip_sioctl_plink_ipmp(ill_t *ill, int ioccmd)
9838 {
9839 	int err;
9840 	ip_stack_t *ipst = ill->ill_ipst;
9841 
9842 	ASSERT(IS_IPMP(ill));
9843 	ASSERT(IAM_WRITER_ILL(ill));
9844 
9845 	switch (ioccmd) {
9846 	case I_LINK:
9847 		return (ENOTSUP);
9848 
9849 	case I_PLINK:
9850 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
9851 		ipmp_illgrp_link_grp(ill->ill_grp, ill->ill_phyint->phyint_grp);
9852 		rw_exit(&ipst->ips_ipmp_lock);
9853 		break;
9854 
9855 	case I_PUNLINK:
9856 		/*
9857 		 * Require all UP ipifs be brought down prior to unlinking the
9858 		 * illgrp so any associated IREs (and other state) is torched.
9859 		 */
9860 		if (ill->ill_ipif_up_count + ill->ill_ipif_dup_count > 0)
9861 			return (EBUSY);
9862 
9863 		/*
9864 		 * NOTE: We hold ipmp_lock across the unlink to prevent a race
9865 		 * with an SIOCSLIFGROUPNAME request from an ill trying to
9866 		 * join this group.  Specifically: ills trying to join grab
9867 		 * ipmp_lock and bump a "pending join" counter checked by
9868 		 * ipmp_illgrp_unlink_grp().  During the unlink no new pending
9869 		 * joins can occur (since we have ipmp_lock).  Once we drop
9870 		 * ipmp_lock, subsequent SIOCSLIFGROUPNAME requests will not
9871 		 * find the illgrp (since we unlinked it) and will return
9872 		 * EAFNOSUPPORT.  This will then take them back through the
9873 		 * IPMP meta-interface plumbing logic in ifconfig, and thus
9874 		 * back through I_PLINK above.
9875 		 */
9876 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
9877 		err = ipmp_illgrp_unlink_grp(ill->ill_grp);
9878 		rw_exit(&ipst->ips_ipmp_lock);
9879 		return (err);
9880 	default:
9881 		break;
9882 	}
9883 	return (0);
9884 }
9885 
9886 /*
9887  * Do I_PLINK/I_LINK or I_PUNLINK/I_UNLINK with consistency checks and also
9888  * atomically set/clear the muxids. Also complete the ioctl by acking or
9889  * naking it.  Note that the code is structured such that the link type,
9890  * whether it's persistent or not, is treated equally.  ifconfig(1M) and
9891  * its clones use the persistent link, while pppd(1M) and perhaps many
9892  * other daemons may use non-persistent link.  When combined with some
9893  * ill_t states, linking and unlinking lower streams may be used as
9894  * indicators of dynamic re-plumbing events [see PSARC/1999/348].
9895  */
9896 /* ARGSUSED */
9897 void
9898 ip_sioctl_plink(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
9899 {
9900 	mblk_t		*mp1, *mp2;
9901 	struct linkblk	*li;
9902 	struct ipmx_s	*ipmxp;
9903 	ill_t		*ill;
9904 	int		ioccmd = ((struct iocblk *)mp->b_rptr)->ioc_cmd;
9905 	int		err = 0;
9906 	boolean_t	entered_ipsq = B_FALSE;
9907 	boolean_t	islink;
9908 	ip_stack_t	*ipst;
9909 
9910 	if (CONN_Q(q))
9911 		ipst = CONNQ_TO_IPST(q);
9912 	else
9913 		ipst = ILLQ_TO_IPST(q);
9914 
9915 	ASSERT(ioccmd == I_PLINK || ioccmd == I_PUNLINK ||
9916 	    ioccmd == I_LINK || ioccmd == I_UNLINK);
9917 
9918 	islink = (ioccmd == I_PLINK || ioccmd == I_LINK);
9919 
9920 	mp1 = mp->b_cont;	/* This is the linkblk info */
9921 	li = (struct linkblk *)mp1->b_rptr;
9922 
9923 	/*
9924 	 * ARP has added this special mblk, and the utility is asking us
9925 	 * to perform consistency checks, and also atomically set the
9926 	 * muxid. Ifconfig is an example.  It achieves this by using
9927 	 * /dev/arp as the mux to plink the arp stream, and pushes arp on
9928 	 * to /dev/udp[6] stream for use as the mux when plinking the IP
9929 	 * stream. SIOCSLIFMUXID is not required.  See ifconfig.c, arp.c
9930 	 * and other comments in this routine for more details.
9931 	 */
9932 	mp2 = mp1->b_cont;	/* This is added by ARP */
9933 
9934 	/*
9935 	 * If I_{P}LINK/I_{P}UNLINK is issued by a utility other than
9936 	 * ifconfig which didn't push ARP on top of the dummy mux, we won't
9937 	 * get the special mblk above.  For backward compatibility, we
9938 	 * request ip_sioctl_plink_ipmod() to skip the consistency checks.
9939 	 * The utility will use SIOCSLIFMUXID to store the muxids.  This is
9940 	 * not atomic, and can leave the streams unplumbable if the utility
9941 	 * is interrupted before it does the SIOCSLIFMUXID.
9942 	 */
9943 	if (mp2 == NULL) {
9944 		err = ip_sioctl_plink_ipmod(ipsq, q, mp, ioccmd, li, B_FALSE);
9945 		if (err == EINPROGRESS)
9946 			return;
9947 		goto done;
9948 	}
9949 
9950 	/*
9951 	 * This is an I_{P}LINK sent down by ifconfig through the ARP module;
9952 	 * ARP has appended this last mblk to tell us whether the lower stream
9953 	 * is an arp-dev stream or an IP module stream.
9954 	 */
9955 	ipmxp = (struct ipmx_s *)mp2->b_rptr;
9956 	if (ipmxp->ipmx_arpdev_stream) {
9957 		/*
9958 		 * The lower stream is the arp-dev stream.
9959 		 */
9960 		ill = ill_lookup_on_name(ipmxp->ipmx_name, B_FALSE, B_FALSE,
9961 		    q, mp, ip_sioctl_plink, &err, NULL, ipst);
9962 		if (ill == NULL) {
9963 			if (err == EINPROGRESS)
9964 				return;
9965 			err = EINVAL;
9966 			goto done;
9967 		}
9968 
9969 		if (ipsq == NULL) {
9970 			ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_sioctl_plink,
9971 			    NEW_OP, B_FALSE);
9972 			if (ipsq == NULL) {
9973 				ill_refrele(ill);
9974 				return;
9975 			}
9976 			entered_ipsq = B_TRUE;
9977 		}
9978 		ASSERT(IAM_WRITER_ILL(ill));
9979 		ill_refrele(ill);
9980 
9981 		/*
9982 		 * To ensure consistency between IP and ARP, the following
9983 		 * LIFO scheme is used in plink/punlink. (IP first, ARP last).
9984 		 * This is because the muxid's are stored in the IP stream on
9985 		 * the ill.
9986 		 *
9987 		 * I_{P}LINK: ifconfig plinks the IP stream before plinking
9988 		 * the ARP stream. On an arp-dev stream, IP checks that it is
9989 		 * not yet plinked, and it also checks that the corresponding
9990 		 * IP stream is already plinked.
9991 		 *
9992 		 * I_{P}UNLINK: ifconfig punlinks the ARP stream before
9993 		 * punlinking the IP stream. IP does not allow punlink of the
9994 		 * IP stream unless the arp stream has been punlinked.
9995 		 */
9996 		if ((islink &&
9997 		    (ill->ill_arp_muxid != 0 || ill->ill_ip_muxid == 0)) ||
9998 		    (!islink && ill->ill_arp_muxid != li->l_index)) {
9999 			err = EINVAL;
10000 			goto done;
10001 		}
10002 
10003 		if (IS_IPMP(ill) &&
10004 		    (err = ip_sioctl_plink_ipmp(ill, ioccmd)) != 0)
10005 			goto done;
10006 
10007 		ill->ill_arp_muxid = islink ? li->l_index : 0;
10008 	} else {
10009 		/*
10010 		 * The lower stream is probably an IP module stream.  Do
10011 		 * consistency checking.
10012 		 */
10013 		err = ip_sioctl_plink_ipmod(ipsq, q, mp, ioccmd, li, B_TRUE);
10014 		if (err == EINPROGRESS)
10015 			return;
10016 	}
10017 done:
10018 	if (err == 0)
10019 		miocack(q, mp, 0, 0);
10020 	else
10021 		miocnak(q, mp, 0, err);
10022 
10023 	/* Conn was refheld in ip_sioctl_copyin_setup */
10024 	if (CONN_Q(q))
10025 		CONN_OPER_PENDING_DONE(Q_TO_CONN(q));
10026 	if (entered_ipsq)
10027 		ipsq_exit(ipsq);
10028 }
10029 
10030 /*
10031  * Process I_{P}LINK and I_{P}UNLINK requests named by `ioccmd' and pointed to
10032  * by `mp' and `li' for the IP module stream (if li->q_bot is in fact an IP
10033  * module stream).  If `doconsist' is set, then do the extended consistency
10034  * checks requested by ifconfig(1M) and (atomically) set ill_ip_muxid here.
10035  * Returns zero on success, EINPROGRESS if the operation is still pending, or
10036  * an error code on failure.
10037  */
10038 static int
10039 ip_sioctl_plink_ipmod(ipsq_t *ipsq, queue_t *q, mblk_t *mp, int ioccmd,
10040     struct linkblk *li, boolean_t doconsist)
10041 {
10042 	int		err = 0;
10043 	ill_t  		*ill;
10044 	queue_t		*ipwq, *dwq;
10045 	const char	*name;
10046 	struct qinit	*qinfo;
10047 	boolean_t	islink = (ioccmd == I_PLINK || ioccmd == I_LINK);
10048 	boolean_t	entered_ipsq = B_FALSE;
10049 
10050 	/*
10051 	 * Walk the lower stream to verify it's the IP module stream.
10052 	 * The IP module is identified by its name, wput function,
10053 	 * and non-NULL q_next.  STREAMS ensures that the lower stream
10054 	 * (li->l_qbot) will not vanish until this ioctl completes.
10055 	 */
10056 	for (ipwq = li->l_qbot; ipwq != NULL; ipwq = ipwq->q_next) {
10057 		qinfo = ipwq->q_qinfo;
10058 		name = qinfo->qi_minfo->mi_idname;
10059 		if (name != NULL && strcmp(name, ip_mod_info.mi_idname) == 0 &&
10060 		    qinfo->qi_putp != (pfi_t)ip_lwput && ipwq->q_next != NULL) {
10061 			break;
10062 		}
10063 	}
10064 
10065 	/*
10066 	 * If this isn't an IP module stream, bail.
10067 	 */
10068 	if (ipwq == NULL)
10069 		return (0);
10070 
10071 	ill = ipwq->q_ptr;
10072 	ASSERT(ill != NULL);
10073 
10074 	if (ipsq == NULL) {
10075 		ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_sioctl_plink,
10076 		    NEW_OP, B_FALSE);
10077 		if (ipsq == NULL)
10078 			return (EINPROGRESS);
10079 		entered_ipsq = B_TRUE;
10080 	}
10081 	ASSERT(IAM_WRITER_ILL(ill));
10082 
10083 	if (doconsist) {
10084 		/*
10085 		 * Consistency checking requires that I_{P}LINK occurs
10086 		 * prior to setting ill_ip_muxid, and that I_{P}UNLINK
10087 		 * occurs prior to clearing ill_arp_muxid.
10088 		 */
10089 		if ((islink && ill->ill_ip_muxid != 0) ||
10090 		    (!islink && ill->ill_arp_muxid != 0)) {
10091 			err = EINVAL;
10092 			goto done;
10093 		}
10094 	}
10095 
10096 	if (IS_IPMP(ill) && (err = ip_sioctl_plink_ipmp(ill, ioccmd)) != 0)
10097 		goto done;
10098 
10099 	/*
10100 	 * As part of I_{P}LINKing, stash the number of downstream modules and
10101 	 * the read queue of the module immediately below IP in the ill.
10102 	 * These are used during the capability negotiation below.
10103 	 */
10104 	ill->ill_lmod_rq = NULL;
10105 	ill->ill_lmod_cnt = 0;
10106 	if (islink && ((dwq = ipwq->q_next) != NULL)) {
10107 		ill->ill_lmod_rq = RD(dwq);
10108 		for (; dwq != NULL; dwq = dwq->q_next)
10109 			ill->ill_lmod_cnt++;
10110 	}
10111 
10112 	if (doconsist)
10113 		ill->ill_ip_muxid = islink ? li->l_index : 0;
10114 
10115 	/*
10116 	 * Mark the ipsq busy until the capability operations initiated below
10117 	 * complete. The PLINK/UNLINK ioctl itself completes when our caller
10118 	 * returns, but the capability operation may complete asynchronously
10119 	 * much later.
10120 	 */
10121 	ipsq_current_start(ipsq, ill->ill_ipif, ioccmd);
10122 	/*
10123 	 * If there's at least one up ipif on this ill, then we're bound to
10124 	 * the underlying driver via DLPI.  In that case, renegotiate
10125 	 * capabilities to account for any possible change in modules
10126 	 * interposed between IP and the driver.
10127 	 */
10128 	if (ill->ill_ipif_up_count > 0) {
10129 		if (islink)
10130 			ill_capability_probe(ill);
10131 		else
10132 			ill_capability_reset(ill, B_FALSE);
10133 	}
10134 	ipsq_current_finish(ipsq);
10135 done:
10136 	if (entered_ipsq)
10137 		ipsq_exit(ipsq);
10138 
10139 	return (err);
10140 }
10141 
10142 /*
10143  * Search the ioctl command in the ioctl tables and return a pointer
10144  * to the ioctl command information. The ioctl command tables are
10145  * static and fully populated at compile time.
10146  */
10147 ip_ioctl_cmd_t *
10148 ip_sioctl_lookup(int ioc_cmd)
10149 {
10150 	int index;
10151 	ip_ioctl_cmd_t *ipip;
10152 	ip_ioctl_cmd_t *ipip_end;
10153 
10154 	if (ioc_cmd == IPI_DONTCARE)
10155 		return (NULL);
10156 
10157 	/*
10158 	 * Do a 2 step search. First search the indexed table
10159 	 * based on the least significant byte of the ioctl cmd.
10160 	 * If we don't find a match, then search the misc table
10161 	 * serially.
10162 	 */
10163 	index = ioc_cmd & 0xFF;
10164 	if (index < ip_ndx_ioctl_count) {
10165 		ipip = &ip_ndx_ioctl_table[index];
10166 		if (ipip->ipi_cmd == ioc_cmd) {
10167 			/* Found a match in the ndx table */
10168 			return (ipip);
10169 		}
10170 	}
10171 
10172 	/* Search the misc table */
10173 	ipip_end = &ip_misc_ioctl_table[ip_misc_ioctl_count];
10174 	for (ipip = ip_misc_ioctl_table; ipip < ipip_end; ipip++) {
10175 		if (ipip->ipi_cmd == ioc_cmd)
10176 			/* Found a match in the misc table */
10177 			return (ipip);
10178 	}
10179 
10180 	return (NULL);
10181 }
10182 
10183 /*
10184  * Wrapper function for resuming deferred ioctl processing
10185  * Used for SIOCGDSTINFO, SIOCGIP6ADDRPOLICY, SIOCGMSFILTER,
10186  * SIOCSMSFILTER, SIOCGIPMSFILTER, and SIOCSIPMSFILTER currently.
10187  */
10188 /* ARGSUSED */
10189 void
10190 ip_sioctl_copyin_resume(ipsq_t *dummy_ipsq, queue_t *q, mblk_t *mp,
10191     void *dummy_arg)
10192 {
10193 	ip_sioctl_copyin_setup(q, mp);
10194 }
10195 
10196 /*
10197  * ip_sioctl_copyin_setup is called by ip_wput with any M_IOCTL message
10198  * that arrives.  Most of the IOCTLs are "socket" IOCTLs which we handle
10199  * in either I_STR or TRANSPARENT form, using the mi_copy facility.
10200  * We establish here the size of the block to be copied in.  mi_copyin
10201  * arranges for this to happen, an processing continues in ip_wput with
10202  * an M_IOCDATA message.
10203  */
10204 void
10205 ip_sioctl_copyin_setup(queue_t *q, mblk_t *mp)
10206 {
10207 	int	copyin_size;
10208 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
10209 	ip_ioctl_cmd_t *ipip;
10210 	cred_t *cr;
10211 	ip_stack_t	*ipst;
10212 
10213 	if (CONN_Q(q))
10214 		ipst = CONNQ_TO_IPST(q);
10215 	else
10216 		ipst = ILLQ_TO_IPST(q);
10217 
10218 	ipip = ip_sioctl_lookup(iocp->ioc_cmd);
10219 	if (ipip == NULL) {
10220 		/*
10221 		 * The ioctl is not one we understand or own.
10222 		 * Pass it along to be processed down stream,
10223 		 * if this is a module instance of IP, else nak
10224 		 * the ioctl.
10225 		 */
10226 		if (q->q_next == NULL) {
10227 			goto nak;
10228 		} else {
10229 			putnext(q, mp);
10230 			return;
10231 		}
10232 	}
10233 
10234 	/*
10235 	 * If this is deferred, then we will do all the checks when we
10236 	 * come back.
10237 	 */
10238 	if ((iocp->ioc_cmd == SIOCGDSTINFO ||
10239 	    iocp->ioc_cmd == SIOCGIP6ADDRPOLICY) && !ip6_asp_can_lookup(ipst)) {
10240 		ip6_asp_pending_op(q, mp, ip_sioctl_copyin_resume);
10241 		return;
10242 	}
10243 
10244 	/*
10245 	 * Only allow a very small subset of IP ioctls on this stream if
10246 	 * IP is a module and not a driver. Allowing ioctls to be processed
10247 	 * in this case may cause assert failures or data corruption.
10248 	 * Typically G[L]IFFLAGS, SLIFNAME/IF_UNITSEL are the only few
10249 	 * ioctls allowed on an IP module stream, after which this stream
10250 	 * normally becomes a multiplexor (at which time the stream head
10251 	 * will fail all ioctls).
10252 	 */
10253 	if ((q->q_next != NULL) && !(ipip->ipi_flags & IPI_MODOK)) {
10254 		if (ipip->ipi_flags & IPI_PASS_DOWN) {
10255 			/*
10256 			 * Pass common Streams ioctls which the IP
10257 			 * module does not own or consume along to
10258 			 * be processed down stream.
10259 			 */
10260 			putnext(q, mp);
10261 			return;
10262 		} else {
10263 			goto nak;
10264 		}
10265 	}
10266 
10267 	/* Make sure we have ioctl data to process. */
10268 	if (mp->b_cont == NULL && !(ipip->ipi_flags & IPI_NULL_BCONT))
10269 		goto nak;
10270 
10271 	/*
10272 	 * Prefer dblk credential over ioctl credential; some synthesized
10273 	 * ioctls have kcred set because there's no way to crhold()
10274 	 * a credential in some contexts.  (ioc_cr is not crfree() by
10275 	 * the framework; the caller of ioctl needs to hold the reference
10276 	 * for the duration of the call).
10277 	 */
10278 	cr = msg_getcred(mp, NULL);
10279 	if (cr == NULL)
10280 		cr = iocp->ioc_cr;
10281 
10282 	/* Make sure normal users don't send down privileged ioctls */
10283 	if ((ipip->ipi_flags & IPI_PRIV) &&
10284 	    (cr != NULL) && secpolicy_ip_config(cr, B_TRUE) != 0) {
10285 		/* We checked the privilege earlier but log it here */
10286 		miocnak(q, mp, 0, secpolicy_ip_config(cr, B_FALSE));
10287 		return;
10288 	}
10289 
10290 	/*
10291 	 * The ioctl command tables can only encode fixed length
10292 	 * ioctl data. If the length is variable, the table will
10293 	 * encode the length as zero. Such special cases are handled
10294 	 * below in the switch.
10295 	 */
10296 	if (ipip->ipi_copyin_size != 0) {
10297 		mi_copyin(q, mp, NULL, ipip->ipi_copyin_size);
10298 		return;
10299 	}
10300 
10301 	switch (iocp->ioc_cmd) {
10302 	case O_SIOCGIFCONF:
10303 	case SIOCGIFCONF:
10304 		/*
10305 		 * This IOCTL is hilarious.  See comments in
10306 		 * ip_sioctl_get_ifconf for the story.
10307 		 */
10308 		if (iocp->ioc_count == TRANSPARENT)
10309 			copyin_size = SIZEOF_STRUCT(ifconf,
10310 			    iocp->ioc_flag);
10311 		else
10312 			copyin_size = iocp->ioc_count;
10313 		mi_copyin(q, mp, NULL, copyin_size);
10314 		return;
10315 
10316 	case O_SIOCGLIFCONF:
10317 	case SIOCGLIFCONF:
10318 		copyin_size = SIZEOF_STRUCT(lifconf, iocp->ioc_flag);
10319 		mi_copyin(q, mp, NULL, copyin_size);
10320 		return;
10321 
10322 	case SIOCGLIFSRCOF:
10323 		copyin_size = SIZEOF_STRUCT(lifsrcof, iocp->ioc_flag);
10324 		mi_copyin(q, mp, NULL, copyin_size);
10325 		return;
10326 	case SIOCGIP6ADDRPOLICY:
10327 		ip_sioctl_ip6addrpolicy(q, mp);
10328 		ip6_asp_table_refrele(ipst);
10329 		return;
10330 
10331 	case SIOCSIP6ADDRPOLICY:
10332 		ip_sioctl_ip6addrpolicy(q, mp);
10333 		return;
10334 
10335 	case SIOCGDSTINFO:
10336 		ip_sioctl_dstinfo(q, mp);
10337 		ip6_asp_table_refrele(ipst);
10338 		return;
10339 
10340 	case I_PLINK:
10341 	case I_PUNLINK:
10342 	case I_LINK:
10343 	case I_UNLINK:
10344 		/*
10345 		 * We treat non-persistent link similarly as the persistent
10346 		 * link case, in terms of plumbing/unplumbing, as well as
10347 		 * dynamic re-plumbing events indicator.  See comments
10348 		 * in ip_sioctl_plink() for more.
10349 		 *
10350 		 * Request can be enqueued in the 'ipsq' while waiting
10351 		 * to become exclusive. So bump up the conn ref.
10352 		 */
10353 		if (CONN_Q(q))
10354 			CONN_INC_REF(Q_TO_CONN(q));
10355 		ip_sioctl_plink(NULL, q, mp, NULL);
10356 		return;
10357 
10358 	case ND_GET:
10359 	case ND_SET:
10360 		/*
10361 		 * Use of the nd table requires holding the reader lock.
10362 		 * Modifying the nd table thru nd_load/nd_unload requires
10363 		 * the writer lock.
10364 		 */
10365 		rw_enter(&ipst->ips_ip_g_nd_lock, RW_READER);
10366 		if (nd_getset(q, ipst->ips_ip_g_nd, mp)) {
10367 			rw_exit(&ipst->ips_ip_g_nd_lock);
10368 
10369 			if (iocp->ioc_error)
10370 				iocp->ioc_count = 0;
10371 			mp->b_datap->db_type = M_IOCACK;
10372 			qreply(q, mp);
10373 			return;
10374 		}
10375 		rw_exit(&ipst->ips_ip_g_nd_lock);
10376 		/*
10377 		 * We don't understand this subioctl of ND_GET / ND_SET.
10378 		 * Maybe intended for some driver / module below us
10379 		 */
10380 		if (q->q_next) {
10381 			putnext(q, mp);
10382 		} else {
10383 			iocp->ioc_error = ENOENT;
10384 			mp->b_datap->db_type = M_IOCNAK;
10385 			iocp->ioc_count = 0;
10386 			qreply(q, mp);
10387 		}
10388 		return;
10389 
10390 	case IP_IOCTL:
10391 		ip_wput_ioctl(q, mp);
10392 		return;
10393 	default:
10394 		cmn_err(CE_PANIC, "should not happen ");
10395 	}
10396 nak:
10397 	if (mp->b_cont != NULL) {
10398 		freemsg(mp->b_cont);
10399 		mp->b_cont = NULL;
10400 	}
10401 	iocp->ioc_error = EINVAL;
10402 	mp->b_datap->db_type = M_IOCNAK;
10403 	iocp->ioc_count = 0;
10404 	qreply(q, mp);
10405 }
10406 
10407 /* ip_wput hands off ARP IOCTL responses to us */
10408 /* ARGSUSED3 */
10409 void
10410 ip_sioctl_iocack(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
10411 {
10412 	struct arpreq *ar;
10413 	struct xarpreq *xar;
10414 	area_t	*area;
10415 	mblk_t	*area_mp;
10416 	struct iocblk *iocp;
10417 	mblk_t	*orig_ioc_mp, *tmp;
10418 	struct iocblk	*orig_iocp;
10419 	ill_t *ill;
10420 	conn_t *connp = NULL;
10421 	mblk_t *pending_mp;
10422 	int x_arp_ioctl = B_FALSE, ifx_arp_ioctl = B_FALSE;
10423 	int *flagsp;
10424 	char *storage = NULL;
10425 	sin_t *sin;
10426 	ipaddr_t addr;
10427 	int err;
10428 	ip_stack_t *ipst;
10429 
10430 	ASSERT(ipsq == NULL || IAM_WRITER_IPSQ(ipsq));
10431 	ill = q->q_ptr;
10432 	ASSERT(ill != NULL);
10433 	ipst = ill->ill_ipst;
10434 
10435 	/*
10436 	 * We should get back from ARP a packet chain that looks like:
10437 	 * M_IOCACK-->ARP_op_MBLK-->ORIG_M_IOCTL-->MI_COPY_MBLK-->[X]ARPREQ_MBLK
10438 	 */
10439 	if (!(area_mp = mp->b_cont) ||
10440 	    (area_mp->b_wptr - area_mp->b_rptr) < sizeof (ip_sock_ar_t) ||
10441 	    !(orig_ioc_mp = area_mp->b_cont) ||
10442 	    !orig_ioc_mp->b_cont || !orig_ioc_mp->b_cont->b_cont) {
10443 		freemsg(mp);
10444 		return;
10445 	}
10446 
10447 	orig_iocp = (struct iocblk *)orig_ioc_mp->b_rptr;
10448 
10449 	tmp = (orig_ioc_mp->b_cont)->b_cont;
10450 	if ((orig_iocp->ioc_cmd == SIOCGXARP) ||
10451 	    (orig_iocp->ioc_cmd == SIOCSXARP) ||
10452 	    (orig_iocp->ioc_cmd == SIOCDXARP)) {
10453 		x_arp_ioctl = B_TRUE;
10454 		xar = (struct xarpreq *)tmp->b_rptr;
10455 		sin = (sin_t *)&xar->xarp_pa;
10456 		flagsp = &xar->xarp_flags;
10457 		storage = xar->xarp_ha.sdl_data;
10458 		if (xar->xarp_ha.sdl_nlen != 0)
10459 			ifx_arp_ioctl = B_TRUE;
10460 	} else {
10461 		ar = (struct arpreq *)tmp->b_rptr;
10462 		sin = (sin_t *)&ar->arp_pa;
10463 		flagsp = &ar->arp_flags;
10464 		storage = ar->arp_ha.sa_data;
10465 	}
10466 
10467 	iocp = (struct iocblk *)mp->b_rptr;
10468 
10469 	/*
10470 	 * Find the pending message; if we're exclusive, it'll be on our IPSQ.
10471 	 * Otherwise, we can find it from our ioc_id.
10472 	 */
10473 	if (ipsq != NULL)
10474 		pending_mp = ipsq_pending_mp_get(ipsq, &connp);
10475 	else
10476 		pending_mp = ill_pending_mp_get(ill, &connp, iocp->ioc_id);
10477 
10478 	if (pending_mp == NULL) {
10479 		ASSERT(connp == NULL);
10480 		inet_freemsg(mp);
10481 		return;
10482 	}
10483 	ASSERT(connp != NULL);
10484 	q = CONNP_TO_WQ(connp);
10485 
10486 	/* Uncouple the internally generated IOCTL from the original one */
10487 	area = (area_t *)area_mp->b_rptr;
10488 	area_mp->b_cont = NULL;
10489 
10490 	/*
10491 	 * Restore the b_next and b_prev used by mi code. This is needed
10492 	 * to complete the ioctl using mi* functions. We stored them in
10493 	 * the pending mp prior to sending the request to ARP.
10494 	 */
10495 	orig_ioc_mp->b_cont->b_next = pending_mp->b_cont->b_next;
10496 	orig_ioc_mp->b_cont->b_prev = pending_mp->b_cont->b_prev;
10497 	inet_freemsg(pending_mp);
10498 
10499 	/*
10500 	 * We're done if there was an error or if this is not an SIOCG{X}ARP
10501 	 * Catch the case where there is an IRE_CACHE by no entry in the
10502 	 * arp table.
10503 	 */
10504 	addr = sin->sin_addr.s_addr;
10505 	if (iocp->ioc_error && iocp->ioc_cmd == AR_ENTRY_SQUERY) {
10506 		ire_t			*ire;
10507 		dl_unitdata_req_t	*dlup;
10508 		mblk_t			*llmp;
10509 		int			addr_len;
10510 		ill_t			*ipsqill = NULL;
10511 
10512 		if (ifx_arp_ioctl) {
10513 			/*
10514 			 * There's no need to lookup the ill, since
10515 			 * we've already done that when we started
10516 			 * processing the ioctl and sent the message
10517 			 * to ARP on that ill.  So use the ill that
10518 			 * is stored in q->q_ptr.
10519 			 */
10520 			ipsqill = ill;
10521 			ire = ire_ctable_lookup(addr, 0, IRE_CACHE,
10522 			    ipsqill->ill_ipif, ALL_ZONES,
10523 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ILL, ipst);
10524 		} else {
10525 			ire = ire_ctable_lookup(addr, 0, IRE_CACHE,
10526 			    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
10527 			if (ire != NULL)
10528 				ipsqill = ire_to_ill(ire);
10529 		}
10530 
10531 		if ((x_arp_ioctl) && (ipsqill != NULL))
10532 			storage += ill_xarp_info(&xar->xarp_ha, ipsqill);
10533 
10534 		if (ire != NULL) {
10535 			/*
10536 			 * Since the ire obtained from cachetable is used for
10537 			 * mac addr copying below, treat an incomplete ire as if
10538 			 * as if we never found it.
10539 			 */
10540 			if (ire->ire_nce != NULL &&
10541 			    ire->ire_nce->nce_state != ND_REACHABLE) {
10542 				ire_refrele(ire);
10543 				ire = NULL;
10544 				ipsqill = NULL;
10545 				goto errack;
10546 			}
10547 			*flagsp = ATF_INUSE;
10548 			llmp = (ire->ire_nce != NULL ?
10549 			    ire->ire_nce->nce_res_mp : NULL);
10550 			if (llmp != NULL && ipsqill != NULL) {
10551 				uchar_t *macaddr;
10552 
10553 				addr_len = ipsqill->ill_phys_addr_length;
10554 				if (x_arp_ioctl && ((addr_len +
10555 				    ipsqill->ill_name_length) >
10556 				    sizeof (xar->xarp_ha.sdl_data))) {
10557 					ire_refrele(ire);
10558 					freemsg(mp);
10559 					ip_ioctl_finish(q, orig_ioc_mp,
10560 					    EINVAL, NO_COPYOUT, ipsq);
10561 					return;
10562 				}
10563 				*flagsp |= ATF_COM;
10564 				dlup = (dl_unitdata_req_t *)llmp->b_rptr;
10565 				if (ipsqill->ill_sap_length < 0)
10566 					macaddr = llmp->b_rptr +
10567 					    dlup->dl_dest_addr_offset;
10568 				else
10569 					macaddr = llmp->b_rptr +
10570 					    dlup->dl_dest_addr_offset +
10571 					    ipsqill->ill_sap_length;
10572 				/*
10573 				 * For SIOCGARP, MAC address length
10574 				 * validation has already been done
10575 				 * before the ioctl was issued to ARP to
10576 				 * allow it to progress only on 6 byte
10577 				 * addressable (ethernet like) media. Thus
10578 				 * the mac address copying can not overwrite
10579 				 * the sa_data area below.
10580 				 */
10581 				bcopy(macaddr, storage, addr_len);
10582 			}
10583 			/* Ditch the internal IOCTL. */
10584 			freemsg(mp);
10585 			ire_refrele(ire);
10586 			ip_ioctl_finish(q, orig_ioc_mp, 0, COPYOUT, ipsq);
10587 			return;
10588 		}
10589 	}
10590 
10591 	/*
10592 	 * If this was a failed AR_ENTRY_ADD or a successful AR_ENTRY_DELETE
10593 	 * on the IPMP meta-interface, ensure any ARP entries added in
10594 	 * ip_sioctl_arp() are deleted.
10595 	 */
10596 	if (IS_IPMP(ill) &&
10597 	    ((iocp->ioc_error != 0 && iocp->ioc_cmd == AR_ENTRY_ADD) ||
10598 	    ((iocp->ioc_error == 0 && iocp->ioc_cmd == AR_ENTRY_DELETE)))) {
10599 		ipmp_illgrp_t *illg = ill->ill_grp;
10600 		ipmp_arpent_t *entp;
10601 
10602 		if ((entp = ipmp_illgrp_lookup_arpent(illg, &addr)) != NULL)
10603 			ipmp_illgrp_destroy_arpent(illg, entp);
10604 	}
10605 
10606 	/*
10607 	 * Delete the coresponding IRE_CACHE if any.
10608 	 * Reset the error if there was one (in case there was no entry
10609 	 * in arp.)
10610 	 */
10611 	if (iocp->ioc_cmd == AR_ENTRY_DELETE) {
10612 		ipif_t *ipintf = NULL;
10613 
10614 		if (ifx_arp_ioctl) {
10615 			/*
10616 			 * There's no need to lookup the ill, since
10617 			 * we've already done that when we started
10618 			 * processing the ioctl and sent the message
10619 			 * to ARP on that ill.  So use the ill that
10620 			 * is stored in q->q_ptr.
10621 			 */
10622 			ipintf = ill->ill_ipif;
10623 		}
10624 		if (ip_ire_clookup_and_delete(addr, ipintf, ipst)) {
10625 			/*
10626 			 * The address in "addr" may be an entry for a
10627 			 * router. If that's true, then any off-net
10628 			 * IRE_CACHE entries that go through the router
10629 			 * with address "addr" must be clobbered. Use
10630 			 * ire_walk to achieve this goal.
10631 			 */
10632 			if (ifx_arp_ioctl)
10633 				ire_walk_ill_v4(MATCH_IRE_ILL, 0,
10634 				    ire_delete_cache_gw, (char *)&addr, ill);
10635 			else
10636 				ire_walk_v4(ire_delete_cache_gw, (char *)&addr,
10637 				    ALL_ZONES, ipst);
10638 			iocp->ioc_error = 0;
10639 		}
10640 	}
10641 errack:
10642 	if (iocp->ioc_error || iocp->ioc_cmd != AR_ENTRY_SQUERY) {
10643 		err = iocp->ioc_error;
10644 		freemsg(mp);
10645 		ip_ioctl_finish(q, orig_ioc_mp, err, NO_COPYOUT, ipsq);
10646 		return;
10647 	}
10648 
10649 	/*
10650 	 * Completion of an SIOCG{X}ARP.  Translate the information from
10651 	 * the area_t into the struct {x}arpreq.
10652 	 */
10653 	if (x_arp_ioctl) {
10654 		storage += ill_xarp_info(&xar->xarp_ha, ill);
10655 		if ((ill->ill_phys_addr_length + ill->ill_name_length) >
10656 		    sizeof (xar->xarp_ha.sdl_data)) {
10657 			freemsg(mp);
10658 			ip_ioctl_finish(q, orig_ioc_mp, EINVAL, NO_COPYOUT,
10659 			    ipsq);
10660 			return;
10661 		}
10662 	}
10663 	*flagsp = ATF_INUSE;
10664 	if (area->area_flags & ACE_F_PERMANENT)
10665 		*flagsp |= ATF_PERM;
10666 	if (area->area_flags & ACE_F_PUBLISH)
10667 		*flagsp |= ATF_PUBL;
10668 	if (area->area_flags & ACE_F_AUTHORITY)
10669 		*flagsp |= ATF_AUTHORITY;
10670 	if (area->area_hw_addr_length != 0) {
10671 		*flagsp |= ATF_COM;
10672 		/*
10673 		 * For SIOCGARP, MAC address length validation has
10674 		 * already been done before the ioctl was issued to ARP
10675 		 * to allow it to progress only on 6 byte addressable
10676 		 * (ethernet like) media. Thus the mac address copying
10677 		 * can not overwrite the sa_data area below.
10678 		 */
10679 		bcopy((char *)area + area->area_hw_addr_offset,
10680 		    storage, area->area_hw_addr_length);
10681 	}
10682 
10683 	/* Ditch the internal IOCTL. */
10684 	freemsg(mp);
10685 	/* Complete the original. */
10686 	ip_ioctl_finish(q, orig_ioc_mp, 0, COPYOUT, ipsq);
10687 }
10688 
10689 /*
10690  * Create a new logical interface. If ipif_id is zero (i.e. not a logical
10691  * interface) create the next available logical interface for this
10692  * physical interface.
10693  * If ipif is NULL (i.e. the lookup didn't find one) attempt to create an
10694  * ipif with the specified name.
10695  *
10696  * If the address family is not AF_UNSPEC then set the address as well.
10697  *
10698  * If ip_sioctl_addr returns EINPROGRESS then the ioctl (the copyout)
10699  * is completed when the DL_BIND_ACK arrive in ip_rput_dlpi_writer.
10700  *
10701  * Executed as a writer on the ill.
10702  * So no lock is needed to traverse the ipif chain, or examine the
10703  * phyint flags.
10704  */
10705 /* ARGSUSED */
10706 int
10707 ip_sioctl_addif(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
10708     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
10709 {
10710 	mblk_t	*mp1;
10711 	struct lifreq *lifr;
10712 	boolean_t	isv6;
10713 	boolean_t	exists;
10714 	char 	*name;
10715 	char	*endp;
10716 	char	*cp;
10717 	int	namelen;
10718 	ipif_t	*ipif;
10719 	long	id;
10720 	ipsq_t	*ipsq;
10721 	ill_t	*ill;
10722 	sin_t	*sin;
10723 	int	err = 0;
10724 	boolean_t found_sep = B_FALSE;
10725 	conn_t	*connp;
10726 	zoneid_t zoneid;
10727 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
10728 
10729 	ASSERT(q->q_next == NULL);
10730 	ip1dbg(("ip_sioctl_addif\n"));
10731 	/* Existence of mp1 has been checked in ip_wput_nondata */
10732 	mp1 = mp->b_cont->b_cont;
10733 	/*
10734 	 * Null terminate the string to protect against buffer
10735 	 * overrun. String was generated by user code and may not
10736 	 * be trusted.
10737 	 */
10738 	lifr = (struct lifreq *)mp1->b_rptr;
10739 	lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
10740 	name = lifr->lifr_name;
10741 	ASSERT(CONN_Q(q));
10742 	connp = Q_TO_CONN(q);
10743 	isv6 = connp->conn_af_isv6;
10744 	zoneid = connp->conn_zoneid;
10745 	namelen = mi_strlen(name);
10746 	if (namelen == 0)
10747 		return (EINVAL);
10748 
10749 	exists = B_FALSE;
10750 	if ((namelen + 1 == sizeof (ipif_loopback_name)) &&
10751 	    (mi_strcmp(name, ipif_loopback_name) == 0)) {
10752 		/*
10753 		 * Allow creating lo0 using SIOCLIFADDIF.
10754 		 * can't be any other writer thread. So can pass null below
10755 		 * for the last 4 args to ipif_lookup_name.
10756 		 */
10757 		ipif = ipif_lookup_on_name(lifr->lifr_name, namelen, B_TRUE,
10758 		    &exists, isv6, zoneid, NULL, NULL, NULL, NULL, ipst);
10759 		/* Prevent any further action */
10760 		if (ipif == NULL) {
10761 			return (ENOBUFS);
10762 		} else if (!exists) {
10763 			/* We created the ipif now and as writer */
10764 			ipif_refrele(ipif);
10765 			return (0);
10766 		} else {
10767 			ill = ipif->ipif_ill;
10768 			ill_refhold(ill);
10769 			ipif_refrele(ipif);
10770 		}
10771 	} else {
10772 		/* Look for a colon in the name. */
10773 		endp = &name[namelen];
10774 		for (cp = endp; --cp > name; ) {
10775 			if (*cp == IPIF_SEPARATOR_CHAR) {
10776 				found_sep = B_TRUE;
10777 				/*
10778 				 * Reject any non-decimal aliases for plumbing
10779 				 * of logical interfaces. Aliases with leading
10780 				 * zeroes are also rejected as they introduce
10781 				 * ambiguity in the naming of the interfaces.
10782 				 * Comparing with "0" takes care of all such
10783 				 * cases.
10784 				 */
10785 				if ((strncmp("0", cp+1, 1)) == 0)
10786 					return (EINVAL);
10787 
10788 				if (ddi_strtol(cp+1, &endp, 10, &id) != 0 ||
10789 				    id <= 0 || *endp != '\0') {
10790 					return (EINVAL);
10791 				}
10792 				*cp = '\0';
10793 				break;
10794 			}
10795 		}
10796 		ill = ill_lookup_on_name(name, B_FALSE, isv6,
10797 		    CONNP_TO_WQ(connp), mp, ip_process_ioctl, &err, NULL, ipst);
10798 		if (found_sep)
10799 			*cp = IPIF_SEPARATOR_CHAR;
10800 		if (ill == NULL)
10801 			return (err);
10802 	}
10803 
10804 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_process_ioctl, NEW_OP,
10805 	    B_TRUE);
10806 
10807 	/*
10808 	 * Release the refhold due to the lookup, now that we are excl
10809 	 * or we are just returning
10810 	 */
10811 	ill_refrele(ill);
10812 
10813 	if (ipsq == NULL)
10814 		return (EINPROGRESS);
10815 
10816 	/* We are now exclusive on the IPSQ */
10817 	ASSERT(IAM_WRITER_ILL(ill));
10818 
10819 	if (found_sep) {
10820 		/* Now see if there is an IPIF with this unit number. */
10821 		for (ipif = ill->ill_ipif; ipif != NULL;
10822 		    ipif = ipif->ipif_next) {
10823 			if (ipif->ipif_id == id) {
10824 				err = EEXIST;
10825 				goto done;
10826 			}
10827 		}
10828 	}
10829 
10830 	/*
10831 	 * We use IRE_LOCAL for lo0:1 etc. for "receive only" use
10832 	 * of lo0.  Plumbing for lo0:0 happens in ipif_lookup_on_name()
10833 	 * instead.
10834 	 */
10835 	if ((ipif = ipif_allocate(ill, found_sep ? id : -1, IRE_LOCAL,
10836 	    B_TRUE, B_TRUE)) == NULL) {
10837 		err = ENOBUFS;
10838 		goto done;
10839 	}
10840 
10841 	/* Return created name with ioctl */
10842 	(void) sprintf(lifr->lifr_name, "%s%c%d", ill->ill_name,
10843 	    IPIF_SEPARATOR_CHAR, ipif->ipif_id);
10844 	ip1dbg(("created %s\n", lifr->lifr_name));
10845 
10846 	/* Set address */
10847 	sin = (sin_t *)&lifr->lifr_addr;
10848 	if (sin->sin_family != AF_UNSPEC) {
10849 		err = ip_sioctl_addr(ipif, sin, q, mp,
10850 		    &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], lifr);
10851 	}
10852 
10853 done:
10854 	ipsq_exit(ipsq);
10855 	return (err);
10856 }
10857 
10858 /*
10859  * Remove an existing logical interface. If ipif_id is zero (i.e. not a logical
10860  * interface) delete it based on the IP address (on this physical interface).
10861  * Otherwise delete it based on the ipif_id.
10862  * Also, special handling to allow a removeif of lo0.
10863  */
10864 /* ARGSUSED */
10865 int
10866 ip_sioctl_removeif(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10867     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
10868 {
10869 	conn_t		*connp;
10870 	ill_t		*ill = ipif->ipif_ill;
10871 	boolean_t	 success;
10872 	ip_stack_t	*ipst;
10873 
10874 	ipst = CONNQ_TO_IPST(q);
10875 
10876 	ASSERT(q->q_next == NULL);
10877 	ip1dbg(("ip_sioctl_remove_if(%s:%u %p)\n",
10878 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10879 	ASSERT(IAM_WRITER_IPIF(ipif));
10880 
10881 	connp = Q_TO_CONN(q);
10882 	/*
10883 	 * Special case for unplumbing lo0 (the loopback physical interface).
10884 	 * If unplumbing lo0, the incoming address structure has been
10885 	 * initialized to all zeros. When unplumbing lo0, all its logical
10886 	 * interfaces must be removed too.
10887 	 *
10888 	 * Note that this interface may be called to remove a specific
10889 	 * loopback logical interface (eg, lo0:1). But in that case
10890 	 * ipif->ipif_id != 0 so that the code path for that case is the
10891 	 * same as any other interface (meaning it skips the code directly
10892 	 * below).
10893 	 */
10894 	if (ipif->ipif_id == 0 && ipif->ipif_net_type == IRE_LOOPBACK) {
10895 		if (sin->sin_family == AF_UNSPEC &&
10896 		    (IN6_IS_ADDR_UNSPECIFIED(&((sin6_t *)sin)->sin6_addr))) {
10897 			/*
10898 			 * Mark it condemned. No new ref. will be made to ill.
10899 			 */
10900 			mutex_enter(&ill->ill_lock);
10901 			ill->ill_state_flags |= ILL_CONDEMNED;
10902 			for (ipif = ill->ill_ipif; ipif != NULL;
10903 			    ipif = ipif->ipif_next) {
10904 				ipif->ipif_state_flags |= IPIF_CONDEMNED;
10905 			}
10906 			mutex_exit(&ill->ill_lock);
10907 
10908 			ipif = ill->ill_ipif;
10909 			/* unplumb the loopback interface */
10910 			ill_delete(ill);
10911 			mutex_enter(&connp->conn_lock);
10912 			mutex_enter(&ill->ill_lock);
10913 
10914 			/* Are any references to this ill active */
10915 			if (ill_is_freeable(ill)) {
10916 				mutex_exit(&ill->ill_lock);
10917 				mutex_exit(&connp->conn_lock);
10918 				ill_delete_tail(ill);
10919 				mi_free(ill);
10920 				return (0);
10921 			}
10922 			success = ipsq_pending_mp_add(connp, ipif,
10923 			    CONNP_TO_WQ(connp), mp, ILL_FREE);
10924 			mutex_exit(&connp->conn_lock);
10925 			mutex_exit(&ill->ill_lock);
10926 			if (success)
10927 				return (EINPROGRESS);
10928 			else
10929 				return (EINTR);
10930 		}
10931 	}
10932 
10933 	if (ipif->ipif_id == 0) {
10934 		ipsq_t *ipsq;
10935 
10936 		/* Find based on address */
10937 		if (ipif->ipif_isv6) {
10938 			sin6_t *sin6;
10939 
10940 			if (sin->sin_family != AF_INET6)
10941 				return (EAFNOSUPPORT);
10942 
10943 			sin6 = (sin6_t *)sin;
10944 			/* We are a writer, so we should be able to lookup */
10945 			ipif = ipif_lookup_addr_exact_v6(&sin6->sin6_addr, ill,
10946 			    ipst);
10947 		} else {
10948 			if (sin->sin_family != AF_INET)
10949 				return (EAFNOSUPPORT);
10950 
10951 			/* We are a writer, so we should be able to lookup */
10952 			ipif = ipif_lookup_addr_exact(sin->sin_addr.s_addr, ill,
10953 			    ipst);
10954 		}
10955 		if (ipif == NULL) {
10956 			return (EADDRNOTAVAIL);
10957 		}
10958 
10959 		/*
10960 		 * It is possible for a user to send an SIOCLIFREMOVEIF with
10961 		 * lifr_name of the physical interface but with an ip address
10962 		 * lifr_addr of a logical interface plumbed over it.
10963 		 * So update ipx_current_ipif now that ipif points to the
10964 		 * correct one.
10965 		 */
10966 		ipsq = ipif->ipif_ill->ill_phyint->phyint_ipsq;
10967 		ipsq->ipsq_xop->ipx_current_ipif = ipif;
10968 
10969 		/* This is a writer */
10970 		ipif_refrele(ipif);
10971 	}
10972 
10973 	/*
10974 	 * Can not delete instance zero since it is tied to the ill.
10975 	 */
10976 	if (ipif->ipif_id == 0)
10977 		return (EBUSY);
10978 
10979 	mutex_enter(&ill->ill_lock);
10980 	ipif->ipif_state_flags |= IPIF_CONDEMNED;
10981 	mutex_exit(&ill->ill_lock);
10982 
10983 	ipif_free(ipif);
10984 
10985 	mutex_enter(&connp->conn_lock);
10986 	mutex_enter(&ill->ill_lock);
10987 
10988 	/* Are any references to this ipif active */
10989 	if (ipif_is_freeable(ipif)) {
10990 		mutex_exit(&ill->ill_lock);
10991 		mutex_exit(&connp->conn_lock);
10992 		ipif_non_duplicate(ipif);
10993 		ipif_down_tail(ipif);
10994 		ipif_free_tail(ipif); /* frees ipif */
10995 		return (0);
10996 	}
10997 	success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp), mp,
10998 	    IPIF_FREE);
10999 	mutex_exit(&ill->ill_lock);
11000 	mutex_exit(&connp->conn_lock);
11001 	if (success)
11002 		return (EINPROGRESS);
11003 	else
11004 		return (EINTR);
11005 }
11006 
11007 /*
11008  * Restart the removeif ioctl. The refcnt has gone down to 0.
11009  * The ipif is already condemned. So can't find it thru lookups.
11010  */
11011 /* ARGSUSED */
11012 int
11013 ip_sioctl_removeif_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
11014     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_if_req)
11015 {
11016 	ill_t *ill = ipif->ipif_ill;
11017 
11018 	ASSERT(IAM_WRITER_IPIF(ipif));
11019 	ASSERT(ipif->ipif_state_flags & IPIF_CONDEMNED);
11020 
11021 	ip1dbg(("ip_sioctl_removeif_restart(%s:%u %p)\n",
11022 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
11023 
11024 	if (ipif->ipif_id == 0 && ipif->ipif_net_type == IRE_LOOPBACK) {
11025 		ASSERT(ill->ill_state_flags & ILL_CONDEMNED);
11026 		ill_delete_tail(ill);
11027 		mi_free(ill);
11028 		return (0);
11029 	}
11030 
11031 	ipif_non_duplicate(ipif);
11032 	ipif_down_tail(ipif);
11033 	ipif_free_tail(ipif);
11034 
11035 	ILL_UNMARK_CHANGING(ill);
11036 	return (0);
11037 }
11038 
11039 /*
11040  * Set the local interface address.
11041  * Allow an address of all zero when the interface is down.
11042  */
11043 /* ARGSUSED */
11044 int
11045 ip_sioctl_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11046     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
11047 {
11048 	int err = 0;
11049 	in6_addr_t v6addr;
11050 	boolean_t need_up = B_FALSE;
11051 
11052 	ip1dbg(("ip_sioctl_addr(%s:%u %p)\n",
11053 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11054 
11055 	ASSERT(IAM_WRITER_IPIF(ipif));
11056 
11057 	if (ipif->ipif_isv6) {
11058 		sin6_t *sin6;
11059 		ill_t *ill;
11060 		phyint_t *phyi;
11061 
11062 		if (sin->sin_family != AF_INET6)
11063 			return (EAFNOSUPPORT);
11064 
11065 		sin6 = (sin6_t *)sin;
11066 		v6addr = sin6->sin6_addr;
11067 		ill = ipif->ipif_ill;
11068 		phyi = ill->ill_phyint;
11069 
11070 		/*
11071 		 * Enforce that true multicast interfaces have a link-local
11072 		 * address for logical unit 0.
11073 		 */
11074 		if (ipif->ipif_id == 0 &&
11075 		    (ill->ill_flags & ILLF_MULTICAST) &&
11076 		    !(ipif->ipif_flags & (IPIF_POINTOPOINT)) &&
11077 		    !(phyi->phyint_flags & (PHYI_LOOPBACK)) &&
11078 		    !IN6_IS_ADDR_LINKLOCAL(&v6addr)) {
11079 			return (EADDRNOTAVAIL);
11080 		}
11081 
11082 		/*
11083 		 * up interfaces shouldn't have the unspecified address
11084 		 * unless they also have the IPIF_NOLOCAL flags set and
11085 		 * have a subnet assigned.
11086 		 */
11087 		if ((ipif->ipif_flags & IPIF_UP) &&
11088 		    IN6_IS_ADDR_UNSPECIFIED(&v6addr) &&
11089 		    (!(ipif->ipif_flags & IPIF_NOLOCAL) ||
11090 		    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) {
11091 			return (EADDRNOTAVAIL);
11092 		}
11093 
11094 		if (!ip_local_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
11095 			return (EADDRNOTAVAIL);
11096 	} else {
11097 		ipaddr_t addr;
11098 
11099 		if (sin->sin_family != AF_INET)
11100 			return (EAFNOSUPPORT);
11101 
11102 		addr = sin->sin_addr.s_addr;
11103 
11104 		/* Allow 0 as the local address. */
11105 		if (addr != 0 && !ip_addr_ok_v4(addr, ipif->ipif_net_mask))
11106 			return (EADDRNOTAVAIL);
11107 
11108 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11109 	}
11110 
11111 	/*
11112 	 * Even if there is no change we redo things just to rerun
11113 	 * ipif_set_default.
11114 	 */
11115 	if (ipif->ipif_flags & IPIF_UP) {
11116 		/*
11117 		 * Setting a new local address, make sure
11118 		 * we have net and subnet bcast ire's for
11119 		 * the old address if we need them.
11120 		 */
11121 		if (!ipif->ipif_isv6)
11122 			ipif_check_bcast_ires(ipif);
11123 		/*
11124 		 * If the interface is already marked up,
11125 		 * we call ipif_down which will take care
11126 		 * of ditching any IREs that have been set
11127 		 * up based on the old interface address.
11128 		 */
11129 		err = ipif_logical_down(ipif, q, mp);
11130 		if (err == EINPROGRESS)
11131 			return (err);
11132 		ipif_down_tail(ipif);
11133 		need_up = 1;
11134 	}
11135 
11136 	err = ip_sioctl_addr_tail(ipif, sin, q, mp, need_up);
11137 	return (err);
11138 }
11139 
11140 int
11141 ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11142     boolean_t need_up)
11143 {
11144 	in6_addr_t v6addr;
11145 	in6_addr_t ov6addr;
11146 	ipaddr_t addr;
11147 	sin6_t	*sin6;
11148 	int	sinlen;
11149 	int	err = 0;
11150 	ill_t	*ill = ipif->ipif_ill;
11151 	boolean_t need_dl_down;
11152 	boolean_t need_arp_down;
11153 	struct iocblk *iocp;
11154 
11155 	iocp = (mp != NULL) ? (struct iocblk *)mp->b_rptr : NULL;
11156 
11157 	ip1dbg(("ip_sioctl_addr_tail(%s:%u %p)\n",
11158 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
11159 	ASSERT(IAM_WRITER_IPIF(ipif));
11160 
11161 	/* Must cancel any pending timer before taking the ill_lock */
11162 	if (ipif->ipif_recovery_id != 0)
11163 		(void) untimeout(ipif->ipif_recovery_id);
11164 	ipif->ipif_recovery_id = 0;
11165 
11166 	if (ipif->ipif_isv6) {
11167 		sin6 = (sin6_t *)sin;
11168 		v6addr = sin6->sin6_addr;
11169 		sinlen = sizeof (struct sockaddr_in6);
11170 	} else {
11171 		addr = sin->sin_addr.s_addr;
11172 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11173 		sinlen = sizeof (struct sockaddr_in);
11174 	}
11175 	mutex_enter(&ill->ill_lock);
11176 	ov6addr = ipif->ipif_v6lcl_addr;
11177 	ipif->ipif_v6lcl_addr = v6addr;
11178 	sctp_update_ipif_addr(ipif, ov6addr);
11179 	if (ipif->ipif_flags & (IPIF_ANYCAST | IPIF_NOLOCAL)) {
11180 		ipif->ipif_v6src_addr = ipv6_all_zeros;
11181 	} else {
11182 		ipif->ipif_v6src_addr = v6addr;
11183 	}
11184 	ipif->ipif_addr_ready = 0;
11185 
11186 	/*
11187 	 * If the interface was previously marked as a duplicate, then since
11188 	 * we've now got a "new" address, it should no longer be considered a
11189 	 * duplicate -- even if the "new" address is the same as the old one.
11190 	 * Note that if all ipifs are down, we may have a pending ARP down
11191 	 * event to handle.  This is because we want to recover from duplicates
11192 	 * and thus delay tearing down ARP until the duplicates have been
11193 	 * removed or disabled.
11194 	 */
11195 	need_dl_down = need_arp_down = B_FALSE;
11196 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
11197 		need_arp_down = !need_up;
11198 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
11199 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
11200 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
11201 			need_dl_down = B_TRUE;
11202 		}
11203 	}
11204 
11205 	if (ipif->ipif_isv6 && IN6_IS_ADDR_6TO4(&v6addr) &&
11206 	    !ill->ill_is_6to4tun) {
11207 		queue_t *wqp = ill->ill_wq;
11208 
11209 		/*
11210 		 * The local address of this interface is a 6to4 address,
11211 		 * check if this interface is in fact a 6to4 tunnel or just
11212 		 * an interface configured with a 6to4 address.  We are only
11213 		 * interested in the former.
11214 		 */
11215 		if (wqp != NULL) {
11216 			while ((wqp->q_next != NULL) &&
11217 			    (wqp->q_next->q_qinfo != NULL) &&
11218 			    (wqp->q_next->q_qinfo->qi_minfo != NULL)) {
11219 
11220 				if (wqp->q_next->q_qinfo->qi_minfo->mi_idnum
11221 				    == TUN6TO4_MODID) {
11222 					/* set for use in IP */
11223 					ill->ill_is_6to4tun = 1;
11224 					break;
11225 				}
11226 				wqp = wqp->q_next;
11227 			}
11228 		}
11229 	}
11230 
11231 	ipif_set_default(ipif);
11232 
11233 	/*
11234 	 * When publishing an interface address change event, we only notify
11235 	 * the event listeners of the new address.  It is assumed that if they
11236 	 * actively care about the addresses assigned that they will have
11237 	 * already discovered the previous address assigned (if there was one.)
11238 	 *
11239 	 * Don't attach nic event message for SIOCLIFADDIF ioctl.
11240 	 */
11241 	if (iocp != NULL && iocp->ioc_cmd != SIOCLIFADDIF) {
11242 		ill_nic_event_dispatch(ill, MAP_IPIF_ID(ipif->ipif_id),
11243 		    NE_ADDRESS_CHANGE, sin, sinlen);
11244 	}
11245 
11246 	mutex_exit(&ill->ill_lock);
11247 
11248 	if (need_up) {
11249 		/*
11250 		 * Now bring the interface back up.  If this
11251 		 * is the only IPIF for the ILL, ipif_up
11252 		 * will have to re-bind to the device, so
11253 		 * we may get back EINPROGRESS, in which
11254 		 * case, this IOCTL will get completed in
11255 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11256 		 */
11257 		err = ipif_up(ipif, q, mp);
11258 	}
11259 
11260 	if (need_dl_down)
11261 		ill_dl_down(ill);
11262 	if (need_arp_down)
11263 		ipif_resolver_down(ipif);
11264 
11265 	return (err);
11266 }
11267 
11268 /*
11269  * Restart entry point to restart the address set operation after the
11270  * refcounts have dropped to zero.
11271  */
11272 /* ARGSUSED */
11273 int
11274 ip_sioctl_addr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11275     ip_ioctl_cmd_t *ipip, void *ifreq)
11276 {
11277 	ip1dbg(("ip_sioctl_addr_restart(%s:%u %p)\n",
11278 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11279 	ASSERT(IAM_WRITER_IPIF(ipif));
11280 	ipif_down_tail(ipif);
11281 	return (ip_sioctl_addr_tail(ipif, sin, q, mp, B_TRUE));
11282 }
11283 
11284 /* ARGSUSED */
11285 int
11286 ip_sioctl_get_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11287     ip_ioctl_cmd_t *ipip, void *if_req)
11288 {
11289 	sin6_t *sin6 = (struct sockaddr_in6 *)sin;
11290 	struct lifreq *lifr = (struct lifreq *)if_req;
11291 
11292 	ip1dbg(("ip_sioctl_get_addr(%s:%u %p)\n",
11293 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11294 	/*
11295 	 * The net mask and address can't change since we have a
11296 	 * reference to the ipif. So no lock is necessary.
11297 	 */
11298 	if (ipif->ipif_isv6) {
11299 		*sin6 = sin6_null;
11300 		sin6->sin6_family = AF_INET6;
11301 		sin6->sin6_addr = ipif->ipif_v6lcl_addr;
11302 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11303 		lifr->lifr_addrlen =
11304 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
11305 	} else {
11306 		*sin = sin_null;
11307 		sin->sin_family = AF_INET;
11308 		sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
11309 		if (ipip->ipi_cmd_type == LIF_CMD) {
11310 			lifr->lifr_addrlen =
11311 			    ip_mask_to_plen(ipif->ipif_net_mask);
11312 		}
11313 	}
11314 	return (0);
11315 }
11316 
11317 /*
11318  * Set the destination address for a pt-pt interface.
11319  */
11320 /* ARGSUSED */
11321 int
11322 ip_sioctl_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11323     ip_ioctl_cmd_t *ipip, void *if_req)
11324 {
11325 	int err = 0;
11326 	in6_addr_t v6addr;
11327 	boolean_t need_up = B_FALSE;
11328 
11329 	ip1dbg(("ip_sioctl_dstaddr(%s:%u %p)\n",
11330 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11331 	ASSERT(IAM_WRITER_IPIF(ipif));
11332 
11333 	if (ipif->ipif_isv6) {
11334 		sin6_t *sin6;
11335 
11336 		if (sin->sin_family != AF_INET6)
11337 			return (EAFNOSUPPORT);
11338 
11339 		sin6 = (sin6_t *)sin;
11340 		v6addr = sin6->sin6_addr;
11341 
11342 		if (!ip_remote_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
11343 			return (EADDRNOTAVAIL);
11344 	} else {
11345 		ipaddr_t addr;
11346 
11347 		if (sin->sin_family != AF_INET)
11348 			return (EAFNOSUPPORT);
11349 
11350 		addr = sin->sin_addr.s_addr;
11351 		if (!ip_addr_ok_v4(addr, ipif->ipif_net_mask))
11352 			return (EADDRNOTAVAIL);
11353 
11354 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11355 	}
11356 
11357 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, &v6addr))
11358 		return (0);	/* No change */
11359 
11360 	if (ipif->ipif_flags & IPIF_UP) {
11361 		/*
11362 		 * If the interface is already marked up,
11363 		 * we call ipif_down which will take care
11364 		 * of ditching any IREs that have been set
11365 		 * up based on the old pp dst address.
11366 		 */
11367 		err = ipif_logical_down(ipif, q, mp);
11368 		if (err == EINPROGRESS)
11369 			return (err);
11370 		ipif_down_tail(ipif);
11371 		need_up = B_TRUE;
11372 	}
11373 	/*
11374 	 * could return EINPROGRESS. If so ioctl will complete in
11375 	 * ip_rput_dlpi_writer
11376 	 */
11377 	err = ip_sioctl_dstaddr_tail(ipif, sin, q, mp, need_up);
11378 	return (err);
11379 }
11380 
11381 static int
11382 ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11383     boolean_t need_up)
11384 {
11385 	in6_addr_t v6addr;
11386 	ill_t	*ill = ipif->ipif_ill;
11387 	int	err = 0;
11388 	boolean_t need_dl_down;
11389 	boolean_t need_arp_down;
11390 
11391 	ip1dbg(("ip_sioctl_dstaddr_tail(%s:%u %p)\n", ill->ill_name,
11392 	    ipif->ipif_id, (void *)ipif));
11393 
11394 	/* Must cancel any pending timer before taking the ill_lock */
11395 	if (ipif->ipif_recovery_id != 0)
11396 		(void) untimeout(ipif->ipif_recovery_id);
11397 	ipif->ipif_recovery_id = 0;
11398 
11399 	if (ipif->ipif_isv6) {
11400 		sin6_t *sin6;
11401 
11402 		sin6 = (sin6_t *)sin;
11403 		v6addr = sin6->sin6_addr;
11404 	} else {
11405 		ipaddr_t addr;
11406 
11407 		addr = sin->sin_addr.s_addr;
11408 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11409 	}
11410 	mutex_enter(&ill->ill_lock);
11411 	/* Set point to point destination address. */
11412 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11413 		/*
11414 		 * Allow this as a means of creating logical
11415 		 * pt-pt interfaces on top of e.g. an Ethernet.
11416 		 * XXX Undocumented HACK for testing.
11417 		 * pt-pt interfaces are created with NUD disabled.
11418 		 */
11419 		ipif->ipif_flags |= IPIF_POINTOPOINT;
11420 		ipif->ipif_flags &= ~IPIF_BROADCAST;
11421 		if (ipif->ipif_isv6)
11422 			ill->ill_flags |= ILLF_NONUD;
11423 	}
11424 
11425 	/*
11426 	 * If the interface was previously marked as a duplicate, then since
11427 	 * we've now got a "new" address, it should no longer be considered a
11428 	 * duplicate -- even if the "new" address is the same as the old one.
11429 	 * Note that if all ipifs are down, we may have a pending ARP down
11430 	 * event to handle.
11431 	 */
11432 	need_dl_down = need_arp_down = B_FALSE;
11433 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
11434 		need_arp_down = !need_up;
11435 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
11436 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
11437 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
11438 			need_dl_down = B_TRUE;
11439 		}
11440 	}
11441 
11442 	/* Set the new address. */
11443 	ipif->ipif_v6pp_dst_addr = v6addr;
11444 	/* Make sure subnet tracks pp_dst */
11445 	ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
11446 	mutex_exit(&ill->ill_lock);
11447 
11448 	if (need_up) {
11449 		/*
11450 		 * Now bring the interface back up.  If this
11451 		 * is the only IPIF for the ILL, ipif_up
11452 		 * will have to re-bind to the device, so
11453 		 * we may get back EINPROGRESS, in which
11454 		 * case, this IOCTL will get completed in
11455 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11456 		 */
11457 		err = ipif_up(ipif, q, mp);
11458 	}
11459 
11460 	if (need_dl_down)
11461 		ill_dl_down(ill);
11462 	if (need_arp_down)
11463 		ipif_resolver_down(ipif);
11464 
11465 	return (err);
11466 }
11467 
11468 /*
11469  * Restart entry point to restart the dstaddress set operation after the
11470  * refcounts have dropped to zero.
11471  */
11472 /* ARGSUSED */
11473 int
11474 ip_sioctl_dstaddr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11475     ip_ioctl_cmd_t *ipip, void *ifreq)
11476 {
11477 	ip1dbg(("ip_sioctl_dstaddr_restart(%s:%u %p)\n",
11478 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11479 	ipif_down_tail(ipif);
11480 	return (ip_sioctl_dstaddr_tail(ipif, sin, q, mp, B_TRUE));
11481 }
11482 
11483 /* ARGSUSED */
11484 int
11485 ip_sioctl_get_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11486     ip_ioctl_cmd_t *ipip, void *if_req)
11487 {
11488 	sin6_t	*sin6 = (struct sockaddr_in6 *)sin;
11489 
11490 	ip1dbg(("ip_sioctl_get_dstaddr(%s:%u %p)\n",
11491 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11492 	/*
11493 	 * Get point to point destination address. The addresses can't
11494 	 * change since we hold a reference to the ipif.
11495 	 */
11496 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0)
11497 		return (EADDRNOTAVAIL);
11498 
11499 	if (ipif->ipif_isv6) {
11500 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11501 		*sin6 = sin6_null;
11502 		sin6->sin6_family = AF_INET6;
11503 		sin6->sin6_addr = ipif->ipif_v6pp_dst_addr;
11504 	} else {
11505 		*sin = sin_null;
11506 		sin->sin_family = AF_INET;
11507 		sin->sin_addr.s_addr = ipif->ipif_pp_dst_addr;
11508 	}
11509 	return (0);
11510 }
11511 
11512 /*
11513  * Set interface flags.  Many flags require special handling (e.g.,
11514  * bringing the interface down); see below for details.
11515  *
11516  * NOTE : We really don't enforce that ipif_id zero should be used
11517  *	  for setting any flags other than IFF_LOGINT_FLAGS. This
11518  *	  is because applications generally does SICGLIFFLAGS and
11519  *	  ORs in the new flags (that affects the logical) and does a
11520  *	  SIOCSLIFFLAGS. Thus, "flags" below could contain bits other
11521  *	  than IFF_LOGINT_FLAGS. One could check whether "turn_on" - the
11522  *	  flags that will be turned on is correct with respect to
11523  *	  ipif_id 0. For backward compatibility reasons, it is not done.
11524  */
11525 /* ARGSUSED */
11526 int
11527 ip_sioctl_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11528     ip_ioctl_cmd_t *ipip, void *if_req)
11529 {
11530 	uint64_t turn_on;
11531 	uint64_t turn_off;
11532 	int	err = 0;
11533 	phyint_t *phyi;
11534 	ill_t *ill;
11535 	uint64_t intf_flags, cantchange_flags;
11536 	boolean_t phyint_flags_modified = B_FALSE;
11537 	uint64_t flags;
11538 	struct ifreq *ifr;
11539 	struct lifreq *lifr;
11540 	boolean_t set_linklocal = B_FALSE;
11541 	boolean_t zero_source = B_FALSE;
11542 
11543 	ip1dbg(("ip_sioctl_flags(%s:%u %p)\n",
11544 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11545 
11546 	ASSERT(IAM_WRITER_IPIF(ipif));
11547 
11548 	ill = ipif->ipif_ill;
11549 	phyi = ill->ill_phyint;
11550 
11551 	if (ipip->ipi_cmd_type == IF_CMD) {
11552 		ifr = (struct ifreq *)if_req;
11553 		flags = (uint64_t)(ifr->ifr_flags & 0x0000ffff);
11554 	} else {
11555 		lifr = (struct lifreq *)if_req;
11556 		flags = lifr->lifr_flags;
11557 	}
11558 
11559 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
11560 
11561 	/*
11562 	 * Have the flags been set correctly until now?
11563 	 */
11564 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
11565 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
11566 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
11567 	/*
11568 	 * Compare the new flags to the old, and partition
11569 	 * into those coming on and those going off.
11570 	 * For the 16 bit command keep the bits above bit 16 unchanged.
11571 	 */
11572 	if (ipip->ipi_cmd == SIOCSIFFLAGS)
11573 		flags |= intf_flags & ~0xFFFF;
11574 
11575 	/*
11576 	 * Explicitly fail attempts to change flags that are always invalid on
11577 	 * an IPMP meta-interface.
11578 	 */
11579 	if (IS_IPMP(ill) && ((flags ^ intf_flags) & IFF_IPMP_INVALID))
11580 		return (EINVAL);
11581 
11582 	/*
11583 	 * Check which flags will change; silently ignore flags which userland
11584 	 * is not allowed to control.  (Because these flags may change between
11585 	 * SIOCGLIFFLAGS and SIOCSLIFFLAGS, and that's outside of userland's
11586 	 * control, we need to silently ignore them rather than fail.)
11587 	 */
11588 	cantchange_flags = IFF_CANTCHANGE;
11589 	if (IS_IPMP(ill))
11590 		cantchange_flags |= IFF_IPMP_CANTCHANGE;
11591 
11592 	turn_on = (flags ^ intf_flags) & ~cantchange_flags;
11593 	if (turn_on == 0)
11594 		return (0);	/* No change */
11595 
11596 	turn_off = intf_flags & turn_on;
11597 	turn_on ^= turn_off;
11598 
11599 	/*
11600 	 * All test addresses must be IFF_DEPRECATED (to ensure source address
11601 	 * selection avoids them) -- so force IFF_DEPRECATED on, and do not
11602 	 * allow it to be turned off.
11603 	 */
11604 	if ((turn_off & (IFF_DEPRECATED|IFF_NOFAILOVER)) == IFF_DEPRECATED &&
11605 	    (turn_on|intf_flags) & IFF_NOFAILOVER)
11606 		return (EINVAL);
11607 
11608 	if (turn_on & IFF_NOFAILOVER) {
11609 		turn_on |= IFF_DEPRECATED;
11610 		flags |= IFF_DEPRECATED;
11611 	}
11612 
11613 	/*
11614 	 * On underlying interfaces, only allow applications to manage test
11615 	 * addresses -- otherwise, they may get confused when the address
11616 	 * moves as part of being brought up.  Likewise, prevent an
11617 	 * application-managed test address from being converted to a data
11618 	 * address.  To prevent migration of administratively up addresses in
11619 	 * the kernel, we don't allow them to be converted either.
11620 	 */
11621 	if (IS_UNDER_IPMP(ill)) {
11622 		const uint64_t appflags = IFF_DHCPRUNNING | IFF_ADDRCONF;
11623 
11624 		if ((turn_on & appflags) && !(flags & IFF_NOFAILOVER))
11625 			return (EINVAL);
11626 
11627 		if ((turn_off & IFF_NOFAILOVER) &&
11628 		    (flags & (appflags | IFF_UP | IFF_DUPLICATE)))
11629 			return (EINVAL);
11630 	}
11631 
11632 	/*
11633 	 * Only allow the IFF_XRESOLV and IFF_TEMPORARY flags to be set on
11634 	 * IPv6 interfaces.
11635 	 */
11636 	if ((turn_on & (IFF_XRESOLV|IFF_TEMPORARY)) && !(ipif->ipif_isv6))
11637 		return (EINVAL);
11638 
11639 	/*
11640 	 * cannot turn off IFF_NOXMIT on  VNI interfaces.
11641 	 */
11642 	if ((turn_off & IFF_NOXMIT) && IS_VNI(ipif->ipif_ill))
11643 		return (EINVAL);
11644 
11645 	/*
11646 	 * Don't allow the IFF_ROUTER flag to be turned on on loopback
11647 	 * interfaces.  It makes no sense in that context.
11648 	 */
11649 	if ((turn_on & IFF_ROUTER) && (phyi->phyint_flags & PHYI_LOOPBACK))
11650 		return (EINVAL);
11651 
11652 	if (flags & (IFF_NOLOCAL|IFF_ANYCAST))
11653 		zero_source = B_TRUE;
11654 
11655 	/*
11656 	 * For IPv6 ipif_id 0, don't allow the interface to be up without
11657 	 * a link local address if IFF_NOLOCAL or IFF_ANYCAST are not set.
11658 	 * If the link local address isn't set, and can be set, it will get
11659 	 * set later on in this function.
11660 	 */
11661 	if (ipif->ipif_id == 0 && ipif->ipif_isv6 &&
11662 	    (flags & IFF_UP) && !zero_source &&
11663 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
11664 		if (ipif_cant_setlinklocal(ipif))
11665 			return (EINVAL);
11666 		set_linklocal = B_TRUE;
11667 	}
11668 
11669 	/*
11670 	 * If we modify physical interface flags, we'll potentially need to
11671 	 * send up two routing socket messages for the changes (one for the
11672 	 * IPv4 ill, and another for the IPv6 ill).  Note that here.
11673 	 */
11674 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
11675 		phyint_flags_modified = B_TRUE;
11676 
11677 	/*
11678 	 * All functioning PHYI_STANDBY interfaces start life PHYI_INACTIVE
11679 	 * (otherwise, we'd immediately use them, defeating standby).  Also,
11680 	 * since PHYI_INACTIVE has a separate meaning when PHYI_STANDBY is not
11681 	 * set, don't allow PHYI_STANDBY to be set if PHYI_INACTIVE is already
11682 	 * set, and clear PHYI_INACTIVE if PHYI_STANDBY is being cleared.  We
11683 	 * also don't allow PHYI_STANDBY if VNI is enabled since its semantics
11684 	 * will not be honored.
11685 	 */
11686 	if (turn_on & PHYI_STANDBY) {
11687 		/*
11688 		 * No need to grab ill_g_usesrc_lock here; see the
11689 		 * synchronization notes in ip.c.
11690 		 */
11691 		if (ill->ill_usesrc_grp_next != NULL ||
11692 		    intf_flags & PHYI_INACTIVE)
11693 			return (EINVAL);
11694 		if (!(flags & PHYI_FAILED)) {
11695 			flags |= PHYI_INACTIVE;
11696 			turn_on |= PHYI_INACTIVE;
11697 		}
11698 	}
11699 
11700 	if (turn_off & PHYI_STANDBY) {
11701 		flags &= ~PHYI_INACTIVE;
11702 		turn_off |= PHYI_INACTIVE;
11703 	}
11704 
11705 	/*
11706 	 * PHYI_FAILED and PHYI_INACTIVE are mutually exclusive; fail if both
11707 	 * would end up on.
11708 	 */
11709 	if ((flags & (PHYI_FAILED | PHYI_INACTIVE)) ==
11710 	    (PHYI_FAILED | PHYI_INACTIVE))
11711 		return (EINVAL);
11712 
11713 	/*
11714 	 * If ILLF_ROUTER changes, we need to change the ip forwarding
11715 	 * status of the interface.
11716 	 */
11717 	if ((turn_on | turn_off) & ILLF_ROUTER)
11718 		(void) ill_forward_set(ill, ((turn_on & ILLF_ROUTER) != 0));
11719 
11720 	/*
11721 	 * If the interface is not UP and we are not going to
11722 	 * bring it UP, record the flags and return. When the
11723 	 * interface comes UP later, the right actions will be
11724 	 * taken.
11725 	 */
11726 	if (!(ipif->ipif_flags & IPIF_UP) &&
11727 	    !(turn_on & IPIF_UP)) {
11728 		/* Record new flags in their respective places. */
11729 		mutex_enter(&ill->ill_lock);
11730 		mutex_enter(&ill->ill_phyint->phyint_lock);
11731 		ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
11732 		ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
11733 		ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
11734 		ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
11735 		phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
11736 		phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
11737 		mutex_exit(&ill->ill_lock);
11738 		mutex_exit(&ill->ill_phyint->phyint_lock);
11739 
11740 		/*
11741 		 * PHYI_FAILED, PHYI_INACTIVE, and PHYI_OFFLINE are all the
11742 		 * same to the kernel: if any of them has been set by
11743 		 * userland, the interface cannot be used for data traffic.
11744 		 */
11745 		if ((turn_on|turn_off) &
11746 		    (PHYI_FAILED | PHYI_INACTIVE | PHYI_OFFLINE)) {
11747 			ASSERT(!IS_IPMP(ill));
11748 			/*
11749 			 * It's possible the ill is part of an "anonymous"
11750 			 * IPMP group rather than a real group.  In that case,
11751 			 * there are no other interfaces in the group and thus
11752 			 * no need to call ipmp_phyint_refresh_active().
11753 			 */
11754 			if (IS_UNDER_IPMP(ill))
11755 				ipmp_phyint_refresh_active(phyi);
11756 		}
11757 
11758 		if (phyint_flags_modified) {
11759 			if (phyi->phyint_illv4 != NULL) {
11760 				ip_rts_ifmsg(phyi->phyint_illv4->
11761 				    ill_ipif, RTSQ_DEFAULT);
11762 			}
11763 			if (phyi->phyint_illv6 != NULL) {
11764 				ip_rts_ifmsg(phyi->phyint_illv6->
11765 				    ill_ipif, RTSQ_DEFAULT);
11766 			}
11767 		}
11768 		return (0);
11769 	} else if (set_linklocal || zero_source) {
11770 		mutex_enter(&ill->ill_lock);
11771 		if (set_linklocal)
11772 			ipif->ipif_state_flags |= IPIF_SET_LINKLOCAL;
11773 		if (zero_source)
11774 			ipif->ipif_state_flags |= IPIF_ZERO_SOURCE;
11775 		mutex_exit(&ill->ill_lock);
11776 	}
11777 
11778 	/*
11779 	 * Disallow IPv6 interfaces coming up that have the unspecified address,
11780 	 * or point-to-point interfaces with an unspecified destination. We do
11781 	 * allow the address to be unspecified for IPIF_NOLOCAL interfaces that
11782 	 * have a subnet assigned, which is how in.ndpd currently manages its
11783 	 * onlink prefix list when no addresses are configured with those
11784 	 * prefixes.
11785 	 */
11786 	if (ipif->ipif_isv6 &&
11787 	    ((IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
11788 	    (!(ipif->ipif_flags & IPIF_NOLOCAL) && !(turn_on & IPIF_NOLOCAL) ||
11789 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) ||
11790 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
11791 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)))) {
11792 		return (EINVAL);
11793 	}
11794 
11795 	/*
11796 	 * Prevent IPv4 point-to-point interfaces with a 0.0.0.0 destination
11797 	 * from being brought up.
11798 	 */
11799 	if (!ipif->ipif_isv6 &&
11800 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
11801 	    ipif->ipif_pp_dst_addr == INADDR_ANY)) {
11802 		return (EINVAL);
11803 	}
11804 
11805 	/*
11806 	 * The only flag changes that we currently take specific action on are
11807 	 * IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT, IPIF_NOLOCAL, ILLF_NOARP,
11808 	 * ILLF_NONUD, IPIF_PRIVATE, IPIF_ANYCAST, IPIF_PREFERRED, and
11809 	 * IPIF_NOFAILOVER.  This is done by bring the ipif down, changing the
11810 	 * flags and bringing it back up again.  For IPIF_NOFAILOVER, the act
11811 	 * of bringing it back up will trigger the address to be moved.
11812 	 */
11813 	if ((turn_on|turn_off) &
11814 	    (IPIF_UP|IPIF_DEPRECATED|IPIF_NOXMIT|IPIF_NOLOCAL|ILLF_NOARP|
11815 	    ILLF_NONUD|IPIF_PRIVATE|IPIF_ANYCAST|IPIF_PREFERRED|
11816 	    IPIF_NOFAILOVER)) {
11817 		/*
11818 		 * Taking this ipif down, make sure we have
11819 		 * valid net and subnet bcast ire's for other
11820 		 * logical interfaces, if we need them.
11821 		 */
11822 		if (!ipif->ipif_isv6)
11823 			ipif_check_bcast_ires(ipif);
11824 
11825 		if (((ipif->ipif_flags | turn_on) & IPIF_UP) &&
11826 		    !(turn_off & IPIF_UP)) {
11827 			if (ipif->ipif_flags & IPIF_UP)
11828 				ill->ill_logical_down = 1;
11829 			turn_on &= ~IPIF_UP;
11830 		}
11831 		err = ipif_down(ipif, q, mp);
11832 		ip1dbg(("ipif_down returns %d err ", err));
11833 		if (err == EINPROGRESS)
11834 			return (err);
11835 		ipif_down_tail(ipif);
11836 	}
11837 	return (ip_sioctl_flags_tail(ipif, flags, q, mp));
11838 }
11839 
11840 static int
11841 ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q, mblk_t *mp)
11842 {
11843 	ill_t	*ill;
11844 	phyint_t *phyi;
11845 	uint64_t turn_on, turn_off;
11846 	uint64_t intf_flags, cantchange_flags;
11847 	boolean_t phyint_flags_modified = B_FALSE;
11848 	int	err = 0;
11849 	boolean_t set_linklocal = B_FALSE;
11850 	boolean_t zero_source = B_FALSE;
11851 
11852 	ip1dbg(("ip_sioctl_flags_tail(%s:%u)\n",
11853 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
11854 
11855 	ASSERT(IAM_WRITER_IPIF(ipif));
11856 
11857 	ill = ipif->ipif_ill;
11858 	phyi = ill->ill_phyint;
11859 
11860 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
11861 	cantchange_flags = IFF_CANTCHANGE | IFF_UP;
11862 	if (IS_IPMP(ill))
11863 		cantchange_flags |= IFF_IPMP_CANTCHANGE;
11864 
11865 	turn_on = (flags ^ intf_flags) & ~cantchange_flags;
11866 	turn_off = intf_flags & turn_on;
11867 	turn_on ^= turn_off;
11868 
11869 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
11870 		phyint_flags_modified = B_TRUE;
11871 
11872 	/*
11873 	 * Now we change the flags. Track current value of
11874 	 * other flags in their respective places.
11875 	 */
11876 	mutex_enter(&ill->ill_lock);
11877 	mutex_enter(&phyi->phyint_lock);
11878 	ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
11879 	ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
11880 	ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
11881 	ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
11882 	phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
11883 	phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
11884 	if (ipif->ipif_state_flags & IPIF_SET_LINKLOCAL) {
11885 		set_linklocal = B_TRUE;
11886 		ipif->ipif_state_flags &= ~IPIF_SET_LINKLOCAL;
11887 	}
11888 	if (ipif->ipif_state_flags & IPIF_ZERO_SOURCE) {
11889 		zero_source = B_TRUE;
11890 		ipif->ipif_state_flags &= ~IPIF_ZERO_SOURCE;
11891 	}
11892 	mutex_exit(&ill->ill_lock);
11893 	mutex_exit(&phyi->phyint_lock);
11894 
11895 	if (set_linklocal)
11896 		(void) ipif_setlinklocal(ipif);
11897 
11898 	if (zero_source)
11899 		ipif->ipif_v6src_addr = ipv6_all_zeros;
11900 	else
11901 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
11902 
11903 	/*
11904 	 * PHYI_FAILED, PHYI_INACTIVE, and PHYI_OFFLINE are all the same to
11905 	 * the kernel: if any of them has been set by userland, the interface
11906 	 * cannot be used for data traffic.
11907 	 */
11908 	if ((turn_on|turn_off) & (PHYI_FAILED | PHYI_INACTIVE | PHYI_OFFLINE)) {
11909 		ASSERT(!IS_IPMP(ill));
11910 		/*
11911 		 * It's possible the ill is part of an "anonymous" IPMP group
11912 		 * rather than a real group.  In that case, there are no other
11913 		 * interfaces in the group and thus no need for us to call
11914 		 * ipmp_phyint_refresh_active().
11915 		 */
11916 		if (IS_UNDER_IPMP(ill))
11917 			ipmp_phyint_refresh_active(phyi);
11918 	}
11919 
11920 	if ((flags & IFF_UP) && !(ipif->ipif_flags & IPIF_UP)) {
11921 		/*
11922 		 * XXX ipif_up really does not know whether a phyint flags
11923 		 * was modified or not. So, it sends up information on
11924 		 * only one routing sockets message. As we don't bring up
11925 		 * the interface and also set PHYI_ flags simultaneously
11926 		 * it should be okay.
11927 		 */
11928 		err = ipif_up(ipif, q, mp);
11929 	} else {
11930 		/*
11931 		 * Make sure routing socket sees all changes to the flags.
11932 		 * ipif_up_done* handles this when we use ipif_up.
11933 		 */
11934 		if (phyint_flags_modified) {
11935 			if (phyi->phyint_illv4 != NULL) {
11936 				ip_rts_ifmsg(phyi->phyint_illv4->
11937 				    ill_ipif, RTSQ_DEFAULT);
11938 			}
11939 			if (phyi->phyint_illv6 != NULL) {
11940 				ip_rts_ifmsg(phyi->phyint_illv6->
11941 				    ill_ipif, RTSQ_DEFAULT);
11942 			}
11943 		} else {
11944 			ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
11945 		}
11946 		/*
11947 		 * Update the flags in SCTP's IPIF list, ipif_up() will do
11948 		 * this in need_up case.
11949 		 */
11950 		sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
11951 	}
11952 	return (err);
11953 }
11954 
11955 /*
11956  * Restart the flags operation now that the refcounts have dropped to zero.
11957  */
11958 /* ARGSUSED */
11959 int
11960 ip_sioctl_flags_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11961     ip_ioctl_cmd_t *ipip, void *if_req)
11962 {
11963 	uint64_t flags;
11964 	struct ifreq *ifr = if_req;
11965 	struct lifreq *lifr = if_req;
11966 
11967 	ip1dbg(("ip_sioctl_flags_restart(%s:%u %p)\n",
11968 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11969 
11970 	ipif_down_tail(ipif);
11971 	if (ipip->ipi_cmd_type == IF_CMD) {
11972 		/* cast to uint16_t prevents unwanted sign extension */
11973 		flags = (uint16_t)ifr->ifr_flags;
11974 	} else {
11975 		flags = lifr->lifr_flags;
11976 	}
11977 	return (ip_sioctl_flags_tail(ipif, flags, q, mp));
11978 }
11979 
11980 /*
11981  * Can operate on either a module or a driver queue.
11982  */
11983 /* ARGSUSED */
11984 int
11985 ip_sioctl_get_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11986     ip_ioctl_cmd_t *ipip, void *if_req)
11987 {
11988 	/*
11989 	 * Has the flags been set correctly till now ?
11990 	 */
11991 	ill_t *ill = ipif->ipif_ill;
11992 	phyint_t *phyi = ill->ill_phyint;
11993 
11994 	ip1dbg(("ip_sioctl_get_flags(%s:%u %p)\n",
11995 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11996 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
11997 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
11998 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
11999 
12000 	/*
12001 	 * Need a lock since some flags can be set even when there are
12002 	 * references to the ipif.
12003 	 */
12004 	mutex_enter(&ill->ill_lock);
12005 	if (ipip->ipi_cmd_type == IF_CMD) {
12006 		struct ifreq *ifr = (struct ifreq *)if_req;
12007 
12008 		/* Get interface flags (low 16 only). */
12009 		ifr->ifr_flags = ((ipif->ipif_flags |
12010 		    ill->ill_flags | phyi->phyint_flags) & 0xffff);
12011 	} else {
12012 		struct lifreq *lifr = (struct lifreq *)if_req;
12013 
12014 		/* Get interface flags. */
12015 		lifr->lifr_flags = ipif->ipif_flags |
12016 		    ill->ill_flags | phyi->phyint_flags;
12017 	}
12018 	mutex_exit(&ill->ill_lock);
12019 	return (0);
12020 }
12021 
12022 /* ARGSUSED */
12023 int
12024 ip_sioctl_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12025     ip_ioctl_cmd_t *ipip, void *if_req)
12026 {
12027 	int mtu;
12028 	int ip_min_mtu;
12029 	struct ifreq	*ifr;
12030 	struct lifreq *lifr;
12031 	ire_t	*ire;
12032 	ip_stack_t *ipst;
12033 
12034 	ip1dbg(("ip_sioctl_mtu(%s:%u %p)\n", ipif->ipif_ill->ill_name,
12035 	    ipif->ipif_id, (void *)ipif));
12036 	if (ipip->ipi_cmd_type == IF_CMD) {
12037 		ifr = (struct ifreq *)if_req;
12038 		mtu = ifr->ifr_metric;
12039 	} else {
12040 		lifr = (struct lifreq *)if_req;
12041 		mtu = lifr->lifr_mtu;
12042 	}
12043 
12044 	if (ipif->ipif_isv6)
12045 		ip_min_mtu = IPV6_MIN_MTU;
12046 	else
12047 		ip_min_mtu = IP_MIN_MTU;
12048 
12049 	if (mtu > ipif->ipif_ill->ill_max_frag || mtu < ip_min_mtu)
12050 		return (EINVAL);
12051 
12052 	/*
12053 	 * Change the MTU size in all relevant ire's.
12054 	 * Mtu change Vs. new ire creation - protocol below.
12055 	 * First change ipif_mtu and the ire_max_frag of the
12056 	 * interface ire. Then do an ire walk and change the
12057 	 * ire_max_frag of all affected ires. During ire_add
12058 	 * under the bucket lock, set the ire_max_frag of the
12059 	 * new ire being created from the ipif/ire from which
12060 	 * it is being derived. If an mtu change happens after
12061 	 * the ire is added, the new ire will be cleaned up.
12062 	 * Conversely if the mtu change happens before the ire
12063 	 * is added, ire_add will see the new value of the mtu.
12064 	 */
12065 	ipif->ipif_mtu = mtu;
12066 	ipif->ipif_flags |= IPIF_FIXEDMTU;
12067 
12068 	if (ipif->ipif_isv6)
12069 		ire = ipif_to_ire_v6(ipif);
12070 	else
12071 		ire = ipif_to_ire(ipif);
12072 	if (ire != NULL) {
12073 		ire->ire_max_frag = ipif->ipif_mtu;
12074 		ire_refrele(ire);
12075 	}
12076 	ipst = ipif->ipif_ill->ill_ipst;
12077 	if (ipif->ipif_flags & IPIF_UP) {
12078 		if (ipif->ipif_isv6)
12079 			ire_walk_v6(ipif_mtu_change, (char *)ipif, ALL_ZONES,
12080 			    ipst);
12081 		else
12082 			ire_walk_v4(ipif_mtu_change, (char *)ipif, ALL_ZONES,
12083 			    ipst);
12084 	}
12085 	/* Update the MTU in SCTP's list */
12086 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
12087 	return (0);
12088 }
12089 
12090 /* Get interface MTU. */
12091 /* ARGSUSED */
12092 int
12093 ip_sioctl_get_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12094 	ip_ioctl_cmd_t *ipip, void *if_req)
12095 {
12096 	struct ifreq	*ifr;
12097 	struct lifreq	*lifr;
12098 
12099 	ip1dbg(("ip_sioctl_get_mtu(%s:%u %p)\n",
12100 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12101 	if (ipip->ipi_cmd_type == IF_CMD) {
12102 		ifr = (struct ifreq *)if_req;
12103 		ifr->ifr_metric = ipif->ipif_mtu;
12104 	} else {
12105 		lifr = (struct lifreq *)if_req;
12106 		lifr->lifr_mtu = ipif->ipif_mtu;
12107 	}
12108 	return (0);
12109 }
12110 
12111 /* Set interface broadcast address. */
12112 /* ARGSUSED2 */
12113 int
12114 ip_sioctl_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12115 	ip_ioctl_cmd_t *ipip, void *if_req)
12116 {
12117 	ipaddr_t addr;
12118 	ire_t	*ire;
12119 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
12120 
12121 	ip1dbg(("ip_sioctl_brdaddr(%s:%u)\n", ipif->ipif_ill->ill_name,
12122 	    ipif->ipif_id));
12123 
12124 	ASSERT(IAM_WRITER_IPIF(ipif));
12125 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
12126 		return (EADDRNOTAVAIL);
12127 
12128 	ASSERT(!(ipif->ipif_isv6));	/* No IPv6 broadcast */
12129 
12130 	if (sin->sin_family != AF_INET)
12131 		return (EAFNOSUPPORT);
12132 
12133 	addr = sin->sin_addr.s_addr;
12134 	if (ipif->ipif_flags & IPIF_UP) {
12135 		/*
12136 		 * If we are already up, make sure the new
12137 		 * broadcast address makes sense.  If it does,
12138 		 * there should be an IRE for it already.
12139 		 * Don't match on ipif, only on the ill
12140 		 * since we are sharing these now.
12141 		 */
12142 		ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST,
12143 		    ipif, ALL_ZONES, NULL,
12144 		    (MATCH_IRE_ILL | MATCH_IRE_TYPE), ipst);
12145 		if (ire == NULL) {
12146 			return (EINVAL);
12147 		} else {
12148 			ire_refrele(ire);
12149 		}
12150 	}
12151 	/*
12152 	 * Changing the broadcast addr for this ipif.
12153 	 * Make sure we have valid net and subnet bcast
12154 	 * ire's for other logical interfaces, if needed.
12155 	 */
12156 	if (addr != ipif->ipif_brd_addr)
12157 		ipif_check_bcast_ires(ipif);
12158 	IN6_IPADDR_TO_V4MAPPED(addr, &ipif->ipif_v6brd_addr);
12159 	return (0);
12160 }
12161 
12162 /* Get interface broadcast address. */
12163 /* ARGSUSED */
12164 int
12165 ip_sioctl_get_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12166     ip_ioctl_cmd_t *ipip, void *if_req)
12167 {
12168 	ip1dbg(("ip_sioctl_get_brdaddr(%s:%u %p)\n",
12169 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12170 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
12171 		return (EADDRNOTAVAIL);
12172 
12173 	/* IPIF_BROADCAST not possible with IPv6 */
12174 	ASSERT(!ipif->ipif_isv6);
12175 	*sin = sin_null;
12176 	sin->sin_family = AF_INET;
12177 	sin->sin_addr.s_addr = ipif->ipif_brd_addr;
12178 	return (0);
12179 }
12180 
12181 /*
12182  * This routine is called to handle the SIOCS*IFNETMASK IOCTL.
12183  */
12184 /* ARGSUSED */
12185 int
12186 ip_sioctl_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12187     ip_ioctl_cmd_t *ipip, void *if_req)
12188 {
12189 	int err = 0;
12190 	in6_addr_t v6mask;
12191 
12192 	ip1dbg(("ip_sioctl_netmask(%s:%u %p)\n",
12193 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12194 
12195 	ASSERT(IAM_WRITER_IPIF(ipif));
12196 
12197 	if (ipif->ipif_isv6) {
12198 		sin6_t *sin6;
12199 
12200 		if (sin->sin_family != AF_INET6)
12201 			return (EAFNOSUPPORT);
12202 
12203 		sin6 = (sin6_t *)sin;
12204 		v6mask = sin6->sin6_addr;
12205 	} else {
12206 		ipaddr_t mask;
12207 
12208 		if (sin->sin_family != AF_INET)
12209 			return (EAFNOSUPPORT);
12210 
12211 		mask = sin->sin_addr.s_addr;
12212 		V4MASK_TO_V6(mask, v6mask);
12213 	}
12214 
12215 	/*
12216 	 * No big deal if the interface isn't already up, or the mask
12217 	 * isn't really changing, or this is pt-pt.
12218 	 */
12219 	if (!(ipif->ipif_flags & IPIF_UP) ||
12220 	    IN6_ARE_ADDR_EQUAL(&v6mask, &ipif->ipif_v6net_mask) ||
12221 	    (ipif->ipif_flags & IPIF_POINTOPOINT)) {
12222 		ipif->ipif_v6net_mask = v6mask;
12223 		if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
12224 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
12225 			    ipif->ipif_v6net_mask,
12226 			    ipif->ipif_v6subnet);
12227 		}
12228 		return (0);
12229 	}
12230 	/*
12231 	 * Make sure we have valid net and subnet broadcast ire's
12232 	 * for the old netmask, if needed by other logical interfaces.
12233 	 */
12234 	if (!ipif->ipif_isv6)
12235 		ipif_check_bcast_ires(ipif);
12236 
12237 	err = ipif_logical_down(ipif, q, mp);
12238 	if (err == EINPROGRESS)
12239 		return (err);
12240 	ipif_down_tail(ipif);
12241 	err = ip_sioctl_netmask_tail(ipif, sin, q, mp);
12242 	return (err);
12243 }
12244 
12245 static int
12246 ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp)
12247 {
12248 	in6_addr_t v6mask;
12249 	int err = 0;
12250 
12251 	ip1dbg(("ip_sioctl_netmask_tail(%s:%u %p)\n",
12252 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12253 
12254 	if (ipif->ipif_isv6) {
12255 		sin6_t *sin6;
12256 
12257 		sin6 = (sin6_t *)sin;
12258 		v6mask = sin6->sin6_addr;
12259 	} else {
12260 		ipaddr_t mask;
12261 
12262 		mask = sin->sin_addr.s_addr;
12263 		V4MASK_TO_V6(mask, v6mask);
12264 	}
12265 
12266 	ipif->ipif_v6net_mask = v6mask;
12267 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
12268 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
12269 		    ipif->ipif_v6subnet);
12270 	}
12271 	err = ipif_up(ipif, q, mp);
12272 
12273 	if (err == 0 || err == EINPROGRESS) {
12274 		/*
12275 		 * The interface must be DL_BOUND if this packet has to
12276 		 * go out on the wire. Since we only go through a logical
12277 		 * down and are bound with the driver during an internal
12278 		 * down/up that is satisfied.
12279 		 */
12280 		if (!ipif->ipif_isv6 && ipif->ipif_ill->ill_wq != NULL) {
12281 			/* Potentially broadcast an address mask reply. */
12282 			ipif_mask_reply(ipif);
12283 		}
12284 	}
12285 	return (err);
12286 }
12287 
12288 /* ARGSUSED */
12289 int
12290 ip_sioctl_netmask_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12291     ip_ioctl_cmd_t *ipip, void *if_req)
12292 {
12293 	ip1dbg(("ip_sioctl_netmask_restart(%s:%u %p)\n",
12294 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12295 	ipif_down_tail(ipif);
12296 	return (ip_sioctl_netmask_tail(ipif, sin, q, mp));
12297 }
12298 
12299 /* Get interface net mask. */
12300 /* ARGSUSED */
12301 int
12302 ip_sioctl_get_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12303     ip_ioctl_cmd_t *ipip, void *if_req)
12304 {
12305 	struct lifreq *lifr = (struct lifreq *)if_req;
12306 	struct sockaddr_in6 *sin6 = (sin6_t *)sin;
12307 
12308 	ip1dbg(("ip_sioctl_get_netmask(%s:%u %p)\n",
12309 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12310 
12311 	/*
12312 	 * net mask can't change since we have a reference to the ipif.
12313 	 */
12314 	if (ipif->ipif_isv6) {
12315 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
12316 		*sin6 = sin6_null;
12317 		sin6->sin6_family = AF_INET6;
12318 		sin6->sin6_addr = ipif->ipif_v6net_mask;
12319 		lifr->lifr_addrlen =
12320 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
12321 	} else {
12322 		*sin = sin_null;
12323 		sin->sin_family = AF_INET;
12324 		sin->sin_addr.s_addr = ipif->ipif_net_mask;
12325 		if (ipip->ipi_cmd_type == LIF_CMD) {
12326 			lifr->lifr_addrlen =
12327 			    ip_mask_to_plen(ipif->ipif_net_mask);
12328 		}
12329 	}
12330 	return (0);
12331 }
12332 
12333 /* ARGSUSED */
12334 int
12335 ip_sioctl_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12336     ip_ioctl_cmd_t *ipip, void *if_req)
12337 {
12338 	ip1dbg(("ip_sioctl_metric(%s:%u %p)\n",
12339 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12340 
12341 	/*
12342 	 * Since no applications should ever be setting metrics on underlying
12343 	 * interfaces, we explicitly fail to smoke 'em out.
12344 	 */
12345 	if (IS_UNDER_IPMP(ipif->ipif_ill))
12346 		return (EINVAL);
12347 
12348 	/*
12349 	 * Set interface metric.  We don't use this for
12350 	 * anything but we keep track of it in case it is
12351 	 * important to routing applications or such.
12352 	 */
12353 	if (ipip->ipi_cmd_type == IF_CMD) {
12354 		struct ifreq    *ifr;
12355 
12356 		ifr = (struct ifreq *)if_req;
12357 		ipif->ipif_metric = ifr->ifr_metric;
12358 	} else {
12359 		struct lifreq   *lifr;
12360 
12361 		lifr = (struct lifreq *)if_req;
12362 		ipif->ipif_metric = lifr->lifr_metric;
12363 	}
12364 	return (0);
12365 }
12366 
12367 /* ARGSUSED */
12368 int
12369 ip_sioctl_get_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12370     ip_ioctl_cmd_t *ipip, void *if_req)
12371 {
12372 	/* Get interface metric. */
12373 	ip1dbg(("ip_sioctl_get_metric(%s:%u %p)\n",
12374 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12375 
12376 	if (ipip->ipi_cmd_type == IF_CMD) {
12377 		struct ifreq    *ifr;
12378 
12379 		ifr = (struct ifreq *)if_req;
12380 		ifr->ifr_metric = ipif->ipif_metric;
12381 	} else {
12382 		struct lifreq   *lifr;
12383 
12384 		lifr = (struct lifreq *)if_req;
12385 		lifr->lifr_metric = ipif->ipif_metric;
12386 	}
12387 
12388 	return (0);
12389 }
12390 
12391 /* ARGSUSED */
12392 int
12393 ip_sioctl_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12394     ip_ioctl_cmd_t *ipip, void *if_req)
12395 {
12396 
12397 	ip1dbg(("ip_sioctl_muxid(%s:%u %p)\n",
12398 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12399 	/*
12400 	 * Set the muxid returned from I_PLINK.
12401 	 */
12402 	if (ipip->ipi_cmd_type == IF_CMD) {
12403 		struct ifreq *ifr = (struct ifreq *)if_req;
12404 
12405 		ipif->ipif_ill->ill_ip_muxid = ifr->ifr_ip_muxid;
12406 		ipif->ipif_ill->ill_arp_muxid = ifr->ifr_arp_muxid;
12407 	} else {
12408 		struct lifreq *lifr = (struct lifreq *)if_req;
12409 
12410 		ipif->ipif_ill->ill_ip_muxid = lifr->lifr_ip_muxid;
12411 		ipif->ipif_ill->ill_arp_muxid = lifr->lifr_arp_muxid;
12412 	}
12413 	return (0);
12414 }
12415 
12416 /* ARGSUSED */
12417 int
12418 ip_sioctl_get_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12419     ip_ioctl_cmd_t *ipip, void *if_req)
12420 {
12421 
12422 	ip1dbg(("ip_sioctl_get_muxid(%s:%u %p)\n",
12423 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12424 	/*
12425 	 * Get the muxid saved in ill for I_PUNLINK.
12426 	 */
12427 	if (ipip->ipi_cmd_type == IF_CMD) {
12428 		struct ifreq *ifr = (struct ifreq *)if_req;
12429 
12430 		ifr->ifr_ip_muxid = ipif->ipif_ill->ill_ip_muxid;
12431 		ifr->ifr_arp_muxid = ipif->ipif_ill->ill_arp_muxid;
12432 	} else {
12433 		struct lifreq *lifr = (struct lifreq *)if_req;
12434 
12435 		lifr->lifr_ip_muxid = ipif->ipif_ill->ill_ip_muxid;
12436 		lifr->lifr_arp_muxid = ipif->ipif_ill->ill_arp_muxid;
12437 	}
12438 	return (0);
12439 }
12440 
12441 /*
12442  * Set the subnet prefix. Does not modify the broadcast address.
12443  */
12444 /* ARGSUSED */
12445 int
12446 ip_sioctl_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12447     ip_ioctl_cmd_t *ipip, void *if_req)
12448 {
12449 	int err = 0;
12450 	in6_addr_t v6addr;
12451 	in6_addr_t v6mask;
12452 	boolean_t need_up = B_FALSE;
12453 	int addrlen;
12454 
12455 	ip1dbg(("ip_sioctl_subnet(%s:%u %p)\n",
12456 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12457 
12458 	ASSERT(IAM_WRITER_IPIF(ipif));
12459 	addrlen = ((struct lifreq *)if_req)->lifr_addrlen;
12460 
12461 	if (ipif->ipif_isv6) {
12462 		sin6_t *sin6;
12463 
12464 		if (sin->sin_family != AF_INET6)
12465 			return (EAFNOSUPPORT);
12466 
12467 		sin6 = (sin6_t *)sin;
12468 		v6addr = sin6->sin6_addr;
12469 		if (!ip_remote_addr_ok_v6(&v6addr, &ipv6_all_ones))
12470 			return (EADDRNOTAVAIL);
12471 	} else {
12472 		ipaddr_t addr;
12473 
12474 		if (sin->sin_family != AF_INET)
12475 			return (EAFNOSUPPORT);
12476 
12477 		addr = sin->sin_addr.s_addr;
12478 		if (!ip_addr_ok_v4(addr, 0xFFFFFFFF))
12479 			return (EADDRNOTAVAIL);
12480 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
12481 		/* Add 96 bits */
12482 		addrlen += IPV6_ABITS - IP_ABITS;
12483 	}
12484 
12485 	if (ip_plen_to_mask_v6(addrlen, &v6mask) == NULL)
12486 		return (EINVAL);
12487 
12488 	/* Check if bits in the address is set past the mask */
12489 	if (!V6_MASK_EQ(v6addr, v6mask, v6addr))
12490 		return (EINVAL);
12491 
12492 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6subnet, &v6addr) &&
12493 	    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6net_mask, &v6mask))
12494 		return (0);	/* No change */
12495 
12496 	if (ipif->ipif_flags & IPIF_UP) {
12497 		/*
12498 		 * If the interface is already marked up,
12499 		 * we call ipif_down which will take care
12500 		 * of ditching any IREs that have been set
12501 		 * up based on the old interface address.
12502 		 */
12503 		err = ipif_logical_down(ipif, q, mp);
12504 		if (err == EINPROGRESS)
12505 			return (err);
12506 		ipif_down_tail(ipif);
12507 		need_up = B_TRUE;
12508 	}
12509 
12510 	err = ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, need_up);
12511 	return (err);
12512 }
12513 
12514 static int
12515 ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t v6addr, in6_addr_t v6mask,
12516     queue_t *q, mblk_t *mp, boolean_t need_up)
12517 {
12518 	ill_t	*ill = ipif->ipif_ill;
12519 	int	err = 0;
12520 
12521 	ip1dbg(("ip_sioctl_subnet_tail(%s:%u %p)\n",
12522 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12523 
12524 	/* Set the new address. */
12525 	mutex_enter(&ill->ill_lock);
12526 	ipif->ipif_v6net_mask = v6mask;
12527 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
12528 		V6_MASK_COPY(v6addr, ipif->ipif_v6net_mask,
12529 		    ipif->ipif_v6subnet);
12530 	}
12531 	mutex_exit(&ill->ill_lock);
12532 
12533 	if (need_up) {
12534 		/*
12535 		 * Now bring the interface back up.  If this
12536 		 * is the only IPIF for the ILL, ipif_up
12537 		 * will have to re-bind to the device, so
12538 		 * we may get back EINPROGRESS, in which
12539 		 * case, this IOCTL will get completed in
12540 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
12541 		 */
12542 		err = ipif_up(ipif, q, mp);
12543 		if (err == EINPROGRESS)
12544 			return (err);
12545 	}
12546 	return (err);
12547 }
12548 
12549 /* ARGSUSED */
12550 int
12551 ip_sioctl_subnet_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12552     ip_ioctl_cmd_t *ipip, void *if_req)
12553 {
12554 	int	addrlen;
12555 	in6_addr_t v6addr;
12556 	in6_addr_t v6mask;
12557 	struct lifreq *lifr = (struct lifreq *)if_req;
12558 
12559 	ip1dbg(("ip_sioctl_subnet_restart(%s:%u %p)\n",
12560 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12561 	ipif_down_tail(ipif);
12562 
12563 	addrlen = lifr->lifr_addrlen;
12564 	if (ipif->ipif_isv6) {
12565 		sin6_t *sin6;
12566 
12567 		sin6 = (sin6_t *)sin;
12568 		v6addr = sin6->sin6_addr;
12569 	} else {
12570 		ipaddr_t addr;
12571 
12572 		addr = sin->sin_addr.s_addr;
12573 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
12574 		addrlen += IPV6_ABITS - IP_ABITS;
12575 	}
12576 	(void) ip_plen_to_mask_v6(addrlen, &v6mask);
12577 
12578 	return (ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, B_TRUE));
12579 }
12580 
12581 /* ARGSUSED */
12582 int
12583 ip_sioctl_get_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12584     ip_ioctl_cmd_t *ipip, void *if_req)
12585 {
12586 	struct lifreq *lifr = (struct lifreq *)if_req;
12587 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sin;
12588 
12589 	ip1dbg(("ip_sioctl_get_subnet(%s:%u %p)\n",
12590 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12591 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
12592 
12593 	if (ipif->ipif_isv6) {
12594 		*sin6 = sin6_null;
12595 		sin6->sin6_family = AF_INET6;
12596 		sin6->sin6_addr = ipif->ipif_v6subnet;
12597 		lifr->lifr_addrlen =
12598 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
12599 	} else {
12600 		*sin = sin_null;
12601 		sin->sin_family = AF_INET;
12602 		sin->sin_addr.s_addr = ipif->ipif_subnet;
12603 		lifr->lifr_addrlen = ip_mask_to_plen(ipif->ipif_net_mask);
12604 	}
12605 	return (0);
12606 }
12607 
12608 /*
12609  * Set the IPv6 address token.
12610  */
12611 /* ARGSUSED */
12612 int
12613 ip_sioctl_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12614     ip_ioctl_cmd_t *ipi, void *if_req)
12615 {
12616 	ill_t *ill = ipif->ipif_ill;
12617 	int err;
12618 	in6_addr_t v6addr;
12619 	in6_addr_t v6mask;
12620 	boolean_t need_up = B_FALSE;
12621 	int i;
12622 	sin6_t *sin6 = (sin6_t *)sin;
12623 	struct lifreq *lifr = (struct lifreq *)if_req;
12624 	int addrlen;
12625 
12626 	ip1dbg(("ip_sioctl_token(%s:%u %p)\n",
12627 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12628 	ASSERT(IAM_WRITER_IPIF(ipif));
12629 
12630 	addrlen = lifr->lifr_addrlen;
12631 	/* Only allow for logical unit zero i.e. not on "le0:17" */
12632 	if (ipif->ipif_id != 0)
12633 		return (EINVAL);
12634 
12635 	if (!ipif->ipif_isv6)
12636 		return (EINVAL);
12637 
12638 	if (addrlen > IPV6_ABITS)
12639 		return (EINVAL);
12640 
12641 	v6addr = sin6->sin6_addr;
12642 
12643 	/*
12644 	 * The length of the token is the length from the end.  To get
12645 	 * the proper mask for this, compute the mask of the bits not
12646 	 * in the token; ie. the prefix, and then xor to get the mask.
12647 	 */
12648 	if (ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask) == NULL)
12649 		return (EINVAL);
12650 	for (i = 0; i < 4; i++) {
12651 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
12652 	}
12653 
12654 	if (V6_MASK_EQ(v6addr, v6mask, ill->ill_token) &&
12655 	    ill->ill_token_length == addrlen)
12656 		return (0);	/* No change */
12657 
12658 	if (ipif->ipif_flags & IPIF_UP) {
12659 		err = ipif_logical_down(ipif, q, mp);
12660 		if (err == EINPROGRESS)
12661 			return (err);
12662 		ipif_down_tail(ipif);
12663 		need_up = B_TRUE;
12664 	}
12665 	err = ip_sioctl_token_tail(ipif, sin6, addrlen, q, mp, need_up);
12666 	return (err);
12667 }
12668 
12669 static int
12670 ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen, queue_t *q,
12671     mblk_t *mp, boolean_t need_up)
12672 {
12673 	in6_addr_t v6addr;
12674 	in6_addr_t v6mask;
12675 	ill_t	*ill = ipif->ipif_ill;
12676 	int	i;
12677 	int	err = 0;
12678 
12679 	ip1dbg(("ip_sioctl_token_tail(%s:%u %p)\n",
12680 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12681 	v6addr = sin6->sin6_addr;
12682 	/*
12683 	 * The length of the token is the length from the end.  To get
12684 	 * the proper mask for this, compute the mask of the bits not
12685 	 * in the token; ie. the prefix, and then xor to get the mask.
12686 	 */
12687 	(void) ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask);
12688 	for (i = 0; i < 4; i++)
12689 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
12690 
12691 	mutex_enter(&ill->ill_lock);
12692 	V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
12693 	ill->ill_token_length = addrlen;
12694 	mutex_exit(&ill->ill_lock);
12695 
12696 	if (need_up) {
12697 		/*
12698 		 * Now bring the interface back up.  If this
12699 		 * is the only IPIF for the ILL, ipif_up
12700 		 * will have to re-bind to the device, so
12701 		 * we may get back EINPROGRESS, in which
12702 		 * case, this IOCTL will get completed in
12703 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
12704 		 */
12705 		err = ipif_up(ipif, q, mp);
12706 		if (err == EINPROGRESS)
12707 			return (err);
12708 	}
12709 	return (err);
12710 }
12711 
12712 /* ARGSUSED */
12713 int
12714 ip_sioctl_get_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12715     ip_ioctl_cmd_t *ipi, void *if_req)
12716 {
12717 	ill_t *ill;
12718 	sin6_t *sin6 = (sin6_t *)sin;
12719 	struct lifreq *lifr = (struct lifreq *)if_req;
12720 
12721 	ip1dbg(("ip_sioctl_get_token(%s:%u %p)\n",
12722 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12723 	if (ipif->ipif_id != 0)
12724 		return (EINVAL);
12725 
12726 	ill = ipif->ipif_ill;
12727 	if (!ill->ill_isv6)
12728 		return (ENXIO);
12729 
12730 	*sin6 = sin6_null;
12731 	sin6->sin6_family = AF_INET6;
12732 	ASSERT(!IN6_IS_ADDR_V4MAPPED(&ill->ill_token));
12733 	sin6->sin6_addr = ill->ill_token;
12734 	lifr->lifr_addrlen = ill->ill_token_length;
12735 	return (0);
12736 }
12737 
12738 /*
12739  * Set (hardware) link specific information that might override
12740  * what was acquired through the DL_INFO_ACK.
12741  * The logic is as follows.
12742  *
12743  * become exclusive
12744  * set CHANGING flag
12745  * change mtu on affected IREs
12746  * clear CHANGING flag
12747  *
12748  * An ire add that occurs before the CHANGING flag is set will have its mtu
12749  * changed by the ip_sioctl_lnkinfo.
12750  *
12751  * During the time the CHANGING flag is set, no new ires will be added to the
12752  * bucket, and ire add will fail (due the CHANGING flag).
12753  *
12754  * An ire add that occurs after the CHANGING flag is set will have the right mtu
12755  * before it is added to the bucket.
12756  *
12757  * Obviously only 1 thread can set the CHANGING flag and we need to become
12758  * exclusive to set the flag.
12759  */
12760 /* ARGSUSED */
12761 int
12762 ip_sioctl_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12763     ip_ioctl_cmd_t *ipi, void *if_req)
12764 {
12765 	ill_t		*ill = ipif->ipif_ill;
12766 	ipif_t		*nipif;
12767 	int		ip_min_mtu;
12768 	boolean_t	mtu_walk = B_FALSE;
12769 	struct lifreq	*lifr = (struct lifreq *)if_req;
12770 	lif_ifinfo_req_t *lir;
12771 	ire_t		*ire;
12772 
12773 	ip1dbg(("ip_sioctl_lnkinfo(%s:%u %p)\n",
12774 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12775 	lir = &lifr->lifr_ifinfo;
12776 	ASSERT(IAM_WRITER_IPIF(ipif));
12777 
12778 	/* Only allow for logical unit zero i.e. not on "le0:17" */
12779 	if (ipif->ipif_id != 0)
12780 		return (EINVAL);
12781 
12782 	/* Set interface MTU. */
12783 	if (ipif->ipif_isv6)
12784 		ip_min_mtu = IPV6_MIN_MTU;
12785 	else
12786 		ip_min_mtu = IP_MIN_MTU;
12787 
12788 	/*
12789 	 * Verify values before we set anything. Allow zero to
12790 	 * mean unspecified.
12791 	 */
12792 	if (lir->lir_maxmtu != 0 &&
12793 	    (lir->lir_maxmtu > ill->ill_max_frag ||
12794 	    lir->lir_maxmtu < ip_min_mtu))
12795 		return (EINVAL);
12796 	if (lir->lir_reachtime != 0 &&
12797 	    lir->lir_reachtime > ND_MAX_REACHTIME)
12798 		return (EINVAL);
12799 	if (lir->lir_reachretrans != 0 &&
12800 	    lir->lir_reachretrans > ND_MAX_REACHRETRANSTIME)
12801 		return (EINVAL);
12802 
12803 	mutex_enter(&ill->ill_lock);
12804 	ill->ill_state_flags |= ILL_CHANGING;
12805 	for (nipif = ill->ill_ipif; nipif != NULL;
12806 	    nipif = nipif->ipif_next) {
12807 		nipif->ipif_state_flags |= IPIF_CHANGING;
12808 	}
12809 
12810 	if (lir->lir_maxmtu != 0) {
12811 		ill->ill_max_mtu = lir->lir_maxmtu;
12812 		ill->ill_user_mtu = lir->lir_maxmtu;
12813 		mtu_walk = B_TRUE;
12814 	}
12815 	mutex_exit(&ill->ill_lock);
12816 
12817 	if (lir->lir_reachtime != 0)
12818 		ill->ill_reachable_time = lir->lir_reachtime;
12819 
12820 	if (lir->lir_reachretrans != 0)
12821 		ill->ill_reachable_retrans_time = lir->lir_reachretrans;
12822 
12823 	ill->ill_max_hops = lir->lir_maxhops;
12824 
12825 	ill->ill_max_buf = ND_MAX_Q;
12826 
12827 	if (mtu_walk) {
12828 		/*
12829 		 * Set the MTU on all ipifs associated with this ill except
12830 		 * for those whose MTU was fixed via SIOCSLIFMTU.
12831 		 */
12832 		for (nipif = ill->ill_ipif; nipif != NULL;
12833 		    nipif = nipif->ipif_next) {
12834 			if (nipif->ipif_flags & IPIF_FIXEDMTU)
12835 				continue;
12836 
12837 			nipif->ipif_mtu = ill->ill_max_mtu;
12838 
12839 			if (!(nipif->ipif_flags & IPIF_UP))
12840 				continue;
12841 
12842 			if (nipif->ipif_isv6)
12843 				ire = ipif_to_ire_v6(nipif);
12844 			else
12845 				ire = ipif_to_ire(nipif);
12846 			if (ire != NULL) {
12847 				ire->ire_max_frag = ipif->ipif_mtu;
12848 				ire_refrele(ire);
12849 			}
12850 
12851 			ire_walk_ill(MATCH_IRE_ILL, 0, ipif_mtu_change,
12852 			    nipif, ill);
12853 		}
12854 	}
12855 
12856 	mutex_enter(&ill->ill_lock);
12857 	for (nipif = ill->ill_ipif; nipif != NULL;
12858 	    nipif = nipif->ipif_next) {
12859 		nipif->ipif_state_flags &= ~IPIF_CHANGING;
12860 	}
12861 	ILL_UNMARK_CHANGING(ill);
12862 	mutex_exit(&ill->ill_lock);
12863 
12864 	/*
12865 	 * Refresh IPMP meta-interface MTU if necessary.
12866 	 */
12867 	if (IS_UNDER_IPMP(ill))
12868 		ipmp_illgrp_refresh_mtu(ill->ill_grp);
12869 
12870 	return (0);
12871 }
12872 
12873 /* ARGSUSED */
12874 int
12875 ip_sioctl_get_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12876     ip_ioctl_cmd_t *ipi, void *if_req)
12877 {
12878 	struct lif_ifinfo_req *lir;
12879 	ill_t *ill = ipif->ipif_ill;
12880 
12881 	ip1dbg(("ip_sioctl_get_lnkinfo(%s:%u %p)\n",
12882 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12883 	if (ipif->ipif_id != 0)
12884 		return (EINVAL);
12885 
12886 	lir = &((struct lifreq *)if_req)->lifr_ifinfo;
12887 	lir->lir_maxhops = ill->ill_max_hops;
12888 	lir->lir_reachtime = ill->ill_reachable_time;
12889 	lir->lir_reachretrans = ill->ill_reachable_retrans_time;
12890 	lir->lir_maxmtu = ill->ill_max_mtu;
12891 
12892 	return (0);
12893 }
12894 
12895 /*
12896  * Return best guess as to the subnet mask for the specified address.
12897  * Based on the subnet masks for all the configured interfaces.
12898  *
12899  * We end up returning a zero mask in the case of default, multicast or
12900  * experimental.
12901  */
12902 static ipaddr_t
12903 ip_subnet_mask(ipaddr_t addr, ipif_t **ipifp, ip_stack_t *ipst)
12904 {
12905 	ipaddr_t net_mask;
12906 	ill_t	*ill;
12907 	ipif_t	*ipif;
12908 	ill_walk_context_t ctx;
12909 	ipif_t	*fallback_ipif = NULL;
12910 
12911 	net_mask = ip_net_mask(addr);
12912 	if (net_mask == 0) {
12913 		*ipifp = NULL;
12914 		return (0);
12915 	}
12916 
12917 	/* Let's check to see if this is maybe a local subnet route. */
12918 	/* this function only applies to IPv4 interfaces */
12919 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
12920 	ill = ILL_START_WALK_V4(&ctx, ipst);
12921 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
12922 		mutex_enter(&ill->ill_lock);
12923 		for (ipif = ill->ill_ipif; ipif != NULL;
12924 		    ipif = ipif->ipif_next) {
12925 			if (!IPIF_CAN_LOOKUP(ipif))
12926 				continue;
12927 			if (!(ipif->ipif_flags & IPIF_UP))
12928 				continue;
12929 			if ((ipif->ipif_subnet & net_mask) ==
12930 			    (addr & net_mask)) {
12931 				/*
12932 				 * Don't trust pt-pt interfaces if there are
12933 				 * other interfaces.
12934 				 */
12935 				if (ipif->ipif_flags & IPIF_POINTOPOINT) {
12936 					if (fallback_ipif == NULL) {
12937 						ipif_refhold_locked(ipif);
12938 						fallback_ipif = ipif;
12939 					}
12940 					continue;
12941 				}
12942 
12943 				/*
12944 				 * Fine. Just assume the same net mask as the
12945 				 * directly attached subnet interface is using.
12946 				 */
12947 				ipif_refhold_locked(ipif);
12948 				mutex_exit(&ill->ill_lock);
12949 				rw_exit(&ipst->ips_ill_g_lock);
12950 				if (fallback_ipif != NULL)
12951 					ipif_refrele(fallback_ipif);
12952 				*ipifp = ipif;
12953 				return (ipif->ipif_net_mask);
12954 			}
12955 		}
12956 		mutex_exit(&ill->ill_lock);
12957 	}
12958 	rw_exit(&ipst->ips_ill_g_lock);
12959 
12960 	*ipifp = fallback_ipif;
12961 	return ((fallback_ipif != NULL) ?
12962 	    fallback_ipif->ipif_net_mask : net_mask);
12963 }
12964 
12965 /*
12966  * ip_sioctl_copyin_setup calls ip_wput_ioctl to process the IP_IOCTL ioctl.
12967  */
12968 static void
12969 ip_wput_ioctl(queue_t *q, mblk_t *mp)
12970 {
12971 	IOCP	iocp;
12972 	ipft_t	*ipft;
12973 	ipllc_t	*ipllc;
12974 	mblk_t	*mp1;
12975 	cred_t	*cr;
12976 	int	error = 0;
12977 	conn_t	*connp;
12978 
12979 	ip1dbg(("ip_wput_ioctl"));
12980 	iocp = (IOCP)mp->b_rptr;
12981 	mp1 = mp->b_cont;
12982 	if (mp1 == NULL) {
12983 		iocp->ioc_error = EINVAL;
12984 		mp->b_datap->db_type = M_IOCNAK;
12985 		iocp->ioc_count = 0;
12986 		qreply(q, mp);
12987 		return;
12988 	}
12989 
12990 	/*
12991 	 * These IOCTLs provide various control capabilities to
12992 	 * upstream agents such as ULPs and processes.	There
12993 	 * are currently two such IOCTLs implemented.  They
12994 	 * are used by TCP to provide update information for
12995 	 * existing IREs and to forcibly delete an IRE for a
12996 	 * host that is not responding, thereby forcing an
12997 	 * attempt at a new route.
12998 	 */
12999 	iocp->ioc_error = EINVAL;
13000 	if (!pullupmsg(mp1, sizeof (ipllc->ipllc_cmd)))
13001 		goto done;
13002 
13003 	ipllc = (ipllc_t *)mp1->b_rptr;
13004 	for (ipft = ip_ioctl_ftbl; ipft->ipft_pfi; ipft++) {
13005 		if (ipllc->ipllc_cmd == ipft->ipft_cmd)
13006 			break;
13007 	}
13008 	/*
13009 	 * prefer credential from mblk over ioctl;
13010 	 * see ip_sioctl_copyin_setup
13011 	 */
13012 	cr = msg_getcred(mp, NULL);
13013 	if (cr == NULL)
13014 		cr = iocp->ioc_cr;
13015 
13016 	/*
13017 	 * Refhold the conn in case the request gets queued up in some lookup
13018 	 */
13019 	ASSERT(CONN_Q(q));
13020 	connp = Q_TO_CONN(q);
13021 	CONN_INC_REF(connp);
13022 	if (ipft->ipft_pfi &&
13023 	    ((mp1->b_wptr - mp1->b_rptr) >= ipft->ipft_min_size ||
13024 	    pullupmsg(mp1, ipft->ipft_min_size))) {
13025 		error = (*ipft->ipft_pfi)(q,
13026 		    (ipft->ipft_flags & IPFT_F_SELF_REPLY) ? mp : mp1, cr);
13027 	}
13028 	if (ipft->ipft_flags & IPFT_F_SELF_REPLY) {
13029 		/*
13030 		 * CONN_OPER_PENDING_DONE happens in the function called
13031 		 * through ipft_pfi above.
13032 		 */
13033 		return;
13034 	}
13035 
13036 	CONN_OPER_PENDING_DONE(connp);
13037 	if (ipft->ipft_flags & IPFT_F_NO_REPLY) {
13038 		freemsg(mp);
13039 		return;
13040 	}
13041 	iocp->ioc_error = error;
13042 
13043 done:
13044 	mp->b_datap->db_type = M_IOCACK;
13045 	if (iocp->ioc_error)
13046 		iocp->ioc_count = 0;
13047 	qreply(q, mp);
13048 }
13049 
13050 /*
13051  * Lookup an ipif using the sequence id (ipif_seqid)
13052  */
13053 ipif_t *
13054 ipif_lookup_seqid(ill_t *ill, uint_t seqid)
13055 {
13056 	ipif_t *ipif;
13057 
13058 	ASSERT(MUTEX_HELD(&ill->ill_lock));
13059 
13060 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13061 		if (ipif->ipif_seqid == seqid && IPIF_CAN_LOOKUP(ipif))
13062 			return (ipif);
13063 	}
13064 	return (NULL);
13065 }
13066 
13067 /*
13068  * Assign a unique id for the ipif. This is used later when we send
13069  * IRES to ARP for resolution where we initialize ire_ipif_seqid
13070  * to the value pointed by ire_ipif->ipif_seqid. Later when the
13071  * IRE is added, we verify that ipif has not disappeared.
13072  */
13073 
13074 static void
13075 ipif_assign_seqid(ipif_t *ipif)
13076 {
13077 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
13078 
13079 	ipif->ipif_seqid = atomic_add_64_nv(&ipst->ips_ipif_g_seqid, 1);
13080 }
13081 
13082 /*
13083  * Clone the contents of `sipif' to `dipif'.  Requires that both ipifs are
13084  * administratively down (i.e., no DAD), of the same type, and locked.  Note
13085  * that the clone is complete -- including the seqid -- and the expectation is
13086  * that the caller will either free or overwrite `sipif' before it's unlocked.
13087  */
13088 static void
13089 ipif_clone(const ipif_t *sipif, ipif_t *dipif)
13090 {
13091 	ASSERT(MUTEX_HELD(&sipif->ipif_ill->ill_lock));
13092 	ASSERT(MUTEX_HELD(&dipif->ipif_ill->ill_lock));
13093 	ASSERT(!(sipif->ipif_flags & (IPIF_UP|IPIF_DUPLICATE)));
13094 	ASSERT(!(dipif->ipif_flags & (IPIF_UP|IPIF_DUPLICATE)));
13095 	ASSERT(sipif->ipif_ire_type == dipif->ipif_ire_type);
13096 	ASSERT(sipif->ipif_arp_del_mp == NULL);
13097 	ASSERT(dipif->ipif_arp_del_mp == NULL);
13098 	ASSERT(sipif->ipif_igmp_rpt == NULL);
13099 	ASSERT(dipif->ipif_igmp_rpt == NULL);
13100 	ASSERT(sipif->ipif_multicast_up == 0);
13101 	ASSERT(dipif->ipif_multicast_up == 0);
13102 	ASSERT(sipif->ipif_joined_allhosts == 0);
13103 	ASSERT(dipif->ipif_joined_allhosts == 0);
13104 
13105 	dipif->ipif_mtu = sipif->ipif_mtu;
13106 	dipif->ipif_flags = sipif->ipif_flags;
13107 	dipif->ipif_metric = sipif->ipif_metric;
13108 	dipif->ipif_zoneid = sipif->ipif_zoneid;
13109 	dipif->ipif_v6subnet = sipif->ipif_v6subnet;
13110 	dipif->ipif_v6lcl_addr = sipif->ipif_v6lcl_addr;
13111 	dipif->ipif_v6src_addr = sipif->ipif_v6src_addr;
13112 	dipif->ipif_v6net_mask = sipif->ipif_v6net_mask;
13113 	dipif->ipif_v6brd_addr = sipif->ipif_v6brd_addr;
13114 	dipif->ipif_v6pp_dst_addr = sipif->ipif_v6pp_dst_addr;
13115 
13116 	/*
13117 	 * While dipif is down right now, it might've been up before.  Since
13118 	 * it's changing identity, its packet counters need to be reset.
13119 	 */
13120 	dipif->ipif_ib_pkt_count = 0;
13121 	dipif->ipif_ob_pkt_count = 0;
13122 	dipif->ipif_fo_pkt_count = 0;
13123 
13124 	/*
13125 	 * As per the comment atop the function, we assume that these sipif
13126 	 * fields will be changed before sipif is unlocked.
13127 	 */
13128 	dipif->ipif_seqid = sipif->ipif_seqid;
13129 	dipif->ipif_saved_ire_mp = sipif->ipif_saved_ire_mp;
13130 	dipif->ipif_saved_ire_cnt = sipif->ipif_saved_ire_cnt;
13131 	dipif->ipif_state_flags = sipif->ipif_state_flags;
13132 }
13133 
13134 /*
13135  * Transfer the contents of `sipif' to `dipif', and then free (if `virgipif'
13136  * is NULL) or overwrite `sipif' with `virgipif', which must be a virgin
13137  * (unreferenced) ipif.  Also, if `sipif' is used by the current xop, then
13138  * transfer the xop to `dipif'.  Requires that all ipifs are administratively
13139  * down (i.e., no DAD), of the same type, and unlocked.
13140  */
13141 static void
13142 ipif_transfer(ipif_t *sipif, ipif_t *dipif, ipif_t *virgipif)
13143 {
13144 	ipsq_t *ipsq = sipif->ipif_ill->ill_phyint->phyint_ipsq;
13145 	ipxop_t *ipx = ipsq->ipsq_xop;
13146 
13147 	ASSERT(sipif != dipif);
13148 	ASSERT(sipif != virgipif);
13149 
13150 	/*
13151 	 * Grab all of the locks that protect the ipif in a defined order.
13152 	 */
13153 	GRAB_ILL_LOCKS(sipif->ipif_ill, dipif->ipif_ill);
13154 	if (sipif > dipif) {
13155 		mutex_enter(&sipif->ipif_saved_ire_lock);
13156 		mutex_enter(&dipif->ipif_saved_ire_lock);
13157 	} else {
13158 		mutex_enter(&dipif->ipif_saved_ire_lock);
13159 		mutex_enter(&sipif->ipif_saved_ire_lock);
13160 	}
13161 
13162 	ipif_clone(sipif, dipif);
13163 	if (virgipif != NULL) {
13164 		ipif_clone(virgipif, sipif);
13165 		mi_free(virgipif);
13166 	}
13167 
13168 	mutex_exit(&sipif->ipif_saved_ire_lock);
13169 	mutex_exit(&dipif->ipif_saved_ire_lock);
13170 	RELEASE_ILL_LOCKS(sipif->ipif_ill, dipif->ipif_ill);
13171 
13172 	/*
13173 	 * Transfer ownership of the current xop, if necessary.
13174 	 */
13175 	if (ipx->ipx_current_ipif == sipif) {
13176 		ASSERT(ipx->ipx_pending_ipif == NULL);
13177 		mutex_enter(&ipx->ipx_lock);
13178 		ipx->ipx_current_ipif = dipif;
13179 		mutex_exit(&ipx->ipx_lock);
13180 	}
13181 
13182 	if (virgipif == NULL)
13183 		mi_free(sipif);
13184 }
13185 
13186 /*
13187  * Insert the ipif, so that the list of ipifs on the ill will be sorted
13188  * with respect to ipif_id. Note that an ipif with an ipif_id of -1 will
13189  * be inserted into the first space available in the list. The value of
13190  * ipif_id will then be set to the appropriate value for its position.
13191  */
13192 static int
13193 ipif_insert(ipif_t *ipif, boolean_t acquire_g_lock)
13194 {
13195 	ill_t *ill;
13196 	ipif_t *tipif;
13197 	ipif_t **tipifp;
13198 	int id;
13199 	ip_stack_t	*ipst;
13200 
13201 	ASSERT(ipif->ipif_ill->ill_net_type == IRE_LOOPBACK ||
13202 	    IAM_WRITER_IPIF(ipif));
13203 
13204 	ill = ipif->ipif_ill;
13205 	ASSERT(ill != NULL);
13206 	ipst = ill->ill_ipst;
13207 
13208 	/*
13209 	 * In the case of lo0:0 we already hold the ill_g_lock.
13210 	 * ill_lookup_on_name (acquires ill_g_lock) -> ipif_allocate ->
13211 	 * ipif_insert.
13212 	 */
13213 	if (acquire_g_lock)
13214 		rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
13215 	mutex_enter(&ill->ill_lock);
13216 	id = ipif->ipif_id;
13217 	tipifp = &(ill->ill_ipif);
13218 	if (id == -1) {	/* need to find a real id */
13219 		id = 0;
13220 		while ((tipif = *tipifp) != NULL) {
13221 			ASSERT(tipif->ipif_id >= id);
13222 			if (tipif->ipif_id != id)
13223 				break; /* non-consecutive id */
13224 			id++;
13225 			tipifp = &(tipif->ipif_next);
13226 		}
13227 		/* limit number of logical interfaces */
13228 		if (id >= ipst->ips_ip_addrs_per_if) {
13229 			mutex_exit(&ill->ill_lock);
13230 			if (acquire_g_lock)
13231 				rw_exit(&ipst->ips_ill_g_lock);
13232 			return (-1);
13233 		}
13234 		ipif->ipif_id = id; /* assign new id */
13235 	} else if (id < ipst->ips_ip_addrs_per_if) {
13236 		/* we have a real id; insert ipif in the right place */
13237 		while ((tipif = *tipifp) != NULL) {
13238 			ASSERT(tipif->ipif_id != id);
13239 			if (tipif->ipif_id > id)
13240 				break; /* found correct location */
13241 			tipifp = &(tipif->ipif_next);
13242 		}
13243 	} else {
13244 		mutex_exit(&ill->ill_lock);
13245 		if (acquire_g_lock)
13246 			rw_exit(&ipst->ips_ill_g_lock);
13247 		return (-1);
13248 	}
13249 
13250 	ASSERT(tipifp != &(ill->ill_ipif) || id == 0);
13251 
13252 	ipif->ipif_next = tipif;
13253 	*tipifp = ipif;
13254 	mutex_exit(&ill->ill_lock);
13255 	if (acquire_g_lock)
13256 		rw_exit(&ipst->ips_ill_g_lock);
13257 
13258 	return (0);
13259 }
13260 
13261 static void
13262 ipif_remove(ipif_t *ipif)
13263 {
13264 	ipif_t	**ipifp;
13265 	ill_t	*ill = ipif->ipif_ill;
13266 
13267 	ASSERT(RW_WRITE_HELD(&ill->ill_ipst->ips_ill_g_lock));
13268 
13269 	mutex_enter(&ill->ill_lock);
13270 	ipifp = &ill->ill_ipif;
13271 	for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
13272 		if (*ipifp == ipif) {
13273 			*ipifp = ipif->ipif_next;
13274 			break;
13275 		}
13276 	}
13277 	mutex_exit(&ill->ill_lock);
13278 }
13279 
13280 /*
13281  * Allocate and initialize a new interface control structure.  (Always
13282  * called as writer.)
13283  * When ipif_allocate() is called from ip_ll_subnet_defaults, the ill
13284  * is not part of the global linked list of ills. ipif_seqid is unique
13285  * in the system and to preserve the uniqueness, it is assigned only
13286  * when ill becomes part of the global list. At that point ill will
13287  * have a name. If it doesn't get assigned here, it will get assigned
13288  * in ipif_set_values() as part of SIOCSLIFNAME processing.
13289  * Aditionally, if we come here from ip_ll_subnet_defaults, we don't set
13290  * the interface flags or any other information from the DL_INFO_ACK for
13291  * DL_STYLE2 drivers (initialize == B_FALSE), since we won't have them at
13292  * this point. The flags etc. will be set in ip_ll_subnet_defaults when the
13293  * second DL_INFO_ACK comes in from the driver.
13294  */
13295 static ipif_t *
13296 ipif_allocate(ill_t *ill, int id, uint_t ire_type, boolean_t initialize,
13297     boolean_t insert)
13298 {
13299 	ipif_t	*ipif;
13300 	phyint_t *phyi = ill->ill_phyint;
13301 	ip_stack_t *ipst = ill->ill_ipst;
13302 
13303 	ip1dbg(("ipif_allocate(%s:%d ill %p)\n",
13304 	    ill->ill_name, id, (void *)ill));
13305 	ASSERT(ire_type == IRE_LOOPBACK || IAM_WRITER_ILL(ill));
13306 
13307 	if ((ipif = (ipif_t *)mi_alloc(sizeof (ipif_t), BPRI_MED)) == NULL)
13308 		return (NULL);
13309 	*ipif = ipif_zero;	/* start clean */
13310 
13311 	ipif->ipif_ill = ill;
13312 	ipif->ipif_id = id;	/* could be -1 */
13313 	/*
13314 	 * Inherit the zoneid from the ill; for the shared stack instance
13315 	 * this is always the global zone
13316 	 */
13317 	ipif->ipif_zoneid = ill->ill_zoneid;
13318 
13319 	mutex_init(&ipif->ipif_saved_ire_lock, NULL, MUTEX_DEFAULT, NULL);
13320 
13321 	ipif->ipif_refcnt = 0;
13322 	ipif->ipif_saved_ire_cnt = 0;
13323 
13324 	if (insert) {
13325 		if (ipif_insert(ipif, ire_type != IRE_LOOPBACK) != 0) {
13326 			mi_free(ipif);
13327 			return (NULL);
13328 		}
13329 		/* -1 id should have been replaced by real id */
13330 		id = ipif->ipif_id;
13331 		ASSERT(id >= 0);
13332 	}
13333 
13334 	if (ill->ill_name[0] != '\0')
13335 		ipif_assign_seqid(ipif);
13336 
13337 	/*
13338 	 * If this is ipif zero, configure ill/phyint-wide information.
13339 	 * Defer most configuration until we're guaranteed we're attached.
13340 	 */
13341 	if (id == 0) {
13342 		if (ill->ill_mactype == SUNW_DL_IPMP) {
13343 			/*
13344 			 * Set PHYI_IPMP and also set PHYI_FAILED since there
13345 			 * are no active interfaces.  Similarly, PHYI_RUNNING
13346 			 * isn't set until the group has an active interface.
13347 			 */
13348 			mutex_enter(&phyi->phyint_lock);
13349 			phyi->phyint_flags |= (PHYI_IPMP | PHYI_FAILED);
13350 			mutex_exit(&phyi->phyint_lock);
13351 
13352 			/*
13353 			 * Create the illgrp (which must not exist yet because
13354 			 * the zeroth ipif is created once per ill).  However,
13355 			 * do not not link it to the ipmp_grp_t until I_PLINK
13356 			 * is called; see ip_sioctl_plink_ipmp() for details.
13357 			 */
13358 			if (ipmp_illgrp_create(ill) == NULL) {
13359 				if (insert) {
13360 					rw_enter(&ipst->ips_ill_g_lock,
13361 					    RW_WRITER);
13362 					ipif_remove(ipif);
13363 					rw_exit(&ipst->ips_ill_g_lock);
13364 				}
13365 				mi_free(ipif);
13366 				return (NULL);
13367 			}
13368 		} else {
13369 			/*
13370 			 * By default, PHYI_RUNNING is set when the zeroth
13371 			 * ipif is created.  For other ipifs, we don't touch
13372 			 * it since DLPI notifications may have changed it.
13373 			 */
13374 			mutex_enter(&phyi->phyint_lock);
13375 			phyi->phyint_flags |= PHYI_RUNNING;
13376 			mutex_exit(&phyi->phyint_lock);
13377 		}
13378 	}
13379 
13380 	/*
13381 	 * We grab the ill_lock and phyint_lock to protect the flag changes.
13382 	 * The ipif is still not up and can't be looked up until the
13383 	 * ioctl completes and the IPIF_CHANGING flag is cleared.
13384 	 */
13385 	mutex_enter(&ill->ill_lock);
13386 	mutex_enter(&phyi->phyint_lock);
13387 
13388 	ipif->ipif_ire_type = ire_type;
13389 
13390 	if (ipif->ipif_isv6) {
13391 		ill->ill_flags |= ILLF_IPV6;
13392 	} else {
13393 		ipaddr_t inaddr_any = INADDR_ANY;
13394 
13395 		ill->ill_flags |= ILLF_IPV4;
13396 
13397 		/* Keep the IN6_IS_ADDR_V4MAPPED assertions happy */
13398 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13399 		    &ipif->ipif_v6lcl_addr);
13400 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13401 		    &ipif->ipif_v6src_addr);
13402 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13403 		    &ipif->ipif_v6subnet);
13404 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13405 		    &ipif->ipif_v6net_mask);
13406 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13407 		    &ipif->ipif_v6brd_addr);
13408 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13409 		    &ipif->ipif_v6pp_dst_addr);
13410 	}
13411 
13412 	/*
13413 	 * Don't set the interface flags etc. now, will do it in
13414 	 * ip_ll_subnet_defaults.
13415 	 */
13416 	if (!initialize)
13417 		goto out;
13418 
13419 	ipif->ipif_mtu = ill->ill_max_mtu;
13420 
13421 	/*
13422 	 * NOTE: The IPMP meta-interface is special-cased because it starts
13423 	 * with no underlying interfaces (and thus an unknown broadcast
13424 	 * address length), but all interfaces that can be placed into an IPMP
13425 	 * group are required to be broadcast-capable.
13426 	 */
13427 	if (ill->ill_bcast_addr_length != 0 || IS_IPMP(ill)) {
13428 		/*
13429 		 * Later detect lack of DLPI driver multicast
13430 		 * capability by catching DL_ENABMULTI errors in
13431 		 * ip_rput_dlpi.
13432 		 */
13433 		ill->ill_flags |= ILLF_MULTICAST;
13434 		if (!ipif->ipif_isv6)
13435 			ipif->ipif_flags |= IPIF_BROADCAST;
13436 	} else {
13437 		if (ill->ill_net_type != IRE_LOOPBACK) {
13438 			if (ipif->ipif_isv6)
13439 				/*
13440 				 * Note: xresolv interfaces will eventually need
13441 				 * NOARP set here as well, but that will require
13442 				 * those external resolvers to have some
13443 				 * knowledge of that flag and act appropriately.
13444 				 * Not to be changed at present.
13445 				 */
13446 				ill->ill_flags |= ILLF_NONUD;
13447 			else
13448 				ill->ill_flags |= ILLF_NOARP;
13449 		}
13450 		if (ill->ill_phys_addr_length == 0) {
13451 			if (ill->ill_mactype == SUNW_DL_VNI) {
13452 				ipif->ipif_flags |= IPIF_NOXMIT;
13453 				phyi->phyint_flags |= PHYI_VIRTUAL;
13454 			} else {
13455 				/* pt-pt supports multicast. */
13456 				ill->ill_flags |= ILLF_MULTICAST;
13457 				if (ill->ill_net_type == IRE_LOOPBACK) {
13458 					phyi->phyint_flags |=
13459 					    (PHYI_LOOPBACK | PHYI_VIRTUAL);
13460 				} else {
13461 					ipif->ipif_flags |= IPIF_POINTOPOINT;
13462 				}
13463 			}
13464 		}
13465 	}
13466 out:
13467 	mutex_exit(&phyi->phyint_lock);
13468 	mutex_exit(&ill->ill_lock);
13469 	return (ipif);
13470 }
13471 
13472 /*
13473  * If appropriate, send a message up to the resolver delete the entry
13474  * for the address of this interface which is going out of business.
13475  * (Always called as writer).
13476  *
13477  * NOTE : We need to check for NULL mps as some of the fields are
13478  *	  initialized only for some interface types. See ipif_resolver_up()
13479  *	  for details.
13480  */
13481 void
13482 ipif_resolver_down(ipif_t *ipif)
13483 {
13484 	mblk_t	*mp;
13485 	ill_t	*ill = ipif->ipif_ill;
13486 
13487 	ip1dbg(("ipif_resolver_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
13488 	ASSERT(IAM_WRITER_IPIF(ipif));
13489 
13490 	if (ill->ill_isv6 && !(ill->ill_flags & ILLF_XRESOLV))
13491 		return;
13492 
13493 	/* Delete the mapping for the local address */
13494 	mp = ipif->ipif_arp_del_mp;
13495 	if (mp != NULL) {
13496 		ip1dbg(("ipif_resolver_down: arp cmd %x for %s:%u\n",
13497 		    *(unsigned *)mp->b_rptr, ill->ill_name, ipif->ipif_id));
13498 		putnext(ill->ill_rq, mp);
13499 		ipif->ipif_arp_del_mp = NULL;
13500 	}
13501 
13502 	/*
13503 	 * Make IPMP aware of the deleted data address.
13504 	 */
13505 	if (IS_IPMP(ill))
13506 		ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
13507 
13508 	/*
13509 	 * If this is the last ipif that is going down and there are no
13510 	 * duplicate addresses we may yet attempt to re-probe, then we need to
13511 	 * clean up ARP completely.
13512 	 */
13513 	if (ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0) {
13514 		/*
13515 		 * If this was the last ipif on an IPMP interface, purge any
13516 		 * IPMP ARP entries associated with it.
13517 		 */
13518 		if (IS_IPMP(ill))
13519 			ipmp_illgrp_refresh_arpent(ill->ill_grp);
13520 
13521 		/* Send up AR_INTERFACE_DOWN message */
13522 		mp = ill->ill_arp_down_mp;
13523 		if (mp != NULL) {
13524 			ip1dbg(("ipif_resolver_down: arp cmd %x for %s:%u\n",
13525 			    *(unsigned *)mp->b_rptr, ill->ill_name,
13526 			    ipif->ipif_id));
13527 			putnext(ill->ill_rq, mp);
13528 			ill->ill_arp_down_mp = NULL;
13529 		}
13530 
13531 		/* Tell ARP to delete the multicast mappings */
13532 		mp = ill->ill_arp_del_mapping_mp;
13533 		if (mp != NULL) {
13534 			ip1dbg(("ipif_resolver_down: arp cmd %x for %s:%u\n",
13535 			    *(unsigned *)mp->b_rptr, ill->ill_name,
13536 			    ipif->ipif_id));
13537 			putnext(ill->ill_rq, mp);
13538 			ill->ill_arp_del_mapping_mp = NULL;
13539 		}
13540 	}
13541 }
13542 
13543 /*
13544  * Set up the multicast mappings for `ipif' in ARP.  If `arp_add_mapping_mp'
13545  * is non-NULL, then upon success it will contain an mblk that can be passed
13546  * to ARP to create the mapping.  Otherwise, if it's NULL, upon success ARP
13547  * will have already been notified to create the mapping.  Returns zero on
13548  * success, -1 upon failure.
13549  */
13550 int
13551 ipif_arp_setup_multicast(ipif_t *ipif, mblk_t **arp_add_mapping_mp)
13552 {
13553 	mblk_t	*del_mp = NULL;
13554 	mblk_t *add_mp = NULL;
13555 	mblk_t *mp;
13556 	ill_t	*ill = ipif->ipif_ill;
13557 	phyint_t *phyi = ill->ill_phyint;
13558 	ipaddr_t addr, mask, extract_mask = 0;
13559 	arma_t	*arma;
13560 	uint8_t *maddr, *bphys_addr;
13561 	uint32_t hw_start;
13562 	dl_unitdata_req_t *dlur;
13563 
13564 	ASSERT(IAM_WRITER_IPIF(ipif));
13565 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
13566 		return (0);
13567 
13568 	/*
13569 	 * IPMP meta-interfaces don't have any inherent multicast mappings,
13570 	 * and instead use the ones on the underlying interfaces.
13571 	 */
13572 	if (IS_IPMP(ill))
13573 		return (0);
13574 
13575 	/*
13576 	 * Delete the existing mapping from ARP.  Normally, ipif_down() ->
13577 	 * ipif_resolver_down() will send this up to ARP, but it may be that
13578 	 * we are enabling PHYI_MULTI_BCAST via ip_rput_dlpi_writer().
13579 	 */
13580 	mp = ill->ill_arp_del_mapping_mp;
13581 	if (mp != NULL) {
13582 		ip1dbg(("ipif_arp_setup_multicast: arp cmd %x for %s:%u\n",
13583 		    *(unsigned *)mp->b_rptr, ill->ill_name, ipif->ipif_id));
13584 		putnext(ill->ill_rq, mp);
13585 		ill->ill_arp_del_mapping_mp = NULL;
13586 	}
13587 
13588 	if (arp_add_mapping_mp != NULL)
13589 		*arp_add_mapping_mp = NULL;
13590 
13591 	/*
13592 	 * Check that the address is not to long for the constant
13593 	 * length reserved in the template arma_t.
13594 	 */
13595 	if (ill->ill_phys_addr_length > IP_MAX_HW_LEN)
13596 		return (-1);
13597 
13598 	/* Add mapping mblk */
13599 	addr = (ipaddr_t)htonl(INADDR_UNSPEC_GROUP);
13600 	mask = (ipaddr_t)htonl(IN_CLASSD_NET);
13601 	add_mp = ill_arp_alloc(ill, (uchar_t *)&ip_arma_multi_template,
13602 	    (caddr_t)&addr);
13603 	if (add_mp == NULL)
13604 		return (-1);
13605 	arma = (arma_t *)add_mp->b_rptr;
13606 	maddr = (uint8_t *)arma + arma->arma_hw_addr_offset;
13607 	bcopy(&mask, (char *)arma + arma->arma_proto_mask_offset, IP_ADDR_LEN);
13608 	arma->arma_hw_addr_length = ill->ill_phys_addr_length;
13609 
13610 	/*
13611 	 * Determine the broadcast address.
13612 	 */
13613 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
13614 	if (ill->ill_sap_length < 0)
13615 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
13616 	else
13617 		bphys_addr = (uchar_t *)dlur +
13618 		    dlur->dl_dest_addr_offset + ill->ill_sap_length;
13619 	/*
13620 	 * Check PHYI_MULTI_BCAST and length of physical
13621 	 * address to determine if we use the mapping or the
13622 	 * broadcast address.
13623 	 */
13624 	if (!(phyi->phyint_flags & PHYI_MULTI_BCAST))
13625 		if (!MEDIA_V4MINFO(ill->ill_media, ill->ill_phys_addr_length,
13626 		    bphys_addr, maddr, &hw_start, &extract_mask))
13627 			phyi->phyint_flags |= PHYI_MULTI_BCAST;
13628 
13629 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) ||
13630 	    (ill->ill_flags & ILLF_MULTICAST)) {
13631 		/* Make sure this will not match the "exact" entry. */
13632 		addr = (ipaddr_t)htonl(INADDR_ALLHOSTS_GROUP);
13633 		del_mp = ill_arp_alloc(ill, (uchar_t *)&ip_ared_template,
13634 		    (caddr_t)&addr);
13635 		if (del_mp == NULL) {
13636 			freemsg(add_mp);
13637 			return (-1);
13638 		}
13639 		bcopy(&extract_mask, (char *)arma +
13640 		    arma->arma_proto_extract_mask_offset, IP_ADDR_LEN);
13641 		if (phyi->phyint_flags & PHYI_MULTI_BCAST) {
13642 			/* Use link-layer broadcast address for MULTI_BCAST */
13643 			bcopy(bphys_addr, maddr, ill->ill_phys_addr_length);
13644 			ip2dbg(("ipif_arp_setup_multicast: adding"
13645 			    " MULTI_BCAST ARP setup for %s\n", ill->ill_name));
13646 		} else {
13647 			arma->arma_hw_mapping_start = hw_start;
13648 			ip2dbg(("ipif_arp_setup_multicast: adding multicast"
13649 			    " ARP setup for %s\n", ill->ill_name));
13650 		}
13651 	} else {
13652 		freemsg(add_mp);
13653 		ASSERT(del_mp == NULL);
13654 		/* It is neither MULTICAST nor MULTI_BCAST */
13655 		return (0);
13656 	}
13657 	ASSERT(add_mp != NULL && del_mp != NULL);
13658 	ASSERT(ill->ill_arp_del_mapping_mp == NULL);
13659 	ill->ill_arp_del_mapping_mp = del_mp;
13660 	if (arp_add_mapping_mp != NULL) {
13661 		/* The caller just wants the mblks allocated */
13662 		*arp_add_mapping_mp = add_mp;
13663 	} else {
13664 		/* The caller wants us to send it to arp */
13665 		putnext(ill->ill_rq, add_mp);
13666 	}
13667 	return (0);
13668 }
13669 
13670 /*
13671  * Get the resolver set up for a new IP address.  (Always called as writer.)
13672  * Called both for IPv4 and IPv6 interfaces, though it only sets up the
13673  * resolver for v6 if it's an ILLF_XRESOLV interface.  Honors ILLF_NOARP.
13674  *
13675  * The enumerated value res_act tunes the behavior:
13676  * 	* Res_act_initial: set up all the resolver structures for a new
13677  *	  IP address.
13678  *	* Res_act_defend: tell ARP that it needs to send a single gratuitous
13679  *	  ARP message in defense of the address.
13680  *	* Res_act_rebind: tell ARP to change the hardware address for an IP
13681  *	  address (and issue gratuitous ARPs).  Used by ipmp_ill_bind_ipif().
13682  *
13683  * Returns zero on success, or an errno upon failure.
13684  */
13685 int
13686 ipif_resolver_up(ipif_t *ipif, enum ip_resolver_action res_act)
13687 {
13688 	mblk_t	*arp_up_mp = NULL;
13689 	mblk_t	*arp_down_mp = NULL;
13690 	mblk_t	*arp_add_mp = NULL;
13691 	mblk_t	*arp_del_mp = NULL;
13692 	mblk_t	*arp_add_mapping_mp = NULL;
13693 	mblk_t	*arp_del_mapping_mp = NULL;
13694 	ill_t	*ill = ipif->ipif_ill;
13695 	int	err = ENOMEM;
13696 	boolean_t added_ipif = B_FALSE;
13697 	boolean_t publish;
13698 	boolean_t was_dup;
13699 
13700 	ip1dbg(("ipif_resolver_up(%s:%u) flags 0x%x\n",
13701 	    ill->ill_name, ipif->ipif_id, (uint_t)ipif->ipif_flags));
13702 	ASSERT(IAM_WRITER_IPIF(ipif));
13703 
13704 	was_dup = B_FALSE;
13705 	if (res_act == Res_act_initial) {
13706 		ipif->ipif_addr_ready = 0;
13707 		/*
13708 		 * We're bringing an interface up here.  There's no way that we
13709 		 * should need to shut down ARP now.
13710 		 */
13711 		mutex_enter(&ill->ill_lock);
13712 		if (ipif->ipif_flags & IPIF_DUPLICATE) {
13713 			ipif->ipif_flags &= ~IPIF_DUPLICATE;
13714 			ill->ill_ipif_dup_count--;
13715 			was_dup = B_TRUE;
13716 		}
13717 		mutex_exit(&ill->ill_lock);
13718 	}
13719 	if (ipif->ipif_recovery_id != 0)
13720 		(void) untimeout(ipif->ipif_recovery_id);
13721 	ipif->ipif_recovery_id = 0;
13722 	if (ill->ill_net_type != IRE_IF_RESOLVER) {
13723 		ipif->ipif_addr_ready = 1;
13724 		return (0);
13725 	}
13726 	/* NDP will set the ipif_addr_ready flag when it's ready */
13727 	if (ill->ill_isv6 && !(ill->ill_flags & ILLF_XRESOLV))
13728 		return (0);
13729 
13730 	if (ill->ill_isv6) {
13731 		/*
13732 		 * External resolver for IPv6
13733 		 */
13734 		ASSERT(res_act == Res_act_initial);
13735 		publish = !IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr);
13736 	} else {
13737 		/*
13738 		 * IPv4 arp case. If the ARP stream has already started
13739 		 * closing, fail this request for ARP bringup. Else
13740 		 * record the fact that an ARP bringup is pending.
13741 		 */
13742 		mutex_enter(&ill->ill_lock);
13743 		if (ill->ill_arp_closing) {
13744 			mutex_exit(&ill->ill_lock);
13745 			err = EINVAL;
13746 			goto failed;
13747 		} else {
13748 			if (ill->ill_ipif_up_count == 0 &&
13749 			    ill->ill_ipif_dup_count == 0 && !was_dup)
13750 				ill->ill_arp_bringup_pending = 1;
13751 			mutex_exit(&ill->ill_lock);
13752 		}
13753 		publish = (ipif->ipif_lcl_addr != INADDR_ANY);
13754 	}
13755 
13756 	if (IS_IPMP(ill) && publish) {
13757 		/*
13758 		 * If we're here via ipif_up(), then the ipif won't be bound
13759 		 * yet -- add it to the group, which will bind it if possible.
13760 		 * (We would add it in ipif_up(), but deleting on failure
13761 		 * there is gruesome.)  If we're here via ipmp_ill_bind_ipif(),
13762 		 * then the ipif has already been added to the group and we
13763 		 * just need to use the binding.
13764 		 */
13765 		if (ipmp_ipif_bound_ill(ipif) == NULL) {
13766 			if (ipmp_illgrp_add_ipif(ill->ill_grp, ipif) == NULL) {
13767 				/*
13768 				 * We couldn't bind the ipif to an ill yet,
13769 				 * so we have nothing to publish.
13770 				 */
13771 				publish = B_FALSE;
13772 			}
13773 			added_ipif = B_TRUE;
13774 		}
13775 	}
13776 
13777 	/*
13778 	 * Add an entry for the local address in ARP only if it
13779 	 * is not UNNUMBERED and it is suitable for publishing.
13780 	 */
13781 	if (!(ipif->ipif_flags & IPIF_UNNUMBERED) && publish) {
13782 		if (res_act == Res_act_defend) {
13783 			arp_add_mp = ipif_area_alloc(ipif, ACE_F_DEFEND);
13784 			if (arp_add_mp == NULL)
13785 				goto failed;
13786 			/*
13787 			 * If we're just defending our address now, then
13788 			 * there's no need to set up ARP multicast mappings.
13789 			 * The publish command is enough.
13790 			 */
13791 			goto done;
13792 		}
13793 
13794 		/*
13795 		 * Allocate an ARP add message and an ARP delete message (the
13796 		 * latter is saved for use when the address goes down).
13797 		 */
13798 		if ((arp_add_mp = ipif_area_alloc(ipif, 0)) == NULL)
13799 			goto failed;
13800 
13801 		if ((arp_del_mp = ipif_ared_alloc(ipif)) == NULL)
13802 			goto failed;
13803 
13804 		if (res_act != Res_act_initial)
13805 			goto arp_setup_multicast;
13806 	} else {
13807 		if (res_act != Res_act_initial)
13808 			goto done;
13809 	}
13810 	/*
13811 	 * Need to bring up ARP or setup multicast mapping only
13812 	 * when the first interface is coming UP.
13813 	 */
13814 	if (ill->ill_ipif_up_count + ill->ill_ipif_dup_count > 0 || was_dup)
13815 		goto done;
13816 
13817 	/*
13818 	 * Allocate an ARP down message (to be saved) and an ARP up message.
13819 	 */
13820 	arp_down_mp = ill_arp_alloc(ill, (uchar_t *)&ip_ard_template, 0);
13821 	if (arp_down_mp == NULL)
13822 		goto failed;
13823 
13824 	arp_up_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aru_template, 0);
13825 	if (arp_up_mp == NULL)
13826 		goto failed;
13827 
13828 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
13829 		goto done;
13830 
13831 arp_setup_multicast:
13832 	/*
13833 	 * Setup the multicast mappings. This function initializes
13834 	 * ill_arp_del_mapping_mp also. This does not need to be done for
13835 	 * IPv6, or for the IPMP interface (since it has no link-layer).
13836 	 */
13837 	if (!ill->ill_isv6 && !IS_IPMP(ill)) {
13838 		err = ipif_arp_setup_multicast(ipif, &arp_add_mapping_mp);
13839 		if (err != 0)
13840 			goto failed;
13841 		ASSERT(ill->ill_arp_del_mapping_mp != NULL);
13842 		ASSERT(arp_add_mapping_mp != NULL);
13843 	}
13844 done:
13845 	if (arp_up_mp != NULL) {
13846 		ip1dbg(("ipif_resolver_up: ARP_UP for %s:%u\n",
13847 		    ill->ill_name, ipif->ipif_id));
13848 		putnext(ill->ill_rq, arp_up_mp);
13849 		arp_up_mp = NULL;
13850 	}
13851 	if (arp_add_mp != NULL) {
13852 		ip1dbg(("ipif_resolver_up: ARP_ADD for %s:%u\n",
13853 		    ill->ill_name, ipif->ipif_id));
13854 		/*
13855 		 * If it's an extended ARP implementation, then we'll wait to
13856 		 * hear that DAD has finished before using the interface.
13857 		 */
13858 		if (!ill->ill_arp_extend)
13859 			ipif->ipif_addr_ready = 1;
13860 		putnext(ill->ill_rq, arp_add_mp);
13861 		arp_add_mp = NULL;
13862 	} else {
13863 		ipif->ipif_addr_ready = 1;
13864 	}
13865 	if (arp_add_mapping_mp != NULL) {
13866 		ip1dbg(("ipif_resolver_up: MAPPING_ADD for %s:%u\n",
13867 		    ill->ill_name, ipif->ipif_id));
13868 		putnext(ill->ill_rq, arp_add_mapping_mp);
13869 		arp_add_mapping_mp = NULL;
13870 	}
13871 
13872 	if (res_act == Res_act_initial) {
13873 		if (ill->ill_flags & ILLF_NOARP)
13874 			err = ill_arp_off(ill);
13875 		else
13876 			err = ill_arp_on(ill);
13877 		if (err != 0) {
13878 			ip0dbg(("ipif_resolver_up: arp_on/off failed %d\n",
13879 			    err));
13880 			goto failed;
13881 		}
13882 	}
13883 
13884 	if (arp_del_mp != NULL) {
13885 		ASSERT(ipif->ipif_arp_del_mp == NULL);
13886 		ipif->ipif_arp_del_mp = arp_del_mp;
13887 	}
13888 	if (arp_down_mp != NULL) {
13889 		ASSERT(ill->ill_arp_down_mp == NULL);
13890 		ill->ill_arp_down_mp = arp_down_mp;
13891 	}
13892 	if (arp_del_mapping_mp != NULL) {
13893 		ASSERT(ill->ill_arp_del_mapping_mp == NULL);
13894 		ill->ill_arp_del_mapping_mp = arp_del_mapping_mp;
13895 	}
13896 
13897 	return ((ill->ill_ipif_up_count != 0 || was_dup ||
13898 	    ill->ill_ipif_dup_count != 0) ? 0 : EINPROGRESS);
13899 failed:
13900 	ip1dbg(("ipif_resolver_up: FAILED\n"));
13901 	if (added_ipif)
13902 		ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
13903 	freemsg(arp_add_mp);
13904 	freemsg(arp_del_mp);
13905 	freemsg(arp_add_mapping_mp);
13906 	freemsg(arp_up_mp);
13907 	freemsg(arp_down_mp);
13908 	ill->ill_arp_bringup_pending = 0;
13909 	return (err);
13910 }
13911 
13912 /*
13913  * This routine restarts IPv4 duplicate address detection (DAD) when a link has
13914  * just gone back up.
13915  */
13916 static void
13917 ipif_arp_start_dad(ipif_t *ipif)
13918 {
13919 	ill_t *ill = ipif->ipif_ill;
13920 	mblk_t *arp_add_mp;
13921 
13922 	/* ACE_F_UNVERIFIED restarts DAD */
13923 	if (ill->ill_net_type != IRE_IF_RESOLVER || ill->ill_arp_closing ||
13924 	    (ipif->ipif_flags & IPIF_UNNUMBERED) ||
13925 	    ipif->ipif_lcl_addr == INADDR_ANY ||
13926 	    (arp_add_mp = ipif_area_alloc(ipif, ACE_F_UNVERIFIED)) == NULL) {
13927 		/*
13928 		 * If we can't contact ARP for some reason, that's not really a
13929 		 * problem.  Just send out the routing socket notification that
13930 		 * DAD completion would have done, and continue.
13931 		 */
13932 		ipif_mask_reply(ipif);
13933 		ipif_up_notify(ipif);
13934 		ipif->ipif_addr_ready = 1;
13935 		return;
13936 	}
13937 
13938 	putnext(ill->ill_rq, arp_add_mp);
13939 }
13940 
13941 static void
13942 ipif_ndp_start_dad(ipif_t *ipif)
13943 {
13944 	nce_t *nce;
13945 
13946 	nce = ndp_lookup_v6(ipif->ipif_ill, B_TRUE, &ipif->ipif_v6lcl_addr,
13947 	    B_FALSE);
13948 	if (nce == NULL)
13949 		return;
13950 
13951 	if (!ndp_restart_dad(nce)) {
13952 		/*
13953 		 * If we can't restart DAD for some reason, that's not really a
13954 		 * problem.  Just send out the routing socket notification that
13955 		 * DAD completion would have done, and continue.
13956 		 */
13957 		ipif_up_notify(ipif);
13958 		ipif->ipif_addr_ready = 1;
13959 	}
13960 	NCE_REFRELE(nce);
13961 }
13962 
13963 /*
13964  * Restart duplicate address detection on all interfaces on the given ill.
13965  *
13966  * This is called when an interface transitions from down to up
13967  * (DL_NOTE_LINK_UP) or up to down (DL_NOTE_LINK_DOWN).
13968  *
13969  * Note that since the underlying physical link has transitioned, we must cause
13970  * at least one routing socket message to be sent here, either via DAD
13971  * completion or just by default on the first ipif.  (If we don't do this, then
13972  * in.mpathd will see long delays when doing link-based failure recovery.)
13973  */
13974 void
13975 ill_restart_dad(ill_t *ill, boolean_t went_up)
13976 {
13977 	ipif_t *ipif;
13978 
13979 	if (ill == NULL)
13980 		return;
13981 
13982 	/*
13983 	 * If layer two doesn't support duplicate address detection, then just
13984 	 * send the routing socket message now and be done with it.
13985 	 */
13986 	if ((ill->ill_isv6 && (ill->ill_flags & ILLF_XRESOLV)) ||
13987 	    (!ill->ill_isv6 && !ill->ill_arp_extend)) {
13988 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
13989 		return;
13990 	}
13991 
13992 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13993 		if (went_up) {
13994 			if (ipif->ipif_flags & IPIF_UP) {
13995 				if (ill->ill_isv6)
13996 					ipif_ndp_start_dad(ipif);
13997 				else
13998 					ipif_arp_start_dad(ipif);
13999 			} else if (ill->ill_isv6 &&
14000 			    (ipif->ipif_flags & IPIF_DUPLICATE)) {
14001 				/*
14002 				 * For IPv4, the ARP module itself will
14003 				 * automatically start the DAD process when it
14004 				 * sees DL_NOTE_LINK_UP.  We respond to the
14005 				 * AR_CN_READY at the completion of that task.
14006 				 * For IPv6, we must kick off the bring-up
14007 				 * process now.
14008 				 */
14009 				ndp_do_recovery(ipif);
14010 			} else {
14011 				/*
14012 				 * Unfortunately, the first ipif is "special"
14013 				 * and represents the underlying ill in the
14014 				 * routing socket messages.  Thus, when this
14015 				 * one ipif is down, we must still notify so
14016 				 * that the user knows the IFF_RUNNING status
14017 				 * change.  (If the first ipif is up, then
14018 				 * we'll handle eventual routing socket
14019 				 * notification via DAD completion.)
14020 				 */
14021 				if (ipif == ill->ill_ipif) {
14022 					ip_rts_ifmsg(ill->ill_ipif,
14023 					    RTSQ_DEFAULT);
14024 				}
14025 			}
14026 		} else {
14027 			/*
14028 			 * After link down, we'll need to send a new routing
14029 			 * message when the link comes back, so clear
14030 			 * ipif_addr_ready.
14031 			 */
14032 			ipif->ipif_addr_ready = 0;
14033 		}
14034 	}
14035 
14036 	/*
14037 	 * If we've torn down links, then notify the user right away.
14038 	 */
14039 	if (!went_up)
14040 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
14041 }
14042 
14043 static void
14044 ipsq_delete(ipsq_t *ipsq)
14045 {
14046 	ipxop_t *ipx = ipsq->ipsq_xop;
14047 
14048 	ipsq->ipsq_ipst = NULL;
14049 	ASSERT(ipsq->ipsq_phyint == NULL);
14050 	ASSERT(ipsq->ipsq_xop != NULL);
14051 	ASSERT(ipsq->ipsq_xopq_mphead == NULL && ipx->ipx_mphead == NULL);
14052 	ASSERT(ipx->ipx_pending_mp == NULL);
14053 	kmem_free(ipsq, sizeof (ipsq_t));
14054 }
14055 
14056 static int
14057 ill_up_ipifs_on_ill(ill_t *ill, queue_t *q, mblk_t *mp)
14058 {
14059 	int err;
14060 	ipif_t *ipif;
14061 
14062 	if (ill == NULL)
14063 		return (0);
14064 
14065 	ASSERT(IAM_WRITER_ILL(ill));
14066 	ill->ill_up_ipifs = B_TRUE;
14067 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
14068 		if (ipif->ipif_was_up) {
14069 			if (!(ipif->ipif_flags & IPIF_UP))
14070 				err = ipif_up(ipif, q, mp);
14071 			ipif->ipif_was_up = B_FALSE;
14072 			if (err != 0) {
14073 				ASSERT(err == EINPROGRESS);
14074 				return (err);
14075 			}
14076 		}
14077 	}
14078 	mutex_enter(&ill->ill_lock);
14079 	ill->ill_state_flags &= ~ILL_CHANGING;
14080 	mutex_exit(&ill->ill_lock);
14081 	ill->ill_up_ipifs = B_FALSE;
14082 	return (0);
14083 }
14084 
14085 /*
14086  * This function is called to bring up all the ipifs that were up before
14087  * bringing the ill down via ill_down_ipifs().
14088  */
14089 int
14090 ill_up_ipifs(ill_t *ill, queue_t *q, mblk_t *mp)
14091 {
14092 	int err;
14093 
14094 	ASSERT(IAM_WRITER_ILL(ill));
14095 
14096 	err = ill_up_ipifs_on_ill(ill->ill_phyint->phyint_illv4, q, mp);
14097 	if (err != 0)
14098 		return (err);
14099 
14100 	return (ill_up_ipifs_on_ill(ill->ill_phyint->phyint_illv6, q, mp));
14101 }
14102 
14103 /*
14104  * Bring down any IPIF_UP ipifs on ill. If "logical" is B_TRUE, we bring
14105  * down the ipifs without sending DL_UNBIND_REQ to the driver.
14106  */
14107 static void
14108 ill_down_ipifs(ill_t *ill, boolean_t logical)
14109 {
14110 	ipif_t *ipif;
14111 
14112 	ASSERT(IAM_WRITER_ILL(ill));
14113 
14114 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
14115 		/*
14116 		 * We go through the ipif_down logic even if the ipif
14117 		 * is already down, since routes can be added based
14118 		 * on down ipifs. Going through ipif_down once again
14119 		 * will delete any IREs created based on these routes.
14120 		 */
14121 		if (ipif->ipif_flags & IPIF_UP)
14122 			ipif->ipif_was_up = B_TRUE;
14123 
14124 		/*
14125 		 * Need to re-create net/subnet bcast ires if
14126 		 * they are dependent on ipif.
14127 		 */
14128 		if (!ipif->ipif_isv6)
14129 			ipif_check_bcast_ires(ipif);
14130 		if (logical) {
14131 			(void) ipif_logical_down(ipif, NULL, NULL);
14132 			ipif_non_duplicate(ipif);
14133 			ipif_down_tail(ipif);
14134 		} else {
14135 			(void) ipif_down(ipif, NULL, NULL);
14136 		}
14137 	}
14138 }
14139 
14140 /*
14141  * Redo source address selection.  This is called when a
14142  * non-NOLOCAL/DEPRECATED/ANYCAST ipif comes up.
14143  */
14144 void
14145 ill_update_source_selection(ill_t *ill)
14146 {
14147 	ipif_t *ipif;
14148 
14149 	ASSERT(IAM_WRITER_ILL(ill));
14150 
14151 	/*
14152 	 * Underlying interfaces are only used for test traffic and thus
14153 	 * should always send with their (deprecated) source addresses.
14154 	 */
14155 	if (IS_UNDER_IPMP(ill))
14156 		return;
14157 
14158 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
14159 		if (ill->ill_isv6)
14160 			ipif_recreate_interface_routes_v6(NULL, ipif);
14161 		else
14162 			ipif_recreate_interface_routes(NULL, ipif);
14163 	}
14164 }
14165 
14166 /*
14167  * Finish the group join started in ip_sioctl_groupname().
14168  */
14169 /* ARGSUSED */
14170 static void
14171 ip_join_illgrps(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy)
14172 {
14173 	ill_t		*ill = q->q_ptr;
14174 	phyint_t	*phyi = ill->ill_phyint;
14175 	ipmp_grp_t	*grp = phyi->phyint_grp;
14176 	ip_stack_t	*ipst = ill->ill_ipst;
14177 
14178 	/* IS_UNDER_IPMP() won't work until ipmp_ill_join_illgrp() is called */
14179 	ASSERT(!IS_IPMP(ill) && grp != NULL);
14180 	ASSERT(IAM_WRITER_IPSQ(ipsq));
14181 
14182 	if (phyi->phyint_illv4 != NULL) {
14183 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
14184 		VERIFY(grp->gr_pendv4-- > 0);
14185 		rw_exit(&ipst->ips_ipmp_lock);
14186 		ipmp_ill_join_illgrp(phyi->phyint_illv4, grp->gr_v4);
14187 	}
14188 	if (phyi->phyint_illv6 != NULL) {
14189 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
14190 		VERIFY(grp->gr_pendv6-- > 0);
14191 		rw_exit(&ipst->ips_ipmp_lock);
14192 		ipmp_ill_join_illgrp(phyi->phyint_illv6, grp->gr_v6);
14193 	}
14194 	freemsg(mp);
14195 }
14196 
14197 /*
14198  * Process an SIOCSLIFGROUPNAME request.
14199  */
14200 /* ARGSUSED */
14201 int
14202 ip_sioctl_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
14203     ip_ioctl_cmd_t *ipip, void *ifreq)
14204 {
14205 	struct lifreq	*lifr = ifreq;
14206 	ill_t		*ill = ipif->ipif_ill;
14207 	ip_stack_t	*ipst = ill->ill_ipst;
14208 	phyint_t	*phyi = ill->ill_phyint;
14209 	ipmp_grp_t	*grp = phyi->phyint_grp;
14210 	mblk_t		*ipsq_mp;
14211 	int		err = 0;
14212 
14213 	/*
14214 	 * Note that phyint_grp can only change here, where we're exclusive.
14215 	 */
14216 	ASSERT(IAM_WRITER_ILL(ill));
14217 
14218 	if (ipif->ipif_id != 0 || ill->ill_usesrc_grp_next != NULL ||
14219 	    (phyi->phyint_flags & PHYI_VIRTUAL))
14220 		return (EINVAL);
14221 
14222 	lifr->lifr_groupname[LIFGRNAMSIZ - 1] = '\0';
14223 
14224 	rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
14225 
14226 	/*
14227 	 * If the name hasn't changed, there's nothing to do.
14228 	 */
14229 	if (grp != NULL && strcmp(grp->gr_name, lifr->lifr_groupname) == 0)
14230 		goto unlock;
14231 
14232 	/*
14233 	 * Handle requests to rename an IPMP meta-interface.
14234 	 *
14235 	 * Note that creation of the IPMP meta-interface is handled in
14236 	 * userland through the standard plumbing sequence.  As part of the
14237 	 * plumbing the IPMP meta-interface, its initial groupname is set to
14238 	 * the name of the interface (see ipif_set_values_tail()).
14239 	 */
14240 	if (IS_IPMP(ill)) {
14241 		err = ipmp_grp_rename(grp, lifr->lifr_groupname);
14242 		goto unlock;
14243 	}
14244 
14245 	/*
14246 	 * Handle requests to add or remove an IP interface from a group.
14247 	 */
14248 	if (lifr->lifr_groupname[0] != '\0') {			/* add */
14249 		/*
14250 		 * Moves are handled by first removing the interface from
14251 		 * its existing group, and then adding it to another group.
14252 		 * So, fail if it's already in a group.
14253 		 */
14254 		if (IS_UNDER_IPMP(ill)) {
14255 			err = EALREADY;
14256 			goto unlock;
14257 		}
14258 
14259 		grp = ipmp_grp_lookup(lifr->lifr_groupname, ipst);
14260 		if (grp == NULL) {
14261 			err = ENOENT;
14262 			goto unlock;
14263 		}
14264 
14265 		/*
14266 		 * Check if the phyint and its ills are suitable for
14267 		 * inclusion into the group.
14268 		 */
14269 		if ((err = ipmp_grp_vet_phyint(grp, phyi)) != 0)
14270 			goto unlock;
14271 
14272 		/*
14273 		 * Checks pass; join the group, and enqueue the remaining
14274 		 * illgrp joins for when we've become part of the group xop
14275 		 * and are exclusive across its IPSQs.  Since qwriter_ip()
14276 		 * requires an mblk_t to scribble on, and since `mp' will be
14277 		 * freed as part of completing the ioctl, allocate another.
14278 		 */
14279 		if ((ipsq_mp = allocb(0, BPRI_MED)) == NULL) {
14280 			err = ENOMEM;
14281 			goto unlock;
14282 		}
14283 
14284 		/*
14285 		 * Before we drop ipmp_lock, bump gr_pend* to ensure that the
14286 		 * IPMP meta-interface ills needed by `phyi' cannot go away
14287 		 * before ip_join_illgrps() is called back.  See the comments
14288 		 * in ip_sioctl_plink_ipmp() for more.
14289 		 */
14290 		if (phyi->phyint_illv4 != NULL)
14291 			grp->gr_pendv4++;
14292 		if (phyi->phyint_illv6 != NULL)
14293 			grp->gr_pendv6++;
14294 
14295 		rw_exit(&ipst->ips_ipmp_lock);
14296 
14297 		ipmp_phyint_join_grp(phyi, grp);
14298 		ill_refhold(ill);
14299 		qwriter_ip(ill, ill->ill_rq, ipsq_mp, ip_join_illgrps,
14300 		    SWITCH_OP, B_FALSE);
14301 		return (0);
14302 	} else {
14303 		/*
14304 		 * Request to remove the interface from a group.  If the
14305 		 * interface is not in a group, this trivially succeeds.
14306 		 */
14307 		rw_exit(&ipst->ips_ipmp_lock);
14308 		if (IS_UNDER_IPMP(ill))
14309 			ipmp_phyint_leave_grp(phyi);
14310 		return (0);
14311 	}
14312 unlock:
14313 	rw_exit(&ipst->ips_ipmp_lock);
14314 	return (err);
14315 }
14316 
14317 /*
14318  * Process an SIOCGLIFBINDING request.
14319  */
14320 /* ARGSUSED */
14321 int
14322 ip_sioctl_get_binding(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
14323     ip_ioctl_cmd_t *ipip, void *ifreq)
14324 {
14325 	ill_t		*ill;
14326 	struct lifreq	*lifr = ifreq;
14327 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
14328 
14329 	if (!IS_IPMP(ipif->ipif_ill))
14330 		return (EINVAL);
14331 
14332 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
14333 	if ((ill = ipif->ipif_bound_ill) == NULL)
14334 		lifr->lifr_binding[0] = '\0';
14335 	else
14336 		(void) strlcpy(lifr->lifr_binding, ill->ill_name, LIFNAMSIZ);
14337 	rw_exit(&ipst->ips_ipmp_lock);
14338 	return (0);
14339 }
14340 
14341 /*
14342  * Process an SIOCGLIFGROUPNAME request.
14343  */
14344 /* ARGSUSED */
14345 int
14346 ip_sioctl_get_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
14347     ip_ioctl_cmd_t *ipip, void *ifreq)
14348 {
14349 	ipmp_grp_t	*grp;
14350 	struct lifreq	*lifr = ifreq;
14351 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
14352 
14353 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
14354 	if ((grp = ipif->ipif_ill->ill_phyint->phyint_grp) == NULL)
14355 		lifr->lifr_groupname[0] = '\0';
14356 	else
14357 		(void) strlcpy(lifr->lifr_groupname, grp->gr_name, LIFGRNAMSIZ);
14358 	rw_exit(&ipst->ips_ipmp_lock);
14359 	return (0);
14360 }
14361 
14362 /*
14363  * Process an SIOCGLIFGROUPINFO request.
14364  */
14365 /* ARGSUSED */
14366 int
14367 ip_sioctl_groupinfo(ipif_t *dummy_ipif, sin_t *sin, queue_t *q, mblk_t *mp,
14368     ip_ioctl_cmd_t *ipip, void *dummy)
14369 {
14370 	ipmp_grp_t	*grp;
14371 	lifgroupinfo_t	*lifgr;
14372 	ip_stack_t	*ipst = CONNQ_TO_IPST(q);
14373 
14374 	/* ip_wput_nondata() verified mp->b_cont->b_cont */
14375 	lifgr = (lifgroupinfo_t *)mp->b_cont->b_cont->b_rptr;
14376 	lifgr->gi_grname[LIFGRNAMSIZ - 1] = '\0';
14377 
14378 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
14379 	if ((grp = ipmp_grp_lookup(lifgr->gi_grname, ipst)) == NULL) {
14380 		rw_exit(&ipst->ips_ipmp_lock);
14381 		return (ENOENT);
14382 	}
14383 	ipmp_grp_info(grp, lifgr);
14384 	rw_exit(&ipst->ips_ipmp_lock);
14385 	return (0);
14386 }
14387 
14388 static void
14389 ill_dl_down(ill_t *ill)
14390 {
14391 	/*
14392 	 * The ill is down; unbind but stay attached since we're still
14393 	 * associated with a PPA. If we have negotiated DLPI capabilites
14394 	 * with the data link service provider (IDS_OK) then reset them.
14395 	 * The interval between unbinding and rebinding is potentially
14396 	 * unbounded hence we cannot assume things will be the same.
14397 	 * The DLPI capabilities will be probed again when the data link
14398 	 * is brought up.
14399 	 */
14400 	mblk_t	*mp = ill->ill_unbind_mp;
14401 
14402 	ip1dbg(("ill_dl_down(%s)\n", ill->ill_name));
14403 
14404 	ill->ill_unbind_mp = NULL;
14405 	if (mp != NULL) {
14406 		ip1dbg(("ill_dl_down: %s (%u) for %s\n",
14407 		    dl_primstr(*(int *)mp->b_rptr), *(int *)mp->b_rptr,
14408 		    ill->ill_name));
14409 		mutex_enter(&ill->ill_lock);
14410 		ill->ill_state_flags |= ILL_DL_UNBIND_IN_PROGRESS;
14411 		mutex_exit(&ill->ill_lock);
14412 		/*
14413 		 * ip_rput does not pass up normal (M_PROTO) DLPI messages
14414 		 * after ILL_CONDEMNED is set. So in the unplumb case, we call
14415 		 * ill_capability_dld_disable disable rightaway. If this is not
14416 		 * an unplumb operation then the disable happens on receipt of
14417 		 * the capab ack via ip_rput_dlpi_writer ->
14418 		 * ill_capability_ack_thr. In both cases the order of
14419 		 * the operations seen by DLD is capability disable followed
14420 		 * by DL_UNBIND. Also the DLD capability disable needs a
14421 		 * cv_wait'able context.
14422 		 */
14423 		if (ill->ill_state_flags & ILL_CONDEMNED)
14424 			ill_capability_dld_disable(ill);
14425 		ill_capability_reset(ill, B_FALSE);
14426 		ill_dlpi_send(ill, mp);
14427 	}
14428 
14429 	/*
14430 	 * Toss all of our multicast memberships.  We could keep them, but
14431 	 * then we'd have to do bookkeeping of any joins and leaves performed
14432 	 * by the application while the the interface is down (we can't just
14433 	 * issue them because arp cannot currently process AR_ENTRY_SQUERY's
14434 	 * on a downed interface).
14435 	 */
14436 	ill_leave_multicast(ill);
14437 
14438 	mutex_enter(&ill->ill_lock);
14439 	ill->ill_dl_up = 0;
14440 	ill_nic_event_dispatch(ill, 0, NE_DOWN, NULL, 0);
14441 	mutex_exit(&ill->ill_lock);
14442 }
14443 
14444 static void
14445 ill_dlpi_dispatch(ill_t *ill, mblk_t *mp)
14446 {
14447 	union DL_primitives *dlp;
14448 	t_uscalar_t prim;
14449 	boolean_t waitack = B_FALSE;
14450 
14451 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
14452 
14453 	dlp = (union DL_primitives *)mp->b_rptr;
14454 	prim = dlp->dl_primitive;
14455 
14456 	ip1dbg(("ill_dlpi_dispatch: sending %s (%u) to %s\n",
14457 	    dl_primstr(prim), prim, ill->ill_name));
14458 
14459 	switch (prim) {
14460 	case DL_PHYS_ADDR_REQ:
14461 	{
14462 		dl_phys_addr_req_t *dlpap = (dl_phys_addr_req_t *)mp->b_rptr;
14463 		ill->ill_phys_addr_pend = dlpap->dl_addr_type;
14464 		break;
14465 	}
14466 	case DL_BIND_REQ:
14467 		mutex_enter(&ill->ill_lock);
14468 		ill->ill_state_flags &= ~ILL_DL_UNBIND_IN_PROGRESS;
14469 		mutex_exit(&ill->ill_lock);
14470 		break;
14471 	}
14472 
14473 	/*
14474 	 * Except for the ACKs for the M_PCPROTO messages, all other ACKs
14475 	 * are dropped by ip_rput() if ILL_CONDEMNED is set. Therefore
14476 	 * we only wait for the ACK of the DL_UNBIND_REQ.
14477 	 */
14478 	mutex_enter(&ill->ill_lock);
14479 	if (!(ill->ill_state_flags & ILL_CONDEMNED) ||
14480 	    (prim == DL_UNBIND_REQ)) {
14481 		ill->ill_dlpi_pending = prim;
14482 		waitack = B_TRUE;
14483 	}
14484 
14485 	mutex_exit(&ill->ill_lock);
14486 	putnext(ill->ill_wq, mp);
14487 
14488 	/*
14489 	 * There is no ack for DL_NOTIFY_CONF messages
14490 	 */
14491 	if (waitack && prim == DL_NOTIFY_CONF)
14492 		ill_dlpi_done(ill, prim);
14493 }
14494 
14495 /*
14496  * Helper function for ill_dlpi_send().
14497  */
14498 /* ARGSUSED */
14499 static void
14500 ill_dlpi_send_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
14501 {
14502 	ill_dlpi_send(q->q_ptr, mp);
14503 }
14504 
14505 /*
14506  * Send a DLPI control message to the driver but make sure there
14507  * is only one outstanding message. Uses ill_dlpi_pending to tell
14508  * when it must queue. ip_rput_dlpi_writer calls ill_dlpi_done()
14509  * when an ACK or a NAK is received to process the next queued message.
14510  */
14511 void
14512 ill_dlpi_send(ill_t *ill, mblk_t *mp)
14513 {
14514 	mblk_t **mpp;
14515 
14516 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
14517 
14518 	/*
14519 	 * To ensure that any DLPI requests for current exclusive operation
14520 	 * are always completely sent before any DLPI messages for other
14521 	 * operations, require writer access before enqueuing.
14522 	 */
14523 	if (!IAM_WRITER_ILL(ill)) {
14524 		ill_refhold(ill);
14525 		/* qwriter_ip() does the ill_refrele() */
14526 		qwriter_ip(ill, ill->ill_wq, mp, ill_dlpi_send_writer,
14527 		    NEW_OP, B_TRUE);
14528 		return;
14529 	}
14530 
14531 	mutex_enter(&ill->ill_lock);
14532 	if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
14533 		/* Must queue message. Tail insertion */
14534 		mpp = &ill->ill_dlpi_deferred;
14535 		while (*mpp != NULL)
14536 			mpp = &((*mpp)->b_next);
14537 
14538 		ip1dbg(("ill_dlpi_send: deferring request for %s\n",
14539 		    ill->ill_name));
14540 
14541 		*mpp = mp;
14542 		mutex_exit(&ill->ill_lock);
14543 		return;
14544 	}
14545 	mutex_exit(&ill->ill_lock);
14546 	ill_dlpi_dispatch(ill, mp);
14547 }
14548 
14549 static void
14550 ill_capability_send(ill_t *ill, mblk_t *mp)
14551 {
14552 	ill->ill_capab_pending_cnt++;
14553 	ill_dlpi_send(ill, mp);
14554 }
14555 
14556 void
14557 ill_capability_done(ill_t *ill)
14558 {
14559 	ASSERT(ill->ill_capab_pending_cnt != 0);
14560 
14561 	ill_dlpi_done(ill, DL_CAPABILITY_REQ);
14562 
14563 	ill->ill_capab_pending_cnt--;
14564 	if (ill->ill_capab_pending_cnt == 0 &&
14565 	    ill->ill_dlpi_capab_state == IDCS_OK)
14566 		ill_capability_reset_alloc(ill);
14567 }
14568 
14569 /*
14570  * Send all deferred DLPI messages without waiting for their ACKs.
14571  */
14572 void
14573 ill_dlpi_send_deferred(ill_t *ill)
14574 {
14575 	mblk_t *mp, *nextmp;
14576 
14577 	/*
14578 	 * Clear ill_dlpi_pending so that the message is not queued in
14579 	 * ill_dlpi_send().
14580 	 */
14581 	mutex_enter(&ill->ill_lock);
14582 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
14583 	mp = ill->ill_dlpi_deferred;
14584 	ill->ill_dlpi_deferred = NULL;
14585 	mutex_exit(&ill->ill_lock);
14586 
14587 	for (; mp != NULL; mp = nextmp) {
14588 		nextmp = mp->b_next;
14589 		mp->b_next = NULL;
14590 		ill_dlpi_send(ill, mp);
14591 	}
14592 }
14593 
14594 /*
14595  * Check if the DLPI primitive `prim' is pending; print a warning if not.
14596  */
14597 boolean_t
14598 ill_dlpi_pending(ill_t *ill, t_uscalar_t prim)
14599 {
14600 	t_uscalar_t pending;
14601 
14602 	mutex_enter(&ill->ill_lock);
14603 	if (ill->ill_dlpi_pending == prim) {
14604 		mutex_exit(&ill->ill_lock);
14605 		return (B_TRUE);
14606 	}
14607 
14608 	/*
14609 	 * During teardown, ill_dlpi_dispatch() will send DLPI requests
14610 	 * without waiting, so don't print any warnings in that case.
14611 	 */
14612 	if (ill->ill_state_flags & ILL_CONDEMNED) {
14613 		mutex_exit(&ill->ill_lock);
14614 		return (B_FALSE);
14615 	}
14616 	pending = ill->ill_dlpi_pending;
14617 	mutex_exit(&ill->ill_lock);
14618 
14619 	if (pending == DL_PRIM_INVAL) {
14620 		(void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
14621 		    "received unsolicited ack for %s on %s\n",
14622 		    dl_primstr(prim), ill->ill_name);
14623 	} else {
14624 		(void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
14625 		    "received unexpected ack for %s on %s (expecting %s)\n",
14626 		    dl_primstr(prim), ill->ill_name, dl_primstr(pending));
14627 	}
14628 	return (B_FALSE);
14629 }
14630 
14631 /*
14632  * Complete the current DLPI operation associated with `prim' on `ill' and
14633  * start the next queued DLPI operation (if any).  If there are no queued DLPI
14634  * operations and the ill's current exclusive IPSQ operation has finished
14635  * (i.e., ipsq_current_finish() was called), then clear ipsq_current_ipif to
14636  * allow the next exclusive IPSQ operation to begin upon ipsq_exit().  See
14637  * the comments above ipsq_current_finish() for details.
14638  */
14639 void
14640 ill_dlpi_done(ill_t *ill, t_uscalar_t prim)
14641 {
14642 	mblk_t *mp;
14643 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
14644 	ipxop_t *ipx = ipsq->ipsq_xop;
14645 
14646 	ASSERT(IAM_WRITER_IPSQ(ipsq));
14647 	mutex_enter(&ill->ill_lock);
14648 
14649 	ASSERT(prim != DL_PRIM_INVAL);
14650 	ASSERT(ill->ill_dlpi_pending == prim);
14651 
14652 	ip1dbg(("ill_dlpi_done: %s has completed %s (%u)\n", ill->ill_name,
14653 	    dl_primstr(ill->ill_dlpi_pending), ill->ill_dlpi_pending));
14654 
14655 	if ((mp = ill->ill_dlpi_deferred) == NULL) {
14656 		ill->ill_dlpi_pending = DL_PRIM_INVAL;
14657 		if (ipx->ipx_current_done) {
14658 			mutex_enter(&ipx->ipx_lock);
14659 			ipx->ipx_current_ipif = NULL;
14660 			mutex_exit(&ipx->ipx_lock);
14661 		}
14662 		cv_signal(&ill->ill_cv);
14663 		mutex_exit(&ill->ill_lock);
14664 		return;
14665 	}
14666 
14667 	ill->ill_dlpi_deferred = mp->b_next;
14668 	mp->b_next = NULL;
14669 	mutex_exit(&ill->ill_lock);
14670 
14671 	ill_dlpi_dispatch(ill, mp);
14672 }
14673 
14674 void
14675 conn_delete_ire(conn_t *connp, caddr_t arg)
14676 {
14677 	ipif_t	*ipif = (ipif_t *)arg;
14678 	ire_t	*ire;
14679 
14680 	/*
14681 	 * Look at the cached ires on conns which has pointers to ipifs.
14682 	 * We just call ire_refrele which clears up the reference
14683 	 * to ire. Called when a conn closes. Also called from ipif_free
14684 	 * to cleanup indirect references to the stale ipif via the cached ire.
14685 	 */
14686 	mutex_enter(&connp->conn_lock);
14687 	ire = connp->conn_ire_cache;
14688 	if (ire != NULL && (ipif == NULL || ire->ire_ipif == ipif)) {
14689 		connp->conn_ire_cache = NULL;
14690 		mutex_exit(&connp->conn_lock);
14691 		IRE_REFRELE_NOTR(ire);
14692 		return;
14693 	}
14694 	mutex_exit(&connp->conn_lock);
14695 
14696 }
14697 
14698 /*
14699  * Some operations (e.g., ipif_down()) conditionally delete a number
14700  * of IREs. Those IREs may have been previously cached in the conn structure.
14701  * This ipcl_walk() walker function releases all references to such IREs based
14702  * on the condemned flag.
14703  */
14704 /* ARGSUSED */
14705 void
14706 conn_cleanup_stale_ire(conn_t *connp, caddr_t arg)
14707 {
14708 	ire_t	*ire;
14709 
14710 	mutex_enter(&connp->conn_lock);
14711 	ire = connp->conn_ire_cache;
14712 	if (ire != NULL && (ire->ire_marks & IRE_MARK_CONDEMNED)) {
14713 		connp->conn_ire_cache = NULL;
14714 		mutex_exit(&connp->conn_lock);
14715 		IRE_REFRELE_NOTR(ire);
14716 		return;
14717 	}
14718 	mutex_exit(&connp->conn_lock);
14719 }
14720 
14721 /*
14722  * Take down a specific interface, but don't lose any information about it.
14723  * (Always called as writer.)
14724  * This function goes through the down sequence even if the interface is
14725  * already down. There are 2 reasons.
14726  * a. Currently we permit interface routes that depend on down interfaces
14727  *    to be added. This behaviour itself is questionable. However it appears
14728  *    that both Solaris and 4.3 BSD have exhibited this behaviour for a long
14729  *    time. We go thru the cleanup in order to remove these routes.
14730  * b. The bringup of the interface could fail in ill_dl_up i.e. we get
14731  *    DL_ERROR_ACK in response to the the DL_BIND request. The interface is
14732  *    down, but we need to cleanup i.e. do ill_dl_down and
14733  *    ip_rput_dlpi_writer (DL_ERROR_ACK) -> ipif_down.
14734  *
14735  * IP-MT notes:
14736  *
14737  * Model of reference to interfaces.
14738  *
14739  * The following members in ipif_t track references to the ipif.
14740  *	int     ipif_refcnt;    Active reference count
14741  *	uint_t  ipif_ire_cnt;   Number of ire's referencing this ipif
14742  *	uint_t  ipif_ilm_cnt;   Number of ilms's references this ipif.
14743  *
14744  * The following members in ill_t track references to the ill.
14745  *	int             ill_refcnt;     active refcnt
14746  *	uint_t          ill_ire_cnt;	Number of ires referencing ill
14747  *	uint_t          ill_nce_cnt;	Number of nces referencing ill
14748  *	uint_t          ill_ilm_cnt;	Number of ilms referencing ill
14749  *
14750  * Reference to an ipif or ill can be obtained in any of the following ways.
14751  *
14752  * Through the lookup functions ipif_lookup_* / ill_lookup_* functions
14753  * Pointers to ipif / ill from other data structures viz ire and conn.
14754  * Implicit reference to the ipif / ill by holding a reference to the ire.
14755  *
14756  * The ipif/ill lookup functions return a reference held ipif / ill.
14757  * ipif_refcnt and ill_refcnt track the reference counts respectively.
14758  * This is a purely dynamic reference count associated with threads holding
14759  * references to the ipif / ill. Pointers from other structures do not
14760  * count towards this reference count.
14761  *
14762  * ipif_ire_cnt/ill_ire_cnt is the number of ire's
14763  * associated with the ipif/ill. This is incremented whenever a new
14764  * ire is created referencing the ipif/ill. This is done atomically inside
14765  * ire_add_v[46] where the ire is actually added to the ire hash table.
14766  * The count is decremented in ire_inactive where the ire is destroyed.
14767  *
14768  * nce's reference ill's thru nce_ill and the count of nce's associated with
14769  * an ill is recorded in ill_nce_cnt. This is incremented atomically in
14770  * ndp_add_v4()/ndp_add_v6() where the nce is actually added to the
14771  * table. Similarly it is decremented in ndp_inactive() where the nce
14772  * is destroyed.
14773  *
14774  * ilm's reference to the ipif (for IPv4 ilm's) or the ill (for IPv6 ilm's)
14775  * is incremented in ilm_add_v6() and decremented before the ilm is freed
14776  * in ilm_walker_cleanup() or ilm_delete().
14777  *
14778  * Flow of ioctls involving interface down/up
14779  *
14780  * The following is the sequence of an attempt to set some critical flags on an
14781  * up interface.
14782  * ip_sioctl_flags
14783  * ipif_down
14784  * wait for ipif to be quiescent
14785  * ipif_down_tail
14786  * ip_sioctl_flags_tail
14787  *
14788  * All set ioctls that involve down/up sequence would have a skeleton similar
14789  * to the above. All the *tail functions are called after the refcounts have
14790  * dropped to the appropriate values.
14791  *
14792  * The mechanism to quiesce an ipif is as follows.
14793  *
14794  * Mark the ipif as IPIF_CHANGING. No more lookups will be allowed
14795  * on the ipif. Callers either pass a flag requesting wait or the lookup
14796  *  functions will return NULL.
14797  *
14798  * Delete all ires referencing this ipif
14799  *
14800  * Any thread attempting to do an ipif_refhold on an ipif that has been
14801  * obtained thru a cached pointer will first make sure that
14802  * the ipif can be refheld using the macro IPIF_CAN_LOOKUP and only then
14803  * increment the refcount.
14804  *
14805  * The above guarantees that the ipif refcount will eventually come down to
14806  * zero and the ipif will quiesce, once all threads that currently hold a
14807  * reference to the ipif refrelease the ipif. The ipif is quiescent after the
14808  * ipif_refcount has dropped to zero and all ire's associated with this ipif
14809  * have also been ire_inactive'd. i.e. when ipif_{ire, ill}_cnt and
14810  * ipif_refcnt both drop to zero. See also: comments above IPIF_DOWN_OK()
14811  * in ip.h
14812  *
14813  * Lookups during the IPIF_CHANGING/ILL_CHANGING interval.
14814  *
14815  * Threads trying to lookup an ipif or ill can pass a flag requesting
14816  * wait and restart if the ipif / ill cannot be looked up currently.
14817  * For eg. bind, and route operations (Eg. route add / delete) cannot return
14818  * failure if the ipif is currently undergoing an exclusive operation, and
14819  * hence pass the flag. The mblk is then enqueued in the ipsq and the operation
14820  * is restarted by ipsq_exit() when the current exclusive operation completes.
14821  * The lookup and enqueue is atomic using the ill_lock and ipsq_lock. The
14822  * lookup is done holding the ill_lock. Hence the ill/ipif state flags can't
14823  * change while the ill_lock is held. Before dropping the ill_lock we acquire
14824  * the ipsq_lock and call ipsq_enq. This ensures that ipsq_exit can't finish
14825  * until we release the ipsq_lock, even though the the ill/ipif state flags
14826  * can change after we drop the ill_lock.
14827  *
14828  * An attempt to send out a packet using an ipif that is currently
14829  * IPIF_CHANGING will fail. No attempt is made in this case to enqueue this
14830  * operation and restart it later when the exclusive condition on the ipif ends.
14831  * This is an example of not passing the wait flag to the lookup functions. For
14832  * example an attempt to refhold and use conn->conn_multicast_ipif and send
14833  * out a multicast packet on that ipif will fail while the ipif is
14834  * IPIF_CHANGING. An attempt to create an IRE_CACHE using an ipif that is
14835  * currently IPIF_CHANGING will also fail.
14836  */
14837 int
14838 ipif_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
14839 {
14840 	ill_t		*ill = ipif->ipif_ill;
14841 	conn_t		*connp;
14842 	boolean_t	success;
14843 	boolean_t	ipif_was_up = B_FALSE;
14844 	ip_stack_t	*ipst = ill->ill_ipst;
14845 
14846 	ASSERT(IAM_WRITER_IPIF(ipif));
14847 
14848 	ip1dbg(("ipif_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
14849 
14850 	if (ipif->ipif_flags & IPIF_UP) {
14851 		mutex_enter(&ill->ill_lock);
14852 		ipif->ipif_flags &= ~IPIF_UP;
14853 		ASSERT(ill->ill_ipif_up_count > 0);
14854 		--ill->ill_ipif_up_count;
14855 		mutex_exit(&ill->ill_lock);
14856 		ipif_was_up = B_TRUE;
14857 		/* Update status in SCTP's list */
14858 		sctp_update_ipif(ipif, SCTP_IPIF_DOWN);
14859 		ill_nic_event_dispatch(ipif->ipif_ill,
14860 		    MAP_IPIF_ID(ipif->ipif_id), NE_LIF_DOWN, NULL, 0);
14861 	}
14862 
14863 	/*
14864 	 * Blow away memberships we established in ipif_multicast_up().
14865 	 */
14866 	ipif_multicast_down(ipif);
14867 
14868 	/*
14869 	 * Remove from the mapping for __sin6_src_id. We insert only
14870 	 * when the address is not INADDR_ANY. As IPv4 addresses are
14871 	 * stored as mapped addresses, we need to check for mapped
14872 	 * INADDR_ANY also.
14873 	 */
14874 	if (ipif_was_up && !IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
14875 	    !IN6_IS_ADDR_V4MAPPED_ANY(&ipif->ipif_v6lcl_addr) &&
14876 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14877 		int err;
14878 
14879 		err = ip_srcid_remove(&ipif->ipif_v6lcl_addr,
14880 		    ipif->ipif_zoneid, ipst);
14881 		if (err != 0) {
14882 			ip0dbg(("ipif_down: srcid_remove %d\n", err));
14883 		}
14884 	}
14885 
14886 	/*
14887 	 * Delete all IRE's pointing at this ipif or its source address.
14888 	 */
14889 	if (ipif->ipif_isv6) {
14890 		ire_walk_v6(ipif_down_delete_ire, (char *)ipif, ALL_ZONES,
14891 		    ipst);
14892 	} else {
14893 		ire_walk_v4(ipif_down_delete_ire, (char *)ipif, ALL_ZONES,
14894 		    ipst);
14895 	}
14896 
14897 	if (ipif_was_up && ill->ill_ipif_up_count == 0) {
14898 		/*
14899 		 * Since the interface is now down, it may have just become
14900 		 * inactive.  Note that this needs to be done even for a
14901 		 * lll_logical_down(), or ARP entries will not get correctly
14902 		 * restored when the interface comes back up.
14903 		 */
14904 		if (IS_UNDER_IPMP(ill))
14905 			ipmp_ill_refresh_active(ill);
14906 	}
14907 
14908 	/*
14909 	 * Cleaning up the conn_ire_cache or conns must be done only after the
14910 	 * ires have been deleted above. Otherwise a thread could end up
14911 	 * caching an ire in a conn after we have finished the cleanup of the
14912 	 * conn. The caching is done after making sure that the ire is not yet
14913 	 * condemned. Also documented in the block comment above ip_output
14914 	 */
14915 	ipcl_walk(conn_cleanup_stale_ire, NULL, ipst);
14916 	/* Also, delete the ires cached in SCTP */
14917 	sctp_ire_cache_flush(ipif);
14918 
14919 	/*
14920 	 * Update any other ipifs which have used "our" local address as
14921 	 * a source address. This entails removing and recreating IRE_INTERFACE
14922 	 * entries for such ipifs.
14923 	 */
14924 	if (ipif->ipif_isv6)
14925 		ipif_update_other_ipifs_v6(ipif);
14926 	else
14927 		ipif_update_other_ipifs(ipif);
14928 
14929 	/*
14930 	 * neighbor-discovery or arp entries for this interface.
14931 	 */
14932 	ipif_ndp_down(ipif);
14933 
14934 	/*
14935 	 * If mp is NULL the caller will wait for the appropriate refcnt.
14936 	 * Eg. ip_sioctl_removeif -> ipif_free  -> ipif_down
14937 	 * and ill_delete -> ipif_free -> ipif_down
14938 	 */
14939 	if (mp == NULL) {
14940 		ASSERT(q == NULL);
14941 		return (0);
14942 	}
14943 
14944 	if (CONN_Q(q)) {
14945 		connp = Q_TO_CONN(q);
14946 		mutex_enter(&connp->conn_lock);
14947 	} else {
14948 		connp = NULL;
14949 	}
14950 	mutex_enter(&ill->ill_lock);
14951 	/*
14952 	 * Are there any ire's pointing to this ipif that are still active ?
14953 	 * If this is the last ipif going down, are there any ire's pointing
14954 	 * to this ill that are still active ?
14955 	 */
14956 	if (ipif_is_quiescent(ipif)) {
14957 		mutex_exit(&ill->ill_lock);
14958 		if (connp != NULL)
14959 			mutex_exit(&connp->conn_lock);
14960 		return (0);
14961 	}
14962 
14963 	ip1dbg(("ipif_down: need to wait, adding pending mp %s ill %p",
14964 	    ill->ill_name, (void *)ill));
14965 	/*
14966 	 * Enqueue the mp atomically in ipsq_pending_mp. When the refcount
14967 	 * drops down, the operation will be restarted by ipif_ill_refrele_tail
14968 	 * which in turn is called by the last refrele on the ipif/ill/ire.
14969 	 */
14970 	success = ipsq_pending_mp_add(connp, ipif, q, mp, IPIF_DOWN);
14971 	if (!success) {
14972 		/* The conn is closing. So just return */
14973 		ASSERT(connp != NULL);
14974 		mutex_exit(&ill->ill_lock);
14975 		mutex_exit(&connp->conn_lock);
14976 		return (EINTR);
14977 	}
14978 
14979 	mutex_exit(&ill->ill_lock);
14980 	if (connp != NULL)
14981 		mutex_exit(&connp->conn_lock);
14982 	return (EINPROGRESS);
14983 }
14984 
14985 void
14986 ipif_down_tail(ipif_t *ipif)
14987 {
14988 	ill_t	*ill = ipif->ipif_ill;
14989 
14990 	/*
14991 	 * Skip any loopback interface (null wq).
14992 	 * If this is the last logical interface on the ill
14993 	 * have ill_dl_down tell the driver we are gone (unbind)
14994 	 * Note that lun 0 can ipif_down even though
14995 	 * there are other logical units that are up.
14996 	 * This occurs e.g. when we change a "significant" IFF_ flag.
14997 	 */
14998 	if (ill->ill_wq != NULL && !ill->ill_logical_down &&
14999 	    ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
15000 	    ill->ill_dl_up) {
15001 		ill_dl_down(ill);
15002 	}
15003 	ill->ill_logical_down = 0;
15004 
15005 	/*
15006 	 * Has to be after removing the routes in ipif_down_delete_ire.
15007 	 */
15008 	ipif_resolver_down(ipif);
15009 
15010 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
15011 	ip_rts_newaddrmsg(RTM_DELETE, 0, ipif, RTSQ_DEFAULT);
15012 }
15013 
15014 /*
15015  * Bring interface logically down without bringing the physical interface
15016  * down e.g. when the netmask is changed. This avoids long lasting link
15017  * negotiations between an ethernet interface and a certain switches.
15018  */
15019 static int
15020 ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
15021 {
15022 	/*
15023 	 * The ill_logical_down flag is a transient flag. It is set here
15024 	 * and is cleared once the down has completed in ipif_down_tail.
15025 	 * This flag does not indicate whether the ill stream is in the
15026 	 * DL_BOUND state with the driver. Instead this flag is used by
15027 	 * ipif_down_tail to determine whether to DL_UNBIND the stream with
15028 	 * the driver. The state of the ill stream i.e. whether it is
15029 	 * DL_BOUND with the driver or not is indicated by the ill_dl_up flag.
15030 	 */
15031 	ipif->ipif_ill->ill_logical_down = 1;
15032 	return (ipif_down(ipif, q, mp));
15033 }
15034 
15035 /*
15036  * This is called when the SIOCSLIFUSESRC ioctl is processed in IP.
15037  * If the usesrc client ILL is already part of a usesrc group or not,
15038  * in either case a ire_stq with the matching usesrc client ILL will
15039  * locate the IRE's that need to be deleted. We want IREs to be created
15040  * with the new source address.
15041  */
15042 static void
15043 ipif_delete_cache_ire(ire_t *ire, char *ill_arg)
15044 {
15045 	ill_t	*ucill = (ill_t *)ill_arg;
15046 
15047 	ASSERT(IAM_WRITER_ILL(ucill));
15048 
15049 	if (ire->ire_stq == NULL)
15050 		return;
15051 
15052 	if ((ire->ire_type == IRE_CACHE) &&
15053 	    ((ill_t *)ire->ire_stq->q_ptr == ucill))
15054 		ire_delete(ire);
15055 }
15056 
15057 /*
15058  * ire_walk routine to delete every IRE dependent on the interface
15059  * address that is going down.	(Always called as writer.)
15060  * Works for both v4 and v6.
15061  * In addition for checking for ire_ipif matches it also checks for
15062  * IRE_CACHE entries which have the same source address as the
15063  * disappearing ipif since ipif_select_source might have picked
15064  * that source. Note that ipif_down/ipif_update_other_ipifs takes
15065  * care of any IRE_INTERFACE with the disappearing source address.
15066  */
15067 static void
15068 ipif_down_delete_ire(ire_t *ire, char *ipif_arg)
15069 {
15070 	ipif_t	*ipif = (ipif_t *)ipif_arg;
15071 
15072 	ASSERT(IAM_WRITER_IPIF(ipif));
15073 	if (ire->ire_ipif == NULL)
15074 		return;
15075 
15076 	if (ire->ire_ipif != ipif) {
15077 		/*
15078 		 * Look for a matching source address.
15079 		 */
15080 		if (ire->ire_type != IRE_CACHE)
15081 			return;
15082 		if (ipif->ipif_flags & IPIF_NOLOCAL)
15083 			return;
15084 
15085 		if (ire->ire_ipversion == IPV4_VERSION) {
15086 			if (ire->ire_src_addr != ipif->ipif_src_addr)
15087 				return;
15088 		} else {
15089 			if (!IN6_ARE_ADDR_EQUAL(&ire->ire_src_addr_v6,
15090 			    &ipif->ipif_v6lcl_addr))
15091 				return;
15092 		}
15093 		ire_delete(ire);
15094 		return;
15095 	}
15096 	/*
15097 	 * ire_delete() will do an ire_flush_cache which will delete
15098 	 * all ire_ipif matches
15099 	 */
15100 	ire_delete(ire);
15101 }
15102 
15103 /*
15104  * ire_walk_ill function for deleting all IRE_CACHE entries for an ill when
15105  * 1) an ipif (on that ill) changes the IPIF_DEPRECATED flags, or
15106  * 2) when an interface is brought up or down (on that ill).
15107  * This ensures that the IRE_CACHE entries don't retain stale source
15108  * address selection results.
15109  */
15110 void
15111 ill_ipif_cache_delete(ire_t *ire, char *ill_arg)
15112 {
15113 	ill_t	*ill = (ill_t *)ill_arg;
15114 
15115 	ASSERT(IAM_WRITER_ILL(ill));
15116 	ASSERT(ire->ire_type == IRE_CACHE);
15117 
15118 	/*
15119 	 * We are called for IRE_CACHEs whose ire_stq or ire_ipif matches
15120 	 * ill, but we only want to delete the IRE if ire_ipif matches.
15121 	 */
15122 	ASSERT(ire->ire_ipif != NULL);
15123 	if (ill == ire->ire_ipif->ipif_ill)
15124 		ire_delete(ire);
15125 }
15126 
15127 /*
15128  * Delete all the IREs whose ire_stq's reference `ill_arg'.  IPMP uses this
15129  * instead of ill_ipif_cache_delete() because ire_ipif->ipif_ill references
15130  * the IPMP ill.
15131  */
15132 void
15133 ill_stq_cache_delete(ire_t *ire, char *ill_arg)
15134 {
15135 	ill_t	*ill = (ill_t *)ill_arg;
15136 
15137 	ASSERT(IAM_WRITER_ILL(ill));
15138 	ASSERT(ire->ire_type == IRE_CACHE);
15139 
15140 	/*
15141 	 * We are called for IRE_CACHEs whose ire_stq or ire_ipif matches
15142 	 * ill, but we only want to delete the IRE if ire_stq matches.
15143 	 */
15144 	if (ire->ire_stq->q_ptr == ill_arg)
15145 		ire_delete(ire);
15146 }
15147 
15148 /*
15149  * Delete all broadcast IREs with a source address on `ill_arg'.
15150  */
15151 static void
15152 ill_broadcast_delete(ire_t *ire, char *ill_arg)
15153 {
15154 	ill_t *ill = (ill_t *)ill_arg;
15155 
15156 	ASSERT(IAM_WRITER_ILL(ill));
15157 	ASSERT(ire->ire_type == IRE_BROADCAST);
15158 
15159 	if (ire->ire_ipif->ipif_ill == ill)
15160 		ire_delete(ire);
15161 }
15162 
15163 /*
15164  * Initiate deallocate of an IPIF. Always called as writer. Called by
15165  * ill_delete or ip_sioctl_removeif.
15166  */
15167 static void
15168 ipif_free(ipif_t *ipif)
15169 {
15170 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
15171 
15172 	ASSERT(IAM_WRITER_IPIF(ipif));
15173 
15174 	if (ipif->ipif_recovery_id != 0)
15175 		(void) untimeout(ipif->ipif_recovery_id);
15176 	ipif->ipif_recovery_id = 0;
15177 
15178 	/* Remove conn references */
15179 	reset_conn_ipif(ipif);
15180 
15181 	/*
15182 	 * Make sure we have valid net and subnet broadcast ire's for the
15183 	 * other ipif's which share them with this ipif.
15184 	 */
15185 	if (!ipif->ipif_isv6)
15186 		ipif_check_bcast_ires(ipif);
15187 
15188 	/*
15189 	 * Take down the interface. We can be called either from ill_delete
15190 	 * or from ip_sioctl_removeif.
15191 	 */
15192 	(void) ipif_down(ipif, NULL, NULL);
15193 
15194 	/*
15195 	 * Now that the interface is down, there's no chance it can still
15196 	 * become a duplicate.  Cancel any timer that may have been set while
15197 	 * tearing down.
15198 	 */
15199 	if (ipif->ipif_recovery_id != 0)
15200 		(void) untimeout(ipif->ipif_recovery_id);
15201 	ipif->ipif_recovery_id = 0;
15202 
15203 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15204 	/* Remove pointers to this ill in the multicast routing tables */
15205 	reset_mrt_vif_ipif(ipif);
15206 	/* If necessary, clear the cached source ipif rotor. */
15207 	if (ipif->ipif_ill->ill_src_ipif == ipif)
15208 		ipif->ipif_ill->ill_src_ipif = NULL;
15209 	rw_exit(&ipst->ips_ill_g_lock);
15210 }
15211 
15212 static void
15213 ipif_free_tail(ipif_t *ipif)
15214 {
15215 	mblk_t	*mp;
15216 	ip_stack_t *ipst = ipif->ipif_ill->ill_ipst;
15217 
15218 	/*
15219 	 * Free state for addition IRE_IF_[NO]RESOLVER ire's.
15220 	 */
15221 	mutex_enter(&ipif->ipif_saved_ire_lock);
15222 	mp = ipif->ipif_saved_ire_mp;
15223 	ipif->ipif_saved_ire_mp = NULL;
15224 	mutex_exit(&ipif->ipif_saved_ire_lock);
15225 	freemsg(mp);
15226 
15227 	/*
15228 	 * Need to hold both ill_g_lock and ill_lock while
15229 	 * inserting or removing an ipif from the linked list
15230 	 * of ipifs hanging off the ill.
15231 	 */
15232 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15233 
15234 	ASSERT(ilm_walk_ipif(ipif) == 0);
15235 
15236 #ifdef DEBUG
15237 	ipif_trace_cleanup(ipif);
15238 #endif
15239 
15240 	/* Ask SCTP to take it out of it list */
15241 	sctp_update_ipif(ipif, SCTP_IPIF_REMOVE);
15242 
15243 	/* Get it out of the ILL interface list. */
15244 	ipif_remove(ipif);
15245 	rw_exit(&ipst->ips_ill_g_lock);
15246 
15247 	mutex_destroy(&ipif->ipif_saved_ire_lock);
15248 
15249 	ASSERT(!(ipif->ipif_flags & (IPIF_UP | IPIF_DUPLICATE)));
15250 	ASSERT(ipif->ipif_recovery_id == 0);
15251 
15252 	/* Free the memory. */
15253 	mi_free(ipif);
15254 }
15255 
15256 /*
15257  * Sets `buf' to an ipif name of the form "ill_name:id", or "ill_name" if "id"
15258  * is zero.
15259  */
15260 void
15261 ipif_get_name(const ipif_t *ipif, char *buf, int len)
15262 {
15263 	char	lbuf[LIFNAMSIZ];
15264 	char	*name;
15265 	size_t	name_len;
15266 
15267 	buf[0] = '\0';
15268 	name = ipif->ipif_ill->ill_name;
15269 	name_len = ipif->ipif_ill->ill_name_length;
15270 	if (ipif->ipif_id != 0) {
15271 		(void) sprintf(lbuf, "%s%c%d", name, IPIF_SEPARATOR_CHAR,
15272 		    ipif->ipif_id);
15273 		name = lbuf;
15274 		name_len = mi_strlen(name) + 1;
15275 	}
15276 	len -= 1;
15277 	buf[len] = '\0';
15278 	len = MIN(len, name_len);
15279 	bcopy(name, buf, len);
15280 }
15281 
15282 /*
15283  * Find an IPIF based on the name passed in.  Names can be of the
15284  * form <phys> (e.g., le0), <phys>:<#> (e.g., le0:1),
15285  * The <phys> string can have forms like <dev><#> (e.g., le0),
15286  * <dev><#>.<module> (e.g. le0.foo), or <dev>.<module><#> (e.g. ip.tun3).
15287  * When there is no colon, the implied unit id is zero. <phys> must
15288  * correspond to the name of an ILL.  (May be called as writer.)
15289  */
15290 static ipif_t *
15291 ipif_lookup_on_name(char *name, size_t namelen, boolean_t do_alloc,
15292     boolean_t *exists, boolean_t isv6, zoneid_t zoneid, queue_t *q,
15293     mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst)
15294 {
15295 	char	*cp;
15296 	char	*endp;
15297 	long	id;
15298 	ill_t	*ill;
15299 	ipif_t	*ipif;
15300 	uint_t	ire_type;
15301 	boolean_t did_alloc = B_FALSE;
15302 	ipsq_t	*ipsq;
15303 
15304 	if (error != NULL)
15305 		*error = 0;
15306 
15307 	/*
15308 	 * If the caller wants to us to create the ipif, make sure we have a
15309 	 * valid zoneid
15310 	 */
15311 	ASSERT(!do_alloc || zoneid != ALL_ZONES);
15312 
15313 	if (namelen == 0) {
15314 		if (error != NULL)
15315 			*error = ENXIO;
15316 		return (NULL);
15317 	}
15318 
15319 	*exists = B_FALSE;
15320 	/* Look for a colon in the name. */
15321 	endp = &name[namelen];
15322 	for (cp = endp; --cp > name; ) {
15323 		if (*cp == IPIF_SEPARATOR_CHAR)
15324 			break;
15325 	}
15326 
15327 	if (*cp == IPIF_SEPARATOR_CHAR) {
15328 		/*
15329 		 * Reject any non-decimal aliases for logical
15330 		 * interfaces. Aliases with leading zeroes
15331 		 * are also rejected as they introduce ambiguity
15332 		 * in the naming of the interfaces.
15333 		 * In order to confirm with existing semantics,
15334 		 * and to not break any programs/script relying
15335 		 * on that behaviour, if<0>:0 is considered to be
15336 		 * a valid interface.
15337 		 *
15338 		 * If alias has two or more digits and the first
15339 		 * is zero, fail.
15340 		 */
15341 		if (&cp[2] < endp && cp[1] == '0') {
15342 			if (error != NULL)
15343 				*error = EINVAL;
15344 			return (NULL);
15345 		}
15346 	}
15347 
15348 	if (cp <= name) {
15349 		cp = endp;
15350 	} else {
15351 		*cp = '\0';
15352 	}
15353 
15354 	/*
15355 	 * Look up the ILL, based on the portion of the name
15356 	 * before the slash. ill_lookup_on_name returns a held ill.
15357 	 * Temporary to check whether ill exists already. If so
15358 	 * ill_lookup_on_name will clear it.
15359 	 */
15360 	ill = ill_lookup_on_name(name, do_alloc, isv6,
15361 	    q, mp, func, error, &did_alloc, ipst);
15362 	if (cp != endp)
15363 		*cp = IPIF_SEPARATOR_CHAR;
15364 	if (ill == NULL)
15365 		return (NULL);
15366 
15367 	/* Establish the unit number in the name. */
15368 	id = 0;
15369 	if (cp < endp && *endp == '\0') {
15370 		/* If there was a colon, the unit number follows. */
15371 		cp++;
15372 		if (ddi_strtol(cp, NULL, 0, &id) != 0) {
15373 			ill_refrele(ill);
15374 			if (error != NULL)
15375 				*error = ENXIO;
15376 			return (NULL);
15377 		}
15378 	}
15379 
15380 	GRAB_CONN_LOCK(q);
15381 	mutex_enter(&ill->ill_lock);
15382 	/* Now see if there is an IPIF with this unit number. */
15383 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
15384 		if (ipif->ipif_id == id) {
15385 			if (zoneid != ALL_ZONES &&
15386 			    zoneid != ipif->ipif_zoneid &&
15387 			    ipif->ipif_zoneid != ALL_ZONES) {
15388 				mutex_exit(&ill->ill_lock);
15389 				RELEASE_CONN_LOCK(q);
15390 				ill_refrele(ill);
15391 				if (error != NULL)
15392 					*error = ENXIO;
15393 				return (NULL);
15394 			}
15395 			/*
15396 			 * The block comment at the start of ipif_down
15397 			 * explains the use of the macros used below
15398 			 */
15399 			if (IPIF_CAN_LOOKUP(ipif)) {
15400 				ipif_refhold_locked(ipif);
15401 				mutex_exit(&ill->ill_lock);
15402 				if (!did_alloc)
15403 					*exists = B_TRUE;
15404 				/*
15405 				 * Drop locks before calling ill_refrele
15406 				 * since it can potentially call into
15407 				 * ipif_ill_refrele_tail which can end up
15408 				 * in trying to acquire any lock.
15409 				 */
15410 				RELEASE_CONN_LOCK(q);
15411 				ill_refrele(ill);
15412 				return (ipif);
15413 			} else if (IPIF_CAN_WAIT(ipif, q)) {
15414 				ipsq = ill->ill_phyint->phyint_ipsq;
15415 				mutex_enter(&ipsq->ipsq_lock);
15416 				mutex_enter(&ipsq->ipsq_xop->ipx_lock);
15417 				mutex_exit(&ill->ill_lock);
15418 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
15419 				mutex_exit(&ipsq->ipsq_xop->ipx_lock);
15420 				mutex_exit(&ipsq->ipsq_lock);
15421 				RELEASE_CONN_LOCK(q);
15422 				ill_refrele(ill);
15423 				if (error != NULL)
15424 					*error = EINPROGRESS;
15425 				return (NULL);
15426 			}
15427 		}
15428 	}
15429 	RELEASE_CONN_LOCK(q);
15430 
15431 	if (!do_alloc) {
15432 		mutex_exit(&ill->ill_lock);
15433 		ill_refrele(ill);
15434 		if (error != NULL)
15435 			*error = ENXIO;
15436 		return (NULL);
15437 	}
15438 
15439 	/*
15440 	 * If none found, atomically allocate and return a new one.
15441 	 * Historically, we used IRE_LOOPBACK only for lun 0, and IRE_LOCAL
15442 	 * to support "receive only" use of lo0:1 etc. as is still done
15443 	 * below as an initial guess.
15444 	 * However, this is now likely to be overriden later in ipif_up_done()
15445 	 * when we know for sure what address has been configured on the
15446 	 * interface, since we might have more than one loopback interface
15447 	 * with a loopback address, e.g. in the case of zones, and all the
15448 	 * interfaces with loopback addresses need to be marked IRE_LOOPBACK.
15449 	 */
15450 	if (ill->ill_net_type == IRE_LOOPBACK && id == 0)
15451 		ire_type = IRE_LOOPBACK;
15452 	else
15453 		ire_type = IRE_LOCAL;
15454 	ipif = ipif_allocate(ill, id, ire_type, B_TRUE, B_TRUE);
15455 	if (ipif != NULL)
15456 		ipif_refhold_locked(ipif);
15457 	else if (error != NULL)
15458 		*error = ENOMEM;
15459 	mutex_exit(&ill->ill_lock);
15460 	ill_refrele(ill);
15461 	return (ipif);
15462 }
15463 
15464 /*
15465  * This routine is called whenever a new address comes up on an ipif.  If
15466  * we are configured to respond to address mask requests, then we are supposed
15467  * to broadcast an address mask reply at this time.  This routine is also
15468  * called if we are already up, but a netmask change is made.  This is legal
15469  * but might not make the system manager very popular.	(May be called
15470  * as writer.)
15471  */
15472 void
15473 ipif_mask_reply(ipif_t *ipif)
15474 {
15475 	icmph_t	*icmph;
15476 	ipha_t	*ipha;
15477 	mblk_t	*mp;
15478 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
15479 
15480 #define	REPLY_LEN	(sizeof (icmp_ipha) + sizeof (icmph_t) + IP_ADDR_LEN)
15481 
15482 	if (!ipst->ips_ip_respond_to_address_mask_broadcast)
15483 		return;
15484 
15485 	/* ICMP mask reply is IPv4 only */
15486 	ASSERT(!ipif->ipif_isv6);
15487 	/* ICMP mask reply is not for a loopback interface */
15488 	ASSERT(ipif->ipif_ill->ill_wq != NULL);
15489 
15490 	mp = allocb(REPLY_LEN, BPRI_HI);
15491 	if (mp == NULL)
15492 		return;
15493 	mp->b_wptr = mp->b_rptr + REPLY_LEN;
15494 
15495 	ipha = (ipha_t *)mp->b_rptr;
15496 	bzero(ipha, REPLY_LEN);
15497 	*ipha = icmp_ipha;
15498 	ipha->ipha_ttl = ipst->ips_ip_broadcast_ttl;
15499 	ipha->ipha_src = ipif->ipif_src_addr;
15500 	ipha->ipha_dst = ipif->ipif_brd_addr;
15501 	ipha->ipha_length = htons(REPLY_LEN);
15502 	ipha->ipha_ident = 0;
15503 
15504 	icmph = (icmph_t *)&ipha[1];
15505 	icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY;
15506 	bcopy(&ipif->ipif_net_mask, &icmph[1], IP_ADDR_LEN);
15507 	icmph->icmph_checksum = IP_CSUM(mp, sizeof (ipha_t), 0);
15508 
15509 	put(ipif->ipif_wq, mp);
15510 
15511 #undef	REPLY_LEN
15512 }
15513 
15514 /*
15515  * When the mtu in the ipif changes, we call this routine through ire_walk
15516  * to update all the relevant IREs.
15517  * Skip IRE_LOCAL and "loopback" IRE_BROADCAST by checking ire_stq.
15518  */
15519 static void
15520 ipif_mtu_change(ire_t *ire, char *ipif_arg)
15521 {
15522 	ipif_t *ipif = (ipif_t *)ipif_arg;
15523 
15524 	if (ire->ire_stq == NULL || ire->ire_ipif != ipif)
15525 		return;
15526 	ire->ire_max_frag = MIN(ipif->ipif_mtu, IP_MAXPACKET);
15527 }
15528 
15529 /*
15530  * When the mtu in the ill changes, we call this routine through ire_walk
15531  * to update all the relevant IREs.
15532  * Skip IRE_LOCAL and "loopback" IRE_BROADCAST by checking ire_stq.
15533  */
15534 void
15535 ill_mtu_change(ire_t *ire, char *ill_arg)
15536 {
15537 	ill_t	*ill = (ill_t *)ill_arg;
15538 
15539 	if (ire->ire_stq == NULL || ire->ire_ipif->ipif_ill != ill)
15540 		return;
15541 	ire->ire_max_frag = ire->ire_ipif->ipif_mtu;
15542 }
15543 
15544 /*
15545  * Join the ipif specific multicast groups.
15546  * Must be called after a mapping has been set up in the resolver.  (Always
15547  * called as writer.)
15548  */
15549 void
15550 ipif_multicast_up(ipif_t *ipif)
15551 {
15552 	int err;
15553 	ill_t *ill;
15554 
15555 	ASSERT(IAM_WRITER_IPIF(ipif));
15556 
15557 	ill = ipif->ipif_ill;
15558 
15559 	ip1dbg(("ipif_multicast_up\n"));
15560 	if (!(ill->ill_flags & ILLF_MULTICAST) || ipif->ipif_multicast_up)
15561 		return;
15562 
15563 	if (ipif->ipif_isv6) {
15564 		in6_addr_t v6allmc = ipv6_all_hosts_mcast;
15565 		in6_addr_t v6solmc = ipv6_solicited_node_mcast;
15566 
15567 		v6solmc.s6_addr32[3] |= ipif->ipif_v6lcl_addr.s6_addr32[3];
15568 
15569 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
15570 			return;
15571 
15572 		ip1dbg(("ipif_multicast_up - addmulti\n"));
15573 
15574 		/*
15575 		 * Join the all hosts multicast address.  We skip this for
15576 		 * underlying IPMP interfaces since they should be invisible.
15577 		 */
15578 		if (!IS_UNDER_IPMP(ill)) {
15579 			err = ip_addmulti_v6(&v6allmc, ill, ipif->ipif_zoneid,
15580 			    ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
15581 			if (err != 0) {
15582 				ip0dbg(("ipif_multicast_up: "
15583 				    "all_hosts_mcast failed %d\n", err));
15584 				return;
15585 			}
15586 			ipif->ipif_joined_allhosts = 1;
15587 		}
15588 
15589 		/*
15590 		 * Enable multicast for the solicited node multicast address
15591 		 */
15592 		if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
15593 			err = ip_addmulti_v6(&v6solmc, ill, ipif->ipif_zoneid,
15594 			    ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
15595 			if (err != 0) {
15596 				ip0dbg(("ipif_multicast_up: solicited MC"
15597 				    " failed %d\n", err));
15598 				if (ipif->ipif_joined_allhosts) {
15599 					(void) ip_delmulti_v6(&v6allmc, ill,
15600 					    ipif->ipif_zoneid, B_TRUE, B_TRUE);
15601 					ipif->ipif_joined_allhosts = 0;
15602 				}
15603 				return;
15604 			}
15605 		}
15606 	} else {
15607 		if (ipif->ipif_lcl_addr == INADDR_ANY || IS_UNDER_IPMP(ill))
15608 			return;
15609 
15610 		/* Join the all hosts multicast address */
15611 		ip1dbg(("ipif_multicast_up - addmulti\n"));
15612 		err = ip_addmulti(htonl(INADDR_ALLHOSTS_GROUP), ipif,
15613 		    ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
15614 		if (err) {
15615 			ip0dbg(("ipif_multicast_up: failed %d\n", err));
15616 			return;
15617 		}
15618 	}
15619 	ipif->ipif_multicast_up = 1;
15620 }
15621 
15622 /*
15623  * Blow away any multicast groups that we joined in ipif_multicast_up().
15624  * (Explicit memberships are blown away in ill_leave_multicast() when the
15625  * ill is brought down.)
15626  */
15627 void
15628 ipif_multicast_down(ipif_t *ipif)
15629 {
15630 	int err;
15631 
15632 	ASSERT(IAM_WRITER_IPIF(ipif));
15633 
15634 	ip1dbg(("ipif_multicast_down\n"));
15635 	if (!ipif->ipif_multicast_up)
15636 		return;
15637 
15638 	ip1dbg(("ipif_multicast_down - delmulti\n"));
15639 
15640 	if (!ipif->ipif_isv6) {
15641 		err = ip_delmulti(htonl(INADDR_ALLHOSTS_GROUP), ipif, B_TRUE,
15642 		    B_TRUE);
15643 		if (err != 0)
15644 			ip0dbg(("ipif_multicast_down: failed %d\n", err));
15645 
15646 		ipif->ipif_multicast_up = 0;
15647 		return;
15648 	}
15649 
15650 	/*
15651 	 * Leave the all-hosts multicast address.
15652 	 */
15653 	if (ipif->ipif_joined_allhosts) {
15654 		err = ip_delmulti_v6(&ipv6_all_hosts_mcast, ipif->ipif_ill,
15655 		    ipif->ipif_zoneid, B_TRUE, B_TRUE);
15656 		if (err != 0) {
15657 			ip0dbg(("ipif_multicast_down: all_hosts_mcast "
15658 			    "failed %d\n", err));
15659 		}
15660 		ipif->ipif_joined_allhosts = 0;
15661 	}
15662 
15663 	/*
15664 	 * Disable multicast for the solicited node multicast address
15665 	 */
15666 	if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
15667 		in6_addr_t ipv6_multi = ipv6_solicited_node_mcast;
15668 
15669 		ipv6_multi.s6_addr32[3] |=
15670 		    ipif->ipif_v6lcl_addr.s6_addr32[3];
15671 
15672 		err = ip_delmulti_v6(&ipv6_multi, ipif->ipif_ill,
15673 		    ipif->ipif_zoneid, B_TRUE, B_TRUE);
15674 		if (err != 0) {
15675 			ip0dbg(("ipif_multicast_down: sol MC failed %d\n",
15676 			    err));
15677 		}
15678 	}
15679 
15680 	ipif->ipif_multicast_up = 0;
15681 }
15682 
15683 /*
15684  * Used when an interface comes up to recreate any extra routes on this
15685  * interface.
15686  */
15687 static ire_t **
15688 ipif_recover_ire(ipif_t *ipif)
15689 {
15690 	mblk_t	*mp;
15691 	ire_t	**ipif_saved_irep;
15692 	ire_t	**irep;
15693 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
15694 
15695 	ip1dbg(("ipif_recover_ire(%s:%u)", ipif->ipif_ill->ill_name,
15696 	    ipif->ipif_id));
15697 
15698 	mutex_enter(&ipif->ipif_saved_ire_lock);
15699 	ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) *
15700 	    ipif->ipif_saved_ire_cnt, KM_NOSLEEP);
15701 	if (ipif_saved_irep == NULL) {
15702 		mutex_exit(&ipif->ipif_saved_ire_lock);
15703 		return (NULL);
15704 	}
15705 
15706 	irep = ipif_saved_irep;
15707 	for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
15708 		ire_t		*ire;
15709 		queue_t		*rfq;
15710 		queue_t		*stq;
15711 		ifrt_t		*ifrt;
15712 		uchar_t		*src_addr;
15713 		uchar_t		*gateway_addr;
15714 		ushort_t	type;
15715 
15716 		/*
15717 		 * When the ire was initially created and then added in
15718 		 * ip_rt_add(), it was created either using ipif->ipif_net_type
15719 		 * in the case of a traditional interface route, or as one of
15720 		 * the IRE_OFFSUBNET types (with the exception of
15721 		 * IRE_HOST types ire which is created by icmp_redirect() and
15722 		 * which we don't need to save or recover).  In the case where
15723 		 * ipif->ipif_net_type was IRE_LOOPBACK, ip_rt_add() will update
15724 		 * the ire_type to IRE_IF_NORESOLVER before calling ire_add()
15725 		 * to satisfy software like GateD and Sun Cluster which creates
15726 		 * routes using the the loopback interface's address as a
15727 		 * gateway.
15728 		 *
15729 		 * As ifrt->ifrt_type reflects the already updated ire_type,
15730 		 * ire_create() will be called in the same way here as
15731 		 * in ip_rt_add(), namely using ipif->ipif_net_type when
15732 		 * the route looks like a traditional interface route (where
15733 		 * ifrt->ifrt_type & IRE_INTERFACE is true) and otherwise using
15734 		 * the saved ifrt->ifrt_type.  This means that in the case where
15735 		 * ipif->ipif_net_type is IRE_LOOPBACK, the ire created by
15736 		 * ire_create() will be an IRE_LOOPBACK, it will then be turned
15737 		 * into an IRE_IF_NORESOLVER and then added by ire_add().
15738 		 */
15739 		ifrt = (ifrt_t *)mp->b_rptr;
15740 		ASSERT(ifrt->ifrt_type != IRE_CACHE);
15741 		if (ifrt->ifrt_type & IRE_INTERFACE) {
15742 			rfq = NULL;
15743 			stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
15744 			    ? ipif->ipif_rq : ipif->ipif_wq;
15745 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
15746 			    ? (uint8_t *)&ifrt->ifrt_src_addr
15747 			    : (uint8_t *)&ipif->ipif_src_addr;
15748 			gateway_addr = NULL;
15749 			type = ipif->ipif_net_type;
15750 		} else if (ifrt->ifrt_type & IRE_BROADCAST) {
15751 			/* Recover multiroute broadcast IRE. */
15752 			rfq = ipif->ipif_rq;
15753 			stq = ipif->ipif_wq;
15754 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
15755 			    ? (uint8_t *)&ifrt->ifrt_src_addr
15756 			    : (uint8_t *)&ipif->ipif_src_addr;
15757 			gateway_addr = (uint8_t *)&ifrt->ifrt_gateway_addr;
15758 			type = ifrt->ifrt_type;
15759 		} else {
15760 			rfq = NULL;
15761 			stq = NULL;
15762 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
15763 			    ? (uint8_t *)&ifrt->ifrt_src_addr : NULL;
15764 			gateway_addr = (uint8_t *)&ifrt->ifrt_gateway_addr;
15765 			type = ifrt->ifrt_type;
15766 		}
15767 
15768 		/*
15769 		 * Create a copy of the IRE with the saved address and netmask.
15770 		 */
15771 		ip1dbg(("ipif_recover_ire: creating IRE %s (%d) for "
15772 		    "0x%x/0x%x\n",
15773 		    ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type,
15774 		    ntohl(ifrt->ifrt_addr),
15775 		    ntohl(ifrt->ifrt_mask)));
15776 		ire = ire_create(
15777 		    (uint8_t *)&ifrt->ifrt_addr,
15778 		    (uint8_t *)&ifrt->ifrt_mask,
15779 		    src_addr,
15780 		    gateway_addr,
15781 		    &ifrt->ifrt_max_frag,
15782 		    NULL,
15783 		    rfq,
15784 		    stq,
15785 		    type,
15786 		    ipif,
15787 		    0,
15788 		    0,
15789 		    0,
15790 		    ifrt->ifrt_flags,
15791 		    &ifrt->ifrt_iulp_info,
15792 		    NULL,
15793 		    NULL,
15794 		    ipst);
15795 
15796 		if (ire == NULL) {
15797 			mutex_exit(&ipif->ipif_saved_ire_lock);
15798 			kmem_free(ipif_saved_irep,
15799 			    ipif->ipif_saved_ire_cnt * sizeof (ire_t *));
15800 			return (NULL);
15801 		}
15802 
15803 		/*
15804 		 * Some software (for example, GateD and Sun Cluster) attempts
15805 		 * to create (what amount to) IRE_PREFIX routes with the
15806 		 * loopback address as the gateway.  This is primarily done to
15807 		 * set up prefixes with the RTF_REJECT flag set (for example,
15808 		 * when generating aggregate routes.)
15809 		 *
15810 		 * If the IRE type (as defined by ipif->ipif_net_type) is
15811 		 * IRE_LOOPBACK, then we map the request into a
15812 		 * IRE_IF_NORESOLVER.
15813 		 */
15814 		if (ipif->ipif_net_type == IRE_LOOPBACK)
15815 			ire->ire_type = IRE_IF_NORESOLVER;
15816 		/*
15817 		 * ire held by ire_add, will be refreled' towards the
15818 		 * the end of ipif_up_done
15819 		 */
15820 		(void) ire_add(&ire, NULL, NULL, NULL, B_FALSE);
15821 		*irep = ire;
15822 		irep++;
15823 		ip1dbg(("ipif_recover_ire: added ire %p\n", (void *)ire));
15824 	}
15825 	mutex_exit(&ipif->ipif_saved_ire_lock);
15826 	return (ipif_saved_irep);
15827 }
15828 
15829 /*
15830  * Used to set the netmask and broadcast address to default values when the
15831  * interface is brought up.  (Always called as writer.)
15832  */
15833 static void
15834 ipif_set_default(ipif_t *ipif)
15835 {
15836 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
15837 
15838 	if (!ipif->ipif_isv6) {
15839 		/*
15840 		 * Interface holds an IPv4 address. Default
15841 		 * mask is the natural netmask.
15842 		 */
15843 		if (!ipif->ipif_net_mask) {
15844 			ipaddr_t	v4mask;
15845 
15846 			v4mask = ip_net_mask(ipif->ipif_lcl_addr);
15847 			V4MASK_TO_V6(v4mask, ipif->ipif_v6net_mask);
15848 		}
15849 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
15850 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
15851 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
15852 		} else {
15853 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
15854 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
15855 		}
15856 		/*
15857 		 * NOTE: SunOS 4.X does this even if the broadcast address
15858 		 * has been already set thus we do the same here.
15859 		 */
15860 		if (ipif->ipif_flags & IPIF_BROADCAST) {
15861 			ipaddr_t	v4addr;
15862 
15863 			v4addr = ipif->ipif_subnet | ~ipif->ipif_net_mask;
15864 			IN6_IPADDR_TO_V4MAPPED(v4addr, &ipif->ipif_v6brd_addr);
15865 		}
15866 	} else {
15867 		/*
15868 		 * Interface holds an IPv6-only address.  Default
15869 		 * mask is all-ones.
15870 		 */
15871 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
15872 			ipif->ipif_v6net_mask = ipv6_all_ones;
15873 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
15874 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
15875 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
15876 		} else {
15877 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
15878 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
15879 		}
15880 	}
15881 }
15882 
15883 /*
15884  * Return 0 if this address can be used as local address without causing
15885  * duplicate address problems. Otherwise, return EADDRNOTAVAIL if the address
15886  * is already up on a different ill, and EADDRINUSE if it's up on the same ill.
15887  * Note that the same IPv6 link-local address is allowed as long as the ills
15888  * are not on the same link.
15889  */
15890 int
15891 ip_addr_availability_check(ipif_t *new_ipif)
15892 {
15893 	in6_addr_t our_v6addr;
15894 	ill_t *ill;
15895 	ipif_t *ipif;
15896 	ill_walk_context_t ctx;
15897 	ip_stack_t	*ipst = new_ipif->ipif_ill->ill_ipst;
15898 
15899 	ASSERT(IAM_WRITER_IPIF(new_ipif));
15900 	ASSERT(MUTEX_HELD(&ipst->ips_ip_addr_avail_lock));
15901 	ASSERT(RW_READ_HELD(&ipst->ips_ill_g_lock));
15902 
15903 	new_ipif->ipif_flags &= ~IPIF_UNNUMBERED;
15904 	if (IN6_IS_ADDR_UNSPECIFIED(&new_ipif->ipif_v6lcl_addr) ||
15905 	    IN6_IS_ADDR_V4MAPPED_ANY(&new_ipif->ipif_v6lcl_addr))
15906 		return (0);
15907 
15908 	our_v6addr = new_ipif->ipif_v6lcl_addr;
15909 
15910 	if (new_ipif->ipif_isv6)
15911 		ill = ILL_START_WALK_V6(&ctx, ipst);
15912 	else
15913 		ill = ILL_START_WALK_V4(&ctx, ipst);
15914 
15915 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
15916 		for (ipif = ill->ill_ipif; ipif != NULL;
15917 		    ipif = ipif->ipif_next) {
15918 			if ((ipif == new_ipif) ||
15919 			    !(ipif->ipif_flags & IPIF_UP) ||
15920 			    (ipif->ipif_flags & IPIF_UNNUMBERED) ||
15921 			    !IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
15922 			    &our_v6addr))
15923 				continue;
15924 
15925 			if (new_ipif->ipif_flags & IPIF_POINTOPOINT)
15926 				new_ipif->ipif_flags |= IPIF_UNNUMBERED;
15927 			else if (ipif->ipif_flags & IPIF_POINTOPOINT)
15928 				ipif->ipif_flags |= IPIF_UNNUMBERED;
15929 			else if ((IN6_IS_ADDR_LINKLOCAL(&our_v6addr) ||
15930 			    IN6_IS_ADDR_SITELOCAL(&our_v6addr)) &&
15931 			    !IS_ON_SAME_LAN(ill, new_ipif->ipif_ill))
15932 				continue;
15933 			else if (new_ipif->ipif_zoneid != ipif->ipif_zoneid &&
15934 			    ipif->ipif_zoneid != ALL_ZONES && IS_LOOPBACK(ill))
15935 				continue;
15936 			else if (new_ipif->ipif_ill == ill)
15937 				return (EADDRINUSE);
15938 			else
15939 				return (EADDRNOTAVAIL);
15940 		}
15941 	}
15942 
15943 	return (0);
15944 }
15945 
15946 /*
15947  * Bring up an ipif: bring up arp/ndp, bring up the DLPI stream, and add
15948  * IREs for the ipif.
15949  * When the routine returns EINPROGRESS then mp has been consumed and
15950  * the ioctl will be acked from ip_rput_dlpi.
15951  */
15952 int
15953 ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp)
15954 {
15955 	ill_t		*ill = ipif->ipif_ill;
15956 	boolean_t 	isv6 = ipif->ipif_isv6;
15957 	int		err = 0;
15958 	boolean_t	success;
15959 	uint_t		ipif_orig_id;
15960 	ip_stack_t	*ipst = ill->ill_ipst;
15961 
15962 	ASSERT(IAM_WRITER_IPIF(ipif));
15963 
15964 	ip1dbg(("ipif_up(%s:%u)\n", ill->ill_name, ipif->ipif_id));
15965 
15966 	/* Shouldn't get here if it is already up. */
15967 	if (ipif->ipif_flags & IPIF_UP)
15968 		return (EALREADY);
15969 
15970 	/*
15971 	 * If this is a request to bring up a data address on an interface
15972 	 * under IPMP, then move the address to its IPMP meta-interface and
15973 	 * try to bring it up.  One complication is that the zeroth ipif for
15974 	 * an ill is special, in that every ill always has one, and that code
15975 	 * throughout IP deferences ill->ill_ipif without holding any locks.
15976 	 */
15977 	if (IS_UNDER_IPMP(ill) && ipmp_ipif_is_dataaddr(ipif) &&
15978 	    (!ipif->ipif_isv6 || !V6_IPIF_LINKLOCAL(ipif))) {
15979 		ipif_t	*stubipif = NULL, *moveipif = NULL;
15980 		ill_t	*ipmp_ill = ipmp_illgrp_ipmp_ill(ill->ill_grp);
15981 
15982 		/*
15983 		 * The ipif being brought up should be quiesced.  If it's not,
15984 		 * something has gone amiss and we need to bail out.  (If it's
15985 		 * quiesced, we know it will remain so via IPIF_CHANGING.)
15986 		 */
15987 		mutex_enter(&ill->ill_lock);
15988 		if (!ipif_is_quiescent(ipif)) {
15989 			mutex_exit(&ill->ill_lock);
15990 			return (EINVAL);
15991 		}
15992 		mutex_exit(&ill->ill_lock);
15993 
15994 		/*
15995 		 * If we're going to need to allocate ipifs, do it prior
15996 		 * to starting the move (and grabbing locks).
15997 		 */
15998 		if (ipif->ipif_id == 0) {
15999 			moveipif = ipif_allocate(ill, 0, IRE_LOCAL, B_TRUE,
16000 			    B_FALSE);
16001 			stubipif = ipif_allocate(ill, 0, IRE_LOCAL, B_TRUE,
16002 			    B_FALSE);
16003 			if (moveipif == NULL || stubipif == NULL) {
16004 				mi_free(moveipif);
16005 				mi_free(stubipif);
16006 				return (ENOMEM);
16007 			}
16008 		}
16009 
16010 		/*
16011 		 * Grab or transfer the ipif to move.  During the move, keep
16012 		 * ill_g_lock held to prevent any ill walker threads from
16013 		 * seeing things in an inconsistent state.
16014 		 */
16015 		rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
16016 		if (ipif->ipif_id != 0) {
16017 			ipif_remove(ipif);
16018 		} else {
16019 			ipif_transfer(ipif, moveipif, stubipif);
16020 			ipif = moveipif;
16021 		}
16022 
16023 		/*
16024 		 * Place the ipif on the IPMP ill.  If the zeroth ipif on
16025 		 * the IPMP ill is a stub (0.0.0.0 down address) then we
16026 		 * replace that one.  Otherwise, pick the next available slot.
16027 		 */
16028 		ipif->ipif_ill = ipmp_ill;
16029 		ipif_orig_id = ipif->ipif_id;
16030 
16031 		if (ipmp_ipif_is_stubaddr(ipmp_ill->ill_ipif)) {
16032 			ipif_transfer(ipif, ipmp_ill->ill_ipif, NULL);
16033 			ipif = ipmp_ill->ill_ipif;
16034 		} else {
16035 			ipif->ipif_id = -1;
16036 			if (ipif_insert(ipif, B_FALSE) != 0) {
16037 				/*
16038 				 * No more available ipif_id's -- put it back
16039 				 * on the original ill and fail the operation.
16040 				 * Since we're writer on the ill, we can be
16041 				 * sure our old slot is still available.
16042 				 */
16043 				ipif->ipif_id = ipif_orig_id;
16044 				ipif->ipif_ill = ill;
16045 				if (ipif_orig_id == 0) {
16046 					ipif_transfer(ipif, ill->ill_ipif,
16047 					    NULL);
16048 				} else {
16049 					VERIFY(ipif_insert(ipif, B_FALSE) == 0);
16050 				}
16051 				rw_exit(&ipst->ips_ill_g_lock);
16052 				return (ENOMEM);
16053 			}
16054 		}
16055 		rw_exit(&ipst->ips_ill_g_lock);
16056 
16057 		/*
16058 		 * Tell SCTP that the ipif has moved.  Note that even if we
16059 		 * had to allocate a new ipif, the original sequence id was
16060 		 * preserved and therefore SCTP won't know.
16061 		 */
16062 		sctp_move_ipif(ipif, ill, ipmp_ill);
16063 
16064 		/*
16065 		 * If the ipif being brought up was on slot zero, then we
16066 		 * first need to bring up the placeholder we stuck there.  In
16067 		 * ip_rput_dlpi_writer(), ip_arp_done(), or the recursive call
16068 		 * to ipif_up() itself, if we successfully bring up the
16069 		 * placeholder, we'll check ill_move_ipif and bring it up too.
16070 		 */
16071 		if (ipif_orig_id == 0) {
16072 			ASSERT(ill->ill_move_ipif == NULL);
16073 			ill->ill_move_ipif = ipif;
16074 			if ((err = ipif_up(ill->ill_ipif, q, mp)) == 0)
16075 				ASSERT(ill->ill_move_ipif == NULL);
16076 			if (err != EINPROGRESS)
16077 				ill->ill_move_ipif = NULL;
16078 			return (err);
16079 		}
16080 
16081 		/*
16082 		 * Bring it up on the IPMP ill.
16083 		 */
16084 		return (ipif_up(ipif, q, mp));
16085 	}
16086 
16087 	/* Skip arp/ndp for any loopback interface. */
16088 	if (ill->ill_wq != NULL) {
16089 		conn_t *connp = CONN_Q(q) ? Q_TO_CONN(q) : NULL;
16090 		ipsq_t	*ipsq = ill->ill_phyint->phyint_ipsq;
16091 
16092 		if (!ill->ill_dl_up) {
16093 			/*
16094 			 * ill_dl_up is not yet set. i.e. we are yet to
16095 			 * DL_BIND with the driver and this is the first
16096 			 * logical interface on the ill to become "up".
16097 			 * Tell the driver to get going (via DL_BIND_REQ).
16098 			 * Note that changing "significant" IFF_ flags
16099 			 * address/netmask etc cause a down/up dance, but
16100 			 * does not cause an unbind (DL_UNBIND) with the driver
16101 			 */
16102 			return (ill_dl_up(ill, ipif, mp, q));
16103 		}
16104 
16105 		/*
16106 		 * ipif_resolver_up may end up sending an
16107 		 * AR_INTERFACE_UP message to ARP, which would, in
16108 		 * turn send a DLPI message to the driver. ioctls are
16109 		 * serialized and so we cannot send more than one
16110 		 * interface up message at a time. If ipif_resolver_up
16111 		 * does send an interface up message to ARP, we get
16112 		 * EINPROGRESS and we will complete in ip_arp_done.
16113 		 */
16114 
16115 		ASSERT(connp != NULL || !CONN_Q(q));
16116 		if (connp != NULL)
16117 			mutex_enter(&connp->conn_lock);
16118 		mutex_enter(&ill->ill_lock);
16119 		success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
16120 		mutex_exit(&ill->ill_lock);
16121 		if (connp != NULL)
16122 			mutex_exit(&connp->conn_lock);
16123 		if (!success)
16124 			return (EINTR);
16125 
16126 		/*
16127 		 * Crank up the resolver.  For IPv6, this cranks up the
16128 		 * external resolver if one is configured, but even if an
16129 		 * external resolver isn't configured, it must be called to
16130 		 * reset DAD state.  For IPv6, if an external resolver is not
16131 		 * being used, ipif_resolver_up() will never return
16132 		 * EINPROGRESS, so we can always call ipif_ndp_up() here.
16133 		 * Note that if an external resolver is being used, there's no
16134 		 * need to call ipif_ndp_up() since it will do nothing.
16135 		 */
16136 		err = ipif_resolver_up(ipif, Res_act_initial);
16137 		if (err == EINPROGRESS) {
16138 			/* We will complete it in ip_arp_done() */
16139 			return (err);
16140 		}
16141 
16142 		if (isv6 && err == 0)
16143 			err = ipif_ndp_up(ipif, B_TRUE);
16144 
16145 		ASSERT(err != EINPROGRESS);
16146 		mp = ipsq_pending_mp_get(ipsq, &connp);
16147 		ASSERT(mp != NULL);
16148 		if (err != 0)
16149 			return (err);
16150 	} else {
16151 		/*
16152 		 * Interfaces without underlying hardware don't do duplicate
16153 		 * address detection.
16154 		 */
16155 		ASSERT(!(ipif->ipif_flags & IPIF_DUPLICATE));
16156 		ipif->ipif_addr_ready = 1;
16157 	}
16158 
16159 	err = isv6 ? ipif_up_done_v6(ipif) : ipif_up_done(ipif);
16160 	if (err == 0 && ill->ill_move_ipif != NULL) {
16161 		ipif = ill->ill_move_ipif;
16162 		ill->ill_move_ipif = NULL;
16163 		return (ipif_up(ipif, q, mp));
16164 	}
16165 	return (err);
16166 }
16167 
16168 /*
16169  * Perform a bind for the physical device.
16170  * When the routine returns EINPROGRESS then mp has been consumed and
16171  * the ioctl will be acked from ip_rput_dlpi.
16172  * Allocate an unbind message and save it until ipif_down.
16173  */
16174 static int
16175 ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
16176 {
16177 	areq_t	*areq;
16178 	mblk_t	*areq_mp = NULL;
16179 	mblk_t	*bind_mp = NULL;
16180 	mblk_t	*unbind_mp = NULL;
16181 	conn_t	*connp;
16182 	boolean_t success;
16183 	uint16_t sap_addr;
16184 
16185 	ip1dbg(("ill_dl_up(%s)\n", ill->ill_name));
16186 	ASSERT(IAM_WRITER_ILL(ill));
16187 	ASSERT(mp != NULL);
16188 
16189 	/* Create a resolver cookie for ARP */
16190 	if (!ill->ill_isv6 && ill->ill_net_type == IRE_IF_RESOLVER) {
16191 		areq_mp = ill_arp_alloc(ill, (uchar_t *)&ip_areq_template, 0);
16192 		if (areq_mp == NULL)
16193 			return (ENOMEM);
16194 
16195 		freemsg(ill->ill_resolver_mp);
16196 		ill->ill_resolver_mp = areq_mp;
16197 		areq = (areq_t *)areq_mp->b_rptr;
16198 		sap_addr = ill->ill_sap;
16199 		bcopy(&sap_addr, areq->areq_sap, sizeof (sap_addr));
16200 	}
16201 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
16202 	    DL_BIND_REQ);
16203 	if (bind_mp == NULL)
16204 		goto bad;
16205 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
16206 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
16207 
16208 	unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ);
16209 	if (unbind_mp == NULL)
16210 		goto bad;
16211 
16212 	/*
16213 	 * Record state needed to complete this operation when the
16214 	 * DL_BIND_ACK shows up.  Also remember the pre-allocated mblks.
16215 	 */
16216 	connp = CONN_Q(q) ? Q_TO_CONN(q) : NULL;
16217 	ASSERT(connp != NULL || !CONN_Q(q));
16218 	GRAB_CONN_LOCK(q);
16219 	mutex_enter(&ipif->ipif_ill->ill_lock);
16220 	success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
16221 	mutex_exit(&ipif->ipif_ill->ill_lock);
16222 	RELEASE_CONN_LOCK(q);
16223 	if (!success)
16224 		goto bad;
16225 
16226 	/*
16227 	 * Save the unbind message for ill_dl_down(); it will be consumed when
16228 	 * the interface goes down.
16229 	 */
16230 	ASSERT(ill->ill_unbind_mp == NULL);
16231 	ill->ill_unbind_mp = unbind_mp;
16232 
16233 	ill_dlpi_send(ill, bind_mp);
16234 	/* Send down link-layer capabilities probe if not already done. */
16235 	ill_capability_probe(ill);
16236 
16237 	/*
16238 	 * Sysid used to rely on the fact that netboots set domainname
16239 	 * and the like. Now that miniroot boots aren't strictly netboots
16240 	 * and miniroot network configuration is driven from userland
16241 	 * these things still need to be set. This situation can be detected
16242 	 * by comparing the interface being configured here to the one
16243 	 * dhcifname was set to reference by the boot loader. Once sysid is
16244 	 * converted to use dhcp_ipc_getinfo() this call can go away.
16245 	 */
16246 	if ((ipif->ipif_flags & IPIF_DHCPRUNNING) &&
16247 	    (strcmp(ill->ill_name, dhcifname) == 0) &&
16248 	    (strlen(srpc_domain) == 0)) {
16249 		if (dhcpinit() != 0)
16250 			cmn_err(CE_WARN, "no cached dhcp response");
16251 	}
16252 
16253 	/*
16254 	 * This operation will complete in ip_rput_dlpi with either
16255 	 * a DL_BIND_ACK or DL_ERROR_ACK.
16256 	 */
16257 	return (EINPROGRESS);
16258 bad:
16259 	ip1dbg(("ill_dl_up(%s) FAILED\n", ill->ill_name));
16260 
16261 	freemsg(bind_mp);
16262 	freemsg(unbind_mp);
16263 	return (ENOMEM);
16264 }
16265 
16266 uint_t ip_loopback_mtuplus = IP_LOOPBACK_MTU + IP_SIMPLE_HDR_LENGTH + 20;
16267 
16268 /*
16269  * DLPI and ARP is up.
16270  * Create all the IREs associated with an interface bring up multicast.
16271  * Set the interface flag and finish other initialization
16272  * that potentially had to be differed to after DL_BIND_ACK.
16273  */
16274 int
16275 ipif_up_done(ipif_t *ipif)
16276 {
16277 	ire_t	*ire_array[20];
16278 	ire_t	**irep = ire_array;
16279 	ire_t	**irep1;
16280 	ipaddr_t net_mask = 0;
16281 	ipaddr_t subnet_mask, route_mask;
16282 	ill_t	*ill = ipif->ipif_ill;
16283 	queue_t	*stq;
16284 	ipif_t	 *src_ipif;
16285 	ipif_t   *tmp_ipif;
16286 	boolean_t	flush_ire_cache = B_TRUE;
16287 	int	err = 0;
16288 	ire_t	**ipif_saved_irep = NULL;
16289 	int ipif_saved_ire_cnt;
16290 	int	cnt;
16291 	boolean_t	src_ipif_held = B_FALSE;
16292 	boolean_t	loopback = B_FALSE;
16293 	ip_stack_t	*ipst = ill->ill_ipst;
16294 
16295 	ip1dbg(("ipif_up_done(%s:%u)\n",
16296 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
16297 	/* Check if this is a loopback interface */
16298 	if (ipif->ipif_ill->ill_wq == NULL)
16299 		loopback = B_TRUE;
16300 
16301 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
16302 	/*
16303 	 * If all other interfaces for this ill are down or DEPRECATED,
16304 	 * or otherwise unsuitable for source address selection, remove
16305 	 * any IRE_CACHE entries for this ill to make sure source
16306 	 * address selection gets to take this new ipif into account.
16307 	 * No need to hold ill_lock while traversing the ipif list since
16308 	 * we are writer
16309 	 */
16310 	for (tmp_ipif = ill->ill_ipif; tmp_ipif;
16311 	    tmp_ipif = tmp_ipif->ipif_next) {
16312 		if (((tmp_ipif->ipif_flags &
16313 		    (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
16314 		    !(tmp_ipif->ipif_flags & IPIF_UP)) ||
16315 		    (tmp_ipif == ipif))
16316 			continue;
16317 		/* first useable pre-existing interface */
16318 		flush_ire_cache = B_FALSE;
16319 		break;
16320 	}
16321 	if (flush_ire_cache)
16322 		ire_walk_ill_v4(MATCH_IRE_ILL | MATCH_IRE_TYPE,
16323 		    IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill);
16324 
16325 	/*
16326 	 * Figure out which way the send-to queue should go.  Only
16327 	 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER or IRE_LOOPBACK
16328 	 * should show up here.
16329 	 */
16330 	switch (ill->ill_net_type) {
16331 	case IRE_IF_RESOLVER:
16332 		stq = ill->ill_rq;
16333 		break;
16334 	case IRE_IF_NORESOLVER:
16335 	case IRE_LOOPBACK:
16336 		stq = ill->ill_wq;
16337 		break;
16338 	default:
16339 		return (EINVAL);
16340 	}
16341 
16342 	if (IS_LOOPBACK(ill)) {
16343 		/*
16344 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
16345 		 * ipif_lookup_on_name(), but in the case of zones we can have
16346 		 * several loopback addresses on lo0. So all the interfaces with
16347 		 * loopback addresses need to be marked IRE_LOOPBACK.
16348 		 */
16349 		if (V4_PART_OF_V6(ipif->ipif_v6lcl_addr) ==
16350 		    htonl(INADDR_LOOPBACK))
16351 			ipif->ipif_ire_type = IRE_LOOPBACK;
16352 		else
16353 			ipif->ipif_ire_type = IRE_LOCAL;
16354 	}
16355 
16356 	if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST) ||
16357 	    ((ipif->ipif_flags & IPIF_DEPRECATED) &&
16358 	    !(ipif->ipif_flags & IPIF_NOFAILOVER))) {
16359 		/*
16360 		 * Can't use our source address. Select a different
16361 		 * source address for the IRE_INTERFACE and IRE_LOCAL
16362 		 */
16363 		src_ipif = ipif_select_source(ipif->ipif_ill,
16364 		    ipif->ipif_subnet, ipif->ipif_zoneid);
16365 		if (src_ipif == NULL)
16366 			src_ipif = ipif;	/* Last resort */
16367 		else
16368 			src_ipif_held = B_TRUE;
16369 	} else {
16370 		src_ipif = ipif;
16371 	}
16372 
16373 	/* Create all the IREs associated with this interface */
16374 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
16375 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
16376 
16377 		/*
16378 		 * If we're on a labeled system then make sure that zone-
16379 		 * private addresses have proper remote host database entries.
16380 		 */
16381 		if (is_system_labeled() &&
16382 		    ipif->ipif_ire_type != IRE_LOOPBACK &&
16383 		    !tsol_check_interface_address(ipif))
16384 			return (EINVAL);
16385 
16386 		/* Register the source address for __sin6_src_id */
16387 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
16388 		    ipif->ipif_zoneid, ipst);
16389 		if (err != 0) {
16390 			ip0dbg(("ipif_up_done: srcid_insert %d\n", err));
16391 			return (err);
16392 		}
16393 
16394 		/* If the interface address is set, create the local IRE. */
16395 		ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x for 0x%x\n",
16396 		    (void *)ipif,
16397 		    ipif->ipif_ire_type,
16398 		    ntohl(ipif->ipif_lcl_addr)));
16399 		*irep++ = ire_create(
16400 		    (uchar_t *)&ipif->ipif_lcl_addr,	/* dest address */
16401 		    (uchar_t *)&ip_g_all_ones,		/* mask */
16402 		    (uchar_t *)&src_ipif->ipif_src_addr, /* source address */
16403 		    NULL,				/* no gateway */
16404 		    &ip_loopback_mtuplus,		/* max frag size */
16405 		    NULL,
16406 		    ipif->ipif_rq,			/* recv-from queue */
16407 		    NULL,				/* no send-to queue */
16408 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
16409 		    ipif,
16410 		    0,
16411 		    0,
16412 		    0,
16413 		    (ipif->ipif_flags & IPIF_PRIVATE) ?
16414 		    RTF_PRIVATE : 0,
16415 		    &ire_uinfo_null,
16416 		    NULL,
16417 		    NULL,
16418 		    ipst);
16419 	} else {
16420 		ip1dbg((
16421 		    "ipif_up_done: not creating IRE %d for 0x%x: flags 0x%x\n",
16422 		    ipif->ipif_ire_type,
16423 		    ntohl(ipif->ipif_lcl_addr),
16424 		    (uint_t)ipif->ipif_flags));
16425 	}
16426 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
16427 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
16428 		net_mask = ip_net_mask(ipif->ipif_lcl_addr);
16429 	} else {
16430 		net_mask = htonl(IN_CLASSA_NET);	/* fallback */
16431 	}
16432 
16433 	subnet_mask = ipif->ipif_net_mask;
16434 
16435 	/*
16436 	 * If mask was not specified, use natural netmask of
16437 	 * interface address. Also, store this mask back into the
16438 	 * ipif struct.
16439 	 */
16440 	if (subnet_mask == 0) {
16441 		subnet_mask = net_mask;
16442 		V4MASK_TO_V6(subnet_mask, ipif->ipif_v6net_mask);
16443 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
16444 		    ipif->ipif_v6subnet);
16445 	}
16446 
16447 	/* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */
16448 	if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) &&
16449 	    ipif->ipif_subnet != INADDR_ANY) {
16450 		/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
16451 
16452 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
16453 			route_mask = IP_HOST_MASK;
16454 		} else {
16455 			route_mask = subnet_mask;
16456 		}
16457 
16458 		ip1dbg(("ipif_up_done: ipif 0x%p ill 0x%p "
16459 		    "creating if IRE ill_net_type 0x%x for 0x%x\n",
16460 		    (void *)ipif, (void *)ill,
16461 		    ill->ill_net_type,
16462 		    ntohl(ipif->ipif_subnet)));
16463 		*irep++ = ire_create(
16464 		    (uchar_t *)&ipif->ipif_subnet,	/* dest address */
16465 		    (uchar_t *)&route_mask,		/* mask */
16466 		    (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */
16467 		    NULL,				/* no gateway */
16468 		    &ipif->ipif_mtu,			/* max frag */
16469 		    NULL,
16470 		    NULL,				/* no recv queue */
16471 		    stq,				/* send-to queue */
16472 		    ill->ill_net_type,			/* IF_[NO]RESOLVER */
16473 		    ipif,
16474 		    0,
16475 		    0,
16476 		    0,
16477 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE: 0,
16478 		    &ire_uinfo_null,
16479 		    NULL,
16480 		    NULL,
16481 		    ipst);
16482 	}
16483 
16484 	/*
16485 	 * Create any necessary broadcast IREs.
16486 	 */
16487 	if (ipif->ipif_flags & IPIF_BROADCAST)
16488 		irep = ipif_create_bcast_ires(ipif, irep);
16489 
16490 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
16491 
16492 	/* If an earlier ire_create failed, get out now */
16493 	for (irep1 = irep; irep1 > ire_array; ) {
16494 		irep1--;
16495 		if (*irep1 == NULL) {
16496 			ip1dbg(("ipif_up_done: NULL ire found in ire_array\n"));
16497 			err = ENOMEM;
16498 			goto bad;
16499 		}
16500 	}
16501 
16502 	/*
16503 	 * Need to atomically check for IP address availability under
16504 	 * ip_addr_avail_lock.  ill_g_lock is held as reader to ensure no new
16505 	 * ills or new ipifs can be added while we are checking availability.
16506 	 */
16507 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
16508 	mutex_enter(&ipst->ips_ip_addr_avail_lock);
16509 	/* Mark it up, and increment counters. */
16510 	ipif->ipif_flags |= IPIF_UP;
16511 	ill->ill_ipif_up_count++;
16512 	err = ip_addr_availability_check(ipif);
16513 	mutex_exit(&ipst->ips_ip_addr_avail_lock);
16514 	rw_exit(&ipst->ips_ill_g_lock);
16515 
16516 	if (err != 0) {
16517 		/*
16518 		 * Our address may already be up on the same ill. In this case,
16519 		 * the ARP entry for our ipif replaced the one for the other
16520 		 * ipif. So we don't want to delete it (otherwise the other ipif
16521 		 * would be unable to send packets).
16522 		 * ip_addr_availability_check() identifies this case for us and
16523 		 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL
16524 		 * which is the expected error code.
16525 		 */
16526 		if (err == EADDRINUSE) {
16527 			freemsg(ipif->ipif_arp_del_mp);
16528 			ipif->ipif_arp_del_mp = NULL;
16529 			err = EADDRNOTAVAIL;
16530 		}
16531 		ill->ill_ipif_up_count--;
16532 		ipif->ipif_flags &= ~IPIF_UP;
16533 		goto bad;
16534 	}
16535 
16536 	/*
16537 	 * Add in all newly created IREs.  ire_create_bcast() has
16538 	 * already checked for duplicates of the IRE_BROADCAST type.
16539 	 */
16540 	for (irep1 = irep; irep1 > ire_array; ) {
16541 		irep1--;
16542 		ASSERT(!MUTEX_HELD(&((*irep1)->ire_ipif->ipif_ill->ill_lock)));
16543 		/*
16544 		 * refheld by ire_add. refele towards the end of the func
16545 		 */
16546 		(void) ire_add(irep1, NULL, NULL, NULL, B_FALSE);
16547 	}
16548 
16549 	/* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */
16550 	ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt;
16551 	ipif_saved_irep = ipif_recover_ire(ipif);
16552 
16553 	if (!loopback) {
16554 		/*
16555 		 * If the broadcast address has been set, make sure it makes
16556 		 * sense based on the interface address.
16557 		 * Only match on ill since we are sharing broadcast addresses.
16558 		 */
16559 		if ((ipif->ipif_brd_addr != INADDR_ANY) &&
16560 		    (ipif->ipif_flags & IPIF_BROADCAST)) {
16561 			ire_t	*ire;
16562 
16563 			ire = ire_ctable_lookup(ipif->ipif_brd_addr, 0,
16564 			    IRE_BROADCAST, ipif, ALL_ZONES,
16565 			    NULL, (MATCH_IRE_TYPE | MATCH_IRE_ILL), ipst);
16566 
16567 			if (ire == NULL) {
16568 				/*
16569 				 * If there isn't a matching broadcast IRE,
16570 				 * revert to the default for this netmask.
16571 				 */
16572 				ipif->ipif_v6brd_addr = ipv6_all_zeros;
16573 				mutex_enter(&ipif->ipif_ill->ill_lock);
16574 				ipif_set_default(ipif);
16575 				mutex_exit(&ipif->ipif_ill->ill_lock);
16576 			} else {
16577 				ire_refrele(ire);
16578 			}
16579 		}
16580 
16581 	}
16582 
16583 	if (ill->ill_need_recover_multicast) {
16584 		/*
16585 		 * Need to recover all multicast memberships in the driver.
16586 		 * This had to be deferred until we had attached.  The same
16587 		 * code exists in ipif_up_done_v6() to recover IPv6
16588 		 * memberships.
16589 		 *
16590 		 * Note that it would be preferable to unconditionally do the
16591 		 * ill_recover_multicast() in ill_dl_up(), but we cannot do
16592 		 * that since ill_join_allmulti() depends on ill_dl_up being
16593 		 * set, and it is not set until we receive a DL_BIND_ACK after
16594 		 * having called ill_dl_up().
16595 		 */
16596 		ill_recover_multicast(ill);
16597 	}
16598 
16599 	if (ill->ill_ipif_up_count == 1) {
16600 		/*
16601 		 * Since the interface is now up, it may now be active.
16602 		 */
16603 		if (IS_UNDER_IPMP(ill))
16604 			ipmp_ill_refresh_active(ill);
16605 
16606 		/*
16607 		 * If this is an IPMP interface, we may now be able to
16608 		 * establish ARP entries.
16609 		 */
16610 		if (IS_IPMP(ill))
16611 			ipmp_illgrp_refresh_arpent(ill->ill_grp);
16612 	}
16613 
16614 	/* Join the allhosts multicast address */
16615 	ipif_multicast_up(ipif);
16616 
16617 	/*
16618 	 * See if anybody else would benefit from our new ipif.
16619 	 */
16620 	if (!loopback &&
16621 	    !(ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) {
16622 		ill_update_source_selection(ill);
16623 	}
16624 
16625 	for (irep1 = irep; irep1 > ire_array; ) {
16626 		irep1--;
16627 		if (*irep1 != NULL) {
16628 			/* was held in ire_add */
16629 			ire_refrele(*irep1);
16630 		}
16631 	}
16632 
16633 	cnt = ipif_saved_ire_cnt;
16634 	for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) {
16635 		if (*irep1 != NULL) {
16636 			/* was held in ire_add */
16637 			ire_refrele(*irep1);
16638 		}
16639 	}
16640 
16641 	if (!loopback && ipif->ipif_addr_ready) {
16642 		/* Broadcast an address mask reply. */
16643 		ipif_mask_reply(ipif);
16644 	}
16645 	if (ipif_saved_irep != NULL) {
16646 		kmem_free(ipif_saved_irep,
16647 		    ipif_saved_ire_cnt * sizeof (ire_t *));
16648 	}
16649 	if (src_ipif_held)
16650 		ipif_refrele(src_ipif);
16651 
16652 	/*
16653 	 * This had to be deferred until we had bound.  Tell routing sockets and
16654 	 * others that this interface is up if it looks like the address has
16655 	 * been validated.  Otherwise, if it isn't ready yet, wait for
16656 	 * duplicate address detection to do its thing.
16657 	 */
16658 	if (ipif->ipif_addr_ready)
16659 		ipif_up_notify(ipif);
16660 	return (0);
16661 
16662 bad:
16663 	ip1dbg(("ipif_up_done: FAILED \n"));
16664 
16665 	while (irep > ire_array) {
16666 		irep--;
16667 		if (*irep != NULL)
16668 			ire_delete(*irep);
16669 	}
16670 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst);
16671 
16672 	if (ipif_saved_irep != NULL) {
16673 		kmem_free(ipif_saved_irep,
16674 		    ipif_saved_ire_cnt * sizeof (ire_t *));
16675 	}
16676 	if (src_ipif_held)
16677 		ipif_refrele(src_ipif);
16678 
16679 	ipif_resolver_down(ipif);
16680 	return (err);
16681 }
16682 
16683 /*
16684  * Turn off the ARP with the ILLF_NOARP flag.
16685  */
16686 static int
16687 ill_arp_off(ill_t *ill)
16688 {
16689 	mblk_t	*arp_off_mp = NULL;
16690 	mblk_t	*arp_on_mp = NULL;
16691 
16692 	ip1dbg(("ill_arp_off(%s)\n", ill->ill_name));
16693 
16694 	ASSERT(IAM_WRITER_ILL(ill));
16695 	ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
16696 
16697 	/*
16698 	 * If the on message is still around we've already done
16699 	 * an arp_off without doing an arp_on thus there is no
16700 	 * work needed.
16701 	 */
16702 	if (ill->ill_arp_on_mp != NULL)
16703 		return (0);
16704 
16705 	/*
16706 	 * Allocate an ARP on message (to be saved) and an ARP off message
16707 	 */
16708 	arp_off_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aroff_template, 0);
16709 	if (!arp_off_mp)
16710 		return (ENOMEM);
16711 
16712 	arp_on_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aron_template, 0);
16713 	if (!arp_on_mp)
16714 		goto failed;
16715 
16716 	ASSERT(ill->ill_arp_on_mp == NULL);
16717 	ill->ill_arp_on_mp = arp_on_mp;
16718 
16719 	/* Send an AR_INTERFACE_OFF request */
16720 	putnext(ill->ill_rq, arp_off_mp);
16721 	return (0);
16722 failed:
16723 
16724 	if (arp_off_mp)
16725 		freemsg(arp_off_mp);
16726 	return (ENOMEM);
16727 }
16728 
16729 /*
16730  * Turn on ARP by turning off the ILLF_NOARP flag.
16731  */
16732 static int
16733 ill_arp_on(ill_t *ill)
16734 {
16735 	mblk_t	*mp;
16736 
16737 	ip1dbg(("ipif_arp_on(%s)\n", ill->ill_name));
16738 
16739 	ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
16740 
16741 	ASSERT(IAM_WRITER_ILL(ill));
16742 	/*
16743 	 * Send an AR_INTERFACE_ON request if we have already done
16744 	 * an arp_off (which allocated the message).
16745 	 */
16746 	if (ill->ill_arp_on_mp != NULL) {
16747 		mp = ill->ill_arp_on_mp;
16748 		ill->ill_arp_on_mp = NULL;
16749 		putnext(ill->ill_rq, mp);
16750 	}
16751 	return (0);
16752 }
16753 
16754 /*
16755  * Checks for availbility of a usable source address (if there is one) when the
16756  * destination ILL has the ill_usesrc_ifindex pointing to another ILL. Note
16757  * this selection is done regardless of the destination.
16758  */
16759 boolean_t
16760 ipif_usesrc_avail(ill_t *ill, zoneid_t zoneid)
16761 {
16762 	uint_t	ifindex;
16763 	ipif_t	*ipif = NULL;
16764 	ill_t	*uill;
16765 	boolean_t isv6;
16766 	ip_stack_t	*ipst = ill->ill_ipst;
16767 
16768 	ASSERT(ill != NULL);
16769 
16770 	isv6 = ill->ill_isv6;
16771 	ifindex = ill->ill_usesrc_ifindex;
16772 	if (ifindex != 0) {
16773 		uill = ill_lookup_on_ifindex(ifindex, isv6, NULL, NULL, NULL,
16774 		    NULL, ipst);
16775 		if (uill == NULL)
16776 			return (NULL);
16777 		mutex_enter(&uill->ill_lock);
16778 		for (ipif = uill->ill_ipif; ipif != NULL;
16779 		    ipif = ipif->ipif_next) {
16780 			if (!IPIF_CAN_LOOKUP(ipif))
16781 				continue;
16782 			if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
16783 				continue;
16784 			if (!(ipif->ipif_flags & IPIF_UP))
16785 				continue;
16786 			if (ipif->ipif_zoneid != zoneid)
16787 				continue;
16788 			if ((isv6 &&
16789 			    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) ||
16790 			    (ipif->ipif_lcl_addr == INADDR_ANY))
16791 				continue;
16792 			mutex_exit(&uill->ill_lock);
16793 			ill_refrele(uill);
16794 			return (B_TRUE);
16795 		}
16796 		mutex_exit(&uill->ill_lock);
16797 		ill_refrele(uill);
16798 	}
16799 	return (B_FALSE);
16800 }
16801 
16802 /*
16803  * IP source address type, sorted from worst to best.  For a given type,
16804  * always prefer IP addresses on the same subnet.  All-zones addresses are
16805  * suboptimal because they pose problems with unlabeled destinations.
16806  */
16807 typedef enum {
16808 	IPIF_NONE,
16809 	IPIF_DIFFNET_DEPRECATED, 	/* deprecated and different subnet */
16810 	IPIF_SAMENET_DEPRECATED, 	/* deprecated and same subnet */
16811 	IPIF_DIFFNET_ALLZONES,		/* allzones and different subnet */
16812 	IPIF_SAMENET_ALLZONES,		/* allzones and same subnet */
16813 	IPIF_DIFFNET,			/* normal and different subnet */
16814 	IPIF_SAMENET			/* normal and same subnet */
16815 } ipif_type_t;
16816 
16817 /*
16818  * Pick the optimal ipif on `ill' for sending to destination `dst' from zone
16819  * `zoneid'.  We rate usable ipifs from low -> high as per the ipif_type_t
16820  * enumeration, and return the highest-rated ipif.  If there's a tie, we pick
16821  * the first one, unless IPMP is used in which case we round-robin among them;
16822  * see below for more.
16823  *
16824  * Returns NULL if there is no suitable source address for the ill.
16825  * This only occurs when there is no valid source address for the ill.
16826  */
16827 ipif_t *
16828 ipif_select_source(ill_t *ill, ipaddr_t dst, zoneid_t zoneid)
16829 {
16830 	ill_t	*usill = NULL;
16831 	ill_t	*ipmp_ill = NULL;
16832 	ipif_t	*start_ipif, *next_ipif, *ipif, *best_ipif;
16833 	ipif_type_t type, best_type;
16834 	tsol_tpc_t *src_rhtp, *dst_rhtp;
16835 	ip_stack_t *ipst = ill->ill_ipst;
16836 	boolean_t samenet;
16837 
16838 	if (ill->ill_usesrc_ifindex != 0) {
16839 		usill = ill_lookup_on_ifindex(ill->ill_usesrc_ifindex,
16840 		    B_FALSE, NULL, NULL, NULL, NULL, ipst);
16841 		if (usill != NULL)
16842 			ill = usill;	/* Select source from usesrc ILL */
16843 		else
16844 			return (NULL);
16845 	}
16846 
16847 	/*
16848 	 * Test addresses should never be used for source address selection,
16849 	 * so if we were passed one, switch to the IPMP meta-interface.
16850 	 */
16851 	if (IS_UNDER_IPMP(ill)) {
16852 		if ((ipmp_ill = ipmp_ill_hold_ipmp_ill(ill)) != NULL)
16853 			ill = ipmp_ill;	/* Select source from IPMP ill */
16854 		else
16855 			return (NULL);
16856 	}
16857 
16858 	/*
16859 	 * If we're dealing with an unlabeled destination on a labeled system,
16860 	 * make sure that we ignore source addresses that are incompatible with
16861 	 * the destination's default label.  That destination's default label
16862 	 * must dominate the minimum label on the source address.
16863 	 */
16864 	dst_rhtp = NULL;
16865 	if (is_system_labeled()) {
16866 		dst_rhtp = find_tpc(&dst, IPV4_VERSION, B_FALSE);
16867 		if (dst_rhtp == NULL)
16868 			return (NULL);
16869 		if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
16870 			TPC_RELE(dst_rhtp);
16871 			dst_rhtp = NULL;
16872 		}
16873 	}
16874 
16875 	/*
16876 	 * Hold the ill_g_lock as reader. This makes sure that no ipif/ill
16877 	 * can be deleted. But an ipif/ill can get CONDEMNED any time.
16878 	 * After selecting the right ipif, under ill_lock make sure ipif is
16879 	 * not condemned, and increment refcnt. If ipif is CONDEMNED,
16880 	 * we retry. Inside the loop we still need to check for CONDEMNED,
16881 	 * but not under a lock.
16882 	 */
16883 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
16884 retry:
16885 	/*
16886 	 * For source address selection, we treat the ipif list as circular
16887 	 * and continue until we get back to where we started.  This allows
16888 	 * IPMP to vary source address selection (which improves inbound load
16889 	 * spreading) by caching its last ending point and starting from
16890 	 * there.  NOTE: we don't have to worry about ill_src_ipif changing
16891 	 * ills since that can't happen on the IPMP ill.
16892 	 */
16893 	start_ipif = ill->ill_ipif;
16894 	if (IS_IPMP(ill) && ill->ill_src_ipif != NULL)
16895 		start_ipif = ill->ill_src_ipif;
16896 
16897 	ipif = start_ipif;
16898 	best_ipif = NULL;
16899 	best_type = IPIF_NONE;
16900 	do {
16901 		if ((next_ipif = ipif->ipif_next) == NULL)
16902 			next_ipif = ill->ill_ipif;
16903 
16904 		if (!IPIF_CAN_LOOKUP(ipif))
16905 			continue;
16906 		/* Always skip NOLOCAL and ANYCAST interfaces */
16907 		if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
16908 			continue;
16909 		if (!(ipif->ipif_flags & IPIF_UP) || !ipif->ipif_addr_ready)
16910 			continue;
16911 		if (ipif->ipif_zoneid != zoneid &&
16912 		    ipif->ipif_zoneid != ALL_ZONES)
16913 			continue;
16914 
16915 		/*
16916 		 * Interfaces with 0.0.0.0 address are allowed to be UP, but
16917 		 * are not valid as source addresses.
16918 		 */
16919 		if (ipif->ipif_lcl_addr == INADDR_ANY)
16920 			continue;
16921 
16922 		/*
16923 		 * Check compatibility of local address for destination's
16924 		 * default label if we're on a labeled system.	Incompatible
16925 		 * addresses can't be used at all.
16926 		 */
16927 		if (dst_rhtp != NULL) {
16928 			boolean_t incompat;
16929 
16930 			src_rhtp = find_tpc(&ipif->ipif_lcl_addr,
16931 			    IPV4_VERSION, B_FALSE);
16932 			if (src_rhtp == NULL)
16933 				continue;
16934 			incompat = src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
16935 			    src_rhtp->tpc_tp.tp_doi !=
16936 			    dst_rhtp->tpc_tp.tp_doi ||
16937 			    (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
16938 			    &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
16939 			    !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
16940 			    src_rhtp->tpc_tp.tp_sl_set_cipso));
16941 			TPC_RELE(src_rhtp);
16942 			if (incompat)
16943 				continue;
16944 		}
16945 
16946 		samenet = ((ipif->ipif_net_mask & dst) == ipif->ipif_subnet);
16947 
16948 		if (ipif->ipif_flags & IPIF_DEPRECATED) {
16949 			type = samenet ? IPIF_SAMENET_DEPRECATED :
16950 			    IPIF_DIFFNET_DEPRECATED;
16951 		} else if (ipif->ipif_zoneid == ALL_ZONES) {
16952 			type = samenet ? IPIF_SAMENET_ALLZONES :
16953 			    IPIF_DIFFNET_ALLZONES;
16954 		} else {
16955 			type = samenet ? IPIF_SAMENET : IPIF_DIFFNET;
16956 		}
16957 
16958 		if (type > best_type) {
16959 			best_type = type;
16960 			best_ipif = ipif;
16961 			if (best_type == IPIF_SAMENET)
16962 				break; /* can't get better */
16963 		}
16964 	} while ((ipif = next_ipif) != start_ipif);
16965 
16966 	if ((ipif = best_ipif) != NULL) {
16967 		mutex_enter(&ipif->ipif_ill->ill_lock);
16968 		if (!IPIF_CAN_LOOKUP(ipif)) {
16969 			mutex_exit(&ipif->ipif_ill->ill_lock);
16970 			goto retry;
16971 		}
16972 		ipif_refhold_locked(ipif);
16973 
16974 		/*
16975 		 * For IPMP, update the source ipif rotor to the next ipif,
16976 		 * provided we can look it up.  (We must not use it if it's
16977 		 * IPIF_CONDEMNED since we may have grabbed ill_g_lock after
16978 		 * ipif_free() checked ill_src_ipif.)
16979 		 */
16980 		if (IS_IPMP(ill) && ipif != NULL) {
16981 			next_ipif = ipif->ipif_next;
16982 			if (next_ipif != NULL && IPIF_CAN_LOOKUP(next_ipif))
16983 				ill->ill_src_ipif = next_ipif;
16984 			else
16985 				ill->ill_src_ipif = NULL;
16986 		}
16987 		mutex_exit(&ipif->ipif_ill->ill_lock);
16988 	}
16989 
16990 	rw_exit(&ipst->ips_ill_g_lock);
16991 	if (usill != NULL)
16992 		ill_refrele(usill);
16993 	if (ipmp_ill != NULL)
16994 		ill_refrele(ipmp_ill);
16995 	if (dst_rhtp != NULL)
16996 		TPC_RELE(dst_rhtp);
16997 
16998 #ifdef DEBUG
16999 	if (ipif == NULL) {
17000 		char buf1[INET6_ADDRSTRLEN];
17001 
17002 		ip1dbg(("ipif_select_source(%s, %s) -> NULL\n",
17003 		    ill->ill_name,
17004 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1))));
17005 	} else {
17006 		char buf1[INET6_ADDRSTRLEN];
17007 		char buf2[INET6_ADDRSTRLEN];
17008 
17009 		ip1dbg(("ipif_select_source(%s, %s) -> %s\n",
17010 		    ipif->ipif_ill->ill_name,
17011 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1)),
17012 		    inet_ntop(AF_INET, &ipif->ipif_lcl_addr,
17013 		    buf2, sizeof (buf2))));
17014 	}
17015 #endif /* DEBUG */
17016 	return (ipif);
17017 }
17018 
17019 /*
17020  * If old_ipif is not NULL, see if ipif was derived from old
17021  * ipif and if so, recreate the interface route by re-doing
17022  * source address selection. This happens when ipif_down ->
17023  * ipif_update_other_ipifs calls us.
17024  *
17025  * If old_ipif is NULL, just redo the source address selection
17026  * if needed. This happens when ipif_up_done calls us.
17027  */
17028 static void
17029 ipif_recreate_interface_routes(ipif_t *old_ipif, ipif_t *ipif)
17030 {
17031 	ire_t *ire;
17032 	ire_t *ipif_ire;
17033 	queue_t *stq;
17034 	ipif_t *nipif;
17035 	ill_t *ill;
17036 	boolean_t need_rele = B_FALSE;
17037 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
17038 
17039 	ASSERT(old_ipif == NULL || IAM_WRITER_IPIF(old_ipif));
17040 	ASSERT(IAM_WRITER_IPIF(ipif));
17041 
17042 	ill = ipif->ipif_ill;
17043 	if (!(ipif->ipif_flags &
17044 	    (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) {
17045 		/*
17046 		 * Can't possibly have borrowed the source
17047 		 * from old_ipif.
17048 		 */
17049 		return;
17050 	}
17051 
17052 	/*
17053 	 * Is there any work to be done? No work if the address
17054 	 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST (
17055 	 * ipif_select_source() does not borrow addresses from
17056 	 * NOLOCAL and ANYCAST interfaces).
17057 	 */
17058 	if ((old_ipif != NULL) &&
17059 	    ((old_ipif->ipif_lcl_addr == INADDR_ANY) ||
17060 	    (old_ipif->ipif_ill->ill_wq == NULL) ||
17061 	    (old_ipif->ipif_flags &
17062 	    (IPIF_NOLOCAL|IPIF_ANYCAST)))) {
17063 		return;
17064 	}
17065 
17066 	/*
17067 	 * Perform the same checks as when creating the
17068 	 * IRE_INTERFACE in ipif_up_done.
17069 	 */
17070 	if (!(ipif->ipif_flags & IPIF_UP))
17071 		return;
17072 
17073 	if ((ipif->ipif_flags & IPIF_NOXMIT) ||
17074 	    (ipif->ipif_subnet == INADDR_ANY))
17075 		return;
17076 
17077 	ipif_ire = ipif_to_ire(ipif);
17078 	if (ipif_ire == NULL)
17079 		return;
17080 
17081 	/*
17082 	 * We know that ipif uses some other source for its
17083 	 * IRE_INTERFACE. Is it using the source of this
17084 	 * old_ipif?
17085 	 */
17086 	if (old_ipif != NULL &&
17087 	    old_ipif->ipif_lcl_addr != ipif_ire->ire_src_addr) {
17088 		ire_refrele(ipif_ire);
17089 		return;
17090 	}
17091 	if (ip_debug > 2) {
17092 		/* ip1dbg */
17093 		pr_addr_dbg("ipif_recreate_interface_routes: deleting IRE for"
17094 		    " src %s\n", AF_INET, &ipif_ire->ire_src_addr);
17095 	}
17096 
17097 	stq = ipif_ire->ire_stq;
17098 
17099 	/*
17100 	 * Can't use our source address. Select a different
17101 	 * source address for the IRE_INTERFACE.
17102 	 */
17103 	nipif = ipif_select_source(ill, ipif->ipif_subnet, ipif->ipif_zoneid);
17104 	if (nipif == NULL) {
17105 		/* Last resort - all ipif's have IPIF_NOLOCAL */
17106 		nipif = ipif;
17107 	} else {
17108 		need_rele = B_TRUE;
17109 	}
17110 
17111 	ire = ire_create(
17112 	    (uchar_t *)&ipif->ipif_subnet,	/* dest pref */
17113 	    (uchar_t *)&ipif->ipif_net_mask,	/* mask */
17114 	    (uchar_t *)&nipif->ipif_src_addr,	/* src addr */
17115 	    NULL,				/* no gateway */
17116 	    &ipif->ipif_mtu,			/* max frag */
17117 	    NULL,				/* no src nce */
17118 	    NULL,				/* no recv from queue */
17119 	    stq,				/* send-to queue */
17120 	    ill->ill_net_type,			/* IF_[NO]RESOLVER */
17121 	    ipif,
17122 	    0,
17123 	    0,
17124 	    0,
17125 	    0,
17126 	    &ire_uinfo_null,
17127 	    NULL,
17128 	    NULL,
17129 	    ipst);
17130 
17131 	if (ire != NULL) {
17132 		ire_t *ret_ire;
17133 		int error;
17134 
17135 		/*
17136 		 * We don't need ipif_ire anymore. We need to delete
17137 		 * before we add so that ire_add does not detect
17138 		 * duplicates.
17139 		 */
17140 		ire_delete(ipif_ire);
17141 		ret_ire = ire;
17142 		error = ire_add(&ret_ire, NULL, NULL, NULL, B_FALSE);
17143 		ASSERT(error == 0);
17144 		ASSERT(ire == ret_ire);
17145 		/* Held in ire_add */
17146 		ire_refrele(ret_ire);
17147 	}
17148 	/*
17149 	 * Either we are falling through from above or could not
17150 	 * allocate a replacement.
17151 	 */
17152 	ire_refrele(ipif_ire);
17153 	if (need_rele)
17154 		ipif_refrele(nipif);
17155 }
17156 
17157 /*
17158  * This old_ipif is going away.
17159  *
17160  * Determine if any other ipif's are using our address as
17161  * ipif_lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or
17162  * IPIF_DEPRECATED).
17163  * Find the IRE_INTERFACE for such ipifs and recreate them
17164  * to use an different source address following the rules in
17165  * ipif_up_done.
17166  */
17167 static void
17168 ipif_update_other_ipifs(ipif_t *old_ipif)
17169 {
17170 	ipif_t	*ipif;
17171 	ill_t	*ill;
17172 	char	buf[INET6_ADDRSTRLEN];
17173 
17174 	ASSERT(IAM_WRITER_IPIF(old_ipif));
17175 
17176 	ill = old_ipif->ipif_ill;
17177 
17178 	ip1dbg(("ipif_update_other_ipifs(%s, %s)\n", ill->ill_name,
17179 	    inet_ntop(AF_INET, &old_ipif->ipif_lcl_addr, buf, sizeof (buf))));
17180 
17181 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17182 		if (ipif == old_ipif)
17183 			continue;
17184 		ipif_recreate_interface_routes(old_ipif, ipif);
17185 	}
17186 }
17187 
17188 /* ARGSUSED */
17189 int
17190 if_unitsel_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
17191 	ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
17192 {
17193 	/*
17194 	 * ill_phyint_reinit merged the v4 and v6 into a single
17195 	 * ipsq.  We might not have been able to complete the
17196 	 * operation in ipif_set_values, if we could not become
17197 	 * exclusive.  If so restart it here.
17198 	 */
17199 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
17200 }
17201 
17202 /*
17203  * Can operate on either a module or a driver queue.
17204  * Returns an error if not a module queue.
17205  */
17206 /* ARGSUSED */
17207 int
17208 if_unitsel(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
17209     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
17210 {
17211 	queue_t		*q1 = q;
17212 	char 		*cp;
17213 	char		interf_name[LIFNAMSIZ];
17214 	uint_t		ppa = *(uint_t *)mp->b_cont->b_cont->b_rptr;
17215 
17216 	if (q->q_next == NULL) {
17217 		ip1dbg((
17218 		    "if_unitsel: IF_UNITSEL: no q_next\n"));
17219 		return (EINVAL);
17220 	}
17221 
17222 	if (((ill_t *)(q->q_ptr))->ill_name[0] != '\0')
17223 		return (EALREADY);
17224 
17225 	do {
17226 		q1 = q1->q_next;
17227 	} while (q1->q_next);
17228 	cp = q1->q_qinfo->qi_minfo->mi_idname;
17229 	(void) sprintf(interf_name, "%s%d", cp, ppa);
17230 
17231 	/*
17232 	 * Here we are not going to delay the ioack until after
17233 	 * ACKs from DL_ATTACH_REQ/DL_BIND_REQ. So no need to save the
17234 	 * original ioctl message before sending the requests.
17235 	 */
17236 	return (ipif_set_values(q, mp, interf_name, &ppa));
17237 }
17238 
17239 /* ARGSUSED */
17240 int
17241 ip_sioctl_sifname(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
17242     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
17243 {
17244 	return (ENXIO);
17245 }
17246 
17247 /*
17248  * Refresh all IRE_BROADCAST entries associated with `ill' to ensure the
17249  * minimum (but complete) set exist.  This is necessary when adding or
17250  * removing an interface to/from an IPMP group, since interfaces in an
17251  * IPMP group use the IRE_BROADCAST entries for the IPMP group (whenever
17252  * its test address subnets overlap with IPMP data addresses).	It's also
17253  * used to refresh the IRE_BROADCAST entries associated with the IPMP
17254  * interface when the nominated broadcast interface changes.
17255  */
17256 void
17257 ill_refresh_bcast(ill_t *ill)
17258 {
17259 	ire_t *ire_array[12];	/* max ipif_create_bcast_ires() can create */
17260 	ire_t **irep;
17261 	ipif_t *ipif;
17262 
17263 	ASSERT(!ill->ill_isv6);
17264 	ASSERT(IAM_WRITER_ILL(ill));
17265 
17266 	/*
17267 	 * Remove any old broadcast IREs.
17268 	 */
17269 	ire_walk_ill_v4(MATCH_IRE_ILL | MATCH_IRE_TYPE, IRE_BROADCAST,
17270 	    ill_broadcast_delete, ill, ill);
17271 
17272 	/*
17273 	 * Create new ones for any ipifs that are up and broadcast-capable.
17274 	 */
17275 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17276 		if ((ipif->ipif_flags & (IPIF_UP|IPIF_BROADCAST)) !=
17277 		    (IPIF_UP|IPIF_BROADCAST))
17278 			continue;
17279 
17280 		irep = ipif_create_bcast_ires(ipif, ire_array);
17281 		while (irep-- > ire_array) {
17282 			(void) ire_add(irep, NULL, NULL, NULL, B_FALSE);
17283 			if (*irep != NULL)
17284 				ire_refrele(*irep);
17285 		}
17286 	}
17287 }
17288 
17289 /*
17290  * Create any IRE_BROADCAST entries for `ipif', and store those entries in
17291  * `irep'.  Returns a pointer to the next free `irep' entry (just like
17292  * ire_check_and_create_bcast()).
17293  */
17294 static ire_t **
17295 ipif_create_bcast_ires(ipif_t *ipif, ire_t **irep)
17296 {
17297 	ipaddr_t addr;
17298 	ipaddr_t netmask = ip_net_mask(ipif->ipif_lcl_addr);
17299 	ipaddr_t subnetmask = ipif->ipif_net_mask;
17300 	int flags = MATCH_IRE_TYPE | MATCH_IRE_ILL;
17301 
17302 	ip1dbg(("ipif_create_bcast_ires: creating broadcast IREs\n"));
17303 
17304 	ASSERT(ipif->ipif_flags & IPIF_BROADCAST);
17305 
17306 	if (ipif->ipif_lcl_addr == INADDR_ANY ||
17307 	    (ipif->ipif_flags & IPIF_NOLOCAL))
17308 		netmask = htonl(IN_CLASSA_NET);		/* fallback */
17309 
17310 	irep = ire_check_and_create_bcast(ipif, 0, irep, flags);
17311 	irep = ire_check_and_create_bcast(ipif, INADDR_BROADCAST, irep, flags);
17312 
17313 	/*
17314 	 * For backward compatibility, we create net broadcast IREs based on
17315 	 * the old "IP address class system", since some old machines only
17316 	 * respond to these class derived net broadcast.  However, we must not
17317 	 * create these net broadcast IREs if the subnetmask is shorter than
17318 	 * the IP address class based derived netmask.  Otherwise, we may
17319 	 * create a net broadcast address which is the same as an IP address
17320 	 * on the subnet -- and then TCP will refuse to talk to that address.
17321 	 */
17322 	if (netmask < subnetmask) {
17323 		addr = netmask & ipif->ipif_subnet;
17324 		irep = ire_check_and_create_bcast(ipif, addr, irep, flags);
17325 		irep = ire_check_and_create_bcast(ipif, ~netmask | addr, irep,
17326 		    flags);
17327 	}
17328 
17329 	/*
17330 	 * Don't create IRE_BROADCAST IREs for the interface if the subnetmask
17331 	 * is 0xFFFFFFFF, as an IRE_LOCAL for that interface is already
17332 	 * created.  Creating these broadcast IREs will only create confusion
17333 	 * as `addr' will be the same as the IP address.
17334 	 */
17335 	if (subnetmask != 0xFFFFFFFF) {
17336 		addr = ipif->ipif_subnet;
17337 		irep = ire_check_and_create_bcast(ipif, addr, irep, flags);
17338 		irep = ire_check_and_create_bcast(ipif, ~subnetmask | addr,
17339 		    irep, flags);
17340 	}
17341 
17342 	return (irep);
17343 }
17344 
17345 /*
17346  * Broadcast IRE info structure used in the functions below.  Since we
17347  * allocate BCAST_COUNT of them on the stack, keep the bit layout compact.
17348  */
17349 typedef struct bcast_ireinfo {
17350 	uchar_t		bi_type;	/* BCAST_* value from below */
17351 	uchar_t		bi_willdie:1, 	/* will this IRE be going away? */
17352 			bi_needrep:1,	/* do we need to replace it? */
17353 			bi_haverep:1,	/* have we replaced it? */
17354 			bi_pad:5;
17355 	ipaddr_t	bi_addr;	/* IRE address */
17356 	ipif_t		*bi_backup;	/* last-ditch ipif to replace it on */
17357 } bcast_ireinfo_t;
17358 
17359 enum { BCAST_ALLONES, BCAST_ALLZEROES, BCAST_NET, BCAST_SUBNET, BCAST_COUNT };
17360 
17361 /*
17362  * Check if `ipif' needs the dying broadcast IRE described by `bireinfop', and
17363  * return B_TRUE if it should immediately be used to recreate the IRE.
17364  */
17365 static boolean_t
17366 ipif_consider_bcast(ipif_t *ipif, bcast_ireinfo_t *bireinfop)
17367 {
17368 	ipaddr_t addr;
17369 
17370 	ASSERT(!bireinfop->bi_haverep && bireinfop->bi_willdie);
17371 
17372 	switch (bireinfop->bi_type) {
17373 	case BCAST_NET:
17374 		addr = ipif->ipif_subnet & ip_net_mask(ipif->ipif_subnet);
17375 		if (addr != bireinfop->bi_addr)
17376 			return (B_FALSE);
17377 		break;
17378 	case BCAST_SUBNET:
17379 		if (ipif->ipif_subnet != bireinfop->bi_addr)
17380 			return (B_FALSE);
17381 		break;
17382 	}
17383 
17384 	bireinfop->bi_needrep = 1;
17385 	if (ipif->ipif_flags & (IPIF_DEPRECATED|IPIF_NOLOCAL|IPIF_ANYCAST)) {
17386 		if (bireinfop->bi_backup == NULL)
17387 			bireinfop->bi_backup = ipif;
17388 		return (B_FALSE);
17389 	}
17390 	return (B_TRUE);
17391 }
17392 
17393 /*
17394  * Create the broadcast IREs described by `bireinfop' on `ipif', and return
17395  * them ala ire_check_and_create_bcast().
17396  */
17397 static ire_t **
17398 ipif_create_bcast(ipif_t *ipif, bcast_ireinfo_t *bireinfop, ire_t **irep)
17399 {
17400 	ipaddr_t mask, addr;
17401 
17402 	ASSERT(!bireinfop->bi_haverep && bireinfop->bi_needrep);
17403 
17404 	addr = bireinfop->bi_addr;
17405 	irep = ire_create_bcast(ipif, addr, irep);
17406 
17407 	switch (bireinfop->bi_type) {
17408 	case BCAST_NET:
17409 		mask = ip_net_mask(ipif->ipif_subnet);
17410 		irep = ire_create_bcast(ipif, addr | ~mask, irep);
17411 		break;
17412 	case BCAST_SUBNET:
17413 		mask = ipif->ipif_net_mask;
17414 		irep = ire_create_bcast(ipif, addr | ~mask, irep);
17415 		break;
17416 	}
17417 
17418 	bireinfop->bi_haverep = 1;
17419 	return (irep);
17420 }
17421 
17422 /*
17423  * Walk through all of the ipifs on `ill' that will be affected by `test_ipif'
17424  * going away, and determine if any of the broadcast IREs (named by `bireinfop')
17425  * that are going away are still needed.  If so, have ipif_create_bcast()
17426  * recreate them (except for the deprecated case, as explained below).
17427  */
17428 static ire_t **
17429 ill_create_bcast(ill_t *ill, ipif_t *test_ipif, bcast_ireinfo_t *bireinfo,
17430     ire_t **irep)
17431 {
17432 	int i;
17433 	ipif_t *ipif;
17434 
17435 	ASSERT(!ill->ill_isv6);
17436 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17437 		/*
17438 		 * Skip this ipif if it's (a) the one being taken down, (b)
17439 		 * not in the same zone, or (c) has no valid local address.
17440 		 */
17441 		if (ipif == test_ipif ||
17442 		    ipif->ipif_zoneid != test_ipif->ipif_zoneid ||
17443 		    ipif->ipif_subnet == 0 ||
17444 		    (ipif->ipif_flags & (IPIF_UP|IPIF_BROADCAST|IPIF_NOXMIT)) !=
17445 		    (IPIF_UP|IPIF_BROADCAST))
17446 			continue;
17447 
17448 		/*
17449 		 * For each dying IRE that hasn't yet been replaced, see if
17450 		 * `ipif' needs it and whether the IRE should be recreated on
17451 		 * `ipif'.  If `ipif' is deprecated, ipif_consider_bcast()
17452 		 * will return B_FALSE even if `ipif' needs the IRE on the
17453 		 * hopes that we'll later find a needy non-deprecated ipif.
17454 		 * However, the ipif is recorded in bi_backup for possible
17455 		 * subsequent use by ipif_check_bcast_ires().
17456 		 */
17457 		for (i = 0; i < BCAST_COUNT; i++) {
17458 			if (!bireinfo[i].bi_willdie || bireinfo[i].bi_haverep)
17459 				continue;
17460 			if (!ipif_consider_bcast(ipif, &bireinfo[i]))
17461 				continue;
17462 			irep = ipif_create_bcast(ipif, &bireinfo[i], irep);
17463 		}
17464 
17465 		/*
17466 		 * If we've replaced all of the broadcast IREs that are going
17467 		 * to be taken down, we know we're done.
17468 		 */
17469 		for (i = 0; i < BCAST_COUNT; i++) {
17470 			if (bireinfo[i].bi_willdie && !bireinfo[i].bi_haverep)
17471 				break;
17472 		}
17473 		if (i == BCAST_COUNT)
17474 			break;
17475 	}
17476 	return (irep);
17477 }
17478 
17479 /*
17480  * Check if `test_ipif' (which is going away) is associated with any existing
17481  * broadcast IREs, and whether any other ipifs (e.g., on the same ill) were
17482  * using those broadcast IREs.  If so, recreate the broadcast IREs on one or
17483  * more of those other ipifs.  (The old IREs will be deleted in ipif_down().)
17484  *
17485  * This is necessary because broadcast IREs are shared.  In particular, a
17486  * given ill has one set of all-zeroes and all-ones broadcast IREs (for every
17487  * zone), plus one set of all-subnet-ones, all-subnet-zeroes, all-net-ones,
17488  * and all-net-zeroes for every net/subnet (and every zone) it has IPIF_UP
17489  * ipifs on.  Thus, if there are two IPIF_UP ipifs on the same subnet with the
17490  * same zone, they will share the same set of broadcast IREs.
17491  *
17492  * Note: the upper bound of 12 IREs comes from the worst case of replacing all
17493  * six pairs (loopback and non-loopback) of broadcast IREs (all-zeroes,
17494  * all-ones, subnet-zeroes, subnet-ones, net-zeroes, and net-ones).
17495  */
17496 static void
17497 ipif_check_bcast_ires(ipif_t *test_ipif)
17498 {
17499 	ill_t		*ill = test_ipif->ipif_ill;
17500 	ire_t		*ire, *ire_array[12]; 		/* see note above */
17501 	ire_t		**irep1, **irep = &ire_array[0];
17502 	uint_t 		i, willdie;
17503 	ipaddr_t	mask = ip_net_mask(test_ipif->ipif_subnet);
17504 	bcast_ireinfo_t	bireinfo[BCAST_COUNT];
17505 
17506 	ASSERT(!test_ipif->ipif_isv6);
17507 	ASSERT(IAM_WRITER_IPIF(test_ipif));
17508 
17509 	/*
17510 	 * No broadcast IREs for the LOOPBACK interface
17511 	 * or others such as point to point and IPIF_NOXMIT.
17512 	 */
17513 	if (!(test_ipif->ipif_flags & IPIF_BROADCAST) ||
17514 	    (test_ipif->ipif_flags & IPIF_NOXMIT))
17515 		return;
17516 
17517 	bzero(bireinfo, sizeof (bireinfo));
17518 	bireinfo[0].bi_type = BCAST_ALLZEROES;
17519 	bireinfo[0].bi_addr = 0;
17520 
17521 	bireinfo[1].bi_type = BCAST_ALLONES;
17522 	bireinfo[1].bi_addr = INADDR_BROADCAST;
17523 
17524 	bireinfo[2].bi_type = BCAST_NET;
17525 	bireinfo[2].bi_addr = test_ipif->ipif_subnet & mask;
17526 
17527 	if (test_ipif->ipif_net_mask != 0)
17528 		mask = test_ipif->ipif_net_mask;
17529 	bireinfo[3].bi_type = BCAST_SUBNET;
17530 	bireinfo[3].bi_addr = test_ipif->ipif_subnet & mask;
17531 
17532 	/*
17533 	 * Figure out what (if any) broadcast IREs will die as a result of
17534 	 * `test_ipif' going away.  If none will die, we're done.
17535 	 */
17536 	for (i = 0, willdie = 0; i < BCAST_COUNT; i++) {
17537 		ire = ire_ctable_lookup(bireinfo[i].bi_addr, 0, IRE_BROADCAST,
17538 		    test_ipif, ALL_ZONES, NULL,
17539 		    (MATCH_IRE_TYPE | MATCH_IRE_IPIF), ill->ill_ipst);
17540 		if (ire != NULL) {
17541 			willdie++;
17542 			bireinfo[i].bi_willdie = 1;
17543 			ire_refrele(ire);
17544 		}
17545 	}
17546 
17547 	if (willdie == 0)
17548 		return;
17549 
17550 	/*
17551 	 * Walk through all the ipifs that will be affected by the dying IREs,
17552 	 * and recreate the IREs as necessary. Note that all interfaces in an
17553 	 * IPMP illgrp share the same broadcast IREs, and thus the entire
17554 	 * illgrp must be walked, starting with the IPMP meta-interface (so
17555 	 * that broadcast IREs end up on it whenever possible).
17556 	 */
17557 	if (IS_UNDER_IPMP(ill))
17558 		ill = ipmp_illgrp_ipmp_ill(ill->ill_grp);
17559 
17560 	irep = ill_create_bcast(ill, test_ipif, bireinfo, irep);
17561 
17562 	if (IS_IPMP(ill) || IS_UNDER_IPMP(ill)) {
17563 		ipmp_illgrp_t *illg = ill->ill_grp;
17564 
17565 		ill = list_head(&illg->ig_if);
17566 		for (; ill != NULL; ill = list_next(&illg->ig_if, ill)) {
17567 			for (i = 0; i < BCAST_COUNT; i++) {
17568 				if (bireinfo[i].bi_willdie &&
17569 				    !bireinfo[i].bi_haverep)
17570 					break;
17571 			}
17572 			if (i == BCAST_COUNT)
17573 				break;
17574 
17575 			irep = ill_create_bcast(ill, test_ipif, bireinfo, irep);
17576 		}
17577 	}
17578 
17579 	/*
17580 	 * Scan through the set of broadcast IREs and see if there are any
17581 	 * that we need to replace that have not yet been replaced.  If so,
17582 	 * replace them using the appropriate backup ipif.
17583 	 */
17584 	for (i = 0; i < BCAST_COUNT; i++) {
17585 		if (bireinfo[i].bi_needrep && !bireinfo[i].bi_haverep)
17586 			irep = ipif_create_bcast(bireinfo[i].bi_backup,
17587 			    &bireinfo[i], irep);
17588 	}
17589 
17590 	/*
17591 	 * If we can't create all of them, don't add any of them.  (Code in
17592 	 * ip_wput_ire() and ire_to_ill() assumes that we always have a
17593 	 * non-loopback copy and loopback copy for a given address.)
17594 	 */
17595 	for (irep1 = irep; irep1 > ire_array; ) {
17596 		irep1--;
17597 		if (*irep1 == NULL) {
17598 			ip0dbg(("ipif_check_bcast_ires: can't create "
17599 			    "IRE_BROADCAST, memory allocation failure\n"));
17600 			while (irep > ire_array) {
17601 				irep--;
17602 				if (*irep != NULL)
17603 					ire_delete(*irep);
17604 			}
17605 			return;
17606 		}
17607 	}
17608 
17609 	for (irep1 = irep; irep1 > ire_array; ) {
17610 		irep1--;
17611 		if (ire_add(irep1, NULL, NULL, NULL, B_FALSE) == 0)
17612 			ire_refrele(*irep1);		/* Held in ire_add */
17613 	}
17614 }
17615 
17616 /*
17617  * Extract both the flags (including IFF_CANTCHANGE) such as IFF_IPV*
17618  * from lifr_flags and the name from lifr_name.
17619  * Set IFF_IPV* and ill_isv6 prior to doing the lookup
17620  * since ipif_lookup_on_name uses the _isv6 flags when matching.
17621  * Returns EINPROGRESS when mp has been consumed by queueing it on
17622  * ill_pending_mp and the ioctl will complete in ip_rput.
17623  *
17624  * Can operate on either a module or a driver queue.
17625  * Returns an error if not a module queue.
17626  */
17627 /* ARGSUSED */
17628 int
17629 ip_sioctl_slifname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17630     ip_ioctl_cmd_t *ipip, void *if_req)
17631 {
17632 	ill_t	*ill = q->q_ptr;
17633 	phyint_t *phyi;
17634 	ip_stack_t *ipst;
17635 	struct lifreq *lifr = if_req;
17636 
17637 	ASSERT(ipif != NULL);
17638 	ip1dbg(("ip_sioctl_slifname %s\n", lifr->lifr_name));
17639 
17640 	if (q->q_next == NULL) {
17641 		ip1dbg(("if_sioctl_slifname: SIOCSLIFNAME: no q_next\n"));
17642 		return (EINVAL);
17643 	}
17644 
17645 	/*
17646 	 * If we are not writer on 'q' then this interface exists already
17647 	 * and previous lookups (ip_extract_lifreq()) found this ipif --
17648 	 * so return EALREADY.
17649 	 */
17650 	if (ill != ipif->ipif_ill)
17651 		return (EALREADY);
17652 
17653 	if (ill->ill_name[0] != '\0')
17654 		return (EALREADY);
17655 
17656 	/*
17657 	 * Set all the flags. Allows all kinds of override. Provide some
17658 	 * sanity checking by not allowing IFF_BROADCAST and IFF_MULTICAST
17659 	 * unless there is either multicast/broadcast support in the driver
17660 	 * or it is a pt-pt link.
17661 	 */
17662 	if (lifr->lifr_flags & (IFF_PROMISC|IFF_ALLMULTI)) {
17663 		/* Meaningless to IP thus don't allow them to be set. */
17664 		ip1dbg(("ip_setname: EINVAL 1\n"));
17665 		return (EINVAL);
17666 	}
17667 
17668 	/*
17669 	 * If there's another ill already with the requested name, ensure
17670 	 * that it's of the same type.  Otherwise, ill_phyint_reinit() will
17671 	 * fuse together two unrelated ills, which will cause chaos.
17672 	 */
17673 	ipst = ill->ill_ipst;
17674 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
17675 	    lifr->lifr_name, NULL);
17676 	if (phyi != NULL) {
17677 		ill_t *ill_mate = phyi->phyint_illv4;
17678 
17679 		if (ill_mate == NULL)
17680 			ill_mate = phyi->phyint_illv6;
17681 		ASSERT(ill_mate != NULL);
17682 
17683 		if (ill_mate->ill_media->ip_m_mac_type !=
17684 		    ill->ill_media->ip_m_mac_type) {
17685 			ip1dbg(("if_sioctl_slifname: SIOCSLIFNAME: attempt to "
17686 			    "use the same ill name on differing media\n"));
17687 			return (EINVAL);
17688 		}
17689 	}
17690 
17691 	/*
17692 	 * For a DL_STYLE2 driver (ill_needs_attach), we would not have the
17693 	 * ill_bcast_addr_length info.
17694 	 */
17695 	if (!ill->ill_needs_attach &&
17696 	    ((lifr->lifr_flags & IFF_MULTICAST) &&
17697 	    !(lifr->lifr_flags & IFF_POINTOPOINT) &&
17698 	    ill->ill_bcast_addr_length == 0)) {
17699 		/* Link not broadcast/pt-pt capable i.e. no multicast */
17700 		ip1dbg(("ip_setname: EINVAL 2\n"));
17701 		return (EINVAL);
17702 	}
17703 	if ((lifr->lifr_flags & IFF_BROADCAST) &&
17704 	    ((lifr->lifr_flags & IFF_IPV6) ||
17705 	    (!ill->ill_needs_attach && ill->ill_bcast_addr_length == 0))) {
17706 		/* Link not broadcast capable or IPv6 i.e. no broadcast */
17707 		ip1dbg(("ip_setname: EINVAL 3\n"));
17708 		return (EINVAL);
17709 	}
17710 	if (lifr->lifr_flags & IFF_UP) {
17711 		/* Can only be set with SIOCSLIFFLAGS */
17712 		ip1dbg(("ip_setname: EINVAL 4\n"));
17713 		return (EINVAL);
17714 	}
17715 	if ((lifr->lifr_flags & (IFF_IPV6|IFF_IPV4)) != IFF_IPV6 &&
17716 	    (lifr->lifr_flags & (IFF_IPV6|IFF_IPV4)) != IFF_IPV4) {
17717 		ip1dbg(("ip_setname: EINVAL 5\n"));
17718 		return (EINVAL);
17719 	}
17720 	/*
17721 	 * Only allow the IFF_XRESOLV flag to be set on IPv6 interfaces.
17722 	 */
17723 	if ((lifr->lifr_flags & IFF_XRESOLV) &&
17724 	    !(lifr->lifr_flags & IFF_IPV6) &&
17725 	    !(ipif->ipif_isv6)) {
17726 		ip1dbg(("ip_setname: EINVAL 6\n"));
17727 		return (EINVAL);
17728 	}
17729 
17730 	/*
17731 	 * The user has done SIOCGLIFFLAGS prior to this ioctl and hence
17732 	 * we have all the flags here. So, we assign rather than we OR.
17733 	 * We can't OR the flags here because we don't want to set
17734 	 * both IFF_IPV4 and IFF_IPV6. We start off as IFF_IPV4 in
17735 	 * ipif_allocate and become IFF_IPV4 or IFF_IPV6 here depending
17736 	 * on lifr_flags value here.
17737 	 */
17738 	/*
17739 	 * This ill has not been inserted into the global list.
17740 	 * So we are still single threaded and don't need any lock
17741 	 */
17742 	ipif->ipif_flags = lifr->lifr_flags & IFF_LOGINT_FLAGS & ~IFF_DUPLICATE;
17743 	ill->ill_flags = lifr->lifr_flags & IFF_PHYINTINST_FLAGS;
17744 	ill->ill_phyint->phyint_flags = lifr->lifr_flags & IFF_PHYINT_FLAGS;
17745 
17746 	/* We started off as V4. */
17747 	if (ill->ill_flags & ILLF_IPV6) {
17748 		ill->ill_phyint->phyint_illv6 = ill;
17749 		ill->ill_phyint->phyint_illv4 = NULL;
17750 	}
17751 
17752 	return (ipif_set_values(q, mp, lifr->lifr_name, &lifr->lifr_ppa));
17753 }
17754 
17755 /* ARGSUSED */
17756 int
17757 ip_sioctl_slifname_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17758     ip_ioctl_cmd_t *ipip, void *if_req)
17759 {
17760 	/*
17761 	 * ill_phyint_reinit merged the v4 and v6 into a single
17762 	 * ipsq.  We might not have been able to complete the
17763 	 * slifname in ipif_set_values, if we could not become
17764 	 * exclusive.  If so restart it here
17765 	 */
17766 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
17767 }
17768 
17769 /*
17770  * Return a pointer to the ipif which matches the index, IP version type and
17771  * zoneid.
17772  */
17773 ipif_t *
17774 ipif_lookup_on_ifindex(uint_t index, boolean_t isv6, zoneid_t zoneid,
17775     queue_t *q, mblk_t *mp, ipsq_func_t func, int *err, ip_stack_t *ipst)
17776 {
17777 	ill_t	*ill;
17778 	ipif_t	*ipif = NULL;
17779 
17780 	ASSERT((q == NULL && mp == NULL && func == NULL && err == NULL) ||
17781 	    (q != NULL && mp != NULL && func != NULL && err != NULL));
17782 
17783 	if (err != NULL)
17784 		*err = 0;
17785 
17786 	ill = ill_lookup_on_ifindex(index, isv6, q, mp, func, err, ipst);
17787 	if (ill != NULL) {
17788 		mutex_enter(&ill->ill_lock);
17789 		for (ipif = ill->ill_ipif; ipif != NULL;
17790 		    ipif = ipif->ipif_next) {
17791 			if (IPIF_CAN_LOOKUP(ipif) && (zoneid == ALL_ZONES ||
17792 			    zoneid == ipif->ipif_zoneid ||
17793 			    ipif->ipif_zoneid == ALL_ZONES)) {
17794 				ipif_refhold_locked(ipif);
17795 				break;
17796 			}
17797 		}
17798 		mutex_exit(&ill->ill_lock);
17799 		ill_refrele(ill);
17800 		if (ipif == NULL && err != NULL)
17801 			*err = ENXIO;
17802 	}
17803 	return (ipif);
17804 }
17805 
17806 /*
17807  * Change an existing physical interface's index. If the new index
17808  * is acceptable we update the index and the phyint_list_avl_by_index tree.
17809  * Finally, we update other systems which may have a dependence on the
17810  * index value.
17811  */
17812 /* ARGSUSED */
17813 int
17814 ip_sioctl_slifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17815     ip_ioctl_cmd_t *ipip, void *ifreq)
17816 {
17817 	ill_t		*ill;
17818 	phyint_t	*phyi;
17819 	struct ifreq	*ifr = (struct ifreq *)ifreq;
17820 	struct lifreq	*lifr = (struct lifreq *)ifreq;
17821 	uint_t	old_index, index;
17822 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
17823 	avl_index_t	where;
17824 
17825 	if (ipip->ipi_cmd_type == IF_CMD)
17826 		index = ifr->ifr_index;
17827 	else
17828 		index = lifr->lifr_index;
17829 
17830 	/*
17831 	 * Only allow on physical interface. Also, index zero is illegal.
17832 	 */
17833 	ill = ipif->ipif_ill;
17834 	phyi = ill->ill_phyint;
17835 	if (ipif->ipif_id != 0 || index == 0) {
17836 		return (EINVAL);
17837 	}
17838 
17839 	/* If the index is not changing, no work to do */
17840 	if (phyi->phyint_ifindex == index)
17841 		return (0);
17842 
17843 	/*
17844 	 * Use phyint_exists() to determine if the new interface index
17845 	 * is already in use. If the index is unused then we need to
17846 	 * change the phyint's position in the phyint_list_avl_by_index
17847 	 * tree. If we do not do this, subsequent lookups (using the new
17848 	 * index value) will not find the phyint.
17849 	 */
17850 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
17851 	if (phyint_exists(index, ipst)) {
17852 		rw_exit(&ipst->ips_ill_g_lock);
17853 		return (EEXIST);
17854 	}
17855 
17856 	/* The new index is unused. Set it in the phyint. */
17857 	old_index = phyi->phyint_ifindex;
17858 	phyi->phyint_ifindex = index;
17859 
17860 	avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_index, phyi);
17861 	(void) avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
17862 	    &index, &where);
17863 	avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
17864 	    phyi, where);
17865 	rw_exit(&ipst->ips_ill_g_lock);
17866 
17867 	/* Update SCTP's ILL list */
17868 	sctp_ill_reindex(ill, old_index);
17869 
17870 	/* Send the routing sockets message */
17871 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
17872 	if (ILL_OTHER(ill))
17873 		ip_rts_ifmsg(ILL_OTHER(ill)->ill_ipif, RTSQ_DEFAULT);
17874 
17875 	return (0);
17876 }
17877 
17878 /* ARGSUSED */
17879 int
17880 ip_sioctl_get_lifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17881     ip_ioctl_cmd_t *ipip, void *ifreq)
17882 {
17883 	struct ifreq	*ifr = (struct ifreq *)ifreq;
17884 	struct lifreq	*lifr = (struct lifreq *)ifreq;
17885 
17886 	ip1dbg(("ip_sioctl_get_lifindex(%s:%u %p)\n",
17887 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
17888 	/* Get the interface index */
17889 	if (ipip->ipi_cmd_type == IF_CMD) {
17890 		ifr->ifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
17891 	} else {
17892 		lifr->lifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
17893 	}
17894 	return (0);
17895 }
17896 
17897 /* ARGSUSED */
17898 int
17899 ip_sioctl_get_lifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17900     ip_ioctl_cmd_t *ipip, void *ifreq)
17901 {
17902 	struct lifreq	*lifr = (struct lifreq *)ifreq;
17903 
17904 	ip1dbg(("ip_sioctl_get_lifzone(%s:%u %p)\n",
17905 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
17906 	/* Get the interface zone */
17907 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
17908 	lifr->lifr_zoneid = ipif->ipif_zoneid;
17909 	return (0);
17910 }
17911 
17912 /*
17913  * Set the zoneid of an interface.
17914  */
17915 /* ARGSUSED */
17916 int
17917 ip_sioctl_slifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17918     ip_ioctl_cmd_t *ipip, void *ifreq)
17919 {
17920 	struct lifreq	*lifr = (struct lifreq *)ifreq;
17921 	int err = 0;
17922 	boolean_t need_up = B_FALSE;
17923 	zone_t *zptr;
17924 	zone_status_t status;
17925 	zoneid_t zoneid;
17926 
17927 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
17928 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES) {
17929 		if (!is_system_labeled())
17930 			return (ENOTSUP);
17931 		zoneid = GLOBAL_ZONEID;
17932 	}
17933 
17934 	/* cannot assign instance zero to a non-global zone */
17935 	if (ipif->ipif_id == 0 && zoneid != GLOBAL_ZONEID)
17936 		return (ENOTSUP);
17937 
17938 	/*
17939 	 * Cannot assign to a zone that doesn't exist or is shutting down.  In
17940 	 * the event of a race with the zone shutdown processing, since IP
17941 	 * serializes this ioctl and SIOCGLIFCONF/SIOCLIFREMOVEIF, we know the
17942 	 * interface will be cleaned up even if the zone is shut down
17943 	 * immediately after the status check. If the interface can't be brought
17944 	 * down right away, and the zone is shut down before the restart
17945 	 * function is called, we resolve the possible races by rechecking the
17946 	 * zone status in the restart function.
17947 	 */
17948 	if ((zptr = zone_find_by_id(zoneid)) == NULL)
17949 		return (EINVAL);
17950 	status = zone_status_get(zptr);
17951 	zone_rele(zptr);
17952 
17953 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING)
17954 		return (EINVAL);
17955 
17956 	if (ipif->ipif_flags & IPIF_UP) {
17957 		/*
17958 		 * If the interface is already marked up,
17959 		 * we call ipif_down which will take care
17960 		 * of ditching any IREs that have been set
17961 		 * up based on the old interface address.
17962 		 */
17963 		err = ipif_logical_down(ipif, q, mp);
17964 		if (err == EINPROGRESS)
17965 			return (err);
17966 		ipif_down_tail(ipif);
17967 		need_up = B_TRUE;
17968 	}
17969 
17970 	err = ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp, need_up);
17971 	return (err);
17972 }
17973 
17974 static int
17975 ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
17976     queue_t *q, mblk_t *mp, boolean_t need_up)
17977 {
17978 	int	err = 0;
17979 	ip_stack_t	*ipst;
17980 
17981 	ip1dbg(("ip_sioctl_zoneid_tail(%s:%u %p)\n",
17982 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
17983 
17984 	if (CONN_Q(q))
17985 		ipst = CONNQ_TO_IPST(q);
17986 	else
17987 		ipst = ILLQ_TO_IPST(q);
17988 
17989 	/*
17990 	 * For exclusive stacks we don't allow a different zoneid than
17991 	 * global.
17992 	 */
17993 	if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID &&
17994 	    zoneid != GLOBAL_ZONEID)
17995 		return (EINVAL);
17996 
17997 	/* Set the new zone id. */
17998 	ipif->ipif_zoneid = zoneid;
17999 
18000 	/* Update sctp list */
18001 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
18002 
18003 	if (need_up) {
18004 		/*
18005 		 * Now bring the interface back up.  If this
18006 		 * is the only IPIF for the ILL, ipif_up
18007 		 * will have to re-bind to the device, so
18008 		 * we may get back EINPROGRESS, in which
18009 		 * case, this IOCTL will get completed in
18010 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
18011 		 */
18012 		err = ipif_up(ipif, q, mp);
18013 	}
18014 	return (err);
18015 }
18016 
18017 /* ARGSUSED */
18018 int
18019 ip_sioctl_slifzone_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
18020     ip_ioctl_cmd_t *ipip, void *if_req)
18021 {
18022 	struct lifreq *lifr = (struct lifreq *)if_req;
18023 	zoneid_t zoneid;
18024 	zone_t *zptr;
18025 	zone_status_t status;
18026 
18027 	ASSERT(ipif->ipif_id != 0);
18028 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
18029 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES)
18030 		zoneid = GLOBAL_ZONEID;
18031 
18032 	ip1dbg(("ip_sioctl_slifzone_restart(%s:%u %p)\n",
18033 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
18034 
18035 	/*
18036 	 * We recheck the zone status to resolve the following race condition:
18037 	 * 1) process sends SIOCSLIFZONE to put hme0:1 in zone "myzone";
18038 	 * 2) hme0:1 is up and can't be brought down right away;
18039 	 * ip_sioctl_slifzone() returns EINPROGRESS and the request is queued;
18040 	 * 3) zone "myzone" is halted; the zone status switches to
18041 	 * 'shutting_down' and the zones framework sends SIOCGLIFCONF to list
18042 	 * the interfaces to remove - hme0:1 is not returned because it's not
18043 	 * yet in "myzone", so it won't be removed;
18044 	 * 4) the restart function for SIOCSLIFZONE is called; without the
18045 	 * status check here, we would have hme0:1 in "myzone" after it's been
18046 	 * destroyed.
18047 	 * Note that if the status check fails, we need to bring the interface
18048 	 * back to its state prior to ip_sioctl_slifzone(), hence the call to
18049 	 * ipif_up_done[_v6]().
18050 	 */
18051 	status = ZONE_IS_UNINITIALIZED;
18052 	if ((zptr = zone_find_by_id(zoneid)) != NULL) {
18053 		status = zone_status_get(zptr);
18054 		zone_rele(zptr);
18055 	}
18056 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING) {
18057 		if (ipif->ipif_isv6) {
18058 			(void) ipif_up_done_v6(ipif);
18059 		} else {
18060 			(void) ipif_up_done(ipif);
18061 		}
18062 		return (EINVAL);
18063 	}
18064 
18065 	ipif_down_tail(ipif);
18066 
18067 	return (ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp,
18068 	    B_TRUE));
18069 }
18070 
18071 /*
18072  * Return the number of addresses on `ill' with one or more of the values
18073  * in `set' set and all of the values in `clear' clear.
18074  */
18075 static uint_t
18076 ill_flagaddr_cnt(const ill_t *ill, uint64_t set, uint64_t clear)
18077 {
18078 	ipif_t	*ipif;
18079 	uint_t	cnt = 0;
18080 
18081 	ASSERT(IAM_WRITER_ILL(ill));
18082 
18083 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
18084 		if ((ipif->ipif_flags & set) && !(ipif->ipif_flags & clear))
18085 			cnt++;
18086 
18087 	return (cnt);
18088 }
18089 
18090 /*
18091  * Return the number of migratable addresses on `ill' that are under
18092  * application control.
18093  */
18094 uint_t
18095 ill_appaddr_cnt(const ill_t *ill)
18096 {
18097 	return (ill_flagaddr_cnt(ill, IPIF_DHCPRUNNING | IPIF_ADDRCONF,
18098 	    IPIF_NOFAILOVER));
18099 }
18100 
18101 /*
18102  * Return the number of point-to-point addresses on `ill'.
18103  */
18104 uint_t
18105 ill_ptpaddr_cnt(const ill_t *ill)
18106 {
18107 	return (ill_flagaddr_cnt(ill, IPIF_POINTOPOINT, 0));
18108 }
18109 
18110 /* ARGSUSED */
18111 int
18112 ip_sioctl_get_lifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
18113 	ip_ioctl_cmd_t *ipip, void *ifreq)
18114 {
18115 	struct lifreq	*lifr = ifreq;
18116 
18117 	ASSERT(q->q_next == NULL);
18118 	ASSERT(CONN_Q(q));
18119 
18120 	ip1dbg(("ip_sioctl_get_lifusesrc(%s:%u %p)\n",
18121 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
18122 	lifr->lifr_index = ipif->ipif_ill->ill_usesrc_ifindex;
18123 	ip1dbg(("ip_sioctl_get_lifusesrc:lifr_index = %d\n", lifr->lifr_index));
18124 
18125 	return (0);
18126 }
18127 
18128 /* Find the previous ILL in this usesrc group */
18129 static ill_t *
18130 ill_prev_usesrc(ill_t *uill)
18131 {
18132 	ill_t *ill;
18133 
18134 	for (ill = uill->ill_usesrc_grp_next;
18135 	    ASSERT(ill), ill->ill_usesrc_grp_next != uill;
18136 	    ill = ill->ill_usesrc_grp_next)
18137 		/* do nothing */;
18138 	return (ill);
18139 }
18140 
18141 /*
18142  * Release all members of the usesrc group. This routine is called
18143  * from ill_delete when the interface being unplumbed is the
18144  * group head.
18145  */
18146 static void
18147 ill_disband_usesrc_group(ill_t *uill)
18148 {
18149 	ill_t *next_ill, *tmp_ill;
18150 	ip_stack_t	*ipst = uill->ill_ipst;
18151 
18152 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_usesrc_lock));
18153 	next_ill = uill->ill_usesrc_grp_next;
18154 
18155 	do {
18156 		ASSERT(next_ill != NULL);
18157 		tmp_ill = next_ill->ill_usesrc_grp_next;
18158 		ASSERT(tmp_ill != NULL);
18159 		next_ill->ill_usesrc_grp_next = NULL;
18160 		next_ill->ill_usesrc_ifindex = 0;
18161 		next_ill = tmp_ill;
18162 	} while (next_ill->ill_usesrc_ifindex != 0);
18163 	uill->ill_usesrc_grp_next = NULL;
18164 }
18165 
18166 /*
18167  * Remove the client usesrc ILL from the list and relink to a new list
18168  */
18169 int
18170 ill_relink_usesrc_ills(ill_t *ucill, ill_t *uill, uint_t ifindex)
18171 {
18172 	ill_t *ill, *tmp_ill;
18173 	ip_stack_t	*ipst = ucill->ill_ipst;
18174 
18175 	ASSERT((ucill != NULL) && (ucill->ill_usesrc_grp_next != NULL) &&
18176 	    (uill != NULL) && RW_WRITE_HELD(&ipst->ips_ill_g_usesrc_lock));
18177 
18178 	/*
18179 	 * Check if the usesrc client ILL passed in is not already
18180 	 * in use as a usesrc ILL i.e one whose source address is
18181 	 * in use OR a usesrc ILL is not already in use as a usesrc
18182 	 * client ILL
18183 	 */
18184 	if ((ucill->ill_usesrc_ifindex == 0) ||
18185 	    (uill->ill_usesrc_ifindex != 0)) {
18186 		return (-1);
18187 	}
18188 
18189 	ill = ill_prev_usesrc(ucill);
18190 	ASSERT(ill->ill_usesrc_grp_next != NULL);
18191 
18192 	/* Remove from the current list */
18193 	if (ill->ill_usesrc_grp_next->ill_usesrc_grp_next == ill) {
18194 		/* Only two elements in the list */
18195 		ASSERT(ill->ill_usesrc_ifindex == 0);
18196 		ill->ill_usesrc_grp_next = NULL;
18197 	} else {
18198 		ill->ill_usesrc_grp_next = ucill->ill_usesrc_grp_next;
18199 	}
18200 
18201 	if (ifindex == 0) {
18202 		ucill->ill_usesrc_ifindex = 0;
18203 		ucill->ill_usesrc_grp_next = NULL;
18204 		return (0);
18205 	}
18206 
18207 	ucill->ill_usesrc_ifindex = ifindex;
18208 	tmp_ill = uill->ill_usesrc_grp_next;
18209 	uill->ill_usesrc_grp_next = ucill;
18210 	ucill->ill_usesrc_grp_next =
18211 	    (tmp_ill != NULL) ? tmp_ill : uill;
18212 	return (0);
18213 }
18214 
18215 /*
18216  * Set the ill_usesrc and ill_usesrc_head fields. See synchronization notes in
18217  * ip.c for locking details.
18218  */
18219 /* ARGSUSED */
18220 int
18221 ip_sioctl_slifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
18222     ip_ioctl_cmd_t *ipip, void *ifreq)
18223 {
18224 	struct lifreq *lifr = (struct lifreq *)ifreq;
18225 	boolean_t isv6 = B_FALSE, reset_flg = B_FALSE,
18226 	    ill_flag_changed = B_FALSE;
18227 	ill_t *usesrc_ill, *usesrc_cli_ill = ipif->ipif_ill;
18228 	int err = 0, ret;
18229 	uint_t ifindex;
18230 	ipsq_t *ipsq = NULL;
18231 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
18232 
18233 	ASSERT(IAM_WRITER_IPIF(ipif));
18234 	ASSERT(q->q_next == NULL);
18235 	ASSERT(CONN_Q(q));
18236 
18237 	isv6 = (Q_TO_CONN(q))->conn_af_isv6;
18238 
18239 	ifindex = lifr->lifr_index;
18240 	if (ifindex == 0) {
18241 		if (usesrc_cli_ill->ill_usesrc_grp_next == NULL) {
18242 			/* non usesrc group interface, nothing to reset */
18243 			return (0);
18244 		}
18245 		ifindex = usesrc_cli_ill->ill_usesrc_ifindex;
18246 		/* valid reset request */
18247 		reset_flg = B_TRUE;
18248 	}
18249 
18250 	usesrc_ill = ill_lookup_on_ifindex(ifindex, isv6, q, mp,
18251 	    ip_process_ioctl, &err, ipst);
18252 	if (usesrc_ill == NULL) {
18253 		return (err);
18254 	}
18255 
18256 	ipsq = ipsq_try_enter(NULL, usesrc_ill, q, mp, ip_process_ioctl,
18257 	    NEW_OP, B_TRUE);
18258 	if (ipsq == NULL) {
18259 		err = EINPROGRESS;
18260 		/* Operation enqueued on the ipsq of the usesrc ILL */
18261 		goto done;
18262 	}
18263 
18264 	/* USESRC isn't currently supported with IPMP */
18265 	if (IS_IPMP(usesrc_ill) || IS_UNDER_IPMP(usesrc_ill)) {
18266 		err = ENOTSUP;
18267 		goto done;
18268 	}
18269 
18270 	/*
18271 	 * USESRC isn't compatible with the STANDBY flag.  (STANDBY is only
18272 	 * used by IPMP underlying interfaces, but someone might think it's
18273 	 * more general and try to use it independently with VNI.)
18274 	 */
18275 	if (usesrc_ill->ill_phyint->phyint_flags & PHYI_STANDBY) {
18276 		err = ENOTSUP;
18277 		goto done;
18278 	}
18279 
18280 	/*
18281 	 * If the client is already in use as a usesrc_ill or a usesrc_ill is
18282 	 * already a client then return EINVAL
18283 	 */
18284 	if (IS_USESRC_ILL(usesrc_cli_ill) || IS_USESRC_CLI_ILL(usesrc_ill)) {
18285 		err = EINVAL;
18286 		goto done;
18287 	}
18288 
18289 	/*
18290 	 * If the ill_usesrc_ifindex field is already set to what it needs to
18291 	 * be then this is a duplicate operation.
18292 	 */
18293 	if (!reset_flg && usesrc_cli_ill->ill_usesrc_ifindex == ifindex) {
18294 		err = 0;
18295 		goto done;
18296 	}
18297 
18298 	ip1dbg(("ip_sioctl_slifusesrc: usesrc_cli_ill %s, usesrc_ill %s,"
18299 	    " v6 = %d", usesrc_cli_ill->ill_name, usesrc_ill->ill_name,
18300 	    usesrc_ill->ill_isv6));
18301 
18302 	/*
18303 	 * The next step ensures that no new ires will be created referencing
18304 	 * the client ill, until the ILL_CHANGING flag is cleared. Then
18305 	 * we go through an ire walk deleting all ire caches that reference
18306 	 * the client ill. New ires referencing the client ill that are added
18307 	 * to the ire table before the ILL_CHANGING flag is set, will be
18308 	 * cleaned up by the ire walk below. Attempt to add new ires referencing
18309 	 * the client ill while the ILL_CHANGING flag is set will be failed
18310 	 * during the ire_add in ire_atomic_start. ire_atomic_start atomically
18311 	 * checks (under the ill_g_usesrc_lock) that the ire being added
18312 	 * is not stale, i.e the ire_stq and ire_ipif are consistent and
18313 	 * belong to the same usesrc group.
18314 	 */
18315 	mutex_enter(&usesrc_cli_ill->ill_lock);
18316 	usesrc_cli_ill->ill_state_flags |= ILL_CHANGING;
18317 	mutex_exit(&usesrc_cli_ill->ill_lock);
18318 	ill_flag_changed = B_TRUE;
18319 
18320 	if (ipif->ipif_isv6)
18321 		ire_walk_v6(ipif_delete_cache_ire, (char *)usesrc_cli_ill,
18322 		    ALL_ZONES, ipst);
18323 	else
18324 		ire_walk_v4(ipif_delete_cache_ire, (char *)usesrc_cli_ill,
18325 		    ALL_ZONES, ipst);
18326 
18327 	/*
18328 	 * ill_g_usesrc_lock global lock protects the ill_usesrc_grp_next
18329 	 * and the ill_usesrc_ifindex fields
18330 	 */
18331 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
18332 
18333 	if (reset_flg) {
18334 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill, 0);
18335 		if (ret != 0) {
18336 			err = EINVAL;
18337 		}
18338 		rw_exit(&ipst->ips_ill_g_usesrc_lock);
18339 		goto done;
18340 	}
18341 
18342 	/*
18343 	 * Four possibilities to consider:
18344 	 * 1. Both usesrc_ill and usesrc_cli_ill are not part of any usesrc grp
18345 	 * 2. usesrc_ill is part of a group but usesrc_cli_ill isn't
18346 	 * 3. usesrc_cli_ill is part of a group but usesrc_ill isn't
18347 	 * 4. Both are part of their respective usesrc groups
18348 	 */
18349 	if ((usesrc_ill->ill_usesrc_grp_next == NULL) &&
18350 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
18351 		ASSERT(usesrc_ill->ill_usesrc_ifindex == 0);
18352 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
18353 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
18354 		usesrc_cli_ill->ill_usesrc_grp_next = usesrc_ill;
18355 	} else if ((usesrc_ill->ill_usesrc_grp_next != NULL) &&
18356 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
18357 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
18358 		/* Insert at head of list */
18359 		usesrc_cli_ill->ill_usesrc_grp_next =
18360 		    usesrc_ill->ill_usesrc_grp_next;
18361 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
18362 	} else {
18363 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill,
18364 		    ifindex);
18365 		if (ret != 0)
18366 			err = EINVAL;
18367 	}
18368 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
18369 
18370 done:
18371 	if (ill_flag_changed) {
18372 		mutex_enter(&usesrc_cli_ill->ill_lock);
18373 		usesrc_cli_ill->ill_state_flags &= ~ILL_CHANGING;
18374 		mutex_exit(&usesrc_cli_ill->ill_lock);
18375 	}
18376 	if (ipsq != NULL)
18377 		ipsq_exit(ipsq);
18378 	/* The refrele on the lifr_name ipif is done by ip_process_ioctl */
18379 	ill_refrele(usesrc_ill);
18380 	return (err);
18381 }
18382 
18383 /*
18384  * comparison function used by avl.
18385  */
18386 static int
18387 ill_phyint_compare_index(const void *index_ptr, const void *phyip)
18388 {
18389 
18390 	uint_t index;
18391 
18392 	ASSERT(phyip != NULL && index_ptr != NULL);
18393 
18394 	index = *((uint_t *)index_ptr);
18395 	/*
18396 	 * let the phyint with the lowest index be on top.
18397 	 */
18398 	if (((phyint_t *)phyip)->phyint_ifindex < index)
18399 		return (1);
18400 	if (((phyint_t *)phyip)->phyint_ifindex > index)
18401 		return (-1);
18402 	return (0);
18403 }
18404 
18405 /*
18406  * comparison function used by avl.
18407  */
18408 static int
18409 ill_phyint_compare_name(const void *name_ptr, const void *phyip)
18410 {
18411 	ill_t *ill;
18412 	int res = 0;
18413 
18414 	ASSERT(phyip != NULL && name_ptr != NULL);
18415 
18416 	if (((phyint_t *)phyip)->phyint_illv4)
18417 		ill = ((phyint_t *)phyip)->phyint_illv4;
18418 	else
18419 		ill = ((phyint_t *)phyip)->phyint_illv6;
18420 	ASSERT(ill != NULL);
18421 
18422 	res = strcmp(ill->ill_name, (char *)name_ptr);
18423 	if (res > 0)
18424 		return (1);
18425 	else if (res < 0)
18426 		return (-1);
18427 	return (0);
18428 }
18429 
18430 /*
18431  * This function is called on the unplumb path via ill_glist_delete() when
18432  * there are no ills left on the phyint and thus the phyint can be freed.
18433  */
18434 static void
18435 phyint_free(phyint_t *phyi)
18436 {
18437 	ip_stack_t *ipst = PHYINT_TO_IPST(phyi);
18438 
18439 	ASSERT(phyi->phyint_illv4 == NULL && phyi->phyint_illv6 == NULL);
18440 
18441 	/*
18442 	 * If this phyint was an IPMP meta-interface, blow away the group.
18443 	 * This is safe to do because all of the illgrps have already been
18444 	 * removed by I_PUNLINK, and thus SIOCSLIFGROUPNAME cannot find us.
18445 	 * If we're cleaning up as a result of failed initialization,
18446 	 * phyint_grp may be NULL.
18447 	 */
18448 	if ((phyi->phyint_flags & PHYI_IPMP) && (phyi->phyint_grp != NULL)) {
18449 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
18450 		ipmp_grp_destroy(phyi->phyint_grp);
18451 		phyi->phyint_grp = NULL;
18452 		rw_exit(&ipst->ips_ipmp_lock);
18453 	}
18454 
18455 	/*
18456 	 * If this interface was under IPMP, take it out of the group.
18457 	 */
18458 	if (phyi->phyint_grp != NULL)
18459 		ipmp_phyint_leave_grp(phyi);
18460 
18461 	/*
18462 	 * Delete the phyint and disassociate its ipsq.  The ipsq itself
18463 	 * will be freed in ipsq_exit().
18464 	 */
18465 	phyi->phyint_ipsq->ipsq_phyint = NULL;
18466 	phyi->phyint_name[0] = '\0';
18467 
18468 	mi_free(phyi);
18469 }
18470 
18471 /*
18472  * Attach the ill to the phyint structure which can be shared by both
18473  * IPv4 and IPv6 ill. ill_init allocates a phyint to just hold flags. This
18474  * function is called from ipif_set_values and ill_lookup_on_name (for
18475  * loopback) where we know the name of the ill. We lookup the ill and if
18476  * there is one present already with the name use that phyint. Otherwise
18477  * reuse the one allocated by ill_init.
18478  */
18479 static void
18480 ill_phyint_reinit(ill_t *ill)
18481 {
18482 	boolean_t isv6 = ill->ill_isv6;
18483 	phyint_t *phyi_old;
18484 	phyint_t *phyi;
18485 	avl_index_t where = 0;
18486 	ill_t	*ill_other = NULL;
18487 	ip_stack_t	*ipst = ill->ill_ipst;
18488 
18489 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
18490 
18491 	phyi_old = ill->ill_phyint;
18492 	ASSERT(isv6 || (phyi_old->phyint_illv4 == ill &&
18493 	    phyi_old->phyint_illv6 == NULL));
18494 	ASSERT(!isv6 || (phyi_old->phyint_illv6 == ill &&
18495 	    phyi_old->phyint_illv4 == NULL));
18496 	ASSERT(phyi_old->phyint_ifindex == 0);
18497 
18498 	/*
18499 	 * Now that our ill has a name, set it in the phyint.
18500 	 */
18501 	(void) strlcpy(ill->ill_phyint->phyint_name, ill->ill_name, LIFNAMSIZ);
18502 
18503 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
18504 	    ill->ill_name, &where);
18505 
18506 	/*
18507 	 * 1. We grabbed the ill_g_lock before inserting this ill into
18508 	 *    the global list of ills. So no other thread could have located
18509 	 *    this ill and hence the ipsq of this ill is guaranteed to be empty.
18510 	 * 2. Now locate the other protocol instance of this ill.
18511 	 * 3. Now grab both ill locks in the right order, and the phyint lock of
18512 	 *    the new ipsq. Holding ill locks + ill_g_lock ensures that the ipsq
18513 	 *    of neither ill can change.
18514 	 * 4. Merge the phyint and thus the ipsq as well of this ill onto the
18515 	 *    other ill.
18516 	 * 5. Release all locks.
18517 	 */
18518 
18519 	/*
18520 	 * Look for IPv4 if we are initializing IPv6 or look for IPv6 if
18521 	 * we are initializing IPv4.
18522 	 */
18523 	if (phyi != NULL) {
18524 		ill_other = (isv6) ? phyi->phyint_illv4 : phyi->phyint_illv6;
18525 		ASSERT(ill_other->ill_phyint != NULL);
18526 		ASSERT((isv6 && !ill_other->ill_isv6) ||
18527 		    (!isv6 && ill_other->ill_isv6));
18528 		GRAB_ILL_LOCKS(ill, ill_other);
18529 		/*
18530 		 * We are potentially throwing away phyint_flags which
18531 		 * could be different from the one that we obtain from
18532 		 * ill_other->ill_phyint. But it is okay as we are assuming
18533 		 * that the state maintained within IP is correct.
18534 		 */
18535 		mutex_enter(&phyi->phyint_lock);
18536 		if (isv6) {
18537 			ASSERT(phyi->phyint_illv6 == NULL);
18538 			phyi->phyint_illv6 = ill;
18539 		} else {
18540 			ASSERT(phyi->phyint_illv4 == NULL);
18541 			phyi->phyint_illv4 = ill;
18542 		}
18543 
18544 		/*
18545 		 * Delete the old phyint and make its ipsq eligible
18546 		 * to be freed in ipsq_exit().
18547 		 */
18548 		phyi_old->phyint_illv4 = NULL;
18549 		phyi_old->phyint_illv6 = NULL;
18550 		phyi_old->phyint_ipsq->ipsq_phyint = NULL;
18551 		phyi_old->phyint_name[0] = '\0';
18552 		mi_free(phyi_old);
18553 	} else {
18554 		mutex_enter(&ill->ill_lock);
18555 		/*
18556 		 * We don't need to acquire any lock, since
18557 		 * the ill is not yet visible globally  and we
18558 		 * have not yet released the ill_g_lock.
18559 		 */
18560 		phyi = phyi_old;
18561 		mutex_enter(&phyi->phyint_lock);
18562 		/* XXX We need a recovery strategy here. */
18563 		if (!phyint_assign_ifindex(phyi, ipst))
18564 			cmn_err(CE_PANIC, "phyint_assign_ifindex() failed");
18565 
18566 		avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
18567 		    (void *)phyi, where);
18568 
18569 		(void) avl_find(&ipst->ips_phyint_g_list->
18570 		    phyint_list_avl_by_index,
18571 		    &phyi->phyint_ifindex, &where);
18572 		avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
18573 		    (void *)phyi, where);
18574 	}
18575 
18576 	/*
18577 	 * Reassigning ill_phyint automatically reassigns the ipsq also.
18578 	 * pending mp is not affected because that is per ill basis.
18579 	 */
18580 	ill->ill_phyint = phyi;
18581 
18582 	/*
18583 	 * Now that the phyint's ifindex has been assigned, complete the
18584 	 * remaining
18585 	 */
18586 
18587 	ill->ill_ip_mib->ipIfStatsIfIndex = ill->ill_phyint->phyint_ifindex;
18588 	if (ill->ill_isv6) {
18589 		ill->ill_icmp6_mib->ipv6IfIcmpIfIndex =
18590 		    ill->ill_phyint->phyint_ifindex;
18591 		ill->ill_mcast_type = ipst->ips_mld_max_version;
18592 	} else {
18593 		ill->ill_mcast_type = ipst->ips_igmp_max_version;
18594 	}
18595 
18596 	/*
18597 	 * Generate an event within the hooks framework to indicate that
18598 	 * a new interface has just been added to IP.  For this event to
18599 	 * be generated, the network interface must, at least, have an
18600 	 * ifindex assigned to it.
18601 	 *
18602 	 * This needs to be run inside the ill_g_lock perimeter to ensure
18603 	 * that the ordering of delivered events to listeners matches the
18604 	 * order of them in the kernel.
18605 	 *
18606 	 * This function could be called from ill_lookup_on_name. In that case
18607 	 * the interface is loopback "lo", which will not generate a NIC event.
18608 	 */
18609 	if (ill->ill_name_length <= 2 ||
18610 	    ill->ill_name[0] != 'l' || ill->ill_name[1] != 'o') {
18611 		ill_nic_event_dispatch(ill, 0, NE_PLUMB, ill->ill_name,
18612 		    ill->ill_name_length);
18613 	}
18614 	RELEASE_ILL_LOCKS(ill, ill_other);
18615 	mutex_exit(&phyi->phyint_lock);
18616 }
18617 
18618 /*
18619  * Notify any downstream modules of the name of this interface.
18620  * An M_IOCTL is used even though we don't expect a successful reply.
18621  * Any reply message from the driver (presumably an M_IOCNAK) will
18622  * eventually get discarded somewhere upstream.  The message format is
18623  * simply an SIOCSLIFNAME ioctl just as might be sent from ifconfig
18624  * to IP.
18625  */
18626 static void
18627 ip_ifname_notify(ill_t *ill, queue_t *q)
18628 {
18629 	mblk_t *mp1, *mp2;
18630 	struct iocblk *iocp;
18631 	struct lifreq *lifr;
18632 
18633 	mp1 = mkiocb(SIOCSLIFNAME);
18634 	if (mp1 == NULL)
18635 		return;
18636 	mp2 = allocb(sizeof (struct lifreq), BPRI_HI);
18637 	if (mp2 == NULL) {
18638 		freeb(mp1);
18639 		return;
18640 	}
18641 
18642 	mp1->b_cont = mp2;
18643 	iocp = (struct iocblk *)mp1->b_rptr;
18644 	iocp->ioc_count = sizeof (struct lifreq);
18645 
18646 	lifr = (struct lifreq *)mp2->b_rptr;
18647 	mp2->b_wptr += sizeof (struct lifreq);
18648 	bzero(lifr, sizeof (struct lifreq));
18649 
18650 	(void) strncpy(lifr->lifr_name, ill->ill_name, LIFNAMSIZ);
18651 	lifr->lifr_ppa = ill->ill_ppa;
18652 	lifr->lifr_flags = (ill->ill_flags & (ILLF_IPV4|ILLF_IPV6));
18653 
18654 	putnext(q, mp1);
18655 }
18656 
18657 static int
18658 ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
18659 {
18660 	int		err;
18661 	ip_stack_t	*ipst = ill->ill_ipst;
18662 	phyint_t	*phyi = ill->ill_phyint;
18663 
18664 	/* Set the obsolete NDD per-interface forwarding name. */
18665 	err = ill_set_ndd_name(ill);
18666 	if (err != 0) {
18667 		cmn_err(CE_WARN, "ipif_set_values: ill_set_ndd_name (%d)\n",
18668 		    err);
18669 	}
18670 
18671 	/*
18672 	 * Now that ill_name is set, the configuration for the IPMP
18673 	 * meta-interface can be performed.
18674 	 */
18675 	if (IS_IPMP(ill)) {
18676 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
18677 		/*
18678 		 * If phyi->phyint_grp is NULL, then this is the first IPMP
18679 		 * meta-interface and we need to create the IPMP group.
18680 		 */
18681 		if (phyi->phyint_grp == NULL) {
18682 			/*
18683 			 * If someone has renamed another IPMP group to have
18684 			 * the same name as our interface, bail.
18685 			 */
18686 			if (ipmp_grp_lookup(ill->ill_name, ipst) != NULL) {
18687 				rw_exit(&ipst->ips_ipmp_lock);
18688 				return (EEXIST);
18689 			}
18690 			phyi->phyint_grp = ipmp_grp_create(ill->ill_name, phyi);
18691 			if (phyi->phyint_grp == NULL) {
18692 				rw_exit(&ipst->ips_ipmp_lock);
18693 				return (ENOMEM);
18694 			}
18695 		}
18696 		rw_exit(&ipst->ips_ipmp_lock);
18697 	}
18698 
18699 	/* Tell downstream modules where they are. */
18700 	ip_ifname_notify(ill, q);
18701 
18702 	/*
18703 	 * ill_dl_phys returns EINPROGRESS in the usual case.
18704 	 * Error cases are ENOMEM ...
18705 	 */
18706 	err = ill_dl_phys(ill, ipif, mp, q);
18707 
18708 	/*
18709 	 * If there is no IRE expiration timer running, get one started.
18710 	 * igmp and mld timers will be triggered by the first multicast
18711 	 */
18712 	if (ipst->ips_ip_ire_expire_id == 0) {
18713 		/*
18714 		 * acquire the lock and check again.
18715 		 */
18716 		mutex_enter(&ipst->ips_ip_trash_timer_lock);
18717 		if (ipst->ips_ip_ire_expire_id == 0) {
18718 			ipst->ips_ip_ire_expire_id = timeout(
18719 			    ip_trash_timer_expire, ipst,
18720 			    MSEC_TO_TICK(ipst->ips_ip_timer_interval));
18721 		}
18722 		mutex_exit(&ipst->ips_ip_trash_timer_lock);
18723 	}
18724 
18725 	if (ill->ill_isv6) {
18726 		mutex_enter(&ipst->ips_mld_slowtimeout_lock);
18727 		if (ipst->ips_mld_slowtimeout_id == 0) {
18728 			ipst->ips_mld_slowtimeout_id = timeout(mld_slowtimo,
18729 			    (void *)ipst,
18730 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
18731 		}
18732 		mutex_exit(&ipst->ips_mld_slowtimeout_lock);
18733 	} else {
18734 		mutex_enter(&ipst->ips_igmp_slowtimeout_lock);
18735 		if (ipst->ips_igmp_slowtimeout_id == 0) {
18736 			ipst->ips_igmp_slowtimeout_id = timeout(igmp_slowtimo,
18737 			    (void *)ipst,
18738 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
18739 		}
18740 		mutex_exit(&ipst->ips_igmp_slowtimeout_lock);
18741 	}
18742 
18743 	return (err);
18744 }
18745 
18746 /*
18747  * Common routine for ppa and ifname setting. Should be called exclusive.
18748  *
18749  * Returns EINPROGRESS when mp has been consumed by queueing it on
18750  * ill_pending_mp and the ioctl will complete in ip_rput.
18751  *
18752  * NOTE : If ppa is UNIT_MAX, we assign the next valid ppa and return
18753  * the new name and new ppa in lifr_name and lifr_ppa respectively.
18754  * For SLIFNAME, we pass these values back to the userland.
18755  */
18756 static int
18757 ipif_set_values(queue_t *q, mblk_t *mp, char *interf_name, uint_t *new_ppa_ptr)
18758 {
18759 	ill_t	*ill;
18760 	ipif_t	*ipif;
18761 	ipsq_t	*ipsq;
18762 	char	*ppa_ptr;
18763 	char	*old_ptr;
18764 	char	old_char;
18765 	int	error;
18766 	ip_stack_t	*ipst;
18767 
18768 	ip1dbg(("ipif_set_values: interface %s\n", interf_name));
18769 	ASSERT(q->q_next != NULL);
18770 	ASSERT(interf_name != NULL);
18771 
18772 	ill = (ill_t *)q->q_ptr;
18773 	ipst = ill->ill_ipst;
18774 
18775 	ASSERT(ill->ill_ipst != NULL);
18776 	ASSERT(ill->ill_name[0] == '\0');
18777 	ASSERT(IAM_WRITER_ILL(ill));
18778 	ASSERT((mi_strlen(interf_name) + 1) <= LIFNAMSIZ);
18779 	ASSERT(ill->ill_ppa == UINT_MAX);
18780 
18781 	/* The ppa is sent down by ifconfig or is chosen */
18782 	if ((ppa_ptr = ill_get_ppa_ptr(interf_name)) == NULL) {
18783 		return (EINVAL);
18784 	}
18785 
18786 	/*
18787 	 * make sure ppa passed in is same as ppa in the name.
18788 	 * This check is not made when ppa == UINT_MAX in that case ppa
18789 	 * in the name could be anything. System will choose a ppa and
18790 	 * update new_ppa_ptr and inter_name to contain the choosen ppa.
18791 	 */
18792 	if (*new_ppa_ptr != UINT_MAX) {
18793 		/* stoi changes the pointer */
18794 		old_ptr = ppa_ptr;
18795 		/*
18796 		 * ifconfig passed in 0 for the ppa for DLPI 1 style devices
18797 		 * (they don't have an externally visible ppa).  We assign one
18798 		 * here so that we can manage the interface.  Note that in
18799 		 * the past this value was always 0 for DLPI 1 drivers.
18800 		 */
18801 		if (*new_ppa_ptr == 0)
18802 			*new_ppa_ptr = stoi(&old_ptr);
18803 		else if (*new_ppa_ptr != (uint_t)stoi(&old_ptr))
18804 			return (EINVAL);
18805 	}
18806 	/*
18807 	 * terminate string before ppa
18808 	 * save char at that location.
18809 	 */
18810 	old_char = ppa_ptr[0];
18811 	ppa_ptr[0] = '\0';
18812 
18813 	ill->ill_ppa = *new_ppa_ptr;
18814 	/*
18815 	 * Finish as much work now as possible before calling ill_glist_insert
18816 	 * which makes the ill globally visible and also merges it with the
18817 	 * other protocol instance of this phyint. The remaining work is
18818 	 * done after entering the ipsq which may happen sometime later.
18819 	 * ill_set_ndd_name occurs after the ill has been made globally visible.
18820 	 */
18821 	ipif = ill->ill_ipif;
18822 
18823 	/* We didn't do this when we allocated ipif in ip_ll_subnet_defaults */
18824 	ipif_assign_seqid(ipif);
18825 
18826 	if (!(ill->ill_flags & (ILLF_IPV4|ILLF_IPV6)))
18827 		ill->ill_flags |= ILLF_IPV4;
18828 
18829 	ASSERT(ipif->ipif_next == NULL);	/* Only one ipif on ill */
18830 	ASSERT((ipif->ipif_flags & IPIF_UP) == 0);
18831 
18832 	if (ill->ill_flags & ILLF_IPV6) {
18833 
18834 		ill->ill_isv6 = B_TRUE;
18835 		if (ill->ill_rq != NULL) {
18836 			ill->ill_rq->q_qinfo = &iprinitv6;
18837 			ill->ill_wq->q_qinfo = &ipwinitv6;
18838 		}
18839 
18840 		/* Keep the !IN6_IS_ADDR_V4MAPPED assertions happy */
18841 		ipif->ipif_v6lcl_addr = ipv6_all_zeros;
18842 		ipif->ipif_v6src_addr = ipv6_all_zeros;
18843 		ipif->ipif_v6subnet = ipv6_all_zeros;
18844 		ipif->ipif_v6net_mask = ipv6_all_zeros;
18845 		ipif->ipif_v6brd_addr = ipv6_all_zeros;
18846 		ipif->ipif_v6pp_dst_addr = ipv6_all_zeros;
18847 		/*
18848 		 * point-to-point or Non-mulicast capable
18849 		 * interfaces won't do NUD unless explicitly
18850 		 * configured to do so.
18851 		 */
18852 		if (ipif->ipif_flags & IPIF_POINTOPOINT ||
18853 		    !(ill->ill_flags & ILLF_MULTICAST)) {
18854 			ill->ill_flags |= ILLF_NONUD;
18855 		}
18856 		/* Make sure IPv4 specific flag is not set on IPv6 if */
18857 		if (ill->ill_flags & ILLF_NOARP) {
18858 			/*
18859 			 * Note: xresolv interfaces will eventually need
18860 			 * NOARP set here as well, but that will require
18861 			 * those external resolvers to have some
18862 			 * knowledge of that flag and act appropriately.
18863 			 * Not to be changed at present.
18864 			 */
18865 			ill->ill_flags &= ~ILLF_NOARP;
18866 		}
18867 		/*
18868 		 * Set the ILLF_ROUTER flag according to the global
18869 		 * IPv6 forwarding policy.
18870 		 */
18871 		if (ipst->ips_ipv6_forward != 0)
18872 			ill->ill_flags |= ILLF_ROUTER;
18873 	} else if (ill->ill_flags & ILLF_IPV4) {
18874 		ill->ill_isv6 = B_FALSE;
18875 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6lcl_addr);
18876 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6src_addr);
18877 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6subnet);
18878 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6net_mask);
18879 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6brd_addr);
18880 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6pp_dst_addr);
18881 		/*
18882 		 * Set the ILLF_ROUTER flag according to the global
18883 		 * IPv4 forwarding policy.
18884 		 */
18885 		if (ipst->ips_ip_g_forward != 0)
18886 			ill->ill_flags |= ILLF_ROUTER;
18887 	}
18888 
18889 	ASSERT(ill->ill_phyint != NULL);
18890 
18891 	/*
18892 	 * The ipIfStatsIfindex and ipv6IfIcmpIfIndex assignments will
18893 	 * be completed in ill_glist_insert -> ill_phyint_reinit
18894 	 */
18895 	if (!ill_allocate_mibs(ill))
18896 		return (ENOMEM);
18897 
18898 	/*
18899 	 * Pick a default sap until we get the DL_INFO_ACK back from
18900 	 * the driver.
18901 	 */
18902 	if (ill->ill_sap == 0) {
18903 		if (ill->ill_isv6)
18904 			ill->ill_sap = IP6_DL_SAP;
18905 		else
18906 			ill->ill_sap = IP_DL_SAP;
18907 	}
18908 
18909 	ill->ill_ifname_pending = 1;
18910 	ill->ill_ifname_pending_err = 0;
18911 
18912 	/*
18913 	 * When the first ipif comes up in ipif_up_done(), multicast groups
18914 	 * that were joined while this ill was not bound to the DLPI link need
18915 	 * to be recovered by ill_recover_multicast().
18916 	 */
18917 	ill->ill_need_recover_multicast = 1;
18918 
18919 	ill_refhold(ill);
18920 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
18921 	if ((error = ill_glist_insert(ill, interf_name,
18922 	    (ill->ill_flags & ILLF_IPV6) == ILLF_IPV6)) > 0) {
18923 		ill->ill_ppa = UINT_MAX;
18924 		ill->ill_name[0] = '\0';
18925 		/*
18926 		 * undo null termination done above.
18927 		 */
18928 		ppa_ptr[0] = old_char;
18929 		rw_exit(&ipst->ips_ill_g_lock);
18930 		ill_refrele(ill);
18931 		return (error);
18932 	}
18933 
18934 	ASSERT(ill->ill_name_length <= LIFNAMSIZ);
18935 
18936 	/*
18937 	 * When we return the buffer pointed to by interf_name should contain
18938 	 * the same name as in ill_name.
18939 	 * If a ppa was choosen by the system (ppa passed in was UINT_MAX)
18940 	 * the buffer pointed to by new_ppa_ptr would not contain the right ppa
18941 	 * so copy full name and update the ppa ptr.
18942 	 * When ppa passed in != UINT_MAX all values are correct just undo
18943 	 * null termination, this saves a bcopy.
18944 	 */
18945 	if (*new_ppa_ptr == UINT_MAX) {
18946 		bcopy(ill->ill_name, interf_name, ill->ill_name_length);
18947 		*new_ppa_ptr = ill->ill_ppa;
18948 	} else {
18949 		/*
18950 		 * undo null termination done above.
18951 		 */
18952 		ppa_ptr[0] = old_char;
18953 	}
18954 
18955 	/* Let SCTP know about this ILL */
18956 	sctp_update_ill(ill, SCTP_ILL_INSERT);
18957 
18958 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_reprocess_ioctl, NEW_OP,
18959 	    B_TRUE);
18960 
18961 	rw_exit(&ipst->ips_ill_g_lock);
18962 	ill_refrele(ill);
18963 	if (ipsq == NULL)
18964 		return (EINPROGRESS);
18965 
18966 	/*
18967 	 * If ill_phyint_reinit() changed our ipsq, then start on the new ipsq.
18968 	 */
18969 	if (ipsq->ipsq_xop->ipx_current_ipif == NULL)
18970 		ipsq_current_start(ipsq, ipif, SIOCSLIFNAME);
18971 	else
18972 		ASSERT(ipsq->ipsq_xop->ipx_current_ipif == ipif);
18973 
18974 	error = ipif_set_values_tail(ill, ipif, mp, q);
18975 	ipsq_exit(ipsq);
18976 	if (error != 0 && error != EINPROGRESS) {
18977 		/*
18978 		 * restore previous values
18979 		 */
18980 		ill->ill_isv6 = B_FALSE;
18981 	}
18982 	return (error);
18983 }
18984 
18985 void
18986 ipif_init(ip_stack_t *ipst)
18987 {
18988 	int i;
18989 
18990 	for (i = 0; i < MAX_G_HEADS; i++) {
18991 		ipst->ips_ill_g_heads[i].ill_g_list_head =
18992 		    (ill_if_t *)&ipst->ips_ill_g_heads[i];
18993 		ipst->ips_ill_g_heads[i].ill_g_list_tail =
18994 		    (ill_if_t *)&ipst->ips_ill_g_heads[i];
18995 	}
18996 
18997 	avl_create(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
18998 	    ill_phyint_compare_index,
18999 	    sizeof (phyint_t),
19000 	    offsetof(struct phyint, phyint_avl_by_index));
19001 	avl_create(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
19002 	    ill_phyint_compare_name,
19003 	    sizeof (phyint_t),
19004 	    offsetof(struct phyint, phyint_avl_by_name));
19005 }
19006 
19007 /*
19008  * Lookup the ipif corresponding to the onlink destination address. For
19009  * point-to-point interfaces, it matches with remote endpoint destination
19010  * address. For point-to-multipoint interfaces it only tries to match the
19011  * destination with the interface's subnet address. The longest, most specific
19012  * match is found to take care of such rare network configurations like -
19013  * le0: 129.146.1.1/16
19014  * le1: 129.146.2.2/24
19015  *
19016  * This is used by SO_DONTROUTE and IP_NEXTHOP.  Since neither of those are
19017  * supported on underlying interfaces in an IPMP group, underlying interfaces
19018  * are ignored when looking up a match.  (If we didn't ignore them, we'd
19019  * risk using a test address as a source for outgoing traffic.)
19020  */
19021 ipif_t *
19022 ipif_lookup_onlink_addr(ipaddr_t addr, zoneid_t zoneid, ip_stack_t *ipst)
19023 {
19024 	ipif_t	*ipif, *best_ipif;
19025 	ill_t	*ill;
19026 	ill_walk_context_t ctx;
19027 
19028 	ASSERT(zoneid != ALL_ZONES);
19029 	best_ipif = NULL;
19030 
19031 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
19032 	ill = ILL_START_WALK_V4(&ctx, ipst);
19033 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
19034 		if (IS_UNDER_IPMP(ill))
19035 			continue;
19036 		mutex_enter(&ill->ill_lock);
19037 		for (ipif = ill->ill_ipif; ipif != NULL;
19038 		    ipif = ipif->ipif_next) {
19039 			if (!IPIF_CAN_LOOKUP(ipif))
19040 				continue;
19041 			if (ipif->ipif_zoneid != zoneid &&
19042 			    ipif->ipif_zoneid != ALL_ZONES)
19043 				continue;
19044 			/*
19045 			 * Point-to-point case. Look for exact match with
19046 			 * destination address.
19047 			 */
19048 			if (ipif->ipif_flags & IPIF_POINTOPOINT) {
19049 				if (ipif->ipif_pp_dst_addr == addr) {
19050 					ipif_refhold_locked(ipif);
19051 					mutex_exit(&ill->ill_lock);
19052 					rw_exit(&ipst->ips_ill_g_lock);
19053 					if (best_ipif != NULL)
19054 						ipif_refrele(best_ipif);
19055 					return (ipif);
19056 				}
19057 			} else if (ipif->ipif_subnet == (addr &
19058 			    ipif->ipif_net_mask)) {
19059 				/*
19060 				 * Point-to-multipoint case. Looping through to
19061 				 * find the most specific match. If there are
19062 				 * multiple best match ipif's then prefer ipif's
19063 				 * that are UP. If there is only one best match
19064 				 * ipif and it is DOWN we must still return it.
19065 				 */
19066 				if ((best_ipif == NULL) ||
19067 				    (ipif->ipif_net_mask >
19068 				    best_ipif->ipif_net_mask) ||
19069 				    ((ipif->ipif_net_mask ==
19070 				    best_ipif->ipif_net_mask) &&
19071 				    ((ipif->ipif_flags & IPIF_UP) &&
19072 				    (!(best_ipif->ipif_flags & IPIF_UP))))) {
19073 					ipif_refhold_locked(ipif);
19074 					mutex_exit(&ill->ill_lock);
19075 					rw_exit(&ipst->ips_ill_g_lock);
19076 					if (best_ipif != NULL)
19077 						ipif_refrele(best_ipif);
19078 					best_ipif = ipif;
19079 					rw_enter(&ipst->ips_ill_g_lock,
19080 					    RW_READER);
19081 					mutex_enter(&ill->ill_lock);
19082 				}
19083 			}
19084 		}
19085 		mutex_exit(&ill->ill_lock);
19086 	}
19087 	rw_exit(&ipst->ips_ill_g_lock);
19088 	return (best_ipif);
19089 }
19090 
19091 /*
19092  * Save enough information so that we can recreate the IRE if
19093  * the interface goes down and then up.
19094  */
19095 static void
19096 ipif_save_ire(ipif_t *ipif, ire_t *ire)
19097 {
19098 	mblk_t	*save_mp;
19099 
19100 	save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
19101 	if (save_mp != NULL) {
19102 		ifrt_t	*ifrt;
19103 
19104 		save_mp->b_wptr += sizeof (ifrt_t);
19105 		ifrt = (ifrt_t *)save_mp->b_rptr;
19106 		bzero(ifrt, sizeof (ifrt_t));
19107 		ifrt->ifrt_type = ire->ire_type;
19108 		ifrt->ifrt_addr = ire->ire_addr;
19109 		ifrt->ifrt_gateway_addr = ire->ire_gateway_addr;
19110 		ifrt->ifrt_src_addr = ire->ire_src_addr;
19111 		ifrt->ifrt_mask = ire->ire_mask;
19112 		ifrt->ifrt_flags = ire->ire_flags;
19113 		ifrt->ifrt_max_frag = ire->ire_max_frag;
19114 		mutex_enter(&ipif->ipif_saved_ire_lock);
19115 		save_mp->b_cont = ipif->ipif_saved_ire_mp;
19116 		ipif->ipif_saved_ire_mp = save_mp;
19117 		ipif->ipif_saved_ire_cnt++;
19118 		mutex_exit(&ipif->ipif_saved_ire_lock);
19119 	}
19120 }
19121 
19122 static void
19123 ipif_remove_ire(ipif_t *ipif, ire_t *ire)
19124 {
19125 	mblk_t	**mpp;
19126 	mblk_t	*mp;
19127 	ifrt_t	*ifrt;
19128 
19129 	/* Remove from ipif_saved_ire_mp list if it is there */
19130 	mutex_enter(&ipif->ipif_saved_ire_lock);
19131 	for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL;
19132 	    mpp = &(*mpp)->b_cont) {
19133 		/*
19134 		 * On a given ipif, the triple of address, gateway and
19135 		 * mask is unique for each saved IRE (in the case of
19136 		 * ordinary interface routes, the gateway address is
19137 		 * all-zeroes).
19138 		 */
19139 		mp = *mpp;
19140 		ifrt = (ifrt_t *)mp->b_rptr;
19141 		if (ifrt->ifrt_addr == ire->ire_addr &&
19142 		    ifrt->ifrt_gateway_addr == ire->ire_gateway_addr &&
19143 		    ifrt->ifrt_mask == ire->ire_mask) {
19144 			*mpp = mp->b_cont;
19145 			ipif->ipif_saved_ire_cnt--;
19146 			freeb(mp);
19147 			break;
19148 		}
19149 	}
19150 	mutex_exit(&ipif->ipif_saved_ire_lock);
19151 }
19152 
19153 /*
19154  * IP multirouting broadcast routes handling
19155  * Append CGTP broadcast IREs to regular ones created
19156  * at ifconfig time.
19157  */
19158 static void
19159 ip_cgtp_bcast_add(ire_t *ire, ire_t *ire_dst, ip_stack_t *ipst)
19160 {
19161 	ire_t *ire_prim;
19162 
19163 	ASSERT(ire != NULL);
19164 	ASSERT(ire_dst != NULL);
19165 
19166 	ire_prim = ire_ctable_lookup(ire->ire_gateway_addr, 0,
19167 	    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
19168 	if (ire_prim != NULL) {
19169 		/*
19170 		 * We are in the special case of broadcasts for
19171 		 * CGTP. We add an IRE_BROADCAST that holds
19172 		 * the RTF_MULTIRT flag, the destination
19173 		 * address of ire_dst and the low level
19174 		 * info of ire_prim. In other words, CGTP
19175 		 * broadcast is added to the redundant ipif.
19176 		 */
19177 		ipif_t *ipif_prim;
19178 		ire_t  *bcast_ire;
19179 
19180 		ipif_prim = ire_prim->ire_ipif;
19181 
19182 		ip2dbg(("ip_cgtp_filter_bcast_add: "
19183 		    "ire_dst %p, ire_prim %p, ipif_prim %p\n",
19184 		    (void *)ire_dst, (void *)ire_prim,
19185 		    (void *)ipif_prim));
19186 
19187 		bcast_ire = ire_create(
19188 		    (uchar_t *)&ire->ire_addr,
19189 		    (uchar_t *)&ip_g_all_ones,
19190 		    (uchar_t *)&ire_dst->ire_src_addr,
19191 		    (uchar_t *)&ire->ire_gateway_addr,
19192 		    &ipif_prim->ipif_mtu,
19193 		    NULL,
19194 		    ipif_prim->ipif_rq,
19195 		    ipif_prim->ipif_wq,
19196 		    IRE_BROADCAST,
19197 		    ipif_prim,
19198 		    0,
19199 		    0,
19200 		    0,
19201 		    ire->ire_flags,
19202 		    &ire_uinfo_null,
19203 		    NULL,
19204 		    NULL,
19205 		    ipst);
19206 
19207 		if (bcast_ire != NULL) {
19208 
19209 			if (ire_add(&bcast_ire, NULL, NULL, NULL,
19210 			    B_FALSE) == 0) {
19211 				ip2dbg(("ip_cgtp_filter_bcast_add: "
19212 				    "added bcast_ire %p\n",
19213 				    (void *)bcast_ire));
19214 
19215 				ipif_save_ire(bcast_ire->ire_ipif,
19216 				    bcast_ire);
19217 				ire_refrele(bcast_ire);
19218 			}
19219 		}
19220 		ire_refrele(ire_prim);
19221 	}
19222 }
19223 
19224 /*
19225  * IP multirouting broadcast routes handling
19226  * Remove the broadcast ire
19227  */
19228 static void
19229 ip_cgtp_bcast_delete(ire_t *ire, ip_stack_t *ipst)
19230 {
19231 	ire_t *ire_dst;
19232 
19233 	ASSERT(ire != NULL);
19234 	ire_dst = ire_ctable_lookup(ire->ire_addr, 0, IRE_BROADCAST,
19235 	    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
19236 	if (ire_dst != NULL) {
19237 		ire_t *ire_prim;
19238 
19239 		ire_prim = ire_ctable_lookup(ire->ire_gateway_addr, 0,
19240 		    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
19241 		if (ire_prim != NULL) {
19242 			ipif_t *ipif_prim;
19243 			ire_t  *bcast_ire;
19244 
19245 			ipif_prim = ire_prim->ire_ipif;
19246 
19247 			ip2dbg(("ip_cgtp_filter_bcast_delete: "
19248 			    "ire_dst %p, ire_prim %p, ipif_prim %p\n",
19249 			    (void *)ire_dst, (void *)ire_prim,
19250 			    (void *)ipif_prim));
19251 
19252 			bcast_ire = ire_ctable_lookup(ire->ire_addr,
19253 			    ire->ire_gateway_addr,
19254 			    IRE_BROADCAST,
19255 			    ipif_prim, ALL_ZONES,
19256 			    NULL,
19257 			    MATCH_IRE_TYPE | MATCH_IRE_GW | MATCH_IRE_IPIF |
19258 			    MATCH_IRE_MASK, ipst);
19259 
19260 			if (bcast_ire != NULL) {
19261 				ip2dbg(("ip_cgtp_filter_bcast_delete: "
19262 				    "looked up bcast_ire %p\n",
19263 				    (void *)bcast_ire));
19264 				ipif_remove_ire(bcast_ire->ire_ipif,
19265 				    bcast_ire);
19266 				ire_delete(bcast_ire);
19267 				ire_refrele(bcast_ire);
19268 			}
19269 			ire_refrele(ire_prim);
19270 		}
19271 		ire_refrele(ire_dst);
19272 	}
19273 }
19274 
19275 /*
19276  * IPsec hardware acceleration capabilities related functions.
19277  */
19278 
19279 /*
19280  * Free a per-ill IPsec capabilities structure.
19281  */
19282 static void
19283 ill_ipsec_capab_free(ill_ipsec_capab_t *capab)
19284 {
19285 	if (capab->auth_hw_algs != NULL)
19286 		kmem_free(capab->auth_hw_algs, capab->algs_size);
19287 	if (capab->encr_hw_algs != NULL)
19288 		kmem_free(capab->encr_hw_algs, capab->algs_size);
19289 	if (capab->encr_algparm != NULL)
19290 		kmem_free(capab->encr_algparm, capab->encr_algparm_size);
19291 	kmem_free(capab, sizeof (ill_ipsec_capab_t));
19292 }
19293 
19294 /*
19295  * Allocate a new per-ill IPsec capabilities structure. This structure
19296  * is specific to an IPsec protocol (AH or ESP). It is implemented as
19297  * an array which specifies, for each algorithm, whether this algorithm
19298  * is supported by the ill or not.
19299  */
19300 static ill_ipsec_capab_t *
19301 ill_ipsec_capab_alloc(void)
19302 {
19303 	ill_ipsec_capab_t *capab;
19304 	uint_t nelems;
19305 
19306 	capab = kmem_zalloc(sizeof (ill_ipsec_capab_t), KM_NOSLEEP);
19307 	if (capab == NULL)
19308 		return (NULL);
19309 
19310 	/* we need one bit per algorithm */
19311 	nelems = MAX_IPSEC_ALGS / BITS(ipsec_capab_elem_t);
19312 	capab->algs_size = nelems * sizeof (ipsec_capab_elem_t);
19313 
19314 	/* allocate memory to store algorithm flags */
19315 	capab->encr_hw_algs = kmem_zalloc(capab->algs_size, KM_NOSLEEP);
19316 	if (capab->encr_hw_algs == NULL)
19317 		goto nomem;
19318 	capab->auth_hw_algs = kmem_zalloc(capab->algs_size, KM_NOSLEEP);
19319 	if (capab->auth_hw_algs == NULL)
19320 		goto nomem;
19321 	/*
19322 	 * Leave encr_algparm NULL for now since we won't need it half
19323 	 * the time
19324 	 */
19325 	return (capab);
19326 
19327 nomem:
19328 	ill_ipsec_capab_free(capab);
19329 	return (NULL);
19330 }
19331 
19332 /*
19333  * Resize capability array.  Since we're exclusive, this is OK.
19334  */
19335 static boolean_t
19336 ill_ipsec_capab_resize_algparm(ill_ipsec_capab_t *capab, int algid)
19337 {
19338 	ipsec_capab_algparm_t *nalp, *oalp;
19339 	uint32_t olen, nlen;
19340 
19341 	oalp = capab->encr_algparm;
19342 	olen = capab->encr_algparm_size;
19343 
19344 	if (oalp != NULL) {
19345 		if (algid < capab->encr_algparm_end)
19346 			return (B_TRUE);
19347 	}
19348 
19349 	nlen = (algid + 1) * sizeof (*nalp);
19350 	nalp = kmem_zalloc(nlen, KM_NOSLEEP);
19351 	if (nalp == NULL)
19352 		return (B_FALSE);
19353 
19354 	if (oalp != NULL) {
19355 		bcopy(oalp, nalp, olen);
19356 		kmem_free(oalp, olen);
19357 	}
19358 	capab->encr_algparm = nalp;
19359 	capab->encr_algparm_size = nlen;
19360 	capab->encr_algparm_end = algid + 1;
19361 
19362 	return (B_TRUE);
19363 }
19364 
19365 /*
19366  * Compare the capabilities of the specified ill with the protocol
19367  * and algorithms specified by the SA passed as argument.
19368  * If they match, returns B_TRUE, B_FALSE if they do not match.
19369  *
19370  * The ill can be passed as a pointer to it, or by specifying its index
19371  * and whether it is an IPv6 ill (ill_index and ill_isv6 arguments).
19372  *
19373  * Called by ipsec_out_is_accelerated() do decide whether an outbound
19374  * packet is eligible for hardware acceleration, and by
19375  * ill_ipsec_capab_send_all() to decide whether a SA must be sent down
19376  * to a particular ill.
19377  */
19378 boolean_t
19379 ipsec_capab_match(ill_t *ill, uint_t ill_index, boolean_t ill_isv6,
19380     ipsa_t *sa, netstack_t *ns)
19381 {
19382 	boolean_t sa_isv6;
19383 	uint_t algid;
19384 	struct ill_ipsec_capab_s *cpp;
19385 	boolean_t need_refrele = B_FALSE;
19386 	ip_stack_t	*ipst = ns->netstack_ip;
19387 
19388 	if (ill == NULL) {
19389 		ill = ill_lookup_on_ifindex(ill_index, ill_isv6, NULL,
19390 		    NULL, NULL, NULL, ipst);
19391 		if (ill == NULL) {
19392 			ip0dbg(("ipsec_capab_match: ill doesn't exist\n"));
19393 			return (B_FALSE);
19394 		}
19395 		need_refrele = B_TRUE;
19396 	}
19397 
19398 	/*
19399 	 * Use the address length specified by the SA to determine
19400 	 * if it corresponds to a IPv6 address, and fail the matching
19401 	 * if the isv6 flag passed as argument does not match.
19402 	 * Note: this check is used for SADB capability checking before
19403 	 * sending SA information to an ill.
19404 	 */
19405 	sa_isv6 = (sa->ipsa_addrfam == AF_INET6);
19406 	if (sa_isv6 != ill_isv6)
19407 		/* protocol mismatch */
19408 		goto done;
19409 
19410 	/*
19411 	 * Check if the ill supports the protocol, algorithm(s) and
19412 	 * key size(s) specified by the SA, and get the pointers to
19413 	 * the algorithms supported by the ill.
19414 	 */
19415 	switch (sa->ipsa_type) {
19416 
19417 	case SADB_SATYPE_ESP:
19418 		if (!(ill->ill_capabilities & ILL_CAPAB_ESP))
19419 			/* ill does not support ESP acceleration */
19420 			goto done;
19421 		cpp = ill->ill_ipsec_capab_esp;
19422 		algid = sa->ipsa_auth_alg;
19423 		if (!IPSEC_ALG_IS_ENABLED(algid, cpp->auth_hw_algs))
19424 			goto done;
19425 		algid = sa->ipsa_encr_alg;
19426 		if (!IPSEC_ALG_IS_ENABLED(algid, cpp->encr_hw_algs))
19427 			goto done;
19428 		if (algid < cpp->encr_algparm_end) {
19429 			ipsec_capab_algparm_t *alp = &cpp->encr_algparm[algid];
19430 			if (sa->ipsa_encrkeybits < alp->minkeylen)
19431 				goto done;
19432 			if (sa->ipsa_encrkeybits > alp->maxkeylen)
19433 				goto done;
19434 		}
19435 		break;
19436 
19437 	case SADB_SATYPE_AH:
19438 		if (!(ill->ill_capabilities & ILL_CAPAB_AH))
19439 			/* ill does not support AH acceleration */
19440 			goto done;
19441 		if (!IPSEC_ALG_IS_ENABLED(sa->ipsa_auth_alg,
19442 		    ill->ill_ipsec_capab_ah->auth_hw_algs))
19443 			goto done;
19444 		break;
19445 	}
19446 
19447 	if (need_refrele)
19448 		ill_refrele(ill);
19449 	return (B_TRUE);
19450 done:
19451 	if (need_refrele)
19452 		ill_refrele(ill);
19453 	return (B_FALSE);
19454 }
19455 
19456 /*
19457  * Add a new ill to the list of IPsec capable ills.
19458  * Called from ill_capability_ipsec_ack() when an ACK was received
19459  * indicating that IPsec hardware processing was enabled for an ill.
19460  *
19461  * ill must point to the ill for which acceleration was enabled.
19462  * dl_cap must be set to DL_CAPAB_IPSEC_AH or DL_CAPAB_IPSEC_ESP.
19463  */
19464 static void
19465 ill_ipsec_capab_add(ill_t *ill, uint_t dl_cap, boolean_t sadb_resync)
19466 {
19467 	ipsec_capab_ill_t **ills, *cur_ill, *new_ill;
19468 	uint_t sa_type;
19469 	uint_t ipproto;
19470 	ip_stack_t	*ipst = ill->ill_ipst;
19471 
19472 	ASSERT((dl_cap == DL_CAPAB_IPSEC_AH) ||
19473 	    (dl_cap == DL_CAPAB_IPSEC_ESP));
19474 
19475 	switch (dl_cap) {
19476 	case DL_CAPAB_IPSEC_AH:
19477 		sa_type = SADB_SATYPE_AH;
19478 		ills = &ipst->ips_ipsec_capab_ills_ah;
19479 		ipproto = IPPROTO_AH;
19480 		break;
19481 	case DL_CAPAB_IPSEC_ESP:
19482 		sa_type = SADB_SATYPE_ESP;
19483 		ills = &ipst->ips_ipsec_capab_ills_esp;
19484 		ipproto = IPPROTO_ESP;
19485 		break;
19486 	}
19487 
19488 	rw_enter(&ipst->ips_ipsec_capab_ills_lock, RW_WRITER);
19489 
19490 	/*
19491 	 * Add ill index to list of hardware accelerators. If
19492 	 * already in list, do nothing.
19493 	 */
19494 	for (cur_ill = *ills; cur_ill != NULL &&
19495 	    (cur_ill->ill_index != ill->ill_phyint->phyint_ifindex ||
19496 	    cur_ill->ill_isv6 != ill->ill_isv6); cur_ill = cur_ill->next)
19497 		;
19498 
19499 	if (cur_ill == NULL) {
19500 		/* if this is a new entry for this ill */
19501 		new_ill = kmem_zalloc(sizeof (ipsec_capab_ill_t), KM_NOSLEEP);
19502 		if (new_ill == NULL) {
19503 			rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19504 			return;
19505 		}
19506 
19507 		new_ill->ill_index = ill->ill_phyint->phyint_ifindex;
19508 		new_ill->ill_isv6 = ill->ill_isv6;
19509 		new_ill->next = *ills;
19510 		*ills = new_ill;
19511 	} else if (!sadb_resync) {
19512 		/* not resync'ing SADB and an entry exists for this ill */
19513 		rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19514 		return;
19515 	}
19516 
19517 	rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19518 
19519 	if (ipst->ips_ipcl_proto_fanout_v6[ipproto].connf_head != NULL)
19520 		/*
19521 		 * IPsec module for protocol loaded, initiate dump
19522 		 * of the SADB to this ill.
19523 		 */
19524 		sadb_ill_download(ill, sa_type);
19525 }
19526 
19527 /*
19528  * Remove an ill from the list of IPsec capable ills.
19529  */
19530 static void
19531 ill_ipsec_capab_delete(ill_t *ill, uint_t dl_cap)
19532 {
19533 	ipsec_capab_ill_t **ills, *cur_ill, *prev_ill;
19534 	ip_stack_t	*ipst = ill->ill_ipst;
19535 
19536 	ASSERT(dl_cap == DL_CAPAB_IPSEC_AH ||
19537 	    dl_cap == DL_CAPAB_IPSEC_ESP);
19538 
19539 	ills = (dl_cap == DL_CAPAB_IPSEC_AH) ? &ipst->ips_ipsec_capab_ills_ah :
19540 	    &ipst->ips_ipsec_capab_ills_esp;
19541 
19542 	rw_enter(&ipst->ips_ipsec_capab_ills_lock, RW_WRITER);
19543 
19544 	prev_ill = NULL;
19545 	for (cur_ill = *ills; cur_ill != NULL && (cur_ill->ill_index !=
19546 	    ill->ill_phyint->phyint_ifindex || cur_ill->ill_isv6 !=
19547 	    ill->ill_isv6); prev_ill = cur_ill, cur_ill = cur_ill->next)
19548 		;
19549 	if (cur_ill == NULL) {
19550 		/* entry not found */
19551 		rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19552 		return;
19553 	}
19554 	if (prev_ill == NULL) {
19555 		/* entry at front of list */
19556 		*ills = NULL;
19557 	} else {
19558 		prev_ill->next = cur_ill->next;
19559 	}
19560 	kmem_free(cur_ill, sizeof (ipsec_capab_ill_t));
19561 	rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19562 }
19563 
19564 /*
19565  * Called by SADB to send a DL_CONTROL_REQ message to every ill
19566  * supporting the specified IPsec protocol acceleration.
19567  * sa_type must be SADB_SATYPE_AH or SADB_SATYPE_ESP.
19568  * We free the mblk and, if sa is non-null, release the held referece.
19569  */
19570 void
19571 ill_ipsec_capab_send_all(uint_t sa_type, mblk_t *mp, ipsa_t *sa,
19572     netstack_t *ns)
19573 {
19574 	ipsec_capab_ill_t *ici, *cur_ici;
19575 	ill_t *ill;
19576 	mblk_t *nmp, *mp_ship_list = NULL, *next_mp;
19577 	ip_stack_t	*ipst = ns->netstack_ip;
19578 
19579 	ici = (sa_type == SADB_SATYPE_AH) ? ipst->ips_ipsec_capab_ills_ah :
19580 	    ipst->ips_ipsec_capab_ills_esp;
19581 
19582 	rw_enter(&ipst->ips_ipsec_capab_ills_lock, RW_READER);
19583 
19584 	for (cur_ici = ici; cur_ici != NULL; cur_ici = cur_ici->next) {
19585 		ill = ill_lookup_on_ifindex(cur_ici->ill_index,
19586 		    cur_ici->ill_isv6, NULL, NULL, NULL, NULL, ipst);
19587 
19588 		/*
19589 		 * Handle the case where the ill goes away while the SADB is
19590 		 * attempting to send messages.  If it's going away, it's
19591 		 * nuking its shadow SADB, so we don't care..
19592 		 */
19593 
19594 		if (ill == NULL)
19595 			continue;
19596 
19597 		if (sa != NULL) {
19598 			/*
19599 			 * Make sure capabilities match before
19600 			 * sending SA to ill.
19601 			 */
19602 			if (!ipsec_capab_match(ill, cur_ici->ill_index,
19603 			    cur_ici->ill_isv6, sa, ipst->ips_netstack)) {
19604 				ill_refrele(ill);
19605 				continue;
19606 			}
19607 
19608 			mutex_enter(&sa->ipsa_lock);
19609 			sa->ipsa_flags |= IPSA_F_HW;
19610 			mutex_exit(&sa->ipsa_lock);
19611 		}
19612 
19613 		/*
19614 		 * Copy template message, and add it to the front
19615 		 * of the mblk ship list. We want to avoid holding
19616 		 * the ipsec_capab_ills_lock while sending the
19617 		 * message to the ills.
19618 		 *
19619 		 * The b_next and b_prev are temporarily used
19620 		 * to build a list of mblks to be sent down, and to
19621 		 * save the ill to which they must be sent.
19622 		 */
19623 		nmp = copymsg(mp);
19624 		if (nmp == NULL) {
19625 			ill_refrele(ill);
19626 			continue;
19627 		}
19628 		ASSERT(nmp->b_next == NULL && nmp->b_prev == NULL);
19629 		nmp->b_next = mp_ship_list;
19630 		mp_ship_list = nmp;
19631 		nmp->b_prev = (mblk_t *)ill;
19632 	}
19633 
19634 	rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19635 
19636 	for (nmp = mp_ship_list; nmp != NULL; nmp = next_mp) {
19637 		/* restore the mblk to a sane state */
19638 		next_mp = nmp->b_next;
19639 		nmp->b_next = NULL;
19640 		ill = (ill_t *)nmp->b_prev;
19641 		nmp->b_prev = NULL;
19642 
19643 		ill_dlpi_send(ill, nmp);
19644 		ill_refrele(ill);
19645 	}
19646 
19647 	if (sa != NULL)
19648 		IPSA_REFRELE(sa);
19649 	freemsg(mp);
19650 }
19651 
19652 /*
19653  * Derive an interface id from the link layer address.
19654  * Knows about IEEE 802 and IEEE EUI-64 mappings.
19655  */
19656 static boolean_t
19657 ip_ether_v6intfid(ill_t *ill, in6_addr_t *v6addr)
19658 {
19659 	char		*addr;
19660 
19661 	if (ill->ill_phys_addr_length != ETHERADDRL)
19662 		return (B_FALSE);
19663 
19664 	/* Form EUI-64 like address */
19665 	addr = (char *)&v6addr->s6_addr32[2];
19666 	bcopy(ill->ill_phys_addr, addr, 3);
19667 	addr[0] ^= 0x2;		/* Toggle Universal/Local bit */
19668 	addr[3] = (char)0xff;
19669 	addr[4] = (char)0xfe;
19670 	bcopy(ill->ill_phys_addr + 3, addr + 5, 3);
19671 	return (B_TRUE);
19672 }
19673 
19674 /* ARGSUSED */
19675 static boolean_t
19676 ip_nodef_v6intfid(ill_t *ill, in6_addr_t *v6addr)
19677 {
19678 	return (B_FALSE);
19679 }
19680 
19681 typedef struct ipmp_ifcookie {
19682 	uint32_t	ic_hostid;
19683 	char		ic_ifname[LIFNAMSIZ];
19684 	char		ic_zonename[ZONENAME_MAX];
19685 } ipmp_ifcookie_t;
19686 
19687 /*
19688  * Construct a pseudo-random interface ID for the IPMP interface that's both
19689  * predictable and (almost) guaranteed to be unique.
19690  */
19691 static boolean_t
19692 ip_ipmp_v6intfid(ill_t *ill, in6_addr_t *v6addr)
19693 {
19694 	zone_t		*zp;
19695 	uint8_t		*addr;
19696 	uchar_t		hash[16];
19697 	ulong_t 	hostid;
19698 	MD5_CTX		ctx;
19699 	ipmp_ifcookie_t	ic = { 0 };
19700 
19701 	ASSERT(IS_IPMP(ill));
19702 
19703 	(void) ddi_strtoul(hw_serial, NULL, 10, &hostid);
19704 	ic.ic_hostid = htonl((uint32_t)hostid);
19705 
19706 	(void) strlcpy(ic.ic_ifname, ill->ill_name, LIFNAMSIZ);
19707 
19708 	if ((zp = zone_find_by_id(ill->ill_zoneid)) != NULL) {
19709 		(void) strlcpy(ic.ic_zonename, zp->zone_name, ZONENAME_MAX);
19710 		zone_rele(zp);
19711 	}
19712 
19713 	MD5Init(&ctx);
19714 	MD5Update(&ctx, &ic, sizeof (ic));
19715 	MD5Final(hash, &ctx);
19716 
19717 	/*
19718 	 * Map the hash to an interface ID per the basic approach in RFC3041.
19719 	 */
19720 	addr = &v6addr->s6_addr8[8];
19721 	bcopy(hash + 8, addr, sizeof (uint64_t));
19722 	addr[0] &= ~0x2;				/* set local bit */
19723 
19724 	return (B_TRUE);
19725 }
19726 
19727 /* ARGSUSED */
19728 static boolean_t
19729 ip_ether_v6mapinfo(uint_t lla_length, uint8_t *bphys_addr, uint8_t *maddr,
19730     uint32_t *hw_start, in6_addr_t *v6_extract_mask)
19731 {
19732 	/*
19733 	 * Multicast address mappings used over Ethernet/802.X.
19734 	 * This address is used as a base for mappings.
19735 	 */
19736 	static uint8_t ipv6_g_phys_multi_addr[] = {0x33, 0x33, 0x00,
19737 	    0x00, 0x00, 0x00};
19738 
19739 	/*
19740 	 * Extract low order 32 bits from IPv6 multicast address.
19741 	 * Or that into the link layer address, starting from the
19742 	 * second byte.
19743 	 */
19744 	*hw_start = 2;
19745 	v6_extract_mask->s6_addr32[0] = 0;
19746 	v6_extract_mask->s6_addr32[1] = 0;
19747 	v6_extract_mask->s6_addr32[2] = 0;
19748 	v6_extract_mask->s6_addr32[3] = 0xffffffffU;
19749 	bcopy(ipv6_g_phys_multi_addr, maddr, lla_length);
19750 	return (B_TRUE);
19751 }
19752 
19753 /*
19754  * Indicate by return value whether multicast is supported. If not,
19755  * this code should not touch/change any parameters.
19756  */
19757 /* ARGSUSED */
19758 static boolean_t
19759 ip_ether_v4mapinfo(uint_t phys_length, uint8_t *bphys_addr, uint8_t *maddr,
19760     uint32_t *hw_start, ipaddr_t *extract_mask)
19761 {
19762 	/*
19763 	 * Multicast address mappings used over Ethernet/802.X.
19764 	 * This address is used as a base for mappings.
19765 	 */
19766 	static uint8_t ip_g_phys_multi_addr[] = { 0x01, 0x00, 0x5e,
19767 	    0x00, 0x00, 0x00 };
19768 
19769 	if (phys_length != ETHERADDRL)
19770 		return (B_FALSE);
19771 
19772 	*extract_mask = htonl(0x007fffff);
19773 	*hw_start = 2;
19774 	bcopy(ip_g_phys_multi_addr, maddr, ETHERADDRL);
19775 	return (B_TRUE);
19776 }
19777 
19778 /*
19779  * Derive IPoIB interface id from the link layer address.
19780  */
19781 static boolean_t
19782 ip_ib_v6intfid(ill_t *ill, in6_addr_t *v6addr)
19783 {
19784 	char		*addr;
19785 
19786 	if (ill->ill_phys_addr_length != 20)
19787 		return (B_FALSE);
19788 	addr = (char *)&v6addr->s6_addr32[2];
19789 	bcopy(ill->ill_phys_addr + 12, addr, 8);
19790 	/*
19791 	 * In IBA 1.1 timeframe, some vendors erroneously set the u/l bit
19792 	 * in the globally assigned EUI-64 GUID to 1, in violation of IEEE
19793 	 * rules. In these cases, the IBA considers these GUIDs to be in
19794 	 * "Modified EUI-64" format, and thus toggling the u/l bit is not
19795 	 * required; vendors are required not to assign global EUI-64's
19796 	 * that differ only in u/l bit values, thus guaranteeing uniqueness
19797 	 * of the interface identifier. Whether the GUID is in modified
19798 	 * or proper EUI-64 format, the ipv6 identifier must have the u/l
19799 	 * bit set to 1.
19800 	 */
19801 	addr[0] |= 2;			/* Set Universal/Local bit to 1 */
19802 	return (B_TRUE);
19803 }
19804 
19805 /*
19806  * Note on mapping from multicast IP addresses to IPoIB multicast link
19807  * addresses. IPoIB multicast link addresses are based on IBA link addresses.
19808  * The format of an IPoIB multicast address is:
19809  *
19810  *  4 byte QPN      Scope Sign.  Pkey
19811  * +--------------------------------------------+
19812  * | 00FFFFFF | FF | 1X | X01B | Pkey | GroupID |
19813  * +--------------------------------------------+
19814  *
19815  * The Scope and Pkey components are properties of the IBA port and
19816  * network interface. They can be ascertained from the broadcast address.
19817  * The Sign. part is the signature, and is 401B for IPv4 and 601B for IPv6.
19818  */
19819 
19820 static boolean_t
19821 ip_ib_v6mapinfo(uint_t lla_length, uint8_t *bphys_addr, uint8_t *maddr,
19822     uint32_t *hw_start, in6_addr_t *v6_extract_mask)
19823 {
19824 	/*
19825 	 * Base IPoIB IPv6 multicast address used for mappings.
19826 	 * Does not contain the IBA scope/Pkey values.
19827 	 */
19828 	static uint8_t ipv6_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
19829 	    0xff, 0x10, 0x60, 0x1b, 0x00, 0x00, 0x00, 0x00,
19830 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
19831 
19832 	/*
19833 	 * Extract low order 80 bits from IPv6 multicast address.
19834 	 * Or that into the link layer address, starting from the
19835 	 * sixth byte.
19836 	 */
19837 	*hw_start = 6;
19838 	bcopy(ipv6_g_phys_ibmulti_addr, maddr, lla_length);
19839 
19840 	/*
19841 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
19842 	 */
19843 	*(maddr + 5) = *(bphys_addr + 5);
19844 	*(maddr + 8) = *(bphys_addr + 8);
19845 	*(maddr + 9) = *(bphys_addr + 9);
19846 
19847 	v6_extract_mask->s6_addr32[0] = 0;
19848 	v6_extract_mask->s6_addr32[1] = htonl(0x0000ffff);
19849 	v6_extract_mask->s6_addr32[2] = 0xffffffffU;
19850 	v6_extract_mask->s6_addr32[3] = 0xffffffffU;
19851 	return (B_TRUE);
19852 }
19853 
19854 static boolean_t
19855 ip_ib_v4mapinfo(uint_t phys_length, uint8_t *bphys_addr, uint8_t *maddr,
19856     uint32_t *hw_start, ipaddr_t *extract_mask)
19857 {
19858 	/*
19859 	 * Base IPoIB IPv4 multicast address used for mappings.
19860 	 * Does not contain the IBA scope/Pkey values.
19861 	 */
19862 	static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
19863 	    0xff, 0x10, 0x40, 0x1b, 0x00, 0x00, 0x00, 0x00,
19864 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
19865 
19866 	if (phys_length != sizeof (ipv4_g_phys_ibmulti_addr))
19867 		return (B_FALSE);
19868 
19869 	/*
19870 	 * Extract low order 28 bits from IPv4 multicast address.
19871 	 * Or that into the link layer address, starting from the
19872 	 * sixteenth byte.
19873 	 */
19874 	*extract_mask = htonl(0x0fffffff);
19875 	*hw_start = 16;
19876 	bcopy(ipv4_g_phys_ibmulti_addr, maddr, phys_length);
19877 
19878 	/*
19879 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
19880 	 */
19881 	*(maddr + 5) = *(bphys_addr + 5);
19882 	*(maddr + 8) = *(bphys_addr + 8);
19883 	*(maddr + 9) = *(bphys_addr + 9);
19884 	return (B_TRUE);
19885 }
19886 
19887 /*
19888  * Returns B_TRUE if an ipif is present in the given zone, matching some flags
19889  * (typically IPIF_UP). If ipifp is non-null, the held ipif is returned there.
19890  * This works for both IPv4 and IPv6; if the passed-in ill is v6, the ipif with
19891  * the link-local address is preferred.
19892  */
19893 boolean_t
19894 ipif_lookup_zoneid(ill_t *ill, zoneid_t zoneid, int flags, ipif_t **ipifp)
19895 {
19896 	ipif_t	*ipif;
19897 	ipif_t	*maybe_ipif = NULL;
19898 
19899 	mutex_enter(&ill->ill_lock);
19900 	if (ill->ill_state_flags & ILL_CONDEMNED) {
19901 		mutex_exit(&ill->ill_lock);
19902 		if (ipifp != NULL)
19903 			*ipifp = NULL;
19904 		return (B_FALSE);
19905 	}
19906 
19907 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
19908 		if (!IPIF_CAN_LOOKUP(ipif))
19909 			continue;
19910 		if (zoneid != ALL_ZONES && ipif->ipif_zoneid != zoneid &&
19911 		    ipif->ipif_zoneid != ALL_ZONES)
19912 			continue;
19913 		if ((ipif->ipif_flags & flags) != flags)
19914 			continue;
19915 
19916 		if (ipifp == NULL) {
19917 			mutex_exit(&ill->ill_lock);
19918 			ASSERT(maybe_ipif == NULL);
19919 			return (B_TRUE);
19920 		}
19921 		if (!ill->ill_isv6 ||
19922 		    IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6src_addr)) {
19923 			ipif_refhold_locked(ipif);
19924 			mutex_exit(&ill->ill_lock);
19925 			*ipifp = ipif;
19926 			return (B_TRUE);
19927 		}
19928 		if (maybe_ipif == NULL)
19929 			maybe_ipif = ipif;
19930 	}
19931 	if (ipifp != NULL) {
19932 		if (maybe_ipif != NULL)
19933 			ipif_refhold_locked(maybe_ipif);
19934 		*ipifp = maybe_ipif;
19935 	}
19936 	mutex_exit(&ill->ill_lock);
19937 	return (maybe_ipif != NULL);
19938 }
19939 
19940 /*
19941  * Return a pointer to an ipif_t given a combination of (ill_idx,ipif_id)
19942  * If a pointer to an ipif_t is returned then the caller will need to do
19943  * an ill_refrele().
19944  */
19945 ipif_t *
19946 ipif_getby_indexes(uint_t ifindex, uint_t lifidx, boolean_t isv6,
19947     ip_stack_t *ipst)
19948 {
19949 	ipif_t *ipif;
19950 	ill_t *ill;
19951 
19952 	ill = ill_lookup_on_ifindex(ifindex, isv6, NULL, NULL, NULL, NULL,
19953 	    ipst);
19954 	if (ill == NULL)
19955 		return (NULL);
19956 
19957 	mutex_enter(&ill->ill_lock);
19958 	if (ill->ill_state_flags & ILL_CONDEMNED) {
19959 		mutex_exit(&ill->ill_lock);
19960 		ill_refrele(ill);
19961 		return (NULL);
19962 	}
19963 
19964 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
19965 		if (!IPIF_CAN_LOOKUP(ipif))
19966 			continue;
19967 		if (lifidx == ipif->ipif_id) {
19968 			ipif_refhold_locked(ipif);
19969 			break;
19970 		}
19971 	}
19972 
19973 	mutex_exit(&ill->ill_lock);
19974 	ill_refrele(ill);
19975 	return (ipif);
19976 }
19977 
19978 /*
19979  * Flush the fastpath by deleting any nce's that are waiting for the fastpath,
19980  * There is one exceptions IRE_BROADCAST are difficult to recreate,
19981  * so instead we just nuke their nce_fp_mp's; see ndp_fastpath_flush()
19982  * for details.
19983  */
19984 void
19985 ill_fastpath_flush(ill_t *ill)
19986 {
19987 	ip_stack_t *ipst = ill->ill_ipst;
19988 
19989 	nce_fastpath_list_dispatch(ill, NULL, NULL);
19990 	ndp_walk_common((ill->ill_isv6 ? ipst->ips_ndp6 : ipst->ips_ndp4),
19991 	    ill, (pfi_t)ndp_fastpath_flush, NULL, B_TRUE);
19992 }
19993 
19994 /*
19995  * Set the physical address information for `ill' to the contents of the
19996  * dl_notify_ind_t pointed to by `mp'.  Must be called as writer, and will be
19997  * asynchronous if `ill' cannot immediately be quiesced -- in which case
19998  * EINPROGRESS will be returned.
19999  */
20000 int
20001 ill_set_phys_addr(ill_t *ill, mblk_t *mp)
20002 {
20003 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
20004 	dl_notify_ind_t	*dlindp = (dl_notify_ind_t *)mp->b_rptr;
20005 
20006 	ASSERT(IAM_WRITER_IPSQ(ipsq));
20007 
20008 	if (dlindp->dl_data != DL_IPV6_LINK_LAYER_ADDR &&
20009 	    dlindp->dl_data != DL_CURR_PHYS_ADDR) {
20010 		/* Changing DL_IPV6_TOKEN is not yet supported */
20011 		return (0);
20012 	}
20013 
20014 	/*
20015 	 * We need to store up to two copies of `mp' in `ill'.  Due to the
20016 	 * design of ipsq_pending_mp_add(), we can't pass them as separate
20017 	 * arguments to ill_set_phys_addr_tail().  Instead, chain them
20018 	 * together here, then pull 'em apart in ill_set_phys_addr_tail().
20019 	 */
20020 	if ((mp = copyb(mp)) == NULL || (mp->b_cont = copyb(mp)) == NULL) {
20021 		freemsg(mp);
20022 		return (ENOMEM);
20023 	}
20024 
20025 	ipsq_current_start(ipsq, ill->ill_ipif, 0);
20026 
20027 	/*
20028 	 * If we can quiesce the ill, then set the address.  If not, then
20029 	 * ill_set_phys_addr_tail() will be called from ipif_ill_refrele_tail().
20030 	 */
20031 	ill_down_ipifs(ill, B_TRUE);
20032 	mutex_enter(&ill->ill_lock);
20033 	if (!ill_is_quiescent(ill)) {
20034 		/* call cannot fail since `conn_t *' argument is NULL */
20035 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
20036 		    mp, ILL_DOWN);
20037 		mutex_exit(&ill->ill_lock);
20038 		return (EINPROGRESS);
20039 	}
20040 	mutex_exit(&ill->ill_lock);
20041 
20042 	ill_set_phys_addr_tail(ipsq, ill->ill_rq, mp, NULL);
20043 	return (0);
20044 }
20045 
20046 /*
20047  * Once the ill associated with `q' has quiesced, set its physical address
20048  * information to the values in `addrmp'.  Note that two copies of `addrmp'
20049  * are passed (linked by b_cont), since we sometimes need to save two distinct
20050  * copies in the ill_t, and our context doesn't permit sleeping or allocation
20051  * failure (we'll free the other copy if it's not needed).  Since the ill_t
20052  * is quiesced, we know any stale IREs with the old address information have
20053  * already been removed, so we don't need to call ill_fastpath_flush().
20054  */
20055 /* ARGSUSED */
20056 static void
20057 ill_set_phys_addr_tail(ipsq_t *ipsq, queue_t *q, mblk_t *addrmp, void *dummy)
20058 {
20059 	ill_t		*ill = q->q_ptr;
20060 	mblk_t		*addrmp2 = unlinkb(addrmp);
20061 	dl_notify_ind_t	*dlindp = (dl_notify_ind_t *)addrmp->b_rptr;
20062 	uint_t		addrlen, addroff;
20063 
20064 	ASSERT(IAM_WRITER_IPSQ(ipsq));
20065 
20066 	addroff	= dlindp->dl_addr_offset;
20067 	addrlen = dlindp->dl_addr_length - ABS(ill->ill_sap_length);
20068 
20069 	switch (dlindp->dl_data) {
20070 	case DL_IPV6_LINK_LAYER_ADDR:
20071 		ill_set_ndmp(ill, addrmp, addroff, addrlen);
20072 		freemsg(addrmp2);
20073 		break;
20074 
20075 	case DL_CURR_PHYS_ADDR:
20076 		freemsg(ill->ill_phys_addr_mp);
20077 		ill->ill_phys_addr = addrmp->b_rptr + addroff;
20078 		ill->ill_phys_addr_mp = addrmp;
20079 		ill->ill_phys_addr_length = addrlen;
20080 
20081 		if (ill->ill_isv6 && !(ill->ill_flags & ILLF_XRESOLV))
20082 			ill_set_ndmp(ill, addrmp2, addroff, addrlen);
20083 		else
20084 			freemsg(addrmp2);
20085 		break;
20086 	default:
20087 		ASSERT(0);
20088 	}
20089 
20090 	/*
20091 	 * If there are ipifs to bring up, ill_up_ipifs() will return
20092 	 * EINPROGRESS, and ipsq_current_finish() will be called by
20093 	 * ip_rput_dlpi_writer() or ip_arp_done() when the last ipif is
20094 	 * brought up.
20095 	 */
20096 	if (ill_up_ipifs(ill, q, addrmp) != EINPROGRESS)
20097 		ipsq_current_finish(ipsq);
20098 }
20099 
20100 /*
20101  * Helper routine for setting the ill_nd_lla fields.
20102  */
20103 void
20104 ill_set_ndmp(ill_t *ill, mblk_t *ndmp, uint_t addroff, uint_t addrlen)
20105 {
20106 	freemsg(ill->ill_nd_lla_mp);
20107 	ill->ill_nd_lla = ndmp->b_rptr + addroff;
20108 	ill->ill_nd_lla_mp = ndmp;
20109 	ill->ill_nd_lla_len = addrlen;
20110 }
20111 
20112 /*
20113  * Replumb the ill.
20114  */
20115 int
20116 ill_replumb(ill_t *ill, mblk_t *mp)
20117 {
20118 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
20119 
20120 	ASSERT(IAM_WRITER_IPSQ(ipsq));
20121 
20122 	ipsq_current_start(ipsq, ill->ill_ipif, 0);
20123 
20124 	/*
20125 	 * If we can quiesce the ill, then continue.  If not, then
20126 	 * ill_replumb_tail() will be called from ipif_ill_refrele_tail().
20127 	 */
20128 	ill_down_ipifs(ill, B_FALSE);
20129 
20130 	mutex_enter(&ill->ill_lock);
20131 	if (!ill_is_quiescent(ill)) {
20132 		/* call cannot fail since `conn_t *' argument is NULL */
20133 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
20134 		    mp, ILL_DOWN);
20135 		mutex_exit(&ill->ill_lock);
20136 		return (EINPROGRESS);
20137 	}
20138 	mutex_exit(&ill->ill_lock);
20139 
20140 	ill_replumb_tail(ipsq, ill->ill_rq, mp, NULL);
20141 	return (0);
20142 }
20143 
20144 /* ARGSUSED */
20145 static void
20146 ill_replumb_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy)
20147 {
20148 	ill_t *ill = q->q_ptr;
20149 
20150 	ASSERT(IAM_WRITER_IPSQ(ipsq));
20151 
20152 	ill_down_ipifs_tail(ill);
20153 
20154 	freemsg(ill->ill_replumb_mp);
20155 	ill->ill_replumb_mp = copyb(mp);
20156 
20157 	/*
20158 	 * Successfully quiesced and brought down the interface, now we send
20159 	 * the DL_NOTE_REPLUMB_DONE message down to the driver. Reuse the
20160 	 * DL_NOTE_REPLUMB message.
20161 	 */
20162 	mp = mexchange(NULL, mp, sizeof (dl_notify_conf_t), M_PROTO,
20163 	    DL_NOTIFY_CONF);
20164 	ASSERT(mp != NULL);
20165 	((dl_notify_conf_t *)mp->b_rptr)->dl_notification =
20166 	    DL_NOTE_REPLUMB_DONE;
20167 	ill_dlpi_send(ill, mp);
20168 
20169 	/*
20170 	 * If there are ipifs to bring up, ill_up_ipifs() will return
20171 	 * EINPROGRESS, and ipsq_current_finish() will be called by
20172 	 * ip_rput_dlpi_writer() or ip_arp_done() when the last ipif is
20173 	 * brought up.
20174 	 */
20175 	if (ill->ill_replumb_mp == NULL ||
20176 	    ill_up_ipifs(ill, q, ill->ill_replumb_mp) != EINPROGRESS) {
20177 		ipsq_current_finish(ipsq);
20178 	}
20179 }
20180 
20181 major_t IP_MAJ;
20182 #define	IP	"ip"
20183 
20184 #define	UDP6DEV		"/devices/pseudo/udp6@0:udp6"
20185 #define	UDPDEV		"/devices/pseudo/udp@0:udp"
20186 
20187 /*
20188  * Issue REMOVEIF ioctls to have the loopback interfaces
20189  * go away.  Other interfaces are either I_LINKed or I_PLINKed;
20190  * the former going away when the user-level processes in the zone
20191  * are killed  * and the latter are cleaned up by the stream head
20192  * str_stack_shutdown callback that undoes all I_PLINKs.
20193  */
20194 void
20195 ip_loopback_cleanup(ip_stack_t *ipst)
20196 {
20197 	int error;
20198 	ldi_handle_t	lh = NULL;
20199 	ldi_ident_t	li = NULL;
20200 	int		rval;
20201 	cred_t		*cr;
20202 	struct strioctl iocb;
20203 	struct lifreq	lifreq;
20204 
20205 	IP_MAJ = ddi_name_to_major(IP);
20206 
20207 #ifdef NS_DEBUG
20208 	(void) printf("ip_loopback_cleanup() stackid %d\n",
20209 	    ipst->ips_netstack->netstack_stackid);
20210 #endif
20211 
20212 	bzero(&lifreq, sizeof (lifreq));
20213 	(void) strcpy(lifreq.lifr_name, ipif_loopback_name);
20214 
20215 	error = ldi_ident_from_major(IP_MAJ, &li);
20216 	if (error) {
20217 #ifdef DEBUG
20218 		printf("ip_loopback_cleanup: lyr ident get failed error %d\n",
20219 		    error);
20220 #endif
20221 		return;
20222 	}
20223 
20224 	cr = zone_get_kcred(netstackid_to_zoneid(
20225 	    ipst->ips_netstack->netstack_stackid));
20226 	ASSERT(cr != NULL);
20227 	error = ldi_open_by_name(UDP6DEV, FREAD|FWRITE, cr, &lh, li);
20228 	if (error) {
20229 #ifdef DEBUG
20230 		printf("ip_loopback_cleanup: open of UDP6DEV failed error %d\n",
20231 		    error);
20232 #endif
20233 		goto out;
20234 	}
20235 	iocb.ic_cmd = SIOCLIFREMOVEIF;
20236 	iocb.ic_timout = 15;
20237 	iocb.ic_len = sizeof (lifreq);
20238 	iocb.ic_dp = (char *)&lifreq;
20239 
20240 	error = ldi_ioctl(lh, I_STR, (intptr_t)&iocb, FKIOCTL, cr, &rval);
20241 	/* LINTED - statement has no consequent */
20242 	if (error) {
20243 #ifdef NS_DEBUG
20244 		printf("ip_loopback_cleanup: ioctl SIOCLIFREMOVEIF failed on "
20245 		    "UDP6 error %d\n", error);
20246 #endif
20247 	}
20248 	(void) ldi_close(lh, FREAD|FWRITE, cr);
20249 	lh = NULL;
20250 
20251 	error = ldi_open_by_name(UDPDEV, FREAD|FWRITE, cr, &lh, li);
20252 	if (error) {
20253 #ifdef NS_DEBUG
20254 		printf("ip_loopback_cleanup: open of UDPDEV failed error %d\n",
20255 		    error);
20256 #endif
20257 		goto out;
20258 	}
20259 
20260 	iocb.ic_cmd = SIOCLIFREMOVEIF;
20261 	iocb.ic_timout = 15;
20262 	iocb.ic_len = sizeof (lifreq);
20263 	iocb.ic_dp = (char *)&lifreq;
20264 
20265 	error = ldi_ioctl(lh, I_STR, (intptr_t)&iocb, FKIOCTL, cr, &rval);
20266 	/* LINTED - statement has no consequent */
20267 	if (error) {
20268 #ifdef NS_DEBUG
20269 		printf("ip_loopback_cleanup: ioctl SIOCLIFREMOVEIF failed on "
20270 		    "UDP error %d\n", error);
20271 #endif
20272 	}
20273 	(void) ldi_close(lh, FREAD|FWRITE, cr);
20274 	lh = NULL;
20275 
20276 out:
20277 	/* Close layered handles */
20278 	if (lh)
20279 		(void) ldi_close(lh, FREAD|FWRITE, cr);
20280 	if (li)
20281 		ldi_ident_release(li);
20282 
20283 	crfree(cr);
20284 }
20285 
20286 /*
20287  * This needs to be in-sync with nic_event_t definition
20288  */
20289 static const char *
20290 ill_hook_event2str(nic_event_t event)
20291 {
20292 	switch (event) {
20293 	case NE_PLUMB:
20294 		return ("PLUMB");
20295 	case NE_UNPLUMB:
20296 		return ("UNPLUMB");
20297 	case NE_UP:
20298 		return ("UP");
20299 	case NE_DOWN:
20300 		return ("DOWN");
20301 	case NE_ADDRESS_CHANGE:
20302 		return ("ADDRESS_CHANGE");
20303 	case NE_LIF_UP:
20304 		return ("LIF_UP");
20305 	case NE_LIF_DOWN:
20306 		return ("LIF_DOWN");
20307 	default:
20308 		return ("UNKNOWN");
20309 	}
20310 }
20311 
20312 void
20313 ill_nic_event_dispatch(ill_t *ill, lif_if_t lif, nic_event_t event,
20314     nic_event_data_t data, size_t datalen)
20315 {
20316 	ip_stack_t		*ipst = ill->ill_ipst;
20317 	hook_nic_event_int_t	*info;
20318 	const char		*str = NULL;
20319 
20320 	/* create a new nic event info */
20321 	if ((info = kmem_alloc(sizeof (*info), KM_NOSLEEP)) == NULL)
20322 		goto fail;
20323 
20324 	info->hnei_event.hne_nic = ill->ill_phyint->phyint_ifindex;
20325 	info->hnei_event.hne_lif = lif;
20326 	info->hnei_event.hne_event = event;
20327 	info->hnei_event.hne_protocol = ill->ill_isv6 ?
20328 	    ipst->ips_ipv6_net_data : ipst->ips_ipv4_net_data;
20329 	info->hnei_event.hne_data = NULL;
20330 	info->hnei_event.hne_datalen = 0;
20331 	info->hnei_stackid = ipst->ips_netstack->netstack_stackid;
20332 
20333 	if (data != NULL && datalen != 0) {
20334 		info->hnei_event.hne_data = kmem_alloc(datalen, KM_NOSLEEP);
20335 		if (info->hnei_event.hne_data == NULL)
20336 			goto fail;
20337 		bcopy(data, info->hnei_event.hne_data, datalen);
20338 		info->hnei_event.hne_datalen = datalen;
20339 	}
20340 
20341 	if (ddi_taskq_dispatch(eventq_queue_nic, ip_ne_queue_func, info,
20342 	    DDI_NOSLEEP) == DDI_SUCCESS)
20343 		return;
20344 
20345 fail:
20346 	if (info != NULL) {
20347 		if (info->hnei_event.hne_data != NULL) {
20348 			kmem_free(info->hnei_event.hne_data,
20349 			    info->hnei_event.hne_datalen);
20350 		}
20351 		kmem_free(info, sizeof (hook_nic_event_t));
20352 	}
20353 	str = ill_hook_event2str(event);
20354 	ip2dbg(("ill_nic_event_dispatch: could not dispatch %s nic event "
20355 	    "information for %s (ENOMEM)\n", str, ill->ill_name));
20356 }
20357 
20358 void
20359 ipif_up_notify(ipif_t *ipif)
20360 {
20361 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
20362 	ip_rts_newaddrmsg(RTM_ADD, 0, ipif, RTSQ_DEFAULT);
20363 	sctp_update_ipif(ipif, SCTP_IPIF_UP);
20364 	ill_nic_event_dispatch(ipif->ipif_ill, MAP_IPIF_ID(ipif->ipif_id),
20365 	    NE_LIF_UP, NULL, 0);
20366 }
20367