xref: /titanic_50/usr/src/uts/common/inet/ip/ip_if.c (revision d00d0b26c4591469742c6f5e781603b0d18de013)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /* Copyright (c) 1990 Mentat Inc. */
26 
27 /*
28  * This file contains the interface control functions for IP.
29  */
30 
31 #include <sys/types.h>
32 #include <sys/stream.h>
33 #include <sys/dlpi.h>
34 #include <sys/stropts.h>
35 #include <sys/strsun.h>
36 #include <sys/sysmacros.h>
37 #include <sys/strsubr.h>
38 #include <sys/strlog.h>
39 #include <sys/ddi.h>
40 #include <sys/sunddi.h>
41 #include <sys/cmn_err.h>
42 #include <sys/kstat.h>
43 #include <sys/debug.h>
44 #include <sys/zone.h>
45 #include <sys/sunldi.h>
46 #include <sys/file.h>
47 #include <sys/bitmap.h>
48 #include <sys/cpuvar.h>
49 #include <sys/time.h>
50 #include <sys/ctype.h>
51 #include <sys/kmem.h>
52 #include <sys/systm.h>
53 #include <sys/param.h>
54 #include <sys/socket.h>
55 #include <sys/isa_defs.h>
56 #include <net/if.h>
57 #include <net/if_arp.h>
58 #include <net/if_types.h>
59 #include <net/if_dl.h>
60 #include <net/route.h>
61 #include <sys/sockio.h>
62 #include <netinet/in.h>
63 #include <netinet/ip6.h>
64 #include <netinet/icmp6.h>
65 #include <netinet/igmp_var.h>
66 #include <sys/policy.h>
67 #include <sys/ethernet.h>
68 #include <sys/callb.h>
69 #include <sys/md5.h>
70 
71 #include <inet/common.h>   /* for various inet/mi.h and inet/nd.h needs */
72 #include <inet/mi.h>
73 #include <inet/nd.h>
74 #include <inet/arp.h>
75 #include <inet/mib2.h>
76 #include <inet/ip.h>
77 #include <inet/ip6.h>
78 #include <inet/ip6_asp.h>
79 #include <inet/tcp.h>
80 #include <inet/ip_multi.h>
81 #include <inet/ip_ire.h>
82 #include <inet/ip_ftable.h>
83 #include <inet/ip_rts.h>
84 #include <inet/ip_ndp.h>
85 #include <inet/ip_if.h>
86 #include <inet/ip_impl.h>
87 #include <inet/tun.h>
88 #include <inet/sctp_ip.h>
89 #include <inet/ip_netinfo.h>
90 
91 #include <net/pfkeyv2.h>
92 #include <inet/ipsec_info.h>
93 #include <inet/sadb.h>
94 #include <inet/ipsec_impl.h>
95 #include <sys/iphada.h>
96 
97 #include <netinet/igmp.h>
98 #include <inet/ip_listutils.h>
99 #include <inet/ipclassifier.h>
100 #include <sys/mac_client.h>
101 #include <sys/dld.h>
102 
103 #include <sys/systeminfo.h>
104 #include <sys/bootconf.h>
105 
106 #include <sys/tsol/tndb.h>
107 #include <sys/tsol/tnet.h>
108 
109 /* The character which tells where the ill_name ends */
110 #define	IPIF_SEPARATOR_CHAR	':'
111 
112 /* IP ioctl function table entry */
113 typedef struct ipft_s {
114 	int	ipft_cmd;
115 	pfi_t	ipft_pfi;
116 	int	ipft_min_size;
117 	int	ipft_flags;
118 } ipft_t;
119 #define	IPFT_F_NO_REPLY		0x1	/* IP ioctl does not expect any reply */
120 #define	IPFT_F_SELF_REPLY	0x2	/* ioctl callee does the ioctl reply */
121 
122 typedef struct ip_sock_ar_s {
123 	union {
124 		area_t	ip_sock_area;
125 		ared_t	ip_sock_ared;
126 		areq_t	ip_sock_areq;
127 	} ip_sock_ar_u;
128 	queue_t	*ip_sock_ar_q;
129 } ip_sock_ar_t;
130 
131 static int	nd_ill_forward_get(queue_t *, mblk_t *, caddr_t, cred_t *);
132 static int	nd_ill_forward_set(queue_t *q, mblk_t *mp,
133 		    char *value, caddr_t cp, cred_t *ioc_cr);
134 
135 static boolean_t ill_is_quiescent(ill_t *);
136 static boolean_t ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask);
137 static ip_m_t	*ip_m_lookup(t_uscalar_t mac_type);
138 static int	ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
139     mblk_t *mp, boolean_t need_up);
140 static int	ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
141     mblk_t *mp, boolean_t need_up);
142 static int	ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
143     queue_t *q, mblk_t *mp, boolean_t need_up);
144 static int	ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q,
145     mblk_t *mp);
146 static int	ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
147     mblk_t *mp);
148 static int	ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t, in6_addr_t,
149     queue_t *q, mblk_t *mp, boolean_t need_up);
150 static int	ip_sioctl_plink_ipmod(ipsq_t *ipsq, queue_t *q, mblk_t *mp,
151     int ioccmd, struct linkblk *li, boolean_t doconsist);
152 static ipaddr_t	ip_subnet_mask(ipaddr_t addr, ipif_t **, ip_stack_t *);
153 static void	ip_wput_ioctl(queue_t *q, mblk_t *mp);
154 static void	ipsq_flush(ill_t *ill);
155 
156 static	int	ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen,
157     queue_t *q, mblk_t *mp, boolean_t need_up);
158 static void	ipsq_delete(ipsq_t *);
159 
160 static ipif_t	*ipif_allocate(ill_t *ill, int id, uint_t ire_type,
161     boolean_t initialize, boolean_t insert);
162 static void	ipif_check_bcast_ires(ipif_t *test_ipif);
163 static ire_t	**ipif_create_bcast_ires(ipif_t *ipif, ire_t **irep);
164 static boolean_t ipif_comp_multi(ipif_t *old_ipif, ipif_t *new_ipif,
165 		    boolean_t isv6);
166 static void	ipif_down_delete_ire(ire_t *ire, char *ipif);
167 static void	ipif_delete_cache_ire(ire_t *, char *);
168 static int	ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp);
169 static void	ipif_free(ipif_t *ipif);
170 static void	ipif_free_tail(ipif_t *ipif);
171 static void	ipif_mtu_change(ire_t *ire, char *ipif_arg);
172 static void	ipif_recreate_interface_routes(ipif_t *old_ipif, ipif_t *ipif);
173 static void	ipif_set_default(ipif_t *ipif);
174 static int	ipif_set_values(queue_t *q, mblk_t *mp,
175     char *interf_name, uint_t *ppa);
176 static int	ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp,
177     queue_t *q);
178 static ipif_t	*ipif_lookup_on_name(char *name, size_t namelen,
179     boolean_t do_alloc, boolean_t *exists, boolean_t isv6, zoneid_t zoneid,
180     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *);
181 static void	ipif_update_other_ipifs(ipif_t *old_ipif);
182 
183 static int	ill_alloc_ppa(ill_if_t *, ill_t *);
184 static int	ill_arp_off(ill_t *ill);
185 static int	ill_arp_on(ill_t *ill);
186 static void	ill_delete_interface_type(ill_if_t *);
187 static int	ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q);
188 static void	ill_dl_down(ill_t *ill);
189 static void	ill_down(ill_t *ill);
190 static void	ill_downi(ire_t *ire, char *ill_arg);
191 static void	ill_free_mib(ill_t *ill);
192 static void	ill_glist_delete(ill_t *);
193 static void	ill_phyint_reinit(ill_t *ill);
194 static void	ill_set_nce_router_flags(ill_t *, boolean_t);
195 static void	ill_set_phys_addr_tail(ipsq_t *, queue_t *, mblk_t *, void *);
196 static ip_v6intfid_func_t ip_ether_v6intfid, ip_ib_v6intfid;
197 static ip_v6intfid_func_t ip_ipmp_v6intfid, ip_nodef_v6intfid;
198 static ip_v6mapinfo_func_t ip_ether_v6mapinfo, ip_ib_v6mapinfo;
199 static ip_v4mapinfo_func_t ip_ether_v4mapinfo, ip_ib_v4mapinfo;
200 static void	ipif_save_ire(ipif_t *, ire_t *);
201 static void	ipif_remove_ire(ipif_t *, ire_t *);
202 static void 	ip_cgtp_bcast_add(ire_t *, ire_t *, ip_stack_t *);
203 static void 	ip_cgtp_bcast_delete(ire_t *, ip_stack_t *);
204 static void	phyint_free(phyint_t *);
205 
206 /*
207  * Per-ill IPsec capabilities management.
208  */
209 static ill_ipsec_capab_t *ill_ipsec_capab_alloc(void);
210 static void	ill_ipsec_capab_free(ill_ipsec_capab_t *);
211 static void	ill_ipsec_capab_add(ill_t *, uint_t, boolean_t);
212 static void	ill_ipsec_capab_delete(ill_t *, uint_t);
213 static boolean_t ill_ipsec_capab_resize_algparm(ill_ipsec_capab_t *, int);
214 static void ill_capability_dispatch(ill_t *, mblk_t *, dl_capability_sub_t *,
215     boolean_t);
216 static void ill_capability_id_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
217 static void ill_capability_mdt_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
218 static void ill_capability_mdt_reset_fill(ill_t *, mblk_t *);
219 static void ill_capability_ipsec_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
220 static void ill_capability_ipsec_reset_fill(ill_t *, mblk_t *);
221 static void ill_capability_hcksum_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
222 static void ill_capability_hcksum_reset_fill(ill_t *, mblk_t *);
223 static void ill_capability_zerocopy_ack(ill_t *, mblk_t *,
224     dl_capability_sub_t *);
225 static void ill_capability_zerocopy_reset_fill(ill_t *, mblk_t *);
226 static int  ill_capability_ipsec_reset_size(ill_t *, int *, int *, int *,
227     int *);
228 static void	ill_capability_dld_reset_fill(ill_t *, mblk_t *);
229 static void	ill_capability_dld_ack(ill_t *, mblk_t *,
230 		    dl_capability_sub_t *);
231 static void	ill_capability_dld_enable(ill_t *);
232 static void	ill_capability_ack_thr(void *);
233 static void	ill_capability_lso_enable(ill_t *);
234 static void	ill_capability_send(ill_t *, mblk_t *);
235 
236 static ill_t	*ill_prev_usesrc(ill_t *);
237 static int	ill_relink_usesrc_ills(ill_t *, ill_t *, uint_t);
238 static void	ill_disband_usesrc_group(ill_t *);
239 static void	conn_cleanup_stale_ire(conn_t *, caddr_t);
240 
241 #ifdef DEBUG
242 static  void    ill_trace_cleanup(const ill_t *);
243 static  void    ipif_trace_cleanup(const ipif_t *);
244 #endif
245 
246 /*
247  * if we go over the memory footprint limit more than once in this msec
248  * interval, we'll start pruning aggressively.
249  */
250 int ip_min_frag_prune_time = 0;
251 
252 /*
253  * max # of IPsec algorithms supported.  Limited to 1 byte by PF_KEY
254  * and the IPsec DOI
255  */
256 #define	MAX_IPSEC_ALGS	256
257 
258 #define	BITSPERBYTE	8
259 #define	BITS(type)	(BITSPERBYTE * (long)sizeof (type))
260 
261 #define	IPSEC_ALG_ENABLE(algs, algid) \
262 		((algs)[(algid) / BITS(ipsec_capab_elem_t)] |= \
263 		(1 << ((algid) % BITS(ipsec_capab_elem_t))))
264 
265 #define	IPSEC_ALG_IS_ENABLED(algid, algs) \
266 		((algs)[(algid) / BITS(ipsec_capab_elem_t)] & \
267 		(1 << ((algid) % BITS(ipsec_capab_elem_t))))
268 
269 typedef uint8_t ipsec_capab_elem_t;
270 
271 /*
272  * Per-algorithm parameters.  Note that at present, only encryption
273  * algorithms have variable keysize (IKE does not provide a way to negotiate
274  * auth algorithm keysize).
275  *
276  * All sizes here are in bits.
277  */
278 typedef struct
279 {
280 	uint16_t	minkeylen;
281 	uint16_t	maxkeylen;
282 } ipsec_capab_algparm_t;
283 
284 /*
285  * Per-ill capabilities.
286  */
287 struct ill_ipsec_capab_s {
288 	ipsec_capab_elem_t *encr_hw_algs;
289 	ipsec_capab_elem_t *auth_hw_algs;
290 	uint32_t algs_size;	/* size of _hw_algs in bytes */
291 	/* algorithm key lengths */
292 	ipsec_capab_algparm_t *encr_algparm;
293 	uint32_t encr_algparm_size;
294 	uint32_t encr_algparm_end;
295 };
296 
297 /*
298  * The field values are larger than strictly necessary for simple
299  * AR_ENTRY_ADDs but the padding lets us accomodate the socket ioctls.
300  */
301 static area_t	ip_area_template = {
302 	AR_ENTRY_ADD,			/* area_cmd */
303 	sizeof (ip_sock_ar_t) + (IP_ADDR_LEN*2) + sizeof (struct sockaddr_dl),
304 					/* area_name_offset */
305 	/* area_name_length temporarily holds this structure length */
306 	sizeof (area_t),			/* area_name_length */
307 	IP_ARP_PROTO_TYPE,		/* area_proto */
308 	sizeof (ip_sock_ar_t),		/* area_proto_addr_offset */
309 	IP_ADDR_LEN,			/* area_proto_addr_length */
310 	sizeof (ip_sock_ar_t) + IP_ADDR_LEN,
311 					/* area_proto_mask_offset */
312 	0,				/* area_flags */
313 	sizeof (ip_sock_ar_t) + IP_ADDR_LEN + IP_ADDR_LEN,
314 					/* area_hw_addr_offset */
315 	/* Zero length hw_addr_length means 'use your idea of the address' */
316 	0				/* area_hw_addr_length */
317 };
318 
319 /*
320  * AR_ENTRY_ADD/DELETE templates have been added for IPv6 external resolver
321  * support
322  */
323 static area_t	ip6_area_template = {
324 	AR_ENTRY_ADD,			/* area_cmd */
325 	sizeof (ip_sock_ar_t) + (IPV6_ADDR_LEN*2) + sizeof (sin6_t),
326 					/* area_name_offset */
327 	/* area_name_length temporarily holds this structure length */
328 	sizeof (area_t),			/* area_name_length */
329 	IP_ARP_PROTO_TYPE,		/* area_proto */
330 	sizeof (ip_sock_ar_t),		/* area_proto_addr_offset */
331 	IPV6_ADDR_LEN,			/* area_proto_addr_length */
332 	sizeof (ip_sock_ar_t) + IPV6_ADDR_LEN,
333 					/* area_proto_mask_offset */
334 	0,				/* area_flags */
335 	sizeof (ip_sock_ar_t) + IPV6_ADDR_LEN + IPV6_ADDR_LEN,
336 					/* area_hw_addr_offset */
337 	/* Zero length hw_addr_length means 'use your idea of the address' */
338 	0				/* area_hw_addr_length */
339 };
340 
341 static ared_t	ip_ared_template = {
342 	AR_ENTRY_DELETE,
343 	sizeof (ared_t) + IP_ADDR_LEN,
344 	sizeof (ared_t),
345 	IP_ARP_PROTO_TYPE,
346 	sizeof (ared_t),
347 	IP_ADDR_LEN,
348 	0
349 };
350 
351 static ared_t	ip6_ared_template = {
352 	AR_ENTRY_DELETE,
353 	sizeof (ared_t) + IPV6_ADDR_LEN,
354 	sizeof (ared_t),
355 	IP_ARP_PROTO_TYPE,
356 	sizeof (ared_t),
357 	IPV6_ADDR_LEN,
358 	0
359 };
360 
361 /*
362  * A template for an IPv6 AR_ENTRY_QUERY template has not been created, as
363  * as the areq doesn't include an IP address in ill_dl_up() (the only place a
364  * areq is used).
365  */
366 static areq_t	ip_areq_template = {
367 	AR_ENTRY_QUERY,			/* cmd */
368 	sizeof (areq_t)+(2*IP_ADDR_LEN),	/* name offset */
369 	sizeof (areq_t),	/* name len (filled by ill_arp_alloc) */
370 	IP_ARP_PROTO_TYPE,		/* protocol, from arps perspective */
371 	sizeof (areq_t),			/* target addr offset */
372 	IP_ADDR_LEN,			/* target addr_length */
373 	0,				/* flags */
374 	sizeof (areq_t) + IP_ADDR_LEN,	/* sender addr offset */
375 	IP_ADDR_LEN,			/* sender addr length */
376 	AR_EQ_DEFAULT_XMIT_COUNT,	/* xmit_count */
377 	AR_EQ_DEFAULT_XMIT_INTERVAL,	/* (re)xmit_interval in milliseconds */
378 	AR_EQ_DEFAULT_MAX_BUFFERED	/* max # of requests to buffer */
379 	/* anything else filled in by the code */
380 };
381 
382 static arc_t	ip_aru_template = {
383 	AR_INTERFACE_UP,
384 	sizeof (arc_t),		/* Name offset */
385 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
386 };
387 
388 static arc_t	ip_ard_template = {
389 	AR_INTERFACE_DOWN,
390 	sizeof (arc_t),		/* Name offset */
391 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
392 };
393 
394 static arc_t	ip_aron_template = {
395 	AR_INTERFACE_ON,
396 	sizeof (arc_t),		/* Name offset */
397 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
398 };
399 
400 static arc_t	ip_aroff_template = {
401 	AR_INTERFACE_OFF,
402 	sizeof (arc_t),		/* Name offset */
403 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
404 };
405 
406 static arma_t	ip_arma_multi_template = {
407 	AR_MAPPING_ADD,
408 	sizeof (arma_t) + 3*IP_ADDR_LEN + IP_MAX_HW_LEN,
409 				/* Name offset */
410 	sizeof (arma_t),	/* Name length (set by ill_arp_alloc) */
411 	IP_ARP_PROTO_TYPE,
412 	sizeof (arma_t),			/* proto_addr_offset */
413 	IP_ADDR_LEN,				/* proto_addr_length */
414 	sizeof (arma_t) + IP_ADDR_LEN,		/* proto_mask_offset */
415 	sizeof (arma_t) + 2*IP_ADDR_LEN,	/* proto_extract_mask_offset */
416 	ACE_F_PERMANENT | ACE_F_MAPPING,	/* flags */
417 	sizeof (arma_t) + 3*IP_ADDR_LEN,	/* hw_addr_offset */
418 	IP_MAX_HW_LEN,				/* hw_addr_length */
419 	0,					/* hw_mapping_start */
420 };
421 
422 static ipft_t	ip_ioctl_ftbl[] = {
423 	{ IP_IOC_IRE_DELETE, ip_ire_delete, sizeof (ipid_t), 0 },
424 	{ IP_IOC_IRE_DELETE_NO_REPLY, ip_ire_delete, sizeof (ipid_t),
425 		IPFT_F_NO_REPLY },
426 	{ IP_IOC_IRE_ADVISE_NO_REPLY, ip_ire_advise, sizeof (ipic_t),
427 		IPFT_F_NO_REPLY },
428 	{ IP_IOC_RTS_REQUEST, ip_rts_request, 0, IPFT_F_SELF_REPLY },
429 	{ 0 }
430 };
431 
432 /* Simple ICMP IP Header Template */
433 static ipha_t icmp_ipha = {
434 	IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
435 };
436 
437 /* Flag descriptors for ip_ipif_report */
438 static nv_t	ipif_nv_tbl[] = {
439 	{ IPIF_UP,		"UP" },
440 	{ IPIF_BROADCAST,	"BROADCAST" },
441 	{ ILLF_DEBUG,		"DEBUG" },
442 	{ PHYI_LOOPBACK,	"LOOPBACK" },
443 	{ IPIF_POINTOPOINT,	"POINTOPOINT" },
444 	{ ILLF_NOTRAILERS,	"NOTRAILERS" },
445 	{ PHYI_RUNNING,		"RUNNING" },
446 	{ ILLF_NOARP,		"NOARP" },
447 	{ PHYI_PROMISC,		"PROMISC" },
448 	{ PHYI_ALLMULTI,	"ALLMULTI" },
449 	{ PHYI_INTELLIGENT,	"INTELLIGENT" },
450 	{ ILLF_MULTICAST,	"MULTICAST" },
451 	{ PHYI_MULTI_BCAST,	"MULTI_BCAST" },
452 	{ IPIF_UNNUMBERED,	"UNNUMBERED" },
453 	{ IPIF_DHCPRUNNING,	"DHCP" },
454 	{ IPIF_PRIVATE,		"PRIVATE" },
455 	{ IPIF_NOXMIT,		"NOXMIT" },
456 	{ IPIF_NOLOCAL,		"NOLOCAL" },
457 	{ IPIF_DEPRECATED,	"DEPRECATED" },
458 	{ IPIF_PREFERRED,	"PREFERRED" },
459 	{ IPIF_TEMPORARY,	"TEMPORARY" },
460 	{ IPIF_ADDRCONF,	"ADDRCONF" },
461 	{ PHYI_VIRTUAL,		"VIRTUAL" },
462 	{ ILLF_ROUTER,		"ROUTER" },
463 	{ ILLF_NONUD,		"NONUD" },
464 	{ IPIF_ANYCAST,		"ANYCAST" },
465 	{ ILLF_NORTEXCH,	"NORTEXCH" },
466 	{ ILLF_IPV4,		"IPV4" },
467 	{ ILLF_IPV6,		"IPV6" },
468 	{ IPIF_NOFAILOVER,	"NOFAILOVER" },
469 	{ PHYI_FAILED,		"FAILED" },
470 	{ PHYI_STANDBY,		"STANDBY" },
471 	{ PHYI_INACTIVE,	"INACTIVE" },
472 	{ PHYI_OFFLINE,		"OFFLINE" },
473 	{ PHYI_IPMP,		"IPMP" }
474 };
475 
476 static uchar_t	ip_six_byte_all_ones[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
477 
478 static ip_m_t   ip_m_tbl[] = {
479 	{ DL_ETHER, IFT_ETHER, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
480 	    ip_ether_v6intfid },
481 	{ DL_CSMACD, IFT_ISO88023, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
482 	    ip_nodef_v6intfid },
483 	{ DL_TPB, IFT_ISO88024, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
484 	    ip_nodef_v6intfid },
485 	{ DL_TPR, IFT_ISO88025, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
486 	    ip_nodef_v6intfid },
487 	{ DL_FDDI, IFT_FDDI, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
488 	    ip_ether_v6intfid },
489 	{ DL_IB, IFT_IB, ip_ib_v4mapinfo, ip_ib_v6mapinfo,
490 	    ip_ib_v6intfid },
491 	{ SUNW_DL_VNI, IFT_OTHER, NULL, NULL, NULL },
492 	{ SUNW_DL_IPMP, IFT_OTHER, NULL, NULL, ip_ipmp_v6intfid },
493 	{ DL_OTHER, IFT_OTHER, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
494 	    ip_nodef_v6intfid }
495 };
496 
497 static ill_t	ill_null;		/* Empty ILL for init. */
498 char	ipif_loopback_name[] = "lo0";
499 static char *ipv4_forward_suffix = ":ip_forwarding";
500 static char *ipv6_forward_suffix = ":ip6_forwarding";
501 static	sin6_t	sin6_null;	/* Zero address for quick clears */
502 static	sin_t	sin_null;	/* Zero address for quick clears */
503 
504 /* When set search for unused ipif_seqid */
505 static ipif_t	ipif_zero;
506 
507 /*
508  * ppa arena is created after these many
509  * interfaces have been plumbed.
510  */
511 uint_t	ill_no_arena = 12;	/* Setable in /etc/system */
512 
513 /*
514  * Allocate per-interface mibs.
515  * Returns true if ok. False otherwise.
516  *  ipsq  may not yet be allocated (loopback case ).
517  */
518 static boolean_t
519 ill_allocate_mibs(ill_t *ill)
520 {
521 	/* Already allocated? */
522 	if (ill->ill_ip_mib != NULL) {
523 		if (ill->ill_isv6)
524 			ASSERT(ill->ill_icmp6_mib != NULL);
525 		return (B_TRUE);
526 	}
527 
528 	ill->ill_ip_mib = kmem_zalloc(sizeof (*ill->ill_ip_mib),
529 	    KM_NOSLEEP);
530 	if (ill->ill_ip_mib == NULL) {
531 		return (B_FALSE);
532 	}
533 
534 	/* Setup static information */
535 	SET_MIB(ill->ill_ip_mib->ipIfStatsEntrySize,
536 	    sizeof (mib2_ipIfStatsEntry_t));
537 	if (ill->ill_isv6) {
538 		ill->ill_ip_mib->ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv6;
539 		SET_MIB(ill->ill_ip_mib->ipIfStatsAddrEntrySize,
540 		    sizeof (mib2_ipv6AddrEntry_t));
541 		SET_MIB(ill->ill_ip_mib->ipIfStatsRouteEntrySize,
542 		    sizeof (mib2_ipv6RouteEntry_t));
543 		SET_MIB(ill->ill_ip_mib->ipIfStatsNetToMediaEntrySize,
544 		    sizeof (mib2_ipv6NetToMediaEntry_t));
545 		SET_MIB(ill->ill_ip_mib->ipIfStatsMemberEntrySize,
546 		    sizeof (ipv6_member_t));
547 		SET_MIB(ill->ill_ip_mib->ipIfStatsGroupSourceEntrySize,
548 		    sizeof (ipv6_grpsrc_t));
549 	} else {
550 		ill->ill_ip_mib->ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv4;
551 		SET_MIB(ill->ill_ip_mib->ipIfStatsAddrEntrySize,
552 		    sizeof (mib2_ipAddrEntry_t));
553 		SET_MIB(ill->ill_ip_mib->ipIfStatsRouteEntrySize,
554 		    sizeof (mib2_ipRouteEntry_t));
555 		SET_MIB(ill->ill_ip_mib->ipIfStatsNetToMediaEntrySize,
556 		    sizeof (mib2_ipNetToMediaEntry_t));
557 		SET_MIB(ill->ill_ip_mib->ipIfStatsMemberEntrySize,
558 		    sizeof (ip_member_t));
559 		SET_MIB(ill->ill_ip_mib->ipIfStatsGroupSourceEntrySize,
560 		    sizeof (ip_grpsrc_t));
561 
562 		/*
563 		 * For a v4 ill, we are done at this point, because per ill
564 		 * icmp mibs are only used for v6.
565 		 */
566 		return (B_TRUE);
567 	}
568 
569 	ill->ill_icmp6_mib = kmem_zalloc(sizeof (*ill->ill_icmp6_mib),
570 	    KM_NOSLEEP);
571 	if (ill->ill_icmp6_mib == NULL) {
572 		kmem_free(ill->ill_ip_mib, sizeof (*ill->ill_ip_mib));
573 		ill->ill_ip_mib = NULL;
574 		return (B_FALSE);
575 	}
576 	/* static icmp info */
577 	ill->ill_icmp6_mib->ipv6IfIcmpEntrySize =
578 	    sizeof (mib2_ipv6IfIcmpEntry_t);
579 	/*
580 	 * The ipIfStatsIfindex and ipv6IfIcmpIndex will be assigned later
581 	 * after the phyint merge occurs in ipif_set_values -> ill_glist_insert
582 	 * -> ill_phyint_reinit
583 	 */
584 	return (B_TRUE);
585 }
586 
587 /*
588  * Common code for preparation of ARP commands.  Two points to remember:
589  * 	1) The ill_name is tacked on at the end of the allocated space so
590  *	   the templates name_offset field must contain the total space
591  *	   to allocate less the name length.
592  *
593  *	2) The templates name_length field should contain the *template*
594  *	   length.  We use it as a parameter to bcopy() and then write
595  *	   the real ill_name_length into the name_length field of the copy.
596  * (Always called as writer.)
597  */
598 mblk_t *
599 ill_arp_alloc(ill_t *ill, const uchar_t *template, caddr_t addr)
600 {
601 	arc_t	*arc = (arc_t *)template;
602 	char	*cp;
603 	int	len;
604 	mblk_t	*mp;
605 	uint_t	name_length = ill->ill_name_length;
606 	uint_t	template_len = arc->arc_name_length;
607 
608 	len = arc->arc_name_offset + name_length;
609 	mp = allocb(len, BPRI_HI);
610 	if (mp == NULL)
611 		return (NULL);
612 	cp = (char *)mp->b_rptr;
613 	mp->b_wptr = (uchar_t *)&cp[len];
614 	if (template_len)
615 		bcopy(template, cp, template_len);
616 	if (len > template_len)
617 		bzero(&cp[template_len], len - template_len);
618 	mp->b_datap->db_type = M_PROTO;
619 
620 	arc = (arc_t *)cp;
621 	arc->arc_name_length = name_length;
622 	cp = (char *)arc + arc->arc_name_offset;
623 	bcopy(ill->ill_name, cp, name_length);
624 
625 	if (addr) {
626 		area_t	*area = (area_t *)mp->b_rptr;
627 
628 		cp = (char *)area + area->area_proto_addr_offset;
629 		bcopy(addr, cp, area->area_proto_addr_length);
630 		if (area->area_cmd == AR_ENTRY_ADD) {
631 			cp = (char *)area;
632 			len = area->area_proto_addr_length;
633 			if (area->area_proto_mask_offset)
634 				cp += area->area_proto_mask_offset;
635 			else
636 				cp += area->area_proto_addr_offset + len;
637 			while (len-- > 0)
638 				*cp++ = (char)~0;
639 		}
640 	}
641 	return (mp);
642 }
643 
644 mblk_t *
645 ipif_area_alloc(ipif_t *ipif, uint_t optflags)
646 {
647 	caddr_t	addr;
648 	mblk_t 	*mp;
649 	area_t	*area;
650 	uchar_t	*areap;
651 	ill_t	*ill = ipif->ipif_ill;
652 
653 	if (ill->ill_isv6) {
654 		ASSERT(ill->ill_flags & ILLF_XRESOLV);
655 		addr = (caddr_t)&ipif->ipif_v6lcl_addr;
656 		areap = (uchar_t *)&ip6_area_template;
657 	} else {
658 		addr = (caddr_t)&ipif->ipif_lcl_addr;
659 		areap = (uchar_t *)&ip_area_template;
660 	}
661 
662 	if ((mp = ill_arp_alloc(ill, areap, addr)) == NULL)
663 		return (NULL);
664 
665 	/*
666 	 * IPMP requires that the hardware address be included in all
667 	 * AR_ENTRY_ADD requests so that ARP can deduce the arl to send on.
668 	 * If there are no active underlying ills in the group (and thus no
669 	 * hardware address, DAD will be deferred until an underlying ill
670 	 * becomes active.
671 	 */
672 	if (IS_IPMP(ill)) {
673 		if ((ill = ipmp_ipif_hold_bound_ill(ipif)) == NULL) {
674 			freemsg(mp);
675 			return (NULL);
676 		}
677 	} else {
678 		ill_refhold(ill);
679 	}
680 
681 	area = (area_t *)mp->b_rptr;
682 	area->area_flags = ACE_F_PERMANENT | ACE_F_PUBLISH | ACE_F_MYADDR;
683 	area->area_flags |= optflags;
684 	area->area_hw_addr_length = ill->ill_phys_addr_length;
685 	bcopy(ill->ill_phys_addr, mp->b_rptr + area->area_hw_addr_offset,
686 	    area->area_hw_addr_length);
687 
688 	ill_refrele(ill);
689 	return (mp);
690 }
691 
692 mblk_t *
693 ipif_ared_alloc(ipif_t *ipif)
694 {
695 	caddr_t	addr;
696 	uchar_t	*aredp;
697 
698 	if (ipif->ipif_ill->ill_isv6) {
699 		ASSERT(ipif->ipif_ill->ill_flags & ILLF_XRESOLV);
700 		addr = (caddr_t)&ipif->ipif_v6lcl_addr;
701 		aredp = (uchar_t *)&ip6_ared_template;
702 	} else {
703 		addr = (caddr_t)&ipif->ipif_lcl_addr;
704 		aredp = (uchar_t *)&ip_ared_template;
705 	}
706 
707 	return (ill_arp_alloc(ipif->ipif_ill, aredp, addr));
708 }
709 
710 mblk_t *
711 ill_ared_alloc(ill_t *ill, ipaddr_t addr)
712 {
713 	return (ill_arp_alloc(ill, (uchar_t *)&ip_ared_template,
714 	    (char *)&addr));
715 }
716 
717 mblk_t *
718 ill_arie_alloc(ill_t *ill, const char *grifname, const void *template)
719 {
720 	mblk_t	*mp = ill_arp_alloc(ill, template, 0);
721 	arie_t	*arie;
722 
723 	if (mp != NULL) {
724 		arie = (arie_t *)mp->b_rptr;
725 		(void) strlcpy(arie->arie_grifname, grifname, LIFNAMSIZ);
726 	}
727 	return (mp);
728 }
729 
730 /*
731  * Completely vaporize a lower level tap and all associated interfaces.
732  * ill_delete is called only out of ip_close when the device control
733  * stream is being closed.
734  */
735 void
736 ill_delete(ill_t *ill)
737 {
738 	ipif_t	*ipif;
739 	ill_t	*prev_ill;
740 	ip_stack_t	*ipst = ill->ill_ipst;
741 
742 	/*
743 	 * ill_delete may be forcibly entering the ipsq. The previous
744 	 * ioctl may not have completed and may need to be aborted.
745 	 * ipsq_flush takes care of it. If we don't need to enter the
746 	 * the ipsq forcibly, the 2nd invocation of ipsq_flush in
747 	 * ill_delete_tail is sufficient.
748 	 */
749 	ipsq_flush(ill);
750 
751 	/*
752 	 * Nuke all interfaces.  ipif_free will take down the interface,
753 	 * remove it from the list, and free the data structure.
754 	 * Walk down the ipif list and remove the logical interfaces
755 	 * first before removing the main ipif. We can't unplumb
756 	 * zeroth interface first in the case of IPv6 as reset_conn_ill
757 	 * -> ip_ll_delmulti_v6 de-references ill_ipif for checking
758 	 * POINTOPOINT.
759 	 *
760 	 * If ill_ipif was not properly initialized (i.e low on memory),
761 	 * then no interfaces to clean up. In this case just clean up the
762 	 * ill.
763 	 */
764 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
765 		ipif_free(ipif);
766 
767 	/*
768 	 * Used only by ill_arp_on and ill_arp_off, which are writers.
769 	 * So nobody can be using this mp now. Free the mp allocated for
770 	 * honoring ILLF_NOARP
771 	 */
772 	freemsg(ill->ill_arp_on_mp);
773 	ill->ill_arp_on_mp = NULL;
774 
775 	/* Clean up msgs on pending upcalls for mrouted */
776 	reset_mrt_ill(ill);
777 
778 	/*
779 	 * ipif_free -> reset_conn_ipif will remove all multicast
780 	 * references for IPv4. For IPv6, we need to do it here as
781 	 * it points only at ills.
782 	 */
783 	reset_conn_ill(ill);
784 
785 	/*
786 	 * Remove multicast references added as a result of calls to
787 	 * ip_join_allmulti().
788 	 */
789 	ip_purge_allmulti(ill);
790 
791 	/*
792 	 * If the ill being deleted is under IPMP, boot it out of the illgrp.
793 	 */
794 	if (IS_UNDER_IPMP(ill))
795 		ipmp_ill_leave_illgrp(ill);
796 
797 	/*
798 	 * ill_down will arrange to blow off any IRE's dependent on this
799 	 * ILL, and shut down fragmentation reassembly.
800 	 */
801 	ill_down(ill);
802 
803 	/* Let SCTP know, so that it can remove this from its list. */
804 	sctp_update_ill(ill, SCTP_ILL_REMOVE);
805 
806 	/*
807 	 * If an address on this ILL is being used as a source address then
808 	 * clear out the pointers in other ILLs that point to this ILL.
809 	 */
810 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
811 	if (ill->ill_usesrc_grp_next != NULL) {
812 		if (ill->ill_usesrc_ifindex == 0) { /* usesrc ILL ? */
813 			ill_disband_usesrc_group(ill);
814 		} else {	/* consumer of the usesrc ILL */
815 			prev_ill = ill_prev_usesrc(ill);
816 			prev_ill->ill_usesrc_grp_next =
817 			    ill->ill_usesrc_grp_next;
818 		}
819 	}
820 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
821 }
822 
823 static void
824 ipif_non_duplicate(ipif_t *ipif)
825 {
826 	ill_t *ill = ipif->ipif_ill;
827 	mutex_enter(&ill->ill_lock);
828 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
829 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
830 		ASSERT(ill->ill_ipif_dup_count > 0);
831 		ill->ill_ipif_dup_count--;
832 	}
833 	mutex_exit(&ill->ill_lock);
834 }
835 
836 /*
837  * ill_delete_tail is called from ip_modclose after all references
838  * to the closing ill are gone. The wait is done in ip_modclose
839  */
840 void
841 ill_delete_tail(ill_t *ill)
842 {
843 	mblk_t	**mpp;
844 	ipif_t	*ipif;
845 	ip_stack_t	*ipst = ill->ill_ipst;
846 
847 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
848 		ipif_non_duplicate(ipif);
849 		ipif_down_tail(ipif);
850 	}
851 
852 	ASSERT(ill->ill_ipif_dup_count == 0 &&
853 	    ill->ill_arp_down_mp == NULL &&
854 	    ill->ill_arp_del_mapping_mp == NULL);
855 
856 	/*
857 	 * If polling capability is enabled (which signifies direct
858 	 * upcall into IP and driver has ill saved as a handle),
859 	 * we need to make sure that unbind has completed before we
860 	 * let the ill disappear and driver no longer has any reference
861 	 * to this ill.
862 	 */
863 	mutex_enter(&ill->ill_lock);
864 	while (ill->ill_state_flags & ILL_DL_UNBIND_IN_PROGRESS)
865 		cv_wait(&ill->ill_cv, &ill->ill_lock);
866 	mutex_exit(&ill->ill_lock);
867 	ASSERT(!(ill->ill_capabilities &
868 	    (ILL_CAPAB_DLD | ILL_CAPAB_DLD_POLL | ILL_CAPAB_DLD_DIRECT)));
869 
870 	if (ill->ill_net_type != IRE_LOOPBACK)
871 		qprocsoff(ill->ill_rq);
872 
873 	/*
874 	 * We do an ipsq_flush once again now. New messages could have
875 	 * landed up from below (M_ERROR or M_HANGUP). Similarly ioctls
876 	 * could also have landed up if an ioctl thread had looked up
877 	 * the ill before we set the ILL_CONDEMNED flag, but not yet
878 	 * enqueued the ioctl when we did the ipsq_flush last time.
879 	 */
880 	ipsq_flush(ill);
881 
882 	/*
883 	 * Free capabilities.
884 	 */
885 	if (ill->ill_ipsec_capab_ah != NULL) {
886 		ill_ipsec_capab_delete(ill, DL_CAPAB_IPSEC_AH);
887 		ill_ipsec_capab_free(ill->ill_ipsec_capab_ah);
888 		ill->ill_ipsec_capab_ah = NULL;
889 	}
890 
891 	if (ill->ill_ipsec_capab_esp != NULL) {
892 		ill_ipsec_capab_delete(ill, DL_CAPAB_IPSEC_ESP);
893 		ill_ipsec_capab_free(ill->ill_ipsec_capab_esp);
894 		ill->ill_ipsec_capab_esp = NULL;
895 	}
896 
897 	if (ill->ill_mdt_capab != NULL) {
898 		kmem_free(ill->ill_mdt_capab, sizeof (ill_mdt_capab_t));
899 		ill->ill_mdt_capab = NULL;
900 	}
901 
902 	if (ill->ill_hcksum_capab != NULL) {
903 		kmem_free(ill->ill_hcksum_capab, sizeof (ill_hcksum_capab_t));
904 		ill->ill_hcksum_capab = NULL;
905 	}
906 
907 	if (ill->ill_zerocopy_capab != NULL) {
908 		kmem_free(ill->ill_zerocopy_capab,
909 		    sizeof (ill_zerocopy_capab_t));
910 		ill->ill_zerocopy_capab = NULL;
911 	}
912 
913 	if (ill->ill_lso_capab != NULL) {
914 		kmem_free(ill->ill_lso_capab, sizeof (ill_lso_capab_t));
915 		ill->ill_lso_capab = NULL;
916 	}
917 
918 	if (ill->ill_dld_capab != NULL) {
919 		kmem_free(ill->ill_dld_capab, sizeof (ill_dld_capab_t));
920 		ill->ill_dld_capab = NULL;
921 	}
922 
923 	while (ill->ill_ipif != NULL)
924 		ipif_free_tail(ill->ill_ipif);
925 
926 	/*
927 	 * We have removed all references to ilm from conn and the ones joined
928 	 * within the kernel.
929 	 *
930 	 * We don't walk conns, mrts and ires because
931 	 *
932 	 * 1) reset_conn_ill and reset_mrt_ill cleans up conns and mrts.
933 	 * 2) ill_down ->ill_downi walks all the ires and cleans up
934 	 *    ill references.
935 	 */
936 	ASSERT(ilm_walk_ill(ill) == 0);
937 
938 	/*
939 	 * If this ill is an IPMP meta-interface, blow away the illgrp.  This
940 	 * is safe to do because the illgrp has already been unlinked from the
941 	 * group by I_PUNLINK, and thus SIOCSLIFGROUPNAME cannot find it.
942 	 */
943 	if (IS_IPMP(ill)) {
944 		ipmp_illgrp_destroy(ill->ill_grp);
945 		ill->ill_grp = NULL;
946 	}
947 
948 	/*
949 	 * Take us out of the list of ILLs. ill_glist_delete -> phyint_free
950 	 * could free the phyint. No more reference to the phyint after this
951 	 * point.
952 	 */
953 	(void) ill_glist_delete(ill);
954 
955 	rw_enter(&ipst->ips_ip_g_nd_lock, RW_WRITER);
956 	if (ill->ill_ndd_name != NULL)
957 		nd_unload(&ipst->ips_ip_g_nd, ill->ill_ndd_name);
958 	rw_exit(&ipst->ips_ip_g_nd_lock);
959 
960 	if (ill->ill_frag_ptr != NULL) {
961 		uint_t count;
962 
963 		for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
964 			mutex_destroy(&ill->ill_frag_hash_tbl[count].ipfb_lock);
965 		}
966 		mi_free(ill->ill_frag_ptr);
967 		ill->ill_frag_ptr = NULL;
968 		ill->ill_frag_hash_tbl = NULL;
969 	}
970 
971 	freemsg(ill->ill_nd_lla_mp);
972 	/* Free all retained control messages. */
973 	mpp = &ill->ill_first_mp_to_free;
974 	do {
975 		while (mpp[0]) {
976 			mblk_t  *mp;
977 			mblk_t  *mp1;
978 
979 			mp = mpp[0];
980 			mpp[0] = mp->b_next;
981 			for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont) {
982 				mp1->b_next = NULL;
983 				mp1->b_prev = NULL;
984 			}
985 			freemsg(mp);
986 		}
987 	} while (mpp++ != &ill->ill_last_mp_to_free);
988 
989 	ill_free_mib(ill);
990 
991 #ifdef DEBUG
992 	ill_trace_cleanup(ill);
993 #endif
994 
995 	/* Drop refcnt here */
996 	netstack_rele(ill->ill_ipst->ips_netstack);
997 	ill->ill_ipst = NULL;
998 }
999 
1000 static void
1001 ill_free_mib(ill_t *ill)
1002 {
1003 	ip_stack_t *ipst = ill->ill_ipst;
1004 
1005 	/*
1006 	 * MIB statistics must not be lost, so when an interface
1007 	 * goes away the counter values will be added to the global
1008 	 * MIBs.
1009 	 */
1010 	if (ill->ill_ip_mib != NULL) {
1011 		if (ill->ill_isv6) {
1012 			ip_mib2_add_ip_stats(&ipst->ips_ip6_mib,
1013 			    ill->ill_ip_mib);
1014 		} else {
1015 			ip_mib2_add_ip_stats(&ipst->ips_ip_mib,
1016 			    ill->ill_ip_mib);
1017 		}
1018 
1019 		kmem_free(ill->ill_ip_mib, sizeof (*ill->ill_ip_mib));
1020 		ill->ill_ip_mib = NULL;
1021 	}
1022 	if (ill->ill_icmp6_mib != NULL) {
1023 		ip_mib2_add_icmp6_stats(&ipst->ips_icmp6_mib,
1024 		    ill->ill_icmp6_mib);
1025 		kmem_free(ill->ill_icmp6_mib, sizeof (*ill->ill_icmp6_mib));
1026 		ill->ill_icmp6_mib = NULL;
1027 	}
1028 }
1029 
1030 /*
1031  * Concatenate together a physical address and a sap.
1032  *
1033  * Sap_lengths are interpreted as follows:
1034  *   sap_length == 0	==>	no sap
1035  *   sap_length > 0	==>	sap is at the head of the dlpi address
1036  *   sap_length < 0	==>	sap is at the tail of the dlpi address
1037  */
1038 static void
1039 ill_dlur_copy_address(uchar_t *phys_src, uint_t phys_length,
1040     t_scalar_t sap_src, t_scalar_t sap_length, uchar_t *dst)
1041 {
1042 	uint16_t sap_addr = (uint16_t)sap_src;
1043 
1044 	if (sap_length == 0) {
1045 		if (phys_src == NULL)
1046 			bzero(dst, phys_length);
1047 		else
1048 			bcopy(phys_src, dst, phys_length);
1049 	} else if (sap_length < 0) {
1050 		if (phys_src == NULL)
1051 			bzero(dst, phys_length);
1052 		else
1053 			bcopy(phys_src, dst, phys_length);
1054 		bcopy(&sap_addr, (char *)dst + phys_length, sizeof (sap_addr));
1055 	} else {
1056 		bcopy(&sap_addr, dst, sizeof (sap_addr));
1057 		if (phys_src == NULL)
1058 			bzero((char *)dst + sap_length, phys_length);
1059 		else
1060 			bcopy(phys_src, (char *)dst + sap_length, phys_length);
1061 	}
1062 }
1063 
1064 /*
1065  * Generate a dl_unitdata_req mblk for the device and address given.
1066  * addr_length is the length of the physical portion of the address.
1067  * If addr is NULL include an all zero address of the specified length.
1068  * TRUE? In any case, addr_length is taken to be the entire length of the
1069  * dlpi address, including the absolute value of sap_length.
1070  */
1071 mblk_t *
1072 ill_dlur_gen(uchar_t *addr, uint_t addr_length, t_uscalar_t sap,
1073 		t_scalar_t sap_length)
1074 {
1075 	dl_unitdata_req_t *dlur;
1076 	mblk_t	*mp;
1077 	t_scalar_t	abs_sap_length;		/* absolute value */
1078 
1079 	abs_sap_length = ABS(sap_length);
1080 	mp = ip_dlpi_alloc(sizeof (*dlur) + addr_length + abs_sap_length,
1081 	    DL_UNITDATA_REQ);
1082 	if (mp == NULL)
1083 		return (NULL);
1084 	dlur = (dl_unitdata_req_t *)mp->b_rptr;
1085 	/* HACK: accomodate incompatible DLPI drivers */
1086 	if (addr_length == 8)
1087 		addr_length = 6;
1088 	dlur->dl_dest_addr_length = addr_length + abs_sap_length;
1089 	dlur->dl_dest_addr_offset = sizeof (*dlur);
1090 	dlur->dl_priority.dl_min = 0;
1091 	dlur->dl_priority.dl_max = 0;
1092 	ill_dlur_copy_address(addr, addr_length, sap, sap_length,
1093 	    (uchar_t *)&dlur[1]);
1094 	return (mp);
1095 }
1096 
1097 /*
1098  * Add the 'mp' to the list of pending mp's headed by ill_pending_mp
1099  * Return an error if we already have 1 or more ioctls in progress.
1100  * This is used only for non-exclusive ioctls. Currently this is used
1101  * for SIOC*ARP and SIOCGTUNPARAM ioctls. Most set ioctls are exclusive
1102  * and thus need to use ipsq_pending_mp_add.
1103  */
1104 boolean_t
1105 ill_pending_mp_add(ill_t *ill, conn_t *connp, mblk_t *add_mp)
1106 {
1107 	ASSERT(MUTEX_HELD(&ill->ill_lock));
1108 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
1109 	/*
1110 	 * M_IOCDATA from ioctls, M_IOCTL from tunnel ioctls.
1111 	 */
1112 	ASSERT((add_mp->b_datap->db_type == M_IOCDATA) ||
1113 	    (add_mp->b_datap->db_type == M_IOCTL));
1114 
1115 	ASSERT(MUTEX_HELD(&connp->conn_lock));
1116 	/*
1117 	 * Return error if the conn has started closing. The conn
1118 	 * could have finished cleaning up the pending mp list,
1119 	 * If so we should not add another mp to the list negating
1120 	 * the cleanup.
1121 	 */
1122 	if (connp->conn_state_flags & CONN_CLOSING)
1123 		return (B_FALSE);
1124 	/*
1125 	 * Add the pending mp to the head of the list, chained by b_next.
1126 	 * Note down the conn on which the ioctl request came, in b_prev.
1127 	 * This will be used to later get the conn, when we get a response
1128 	 * on the ill queue, from some other module (typically arp)
1129 	 */
1130 	add_mp->b_next = (void *)ill->ill_pending_mp;
1131 	add_mp->b_queue = CONNP_TO_WQ(connp);
1132 	ill->ill_pending_mp = add_mp;
1133 	if (connp != NULL)
1134 		connp->conn_oper_pending_ill = ill;
1135 	return (B_TRUE);
1136 }
1137 
1138 /*
1139  * Retrieve the ill_pending_mp and return it. We have to walk the list
1140  * of mblks starting at ill_pending_mp, and match based on the ioc_id.
1141  */
1142 mblk_t *
1143 ill_pending_mp_get(ill_t *ill, conn_t **connpp, uint_t ioc_id)
1144 {
1145 	mblk_t	*prev = NULL;
1146 	mblk_t	*curr = NULL;
1147 	uint_t	id;
1148 	conn_t	*connp;
1149 
1150 	/*
1151 	 * When the conn closes, conn_ioctl_cleanup needs to clean
1152 	 * up the pending mp, but it does not know the ioc_id and
1153 	 * passes in a zero for it.
1154 	 */
1155 	mutex_enter(&ill->ill_lock);
1156 	if (ioc_id != 0)
1157 		*connpp = NULL;
1158 
1159 	/* Search the list for the appropriate ioctl based on ioc_id */
1160 	for (prev = NULL, curr = ill->ill_pending_mp; curr != NULL;
1161 	    prev = curr, curr = curr->b_next) {
1162 		id = ((struct iocblk *)curr->b_rptr)->ioc_id;
1163 		connp = Q_TO_CONN(curr->b_queue);
1164 		/* Match based on the ioc_id or based on the conn */
1165 		if ((id == ioc_id) || (ioc_id == 0 && connp == *connpp))
1166 			break;
1167 	}
1168 
1169 	if (curr != NULL) {
1170 		/* Unlink the mblk from the pending mp list */
1171 		if (prev != NULL) {
1172 			prev->b_next = curr->b_next;
1173 		} else {
1174 			ASSERT(ill->ill_pending_mp == curr);
1175 			ill->ill_pending_mp = curr->b_next;
1176 		}
1177 
1178 		/*
1179 		 * conn refcnt must have been bumped up at the start of
1180 		 * the ioctl. So we can safely access the conn.
1181 		 */
1182 		ASSERT(CONN_Q(curr->b_queue));
1183 		*connpp = Q_TO_CONN(curr->b_queue);
1184 		curr->b_next = NULL;
1185 		curr->b_queue = NULL;
1186 	}
1187 
1188 	mutex_exit(&ill->ill_lock);
1189 
1190 	return (curr);
1191 }
1192 
1193 /*
1194  * Add the pending mp to the list. There can be only 1 pending mp
1195  * in the list. Any exclusive ioctl that needs to wait for a response
1196  * from another module or driver needs to use this function to set
1197  * the ipx_pending_mp to the ioctl mblk and wait for the response from
1198  * the other module/driver. This is also used while waiting for the
1199  * ipif/ill/ire refcnts to drop to zero in bringing down an ipif.
1200  */
1201 boolean_t
1202 ipsq_pending_mp_add(conn_t *connp, ipif_t *ipif, queue_t *q, mblk_t *add_mp,
1203     int waitfor)
1204 {
1205 	ipxop_t	*ipx = ipif->ipif_ill->ill_phyint->phyint_ipsq->ipsq_xop;
1206 
1207 	ASSERT(IAM_WRITER_IPIF(ipif));
1208 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
1209 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
1210 	ASSERT(ipx->ipx_pending_mp == NULL);
1211 	/*
1212 	 * The caller may be using a different ipif than the one passed into
1213 	 * ipsq_current_start() (e.g., suppose an ioctl that came in on the V4
1214 	 * ill needs to wait for the V6 ill to quiesce).  So we can't ASSERT
1215 	 * that `ipx_current_ipif == ipif'.
1216 	 */
1217 	ASSERT(ipx->ipx_current_ipif != NULL);
1218 
1219 	/*
1220 	 * M_IOCDATA from ioctls, M_IOCTL from tunnel ioctls,
1221 	 * M_ERROR/M_HANGUP/M_PROTO/M_PCPROTO from the driver.
1222 	 */
1223 	ASSERT((DB_TYPE(add_mp) == M_IOCDATA) || (DB_TYPE(add_mp) == M_IOCTL) ||
1224 	    (DB_TYPE(add_mp) == M_ERROR) || (DB_TYPE(add_mp) == M_HANGUP) ||
1225 	    (DB_TYPE(add_mp) == M_PROTO) || (DB_TYPE(add_mp) == M_PCPROTO));
1226 
1227 	if (connp != NULL) {
1228 		ASSERT(MUTEX_HELD(&connp->conn_lock));
1229 		/*
1230 		 * Return error if the conn has started closing. The conn
1231 		 * could have finished cleaning up the pending mp list,
1232 		 * If so we should not add another mp to the list negating
1233 		 * the cleanup.
1234 		 */
1235 		if (connp->conn_state_flags & CONN_CLOSING)
1236 			return (B_FALSE);
1237 	}
1238 	mutex_enter(&ipx->ipx_lock);
1239 	ipx->ipx_pending_ipif = ipif;
1240 	/*
1241 	 * Note down the queue in b_queue. This will be returned by
1242 	 * ipsq_pending_mp_get. Caller will then use these values to restart
1243 	 * the processing
1244 	 */
1245 	add_mp->b_next = NULL;
1246 	add_mp->b_queue = q;
1247 	ipx->ipx_pending_mp = add_mp;
1248 	ipx->ipx_waitfor = waitfor;
1249 	mutex_exit(&ipx->ipx_lock);
1250 
1251 	if (connp != NULL)
1252 		connp->conn_oper_pending_ill = ipif->ipif_ill;
1253 
1254 	return (B_TRUE);
1255 }
1256 
1257 /*
1258  * Retrieve the ipx_pending_mp and return it. There can be only 1 mp
1259  * queued in the list.
1260  */
1261 mblk_t *
1262 ipsq_pending_mp_get(ipsq_t *ipsq, conn_t **connpp)
1263 {
1264 	mblk_t	*curr = NULL;
1265 	ipxop_t	*ipx = ipsq->ipsq_xop;
1266 
1267 	*connpp = NULL;
1268 	mutex_enter(&ipx->ipx_lock);
1269 	if (ipx->ipx_pending_mp == NULL) {
1270 		mutex_exit(&ipx->ipx_lock);
1271 		return (NULL);
1272 	}
1273 
1274 	/* There can be only 1 such excl message */
1275 	curr = ipx->ipx_pending_mp;
1276 	ASSERT(curr->b_next == NULL);
1277 	ipx->ipx_pending_ipif = NULL;
1278 	ipx->ipx_pending_mp = NULL;
1279 	ipx->ipx_waitfor = 0;
1280 	mutex_exit(&ipx->ipx_lock);
1281 
1282 	if (CONN_Q(curr->b_queue)) {
1283 		/*
1284 		 * This mp did a refhold on the conn, at the start of the ioctl.
1285 		 * So we can safely return a pointer to the conn to the caller.
1286 		 */
1287 		*connpp = Q_TO_CONN(curr->b_queue);
1288 	} else {
1289 		*connpp = NULL;
1290 	}
1291 	curr->b_next = NULL;
1292 	curr->b_prev = NULL;
1293 	return (curr);
1294 }
1295 
1296 /*
1297  * Cleanup the ioctl mp queued in ipx_pending_mp
1298  * - Called in the ill_delete path
1299  * - Called in the M_ERROR or M_HANGUP path on the ill.
1300  * - Called in the conn close path.
1301  */
1302 boolean_t
1303 ipsq_pending_mp_cleanup(ill_t *ill, conn_t *connp)
1304 {
1305 	mblk_t	*mp;
1306 	ipxop_t	*ipx;
1307 	queue_t	*q;
1308 	ipif_t	*ipif;
1309 
1310 	ASSERT(IAM_WRITER_ILL(ill));
1311 	ipx = ill->ill_phyint->phyint_ipsq->ipsq_xop;
1312 
1313 	/*
1314 	 * If connp is null, unconditionally clean up the ipx_pending_mp.
1315 	 * This happens in M_ERROR/M_HANGUP. We need to abort the current ioctl
1316 	 * even if it is meant for another ill, since we have to enqueue
1317 	 * a new mp now in ipx_pending_mp to complete the ipif_down.
1318 	 * If connp is non-null we are called from the conn close path.
1319 	 */
1320 	mutex_enter(&ipx->ipx_lock);
1321 	mp = ipx->ipx_pending_mp;
1322 	if (mp == NULL || (connp != NULL &&
1323 	    mp->b_queue != CONNP_TO_WQ(connp))) {
1324 		mutex_exit(&ipx->ipx_lock);
1325 		return (B_FALSE);
1326 	}
1327 	/* Now remove from the ipx_pending_mp */
1328 	ipx->ipx_pending_mp = NULL;
1329 	q = mp->b_queue;
1330 	mp->b_next = NULL;
1331 	mp->b_prev = NULL;
1332 	mp->b_queue = NULL;
1333 
1334 	ipif = ipx->ipx_pending_ipif;
1335 	ipx->ipx_pending_ipif = NULL;
1336 	ipx->ipx_waitfor = 0;
1337 	ipx->ipx_current_ipif = NULL;
1338 	ipx->ipx_current_ioctl = 0;
1339 	ipx->ipx_current_done = B_TRUE;
1340 	mutex_exit(&ipx->ipx_lock);
1341 
1342 	if (DB_TYPE(mp) == M_IOCTL || DB_TYPE(mp) == M_IOCDATA) {
1343 		if (connp == NULL) {
1344 			ip_ioctl_finish(q, mp, ENXIO, NO_COPYOUT, NULL);
1345 		} else {
1346 			ip_ioctl_finish(q, mp, ENXIO, CONN_CLOSE, NULL);
1347 			mutex_enter(&ipif->ipif_ill->ill_lock);
1348 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
1349 			mutex_exit(&ipif->ipif_ill->ill_lock);
1350 		}
1351 	} else {
1352 		/*
1353 		 * IP-MT XXX In the case of TLI/XTI bind / optmgmt this can't
1354 		 * be just inet_freemsg. we have to restart it
1355 		 * otherwise the thread will be stuck.
1356 		 */
1357 		inet_freemsg(mp);
1358 	}
1359 	return (B_TRUE);
1360 }
1361 
1362 /*
1363  * The ill is closing. Cleanup all the pending mps. Called exclusively
1364  * towards the end of ill_delete. The refcount has gone to 0. So nobody
1365  * knows this ill, and hence nobody can add an mp to this list
1366  */
1367 static void
1368 ill_pending_mp_cleanup(ill_t *ill)
1369 {
1370 	mblk_t	*mp;
1371 	queue_t	*q;
1372 
1373 	ASSERT(IAM_WRITER_ILL(ill));
1374 
1375 	mutex_enter(&ill->ill_lock);
1376 	/*
1377 	 * Every mp on the pending mp list originating from an ioctl
1378 	 * added 1 to the conn refcnt, at the start of the ioctl.
1379 	 * So bump it down now.  See comments in ip_wput_nondata()
1380 	 */
1381 	while (ill->ill_pending_mp != NULL) {
1382 		mp = ill->ill_pending_mp;
1383 		ill->ill_pending_mp = mp->b_next;
1384 		mutex_exit(&ill->ill_lock);
1385 
1386 		q = mp->b_queue;
1387 		ASSERT(CONN_Q(q));
1388 		mp->b_next = NULL;
1389 		mp->b_prev = NULL;
1390 		mp->b_queue = NULL;
1391 		ip_ioctl_finish(q, mp, ENXIO, NO_COPYOUT, NULL);
1392 		mutex_enter(&ill->ill_lock);
1393 	}
1394 	ill->ill_pending_ipif = NULL;
1395 
1396 	mutex_exit(&ill->ill_lock);
1397 }
1398 
1399 /*
1400  * Called in the conn close path and ill delete path
1401  */
1402 static void
1403 ipsq_xopq_mp_cleanup(ill_t *ill, conn_t *connp)
1404 {
1405 	ipsq_t	*ipsq;
1406 	mblk_t	*prev;
1407 	mblk_t	*curr;
1408 	mblk_t	*next;
1409 	queue_t	*q;
1410 	mblk_t	*tmp_list = NULL;
1411 
1412 	ASSERT(IAM_WRITER_ILL(ill));
1413 	if (connp != NULL)
1414 		q = CONNP_TO_WQ(connp);
1415 	else
1416 		q = ill->ill_wq;
1417 
1418 	ipsq = ill->ill_phyint->phyint_ipsq;
1419 	/*
1420 	 * Cleanup the ioctl mp's queued in ipsq_xopq_pending_mp if any.
1421 	 * In the case of ioctl from a conn, there can be only 1 mp
1422 	 * queued on the ipsq. If an ill is being unplumbed, only messages
1423 	 * related to this ill are flushed, like M_ERROR or M_HANGUP message.
1424 	 * ioctls meant for this ill form conn's are not flushed. They will
1425 	 * be processed during ipsq_exit and will not find the ill and will
1426 	 * return error.
1427 	 */
1428 	mutex_enter(&ipsq->ipsq_lock);
1429 	for (prev = NULL, curr = ipsq->ipsq_xopq_mphead; curr != NULL;
1430 	    curr = next) {
1431 		next = curr->b_next;
1432 		if (curr->b_queue == q || curr->b_queue == RD(q)) {
1433 			/* Unlink the mblk from the pending mp list */
1434 			if (prev != NULL) {
1435 				prev->b_next = curr->b_next;
1436 			} else {
1437 				ASSERT(ipsq->ipsq_xopq_mphead == curr);
1438 				ipsq->ipsq_xopq_mphead = curr->b_next;
1439 			}
1440 			if (ipsq->ipsq_xopq_mptail == curr)
1441 				ipsq->ipsq_xopq_mptail = prev;
1442 			/*
1443 			 * Create a temporary list and release the ipsq lock
1444 			 * New elements are added to the head of the tmp_list
1445 			 */
1446 			curr->b_next = tmp_list;
1447 			tmp_list = curr;
1448 		} else {
1449 			prev = curr;
1450 		}
1451 	}
1452 	mutex_exit(&ipsq->ipsq_lock);
1453 
1454 	while (tmp_list != NULL) {
1455 		curr = tmp_list;
1456 		tmp_list = curr->b_next;
1457 		curr->b_next = NULL;
1458 		curr->b_prev = NULL;
1459 		curr->b_queue = NULL;
1460 		if (DB_TYPE(curr) == M_IOCTL || DB_TYPE(curr) == M_IOCDATA) {
1461 			ip_ioctl_finish(q, curr, ENXIO, connp != NULL ?
1462 			    CONN_CLOSE : NO_COPYOUT, NULL);
1463 		} else {
1464 			/*
1465 			 * IP-MT XXX In the case of TLI/XTI bind / optmgmt
1466 			 * this can't be just inet_freemsg. we have to
1467 			 * restart it otherwise the thread will be stuck.
1468 			 */
1469 			inet_freemsg(curr);
1470 		}
1471 	}
1472 }
1473 
1474 /*
1475  * This conn has started closing. Cleanup any pending ioctl from this conn.
1476  * STREAMS ensures that there can be at most 1 ioctl pending on a stream.
1477  */
1478 void
1479 conn_ioctl_cleanup(conn_t *connp)
1480 {
1481 	mblk_t *curr;
1482 	ipsq_t	*ipsq;
1483 	ill_t	*ill;
1484 	boolean_t refheld;
1485 
1486 	/*
1487 	 * Is any exclusive ioctl pending ? If so clean it up. If the
1488 	 * ioctl has not yet started, the mp is pending in the list headed by
1489 	 * ipsq_xopq_head. If the ioctl has started the mp could be present in
1490 	 * ipx_pending_mp. If the ioctl timed out in the streamhead but
1491 	 * is currently executing now the mp is not queued anywhere but
1492 	 * conn_oper_pending_ill is null. The conn close will wait
1493 	 * till the conn_ref drops to zero.
1494 	 */
1495 	mutex_enter(&connp->conn_lock);
1496 	ill = connp->conn_oper_pending_ill;
1497 	if (ill == NULL) {
1498 		mutex_exit(&connp->conn_lock);
1499 		return;
1500 	}
1501 
1502 	curr = ill_pending_mp_get(ill, &connp, 0);
1503 	if (curr != NULL) {
1504 		mutex_exit(&connp->conn_lock);
1505 		CONN_DEC_REF(connp);
1506 		inet_freemsg(curr);
1507 		return;
1508 	}
1509 	/*
1510 	 * We may not be able to refhold the ill if the ill/ipif
1511 	 * is changing. But we need to make sure that the ill will
1512 	 * not vanish. So we just bump up the ill_waiter count.
1513 	 */
1514 	refheld = ill_waiter_inc(ill);
1515 	mutex_exit(&connp->conn_lock);
1516 	if (refheld) {
1517 		if (ipsq_enter(ill, B_TRUE, NEW_OP)) {
1518 			ill_waiter_dcr(ill);
1519 			/*
1520 			 * Check whether this ioctl has started and is
1521 			 * pending. If it is not found there then check
1522 			 * whether this ioctl has not even started and is in
1523 			 * the ipsq_xopq list.
1524 			 */
1525 			if (!ipsq_pending_mp_cleanup(ill, connp))
1526 				ipsq_xopq_mp_cleanup(ill, connp);
1527 			ipsq = ill->ill_phyint->phyint_ipsq;
1528 			ipsq_exit(ipsq);
1529 			return;
1530 		}
1531 	}
1532 
1533 	/*
1534 	 * The ill is also closing and we could not bump up the
1535 	 * ill_waiter_count or we could not enter the ipsq. Leave
1536 	 * the cleanup to ill_delete
1537 	 */
1538 	mutex_enter(&connp->conn_lock);
1539 	while (connp->conn_oper_pending_ill != NULL)
1540 		cv_wait(&connp->conn_refcv, &connp->conn_lock);
1541 	mutex_exit(&connp->conn_lock);
1542 	if (refheld)
1543 		ill_waiter_dcr(ill);
1544 }
1545 
1546 /*
1547  * ipcl_walk function for cleaning up conn_*_ill fields.
1548  */
1549 static void
1550 conn_cleanup_ill(conn_t *connp, caddr_t arg)
1551 {
1552 	ill_t	*ill = (ill_t *)arg;
1553 	ire_t	*ire;
1554 
1555 	mutex_enter(&connp->conn_lock);
1556 	if (connp->conn_multicast_ill == ill) {
1557 		/* Revert to late binding */
1558 		connp->conn_multicast_ill = NULL;
1559 	}
1560 	if (connp->conn_incoming_ill == ill)
1561 		connp->conn_incoming_ill = NULL;
1562 	if (connp->conn_outgoing_ill == ill)
1563 		connp->conn_outgoing_ill = NULL;
1564 	if (connp->conn_dhcpinit_ill == ill) {
1565 		connp->conn_dhcpinit_ill = NULL;
1566 		ASSERT(ill->ill_dhcpinit != 0);
1567 		atomic_dec_32(&ill->ill_dhcpinit);
1568 	}
1569 	if (connp->conn_ire_cache != NULL) {
1570 		ire = connp->conn_ire_cache;
1571 		/*
1572 		 * Source address selection makes it possible for IRE_CACHE
1573 		 * entries to be created with ire_stq coming from interface X
1574 		 * and ipif coming from interface Y.  Thus whenever interface
1575 		 * X goes down, remove all references to it by checking both
1576 		 * on ire_ipif and ire_stq.
1577 		 */
1578 		if ((ire->ire_ipif != NULL && ire->ire_ipif->ipif_ill == ill) ||
1579 		    (ire->ire_type == IRE_CACHE &&
1580 		    ire->ire_stq == ill->ill_wq)) {
1581 			connp->conn_ire_cache = NULL;
1582 			mutex_exit(&connp->conn_lock);
1583 			ire_refrele_notr(ire);
1584 			return;
1585 		}
1586 	}
1587 	mutex_exit(&connp->conn_lock);
1588 }
1589 
1590 /* ARGSUSED */
1591 void
1592 ipif_all_down_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
1593 {
1594 	ill_t	*ill = q->q_ptr;
1595 	ipif_t	*ipif;
1596 
1597 	ASSERT(IAM_WRITER_IPSQ(ipsq));
1598 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
1599 		ipif_non_duplicate(ipif);
1600 		ipif_down_tail(ipif);
1601 	}
1602 	freemsg(mp);
1603 	ipsq_current_finish(ipsq);
1604 }
1605 
1606 /*
1607  * ill_down_start is called when we want to down this ill and bring it up again
1608  * It is called when we receive an M_ERROR / M_HANGUP. In this case we shut down
1609  * all interfaces, but don't tear down any plumbing.
1610  */
1611 boolean_t
1612 ill_down_start(queue_t *q, mblk_t *mp)
1613 {
1614 	ill_t	*ill = q->q_ptr;
1615 	ipif_t	*ipif;
1616 
1617 	ASSERT(IAM_WRITER_ILL(ill));
1618 
1619 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
1620 		(void) ipif_down(ipif, NULL, NULL);
1621 
1622 	ill_down(ill);
1623 
1624 	(void) ipsq_pending_mp_cleanup(ill, NULL);
1625 
1626 	ipsq_current_start(ill->ill_phyint->phyint_ipsq, ill->ill_ipif, 0);
1627 
1628 	/*
1629 	 * Atomically test and add the pending mp if references are active.
1630 	 */
1631 	mutex_enter(&ill->ill_lock);
1632 	if (!ill_is_quiescent(ill)) {
1633 		/* call cannot fail since `conn_t *' argument is NULL */
1634 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
1635 		    mp, ILL_DOWN);
1636 		mutex_exit(&ill->ill_lock);
1637 		return (B_FALSE);
1638 	}
1639 	mutex_exit(&ill->ill_lock);
1640 	return (B_TRUE);
1641 }
1642 
1643 static void
1644 ill_down(ill_t *ill)
1645 {
1646 	ip_stack_t	*ipst = ill->ill_ipst;
1647 
1648 	/* Blow off any IREs dependent on this ILL. */
1649 	ire_walk(ill_downi, ill, ipst);
1650 
1651 	/* Remove any conn_*_ill depending on this ill */
1652 	ipcl_walk(conn_cleanup_ill, (caddr_t)ill, ipst);
1653 }
1654 
1655 /*
1656  * ire_walk routine used to delete every IRE that depends on queues
1657  * associated with 'ill'.  (Always called as writer.)
1658  */
1659 static void
1660 ill_downi(ire_t *ire, char *ill_arg)
1661 {
1662 	ill_t	*ill = (ill_t *)ill_arg;
1663 
1664 	/*
1665 	 * Source address selection makes it possible for IRE_CACHE
1666 	 * entries to be created with ire_stq coming from interface X
1667 	 * and ipif coming from interface Y.  Thus whenever interface
1668 	 * X goes down, remove all references to it by checking both
1669 	 * on ire_ipif and ire_stq.
1670 	 */
1671 	if ((ire->ire_ipif != NULL && ire->ire_ipif->ipif_ill == ill) ||
1672 	    (ire->ire_type == IRE_CACHE && ire->ire_stq == ill->ill_wq)) {
1673 		ire_delete(ire);
1674 	}
1675 }
1676 
1677 /*
1678  * Remove ire/nce from the fastpath list.
1679  */
1680 void
1681 ill_fastpath_nack(ill_t *ill)
1682 {
1683 	nce_fastpath_list_dispatch(ill, NULL, NULL);
1684 }
1685 
1686 /* Consume an M_IOCACK of the fastpath probe. */
1687 void
1688 ill_fastpath_ack(ill_t *ill, mblk_t *mp)
1689 {
1690 	mblk_t	*mp1 = mp;
1691 
1692 	/*
1693 	 * If this was the first attempt turn on the fastpath probing.
1694 	 */
1695 	mutex_enter(&ill->ill_lock);
1696 	if (ill->ill_dlpi_fastpath_state == IDS_INPROGRESS)
1697 		ill->ill_dlpi_fastpath_state = IDS_OK;
1698 	mutex_exit(&ill->ill_lock);
1699 
1700 	/* Free the M_IOCACK mblk, hold on to the data */
1701 	mp = mp->b_cont;
1702 	freeb(mp1);
1703 	if (mp == NULL)
1704 		return;
1705 	if (mp->b_cont != NULL) {
1706 		/*
1707 		 * Update all IRE's or NCE's that are waiting for
1708 		 * fastpath update.
1709 		 */
1710 		nce_fastpath_list_dispatch(ill, ndp_fastpath_update, mp);
1711 		mp1 = mp->b_cont;
1712 		freeb(mp);
1713 		mp = mp1;
1714 	} else {
1715 		ip0dbg(("ill_fastpath_ack:  no b_cont\n"));
1716 	}
1717 
1718 	freeb(mp);
1719 }
1720 
1721 /*
1722  * Throw an M_IOCTL message downstream asking "do you know fastpath?"
1723  * The data portion of the request is a dl_unitdata_req_t template for
1724  * what we would send downstream in the absence of a fastpath confirmation.
1725  */
1726 int
1727 ill_fastpath_probe(ill_t *ill, mblk_t *dlur_mp)
1728 {
1729 	struct iocblk	*ioc;
1730 	mblk_t	*mp;
1731 
1732 	if (dlur_mp == NULL)
1733 		return (EINVAL);
1734 
1735 	mutex_enter(&ill->ill_lock);
1736 	switch (ill->ill_dlpi_fastpath_state) {
1737 	case IDS_FAILED:
1738 		/*
1739 		 * Driver NAKed the first fastpath ioctl - assume it doesn't
1740 		 * support it.
1741 		 */
1742 		mutex_exit(&ill->ill_lock);
1743 		return (ENOTSUP);
1744 	case IDS_UNKNOWN:
1745 		/* This is the first probe */
1746 		ill->ill_dlpi_fastpath_state = IDS_INPROGRESS;
1747 		break;
1748 	default:
1749 		break;
1750 	}
1751 	mutex_exit(&ill->ill_lock);
1752 
1753 	if ((mp = mkiocb(DL_IOC_HDR_INFO)) == NULL)
1754 		return (EAGAIN);
1755 
1756 	mp->b_cont = copyb(dlur_mp);
1757 	if (mp->b_cont == NULL) {
1758 		freeb(mp);
1759 		return (EAGAIN);
1760 	}
1761 
1762 	ioc = (struct iocblk *)mp->b_rptr;
1763 	ioc->ioc_count = msgdsize(mp->b_cont);
1764 
1765 	putnext(ill->ill_wq, mp);
1766 	return (0);
1767 }
1768 
1769 void
1770 ill_capability_probe(ill_t *ill)
1771 {
1772 	mblk_t	*mp;
1773 
1774 	ASSERT(IAM_WRITER_ILL(ill));
1775 
1776 	if (ill->ill_dlpi_capab_state != IDCS_UNKNOWN &&
1777 	    ill->ill_dlpi_capab_state != IDCS_FAILED)
1778 		return;
1779 
1780 	/*
1781 	 * We are starting a new cycle of capability negotiation.
1782 	 * Free up the capab reset messages of any previous incarnation.
1783 	 * We will do a fresh allocation when we get the response to our probe
1784 	 */
1785 	if (ill->ill_capab_reset_mp != NULL) {
1786 		freemsg(ill->ill_capab_reset_mp);
1787 		ill->ill_capab_reset_mp = NULL;
1788 	}
1789 
1790 	ip1dbg(("ill_capability_probe: starting capability negotiation\n"));
1791 
1792 	mp = ip_dlpi_alloc(sizeof (dl_capability_req_t), DL_CAPABILITY_REQ);
1793 	if (mp == NULL)
1794 		return;
1795 
1796 	ill_capability_send(ill, mp);
1797 	ill->ill_dlpi_capab_state = IDCS_PROBE_SENT;
1798 }
1799 
1800 void
1801 ill_capability_reset(ill_t *ill, boolean_t reneg)
1802 {
1803 	ASSERT(IAM_WRITER_ILL(ill));
1804 
1805 	if (ill->ill_dlpi_capab_state != IDCS_OK)
1806 		return;
1807 
1808 	ill->ill_dlpi_capab_state = reneg ? IDCS_RENEG : IDCS_RESET_SENT;
1809 
1810 	ill_capability_send(ill, ill->ill_capab_reset_mp);
1811 	ill->ill_capab_reset_mp = NULL;
1812 	/*
1813 	 * We turn off all capabilities except those pertaining to
1814 	 * direct function call capabilities viz. ILL_CAPAB_DLD*
1815 	 * which will be turned off by the corresponding reset functions.
1816 	 */
1817 	ill->ill_capabilities &= ~(ILL_CAPAB_MDT | ILL_CAPAB_HCKSUM  |
1818 	    ILL_CAPAB_ZEROCOPY | ILL_CAPAB_AH | ILL_CAPAB_ESP);
1819 }
1820 
1821 static void
1822 ill_capability_reset_alloc(ill_t *ill)
1823 {
1824 	mblk_t *mp;
1825 	size_t	size = 0;
1826 	int	err;
1827 	dl_capability_req_t	*capb;
1828 
1829 	ASSERT(IAM_WRITER_ILL(ill));
1830 	ASSERT(ill->ill_capab_reset_mp == NULL);
1831 
1832 	if (ILL_MDT_CAPABLE(ill))
1833 		size += sizeof (dl_capability_sub_t) + sizeof (dl_capab_mdt_t);
1834 
1835 	if (ILL_HCKSUM_CAPABLE(ill)) {
1836 		size += sizeof (dl_capability_sub_t) +
1837 		    sizeof (dl_capab_hcksum_t);
1838 	}
1839 
1840 	if (ill->ill_capabilities & ILL_CAPAB_ZEROCOPY) {
1841 		size += sizeof (dl_capability_sub_t) +
1842 		    sizeof (dl_capab_zerocopy_t);
1843 	}
1844 
1845 	if (ill->ill_capabilities & (ILL_CAPAB_AH | ILL_CAPAB_ESP)) {
1846 		size += sizeof (dl_capability_sub_t);
1847 		size += ill_capability_ipsec_reset_size(ill, NULL, NULL,
1848 		    NULL, NULL);
1849 	}
1850 
1851 	if (ill->ill_capabilities & ILL_CAPAB_DLD) {
1852 		size += sizeof (dl_capability_sub_t) +
1853 		    sizeof (dl_capab_dld_t);
1854 	}
1855 
1856 	mp = allocb_wait(size + sizeof (dl_capability_req_t), BPRI_MED,
1857 	    STR_NOSIG, &err);
1858 
1859 	mp->b_datap->db_type = M_PROTO;
1860 	bzero(mp->b_rptr, size + sizeof (dl_capability_req_t));
1861 
1862 	capb = (dl_capability_req_t *)mp->b_rptr;
1863 	capb->dl_primitive = DL_CAPABILITY_REQ;
1864 	capb->dl_sub_offset = sizeof (dl_capability_req_t);
1865 	capb->dl_sub_length = size;
1866 
1867 	mp->b_wptr += sizeof (dl_capability_req_t);
1868 
1869 	/*
1870 	 * Each handler fills in the corresponding dl_capability_sub_t
1871 	 * inside the mblk,
1872 	 */
1873 	ill_capability_mdt_reset_fill(ill, mp);
1874 	ill_capability_hcksum_reset_fill(ill, mp);
1875 	ill_capability_zerocopy_reset_fill(ill, mp);
1876 	ill_capability_ipsec_reset_fill(ill, mp);
1877 	ill_capability_dld_reset_fill(ill, mp);
1878 
1879 	ill->ill_capab_reset_mp = mp;
1880 }
1881 
1882 static void
1883 ill_capability_id_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *outers)
1884 {
1885 	dl_capab_id_t *id_ic;
1886 	uint_t sub_dl_cap = outers->dl_cap;
1887 	dl_capability_sub_t *inners;
1888 	uint8_t *capend;
1889 
1890 	ASSERT(sub_dl_cap == DL_CAPAB_ID_WRAPPER);
1891 
1892 	/*
1893 	 * Note: range checks here are not absolutely sufficient to
1894 	 * make us robust against malformed messages sent by drivers;
1895 	 * this is in keeping with the rest of IP's dlpi handling.
1896 	 * (Remember, it's coming from something else in the kernel
1897 	 * address space)
1898 	 */
1899 
1900 	capend = (uint8_t *)(outers + 1) + outers->dl_length;
1901 	if (capend > mp->b_wptr) {
1902 		cmn_err(CE_WARN, "ill_capability_id_ack: "
1903 		    "malformed sub-capability too long for mblk");
1904 		return;
1905 	}
1906 
1907 	id_ic = (dl_capab_id_t *)(outers + 1);
1908 
1909 	if (outers->dl_length < sizeof (*id_ic) ||
1910 	    (inners = &id_ic->id_subcap,
1911 	    inners->dl_length > (outers->dl_length - sizeof (*inners)))) {
1912 		cmn_err(CE_WARN, "ill_capability_id_ack: malformed "
1913 		    "encapsulated capab type %d too long for mblk",
1914 		    inners->dl_cap);
1915 		return;
1916 	}
1917 
1918 	if (!dlcapabcheckqid(&id_ic->id_mid, ill->ill_lmod_rq)) {
1919 		ip1dbg(("ill_capability_id_ack: mid token for capab type %d "
1920 		    "isn't as expected; pass-thru module(s) detected, "
1921 		    "discarding capability\n", inners->dl_cap));
1922 		return;
1923 	}
1924 
1925 	/* Process the encapsulated sub-capability */
1926 	ill_capability_dispatch(ill, mp, inners, B_TRUE);
1927 }
1928 
1929 /*
1930  * Process Multidata Transmit capability negotiation ack received from a
1931  * DLS Provider.  isub must point to the sub-capability (DL_CAPAB_MDT) of a
1932  * DL_CAPABILITY_ACK message.
1933  */
1934 static void
1935 ill_capability_mdt_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1936 {
1937 	mblk_t *nmp = NULL;
1938 	dl_capability_req_t *oc;
1939 	dl_capab_mdt_t *mdt_ic, *mdt_oc;
1940 	ill_mdt_capab_t **ill_mdt_capab;
1941 	uint_t sub_dl_cap = isub->dl_cap;
1942 	uint8_t *capend;
1943 
1944 	ASSERT(sub_dl_cap == DL_CAPAB_MDT);
1945 
1946 	ill_mdt_capab = (ill_mdt_capab_t **)&ill->ill_mdt_capab;
1947 
1948 	/*
1949 	 * Note: range checks here are not absolutely sufficient to
1950 	 * make us robust against malformed messages sent by drivers;
1951 	 * this is in keeping with the rest of IP's dlpi handling.
1952 	 * (Remember, it's coming from something else in the kernel
1953 	 * address space)
1954 	 */
1955 
1956 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1957 	if (capend > mp->b_wptr) {
1958 		cmn_err(CE_WARN, "ill_capability_mdt_ack: "
1959 		    "malformed sub-capability too long for mblk");
1960 		return;
1961 	}
1962 
1963 	mdt_ic = (dl_capab_mdt_t *)(isub + 1);
1964 
1965 	if (mdt_ic->mdt_version != MDT_VERSION_2) {
1966 		cmn_err(CE_CONT, "ill_capability_mdt_ack: "
1967 		    "unsupported MDT sub-capability (version %d, expected %d)",
1968 		    mdt_ic->mdt_version, MDT_VERSION_2);
1969 		return;
1970 	}
1971 
1972 	if (!dlcapabcheckqid(&mdt_ic->mdt_mid, ill->ill_lmod_rq)) {
1973 		ip1dbg(("ill_capability_mdt_ack: mid token for MDT "
1974 		    "capability isn't as expected; pass-thru module(s) "
1975 		    "detected, discarding capability\n"));
1976 		return;
1977 	}
1978 
1979 	if (mdt_ic->mdt_flags & DL_CAPAB_MDT_ENABLE) {
1980 
1981 		if (*ill_mdt_capab == NULL) {
1982 			*ill_mdt_capab = kmem_zalloc(sizeof (ill_mdt_capab_t),
1983 			    KM_NOSLEEP);
1984 			if (*ill_mdt_capab == NULL) {
1985 				cmn_err(CE_WARN, "ill_capability_mdt_ack: "
1986 				    "could not enable MDT version %d "
1987 				    "for %s (ENOMEM)\n", MDT_VERSION_2,
1988 				    ill->ill_name);
1989 				return;
1990 			}
1991 		}
1992 
1993 		ip1dbg(("ill_capability_mdt_ack: interface %s supports "
1994 		    "MDT version %d (%d bytes leading, %d bytes trailing "
1995 		    "header spaces, %d max pld bufs, %d span limit)\n",
1996 		    ill->ill_name, MDT_VERSION_2,
1997 		    mdt_ic->mdt_hdr_head, mdt_ic->mdt_hdr_tail,
1998 		    mdt_ic->mdt_max_pld, mdt_ic->mdt_span_limit));
1999 
2000 		(*ill_mdt_capab)->ill_mdt_version = MDT_VERSION_2;
2001 		(*ill_mdt_capab)->ill_mdt_on = 1;
2002 		/*
2003 		 * Round the following values to the nearest 32-bit; ULP
2004 		 * may further adjust them to accomodate for additional
2005 		 * protocol headers.  We pass these values to ULP during
2006 		 * bind time.
2007 		 */
2008 		(*ill_mdt_capab)->ill_mdt_hdr_head =
2009 		    roundup(mdt_ic->mdt_hdr_head, 4);
2010 		(*ill_mdt_capab)->ill_mdt_hdr_tail =
2011 		    roundup(mdt_ic->mdt_hdr_tail, 4);
2012 		(*ill_mdt_capab)->ill_mdt_max_pld = mdt_ic->mdt_max_pld;
2013 		(*ill_mdt_capab)->ill_mdt_span_limit = mdt_ic->mdt_span_limit;
2014 
2015 		ill->ill_capabilities |= ILL_CAPAB_MDT;
2016 	} else {
2017 		uint_t size;
2018 		uchar_t *rptr;
2019 
2020 		size = sizeof (dl_capability_req_t) +
2021 		    sizeof (dl_capability_sub_t) + sizeof (dl_capab_mdt_t);
2022 
2023 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2024 			cmn_err(CE_WARN, "ill_capability_mdt_ack: "
2025 			    "could not enable MDT for %s (ENOMEM)\n",
2026 			    ill->ill_name);
2027 			return;
2028 		}
2029 
2030 		rptr = nmp->b_rptr;
2031 		/* initialize dl_capability_req_t */
2032 		oc = (dl_capability_req_t *)nmp->b_rptr;
2033 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
2034 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
2035 		    sizeof (dl_capab_mdt_t);
2036 		nmp->b_rptr += sizeof (dl_capability_req_t);
2037 
2038 		/* initialize dl_capability_sub_t */
2039 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
2040 		nmp->b_rptr += sizeof (*isub);
2041 
2042 		/* initialize dl_capab_mdt_t */
2043 		mdt_oc = (dl_capab_mdt_t *)nmp->b_rptr;
2044 		bcopy(mdt_ic, mdt_oc, sizeof (*mdt_ic));
2045 
2046 		nmp->b_rptr = rptr;
2047 
2048 		ip1dbg(("ill_capability_mdt_ack: asking interface %s "
2049 		    "to enable MDT version %d\n", ill->ill_name,
2050 		    MDT_VERSION_2));
2051 
2052 		/* set ENABLE flag */
2053 		mdt_oc->mdt_flags |= DL_CAPAB_MDT_ENABLE;
2054 
2055 		/* nmp points to a DL_CAPABILITY_REQ message to enable MDT */
2056 		ill_capability_send(ill, nmp);
2057 	}
2058 }
2059 
2060 static void
2061 ill_capability_mdt_reset_fill(ill_t *ill, mblk_t *mp)
2062 {
2063 	dl_capab_mdt_t *mdt_subcap;
2064 	dl_capability_sub_t *dl_subcap;
2065 
2066 	if (!ILL_MDT_CAPABLE(ill))
2067 		return;
2068 
2069 	ASSERT(ill->ill_mdt_capab != NULL);
2070 
2071 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2072 	dl_subcap->dl_cap = DL_CAPAB_MDT;
2073 	dl_subcap->dl_length = sizeof (*mdt_subcap);
2074 
2075 	mdt_subcap = (dl_capab_mdt_t *)(dl_subcap + 1);
2076 	mdt_subcap->mdt_version = ill->ill_mdt_capab->ill_mdt_version;
2077 	mdt_subcap->mdt_flags = 0;
2078 	mdt_subcap->mdt_hdr_head = 0;
2079 	mdt_subcap->mdt_hdr_tail = 0;
2080 
2081 	mp->b_wptr += sizeof (*dl_subcap) + sizeof (*mdt_subcap);
2082 }
2083 
2084 static void
2085 ill_capability_dld_reset_fill(ill_t *ill, mblk_t *mp)
2086 {
2087 	dl_capability_sub_t *dl_subcap;
2088 
2089 	if (!(ill->ill_capabilities & ILL_CAPAB_DLD))
2090 		return;
2091 
2092 	/*
2093 	 * The dl_capab_dld_t that follows the dl_capability_sub_t is not
2094 	 * initialized below since it is not used by DLD.
2095 	 */
2096 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2097 	dl_subcap->dl_cap = DL_CAPAB_DLD;
2098 	dl_subcap->dl_length = sizeof (dl_capab_dld_t);
2099 
2100 	mp->b_wptr += sizeof (dl_capability_sub_t) + sizeof (dl_capab_dld_t);
2101 }
2102 
2103 /*
2104  * Send a DL_NOTIFY_REQ to the specified ill to enable
2105  * DL_NOTE_PROMISC_ON/OFF_PHYS notifications.
2106  * Invoked by ill_capability_ipsec_ack() before enabling IPsec hardware
2107  * acceleration.
2108  * Returns B_TRUE on success, B_FALSE if the message could not be sent.
2109  */
2110 static boolean_t
2111 ill_enable_promisc_notify(ill_t *ill)
2112 {
2113 	mblk_t *mp;
2114 	dl_notify_req_t *req;
2115 
2116 	IPSECHW_DEBUG(IPSECHW_PKT, ("ill_enable_promisc_notify:\n"));
2117 
2118 	mp = ip_dlpi_alloc(sizeof (dl_notify_req_t), DL_NOTIFY_REQ);
2119 	if (mp == NULL)
2120 		return (B_FALSE);
2121 
2122 	req = (dl_notify_req_t *)mp->b_rptr;
2123 	req->dl_notifications = DL_NOTE_PROMISC_ON_PHYS |
2124 	    DL_NOTE_PROMISC_OFF_PHYS;
2125 
2126 	ill_dlpi_send(ill, mp);
2127 
2128 	return (B_TRUE);
2129 }
2130 
2131 /*
2132  * Allocate an IPsec capability request which will be filled by our
2133  * caller to turn on support for one or more algorithms.
2134  */
2135 static mblk_t *
2136 ill_alloc_ipsec_cap_req(ill_t *ill, dl_capability_sub_t *isub)
2137 {
2138 	mblk_t *nmp;
2139 	dl_capability_req_t	*ocap;
2140 	dl_capab_ipsec_t	*ocip;
2141 	dl_capab_ipsec_t	*icip;
2142 	uint8_t			*ptr;
2143 	icip = (dl_capab_ipsec_t *)(isub + 1);
2144 
2145 	/*
2146 	 * The first time around, we send a DL_NOTIFY_REQ to enable
2147 	 * PROMISC_ON/OFF notification from the provider. We need to
2148 	 * do this before enabling the algorithms to avoid leakage of
2149 	 * cleartext packets.
2150 	 */
2151 
2152 	if (!ill_enable_promisc_notify(ill))
2153 		return (NULL);
2154 
2155 	/*
2156 	 * Allocate new mblk which will contain a new capability
2157 	 * request to enable the capabilities.
2158 	 */
2159 
2160 	nmp = ip_dlpi_alloc(sizeof (dl_capability_req_t) +
2161 	    sizeof (dl_capability_sub_t) + isub->dl_length, DL_CAPABILITY_REQ);
2162 	if (nmp == NULL)
2163 		return (NULL);
2164 
2165 	ptr = nmp->b_rptr;
2166 
2167 	/* initialize dl_capability_req_t */
2168 	ocap = (dl_capability_req_t *)ptr;
2169 	ocap->dl_sub_offset = sizeof (dl_capability_req_t);
2170 	ocap->dl_sub_length = sizeof (dl_capability_sub_t) + isub->dl_length;
2171 	ptr += sizeof (dl_capability_req_t);
2172 
2173 	/* initialize dl_capability_sub_t */
2174 	bcopy(isub, ptr, sizeof (*isub));
2175 	ptr += sizeof (*isub);
2176 
2177 	/* initialize dl_capab_ipsec_t */
2178 	ocip = (dl_capab_ipsec_t *)ptr;
2179 	bcopy(icip, ocip, sizeof (*icip));
2180 
2181 	nmp->b_wptr = (uchar_t *)(&ocip->cip_data[0]);
2182 	return (nmp);
2183 }
2184 
2185 /*
2186  * Process an IPsec capability negotiation ack received from a DLS Provider.
2187  * isub must point to the sub-capability (DL_CAPAB_IPSEC_AH or
2188  * DL_CAPAB_IPSEC_ESP) of a DL_CAPABILITY_ACK message.
2189  */
2190 static void
2191 ill_capability_ipsec_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2192 {
2193 	dl_capab_ipsec_t	*icip;
2194 	dl_capab_ipsec_alg_t	*ialg;	/* ptr to input alg spec. */
2195 	dl_capab_ipsec_alg_t	*oalg;	/* ptr to output alg spec. */
2196 	uint_t cipher, nciphers;
2197 	mblk_t *nmp;
2198 	uint_t alg_len;
2199 	boolean_t need_sadb_dump;
2200 	uint_t sub_dl_cap = isub->dl_cap;
2201 	ill_ipsec_capab_t **ill_capab;
2202 	uint64_t ill_capab_flag;
2203 	uint8_t *capend, *ciphend;
2204 	boolean_t sadb_resync;
2205 
2206 	ASSERT(sub_dl_cap == DL_CAPAB_IPSEC_AH ||
2207 	    sub_dl_cap == DL_CAPAB_IPSEC_ESP);
2208 
2209 	if (sub_dl_cap == DL_CAPAB_IPSEC_AH) {
2210 		ill_capab = (ill_ipsec_capab_t **)&ill->ill_ipsec_capab_ah;
2211 		ill_capab_flag = ILL_CAPAB_AH;
2212 	} else {
2213 		ill_capab = (ill_ipsec_capab_t **)&ill->ill_ipsec_capab_esp;
2214 		ill_capab_flag = ILL_CAPAB_ESP;
2215 	}
2216 
2217 	/*
2218 	 * If the ill capability structure exists, then this incoming
2219 	 * DL_CAPABILITY_ACK is a response to a "renegotiation" cycle.
2220 	 * If this is so, then we'd need to resynchronize the SADB
2221 	 * after re-enabling the offloaded ciphers.
2222 	 */
2223 	sadb_resync = (*ill_capab != NULL);
2224 
2225 	/*
2226 	 * Note: range checks here are not absolutely sufficient to
2227 	 * make us robust against malformed messages sent by drivers;
2228 	 * this is in keeping with the rest of IP's dlpi handling.
2229 	 * (Remember, it's coming from something else in the kernel
2230 	 * address space)
2231 	 */
2232 
2233 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2234 	if (capend > mp->b_wptr) {
2235 		cmn_err(CE_WARN, "ill_capability_ipsec_ack: "
2236 		    "malformed sub-capability too long for mblk");
2237 		return;
2238 	}
2239 
2240 	/*
2241 	 * There are two types of acks we process here:
2242 	 * 1. acks in reply to a (first form) generic capability req
2243 	 *    (no ENABLE flag set)
2244 	 * 2. acks in reply to a ENABLE capability req.
2245 	 *    (ENABLE flag set)
2246 	 *
2247 	 * We process the subcapability passed as argument as follows:
2248 	 * 1 do initializations
2249 	 *   1.1 initialize nmp = NULL
2250 	 *   1.2 set need_sadb_dump to B_FALSE
2251 	 * 2 for each cipher in subcapability:
2252 	 *   2.1 if ENABLE flag is set:
2253 	 *	2.1.1 update per-ill ipsec capabilities info
2254 	 *	2.1.2 set need_sadb_dump to B_TRUE
2255 	 *   2.2 if ENABLE flag is not set:
2256 	 *	2.2.1 if nmp is NULL:
2257 	 *		2.2.1.1 allocate and initialize nmp
2258 	 *		2.2.1.2 init current pos in nmp
2259 	 *	2.2.2 copy current cipher to current pos in nmp
2260 	 *	2.2.3 set ENABLE flag in nmp
2261 	 *	2.2.4 update current pos
2262 	 * 3 if nmp is not equal to NULL, send enable request
2263 	 *   3.1 send capability request
2264 	 * 4 if need_sadb_dump is B_TRUE
2265 	 *   4.1 enable promiscuous on/off notifications
2266 	 *   4.2 call ill_dlpi_send(isub->dlcap) to send all
2267 	 *	AH or ESP SA's to interface.
2268 	 */
2269 
2270 	nmp = NULL;
2271 	oalg = NULL;
2272 	need_sadb_dump = B_FALSE;
2273 	icip = (dl_capab_ipsec_t *)(isub + 1);
2274 	ialg = (dl_capab_ipsec_alg_t *)(&icip->cip_data[0]);
2275 
2276 	nciphers = icip->cip_nciphers;
2277 	ciphend = (uint8_t *)(ialg + icip->cip_nciphers);
2278 
2279 	if (ciphend > capend) {
2280 		cmn_err(CE_WARN, "ill_capability_ipsec_ack: "
2281 		    "too many ciphers for sub-capability len");
2282 		return;
2283 	}
2284 
2285 	for (cipher = 0; cipher < nciphers; cipher++) {
2286 		alg_len = sizeof (dl_capab_ipsec_alg_t);
2287 
2288 		if (ialg->alg_flag & DL_CAPAB_ALG_ENABLE) {
2289 			/*
2290 			 * TBD: when we provide a way to disable capabilities
2291 			 * from above, need to manage the request-pending state
2292 			 * and fail if we were not expecting this ACK.
2293 			 */
2294 			IPSECHW_DEBUG(IPSECHW_CAPAB,
2295 			    ("ill_capability_ipsec_ack: got ENABLE ACK\n"));
2296 
2297 			/*
2298 			 * Update IPsec capabilities for this ill
2299 			 */
2300 
2301 			if (*ill_capab == NULL) {
2302 				IPSECHW_DEBUG(IPSECHW_CAPAB,
2303 				    ("ill_capability_ipsec_ack: "
2304 				    "allocating ipsec_capab for ill\n"));
2305 				*ill_capab = ill_ipsec_capab_alloc();
2306 
2307 				if (*ill_capab == NULL) {
2308 					cmn_err(CE_WARN,
2309 					    "ill_capability_ipsec_ack: "
2310 					    "could not enable IPsec Hardware "
2311 					    "acceleration for %s (ENOMEM)\n",
2312 					    ill->ill_name);
2313 					return;
2314 				}
2315 			}
2316 
2317 			ASSERT(ialg->alg_type == DL_CAPAB_IPSEC_ALG_AUTH ||
2318 			    ialg->alg_type == DL_CAPAB_IPSEC_ALG_ENCR);
2319 
2320 			if (ialg->alg_prim >= MAX_IPSEC_ALGS) {
2321 				cmn_err(CE_WARN,
2322 				    "ill_capability_ipsec_ack: "
2323 				    "malformed IPsec algorithm id %d",
2324 				    ialg->alg_prim);
2325 				continue;
2326 			}
2327 
2328 			if (ialg->alg_type == DL_CAPAB_IPSEC_ALG_AUTH) {
2329 				IPSEC_ALG_ENABLE((*ill_capab)->auth_hw_algs,
2330 				    ialg->alg_prim);
2331 			} else {
2332 				ipsec_capab_algparm_t *alp;
2333 
2334 				IPSEC_ALG_ENABLE((*ill_capab)->encr_hw_algs,
2335 				    ialg->alg_prim);
2336 				if (!ill_ipsec_capab_resize_algparm(*ill_capab,
2337 				    ialg->alg_prim)) {
2338 					cmn_err(CE_WARN,
2339 					    "ill_capability_ipsec_ack: "
2340 					    "no space for IPsec alg id %d",
2341 					    ialg->alg_prim);
2342 					continue;
2343 				}
2344 				alp = &((*ill_capab)->encr_algparm[
2345 				    ialg->alg_prim]);
2346 				alp->minkeylen = ialg->alg_minbits;
2347 				alp->maxkeylen = ialg->alg_maxbits;
2348 			}
2349 			ill->ill_capabilities |= ill_capab_flag;
2350 			/*
2351 			 * indicate that a capability was enabled, which
2352 			 * will be used below to kick off a SADB dump
2353 			 * to the ill.
2354 			 */
2355 			need_sadb_dump = B_TRUE;
2356 		} else {
2357 			IPSECHW_DEBUG(IPSECHW_CAPAB,
2358 			    ("ill_capability_ipsec_ack: enabling alg 0x%x\n",
2359 			    ialg->alg_prim));
2360 
2361 			if (nmp == NULL) {
2362 				nmp = ill_alloc_ipsec_cap_req(ill, isub);
2363 				if (nmp == NULL) {
2364 					/*
2365 					 * Sending the PROMISC_ON/OFF
2366 					 * notification request failed.
2367 					 * We cannot enable the algorithms
2368 					 * since the Provider will not
2369 					 * notify IP of promiscous mode
2370 					 * changes, which could lead
2371 					 * to leakage of packets.
2372 					 */
2373 					cmn_err(CE_WARN,
2374 					    "ill_capability_ipsec_ack: "
2375 					    "could not enable IPsec Hardware "
2376 					    "acceleration for %s (ENOMEM)\n",
2377 					    ill->ill_name);
2378 					return;
2379 				}
2380 				/* ptr to current output alg specifier */
2381 				oalg = (dl_capab_ipsec_alg_t *)nmp->b_wptr;
2382 			}
2383 
2384 			/*
2385 			 * Copy current alg specifier, set ENABLE
2386 			 * flag, and advance to next output alg.
2387 			 * For now we enable all IPsec capabilities.
2388 			 */
2389 			ASSERT(oalg != NULL);
2390 			bcopy(ialg, oalg, alg_len);
2391 			oalg->alg_flag |= DL_CAPAB_ALG_ENABLE;
2392 			nmp->b_wptr += alg_len;
2393 			oalg = (dl_capab_ipsec_alg_t *)nmp->b_wptr;
2394 		}
2395 
2396 		/* move to next input algorithm specifier */
2397 		ialg = (dl_capab_ipsec_alg_t *)
2398 		    ((char *)ialg + alg_len);
2399 	}
2400 
2401 	if (nmp != NULL)
2402 		/*
2403 		 * nmp points to a DL_CAPABILITY_REQ message to enable
2404 		 * IPsec hardware acceleration.
2405 		 */
2406 		ill_capability_send(ill, nmp);
2407 
2408 	if (need_sadb_dump)
2409 		/*
2410 		 * An acknowledgement corresponding to a request to
2411 		 * enable acceleration was received, notify SADB.
2412 		 */
2413 		ill_ipsec_capab_add(ill, sub_dl_cap, sadb_resync);
2414 }
2415 
2416 /*
2417  * Given an mblk with enough space in it, create sub-capability entries for
2418  * DL_CAPAB_IPSEC_{AH,ESP} types which consist of previously-advertised
2419  * offloaded ciphers (both AUTH and ENCR) with their enable flags cleared,
2420  * in preparation for the reset the DL_CAPABILITY_REQ message.
2421  */
2422 static void
2423 ill_fill_ipsec_reset(uint_t nciphers, int stype, uint_t slen,
2424     ill_ipsec_capab_t *ill_cap, mblk_t *mp)
2425 {
2426 	dl_capab_ipsec_t *oipsec;
2427 	dl_capab_ipsec_alg_t *oalg;
2428 	dl_capability_sub_t *dl_subcap;
2429 	int i, k;
2430 
2431 	ASSERT(nciphers > 0);
2432 	ASSERT(ill_cap != NULL);
2433 	ASSERT(mp != NULL);
2434 	ASSERT(MBLKTAIL(mp) >= sizeof (*dl_subcap) + sizeof (*oipsec) + slen);
2435 
2436 	/* dl_capability_sub_t for "stype" */
2437 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2438 	dl_subcap->dl_cap = stype;
2439 	dl_subcap->dl_length = sizeof (dl_capab_ipsec_t) + slen;
2440 	mp->b_wptr += sizeof (dl_capability_sub_t);
2441 
2442 	/* dl_capab_ipsec_t for "stype" */
2443 	oipsec = (dl_capab_ipsec_t *)mp->b_wptr;
2444 	oipsec->cip_version = 1;
2445 	oipsec->cip_nciphers = nciphers;
2446 	mp->b_wptr = (uchar_t *)&oipsec->cip_data[0];
2447 
2448 	/* create entries for "stype" AUTH ciphers */
2449 	for (i = 0; i < ill_cap->algs_size; i++) {
2450 		for (k = 0; k < BITSPERBYTE; k++) {
2451 			if ((ill_cap->auth_hw_algs[i] & (1 << k)) == 0)
2452 				continue;
2453 
2454 			oalg = (dl_capab_ipsec_alg_t *)mp->b_wptr;
2455 			bzero((void *)oalg, sizeof (*oalg));
2456 			oalg->alg_type = DL_CAPAB_IPSEC_ALG_AUTH;
2457 			oalg->alg_prim = k + (BITSPERBYTE * i);
2458 			mp->b_wptr += sizeof (dl_capab_ipsec_alg_t);
2459 		}
2460 	}
2461 	/* create entries for "stype" ENCR ciphers */
2462 	for (i = 0; i < ill_cap->algs_size; i++) {
2463 		for (k = 0; k < BITSPERBYTE; k++) {
2464 			if ((ill_cap->encr_hw_algs[i] & (1 << k)) == 0)
2465 				continue;
2466 
2467 			oalg = (dl_capab_ipsec_alg_t *)mp->b_wptr;
2468 			bzero((void *)oalg, sizeof (*oalg));
2469 			oalg->alg_type = DL_CAPAB_IPSEC_ALG_ENCR;
2470 			oalg->alg_prim = k + (BITSPERBYTE * i);
2471 			mp->b_wptr += sizeof (dl_capab_ipsec_alg_t);
2472 		}
2473 	}
2474 }
2475 
2476 /*
2477  * Macro to count number of 1s in a byte (8-bit word).  The total count is
2478  * accumulated into the passed-in argument (sum).  We could use SPARCv9's
2479  * POPC instruction, but our macro is more flexible for an arbitrary length
2480  * of bytes, such as {auth,encr}_hw_algs.  These variables are currently
2481  * 256-bits long (MAX_IPSEC_ALGS), so if we know for sure that the length
2482  * stays that way, we can reduce the number of iterations required.
2483  */
2484 #define	COUNT_1S(val, sum) {					\
2485 	uint8_t x = val & 0xff;					\
2486 	x = (x & 0x55) + ((x >> 1) & 0x55);			\
2487 	x = (x & 0x33) + ((x >> 2) & 0x33);			\
2488 	sum += (x & 0xf) + ((x >> 4) & 0xf);			\
2489 }
2490 
2491 /* ARGSUSED */
2492 static int
2493 ill_capability_ipsec_reset_size(ill_t *ill, int *ah_cntp, int *ah_lenp,
2494     int *esp_cntp, int *esp_lenp)
2495 {
2496 	ill_ipsec_capab_t *cap_ah = ill->ill_ipsec_capab_ah;
2497 	ill_ipsec_capab_t *cap_esp = ill->ill_ipsec_capab_esp;
2498 	uint64_t ill_capabilities = ill->ill_capabilities;
2499 	int ah_cnt = 0, esp_cnt = 0;
2500 	int ah_len = 0, esp_len = 0;
2501 	int i, size = 0;
2502 
2503 	if (!(ill_capabilities & (ILL_CAPAB_AH | ILL_CAPAB_ESP)))
2504 		return (0);
2505 
2506 	ASSERT(cap_ah != NULL || !(ill_capabilities & ILL_CAPAB_AH));
2507 	ASSERT(cap_esp != NULL || !(ill_capabilities & ILL_CAPAB_ESP));
2508 
2509 	/* Find out the number of ciphers for AH */
2510 	if (cap_ah != NULL) {
2511 		for (i = 0; i < cap_ah->algs_size; i++) {
2512 			COUNT_1S(cap_ah->auth_hw_algs[i], ah_cnt);
2513 			COUNT_1S(cap_ah->encr_hw_algs[i], ah_cnt);
2514 		}
2515 		if (ah_cnt > 0) {
2516 			size += sizeof (dl_capability_sub_t) +
2517 			    sizeof (dl_capab_ipsec_t);
2518 			/* dl_capab_ipsec_t contains one dl_capab_ipsec_alg_t */
2519 			ah_len = (ah_cnt - 1) * sizeof (dl_capab_ipsec_alg_t);
2520 			size += ah_len;
2521 		}
2522 	}
2523 
2524 	/* Find out the number of ciphers for ESP */
2525 	if (cap_esp != NULL) {
2526 		for (i = 0; i < cap_esp->algs_size; i++) {
2527 			COUNT_1S(cap_esp->auth_hw_algs[i], esp_cnt);
2528 			COUNT_1S(cap_esp->encr_hw_algs[i], esp_cnt);
2529 		}
2530 		if (esp_cnt > 0) {
2531 			size += sizeof (dl_capability_sub_t) +
2532 			    sizeof (dl_capab_ipsec_t);
2533 			/* dl_capab_ipsec_t contains one dl_capab_ipsec_alg_t */
2534 			esp_len = (esp_cnt - 1) * sizeof (dl_capab_ipsec_alg_t);
2535 			size += esp_len;
2536 		}
2537 	}
2538 
2539 	if (ah_cntp != NULL)
2540 		*ah_cntp = ah_cnt;
2541 	if (ah_lenp != NULL)
2542 		*ah_lenp = ah_len;
2543 	if (esp_cntp != NULL)
2544 		*esp_cntp = esp_cnt;
2545 	if (esp_lenp != NULL)
2546 		*esp_lenp = esp_len;
2547 
2548 	return (size);
2549 }
2550 
2551 /* ARGSUSED */
2552 static void
2553 ill_capability_ipsec_reset_fill(ill_t *ill, mblk_t *mp)
2554 {
2555 	ill_ipsec_capab_t *cap_ah = ill->ill_ipsec_capab_ah;
2556 	ill_ipsec_capab_t *cap_esp = ill->ill_ipsec_capab_esp;
2557 	int ah_cnt = 0, esp_cnt = 0;
2558 	int ah_len = 0, esp_len = 0;
2559 	int size;
2560 
2561 	size = ill_capability_ipsec_reset_size(ill, &ah_cnt, &ah_len,
2562 	    &esp_cnt, &esp_len);
2563 	if (size == 0)
2564 		return;
2565 
2566 	/*
2567 	 * Clear the capability flags for IPsec HA but retain the ill
2568 	 * capability structures since it's possible that another thread
2569 	 * is still referring to them.  The structures only get deallocated
2570 	 * when we destroy the ill.
2571 	 *
2572 	 * Various places check the flags to see if the ill is capable of
2573 	 * hardware acceleration, and by clearing them we ensure that new
2574 	 * outbound IPsec packets are sent down encrypted.
2575 	 */
2576 
2577 	/* Fill in DL_CAPAB_IPSEC_AH sub-capability entries */
2578 	if (ah_cnt > 0) {
2579 		ill_fill_ipsec_reset(ah_cnt, DL_CAPAB_IPSEC_AH, ah_len,
2580 		    cap_ah, mp);
2581 	}
2582 
2583 	/* Fill in DL_CAPAB_IPSEC_ESP sub-capability entries */
2584 	if (esp_cnt > 0) {
2585 		ill_fill_ipsec_reset(esp_cnt, DL_CAPAB_IPSEC_ESP, esp_len,
2586 		    cap_esp, mp);
2587 	}
2588 
2589 	/*
2590 	 * At this point we've composed a bunch of sub-capabilities to be
2591 	 * encapsulated in a DL_CAPABILITY_REQ and later sent downstream
2592 	 * by the caller.  Upon receiving this reset message, the driver
2593 	 * must stop inbound decryption (by destroying all inbound SAs)
2594 	 * and let the corresponding packets come in encrypted.
2595 	 */
2596 }
2597 
2598 static void
2599 ill_capability_dispatch(ill_t *ill, mblk_t *mp, dl_capability_sub_t *subp,
2600     boolean_t encapsulated)
2601 {
2602 	boolean_t legacy = B_FALSE;
2603 
2604 	/*
2605 	 * Note that only the following two sub-capabilities may be
2606 	 * considered as "legacy", since their original definitions
2607 	 * do not incorporate the dl_mid_t module ID token, and hence
2608 	 * may require the use of the wrapper sub-capability.
2609 	 */
2610 	switch (subp->dl_cap) {
2611 	case DL_CAPAB_IPSEC_AH:
2612 	case DL_CAPAB_IPSEC_ESP:
2613 		legacy = B_TRUE;
2614 		break;
2615 	}
2616 
2617 	/*
2618 	 * For legacy sub-capabilities which don't incorporate a queue_t
2619 	 * pointer in their structures, discard them if we detect that
2620 	 * there are intermediate modules in between IP and the driver.
2621 	 */
2622 	if (!encapsulated && legacy && ill->ill_lmod_cnt > 1) {
2623 		ip1dbg(("ill_capability_dispatch: unencapsulated capab type "
2624 		    "%d discarded; %d module(s) present below IP\n",
2625 		    subp->dl_cap, ill->ill_lmod_cnt));
2626 		return;
2627 	}
2628 
2629 	switch (subp->dl_cap) {
2630 	case DL_CAPAB_IPSEC_AH:
2631 	case DL_CAPAB_IPSEC_ESP:
2632 		ill_capability_ipsec_ack(ill, mp, subp);
2633 		break;
2634 	case DL_CAPAB_MDT:
2635 		ill_capability_mdt_ack(ill, mp, subp);
2636 		break;
2637 	case DL_CAPAB_HCKSUM:
2638 		ill_capability_hcksum_ack(ill, mp, subp);
2639 		break;
2640 	case DL_CAPAB_ZEROCOPY:
2641 		ill_capability_zerocopy_ack(ill, mp, subp);
2642 		break;
2643 	case DL_CAPAB_DLD:
2644 		ill_capability_dld_ack(ill, mp, subp);
2645 		break;
2646 	default:
2647 		ip1dbg(("ill_capability_dispatch: unknown capab type %d\n",
2648 		    subp->dl_cap));
2649 	}
2650 }
2651 
2652 /*
2653  * Process a hardware checksum offload capability negotiation ack received
2654  * from a DLS Provider.isub must point to the sub-capability (DL_CAPAB_HCKSUM)
2655  * of a DL_CAPABILITY_ACK message.
2656  */
2657 static void
2658 ill_capability_hcksum_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2659 {
2660 	dl_capability_req_t	*ocap;
2661 	dl_capab_hcksum_t	*ihck, *ohck;
2662 	ill_hcksum_capab_t	**ill_hcksum;
2663 	mblk_t			*nmp = NULL;
2664 	uint_t			sub_dl_cap = isub->dl_cap;
2665 	uint8_t			*capend;
2666 
2667 	ASSERT(sub_dl_cap == DL_CAPAB_HCKSUM);
2668 
2669 	ill_hcksum = (ill_hcksum_capab_t **)&ill->ill_hcksum_capab;
2670 
2671 	/*
2672 	 * Note: range checks here are not absolutely sufficient to
2673 	 * make us robust against malformed messages sent by drivers;
2674 	 * this is in keeping with the rest of IP's dlpi handling.
2675 	 * (Remember, it's coming from something else in the kernel
2676 	 * address space)
2677 	 */
2678 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2679 	if (capend > mp->b_wptr) {
2680 		cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
2681 		    "malformed sub-capability too long for mblk");
2682 		return;
2683 	}
2684 
2685 	/*
2686 	 * There are two types of acks we process here:
2687 	 * 1. acks in reply to a (first form) generic capability req
2688 	 *    (no ENABLE flag set)
2689 	 * 2. acks in reply to a ENABLE capability req.
2690 	 *    (ENABLE flag set)
2691 	 */
2692 	ihck = (dl_capab_hcksum_t *)(isub + 1);
2693 
2694 	if (ihck->hcksum_version != HCKSUM_VERSION_1) {
2695 		cmn_err(CE_CONT, "ill_capability_hcksum_ack: "
2696 		    "unsupported hardware checksum "
2697 		    "sub-capability (version %d, expected %d)",
2698 		    ihck->hcksum_version, HCKSUM_VERSION_1);
2699 		return;
2700 	}
2701 
2702 	if (!dlcapabcheckqid(&ihck->hcksum_mid, ill->ill_lmod_rq)) {
2703 		ip1dbg(("ill_capability_hcksum_ack: mid token for hardware "
2704 		    "checksum capability isn't as expected; pass-thru "
2705 		    "module(s) detected, discarding capability\n"));
2706 		return;
2707 	}
2708 
2709 #define	CURR_HCKSUM_CAPAB				\
2710 	(HCKSUM_INET_PARTIAL | HCKSUM_INET_FULL_V4 |	\
2711 	HCKSUM_INET_FULL_V6 | HCKSUM_IPHDRCKSUM)
2712 
2713 	if ((ihck->hcksum_txflags & HCKSUM_ENABLE) &&
2714 	    (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB)) {
2715 		/* do ENABLE processing */
2716 		if (*ill_hcksum == NULL) {
2717 			*ill_hcksum = kmem_zalloc(sizeof (ill_hcksum_capab_t),
2718 			    KM_NOSLEEP);
2719 
2720 			if (*ill_hcksum == NULL) {
2721 				cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
2722 				    "could not enable hcksum version %d "
2723 				    "for %s (ENOMEM)\n", HCKSUM_CURRENT_VERSION,
2724 				    ill->ill_name);
2725 				return;
2726 			}
2727 		}
2728 
2729 		(*ill_hcksum)->ill_hcksum_version = ihck->hcksum_version;
2730 		(*ill_hcksum)->ill_hcksum_txflags = ihck->hcksum_txflags;
2731 		ill->ill_capabilities |= ILL_CAPAB_HCKSUM;
2732 		ip1dbg(("ill_capability_hcksum_ack: interface %s "
2733 		    "has enabled hardware checksumming\n ",
2734 		    ill->ill_name));
2735 	} else if (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB) {
2736 		/*
2737 		 * Enabling hardware checksum offload
2738 		 * Currently IP supports {TCP,UDP}/IPv4
2739 		 * partial and full cksum offload and
2740 		 * IPv4 header checksum offload.
2741 		 * Allocate new mblk which will
2742 		 * contain a new capability request
2743 		 * to enable hardware checksum offload.
2744 		 */
2745 		uint_t	size;
2746 		uchar_t	*rptr;
2747 
2748 		size = sizeof (dl_capability_req_t) +
2749 		    sizeof (dl_capability_sub_t) + isub->dl_length;
2750 
2751 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2752 			cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
2753 			    "could not enable hardware cksum for %s (ENOMEM)\n",
2754 			    ill->ill_name);
2755 			return;
2756 		}
2757 
2758 		rptr = nmp->b_rptr;
2759 		/* initialize dl_capability_req_t */
2760 		ocap = (dl_capability_req_t *)nmp->b_rptr;
2761 		ocap->dl_sub_offset =
2762 		    sizeof (dl_capability_req_t);
2763 		ocap->dl_sub_length =
2764 		    sizeof (dl_capability_sub_t) +
2765 		    isub->dl_length;
2766 		nmp->b_rptr += sizeof (dl_capability_req_t);
2767 
2768 		/* initialize dl_capability_sub_t */
2769 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
2770 		nmp->b_rptr += sizeof (*isub);
2771 
2772 		/* initialize dl_capab_hcksum_t */
2773 		ohck = (dl_capab_hcksum_t *)nmp->b_rptr;
2774 		bcopy(ihck, ohck, sizeof (*ihck));
2775 
2776 		nmp->b_rptr = rptr;
2777 		ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
2778 
2779 		/* Set ENABLE flag */
2780 		ohck->hcksum_txflags &= CURR_HCKSUM_CAPAB;
2781 		ohck->hcksum_txflags |= HCKSUM_ENABLE;
2782 
2783 		/*
2784 		 * nmp points to a DL_CAPABILITY_REQ message to enable
2785 		 * hardware checksum acceleration.
2786 		 */
2787 		ill_capability_send(ill, nmp);
2788 	} else {
2789 		ip1dbg(("ill_capability_hcksum_ack: interface %s has "
2790 		    "advertised %x hardware checksum capability flags\n",
2791 		    ill->ill_name, ihck->hcksum_txflags));
2792 	}
2793 }
2794 
2795 static void
2796 ill_capability_hcksum_reset_fill(ill_t *ill, mblk_t *mp)
2797 {
2798 	dl_capab_hcksum_t *hck_subcap;
2799 	dl_capability_sub_t *dl_subcap;
2800 
2801 	if (!ILL_HCKSUM_CAPABLE(ill))
2802 		return;
2803 
2804 	ASSERT(ill->ill_hcksum_capab != NULL);
2805 
2806 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2807 	dl_subcap->dl_cap = DL_CAPAB_HCKSUM;
2808 	dl_subcap->dl_length = sizeof (*hck_subcap);
2809 
2810 	hck_subcap = (dl_capab_hcksum_t *)(dl_subcap + 1);
2811 	hck_subcap->hcksum_version = ill->ill_hcksum_capab->ill_hcksum_version;
2812 	hck_subcap->hcksum_txflags = 0;
2813 
2814 	mp->b_wptr += sizeof (*dl_subcap) + sizeof (*hck_subcap);
2815 }
2816 
2817 static void
2818 ill_capability_zerocopy_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2819 {
2820 	mblk_t *nmp = NULL;
2821 	dl_capability_req_t *oc;
2822 	dl_capab_zerocopy_t *zc_ic, *zc_oc;
2823 	ill_zerocopy_capab_t **ill_zerocopy_capab;
2824 	uint_t sub_dl_cap = isub->dl_cap;
2825 	uint8_t *capend;
2826 
2827 	ASSERT(sub_dl_cap == DL_CAPAB_ZEROCOPY);
2828 
2829 	ill_zerocopy_capab = (ill_zerocopy_capab_t **)&ill->ill_zerocopy_capab;
2830 
2831 	/*
2832 	 * Note: range checks here are not absolutely sufficient to
2833 	 * make us robust against malformed messages sent by drivers;
2834 	 * this is in keeping with the rest of IP's dlpi handling.
2835 	 * (Remember, it's coming from something else in the kernel
2836 	 * address space)
2837 	 */
2838 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2839 	if (capend > mp->b_wptr) {
2840 		cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
2841 		    "malformed sub-capability too long for mblk");
2842 		return;
2843 	}
2844 
2845 	zc_ic = (dl_capab_zerocopy_t *)(isub + 1);
2846 	if (zc_ic->zerocopy_version != ZEROCOPY_VERSION_1) {
2847 		cmn_err(CE_CONT, "ill_capability_zerocopy_ack: "
2848 		    "unsupported ZEROCOPY sub-capability (version %d, "
2849 		    "expected %d)", zc_ic->zerocopy_version,
2850 		    ZEROCOPY_VERSION_1);
2851 		return;
2852 	}
2853 
2854 	if (!dlcapabcheckqid(&zc_ic->zerocopy_mid, ill->ill_lmod_rq)) {
2855 		ip1dbg(("ill_capability_zerocopy_ack: mid token for zerocopy "
2856 		    "capability isn't as expected; pass-thru module(s) "
2857 		    "detected, discarding capability\n"));
2858 		return;
2859 	}
2860 
2861 	if ((zc_ic->zerocopy_flags & DL_CAPAB_VMSAFE_MEM) != 0) {
2862 		if (*ill_zerocopy_capab == NULL) {
2863 			*ill_zerocopy_capab =
2864 			    kmem_zalloc(sizeof (ill_zerocopy_capab_t),
2865 			    KM_NOSLEEP);
2866 
2867 			if (*ill_zerocopy_capab == NULL) {
2868 				cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
2869 				    "could not enable Zero-copy version %d "
2870 				    "for %s (ENOMEM)\n", ZEROCOPY_VERSION_1,
2871 				    ill->ill_name);
2872 				return;
2873 			}
2874 		}
2875 
2876 		ip1dbg(("ill_capability_zerocopy_ack: interface %s "
2877 		    "supports Zero-copy version %d\n", ill->ill_name,
2878 		    ZEROCOPY_VERSION_1));
2879 
2880 		(*ill_zerocopy_capab)->ill_zerocopy_version =
2881 		    zc_ic->zerocopy_version;
2882 		(*ill_zerocopy_capab)->ill_zerocopy_flags =
2883 		    zc_ic->zerocopy_flags;
2884 
2885 		ill->ill_capabilities |= ILL_CAPAB_ZEROCOPY;
2886 	} else {
2887 		uint_t size;
2888 		uchar_t *rptr;
2889 
2890 		size = sizeof (dl_capability_req_t) +
2891 		    sizeof (dl_capability_sub_t) +
2892 		    sizeof (dl_capab_zerocopy_t);
2893 
2894 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2895 			cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
2896 			    "could not enable zerocopy for %s (ENOMEM)\n",
2897 			    ill->ill_name);
2898 			return;
2899 		}
2900 
2901 		rptr = nmp->b_rptr;
2902 		/* initialize dl_capability_req_t */
2903 		oc = (dl_capability_req_t *)rptr;
2904 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
2905 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
2906 		    sizeof (dl_capab_zerocopy_t);
2907 		rptr += sizeof (dl_capability_req_t);
2908 
2909 		/* initialize dl_capability_sub_t */
2910 		bcopy(isub, rptr, sizeof (*isub));
2911 		rptr += sizeof (*isub);
2912 
2913 		/* initialize dl_capab_zerocopy_t */
2914 		zc_oc = (dl_capab_zerocopy_t *)rptr;
2915 		*zc_oc = *zc_ic;
2916 
2917 		ip1dbg(("ill_capability_zerocopy_ack: asking interface %s "
2918 		    "to enable zero-copy version %d\n", ill->ill_name,
2919 		    ZEROCOPY_VERSION_1));
2920 
2921 		/* set VMSAFE_MEM flag */
2922 		zc_oc->zerocopy_flags |= DL_CAPAB_VMSAFE_MEM;
2923 
2924 		/* nmp points to a DL_CAPABILITY_REQ message to enable zcopy */
2925 		ill_capability_send(ill, nmp);
2926 	}
2927 }
2928 
2929 static void
2930 ill_capability_zerocopy_reset_fill(ill_t *ill, mblk_t *mp)
2931 {
2932 	dl_capab_zerocopy_t *zerocopy_subcap;
2933 	dl_capability_sub_t *dl_subcap;
2934 
2935 	if (!(ill->ill_capabilities & ILL_CAPAB_ZEROCOPY))
2936 		return;
2937 
2938 	ASSERT(ill->ill_zerocopy_capab != NULL);
2939 
2940 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2941 	dl_subcap->dl_cap = DL_CAPAB_ZEROCOPY;
2942 	dl_subcap->dl_length = sizeof (*zerocopy_subcap);
2943 
2944 	zerocopy_subcap = (dl_capab_zerocopy_t *)(dl_subcap + 1);
2945 	zerocopy_subcap->zerocopy_version =
2946 	    ill->ill_zerocopy_capab->ill_zerocopy_version;
2947 	zerocopy_subcap->zerocopy_flags = 0;
2948 
2949 	mp->b_wptr += sizeof (*dl_subcap) + sizeof (*zerocopy_subcap);
2950 }
2951 
2952 /*
2953  * DLD capability
2954  * Refer to dld.h for more information regarding the purpose and usage
2955  * of this capability.
2956  */
2957 static void
2958 ill_capability_dld_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2959 {
2960 	dl_capab_dld_t		*dld_ic, dld;
2961 	uint_t			sub_dl_cap = isub->dl_cap;
2962 	uint8_t			*capend;
2963 	ill_dld_capab_t		*idc;
2964 
2965 	ASSERT(IAM_WRITER_ILL(ill));
2966 	ASSERT(sub_dl_cap == DL_CAPAB_DLD);
2967 
2968 	/*
2969 	 * Note: range checks here are not absolutely sufficient to
2970 	 * make us robust against malformed messages sent by drivers;
2971 	 * this is in keeping with the rest of IP's dlpi handling.
2972 	 * (Remember, it's coming from something else in the kernel
2973 	 * address space)
2974 	 */
2975 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2976 	if (capend > mp->b_wptr) {
2977 		cmn_err(CE_WARN, "ill_capability_dld_ack: "
2978 		    "malformed sub-capability too long for mblk");
2979 		return;
2980 	}
2981 	dld_ic = (dl_capab_dld_t *)(isub + 1);
2982 	if (dld_ic->dld_version != DLD_CURRENT_VERSION) {
2983 		cmn_err(CE_CONT, "ill_capability_dld_ack: "
2984 		    "unsupported DLD sub-capability (version %d, "
2985 		    "expected %d)", dld_ic->dld_version,
2986 		    DLD_CURRENT_VERSION);
2987 		return;
2988 	}
2989 	if (!dlcapabcheckqid(&dld_ic->dld_mid, ill->ill_lmod_rq)) {
2990 		ip1dbg(("ill_capability_dld_ack: mid token for dld "
2991 		    "capability isn't as expected; pass-thru module(s) "
2992 		    "detected, discarding capability\n"));
2993 		return;
2994 	}
2995 
2996 	/*
2997 	 * Copy locally to ensure alignment.
2998 	 */
2999 	bcopy(dld_ic, &dld, sizeof (dl_capab_dld_t));
3000 
3001 	if ((idc = ill->ill_dld_capab) == NULL) {
3002 		idc = kmem_zalloc(sizeof (ill_dld_capab_t), KM_NOSLEEP);
3003 		if (idc == NULL) {
3004 			cmn_err(CE_WARN, "ill_capability_dld_ack: "
3005 			    "could not enable DLD version %d "
3006 			    "for %s (ENOMEM)\n", DLD_CURRENT_VERSION,
3007 			    ill->ill_name);
3008 			return;
3009 		}
3010 		idc->idc_capab_df = (ip_capab_func_t)dld.dld_capab;
3011 		idc->idc_capab_dh = (void *)dld.dld_capab_handle;
3012 		ill->ill_dld_capab = idc;
3013 	}
3014 	ip1dbg(("ill_capability_dld_ack: interface %s "
3015 	    "supports DLD version %d\n", ill->ill_name, DLD_CURRENT_VERSION));
3016 
3017 	ill_capability_dld_enable(ill);
3018 }
3019 
3020 /*
3021  * Typically capability negotiation between IP and the driver happens via
3022  * DLPI message exchange. However GLD also offers a direct function call
3023  * mechanism to exchange the DLD_DIRECT_CAPAB and DLD_POLL_CAPAB capabilities,
3024  * But arbitrary function calls into IP or GLD are not permitted, since both
3025  * of them are protected by their own perimeter mechanism. The perimeter can
3026  * be viewed as a coarse lock or serialization mechanism. The hierarchy of
3027  * these perimeters is IP -> MAC. Thus for example to enable the squeue
3028  * polling, IP needs to enter its perimeter, then call ill_mac_perim_enter
3029  * to enter the mac perimeter and then do the direct function calls into
3030  * GLD to enable squeue polling. The ring related callbacks from the mac into
3031  * the stack to add, bind, quiesce, restart or cleanup a ring are all
3032  * protected by the mac perimeter.
3033  */
3034 static void
3035 ill_mac_perim_enter(ill_t *ill, mac_perim_handle_t *mphp)
3036 {
3037 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
3038 	int			err;
3039 
3040 	err = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, mphp,
3041 	    DLD_ENABLE);
3042 	ASSERT(err == 0);
3043 }
3044 
3045 static void
3046 ill_mac_perim_exit(ill_t *ill, mac_perim_handle_t mph)
3047 {
3048 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
3049 	int			err;
3050 
3051 	err = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, mph,
3052 	    DLD_DISABLE);
3053 	ASSERT(err == 0);
3054 }
3055 
3056 boolean_t
3057 ill_mac_perim_held(ill_t *ill)
3058 {
3059 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
3060 
3061 	return (idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, NULL,
3062 	    DLD_QUERY));
3063 }
3064 
3065 static void
3066 ill_capability_direct_enable(ill_t *ill)
3067 {
3068 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
3069 	ill_dld_direct_t	*idd = &idc->idc_direct;
3070 	dld_capab_direct_t	direct;
3071 	int			rc;
3072 
3073 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
3074 
3075 	bzero(&direct, sizeof (direct));
3076 	direct.di_rx_cf = (uintptr_t)ip_input;
3077 	direct.di_rx_ch = ill;
3078 
3079 	rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_DIRECT, &direct,
3080 	    DLD_ENABLE);
3081 	if (rc == 0) {
3082 		idd->idd_tx_df = (ip_dld_tx_t)direct.di_tx_df;
3083 		idd->idd_tx_dh = direct.di_tx_dh;
3084 		idd->idd_tx_cb_df = (ip_dld_callb_t)direct.di_tx_cb_df;
3085 		idd->idd_tx_cb_dh = direct.di_tx_cb_dh;
3086 		/*
3087 		 * One time registration of flow enable callback function
3088 		 */
3089 		ill->ill_flownotify_mh = idd->idd_tx_cb_df(idd->idd_tx_cb_dh,
3090 		    ill_flow_enable, ill);
3091 		ill->ill_capabilities |= ILL_CAPAB_DLD_DIRECT;
3092 		DTRACE_PROBE1(direct_on, (ill_t *), ill);
3093 	} else {
3094 		cmn_err(CE_WARN, "warning: could not enable DIRECT "
3095 		    "capability, rc = %d\n", rc);
3096 		DTRACE_PROBE2(direct_off, (ill_t *), ill, (int), rc);
3097 	}
3098 }
3099 
3100 static void
3101 ill_capability_poll_enable(ill_t *ill)
3102 {
3103 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
3104 	dld_capab_poll_t	poll;
3105 	int			rc;
3106 
3107 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
3108 
3109 	bzero(&poll, sizeof (poll));
3110 	poll.poll_ring_add_cf = (uintptr_t)ip_squeue_add_ring;
3111 	poll.poll_ring_remove_cf = (uintptr_t)ip_squeue_clean_ring;
3112 	poll.poll_ring_quiesce_cf = (uintptr_t)ip_squeue_quiesce_ring;
3113 	poll.poll_ring_restart_cf = (uintptr_t)ip_squeue_restart_ring;
3114 	poll.poll_ring_bind_cf = (uintptr_t)ip_squeue_bind_ring;
3115 	poll.poll_ring_ch = ill;
3116 	rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_POLL, &poll,
3117 	    DLD_ENABLE);
3118 	if (rc == 0) {
3119 		ill->ill_capabilities |= ILL_CAPAB_DLD_POLL;
3120 		DTRACE_PROBE1(poll_on, (ill_t *), ill);
3121 	} else {
3122 		ip1dbg(("warning: could not enable POLL "
3123 		    "capability, rc = %d\n", rc));
3124 		DTRACE_PROBE2(poll_off, (ill_t *), ill, (int), rc);
3125 	}
3126 }
3127 
3128 /*
3129  * Enable the LSO capability.
3130  */
3131 static void
3132 ill_capability_lso_enable(ill_t *ill)
3133 {
3134 	ill_dld_capab_t	*idc = ill->ill_dld_capab;
3135 	dld_capab_lso_t	lso;
3136 	int rc;
3137 
3138 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
3139 
3140 	if (ill->ill_lso_capab == NULL) {
3141 		ill->ill_lso_capab = kmem_zalloc(sizeof (ill_lso_capab_t),
3142 		    KM_NOSLEEP);
3143 		if (ill->ill_lso_capab == NULL) {
3144 			cmn_err(CE_WARN, "ill_capability_lso_enable: "
3145 			    "could not enable LSO for %s (ENOMEM)\n",
3146 			    ill->ill_name);
3147 			return;
3148 		}
3149 	}
3150 
3151 	bzero(&lso, sizeof (lso));
3152 	if ((rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_LSO, &lso,
3153 	    DLD_ENABLE)) == 0) {
3154 		ill->ill_lso_capab->ill_lso_flags = lso.lso_flags;
3155 		ill->ill_lso_capab->ill_lso_max = lso.lso_max;
3156 		ill->ill_capabilities |= ILL_CAPAB_DLD_LSO;
3157 		ip1dbg(("ill_capability_lso_enable: interface %s "
3158 		    "has enabled LSO\n ", ill->ill_name));
3159 	} else {
3160 		kmem_free(ill->ill_lso_capab, sizeof (ill_lso_capab_t));
3161 		ill->ill_lso_capab = NULL;
3162 		DTRACE_PROBE2(lso_off, (ill_t *), ill, (int), rc);
3163 	}
3164 }
3165 
3166 static void
3167 ill_capability_dld_enable(ill_t *ill)
3168 {
3169 	mac_perim_handle_t mph;
3170 
3171 	ASSERT(IAM_WRITER_ILL(ill));
3172 
3173 	if (ill->ill_isv6)
3174 		return;
3175 
3176 	ill_mac_perim_enter(ill, &mph);
3177 	if (!ill->ill_isv6) {
3178 		ill_capability_direct_enable(ill);
3179 		ill_capability_poll_enable(ill);
3180 		ill_capability_lso_enable(ill);
3181 	}
3182 	ill->ill_capabilities |= ILL_CAPAB_DLD;
3183 	ill_mac_perim_exit(ill, mph);
3184 }
3185 
3186 static void
3187 ill_capability_dld_disable(ill_t *ill)
3188 {
3189 	ill_dld_capab_t	*idc;
3190 	ill_dld_direct_t *idd;
3191 	mac_perim_handle_t	mph;
3192 
3193 	ASSERT(IAM_WRITER_ILL(ill));
3194 
3195 	if (!(ill->ill_capabilities & ILL_CAPAB_DLD))
3196 		return;
3197 
3198 	ill_mac_perim_enter(ill, &mph);
3199 
3200 	idc = ill->ill_dld_capab;
3201 	if ((ill->ill_capabilities & ILL_CAPAB_DLD_DIRECT) != 0) {
3202 		/*
3203 		 * For performance we avoid locks in the transmit data path
3204 		 * and don't maintain a count of the number of threads using
3205 		 * direct calls. Thus some threads could be using direct
3206 		 * transmit calls to GLD, even after the capability mechanism
3207 		 * turns it off. This is still safe since the handles used in
3208 		 * the direct calls continue to be valid until the unplumb is
3209 		 * completed. Remove the callback that was added (1-time) at
3210 		 * capab enable time.
3211 		 */
3212 		mutex_enter(&ill->ill_lock);
3213 		ill->ill_capabilities &= ~ILL_CAPAB_DLD_DIRECT;
3214 		mutex_exit(&ill->ill_lock);
3215 		if (ill->ill_flownotify_mh != NULL) {
3216 			idd = &idc->idc_direct;
3217 			idd->idd_tx_cb_df(idd->idd_tx_cb_dh, NULL,
3218 			    ill->ill_flownotify_mh);
3219 			ill->ill_flownotify_mh = NULL;
3220 		}
3221 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_DIRECT,
3222 		    NULL, DLD_DISABLE);
3223 	}
3224 
3225 	if ((ill->ill_capabilities & ILL_CAPAB_DLD_POLL) != 0) {
3226 		ill->ill_capabilities &= ~ILL_CAPAB_DLD_POLL;
3227 		ip_squeue_clean_all(ill);
3228 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_POLL,
3229 		    NULL, DLD_DISABLE);
3230 	}
3231 
3232 	if ((ill->ill_capabilities & ILL_CAPAB_DLD_LSO) != 0) {
3233 		ASSERT(ill->ill_lso_capab != NULL);
3234 		/*
3235 		 * Clear the capability flag for LSO but retain the
3236 		 * ill_lso_capab structure since it's possible that another
3237 		 * thread is still referring to it.  The structure only gets
3238 		 * deallocated when we destroy the ill.
3239 		 */
3240 
3241 		ill->ill_capabilities &= ~ILL_CAPAB_DLD_LSO;
3242 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_LSO,
3243 		    NULL, DLD_DISABLE);
3244 	}
3245 
3246 	ill->ill_capabilities &= ~ILL_CAPAB_DLD;
3247 	ill_mac_perim_exit(ill, mph);
3248 }
3249 
3250 /*
3251  * Capability Negotiation protocol
3252  *
3253  * We don't wait for DLPI capability operations to finish during interface
3254  * bringup or teardown. Doing so would introduce more asynchrony and the
3255  * interface up/down operations will need multiple return and restarts.
3256  * Instead the 'ipsq_current_ipif' of the ipsq is not cleared as long as
3257  * the 'ill_dlpi_deferred' chain is non-empty. This ensures that the next
3258  * exclusive operation won't start until the DLPI operations of the previous
3259  * exclusive operation complete.
3260  *
3261  * The capability state machine is shown below.
3262  *
3263  * state		next state		event, action
3264  *
3265  * IDCS_UNKNOWN 	IDCS_PROBE_SENT		ill_capability_probe
3266  * IDCS_PROBE_SENT	IDCS_OK			ill_capability_ack
3267  * IDCS_PROBE_SENT	IDCS_FAILED		ip_rput_dlpi_writer (nack)
3268  * IDCS_OK		IDCS_RENEG		Receipt of DL_NOTE_CAPAB_RENEG
3269  * IDCS_OK		IDCS_RESET_SENT		ill_capability_reset
3270  * IDCS_RESET_SENT	IDCS_UNKNOWN		ill_capability_ack_thr
3271  * IDCS_RENEG		IDCS_PROBE_SENT		ill_capability_ack_thr ->
3272  *						    ill_capability_probe.
3273  */
3274 
3275 /*
3276  * Dedicated thread started from ip_stack_init that handles capability
3277  * disable. This thread ensures the taskq dispatch does not fail by waiting
3278  * for resources using TQ_SLEEP. The taskq mechanism is used to ensure
3279  * that direct calls to DLD are done in a cv_waitable context.
3280  */
3281 void
3282 ill_taskq_dispatch(ip_stack_t *ipst)
3283 {
3284 	callb_cpr_t cprinfo;
3285 	char 	name[64];
3286 	mblk_t	*mp;
3287 
3288 	(void) snprintf(name, sizeof (name), "ill_taskq_dispatch_%d",
3289 	    ipst->ips_netstack->netstack_stackid);
3290 	CALLB_CPR_INIT(&cprinfo, &ipst->ips_capab_taskq_lock, callb_generic_cpr,
3291 	    name);
3292 	mutex_enter(&ipst->ips_capab_taskq_lock);
3293 
3294 	for (;;) {
3295 		mp = list_head(&ipst->ips_capab_taskq_list);
3296 		while (mp != NULL) {
3297 			list_remove(&ipst->ips_capab_taskq_list, mp);
3298 			mutex_exit(&ipst->ips_capab_taskq_lock);
3299 			VERIFY(taskq_dispatch(system_taskq,
3300 			    ill_capability_ack_thr, mp, TQ_SLEEP) != 0);
3301 			mutex_enter(&ipst->ips_capab_taskq_lock);
3302 			mp = list_head(&ipst->ips_capab_taskq_list);
3303 		}
3304 
3305 		if (ipst->ips_capab_taskq_quit)
3306 			break;
3307 		CALLB_CPR_SAFE_BEGIN(&cprinfo);
3308 		cv_wait(&ipst->ips_capab_taskq_cv, &ipst->ips_capab_taskq_lock);
3309 		CALLB_CPR_SAFE_END(&cprinfo, &ipst->ips_capab_taskq_lock);
3310 	}
3311 	VERIFY(list_head(&ipst->ips_capab_taskq_list) == NULL);
3312 	CALLB_CPR_EXIT(&cprinfo);
3313 	thread_exit();
3314 }
3315 
3316 /*
3317  * Consume a new-style hardware capabilities negotiation ack.
3318  * Called via taskq on receipt of DL_CAPABBILITY_ACK.
3319  */
3320 static void
3321 ill_capability_ack_thr(void *arg)
3322 {
3323 	mblk_t	*mp = arg;
3324 	dl_capability_ack_t *capp;
3325 	dl_capability_sub_t *subp, *endp;
3326 	ill_t	*ill;
3327 	boolean_t reneg;
3328 
3329 	ill = (ill_t *)mp->b_prev;
3330 	VERIFY(ipsq_enter(ill, B_FALSE, CUR_OP) == B_TRUE);
3331 
3332 	if (ill->ill_dlpi_capab_state == IDCS_RESET_SENT ||
3333 	    ill->ill_dlpi_capab_state == IDCS_RENEG) {
3334 		/*
3335 		 * We have received the ack for our DL_CAPAB reset request.
3336 		 * There isnt' anything in the message that needs processing.
3337 		 * All message based capabilities have been disabled, now
3338 		 * do the function call based capability disable.
3339 		 */
3340 		reneg = ill->ill_dlpi_capab_state == IDCS_RENEG;
3341 		ill_capability_dld_disable(ill);
3342 		ill->ill_dlpi_capab_state = IDCS_UNKNOWN;
3343 		if (reneg)
3344 			ill_capability_probe(ill);
3345 		goto done;
3346 	}
3347 
3348 	if (ill->ill_dlpi_capab_state == IDCS_PROBE_SENT)
3349 		ill->ill_dlpi_capab_state = IDCS_OK;
3350 
3351 	capp = (dl_capability_ack_t *)mp->b_rptr;
3352 
3353 	if (capp->dl_sub_length == 0) {
3354 		/* no new-style capabilities */
3355 		goto done;
3356 	}
3357 
3358 	/* make sure the driver supplied correct dl_sub_length */
3359 	if ((sizeof (*capp) + capp->dl_sub_length) > MBLKL(mp)) {
3360 		ip0dbg(("ill_capability_ack: bad DL_CAPABILITY_ACK, "
3361 		    "invalid dl_sub_length (%d)\n", capp->dl_sub_length));
3362 		goto done;
3363 	}
3364 
3365 #define	SC(base, offset) (dl_capability_sub_t *)(((uchar_t *)(base))+(offset))
3366 	/*
3367 	 * There are sub-capabilities. Process the ones we know about.
3368 	 * Loop until we don't have room for another sub-cap header..
3369 	 */
3370 	for (subp = SC(capp, capp->dl_sub_offset),
3371 	    endp = SC(subp, capp->dl_sub_length - sizeof (*subp));
3372 	    subp <= endp;
3373 	    subp = SC(subp, sizeof (dl_capability_sub_t) + subp->dl_length)) {
3374 
3375 		switch (subp->dl_cap) {
3376 		case DL_CAPAB_ID_WRAPPER:
3377 			ill_capability_id_ack(ill, mp, subp);
3378 			break;
3379 		default:
3380 			ill_capability_dispatch(ill, mp, subp, B_FALSE);
3381 			break;
3382 		}
3383 	}
3384 #undef SC
3385 done:
3386 	inet_freemsg(mp);
3387 	ill_capability_done(ill);
3388 	ipsq_exit(ill->ill_phyint->phyint_ipsq);
3389 }
3390 
3391 /*
3392  * This needs to be started in a taskq thread to provide a cv_waitable
3393  * context.
3394  */
3395 void
3396 ill_capability_ack(ill_t *ill, mblk_t *mp)
3397 {
3398 	ip_stack_t	*ipst = ill->ill_ipst;
3399 
3400 	mp->b_prev = (mblk_t *)ill;
3401 	if (taskq_dispatch(system_taskq, ill_capability_ack_thr, mp,
3402 	    TQ_NOSLEEP) != 0)
3403 		return;
3404 
3405 	/*
3406 	 * The taskq dispatch failed. Signal the ill_taskq_dispatch thread
3407 	 * which will do the dispatch using TQ_SLEEP to guarantee success.
3408 	 */
3409 	mutex_enter(&ipst->ips_capab_taskq_lock);
3410 	list_insert_tail(&ipst->ips_capab_taskq_list, mp);
3411 	cv_signal(&ipst->ips_capab_taskq_cv);
3412 	mutex_exit(&ipst->ips_capab_taskq_lock);
3413 }
3414 
3415 /*
3416  * This routine is called to scan the fragmentation reassembly table for
3417  * the specified ILL for any packets that are starting to smell.
3418  * dead_interval is the maximum time in seconds that will be tolerated.  It
3419  * will either be the value specified in ip_g_frag_timeout, or zero if the
3420  * ILL is shutting down and it is time to blow everything off.
3421  *
3422  * It returns the number of seconds (as a time_t) that the next frag timer
3423  * should be scheduled for, 0 meaning that the timer doesn't need to be
3424  * re-started.  Note that the method of calculating next_timeout isn't
3425  * entirely accurate since time will flow between the time we grab
3426  * current_time and the time we schedule the next timeout.  This isn't a
3427  * big problem since this is the timer for sending an ICMP reassembly time
3428  * exceeded messages, and it doesn't have to be exactly accurate.
3429  *
3430  * This function is
3431  * sometimes called as writer, although this is not required.
3432  */
3433 time_t
3434 ill_frag_timeout(ill_t *ill, time_t dead_interval)
3435 {
3436 	ipfb_t	*ipfb;
3437 	ipfb_t	*endp;
3438 	ipf_t	*ipf;
3439 	ipf_t	*ipfnext;
3440 	mblk_t	*mp;
3441 	time_t	current_time = gethrestime_sec();
3442 	time_t	next_timeout = 0;
3443 	uint32_t	hdr_length;
3444 	mblk_t	*send_icmp_head;
3445 	mblk_t	*send_icmp_head_v6;
3446 	zoneid_t zoneid;
3447 	ip_stack_t *ipst = ill->ill_ipst;
3448 
3449 	ipfb = ill->ill_frag_hash_tbl;
3450 	if (ipfb == NULL)
3451 		return (B_FALSE);
3452 	endp = &ipfb[ILL_FRAG_HASH_TBL_COUNT];
3453 	/* Walk the frag hash table. */
3454 	for (; ipfb < endp; ipfb++) {
3455 		send_icmp_head = NULL;
3456 		send_icmp_head_v6 = NULL;
3457 		mutex_enter(&ipfb->ipfb_lock);
3458 		while ((ipf = ipfb->ipfb_ipf) != 0) {
3459 			time_t frag_time = current_time - ipf->ipf_timestamp;
3460 			time_t frag_timeout;
3461 
3462 			if (frag_time < dead_interval) {
3463 				/*
3464 				 * There are some outstanding fragments
3465 				 * that will timeout later.  Make note of
3466 				 * the time so that we can reschedule the
3467 				 * next timeout appropriately.
3468 				 */
3469 				frag_timeout = dead_interval - frag_time;
3470 				if (next_timeout == 0 ||
3471 				    frag_timeout < next_timeout) {
3472 					next_timeout = frag_timeout;
3473 				}
3474 				break;
3475 			}
3476 			/* Time's up.  Get it out of here. */
3477 			hdr_length = ipf->ipf_nf_hdr_len;
3478 			ipfnext = ipf->ipf_hash_next;
3479 			if (ipfnext)
3480 				ipfnext->ipf_ptphn = ipf->ipf_ptphn;
3481 			*ipf->ipf_ptphn = ipfnext;
3482 			mp = ipf->ipf_mp->b_cont;
3483 			for (; mp; mp = mp->b_cont) {
3484 				/* Extra points for neatness. */
3485 				IP_REASS_SET_START(mp, 0);
3486 				IP_REASS_SET_END(mp, 0);
3487 			}
3488 			mp = ipf->ipf_mp->b_cont;
3489 			atomic_add_32(&ill->ill_frag_count, -ipf->ipf_count);
3490 			ASSERT(ipfb->ipfb_count >= ipf->ipf_count);
3491 			ipfb->ipfb_count -= ipf->ipf_count;
3492 			ASSERT(ipfb->ipfb_frag_pkts > 0);
3493 			ipfb->ipfb_frag_pkts--;
3494 			/*
3495 			 * We do not send any icmp message from here because
3496 			 * we currently are holding the ipfb_lock for this
3497 			 * hash chain. If we try and send any icmp messages
3498 			 * from here we may end up via a put back into ip
3499 			 * trying to get the same lock, causing a recursive
3500 			 * mutex panic. Instead we build a list and send all
3501 			 * the icmp messages after we have dropped the lock.
3502 			 */
3503 			if (ill->ill_isv6) {
3504 				if (hdr_length != 0) {
3505 					mp->b_next = send_icmp_head_v6;
3506 					send_icmp_head_v6 = mp;
3507 				} else {
3508 					freemsg(mp);
3509 				}
3510 			} else {
3511 				if (hdr_length != 0) {
3512 					mp->b_next = send_icmp_head;
3513 					send_icmp_head = mp;
3514 				} else {
3515 					freemsg(mp);
3516 				}
3517 			}
3518 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmFails);
3519 			freeb(ipf->ipf_mp);
3520 		}
3521 		mutex_exit(&ipfb->ipfb_lock);
3522 		/*
3523 		 * Now need to send any icmp messages that we delayed from
3524 		 * above.
3525 		 */
3526 		while (send_icmp_head_v6 != NULL) {
3527 			ip6_t *ip6h;
3528 
3529 			mp = send_icmp_head_v6;
3530 			send_icmp_head_v6 = send_icmp_head_v6->b_next;
3531 			mp->b_next = NULL;
3532 			if (mp->b_datap->db_type == M_CTL)
3533 				ip6h = (ip6_t *)mp->b_cont->b_rptr;
3534 			else
3535 				ip6h = (ip6_t *)mp->b_rptr;
3536 			zoneid = ipif_lookup_addr_zoneid_v6(&ip6h->ip6_dst,
3537 			    ill, ipst);
3538 			if (zoneid == ALL_ZONES) {
3539 				freemsg(mp);
3540 			} else {
3541 				icmp_time_exceeded_v6(ill->ill_wq, mp,
3542 				    ICMP_REASSEMBLY_TIME_EXCEEDED, B_FALSE,
3543 				    B_FALSE, zoneid, ipst);
3544 			}
3545 		}
3546 		while (send_icmp_head != NULL) {
3547 			ipaddr_t dst;
3548 
3549 			mp = send_icmp_head;
3550 			send_icmp_head = send_icmp_head->b_next;
3551 			mp->b_next = NULL;
3552 
3553 			if (mp->b_datap->db_type == M_CTL)
3554 				dst = ((ipha_t *)mp->b_cont->b_rptr)->ipha_dst;
3555 			else
3556 				dst = ((ipha_t *)mp->b_rptr)->ipha_dst;
3557 
3558 			zoneid = ipif_lookup_addr_zoneid(dst, ill, ipst);
3559 			if (zoneid == ALL_ZONES) {
3560 				freemsg(mp);
3561 			} else {
3562 				icmp_time_exceeded(ill->ill_wq, mp,
3563 				    ICMP_REASSEMBLY_TIME_EXCEEDED, zoneid,
3564 				    ipst);
3565 			}
3566 		}
3567 	}
3568 	/*
3569 	 * A non-dying ILL will use the return value to decide whether to
3570 	 * restart the frag timer, and for how long.
3571 	 */
3572 	return (next_timeout);
3573 }
3574 
3575 /*
3576  * This routine is called when the approximate count of mblk memory used
3577  * for the specified ILL has exceeded max_count.
3578  */
3579 void
3580 ill_frag_prune(ill_t *ill, uint_t max_count)
3581 {
3582 	ipfb_t	*ipfb;
3583 	ipf_t	*ipf;
3584 	size_t	count;
3585 
3586 	/*
3587 	 * If we are here within ip_min_frag_prune_time msecs remove
3588 	 * ill_frag_free_num_pkts oldest packets from each bucket and increment
3589 	 * ill_frag_free_num_pkts.
3590 	 */
3591 	mutex_enter(&ill->ill_lock);
3592 	if (TICK_TO_MSEC(lbolt - ill->ill_last_frag_clean_time) <=
3593 	    (ip_min_frag_prune_time != 0 ?
3594 	    ip_min_frag_prune_time : msec_per_tick)) {
3595 
3596 		ill->ill_frag_free_num_pkts++;
3597 
3598 	} else {
3599 		ill->ill_frag_free_num_pkts = 0;
3600 	}
3601 	ill->ill_last_frag_clean_time = lbolt;
3602 	mutex_exit(&ill->ill_lock);
3603 
3604 	/*
3605 	 * free ill_frag_free_num_pkts oldest packets from each bucket.
3606 	 */
3607 	if (ill->ill_frag_free_num_pkts != 0) {
3608 		int ix;
3609 
3610 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
3611 			ipfb = &ill->ill_frag_hash_tbl[ix];
3612 			mutex_enter(&ipfb->ipfb_lock);
3613 			if (ipfb->ipfb_ipf != NULL) {
3614 				ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf,
3615 				    ill->ill_frag_free_num_pkts);
3616 			}
3617 			mutex_exit(&ipfb->ipfb_lock);
3618 		}
3619 	}
3620 	/*
3621 	 * While the reassembly list for this ILL is too big, prune a fragment
3622 	 * queue by age, oldest first.
3623 	 */
3624 	while (ill->ill_frag_count > max_count) {
3625 		int	ix;
3626 		ipfb_t	*oipfb = NULL;
3627 		uint_t	oldest = UINT_MAX;
3628 
3629 		count = 0;
3630 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
3631 			ipfb = &ill->ill_frag_hash_tbl[ix];
3632 			mutex_enter(&ipfb->ipfb_lock);
3633 			ipf = ipfb->ipfb_ipf;
3634 			if (ipf != NULL && ipf->ipf_gen < oldest) {
3635 				oldest = ipf->ipf_gen;
3636 				oipfb = ipfb;
3637 			}
3638 			count += ipfb->ipfb_count;
3639 			mutex_exit(&ipfb->ipfb_lock);
3640 		}
3641 		if (oipfb == NULL)
3642 			break;
3643 
3644 		if (count <= max_count)
3645 			return;	/* Somebody beat us to it, nothing to do */
3646 		mutex_enter(&oipfb->ipfb_lock);
3647 		ipf = oipfb->ipfb_ipf;
3648 		if (ipf != NULL) {
3649 			ill_frag_free_pkts(ill, oipfb, ipf, 1);
3650 		}
3651 		mutex_exit(&oipfb->ipfb_lock);
3652 	}
3653 }
3654 
3655 /*
3656  * free 'free_cnt' fragmented packets starting at ipf.
3657  */
3658 void
3659 ill_frag_free_pkts(ill_t *ill, ipfb_t *ipfb, ipf_t *ipf, int free_cnt)
3660 {
3661 	size_t	count;
3662 	mblk_t	*mp;
3663 	mblk_t	*tmp;
3664 	ipf_t **ipfp = ipf->ipf_ptphn;
3665 
3666 	ASSERT(MUTEX_HELD(&ipfb->ipfb_lock));
3667 	ASSERT(ipfp != NULL);
3668 	ASSERT(ipf != NULL);
3669 
3670 	while (ipf != NULL && free_cnt-- > 0) {
3671 		count = ipf->ipf_count;
3672 		mp = ipf->ipf_mp;
3673 		ipf = ipf->ipf_hash_next;
3674 		for (tmp = mp; tmp; tmp = tmp->b_cont) {
3675 			IP_REASS_SET_START(tmp, 0);
3676 			IP_REASS_SET_END(tmp, 0);
3677 		}
3678 		atomic_add_32(&ill->ill_frag_count, -count);
3679 		ASSERT(ipfb->ipfb_count >= count);
3680 		ipfb->ipfb_count -= count;
3681 		ASSERT(ipfb->ipfb_frag_pkts > 0);
3682 		ipfb->ipfb_frag_pkts--;
3683 		freemsg(mp);
3684 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmFails);
3685 	}
3686 
3687 	if (ipf)
3688 		ipf->ipf_ptphn = ipfp;
3689 	ipfp[0] = ipf;
3690 }
3691 
3692 #define	ND_FORWARD_WARNING	"The <if>:ip*_forwarding ndd variables are " \
3693 	"obsolete and may be removed in a future release of Solaris.  Use " \
3694 	"ifconfig(1M) to manipulate the forwarding status of an interface."
3695 
3696 /*
3697  * For obsolete per-interface forwarding configuration;
3698  * called in response to ND_GET.
3699  */
3700 /* ARGSUSED */
3701 static int
3702 nd_ill_forward_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *ioc_cr)
3703 {
3704 	ill_t *ill = (ill_t *)cp;
3705 
3706 	cmn_err(CE_WARN, ND_FORWARD_WARNING);
3707 
3708 	(void) mi_mpprintf(mp, "%d", (ill->ill_flags & ILLF_ROUTER) != 0);
3709 	return (0);
3710 }
3711 
3712 /*
3713  * For obsolete per-interface forwarding configuration;
3714  * called in response to ND_SET.
3715  */
3716 /* ARGSUSED */
3717 static int
3718 nd_ill_forward_set(queue_t *q, mblk_t *mp, char *valuestr, caddr_t cp,
3719     cred_t *ioc_cr)
3720 {
3721 	long value;
3722 	int retval;
3723 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
3724 
3725 	cmn_err(CE_WARN, ND_FORWARD_WARNING);
3726 
3727 	if (ddi_strtol(valuestr, NULL, 10, &value) != 0 ||
3728 	    value < 0 || value > 1) {
3729 		return (EINVAL);
3730 	}
3731 
3732 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3733 	retval = ill_forward_set((ill_t *)cp, (value != 0));
3734 	rw_exit(&ipst->ips_ill_g_lock);
3735 	return (retval);
3736 }
3737 
3738 /*
3739  * Helper function for ill_forward_set().
3740  */
3741 static void
3742 ill_forward_set_on_ill(ill_t *ill, boolean_t enable)
3743 {
3744 	ip_stack_t	*ipst = ill->ill_ipst;
3745 
3746 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ipst->ips_ill_g_lock));
3747 
3748 	ip1dbg(("ill_forward_set: %s %s forwarding on %s",
3749 	    (enable ? "Enabling" : "Disabling"),
3750 	    (ill->ill_isv6 ? "IPv6" : "IPv4"), ill->ill_name));
3751 	mutex_enter(&ill->ill_lock);
3752 	if (enable)
3753 		ill->ill_flags |= ILLF_ROUTER;
3754 	else
3755 		ill->ill_flags &= ~ILLF_ROUTER;
3756 	mutex_exit(&ill->ill_lock);
3757 	if (ill->ill_isv6)
3758 		ill_set_nce_router_flags(ill, enable);
3759 	/* Notify routing socket listeners of this change. */
3760 	ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
3761 }
3762 
3763 /*
3764  * Set an ill's ILLF_ROUTER flag appropriately.  Send up RTS_IFINFO routing
3765  * socket messages for each interface whose flags we change.
3766  */
3767 int
3768 ill_forward_set(ill_t *ill, boolean_t enable)
3769 {
3770 	ipmp_illgrp_t *illg;
3771 	ip_stack_t *ipst = ill->ill_ipst;
3772 
3773 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ipst->ips_ill_g_lock));
3774 
3775 	if ((enable && (ill->ill_flags & ILLF_ROUTER)) ||
3776 	    (!enable && !(ill->ill_flags & ILLF_ROUTER)))
3777 		return (0);
3778 
3779 	if (IS_LOOPBACK(ill))
3780 		return (EINVAL);
3781 
3782 	if (IS_IPMP(ill) || IS_UNDER_IPMP(ill)) {
3783 		/*
3784 		 * Update all of the interfaces in the group.
3785 		 */
3786 		illg = ill->ill_grp;
3787 		ill = list_head(&illg->ig_if);
3788 		for (; ill != NULL; ill = list_next(&illg->ig_if, ill))
3789 			ill_forward_set_on_ill(ill, enable);
3790 
3791 		/*
3792 		 * Update the IPMP meta-interface.
3793 		 */
3794 		ill_forward_set_on_ill(ipmp_illgrp_ipmp_ill(illg), enable);
3795 		return (0);
3796 	}
3797 
3798 	ill_forward_set_on_ill(ill, enable);
3799 	return (0);
3800 }
3801 
3802 /*
3803  * Based on the ILLF_ROUTER flag of an ill, make sure all local nce's for
3804  * addresses assigned to the ill have the NCE_F_ISROUTER flag appropriately
3805  * set or clear.
3806  */
3807 static void
3808 ill_set_nce_router_flags(ill_t *ill, boolean_t enable)
3809 {
3810 	ipif_t *ipif;
3811 	nce_t *nce;
3812 
3813 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
3814 		/*
3815 		 * NOTE: we match across the illgrp because nce's for
3816 		 * addresses on IPMP interfaces have an nce_ill that points to
3817 		 * the bound underlying ill.
3818 		 */
3819 		nce = ndp_lookup_v6(ill, B_TRUE, &ipif->ipif_v6lcl_addr,
3820 		    B_FALSE);
3821 		if (nce != NULL) {
3822 			mutex_enter(&nce->nce_lock);
3823 			if (enable)
3824 				nce->nce_flags |= NCE_F_ISROUTER;
3825 			else
3826 				nce->nce_flags &= ~NCE_F_ISROUTER;
3827 			mutex_exit(&nce->nce_lock);
3828 			NCE_REFRELE(nce);
3829 		}
3830 	}
3831 }
3832 
3833 /*
3834  * Given an ill with a _valid_ name, add the ip_forwarding ndd variable
3835  * for this ill.  Make sure the v6/v4 question has been answered about this
3836  * ill.  The creation of this ndd variable is only for backwards compatibility.
3837  * The preferred way to control per-interface IP forwarding is through the
3838  * ILLF_ROUTER interface flag.
3839  */
3840 static int
3841 ill_set_ndd_name(ill_t *ill)
3842 {
3843 	char *suffix;
3844 	ip_stack_t	*ipst = ill->ill_ipst;
3845 
3846 	ASSERT(IAM_WRITER_ILL(ill));
3847 
3848 	if (ill->ill_isv6)
3849 		suffix = ipv6_forward_suffix;
3850 	else
3851 		suffix = ipv4_forward_suffix;
3852 
3853 	ill->ill_ndd_name = ill->ill_name + ill->ill_name_length;
3854 	bcopy(ill->ill_name, ill->ill_ndd_name, ill->ill_name_length - 1);
3855 	/*
3856 	 * Copies over the '\0'.
3857 	 * Note that strlen(suffix) is always bounded.
3858 	 */
3859 	bcopy(suffix, ill->ill_ndd_name + ill->ill_name_length - 1,
3860 	    strlen(suffix) + 1);
3861 
3862 	/*
3863 	 * Use of the nd table requires holding the reader lock.
3864 	 * Modifying the nd table thru nd_load/nd_unload requires
3865 	 * the writer lock.
3866 	 */
3867 	rw_enter(&ipst->ips_ip_g_nd_lock, RW_WRITER);
3868 	if (!nd_load(&ipst->ips_ip_g_nd, ill->ill_ndd_name, nd_ill_forward_get,
3869 	    nd_ill_forward_set, (caddr_t)ill)) {
3870 		/*
3871 		 * If the nd_load failed, it only meant that it could not
3872 		 * allocate a new bunch of room for further NDD expansion.
3873 		 * Because of that, the ill_ndd_name will be set to 0, and
3874 		 * this interface is at the mercy of the global ip_forwarding
3875 		 * variable.
3876 		 */
3877 		rw_exit(&ipst->ips_ip_g_nd_lock);
3878 		ill->ill_ndd_name = NULL;
3879 		return (ENOMEM);
3880 	}
3881 	rw_exit(&ipst->ips_ip_g_nd_lock);
3882 	return (0);
3883 }
3884 
3885 /*
3886  * Intializes the context structure and returns the first ill in the list
3887  * cuurently start_list and end_list can have values:
3888  * MAX_G_HEADS		Traverse both IPV4 and IPV6 lists.
3889  * IP_V4_G_HEAD		Traverse IPV4 list only.
3890  * IP_V6_G_HEAD		Traverse IPV6 list only.
3891  */
3892 
3893 /*
3894  * We don't check for CONDEMNED ills here. Caller must do that if
3895  * necessary under the ill lock.
3896  */
3897 ill_t *
3898 ill_first(int start_list, int end_list, ill_walk_context_t *ctx,
3899     ip_stack_t *ipst)
3900 {
3901 	ill_if_t *ifp;
3902 	ill_t *ill;
3903 	avl_tree_t *avl_tree;
3904 
3905 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
3906 	ASSERT(end_list <= MAX_G_HEADS && start_list >= 0);
3907 
3908 	/*
3909 	 * setup the lists to search
3910 	 */
3911 	if (end_list != MAX_G_HEADS) {
3912 		ctx->ctx_current_list = start_list;
3913 		ctx->ctx_last_list = end_list;
3914 	} else {
3915 		ctx->ctx_last_list = MAX_G_HEADS - 1;
3916 		ctx->ctx_current_list = 0;
3917 	}
3918 
3919 	while (ctx->ctx_current_list <= ctx->ctx_last_list) {
3920 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst);
3921 		if (ifp != (ill_if_t *)
3922 		    &IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst)) {
3923 			avl_tree = &ifp->illif_avl_by_ppa;
3924 			ill = avl_first(avl_tree);
3925 			/*
3926 			 * ill is guaranteed to be non NULL or ifp should have
3927 			 * not existed.
3928 			 */
3929 			ASSERT(ill != NULL);
3930 			return (ill);
3931 		}
3932 		ctx->ctx_current_list++;
3933 	}
3934 
3935 	return (NULL);
3936 }
3937 
3938 /*
3939  * returns the next ill in the list. ill_first() must have been called
3940  * before calling ill_next() or bad things will happen.
3941  */
3942 
3943 /*
3944  * We don't check for CONDEMNED ills here. Caller must do that if
3945  * necessary under the ill lock.
3946  */
3947 ill_t *
3948 ill_next(ill_walk_context_t *ctx, ill_t *lastill)
3949 {
3950 	ill_if_t *ifp;
3951 	ill_t *ill;
3952 	ip_stack_t	*ipst = lastill->ill_ipst;
3953 
3954 	ASSERT(lastill->ill_ifptr != (ill_if_t *)
3955 	    &IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst));
3956 	if ((ill = avl_walk(&lastill->ill_ifptr->illif_avl_by_ppa, lastill,
3957 	    AVL_AFTER)) != NULL) {
3958 		return (ill);
3959 	}
3960 
3961 	/* goto next ill_ifp in the list. */
3962 	ifp = lastill->ill_ifptr->illif_next;
3963 
3964 	/* make sure not at end of circular list */
3965 	while (ifp ==
3966 	    (ill_if_t *)&IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst)) {
3967 		if (++ctx->ctx_current_list > ctx->ctx_last_list)
3968 			return (NULL);
3969 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst);
3970 	}
3971 
3972 	return (avl_first(&ifp->illif_avl_by_ppa));
3973 }
3974 
3975 /*
3976  * Check interface name for correct format: [a-zA-Z]+[a-zA-Z0-9._]*[0-9]+
3977  * The final number (PPA) must not have any leading zeros.  Upon success, a
3978  * pointer to the start of the PPA is returned; otherwise NULL is returned.
3979  */
3980 static char *
3981 ill_get_ppa_ptr(char *name)
3982 {
3983 	int namelen = strlen(name);
3984 	int end_ndx = namelen - 1;
3985 	int ppa_ndx, i;
3986 
3987 	/*
3988 	 * Check that the first character is [a-zA-Z], and that the last
3989 	 * character is [0-9].
3990 	 */
3991 	if (namelen == 0 || !isalpha(name[0]) || !isdigit(name[end_ndx]))
3992 		return (NULL);
3993 
3994 	/*
3995 	 * Set `ppa_ndx' to the PPA start, and check for leading zeroes.
3996 	 */
3997 	for (ppa_ndx = end_ndx; ppa_ndx > 0; ppa_ndx--)
3998 		if (!isdigit(name[ppa_ndx - 1]))
3999 			break;
4000 
4001 	if (name[ppa_ndx] == '0' && ppa_ndx < end_ndx)
4002 		return (NULL);
4003 
4004 	/*
4005 	 * Check that the intermediate characters are [a-z0-9.]
4006 	 */
4007 	for (i = 1; i < ppa_ndx; i++) {
4008 		if (!isalpha(name[i]) && !isdigit(name[i]) &&
4009 		    name[i] != '.' && name[i] != '_') {
4010 			return (NULL);
4011 		}
4012 	}
4013 
4014 	return (name + ppa_ndx);
4015 }
4016 
4017 /*
4018  * use avl tree to locate the ill.
4019  */
4020 static ill_t *
4021 ill_find_by_name(char *name, boolean_t isv6, queue_t *q, mblk_t *mp,
4022     ipsq_func_t func, int *error, ip_stack_t *ipst)
4023 {
4024 	char *ppa_ptr = NULL;
4025 	int len;
4026 	uint_t ppa;
4027 	ill_t *ill = NULL;
4028 	ill_if_t *ifp;
4029 	int list;
4030 	ipsq_t *ipsq;
4031 
4032 	if (error != NULL)
4033 		*error = 0;
4034 
4035 	/*
4036 	 * get ppa ptr
4037 	 */
4038 	if (isv6)
4039 		list = IP_V6_G_HEAD;
4040 	else
4041 		list = IP_V4_G_HEAD;
4042 
4043 	if ((ppa_ptr = ill_get_ppa_ptr(name)) == NULL) {
4044 		if (error != NULL)
4045 			*error = ENXIO;
4046 		return (NULL);
4047 	}
4048 
4049 	len = ppa_ptr - name + 1;
4050 
4051 	ppa = stoi(&ppa_ptr);
4052 
4053 	ifp = IP_VX_ILL_G_LIST(list, ipst);
4054 
4055 	while (ifp != (ill_if_t *)&IP_VX_ILL_G_LIST(list, ipst)) {
4056 		/*
4057 		 * match is done on len - 1 as the name is not null
4058 		 * terminated it contains ppa in addition to the interface
4059 		 * name.
4060 		 */
4061 		if ((ifp->illif_name_len == len) &&
4062 		    bcmp(ifp->illif_name, name, len - 1) == 0) {
4063 			break;
4064 		} else {
4065 			ifp = ifp->illif_next;
4066 		}
4067 	}
4068 
4069 	if (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(list, ipst)) {
4070 		/*
4071 		 * Even the interface type does not exist.
4072 		 */
4073 		if (error != NULL)
4074 			*error = ENXIO;
4075 		return (NULL);
4076 	}
4077 
4078 	ill = avl_find(&ifp->illif_avl_by_ppa, (void *) &ppa, NULL);
4079 	if (ill != NULL) {
4080 		/*
4081 		 * The block comment at the start of ipif_down
4082 		 * explains the use of the macros used below
4083 		 */
4084 		GRAB_CONN_LOCK(q);
4085 		mutex_enter(&ill->ill_lock);
4086 		if (ILL_CAN_LOOKUP(ill)) {
4087 			ill_refhold_locked(ill);
4088 			mutex_exit(&ill->ill_lock);
4089 			RELEASE_CONN_LOCK(q);
4090 			return (ill);
4091 		} else if (ILL_CAN_WAIT(ill, q)) {
4092 			ipsq = ill->ill_phyint->phyint_ipsq;
4093 			mutex_enter(&ipsq->ipsq_lock);
4094 			mutex_enter(&ipsq->ipsq_xop->ipx_lock);
4095 			mutex_exit(&ill->ill_lock);
4096 			ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
4097 			mutex_exit(&ipsq->ipsq_xop->ipx_lock);
4098 			mutex_exit(&ipsq->ipsq_lock);
4099 			RELEASE_CONN_LOCK(q);
4100 			if (error != NULL)
4101 				*error = EINPROGRESS;
4102 			return (NULL);
4103 		}
4104 		mutex_exit(&ill->ill_lock);
4105 		RELEASE_CONN_LOCK(q);
4106 	}
4107 	if (error != NULL)
4108 		*error = ENXIO;
4109 	return (NULL);
4110 }
4111 
4112 /*
4113  * comparison function for use with avl.
4114  */
4115 static int
4116 ill_compare_ppa(const void *ppa_ptr, const void *ill_ptr)
4117 {
4118 	uint_t ppa;
4119 	uint_t ill_ppa;
4120 
4121 	ASSERT(ppa_ptr != NULL && ill_ptr != NULL);
4122 
4123 	ppa = *((uint_t *)ppa_ptr);
4124 	ill_ppa = ((const ill_t *)ill_ptr)->ill_ppa;
4125 	/*
4126 	 * We want the ill with the lowest ppa to be on the
4127 	 * top.
4128 	 */
4129 	if (ill_ppa < ppa)
4130 		return (1);
4131 	if (ill_ppa > ppa)
4132 		return (-1);
4133 	return (0);
4134 }
4135 
4136 /*
4137  * remove an interface type from the global list.
4138  */
4139 static void
4140 ill_delete_interface_type(ill_if_t *interface)
4141 {
4142 	ASSERT(interface != NULL);
4143 	ASSERT(avl_numnodes(&interface->illif_avl_by_ppa) == 0);
4144 
4145 	avl_destroy(&interface->illif_avl_by_ppa);
4146 	if (interface->illif_ppa_arena != NULL)
4147 		vmem_destroy(interface->illif_ppa_arena);
4148 
4149 	remque(interface);
4150 
4151 	mi_free(interface);
4152 }
4153 
4154 /*
4155  * remove ill from the global list.
4156  */
4157 static void
4158 ill_glist_delete(ill_t *ill)
4159 {
4160 	ip_stack_t	*ipst;
4161 	phyint_t	*phyi;
4162 
4163 	if (ill == NULL)
4164 		return;
4165 	ipst = ill->ill_ipst;
4166 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
4167 
4168 	/*
4169 	 * If the ill was never inserted into the AVL tree
4170 	 * we skip the if branch.
4171 	 */
4172 	if (ill->ill_ifptr != NULL) {
4173 		/*
4174 		 * remove from AVL tree and free ppa number
4175 		 */
4176 		avl_remove(&ill->ill_ifptr->illif_avl_by_ppa, ill);
4177 
4178 		if (ill->ill_ifptr->illif_ppa_arena != NULL) {
4179 			vmem_free(ill->ill_ifptr->illif_ppa_arena,
4180 			    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
4181 		}
4182 		if (avl_numnodes(&ill->ill_ifptr->illif_avl_by_ppa) == 0) {
4183 			ill_delete_interface_type(ill->ill_ifptr);
4184 		}
4185 
4186 		/*
4187 		 * Indicate ill is no longer in the list.
4188 		 */
4189 		ill->ill_ifptr = NULL;
4190 		ill->ill_name_length = 0;
4191 		ill->ill_name[0] = '\0';
4192 		ill->ill_ppa = UINT_MAX;
4193 	}
4194 
4195 	/* Generate one last event for this ill. */
4196 	ill_nic_event_dispatch(ill, 0, NE_UNPLUMB, ill->ill_name,
4197 	    ill->ill_name_length);
4198 
4199 	ASSERT(ill->ill_phyint != NULL);
4200 	phyi = ill->ill_phyint;
4201 	ill->ill_phyint = NULL;
4202 
4203 	/*
4204 	 * ill_init allocates a phyint always to store the copy
4205 	 * of flags relevant to phyint. At that point in time, we could
4206 	 * not assign the name and hence phyint_illv4/v6 could not be
4207 	 * initialized. Later in ipif_set_values, we assign the name to
4208 	 * the ill, at which point in time we assign phyint_illv4/v6.
4209 	 * Thus we don't rely on phyint_illv6 to be initialized always.
4210 	 */
4211 	if (ill->ill_flags & ILLF_IPV6)
4212 		phyi->phyint_illv6 = NULL;
4213 	else
4214 		phyi->phyint_illv4 = NULL;
4215 
4216 	if (phyi->phyint_illv4 != NULL || phyi->phyint_illv6 != NULL) {
4217 		rw_exit(&ipst->ips_ill_g_lock);
4218 		return;
4219 	}
4220 
4221 	/*
4222 	 * There are no ills left on this phyint; pull it out of the phyint
4223 	 * avl trees, and free it.
4224 	 */
4225 	if (phyi->phyint_ifindex > 0) {
4226 		avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
4227 		    phyi);
4228 		avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
4229 		    phyi);
4230 	}
4231 	rw_exit(&ipst->ips_ill_g_lock);
4232 
4233 	phyint_free(phyi);
4234 }
4235 
4236 /*
4237  * allocate a ppa, if the number of plumbed interfaces of this type are
4238  * less than ill_no_arena do a linear search to find a unused ppa.
4239  * When the number goes beyond ill_no_arena switch to using an arena.
4240  * Note: ppa value of zero cannot be allocated from vmem_arena as it
4241  * is the return value for an error condition, so allocation starts at one
4242  * and is decremented by one.
4243  */
4244 static int
4245 ill_alloc_ppa(ill_if_t *ifp, ill_t *ill)
4246 {
4247 	ill_t *tmp_ill;
4248 	uint_t start, end;
4249 	int ppa;
4250 
4251 	if (ifp->illif_ppa_arena == NULL &&
4252 	    (avl_numnodes(&ifp->illif_avl_by_ppa) + 1 > ill_no_arena)) {
4253 		/*
4254 		 * Create an arena.
4255 		 */
4256 		ifp->illif_ppa_arena = vmem_create(ifp->illif_name,
4257 		    (void *)1, UINT_MAX - 1, 1, NULL, NULL,
4258 		    NULL, 0, VM_SLEEP | VMC_IDENTIFIER);
4259 			/* allocate what has already been assigned */
4260 		for (tmp_ill = avl_first(&ifp->illif_avl_by_ppa);
4261 		    tmp_ill != NULL; tmp_ill = avl_walk(&ifp->illif_avl_by_ppa,
4262 		    tmp_ill, AVL_AFTER)) {
4263 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
4264 			    1,		/* size */
4265 			    1,		/* align/quantum */
4266 			    0,		/* phase */
4267 			    0,		/* nocross */
4268 			    /* minaddr */
4269 			    (void *)((uintptr_t)tmp_ill->ill_ppa + 1),
4270 			    /* maxaddr */
4271 			    (void *)((uintptr_t)tmp_ill->ill_ppa + 2),
4272 			    VM_NOSLEEP|VM_FIRSTFIT);
4273 			if (ppa == 0) {
4274 				ip1dbg(("ill_alloc_ppa: ppa allocation"
4275 				    " failed while switching"));
4276 				vmem_destroy(ifp->illif_ppa_arena);
4277 				ifp->illif_ppa_arena = NULL;
4278 				break;
4279 			}
4280 		}
4281 	}
4282 
4283 	if (ifp->illif_ppa_arena != NULL) {
4284 		if (ill->ill_ppa == UINT_MAX) {
4285 			ppa = (int)(uintptr_t)vmem_alloc(ifp->illif_ppa_arena,
4286 			    1, VM_NOSLEEP|VM_FIRSTFIT);
4287 			if (ppa == 0)
4288 				return (EAGAIN);
4289 			ill->ill_ppa = --ppa;
4290 		} else {
4291 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
4292 			    1, 		/* size */
4293 			    1, 		/* align/quantum */
4294 			    0, 		/* phase */
4295 			    0, 		/* nocross */
4296 			    (void *)(uintptr_t)(ill->ill_ppa + 1), /* minaddr */
4297 			    (void *)(uintptr_t)(ill->ill_ppa + 2), /* maxaddr */
4298 			    VM_NOSLEEP|VM_FIRSTFIT);
4299 			/*
4300 			 * Most likely the allocation failed because
4301 			 * the requested ppa was in use.
4302 			 */
4303 			if (ppa == 0)
4304 				return (EEXIST);
4305 		}
4306 		return (0);
4307 	}
4308 
4309 	/*
4310 	 * No arena is in use and not enough (>ill_no_arena) interfaces have
4311 	 * been plumbed to create one. Do a linear search to get a unused ppa.
4312 	 */
4313 	if (ill->ill_ppa == UINT_MAX) {
4314 		end = UINT_MAX - 1;
4315 		start = 0;
4316 	} else {
4317 		end = start = ill->ill_ppa;
4318 	}
4319 
4320 	tmp_ill = avl_find(&ifp->illif_avl_by_ppa, (void *)&start, NULL);
4321 	while (tmp_ill != NULL && tmp_ill->ill_ppa == start) {
4322 		if (start++ >= end) {
4323 			if (ill->ill_ppa == UINT_MAX)
4324 				return (EAGAIN);
4325 			else
4326 				return (EEXIST);
4327 		}
4328 		tmp_ill = avl_walk(&ifp->illif_avl_by_ppa, tmp_ill, AVL_AFTER);
4329 	}
4330 	ill->ill_ppa = start;
4331 	return (0);
4332 }
4333 
4334 /*
4335  * Insert ill into the list of configured ill's. Once this function completes,
4336  * the ill is globally visible and is available through lookups. More precisely
4337  * this happens after the caller drops the ill_g_lock.
4338  */
4339 static int
4340 ill_glist_insert(ill_t *ill, char *name, boolean_t isv6)
4341 {
4342 	ill_if_t *ill_interface;
4343 	avl_index_t where = 0;
4344 	int error;
4345 	int name_length;
4346 	int index;
4347 	boolean_t check_length = B_FALSE;
4348 	ip_stack_t	*ipst = ill->ill_ipst;
4349 
4350 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
4351 
4352 	name_length = mi_strlen(name) + 1;
4353 
4354 	if (isv6)
4355 		index = IP_V6_G_HEAD;
4356 	else
4357 		index = IP_V4_G_HEAD;
4358 
4359 	ill_interface = IP_VX_ILL_G_LIST(index, ipst);
4360 	/*
4361 	 * Search for interface type based on name
4362 	 */
4363 	while (ill_interface != (ill_if_t *)&IP_VX_ILL_G_LIST(index, ipst)) {
4364 		if ((ill_interface->illif_name_len == name_length) &&
4365 		    (strcmp(ill_interface->illif_name, name) == 0)) {
4366 			break;
4367 		}
4368 		ill_interface = ill_interface->illif_next;
4369 	}
4370 
4371 	/*
4372 	 * Interface type not found, create one.
4373 	 */
4374 	if (ill_interface == (ill_if_t *)&IP_VX_ILL_G_LIST(index, ipst)) {
4375 		ill_g_head_t ghead;
4376 
4377 		/*
4378 		 * allocate ill_if_t structure
4379 		 */
4380 		ill_interface = (ill_if_t *)mi_zalloc(sizeof (ill_if_t));
4381 		if (ill_interface == NULL) {
4382 			return (ENOMEM);
4383 		}
4384 
4385 		(void) strcpy(ill_interface->illif_name, name);
4386 		ill_interface->illif_name_len = name_length;
4387 
4388 		avl_create(&ill_interface->illif_avl_by_ppa,
4389 		    ill_compare_ppa, sizeof (ill_t),
4390 		    offsetof(struct ill_s, ill_avl_byppa));
4391 
4392 		/*
4393 		 * link the structure in the back to maintain order
4394 		 * of configuration for ifconfig output.
4395 		 */
4396 		ghead = ipst->ips_ill_g_heads[index];
4397 		insque(ill_interface, ghead.ill_g_list_tail);
4398 	}
4399 
4400 	if (ill->ill_ppa == UINT_MAX)
4401 		check_length = B_TRUE;
4402 
4403 	error = ill_alloc_ppa(ill_interface, ill);
4404 	if (error != 0) {
4405 		if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
4406 			ill_delete_interface_type(ill->ill_ifptr);
4407 		return (error);
4408 	}
4409 
4410 	/*
4411 	 * When the ppa is choosen by the system, check that there is
4412 	 * enough space to insert ppa. if a specific ppa was passed in this
4413 	 * check is not required as the interface name passed in will have
4414 	 * the right ppa in it.
4415 	 */
4416 	if (check_length) {
4417 		/*
4418 		 * UINT_MAX - 1 should fit in 10 chars, alloc 12 chars.
4419 		 */
4420 		char buf[sizeof (uint_t) * 3];
4421 
4422 		/*
4423 		 * convert ppa to string to calculate the amount of space
4424 		 * required for it in the name.
4425 		 */
4426 		numtos(ill->ill_ppa, buf);
4427 
4428 		/* Do we have enough space to insert ppa ? */
4429 
4430 		if ((mi_strlen(name) + mi_strlen(buf) + 1) > LIFNAMSIZ) {
4431 			/* Free ppa and interface type struct */
4432 			if (ill_interface->illif_ppa_arena != NULL) {
4433 				vmem_free(ill_interface->illif_ppa_arena,
4434 				    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
4435 			}
4436 			if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
4437 				ill_delete_interface_type(ill->ill_ifptr);
4438 
4439 			return (EINVAL);
4440 		}
4441 	}
4442 
4443 	(void) sprintf(ill->ill_name, "%s%u", name, ill->ill_ppa);
4444 	ill->ill_name_length = mi_strlen(ill->ill_name) + 1;
4445 
4446 	(void) avl_find(&ill_interface->illif_avl_by_ppa, &ill->ill_ppa,
4447 	    &where);
4448 	ill->ill_ifptr = ill_interface;
4449 	avl_insert(&ill_interface->illif_avl_by_ppa, ill, where);
4450 
4451 	ill_phyint_reinit(ill);
4452 	return (0);
4453 }
4454 
4455 /* Initialize the per phyint ipsq used for serialization */
4456 static boolean_t
4457 ipsq_init(ill_t *ill, boolean_t enter)
4458 {
4459 	ipsq_t  *ipsq;
4460 	ipxop_t	*ipx;
4461 
4462 	if ((ipsq = kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP)) == NULL)
4463 		return (B_FALSE);
4464 
4465 	ill->ill_phyint->phyint_ipsq = ipsq;
4466 	ipx = ipsq->ipsq_xop = &ipsq->ipsq_ownxop;
4467 	ipx->ipx_ipsq = ipsq;
4468 	ipsq->ipsq_next = ipsq;
4469 	ipsq->ipsq_phyint = ill->ill_phyint;
4470 	mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, 0);
4471 	mutex_init(&ipx->ipx_lock, NULL, MUTEX_DEFAULT, 0);
4472 	ipsq->ipsq_ipst = ill->ill_ipst;	/* No netstack_hold */
4473 	if (enter) {
4474 		ipx->ipx_writer = curthread;
4475 		ipx->ipx_forced = B_FALSE;
4476 		ipx->ipx_reentry_cnt = 1;
4477 #ifdef DEBUG
4478 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
4479 #endif
4480 	}
4481 	return (B_TRUE);
4482 }
4483 
4484 /*
4485  * ill_init is called by ip_open when a device control stream is opened.
4486  * It does a few initializations, and shoots a DL_INFO_REQ message down
4487  * to the driver.  The response is later picked up in ip_rput_dlpi and
4488  * used to set up default mechanisms for talking to the driver.  (Always
4489  * called as writer.)
4490  *
4491  * If this function returns error, ip_open will call ip_close which in
4492  * turn will call ill_delete to clean up any memory allocated here that
4493  * is not yet freed.
4494  */
4495 int
4496 ill_init(queue_t *q, ill_t *ill)
4497 {
4498 	int	count;
4499 	dl_info_req_t	*dlir;
4500 	mblk_t	*info_mp;
4501 	uchar_t *frag_ptr;
4502 
4503 	/*
4504 	 * The ill is initialized to zero by mi_alloc*(). In addition
4505 	 * some fields already contain valid values, initialized in
4506 	 * ip_open(), before we reach here.
4507 	 */
4508 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, 0);
4509 
4510 	ill->ill_rq = q;
4511 	ill->ill_wq = WR(q);
4512 
4513 	info_mp = allocb(MAX(sizeof (dl_info_req_t), sizeof (dl_info_ack_t)),
4514 	    BPRI_HI);
4515 	if (info_mp == NULL)
4516 		return (ENOMEM);
4517 
4518 	/*
4519 	 * Allocate sufficient space to contain our fragment hash table and
4520 	 * the device name.
4521 	 */
4522 	frag_ptr = (uchar_t *)mi_zalloc(ILL_FRAG_HASH_TBL_SIZE +
4523 	    2 * LIFNAMSIZ + 5 + strlen(ipv6_forward_suffix));
4524 	if (frag_ptr == NULL) {
4525 		freemsg(info_mp);
4526 		return (ENOMEM);
4527 	}
4528 	ill->ill_frag_ptr = frag_ptr;
4529 	ill->ill_frag_free_num_pkts = 0;
4530 	ill->ill_last_frag_clean_time = 0;
4531 	ill->ill_frag_hash_tbl = (ipfb_t *)frag_ptr;
4532 	ill->ill_name = (char *)(frag_ptr + ILL_FRAG_HASH_TBL_SIZE);
4533 	for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
4534 		mutex_init(&ill->ill_frag_hash_tbl[count].ipfb_lock,
4535 		    NULL, MUTEX_DEFAULT, NULL);
4536 	}
4537 
4538 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
4539 	if (ill->ill_phyint == NULL) {
4540 		freemsg(info_mp);
4541 		mi_free(frag_ptr);
4542 		return (ENOMEM);
4543 	}
4544 
4545 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
4546 	/*
4547 	 * For now pretend this is a v4 ill. We need to set phyint_ill*
4548 	 * at this point because of the following reason. If we can't
4549 	 * enter the ipsq at some point and cv_wait, the writer that
4550 	 * wakes us up tries to locate us using the list of all phyints
4551 	 * in an ipsq and the ills from the phyint thru the phyint_ill*.
4552 	 * If we don't set it now, we risk a missed wakeup.
4553 	 */
4554 	ill->ill_phyint->phyint_illv4 = ill;
4555 	ill->ill_ppa = UINT_MAX;
4556 	ill->ill_fastpath_list = &ill->ill_fastpath_list;
4557 
4558 	if (!ipsq_init(ill, B_TRUE)) {
4559 		freemsg(info_mp);
4560 		mi_free(frag_ptr);
4561 		mi_free(ill->ill_phyint);
4562 		return (ENOMEM);
4563 	}
4564 
4565 	ill->ill_state_flags |= ILL_LL_SUBNET_PENDING;
4566 
4567 	/* Frag queue limit stuff */
4568 	ill->ill_frag_count = 0;
4569 	ill->ill_ipf_gen = 0;
4570 
4571 	ill->ill_global_timer = INFINITY;
4572 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
4573 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
4574 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
4575 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
4576 
4577 	/*
4578 	 * Initialize IPv6 configuration variables.  The IP module is always
4579 	 * opened as an IPv4 module.  Instead tracking down the cases where
4580 	 * it switches to do ipv6, we'll just initialize the IPv6 configuration
4581 	 * here for convenience, this has no effect until the ill is set to do
4582 	 * IPv6.
4583 	 */
4584 	ill->ill_reachable_time = ND_REACHABLE_TIME;
4585 	ill->ill_reachable_retrans_time = ND_RETRANS_TIMER;
4586 	ill->ill_xmit_count = ND_MAX_MULTICAST_SOLICIT;
4587 	ill->ill_max_buf = ND_MAX_Q;
4588 	ill->ill_refcnt = 0;
4589 
4590 	/* Send down the Info Request to the driver. */
4591 	info_mp->b_datap->db_type = M_PCPROTO;
4592 	dlir = (dl_info_req_t *)info_mp->b_rptr;
4593 	info_mp->b_wptr = (uchar_t *)&dlir[1];
4594 	dlir->dl_primitive = DL_INFO_REQ;
4595 
4596 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
4597 
4598 	qprocson(q);
4599 	ill_dlpi_send(ill, info_mp);
4600 
4601 	return (0);
4602 }
4603 
4604 /*
4605  * ill_dls_info
4606  * creates datalink socket info from the device.
4607  */
4608 int
4609 ill_dls_info(struct sockaddr_dl *sdl, const ipif_t *ipif)
4610 {
4611 	size_t	len;
4612 	ill_t	*ill = ipif->ipif_ill;
4613 
4614 	sdl->sdl_family = AF_LINK;
4615 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
4616 	sdl->sdl_type = ill->ill_type;
4617 	ipif_get_name(ipif, sdl->sdl_data, sizeof (sdl->sdl_data));
4618 	len = strlen(sdl->sdl_data);
4619 	ASSERT(len < 256);
4620 	sdl->sdl_nlen = (uchar_t)len;
4621 	sdl->sdl_alen = ill->ill_phys_addr_length;
4622 	sdl->sdl_slen = 0;
4623 	if (ill->ill_phys_addr_length != 0 && ill->ill_phys_addr != NULL)
4624 		bcopy(ill->ill_phys_addr, &sdl->sdl_data[len], sdl->sdl_alen);
4625 
4626 	return (sizeof (struct sockaddr_dl));
4627 }
4628 
4629 /*
4630  * ill_xarp_info
4631  * creates xarp info from the device.
4632  */
4633 static int
4634 ill_xarp_info(struct sockaddr_dl *sdl, ill_t *ill)
4635 {
4636 	sdl->sdl_family = AF_LINK;
4637 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
4638 	sdl->sdl_type = ill->ill_type;
4639 	ipif_get_name(ill->ill_ipif, sdl->sdl_data, sizeof (sdl->sdl_data));
4640 	sdl->sdl_nlen = (uchar_t)mi_strlen(sdl->sdl_data);
4641 	sdl->sdl_alen = ill->ill_phys_addr_length;
4642 	sdl->sdl_slen = 0;
4643 	return (sdl->sdl_nlen);
4644 }
4645 
4646 static int
4647 loopback_kstat_update(kstat_t *ksp, int rw)
4648 {
4649 	kstat_named_t *kn;
4650 	netstackid_t	stackid;
4651 	netstack_t	*ns;
4652 	ip_stack_t	*ipst;
4653 
4654 	if (ksp == NULL || ksp->ks_data == NULL)
4655 		return (EIO);
4656 
4657 	if (rw == KSTAT_WRITE)
4658 		return (EACCES);
4659 
4660 	kn = KSTAT_NAMED_PTR(ksp);
4661 	stackid = (zoneid_t)(uintptr_t)ksp->ks_private;
4662 
4663 	ns = netstack_find_by_stackid(stackid);
4664 	if (ns == NULL)
4665 		return (-1);
4666 
4667 	ipst = ns->netstack_ip;
4668 	if (ipst == NULL) {
4669 		netstack_rele(ns);
4670 		return (-1);
4671 	}
4672 	kn[0].value.ui32 = ipst->ips_loopback_packets;
4673 	kn[1].value.ui32 = ipst->ips_loopback_packets;
4674 	netstack_rele(ns);
4675 	return (0);
4676 }
4677 
4678 /*
4679  * Has ifindex been plumbed already?
4680  */
4681 boolean_t
4682 phyint_exists(uint_t index, ip_stack_t *ipst)
4683 {
4684 	ASSERT(index != 0);
4685 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
4686 
4687 	return (avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
4688 	    &index, NULL) != NULL);
4689 }
4690 
4691 /* Pick a unique ifindex */
4692 boolean_t
4693 ip_assign_ifindex(uint_t *indexp, ip_stack_t *ipst)
4694 {
4695 	uint_t starting_index;
4696 
4697 	if (!ipst->ips_ill_index_wrap) {
4698 		*indexp = ipst->ips_ill_index++;
4699 		if (ipst->ips_ill_index == 0) {
4700 			/* Reached the uint_t limit Next time wrap  */
4701 			ipst->ips_ill_index_wrap = B_TRUE;
4702 		}
4703 		return (B_TRUE);
4704 	}
4705 
4706 	/*
4707 	 * Start reusing unused indexes. Note that we hold the ill_g_lock
4708 	 * at this point and don't want to call any function that attempts
4709 	 * to get the lock again.
4710 	 */
4711 	starting_index = ipst->ips_ill_index++;
4712 	for (; ipst->ips_ill_index != starting_index; ipst->ips_ill_index++) {
4713 		if (ipst->ips_ill_index != 0 &&
4714 		    !phyint_exists(ipst->ips_ill_index, ipst)) {
4715 			/* found unused index - use it */
4716 			*indexp = ipst->ips_ill_index;
4717 			return (B_TRUE);
4718 		}
4719 	}
4720 
4721 	/*
4722 	 * all interface indicies are inuse.
4723 	 */
4724 	return (B_FALSE);
4725 }
4726 
4727 /*
4728  * Assign a unique interface index for the phyint.
4729  */
4730 static boolean_t
4731 phyint_assign_ifindex(phyint_t *phyi, ip_stack_t *ipst)
4732 {
4733 	ASSERT(phyi->phyint_ifindex == 0);
4734 	return (ip_assign_ifindex(&phyi->phyint_ifindex, ipst));
4735 }
4736 
4737 /*
4738  * Return a pointer to the ill which matches the supplied name.  Note that
4739  * the ill name length includes the null termination character.  (May be
4740  * called as writer.)
4741  * If do_alloc and the interface is "lo0" it will be automatically created.
4742  * Cannot bump up reference on condemned ills. So dup detect can't be done
4743  * using this func.
4744  */
4745 ill_t *
4746 ill_lookup_on_name(char *name, boolean_t do_alloc, boolean_t isv6,
4747     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, boolean_t *did_alloc,
4748     ip_stack_t *ipst)
4749 {
4750 	ill_t	*ill;
4751 	ipif_t	*ipif;
4752 	ipsq_t	*ipsq;
4753 	kstat_named_t	*kn;
4754 	boolean_t isloopback;
4755 	in6_addr_t ov6addr;
4756 
4757 	isloopback = mi_strcmp(name, ipif_loopback_name) == 0;
4758 
4759 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4760 	ill = ill_find_by_name(name, isv6, q, mp, func, error, ipst);
4761 	rw_exit(&ipst->ips_ill_g_lock);
4762 	if (ill != NULL || (error != NULL && *error == EINPROGRESS))
4763 		return (ill);
4764 
4765 	/*
4766 	 * Couldn't find it.  Does this happen to be a lookup for the
4767 	 * loopback device and are we allowed to allocate it?
4768 	 */
4769 	if (!isloopback || !do_alloc)
4770 		return (NULL);
4771 
4772 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
4773 
4774 	ill = ill_find_by_name(name, isv6, q, mp, func, error, ipst);
4775 	if (ill != NULL || (error != NULL && *error == EINPROGRESS)) {
4776 		rw_exit(&ipst->ips_ill_g_lock);
4777 		return (ill);
4778 	}
4779 
4780 	/* Create the loopback device on demand */
4781 	ill = (ill_t *)(mi_alloc(sizeof (ill_t) +
4782 	    sizeof (ipif_loopback_name), BPRI_MED));
4783 	if (ill == NULL)
4784 		goto done;
4785 
4786 	*ill = ill_null;
4787 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, NULL);
4788 	ill->ill_ipst = ipst;
4789 	netstack_hold(ipst->ips_netstack);
4790 	/*
4791 	 * For exclusive stacks we set the zoneid to zero
4792 	 * to make IP operate as if in the global zone.
4793 	 */
4794 	ill->ill_zoneid = GLOBAL_ZONEID;
4795 
4796 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
4797 	if (ill->ill_phyint == NULL)
4798 		goto done;
4799 
4800 	if (isv6)
4801 		ill->ill_phyint->phyint_illv6 = ill;
4802 	else
4803 		ill->ill_phyint->phyint_illv4 = ill;
4804 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
4805 	ill->ill_max_frag = IP_LOOPBACK_MTU;
4806 	/* Add room for tcp+ip headers */
4807 	if (isv6) {
4808 		ill->ill_isv6 = B_TRUE;
4809 		ill->ill_max_frag += IPV6_HDR_LEN + 20;	/* for TCP */
4810 	} else {
4811 		ill->ill_max_frag += IP_SIMPLE_HDR_LENGTH + 20;
4812 	}
4813 	if (!ill_allocate_mibs(ill))
4814 		goto done;
4815 	ill->ill_max_mtu = ill->ill_max_frag;
4816 	/*
4817 	 * ipif_loopback_name can't be pointed at directly because its used
4818 	 * by both the ipv4 and ipv6 interfaces.  When the ill is removed
4819 	 * from the glist, ill_glist_delete() sets the first character of
4820 	 * ill_name to '\0'.
4821 	 */
4822 	ill->ill_name = (char *)ill + sizeof (*ill);
4823 	(void) strcpy(ill->ill_name, ipif_loopback_name);
4824 	ill->ill_name_length = sizeof (ipif_loopback_name);
4825 	/* Set ill_dlpi_pending for ipsq_current_finish() to work properly */
4826 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
4827 
4828 	ill->ill_global_timer = INFINITY;
4829 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
4830 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
4831 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
4832 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
4833 
4834 	/* No resolver here. */
4835 	ill->ill_net_type = IRE_LOOPBACK;
4836 
4837 	/* Initialize the ipsq */
4838 	if (!ipsq_init(ill, B_FALSE))
4839 		goto done;
4840 
4841 	ipif = ipif_allocate(ill, 0L, IRE_LOOPBACK, B_TRUE, B_TRUE);
4842 	if (ipif == NULL)
4843 		goto done;
4844 
4845 	ill->ill_flags = ILLF_MULTICAST;
4846 
4847 	ov6addr = ipif->ipif_v6lcl_addr;
4848 	/* Set up default loopback address and mask. */
4849 	if (!isv6) {
4850 		ipaddr_t inaddr_loopback = htonl(INADDR_LOOPBACK);
4851 
4852 		IN6_IPADDR_TO_V4MAPPED(inaddr_loopback, &ipif->ipif_v6lcl_addr);
4853 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
4854 		V4MASK_TO_V6(htonl(IN_CLASSA_NET), ipif->ipif_v6net_mask);
4855 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
4856 		    ipif->ipif_v6subnet);
4857 		ill->ill_flags |= ILLF_IPV4;
4858 	} else {
4859 		ipif->ipif_v6lcl_addr = ipv6_loopback;
4860 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
4861 		ipif->ipif_v6net_mask = ipv6_all_ones;
4862 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
4863 		    ipif->ipif_v6subnet);
4864 		ill->ill_flags |= ILLF_IPV6;
4865 	}
4866 
4867 	/*
4868 	 * Chain us in at the end of the ill list. hold the ill
4869 	 * before we make it globally visible. 1 for the lookup.
4870 	 */
4871 	ill->ill_refcnt = 0;
4872 	ill_refhold(ill);
4873 
4874 	ill->ill_frag_count = 0;
4875 	ill->ill_frag_free_num_pkts = 0;
4876 	ill->ill_last_frag_clean_time = 0;
4877 
4878 	ipsq = ill->ill_phyint->phyint_ipsq;
4879 
4880 	if (ill_glist_insert(ill, "lo", isv6) != 0)
4881 		cmn_err(CE_PANIC, "cannot insert loopback interface");
4882 
4883 	/* Let SCTP know so that it can add this to its list */
4884 	sctp_update_ill(ill, SCTP_ILL_INSERT);
4885 
4886 	/*
4887 	 * We have already assigned ipif_v6lcl_addr above, but we need to
4888 	 * call sctp_update_ipif_addr() after SCTP_ILL_INSERT, which
4889 	 * requires to be after ill_glist_insert() since we need the
4890 	 * ill_index set. Pass on ipv6_loopback as the old address.
4891 	 */
4892 	sctp_update_ipif_addr(ipif, ov6addr);
4893 
4894 	/*
4895 	 * ill_glist_insert() -> ill_phyint_reinit() may have merged IPSQs.
4896 	 * If so, free our original one.
4897 	 */
4898 	if (ipsq != ill->ill_phyint->phyint_ipsq)
4899 		ipsq_delete(ipsq);
4900 
4901 	/*
4902 	 * Delay this till the ipif is allocated as ipif_allocate
4903 	 * de-references ill_phyint for getting the ifindex. We
4904 	 * can't do this before ipif_allocate because ill_phyint_reinit
4905 	 * -> phyint_assign_ifindex expects ipif to be present.
4906 	 */
4907 	mutex_enter(&ill->ill_phyint->phyint_lock);
4908 	ill->ill_phyint->phyint_flags |= PHYI_LOOPBACK | PHYI_VIRTUAL;
4909 	mutex_exit(&ill->ill_phyint->phyint_lock);
4910 
4911 	if (ipst->ips_loopback_ksp == NULL) {
4912 		/* Export loopback interface statistics */
4913 		ipst->ips_loopback_ksp = kstat_create_netstack("lo", 0,
4914 		    ipif_loopback_name, "net",
4915 		    KSTAT_TYPE_NAMED, 2, 0,
4916 		    ipst->ips_netstack->netstack_stackid);
4917 		if (ipst->ips_loopback_ksp != NULL) {
4918 			ipst->ips_loopback_ksp->ks_update =
4919 			    loopback_kstat_update;
4920 			kn = KSTAT_NAMED_PTR(ipst->ips_loopback_ksp);
4921 			kstat_named_init(&kn[0], "ipackets", KSTAT_DATA_UINT32);
4922 			kstat_named_init(&kn[1], "opackets", KSTAT_DATA_UINT32);
4923 			ipst->ips_loopback_ksp->ks_private =
4924 			    (void *)(uintptr_t)ipst->ips_netstack->
4925 			    netstack_stackid;
4926 			kstat_install(ipst->ips_loopback_ksp);
4927 		}
4928 	}
4929 
4930 	if (error != NULL)
4931 		*error = 0;
4932 	*did_alloc = B_TRUE;
4933 	rw_exit(&ipst->ips_ill_g_lock);
4934 	ill_nic_event_dispatch(ill, MAP_IPIF_ID(ill->ill_ipif->ipif_id),
4935 	    NE_PLUMB, ill->ill_name, ill->ill_name_length);
4936 	return (ill);
4937 done:
4938 	if (ill != NULL) {
4939 		if (ill->ill_phyint != NULL) {
4940 			ipsq = ill->ill_phyint->phyint_ipsq;
4941 			if (ipsq != NULL) {
4942 				ipsq->ipsq_phyint = NULL;
4943 				ipsq_delete(ipsq);
4944 			}
4945 			mi_free(ill->ill_phyint);
4946 		}
4947 		ill_free_mib(ill);
4948 		if (ill->ill_ipst != NULL)
4949 			netstack_rele(ill->ill_ipst->ips_netstack);
4950 		mi_free(ill);
4951 	}
4952 	rw_exit(&ipst->ips_ill_g_lock);
4953 	if (error != NULL)
4954 		*error = ENOMEM;
4955 	return (NULL);
4956 }
4957 
4958 /*
4959  * For IPP calls - use the ip_stack_t for global stack.
4960  */
4961 ill_t *
4962 ill_lookup_on_ifindex_global_instance(uint_t index, boolean_t isv6,
4963     queue_t *q, mblk_t *mp, ipsq_func_t func, int *err)
4964 {
4965 	ip_stack_t	*ipst;
4966 	ill_t		*ill;
4967 
4968 	ipst = netstack_find_by_stackid(GLOBAL_NETSTACKID)->netstack_ip;
4969 	if (ipst == NULL) {
4970 		cmn_err(CE_WARN, "No ip_stack_t for zoneid zero!\n");
4971 		return (NULL);
4972 	}
4973 
4974 	ill = ill_lookup_on_ifindex(index, isv6, q, mp, func, err, ipst);
4975 	netstack_rele(ipst->ips_netstack);
4976 	return (ill);
4977 }
4978 
4979 /*
4980  * Return a pointer to the ill which matches the index and IP version type.
4981  */
4982 ill_t *
4983 ill_lookup_on_ifindex(uint_t index, boolean_t isv6, queue_t *q, mblk_t *mp,
4984     ipsq_func_t func, int *err, ip_stack_t *ipst)
4985 {
4986 	ill_t	*ill;
4987 	ipsq_t  *ipsq;
4988 	phyint_t *phyi;
4989 
4990 	ASSERT((q == NULL && mp == NULL && func == NULL && err == NULL) ||
4991 	    (q != NULL && mp != NULL && func != NULL && err != NULL));
4992 
4993 	if (err != NULL)
4994 		*err = 0;
4995 
4996 	/*
4997 	 * Indexes are stored in the phyint - a common structure
4998 	 * to both IPv4 and IPv6.
4999 	 */
5000 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5001 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
5002 	    (void *) &index, NULL);
5003 	if (phyi != NULL) {
5004 		ill = isv6 ? phyi->phyint_illv6: phyi->phyint_illv4;
5005 		if (ill != NULL) {
5006 			/*
5007 			 * The block comment at the start of ipif_down
5008 			 * explains the use of the macros used below
5009 			 */
5010 			GRAB_CONN_LOCK(q);
5011 			mutex_enter(&ill->ill_lock);
5012 			if (ILL_CAN_LOOKUP(ill)) {
5013 				ill_refhold_locked(ill);
5014 				mutex_exit(&ill->ill_lock);
5015 				RELEASE_CONN_LOCK(q);
5016 				rw_exit(&ipst->ips_ill_g_lock);
5017 				return (ill);
5018 			} else if (ILL_CAN_WAIT(ill, q)) {
5019 				ipsq = ill->ill_phyint->phyint_ipsq;
5020 				mutex_enter(&ipsq->ipsq_lock);
5021 				mutex_enter(&ipsq->ipsq_xop->ipx_lock);
5022 				rw_exit(&ipst->ips_ill_g_lock);
5023 				mutex_exit(&ill->ill_lock);
5024 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
5025 				mutex_exit(&ipsq->ipsq_xop->ipx_lock);
5026 				mutex_exit(&ipsq->ipsq_lock);
5027 				RELEASE_CONN_LOCK(q);
5028 				if (err != NULL)
5029 					*err = EINPROGRESS;
5030 				return (NULL);
5031 			}
5032 			RELEASE_CONN_LOCK(q);
5033 			mutex_exit(&ill->ill_lock);
5034 		}
5035 	}
5036 	rw_exit(&ipst->ips_ill_g_lock);
5037 	if (err != NULL)
5038 		*err = ENXIO;
5039 	return (NULL);
5040 }
5041 
5042 /*
5043  * Return the ifindex next in sequence after the passed in ifindex.
5044  * If there is no next ifindex for the given protocol, return 0.
5045  */
5046 uint_t
5047 ill_get_next_ifindex(uint_t index, boolean_t isv6, ip_stack_t *ipst)
5048 {
5049 	phyint_t *phyi;
5050 	phyint_t *phyi_initial;
5051 	uint_t   ifindex;
5052 
5053 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5054 
5055 	if (index == 0) {
5056 		phyi = avl_first(
5057 		    &ipst->ips_phyint_g_list->phyint_list_avl_by_index);
5058 	} else {
5059 		phyi = phyi_initial = avl_find(
5060 		    &ipst->ips_phyint_g_list->phyint_list_avl_by_index,
5061 		    (void *) &index, NULL);
5062 	}
5063 
5064 	for (; phyi != NULL;
5065 	    phyi = avl_walk(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
5066 	    phyi, AVL_AFTER)) {
5067 		/*
5068 		 * If we're not returning the first interface in the tree
5069 		 * and we still haven't moved past the phyint_t that
5070 		 * corresponds to index, avl_walk needs to be called again
5071 		 */
5072 		if (!((index != 0) && (phyi == phyi_initial))) {
5073 			if (isv6) {
5074 				if ((phyi->phyint_illv6) &&
5075 				    ILL_CAN_LOOKUP(phyi->phyint_illv6) &&
5076 				    (phyi->phyint_illv6->ill_isv6 == 1))
5077 					break;
5078 			} else {
5079 				if ((phyi->phyint_illv4) &&
5080 				    ILL_CAN_LOOKUP(phyi->phyint_illv4) &&
5081 				    (phyi->phyint_illv4->ill_isv6 == 0))
5082 					break;
5083 			}
5084 		}
5085 	}
5086 
5087 	rw_exit(&ipst->ips_ill_g_lock);
5088 
5089 	if (phyi != NULL)
5090 		ifindex = phyi->phyint_ifindex;
5091 	else
5092 		ifindex = 0;
5093 
5094 	return (ifindex);
5095 }
5096 
5097 /*
5098  * Return the ifindex for the named interface.
5099  * If there is no next ifindex for the interface, return 0.
5100  */
5101 uint_t
5102 ill_get_ifindex_by_name(char *name, ip_stack_t *ipst)
5103 {
5104 	phyint_t	*phyi;
5105 	avl_index_t	where = 0;
5106 	uint_t		ifindex;
5107 
5108 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5109 
5110 	if ((phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
5111 	    name, &where)) == NULL) {
5112 		rw_exit(&ipst->ips_ill_g_lock);
5113 		return (0);
5114 	}
5115 
5116 	ifindex = phyi->phyint_ifindex;
5117 
5118 	rw_exit(&ipst->ips_ill_g_lock);
5119 
5120 	return (ifindex);
5121 }
5122 
5123 /*
5124  * Obtain a reference to the ill. The ill_refcnt is a dynamic refcnt
5125  * that gives a running thread a reference to the ill. This reference must be
5126  * released by the thread when it is done accessing the ill and related
5127  * objects. ill_refcnt can not be used to account for static references
5128  * such as other structures pointing to an ill. Callers must generally
5129  * check whether an ill can be refheld by using ILL_CAN_LOOKUP macros
5130  * or be sure that the ill is not being deleted or changing state before
5131  * calling the refhold functions. A non-zero ill_refcnt ensures that the
5132  * ill won't change any of its critical state such as address, netmask etc.
5133  */
5134 void
5135 ill_refhold(ill_t *ill)
5136 {
5137 	mutex_enter(&ill->ill_lock);
5138 	ill->ill_refcnt++;
5139 	ILL_TRACE_REF(ill);
5140 	mutex_exit(&ill->ill_lock);
5141 }
5142 
5143 void
5144 ill_refhold_locked(ill_t *ill)
5145 {
5146 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5147 	ill->ill_refcnt++;
5148 	ILL_TRACE_REF(ill);
5149 }
5150 
5151 int
5152 ill_check_and_refhold(ill_t *ill)
5153 {
5154 	mutex_enter(&ill->ill_lock);
5155 	if (ILL_CAN_LOOKUP(ill)) {
5156 		ill_refhold_locked(ill);
5157 		mutex_exit(&ill->ill_lock);
5158 		return (0);
5159 	}
5160 	mutex_exit(&ill->ill_lock);
5161 	return (ILL_LOOKUP_FAILED);
5162 }
5163 
5164 /*
5165  * Must not be called while holding any locks. Otherwise if this is
5166  * the last reference to be released, there is a chance of recursive mutex
5167  * panic due to ill_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
5168  * to restart an ioctl.
5169  */
5170 void
5171 ill_refrele(ill_t *ill)
5172 {
5173 	mutex_enter(&ill->ill_lock);
5174 	ASSERT(ill->ill_refcnt != 0);
5175 	ill->ill_refcnt--;
5176 	ILL_UNTRACE_REF(ill);
5177 	if (ill->ill_refcnt != 0) {
5178 		/* Every ire pointing to the ill adds 1 to ill_refcnt */
5179 		mutex_exit(&ill->ill_lock);
5180 		return;
5181 	}
5182 
5183 	/* Drops the ill_lock */
5184 	ipif_ill_refrele_tail(ill);
5185 }
5186 
5187 /*
5188  * Obtain a weak reference count on the ill. This reference ensures the
5189  * ill won't be freed, but the ill may change any of its critical state
5190  * such as netmask, address etc. Returns an error if the ill has started
5191  * closing.
5192  */
5193 boolean_t
5194 ill_waiter_inc(ill_t *ill)
5195 {
5196 	mutex_enter(&ill->ill_lock);
5197 	if (ill->ill_state_flags & ILL_CONDEMNED) {
5198 		mutex_exit(&ill->ill_lock);
5199 		return (B_FALSE);
5200 	}
5201 	ill->ill_waiters++;
5202 	mutex_exit(&ill->ill_lock);
5203 	return (B_TRUE);
5204 }
5205 
5206 void
5207 ill_waiter_dcr(ill_t *ill)
5208 {
5209 	mutex_enter(&ill->ill_lock);
5210 	ill->ill_waiters--;
5211 	if (ill->ill_waiters == 0)
5212 		cv_broadcast(&ill->ill_cv);
5213 	mutex_exit(&ill->ill_lock);
5214 }
5215 
5216 /*
5217  * Named Dispatch routine to produce a formatted report on all ILLs.
5218  * This report is accessed by using the ndd utility to "get" ND variable
5219  * "ip_ill_status".
5220  */
5221 /* ARGSUSED */
5222 int
5223 ip_ill_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
5224 {
5225 	ill_t		*ill;
5226 	ill_walk_context_t ctx;
5227 	ip_stack_t	*ipst;
5228 
5229 	ipst = CONNQ_TO_IPST(q);
5230 
5231 	(void) mi_mpprintf(mp,
5232 	    "ILL      " MI_COL_HDRPAD_STR
5233 	/*   01234567[89ABCDEF] */
5234 	    "rq       " MI_COL_HDRPAD_STR
5235 	/*   01234567[89ABCDEF] */
5236 	    "wq       " MI_COL_HDRPAD_STR
5237 	/*   01234567[89ABCDEF] */
5238 	    "upcnt mxfrg err name");
5239 	/*   12345 12345 123 xxxxxxxx  */
5240 
5241 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5242 	ill = ILL_START_WALK_ALL(&ctx, ipst);
5243 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5244 		(void) mi_mpprintf(mp,
5245 		    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR
5246 		    "%05u %05u %03d %s",
5247 		    (void *)ill, (void *)ill->ill_rq, (void *)ill->ill_wq,
5248 		    ill->ill_ipif_up_count,
5249 		    ill->ill_max_frag, ill->ill_error, ill->ill_name);
5250 	}
5251 	rw_exit(&ipst->ips_ill_g_lock);
5252 
5253 	return (0);
5254 }
5255 
5256 /*
5257  * Named Dispatch routine to produce a formatted report on all IPIFs.
5258  * This report is accessed by using the ndd utility to "get" ND variable
5259  * "ip_ipif_status".
5260  */
5261 /* ARGSUSED */
5262 int
5263 ip_ipif_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
5264 {
5265 	char	buf1[INET6_ADDRSTRLEN];
5266 	char	buf2[INET6_ADDRSTRLEN];
5267 	char	buf3[INET6_ADDRSTRLEN];
5268 	char	buf4[INET6_ADDRSTRLEN];
5269 	char	buf5[INET6_ADDRSTRLEN];
5270 	char	buf6[INET6_ADDRSTRLEN];
5271 	char	buf[LIFNAMSIZ];
5272 	ill_t	*ill;
5273 	ipif_t	*ipif;
5274 	nv_t	*nvp;
5275 	uint64_t flags;
5276 	zoneid_t zoneid;
5277 	ill_walk_context_t ctx;
5278 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
5279 
5280 	(void) mi_mpprintf(mp,
5281 	    "IPIF metric mtu in/out/forward name zone flags...\n"
5282 	    "\tlocal address\n"
5283 	    "\tsrc address\n"
5284 	    "\tsubnet\n"
5285 	    "\tmask\n"
5286 	    "\tbroadcast\n"
5287 	    "\tp-p-dst");
5288 
5289 	ASSERT(q->q_next == NULL);
5290 	zoneid = Q_TO_CONN(q)->conn_zoneid;	/* IP is a driver */
5291 
5292 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5293 	ill = ILL_START_WALK_ALL(&ctx, ipst);
5294 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5295 		for (ipif = ill->ill_ipif; ipif != NULL;
5296 		    ipif = ipif->ipif_next) {
5297 			if (zoneid != GLOBAL_ZONEID &&
5298 			    zoneid != ipif->ipif_zoneid &&
5299 			    ipif->ipif_zoneid != ALL_ZONES)
5300 				continue;
5301 
5302 			ipif_get_name(ipif, buf, sizeof (buf));
5303 			(void) mi_mpprintf(mp,
5304 			    MI_COL_PTRFMT_STR
5305 			    "%04u %05u %u/%u/%u %s %d",
5306 			    (void *)ipif,
5307 			    ipif->ipif_metric, ipif->ipif_mtu,
5308 			    ipif->ipif_ib_pkt_count,
5309 			    ipif->ipif_ob_pkt_count,
5310 			    ipif->ipif_fo_pkt_count,
5311 			    buf,
5312 			    ipif->ipif_zoneid);
5313 
5314 		flags = ipif->ipif_flags | ipif->ipif_ill->ill_flags |
5315 		    ipif->ipif_ill->ill_phyint->phyint_flags;
5316 
5317 		/* Tack on text strings for any flags. */
5318 		nvp = ipif_nv_tbl;
5319 		for (; nvp < A_END(ipif_nv_tbl); nvp++) {
5320 			if (nvp->nv_value & flags)
5321 				(void) mi_mpprintf_nr(mp, " %s",
5322 				    nvp->nv_name);
5323 		}
5324 		(void) mi_mpprintf(mp,
5325 		    "\t%s\n\t%s\n\t%s\n\t%s\n\t%s\n\t%s",
5326 		    inet_ntop(AF_INET6,
5327 		    &ipif->ipif_v6lcl_addr, buf1, sizeof (buf1)),
5328 		    inet_ntop(AF_INET6,
5329 		    &ipif->ipif_v6src_addr, buf2, sizeof (buf2)),
5330 		    inet_ntop(AF_INET6,
5331 		    &ipif->ipif_v6subnet, buf3, sizeof (buf3)),
5332 		    inet_ntop(AF_INET6,
5333 		    &ipif->ipif_v6net_mask, buf4, sizeof (buf4)),
5334 		    inet_ntop(AF_INET6,
5335 		    &ipif->ipif_v6brd_addr, buf5, sizeof (buf5)),
5336 		    inet_ntop(AF_INET6,
5337 		    &ipif->ipif_v6pp_dst_addr, buf6, sizeof (buf6)));
5338 		}
5339 	}
5340 	rw_exit(&ipst->ips_ill_g_lock);
5341 	return (0);
5342 }
5343 
5344 /*
5345  * ip_ll_subnet_defaults is called when we get the DL_INFO_ACK back from the
5346  * driver.  We construct best guess defaults for lower level information that
5347  * we need.  If an interface is brought up without injection of any overriding
5348  * information from outside, we have to be ready to go with these defaults.
5349  * When we get the first DL_INFO_ACK (from ip_open() sending a DL_INFO_REQ)
5350  * we primarely want the dl_provider_style.
5351  * The subsequent DL_INFO_ACK is received after doing a DL_ATTACH and DL_BIND
5352  * at which point we assume the other part of the information is valid.
5353  */
5354 void
5355 ip_ll_subnet_defaults(ill_t *ill, mblk_t *mp)
5356 {
5357 	uchar_t		*brdcst_addr;
5358 	uint_t		brdcst_addr_length, phys_addr_length;
5359 	t_scalar_t	sap_length;
5360 	dl_info_ack_t	*dlia;
5361 	ip_m_t		*ipm;
5362 	dl_qos_cl_sel1_t *sel1;
5363 	int		min_mtu;
5364 
5365 	ASSERT(IAM_WRITER_ILL(ill));
5366 
5367 	/*
5368 	 * Till the ill is fully up ILL_CHANGING will be set and
5369 	 * the ill is not globally visible. So no need for a lock.
5370 	 */
5371 	dlia = (dl_info_ack_t *)mp->b_rptr;
5372 	ill->ill_mactype = dlia->dl_mac_type;
5373 
5374 	ipm = ip_m_lookup(dlia->dl_mac_type);
5375 	if (ipm == NULL) {
5376 		ipm = ip_m_lookup(DL_OTHER);
5377 		ASSERT(ipm != NULL);
5378 	}
5379 	ill->ill_media = ipm;
5380 
5381 	/*
5382 	 * When the new DLPI stuff is ready we'll pull lengths
5383 	 * from dlia.
5384 	 */
5385 	if (dlia->dl_version == DL_VERSION_2) {
5386 		brdcst_addr_length = dlia->dl_brdcst_addr_length;
5387 		brdcst_addr = mi_offset_param(mp, dlia->dl_brdcst_addr_offset,
5388 		    brdcst_addr_length);
5389 		if (brdcst_addr == NULL) {
5390 			brdcst_addr_length = 0;
5391 		}
5392 		sap_length = dlia->dl_sap_length;
5393 		phys_addr_length = dlia->dl_addr_length - ABS(sap_length);
5394 		ip1dbg(("ip: bcast_len %d, sap_len %d, phys_len %d\n",
5395 		    brdcst_addr_length, sap_length, phys_addr_length));
5396 	} else {
5397 		brdcst_addr_length = 6;
5398 		brdcst_addr = ip_six_byte_all_ones;
5399 		sap_length = -2;
5400 		phys_addr_length = brdcst_addr_length;
5401 	}
5402 
5403 	ill->ill_bcast_addr_length = brdcst_addr_length;
5404 	ill->ill_phys_addr_length = phys_addr_length;
5405 	ill->ill_sap_length = sap_length;
5406 
5407 	/*
5408 	 * Synthetic DLPI types such as SUNW_DL_IPMP specify a zero SDU,
5409 	 * but we must ensure a minimum IP MTU is used since other bits of
5410 	 * IP will fly apart otherwise.
5411 	 */
5412 	min_mtu = ill->ill_isv6 ? IPV6_MIN_MTU : IP_MIN_MTU;
5413 	ill->ill_max_frag  = MAX(min_mtu, dlia->dl_max_sdu);
5414 	ill->ill_max_mtu = ill->ill_max_frag;
5415 
5416 	ill->ill_type = ipm->ip_m_type;
5417 
5418 	if (!ill->ill_dlpi_style_set) {
5419 		if (dlia->dl_provider_style == DL_STYLE2)
5420 			ill->ill_needs_attach = 1;
5421 
5422 		/*
5423 		 * Allocate the first ipif on this ill. We don't delay it
5424 		 * further as ioctl handling assumes atleast one ipif to
5425 		 * be present.
5426 		 *
5427 		 * At this point we don't know whether the ill is v4 or v6.
5428 		 * We will know this whan the SIOCSLIFNAME happens and
5429 		 * the correct value for ill_isv6 will be assigned in
5430 		 * ipif_set_values(). We need to hold the ill lock and
5431 		 * clear the ILL_LL_SUBNET_PENDING flag and atomically do
5432 		 * the wakeup.
5433 		 */
5434 		(void) ipif_allocate(ill, 0, IRE_LOCAL,
5435 		    dlia->dl_provider_style != DL_STYLE2, B_TRUE);
5436 		mutex_enter(&ill->ill_lock);
5437 		ASSERT(ill->ill_dlpi_style_set == 0);
5438 		ill->ill_dlpi_style_set = 1;
5439 		ill->ill_state_flags &= ~ILL_LL_SUBNET_PENDING;
5440 		cv_broadcast(&ill->ill_cv);
5441 		mutex_exit(&ill->ill_lock);
5442 		freemsg(mp);
5443 		return;
5444 	}
5445 	ASSERT(ill->ill_ipif != NULL);
5446 	/*
5447 	 * We know whether it is IPv4 or IPv6 now, as this is the
5448 	 * second DL_INFO_ACK we are recieving in response to the
5449 	 * DL_INFO_REQ sent in ipif_set_values.
5450 	 */
5451 	if (ill->ill_isv6)
5452 		ill->ill_sap = IP6_DL_SAP;
5453 	else
5454 		ill->ill_sap = IP_DL_SAP;
5455 	/*
5456 	 * Set ipif_mtu which is used to set the IRE's
5457 	 * ire_max_frag value. The driver could have sent
5458 	 * a different mtu from what it sent last time. No
5459 	 * need to call ipif_mtu_change because IREs have
5460 	 * not yet been created.
5461 	 */
5462 	ill->ill_ipif->ipif_mtu = ill->ill_max_mtu;
5463 	/*
5464 	 * Clear all the flags that were set based on ill_bcast_addr_length
5465 	 * and ill_phys_addr_length (in ipif_set_values) as these could have
5466 	 * changed now and we need to re-evaluate.
5467 	 */
5468 	ill->ill_flags &= ~(ILLF_MULTICAST | ILLF_NONUD | ILLF_NOARP);
5469 	ill->ill_ipif->ipif_flags &= ~(IPIF_BROADCAST | IPIF_POINTOPOINT);
5470 
5471 	/*
5472 	 * Free ill_resolver_mp and ill_bcast_mp as things could have
5473 	 * changed now.
5474 	 *
5475 	 * NOTE: The IPMP meta-interface is special-cased because it starts
5476 	 * with no underlying interfaces (and thus an unknown broadcast
5477 	 * address length), but we enforce that an interface is broadcast-
5478 	 * capable as part of allowing it to join a group.
5479 	 */
5480 	if (ill->ill_bcast_addr_length == 0 && !IS_IPMP(ill)) {
5481 		if (ill->ill_resolver_mp != NULL)
5482 			freemsg(ill->ill_resolver_mp);
5483 		if (ill->ill_bcast_mp != NULL)
5484 			freemsg(ill->ill_bcast_mp);
5485 		if (ill->ill_flags & ILLF_XRESOLV)
5486 			ill->ill_net_type = IRE_IF_RESOLVER;
5487 		else
5488 			ill->ill_net_type = IRE_IF_NORESOLVER;
5489 		ill->ill_resolver_mp = ill_dlur_gen(NULL,
5490 		    ill->ill_phys_addr_length,
5491 		    ill->ill_sap,
5492 		    ill->ill_sap_length);
5493 		ill->ill_bcast_mp = copymsg(ill->ill_resolver_mp);
5494 
5495 		if (ill->ill_isv6)
5496 			/*
5497 			 * Note: xresolv interfaces will eventually need NOARP
5498 			 * set here as well, but that will require those
5499 			 * external resolvers to have some knowledge of
5500 			 * that flag and act appropriately. Not to be changed
5501 			 * at present.
5502 			 */
5503 			ill->ill_flags |= ILLF_NONUD;
5504 		else
5505 			ill->ill_flags |= ILLF_NOARP;
5506 
5507 		if (ill->ill_phys_addr_length == 0) {
5508 			if (ill->ill_media->ip_m_mac_type == SUNW_DL_VNI) {
5509 				ill->ill_ipif->ipif_flags |= IPIF_NOXMIT;
5510 				ill->ill_phyint->phyint_flags |= PHYI_VIRTUAL;
5511 			} else {
5512 				/* pt-pt supports multicast. */
5513 				ill->ill_flags |= ILLF_MULTICAST;
5514 				ill->ill_ipif->ipif_flags |= IPIF_POINTOPOINT;
5515 			}
5516 		}
5517 	} else {
5518 		ill->ill_net_type = IRE_IF_RESOLVER;
5519 		if (ill->ill_bcast_mp != NULL)
5520 			freemsg(ill->ill_bcast_mp);
5521 		ill->ill_bcast_mp = ill_dlur_gen(brdcst_addr,
5522 		    ill->ill_bcast_addr_length, ill->ill_sap,
5523 		    ill->ill_sap_length);
5524 		/*
5525 		 * Later detect lack of DLPI driver multicast
5526 		 * capability by catching DL_ENABMULTI errors in
5527 		 * ip_rput_dlpi.
5528 		 */
5529 		ill->ill_flags |= ILLF_MULTICAST;
5530 		if (!ill->ill_isv6)
5531 			ill->ill_ipif->ipif_flags |= IPIF_BROADCAST;
5532 	}
5533 
5534 	/* For IPMP, PHYI_IPMP should already be set by ipif_allocate() */
5535 	if (ill->ill_mactype == SUNW_DL_IPMP)
5536 		ASSERT(ill->ill_phyint->phyint_flags & PHYI_IPMP);
5537 
5538 	/* By default an interface does not support any CoS marking */
5539 	ill->ill_flags &= ~ILLF_COS_ENABLED;
5540 
5541 	/*
5542 	 * If we get QoS information in DL_INFO_ACK, the device supports
5543 	 * some form of CoS marking, set ILLF_COS_ENABLED.
5544 	 */
5545 	sel1 = (dl_qos_cl_sel1_t *)mi_offset_param(mp, dlia->dl_qos_offset,
5546 	    dlia->dl_qos_length);
5547 	if ((sel1 != NULL) && (sel1->dl_qos_type == DL_QOS_CL_SEL1)) {
5548 		ill->ill_flags |= ILLF_COS_ENABLED;
5549 	}
5550 
5551 	/* Clear any previous error indication. */
5552 	ill->ill_error = 0;
5553 	freemsg(mp);
5554 }
5555 
5556 /*
5557  * Perform various checks to verify that an address would make sense as a
5558  * local, remote, or subnet interface address.
5559  */
5560 static boolean_t
5561 ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask)
5562 {
5563 	ipaddr_t	net_mask;
5564 
5565 	/*
5566 	 * Don't allow all zeroes, or all ones, but allow
5567 	 * all ones netmask.
5568 	 */
5569 	if ((net_mask = ip_net_mask(addr)) == 0)
5570 		return (B_FALSE);
5571 	/* A given netmask overrides the "guess" netmask */
5572 	if (subnet_mask != 0)
5573 		net_mask = subnet_mask;
5574 	if ((net_mask != ~(ipaddr_t)0) && ((addr == (addr & net_mask)) ||
5575 	    (addr == (addr | ~net_mask)))) {
5576 		return (B_FALSE);
5577 	}
5578 
5579 	/*
5580 	 * Even if the netmask is all ones, we do not allow address to be
5581 	 * 255.255.255.255
5582 	 */
5583 	if (addr == INADDR_BROADCAST)
5584 		return (B_FALSE);
5585 
5586 	if (CLASSD(addr))
5587 		return (B_FALSE);
5588 
5589 	return (B_TRUE);
5590 }
5591 
5592 #define	V6_IPIF_LINKLOCAL(p)	\
5593 	IN6_IS_ADDR_LINKLOCAL(&(p)->ipif_v6lcl_addr)
5594 
5595 /*
5596  * Compare two given ipifs and check if the second one is better than
5597  * the first one using the order of preference (not taking deprecated
5598  * into acount) specified in ipif_lookup_multicast().
5599  */
5600 static boolean_t
5601 ipif_comp_multi(ipif_t *old_ipif, ipif_t *new_ipif, boolean_t isv6)
5602 {
5603 	/* Check the least preferred first. */
5604 	if (IS_LOOPBACK(old_ipif->ipif_ill)) {
5605 		/* If both ipifs are the same, use the first one. */
5606 		if (IS_LOOPBACK(new_ipif->ipif_ill))
5607 			return (B_FALSE);
5608 		else
5609 			return (B_TRUE);
5610 	}
5611 
5612 	/* For IPv6, check for link local address. */
5613 	if (isv6 && V6_IPIF_LINKLOCAL(old_ipif)) {
5614 		if (IS_LOOPBACK(new_ipif->ipif_ill) ||
5615 		    V6_IPIF_LINKLOCAL(new_ipif)) {
5616 			/* The second one is equal or less preferred. */
5617 			return (B_FALSE);
5618 		} else {
5619 			return (B_TRUE);
5620 		}
5621 	}
5622 
5623 	/* Then check for point to point interface. */
5624 	if (old_ipif->ipif_flags & IPIF_POINTOPOINT) {
5625 		if (IS_LOOPBACK(new_ipif->ipif_ill) ||
5626 		    (isv6 && V6_IPIF_LINKLOCAL(new_ipif)) ||
5627 		    (new_ipif->ipif_flags & IPIF_POINTOPOINT)) {
5628 			return (B_FALSE);
5629 		} else {
5630 			return (B_TRUE);
5631 		}
5632 	}
5633 
5634 	/* old_ipif is a normal interface, so no need to use the new one. */
5635 	return (B_FALSE);
5636 }
5637 
5638 /*
5639  * Find a mulitcast-capable ipif given an IP instance and zoneid.
5640  * The ipif must be up, and its ill must multicast-capable, not
5641  * condemned, not an underlying interface in an IPMP group, and
5642  * not a VNI interface.  Order of preference:
5643  *
5644  * 	1a. normal
5645  * 	1b. normal, but deprecated
5646  * 	2a. point to point
5647  * 	2b. point to point, but deprecated
5648  * 	3a. link local
5649  * 	3b. link local, but deprecated
5650  * 	4. loopback.
5651  */
5652 ipif_t *
5653 ipif_lookup_multicast(ip_stack_t *ipst, zoneid_t zoneid, boolean_t isv6)
5654 {
5655 	ill_t			*ill;
5656 	ill_walk_context_t	ctx;
5657 	ipif_t			*ipif;
5658 	ipif_t			*saved_ipif = NULL;
5659 	ipif_t			*dep_ipif = NULL;
5660 
5661 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5662 	if (isv6)
5663 		ill = ILL_START_WALK_V6(&ctx, ipst);
5664 	else
5665 		ill = ILL_START_WALK_V4(&ctx, ipst);
5666 
5667 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5668 		mutex_enter(&ill->ill_lock);
5669 		if (IS_VNI(ill) || IS_UNDER_IPMP(ill) || !ILL_CAN_LOOKUP(ill) ||
5670 		    !(ill->ill_flags & ILLF_MULTICAST)) {
5671 			mutex_exit(&ill->ill_lock);
5672 			continue;
5673 		}
5674 		for (ipif = ill->ill_ipif; ipif != NULL;
5675 		    ipif = ipif->ipif_next) {
5676 			if (zoneid != ipif->ipif_zoneid &&
5677 			    zoneid != ALL_ZONES &&
5678 			    ipif->ipif_zoneid != ALL_ZONES) {
5679 				continue;
5680 			}
5681 			if (!(ipif->ipif_flags & IPIF_UP) ||
5682 			    !IPIF_CAN_LOOKUP(ipif)) {
5683 				continue;
5684 			}
5685 
5686 			/*
5687 			 * Found one candidate.  If it is deprecated,
5688 			 * remember it in dep_ipif.  If it is not deprecated,
5689 			 * remember it in saved_ipif.
5690 			 */
5691 			if (ipif->ipif_flags & IPIF_DEPRECATED) {
5692 				if (dep_ipif == NULL) {
5693 					dep_ipif = ipif;
5694 				} else if (ipif_comp_multi(dep_ipif, ipif,
5695 				    isv6)) {
5696 					/*
5697 					 * If the previous dep_ipif does not
5698 					 * belong to the same ill, we've done
5699 					 * a ipif_refhold() on it.  So we need
5700 					 * to release it.
5701 					 */
5702 					if (dep_ipif->ipif_ill != ill)
5703 						ipif_refrele(dep_ipif);
5704 					dep_ipif = ipif;
5705 				}
5706 				continue;
5707 			}
5708 			if (saved_ipif == NULL) {
5709 				saved_ipif = ipif;
5710 			} else {
5711 				if (ipif_comp_multi(saved_ipif, ipif, isv6)) {
5712 					if (saved_ipif->ipif_ill != ill)
5713 						ipif_refrele(saved_ipif);
5714 					saved_ipif = ipif;
5715 				}
5716 			}
5717 		}
5718 		/*
5719 		 * Before going to the next ill, do a ipif_refhold() on the
5720 		 * saved ones.
5721 		 */
5722 		if (saved_ipif != NULL && saved_ipif->ipif_ill == ill)
5723 			ipif_refhold_locked(saved_ipif);
5724 		if (dep_ipif != NULL && dep_ipif->ipif_ill == ill)
5725 			ipif_refhold_locked(dep_ipif);
5726 		mutex_exit(&ill->ill_lock);
5727 	}
5728 	rw_exit(&ipst->ips_ill_g_lock);
5729 
5730 	/*
5731 	 * If we have only the saved_ipif, return it.  But if we have both
5732 	 * saved_ipif and dep_ipif, check to see which one is better.
5733 	 */
5734 	if (saved_ipif != NULL) {
5735 		if (dep_ipif != NULL) {
5736 			if (ipif_comp_multi(saved_ipif, dep_ipif, isv6)) {
5737 				ipif_refrele(saved_ipif);
5738 				return (dep_ipif);
5739 			} else {
5740 				ipif_refrele(dep_ipif);
5741 				return (saved_ipif);
5742 			}
5743 		}
5744 		return (saved_ipif);
5745 	} else {
5746 		return (dep_ipif);
5747 	}
5748 }
5749 
5750 /*
5751  * This function is called when an application does not specify an interface
5752  * to be used for multicast traffic (joining a group/sending data).  It
5753  * calls ire_lookup_multi() to look for an interface route for the
5754  * specified multicast group.  Doing this allows the administrator to add
5755  * prefix routes for multicast to indicate which interface to be used for
5756  * multicast traffic in the above scenario.  The route could be for all
5757  * multicast (224.0/4), for a single multicast group (a /32 route) or
5758  * anything in between.  If there is no such multicast route, we just find
5759  * any multicast capable interface and return it.  The returned ipif
5760  * is refhold'ed.
5761  */
5762 ipif_t *
5763 ipif_lookup_group(ipaddr_t group, zoneid_t zoneid, ip_stack_t *ipst)
5764 {
5765 	ire_t			*ire;
5766 	ipif_t			*ipif;
5767 
5768 	ire = ire_lookup_multi(group, zoneid, ipst);
5769 	if (ire != NULL) {
5770 		ipif = ire->ire_ipif;
5771 		ipif_refhold(ipif);
5772 		ire_refrele(ire);
5773 		return (ipif);
5774 	}
5775 
5776 	return (ipif_lookup_multicast(ipst, zoneid, B_FALSE));
5777 }
5778 
5779 /*
5780  * Look for an ipif with the specified interface address and destination.
5781  * The destination address is used only for matching point-to-point interfaces.
5782  */
5783 ipif_t *
5784 ipif_lookup_interface(ipaddr_t if_addr, ipaddr_t dst, queue_t *q, mblk_t *mp,
5785     ipsq_func_t func, int *error, ip_stack_t *ipst)
5786 {
5787 	ipif_t	*ipif;
5788 	ill_t	*ill;
5789 	ill_walk_context_t ctx;
5790 	ipsq_t	*ipsq;
5791 
5792 	if (error != NULL)
5793 		*error = 0;
5794 
5795 	/*
5796 	 * First match all the point-to-point interfaces
5797 	 * before looking at non-point-to-point interfaces.
5798 	 * This is done to avoid returning non-point-to-point
5799 	 * ipif instead of unnumbered point-to-point ipif.
5800 	 */
5801 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5802 	ill = ILL_START_WALK_V4(&ctx, ipst);
5803 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5804 		GRAB_CONN_LOCK(q);
5805 		mutex_enter(&ill->ill_lock);
5806 		for (ipif = ill->ill_ipif; ipif != NULL;
5807 		    ipif = ipif->ipif_next) {
5808 			/* Allow the ipif to be down */
5809 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
5810 			    (ipif->ipif_lcl_addr == if_addr) &&
5811 			    (ipif->ipif_pp_dst_addr == dst)) {
5812 				/*
5813 				 * The block comment at the start of ipif_down
5814 				 * explains the use of the macros used below
5815 				 */
5816 				if (IPIF_CAN_LOOKUP(ipif)) {
5817 					ipif_refhold_locked(ipif);
5818 					mutex_exit(&ill->ill_lock);
5819 					RELEASE_CONN_LOCK(q);
5820 					rw_exit(&ipst->ips_ill_g_lock);
5821 					return (ipif);
5822 				} else if (IPIF_CAN_WAIT(ipif, q)) {
5823 					ipsq = ill->ill_phyint->phyint_ipsq;
5824 					mutex_enter(&ipsq->ipsq_lock);
5825 					mutex_enter(&ipsq->ipsq_xop->ipx_lock);
5826 					mutex_exit(&ill->ill_lock);
5827 					rw_exit(&ipst->ips_ill_g_lock);
5828 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
5829 					    ill);
5830 					mutex_exit(&ipsq->ipsq_xop->ipx_lock);
5831 					mutex_exit(&ipsq->ipsq_lock);
5832 					RELEASE_CONN_LOCK(q);
5833 					if (error != NULL)
5834 						*error = EINPROGRESS;
5835 					return (NULL);
5836 				}
5837 			}
5838 		}
5839 		mutex_exit(&ill->ill_lock);
5840 		RELEASE_CONN_LOCK(q);
5841 	}
5842 	rw_exit(&ipst->ips_ill_g_lock);
5843 
5844 	/* lookup the ipif based on interface address */
5845 	ipif = ipif_lookup_addr(if_addr, NULL, ALL_ZONES, q, mp, func, error,
5846 	    ipst);
5847 	ASSERT(ipif == NULL || !ipif->ipif_isv6);
5848 	return (ipif);
5849 }
5850 
5851 /*
5852  * Common function for ipif_lookup_addr() and ipif_lookup_addr_exact().
5853  */
5854 static ipif_t *
5855 ipif_lookup_addr_common(ipaddr_t addr, ill_t *match_ill, boolean_t match_illgrp,
5856     zoneid_t zoneid, queue_t *q, mblk_t *mp, ipsq_func_t func, int *error,
5857     ip_stack_t *ipst)
5858 {
5859 	ipif_t  *ipif;
5860 	ill_t   *ill;
5861 	boolean_t ptp = B_FALSE;
5862 	ipsq_t	*ipsq;
5863 	ill_walk_context_t	ctx;
5864 
5865 	if (error != NULL)
5866 		*error = 0;
5867 
5868 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5869 	/*
5870 	 * Repeat twice, first based on local addresses and
5871 	 * next time for pointopoint.
5872 	 */
5873 repeat:
5874 	ill = ILL_START_WALK_V4(&ctx, ipst);
5875 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5876 		if (match_ill != NULL && ill != match_ill &&
5877 		    (!match_illgrp || !IS_IN_SAME_ILLGRP(ill, match_ill))) {
5878 			continue;
5879 		}
5880 		GRAB_CONN_LOCK(q);
5881 		mutex_enter(&ill->ill_lock);
5882 		for (ipif = ill->ill_ipif; ipif != NULL;
5883 		    ipif = ipif->ipif_next) {
5884 			if (zoneid != ALL_ZONES &&
5885 			    zoneid != ipif->ipif_zoneid &&
5886 			    ipif->ipif_zoneid != ALL_ZONES)
5887 				continue;
5888 			/* Allow the ipif to be down */
5889 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
5890 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
5891 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
5892 			    (ipif->ipif_pp_dst_addr == addr))) {
5893 				/*
5894 				 * The block comment at the start of ipif_down
5895 				 * explains the use of the macros used below
5896 				 */
5897 				if (IPIF_CAN_LOOKUP(ipif)) {
5898 					ipif_refhold_locked(ipif);
5899 					mutex_exit(&ill->ill_lock);
5900 					RELEASE_CONN_LOCK(q);
5901 					rw_exit(&ipst->ips_ill_g_lock);
5902 					return (ipif);
5903 				} else if (IPIF_CAN_WAIT(ipif, q)) {
5904 					ipsq = ill->ill_phyint->phyint_ipsq;
5905 					mutex_enter(&ipsq->ipsq_lock);
5906 					mutex_enter(&ipsq->ipsq_xop->ipx_lock);
5907 					mutex_exit(&ill->ill_lock);
5908 					rw_exit(&ipst->ips_ill_g_lock);
5909 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
5910 					    ill);
5911 					mutex_exit(&ipsq->ipsq_xop->ipx_lock);
5912 					mutex_exit(&ipsq->ipsq_lock);
5913 					RELEASE_CONN_LOCK(q);
5914 					if (error != NULL)
5915 						*error = EINPROGRESS;
5916 					return (NULL);
5917 				}
5918 			}
5919 		}
5920 		mutex_exit(&ill->ill_lock);
5921 		RELEASE_CONN_LOCK(q);
5922 	}
5923 
5924 	/* If we already did the ptp case, then we are done */
5925 	if (ptp) {
5926 		rw_exit(&ipst->ips_ill_g_lock);
5927 		if (error != NULL)
5928 			*error = ENXIO;
5929 		return (NULL);
5930 	}
5931 	ptp = B_TRUE;
5932 	goto repeat;
5933 }
5934 
5935 /*
5936  * Check if the address exists in the system.
5937  * We don't hold the conn_lock as we will not perform defered ipsqueue
5938  * operation.
5939  */
5940 boolean_t
5941 ip_addr_exists(ipaddr_t addr, zoneid_t zoneid, ip_stack_t *ipst)
5942 {
5943 	ipif_t  *ipif;
5944 	ill_t   *ill;
5945 	ill_walk_context_t	ctx;
5946 
5947 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
5948 
5949 	ill = ILL_START_WALK_V4(&ctx, ipst);
5950 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5951 		mutex_enter(&ill->ill_lock);
5952 		for (ipif = ill->ill_ipif; ipif != NULL;
5953 		    ipif = ipif->ipif_next) {
5954 			if (zoneid != ALL_ZONES &&
5955 			    zoneid != ipif->ipif_zoneid &&
5956 			    ipif->ipif_zoneid != ALL_ZONES)
5957 				continue;
5958 			/* Allow the ipif to be down */
5959 			/*
5960 			 * XXX Different from ipif_lookup_addr(), we don't do
5961 			 * twice lookups. As from bind()'s point of view, we
5962 			 * may return once we find a match.
5963 			 */
5964 			if (((ipif->ipif_lcl_addr == addr) &&
5965 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
5966 			    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
5967 			    (ipif->ipif_pp_dst_addr == addr))) {
5968 				/*
5969 				 * Allow bind() to be successful even if the
5970 				 * ipif is with IPIF_CHANGING bit set.
5971 				 */
5972 				mutex_exit(&ill->ill_lock);
5973 				rw_exit(&ipst->ips_ill_g_lock);
5974 				return (B_TRUE);
5975 			}
5976 		}
5977 		mutex_exit(&ill->ill_lock);
5978 	}
5979 
5980 	rw_exit(&ipst->ips_ill_g_lock);
5981 	return (B_FALSE);
5982 }
5983 
5984 /*
5985  * Lookup an ipif with the specified address.  For point-to-point links we
5986  * look for matches on either the destination address or the local address,
5987  * but we skip the local address check if IPIF_UNNUMBERED is set.  If the
5988  * `match_ill' argument is non-NULL, the lookup is restricted to that ill
5989  * (or illgrp if `match_ill' is in an IPMP group).
5990  */
5991 ipif_t *
5992 ipif_lookup_addr(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid, queue_t *q,
5993     mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst)
5994 {
5995 	return (ipif_lookup_addr_common(addr, match_ill, B_TRUE, zoneid, q, mp,
5996 	    func, error, ipst));
5997 }
5998 
5999 /*
6000  * Special abbreviated version of ipif_lookup_addr() that doesn't match
6001  * `match_ill' across the IPMP group.  This function is only needed in some
6002  * corner-cases; almost everything should use ipif_lookup_addr().
6003  */
6004 static ipif_t *
6005 ipif_lookup_addr_exact(ipaddr_t addr, ill_t *match_ill, ip_stack_t *ipst)
6006 {
6007 	ASSERT(match_ill != NULL);
6008 	return (ipif_lookup_addr_common(addr, match_ill, B_FALSE, ALL_ZONES,
6009 	    NULL, NULL, NULL, NULL, ipst));
6010 }
6011 
6012 /*
6013  * Look for an ipif with the specified address. For point-point links
6014  * we look for matches on either the destination address and the local
6015  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
6016  * is set.
6017  * If the `match_ill' argument is non-NULL, the lookup is restricted to that
6018  * ill (or illgrp if `match_ill' is in an IPMP group).
6019  * Return the zoneid for the ipif which matches. ALL_ZONES if no match.
6020  */
6021 zoneid_t
6022 ipif_lookup_addr_zoneid(ipaddr_t addr, ill_t *match_ill, ip_stack_t *ipst)
6023 {
6024 	zoneid_t zoneid;
6025 	ipif_t  *ipif;
6026 	ill_t   *ill;
6027 	boolean_t ptp = B_FALSE;
6028 	ill_walk_context_t	ctx;
6029 
6030 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
6031 	/*
6032 	 * Repeat twice, first based on local addresses and
6033 	 * next time for pointopoint.
6034 	 */
6035 repeat:
6036 	ill = ILL_START_WALK_V4(&ctx, ipst);
6037 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
6038 		if (match_ill != NULL && ill != match_ill &&
6039 		    !IS_IN_SAME_ILLGRP(ill, match_ill)) {
6040 			continue;
6041 		}
6042 		mutex_enter(&ill->ill_lock);
6043 		for (ipif = ill->ill_ipif; ipif != NULL;
6044 		    ipif = ipif->ipif_next) {
6045 			/* Allow the ipif to be down */
6046 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
6047 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
6048 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
6049 			    (ipif->ipif_pp_dst_addr == addr)) &&
6050 			    !(ipif->ipif_state_flags & IPIF_CONDEMNED)) {
6051 				zoneid = ipif->ipif_zoneid;
6052 				mutex_exit(&ill->ill_lock);
6053 				rw_exit(&ipst->ips_ill_g_lock);
6054 				/*
6055 				 * If ipif_zoneid was ALL_ZONES then we have
6056 				 * a trusted extensions shared IP address.
6057 				 * In that case GLOBAL_ZONEID works to send.
6058 				 */
6059 				if (zoneid == ALL_ZONES)
6060 					zoneid = GLOBAL_ZONEID;
6061 				return (zoneid);
6062 			}
6063 		}
6064 		mutex_exit(&ill->ill_lock);
6065 	}
6066 
6067 	/* If we already did the ptp case, then we are done */
6068 	if (ptp) {
6069 		rw_exit(&ipst->ips_ill_g_lock);
6070 		return (ALL_ZONES);
6071 	}
6072 	ptp = B_TRUE;
6073 	goto repeat;
6074 }
6075 
6076 /*
6077  * Look for an ipif that matches the specified remote address i.e. the
6078  * ipif that would receive the specified packet.
6079  * First look for directly connected interfaces and then do a recursive
6080  * IRE lookup and pick the first ipif corresponding to the source address in the
6081  * ire.
6082  * Returns: held ipif
6083  */
6084 ipif_t *
6085 ipif_lookup_remote(ill_t *ill, ipaddr_t addr, zoneid_t zoneid)
6086 {
6087 	ipif_t	*ipif;
6088 	ire_t	*ire;
6089 	ip_stack_t	*ipst = ill->ill_ipst;
6090 
6091 	ASSERT(!ill->ill_isv6);
6092 
6093 	/*
6094 	 * Someone could be changing this ipif currently or change it
6095 	 * after we return this. Thus  a few packets could use the old
6096 	 * old values. However structure updates/creates (ire, ilg, ilm etc)
6097 	 * will atomically be updated or cleaned up with the new value
6098 	 * Thus we don't need a lock to check the flags or other attrs below.
6099 	 */
6100 	mutex_enter(&ill->ill_lock);
6101 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
6102 		if (!IPIF_CAN_LOOKUP(ipif))
6103 			continue;
6104 		if (zoneid != ALL_ZONES && zoneid != ipif->ipif_zoneid &&
6105 		    ipif->ipif_zoneid != ALL_ZONES)
6106 			continue;
6107 		/* Allow the ipif to be down */
6108 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
6109 			if ((ipif->ipif_pp_dst_addr == addr) ||
6110 			    (!(ipif->ipif_flags & IPIF_UNNUMBERED) &&
6111 			    ipif->ipif_lcl_addr == addr)) {
6112 				ipif_refhold_locked(ipif);
6113 				mutex_exit(&ill->ill_lock);
6114 				return (ipif);
6115 			}
6116 		} else if (ipif->ipif_subnet == (addr & ipif->ipif_net_mask)) {
6117 			ipif_refhold_locked(ipif);
6118 			mutex_exit(&ill->ill_lock);
6119 			return (ipif);
6120 		}
6121 	}
6122 	mutex_exit(&ill->ill_lock);
6123 	ire = ire_route_lookup(addr, 0, 0, 0, NULL, NULL, zoneid,
6124 	    NULL, MATCH_IRE_RECURSIVE, ipst);
6125 	if (ire != NULL) {
6126 		/*
6127 		 * The callers of this function wants to know the
6128 		 * interface on which they have to send the replies
6129 		 * back. For IREs that have ire_stq and ire_ipif
6130 		 * derived from different ills, we really don't care
6131 		 * what we return here.
6132 		 */
6133 		ipif = ire->ire_ipif;
6134 		if (ipif != NULL) {
6135 			ipif_refhold(ipif);
6136 			ire_refrele(ire);
6137 			return (ipif);
6138 		}
6139 		ire_refrele(ire);
6140 	}
6141 	/* Pick the first interface */
6142 	ipif = ipif_get_next_ipif(NULL, ill);
6143 	return (ipif);
6144 }
6145 
6146 /*
6147  * This func does not prevent refcnt from increasing. But if
6148  * the caller has taken steps to that effect, then this func
6149  * can be used to determine whether the ill has become quiescent
6150  */
6151 static boolean_t
6152 ill_is_quiescent(ill_t *ill)
6153 {
6154 	ipif_t	*ipif;
6155 
6156 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6157 
6158 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
6159 		if (ipif->ipif_refcnt != 0 || !IPIF_DOWN_OK(ipif)) {
6160 			return (B_FALSE);
6161 		}
6162 	}
6163 	if (!ILL_DOWN_OK(ill) || ill->ill_refcnt != 0) {
6164 		return (B_FALSE);
6165 	}
6166 	return (B_TRUE);
6167 }
6168 
6169 boolean_t
6170 ill_is_freeable(ill_t *ill)
6171 {
6172 	ipif_t	*ipif;
6173 
6174 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6175 
6176 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
6177 		if (ipif->ipif_refcnt != 0 || !IPIF_FREE_OK(ipif)) {
6178 			return (B_FALSE);
6179 		}
6180 	}
6181 	if (!ILL_FREE_OK(ill) || ill->ill_refcnt != 0) {
6182 		return (B_FALSE);
6183 	}
6184 	return (B_TRUE);
6185 }
6186 
6187 /*
6188  * This func does not prevent refcnt from increasing. But if
6189  * the caller has taken steps to that effect, then this func
6190  * can be used to determine whether the ipif has become quiescent
6191  */
6192 static boolean_t
6193 ipif_is_quiescent(ipif_t *ipif)
6194 {
6195 	ill_t *ill;
6196 
6197 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6198 
6199 	if (ipif->ipif_refcnt != 0 || !IPIF_DOWN_OK(ipif)) {
6200 		return (B_FALSE);
6201 	}
6202 
6203 	ill = ipif->ipif_ill;
6204 	if (ill->ill_ipif_up_count != 0 || ill->ill_ipif_dup_count != 0 ||
6205 	    ill->ill_logical_down) {
6206 		return (B_TRUE);
6207 	}
6208 
6209 	/* This is the last ipif going down or being deleted on this ill */
6210 	if (!ILL_DOWN_OK(ill) || ill->ill_refcnt != 0) {
6211 		return (B_FALSE);
6212 	}
6213 
6214 	return (B_TRUE);
6215 }
6216 
6217 /*
6218  * return true if the ipif can be destroyed: the ipif has to be quiescent
6219  * with zero references from ire/nce/ilm to it.
6220  */
6221 static boolean_t
6222 ipif_is_freeable(ipif_t *ipif)
6223 {
6224 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6225 	ASSERT(ipif->ipif_id != 0);
6226 	return (ipif->ipif_refcnt == 0 && IPIF_FREE_OK(ipif));
6227 }
6228 
6229 /*
6230  * The ipif/ill/ire has been refreled. Do the tail processing.
6231  * Determine if the ipif or ill in question has become quiescent and if so
6232  * wakeup close and/or restart any queued pending ioctl that is waiting
6233  * for the ipif_down (or ill_down)
6234  */
6235 void
6236 ipif_ill_refrele_tail(ill_t *ill)
6237 {
6238 	mblk_t	*mp;
6239 	conn_t	*connp;
6240 	ipsq_t	*ipsq;
6241 	ipxop_t	*ipx;
6242 	ipif_t	*ipif;
6243 	dl_notify_ind_t *dlindp;
6244 
6245 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6246 
6247 	if ((ill->ill_state_flags & ILL_CONDEMNED) && ill_is_freeable(ill)) {
6248 		/* ip_modclose() may be waiting */
6249 		cv_broadcast(&ill->ill_cv);
6250 	}
6251 
6252 	ipsq = ill->ill_phyint->phyint_ipsq;
6253 	mutex_enter(&ipsq->ipsq_lock);
6254 	ipx = ipsq->ipsq_xop;
6255 	mutex_enter(&ipx->ipx_lock);
6256 	if (ipx->ipx_waitfor == 0)	/* no one's waiting; bail */
6257 		goto unlock;
6258 
6259 	ASSERT(ipx->ipx_pending_mp != NULL && ipx->ipx_pending_ipif != NULL);
6260 
6261 	ipif = ipx->ipx_pending_ipif;
6262 	if (ipif->ipif_ill != ill) 	/* wait is for another ill; bail */
6263 		goto unlock;
6264 
6265 	switch (ipx->ipx_waitfor) {
6266 	case IPIF_DOWN:
6267 		if (!ipif_is_quiescent(ipif))
6268 			goto unlock;
6269 		break;
6270 	case IPIF_FREE:
6271 		if (!ipif_is_freeable(ipif))
6272 			goto unlock;
6273 		break;
6274 	case ILL_DOWN:
6275 		if (!ill_is_quiescent(ill))
6276 			goto unlock;
6277 		break;
6278 	case ILL_FREE:
6279 		/*
6280 		 * ILL_FREE is only for loopback; normal ill teardown waits
6281 		 * synchronously in ip_modclose() without using ipx_waitfor,
6282 		 * handled by the cv_broadcast() at the top of this function.
6283 		 */
6284 		if (!ill_is_freeable(ill))
6285 			goto unlock;
6286 		break;
6287 	default:
6288 		cmn_err(CE_PANIC, "ipsq: %p unknown ipx_waitfor %d\n",
6289 		    (void *)ipsq, ipx->ipx_waitfor);
6290 	}
6291 
6292 	ill_refhold_locked(ill);	/* for qwriter_ip() call below */
6293 	mutex_exit(&ipx->ipx_lock);
6294 	mp = ipsq_pending_mp_get(ipsq, &connp);
6295 	mutex_exit(&ipsq->ipsq_lock);
6296 	mutex_exit(&ill->ill_lock);
6297 
6298 	ASSERT(mp != NULL);
6299 	/*
6300 	 * NOTE: all of the qwriter_ip() calls below use CUR_OP since
6301 	 * we can only get here when the current operation decides it
6302 	 * it needs to quiesce via ipsq_pending_mp_add().
6303 	 */
6304 	switch (mp->b_datap->db_type) {
6305 	case M_PCPROTO:
6306 	case M_PROTO:
6307 		/*
6308 		 * For now, only DL_NOTIFY_IND messages can use this facility.
6309 		 */
6310 		dlindp = (dl_notify_ind_t *)mp->b_rptr;
6311 		ASSERT(dlindp->dl_primitive == DL_NOTIFY_IND);
6312 
6313 		switch (dlindp->dl_notification) {
6314 		case DL_NOTE_PHYS_ADDR:
6315 			qwriter_ip(ill, ill->ill_rq, mp,
6316 			    ill_set_phys_addr_tail, CUR_OP, B_TRUE);
6317 			return;
6318 		default:
6319 			ASSERT(0);
6320 			ill_refrele(ill);
6321 		}
6322 		break;
6323 
6324 	case M_ERROR:
6325 	case M_HANGUP:
6326 		qwriter_ip(ill, ill->ill_rq, mp, ipif_all_down_tail, CUR_OP,
6327 		    B_TRUE);
6328 		return;
6329 
6330 	case M_IOCTL:
6331 	case M_IOCDATA:
6332 		qwriter_ip(ill, (connp != NULL ? CONNP_TO_WQ(connp) :
6333 		    ill->ill_wq), mp, ip_reprocess_ioctl, CUR_OP, B_TRUE);
6334 		return;
6335 
6336 	default:
6337 		cmn_err(CE_PANIC, "ipif_ill_refrele_tail mp %p "
6338 		    "db_type %d\n", (void *)mp, mp->b_datap->db_type);
6339 	}
6340 	return;
6341 unlock:
6342 	mutex_exit(&ipsq->ipsq_lock);
6343 	mutex_exit(&ipx->ipx_lock);
6344 	mutex_exit(&ill->ill_lock);
6345 }
6346 
6347 #ifdef DEBUG
6348 /* Reuse trace buffer from beginning (if reached the end) and record trace */
6349 static void
6350 th_trace_rrecord(th_trace_t *th_trace)
6351 {
6352 	tr_buf_t *tr_buf;
6353 	uint_t lastref;
6354 
6355 	lastref = th_trace->th_trace_lastref;
6356 	lastref++;
6357 	if (lastref == TR_BUF_MAX)
6358 		lastref = 0;
6359 	th_trace->th_trace_lastref = lastref;
6360 	tr_buf = &th_trace->th_trbuf[lastref];
6361 	tr_buf->tr_time = lbolt;
6362 	tr_buf->tr_depth = getpcstack(tr_buf->tr_stack, TR_STACK_DEPTH);
6363 }
6364 
6365 static void
6366 th_trace_free(void *value)
6367 {
6368 	th_trace_t *th_trace = value;
6369 
6370 	ASSERT(th_trace->th_refcnt == 0);
6371 	kmem_free(th_trace, sizeof (*th_trace));
6372 }
6373 
6374 /*
6375  * Find or create the per-thread hash table used to track object references.
6376  * The ipst argument is NULL if we shouldn't allocate.
6377  *
6378  * Accesses per-thread data, so there's no need to lock here.
6379  */
6380 static mod_hash_t *
6381 th_trace_gethash(ip_stack_t *ipst)
6382 {
6383 	th_hash_t *thh;
6384 
6385 	if ((thh = tsd_get(ip_thread_data)) == NULL && ipst != NULL) {
6386 		mod_hash_t *mh;
6387 		char name[256];
6388 		size_t objsize, rshift;
6389 		int retv;
6390 
6391 		if ((thh = kmem_alloc(sizeof (*thh), KM_NOSLEEP)) == NULL)
6392 			return (NULL);
6393 		(void) snprintf(name, sizeof (name), "th_trace_%p",
6394 		    (void *)curthread);
6395 
6396 		/*
6397 		 * We use mod_hash_create_extended here rather than the more
6398 		 * obvious mod_hash_create_ptrhash because the latter has a
6399 		 * hard-coded KM_SLEEP, and we'd prefer to fail rather than
6400 		 * block.
6401 		 */
6402 		objsize = MAX(MAX(sizeof (ill_t), sizeof (ipif_t)),
6403 		    MAX(sizeof (ire_t), sizeof (nce_t)));
6404 		rshift = highbit(objsize);
6405 		mh = mod_hash_create_extended(name, 64, mod_hash_null_keydtor,
6406 		    th_trace_free, mod_hash_byptr, (void *)rshift,
6407 		    mod_hash_ptrkey_cmp, KM_NOSLEEP);
6408 		if (mh == NULL) {
6409 			kmem_free(thh, sizeof (*thh));
6410 			return (NULL);
6411 		}
6412 		thh->thh_hash = mh;
6413 		thh->thh_ipst = ipst;
6414 		/*
6415 		 * We trace ills, ipifs, ires, and nces.  All of these are
6416 		 * per-IP-stack, so the lock on the thread list is as well.
6417 		 */
6418 		rw_enter(&ip_thread_rwlock, RW_WRITER);
6419 		list_insert_tail(&ip_thread_list, thh);
6420 		rw_exit(&ip_thread_rwlock);
6421 		retv = tsd_set(ip_thread_data, thh);
6422 		ASSERT(retv == 0);
6423 	}
6424 	return (thh != NULL ? thh->thh_hash : NULL);
6425 }
6426 
6427 boolean_t
6428 th_trace_ref(const void *obj, ip_stack_t *ipst)
6429 {
6430 	th_trace_t *th_trace;
6431 	mod_hash_t *mh;
6432 	mod_hash_val_t val;
6433 
6434 	if ((mh = th_trace_gethash(ipst)) == NULL)
6435 		return (B_FALSE);
6436 
6437 	/*
6438 	 * Attempt to locate the trace buffer for this obj and thread.
6439 	 * If it does not exist, then allocate a new trace buffer and
6440 	 * insert into the hash.
6441 	 */
6442 	if (mod_hash_find(mh, (mod_hash_key_t)obj, &val) == MH_ERR_NOTFOUND) {
6443 		th_trace = kmem_zalloc(sizeof (th_trace_t), KM_NOSLEEP);
6444 		if (th_trace == NULL)
6445 			return (B_FALSE);
6446 
6447 		th_trace->th_id = curthread;
6448 		if (mod_hash_insert(mh, (mod_hash_key_t)obj,
6449 		    (mod_hash_val_t)th_trace) != 0) {
6450 			kmem_free(th_trace, sizeof (th_trace_t));
6451 			return (B_FALSE);
6452 		}
6453 	} else {
6454 		th_trace = (th_trace_t *)val;
6455 	}
6456 
6457 	ASSERT(th_trace->th_refcnt >= 0 &&
6458 	    th_trace->th_refcnt < TR_BUF_MAX - 1);
6459 
6460 	th_trace->th_refcnt++;
6461 	th_trace_rrecord(th_trace);
6462 	return (B_TRUE);
6463 }
6464 
6465 /*
6466  * For the purpose of tracing a reference release, we assume that global
6467  * tracing is always on and that the same thread initiated the reference hold
6468  * is releasing.
6469  */
6470 void
6471 th_trace_unref(const void *obj)
6472 {
6473 	int retv;
6474 	mod_hash_t *mh;
6475 	th_trace_t *th_trace;
6476 	mod_hash_val_t val;
6477 
6478 	mh = th_trace_gethash(NULL);
6479 	retv = mod_hash_find(mh, (mod_hash_key_t)obj, &val);
6480 	ASSERT(retv == 0);
6481 	th_trace = (th_trace_t *)val;
6482 
6483 	ASSERT(th_trace->th_refcnt > 0);
6484 	th_trace->th_refcnt--;
6485 	th_trace_rrecord(th_trace);
6486 }
6487 
6488 /*
6489  * If tracing has been disabled, then we assume that the reference counts are
6490  * now useless, and we clear them out before destroying the entries.
6491  */
6492 void
6493 th_trace_cleanup(const void *obj, boolean_t trace_disable)
6494 {
6495 	th_hash_t	*thh;
6496 	mod_hash_t	*mh;
6497 	mod_hash_val_t	val;
6498 	th_trace_t	*th_trace;
6499 	int		retv;
6500 
6501 	rw_enter(&ip_thread_rwlock, RW_READER);
6502 	for (thh = list_head(&ip_thread_list); thh != NULL;
6503 	    thh = list_next(&ip_thread_list, thh)) {
6504 		if (mod_hash_find(mh = thh->thh_hash, (mod_hash_key_t)obj,
6505 		    &val) == 0) {
6506 			th_trace = (th_trace_t *)val;
6507 			if (trace_disable)
6508 				th_trace->th_refcnt = 0;
6509 			retv = mod_hash_destroy(mh, (mod_hash_key_t)obj);
6510 			ASSERT(retv == 0);
6511 		}
6512 	}
6513 	rw_exit(&ip_thread_rwlock);
6514 }
6515 
6516 void
6517 ipif_trace_ref(ipif_t *ipif)
6518 {
6519 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6520 
6521 	if (ipif->ipif_trace_disable)
6522 		return;
6523 
6524 	if (!th_trace_ref(ipif, ipif->ipif_ill->ill_ipst)) {
6525 		ipif->ipif_trace_disable = B_TRUE;
6526 		ipif_trace_cleanup(ipif);
6527 	}
6528 }
6529 
6530 void
6531 ipif_untrace_ref(ipif_t *ipif)
6532 {
6533 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6534 
6535 	if (!ipif->ipif_trace_disable)
6536 		th_trace_unref(ipif);
6537 }
6538 
6539 void
6540 ill_trace_ref(ill_t *ill)
6541 {
6542 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6543 
6544 	if (ill->ill_trace_disable)
6545 		return;
6546 
6547 	if (!th_trace_ref(ill, ill->ill_ipst)) {
6548 		ill->ill_trace_disable = B_TRUE;
6549 		ill_trace_cleanup(ill);
6550 	}
6551 }
6552 
6553 void
6554 ill_untrace_ref(ill_t *ill)
6555 {
6556 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6557 
6558 	if (!ill->ill_trace_disable)
6559 		th_trace_unref(ill);
6560 }
6561 
6562 /*
6563  * Called when ipif is unplumbed or when memory alloc fails.  Note that on
6564  * failure, ipif_trace_disable is set.
6565  */
6566 static void
6567 ipif_trace_cleanup(const ipif_t *ipif)
6568 {
6569 	th_trace_cleanup(ipif, ipif->ipif_trace_disable);
6570 }
6571 
6572 /*
6573  * Called when ill is unplumbed or when memory alloc fails.  Note that on
6574  * failure, ill_trace_disable is set.
6575  */
6576 static void
6577 ill_trace_cleanup(const ill_t *ill)
6578 {
6579 	th_trace_cleanup(ill, ill->ill_trace_disable);
6580 }
6581 #endif /* DEBUG */
6582 
6583 void
6584 ipif_refhold_locked(ipif_t *ipif)
6585 {
6586 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6587 	ipif->ipif_refcnt++;
6588 	IPIF_TRACE_REF(ipif);
6589 }
6590 
6591 void
6592 ipif_refhold(ipif_t *ipif)
6593 {
6594 	ill_t	*ill;
6595 
6596 	ill = ipif->ipif_ill;
6597 	mutex_enter(&ill->ill_lock);
6598 	ipif->ipif_refcnt++;
6599 	IPIF_TRACE_REF(ipif);
6600 	mutex_exit(&ill->ill_lock);
6601 }
6602 
6603 /*
6604  * Must not be called while holding any locks. Otherwise if this is
6605  * the last reference to be released there is a chance of recursive mutex
6606  * panic due to ipif_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
6607  * to restart an ioctl.
6608  */
6609 void
6610 ipif_refrele(ipif_t *ipif)
6611 {
6612 	ill_t	*ill;
6613 
6614 	ill = ipif->ipif_ill;
6615 
6616 	mutex_enter(&ill->ill_lock);
6617 	ASSERT(ipif->ipif_refcnt != 0);
6618 	ipif->ipif_refcnt--;
6619 	IPIF_UNTRACE_REF(ipif);
6620 	if (ipif->ipif_refcnt != 0) {
6621 		mutex_exit(&ill->ill_lock);
6622 		return;
6623 	}
6624 
6625 	/* Drops the ill_lock */
6626 	ipif_ill_refrele_tail(ill);
6627 }
6628 
6629 ipif_t *
6630 ipif_get_next_ipif(ipif_t *curr, ill_t *ill)
6631 {
6632 	ipif_t	*ipif;
6633 
6634 	mutex_enter(&ill->ill_lock);
6635 	for (ipif = (curr == NULL ? ill->ill_ipif : curr->ipif_next);
6636 	    ipif != NULL; ipif = ipif->ipif_next) {
6637 		if (!IPIF_CAN_LOOKUP(ipif))
6638 			continue;
6639 		ipif_refhold_locked(ipif);
6640 		mutex_exit(&ill->ill_lock);
6641 		return (ipif);
6642 	}
6643 	mutex_exit(&ill->ill_lock);
6644 	return (NULL);
6645 }
6646 
6647 /*
6648  * TODO: make this table extendible at run time
6649  * Return a pointer to the mac type info for 'mac_type'
6650  */
6651 static ip_m_t *
6652 ip_m_lookup(t_uscalar_t mac_type)
6653 {
6654 	ip_m_t	*ipm;
6655 
6656 	for (ipm = ip_m_tbl; ipm < A_END(ip_m_tbl); ipm++)
6657 		if (ipm->ip_m_mac_type == mac_type)
6658 			return (ipm);
6659 	return (NULL);
6660 }
6661 
6662 /*
6663  * ip_rt_add is called to add an IPv4 route to the forwarding table.
6664  * ipif_arg is passed in to associate it with the correct interface.
6665  * We may need to restart this operation if the ipif cannot be looked up
6666  * due to an exclusive operation that is currently in progress. The restart
6667  * entry point is specified by 'func'
6668  */
6669 int
6670 ip_rt_add(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
6671     ipaddr_t src_addr, int flags, ipif_t *ipif_arg, ire_t **ire_arg,
6672     boolean_t ioctl_msg, queue_t *q, mblk_t *mp, ipsq_func_t func,
6673     struct rtsa_s *sp, ip_stack_t *ipst)
6674 {
6675 	ire_t	*ire;
6676 	ire_t	*gw_ire = NULL;
6677 	ipif_t	*ipif = NULL;
6678 	boolean_t ipif_refheld = B_FALSE;
6679 	uint_t	type;
6680 	int	match_flags = MATCH_IRE_TYPE;
6681 	int	error;
6682 	tsol_gc_t *gc = NULL;
6683 	tsol_gcgrp_t *gcgrp = NULL;
6684 	boolean_t gcgrp_xtraref = B_FALSE;
6685 
6686 	ip1dbg(("ip_rt_add:"));
6687 
6688 	if (ire_arg != NULL)
6689 		*ire_arg = NULL;
6690 
6691 	/*
6692 	 * If this is the case of RTF_HOST being set, then we set the netmask
6693 	 * to all ones (regardless if one was supplied).
6694 	 */
6695 	if (flags & RTF_HOST)
6696 		mask = IP_HOST_MASK;
6697 
6698 	/*
6699 	 * Prevent routes with a zero gateway from being created (since
6700 	 * interfaces can currently be plumbed and brought up no assigned
6701 	 * address).
6702 	 */
6703 	if (gw_addr == 0)
6704 		return (ENETUNREACH);
6705 	/*
6706 	 * Get the ipif, if any, corresponding to the gw_addr
6707 	 */
6708 	ipif = ipif_lookup_interface(gw_addr, dst_addr, q, mp, func, &error,
6709 	    ipst);
6710 	if (ipif != NULL) {
6711 		if (IS_VNI(ipif->ipif_ill)) {
6712 			ipif_refrele(ipif);
6713 			return (EINVAL);
6714 		}
6715 		ipif_refheld = B_TRUE;
6716 	} else if (error == EINPROGRESS) {
6717 		ip1dbg(("ip_rt_add: null and EINPROGRESS"));
6718 		return (EINPROGRESS);
6719 	} else {
6720 		error = 0;
6721 	}
6722 
6723 	if (ipif != NULL) {
6724 		ip1dbg(("ip_rt_add: ipif_lookup_interface done ipif nonnull"));
6725 		ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6726 	} else {
6727 		ip1dbg(("ip_rt_add: ipif_lookup_interface done ipif is null"));
6728 	}
6729 
6730 	/*
6731 	 * GateD will attempt to create routes with a loopback interface
6732 	 * address as the gateway and with RTF_GATEWAY set.  We allow
6733 	 * these routes to be added, but create them as interface routes
6734 	 * since the gateway is an interface address.
6735 	 */
6736 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
6737 		flags &= ~RTF_GATEWAY;
6738 		if (gw_addr == INADDR_LOOPBACK && dst_addr == INADDR_LOOPBACK &&
6739 		    mask == IP_HOST_MASK) {
6740 			ire = ire_ctable_lookup(dst_addr, 0, IRE_LOOPBACK, ipif,
6741 			    ALL_ZONES, NULL, match_flags, ipst);
6742 			if (ire != NULL) {
6743 				ire_refrele(ire);
6744 				if (ipif_refheld)
6745 					ipif_refrele(ipif);
6746 				return (EEXIST);
6747 			}
6748 			ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x"
6749 			    "for 0x%x\n", (void *)ipif,
6750 			    ipif->ipif_ire_type,
6751 			    ntohl(ipif->ipif_lcl_addr)));
6752 			ire = ire_create(
6753 			    (uchar_t *)&dst_addr,	/* dest address */
6754 			    (uchar_t *)&mask,		/* mask */
6755 			    (uchar_t *)&ipif->ipif_src_addr,
6756 			    NULL,			/* no gateway */
6757 			    &ipif->ipif_mtu,
6758 			    NULL,
6759 			    ipif->ipif_rq,		/* recv-from queue */
6760 			    NULL,			/* no send-to queue */
6761 			    ipif->ipif_ire_type,	/* LOOPBACK */
6762 			    ipif,
6763 			    0,
6764 			    0,
6765 			    0,
6766 			    (ipif->ipif_flags & IPIF_PRIVATE) ?
6767 			    RTF_PRIVATE : 0,
6768 			    &ire_uinfo_null,
6769 			    NULL,
6770 			    NULL,
6771 			    ipst);
6772 
6773 			if (ire == NULL) {
6774 				if (ipif_refheld)
6775 					ipif_refrele(ipif);
6776 				return (ENOMEM);
6777 			}
6778 			error = ire_add(&ire, q, mp, func, B_FALSE);
6779 			if (error == 0)
6780 				goto save_ire;
6781 			if (ipif_refheld)
6782 				ipif_refrele(ipif);
6783 			return (error);
6784 
6785 		}
6786 	}
6787 
6788 	/*
6789 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
6790 	 * and the gateway address provided is one of the system's interface
6791 	 * addresses.  By using the routing socket interface and supplying an
6792 	 * RTA_IFP sockaddr with an interface index, an alternate method of
6793 	 * specifying an interface route to be created is available which uses
6794 	 * the interface index that specifies the outgoing interface rather than
6795 	 * the address of an outgoing interface (which may not be able to
6796 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
6797 	 * flag, routes can be specified which not only specify the next-hop to
6798 	 * be used when routing to a certain prefix, but also which outgoing
6799 	 * interface should be used.
6800 	 *
6801 	 * Previously, interfaces would have unique addresses assigned to them
6802 	 * and so the address assigned to a particular interface could be used
6803 	 * to identify a particular interface.  One exception to this was the
6804 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
6805 	 *
6806 	 * With the advent of IPv6 and its link-local addresses, this
6807 	 * restriction was relaxed and interfaces could share addresses between
6808 	 * themselves.  In fact, typically all of the link-local interfaces on
6809 	 * an IPv6 node or router will have the same link-local address.  In
6810 	 * order to differentiate between these interfaces, the use of an
6811 	 * interface index is necessary and this index can be carried inside a
6812 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
6813 	 * of using the interface index, however, is that all of the ipif's that
6814 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
6815 	 * cannot be used to differentiate between ipif's (or logical
6816 	 * interfaces) that belong to the same ill (physical interface).
6817 	 *
6818 	 * For example, in the following case involving IPv4 interfaces and
6819 	 * logical interfaces
6820 	 *
6821 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
6822 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0:1
6823 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0:2
6824 	 *
6825 	 * the ipif's corresponding to each of these interface routes can be
6826 	 * uniquely identified by the "gateway" (actually interface address).
6827 	 *
6828 	 * In this case involving multiple IPv6 default routes to a particular
6829 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
6830 	 * default route is of interest:
6831 	 *
6832 	 *	default		fe80::123:4567:89ab:cdef	U	if0
6833 	 *	default		fe80::123:4567:89ab:cdef	U	if1
6834 	 */
6835 
6836 	/* RTF_GATEWAY not set */
6837 	if (!(flags & RTF_GATEWAY)) {
6838 		queue_t	*stq;
6839 
6840 		if (sp != NULL) {
6841 			ip2dbg(("ip_rt_add: gateway security attributes "
6842 			    "cannot be set with interface route\n"));
6843 			if (ipif_refheld)
6844 				ipif_refrele(ipif);
6845 			return (EINVAL);
6846 		}
6847 
6848 		/*
6849 		 * As the interface index specified with the RTA_IFP sockaddr is
6850 		 * the same for all ipif's off of an ill, the matching logic
6851 		 * below uses MATCH_IRE_ILL if such an index was specified.
6852 		 * This means that routes sharing the same prefix when added
6853 		 * using a RTA_IFP sockaddr must have distinct interface
6854 		 * indices (namely, they must be on distinct ill's).
6855 		 *
6856 		 * On the other hand, since the gateway address will usually be
6857 		 * different for each ipif on the system, the matching logic
6858 		 * uses MATCH_IRE_IPIF in the case of a traditional interface
6859 		 * route.  This means that interface routes for the same prefix
6860 		 * can be created if they belong to distinct ipif's and if a
6861 		 * RTA_IFP sockaddr is not present.
6862 		 */
6863 		if (ipif_arg != NULL) {
6864 			if (ipif_refheld)  {
6865 				ipif_refrele(ipif);
6866 				ipif_refheld = B_FALSE;
6867 			}
6868 			ipif = ipif_arg;
6869 			match_flags |= MATCH_IRE_ILL;
6870 		} else {
6871 			/*
6872 			 * Check the ipif corresponding to the gw_addr
6873 			 */
6874 			if (ipif == NULL)
6875 				return (ENETUNREACH);
6876 			match_flags |= MATCH_IRE_IPIF;
6877 		}
6878 		ASSERT(ipif != NULL);
6879 
6880 		/*
6881 		 * We check for an existing entry at this point.
6882 		 *
6883 		 * Since a netmask isn't passed in via the ioctl interface
6884 		 * (SIOCADDRT), we don't check for a matching netmask in that
6885 		 * case.
6886 		 */
6887 		if (!ioctl_msg)
6888 			match_flags |= MATCH_IRE_MASK;
6889 		ire = ire_ftable_lookup(dst_addr, mask, 0, IRE_INTERFACE, ipif,
6890 		    NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
6891 		if (ire != NULL) {
6892 			ire_refrele(ire);
6893 			if (ipif_refheld)
6894 				ipif_refrele(ipif);
6895 			return (EEXIST);
6896 		}
6897 
6898 		stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
6899 		    ? ipif->ipif_rq : ipif->ipif_wq;
6900 
6901 		/*
6902 		 * Create a copy of the IRE_LOOPBACK,
6903 		 * IRE_IF_NORESOLVER or IRE_IF_RESOLVER with
6904 		 * the modified address and netmask.
6905 		 */
6906 		ire = ire_create(
6907 		    (uchar_t *)&dst_addr,
6908 		    (uint8_t *)&mask,
6909 		    (uint8_t *)&ipif->ipif_src_addr,
6910 		    NULL,
6911 		    &ipif->ipif_mtu,
6912 		    NULL,
6913 		    NULL,
6914 		    stq,
6915 		    ipif->ipif_net_type,
6916 		    ipif,
6917 		    0,
6918 		    0,
6919 		    0,
6920 		    flags,
6921 		    &ire_uinfo_null,
6922 		    NULL,
6923 		    NULL,
6924 		    ipst);
6925 		if (ire == NULL) {
6926 			if (ipif_refheld)
6927 				ipif_refrele(ipif);
6928 			return (ENOMEM);
6929 		}
6930 
6931 		/*
6932 		 * Some software (for example, GateD and Sun Cluster) attempts
6933 		 * to create (what amount to) IRE_PREFIX routes with the
6934 		 * loopback address as the gateway.  This is primarily done to
6935 		 * set up prefixes with the RTF_REJECT flag set (for example,
6936 		 * when generating aggregate routes.)
6937 		 *
6938 		 * If the IRE type (as defined by ipif->ipif_net_type) is
6939 		 * IRE_LOOPBACK, then we map the request into a
6940 		 * IRE_IF_NORESOLVER. We also OR in the RTF_BLACKHOLE flag as
6941 		 * these interface routes, by definition, can only be that.
6942 		 *
6943 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
6944 		 * routine, but rather using ire_create() directly.
6945 		 *
6946 		 */
6947 		if (ipif->ipif_net_type == IRE_LOOPBACK) {
6948 			ire->ire_type = IRE_IF_NORESOLVER;
6949 			ire->ire_flags |= RTF_BLACKHOLE;
6950 		}
6951 
6952 		error = ire_add(&ire, q, mp, func, B_FALSE);
6953 		if (error == 0)
6954 			goto save_ire;
6955 
6956 		/*
6957 		 * In the result of failure, ire_add() will have already
6958 		 * deleted the ire in question, so there is no need to
6959 		 * do that here.
6960 		 */
6961 		if (ipif_refheld)
6962 			ipif_refrele(ipif);
6963 		return (error);
6964 	}
6965 	if (ipif_refheld) {
6966 		ipif_refrele(ipif);
6967 		ipif_refheld = B_FALSE;
6968 	}
6969 
6970 	/*
6971 	 * Get an interface IRE for the specified gateway.
6972 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
6973 	 * gateway, it is currently unreachable and we fail the request
6974 	 * accordingly.
6975 	 */
6976 	ipif = ipif_arg;
6977 	if (ipif_arg != NULL)
6978 		match_flags |= MATCH_IRE_ILL;
6979 again:
6980 	gw_ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg, NULL,
6981 	    ALL_ZONES, 0, NULL, match_flags, ipst);
6982 	if (gw_ire == NULL) {
6983 		/*
6984 		 * With IPMP, we allow host routes to influence in.mpathd's
6985 		 * target selection.  However, if the test addresses are on
6986 		 * their own network, the above lookup will fail since the
6987 		 * underlying IRE_INTERFACEs are marked hidden.  So allow
6988 		 * hidden test IREs to be found and try again.
6989 		 */
6990 		if (!(match_flags & MATCH_IRE_MARK_TESTHIDDEN))  {
6991 			match_flags |= MATCH_IRE_MARK_TESTHIDDEN;
6992 			goto again;
6993 		}
6994 		return (ENETUNREACH);
6995 	}
6996 
6997 	/*
6998 	 * We create one of three types of IREs as a result of this request
6999 	 * based on the netmask.  A netmask of all ones (which is automatically
7000 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
7001 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
7002 	 * created.  Otherwise, an IRE_PREFIX route is created for the
7003 	 * destination prefix.
7004 	 */
7005 	if (mask == IP_HOST_MASK)
7006 		type = IRE_HOST;
7007 	else if (mask == 0)
7008 		type = IRE_DEFAULT;
7009 	else
7010 		type = IRE_PREFIX;
7011 
7012 	/* check for a duplicate entry */
7013 	ire = ire_ftable_lookup(dst_addr, mask, gw_addr, type, ipif_arg,
7014 	    NULL, ALL_ZONES, 0, NULL,
7015 	    match_flags | MATCH_IRE_MASK | MATCH_IRE_GW, ipst);
7016 	if (ire != NULL) {
7017 		ire_refrele(gw_ire);
7018 		ire_refrele(ire);
7019 		return (EEXIST);
7020 	}
7021 
7022 	/* Security attribute exists */
7023 	if (sp != NULL) {
7024 		tsol_gcgrp_addr_t ga;
7025 
7026 		/* find or create the gateway credentials group */
7027 		ga.ga_af = AF_INET;
7028 		IN6_IPADDR_TO_V4MAPPED(gw_addr, &ga.ga_addr);
7029 
7030 		/* we hold reference to it upon success */
7031 		gcgrp = gcgrp_lookup(&ga, B_TRUE);
7032 		if (gcgrp == NULL) {
7033 			ire_refrele(gw_ire);
7034 			return (ENOMEM);
7035 		}
7036 
7037 		/*
7038 		 * Create and add the security attribute to the group; a
7039 		 * reference to the group is made upon allocating a new
7040 		 * entry successfully.  If it finds an already-existing
7041 		 * entry for the security attribute in the group, it simply
7042 		 * returns it and no new reference is made to the group.
7043 		 */
7044 		gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
7045 		if (gc == NULL) {
7046 			/* release reference held by gcgrp_lookup */
7047 			GCGRP_REFRELE(gcgrp);
7048 			ire_refrele(gw_ire);
7049 			return (ENOMEM);
7050 		}
7051 	}
7052 
7053 	/* Create the IRE. */
7054 	ire = ire_create(
7055 	    (uchar_t *)&dst_addr,		/* dest address */
7056 	    (uchar_t *)&mask,			/* mask */
7057 	    /* src address assigned by the caller? */
7058 	    (uchar_t *)(((src_addr != INADDR_ANY) &&
7059 	    (flags & RTF_SETSRC)) ?  &src_addr : NULL),
7060 	    (uchar_t *)&gw_addr,		/* gateway address */
7061 	    &gw_ire->ire_max_frag,
7062 	    NULL,				/* no src nce */
7063 	    NULL,				/* no recv-from queue */
7064 	    NULL,				/* no send-to queue */
7065 	    (ushort_t)type,			/* IRE type */
7066 	    ipif_arg,
7067 	    0,
7068 	    0,
7069 	    0,
7070 	    flags,
7071 	    &gw_ire->ire_uinfo,			/* Inherit ULP info from gw */
7072 	    gc,					/* security attribute */
7073 	    NULL,
7074 	    ipst);
7075 
7076 	/*
7077 	 * The ire holds a reference to the 'gc' and the 'gc' holds a
7078 	 * reference to the 'gcgrp'. We can now release the extra reference
7079 	 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
7080 	 */
7081 	if (gcgrp_xtraref)
7082 		GCGRP_REFRELE(gcgrp);
7083 	if (ire == NULL) {
7084 		if (gc != NULL)
7085 			GC_REFRELE(gc);
7086 		ire_refrele(gw_ire);
7087 		return (ENOMEM);
7088 	}
7089 
7090 	/*
7091 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
7092 	 * SUN/OS socket stuff does but do we really want to allow 0.0.0.0?
7093 	 */
7094 
7095 	/* Add the new IRE. */
7096 	error = ire_add(&ire, q, mp, func, B_FALSE);
7097 	if (error != 0) {
7098 		/*
7099 		 * In the result of failure, ire_add() will have already
7100 		 * deleted the ire in question, so there is no need to
7101 		 * do that here.
7102 		 */
7103 		ire_refrele(gw_ire);
7104 		return (error);
7105 	}
7106 
7107 	if (flags & RTF_MULTIRT) {
7108 		/*
7109 		 * Invoke the CGTP (multirouting) filtering module
7110 		 * to add the dst address in the filtering database.
7111 		 * Replicated inbound packets coming from that address
7112 		 * will be filtered to discard the duplicates.
7113 		 * It is not necessary to call the CGTP filter hook
7114 		 * when the dst address is a broadcast or multicast,
7115 		 * because an IP source address cannot be a broadcast
7116 		 * or a multicast.
7117 		 */
7118 		ire_t *ire_dst = ire_ctable_lookup(ire->ire_addr, 0,
7119 		    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
7120 		if (ire_dst != NULL) {
7121 			ip_cgtp_bcast_add(ire, ire_dst, ipst);
7122 			ire_refrele(ire_dst);
7123 			goto save_ire;
7124 		}
7125 		if (ipst->ips_ip_cgtp_filter_ops != NULL &&
7126 		    !CLASSD(ire->ire_addr)) {
7127 			int res = ipst->ips_ip_cgtp_filter_ops->cfo_add_dest_v4(
7128 			    ipst->ips_netstack->netstack_stackid,
7129 			    ire->ire_addr,
7130 			    ire->ire_gateway_addr,
7131 			    ire->ire_src_addr,
7132 			    gw_ire->ire_src_addr);
7133 			if (res != 0) {
7134 				ire_refrele(gw_ire);
7135 				ire_delete(ire);
7136 				return (res);
7137 			}
7138 		}
7139 	}
7140 
7141 	/*
7142 	 * Now that the prefix IRE entry has been created, delete any
7143 	 * existing gateway IRE cache entries as well as any IRE caches
7144 	 * using the gateway, and force them to be created through
7145 	 * ip_newroute.
7146 	 */
7147 	if (gc != NULL) {
7148 		ASSERT(gcgrp != NULL);
7149 		ire_clookup_delete_cache_gw(gw_addr, ALL_ZONES, ipst);
7150 	}
7151 
7152 save_ire:
7153 	if (gw_ire != NULL) {
7154 		ire_refrele(gw_ire);
7155 	}
7156 	if (ipif != NULL) {
7157 		/*
7158 		 * Save enough information so that we can recreate the IRE if
7159 		 * the interface goes down and then up.  The metrics associated
7160 		 * with the route will be saved as well when rts_setmetrics() is
7161 		 * called after the IRE has been created.  In the case where
7162 		 * memory cannot be allocated, none of this information will be
7163 		 * saved.
7164 		 */
7165 		ipif_save_ire(ipif, ire);
7166 	}
7167 	if (ioctl_msg)
7168 		ip_rts_rtmsg(RTM_OLDADD, ire, 0, ipst);
7169 	if (ire_arg != NULL) {
7170 		/*
7171 		 * Store the ire that was successfully added into where ire_arg
7172 		 * points to so that callers don't have to look it up
7173 		 * themselves (but they are responsible for ire_refrele()ing
7174 		 * the ire when they are finished with it).
7175 		 */
7176 		*ire_arg = ire;
7177 	} else {
7178 		ire_refrele(ire);		/* Held in ire_add */
7179 	}
7180 	if (ipif_refheld)
7181 		ipif_refrele(ipif);
7182 	return (0);
7183 }
7184 
7185 /*
7186  * ip_rt_delete is called to delete an IPv4 route.
7187  * ipif_arg is passed in to associate it with the correct interface.
7188  * We may need to restart this operation if the ipif cannot be looked up
7189  * due to an exclusive operation that is currently in progress. The restart
7190  * entry point is specified by 'func'
7191  */
7192 /* ARGSUSED4 */
7193 int
7194 ip_rt_delete(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
7195     uint_t rtm_addrs, int flags, ipif_t *ipif_arg, boolean_t ioctl_msg,
7196     queue_t *q, mblk_t *mp, ipsq_func_t func, ip_stack_t *ipst)
7197 {
7198 	ire_t	*ire = NULL;
7199 	ipif_t	*ipif;
7200 	boolean_t ipif_refheld = B_FALSE;
7201 	uint_t	type;
7202 	uint_t	match_flags = MATCH_IRE_TYPE;
7203 	int	err = 0;
7204 
7205 	ip1dbg(("ip_rt_delete:"));
7206 	/*
7207 	 * If this is the case of RTF_HOST being set, then we set the netmask
7208 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
7209 	 */
7210 	if (flags & RTF_HOST) {
7211 		mask = IP_HOST_MASK;
7212 		match_flags |= MATCH_IRE_MASK;
7213 	} else if (rtm_addrs & RTA_NETMASK) {
7214 		match_flags |= MATCH_IRE_MASK;
7215 	}
7216 
7217 	/*
7218 	 * Note that RTF_GATEWAY is never set on a delete, therefore
7219 	 * we check if the gateway address is one of our interfaces first,
7220 	 * and fall back on RTF_GATEWAY routes.
7221 	 *
7222 	 * This makes it possible to delete an original
7223 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
7224 	 *
7225 	 * As the interface index specified with the RTA_IFP sockaddr is the
7226 	 * same for all ipif's off of an ill, the matching logic below uses
7227 	 * MATCH_IRE_ILL if such an index was specified.  This means a route
7228 	 * sharing the same prefix and interface index as the the route
7229 	 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr
7230 	 * is specified in the request.
7231 	 *
7232 	 * On the other hand, since the gateway address will usually be
7233 	 * different for each ipif on the system, the matching logic
7234 	 * uses MATCH_IRE_IPIF in the case of a traditional interface
7235 	 * route.  This means that interface routes for the same prefix can be
7236 	 * uniquely identified if they belong to distinct ipif's and if a
7237 	 * RTA_IFP sockaddr is not present.
7238 	 *
7239 	 * For more detail on specifying routes by gateway address and by
7240 	 * interface index, see the comments in ip_rt_add().
7241 	 */
7242 	ipif = ipif_lookup_interface(gw_addr, dst_addr, q, mp, func, &err,
7243 	    ipst);
7244 	if (ipif != NULL)
7245 		ipif_refheld = B_TRUE;
7246 	else if (err == EINPROGRESS)
7247 		return (err);
7248 	else
7249 		err = 0;
7250 	if (ipif != NULL) {
7251 		if (ipif_arg != NULL) {
7252 			if (ipif_refheld) {
7253 				ipif_refrele(ipif);
7254 				ipif_refheld = B_FALSE;
7255 			}
7256 			ipif = ipif_arg;
7257 			match_flags |= MATCH_IRE_ILL;
7258 		} else {
7259 			match_flags |= MATCH_IRE_IPIF;
7260 		}
7261 		if (ipif->ipif_ire_type == IRE_LOOPBACK) {
7262 			ire = ire_ctable_lookup(dst_addr, 0, IRE_LOOPBACK, ipif,
7263 			    ALL_ZONES, NULL, match_flags, ipst);
7264 		}
7265 		if (ire == NULL) {
7266 			ire = ire_ftable_lookup(dst_addr, mask, 0,
7267 			    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL,
7268 			    match_flags, ipst);
7269 		}
7270 	}
7271 
7272 	if (ire == NULL) {
7273 		/*
7274 		 * At this point, the gateway address is not one of our own
7275 		 * addresses or a matching interface route was not found.  We
7276 		 * set the IRE type to lookup based on whether
7277 		 * this is a host route, a default route or just a prefix.
7278 		 *
7279 		 * If an ipif_arg was passed in, then the lookup is based on an
7280 		 * interface index so MATCH_IRE_ILL is added to match_flags.
7281 		 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is
7282 		 * set as the route being looked up is not a traditional
7283 		 * interface route.
7284 		 */
7285 		match_flags &= ~MATCH_IRE_IPIF;
7286 		match_flags |= MATCH_IRE_GW;
7287 		if (ipif_arg != NULL)
7288 			match_flags |= MATCH_IRE_ILL;
7289 		if (mask == IP_HOST_MASK)
7290 			type = IRE_HOST;
7291 		else if (mask == 0)
7292 			type = IRE_DEFAULT;
7293 		else
7294 			type = IRE_PREFIX;
7295 		ire = ire_ftable_lookup(dst_addr, mask, gw_addr, type, ipif_arg,
7296 		    NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
7297 	}
7298 
7299 	if (ipif_refheld)
7300 		ipif_refrele(ipif);
7301 
7302 	/* ipif is not refheld anymore */
7303 	if (ire == NULL)
7304 		return (ESRCH);
7305 
7306 	if (ire->ire_flags & RTF_MULTIRT) {
7307 		/*
7308 		 * Invoke the CGTP (multirouting) filtering module
7309 		 * to remove the dst address from the filtering database.
7310 		 * Packets coming from that address will no longer be
7311 		 * filtered to remove duplicates.
7312 		 */
7313 		if (ipst->ips_ip_cgtp_filter_ops != NULL) {
7314 			err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v4(
7315 			    ipst->ips_netstack->netstack_stackid,
7316 			    ire->ire_addr, ire->ire_gateway_addr);
7317 		}
7318 		ip_cgtp_bcast_delete(ire, ipst);
7319 	}
7320 
7321 	ipif = ire->ire_ipif;
7322 	if (ipif != NULL)
7323 		ipif_remove_ire(ipif, ire);
7324 	if (ioctl_msg)
7325 		ip_rts_rtmsg(RTM_OLDDEL, ire, 0, ipst);
7326 	ire_delete(ire);
7327 	ire_refrele(ire);
7328 	return (err);
7329 }
7330 
7331 /*
7332  * ip_siocaddrt is called to complete processing of an SIOCADDRT IOCTL.
7333  */
7334 /* ARGSUSED */
7335 int
7336 ip_siocaddrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
7337     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
7338 {
7339 	ipaddr_t dst_addr;
7340 	ipaddr_t gw_addr;
7341 	ipaddr_t mask;
7342 	int error = 0;
7343 	mblk_t *mp1;
7344 	struct rtentry *rt;
7345 	ipif_t *ipif = NULL;
7346 	ip_stack_t	*ipst;
7347 
7348 	ASSERT(q->q_next == NULL);
7349 	ipst = CONNQ_TO_IPST(q);
7350 
7351 	ip1dbg(("ip_siocaddrt:"));
7352 	/* Existence of mp1 verified in ip_wput_nondata */
7353 	mp1 = mp->b_cont->b_cont;
7354 	rt = (struct rtentry *)mp1->b_rptr;
7355 
7356 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
7357 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
7358 
7359 	/*
7360 	 * If the RTF_HOST flag is on, this is a request to assign a gateway
7361 	 * to a particular host address.  In this case, we set the netmask to
7362 	 * all ones for the particular destination address.  Otherwise,
7363 	 * determine the netmask to be used based on dst_addr and the interfaces
7364 	 * in use.
7365 	 */
7366 	if (rt->rt_flags & RTF_HOST) {
7367 		mask = IP_HOST_MASK;
7368 	} else {
7369 		/*
7370 		 * Note that ip_subnet_mask returns a zero mask in the case of
7371 		 * default (an all-zeroes address).
7372 		 */
7373 		mask = ip_subnet_mask(dst_addr, &ipif, ipst);
7374 	}
7375 
7376 	error = ip_rt_add(dst_addr, mask, gw_addr, 0, rt->rt_flags, NULL, NULL,
7377 	    B_TRUE, q, mp, ip_process_ioctl, NULL, ipst);
7378 	if (ipif != NULL)
7379 		ipif_refrele(ipif);
7380 	return (error);
7381 }
7382 
7383 /*
7384  * ip_siocdelrt is called to complete processing of an SIOCDELRT IOCTL.
7385  */
7386 /* ARGSUSED */
7387 int
7388 ip_siocdelrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
7389     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
7390 {
7391 	ipaddr_t dst_addr;
7392 	ipaddr_t gw_addr;
7393 	ipaddr_t mask;
7394 	int error;
7395 	mblk_t *mp1;
7396 	struct rtentry *rt;
7397 	ipif_t *ipif = NULL;
7398 	ip_stack_t	*ipst;
7399 
7400 	ASSERT(q->q_next == NULL);
7401 	ipst = CONNQ_TO_IPST(q);
7402 
7403 	ip1dbg(("ip_siocdelrt:"));
7404 	/* Existence of mp1 verified in ip_wput_nondata */
7405 	mp1 = mp->b_cont->b_cont;
7406 	rt = (struct rtentry *)mp1->b_rptr;
7407 
7408 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
7409 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
7410 
7411 	/*
7412 	 * If the RTF_HOST flag is on, this is a request to delete a gateway
7413 	 * to a particular host address.  In this case, we set the netmask to
7414 	 * all ones for the particular destination address.  Otherwise,
7415 	 * determine the netmask to be used based on dst_addr and the interfaces
7416 	 * in use.
7417 	 */
7418 	if (rt->rt_flags & RTF_HOST) {
7419 		mask = IP_HOST_MASK;
7420 	} else {
7421 		/*
7422 		 * Note that ip_subnet_mask returns a zero mask in the case of
7423 		 * default (an all-zeroes address).
7424 		 */
7425 		mask = ip_subnet_mask(dst_addr, &ipif, ipst);
7426 	}
7427 
7428 	error = ip_rt_delete(dst_addr, mask, gw_addr,
7429 	    RTA_DST | RTA_GATEWAY | RTA_NETMASK, rt->rt_flags, NULL, B_TRUE, q,
7430 	    mp, ip_process_ioctl, ipst);
7431 	if (ipif != NULL)
7432 		ipif_refrele(ipif);
7433 	return (error);
7434 }
7435 
7436 /*
7437  * Enqueue the mp onto the ipsq, chained by b_next.
7438  * b_prev stores the function to be executed later, and b_queue the queue
7439  * where this mp originated.
7440  */
7441 void
7442 ipsq_enq(ipsq_t *ipsq, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
7443     ill_t *pending_ill)
7444 {
7445 	conn_t	*connp;
7446 	ipxop_t *ipx = ipsq->ipsq_xop;
7447 
7448 	ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
7449 	ASSERT(MUTEX_HELD(&ipx->ipx_lock));
7450 	ASSERT(func != NULL);
7451 
7452 	mp->b_queue = q;
7453 	mp->b_prev = (void *)func;
7454 	mp->b_next = NULL;
7455 
7456 	switch (type) {
7457 	case CUR_OP:
7458 		if (ipx->ipx_mptail != NULL) {
7459 			ASSERT(ipx->ipx_mphead != NULL);
7460 			ipx->ipx_mptail->b_next = mp;
7461 		} else {
7462 			ASSERT(ipx->ipx_mphead == NULL);
7463 			ipx->ipx_mphead = mp;
7464 		}
7465 		ipx->ipx_mptail = mp;
7466 		break;
7467 
7468 	case NEW_OP:
7469 		if (ipsq->ipsq_xopq_mptail != NULL) {
7470 			ASSERT(ipsq->ipsq_xopq_mphead != NULL);
7471 			ipsq->ipsq_xopq_mptail->b_next = mp;
7472 		} else {
7473 			ASSERT(ipsq->ipsq_xopq_mphead == NULL);
7474 			ipsq->ipsq_xopq_mphead = mp;
7475 		}
7476 		ipsq->ipsq_xopq_mptail = mp;
7477 		ipx->ipx_ipsq_queued = B_TRUE;
7478 		break;
7479 
7480 	case SWITCH_OP:
7481 		ASSERT(ipsq->ipsq_swxop != NULL);
7482 		/* only one switch operation is currently allowed */
7483 		ASSERT(ipsq->ipsq_switch_mp == NULL);
7484 		ipsq->ipsq_switch_mp = mp;
7485 		ipx->ipx_ipsq_queued = B_TRUE;
7486 		break;
7487 	default:
7488 		cmn_err(CE_PANIC, "ipsq_enq %d type \n", type);
7489 	}
7490 
7491 	if (CONN_Q(q) && pending_ill != NULL) {
7492 		connp = Q_TO_CONN(q);
7493 		ASSERT(MUTEX_HELD(&connp->conn_lock));
7494 		connp->conn_oper_pending_ill = pending_ill;
7495 	}
7496 }
7497 
7498 /*
7499  * Dequeue the next message that requested exclusive access to this IPSQ's
7500  * xop.  Specifically:
7501  *
7502  *  1. If we're still processing the current operation on `ipsq', then
7503  *     dequeue the next message for the operation (from ipx_mphead), or
7504  *     return NULL if there are no queued messages for the operation.
7505  *     These messages are queued via CUR_OP to qwriter_ip() and friends.
7506  *
7507  *  2. If the current operation on `ipsq' has completed (ipx_current_ipif is
7508  *     not set) see if the ipsq has requested an xop switch.  If so, switch
7509  *     `ipsq' to a different xop.  Xop switches only happen when joining or
7510  *     leaving IPMP groups and require a careful dance -- see the comments
7511  *     in-line below for details.  If we're leaving a group xop or if we're
7512  *     joining a group xop and become writer on it, then we proceed to (3).
7513  *     Otherwise, we return NULL and exit the xop.
7514  *
7515  *  3. For each IPSQ in the xop, return any switch operation stored on
7516  *     ipsq_switch_mp (set via SWITCH_OP); these must be processed before
7517  *     any other messages queued on the IPSQ.  Otherwise, dequeue the next
7518  *     exclusive operation (queued via NEW_OP) stored on ipsq_xopq_mphead.
7519  *     Note that if the phyint tied to `ipsq' is not using IPMP there will
7520  *     only be one IPSQ in the xop.  Otherwise, there will be one IPSQ for
7521  *     each phyint in the group, including the IPMP meta-interface phyint.
7522  */
7523 static mblk_t *
7524 ipsq_dq(ipsq_t *ipsq)
7525 {
7526 	ill_t	*illv4, *illv6;
7527 	mblk_t	*mp;
7528 	ipsq_t	*xopipsq;
7529 	ipsq_t	*leftipsq = NULL;
7530 	ipxop_t *ipx;
7531 	phyint_t *phyi = ipsq->ipsq_phyint;
7532 	ip_stack_t *ipst = ipsq->ipsq_ipst;
7533 	boolean_t emptied = B_FALSE;
7534 
7535 	/*
7536 	 * Grab all the locks we need in the defined order (ill_g_lock ->
7537 	 * ipsq_lock -> ipx_lock); ill_g_lock is needed to use ipsq_next.
7538 	 */
7539 	rw_enter(&ipst->ips_ill_g_lock,
7540 	    ipsq->ipsq_swxop != NULL ? RW_WRITER : RW_READER);
7541 	mutex_enter(&ipsq->ipsq_lock);
7542 	ipx = ipsq->ipsq_xop;
7543 	mutex_enter(&ipx->ipx_lock);
7544 
7545 	/*
7546 	 * Dequeue the next message associated with the current exclusive
7547 	 * operation, if any.
7548 	 */
7549 	if ((mp = ipx->ipx_mphead) != NULL) {
7550 		ipx->ipx_mphead = mp->b_next;
7551 		if (ipx->ipx_mphead == NULL)
7552 			ipx->ipx_mptail = NULL;
7553 		mp->b_next = (void *)ipsq;
7554 		goto out;
7555 	}
7556 
7557 	if (ipx->ipx_current_ipif != NULL)
7558 		goto empty;
7559 
7560 	if (ipsq->ipsq_swxop != NULL) {
7561 		/*
7562 		 * The exclusive operation that is now being completed has
7563 		 * requested a switch to a different xop.  This happens
7564 		 * when an interface joins or leaves an IPMP group.  Joins
7565 		 * happen through SIOCSLIFGROUPNAME (ip_sioctl_groupname()).
7566 		 * Leaves happen via SIOCSLIFGROUPNAME, interface unplumb
7567 		 * (phyint_free()), or interface plumb for an ill type
7568 		 * not in the IPMP group (ip_rput_dlpi_writer()).
7569 		 *
7570 		 * Xop switches are not allowed on the IPMP meta-interface.
7571 		 */
7572 		ASSERT(phyi == NULL || !(phyi->phyint_flags & PHYI_IPMP));
7573 		ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
7574 		DTRACE_PROBE1(ipsq__switch, (ipsq_t *), ipsq);
7575 
7576 		if (ipsq->ipsq_swxop == &ipsq->ipsq_ownxop) {
7577 			/*
7578 			 * We're switching back to our own xop, so we have two
7579 			 * xop's to drain/exit: our own, and the group xop
7580 			 * that we are leaving.
7581 			 *
7582 			 * First, pull ourselves out of the group ipsq list.
7583 			 * This is safe since we're writer on ill_g_lock.
7584 			 */
7585 			ASSERT(ipsq->ipsq_xop != &ipsq->ipsq_ownxop);
7586 
7587 			xopipsq = ipx->ipx_ipsq;
7588 			while (xopipsq->ipsq_next != ipsq)
7589 				xopipsq = xopipsq->ipsq_next;
7590 
7591 			xopipsq->ipsq_next = ipsq->ipsq_next;
7592 			ipsq->ipsq_next = ipsq;
7593 			ipsq->ipsq_xop = ipsq->ipsq_swxop;
7594 			ipsq->ipsq_swxop = NULL;
7595 
7596 			/*
7597 			 * Second, prepare to exit the group xop.  The actual
7598 			 * ipsq_exit() is done at the end of this function
7599 			 * since we cannot hold any locks across ipsq_exit().
7600 			 * Note that although we drop the group's ipx_lock, no
7601 			 * threads can proceed since we're still ipx_writer.
7602 			 */
7603 			leftipsq = xopipsq;
7604 			mutex_exit(&ipx->ipx_lock);
7605 
7606 			/*
7607 			 * Third, set ipx to point to our own xop (which was
7608 			 * inactive and therefore can be entered).
7609 			 */
7610 			ipx = ipsq->ipsq_xop;
7611 			mutex_enter(&ipx->ipx_lock);
7612 			ASSERT(ipx->ipx_writer == NULL);
7613 			ASSERT(ipx->ipx_current_ipif == NULL);
7614 		} else {
7615 			/*
7616 			 * We're switching from our own xop to a group xop.
7617 			 * The requestor of the switch must ensure that the
7618 			 * group xop cannot go away (e.g. by ensuring the
7619 			 * phyint associated with the xop cannot go away).
7620 			 *
7621 			 * If we can become writer on our new xop, then we'll
7622 			 * do the drain.  Otherwise, the current writer of our
7623 			 * new xop will do the drain when it exits.
7624 			 *
7625 			 * First, splice ourselves into the group IPSQ list.
7626 			 * This is safe since we're writer on ill_g_lock.
7627 			 */
7628 			ASSERT(ipsq->ipsq_xop == &ipsq->ipsq_ownxop);
7629 
7630 			xopipsq = ipsq->ipsq_swxop->ipx_ipsq;
7631 			while (xopipsq->ipsq_next != ipsq->ipsq_swxop->ipx_ipsq)
7632 				xopipsq = xopipsq->ipsq_next;
7633 
7634 			xopipsq->ipsq_next = ipsq;
7635 			ipsq->ipsq_next = ipsq->ipsq_swxop->ipx_ipsq;
7636 			ipsq->ipsq_xop = ipsq->ipsq_swxop;
7637 			ipsq->ipsq_swxop = NULL;
7638 
7639 			/*
7640 			 * Second, exit our own xop, since it's now unused.
7641 			 * This is safe since we've got the only reference.
7642 			 */
7643 			ASSERT(ipx->ipx_writer == curthread);
7644 			ipx->ipx_writer = NULL;
7645 			VERIFY(--ipx->ipx_reentry_cnt == 0);
7646 			ipx->ipx_ipsq_queued = B_FALSE;
7647 			mutex_exit(&ipx->ipx_lock);
7648 
7649 			/*
7650 			 * Third, set ipx to point to our new xop, and check
7651 			 * if we can become writer on it.  If we cannot, then
7652 			 * the current writer will drain the IPSQ group when
7653 			 * it exits.  Our ipsq_xop is guaranteed to be stable
7654 			 * because we're still holding ipsq_lock.
7655 			 */
7656 			ipx = ipsq->ipsq_xop;
7657 			mutex_enter(&ipx->ipx_lock);
7658 			if (ipx->ipx_writer != NULL ||
7659 			    ipx->ipx_current_ipif != NULL) {
7660 				goto out;
7661 			}
7662 		}
7663 
7664 		/*
7665 		 * Fourth, become writer on our new ipx before we continue
7666 		 * with the drain.  Note that we never dropped ipsq_lock
7667 		 * above, so no other thread could've raced with us to
7668 		 * become writer first.  Also, we're holding ipx_lock, so
7669 		 * no other thread can examine the ipx right now.
7670 		 */
7671 		ASSERT(ipx->ipx_current_ipif == NULL);
7672 		ASSERT(ipx->ipx_mphead == NULL && ipx->ipx_mptail == NULL);
7673 		VERIFY(ipx->ipx_reentry_cnt++ == 0);
7674 		ipx->ipx_writer = curthread;
7675 		ipx->ipx_forced = B_FALSE;
7676 #ifdef DEBUG
7677 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
7678 #endif
7679 	}
7680 
7681 	xopipsq = ipsq;
7682 	do {
7683 		/*
7684 		 * So that other operations operate on a consistent and
7685 		 * complete phyint, a switch message on an IPSQ must be
7686 		 * handled prior to any other operations on that IPSQ.
7687 		 */
7688 		if ((mp = xopipsq->ipsq_switch_mp) != NULL) {
7689 			xopipsq->ipsq_switch_mp = NULL;
7690 			ASSERT(mp->b_next == NULL);
7691 			mp->b_next = (void *)xopipsq;
7692 			goto out;
7693 		}
7694 
7695 		if ((mp = xopipsq->ipsq_xopq_mphead) != NULL) {
7696 			xopipsq->ipsq_xopq_mphead = mp->b_next;
7697 			if (xopipsq->ipsq_xopq_mphead == NULL)
7698 				xopipsq->ipsq_xopq_mptail = NULL;
7699 			mp->b_next = (void *)xopipsq;
7700 			goto out;
7701 		}
7702 	} while ((xopipsq = xopipsq->ipsq_next) != ipsq);
7703 empty:
7704 	/*
7705 	 * There are no messages.  Further, we are holding ipx_lock, hence no
7706 	 * new messages can end up on any IPSQ in the xop.
7707 	 */
7708 	ipx->ipx_writer = NULL;
7709 	ipx->ipx_forced = B_FALSE;
7710 	VERIFY(--ipx->ipx_reentry_cnt == 0);
7711 	ipx->ipx_ipsq_queued = B_FALSE;
7712 	emptied = B_TRUE;
7713 #ifdef	DEBUG
7714 	ipx->ipx_depth = 0;
7715 #endif
7716 out:
7717 	mutex_exit(&ipx->ipx_lock);
7718 	mutex_exit(&ipsq->ipsq_lock);
7719 
7720 	/*
7721 	 * If we completely emptied the xop, then wake up any threads waiting
7722 	 * to enter any of the IPSQ's associated with it.
7723 	 */
7724 	if (emptied) {
7725 		xopipsq = ipsq;
7726 		do {
7727 			if ((phyi = xopipsq->ipsq_phyint) == NULL)
7728 				continue;
7729 
7730 			illv4 = phyi->phyint_illv4;
7731 			illv6 = phyi->phyint_illv6;
7732 
7733 			GRAB_ILL_LOCKS(illv4, illv6);
7734 			if (illv4 != NULL)
7735 				cv_broadcast(&illv4->ill_cv);
7736 			if (illv6 != NULL)
7737 				cv_broadcast(&illv6->ill_cv);
7738 			RELEASE_ILL_LOCKS(illv4, illv6);
7739 		} while ((xopipsq = xopipsq->ipsq_next) != ipsq);
7740 	}
7741 	rw_exit(&ipst->ips_ill_g_lock);
7742 
7743 	/*
7744 	 * Now that all locks are dropped, exit the IPSQ we left.
7745 	 */
7746 	if (leftipsq != NULL)
7747 		ipsq_exit(leftipsq);
7748 
7749 	return (mp);
7750 }
7751 
7752 /*
7753  * Enter the ipsq corresponding to ill, by waiting synchronously till
7754  * we can enter the ipsq exclusively. Unless 'force' is used, the ipsq
7755  * will have to drain completely before ipsq_enter returns success.
7756  * ipx_current_ipif will be set if some exclusive op is in progress,
7757  * and the ipsq_exit logic will start the next enqueued op after
7758  * completion of the current op. If 'force' is used, we don't wait
7759  * for the enqueued ops. This is needed when a conn_close wants to
7760  * enter the ipsq and abort an ioctl that is somehow stuck. Unplumb
7761  * of an ill can also use this option. But we dont' use it currently.
7762  */
7763 #define	ENTER_SQ_WAIT_TICKS 100
7764 boolean_t
7765 ipsq_enter(ill_t *ill, boolean_t force, int type)
7766 {
7767 	ipsq_t	*ipsq;
7768 	ipxop_t *ipx;
7769 	boolean_t waited_enough = B_FALSE;
7770 
7771 	/*
7772 	 * Note that the relationship between ill and ipsq is fixed as long as
7773 	 * the ill is not ILL_CONDEMNED.  Holding ipsq_lock ensures the
7774 	 * relationship between the IPSQ and xop cannot change.  However,
7775 	 * since we cannot hold ipsq_lock across the cv_wait(), it may change
7776 	 * while we're waiting.  We wait on ill_cv and rely on ipsq_exit()
7777 	 * waking up all ills in the xop when it becomes available.
7778 	 */
7779 	mutex_enter(&ill->ill_lock);
7780 	for (;;) {
7781 		if (ill->ill_state_flags & ILL_CONDEMNED) {
7782 			mutex_exit(&ill->ill_lock);
7783 			return (B_FALSE);
7784 		}
7785 
7786 		ipsq = ill->ill_phyint->phyint_ipsq;
7787 		mutex_enter(&ipsq->ipsq_lock);
7788 		ipx = ipsq->ipsq_xop;
7789 		mutex_enter(&ipx->ipx_lock);
7790 
7791 		if (ipx->ipx_writer == NULL && (type == CUR_OP ||
7792 		    ipx->ipx_current_ipif == NULL || waited_enough))
7793 			break;
7794 
7795 		if (!force || ipx->ipx_writer != NULL) {
7796 			mutex_exit(&ipx->ipx_lock);
7797 			mutex_exit(&ipsq->ipsq_lock);
7798 			cv_wait(&ill->ill_cv, &ill->ill_lock);
7799 		} else {
7800 			mutex_exit(&ipx->ipx_lock);
7801 			mutex_exit(&ipsq->ipsq_lock);
7802 			(void) cv_timedwait(&ill->ill_cv,
7803 			    &ill->ill_lock, lbolt + ENTER_SQ_WAIT_TICKS);
7804 			waited_enough = B_TRUE;
7805 		}
7806 	}
7807 
7808 	ASSERT(ipx->ipx_mphead == NULL && ipx->ipx_mptail == NULL);
7809 	ASSERT(ipx->ipx_reentry_cnt == 0);
7810 	ipx->ipx_writer = curthread;
7811 	ipx->ipx_forced = (ipx->ipx_current_ipif != NULL);
7812 	ipx->ipx_reentry_cnt++;
7813 #ifdef DEBUG
7814 	ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
7815 #endif
7816 	mutex_exit(&ipx->ipx_lock);
7817 	mutex_exit(&ipsq->ipsq_lock);
7818 	mutex_exit(&ill->ill_lock);
7819 	return (B_TRUE);
7820 }
7821 
7822 boolean_t
7823 ill_perim_enter(ill_t *ill)
7824 {
7825 	return (ipsq_enter(ill, B_FALSE, CUR_OP));
7826 }
7827 
7828 void
7829 ill_perim_exit(ill_t *ill)
7830 {
7831 	ipsq_exit(ill->ill_phyint->phyint_ipsq);
7832 }
7833 
7834 /*
7835  * The ipsq_t (ipsq) is the synchronization data structure used to serialize
7836  * certain critical operations like plumbing (i.e. most set ioctls), multicast
7837  * joins, igmp/mld timers, etc.  There is one ipsq per phyint. The ipsq
7838  * serializes exclusive ioctls issued by applications on a per ipsq basis in
7839  * ipsq_xopq_mphead. It also protects against multiple threads executing in
7840  * the ipsq. Responses from the driver pertain to the current ioctl (say a
7841  * DL_BIND_ACK in response to a DL_BIND_REQ initiated as part of bringing
7842  * up the interface) and are enqueued in ipx_mphead.
7843  *
7844  * If a thread does not want to reenter the ipsq when it is already writer,
7845  * it must make sure that the specified reentry point to be called later
7846  * when the ipsq is empty, nor any code path starting from the specified reentry
7847  * point must never ever try to enter the ipsq again. Otherwise it can lead
7848  * to an infinite loop. The reentry point ip_rput_dlpi_writer is an example.
7849  * When the thread that is currently exclusive finishes, it (ipsq_exit)
7850  * dequeues the requests waiting to become exclusive in ipx_mphead and calls
7851  * the reentry point. When the list at ipx_mphead becomes empty ipsq_exit
7852  * proceeds to dequeue the next ioctl in ipsq_xopq_mphead and start the next
7853  * ioctl if the current ioctl has completed. If the current ioctl is still
7854  * in progress it simply returns. The current ioctl could be waiting for
7855  * a response from another module (arp or the driver or could be waiting for
7856  * the ipif/ill/ire refcnts to drop to zero. In such a case the ipx_pending_mp
7857  * and ipx_pending_ipif are set. ipx_current_ipif is set throughout the
7858  * execution of the ioctl and ipsq_exit does not start the next ioctl unless
7859  * ipx_current_ipif is NULL which happens only once the ioctl is complete and
7860  * all associated DLPI operations have completed.
7861  */
7862 
7863 /*
7864  * Try to enter the IPSQ corresponding to `ipif' or `ill' exclusively (`ipif'
7865  * and `ill' cannot both be specified).  Returns a pointer to the entered IPSQ
7866  * on success, or NULL on failure.  The caller ensures ipif/ill is valid by
7867  * refholding it as necessary.  If the IPSQ cannot be entered and `func' is
7868  * non-NULL, then `func' will be called back with `q' and `mp' once the IPSQ
7869  * can be entered.  If `func' is NULL, then `q' and `mp' are ignored.
7870  */
7871 ipsq_t *
7872 ipsq_try_enter(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
7873     ipsq_func_t func, int type, boolean_t reentry_ok)
7874 {
7875 	ipsq_t	*ipsq;
7876 	ipxop_t	*ipx;
7877 
7878 	/* Only 1 of ipif or ill can be specified */
7879 	ASSERT((ipif != NULL) ^ (ill != NULL));
7880 	if (ipif != NULL)
7881 		ill = ipif->ipif_ill;
7882 
7883 	/*
7884 	 * lock ordering: conn_lock -> ill_lock -> ipsq_lock -> ipx_lock.
7885 	 * ipx of an ipsq can't change when ipsq_lock is held.
7886 	 */
7887 	GRAB_CONN_LOCK(q);
7888 	mutex_enter(&ill->ill_lock);
7889 	ipsq = ill->ill_phyint->phyint_ipsq;
7890 	mutex_enter(&ipsq->ipsq_lock);
7891 	ipx = ipsq->ipsq_xop;
7892 	mutex_enter(&ipx->ipx_lock);
7893 
7894 	/*
7895 	 * 1. Enter the ipsq if we are already writer and reentry is ok.
7896 	 *    (Note: If the caller does not specify reentry_ok then neither
7897 	 *    'func' nor any of its callees must ever attempt to enter the ipsq
7898 	 *    again. Otherwise it can lead to an infinite loop
7899 	 * 2. Enter the ipsq if there is no current writer and this attempted
7900 	 *    entry is part of the current operation
7901 	 * 3. Enter the ipsq if there is no current writer and this is a new
7902 	 *    operation and the operation queue is empty and there is no
7903 	 *    operation currently in progress
7904 	 */
7905 	if ((ipx->ipx_writer == curthread && reentry_ok) ||
7906 	    (ipx->ipx_writer == NULL && (type == CUR_OP || (type == NEW_OP &&
7907 	    !ipx->ipx_ipsq_queued && ipx->ipx_current_ipif == NULL)))) {
7908 		/* Success. */
7909 		ipx->ipx_reentry_cnt++;
7910 		ipx->ipx_writer = curthread;
7911 		ipx->ipx_forced = B_FALSE;
7912 		mutex_exit(&ipx->ipx_lock);
7913 		mutex_exit(&ipsq->ipsq_lock);
7914 		mutex_exit(&ill->ill_lock);
7915 		RELEASE_CONN_LOCK(q);
7916 #ifdef DEBUG
7917 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
7918 #endif
7919 		return (ipsq);
7920 	}
7921 
7922 	if (func != NULL)
7923 		ipsq_enq(ipsq, q, mp, func, type, ill);
7924 
7925 	mutex_exit(&ipx->ipx_lock);
7926 	mutex_exit(&ipsq->ipsq_lock);
7927 	mutex_exit(&ill->ill_lock);
7928 	RELEASE_CONN_LOCK(q);
7929 	return (NULL);
7930 }
7931 
7932 /*
7933  * Try to enter the IPSQ corresponding to `ill' as writer.  The caller ensures
7934  * ill is valid by refholding it if necessary; we will refrele.  If the IPSQ
7935  * cannot be entered, the mp is queued for completion.
7936  */
7937 void
7938 qwriter_ip(ill_t *ill, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
7939     boolean_t reentry_ok)
7940 {
7941 	ipsq_t	*ipsq;
7942 
7943 	ipsq = ipsq_try_enter(NULL, ill, q, mp, func, type, reentry_ok);
7944 
7945 	/*
7946 	 * Drop the caller's refhold on the ill.  This is safe since we either
7947 	 * entered the IPSQ (and thus are exclusive), or failed to enter the
7948 	 * IPSQ, in which case we return without accessing ill anymore.  This
7949 	 * is needed because func needs to see the correct refcount.
7950 	 * e.g. removeif can work only then.
7951 	 */
7952 	ill_refrele(ill);
7953 	if (ipsq != NULL) {
7954 		(*func)(ipsq, q, mp, NULL);
7955 		ipsq_exit(ipsq);
7956 	}
7957 }
7958 
7959 /*
7960  * Exit the specified IPSQ.  If this is the final exit on it then drain it
7961  * prior to exiting.  Caller must be writer on the specified IPSQ.
7962  */
7963 void
7964 ipsq_exit(ipsq_t *ipsq)
7965 {
7966 	mblk_t *mp;
7967 	ipsq_t *mp_ipsq;
7968 	queue_t	*q;
7969 	phyint_t *phyi;
7970 	ipsq_func_t func;
7971 
7972 	ASSERT(IAM_WRITER_IPSQ(ipsq));
7973 
7974 	ASSERT(ipsq->ipsq_xop->ipx_reentry_cnt >= 1);
7975 	if (ipsq->ipsq_xop->ipx_reentry_cnt != 1) {
7976 		ipsq->ipsq_xop->ipx_reentry_cnt--;
7977 		return;
7978 	}
7979 
7980 	for (;;) {
7981 		phyi = ipsq->ipsq_phyint;
7982 		mp = ipsq_dq(ipsq);
7983 		mp_ipsq = (mp == NULL) ? NULL : (ipsq_t *)mp->b_next;
7984 
7985 		/*
7986 		 * If we've changed to a new IPSQ, and the phyint associated
7987 		 * with the old one has gone away, free the old IPSQ.  Note
7988 		 * that this cannot happen while the IPSQ is in a group.
7989 		 */
7990 		if (mp_ipsq != ipsq && phyi == NULL) {
7991 			ASSERT(ipsq->ipsq_next == ipsq);
7992 			ASSERT(ipsq->ipsq_xop == &ipsq->ipsq_ownxop);
7993 			ipsq_delete(ipsq);
7994 		}
7995 
7996 		if (mp == NULL)
7997 			break;
7998 
7999 		q = mp->b_queue;
8000 		func = (ipsq_func_t)mp->b_prev;
8001 		ipsq = mp_ipsq;
8002 		mp->b_next = mp->b_prev = NULL;
8003 		mp->b_queue = NULL;
8004 
8005 		/*
8006 		 * If 'q' is an conn queue, it is valid, since we did a
8007 		 * a refhold on the conn at the start of the ioctl.
8008 		 * If 'q' is an ill queue, it is valid, since close of an
8009 		 * ill will clean up its IPSQ.
8010 		 */
8011 		(*func)(ipsq, q, mp, NULL);
8012 	}
8013 }
8014 
8015 /*
8016  * Start the current exclusive operation on `ipsq'; associate it with `ipif'
8017  * and `ioccmd'.
8018  */
8019 void
8020 ipsq_current_start(ipsq_t *ipsq, ipif_t *ipif, int ioccmd)
8021 {
8022 	ipxop_t *ipx = ipsq->ipsq_xop;
8023 
8024 	ASSERT(IAM_WRITER_IPSQ(ipsq));
8025 	ASSERT(ipx->ipx_current_ipif == NULL);
8026 	ASSERT(ipx->ipx_current_ioctl == 0);
8027 
8028 	ipx->ipx_current_done = B_FALSE;
8029 	ipx->ipx_current_ioctl = ioccmd;
8030 	mutex_enter(&ipx->ipx_lock);
8031 	ipx->ipx_current_ipif = ipif;
8032 	mutex_exit(&ipx->ipx_lock);
8033 }
8034 
8035 /*
8036  * Finish the current exclusive operation on `ipsq'.  Usually, this will allow
8037  * the next exclusive operation to begin once we ipsq_exit().  However, if
8038  * pending DLPI operations remain, then we will wait for the queue to drain
8039  * before allowing the next exclusive operation to begin.  This ensures that
8040  * DLPI operations from one exclusive operation are never improperly processed
8041  * as part of a subsequent exclusive operation.
8042  */
8043 void
8044 ipsq_current_finish(ipsq_t *ipsq)
8045 {
8046 	ipxop_t	*ipx = ipsq->ipsq_xop;
8047 	t_uscalar_t dlpi_pending = DL_PRIM_INVAL;
8048 	ipif_t	*ipif = ipx->ipx_current_ipif;
8049 
8050 	ASSERT(IAM_WRITER_IPSQ(ipsq));
8051 
8052 	/*
8053 	 * For SIOCLIFREMOVEIF, the ipif has been already been blown away
8054 	 * (but in that case, IPIF_CHANGING will already be clear and no
8055 	 * pending DLPI messages can remain).
8056 	 */
8057 	if (ipx->ipx_current_ioctl != SIOCLIFREMOVEIF) {
8058 		ill_t *ill = ipif->ipif_ill;
8059 
8060 		mutex_enter(&ill->ill_lock);
8061 		dlpi_pending = ill->ill_dlpi_pending;
8062 		ipif->ipif_state_flags &= ~IPIF_CHANGING;
8063 		mutex_exit(&ill->ill_lock);
8064 	}
8065 
8066 	ASSERT(!ipx->ipx_current_done);
8067 	ipx->ipx_current_done = B_TRUE;
8068 	ipx->ipx_current_ioctl = 0;
8069 	if (dlpi_pending == DL_PRIM_INVAL) {
8070 		mutex_enter(&ipx->ipx_lock);
8071 		ipx->ipx_current_ipif = NULL;
8072 		mutex_exit(&ipx->ipx_lock);
8073 	}
8074 }
8075 
8076 /*
8077  * The ill is closing. Flush all messages on the ipsq that originated
8078  * from this ill. Usually there wont' be any messages on the ipsq_xopq_mphead
8079  * for this ill since ipsq_enter could not have entered until then.
8080  * New messages can't be queued since the CONDEMNED flag is set.
8081  */
8082 static void
8083 ipsq_flush(ill_t *ill)
8084 {
8085 	queue_t	*q;
8086 	mblk_t	*prev;
8087 	mblk_t	*mp;
8088 	mblk_t	*mp_next;
8089 	ipxop_t	*ipx = ill->ill_phyint->phyint_ipsq->ipsq_xop;
8090 
8091 	ASSERT(IAM_WRITER_ILL(ill));
8092 
8093 	/*
8094 	 * Flush any messages sent up by the driver.
8095 	 */
8096 	mutex_enter(&ipx->ipx_lock);
8097 	for (prev = NULL, mp = ipx->ipx_mphead; mp != NULL; mp = mp_next) {
8098 		mp_next = mp->b_next;
8099 		q = mp->b_queue;
8100 		if (q == ill->ill_rq || q == ill->ill_wq) {
8101 			/* dequeue mp */
8102 			if (prev == NULL)
8103 				ipx->ipx_mphead = mp->b_next;
8104 			else
8105 				prev->b_next = mp->b_next;
8106 			if (ipx->ipx_mptail == mp) {
8107 				ASSERT(mp_next == NULL);
8108 				ipx->ipx_mptail = prev;
8109 			}
8110 			inet_freemsg(mp);
8111 		} else {
8112 			prev = mp;
8113 		}
8114 	}
8115 	mutex_exit(&ipx->ipx_lock);
8116 	(void) ipsq_pending_mp_cleanup(ill, NULL);
8117 	ipsq_xopq_mp_cleanup(ill, NULL);
8118 	ill_pending_mp_cleanup(ill);
8119 }
8120 
8121 /*
8122  * Parse an iftun_req structure coming down SIOC[GS]TUNPARAM ioctls,
8123  * refhold and return the associated ipif
8124  */
8125 /* ARGSUSED */
8126 int
8127 ip_extract_tunreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
8128     cmd_info_t *ci, ipsq_func_t func)
8129 {
8130 	boolean_t exists;
8131 	struct iftun_req *ta;
8132 	ipif_t  *ipif;
8133 	ill_t   *ill;
8134 	boolean_t isv6;
8135 	mblk_t  *mp1;
8136 	int error;
8137 	conn_t  *connp;
8138 	ip_stack_t  *ipst;
8139 
8140 	/* Existence verified in ip_wput_nondata */
8141 	mp1 = mp->b_cont->b_cont;
8142 	ta = (struct iftun_req *)mp1->b_rptr;
8143 	/*
8144 	 * Null terminate the string to protect against buffer
8145 	 * overrun. String was generated by user code and may not
8146 	 * be trusted.
8147 	 */
8148 	ta->ifta_lifr_name[LIFNAMSIZ - 1] = '\0';
8149 
8150 	connp = Q_TO_CONN(q);
8151 	isv6 = connp->conn_af_isv6;
8152 	ipst = connp->conn_netstack->netstack_ip;
8153 
8154 	/* Disallows implicit create */
8155 	ipif = ipif_lookup_on_name(ta->ifta_lifr_name,
8156 	    mi_strlen(ta->ifta_lifr_name), B_FALSE, &exists, isv6,
8157 	    connp->conn_zoneid, CONNP_TO_WQ(connp), mp, func, &error, ipst);
8158 	if (ipif == NULL)
8159 		return (error);
8160 
8161 	if (ipif->ipif_id != 0) {
8162 		/*
8163 		 * We really don't want to set/get tunnel parameters
8164 		 * on virtual tunnel interfaces.  Only allow the
8165 		 * base tunnel to do these.
8166 		 */
8167 		ipif_refrele(ipif);
8168 		return (EINVAL);
8169 	}
8170 
8171 	/*
8172 	 * Send down to tunnel mod for ioctl processing.
8173 	 * Will finish ioctl in ip_rput_other().
8174 	 */
8175 	ill = ipif->ipif_ill;
8176 	if (ill->ill_net_type == IRE_LOOPBACK) {
8177 		ipif_refrele(ipif);
8178 		return (EOPNOTSUPP);
8179 	}
8180 
8181 	if (ill->ill_wq == NULL) {
8182 		ipif_refrele(ipif);
8183 		return (ENXIO);
8184 	}
8185 	/*
8186 	 * Mark the ioctl as coming from an IPv6 interface for
8187 	 * tun's convenience.
8188 	 */
8189 	if (ill->ill_isv6)
8190 		ta->ifta_flags |= 0x80000000;
8191 	ci->ci_ipif = ipif;
8192 	return (0);
8193 }
8194 
8195 /*
8196  * Parse an ifreq or lifreq struct coming down ioctls and refhold
8197  * and return the associated ipif.
8198  * Return value:
8199  *	Non zero: An error has occurred. ci may not be filled out.
8200  *	zero : ci is filled out with the ioctl cmd in ci.ci_name, and
8201  *	a held ipif in ci.ci_ipif.
8202  */
8203 int
8204 ip_extract_lifreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
8205     cmd_info_t *ci, ipsq_func_t func)
8206 {
8207 	char		*name;
8208 	struct ifreq    *ifr;
8209 	struct lifreq    *lifr;
8210 	ipif_t		*ipif = NULL;
8211 	ill_t		*ill;
8212 	conn_t		*connp;
8213 	boolean_t	isv6;
8214 	boolean_t	exists;
8215 	int		err;
8216 	mblk_t		*mp1;
8217 	zoneid_t	zoneid;
8218 	ip_stack_t	*ipst;
8219 
8220 	if (q->q_next != NULL) {
8221 		ill = (ill_t *)q->q_ptr;
8222 		isv6 = ill->ill_isv6;
8223 		connp = NULL;
8224 		zoneid = ALL_ZONES;
8225 		ipst = ill->ill_ipst;
8226 	} else {
8227 		ill = NULL;
8228 		connp = Q_TO_CONN(q);
8229 		isv6 = connp->conn_af_isv6;
8230 		zoneid = connp->conn_zoneid;
8231 		if (zoneid == GLOBAL_ZONEID) {
8232 			/* global zone can access ipifs in all zones */
8233 			zoneid = ALL_ZONES;
8234 		}
8235 		ipst = connp->conn_netstack->netstack_ip;
8236 	}
8237 
8238 	/* Has been checked in ip_wput_nondata */
8239 	mp1 = mp->b_cont->b_cont;
8240 
8241 	if (ipip->ipi_cmd_type == IF_CMD) {
8242 		/* This a old style SIOC[GS]IF* command */
8243 		ifr = (struct ifreq *)mp1->b_rptr;
8244 		/*
8245 		 * Null terminate the string to protect against buffer
8246 		 * overrun. String was generated by user code and may not
8247 		 * be trusted.
8248 		 */
8249 		ifr->ifr_name[IFNAMSIZ - 1] = '\0';
8250 		name = ifr->ifr_name;
8251 		ci->ci_sin = (sin_t *)&ifr->ifr_addr;
8252 		ci->ci_sin6 = NULL;
8253 		ci->ci_lifr = (struct lifreq *)ifr;
8254 	} else {
8255 		/* This a new style SIOC[GS]LIF* command */
8256 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
8257 		lifr = (struct lifreq *)mp1->b_rptr;
8258 		/*
8259 		 * Null terminate the string to protect against buffer
8260 		 * overrun. String was generated by user code and may not
8261 		 * be trusted.
8262 		 */
8263 		lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
8264 		name = lifr->lifr_name;
8265 		ci->ci_sin = (sin_t *)&lifr->lifr_addr;
8266 		ci->ci_sin6 = (sin6_t *)&lifr->lifr_addr;
8267 		ci->ci_lifr = lifr;
8268 	}
8269 
8270 	if (ipip->ipi_cmd == SIOCSLIFNAME) {
8271 		/*
8272 		 * The ioctl will be failed if the ioctl comes down
8273 		 * an conn stream
8274 		 */
8275 		if (ill == NULL) {
8276 			/*
8277 			 * Not an ill queue, return EINVAL same as the
8278 			 * old error code.
8279 			 */
8280 			return (ENXIO);
8281 		}
8282 		ipif = ill->ill_ipif;
8283 		ipif_refhold(ipif);
8284 	} else {
8285 		ipif = ipif_lookup_on_name(name, mi_strlen(name), B_FALSE,
8286 		    &exists, isv6, zoneid,
8287 		    (connp == NULL) ? q : CONNP_TO_WQ(connp), mp, func, &err,
8288 		    ipst);
8289 		if (ipif == NULL) {
8290 			if (err == EINPROGRESS)
8291 				return (err);
8292 			err = 0;	/* Ensure we don't use it below */
8293 		}
8294 	}
8295 
8296 	/*
8297 	 * Old style [GS]IFCMD does not admit IPv6 ipif
8298 	 */
8299 	if (ipif != NULL && ipif->ipif_isv6 && ipip->ipi_cmd_type == IF_CMD) {
8300 		ipif_refrele(ipif);
8301 		return (ENXIO);
8302 	}
8303 
8304 	if (ipif == NULL && ill != NULL && ill->ill_ipif != NULL &&
8305 	    name[0] == '\0') {
8306 		/*
8307 		 * Handle a or a SIOC?IF* with a null name
8308 		 * during plumb (on the ill queue before the I_PLINK).
8309 		 */
8310 		ipif = ill->ill_ipif;
8311 		ipif_refhold(ipif);
8312 	}
8313 
8314 	if (ipif == NULL)
8315 		return (ENXIO);
8316 
8317 	ci->ci_ipif = ipif;
8318 	return (0);
8319 }
8320 
8321 /*
8322  * Return the total number of ipifs.
8323  */
8324 static uint_t
8325 ip_get_numifs(zoneid_t zoneid, ip_stack_t *ipst)
8326 {
8327 	uint_t numifs = 0;
8328 	ill_t	*ill;
8329 	ill_walk_context_t	ctx;
8330 	ipif_t	*ipif;
8331 
8332 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
8333 	ill = ILL_START_WALK_V4(&ctx, ipst);
8334 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8335 		if (IS_UNDER_IPMP(ill))
8336 			continue;
8337 		for (ipif = ill->ill_ipif; ipif != NULL;
8338 		    ipif = ipif->ipif_next) {
8339 			if (ipif->ipif_zoneid == zoneid ||
8340 			    ipif->ipif_zoneid == ALL_ZONES)
8341 				numifs++;
8342 		}
8343 	}
8344 	rw_exit(&ipst->ips_ill_g_lock);
8345 	return (numifs);
8346 }
8347 
8348 /*
8349  * Return the total number of ipifs.
8350  */
8351 static uint_t
8352 ip_get_numlifs(int family, int lifn_flags, zoneid_t zoneid, ip_stack_t *ipst)
8353 {
8354 	uint_t numifs = 0;
8355 	ill_t	*ill;
8356 	ipif_t	*ipif;
8357 	ill_walk_context_t	ctx;
8358 
8359 	ip1dbg(("ip_get_numlifs(%d %u %d)\n", family, lifn_flags, (int)zoneid));
8360 
8361 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
8362 	if (family == AF_INET)
8363 		ill = ILL_START_WALK_V4(&ctx, ipst);
8364 	else if (family == AF_INET6)
8365 		ill = ILL_START_WALK_V6(&ctx, ipst);
8366 	else
8367 		ill = ILL_START_WALK_ALL(&ctx, ipst);
8368 
8369 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8370 		if (IS_UNDER_IPMP(ill) && !(lifn_flags & LIFC_UNDER_IPMP))
8371 			continue;
8372 
8373 		for (ipif = ill->ill_ipif; ipif != NULL;
8374 		    ipif = ipif->ipif_next) {
8375 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
8376 			    !(lifn_flags & LIFC_NOXMIT))
8377 				continue;
8378 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
8379 			    !(lifn_flags & LIFC_TEMPORARY))
8380 				continue;
8381 			if (((ipif->ipif_flags &
8382 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
8383 			    IPIF_DEPRECATED)) ||
8384 			    IS_LOOPBACK(ill) ||
8385 			    !(ipif->ipif_flags & IPIF_UP)) &&
8386 			    (lifn_flags & LIFC_EXTERNAL_SOURCE))
8387 				continue;
8388 
8389 			if (zoneid != ipif->ipif_zoneid &&
8390 			    ipif->ipif_zoneid != ALL_ZONES &&
8391 			    (zoneid != GLOBAL_ZONEID ||
8392 			    !(lifn_flags & LIFC_ALLZONES)))
8393 				continue;
8394 
8395 			numifs++;
8396 		}
8397 	}
8398 	rw_exit(&ipst->ips_ill_g_lock);
8399 	return (numifs);
8400 }
8401 
8402 uint_t
8403 ip_get_lifsrcofnum(ill_t *ill)
8404 {
8405 	uint_t numifs = 0;
8406 	ill_t	*ill_head = ill;
8407 	ip_stack_t	*ipst = ill->ill_ipst;
8408 
8409 	/*
8410 	 * ill_g_usesrc_lock protects ill_usesrc_grp_next, for example, some
8411 	 * other thread may be trying to relink the ILLs in this usesrc group
8412 	 * and adjusting the ill_usesrc_grp_next pointers
8413 	 */
8414 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
8415 	if ((ill->ill_usesrc_ifindex == 0) &&
8416 	    (ill->ill_usesrc_grp_next != NULL)) {
8417 		for (; (ill != NULL) && (ill->ill_usesrc_grp_next != ill_head);
8418 		    ill = ill->ill_usesrc_grp_next)
8419 			numifs++;
8420 	}
8421 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
8422 
8423 	return (numifs);
8424 }
8425 
8426 /* Null values are passed in for ipif, sin, and ifreq */
8427 /* ARGSUSED */
8428 int
8429 ip_sioctl_get_ifnum(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8430     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8431 {
8432 	int *nump;
8433 	conn_t *connp = Q_TO_CONN(q);
8434 
8435 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
8436 
8437 	/* Existence of b_cont->b_cont checked in ip_wput_nondata */
8438 	nump = (int *)mp->b_cont->b_cont->b_rptr;
8439 
8440 	*nump = ip_get_numifs(connp->conn_zoneid,
8441 	    connp->conn_netstack->netstack_ip);
8442 	ip1dbg(("ip_sioctl_get_ifnum numifs %d", *nump));
8443 	return (0);
8444 }
8445 
8446 /* Null values are passed in for ipif, sin, and ifreq */
8447 /* ARGSUSED */
8448 int
8449 ip_sioctl_get_lifnum(ipif_t *dummy_ipif, sin_t *dummy_sin,
8450     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8451 {
8452 	struct lifnum *lifn;
8453 	mblk_t	*mp1;
8454 	conn_t *connp = Q_TO_CONN(q);
8455 
8456 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
8457 
8458 	/* Existence checked in ip_wput_nondata */
8459 	mp1 = mp->b_cont->b_cont;
8460 
8461 	lifn = (struct lifnum *)mp1->b_rptr;
8462 	switch (lifn->lifn_family) {
8463 	case AF_UNSPEC:
8464 	case AF_INET:
8465 	case AF_INET6:
8466 		break;
8467 	default:
8468 		return (EAFNOSUPPORT);
8469 	}
8470 
8471 	lifn->lifn_count = ip_get_numlifs(lifn->lifn_family, lifn->lifn_flags,
8472 	    connp->conn_zoneid, connp->conn_netstack->netstack_ip);
8473 	ip1dbg(("ip_sioctl_get_lifnum numifs %d", lifn->lifn_count));
8474 	return (0);
8475 }
8476 
8477 /* ARGSUSED */
8478 int
8479 ip_sioctl_get_ifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8480     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8481 {
8482 	STRUCT_HANDLE(ifconf, ifc);
8483 	mblk_t *mp1;
8484 	struct iocblk *iocp;
8485 	struct ifreq *ifr;
8486 	ill_walk_context_t	ctx;
8487 	ill_t	*ill;
8488 	ipif_t	*ipif;
8489 	struct sockaddr_in *sin;
8490 	int32_t	ifclen;
8491 	zoneid_t zoneid;
8492 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
8493 
8494 	ASSERT(q->q_next == NULL); /* not valid ioctls for ip as a module */
8495 
8496 	ip1dbg(("ip_sioctl_get_ifconf"));
8497 	/* Existence verified in ip_wput_nondata */
8498 	mp1 = mp->b_cont->b_cont;
8499 	iocp = (struct iocblk *)mp->b_rptr;
8500 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8501 
8502 	/*
8503 	 * The original SIOCGIFCONF passed in a struct ifconf which specified
8504 	 * the user buffer address and length into which the list of struct
8505 	 * ifreqs was to be copied.  Since AT&T Streams does not seem to
8506 	 * allow M_COPYOUT to be used in conjunction with I_STR IOCTLS,
8507 	 * the SIOCGIFCONF operation was redefined to simply provide
8508 	 * a large output buffer into which we are supposed to jam the ifreq
8509 	 * array.  The same ioctl command code was used, despite the fact that
8510 	 * both the applications and the kernel code had to change, thus making
8511 	 * it impossible to support both interfaces.
8512 	 *
8513 	 * For reasons not good enough to try to explain, the following
8514 	 * algorithm is used for deciding what to do with one of these:
8515 	 * If the IOCTL comes in as an I_STR, it is assumed to be of the new
8516 	 * form with the output buffer coming down as the continuation message.
8517 	 * If it arrives as a TRANSPARENT IOCTL, it is assumed to be old style,
8518 	 * and we have to copy in the ifconf structure to find out how big the
8519 	 * output buffer is and where to copy out to.  Sure no problem...
8520 	 *
8521 	 */
8522 	STRUCT_SET_HANDLE(ifc, iocp->ioc_flag, NULL);
8523 	if ((mp1->b_wptr - mp1->b_rptr) == STRUCT_SIZE(ifc)) {
8524 		int numifs = 0;
8525 		size_t ifc_bufsize;
8526 
8527 		/*
8528 		 * Must be (better be!) continuation of a TRANSPARENT
8529 		 * IOCTL.  We just copied in the ifconf structure.
8530 		 */
8531 		STRUCT_SET_HANDLE(ifc, iocp->ioc_flag,
8532 		    (struct ifconf *)mp1->b_rptr);
8533 
8534 		/*
8535 		 * Allocate a buffer to hold requested information.
8536 		 *
8537 		 * If ifc_len is larger than what is needed, we only
8538 		 * allocate what we will use.
8539 		 *
8540 		 * If ifc_len is smaller than what is needed, return
8541 		 * EINVAL.
8542 		 *
8543 		 * XXX: the ill_t structure can hava 2 counters, for
8544 		 * v4 and v6 (not just ill_ipif_up_count) to store the
8545 		 * number of interfaces for a device, so we don't need
8546 		 * to count them here...
8547 		 */
8548 		numifs = ip_get_numifs(zoneid, ipst);
8549 
8550 		ifclen = STRUCT_FGET(ifc, ifc_len);
8551 		ifc_bufsize = numifs * sizeof (struct ifreq);
8552 		if (ifc_bufsize > ifclen) {
8553 			if (iocp->ioc_cmd == O_SIOCGIFCONF) {
8554 				/* old behaviour */
8555 				return (EINVAL);
8556 			} else {
8557 				ifc_bufsize = ifclen;
8558 			}
8559 		}
8560 
8561 		mp1 = mi_copyout_alloc(q, mp,
8562 		    STRUCT_FGETP(ifc, ifc_buf), ifc_bufsize, B_FALSE);
8563 		if (mp1 == NULL)
8564 			return (ENOMEM);
8565 
8566 		mp1->b_wptr = mp1->b_rptr + ifc_bufsize;
8567 	}
8568 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
8569 	/*
8570 	 * the SIOCGIFCONF ioctl only knows about
8571 	 * IPv4 addresses, so don't try to tell
8572 	 * it about interfaces with IPv6-only
8573 	 * addresses. (Last parm 'isv6' is B_FALSE)
8574 	 */
8575 
8576 	ifr = (struct ifreq *)mp1->b_rptr;
8577 
8578 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
8579 	ill = ILL_START_WALK_V4(&ctx, ipst);
8580 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8581 		if (IS_UNDER_IPMP(ill))
8582 			continue;
8583 		for (ipif = ill->ill_ipif; ipif != NULL;
8584 		    ipif = ipif->ipif_next) {
8585 			if (zoneid != ipif->ipif_zoneid &&
8586 			    ipif->ipif_zoneid != ALL_ZONES)
8587 				continue;
8588 			if ((uchar_t *)&ifr[1] > mp1->b_wptr) {
8589 				if (iocp->ioc_cmd == O_SIOCGIFCONF) {
8590 					/* old behaviour */
8591 					rw_exit(&ipst->ips_ill_g_lock);
8592 					return (EINVAL);
8593 				} else {
8594 					goto if_copydone;
8595 				}
8596 			}
8597 			ipif_get_name(ipif, ifr->ifr_name,
8598 			    sizeof (ifr->ifr_name));
8599 			sin = (sin_t *)&ifr->ifr_addr;
8600 			*sin = sin_null;
8601 			sin->sin_family = AF_INET;
8602 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
8603 			ifr++;
8604 		}
8605 	}
8606 if_copydone:
8607 	rw_exit(&ipst->ips_ill_g_lock);
8608 	mp1->b_wptr = (uchar_t *)ifr;
8609 
8610 	if (STRUCT_BUF(ifc) != NULL) {
8611 		STRUCT_FSET(ifc, ifc_len,
8612 		    (int)((uchar_t *)ifr - mp1->b_rptr));
8613 	}
8614 	return (0);
8615 }
8616 
8617 /*
8618  * Get the interfaces using the address hosted on the interface passed in,
8619  * as a source adddress
8620  */
8621 /* ARGSUSED */
8622 int
8623 ip_sioctl_get_lifsrcof(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8624     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8625 {
8626 	mblk_t *mp1;
8627 	ill_t	*ill, *ill_head;
8628 	ipif_t	*ipif, *orig_ipif;
8629 	int	numlifs = 0;
8630 	size_t	lifs_bufsize, lifsmaxlen;
8631 	struct	lifreq *lifr;
8632 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8633 	uint_t	ifindex;
8634 	zoneid_t zoneid;
8635 	int err = 0;
8636 	boolean_t isv6 = B_FALSE;
8637 	struct	sockaddr_in	*sin;
8638 	struct	sockaddr_in6	*sin6;
8639 	STRUCT_HANDLE(lifsrcof, lifs);
8640 	ip_stack_t		*ipst;
8641 
8642 	ipst = CONNQ_TO_IPST(q);
8643 
8644 	ASSERT(q->q_next == NULL);
8645 
8646 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8647 
8648 	/* Existence verified in ip_wput_nondata */
8649 	mp1 = mp->b_cont->b_cont;
8650 
8651 	/*
8652 	 * Must be (better be!) continuation of a TRANSPARENT
8653 	 * IOCTL.  We just copied in the lifsrcof structure.
8654 	 */
8655 	STRUCT_SET_HANDLE(lifs, iocp->ioc_flag,
8656 	    (struct lifsrcof *)mp1->b_rptr);
8657 
8658 	if (MBLKL(mp1) != STRUCT_SIZE(lifs))
8659 		return (EINVAL);
8660 
8661 	ifindex = STRUCT_FGET(lifs, lifs_ifindex);
8662 	isv6 = (Q_TO_CONN(q))->conn_af_isv6;
8663 	ipif = ipif_lookup_on_ifindex(ifindex, isv6, zoneid, q, mp,
8664 	    ip_process_ioctl, &err, ipst);
8665 	if (ipif == NULL) {
8666 		ip1dbg(("ip_sioctl_get_lifsrcof: no ipif for ifindex %d\n",
8667 		    ifindex));
8668 		return (err);
8669 	}
8670 
8671 	/* Allocate a buffer to hold requested information */
8672 	numlifs = ip_get_lifsrcofnum(ipif->ipif_ill);
8673 	lifs_bufsize = numlifs * sizeof (struct lifreq);
8674 	lifsmaxlen =  STRUCT_FGET(lifs, lifs_maxlen);
8675 	/* The actual size needed is always returned in lifs_len */
8676 	STRUCT_FSET(lifs, lifs_len, lifs_bufsize);
8677 
8678 	/* If the amount we need is more than what is passed in, abort */
8679 	if (lifs_bufsize > lifsmaxlen || lifs_bufsize == 0) {
8680 		ipif_refrele(ipif);
8681 		return (0);
8682 	}
8683 
8684 	mp1 = mi_copyout_alloc(q, mp,
8685 	    STRUCT_FGETP(lifs, lifs_buf), lifs_bufsize, B_FALSE);
8686 	if (mp1 == NULL) {
8687 		ipif_refrele(ipif);
8688 		return (ENOMEM);
8689 	}
8690 
8691 	mp1->b_wptr = mp1->b_rptr + lifs_bufsize;
8692 	bzero(mp1->b_rptr, lifs_bufsize);
8693 
8694 	lifr = (struct lifreq *)mp1->b_rptr;
8695 
8696 	ill = ill_head = ipif->ipif_ill;
8697 	orig_ipif = ipif;
8698 
8699 	/* ill_g_usesrc_lock protects ill_usesrc_grp_next */
8700 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
8701 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
8702 
8703 	ill = ill->ill_usesrc_grp_next; /* start from next ill */
8704 	for (; (ill != NULL) && (ill != ill_head);
8705 	    ill = ill->ill_usesrc_grp_next) {
8706 
8707 		if ((uchar_t *)&lifr[1] > mp1->b_wptr)
8708 			break;
8709 
8710 		ipif = ill->ill_ipif;
8711 		ipif_get_name(ipif, lifr->lifr_name, sizeof (lifr->lifr_name));
8712 		if (ipif->ipif_isv6) {
8713 			sin6 = (sin6_t *)&lifr->lifr_addr;
8714 			*sin6 = sin6_null;
8715 			sin6->sin6_family = AF_INET6;
8716 			sin6->sin6_addr = ipif->ipif_v6lcl_addr;
8717 			lifr->lifr_addrlen = ip_mask_to_plen_v6(
8718 			    &ipif->ipif_v6net_mask);
8719 		} else {
8720 			sin = (sin_t *)&lifr->lifr_addr;
8721 			*sin = sin_null;
8722 			sin->sin_family = AF_INET;
8723 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
8724 			lifr->lifr_addrlen = ip_mask_to_plen(
8725 			    ipif->ipif_net_mask);
8726 		}
8727 		lifr++;
8728 	}
8729 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
8730 	rw_exit(&ipst->ips_ill_g_lock);
8731 	ipif_refrele(orig_ipif);
8732 	mp1->b_wptr = (uchar_t *)lifr;
8733 	STRUCT_FSET(lifs, lifs_len, (int)((uchar_t *)lifr - mp1->b_rptr));
8734 
8735 	return (0);
8736 }
8737 
8738 /* ARGSUSED */
8739 int
8740 ip_sioctl_get_lifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8741     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8742 {
8743 	mblk_t *mp1;
8744 	int	list;
8745 	ill_t	*ill;
8746 	ipif_t	*ipif;
8747 	int	flags;
8748 	int	numlifs = 0;
8749 	size_t	lifc_bufsize;
8750 	struct	lifreq *lifr;
8751 	sa_family_t	family;
8752 	struct	sockaddr_in	*sin;
8753 	struct	sockaddr_in6	*sin6;
8754 	ill_walk_context_t	ctx;
8755 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8756 	int32_t	lifclen;
8757 	zoneid_t zoneid;
8758 	STRUCT_HANDLE(lifconf, lifc);
8759 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
8760 
8761 	ip1dbg(("ip_sioctl_get_lifconf"));
8762 
8763 	ASSERT(q->q_next == NULL);
8764 
8765 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8766 
8767 	/* Existence verified in ip_wput_nondata */
8768 	mp1 = mp->b_cont->b_cont;
8769 
8770 	/*
8771 	 * An extended version of SIOCGIFCONF that takes an
8772 	 * additional address family and flags field.
8773 	 * AF_UNSPEC retrieve both IPv4 and IPv6.
8774 	 * Unless LIFC_NOXMIT is specified the IPIF_NOXMIT
8775 	 * interfaces are omitted.
8776 	 * Similarly, IPIF_TEMPORARY interfaces are omitted
8777 	 * unless LIFC_TEMPORARY is specified.
8778 	 * If LIFC_EXTERNAL_SOURCE is specified, IPIF_NOXMIT,
8779 	 * IPIF_NOLOCAL, PHYI_LOOPBACK, IPIF_DEPRECATED and
8780 	 * not IPIF_UP interfaces are omitted. LIFC_EXTERNAL_SOURCE
8781 	 * has priority over LIFC_NOXMIT.
8782 	 */
8783 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, NULL);
8784 
8785 	if ((mp1->b_wptr - mp1->b_rptr) != STRUCT_SIZE(lifc))
8786 		return (EINVAL);
8787 
8788 	/*
8789 	 * Must be (better be!) continuation of a TRANSPARENT
8790 	 * IOCTL.  We just copied in the lifconf structure.
8791 	 */
8792 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, (struct lifconf *)mp1->b_rptr);
8793 
8794 	family = STRUCT_FGET(lifc, lifc_family);
8795 	flags = STRUCT_FGET(lifc, lifc_flags);
8796 
8797 	switch (family) {
8798 	case AF_UNSPEC:
8799 		/*
8800 		 * walk all ILL's.
8801 		 */
8802 		list = MAX_G_HEADS;
8803 		break;
8804 	case AF_INET:
8805 		/*
8806 		 * walk only IPV4 ILL's.
8807 		 */
8808 		list = IP_V4_G_HEAD;
8809 		break;
8810 	case AF_INET6:
8811 		/*
8812 		 * walk only IPV6 ILL's.
8813 		 */
8814 		list = IP_V6_G_HEAD;
8815 		break;
8816 	default:
8817 		return (EAFNOSUPPORT);
8818 	}
8819 
8820 	/*
8821 	 * Allocate a buffer to hold requested information.
8822 	 *
8823 	 * If lifc_len is larger than what is needed, we only
8824 	 * allocate what we will use.
8825 	 *
8826 	 * If lifc_len is smaller than what is needed, return
8827 	 * EINVAL.
8828 	 */
8829 	numlifs = ip_get_numlifs(family, flags, zoneid, ipst);
8830 	lifc_bufsize = numlifs * sizeof (struct lifreq);
8831 	lifclen = STRUCT_FGET(lifc, lifc_len);
8832 	if (lifc_bufsize > lifclen) {
8833 		if (iocp->ioc_cmd == O_SIOCGLIFCONF)
8834 			return (EINVAL);
8835 		else
8836 			lifc_bufsize = lifclen;
8837 	}
8838 
8839 	mp1 = mi_copyout_alloc(q, mp,
8840 	    STRUCT_FGETP(lifc, lifc_buf), lifc_bufsize, B_FALSE);
8841 	if (mp1 == NULL)
8842 		return (ENOMEM);
8843 
8844 	mp1->b_wptr = mp1->b_rptr + lifc_bufsize;
8845 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
8846 
8847 	lifr = (struct lifreq *)mp1->b_rptr;
8848 
8849 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
8850 	ill = ill_first(list, list, &ctx, ipst);
8851 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8852 		if (IS_UNDER_IPMP(ill) && !(flags & LIFC_UNDER_IPMP))
8853 			continue;
8854 
8855 		for (ipif = ill->ill_ipif; ipif != NULL;
8856 		    ipif = ipif->ipif_next) {
8857 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
8858 			    !(flags & LIFC_NOXMIT))
8859 				continue;
8860 
8861 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
8862 			    !(flags & LIFC_TEMPORARY))
8863 				continue;
8864 
8865 			if (((ipif->ipif_flags &
8866 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
8867 			    IPIF_DEPRECATED)) ||
8868 			    IS_LOOPBACK(ill) ||
8869 			    !(ipif->ipif_flags & IPIF_UP)) &&
8870 			    (flags & LIFC_EXTERNAL_SOURCE))
8871 				continue;
8872 
8873 			if (zoneid != ipif->ipif_zoneid &&
8874 			    ipif->ipif_zoneid != ALL_ZONES &&
8875 			    (zoneid != GLOBAL_ZONEID ||
8876 			    !(flags & LIFC_ALLZONES)))
8877 				continue;
8878 
8879 			if ((uchar_t *)&lifr[1] > mp1->b_wptr) {
8880 				if (iocp->ioc_cmd == O_SIOCGLIFCONF) {
8881 					rw_exit(&ipst->ips_ill_g_lock);
8882 					return (EINVAL);
8883 				} else {
8884 					goto lif_copydone;
8885 				}
8886 			}
8887 
8888 			ipif_get_name(ipif, lifr->lifr_name,
8889 			    sizeof (lifr->lifr_name));
8890 			lifr->lifr_type = ill->ill_type;
8891 			if (ipif->ipif_isv6) {
8892 				sin6 = (sin6_t *)&lifr->lifr_addr;
8893 				*sin6 = sin6_null;
8894 				sin6->sin6_family = AF_INET6;
8895 				sin6->sin6_addr =
8896 				    ipif->ipif_v6lcl_addr;
8897 				lifr->lifr_addrlen =
8898 				    ip_mask_to_plen_v6(
8899 				    &ipif->ipif_v6net_mask);
8900 			} else {
8901 				sin = (sin_t *)&lifr->lifr_addr;
8902 				*sin = sin_null;
8903 				sin->sin_family = AF_INET;
8904 				sin->sin_addr.s_addr =
8905 				    ipif->ipif_lcl_addr;
8906 				lifr->lifr_addrlen =
8907 				    ip_mask_to_plen(
8908 				    ipif->ipif_net_mask);
8909 			}
8910 			lifr++;
8911 		}
8912 	}
8913 lif_copydone:
8914 	rw_exit(&ipst->ips_ill_g_lock);
8915 
8916 	mp1->b_wptr = (uchar_t *)lifr;
8917 	if (STRUCT_BUF(lifc) != NULL) {
8918 		STRUCT_FSET(lifc, lifc_len,
8919 		    (int)((uchar_t *)lifr - mp1->b_rptr));
8920 	}
8921 	return (0);
8922 }
8923 
8924 static void
8925 ip_sioctl_ip6addrpolicy(queue_t *q, mblk_t *mp)
8926 {
8927 	ip6_asp_t *table;
8928 	size_t table_size;
8929 	mblk_t *data_mp;
8930 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8931 	ip_stack_t	*ipst;
8932 
8933 	if (q->q_next == NULL)
8934 		ipst = CONNQ_TO_IPST(q);
8935 	else
8936 		ipst = ILLQ_TO_IPST(q);
8937 
8938 	/* These two ioctls are I_STR only */
8939 	if (iocp->ioc_count == TRANSPARENT) {
8940 		miocnak(q, mp, 0, EINVAL);
8941 		return;
8942 	}
8943 
8944 	data_mp = mp->b_cont;
8945 	if (data_mp == NULL) {
8946 		/* The user passed us a NULL argument */
8947 		table = NULL;
8948 		table_size = iocp->ioc_count;
8949 	} else {
8950 		/*
8951 		 * The user provided a table.  The stream head
8952 		 * may have copied in the user data in chunks,
8953 		 * so make sure everything is pulled up
8954 		 * properly.
8955 		 */
8956 		if (MBLKL(data_mp) < iocp->ioc_count) {
8957 			mblk_t *new_data_mp;
8958 			if ((new_data_mp = msgpullup(data_mp, -1)) ==
8959 			    NULL) {
8960 				miocnak(q, mp, 0, ENOMEM);
8961 				return;
8962 			}
8963 			freemsg(data_mp);
8964 			data_mp = new_data_mp;
8965 			mp->b_cont = data_mp;
8966 		}
8967 		table = (ip6_asp_t *)data_mp->b_rptr;
8968 		table_size = iocp->ioc_count;
8969 	}
8970 
8971 	switch (iocp->ioc_cmd) {
8972 	case SIOCGIP6ADDRPOLICY:
8973 		iocp->ioc_rval = ip6_asp_get(table, table_size, ipst);
8974 		if (iocp->ioc_rval == -1)
8975 			iocp->ioc_error = EINVAL;
8976 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
8977 		else if (table != NULL &&
8978 		    (iocp->ioc_flag & IOC_MODELS) == IOC_ILP32) {
8979 			ip6_asp_t *src = table;
8980 			ip6_asp32_t *dst = (void *)table;
8981 			int count = table_size / sizeof (ip6_asp_t);
8982 			int i;
8983 
8984 			/*
8985 			 * We need to do an in-place shrink of the array
8986 			 * to match the alignment attributes of the
8987 			 * 32-bit ABI looking at it.
8988 			 */
8989 			/* LINTED: logical expression always true: op "||" */
8990 			ASSERT(sizeof (*src) > sizeof (*dst));
8991 			for (i = 1; i < count; i++)
8992 				bcopy(src + i, dst + i, sizeof (*dst));
8993 		}
8994 #endif
8995 		break;
8996 
8997 	case SIOCSIP6ADDRPOLICY:
8998 		ASSERT(mp->b_prev == NULL);
8999 		mp->b_prev = (void *)q;
9000 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
9001 		/*
9002 		 * We pass in the datamodel here so that the ip6_asp_replace()
9003 		 * routine can handle converting from 32-bit to native formats
9004 		 * where necessary.
9005 		 *
9006 		 * A better way to handle this might be to convert the inbound
9007 		 * data structure here, and hang it off a new 'mp'; thus the
9008 		 * ip6_asp_replace() logic would always be dealing with native
9009 		 * format data structures..
9010 		 *
9011 		 * (An even simpler way to handle these ioctls is to just
9012 		 * add a 32-bit trailing 'pad' field to the ip6_asp_t structure
9013 		 * and just recompile everything that depends on it.)
9014 		 */
9015 #endif
9016 		ip6_asp_replace(mp, table, table_size, B_FALSE, ipst,
9017 		    iocp->ioc_flag & IOC_MODELS);
9018 		return;
9019 	}
9020 
9021 	DB_TYPE(mp) =  (iocp->ioc_error == 0) ? M_IOCACK : M_IOCNAK;
9022 	qreply(q, mp);
9023 }
9024 
9025 static void
9026 ip_sioctl_dstinfo(queue_t *q, mblk_t *mp)
9027 {
9028 	mblk_t 		*data_mp;
9029 	struct dstinforeq	*dir;
9030 	uint8_t		*end, *cur;
9031 	in6_addr_t	*daddr, *saddr;
9032 	ipaddr_t	v4daddr;
9033 	ire_t		*ire;
9034 	char		*slabel, *dlabel;
9035 	boolean_t	isipv4;
9036 	int		match_ire;
9037 	ill_t		*dst_ill;
9038 	ipif_t		*src_ipif, *ire_ipif;
9039 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
9040 	zoneid_t	zoneid;
9041 	ip_stack_t	*ipst = CONNQ_TO_IPST(q);
9042 
9043 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
9044 	zoneid = Q_TO_CONN(q)->conn_zoneid;
9045 
9046 	/*
9047 	 * This ioctl is I_STR only, and must have a
9048 	 * data mblk following the M_IOCTL mblk.
9049 	 */
9050 	data_mp = mp->b_cont;
9051 	if (iocp->ioc_count == TRANSPARENT || data_mp == NULL) {
9052 		miocnak(q, mp, 0, EINVAL);
9053 		return;
9054 	}
9055 
9056 	if (MBLKL(data_mp) < iocp->ioc_count) {
9057 		mblk_t *new_data_mp;
9058 
9059 		if ((new_data_mp = msgpullup(data_mp, -1)) == NULL) {
9060 			miocnak(q, mp, 0, ENOMEM);
9061 			return;
9062 		}
9063 		freemsg(data_mp);
9064 		data_mp = new_data_mp;
9065 		mp->b_cont = data_mp;
9066 	}
9067 	match_ire = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | MATCH_IRE_PARENT;
9068 
9069 	for (cur = data_mp->b_rptr, end = data_mp->b_wptr;
9070 	    end - cur >= sizeof (struct dstinforeq);
9071 	    cur += sizeof (struct dstinforeq)) {
9072 		dir = (struct dstinforeq *)cur;
9073 		daddr = &dir->dir_daddr;
9074 		saddr = &dir->dir_saddr;
9075 
9076 		/*
9077 		 * ip_addr_scope_v6() and ip6_asp_lookup() handle
9078 		 * v4 mapped addresses; ire_ftable_lookup[_v6]()
9079 		 * and ipif_select_source[_v6]() do not.
9080 		 */
9081 		dir->dir_dscope = ip_addr_scope_v6(daddr);
9082 		dlabel = ip6_asp_lookup(daddr, &dir->dir_precedence, ipst);
9083 
9084 		isipv4 = IN6_IS_ADDR_V4MAPPED(daddr);
9085 		if (isipv4) {
9086 			IN6_V4MAPPED_TO_IPADDR(daddr, v4daddr);
9087 			ire = ire_ftable_lookup(v4daddr, NULL, NULL,
9088 			    0, NULL, NULL, zoneid, 0, NULL, match_ire, ipst);
9089 		} else {
9090 			ire = ire_ftable_lookup_v6(daddr, NULL, NULL,
9091 			    0, NULL, NULL, zoneid, 0, NULL, match_ire, ipst);
9092 		}
9093 		if (ire == NULL) {
9094 			dir->dir_dreachable = 0;
9095 
9096 			/* move on to next dst addr */
9097 			continue;
9098 		}
9099 		dir->dir_dreachable = 1;
9100 
9101 		ire_ipif = ire->ire_ipif;
9102 		if (ire_ipif == NULL)
9103 			goto next_dst;
9104 
9105 		/*
9106 		 * We expect to get back an interface ire or a
9107 		 * gateway ire cache entry.  For both types, the
9108 		 * output interface is ire_ipif->ipif_ill.
9109 		 */
9110 		dst_ill = ire_ipif->ipif_ill;
9111 		dir->dir_dmactype = dst_ill->ill_mactype;
9112 
9113 		if (isipv4) {
9114 			src_ipif = ipif_select_source(dst_ill, v4daddr, zoneid);
9115 		} else {
9116 			src_ipif = ipif_select_source_v6(dst_ill,
9117 			    daddr, B_FALSE, IPV6_PREFER_SRC_DEFAULT, zoneid);
9118 		}
9119 		if (src_ipif == NULL)
9120 			goto next_dst;
9121 
9122 		*saddr = src_ipif->ipif_v6lcl_addr;
9123 		dir->dir_sscope = ip_addr_scope_v6(saddr);
9124 		slabel = ip6_asp_lookup(saddr, NULL, ipst);
9125 		dir->dir_labelmatch = ip6_asp_labelcmp(dlabel, slabel);
9126 		dir->dir_sdeprecated =
9127 		    (src_ipif->ipif_flags & IPIF_DEPRECATED) ? 1 : 0;
9128 		ipif_refrele(src_ipif);
9129 next_dst:
9130 		ire_refrele(ire);
9131 	}
9132 	miocack(q, mp, iocp->ioc_count, 0);
9133 }
9134 
9135 /*
9136  * Check if this is an address assigned to this machine.
9137  * Skips interfaces that are down by using ire checks.
9138  * Translates mapped addresses to v4 addresses and then
9139  * treats them as such, returning true if the v4 address
9140  * associated with this mapped address is configured.
9141  * Note: Applications will have to be careful what they do
9142  * with the response; use of mapped addresses limits
9143  * what can be done with the socket, especially with
9144  * respect to socket options and ioctls - neither IPv4
9145  * options nor IPv6 sticky options/ancillary data options
9146  * may be used.
9147  */
9148 /* ARGSUSED */
9149 int
9150 ip_sioctl_tmyaddr(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9151     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9152 {
9153 	struct sioc_addrreq *sia;
9154 	sin_t *sin;
9155 	ire_t *ire;
9156 	mblk_t *mp1;
9157 	zoneid_t zoneid;
9158 	ip_stack_t	*ipst;
9159 
9160 	ip1dbg(("ip_sioctl_tmyaddr"));
9161 
9162 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
9163 	zoneid = Q_TO_CONN(q)->conn_zoneid;
9164 	ipst = CONNQ_TO_IPST(q);
9165 
9166 	/* Existence verified in ip_wput_nondata */
9167 	mp1 = mp->b_cont->b_cont;
9168 	sia = (struct sioc_addrreq *)mp1->b_rptr;
9169 	sin = (sin_t *)&sia->sa_addr;
9170 	switch (sin->sin_family) {
9171 	case AF_INET6: {
9172 		sin6_t *sin6 = (sin6_t *)sin;
9173 
9174 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
9175 			ipaddr_t v4_addr;
9176 
9177 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
9178 			    v4_addr);
9179 			ire = ire_ctable_lookup(v4_addr, 0,
9180 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
9181 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, ipst);
9182 		} else {
9183 			in6_addr_t v6addr;
9184 
9185 			v6addr = sin6->sin6_addr;
9186 			ire = ire_ctable_lookup_v6(&v6addr, 0,
9187 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
9188 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, ipst);
9189 		}
9190 		break;
9191 	}
9192 	case AF_INET: {
9193 		ipaddr_t v4addr;
9194 
9195 		v4addr = sin->sin_addr.s_addr;
9196 		ire = ire_ctable_lookup(v4addr, 0,
9197 		    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
9198 		    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, ipst);
9199 		break;
9200 	}
9201 	default:
9202 		return (EAFNOSUPPORT);
9203 	}
9204 	if (ire != NULL) {
9205 		sia->sa_res = 1;
9206 		ire_refrele(ire);
9207 	} else {
9208 		sia->sa_res = 0;
9209 	}
9210 	return (0);
9211 }
9212 
9213 /*
9214  * Check if this is an address assigned on-link i.e. neighbor,
9215  * and makes sure it's reachable from the current zone.
9216  * Returns true for my addresses as well.
9217  * Translates mapped addresses to v4 addresses and then
9218  * treats them as such, returning true if the v4 address
9219  * associated with this mapped address is configured.
9220  * Note: Applications will have to be careful what they do
9221  * with the response; use of mapped addresses limits
9222  * what can be done with the socket, especially with
9223  * respect to socket options and ioctls - neither IPv4
9224  * options nor IPv6 sticky options/ancillary data options
9225  * may be used.
9226  */
9227 /* ARGSUSED */
9228 int
9229 ip_sioctl_tonlink(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9230     ip_ioctl_cmd_t *ipip, void *duymmy_ifreq)
9231 {
9232 	struct sioc_addrreq *sia;
9233 	sin_t *sin;
9234 	mblk_t	*mp1;
9235 	ire_t *ire = NULL;
9236 	zoneid_t zoneid;
9237 	ip_stack_t	*ipst;
9238 
9239 	ip1dbg(("ip_sioctl_tonlink"));
9240 
9241 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
9242 	zoneid = Q_TO_CONN(q)->conn_zoneid;
9243 	ipst = CONNQ_TO_IPST(q);
9244 
9245 	/* Existence verified in ip_wput_nondata */
9246 	mp1 = mp->b_cont->b_cont;
9247 	sia = (struct sioc_addrreq *)mp1->b_rptr;
9248 	sin = (sin_t *)&sia->sa_addr;
9249 
9250 	/*
9251 	 * Match addresses with a zero gateway field to avoid
9252 	 * routes going through a router.
9253 	 * Exclude broadcast and multicast addresses.
9254 	 */
9255 	switch (sin->sin_family) {
9256 	case AF_INET6: {
9257 		sin6_t *sin6 = (sin6_t *)sin;
9258 
9259 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
9260 			ipaddr_t v4_addr;
9261 
9262 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
9263 			    v4_addr);
9264 			if (!CLASSD(v4_addr)) {
9265 				ire = ire_route_lookup(v4_addr, 0, 0, 0,
9266 				    NULL, NULL, zoneid, NULL,
9267 				    MATCH_IRE_GW, ipst);
9268 			}
9269 		} else {
9270 			in6_addr_t v6addr;
9271 			in6_addr_t v6gw;
9272 
9273 			v6addr = sin6->sin6_addr;
9274 			v6gw = ipv6_all_zeros;
9275 			if (!IN6_IS_ADDR_MULTICAST(&v6addr)) {
9276 				ire = ire_route_lookup_v6(&v6addr, 0,
9277 				    &v6gw, 0, NULL, NULL, zoneid,
9278 				    NULL, MATCH_IRE_GW, ipst);
9279 			}
9280 		}
9281 		break;
9282 	}
9283 	case AF_INET: {
9284 		ipaddr_t v4addr;
9285 
9286 		v4addr = sin->sin_addr.s_addr;
9287 		if (!CLASSD(v4addr)) {
9288 			ire = ire_route_lookup(v4addr, 0, 0, 0,
9289 			    NULL, NULL, zoneid, NULL,
9290 			    MATCH_IRE_GW, ipst);
9291 		}
9292 		break;
9293 	}
9294 	default:
9295 		return (EAFNOSUPPORT);
9296 	}
9297 	sia->sa_res = 0;
9298 	if (ire != NULL) {
9299 		if (ire->ire_type & (IRE_INTERFACE|IRE_CACHE|
9300 		    IRE_LOCAL|IRE_LOOPBACK)) {
9301 			sia->sa_res = 1;
9302 		}
9303 		ire_refrele(ire);
9304 	}
9305 	return (0);
9306 }
9307 
9308 /*
9309  * TBD: implement when kernel maintaines a list of site prefixes.
9310  */
9311 /* ARGSUSED */
9312 int
9313 ip_sioctl_tmysite(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9314     ip_ioctl_cmd_t *ipip, void *ifreq)
9315 {
9316 	return (ENXIO);
9317 }
9318 
9319 /* ARGSUSED */
9320 int
9321 ip_sioctl_tunparam(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9322     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9323 {
9324 	ill_t		*ill;
9325 	mblk_t		*mp1;
9326 	conn_t		*connp;
9327 	boolean_t	success;
9328 
9329 	ip1dbg(("ip_sioctl_tunparam(%s:%u %p)\n",
9330 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9331 	/* ioctl comes down on an conn */
9332 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9333 	connp = Q_TO_CONN(q);
9334 
9335 	mp->b_datap->db_type = M_IOCTL;
9336 
9337 	/*
9338 	 * Send down a copy. (copymsg does not copy b_next/b_prev).
9339 	 * The original mp contains contaminated b_next values due to 'mi',
9340 	 * which is needed to do the mi_copy_done. Unfortunately if we
9341 	 * send down the original mblk itself and if we are popped due to an
9342 	 * an unplumb before the response comes back from tunnel,
9343 	 * the streamhead (which does a freemsg) will see this contaminated
9344 	 * message and the assertion in freemsg about non-null b_next/b_prev
9345 	 * will panic a DEBUG kernel.
9346 	 */
9347 	mp1 = copymsg(mp);
9348 	if (mp1 == NULL)
9349 		return (ENOMEM);
9350 
9351 	ill = ipif->ipif_ill;
9352 	mutex_enter(&connp->conn_lock);
9353 	mutex_enter(&ill->ill_lock);
9354 	if (ipip->ipi_cmd == SIOCSTUNPARAM || ipip->ipi_cmd == OSIOCSTUNPARAM) {
9355 		success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp),
9356 		    mp, 0);
9357 	} else {
9358 		success = ill_pending_mp_add(ill, connp, mp);
9359 	}
9360 	mutex_exit(&ill->ill_lock);
9361 	mutex_exit(&connp->conn_lock);
9362 
9363 	if (success) {
9364 		ip1dbg(("sending down tunparam request "));
9365 		putnext(ill->ill_wq, mp1);
9366 		return (EINPROGRESS);
9367 	} else {
9368 		/* The conn has started closing */
9369 		freemsg(mp1);
9370 		return (EINTR);
9371 	}
9372 }
9373 
9374 /*
9375  * ARP IOCTLs.
9376  * How does IP get in the business of fronting ARP configuration/queries?
9377  * Well it's like this, the Berkeley ARP IOCTLs (SIOCGARP, SIOCDARP, SIOCSARP)
9378  * are by tradition passed in through a datagram socket.  That lands in IP.
9379  * As it happens, this is just as well since the interface is quite crude in
9380  * that it passes in no information about protocol or hardware types, or
9381  * interface association.  After making the protocol assumption, IP is in
9382  * the position to look up the name of the ILL, which ARP will need, and
9383  * format a request that can be handled by ARP.  The request is passed up
9384  * stream to ARP, and the original IOCTL is completed by IP when ARP passes
9385  * back a response.  ARP supports its own set of more general IOCTLs, in
9386  * case anyone is interested.
9387  */
9388 /* ARGSUSED */
9389 int
9390 ip_sioctl_arp(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9391     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9392 {
9393 	mblk_t *mp1;
9394 	mblk_t *mp2;
9395 	mblk_t *pending_mp;
9396 	ipaddr_t ipaddr;
9397 	area_t *area;
9398 	struct iocblk *iocp;
9399 	conn_t *connp;
9400 	struct arpreq *ar;
9401 	struct xarpreq *xar;
9402 	int flags, alength;
9403 	uchar_t *lladdr;
9404 	ire_t *ire;
9405 	ip_stack_t *ipst;
9406 	ill_t *ill = ipif->ipif_ill;
9407 	ill_t *proxy_ill = NULL;
9408 	ipmp_arpent_t *entp = NULL;
9409 	boolean_t if_arp_ioctl = B_FALSE;
9410 	boolean_t proxyarp = B_FALSE;
9411 
9412 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9413 	connp = Q_TO_CONN(q);
9414 	ipst = connp->conn_netstack->netstack_ip;
9415 
9416 	if (ipip->ipi_cmd_type == XARP_CMD) {
9417 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->XARPREQ_MBLK */
9418 		xar = (struct xarpreq *)mp->b_cont->b_cont->b_rptr;
9419 		ar = NULL;
9420 
9421 		flags = xar->xarp_flags;
9422 		lladdr = (uchar_t *)LLADDR(&xar->xarp_ha);
9423 		if_arp_ioctl = (xar->xarp_ha.sdl_nlen != 0);
9424 		/*
9425 		 * Validate against user's link layer address length
9426 		 * input and name and addr length limits.
9427 		 */
9428 		alength = ill->ill_phys_addr_length;
9429 		if (ipip->ipi_cmd == SIOCSXARP) {
9430 			if (alength != xar->xarp_ha.sdl_alen ||
9431 			    (alength + xar->xarp_ha.sdl_nlen >
9432 			    sizeof (xar->xarp_ha.sdl_data)))
9433 				return (EINVAL);
9434 		}
9435 	} else {
9436 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->ARPREQ_MBLK */
9437 		ar = (struct arpreq *)mp->b_cont->b_cont->b_rptr;
9438 		xar = NULL;
9439 
9440 		flags = ar->arp_flags;
9441 		lladdr = (uchar_t *)ar->arp_ha.sa_data;
9442 		/*
9443 		 * Theoretically, the sa_family could tell us what link
9444 		 * layer type this operation is trying to deal with. By
9445 		 * common usage AF_UNSPEC means ethernet. We'll assume
9446 		 * any attempt to use the SIOC?ARP ioctls is for ethernet,
9447 		 * for now. Our new SIOC*XARP ioctls can be used more
9448 		 * generally.
9449 		 *
9450 		 * If the underlying media happens to have a non 6 byte
9451 		 * address, arp module will fail set/get, but the del
9452 		 * operation will succeed.
9453 		 */
9454 		alength = 6;
9455 		if ((ipip->ipi_cmd != SIOCDARP) &&
9456 		    (alength != ill->ill_phys_addr_length)) {
9457 			return (EINVAL);
9458 		}
9459 	}
9460 
9461 	ipaddr = sin->sin_addr.s_addr;
9462 
9463 	/*
9464 	 * IPMP ARP special handling:
9465 	 *
9466 	 * 1. Since ARP mappings must appear consistent across the group,
9467 	 *    prohibit changing ARP mappings on the underlying interfaces.
9468 	 *
9469 	 * 2. Since ARP mappings for IPMP data addresses are maintained by
9470 	 *    IP itself, prohibit changing them.
9471 	 *
9472 	 * 3. For proxy ARP, use a functioning hardware address in the group,
9473 	 *    provided one exists.  If one doesn't, just add the entry as-is;
9474 	 *    ipmp_illgrp_refresh_arpent() will refresh it if things change.
9475 	 */
9476 	if (IS_UNDER_IPMP(ill)) {
9477 		if (ipip->ipi_cmd != SIOCGARP && ipip->ipi_cmd != SIOCGXARP)
9478 			return (EPERM);
9479 	}
9480 	if (IS_IPMP(ill)) {
9481 		ipmp_illgrp_t *illg = ill->ill_grp;
9482 
9483 		switch (ipip->ipi_cmd) {
9484 		case SIOCSARP:
9485 		case SIOCSXARP:
9486 			proxy_ill = ipmp_illgrp_find_ill(illg, lladdr, alength);
9487 			if (proxy_ill != NULL) {
9488 				proxyarp = B_TRUE;
9489 				if (!ipmp_ill_is_active(proxy_ill))
9490 					proxy_ill = ipmp_illgrp_next_ill(illg);
9491 				if (proxy_ill != NULL)
9492 					lladdr = proxy_ill->ill_phys_addr;
9493 			}
9494 			/* FALLTHRU */
9495 		case SIOCDARP:
9496 		case SIOCDXARP:
9497 			ire = ire_ctable_lookup(ipaddr, 0, IRE_LOCAL, NULL,
9498 			    ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
9499 			if (ire != NULL) {
9500 				ire_refrele(ire);
9501 				return (EPERM);
9502 			}
9503 		}
9504 	}
9505 
9506 	/*
9507 	 * We are going to pass up to ARP a packet chain that looks
9508 	 * like:
9509 	 *
9510 	 * M_IOCTL-->ARP_op_MBLK-->ORIG_M_IOCTL-->MI_COPY_MBLK-->[X]ARPREQ_MBLK
9511 	 *
9512 	 * Get a copy of the original IOCTL mblk to head the chain,
9513 	 * to be sent up (in mp1). Also get another copy to store
9514 	 * in the ill_pending_mp list, for matching the response
9515 	 * when it comes back from ARP.
9516 	 */
9517 	mp1 = copyb(mp);
9518 	pending_mp = copymsg(mp);
9519 	if (mp1 == NULL || pending_mp == NULL) {
9520 		if (mp1 != NULL)
9521 			freeb(mp1);
9522 		if (pending_mp != NULL)
9523 			inet_freemsg(pending_mp);
9524 		return (ENOMEM);
9525 	}
9526 
9527 	mp2 = ill_arp_alloc(ill, (uchar_t *)&ip_area_template,
9528 	    (caddr_t)&ipaddr);
9529 	if (mp2 == NULL) {
9530 		freeb(mp1);
9531 		inet_freemsg(pending_mp);
9532 		return (ENOMEM);
9533 	}
9534 	/* Put together the chain. */
9535 	mp1->b_cont = mp2;
9536 	mp1->b_datap->db_type = M_IOCTL;
9537 	mp2->b_cont = mp;
9538 	mp2->b_datap->db_type = M_DATA;
9539 
9540 	iocp = (struct iocblk *)mp1->b_rptr;
9541 
9542 	/*
9543 	 * An M_IOCDATA's payload (struct copyresp) is mostly the same as an
9544 	 * M_IOCTL's payload (struct iocblk), but 'struct copyresp' has a
9545 	 * cp_private field (or cp_rval on 32-bit systems) in place of the
9546 	 * ioc_count field; set ioc_count to be correct.
9547 	 */
9548 	iocp->ioc_count = MBLKL(mp1->b_cont);
9549 
9550 	/*
9551 	 * Set the proper command in the ARP message.
9552 	 * Convert the SIOC{G|S|D}ARP calls into our
9553 	 * AR_ENTRY_xxx calls.
9554 	 */
9555 	area = (area_t *)mp2->b_rptr;
9556 	switch (iocp->ioc_cmd) {
9557 	case SIOCDARP:
9558 	case SIOCDXARP:
9559 		/*
9560 		 * We defer deleting the corresponding IRE until
9561 		 * we return from arp.
9562 		 */
9563 		area->area_cmd = AR_ENTRY_DELETE;
9564 		area->area_proto_mask_offset = 0;
9565 		break;
9566 	case SIOCGARP:
9567 	case SIOCGXARP:
9568 		area->area_cmd = AR_ENTRY_SQUERY;
9569 		area->area_proto_mask_offset = 0;
9570 		break;
9571 	case SIOCSARP:
9572 	case SIOCSXARP:
9573 		/*
9574 		 * Delete the corresponding ire to make sure IP will
9575 		 * pick up any change from arp.
9576 		 */
9577 		if (!if_arp_ioctl) {
9578 			(void) ip_ire_clookup_and_delete(ipaddr, NULL, ipst);
9579 		} else {
9580 			ipif_t *ipif = ipif_get_next_ipif(NULL, ill);
9581 			if (ipif != NULL) {
9582 				(void) ip_ire_clookup_and_delete(ipaddr, ipif,
9583 				    ipst);
9584 				ipif_refrele(ipif);
9585 			}
9586 		}
9587 		break;
9588 	}
9589 	iocp->ioc_cmd = area->area_cmd;
9590 
9591 	/*
9592 	 * Fill in the rest of the ARP operation fields.
9593 	 */
9594 	area->area_hw_addr_length = alength;
9595 	bcopy(lladdr, (char *)area + area->area_hw_addr_offset, alength);
9596 
9597 	/* Translate the flags. */
9598 	if (flags & ATF_PERM)
9599 		area->area_flags |= ACE_F_PERMANENT;
9600 	if (flags & ATF_PUBL)
9601 		area->area_flags |= ACE_F_PUBLISH;
9602 	if (flags & ATF_AUTHORITY)
9603 		area->area_flags |= ACE_F_AUTHORITY;
9604 
9605 	/*
9606 	 * If this is a permanent AR_ENTRY_ADD on the IPMP interface, track it
9607 	 * so that IP can update ARP as the active ills in the group change.
9608 	 */
9609 	if (IS_IPMP(ill) && area->area_cmd == AR_ENTRY_ADD &&
9610 	    (area->area_flags & ACE_F_PERMANENT)) {
9611 		entp = ipmp_illgrp_create_arpent(ill->ill_grp, mp2, proxyarp);
9612 
9613 		/*
9614 		 * The second part of the conditional below handles a corner
9615 		 * case: if this is proxy ARP and the IPMP group has no active
9616 		 * interfaces, we can't send the request to ARP now since it
9617 		 * won't be able to build an ACE.  So we return success and
9618 		 * notify ARP about the proxy ARP entry once an interface
9619 		 * becomes active.
9620 		 */
9621 		if (entp == NULL || (proxyarp && proxy_ill == NULL)) {
9622 			mp2->b_cont = NULL;
9623 			inet_freemsg(mp1);
9624 			inet_freemsg(pending_mp);
9625 			return (entp == NULL ? ENOMEM : 0);
9626 		}
9627 	}
9628 
9629 	/*
9630 	 * Before sending 'mp' to ARP, we have to clear the b_next
9631 	 * and b_prev. Otherwise if STREAMS encounters such a message
9632 	 * in freemsg(), (because ARP can close any time) it can cause
9633 	 * a panic. But mi code needs the b_next and b_prev values of
9634 	 * mp->b_cont, to complete the ioctl. So we store it here
9635 	 * in pending_mp->bcont, and restore it in ip_sioctl_iocack()
9636 	 * when the response comes down from ARP.
9637 	 */
9638 	pending_mp->b_cont->b_next = mp->b_cont->b_next;
9639 	pending_mp->b_cont->b_prev = mp->b_cont->b_prev;
9640 	mp->b_cont->b_next = NULL;
9641 	mp->b_cont->b_prev = NULL;
9642 
9643 	mutex_enter(&connp->conn_lock);
9644 	mutex_enter(&ill->ill_lock);
9645 	/* conn has not yet started closing, hence this can't fail */
9646 	if (ipip->ipi_flags & IPI_WR) {
9647 		VERIFY(ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp),
9648 		    pending_mp, 0) != 0);
9649 	} else {
9650 		VERIFY(ill_pending_mp_add(ill, connp, pending_mp) != 0);
9651 	}
9652 	mutex_exit(&ill->ill_lock);
9653 	mutex_exit(&connp->conn_lock);
9654 
9655 	/*
9656 	 * Up to ARP it goes.  The response will come back in ip_wput() as an
9657 	 * M_IOCACK, and will be handed to ip_sioctl_iocack() for completion.
9658 	 */
9659 	putnext(ill->ill_rq, mp1);
9660 
9661 	/*
9662 	 * If we created an IPMP ARP entry, mark that we've notified ARP.
9663 	 */
9664 	if (entp != NULL)
9665 		ipmp_illgrp_mark_arpent(ill->ill_grp, entp);
9666 
9667 	return (EINPROGRESS);
9668 }
9669 
9670 /*
9671  * Parse an [x]arpreq structure coming down SIOC[GSD][X]ARP ioctls, identify
9672  * the associated sin and refhold and return the associated ipif via `ci'.
9673  */
9674 int
9675 ip_extract_arpreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
9676     cmd_info_t *ci, ipsq_func_t func)
9677 {
9678 	mblk_t	*mp1;
9679 	int	err;
9680 	sin_t	*sin;
9681 	conn_t	*connp;
9682 	ipif_t	*ipif;
9683 	ire_t	*ire = NULL;
9684 	ill_t	*ill = NULL;
9685 	boolean_t exists;
9686 	ip_stack_t *ipst;
9687 	struct arpreq *ar;
9688 	struct xarpreq *xar;
9689 	struct sockaddr_dl *sdl;
9690 
9691 	/* ioctl comes down on a conn */
9692 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9693 	connp = Q_TO_CONN(q);
9694 	if (connp->conn_af_isv6)
9695 		return (ENXIO);
9696 
9697 	ipst = connp->conn_netstack->netstack_ip;
9698 
9699 	/* Verified in ip_wput_nondata */
9700 	mp1 = mp->b_cont->b_cont;
9701 
9702 	if (ipip->ipi_cmd_type == XARP_CMD) {
9703 		ASSERT(MBLKL(mp1) >= sizeof (struct xarpreq));
9704 		xar = (struct xarpreq *)mp1->b_rptr;
9705 		sin = (sin_t *)&xar->xarp_pa;
9706 		sdl = &xar->xarp_ha;
9707 
9708 		if (sdl->sdl_family != AF_LINK || sin->sin_family != AF_INET)
9709 			return (ENXIO);
9710 		if (sdl->sdl_nlen >= LIFNAMSIZ)
9711 			return (EINVAL);
9712 	} else {
9713 		ASSERT(ipip->ipi_cmd_type == ARP_CMD);
9714 		ASSERT(MBLKL(mp1) >= sizeof (struct arpreq));
9715 		ar = (struct arpreq *)mp1->b_rptr;
9716 		sin = (sin_t *)&ar->arp_pa;
9717 	}
9718 
9719 	if (ipip->ipi_cmd_type == XARP_CMD && sdl->sdl_nlen != 0) {
9720 		ipif = ipif_lookup_on_name(sdl->sdl_data, sdl->sdl_nlen,
9721 		    B_FALSE, &exists, B_FALSE, ALL_ZONES, CONNP_TO_WQ(connp),
9722 		    mp, func, &err, ipst);
9723 		if (ipif == NULL)
9724 			return (err);
9725 		if (ipif->ipif_id != 0) {
9726 			ipif_refrele(ipif);
9727 			return (ENXIO);
9728 		}
9729 	} else {
9730 		/*
9731 		 * Either an SIOC[DGS]ARP or an SIOC[DGS]XARP with an sdl_nlen
9732 		 * of 0: use the IP address to find the ipif.  If the IP
9733 		 * address is an IPMP test address, ire_ftable_lookup() will
9734 		 * find the wrong ill, so we first do an ipif_lookup_addr().
9735 		 */
9736 		ipif = ipif_lookup_addr(sin->sin_addr.s_addr, NULL, ALL_ZONES,
9737 		    CONNP_TO_WQ(connp), mp, func, &err, ipst);
9738 		if (ipif == NULL) {
9739 			ire = ire_ftable_lookup(sin->sin_addr.s_addr, 0, 0,
9740 			    IRE_IF_RESOLVER, NULL, NULL, ALL_ZONES, 0, NULL,
9741 			    MATCH_IRE_TYPE, ipst);
9742 			if (ire == NULL || ((ill = ire_to_ill(ire)) == NULL)) {
9743 				if (ire != NULL)
9744 					ire_refrele(ire);
9745 				return (ENXIO);
9746 			}
9747 			ipif = ill->ill_ipif;
9748 			ipif_refhold(ipif);
9749 			ire_refrele(ire);
9750 		}
9751 	}
9752 
9753 	if (ipif->ipif_net_type != IRE_IF_RESOLVER) {
9754 		ipif_refrele(ipif);
9755 		return (ENXIO);
9756 	}
9757 
9758 	ci->ci_sin = sin;
9759 	ci->ci_ipif = ipif;
9760 	return (0);
9761 }
9762 
9763 /*
9764  * Link or unlink the illgrp on IPMP meta-interface `ill' depending on the
9765  * value of `ioccmd'.  While an illgrp is linked to an ipmp_grp_t, it is
9766  * accessible from that ipmp_grp_t, which means SIOCSLIFGROUPNAME can look it
9767  * up and thus an ill can join that illgrp.
9768  *
9769  * We use I_PLINK/I_PUNLINK to do the link/unlink operations rather than
9770  * open()/close() primarily because close() is not allowed to fail or block
9771  * forever.  On the other hand, I_PUNLINK *can* fail, and there's no reason
9772  * why anyone should ever need to I_PUNLINK an in-use IPMP stream.  To ensure
9773  * symmetric behavior (e.g., doing an I_PLINK after and I_PUNLINK undoes the
9774  * I_PUNLINK) we defer linking to I_PLINK.  Separately, we also fail attempts
9775  * to I_LINK since I_UNLINK is optional and we'd end up in an inconsistent
9776  * state if I_UNLINK didn't occur.
9777  *
9778  * Note that for each plumb/unplumb operation, we may end up here more than
9779  * once because of the way ifconfig works.  However, it's OK to link the same
9780  * illgrp more than once, or unlink an illgrp that's already unlinked.
9781  */
9782 static int
9783 ip_sioctl_plink_ipmp(ill_t *ill, int ioccmd)
9784 {
9785 	int err;
9786 	ip_stack_t *ipst = ill->ill_ipst;
9787 
9788 	ASSERT(IS_IPMP(ill));
9789 	ASSERT(IAM_WRITER_ILL(ill));
9790 
9791 	switch (ioccmd) {
9792 	case I_LINK:
9793 		return (ENOTSUP);
9794 
9795 	case I_PLINK:
9796 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
9797 		ipmp_illgrp_link_grp(ill->ill_grp, ill->ill_phyint->phyint_grp);
9798 		rw_exit(&ipst->ips_ipmp_lock);
9799 		break;
9800 
9801 	case I_PUNLINK:
9802 		/*
9803 		 * Require all UP ipifs be brought down prior to unlinking the
9804 		 * illgrp so any associated IREs (and other state) is torched.
9805 		 */
9806 		if (ill->ill_ipif_up_count + ill->ill_ipif_dup_count > 0)
9807 			return (EBUSY);
9808 
9809 		/*
9810 		 * NOTE: We hold ipmp_lock across the unlink to prevent a race
9811 		 * with an SIOCSLIFGROUPNAME request from an ill trying to
9812 		 * join this group.  Specifically: ills trying to join grab
9813 		 * ipmp_lock and bump a "pending join" counter checked by
9814 		 * ipmp_illgrp_unlink_grp().  During the unlink no new pending
9815 		 * joins can occur (since we have ipmp_lock).  Once we drop
9816 		 * ipmp_lock, subsequent SIOCSLIFGROUPNAME requests will not
9817 		 * find the illgrp (since we unlinked it) and will return
9818 		 * EAFNOSUPPORT.  This will then take them back through the
9819 		 * IPMP meta-interface plumbing logic in ifconfig, and thus
9820 		 * back through I_PLINK above.
9821 		 */
9822 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
9823 		err = ipmp_illgrp_unlink_grp(ill->ill_grp);
9824 		rw_exit(&ipst->ips_ipmp_lock);
9825 		return (err);
9826 	default:
9827 		break;
9828 	}
9829 	return (0);
9830 }
9831 
9832 /*
9833  * Do I_PLINK/I_LINK or I_PUNLINK/I_UNLINK with consistency checks and also
9834  * atomically set/clear the muxids. Also complete the ioctl by acking or
9835  * naking it.  Note that the code is structured such that the link type,
9836  * whether it's persistent or not, is treated equally.  ifconfig(1M) and
9837  * its clones use the persistent link, while pppd(1M) and perhaps many
9838  * other daemons may use non-persistent link.  When combined with some
9839  * ill_t states, linking and unlinking lower streams may be used as
9840  * indicators of dynamic re-plumbing events [see PSARC/1999/348].
9841  */
9842 /* ARGSUSED */
9843 void
9844 ip_sioctl_plink(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
9845 {
9846 	mblk_t		*mp1, *mp2;
9847 	struct linkblk	*li;
9848 	struct ipmx_s	*ipmxp;
9849 	ill_t		*ill;
9850 	int		ioccmd = ((struct iocblk *)mp->b_rptr)->ioc_cmd;
9851 	int		err = 0;
9852 	boolean_t	entered_ipsq = B_FALSE;
9853 	boolean_t	islink;
9854 	ip_stack_t	*ipst;
9855 
9856 	if (CONN_Q(q))
9857 		ipst = CONNQ_TO_IPST(q);
9858 	else
9859 		ipst = ILLQ_TO_IPST(q);
9860 
9861 	ASSERT(ioccmd == I_PLINK || ioccmd == I_PUNLINK ||
9862 	    ioccmd == I_LINK || ioccmd == I_UNLINK);
9863 
9864 	islink = (ioccmd == I_PLINK || ioccmd == I_LINK);
9865 
9866 	mp1 = mp->b_cont;	/* This is the linkblk info */
9867 	li = (struct linkblk *)mp1->b_rptr;
9868 
9869 	/*
9870 	 * ARP has added this special mblk, and the utility is asking us
9871 	 * to perform consistency checks, and also atomically set the
9872 	 * muxid. Ifconfig is an example.  It achieves this by using
9873 	 * /dev/arp as the mux to plink the arp stream, and pushes arp on
9874 	 * to /dev/udp[6] stream for use as the mux when plinking the IP
9875 	 * stream. SIOCSLIFMUXID is not required.  See ifconfig.c, arp.c
9876 	 * and other comments in this routine for more details.
9877 	 */
9878 	mp2 = mp1->b_cont;	/* This is added by ARP */
9879 
9880 	/*
9881 	 * If I_{P}LINK/I_{P}UNLINK is issued by a utility other than
9882 	 * ifconfig which didn't push ARP on top of the dummy mux, we won't
9883 	 * get the special mblk above.  For backward compatibility, we
9884 	 * request ip_sioctl_plink_ipmod() to skip the consistency checks.
9885 	 * The utility will use SIOCSLIFMUXID to store the muxids.  This is
9886 	 * not atomic, and can leave the streams unplumbable if the utility
9887 	 * is interrupted before it does the SIOCSLIFMUXID.
9888 	 */
9889 	if (mp2 == NULL) {
9890 		err = ip_sioctl_plink_ipmod(ipsq, q, mp, ioccmd, li, B_FALSE);
9891 		if (err == EINPROGRESS)
9892 			return;
9893 		goto done;
9894 	}
9895 
9896 	/*
9897 	 * This is an I_{P}LINK sent down by ifconfig through the ARP module;
9898 	 * ARP has appended this last mblk to tell us whether the lower stream
9899 	 * is an arp-dev stream or an IP module stream.
9900 	 */
9901 	ipmxp = (struct ipmx_s *)mp2->b_rptr;
9902 	if (ipmxp->ipmx_arpdev_stream) {
9903 		/*
9904 		 * The lower stream is the arp-dev stream.
9905 		 */
9906 		ill = ill_lookup_on_name(ipmxp->ipmx_name, B_FALSE, B_FALSE,
9907 		    q, mp, ip_sioctl_plink, &err, NULL, ipst);
9908 		if (ill == NULL) {
9909 			if (err == EINPROGRESS)
9910 				return;
9911 			err = EINVAL;
9912 			goto done;
9913 		}
9914 
9915 		if (ipsq == NULL) {
9916 			ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_sioctl_plink,
9917 			    NEW_OP, B_FALSE);
9918 			if (ipsq == NULL) {
9919 				ill_refrele(ill);
9920 				return;
9921 			}
9922 			entered_ipsq = B_TRUE;
9923 		}
9924 		ASSERT(IAM_WRITER_ILL(ill));
9925 		ill_refrele(ill);
9926 
9927 		/*
9928 		 * To ensure consistency between IP and ARP, the following
9929 		 * LIFO scheme is used in plink/punlink. (IP first, ARP last).
9930 		 * This is because the muxid's are stored in the IP stream on
9931 		 * the ill.
9932 		 *
9933 		 * I_{P}LINK: ifconfig plinks the IP stream before plinking
9934 		 * the ARP stream. On an arp-dev stream, IP checks that it is
9935 		 * not yet plinked, and it also checks that the corresponding
9936 		 * IP stream is already plinked.
9937 		 *
9938 		 * I_{P}UNLINK: ifconfig punlinks the ARP stream before
9939 		 * punlinking the IP stream. IP does not allow punlink of the
9940 		 * IP stream unless the arp stream has been punlinked.
9941 		 */
9942 		if ((islink &&
9943 		    (ill->ill_arp_muxid != 0 || ill->ill_ip_muxid == 0)) ||
9944 		    (!islink && ill->ill_arp_muxid != li->l_index)) {
9945 			err = EINVAL;
9946 			goto done;
9947 		}
9948 
9949 		if (IS_IPMP(ill) &&
9950 		    (err = ip_sioctl_plink_ipmp(ill, ioccmd)) != 0)
9951 			goto done;
9952 
9953 		ill->ill_arp_muxid = islink ? li->l_index : 0;
9954 	} else {
9955 		/*
9956 		 * The lower stream is probably an IP module stream.  Do
9957 		 * consistency checking.
9958 		 */
9959 		err = ip_sioctl_plink_ipmod(ipsq, q, mp, ioccmd, li, B_TRUE);
9960 		if (err == EINPROGRESS)
9961 			return;
9962 	}
9963 done:
9964 	if (err == 0)
9965 		miocack(q, mp, 0, 0);
9966 	else
9967 		miocnak(q, mp, 0, err);
9968 
9969 	/* Conn was refheld in ip_sioctl_copyin_setup */
9970 	if (CONN_Q(q))
9971 		CONN_OPER_PENDING_DONE(Q_TO_CONN(q));
9972 	if (entered_ipsq)
9973 		ipsq_exit(ipsq);
9974 }
9975 
9976 /*
9977  * Process I_{P}LINK and I_{P}UNLINK requests named by `ioccmd' and pointed to
9978  * by `mp' and `li' for the IP module stream (if li->q_bot is in fact an IP
9979  * module stream).  If `doconsist' is set, then do the extended consistency
9980  * checks requested by ifconfig(1M) and (atomically) set ill_ip_muxid here.
9981  * Returns zero on success, EINPROGRESS if the operation is still pending, or
9982  * an error code on failure.
9983  */
9984 static int
9985 ip_sioctl_plink_ipmod(ipsq_t *ipsq, queue_t *q, mblk_t *mp, int ioccmd,
9986     struct linkblk *li, boolean_t doconsist)
9987 {
9988 	int		err = 0;
9989 	ill_t  		*ill;
9990 	queue_t		*ipwq, *dwq;
9991 	const char	*name;
9992 	struct qinit	*qinfo;
9993 	boolean_t	islink = (ioccmd == I_PLINK || ioccmd == I_LINK);
9994 	boolean_t	entered_ipsq = B_FALSE;
9995 
9996 	/*
9997 	 * Walk the lower stream to verify it's the IP module stream.
9998 	 * The IP module is identified by its name, wput function,
9999 	 * and non-NULL q_next.  STREAMS ensures that the lower stream
10000 	 * (li->l_qbot) will not vanish until this ioctl completes.
10001 	 */
10002 	for (ipwq = li->l_qbot; ipwq != NULL; ipwq = ipwq->q_next) {
10003 		qinfo = ipwq->q_qinfo;
10004 		name = qinfo->qi_minfo->mi_idname;
10005 		if (name != NULL && strcmp(name, ip_mod_info.mi_idname) == 0 &&
10006 		    qinfo->qi_putp != (pfi_t)ip_lwput && ipwq->q_next != NULL) {
10007 			break;
10008 		}
10009 	}
10010 
10011 	/*
10012 	 * If this isn't an IP module stream, bail.
10013 	 */
10014 	if (ipwq == NULL)
10015 		return (0);
10016 
10017 	ill = ipwq->q_ptr;
10018 	ASSERT(ill != NULL);
10019 
10020 	if (ipsq == NULL) {
10021 		ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_sioctl_plink,
10022 		    NEW_OP, B_FALSE);
10023 		if (ipsq == NULL)
10024 			return (EINPROGRESS);
10025 		entered_ipsq = B_TRUE;
10026 	}
10027 	ASSERT(IAM_WRITER_ILL(ill));
10028 
10029 	if (doconsist) {
10030 		/*
10031 		 * Consistency checking requires that I_{P}LINK occurs
10032 		 * prior to setting ill_ip_muxid, and that I_{P}UNLINK
10033 		 * occurs prior to clearing ill_arp_muxid.
10034 		 */
10035 		if ((islink && ill->ill_ip_muxid != 0) ||
10036 		    (!islink && ill->ill_arp_muxid != 0)) {
10037 			err = EINVAL;
10038 			goto done;
10039 		}
10040 	}
10041 
10042 	if (IS_IPMP(ill) && (err = ip_sioctl_plink_ipmp(ill, ioccmd)) != 0)
10043 		goto done;
10044 
10045 	/*
10046 	 * As part of I_{P}LINKing, stash the number of downstream modules and
10047 	 * the read queue of the module immediately below IP in the ill.
10048 	 * These are used during the capability negotiation below.
10049 	 */
10050 	ill->ill_lmod_rq = NULL;
10051 	ill->ill_lmod_cnt = 0;
10052 	if (islink && ((dwq = ipwq->q_next) != NULL)) {
10053 		ill->ill_lmod_rq = RD(dwq);
10054 		for (; dwq != NULL; dwq = dwq->q_next)
10055 			ill->ill_lmod_cnt++;
10056 	}
10057 
10058 	if (doconsist)
10059 		ill->ill_ip_muxid = islink ? li->l_index : 0;
10060 
10061 	/*
10062 	 * Mark the ipsq busy until the capability operations initiated below
10063 	 * complete. The PLINK/UNLINK ioctl itself completes when our caller
10064 	 * returns, but the capability operation may complete asynchronously
10065 	 * much later.
10066 	 */
10067 	ipsq_current_start(ipsq, ill->ill_ipif, ioccmd);
10068 	/*
10069 	 * If there's at least one up ipif on this ill, then we're bound to
10070 	 * the underlying driver via DLPI.  In that case, renegotiate
10071 	 * capabilities to account for any possible change in modules
10072 	 * interposed between IP and the driver.
10073 	 */
10074 	if (ill->ill_ipif_up_count > 0) {
10075 		if (islink)
10076 			ill_capability_probe(ill);
10077 		else
10078 			ill_capability_reset(ill, B_FALSE);
10079 	}
10080 	ipsq_current_finish(ipsq);
10081 done:
10082 	if (entered_ipsq)
10083 		ipsq_exit(ipsq);
10084 
10085 	return (err);
10086 }
10087 
10088 /*
10089  * Search the ioctl command in the ioctl tables and return a pointer
10090  * to the ioctl command information. The ioctl command tables are
10091  * static and fully populated at compile time.
10092  */
10093 ip_ioctl_cmd_t *
10094 ip_sioctl_lookup(int ioc_cmd)
10095 {
10096 	int index;
10097 	ip_ioctl_cmd_t *ipip;
10098 	ip_ioctl_cmd_t *ipip_end;
10099 
10100 	if (ioc_cmd == IPI_DONTCARE)
10101 		return (NULL);
10102 
10103 	/*
10104 	 * Do a 2 step search. First search the indexed table
10105 	 * based on the least significant byte of the ioctl cmd.
10106 	 * If we don't find a match, then search the misc table
10107 	 * serially.
10108 	 */
10109 	index = ioc_cmd & 0xFF;
10110 	if (index < ip_ndx_ioctl_count) {
10111 		ipip = &ip_ndx_ioctl_table[index];
10112 		if (ipip->ipi_cmd == ioc_cmd) {
10113 			/* Found a match in the ndx table */
10114 			return (ipip);
10115 		}
10116 	}
10117 
10118 	/* Search the misc table */
10119 	ipip_end = &ip_misc_ioctl_table[ip_misc_ioctl_count];
10120 	for (ipip = ip_misc_ioctl_table; ipip < ipip_end; ipip++) {
10121 		if (ipip->ipi_cmd == ioc_cmd)
10122 			/* Found a match in the misc table */
10123 			return (ipip);
10124 	}
10125 
10126 	return (NULL);
10127 }
10128 
10129 /*
10130  * Wrapper function for resuming deferred ioctl processing
10131  * Used for SIOCGDSTINFO, SIOCGIP6ADDRPOLICY, SIOCGMSFILTER,
10132  * SIOCSMSFILTER, SIOCGIPMSFILTER, and SIOCSIPMSFILTER currently.
10133  */
10134 /* ARGSUSED */
10135 void
10136 ip_sioctl_copyin_resume(ipsq_t *dummy_ipsq, queue_t *q, mblk_t *mp,
10137     void *dummy_arg)
10138 {
10139 	ip_sioctl_copyin_setup(q, mp);
10140 }
10141 
10142 /*
10143  * ip_sioctl_copyin_setup is called by ip_wput with any M_IOCTL message
10144  * that arrives.  Most of the IOCTLs are "socket" IOCTLs which we handle
10145  * in either I_STR or TRANSPARENT form, using the mi_copy facility.
10146  * We establish here the size of the block to be copied in.  mi_copyin
10147  * arranges for this to happen, an processing continues in ip_wput with
10148  * an M_IOCDATA message.
10149  */
10150 void
10151 ip_sioctl_copyin_setup(queue_t *q, mblk_t *mp)
10152 {
10153 	int	copyin_size;
10154 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
10155 	ip_ioctl_cmd_t *ipip;
10156 	cred_t *cr;
10157 	ip_stack_t	*ipst;
10158 
10159 	if (CONN_Q(q))
10160 		ipst = CONNQ_TO_IPST(q);
10161 	else
10162 		ipst = ILLQ_TO_IPST(q);
10163 
10164 	ipip = ip_sioctl_lookup(iocp->ioc_cmd);
10165 	if (ipip == NULL) {
10166 		/*
10167 		 * The ioctl is not one we understand or own.
10168 		 * Pass it along to be processed down stream,
10169 		 * if this is a module instance of IP, else nak
10170 		 * the ioctl.
10171 		 */
10172 		if (q->q_next == NULL) {
10173 			goto nak;
10174 		} else {
10175 			putnext(q, mp);
10176 			return;
10177 		}
10178 	}
10179 
10180 	/*
10181 	 * If this is deferred, then we will do all the checks when we
10182 	 * come back.
10183 	 */
10184 	if ((iocp->ioc_cmd == SIOCGDSTINFO ||
10185 	    iocp->ioc_cmd == SIOCGIP6ADDRPOLICY) && !ip6_asp_can_lookup(ipst)) {
10186 		ip6_asp_pending_op(q, mp, ip_sioctl_copyin_resume);
10187 		return;
10188 	}
10189 
10190 	/*
10191 	 * Only allow a very small subset of IP ioctls on this stream if
10192 	 * IP is a module and not a driver. Allowing ioctls to be processed
10193 	 * in this case may cause assert failures or data corruption.
10194 	 * Typically G[L]IFFLAGS, SLIFNAME/IF_UNITSEL are the only few
10195 	 * ioctls allowed on an IP module stream, after which this stream
10196 	 * normally becomes a multiplexor (at which time the stream head
10197 	 * will fail all ioctls).
10198 	 */
10199 	if ((q->q_next != NULL) && !(ipip->ipi_flags & IPI_MODOK)) {
10200 		if (ipip->ipi_flags & IPI_PASS_DOWN) {
10201 			/*
10202 			 * Pass common Streams ioctls which the IP
10203 			 * module does not own or consume along to
10204 			 * be processed down stream.
10205 			 */
10206 			putnext(q, mp);
10207 			return;
10208 		} else {
10209 			goto nak;
10210 		}
10211 	}
10212 
10213 	/* Make sure we have ioctl data to process. */
10214 	if (mp->b_cont == NULL && !(ipip->ipi_flags & IPI_NULL_BCONT))
10215 		goto nak;
10216 
10217 	/*
10218 	 * Prefer dblk credential over ioctl credential; some synthesized
10219 	 * ioctls have kcred set because there's no way to crhold()
10220 	 * a credential in some contexts.  (ioc_cr is not crfree() by
10221 	 * the framework; the caller of ioctl needs to hold the reference
10222 	 * for the duration of the call).
10223 	 */
10224 	cr = msg_getcred(mp, NULL);
10225 	if (cr == NULL)
10226 		cr = iocp->ioc_cr;
10227 
10228 	/* Make sure normal users don't send down privileged ioctls */
10229 	if ((ipip->ipi_flags & IPI_PRIV) &&
10230 	    (cr != NULL) && secpolicy_ip_config(cr, B_TRUE) != 0) {
10231 		/* We checked the privilege earlier but log it here */
10232 		miocnak(q, mp, 0, secpolicy_ip_config(cr, B_FALSE));
10233 		return;
10234 	}
10235 
10236 	/*
10237 	 * The ioctl command tables can only encode fixed length
10238 	 * ioctl data. If the length is variable, the table will
10239 	 * encode the length as zero. Such special cases are handled
10240 	 * below in the switch.
10241 	 */
10242 	if (ipip->ipi_copyin_size != 0) {
10243 		mi_copyin(q, mp, NULL, ipip->ipi_copyin_size);
10244 		return;
10245 	}
10246 
10247 	switch (iocp->ioc_cmd) {
10248 	case O_SIOCGIFCONF:
10249 	case SIOCGIFCONF:
10250 		/*
10251 		 * This IOCTL is hilarious.  See comments in
10252 		 * ip_sioctl_get_ifconf for the story.
10253 		 */
10254 		if (iocp->ioc_count == TRANSPARENT)
10255 			copyin_size = SIZEOF_STRUCT(ifconf,
10256 			    iocp->ioc_flag);
10257 		else
10258 			copyin_size = iocp->ioc_count;
10259 		mi_copyin(q, mp, NULL, copyin_size);
10260 		return;
10261 
10262 	case O_SIOCGLIFCONF:
10263 	case SIOCGLIFCONF:
10264 		copyin_size = SIZEOF_STRUCT(lifconf, iocp->ioc_flag);
10265 		mi_copyin(q, mp, NULL, copyin_size);
10266 		return;
10267 
10268 	case SIOCGLIFSRCOF:
10269 		copyin_size = SIZEOF_STRUCT(lifsrcof, iocp->ioc_flag);
10270 		mi_copyin(q, mp, NULL, copyin_size);
10271 		return;
10272 	case SIOCGIP6ADDRPOLICY:
10273 		ip_sioctl_ip6addrpolicy(q, mp);
10274 		ip6_asp_table_refrele(ipst);
10275 		return;
10276 
10277 	case SIOCSIP6ADDRPOLICY:
10278 		ip_sioctl_ip6addrpolicy(q, mp);
10279 		return;
10280 
10281 	case SIOCGDSTINFO:
10282 		ip_sioctl_dstinfo(q, mp);
10283 		ip6_asp_table_refrele(ipst);
10284 		return;
10285 
10286 	case I_PLINK:
10287 	case I_PUNLINK:
10288 	case I_LINK:
10289 	case I_UNLINK:
10290 		/*
10291 		 * We treat non-persistent link similarly as the persistent
10292 		 * link case, in terms of plumbing/unplumbing, as well as
10293 		 * dynamic re-plumbing events indicator.  See comments
10294 		 * in ip_sioctl_plink() for more.
10295 		 *
10296 		 * Request can be enqueued in the 'ipsq' while waiting
10297 		 * to become exclusive. So bump up the conn ref.
10298 		 */
10299 		if (CONN_Q(q))
10300 			CONN_INC_REF(Q_TO_CONN(q));
10301 		ip_sioctl_plink(NULL, q, mp, NULL);
10302 		return;
10303 
10304 	case ND_GET:
10305 	case ND_SET:
10306 		/*
10307 		 * Use of the nd table requires holding the reader lock.
10308 		 * Modifying the nd table thru nd_load/nd_unload requires
10309 		 * the writer lock.
10310 		 */
10311 		rw_enter(&ipst->ips_ip_g_nd_lock, RW_READER);
10312 		if (nd_getset(q, ipst->ips_ip_g_nd, mp)) {
10313 			rw_exit(&ipst->ips_ip_g_nd_lock);
10314 
10315 			if (iocp->ioc_error)
10316 				iocp->ioc_count = 0;
10317 			mp->b_datap->db_type = M_IOCACK;
10318 			qreply(q, mp);
10319 			return;
10320 		}
10321 		rw_exit(&ipst->ips_ip_g_nd_lock);
10322 		/*
10323 		 * We don't understand this subioctl of ND_GET / ND_SET.
10324 		 * Maybe intended for some driver / module below us
10325 		 */
10326 		if (q->q_next) {
10327 			putnext(q, mp);
10328 		} else {
10329 			iocp->ioc_error = ENOENT;
10330 			mp->b_datap->db_type = M_IOCNAK;
10331 			iocp->ioc_count = 0;
10332 			qreply(q, mp);
10333 		}
10334 		return;
10335 
10336 	case IP_IOCTL:
10337 		ip_wput_ioctl(q, mp);
10338 		return;
10339 	default:
10340 		cmn_err(CE_PANIC, "should not happen ");
10341 	}
10342 nak:
10343 	if (mp->b_cont != NULL) {
10344 		freemsg(mp->b_cont);
10345 		mp->b_cont = NULL;
10346 	}
10347 	iocp->ioc_error = EINVAL;
10348 	mp->b_datap->db_type = M_IOCNAK;
10349 	iocp->ioc_count = 0;
10350 	qreply(q, mp);
10351 }
10352 
10353 /* ip_wput hands off ARP IOCTL responses to us */
10354 /* ARGSUSED3 */
10355 void
10356 ip_sioctl_iocack(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
10357 {
10358 	struct arpreq *ar;
10359 	struct xarpreq *xar;
10360 	area_t	*area;
10361 	mblk_t	*area_mp;
10362 	struct iocblk *iocp;
10363 	mblk_t	*orig_ioc_mp, *tmp;
10364 	struct iocblk	*orig_iocp;
10365 	ill_t *ill;
10366 	conn_t *connp = NULL;
10367 	mblk_t *pending_mp;
10368 	int x_arp_ioctl = B_FALSE, ifx_arp_ioctl = B_FALSE;
10369 	int *flagsp;
10370 	char *storage = NULL;
10371 	sin_t *sin;
10372 	ipaddr_t addr;
10373 	int err;
10374 	ip_stack_t *ipst;
10375 
10376 	ASSERT(ipsq == NULL || IAM_WRITER_IPSQ(ipsq));
10377 	ill = q->q_ptr;
10378 	ASSERT(ill != NULL);
10379 	ipst = ill->ill_ipst;
10380 
10381 	/*
10382 	 * We should get back from ARP a packet chain that looks like:
10383 	 * M_IOCACK-->ARP_op_MBLK-->ORIG_M_IOCTL-->MI_COPY_MBLK-->[X]ARPREQ_MBLK
10384 	 */
10385 	if (!(area_mp = mp->b_cont) ||
10386 	    (area_mp->b_wptr - area_mp->b_rptr) < sizeof (ip_sock_ar_t) ||
10387 	    !(orig_ioc_mp = area_mp->b_cont) ||
10388 	    !orig_ioc_mp->b_cont || !orig_ioc_mp->b_cont->b_cont) {
10389 		freemsg(mp);
10390 		return;
10391 	}
10392 
10393 	orig_iocp = (struct iocblk *)orig_ioc_mp->b_rptr;
10394 
10395 	tmp = (orig_ioc_mp->b_cont)->b_cont;
10396 	if ((orig_iocp->ioc_cmd == SIOCGXARP) ||
10397 	    (orig_iocp->ioc_cmd == SIOCSXARP) ||
10398 	    (orig_iocp->ioc_cmd == SIOCDXARP)) {
10399 		x_arp_ioctl = B_TRUE;
10400 		xar = (struct xarpreq *)tmp->b_rptr;
10401 		sin = (sin_t *)&xar->xarp_pa;
10402 		flagsp = &xar->xarp_flags;
10403 		storage = xar->xarp_ha.sdl_data;
10404 		if (xar->xarp_ha.sdl_nlen != 0)
10405 			ifx_arp_ioctl = B_TRUE;
10406 	} else {
10407 		ar = (struct arpreq *)tmp->b_rptr;
10408 		sin = (sin_t *)&ar->arp_pa;
10409 		flagsp = &ar->arp_flags;
10410 		storage = ar->arp_ha.sa_data;
10411 	}
10412 
10413 	iocp = (struct iocblk *)mp->b_rptr;
10414 
10415 	/*
10416 	 * Find the pending message; if we're exclusive, it'll be on our IPSQ.
10417 	 * Otherwise, we can find it from our ioc_id.
10418 	 */
10419 	if (ipsq != NULL)
10420 		pending_mp = ipsq_pending_mp_get(ipsq, &connp);
10421 	else
10422 		pending_mp = ill_pending_mp_get(ill, &connp, iocp->ioc_id);
10423 
10424 	if (pending_mp == NULL) {
10425 		ASSERT(connp == NULL);
10426 		inet_freemsg(mp);
10427 		return;
10428 	}
10429 	ASSERT(connp != NULL);
10430 	q = CONNP_TO_WQ(connp);
10431 
10432 	/* Uncouple the internally generated IOCTL from the original one */
10433 	area = (area_t *)area_mp->b_rptr;
10434 	area_mp->b_cont = NULL;
10435 
10436 	/*
10437 	 * Restore the b_next and b_prev used by mi code. This is needed
10438 	 * to complete the ioctl using mi* functions. We stored them in
10439 	 * the pending mp prior to sending the request to ARP.
10440 	 */
10441 	orig_ioc_mp->b_cont->b_next = pending_mp->b_cont->b_next;
10442 	orig_ioc_mp->b_cont->b_prev = pending_mp->b_cont->b_prev;
10443 	inet_freemsg(pending_mp);
10444 
10445 	/*
10446 	 * We're done if there was an error or if this is not an SIOCG{X}ARP
10447 	 * Catch the case where there is an IRE_CACHE by no entry in the
10448 	 * arp table.
10449 	 */
10450 	addr = sin->sin_addr.s_addr;
10451 	if (iocp->ioc_error && iocp->ioc_cmd == AR_ENTRY_SQUERY) {
10452 		ire_t			*ire;
10453 		dl_unitdata_req_t	*dlup;
10454 		mblk_t			*llmp;
10455 		int			addr_len;
10456 		ill_t			*ipsqill = NULL;
10457 
10458 		if (ifx_arp_ioctl) {
10459 			/*
10460 			 * There's no need to lookup the ill, since
10461 			 * we've already done that when we started
10462 			 * processing the ioctl and sent the message
10463 			 * to ARP on that ill.  So use the ill that
10464 			 * is stored in q->q_ptr.
10465 			 */
10466 			ipsqill = ill;
10467 			ire = ire_ctable_lookup(addr, 0, IRE_CACHE,
10468 			    ipsqill->ill_ipif, ALL_ZONES,
10469 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ILL, ipst);
10470 		} else {
10471 			ire = ire_ctable_lookup(addr, 0, IRE_CACHE,
10472 			    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
10473 			if (ire != NULL)
10474 				ipsqill = ire_to_ill(ire);
10475 		}
10476 
10477 		if ((x_arp_ioctl) && (ipsqill != NULL))
10478 			storage += ill_xarp_info(&xar->xarp_ha, ipsqill);
10479 
10480 		if (ire != NULL) {
10481 			/*
10482 			 * Since the ire obtained from cachetable is used for
10483 			 * mac addr copying below, treat an incomplete ire as if
10484 			 * as if we never found it.
10485 			 */
10486 			if (ire->ire_nce != NULL &&
10487 			    ire->ire_nce->nce_state != ND_REACHABLE) {
10488 				ire_refrele(ire);
10489 				ire = NULL;
10490 				ipsqill = NULL;
10491 				goto errack;
10492 			}
10493 			*flagsp = ATF_INUSE;
10494 			llmp = (ire->ire_nce != NULL ?
10495 			    ire->ire_nce->nce_res_mp : NULL);
10496 			if (llmp != NULL && ipsqill != NULL) {
10497 				uchar_t *macaddr;
10498 
10499 				addr_len = ipsqill->ill_phys_addr_length;
10500 				if (x_arp_ioctl && ((addr_len +
10501 				    ipsqill->ill_name_length) >
10502 				    sizeof (xar->xarp_ha.sdl_data))) {
10503 					ire_refrele(ire);
10504 					freemsg(mp);
10505 					ip_ioctl_finish(q, orig_ioc_mp,
10506 					    EINVAL, NO_COPYOUT, ipsq);
10507 					return;
10508 				}
10509 				*flagsp |= ATF_COM;
10510 				dlup = (dl_unitdata_req_t *)llmp->b_rptr;
10511 				if (ipsqill->ill_sap_length < 0)
10512 					macaddr = llmp->b_rptr +
10513 					    dlup->dl_dest_addr_offset;
10514 				else
10515 					macaddr = llmp->b_rptr +
10516 					    dlup->dl_dest_addr_offset +
10517 					    ipsqill->ill_sap_length;
10518 				/*
10519 				 * For SIOCGARP, MAC address length
10520 				 * validation has already been done
10521 				 * before the ioctl was issued to ARP to
10522 				 * allow it to progress only on 6 byte
10523 				 * addressable (ethernet like) media. Thus
10524 				 * the mac address copying can not overwrite
10525 				 * the sa_data area below.
10526 				 */
10527 				bcopy(macaddr, storage, addr_len);
10528 			}
10529 			/* Ditch the internal IOCTL. */
10530 			freemsg(mp);
10531 			ire_refrele(ire);
10532 			ip_ioctl_finish(q, orig_ioc_mp, 0, COPYOUT, ipsq);
10533 			return;
10534 		}
10535 	}
10536 
10537 	/*
10538 	 * If this was a failed AR_ENTRY_ADD or a successful AR_ENTRY_DELETE
10539 	 * on the IPMP meta-interface, ensure any ARP entries added in
10540 	 * ip_sioctl_arp() are deleted.
10541 	 */
10542 	if (IS_IPMP(ill) &&
10543 	    ((iocp->ioc_error != 0 && iocp->ioc_cmd == AR_ENTRY_ADD) ||
10544 	    ((iocp->ioc_error == 0 && iocp->ioc_cmd == AR_ENTRY_DELETE)))) {
10545 		ipmp_illgrp_t *illg = ill->ill_grp;
10546 		ipmp_arpent_t *entp;
10547 
10548 		if ((entp = ipmp_illgrp_lookup_arpent(illg, &addr)) != NULL)
10549 			ipmp_illgrp_destroy_arpent(illg, entp);
10550 	}
10551 
10552 	/*
10553 	 * Delete the coresponding IRE_CACHE if any.
10554 	 * Reset the error if there was one (in case there was no entry
10555 	 * in arp.)
10556 	 */
10557 	if (iocp->ioc_cmd == AR_ENTRY_DELETE) {
10558 		ipif_t *ipintf = NULL;
10559 
10560 		if (ifx_arp_ioctl) {
10561 			/*
10562 			 * There's no need to lookup the ill, since
10563 			 * we've already done that when we started
10564 			 * processing the ioctl and sent the message
10565 			 * to ARP on that ill.  So use the ill that
10566 			 * is stored in q->q_ptr.
10567 			 */
10568 			ipintf = ill->ill_ipif;
10569 		}
10570 		if (ip_ire_clookup_and_delete(addr, ipintf, ipst)) {
10571 			/*
10572 			 * The address in "addr" may be an entry for a
10573 			 * router. If that's true, then any off-net
10574 			 * IRE_CACHE entries that go through the router
10575 			 * with address "addr" must be clobbered. Use
10576 			 * ire_walk to achieve this goal.
10577 			 */
10578 			if (ifx_arp_ioctl)
10579 				ire_walk_ill_v4(MATCH_IRE_ILL, 0,
10580 				    ire_delete_cache_gw, (char *)&addr, ill);
10581 			else
10582 				ire_walk_v4(ire_delete_cache_gw, (char *)&addr,
10583 				    ALL_ZONES, ipst);
10584 			iocp->ioc_error = 0;
10585 		}
10586 	}
10587 errack:
10588 	if (iocp->ioc_error || iocp->ioc_cmd != AR_ENTRY_SQUERY) {
10589 		err = iocp->ioc_error;
10590 		freemsg(mp);
10591 		ip_ioctl_finish(q, orig_ioc_mp, err, NO_COPYOUT, ipsq);
10592 		return;
10593 	}
10594 
10595 	/*
10596 	 * Completion of an SIOCG{X}ARP.  Translate the information from
10597 	 * the area_t into the struct {x}arpreq.
10598 	 */
10599 	if (x_arp_ioctl) {
10600 		storage += ill_xarp_info(&xar->xarp_ha, ill);
10601 		if ((ill->ill_phys_addr_length + ill->ill_name_length) >
10602 		    sizeof (xar->xarp_ha.sdl_data)) {
10603 			freemsg(mp);
10604 			ip_ioctl_finish(q, orig_ioc_mp, EINVAL, NO_COPYOUT,
10605 			    ipsq);
10606 			return;
10607 		}
10608 	}
10609 	*flagsp = ATF_INUSE;
10610 	if (area->area_flags & ACE_F_PERMANENT)
10611 		*flagsp |= ATF_PERM;
10612 	if (area->area_flags & ACE_F_PUBLISH)
10613 		*flagsp |= ATF_PUBL;
10614 	if (area->area_flags & ACE_F_AUTHORITY)
10615 		*flagsp |= ATF_AUTHORITY;
10616 	if (area->area_hw_addr_length != 0) {
10617 		*flagsp |= ATF_COM;
10618 		/*
10619 		 * For SIOCGARP, MAC address length validation has
10620 		 * already been done before the ioctl was issued to ARP
10621 		 * to allow it to progress only on 6 byte addressable
10622 		 * (ethernet like) media. Thus the mac address copying
10623 		 * can not overwrite the sa_data area below.
10624 		 */
10625 		bcopy((char *)area + area->area_hw_addr_offset,
10626 		    storage, area->area_hw_addr_length);
10627 	}
10628 
10629 	/* Ditch the internal IOCTL. */
10630 	freemsg(mp);
10631 	/* Complete the original. */
10632 	ip_ioctl_finish(q, orig_ioc_mp, 0, COPYOUT, ipsq);
10633 }
10634 
10635 /*
10636  * Create a new logical interface. If ipif_id is zero (i.e. not a logical
10637  * interface) create the next available logical interface for this
10638  * physical interface.
10639  * If ipif is NULL (i.e. the lookup didn't find one) attempt to create an
10640  * ipif with the specified name.
10641  *
10642  * If the address family is not AF_UNSPEC then set the address as well.
10643  *
10644  * If ip_sioctl_addr returns EINPROGRESS then the ioctl (the copyout)
10645  * is completed when the DL_BIND_ACK arrive in ip_rput_dlpi_writer.
10646  *
10647  * Executed as a writer on the ill.
10648  * So no lock is needed to traverse the ipif chain, or examine the
10649  * phyint flags.
10650  */
10651 /* ARGSUSED */
10652 int
10653 ip_sioctl_addif(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
10654     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
10655 {
10656 	mblk_t	*mp1;
10657 	struct lifreq *lifr;
10658 	boolean_t	isv6;
10659 	boolean_t	exists;
10660 	char 	*name;
10661 	char	*endp;
10662 	char	*cp;
10663 	int	namelen;
10664 	ipif_t	*ipif;
10665 	long	id;
10666 	ipsq_t	*ipsq;
10667 	ill_t	*ill;
10668 	sin_t	*sin;
10669 	int	err = 0;
10670 	boolean_t found_sep = B_FALSE;
10671 	conn_t	*connp;
10672 	zoneid_t zoneid;
10673 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
10674 
10675 	ASSERT(q->q_next == NULL);
10676 	ip1dbg(("ip_sioctl_addif\n"));
10677 	/* Existence of mp1 has been checked in ip_wput_nondata */
10678 	mp1 = mp->b_cont->b_cont;
10679 	/*
10680 	 * Null terminate the string to protect against buffer
10681 	 * overrun. String was generated by user code and may not
10682 	 * be trusted.
10683 	 */
10684 	lifr = (struct lifreq *)mp1->b_rptr;
10685 	lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
10686 	name = lifr->lifr_name;
10687 	ASSERT(CONN_Q(q));
10688 	connp = Q_TO_CONN(q);
10689 	isv6 = connp->conn_af_isv6;
10690 	zoneid = connp->conn_zoneid;
10691 	namelen = mi_strlen(name);
10692 	if (namelen == 0)
10693 		return (EINVAL);
10694 
10695 	exists = B_FALSE;
10696 	if ((namelen + 1 == sizeof (ipif_loopback_name)) &&
10697 	    (mi_strcmp(name, ipif_loopback_name) == 0)) {
10698 		/*
10699 		 * Allow creating lo0 using SIOCLIFADDIF.
10700 		 * can't be any other writer thread. So can pass null below
10701 		 * for the last 4 args to ipif_lookup_name.
10702 		 */
10703 		ipif = ipif_lookup_on_name(lifr->lifr_name, namelen, B_TRUE,
10704 		    &exists, isv6, zoneid, NULL, NULL, NULL, NULL, ipst);
10705 		/* Prevent any further action */
10706 		if (ipif == NULL) {
10707 			return (ENOBUFS);
10708 		} else if (!exists) {
10709 			/* We created the ipif now and as writer */
10710 			ipif_refrele(ipif);
10711 			return (0);
10712 		} else {
10713 			ill = ipif->ipif_ill;
10714 			ill_refhold(ill);
10715 			ipif_refrele(ipif);
10716 		}
10717 	} else {
10718 		/* Look for a colon in the name. */
10719 		endp = &name[namelen];
10720 		for (cp = endp; --cp > name; ) {
10721 			if (*cp == IPIF_SEPARATOR_CHAR) {
10722 				found_sep = B_TRUE;
10723 				/*
10724 				 * Reject any non-decimal aliases for plumbing
10725 				 * of logical interfaces. Aliases with leading
10726 				 * zeroes are also rejected as they introduce
10727 				 * ambiguity in the naming of the interfaces.
10728 				 * Comparing with "0" takes care of all such
10729 				 * cases.
10730 				 */
10731 				if ((strncmp("0", cp+1, 1)) == 0)
10732 					return (EINVAL);
10733 
10734 				if (ddi_strtol(cp+1, &endp, 10, &id) != 0 ||
10735 				    id <= 0 || *endp != '\0') {
10736 					return (EINVAL);
10737 				}
10738 				*cp = '\0';
10739 				break;
10740 			}
10741 		}
10742 		ill = ill_lookup_on_name(name, B_FALSE, isv6,
10743 		    CONNP_TO_WQ(connp), mp, ip_process_ioctl, &err, NULL, ipst);
10744 		if (found_sep)
10745 			*cp = IPIF_SEPARATOR_CHAR;
10746 		if (ill == NULL)
10747 			return (err);
10748 	}
10749 
10750 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_process_ioctl, NEW_OP,
10751 	    B_TRUE);
10752 
10753 	/*
10754 	 * Release the refhold due to the lookup, now that we are excl
10755 	 * or we are just returning
10756 	 */
10757 	ill_refrele(ill);
10758 
10759 	if (ipsq == NULL)
10760 		return (EINPROGRESS);
10761 
10762 	/* We are now exclusive on the IPSQ */
10763 	ASSERT(IAM_WRITER_ILL(ill));
10764 
10765 	if (found_sep) {
10766 		/* Now see if there is an IPIF with this unit number. */
10767 		for (ipif = ill->ill_ipif; ipif != NULL;
10768 		    ipif = ipif->ipif_next) {
10769 			if (ipif->ipif_id == id) {
10770 				err = EEXIST;
10771 				goto done;
10772 			}
10773 		}
10774 	}
10775 
10776 	/*
10777 	 * We use IRE_LOCAL for lo0:1 etc. for "receive only" use
10778 	 * of lo0.  Plumbing for lo0:0 happens in ipif_lookup_on_name()
10779 	 * instead.
10780 	 */
10781 	if ((ipif = ipif_allocate(ill, found_sep ? id : -1, IRE_LOCAL,
10782 	    B_TRUE, B_TRUE)) == NULL) {
10783 		err = ENOBUFS;
10784 		goto done;
10785 	}
10786 
10787 	/* Return created name with ioctl */
10788 	(void) sprintf(lifr->lifr_name, "%s%c%d", ill->ill_name,
10789 	    IPIF_SEPARATOR_CHAR, ipif->ipif_id);
10790 	ip1dbg(("created %s\n", lifr->lifr_name));
10791 
10792 	/* Set address */
10793 	sin = (sin_t *)&lifr->lifr_addr;
10794 	if (sin->sin_family != AF_UNSPEC) {
10795 		err = ip_sioctl_addr(ipif, sin, q, mp,
10796 		    &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], lifr);
10797 	}
10798 
10799 done:
10800 	ipsq_exit(ipsq);
10801 	return (err);
10802 }
10803 
10804 /*
10805  * Remove an existing logical interface. If ipif_id is zero (i.e. not a logical
10806  * interface) delete it based on the IP address (on this physical interface).
10807  * Otherwise delete it based on the ipif_id.
10808  * Also, special handling to allow a removeif of lo0.
10809  */
10810 /* ARGSUSED */
10811 int
10812 ip_sioctl_removeif(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10813     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
10814 {
10815 	conn_t		*connp;
10816 	ill_t		*ill = ipif->ipif_ill;
10817 	boolean_t	 success;
10818 	ip_stack_t	*ipst;
10819 
10820 	ipst = CONNQ_TO_IPST(q);
10821 
10822 	ASSERT(q->q_next == NULL);
10823 	ip1dbg(("ip_sioctl_remove_if(%s:%u %p)\n",
10824 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10825 	ASSERT(IAM_WRITER_IPIF(ipif));
10826 
10827 	connp = Q_TO_CONN(q);
10828 	/*
10829 	 * Special case for unplumbing lo0 (the loopback physical interface).
10830 	 * If unplumbing lo0, the incoming address structure has been
10831 	 * initialized to all zeros. When unplumbing lo0, all its logical
10832 	 * interfaces must be removed too.
10833 	 *
10834 	 * Note that this interface may be called to remove a specific
10835 	 * loopback logical interface (eg, lo0:1). But in that case
10836 	 * ipif->ipif_id != 0 so that the code path for that case is the
10837 	 * same as any other interface (meaning it skips the code directly
10838 	 * below).
10839 	 */
10840 	if (ipif->ipif_id == 0 && ipif->ipif_net_type == IRE_LOOPBACK) {
10841 		if (sin->sin_family == AF_UNSPEC &&
10842 		    (IN6_IS_ADDR_UNSPECIFIED(&((sin6_t *)sin)->sin6_addr))) {
10843 			/*
10844 			 * Mark it condemned. No new ref. will be made to ill.
10845 			 */
10846 			mutex_enter(&ill->ill_lock);
10847 			ill->ill_state_flags |= ILL_CONDEMNED;
10848 			for (ipif = ill->ill_ipif; ipif != NULL;
10849 			    ipif = ipif->ipif_next) {
10850 				ipif->ipif_state_flags |= IPIF_CONDEMNED;
10851 			}
10852 			mutex_exit(&ill->ill_lock);
10853 
10854 			ipif = ill->ill_ipif;
10855 			/* unplumb the loopback interface */
10856 			ill_delete(ill);
10857 			mutex_enter(&connp->conn_lock);
10858 			mutex_enter(&ill->ill_lock);
10859 
10860 			/* Are any references to this ill active */
10861 			if (ill_is_freeable(ill)) {
10862 				mutex_exit(&ill->ill_lock);
10863 				mutex_exit(&connp->conn_lock);
10864 				ill_delete_tail(ill);
10865 				mi_free(ill);
10866 				return (0);
10867 			}
10868 			success = ipsq_pending_mp_add(connp, ipif,
10869 			    CONNP_TO_WQ(connp), mp, ILL_FREE);
10870 			mutex_exit(&connp->conn_lock);
10871 			mutex_exit(&ill->ill_lock);
10872 			if (success)
10873 				return (EINPROGRESS);
10874 			else
10875 				return (EINTR);
10876 		}
10877 	}
10878 
10879 	if (ipif->ipif_id == 0) {
10880 		ipsq_t *ipsq;
10881 
10882 		/* Find based on address */
10883 		if (ipif->ipif_isv6) {
10884 			sin6_t *sin6;
10885 
10886 			if (sin->sin_family != AF_INET6)
10887 				return (EAFNOSUPPORT);
10888 
10889 			sin6 = (sin6_t *)sin;
10890 			/* We are a writer, so we should be able to lookup */
10891 			ipif = ipif_lookup_addr_exact_v6(&sin6->sin6_addr, ill,
10892 			    ipst);
10893 		} else {
10894 			if (sin->sin_family != AF_INET)
10895 				return (EAFNOSUPPORT);
10896 
10897 			/* We are a writer, so we should be able to lookup */
10898 			ipif = ipif_lookup_addr_exact(sin->sin_addr.s_addr, ill,
10899 			    ipst);
10900 		}
10901 		if (ipif == NULL) {
10902 			return (EADDRNOTAVAIL);
10903 		}
10904 
10905 		/*
10906 		 * It is possible for a user to send an SIOCLIFREMOVEIF with
10907 		 * lifr_name of the physical interface but with an ip address
10908 		 * lifr_addr of a logical interface plumbed over it.
10909 		 * So update ipx_current_ipif now that ipif points to the
10910 		 * correct one.
10911 		 */
10912 		ipsq = ipif->ipif_ill->ill_phyint->phyint_ipsq;
10913 		ipsq->ipsq_xop->ipx_current_ipif = ipif;
10914 
10915 		/* This is a writer */
10916 		ipif_refrele(ipif);
10917 	}
10918 
10919 	/*
10920 	 * Can not delete instance zero since it is tied to the ill.
10921 	 */
10922 	if (ipif->ipif_id == 0)
10923 		return (EBUSY);
10924 
10925 	mutex_enter(&ill->ill_lock);
10926 	ipif->ipif_state_flags |= IPIF_CONDEMNED;
10927 	mutex_exit(&ill->ill_lock);
10928 
10929 	ipif_free(ipif);
10930 
10931 	mutex_enter(&connp->conn_lock);
10932 	mutex_enter(&ill->ill_lock);
10933 
10934 	/* Are any references to this ipif active */
10935 	if (ipif_is_freeable(ipif)) {
10936 		mutex_exit(&ill->ill_lock);
10937 		mutex_exit(&connp->conn_lock);
10938 		ipif_non_duplicate(ipif);
10939 		ipif_down_tail(ipif);
10940 		ipif_free_tail(ipif); /* frees ipif */
10941 		return (0);
10942 	}
10943 	success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp), mp,
10944 	    IPIF_FREE);
10945 	mutex_exit(&ill->ill_lock);
10946 	mutex_exit(&connp->conn_lock);
10947 	if (success)
10948 		return (EINPROGRESS);
10949 	else
10950 		return (EINTR);
10951 }
10952 
10953 /*
10954  * Restart the removeif ioctl. The refcnt has gone down to 0.
10955  * The ipif is already condemned. So can't find it thru lookups.
10956  */
10957 /* ARGSUSED */
10958 int
10959 ip_sioctl_removeif_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
10960     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_if_req)
10961 {
10962 	ill_t *ill = ipif->ipif_ill;
10963 
10964 	ASSERT(IAM_WRITER_IPIF(ipif));
10965 	ASSERT(ipif->ipif_state_flags & IPIF_CONDEMNED);
10966 
10967 	ip1dbg(("ip_sioctl_removeif_restart(%s:%u %p)\n",
10968 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
10969 
10970 	if (ipif->ipif_id == 0 && ipif->ipif_net_type == IRE_LOOPBACK) {
10971 		ASSERT(ill->ill_state_flags & ILL_CONDEMNED);
10972 		ill_delete_tail(ill);
10973 		mi_free(ill);
10974 		return (0);
10975 	}
10976 
10977 	ipif_non_duplicate(ipif);
10978 	ipif_down_tail(ipif);
10979 	ipif_free_tail(ipif);
10980 
10981 	ILL_UNMARK_CHANGING(ill);
10982 	return (0);
10983 }
10984 
10985 /*
10986  * Set the local interface address.
10987  * Allow an address of all zero when the interface is down.
10988  */
10989 /* ARGSUSED */
10990 int
10991 ip_sioctl_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10992     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
10993 {
10994 	int err = 0;
10995 	in6_addr_t v6addr;
10996 	boolean_t need_up = B_FALSE;
10997 
10998 	ip1dbg(("ip_sioctl_addr(%s:%u %p)\n",
10999 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11000 
11001 	ASSERT(IAM_WRITER_IPIF(ipif));
11002 
11003 	if (ipif->ipif_isv6) {
11004 		sin6_t *sin6;
11005 		ill_t *ill;
11006 		phyint_t *phyi;
11007 
11008 		if (sin->sin_family != AF_INET6)
11009 			return (EAFNOSUPPORT);
11010 
11011 		sin6 = (sin6_t *)sin;
11012 		v6addr = sin6->sin6_addr;
11013 		ill = ipif->ipif_ill;
11014 		phyi = ill->ill_phyint;
11015 
11016 		/*
11017 		 * Enforce that true multicast interfaces have a link-local
11018 		 * address for logical unit 0.
11019 		 */
11020 		if (ipif->ipif_id == 0 &&
11021 		    (ill->ill_flags & ILLF_MULTICAST) &&
11022 		    !(ipif->ipif_flags & (IPIF_POINTOPOINT)) &&
11023 		    !(phyi->phyint_flags & (PHYI_LOOPBACK)) &&
11024 		    !IN6_IS_ADDR_LINKLOCAL(&v6addr)) {
11025 			return (EADDRNOTAVAIL);
11026 		}
11027 
11028 		/*
11029 		 * up interfaces shouldn't have the unspecified address
11030 		 * unless they also have the IPIF_NOLOCAL flags set and
11031 		 * have a subnet assigned.
11032 		 */
11033 		if ((ipif->ipif_flags & IPIF_UP) &&
11034 		    IN6_IS_ADDR_UNSPECIFIED(&v6addr) &&
11035 		    (!(ipif->ipif_flags & IPIF_NOLOCAL) ||
11036 		    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) {
11037 			return (EADDRNOTAVAIL);
11038 		}
11039 
11040 		if (!ip_local_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
11041 			return (EADDRNOTAVAIL);
11042 	} else {
11043 		ipaddr_t addr;
11044 
11045 		if (sin->sin_family != AF_INET)
11046 			return (EAFNOSUPPORT);
11047 
11048 		addr = sin->sin_addr.s_addr;
11049 
11050 		/* Allow 0 as the local address. */
11051 		if (addr != 0 && !ip_addr_ok_v4(addr, ipif->ipif_net_mask))
11052 			return (EADDRNOTAVAIL);
11053 
11054 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11055 	}
11056 
11057 	/*
11058 	 * Even if there is no change we redo things just to rerun
11059 	 * ipif_set_default.
11060 	 */
11061 	if (ipif->ipif_flags & IPIF_UP) {
11062 		/*
11063 		 * Setting a new local address, make sure
11064 		 * we have net and subnet bcast ire's for
11065 		 * the old address if we need them.
11066 		 */
11067 		if (!ipif->ipif_isv6)
11068 			ipif_check_bcast_ires(ipif);
11069 		/*
11070 		 * If the interface is already marked up,
11071 		 * we call ipif_down which will take care
11072 		 * of ditching any IREs that have been set
11073 		 * up based on the old interface address.
11074 		 */
11075 		err = ipif_logical_down(ipif, q, mp);
11076 		if (err == EINPROGRESS)
11077 			return (err);
11078 		ipif_down_tail(ipif);
11079 		need_up = 1;
11080 	}
11081 
11082 	err = ip_sioctl_addr_tail(ipif, sin, q, mp, need_up);
11083 	return (err);
11084 }
11085 
11086 int
11087 ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11088     boolean_t need_up)
11089 {
11090 	in6_addr_t v6addr;
11091 	in6_addr_t ov6addr;
11092 	ipaddr_t addr;
11093 	sin6_t	*sin6;
11094 	int	sinlen;
11095 	int	err = 0;
11096 	ill_t	*ill = ipif->ipif_ill;
11097 	boolean_t need_dl_down;
11098 	boolean_t need_arp_down;
11099 	struct iocblk *iocp;
11100 
11101 	iocp = (mp != NULL) ? (struct iocblk *)mp->b_rptr : NULL;
11102 
11103 	ip1dbg(("ip_sioctl_addr_tail(%s:%u %p)\n",
11104 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
11105 	ASSERT(IAM_WRITER_IPIF(ipif));
11106 
11107 	/* Must cancel any pending timer before taking the ill_lock */
11108 	if (ipif->ipif_recovery_id != 0)
11109 		(void) untimeout(ipif->ipif_recovery_id);
11110 	ipif->ipif_recovery_id = 0;
11111 
11112 	if (ipif->ipif_isv6) {
11113 		sin6 = (sin6_t *)sin;
11114 		v6addr = sin6->sin6_addr;
11115 		sinlen = sizeof (struct sockaddr_in6);
11116 	} else {
11117 		addr = sin->sin_addr.s_addr;
11118 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11119 		sinlen = sizeof (struct sockaddr_in);
11120 	}
11121 	mutex_enter(&ill->ill_lock);
11122 	ov6addr = ipif->ipif_v6lcl_addr;
11123 	ipif->ipif_v6lcl_addr = v6addr;
11124 	sctp_update_ipif_addr(ipif, ov6addr);
11125 	if (ipif->ipif_flags & (IPIF_ANYCAST | IPIF_NOLOCAL)) {
11126 		ipif->ipif_v6src_addr = ipv6_all_zeros;
11127 	} else {
11128 		ipif->ipif_v6src_addr = v6addr;
11129 	}
11130 	ipif->ipif_addr_ready = 0;
11131 
11132 	/*
11133 	 * If the interface was previously marked as a duplicate, then since
11134 	 * we've now got a "new" address, it should no longer be considered a
11135 	 * duplicate -- even if the "new" address is the same as the old one.
11136 	 * Note that if all ipifs are down, we may have a pending ARP down
11137 	 * event to handle.  This is because we want to recover from duplicates
11138 	 * and thus delay tearing down ARP until the duplicates have been
11139 	 * removed or disabled.
11140 	 */
11141 	need_dl_down = need_arp_down = B_FALSE;
11142 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
11143 		need_arp_down = !need_up;
11144 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
11145 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
11146 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
11147 			need_dl_down = B_TRUE;
11148 		}
11149 	}
11150 
11151 	if (ipif->ipif_isv6 && IN6_IS_ADDR_6TO4(&v6addr) &&
11152 	    !ill->ill_is_6to4tun) {
11153 		queue_t *wqp = ill->ill_wq;
11154 
11155 		/*
11156 		 * The local address of this interface is a 6to4 address,
11157 		 * check if this interface is in fact a 6to4 tunnel or just
11158 		 * an interface configured with a 6to4 address.  We are only
11159 		 * interested in the former.
11160 		 */
11161 		if (wqp != NULL) {
11162 			while ((wqp->q_next != NULL) &&
11163 			    (wqp->q_next->q_qinfo != NULL) &&
11164 			    (wqp->q_next->q_qinfo->qi_minfo != NULL)) {
11165 
11166 				if (wqp->q_next->q_qinfo->qi_minfo->mi_idnum
11167 				    == TUN6TO4_MODID) {
11168 					/* set for use in IP */
11169 					ill->ill_is_6to4tun = 1;
11170 					break;
11171 				}
11172 				wqp = wqp->q_next;
11173 			}
11174 		}
11175 	}
11176 
11177 	ipif_set_default(ipif);
11178 
11179 	/*
11180 	 * When publishing an interface address change event, we only notify
11181 	 * the event listeners of the new address.  It is assumed that if they
11182 	 * actively care about the addresses assigned that they will have
11183 	 * already discovered the previous address assigned (if there was one.)
11184 	 *
11185 	 * Don't attach nic event message for SIOCLIFADDIF ioctl.
11186 	 */
11187 	if (iocp != NULL && iocp->ioc_cmd != SIOCLIFADDIF) {
11188 		ill_nic_event_dispatch(ill, MAP_IPIF_ID(ipif->ipif_id),
11189 		    NE_ADDRESS_CHANGE, sin, sinlen);
11190 	}
11191 
11192 	mutex_exit(&ill->ill_lock);
11193 
11194 	if (need_up) {
11195 		/*
11196 		 * Now bring the interface back up.  If this
11197 		 * is the only IPIF for the ILL, ipif_up
11198 		 * will have to re-bind to the device, so
11199 		 * we may get back EINPROGRESS, in which
11200 		 * case, this IOCTL will get completed in
11201 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11202 		 */
11203 		err = ipif_up(ipif, q, mp);
11204 	}
11205 
11206 	if (need_dl_down)
11207 		ill_dl_down(ill);
11208 	if (need_arp_down)
11209 		ipif_resolver_down(ipif);
11210 
11211 	return (err);
11212 }
11213 
11214 /*
11215  * Restart entry point to restart the address set operation after the
11216  * refcounts have dropped to zero.
11217  */
11218 /* ARGSUSED */
11219 int
11220 ip_sioctl_addr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11221     ip_ioctl_cmd_t *ipip, void *ifreq)
11222 {
11223 	ip1dbg(("ip_sioctl_addr_restart(%s:%u %p)\n",
11224 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11225 	ASSERT(IAM_WRITER_IPIF(ipif));
11226 	ipif_down_tail(ipif);
11227 	return (ip_sioctl_addr_tail(ipif, sin, q, mp, B_TRUE));
11228 }
11229 
11230 /* ARGSUSED */
11231 int
11232 ip_sioctl_get_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11233     ip_ioctl_cmd_t *ipip, void *if_req)
11234 {
11235 	sin6_t *sin6 = (struct sockaddr_in6 *)sin;
11236 	struct lifreq *lifr = (struct lifreq *)if_req;
11237 
11238 	ip1dbg(("ip_sioctl_get_addr(%s:%u %p)\n",
11239 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11240 	/*
11241 	 * The net mask and address can't change since we have a
11242 	 * reference to the ipif. So no lock is necessary.
11243 	 */
11244 	if (ipif->ipif_isv6) {
11245 		*sin6 = sin6_null;
11246 		sin6->sin6_family = AF_INET6;
11247 		sin6->sin6_addr = ipif->ipif_v6lcl_addr;
11248 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11249 		lifr->lifr_addrlen =
11250 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
11251 	} else {
11252 		*sin = sin_null;
11253 		sin->sin_family = AF_INET;
11254 		sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
11255 		if (ipip->ipi_cmd_type == LIF_CMD) {
11256 			lifr->lifr_addrlen =
11257 			    ip_mask_to_plen(ipif->ipif_net_mask);
11258 		}
11259 	}
11260 	return (0);
11261 }
11262 
11263 /*
11264  * Set the destination address for a pt-pt interface.
11265  */
11266 /* ARGSUSED */
11267 int
11268 ip_sioctl_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11269     ip_ioctl_cmd_t *ipip, void *if_req)
11270 {
11271 	int err = 0;
11272 	in6_addr_t v6addr;
11273 	boolean_t need_up = B_FALSE;
11274 
11275 	ip1dbg(("ip_sioctl_dstaddr(%s:%u %p)\n",
11276 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11277 	ASSERT(IAM_WRITER_IPIF(ipif));
11278 
11279 	if (ipif->ipif_isv6) {
11280 		sin6_t *sin6;
11281 
11282 		if (sin->sin_family != AF_INET6)
11283 			return (EAFNOSUPPORT);
11284 
11285 		sin6 = (sin6_t *)sin;
11286 		v6addr = sin6->sin6_addr;
11287 
11288 		if (!ip_remote_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
11289 			return (EADDRNOTAVAIL);
11290 	} else {
11291 		ipaddr_t addr;
11292 
11293 		if (sin->sin_family != AF_INET)
11294 			return (EAFNOSUPPORT);
11295 
11296 		addr = sin->sin_addr.s_addr;
11297 		if (!ip_addr_ok_v4(addr, ipif->ipif_net_mask))
11298 			return (EADDRNOTAVAIL);
11299 
11300 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11301 	}
11302 
11303 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, &v6addr))
11304 		return (0);	/* No change */
11305 
11306 	if (ipif->ipif_flags & IPIF_UP) {
11307 		/*
11308 		 * If the interface is already marked up,
11309 		 * we call ipif_down which will take care
11310 		 * of ditching any IREs that have been set
11311 		 * up based on the old pp dst address.
11312 		 */
11313 		err = ipif_logical_down(ipif, q, mp);
11314 		if (err == EINPROGRESS)
11315 			return (err);
11316 		ipif_down_tail(ipif);
11317 		need_up = B_TRUE;
11318 	}
11319 	/*
11320 	 * could return EINPROGRESS. If so ioctl will complete in
11321 	 * ip_rput_dlpi_writer
11322 	 */
11323 	err = ip_sioctl_dstaddr_tail(ipif, sin, q, mp, need_up);
11324 	return (err);
11325 }
11326 
11327 static int
11328 ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11329     boolean_t need_up)
11330 {
11331 	in6_addr_t v6addr;
11332 	ill_t	*ill = ipif->ipif_ill;
11333 	int	err = 0;
11334 	boolean_t need_dl_down;
11335 	boolean_t need_arp_down;
11336 
11337 	ip1dbg(("ip_sioctl_dstaddr_tail(%s:%u %p)\n", ill->ill_name,
11338 	    ipif->ipif_id, (void *)ipif));
11339 
11340 	/* Must cancel any pending timer before taking the ill_lock */
11341 	if (ipif->ipif_recovery_id != 0)
11342 		(void) untimeout(ipif->ipif_recovery_id);
11343 	ipif->ipif_recovery_id = 0;
11344 
11345 	if (ipif->ipif_isv6) {
11346 		sin6_t *sin6;
11347 
11348 		sin6 = (sin6_t *)sin;
11349 		v6addr = sin6->sin6_addr;
11350 	} else {
11351 		ipaddr_t addr;
11352 
11353 		addr = sin->sin_addr.s_addr;
11354 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11355 	}
11356 	mutex_enter(&ill->ill_lock);
11357 	/* Set point to point destination address. */
11358 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11359 		/*
11360 		 * Allow this as a means of creating logical
11361 		 * pt-pt interfaces on top of e.g. an Ethernet.
11362 		 * XXX Undocumented HACK for testing.
11363 		 * pt-pt interfaces are created with NUD disabled.
11364 		 */
11365 		ipif->ipif_flags |= IPIF_POINTOPOINT;
11366 		ipif->ipif_flags &= ~IPIF_BROADCAST;
11367 		if (ipif->ipif_isv6)
11368 			ill->ill_flags |= ILLF_NONUD;
11369 	}
11370 
11371 	/*
11372 	 * If the interface was previously marked as a duplicate, then since
11373 	 * we've now got a "new" address, it should no longer be considered a
11374 	 * duplicate -- even if the "new" address is the same as the old one.
11375 	 * Note that if all ipifs are down, we may have a pending ARP down
11376 	 * event to handle.
11377 	 */
11378 	need_dl_down = need_arp_down = B_FALSE;
11379 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
11380 		need_arp_down = !need_up;
11381 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
11382 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
11383 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
11384 			need_dl_down = B_TRUE;
11385 		}
11386 	}
11387 
11388 	/* Set the new address. */
11389 	ipif->ipif_v6pp_dst_addr = v6addr;
11390 	/* Make sure subnet tracks pp_dst */
11391 	ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
11392 	mutex_exit(&ill->ill_lock);
11393 
11394 	if (need_up) {
11395 		/*
11396 		 * Now bring the interface back up.  If this
11397 		 * is the only IPIF for the ILL, ipif_up
11398 		 * will have to re-bind to the device, so
11399 		 * we may get back EINPROGRESS, in which
11400 		 * case, this IOCTL will get completed in
11401 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11402 		 */
11403 		err = ipif_up(ipif, q, mp);
11404 	}
11405 
11406 	if (need_dl_down)
11407 		ill_dl_down(ill);
11408 	if (need_arp_down)
11409 		ipif_resolver_down(ipif);
11410 
11411 	return (err);
11412 }
11413 
11414 /*
11415  * Restart entry point to restart the dstaddress set operation after the
11416  * refcounts have dropped to zero.
11417  */
11418 /* ARGSUSED */
11419 int
11420 ip_sioctl_dstaddr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11421     ip_ioctl_cmd_t *ipip, void *ifreq)
11422 {
11423 	ip1dbg(("ip_sioctl_dstaddr_restart(%s:%u %p)\n",
11424 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11425 	ipif_down_tail(ipif);
11426 	return (ip_sioctl_dstaddr_tail(ipif, sin, q, mp, B_TRUE));
11427 }
11428 
11429 /* ARGSUSED */
11430 int
11431 ip_sioctl_get_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11432     ip_ioctl_cmd_t *ipip, void *if_req)
11433 {
11434 	sin6_t	*sin6 = (struct sockaddr_in6 *)sin;
11435 
11436 	ip1dbg(("ip_sioctl_get_dstaddr(%s:%u %p)\n",
11437 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11438 	/*
11439 	 * Get point to point destination address. The addresses can't
11440 	 * change since we hold a reference to the ipif.
11441 	 */
11442 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0)
11443 		return (EADDRNOTAVAIL);
11444 
11445 	if (ipif->ipif_isv6) {
11446 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11447 		*sin6 = sin6_null;
11448 		sin6->sin6_family = AF_INET6;
11449 		sin6->sin6_addr = ipif->ipif_v6pp_dst_addr;
11450 	} else {
11451 		*sin = sin_null;
11452 		sin->sin_family = AF_INET;
11453 		sin->sin_addr.s_addr = ipif->ipif_pp_dst_addr;
11454 	}
11455 	return (0);
11456 }
11457 
11458 /*
11459  * Set interface flags.  Many flags require special handling (e.g.,
11460  * bringing the interface down); see below for details.
11461  *
11462  * NOTE : We really don't enforce that ipif_id zero should be used
11463  *	  for setting any flags other than IFF_LOGINT_FLAGS. This
11464  *	  is because applications generally does SICGLIFFLAGS and
11465  *	  ORs in the new flags (that affects the logical) and does a
11466  *	  SIOCSLIFFLAGS. Thus, "flags" below could contain bits other
11467  *	  than IFF_LOGINT_FLAGS. One could check whether "turn_on" - the
11468  *	  flags that will be turned on is correct with respect to
11469  *	  ipif_id 0. For backward compatibility reasons, it is not done.
11470  */
11471 /* ARGSUSED */
11472 int
11473 ip_sioctl_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11474     ip_ioctl_cmd_t *ipip, void *if_req)
11475 {
11476 	uint64_t turn_on;
11477 	uint64_t turn_off;
11478 	int	err = 0;
11479 	phyint_t *phyi;
11480 	ill_t *ill;
11481 	uint64_t intf_flags, cantchange_flags;
11482 	boolean_t phyint_flags_modified = B_FALSE;
11483 	uint64_t flags;
11484 	struct ifreq *ifr;
11485 	struct lifreq *lifr;
11486 	boolean_t set_linklocal = B_FALSE;
11487 	boolean_t zero_source = B_FALSE;
11488 
11489 	ip1dbg(("ip_sioctl_flags(%s:%u %p)\n",
11490 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11491 
11492 	ASSERT(IAM_WRITER_IPIF(ipif));
11493 
11494 	ill = ipif->ipif_ill;
11495 	phyi = ill->ill_phyint;
11496 
11497 	if (ipip->ipi_cmd_type == IF_CMD) {
11498 		ifr = (struct ifreq *)if_req;
11499 		flags = (uint64_t)(ifr->ifr_flags & 0x0000ffff);
11500 	} else {
11501 		lifr = (struct lifreq *)if_req;
11502 		flags = lifr->lifr_flags;
11503 	}
11504 
11505 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
11506 
11507 	/*
11508 	 * Have the flags been set correctly until now?
11509 	 */
11510 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
11511 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
11512 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
11513 	/*
11514 	 * Compare the new flags to the old, and partition
11515 	 * into those coming on and those going off.
11516 	 * For the 16 bit command keep the bits above bit 16 unchanged.
11517 	 */
11518 	if (ipip->ipi_cmd == SIOCSIFFLAGS)
11519 		flags |= intf_flags & ~0xFFFF;
11520 
11521 	/*
11522 	 * Explicitly fail attempts to change flags that are always invalid on
11523 	 * an IPMP meta-interface.
11524 	 */
11525 	if (IS_IPMP(ill) && ((flags ^ intf_flags) & IFF_IPMP_INVALID))
11526 		return (EINVAL);
11527 
11528 	/*
11529 	 * Check which flags will change; silently ignore flags which userland
11530 	 * is not allowed to control.  (Because these flags may change between
11531 	 * SIOCGLIFFLAGS and SIOCSLIFFLAGS, and that's outside of userland's
11532 	 * control, we need to silently ignore them rather than fail.)
11533 	 */
11534 	cantchange_flags = IFF_CANTCHANGE;
11535 	if (IS_IPMP(ill))
11536 		cantchange_flags |= IFF_IPMP_CANTCHANGE;
11537 
11538 	turn_on = (flags ^ intf_flags) & ~cantchange_flags;
11539 	if (turn_on == 0)
11540 		return (0);	/* No change */
11541 
11542 	turn_off = intf_flags & turn_on;
11543 	turn_on ^= turn_off;
11544 
11545 	/*
11546 	 * All test addresses must be IFF_DEPRECATED (to ensure source address
11547 	 * selection avoids them) -- so force IFF_DEPRECATED on, and do not
11548 	 * allow it to be turned off.
11549 	 */
11550 	if ((turn_off & (IFF_DEPRECATED|IFF_NOFAILOVER)) == IFF_DEPRECATED &&
11551 	    (turn_on|intf_flags) & IFF_NOFAILOVER)
11552 		return (EINVAL);
11553 
11554 	if (turn_on & IFF_NOFAILOVER) {
11555 		turn_on |= IFF_DEPRECATED;
11556 		flags |= IFF_DEPRECATED;
11557 	}
11558 
11559 	/*
11560 	 * On underlying interfaces, only allow applications to manage test
11561 	 * addresses -- otherwise, they may get confused when the address
11562 	 * moves as part of being brought up.  Likewise, prevent an
11563 	 * application-managed test address from being converted to a data
11564 	 * address.  To prevent migration of administratively up addresses in
11565 	 * the kernel, we don't allow them to be converted either.
11566 	 */
11567 	if (IS_UNDER_IPMP(ill)) {
11568 		const uint64_t appflags = IFF_DHCPRUNNING | IFF_ADDRCONF;
11569 
11570 		if ((turn_on & appflags) && !(flags & IFF_NOFAILOVER))
11571 			return (EINVAL);
11572 
11573 		if ((turn_off & IFF_NOFAILOVER) &&
11574 		    (flags & (appflags | IFF_UP | IFF_DUPLICATE)))
11575 			return (EINVAL);
11576 	}
11577 
11578 	/*
11579 	 * Only allow the IFF_XRESOLV and IFF_TEMPORARY flags to be set on
11580 	 * IPv6 interfaces.
11581 	 */
11582 	if ((turn_on & (IFF_XRESOLV|IFF_TEMPORARY)) && !(ipif->ipif_isv6))
11583 		return (EINVAL);
11584 
11585 	/*
11586 	 * cannot turn off IFF_NOXMIT on  VNI interfaces.
11587 	 */
11588 	if ((turn_off & IFF_NOXMIT) && IS_VNI(ipif->ipif_ill))
11589 		return (EINVAL);
11590 
11591 	/*
11592 	 * Don't allow the IFF_ROUTER flag to be turned on on loopback
11593 	 * interfaces.  It makes no sense in that context.
11594 	 */
11595 	if ((turn_on & IFF_ROUTER) && (phyi->phyint_flags & PHYI_LOOPBACK))
11596 		return (EINVAL);
11597 
11598 	if (flags & (IFF_NOLOCAL|IFF_ANYCAST))
11599 		zero_source = B_TRUE;
11600 
11601 	/*
11602 	 * For IPv6 ipif_id 0, don't allow the interface to be up without
11603 	 * a link local address if IFF_NOLOCAL or IFF_ANYCAST are not set.
11604 	 * If the link local address isn't set, and can be set, it will get
11605 	 * set later on in this function.
11606 	 */
11607 	if (ipif->ipif_id == 0 && ipif->ipif_isv6 &&
11608 	    (flags & IFF_UP) && !zero_source &&
11609 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
11610 		if (ipif_cant_setlinklocal(ipif))
11611 			return (EINVAL);
11612 		set_linklocal = B_TRUE;
11613 	}
11614 
11615 	/*
11616 	 * If we modify physical interface flags, we'll potentially need to
11617 	 * send up two routing socket messages for the changes (one for the
11618 	 * IPv4 ill, and another for the IPv6 ill).  Note that here.
11619 	 */
11620 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
11621 		phyint_flags_modified = B_TRUE;
11622 
11623 	/*
11624 	 * All functioning PHYI_STANDBY interfaces start life PHYI_INACTIVE
11625 	 * (otherwise, we'd immediately use them, defeating standby).  Also,
11626 	 * since PHYI_INACTIVE has a separate meaning when PHYI_STANDBY is not
11627 	 * set, don't allow PHYI_STANDBY to be set if PHYI_INACTIVE is already
11628 	 * set, and clear PHYI_INACTIVE if PHYI_STANDBY is being cleared.  We
11629 	 * also don't allow PHYI_STANDBY if VNI is enabled since its semantics
11630 	 * will not be honored.
11631 	 */
11632 	if (turn_on & PHYI_STANDBY) {
11633 		/*
11634 		 * No need to grab ill_g_usesrc_lock here; see the
11635 		 * synchronization notes in ip.c.
11636 		 */
11637 		if (ill->ill_usesrc_grp_next != NULL ||
11638 		    intf_flags & PHYI_INACTIVE)
11639 			return (EINVAL);
11640 		if (!(flags & PHYI_FAILED)) {
11641 			flags |= PHYI_INACTIVE;
11642 			turn_on |= PHYI_INACTIVE;
11643 		}
11644 	}
11645 
11646 	if (turn_off & PHYI_STANDBY) {
11647 		flags &= ~PHYI_INACTIVE;
11648 		turn_off |= PHYI_INACTIVE;
11649 	}
11650 
11651 	/*
11652 	 * PHYI_FAILED and PHYI_INACTIVE are mutually exclusive; fail if both
11653 	 * would end up on.
11654 	 */
11655 	if ((flags & (PHYI_FAILED | PHYI_INACTIVE)) ==
11656 	    (PHYI_FAILED | PHYI_INACTIVE))
11657 		return (EINVAL);
11658 
11659 	/*
11660 	 * If ILLF_ROUTER changes, we need to change the ip forwarding
11661 	 * status of the interface.
11662 	 */
11663 	if ((turn_on | turn_off) & ILLF_ROUTER)
11664 		(void) ill_forward_set(ill, ((turn_on & ILLF_ROUTER) != 0));
11665 
11666 	/*
11667 	 * If the interface is not UP and we are not going to
11668 	 * bring it UP, record the flags and return. When the
11669 	 * interface comes UP later, the right actions will be
11670 	 * taken.
11671 	 */
11672 	if (!(ipif->ipif_flags & IPIF_UP) &&
11673 	    !(turn_on & IPIF_UP)) {
11674 		/* Record new flags in their respective places. */
11675 		mutex_enter(&ill->ill_lock);
11676 		mutex_enter(&ill->ill_phyint->phyint_lock);
11677 		ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
11678 		ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
11679 		ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
11680 		ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
11681 		phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
11682 		phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
11683 		mutex_exit(&ill->ill_lock);
11684 		mutex_exit(&ill->ill_phyint->phyint_lock);
11685 
11686 		/*
11687 		 * PHYI_FAILED, PHYI_INACTIVE, and PHYI_OFFLINE are all the
11688 		 * same to the kernel: if any of them has been set by
11689 		 * userland, the interface cannot be used for data traffic.
11690 		 */
11691 		if ((turn_on|turn_off) &
11692 		    (PHYI_FAILED | PHYI_INACTIVE | PHYI_OFFLINE)) {
11693 			ASSERT(!IS_IPMP(ill));
11694 			/*
11695 			 * It's possible the ill is part of an "anonymous"
11696 			 * IPMP group rather than a real group.  In that case,
11697 			 * there are no other interfaces in the group and thus
11698 			 * no need to call ipmp_phyint_refresh_active().
11699 			 */
11700 			if (IS_UNDER_IPMP(ill))
11701 				ipmp_phyint_refresh_active(phyi);
11702 		}
11703 
11704 		if (phyint_flags_modified) {
11705 			if (phyi->phyint_illv4 != NULL) {
11706 				ip_rts_ifmsg(phyi->phyint_illv4->
11707 				    ill_ipif, RTSQ_DEFAULT);
11708 			}
11709 			if (phyi->phyint_illv6 != NULL) {
11710 				ip_rts_ifmsg(phyi->phyint_illv6->
11711 				    ill_ipif, RTSQ_DEFAULT);
11712 			}
11713 		}
11714 		return (0);
11715 	} else if (set_linklocal || zero_source) {
11716 		mutex_enter(&ill->ill_lock);
11717 		if (set_linklocal)
11718 			ipif->ipif_state_flags |= IPIF_SET_LINKLOCAL;
11719 		if (zero_source)
11720 			ipif->ipif_state_flags |= IPIF_ZERO_SOURCE;
11721 		mutex_exit(&ill->ill_lock);
11722 	}
11723 
11724 	/*
11725 	 * Disallow IPv6 interfaces coming up that have the unspecified address,
11726 	 * or point-to-point interfaces with an unspecified destination. We do
11727 	 * allow the address to be unspecified for IPIF_NOLOCAL interfaces that
11728 	 * have a subnet assigned, which is how in.ndpd currently manages its
11729 	 * onlink prefix list when no addresses are configured with those
11730 	 * prefixes.
11731 	 */
11732 	if (ipif->ipif_isv6 &&
11733 	    ((IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
11734 	    (!(ipif->ipif_flags & IPIF_NOLOCAL) && !(turn_on & IPIF_NOLOCAL) ||
11735 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) ||
11736 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
11737 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)))) {
11738 		return (EINVAL);
11739 	}
11740 
11741 	/*
11742 	 * Prevent IPv4 point-to-point interfaces with a 0.0.0.0 destination
11743 	 * from being brought up.
11744 	 */
11745 	if (!ipif->ipif_isv6 &&
11746 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
11747 	    ipif->ipif_pp_dst_addr == INADDR_ANY)) {
11748 		return (EINVAL);
11749 	}
11750 
11751 	/*
11752 	 * The only flag changes that we currently take specific action on are
11753 	 * IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT, IPIF_NOLOCAL, ILLF_NOARP,
11754 	 * ILLF_NONUD, IPIF_PRIVATE, IPIF_ANYCAST, IPIF_PREFERRED, and
11755 	 * IPIF_NOFAILOVER.  This is done by bring the ipif down, changing the
11756 	 * flags and bringing it back up again.  For IPIF_NOFAILOVER, the act
11757 	 * of bringing it back up will trigger the address to be moved.
11758 	 */
11759 	if ((turn_on|turn_off) &
11760 	    (IPIF_UP|IPIF_DEPRECATED|IPIF_NOXMIT|IPIF_NOLOCAL|ILLF_NOARP|
11761 	    ILLF_NONUD|IPIF_PRIVATE|IPIF_ANYCAST|IPIF_PREFERRED|
11762 	    IPIF_NOFAILOVER)) {
11763 		/*
11764 		 * Taking this ipif down, make sure we have
11765 		 * valid net and subnet bcast ire's for other
11766 		 * logical interfaces, if we need them.
11767 		 */
11768 		if (!ipif->ipif_isv6)
11769 			ipif_check_bcast_ires(ipif);
11770 
11771 		if (((ipif->ipif_flags | turn_on) & IPIF_UP) &&
11772 		    !(turn_off & IPIF_UP)) {
11773 			if (ipif->ipif_flags & IPIF_UP)
11774 				ill->ill_logical_down = 1;
11775 			turn_on &= ~IPIF_UP;
11776 		}
11777 		err = ipif_down(ipif, q, mp);
11778 		ip1dbg(("ipif_down returns %d err ", err));
11779 		if (err == EINPROGRESS)
11780 			return (err);
11781 		ipif_down_tail(ipif);
11782 	}
11783 	return (ip_sioctl_flags_tail(ipif, flags, q, mp));
11784 }
11785 
11786 static int
11787 ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q, mblk_t *mp)
11788 {
11789 	ill_t	*ill;
11790 	phyint_t *phyi;
11791 	uint64_t turn_on, turn_off;
11792 	uint64_t intf_flags, cantchange_flags;
11793 	boolean_t phyint_flags_modified = B_FALSE;
11794 	int	err = 0;
11795 	boolean_t set_linklocal = B_FALSE;
11796 	boolean_t zero_source = B_FALSE;
11797 
11798 	ip1dbg(("ip_sioctl_flags_tail(%s:%u)\n",
11799 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
11800 
11801 	ASSERT(IAM_WRITER_IPIF(ipif));
11802 
11803 	ill = ipif->ipif_ill;
11804 	phyi = ill->ill_phyint;
11805 
11806 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
11807 	cantchange_flags = IFF_CANTCHANGE | IFF_UP;
11808 	if (IS_IPMP(ill))
11809 		cantchange_flags |= IFF_IPMP_CANTCHANGE;
11810 
11811 	turn_on = (flags ^ intf_flags) & ~cantchange_flags;
11812 	turn_off = intf_flags & turn_on;
11813 	turn_on ^= turn_off;
11814 
11815 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
11816 		phyint_flags_modified = B_TRUE;
11817 
11818 	/*
11819 	 * Now we change the flags. Track current value of
11820 	 * other flags in their respective places.
11821 	 */
11822 	mutex_enter(&ill->ill_lock);
11823 	mutex_enter(&phyi->phyint_lock);
11824 	ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
11825 	ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
11826 	ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
11827 	ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
11828 	phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
11829 	phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
11830 	if (ipif->ipif_state_flags & IPIF_SET_LINKLOCAL) {
11831 		set_linklocal = B_TRUE;
11832 		ipif->ipif_state_flags &= ~IPIF_SET_LINKLOCAL;
11833 	}
11834 	if (ipif->ipif_state_flags & IPIF_ZERO_SOURCE) {
11835 		zero_source = B_TRUE;
11836 		ipif->ipif_state_flags &= ~IPIF_ZERO_SOURCE;
11837 	}
11838 	mutex_exit(&ill->ill_lock);
11839 	mutex_exit(&phyi->phyint_lock);
11840 
11841 	if (set_linklocal)
11842 		(void) ipif_setlinklocal(ipif);
11843 
11844 	if (zero_source)
11845 		ipif->ipif_v6src_addr = ipv6_all_zeros;
11846 	else
11847 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
11848 
11849 	/*
11850 	 * PHYI_FAILED, PHYI_INACTIVE, and PHYI_OFFLINE are all the same to
11851 	 * the kernel: if any of them has been set by userland, the interface
11852 	 * cannot be used for data traffic.
11853 	 */
11854 	if ((turn_on|turn_off) & (PHYI_FAILED | PHYI_INACTIVE | PHYI_OFFLINE)) {
11855 		ASSERT(!IS_IPMP(ill));
11856 		/*
11857 		 * It's possible the ill is part of an "anonymous" IPMP group
11858 		 * rather than a real group.  In that case, there are no other
11859 		 * interfaces in the group and thus no need for us to call
11860 		 * ipmp_phyint_refresh_active().
11861 		 */
11862 		if (IS_UNDER_IPMP(ill))
11863 			ipmp_phyint_refresh_active(phyi);
11864 	}
11865 
11866 	if ((flags & IFF_UP) && !(ipif->ipif_flags & IPIF_UP)) {
11867 		/*
11868 		 * XXX ipif_up really does not know whether a phyint flags
11869 		 * was modified or not. So, it sends up information on
11870 		 * only one routing sockets message. As we don't bring up
11871 		 * the interface and also set PHYI_ flags simultaneously
11872 		 * it should be okay.
11873 		 */
11874 		err = ipif_up(ipif, q, mp);
11875 	} else {
11876 		/*
11877 		 * Make sure routing socket sees all changes to the flags.
11878 		 * ipif_up_done* handles this when we use ipif_up.
11879 		 */
11880 		if (phyint_flags_modified) {
11881 			if (phyi->phyint_illv4 != NULL) {
11882 				ip_rts_ifmsg(phyi->phyint_illv4->
11883 				    ill_ipif, RTSQ_DEFAULT);
11884 			}
11885 			if (phyi->phyint_illv6 != NULL) {
11886 				ip_rts_ifmsg(phyi->phyint_illv6->
11887 				    ill_ipif, RTSQ_DEFAULT);
11888 			}
11889 		} else {
11890 			ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
11891 		}
11892 		/*
11893 		 * Update the flags in SCTP's IPIF list, ipif_up() will do
11894 		 * this in need_up case.
11895 		 */
11896 		sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
11897 	}
11898 	return (err);
11899 }
11900 
11901 /*
11902  * Restart the flags operation now that the refcounts have dropped to zero.
11903  */
11904 /* ARGSUSED */
11905 int
11906 ip_sioctl_flags_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11907     ip_ioctl_cmd_t *ipip, void *if_req)
11908 {
11909 	uint64_t flags;
11910 	struct ifreq *ifr = if_req;
11911 	struct lifreq *lifr = if_req;
11912 
11913 	ip1dbg(("ip_sioctl_flags_restart(%s:%u %p)\n",
11914 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11915 
11916 	ipif_down_tail(ipif);
11917 	if (ipip->ipi_cmd_type == IF_CMD) {
11918 		/* cast to uint16_t prevents unwanted sign extension */
11919 		flags = (uint16_t)ifr->ifr_flags;
11920 	} else {
11921 		flags = lifr->lifr_flags;
11922 	}
11923 	return (ip_sioctl_flags_tail(ipif, flags, q, mp));
11924 }
11925 
11926 /*
11927  * Can operate on either a module or a driver queue.
11928  */
11929 /* ARGSUSED */
11930 int
11931 ip_sioctl_get_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11932     ip_ioctl_cmd_t *ipip, void *if_req)
11933 {
11934 	/*
11935 	 * Has the flags been set correctly till now ?
11936 	 */
11937 	ill_t *ill = ipif->ipif_ill;
11938 	phyint_t *phyi = ill->ill_phyint;
11939 
11940 	ip1dbg(("ip_sioctl_get_flags(%s:%u %p)\n",
11941 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11942 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
11943 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
11944 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
11945 
11946 	/*
11947 	 * Need a lock since some flags can be set even when there are
11948 	 * references to the ipif.
11949 	 */
11950 	mutex_enter(&ill->ill_lock);
11951 	if (ipip->ipi_cmd_type == IF_CMD) {
11952 		struct ifreq *ifr = (struct ifreq *)if_req;
11953 
11954 		/* Get interface flags (low 16 only). */
11955 		ifr->ifr_flags = ((ipif->ipif_flags |
11956 		    ill->ill_flags | phyi->phyint_flags) & 0xffff);
11957 	} else {
11958 		struct lifreq *lifr = (struct lifreq *)if_req;
11959 
11960 		/* Get interface flags. */
11961 		lifr->lifr_flags = ipif->ipif_flags |
11962 		    ill->ill_flags | phyi->phyint_flags;
11963 	}
11964 	mutex_exit(&ill->ill_lock);
11965 	return (0);
11966 }
11967 
11968 /* ARGSUSED */
11969 int
11970 ip_sioctl_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11971     ip_ioctl_cmd_t *ipip, void *if_req)
11972 {
11973 	int mtu;
11974 	int ip_min_mtu;
11975 	struct ifreq	*ifr;
11976 	struct lifreq *lifr;
11977 	ire_t	*ire;
11978 	ip_stack_t *ipst;
11979 
11980 	ip1dbg(("ip_sioctl_mtu(%s:%u %p)\n", ipif->ipif_ill->ill_name,
11981 	    ipif->ipif_id, (void *)ipif));
11982 	if (ipip->ipi_cmd_type == IF_CMD) {
11983 		ifr = (struct ifreq *)if_req;
11984 		mtu = ifr->ifr_metric;
11985 	} else {
11986 		lifr = (struct lifreq *)if_req;
11987 		mtu = lifr->lifr_mtu;
11988 	}
11989 
11990 	if (ipif->ipif_isv6)
11991 		ip_min_mtu = IPV6_MIN_MTU;
11992 	else
11993 		ip_min_mtu = IP_MIN_MTU;
11994 
11995 	if (mtu > ipif->ipif_ill->ill_max_frag || mtu < ip_min_mtu)
11996 		return (EINVAL);
11997 
11998 	/*
11999 	 * Change the MTU size in all relevant ire's.
12000 	 * Mtu change Vs. new ire creation - protocol below.
12001 	 * First change ipif_mtu and the ire_max_frag of the
12002 	 * interface ire. Then do an ire walk and change the
12003 	 * ire_max_frag of all affected ires. During ire_add
12004 	 * under the bucket lock, set the ire_max_frag of the
12005 	 * new ire being created from the ipif/ire from which
12006 	 * it is being derived. If an mtu change happens after
12007 	 * the ire is added, the new ire will be cleaned up.
12008 	 * Conversely if the mtu change happens before the ire
12009 	 * is added, ire_add will see the new value of the mtu.
12010 	 */
12011 	ipif->ipif_mtu = mtu;
12012 	ipif->ipif_flags |= IPIF_FIXEDMTU;
12013 
12014 	if (ipif->ipif_isv6)
12015 		ire = ipif_to_ire_v6(ipif);
12016 	else
12017 		ire = ipif_to_ire(ipif);
12018 	if (ire != NULL) {
12019 		ire->ire_max_frag = ipif->ipif_mtu;
12020 		ire_refrele(ire);
12021 	}
12022 	ipst = ipif->ipif_ill->ill_ipst;
12023 	if (ipif->ipif_flags & IPIF_UP) {
12024 		if (ipif->ipif_isv6)
12025 			ire_walk_v6(ipif_mtu_change, (char *)ipif, ALL_ZONES,
12026 			    ipst);
12027 		else
12028 			ire_walk_v4(ipif_mtu_change, (char *)ipif, ALL_ZONES,
12029 			    ipst);
12030 	}
12031 	/* Update the MTU in SCTP's list */
12032 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
12033 	return (0);
12034 }
12035 
12036 /* Get interface MTU. */
12037 /* ARGSUSED */
12038 int
12039 ip_sioctl_get_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12040 	ip_ioctl_cmd_t *ipip, void *if_req)
12041 {
12042 	struct ifreq	*ifr;
12043 	struct lifreq	*lifr;
12044 
12045 	ip1dbg(("ip_sioctl_get_mtu(%s:%u %p)\n",
12046 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12047 	if (ipip->ipi_cmd_type == IF_CMD) {
12048 		ifr = (struct ifreq *)if_req;
12049 		ifr->ifr_metric = ipif->ipif_mtu;
12050 	} else {
12051 		lifr = (struct lifreq *)if_req;
12052 		lifr->lifr_mtu = ipif->ipif_mtu;
12053 	}
12054 	return (0);
12055 }
12056 
12057 /* Set interface broadcast address. */
12058 /* ARGSUSED2 */
12059 int
12060 ip_sioctl_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12061 	ip_ioctl_cmd_t *ipip, void *if_req)
12062 {
12063 	ipaddr_t addr;
12064 	ire_t	*ire;
12065 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
12066 
12067 	ip1dbg(("ip_sioctl_brdaddr(%s:%u)\n", ipif->ipif_ill->ill_name,
12068 	    ipif->ipif_id));
12069 
12070 	ASSERT(IAM_WRITER_IPIF(ipif));
12071 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
12072 		return (EADDRNOTAVAIL);
12073 
12074 	ASSERT(!(ipif->ipif_isv6));	/* No IPv6 broadcast */
12075 
12076 	if (sin->sin_family != AF_INET)
12077 		return (EAFNOSUPPORT);
12078 
12079 	addr = sin->sin_addr.s_addr;
12080 	if (ipif->ipif_flags & IPIF_UP) {
12081 		/*
12082 		 * If we are already up, make sure the new
12083 		 * broadcast address makes sense.  If it does,
12084 		 * there should be an IRE for it already.
12085 		 * Don't match on ipif, only on the ill
12086 		 * since we are sharing these now.
12087 		 */
12088 		ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST,
12089 		    ipif, ALL_ZONES, NULL,
12090 		    (MATCH_IRE_ILL | MATCH_IRE_TYPE), ipst);
12091 		if (ire == NULL) {
12092 			return (EINVAL);
12093 		} else {
12094 			ire_refrele(ire);
12095 		}
12096 	}
12097 	/*
12098 	 * Changing the broadcast addr for this ipif.
12099 	 * Make sure we have valid net and subnet bcast
12100 	 * ire's for other logical interfaces, if needed.
12101 	 */
12102 	if (addr != ipif->ipif_brd_addr)
12103 		ipif_check_bcast_ires(ipif);
12104 	IN6_IPADDR_TO_V4MAPPED(addr, &ipif->ipif_v6brd_addr);
12105 	return (0);
12106 }
12107 
12108 /* Get interface broadcast address. */
12109 /* ARGSUSED */
12110 int
12111 ip_sioctl_get_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12112     ip_ioctl_cmd_t *ipip, void *if_req)
12113 {
12114 	ip1dbg(("ip_sioctl_get_brdaddr(%s:%u %p)\n",
12115 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12116 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
12117 		return (EADDRNOTAVAIL);
12118 
12119 	/* IPIF_BROADCAST not possible with IPv6 */
12120 	ASSERT(!ipif->ipif_isv6);
12121 	*sin = sin_null;
12122 	sin->sin_family = AF_INET;
12123 	sin->sin_addr.s_addr = ipif->ipif_brd_addr;
12124 	return (0);
12125 }
12126 
12127 /*
12128  * This routine is called to handle the SIOCS*IFNETMASK IOCTL.
12129  */
12130 /* ARGSUSED */
12131 int
12132 ip_sioctl_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12133     ip_ioctl_cmd_t *ipip, void *if_req)
12134 {
12135 	int err = 0;
12136 	in6_addr_t v6mask;
12137 
12138 	ip1dbg(("ip_sioctl_netmask(%s:%u %p)\n",
12139 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12140 
12141 	ASSERT(IAM_WRITER_IPIF(ipif));
12142 
12143 	if (ipif->ipif_isv6) {
12144 		sin6_t *sin6;
12145 
12146 		if (sin->sin_family != AF_INET6)
12147 			return (EAFNOSUPPORT);
12148 
12149 		sin6 = (sin6_t *)sin;
12150 		v6mask = sin6->sin6_addr;
12151 	} else {
12152 		ipaddr_t mask;
12153 
12154 		if (sin->sin_family != AF_INET)
12155 			return (EAFNOSUPPORT);
12156 
12157 		mask = sin->sin_addr.s_addr;
12158 		V4MASK_TO_V6(mask, v6mask);
12159 	}
12160 
12161 	/*
12162 	 * No big deal if the interface isn't already up, or the mask
12163 	 * isn't really changing, or this is pt-pt.
12164 	 */
12165 	if (!(ipif->ipif_flags & IPIF_UP) ||
12166 	    IN6_ARE_ADDR_EQUAL(&v6mask, &ipif->ipif_v6net_mask) ||
12167 	    (ipif->ipif_flags & IPIF_POINTOPOINT)) {
12168 		ipif->ipif_v6net_mask = v6mask;
12169 		if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
12170 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
12171 			    ipif->ipif_v6net_mask,
12172 			    ipif->ipif_v6subnet);
12173 		}
12174 		return (0);
12175 	}
12176 	/*
12177 	 * Make sure we have valid net and subnet broadcast ire's
12178 	 * for the old netmask, if needed by other logical interfaces.
12179 	 */
12180 	if (!ipif->ipif_isv6)
12181 		ipif_check_bcast_ires(ipif);
12182 
12183 	err = ipif_logical_down(ipif, q, mp);
12184 	if (err == EINPROGRESS)
12185 		return (err);
12186 	ipif_down_tail(ipif);
12187 	err = ip_sioctl_netmask_tail(ipif, sin, q, mp);
12188 	return (err);
12189 }
12190 
12191 static int
12192 ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp)
12193 {
12194 	in6_addr_t v6mask;
12195 	int err = 0;
12196 
12197 	ip1dbg(("ip_sioctl_netmask_tail(%s:%u %p)\n",
12198 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12199 
12200 	if (ipif->ipif_isv6) {
12201 		sin6_t *sin6;
12202 
12203 		sin6 = (sin6_t *)sin;
12204 		v6mask = sin6->sin6_addr;
12205 	} else {
12206 		ipaddr_t mask;
12207 
12208 		mask = sin->sin_addr.s_addr;
12209 		V4MASK_TO_V6(mask, v6mask);
12210 	}
12211 
12212 	ipif->ipif_v6net_mask = v6mask;
12213 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
12214 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
12215 		    ipif->ipif_v6subnet);
12216 	}
12217 	err = ipif_up(ipif, q, mp);
12218 
12219 	if (err == 0 || err == EINPROGRESS) {
12220 		/*
12221 		 * The interface must be DL_BOUND if this packet has to
12222 		 * go out on the wire. Since we only go through a logical
12223 		 * down and are bound with the driver during an internal
12224 		 * down/up that is satisfied.
12225 		 */
12226 		if (!ipif->ipif_isv6 && ipif->ipif_ill->ill_wq != NULL) {
12227 			/* Potentially broadcast an address mask reply. */
12228 			ipif_mask_reply(ipif);
12229 		}
12230 	}
12231 	return (err);
12232 }
12233 
12234 /* ARGSUSED */
12235 int
12236 ip_sioctl_netmask_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12237     ip_ioctl_cmd_t *ipip, void *if_req)
12238 {
12239 	ip1dbg(("ip_sioctl_netmask_restart(%s:%u %p)\n",
12240 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12241 	ipif_down_tail(ipif);
12242 	return (ip_sioctl_netmask_tail(ipif, sin, q, mp));
12243 }
12244 
12245 /* Get interface net mask. */
12246 /* ARGSUSED */
12247 int
12248 ip_sioctl_get_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12249     ip_ioctl_cmd_t *ipip, void *if_req)
12250 {
12251 	struct lifreq *lifr = (struct lifreq *)if_req;
12252 	struct sockaddr_in6 *sin6 = (sin6_t *)sin;
12253 
12254 	ip1dbg(("ip_sioctl_get_netmask(%s:%u %p)\n",
12255 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12256 
12257 	/*
12258 	 * net mask can't change since we have a reference to the ipif.
12259 	 */
12260 	if (ipif->ipif_isv6) {
12261 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
12262 		*sin6 = sin6_null;
12263 		sin6->sin6_family = AF_INET6;
12264 		sin6->sin6_addr = ipif->ipif_v6net_mask;
12265 		lifr->lifr_addrlen =
12266 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
12267 	} else {
12268 		*sin = sin_null;
12269 		sin->sin_family = AF_INET;
12270 		sin->sin_addr.s_addr = ipif->ipif_net_mask;
12271 		if (ipip->ipi_cmd_type == LIF_CMD) {
12272 			lifr->lifr_addrlen =
12273 			    ip_mask_to_plen(ipif->ipif_net_mask);
12274 		}
12275 	}
12276 	return (0);
12277 }
12278 
12279 /* ARGSUSED */
12280 int
12281 ip_sioctl_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12282     ip_ioctl_cmd_t *ipip, void *if_req)
12283 {
12284 	ip1dbg(("ip_sioctl_metric(%s:%u %p)\n",
12285 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12286 
12287 	/*
12288 	 * Since no applications should ever be setting metrics on underlying
12289 	 * interfaces, we explicitly fail to smoke 'em out.
12290 	 */
12291 	if (IS_UNDER_IPMP(ipif->ipif_ill))
12292 		return (EINVAL);
12293 
12294 	/*
12295 	 * Set interface metric.  We don't use this for
12296 	 * anything but we keep track of it in case it is
12297 	 * important to routing applications or such.
12298 	 */
12299 	if (ipip->ipi_cmd_type == IF_CMD) {
12300 		struct ifreq    *ifr;
12301 
12302 		ifr = (struct ifreq *)if_req;
12303 		ipif->ipif_metric = ifr->ifr_metric;
12304 	} else {
12305 		struct lifreq   *lifr;
12306 
12307 		lifr = (struct lifreq *)if_req;
12308 		ipif->ipif_metric = lifr->lifr_metric;
12309 	}
12310 	return (0);
12311 }
12312 
12313 /* ARGSUSED */
12314 int
12315 ip_sioctl_get_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12316     ip_ioctl_cmd_t *ipip, void *if_req)
12317 {
12318 	/* Get interface metric. */
12319 	ip1dbg(("ip_sioctl_get_metric(%s:%u %p)\n",
12320 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12321 
12322 	if (ipip->ipi_cmd_type == IF_CMD) {
12323 		struct ifreq    *ifr;
12324 
12325 		ifr = (struct ifreq *)if_req;
12326 		ifr->ifr_metric = ipif->ipif_metric;
12327 	} else {
12328 		struct lifreq   *lifr;
12329 
12330 		lifr = (struct lifreq *)if_req;
12331 		lifr->lifr_metric = ipif->ipif_metric;
12332 	}
12333 
12334 	return (0);
12335 }
12336 
12337 /* ARGSUSED */
12338 int
12339 ip_sioctl_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12340     ip_ioctl_cmd_t *ipip, void *if_req)
12341 {
12342 
12343 	ip1dbg(("ip_sioctl_muxid(%s:%u %p)\n",
12344 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12345 	/*
12346 	 * Set the muxid returned from I_PLINK.
12347 	 */
12348 	if (ipip->ipi_cmd_type == IF_CMD) {
12349 		struct ifreq *ifr = (struct ifreq *)if_req;
12350 
12351 		ipif->ipif_ill->ill_ip_muxid = ifr->ifr_ip_muxid;
12352 		ipif->ipif_ill->ill_arp_muxid = ifr->ifr_arp_muxid;
12353 	} else {
12354 		struct lifreq *lifr = (struct lifreq *)if_req;
12355 
12356 		ipif->ipif_ill->ill_ip_muxid = lifr->lifr_ip_muxid;
12357 		ipif->ipif_ill->ill_arp_muxid = lifr->lifr_arp_muxid;
12358 	}
12359 	return (0);
12360 }
12361 
12362 /* ARGSUSED */
12363 int
12364 ip_sioctl_get_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12365     ip_ioctl_cmd_t *ipip, void *if_req)
12366 {
12367 
12368 	ip1dbg(("ip_sioctl_get_muxid(%s:%u %p)\n",
12369 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12370 	/*
12371 	 * Get the muxid saved in ill for I_PUNLINK.
12372 	 */
12373 	if (ipip->ipi_cmd_type == IF_CMD) {
12374 		struct ifreq *ifr = (struct ifreq *)if_req;
12375 
12376 		ifr->ifr_ip_muxid = ipif->ipif_ill->ill_ip_muxid;
12377 		ifr->ifr_arp_muxid = ipif->ipif_ill->ill_arp_muxid;
12378 	} else {
12379 		struct lifreq *lifr = (struct lifreq *)if_req;
12380 
12381 		lifr->lifr_ip_muxid = ipif->ipif_ill->ill_ip_muxid;
12382 		lifr->lifr_arp_muxid = ipif->ipif_ill->ill_arp_muxid;
12383 	}
12384 	return (0);
12385 }
12386 
12387 /*
12388  * Set the subnet prefix. Does not modify the broadcast address.
12389  */
12390 /* ARGSUSED */
12391 int
12392 ip_sioctl_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12393     ip_ioctl_cmd_t *ipip, void *if_req)
12394 {
12395 	int err = 0;
12396 	in6_addr_t v6addr;
12397 	in6_addr_t v6mask;
12398 	boolean_t need_up = B_FALSE;
12399 	int addrlen;
12400 
12401 	ip1dbg(("ip_sioctl_subnet(%s:%u %p)\n",
12402 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12403 
12404 	ASSERT(IAM_WRITER_IPIF(ipif));
12405 	addrlen = ((struct lifreq *)if_req)->lifr_addrlen;
12406 
12407 	if (ipif->ipif_isv6) {
12408 		sin6_t *sin6;
12409 
12410 		if (sin->sin_family != AF_INET6)
12411 			return (EAFNOSUPPORT);
12412 
12413 		sin6 = (sin6_t *)sin;
12414 		v6addr = sin6->sin6_addr;
12415 		if (!ip_remote_addr_ok_v6(&v6addr, &ipv6_all_ones))
12416 			return (EADDRNOTAVAIL);
12417 	} else {
12418 		ipaddr_t addr;
12419 
12420 		if (sin->sin_family != AF_INET)
12421 			return (EAFNOSUPPORT);
12422 
12423 		addr = sin->sin_addr.s_addr;
12424 		if (!ip_addr_ok_v4(addr, 0xFFFFFFFF))
12425 			return (EADDRNOTAVAIL);
12426 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
12427 		/* Add 96 bits */
12428 		addrlen += IPV6_ABITS - IP_ABITS;
12429 	}
12430 
12431 	if (ip_plen_to_mask_v6(addrlen, &v6mask) == NULL)
12432 		return (EINVAL);
12433 
12434 	/* Check if bits in the address is set past the mask */
12435 	if (!V6_MASK_EQ(v6addr, v6mask, v6addr))
12436 		return (EINVAL);
12437 
12438 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6subnet, &v6addr) &&
12439 	    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6net_mask, &v6mask))
12440 		return (0);	/* No change */
12441 
12442 	if (ipif->ipif_flags & IPIF_UP) {
12443 		/*
12444 		 * If the interface is already marked up,
12445 		 * we call ipif_down which will take care
12446 		 * of ditching any IREs that have been set
12447 		 * up based on the old interface address.
12448 		 */
12449 		err = ipif_logical_down(ipif, q, mp);
12450 		if (err == EINPROGRESS)
12451 			return (err);
12452 		ipif_down_tail(ipif);
12453 		need_up = B_TRUE;
12454 	}
12455 
12456 	err = ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, need_up);
12457 	return (err);
12458 }
12459 
12460 static int
12461 ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t v6addr, in6_addr_t v6mask,
12462     queue_t *q, mblk_t *mp, boolean_t need_up)
12463 {
12464 	ill_t	*ill = ipif->ipif_ill;
12465 	int	err = 0;
12466 
12467 	ip1dbg(("ip_sioctl_subnet_tail(%s:%u %p)\n",
12468 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12469 
12470 	/* Set the new address. */
12471 	mutex_enter(&ill->ill_lock);
12472 	ipif->ipif_v6net_mask = v6mask;
12473 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
12474 		V6_MASK_COPY(v6addr, ipif->ipif_v6net_mask,
12475 		    ipif->ipif_v6subnet);
12476 	}
12477 	mutex_exit(&ill->ill_lock);
12478 
12479 	if (need_up) {
12480 		/*
12481 		 * Now bring the interface back up.  If this
12482 		 * is the only IPIF for the ILL, ipif_up
12483 		 * will have to re-bind to the device, so
12484 		 * we may get back EINPROGRESS, in which
12485 		 * case, this IOCTL will get completed in
12486 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
12487 		 */
12488 		err = ipif_up(ipif, q, mp);
12489 		if (err == EINPROGRESS)
12490 			return (err);
12491 	}
12492 	return (err);
12493 }
12494 
12495 /* ARGSUSED */
12496 int
12497 ip_sioctl_subnet_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12498     ip_ioctl_cmd_t *ipip, void *if_req)
12499 {
12500 	int	addrlen;
12501 	in6_addr_t v6addr;
12502 	in6_addr_t v6mask;
12503 	struct lifreq *lifr = (struct lifreq *)if_req;
12504 
12505 	ip1dbg(("ip_sioctl_subnet_restart(%s:%u %p)\n",
12506 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12507 	ipif_down_tail(ipif);
12508 
12509 	addrlen = lifr->lifr_addrlen;
12510 	if (ipif->ipif_isv6) {
12511 		sin6_t *sin6;
12512 
12513 		sin6 = (sin6_t *)sin;
12514 		v6addr = sin6->sin6_addr;
12515 	} else {
12516 		ipaddr_t addr;
12517 
12518 		addr = sin->sin_addr.s_addr;
12519 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
12520 		addrlen += IPV6_ABITS - IP_ABITS;
12521 	}
12522 	(void) ip_plen_to_mask_v6(addrlen, &v6mask);
12523 
12524 	return (ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, B_TRUE));
12525 }
12526 
12527 /* ARGSUSED */
12528 int
12529 ip_sioctl_get_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12530     ip_ioctl_cmd_t *ipip, void *if_req)
12531 {
12532 	struct lifreq *lifr = (struct lifreq *)if_req;
12533 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sin;
12534 
12535 	ip1dbg(("ip_sioctl_get_subnet(%s:%u %p)\n",
12536 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12537 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
12538 
12539 	if (ipif->ipif_isv6) {
12540 		*sin6 = sin6_null;
12541 		sin6->sin6_family = AF_INET6;
12542 		sin6->sin6_addr = ipif->ipif_v6subnet;
12543 		lifr->lifr_addrlen =
12544 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
12545 	} else {
12546 		*sin = sin_null;
12547 		sin->sin_family = AF_INET;
12548 		sin->sin_addr.s_addr = ipif->ipif_subnet;
12549 		lifr->lifr_addrlen = ip_mask_to_plen(ipif->ipif_net_mask);
12550 	}
12551 	return (0);
12552 }
12553 
12554 /*
12555  * Set the IPv6 address token.
12556  */
12557 /* ARGSUSED */
12558 int
12559 ip_sioctl_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12560     ip_ioctl_cmd_t *ipi, void *if_req)
12561 {
12562 	ill_t *ill = ipif->ipif_ill;
12563 	int err;
12564 	in6_addr_t v6addr;
12565 	in6_addr_t v6mask;
12566 	boolean_t need_up = B_FALSE;
12567 	int i;
12568 	sin6_t *sin6 = (sin6_t *)sin;
12569 	struct lifreq *lifr = (struct lifreq *)if_req;
12570 	int addrlen;
12571 
12572 	ip1dbg(("ip_sioctl_token(%s:%u %p)\n",
12573 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12574 	ASSERT(IAM_WRITER_IPIF(ipif));
12575 
12576 	addrlen = lifr->lifr_addrlen;
12577 	/* Only allow for logical unit zero i.e. not on "le0:17" */
12578 	if (ipif->ipif_id != 0)
12579 		return (EINVAL);
12580 
12581 	if (!ipif->ipif_isv6)
12582 		return (EINVAL);
12583 
12584 	if (addrlen > IPV6_ABITS)
12585 		return (EINVAL);
12586 
12587 	v6addr = sin6->sin6_addr;
12588 
12589 	/*
12590 	 * The length of the token is the length from the end.  To get
12591 	 * the proper mask for this, compute the mask of the bits not
12592 	 * in the token; ie. the prefix, and then xor to get the mask.
12593 	 */
12594 	if (ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask) == NULL)
12595 		return (EINVAL);
12596 	for (i = 0; i < 4; i++) {
12597 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
12598 	}
12599 
12600 	if (V6_MASK_EQ(v6addr, v6mask, ill->ill_token) &&
12601 	    ill->ill_token_length == addrlen)
12602 		return (0);	/* No change */
12603 
12604 	if (ipif->ipif_flags & IPIF_UP) {
12605 		err = ipif_logical_down(ipif, q, mp);
12606 		if (err == EINPROGRESS)
12607 			return (err);
12608 		ipif_down_tail(ipif);
12609 		need_up = B_TRUE;
12610 	}
12611 	err = ip_sioctl_token_tail(ipif, sin6, addrlen, q, mp, need_up);
12612 	return (err);
12613 }
12614 
12615 static int
12616 ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen, queue_t *q,
12617     mblk_t *mp, boolean_t need_up)
12618 {
12619 	in6_addr_t v6addr;
12620 	in6_addr_t v6mask;
12621 	ill_t	*ill = ipif->ipif_ill;
12622 	int	i;
12623 	int	err = 0;
12624 
12625 	ip1dbg(("ip_sioctl_token_tail(%s:%u %p)\n",
12626 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12627 	v6addr = sin6->sin6_addr;
12628 	/*
12629 	 * The length of the token is the length from the end.  To get
12630 	 * the proper mask for this, compute the mask of the bits not
12631 	 * in the token; ie. the prefix, and then xor to get the mask.
12632 	 */
12633 	(void) ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask);
12634 	for (i = 0; i < 4; i++)
12635 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
12636 
12637 	mutex_enter(&ill->ill_lock);
12638 	V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
12639 	ill->ill_token_length = addrlen;
12640 	mutex_exit(&ill->ill_lock);
12641 
12642 	if (need_up) {
12643 		/*
12644 		 * Now bring the interface back up.  If this
12645 		 * is the only IPIF for the ILL, ipif_up
12646 		 * will have to re-bind to the device, so
12647 		 * we may get back EINPROGRESS, in which
12648 		 * case, this IOCTL will get completed in
12649 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
12650 		 */
12651 		err = ipif_up(ipif, q, mp);
12652 		if (err == EINPROGRESS)
12653 			return (err);
12654 	}
12655 	return (err);
12656 }
12657 
12658 /* ARGSUSED */
12659 int
12660 ip_sioctl_get_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12661     ip_ioctl_cmd_t *ipi, void *if_req)
12662 {
12663 	ill_t *ill;
12664 	sin6_t *sin6 = (sin6_t *)sin;
12665 	struct lifreq *lifr = (struct lifreq *)if_req;
12666 
12667 	ip1dbg(("ip_sioctl_get_token(%s:%u %p)\n",
12668 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12669 	if (ipif->ipif_id != 0)
12670 		return (EINVAL);
12671 
12672 	ill = ipif->ipif_ill;
12673 	if (!ill->ill_isv6)
12674 		return (ENXIO);
12675 
12676 	*sin6 = sin6_null;
12677 	sin6->sin6_family = AF_INET6;
12678 	ASSERT(!IN6_IS_ADDR_V4MAPPED(&ill->ill_token));
12679 	sin6->sin6_addr = ill->ill_token;
12680 	lifr->lifr_addrlen = ill->ill_token_length;
12681 	return (0);
12682 }
12683 
12684 /*
12685  * Set (hardware) link specific information that might override
12686  * what was acquired through the DL_INFO_ACK.
12687  * The logic is as follows.
12688  *
12689  * become exclusive
12690  * set CHANGING flag
12691  * change mtu on affected IREs
12692  * clear CHANGING flag
12693  *
12694  * An ire add that occurs before the CHANGING flag is set will have its mtu
12695  * changed by the ip_sioctl_lnkinfo.
12696  *
12697  * During the time the CHANGING flag is set, no new ires will be added to the
12698  * bucket, and ire add will fail (due the CHANGING flag).
12699  *
12700  * An ire add that occurs after the CHANGING flag is set will have the right mtu
12701  * before it is added to the bucket.
12702  *
12703  * Obviously only 1 thread can set the CHANGING flag and we need to become
12704  * exclusive to set the flag.
12705  */
12706 /* ARGSUSED */
12707 int
12708 ip_sioctl_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12709     ip_ioctl_cmd_t *ipi, void *if_req)
12710 {
12711 	ill_t		*ill = ipif->ipif_ill;
12712 	ipif_t		*nipif;
12713 	int		ip_min_mtu;
12714 	boolean_t	mtu_walk = B_FALSE;
12715 	struct lifreq	*lifr = (struct lifreq *)if_req;
12716 	lif_ifinfo_req_t *lir;
12717 	ire_t		*ire;
12718 
12719 	ip1dbg(("ip_sioctl_lnkinfo(%s:%u %p)\n",
12720 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12721 	lir = &lifr->lifr_ifinfo;
12722 	ASSERT(IAM_WRITER_IPIF(ipif));
12723 
12724 	/* Only allow for logical unit zero i.e. not on "le0:17" */
12725 	if (ipif->ipif_id != 0)
12726 		return (EINVAL);
12727 
12728 	/* Set interface MTU. */
12729 	if (ipif->ipif_isv6)
12730 		ip_min_mtu = IPV6_MIN_MTU;
12731 	else
12732 		ip_min_mtu = IP_MIN_MTU;
12733 
12734 	/*
12735 	 * Verify values before we set anything. Allow zero to
12736 	 * mean unspecified.
12737 	 */
12738 	if (lir->lir_maxmtu != 0 &&
12739 	    (lir->lir_maxmtu > ill->ill_max_frag ||
12740 	    lir->lir_maxmtu < ip_min_mtu))
12741 		return (EINVAL);
12742 	if (lir->lir_reachtime != 0 &&
12743 	    lir->lir_reachtime > ND_MAX_REACHTIME)
12744 		return (EINVAL);
12745 	if (lir->lir_reachretrans != 0 &&
12746 	    lir->lir_reachretrans > ND_MAX_REACHRETRANSTIME)
12747 		return (EINVAL);
12748 
12749 	mutex_enter(&ill->ill_lock);
12750 	ill->ill_state_flags |= ILL_CHANGING;
12751 	for (nipif = ill->ill_ipif; nipif != NULL;
12752 	    nipif = nipif->ipif_next) {
12753 		nipif->ipif_state_flags |= IPIF_CHANGING;
12754 	}
12755 
12756 	if (lir->lir_maxmtu != 0) {
12757 		ill->ill_max_mtu = lir->lir_maxmtu;
12758 		ill->ill_user_mtu = lir->lir_maxmtu;
12759 		mtu_walk = B_TRUE;
12760 	}
12761 	mutex_exit(&ill->ill_lock);
12762 
12763 	if (lir->lir_reachtime != 0)
12764 		ill->ill_reachable_time = lir->lir_reachtime;
12765 
12766 	if (lir->lir_reachretrans != 0)
12767 		ill->ill_reachable_retrans_time = lir->lir_reachretrans;
12768 
12769 	ill->ill_max_hops = lir->lir_maxhops;
12770 
12771 	ill->ill_max_buf = ND_MAX_Q;
12772 
12773 	if (mtu_walk) {
12774 		/*
12775 		 * Set the MTU on all ipifs associated with this ill except
12776 		 * for those whose MTU was fixed via SIOCSLIFMTU.
12777 		 */
12778 		for (nipif = ill->ill_ipif; nipif != NULL;
12779 		    nipif = nipif->ipif_next) {
12780 			if (nipif->ipif_flags & IPIF_FIXEDMTU)
12781 				continue;
12782 
12783 			nipif->ipif_mtu = ill->ill_max_mtu;
12784 
12785 			if (!(nipif->ipif_flags & IPIF_UP))
12786 				continue;
12787 
12788 			if (nipif->ipif_isv6)
12789 				ire = ipif_to_ire_v6(nipif);
12790 			else
12791 				ire = ipif_to_ire(nipif);
12792 			if (ire != NULL) {
12793 				ire->ire_max_frag = ipif->ipif_mtu;
12794 				ire_refrele(ire);
12795 			}
12796 
12797 			ire_walk_ill(MATCH_IRE_ILL, 0, ipif_mtu_change,
12798 			    nipif, ill);
12799 		}
12800 	}
12801 
12802 	mutex_enter(&ill->ill_lock);
12803 	for (nipif = ill->ill_ipif; nipif != NULL;
12804 	    nipif = nipif->ipif_next) {
12805 		nipif->ipif_state_flags &= ~IPIF_CHANGING;
12806 	}
12807 	ILL_UNMARK_CHANGING(ill);
12808 	mutex_exit(&ill->ill_lock);
12809 
12810 	/*
12811 	 * Refresh IPMP meta-interface MTU if necessary.
12812 	 */
12813 	if (IS_UNDER_IPMP(ill))
12814 		ipmp_illgrp_refresh_mtu(ill->ill_grp);
12815 
12816 	return (0);
12817 }
12818 
12819 /* ARGSUSED */
12820 int
12821 ip_sioctl_get_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12822     ip_ioctl_cmd_t *ipi, void *if_req)
12823 {
12824 	struct lif_ifinfo_req *lir;
12825 	ill_t *ill = ipif->ipif_ill;
12826 
12827 	ip1dbg(("ip_sioctl_get_lnkinfo(%s:%u %p)\n",
12828 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12829 	if (ipif->ipif_id != 0)
12830 		return (EINVAL);
12831 
12832 	lir = &((struct lifreq *)if_req)->lifr_ifinfo;
12833 	lir->lir_maxhops = ill->ill_max_hops;
12834 	lir->lir_reachtime = ill->ill_reachable_time;
12835 	lir->lir_reachretrans = ill->ill_reachable_retrans_time;
12836 	lir->lir_maxmtu = ill->ill_max_mtu;
12837 
12838 	return (0);
12839 }
12840 
12841 /*
12842  * Return best guess as to the subnet mask for the specified address.
12843  * Based on the subnet masks for all the configured interfaces.
12844  *
12845  * We end up returning a zero mask in the case of default, multicast or
12846  * experimental.
12847  */
12848 static ipaddr_t
12849 ip_subnet_mask(ipaddr_t addr, ipif_t **ipifp, ip_stack_t *ipst)
12850 {
12851 	ipaddr_t net_mask;
12852 	ill_t	*ill;
12853 	ipif_t	*ipif;
12854 	ill_walk_context_t ctx;
12855 	ipif_t	*fallback_ipif = NULL;
12856 
12857 	net_mask = ip_net_mask(addr);
12858 	if (net_mask == 0) {
12859 		*ipifp = NULL;
12860 		return (0);
12861 	}
12862 
12863 	/* Let's check to see if this is maybe a local subnet route. */
12864 	/* this function only applies to IPv4 interfaces */
12865 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
12866 	ill = ILL_START_WALK_V4(&ctx, ipst);
12867 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
12868 		mutex_enter(&ill->ill_lock);
12869 		for (ipif = ill->ill_ipif; ipif != NULL;
12870 		    ipif = ipif->ipif_next) {
12871 			if (!IPIF_CAN_LOOKUP(ipif))
12872 				continue;
12873 			if (!(ipif->ipif_flags & IPIF_UP))
12874 				continue;
12875 			if ((ipif->ipif_subnet & net_mask) ==
12876 			    (addr & net_mask)) {
12877 				/*
12878 				 * Don't trust pt-pt interfaces if there are
12879 				 * other interfaces.
12880 				 */
12881 				if (ipif->ipif_flags & IPIF_POINTOPOINT) {
12882 					if (fallback_ipif == NULL) {
12883 						ipif_refhold_locked(ipif);
12884 						fallback_ipif = ipif;
12885 					}
12886 					continue;
12887 				}
12888 
12889 				/*
12890 				 * Fine. Just assume the same net mask as the
12891 				 * directly attached subnet interface is using.
12892 				 */
12893 				ipif_refhold_locked(ipif);
12894 				mutex_exit(&ill->ill_lock);
12895 				rw_exit(&ipst->ips_ill_g_lock);
12896 				if (fallback_ipif != NULL)
12897 					ipif_refrele(fallback_ipif);
12898 				*ipifp = ipif;
12899 				return (ipif->ipif_net_mask);
12900 			}
12901 		}
12902 		mutex_exit(&ill->ill_lock);
12903 	}
12904 	rw_exit(&ipst->ips_ill_g_lock);
12905 
12906 	*ipifp = fallback_ipif;
12907 	return ((fallback_ipif != NULL) ?
12908 	    fallback_ipif->ipif_net_mask : net_mask);
12909 }
12910 
12911 /*
12912  * ip_sioctl_copyin_setup calls ip_wput_ioctl to process the IP_IOCTL ioctl.
12913  */
12914 static void
12915 ip_wput_ioctl(queue_t *q, mblk_t *mp)
12916 {
12917 	IOCP	iocp;
12918 	ipft_t	*ipft;
12919 	ipllc_t	*ipllc;
12920 	mblk_t	*mp1;
12921 	cred_t	*cr;
12922 	int	error = 0;
12923 	conn_t	*connp;
12924 
12925 	ip1dbg(("ip_wput_ioctl"));
12926 	iocp = (IOCP)mp->b_rptr;
12927 	mp1 = mp->b_cont;
12928 	if (mp1 == NULL) {
12929 		iocp->ioc_error = EINVAL;
12930 		mp->b_datap->db_type = M_IOCNAK;
12931 		iocp->ioc_count = 0;
12932 		qreply(q, mp);
12933 		return;
12934 	}
12935 
12936 	/*
12937 	 * These IOCTLs provide various control capabilities to
12938 	 * upstream agents such as ULPs and processes.	There
12939 	 * are currently two such IOCTLs implemented.  They
12940 	 * are used by TCP to provide update information for
12941 	 * existing IREs and to forcibly delete an IRE for a
12942 	 * host that is not responding, thereby forcing an
12943 	 * attempt at a new route.
12944 	 */
12945 	iocp->ioc_error = EINVAL;
12946 	if (!pullupmsg(mp1, sizeof (ipllc->ipllc_cmd)))
12947 		goto done;
12948 
12949 	ipllc = (ipllc_t *)mp1->b_rptr;
12950 	for (ipft = ip_ioctl_ftbl; ipft->ipft_pfi; ipft++) {
12951 		if (ipllc->ipllc_cmd == ipft->ipft_cmd)
12952 			break;
12953 	}
12954 	/*
12955 	 * prefer credential from mblk over ioctl;
12956 	 * see ip_sioctl_copyin_setup
12957 	 */
12958 	cr = msg_getcred(mp, NULL);
12959 	if (cr == NULL)
12960 		cr = iocp->ioc_cr;
12961 
12962 	/*
12963 	 * Refhold the conn in case the request gets queued up in some lookup
12964 	 */
12965 	ASSERT(CONN_Q(q));
12966 	connp = Q_TO_CONN(q);
12967 	CONN_INC_REF(connp);
12968 	if (ipft->ipft_pfi &&
12969 	    ((mp1->b_wptr - mp1->b_rptr) >= ipft->ipft_min_size ||
12970 	    pullupmsg(mp1, ipft->ipft_min_size))) {
12971 		error = (*ipft->ipft_pfi)(q,
12972 		    (ipft->ipft_flags & IPFT_F_SELF_REPLY) ? mp : mp1, cr);
12973 	}
12974 	if (ipft->ipft_flags & IPFT_F_SELF_REPLY) {
12975 		/*
12976 		 * CONN_OPER_PENDING_DONE happens in the function called
12977 		 * through ipft_pfi above.
12978 		 */
12979 		return;
12980 	}
12981 
12982 	CONN_OPER_PENDING_DONE(connp);
12983 	if (ipft->ipft_flags & IPFT_F_NO_REPLY) {
12984 		freemsg(mp);
12985 		return;
12986 	}
12987 	iocp->ioc_error = error;
12988 
12989 done:
12990 	mp->b_datap->db_type = M_IOCACK;
12991 	if (iocp->ioc_error)
12992 		iocp->ioc_count = 0;
12993 	qreply(q, mp);
12994 }
12995 
12996 /*
12997  * Lookup an ipif using the sequence id (ipif_seqid)
12998  */
12999 ipif_t *
13000 ipif_lookup_seqid(ill_t *ill, uint_t seqid)
13001 {
13002 	ipif_t *ipif;
13003 
13004 	ASSERT(MUTEX_HELD(&ill->ill_lock));
13005 
13006 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13007 		if (ipif->ipif_seqid == seqid && IPIF_CAN_LOOKUP(ipif))
13008 			return (ipif);
13009 	}
13010 	return (NULL);
13011 }
13012 
13013 /*
13014  * Assign a unique id for the ipif. This is used later when we send
13015  * IRES to ARP for resolution where we initialize ire_ipif_seqid
13016  * to the value pointed by ire_ipif->ipif_seqid. Later when the
13017  * IRE is added, we verify that ipif has not disappeared.
13018  */
13019 
13020 static void
13021 ipif_assign_seqid(ipif_t *ipif)
13022 {
13023 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
13024 
13025 	ipif->ipif_seqid = atomic_add_64_nv(&ipst->ips_ipif_g_seqid, 1);
13026 }
13027 
13028 /*
13029  * Clone the contents of `sipif' to `dipif'.  Requires that both ipifs are
13030  * administratively down (i.e., no DAD), of the same type, and locked.  Note
13031  * that the clone is complete -- including the seqid -- and the expectation is
13032  * that the caller will either free or overwrite `sipif' before it's unlocked.
13033  */
13034 static void
13035 ipif_clone(const ipif_t *sipif, ipif_t *dipif)
13036 {
13037 	ASSERT(MUTEX_HELD(&sipif->ipif_ill->ill_lock));
13038 	ASSERT(MUTEX_HELD(&dipif->ipif_ill->ill_lock));
13039 	ASSERT(!(sipif->ipif_flags & (IPIF_UP|IPIF_DUPLICATE)));
13040 	ASSERT(!(dipif->ipif_flags & (IPIF_UP|IPIF_DUPLICATE)));
13041 	ASSERT(sipif->ipif_ire_type == dipif->ipif_ire_type);
13042 	ASSERT(sipif->ipif_arp_del_mp == NULL);
13043 	ASSERT(dipif->ipif_arp_del_mp == NULL);
13044 	ASSERT(sipif->ipif_igmp_rpt == NULL);
13045 	ASSERT(dipif->ipif_igmp_rpt == NULL);
13046 	ASSERT(sipif->ipif_multicast_up == 0);
13047 	ASSERT(dipif->ipif_multicast_up == 0);
13048 	ASSERT(sipif->ipif_joined_allhosts == 0);
13049 	ASSERT(dipif->ipif_joined_allhosts == 0);
13050 
13051 	dipif->ipif_mtu = sipif->ipif_mtu;
13052 	dipif->ipif_flags = sipif->ipif_flags;
13053 	dipif->ipif_metric = sipif->ipif_metric;
13054 	dipif->ipif_zoneid = sipif->ipif_zoneid;
13055 	dipif->ipif_v6subnet = sipif->ipif_v6subnet;
13056 	dipif->ipif_v6lcl_addr = sipif->ipif_v6lcl_addr;
13057 	dipif->ipif_v6src_addr = sipif->ipif_v6src_addr;
13058 	dipif->ipif_v6net_mask = sipif->ipif_v6net_mask;
13059 	dipif->ipif_v6brd_addr = sipif->ipif_v6brd_addr;
13060 	dipif->ipif_v6pp_dst_addr = sipif->ipif_v6pp_dst_addr;
13061 
13062 	/*
13063 	 * While dipif is down right now, it might've been up before.  Since
13064 	 * it's changing identity, its packet counters need to be reset.
13065 	 */
13066 	dipif->ipif_ib_pkt_count = 0;
13067 	dipif->ipif_ob_pkt_count = 0;
13068 	dipif->ipif_fo_pkt_count = 0;
13069 
13070 	/*
13071 	 * As per the comment atop the function, we assume that these sipif
13072 	 * fields will be changed before sipif is unlocked.
13073 	 */
13074 	dipif->ipif_seqid = sipif->ipif_seqid;
13075 	dipif->ipif_saved_ire_mp = sipif->ipif_saved_ire_mp;
13076 	dipif->ipif_saved_ire_cnt = sipif->ipif_saved_ire_cnt;
13077 	dipif->ipif_state_flags = sipif->ipif_state_flags;
13078 }
13079 
13080 /*
13081  * Transfer the contents of `sipif' to `dipif', and then free (if `virgipif'
13082  * is NULL) or overwrite `sipif' with `virgipif', which must be a virgin
13083  * (unreferenced) ipif.  Also, if `sipif' is used by the current xop, then
13084  * transfer the xop to `dipif'.  Requires that all ipifs are administratively
13085  * down (i.e., no DAD), of the same type, and unlocked.
13086  */
13087 static void
13088 ipif_transfer(ipif_t *sipif, ipif_t *dipif, ipif_t *virgipif)
13089 {
13090 	ipsq_t *ipsq = sipif->ipif_ill->ill_phyint->phyint_ipsq;
13091 	ipxop_t *ipx = ipsq->ipsq_xop;
13092 
13093 	ASSERT(sipif != dipif);
13094 	ASSERT(sipif != virgipif);
13095 
13096 	/*
13097 	 * Grab all of the locks that protect the ipif in a defined order.
13098 	 */
13099 	GRAB_ILL_LOCKS(sipif->ipif_ill, dipif->ipif_ill);
13100 	if (sipif > dipif) {
13101 		mutex_enter(&sipif->ipif_saved_ire_lock);
13102 		mutex_enter(&dipif->ipif_saved_ire_lock);
13103 	} else {
13104 		mutex_enter(&dipif->ipif_saved_ire_lock);
13105 		mutex_enter(&sipif->ipif_saved_ire_lock);
13106 	}
13107 
13108 	ipif_clone(sipif, dipif);
13109 	if (virgipif != NULL) {
13110 		ipif_clone(virgipif, sipif);
13111 		mi_free(virgipif);
13112 	}
13113 
13114 	mutex_exit(&sipif->ipif_saved_ire_lock);
13115 	mutex_exit(&dipif->ipif_saved_ire_lock);
13116 	RELEASE_ILL_LOCKS(sipif->ipif_ill, dipif->ipif_ill);
13117 
13118 	/*
13119 	 * Transfer ownership of the current xop, if necessary.
13120 	 */
13121 	if (ipx->ipx_current_ipif == sipif) {
13122 		ASSERT(ipx->ipx_pending_ipif == NULL);
13123 		mutex_enter(&ipx->ipx_lock);
13124 		ipx->ipx_current_ipif = dipif;
13125 		mutex_exit(&ipx->ipx_lock);
13126 	}
13127 
13128 	if (virgipif == NULL)
13129 		mi_free(sipif);
13130 }
13131 
13132 /*
13133  * Insert the ipif, so that the list of ipifs on the ill will be sorted
13134  * with respect to ipif_id. Note that an ipif with an ipif_id of -1 will
13135  * be inserted into the first space available in the list. The value of
13136  * ipif_id will then be set to the appropriate value for its position.
13137  */
13138 static int
13139 ipif_insert(ipif_t *ipif, boolean_t acquire_g_lock)
13140 {
13141 	ill_t *ill;
13142 	ipif_t *tipif;
13143 	ipif_t **tipifp;
13144 	int id;
13145 	ip_stack_t	*ipst;
13146 
13147 	ASSERT(ipif->ipif_ill->ill_net_type == IRE_LOOPBACK ||
13148 	    IAM_WRITER_IPIF(ipif));
13149 
13150 	ill = ipif->ipif_ill;
13151 	ASSERT(ill != NULL);
13152 	ipst = ill->ill_ipst;
13153 
13154 	/*
13155 	 * In the case of lo0:0 we already hold the ill_g_lock.
13156 	 * ill_lookup_on_name (acquires ill_g_lock) -> ipif_allocate ->
13157 	 * ipif_insert.
13158 	 */
13159 	if (acquire_g_lock)
13160 		rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
13161 	mutex_enter(&ill->ill_lock);
13162 	id = ipif->ipif_id;
13163 	tipifp = &(ill->ill_ipif);
13164 	if (id == -1) {	/* need to find a real id */
13165 		id = 0;
13166 		while ((tipif = *tipifp) != NULL) {
13167 			ASSERT(tipif->ipif_id >= id);
13168 			if (tipif->ipif_id != id)
13169 				break; /* non-consecutive id */
13170 			id++;
13171 			tipifp = &(tipif->ipif_next);
13172 		}
13173 		/* limit number of logical interfaces */
13174 		if (id >= ipst->ips_ip_addrs_per_if) {
13175 			mutex_exit(&ill->ill_lock);
13176 			if (acquire_g_lock)
13177 				rw_exit(&ipst->ips_ill_g_lock);
13178 			return (-1);
13179 		}
13180 		ipif->ipif_id = id; /* assign new id */
13181 	} else if (id < ipst->ips_ip_addrs_per_if) {
13182 		/* we have a real id; insert ipif in the right place */
13183 		while ((tipif = *tipifp) != NULL) {
13184 			ASSERT(tipif->ipif_id != id);
13185 			if (tipif->ipif_id > id)
13186 				break; /* found correct location */
13187 			tipifp = &(tipif->ipif_next);
13188 		}
13189 	} else {
13190 		mutex_exit(&ill->ill_lock);
13191 		if (acquire_g_lock)
13192 			rw_exit(&ipst->ips_ill_g_lock);
13193 		return (-1);
13194 	}
13195 
13196 	ASSERT(tipifp != &(ill->ill_ipif) || id == 0);
13197 
13198 	ipif->ipif_next = tipif;
13199 	*tipifp = ipif;
13200 	mutex_exit(&ill->ill_lock);
13201 	if (acquire_g_lock)
13202 		rw_exit(&ipst->ips_ill_g_lock);
13203 
13204 	return (0);
13205 }
13206 
13207 static void
13208 ipif_remove(ipif_t *ipif)
13209 {
13210 	ipif_t	**ipifp;
13211 	ill_t	*ill = ipif->ipif_ill;
13212 
13213 	ASSERT(RW_WRITE_HELD(&ill->ill_ipst->ips_ill_g_lock));
13214 
13215 	mutex_enter(&ill->ill_lock);
13216 	ipifp = &ill->ill_ipif;
13217 	for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
13218 		if (*ipifp == ipif) {
13219 			*ipifp = ipif->ipif_next;
13220 			break;
13221 		}
13222 	}
13223 	mutex_exit(&ill->ill_lock);
13224 }
13225 
13226 /*
13227  * Allocate and initialize a new interface control structure.  (Always
13228  * called as writer.)
13229  * When ipif_allocate() is called from ip_ll_subnet_defaults, the ill
13230  * is not part of the global linked list of ills. ipif_seqid is unique
13231  * in the system and to preserve the uniqueness, it is assigned only
13232  * when ill becomes part of the global list. At that point ill will
13233  * have a name. If it doesn't get assigned here, it will get assigned
13234  * in ipif_set_values() as part of SIOCSLIFNAME processing.
13235  * Aditionally, if we come here from ip_ll_subnet_defaults, we don't set
13236  * the interface flags or any other information from the DL_INFO_ACK for
13237  * DL_STYLE2 drivers (initialize == B_FALSE), since we won't have them at
13238  * this point. The flags etc. will be set in ip_ll_subnet_defaults when the
13239  * second DL_INFO_ACK comes in from the driver.
13240  */
13241 static ipif_t *
13242 ipif_allocate(ill_t *ill, int id, uint_t ire_type, boolean_t initialize,
13243     boolean_t insert)
13244 {
13245 	ipif_t	*ipif;
13246 	phyint_t *phyi = ill->ill_phyint;
13247 	ip_stack_t *ipst = ill->ill_ipst;
13248 
13249 	ip1dbg(("ipif_allocate(%s:%d ill %p)\n",
13250 	    ill->ill_name, id, (void *)ill));
13251 	ASSERT(ire_type == IRE_LOOPBACK || IAM_WRITER_ILL(ill));
13252 
13253 	if ((ipif = (ipif_t *)mi_alloc(sizeof (ipif_t), BPRI_MED)) == NULL)
13254 		return (NULL);
13255 	*ipif = ipif_zero;	/* start clean */
13256 
13257 	ipif->ipif_ill = ill;
13258 	ipif->ipif_id = id;	/* could be -1 */
13259 	/*
13260 	 * Inherit the zoneid from the ill; for the shared stack instance
13261 	 * this is always the global zone
13262 	 */
13263 	ipif->ipif_zoneid = ill->ill_zoneid;
13264 
13265 	mutex_init(&ipif->ipif_saved_ire_lock, NULL, MUTEX_DEFAULT, NULL);
13266 
13267 	ipif->ipif_refcnt = 0;
13268 	ipif->ipif_saved_ire_cnt = 0;
13269 
13270 	if (insert) {
13271 		if (ipif_insert(ipif, ire_type != IRE_LOOPBACK) != 0) {
13272 			mi_free(ipif);
13273 			return (NULL);
13274 		}
13275 		/* -1 id should have been replaced by real id */
13276 		id = ipif->ipif_id;
13277 		ASSERT(id >= 0);
13278 	}
13279 
13280 	if (ill->ill_name[0] != '\0')
13281 		ipif_assign_seqid(ipif);
13282 
13283 	/*
13284 	 * If this is ipif zero, configure ill/phyint-wide information.
13285 	 * Defer most configuration until we're guaranteed we're attached.
13286 	 */
13287 	if (id == 0) {
13288 		if (ill->ill_mactype == SUNW_DL_IPMP) {
13289 			/*
13290 			 * Set PHYI_IPMP and also set PHYI_FAILED since there
13291 			 * are no active interfaces.  Similarly, PHYI_RUNNING
13292 			 * isn't set until the group has an active interface.
13293 			 */
13294 			mutex_enter(&phyi->phyint_lock);
13295 			phyi->phyint_flags |= (PHYI_IPMP | PHYI_FAILED);
13296 			mutex_exit(&phyi->phyint_lock);
13297 
13298 			/*
13299 			 * Create the illgrp (which must not exist yet because
13300 			 * the zeroth ipif is created once per ill).  However,
13301 			 * do not not link it to the ipmp_grp_t until I_PLINK
13302 			 * is called; see ip_sioctl_plink_ipmp() for details.
13303 			 */
13304 			if (ipmp_illgrp_create(ill) == NULL) {
13305 				if (insert) {
13306 					rw_enter(&ipst->ips_ill_g_lock,
13307 					    RW_WRITER);
13308 					ipif_remove(ipif);
13309 					rw_exit(&ipst->ips_ill_g_lock);
13310 				}
13311 				mi_free(ipif);
13312 				return (NULL);
13313 			}
13314 		} else {
13315 			/*
13316 			 * By default, PHYI_RUNNING is set when the zeroth
13317 			 * ipif is created.  For other ipifs, we don't touch
13318 			 * it since DLPI notifications may have changed it.
13319 			 */
13320 			mutex_enter(&phyi->phyint_lock);
13321 			phyi->phyint_flags |= PHYI_RUNNING;
13322 			mutex_exit(&phyi->phyint_lock);
13323 		}
13324 	}
13325 
13326 	/*
13327 	 * We grab the ill_lock and phyint_lock to protect the flag changes.
13328 	 * The ipif is still not up and can't be looked up until the
13329 	 * ioctl completes and the IPIF_CHANGING flag is cleared.
13330 	 */
13331 	mutex_enter(&ill->ill_lock);
13332 	mutex_enter(&phyi->phyint_lock);
13333 
13334 	ipif->ipif_ire_type = ire_type;
13335 
13336 	if (ipif->ipif_isv6) {
13337 		ill->ill_flags |= ILLF_IPV6;
13338 	} else {
13339 		ipaddr_t inaddr_any = INADDR_ANY;
13340 
13341 		ill->ill_flags |= ILLF_IPV4;
13342 
13343 		/* Keep the IN6_IS_ADDR_V4MAPPED assertions happy */
13344 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13345 		    &ipif->ipif_v6lcl_addr);
13346 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13347 		    &ipif->ipif_v6src_addr);
13348 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13349 		    &ipif->ipif_v6subnet);
13350 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13351 		    &ipif->ipif_v6net_mask);
13352 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13353 		    &ipif->ipif_v6brd_addr);
13354 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13355 		    &ipif->ipif_v6pp_dst_addr);
13356 	}
13357 
13358 	/*
13359 	 * Don't set the interface flags etc. now, will do it in
13360 	 * ip_ll_subnet_defaults.
13361 	 */
13362 	if (!initialize)
13363 		goto out;
13364 
13365 	ipif->ipif_mtu = ill->ill_max_mtu;
13366 
13367 	/*
13368 	 * NOTE: The IPMP meta-interface is special-cased because it starts
13369 	 * with no underlying interfaces (and thus an unknown broadcast
13370 	 * address length), but all interfaces that can be placed into an IPMP
13371 	 * group are required to be broadcast-capable.
13372 	 */
13373 	if (ill->ill_bcast_addr_length != 0 || IS_IPMP(ill)) {
13374 		/*
13375 		 * Later detect lack of DLPI driver multicast
13376 		 * capability by catching DL_ENABMULTI errors in
13377 		 * ip_rput_dlpi.
13378 		 */
13379 		ill->ill_flags |= ILLF_MULTICAST;
13380 		if (!ipif->ipif_isv6)
13381 			ipif->ipif_flags |= IPIF_BROADCAST;
13382 	} else {
13383 		if (ill->ill_net_type != IRE_LOOPBACK) {
13384 			if (ipif->ipif_isv6)
13385 				/*
13386 				 * Note: xresolv interfaces will eventually need
13387 				 * NOARP set here as well, but that will require
13388 				 * those external resolvers to have some
13389 				 * knowledge of that flag and act appropriately.
13390 				 * Not to be changed at present.
13391 				 */
13392 				ill->ill_flags |= ILLF_NONUD;
13393 			else
13394 				ill->ill_flags |= ILLF_NOARP;
13395 		}
13396 		if (ill->ill_phys_addr_length == 0) {
13397 			if (ill->ill_mactype == SUNW_DL_VNI) {
13398 				ipif->ipif_flags |= IPIF_NOXMIT;
13399 				phyi->phyint_flags |= PHYI_VIRTUAL;
13400 			} else {
13401 				/* pt-pt supports multicast. */
13402 				ill->ill_flags |= ILLF_MULTICAST;
13403 				if (ill->ill_net_type == IRE_LOOPBACK) {
13404 					phyi->phyint_flags |=
13405 					    (PHYI_LOOPBACK | PHYI_VIRTUAL);
13406 				} else {
13407 					ipif->ipif_flags |= IPIF_POINTOPOINT;
13408 				}
13409 			}
13410 		}
13411 	}
13412 out:
13413 	mutex_exit(&phyi->phyint_lock);
13414 	mutex_exit(&ill->ill_lock);
13415 	return (ipif);
13416 }
13417 
13418 /*
13419  * If appropriate, send a message up to the resolver delete the entry
13420  * for the address of this interface which is going out of business.
13421  * (Always called as writer).
13422  *
13423  * NOTE : We need to check for NULL mps as some of the fields are
13424  *	  initialized only for some interface types. See ipif_resolver_up()
13425  *	  for details.
13426  */
13427 void
13428 ipif_resolver_down(ipif_t *ipif)
13429 {
13430 	mblk_t	*mp;
13431 	ill_t	*ill = ipif->ipif_ill;
13432 
13433 	ip1dbg(("ipif_resolver_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
13434 	ASSERT(IAM_WRITER_IPIF(ipif));
13435 
13436 	if (ill->ill_isv6 && !(ill->ill_flags & ILLF_XRESOLV))
13437 		return;
13438 
13439 	/* Delete the mapping for the local address */
13440 	mp = ipif->ipif_arp_del_mp;
13441 	if (mp != NULL) {
13442 		ip1dbg(("ipif_resolver_down: arp cmd %x for %s:%u\n",
13443 		    *(unsigned *)mp->b_rptr, ill->ill_name, ipif->ipif_id));
13444 		putnext(ill->ill_rq, mp);
13445 		ipif->ipif_arp_del_mp = NULL;
13446 	}
13447 
13448 	/*
13449 	 * Make IPMP aware of the deleted data address.
13450 	 */
13451 	if (IS_IPMP(ill))
13452 		ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
13453 
13454 	/*
13455 	 * If this is the last ipif that is going down and there are no
13456 	 * duplicate addresses we may yet attempt to re-probe, then we need to
13457 	 * clean up ARP completely.
13458 	 */
13459 	if (ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0) {
13460 		/*
13461 		 * If this was the last ipif on an IPMP interface, purge any
13462 		 * IPMP ARP entries associated with it.
13463 		 */
13464 		if (IS_IPMP(ill))
13465 			ipmp_illgrp_refresh_arpent(ill->ill_grp);
13466 
13467 		/* Send up AR_INTERFACE_DOWN message */
13468 		mp = ill->ill_arp_down_mp;
13469 		if (mp != NULL) {
13470 			ip1dbg(("ipif_resolver_down: arp cmd %x for %s:%u\n",
13471 			    *(unsigned *)mp->b_rptr, ill->ill_name,
13472 			    ipif->ipif_id));
13473 			putnext(ill->ill_rq, mp);
13474 			ill->ill_arp_down_mp = NULL;
13475 		}
13476 
13477 		/* Tell ARP to delete the multicast mappings */
13478 		mp = ill->ill_arp_del_mapping_mp;
13479 		if (mp != NULL) {
13480 			ip1dbg(("ipif_resolver_down: arp cmd %x for %s:%u\n",
13481 			    *(unsigned *)mp->b_rptr, ill->ill_name,
13482 			    ipif->ipif_id));
13483 			putnext(ill->ill_rq, mp);
13484 			ill->ill_arp_del_mapping_mp = NULL;
13485 		}
13486 	}
13487 }
13488 
13489 /*
13490  * Set up the multicast mappings for `ipif' in ARP.  If `arp_add_mapping_mp'
13491  * is non-NULL, then upon success it will contain an mblk that can be passed
13492  * to ARP to create the mapping.  Otherwise, if it's NULL, upon success ARP
13493  * will have already been notified to create the mapping.  Returns zero on
13494  * success, -1 upon failure.
13495  */
13496 int
13497 ipif_arp_setup_multicast(ipif_t *ipif, mblk_t **arp_add_mapping_mp)
13498 {
13499 	mblk_t	*del_mp = NULL;
13500 	mblk_t *add_mp = NULL;
13501 	mblk_t *mp;
13502 	ill_t	*ill = ipif->ipif_ill;
13503 	phyint_t *phyi = ill->ill_phyint;
13504 	ipaddr_t addr, mask, extract_mask = 0;
13505 	arma_t	*arma;
13506 	uint8_t *maddr, *bphys_addr;
13507 	uint32_t hw_start;
13508 	dl_unitdata_req_t *dlur;
13509 
13510 	ASSERT(IAM_WRITER_IPIF(ipif));
13511 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
13512 		return (0);
13513 
13514 	/*
13515 	 * IPMP meta-interfaces don't have any inherent multicast mappings,
13516 	 * and instead use the ones on the underlying interfaces.
13517 	 */
13518 	if (IS_IPMP(ill))
13519 		return (0);
13520 
13521 	/*
13522 	 * Delete the existing mapping from ARP.  Normally, ipif_down() ->
13523 	 * ipif_resolver_down() will send this up to ARP, but it may be that
13524 	 * we are enabling PHYI_MULTI_BCAST via ip_rput_dlpi_writer().
13525 	 */
13526 	mp = ill->ill_arp_del_mapping_mp;
13527 	if (mp != NULL) {
13528 		ip1dbg(("ipif_arp_setup_multicast: arp cmd %x for %s:%u\n",
13529 		    *(unsigned *)mp->b_rptr, ill->ill_name, ipif->ipif_id));
13530 		putnext(ill->ill_rq, mp);
13531 		ill->ill_arp_del_mapping_mp = NULL;
13532 	}
13533 
13534 	if (arp_add_mapping_mp != NULL)
13535 		*arp_add_mapping_mp = NULL;
13536 
13537 	/*
13538 	 * Check that the address is not to long for the constant
13539 	 * length reserved in the template arma_t.
13540 	 */
13541 	if (ill->ill_phys_addr_length > IP_MAX_HW_LEN)
13542 		return (-1);
13543 
13544 	/* Add mapping mblk */
13545 	addr = (ipaddr_t)htonl(INADDR_UNSPEC_GROUP);
13546 	mask = (ipaddr_t)htonl(IN_CLASSD_NET);
13547 	add_mp = ill_arp_alloc(ill, (uchar_t *)&ip_arma_multi_template,
13548 	    (caddr_t)&addr);
13549 	if (add_mp == NULL)
13550 		return (-1);
13551 	arma = (arma_t *)add_mp->b_rptr;
13552 	maddr = (uint8_t *)arma + arma->arma_hw_addr_offset;
13553 	bcopy(&mask, (char *)arma + arma->arma_proto_mask_offset, IP_ADDR_LEN);
13554 	arma->arma_hw_addr_length = ill->ill_phys_addr_length;
13555 
13556 	/*
13557 	 * Determine the broadcast address.
13558 	 */
13559 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
13560 	if (ill->ill_sap_length < 0)
13561 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
13562 	else
13563 		bphys_addr = (uchar_t *)dlur +
13564 		    dlur->dl_dest_addr_offset + ill->ill_sap_length;
13565 	/*
13566 	 * Check PHYI_MULTI_BCAST and length of physical
13567 	 * address to determine if we use the mapping or the
13568 	 * broadcast address.
13569 	 */
13570 	if (!(phyi->phyint_flags & PHYI_MULTI_BCAST))
13571 		if (!MEDIA_V4MINFO(ill->ill_media, ill->ill_phys_addr_length,
13572 		    bphys_addr, maddr, &hw_start, &extract_mask))
13573 			phyi->phyint_flags |= PHYI_MULTI_BCAST;
13574 
13575 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) ||
13576 	    (ill->ill_flags & ILLF_MULTICAST)) {
13577 		/* Make sure this will not match the "exact" entry. */
13578 		addr = (ipaddr_t)htonl(INADDR_ALLHOSTS_GROUP);
13579 		del_mp = ill_arp_alloc(ill, (uchar_t *)&ip_ared_template,
13580 		    (caddr_t)&addr);
13581 		if (del_mp == NULL) {
13582 			freemsg(add_mp);
13583 			return (-1);
13584 		}
13585 		bcopy(&extract_mask, (char *)arma +
13586 		    arma->arma_proto_extract_mask_offset, IP_ADDR_LEN);
13587 		if (phyi->phyint_flags & PHYI_MULTI_BCAST) {
13588 			/* Use link-layer broadcast address for MULTI_BCAST */
13589 			bcopy(bphys_addr, maddr, ill->ill_phys_addr_length);
13590 			ip2dbg(("ipif_arp_setup_multicast: adding"
13591 			    " MULTI_BCAST ARP setup for %s\n", ill->ill_name));
13592 		} else {
13593 			arma->arma_hw_mapping_start = hw_start;
13594 			ip2dbg(("ipif_arp_setup_multicast: adding multicast"
13595 			    " ARP setup for %s\n", ill->ill_name));
13596 		}
13597 	} else {
13598 		freemsg(add_mp);
13599 		ASSERT(del_mp == NULL);
13600 		/* It is neither MULTICAST nor MULTI_BCAST */
13601 		return (0);
13602 	}
13603 	ASSERT(add_mp != NULL && del_mp != NULL);
13604 	ASSERT(ill->ill_arp_del_mapping_mp == NULL);
13605 	ill->ill_arp_del_mapping_mp = del_mp;
13606 	if (arp_add_mapping_mp != NULL) {
13607 		/* The caller just wants the mblks allocated */
13608 		*arp_add_mapping_mp = add_mp;
13609 	} else {
13610 		/* The caller wants us to send it to arp */
13611 		putnext(ill->ill_rq, add_mp);
13612 	}
13613 	return (0);
13614 }
13615 
13616 /*
13617  * Get the resolver set up for a new IP address.  (Always called as writer.)
13618  * Called both for IPv4 and IPv6 interfaces, though it only sets up the
13619  * resolver for v6 if it's an ILLF_XRESOLV interface.  Honors ILLF_NOARP.
13620  *
13621  * The enumerated value res_act tunes the behavior:
13622  * 	* Res_act_initial: set up all the resolver structures for a new
13623  *	  IP address.
13624  *	* Res_act_defend: tell ARP that it needs to send a single gratuitous
13625  *	  ARP message in defense of the address.
13626  *	* Res_act_rebind: tell ARP to change the hardware address for an IP
13627  *	  address (and issue gratuitous ARPs).  Used by ipmp_ill_bind_ipif().
13628  *
13629  * Returns zero on success, or an errno upon failure.
13630  */
13631 int
13632 ipif_resolver_up(ipif_t *ipif, enum ip_resolver_action res_act)
13633 {
13634 	mblk_t	*arp_up_mp = NULL;
13635 	mblk_t	*arp_down_mp = NULL;
13636 	mblk_t	*arp_add_mp = NULL;
13637 	mblk_t	*arp_del_mp = NULL;
13638 	mblk_t	*arp_add_mapping_mp = NULL;
13639 	mblk_t	*arp_del_mapping_mp = NULL;
13640 	ill_t	*ill = ipif->ipif_ill;
13641 	int	err = ENOMEM;
13642 	boolean_t added_ipif = B_FALSE;
13643 	boolean_t publish;
13644 	boolean_t was_dup;
13645 
13646 	ip1dbg(("ipif_resolver_up(%s:%u) flags 0x%x\n",
13647 	    ill->ill_name, ipif->ipif_id, (uint_t)ipif->ipif_flags));
13648 	ASSERT(IAM_WRITER_IPIF(ipif));
13649 
13650 	was_dup = B_FALSE;
13651 	if (res_act == Res_act_initial) {
13652 		ipif->ipif_addr_ready = 0;
13653 		/*
13654 		 * We're bringing an interface up here.  There's no way that we
13655 		 * should need to shut down ARP now.
13656 		 */
13657 		mutex_enter(&ill->ill_lock);
13658 		if (ipif->ipif_flags & IPIF_DUPLICATE) {
13659 			ipif->ipif_flags &= ~IPIF_DUPLICATE;
13660 			ill->ill_ipif_dup_count--;
13661 			was_dup = B_TRUE;
13662 		}
13663 		mutex_exit(&ill->ill_lock);
13664 	}
13665 	if (ipif->ipif_recovery_id != 0)
13666 		(void) untimeout(ipif->ipif_recovery_id);
13667 	ipif->ipif_recovery_id = 0;
13668 	if (ill->ill_net_type != IRE_IF_RESOLVER) {
13669 		ipif->ipif_addr_ready = 1;
13670 		return (0);
13671 	}
13672 	/* NDP will set the ipif_addr_ready flag when it's ready */
13673 	if (ill->ill_isv6 && !(ill->ill_flags & ILLF_XRESOLV))
13674 		return (0);
13675 
13676 	if (ill->ill_isv6) {
13677 		/*
13678 		 * External resolver for IPv6
13679 		 */
13680 		ASSERT(res_act == Res_act_initial);
13681 		publish = !IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr);
13682 	} else {
13683 		/*
13684 		 * IPv4 arp case. If the ARP stream has already started
13685 		 * closing, fail this request for ARP bringup. Else
13686 		 * record the fact that an ARP bringup is pending.
13687 		 */
13688 		mutex_enter(&ill->ill_lock);
13689 		if (ill->ill_arp_closing) {
13690 			mutex_exit(&ill->ill_lock);
13691 			err = EINVAL;
13692 			goto failed;
13693 		} else {
13694 			if (ill->ill_ipif_up_count == 0 &&
13695 			    ill->ill_ipif_dup_count == 0 && !was_dup)
13696 				ill->ill_arp_bringup_pending = 1;
13697 			mutex_exit(&ill->ill_lock);
13698 		}
13699 		publish = (ipif->ipif_lcl_addr != INADDR_ANY);
13700 	}
13701 
13702 	if (IS_IPMP(ill) && publish) {
13703 		/*
13704 		 * If we're here via ipif_up(), then the ipif won't be bound
13705 		 * yet -- add it to the group, which will bind it if possible.
13706 		 * (We would add it in ipif_up(), but deleting on failure
13707 		 * there is gruesome.)  If we're here via ipmp_ill_bind_ipif(),
13708 		 * then the ipif has already been added to the group and we
13709 		 * just need to use the binding.
13710 		 */
13711 		if (ipmp_ipif_bound_ill(ipif) == NULL) {
13712 			if (ipmp_illgrp_add_ipif(ill->ill_grp, ipif) == NULL) {
13713 				/*
13714 				 * We couldn't bind the ipif to an ill yet,
13715 				 * so we have nothing to publish.
13716 				 */
13717 				publish = B_FALSE;
13718 			}
13719 			added_ipif = B_TRUE;
13720 		}
13721 	}
13722 
13723 	/*
13724 	 * Add an entry for the local address in ARP only if it
13725 	 * is not UNNUMBERED and it is suitable for publishing.
13726 	 */
13727 	if (!(ipif->ipif_flags & IPIF_UNNUMBERED) && publish) {
13728 		if (res_act == Res_act_defend) {
13729 			arp_add_mp = ipif_area_alloc(ipif, ACE_F_DEFEND);
13730 			if (arp_add_mp == NULL)
13731 				goto failed;
13732 			/*
13733 			 * If we're just defending our address now, then
13734 			 * there's no need to set up ARP multicast mappings.
13735 			 * The publish command is enough.
13736 			 */
13737 			goto done;
13738 		}
13739 
13740 		/*
13741 		 * Allocate an ARP add message and an ARP delete message (the
13742 		 * latter is saved for use when the address goes down).
13743 		 */
13744 		if ((arp_add_mp = ipif_area_alloc(ipif, 0)) == NULL)
13745 			goto failed;
13746 
13747 		if ((arp_del_mp = ipif_ared_alloc(ipif)) == NULL)
13748 			goto failed;
13749 
13750 		if (res_act != Res_act_initial)
13751 			goto arp_setup_multicast;
13752 	} else {
13753 		if (res_act != Res_act_initial)
13754 			goto done;
13755 	}
13756 	/*
13757 	 * Need to bring up ARP or setup multicast mapping only
13758 	 * when the first interface is coming UP.
13759 	 */
13760 	if (ill->ill_ipif_up_count + ill->ill_ipif_dup_count > 0 || was_dup)
13761 		goto done;
13762 
13763 	/*
13764 	 * Allocate an ARP down message (to be saved) and an ARP up message.
13765 	 */
13766 	arp_down_mp = ill_arp_alloc(ill, (uchar_t *)&ip_ard_template, 0);
13767 	if (arp_down_mp == NULL)
13768 		goto failed;
13769 
13770 	arp_up_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aru_template, 0);
13771 	if (arp_up_mp == NULL)
13772 		goto failed;
13773 
13774 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
13775 		goto done;
13776 
13777 arp_setup_multicast:
13778 	/*
13779 	 * Setup the multicast mappings. This function initializes
13780 	 * ill_arp_del_mapping_mp also. This does not need to be done for
13781 	 * IPv6, or for the IPMP interface (since it has no link-layer).
13782 	 */
13783 	if (!ill->ill_isv6 && !IS_IPMP(ill)) {
13784 		err = ipif_arp_setup_multicast(ipif, &arp_add_mapping_mp);
13785 		if (err != 0)
13786 			goto failed;
13787 		ASSERT(ill->ill_arp_del_mapping_mp != NULL);
13788 		ASSERT(arp_add_mapping_mp != NULL);
13789 	}
13790 done:
13791 	if (arp_up_mp != NULL) {
13792 		ip1dbg(("ipif_resolver_up: ARP_UP for %s:%u\n",
13793 		    ill->ill_name, ipif->ipif_id));
13794 		putnext(ill->ill_rq, arp_up_mp);
13795 		arp_up_mp = NULL;
13796 	}
13797 	if (arp_add_mp != NULL) {
13798 		ip1dbg(("ipif_resolver_up: ARP_ADD for %s:%u\n",
13799 		    ill->ill_name, ipif->ipif_id));
13800 		/*
13801 		 * If it's an extended ARP implementation, then we'll wait to
13802 		 * hear that DAD has finished before using the interface.
13803 		 */
13804 		if (!ill->ill_arp_extend)
13805 			ipif->ipif_addr_ready = 1;
13806 		putnext(ill->ill_rq, arp_add_mp);
13807 		arp_add_mp = NULL;
13808 	} else {
13809 		ipif->ipif_addr_ready = 1;
13810 	}
13811 	if (arp_add_mapping_mp != NULL) {
13812 		ip1dbg(("ipif_resolver_up: MAPPING_ADD for %s:%u\n",
13813 		    ill->ill_name, ipif->ipif_id));
13814 		putnext(ill->ill_rq, arp_add_mapping_mp);
13815 		arp_add_mapping_mp = NULL;
13816 	}
13817 
13818 	if (res_act == Res_act_initial) {
13819 		if (ill->ill_flags & ILLF_NOARP)
13820 			err = ill_arp_off(ill);
13821 		else
13822 			err = ill_arp_on(ill);
13823 		if (err != 0) {
13824 			ip0dbg(("ipif_resolver_up: arp_on/off failed %d\n",
13825 			    err));
13826 			goto failed;
13827 		}
13828 	}
13829 
13830 	if (arp_del_mp != NULL) {
13831 		ASSERT(ipif->ipif_arp_del_mp == NULL);
13832 		ipif->ipif_arp_del_mp = arp_del_mp;
13833 	}
13834 	if (arp_down_mp != NULL) {
13835 		ASSERT(ill->ill_arp_down_mp == NULL);
13836 		ill->ill_arp_down_mp = arp_down_mp;
13837 	}
13838 	if (arp_del_mapping_mp != NULL) {
13839 		ASSERT(ill->ill_arp_del_mapping_mp == NULL);
13840 		ill->ill_arp_del_mapping_mp = arp_del_mapping_mp;
13841 	}
13842 
13843 	return ((ill->ill_ipif_up_count != 0 || was_dup ||
13844 	    ill->ill_ipif_dup_count != 0) ? 0 : EINPROGRESS);
13845 failed:
13846 	ip1dbg(("ipif_resolver_up: FAILED\n"));
13847 	if (added_ipif)
13848 		ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
13849 	freemsg(arp_add_mp);
13850 	freemsg(arp_del_mp);
13851 	freemsg(arp_add_mapping_mp);
13852 	freemsg(arp_up_mp);
13853 	freemsg(arp_down_mp);
13854 	ill->ill_arp_bringup_pending = 0;
13855 	return (err);
13856 }
13857 
13858 /*
13859  * This routine restarts IPv4 duplicate address detection (DAD) when a link has
13860  * just gone back up.
13861  */
13862 static void
13863 ipif_arp_start_dad(ipif_t *ipif)
13864 {
13865 	ill_t *ill = ipif->ipif_ill;
13866 	mblk_t *arp_add_mp;
13867 
13868 	/* ACE_F_UNVERIFIED restarts DAD */
13869 	if (ill->ill_net_type != IRE_IF_RESOLVER || ill->ill_arp_closing ||
13870 	    (ipif->ipif_flags & IPIF_UNNUMBERED) ||
13871 	    ipif->ipif_lcl_addr == INADDR_ANY ||
13872 	    (arp_add_mp = ipif_area_alloc(ipif, ACE_F_UNVERIFIED)) == NULL) {
13873 		/*
13874 		 * If we can't contact ARP for some reason, that's not really a
13875 		 * problem.  Just send out the routing socket notification that
13876 		 * DAD completion would have done, and continue.
13877 		 */
13878 		ipif_mask_reply(ipif);
13879 		ipif_up_notify(ipif);
13880 		ipif->ipif_addr_ready = 1;
13881 		return;
13882 	}
13883 
13884 	putnext(ill->ill_rq, arp_add_mp);
13885 }
13886 
13887 static void
13888 ipif_ndp_start_dad(ipif_t *ipif)
13889 {
13890 	nce_t *nce;
13891 
13892 	nce = ndp_lookup_v6(ipif->ipif_ill, B_TRUE, &ipif->ipif_v6lcl_addr,
13893 	    B_FALSE);
13894 	if (nce == NULL)
13895 		return;
13896 
13897 	if (!ndp_restart_dad(nce)) {
13898 		/*
13899 		 * If we can't restart DAD for some reason, that's not really a
13900 		 * problem.  Just send out the routing socket notification that
13901 		 * DAD completion would have done, and continue.
13902 		 */
13903 		ipif_up_notify(ipif);
13904 		ipif->ipif_addr_ready = 1;
13905 	}
13906 	NCE_REFRELE(nce);
13907 }
13908 
13909 /*
13910  * Restart duplicate address detection on all interfaces on the given ill.
13911  *
13912  * This is called when an interface transitions from down to up
13913  * (DL_NOTE_LINK_UP) or up to down (DL_NOTE_LINK_DOWN).
13914  *
13915  * Note that since the underlying physical link has transitioned, we must cause
13916  * at least one routing socket message to be sent here, either via DAD
13917  * completion or just by default on the first ipif.  (If we don't do this, then
13918  * in.mpathd will see long delays when doing link-based failure recovery.)
13919  */
13920 void
13921 ill_restart_dad(ill_t *ill, boolean_t went_up)
13922 {
13923 	ipif_t *ipif;
13924 
13925 	if (ill == NULL)
13926 		return;
13927 
13928 	/*
13929 	 * If layer two doesn't support duplicate address detection, then just
13930 	 * send the routing socket message now and be done with it.
13931 	 */
13932 	if ((ill->ill_isv6 && (ill->ill_flags & ILLF_XRESOLV)) ||
13933 	    (!ill->ill_isv6 && !ill->ill_arp_extend)) {
13934 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
13935 		return;
13936 	}
13937 
13938 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13939 		if (went_up) {
13940 			if (ipif->ipif_flags & IPIF_UP) {
13941 				if (ill->ill_isv6)
13942 					ipif_ndp_start_dad(ipif);
13943 				else
13944 					ipif_arp_start_dad(ipif);
13945 			} else if (ill->ill_isv6 &&
13946 			    (ipif->ipif_flags & IPIF_DUPLICATE)) {
13947 				/*
13948 				 * For IPv4, the ARP module itself will
13949 				 * automatically start the DAD process when it
13950 				 * sees DL_NOTE_LINK_UP.  We respond to the
13951 				 * AR_CN_READY at the completion of that task.
13952 				 * For IPv6, we must kick off the bring-up
13953 				 * process now.
13954 				 */
13955 				ndp_do_recovery(ipif);
13956 			} else {
13957 				/*
13958 				 * Unfortunately, the first ipif is "special"
13959 				 * and represents the underlying ill in the
13960 				 * routing socket messages.  Thus, when this
13961 				 * one ipif is down, we must still notify so
13962 				 * that the user knows the IFF_RUNNING status
13963 				 * change.  (If the first ipif is up, then
13964 				 * we'll handle eventual routing socket
13965 				 * notification via DAD completion.)
13966 				 */
13967 				if (ipif == ill->ill_ipif) {
13968 					ip_rts_ifmsg(ill->ill_ipif,
13969 					    RTSQ_DEFAULT);
13970 				}
13971 			}
13972 		} else {
13973 			/*
13974 			 * After link down, we'll need to send a new routing
13975 			 * message when the link comes back, so clear
13976 			 * ipif_addr_ready.
13977 			 */
13978 			ipif->ipif_addr_ready = 0;
13979 		}
13980 	}
13981 
13982 	/*
13983 	 * If we've torn down links, then notify the user right away.
13984 	 */
13985 	if (!went_up)
13986 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
13987 }
13988 
13989 static void
13990 ipsq_delete(ipsq_t *ipsq)
13991 {
13992 	ipxop_t *ipx = ipsq->ipsq_xop;
13993 
13994 	ipsq->ipsq_ipst = NULL;
13995 	ASSERT(ipsq->ipsq_phyint == NULL);
13996 	ASSERT(ipsq->ipsq_xop != NULL);
13997 	ASSERT(ipsq->ipsq_xopq_mphead == NULL && ipx->ipx_mphead == NULL);
13998 	ASSERT(ipx->ipx_pending_mp == NULL);
13999 	kmem_free(ipsq, sizeof (ipsq_t));
14000 }
14001 
14002 static int
14003 ill_up_ipifs_on_ill(ill_t *ill, queue_t *q, mblk_t *mp)
14004 {
14005 	int err;
14006 	ipif_t *ipif;
14007 
14008 	if (ill == NULL)
14009 		return (0);
14010 
14011 	/*
14012 	 * Except for ipif_state_flags and ill_state_flags the other
14013 	 * fields of the ipif/ill that are modified below are protected
14014 	 * implicitly since we are a writer. We would have tried to down
14015 	 * even an ipif that was already down, in ill_down_ipifs. So we
14016 	 * just blindly clear the IPIF_CHANGING flag here on all ipifs.
14017 	 */
14018 	ASSERT(IAM_WRITER_ILL(ill));
14019 
14020 	ill->ill_up_ipifs = B_TRUE;
14021 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
14022 		mutex_enter(&ill->ill_lock);
14023 		ipif->ipif_state_flags &= ~IPIF_CHANGING;
14024 		mutex_exit(&ill->ill_lock);
14025 		if (ipif->ipif_was_up) {
14026 			if (!(ipif->ipif_flags & IPIF_UP))
14027 				err = ipif_up(ipif, q, mp);
14028 			ipif->ipif_was_up = B_FALSE;
14029 			if (err != 0) {
14030 				ASSERT(err == EINPROGRESS);
14031 				return (err);
14032 			}
14033 		}
14034 	}
14035 	mutex_enter(&ill->ill_lock);
14036 	ill->ill_state_flags &= ~ILL_CHANGING;
14037 	mutex_exit(&ill->ill_lock);
14038 	ill->ill_up_ipifs = B_FALSE;
14039 	return (0);
14040 }
14041 
14042 /*
14043  * This function is called to bring up all the ipifs that were up before
14044  * bringing the ill down via ill_down_ipifs().
14045  */
14046 int
14047 ill_up_ipifs(ill_t *ill, queue_t *q, mblk_t *mp)
14048 {
14049 	int err;
14050 
14051 	ASSERT(IAM_WRITER_ILL(ill));
14052 
14053 	err = ill_up_ipifs_on_ill(ill->ill_phyint->phyint_illv4, q, mp);
14054 	if (err != 0)
14055 		return (err);
14056 
14057 	return (ill_up_ipifs_on_ill(ill->ill_phyint->phyint_illv6, q, mp));
14058 }
14059 
14060 /*
14061  * Bring down any IPIF_UP ipifs on ill.
14062  */
14063 static void
14064 ill_down_ipifs(ill_t *ill)
14065 {
14066 	ipif_t *ipif;
14067 
14068 	ASSERT(IAM_WRITER_ILL(ill));
14069 
14070 	/*
14071 	 * Except for ipif_state_flags the other fields of the ipif/ill that
14072 	 * are modified below are protected implicitly since we are a writer
14073 	 */
14074 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
14075 		/*
14076 		 * We go through the ipif_down logic even if the ipif
14077 		 * is already down, since routes can be added based
14078 		 * on down ipifs. Going through ipif_down once again
14079 		 * will delete any IREs created based on these routes.
14080 		 */
14081 		if (ipif->ipif_flags & IPIF_UP)
14082 			ipif->ipif_was_up = B_TRUE;
14083 
14084 		mutex_enter(&ill->ill_lock);
14085 		ipif->ipif_state_flags |= IPIF_CHANGING;
14086 		mutex_exit(&ill->ill_lock);
14087 
14088 		/*
14089 		 * Need to re-create net/subnet bcast ires if
14090 		 * they are dependent on ipif.
14091 		 */
14092 		if (!ipif->ipif_isv6)
14093 			ipif_check_bcast_ires(ipif);
14094 		(void) ipif_logical_down(ipif, NULL, NULL);
14095 		ipif_non_duplicate(ipif);
14096 		ipif_down_tail(ipif);
14097 	}
14098 }
14099 
14100 /*
14101  * Redo source address selection.  This is called when a
14102  * non-NOLOCAL/DEPRECATED/ANYCAST ipif comes up.
14103  */
14104 void
14105 ill_update_source_selection(ill_t *ill)
14106 {
14107 	ipif_t *ipif;
14108 
14109 	ASSERT(IAM_WRITER_ILL(ill));
14110 
14111 	/*
14112 	 * Underlying interfaces are only used for test traffic and thus
14113 	 * should always send with their (deprecated) source addresses.
14114 	 */
14115 	if (IS_UNDER_IPMP(ill))
14116 		return;
14117 
14118 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
14119 		if (ill->ill_isv6)
14120 			ipif_recreate_interface_routes_v6(NULL, ipif);
14121 		else
14122 			ipif_recreate_interface_routes(NULL, ipif);
14123 	}
14124 }
14125 
14126 /*
14127  * Finish the group join started in ip_sioctl_groupname().
14128  */
14129 /* ARGSUSED */
14130 static void
14131 ip_join_illgrps(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy)
14132 {
14133 	ill_t		*ill = q->q_ptr;
14134 	phyint_t	*phyi = ill->ill_phyint;
14135 	ipmp_grp_t	*grp = phyi->phyint_grp;
14136 	ip_stack_t	*ipst = ill->ill_ipst;
14137 
14138 	/* IS_UNDER_IPMP() won't work until ipmp_ill_join_illgrp() is called */
14139 	ASSERT(!IS_IPMP(ill) && grp != NULL);
14140 	ASSERT(IAM_WRITER_IPSQ(ipsq));
14141 
14142 	if (phyi->phyint_illv4 != NULL) {
14143 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
14144 		VERIFY(grp->gr_pendv4-- > 0);
14145 		rw_exit(&ipst->ips_ipmp_lock);
14146 		ipmp_ill_join_illgrp(phyi->phyint_illv4, grp->gr_v4);
14147 	}
14148 	if (phyi->phyint_illv6 != NULL) {
14149 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
14150 		VERIFY(grp->gr_pendv6-- > 0);
14151 		rw_exit(&ipst->ips_ipmp_lock);
14152 		ipmp_ill_join_illgrp(phyi->phyint_illv6, grp->gr_v6);
14153 	}
14154 	freemsg(mp);
14155 }
14156 
14157 /*
14158  * Process an SIOCSLIFGROUPNAME request.
14159  */
14160 /* ARGSUSED */
14161 int
14162 ip_sioctl_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
14163     ip_ioctl_cmd_t *ipip, void *ifreq)
14164 {
14165 	struct lifreq	*lifr = ifreq;
14166 	ill_t		*ill = ipif->ipif_ill;
14167 	ip_stack_t	*ipst = ill->ill_ipst;
14168 	phyint_t	*phyi = ill->ill_phyint;
14169 	ipmp_grp_t	*grp = phyi->phyint_grp;
14170 	mblk_t		*ipsq_mp;
14171 	int		err = 0;
14172 
14173 	/*
14174 	 * Note that phyint_grp can only change here, where we're exclusive.
14175 	 */
14176 	ASSERT(IAM_WRITER_ILL(ill));
14177 
14178 	if (ipif->ipif_id != 0 || ill->ill_usesrc_grp_next != NULL ||
14179 	    (phyi->phyint_flags & PHYI_VIRTUAL))
14180 		return (EINVAL);
14181 
14182 	lifr->lifr_groupname[LIFGRNAMSIZ - 1] = '\0';
14183 
14184 	rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
14185 
14186 	/*
14187 	 * If the name hasn't changed, there's nothing to do.
14188 	 */
14189 	if (grp != NULL && strcmp(grp->gr_name, lifr->lifr_groupname) == 0)
14190 		goto unlock;
14191 
14192 	/*
14193 	 * Handle requests to rename an IPMP meta-interface.
14194 	 *
14195 	 * Note that creation of the IPMP meta-interface is handled in
14196 	 * userland through the standard plumbing sequence.  As part of the
14197 	 * plumbing the IPMP meta-interface, its initial groupname is set to
14198 	 * the name of the interface (see ipif_set_values_tail()).
14199 	 */
14200 	if (IS_IPMP(ill)) {
14201 		err = ipmp_grp_rename(grp, lifr->lifr_groupname);
14202 		goto unlock;
14203 	}
14204 
14205 	/*
14206 	 * Handle requests to add or remove an IP interface from a group.
14207 	 */
14208 	if (lifr->lifr_groupname[0] != '\0') {			/* add */
14209 		/*
14210 		 * Moves are handled by first removing the interface from
14211 		 * its existing group, and then adding it to another group.
14212 		 * So, fail if it's already in a group.
14213 		 */
14214 		if (IS_UNDER_IPMP(ill)) {
14215 			err = EALREADY;
14216 			goto unlock;
14217 		}
14218 
14219 		grp = ipmp_grp_lookup(lifr->lifr_groupname, ipst);
14220 		if (grp == NULL) {
14221 			err = ENOENT;
14222 			goto unlock;
14223 		}
14224 
14225 		/*
14226 		 * Check if the phyint and its ills are suitable for
14227 		 * inclusion into the group.
14228 		 */
14229 		if ((err = ipmp_grp_vet_phyint(grp, phyi)) != 0)
14230 			goto unlock;
14231 
14232 		/*
14233 		 * Checks pass; join the group, and enqueue the remaining
14234 		 * illgrp joins for when we've become part of the group xop
14235 		 * and are exclusive across its IPSQs.  Since qwriter_ip()
14236 		 * requires an mblk_t to scribble on, and since `mp' will be
14237 		 * freed as part of completing the ioctl, allocate another.
14238 		 */
14239 		if ((ipsq_mp = allocb(0, BPRI_MED)) == NULL) {
14240 			err = ENOMEM;
14241 			goto unlock;
14242 		}
14243 
14244 		/*
14245 		 * Before we drop ipmp_lock, bump gr_pend* to ensure that the
14246 		 * IPMP meta-interface ills needed by `phyi' cannot go away
14247 		 * before ip_join_illgrps() is called back.  See the comments
14248 		 * in ip_sioctl_plink_ipmp() for more.
14249 		 */
14250 		if (phyi->phyint_illv4 != NULL)
14251 			grp->gr_pendv4++;
14252 		if (phyi->phyint_illv6 != NULL)
14253 			grp->gr_pendv6++;
14254 
14255 		rw_exit(&ipst->ips_ipmp_lock);
14256 
14257 		ipmp_phyint_join_grp(phyi, grp);
14258 		ill_refhold(ill);
14259 		qwriter_ip(ill, ill->ill_rq, ipsq_mp, ip_join_illgrps,
14260 		    SWITCH_OP, B_FALSE);
14261 		return (0);
14262 	} else {
14263 		/*
14264 		 * Request to remove the interface from a group.  If the
14265 		 * interface is not in a group, this trivially succeeds.
14266 		 */
14267 		rw_exit(&ipst->ips_ipmp_lock);
14268 		if (IS_UNDER_IPMP(ill))
14269 			ipmp_phyint_leave_grp(phyi);
14270 		return (0);
14271 	}
14272 unlock:
14273 	rw_exit(&ipst->ips_ipmp_lock);
14274 	return (err);
14275 }
14276 
14277 /*
14278  * Process an SIOCGLIFBINDING request.
14279  */
14280 /* ARGSUSED */
14281 int
14282 ip_sioctl_get_binding(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
14283     ip_ioctl_cmd_t *ipip, void *ifreq)
14284 {
14285 	ill_t		*ill;
14286 	struct lifreq	*lifr = ifreq;
14287 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
14288 
14289 	if (!IS_IPMP(ipif->ipif_ill))
14290 		return (EINVAL);
14291 
14292 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
14293 	if ((ill = ipif->ipif_bound_ill) == NULL)
14294 		lifr->lifr_binding[0] = '\0';
14295 	else
14296 		(void) strlcpy(lifr->lifr_binding, ill->ill_name, LIFNAMSIZ);
14297 	rw_exit(&ipst->ips_ipmp_lock);
14298 	return (0);
14299 }
14300 
14301 /*
14302  * Process an SIOCGLIFGROUPNAME request.
14303  */
14304 /* ARGSUSED */
14305 int
14306 ip_sioctl_get_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
14307     ip_ioctl_cmd_t *ipip, void *ifreq)
14308 {
14309 	ipmp_grp_t	*grp;
14310 	struct lifreq	*lifr = ifreq;
14311 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
14312 
14313 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
14314 	if ((grp = ipif->ipif_ill->ill_phyint->phyint_grp) == NULL)
14315 		lifr->lifr_groupname[0] = '\0';
14316 	else
14317 		(void) strlcpy(lifr->lifr_groupname, grp->gr_name, LIFGRNAMSIZ);
14318 	rw_exit(&ipst->ips_ipmp_lock);
14319 	return (0);
14320 }
14321 
14322 /*
14323  * Process an SIOCGLIFGROUPINFO request.
14324  */
14325 /* ARGSUSED */
14326 int
14327 ip_sioctl_groupinfo(ipif_t *dummy_ipif, sin_t *sin, queue_t *q, mblk_t *mp,
14328     ip_ioctl_cmd_t *ipip, void *dummy)
14329 {
14330 	ipmp_grp_t	*grp;
14331 	lifgroupinfo_t	*lifgr;
14332 	ip_stack_t	*ipst = CONNQ_TO_IPST(q);
14333 
14334 	/* ip_wput_nondata() verified mp->b_cont->b_cont */
14335 	lifgr = (lifgroupinfo_t *)mp->b_cont->b_cont->b_rptr;
14336 	lifgr->gi_grname[LIFGRNAMSIZ - 1] = '\0';
14337 
14338 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
14339 	if ((grp = ipmp_grp_lookup(lifgr->gi_grname, ipst)) == NULL) {
14340 		rw_exit(&ipst->ips_ipmp_lock);
14341 		return (ENOENT);
14342 	}
14343 	ipmp_grp_info(grp, lifgr);
14344 	rw_exit(&ipst->ips_ipmp_lock);
14345 	return (0);
14346 }
14347 
14348 static void
14349 ill_dl_down(ill_t *ill)
14350 {
14351 	/*
14352 	 * The ill is down; unbind but stay attached since we're still
14353 	 * associated with a PPA. If we have negotiated DLPI capabilites
14354 	 * with the data link service provider (IDS_OK) then reset them.
14355 	 * The interval between unbinding and rebinding is potentially
14356 	 * unbounded hence we cannot assume things will be the same.
14357 	 * The DLPI capabilities will be probed again when the data link
14358 	 * is brought up.
14359 	 */
14360 	mblk_t	*mp = ill->ill_unbind_mp;
14361 
14362 	ip1dbg(("ill_dl_down(%s)\n", ill->ill_name));
14363 
14364 	ill->ill_unbind_mp = NULL;
14365 	if (mp != NULL) {
14366 		ip1dbg(("ill_dl_down: %s (%u) for %s\n",
14367 		    dl_primstr(*(int *)mp->b_rptr), *(int *)mp->b_rptr,
14368 		    ill->ill_name));
14369 		mutex_enter(&ill->ill_lock);
14370 		ill->ill_state_flags |= ILL_DL_UNBIND_IN_PROGRESS;
14371 		mutex_exit(&ill->ill_lock);
14372 		/*
14373 		 * ip_rput does not pass up normal (M_PROTO) DLPI messages
14374 		 * after ILL_CONDEMNED is set. So in the unplumb case, we call
14375 		 * ill_capability_dld_disable disable rightaway. If this is not
14376 		 * an unplumb operation then the disable happens on receipt of
14377 		 * the capab ack via ip_rput_dlpi_writer ->
14378 		 * ill_capability_ack_thr. In both cases the order of
14379 		 * the operations seen by DLD is capability disable followed
14380 		 * by DL_UNBIND. Also the DLD capability disable needs a
14381 		 * cv_wait'able context.
14382 		 */
14383 		if (ill->ill_state_flags & ILL_CONDEMNED)
14384 			ill_capability_dld_disable(ill);
14385 		ill_capability_reset(ill, B_FALSE);
14386 		ill_dlpi_send(ill, mp);
14387 	}
14388 
14389 	/*
14390 	 * Toss all of our multicast memberships.  We could keep them, but
14391 	 * then we'd have to do bookkeeping of any joins and leaves performed
14392 	 * by the application while the the interface is down (we can't just
14393 	 * issue them because arp cannot currently process AR_ENTRY_SQUERY's
14394 	 * on a downed interface).
14395 	 */
14396 	ill_leave_multicast(ill);
14397 
14398 	mutex_enter(&ill->ill_lock);
14399 	ill->ill_dl_up = 0;
14400 	ill_nic_event_dispatch(ill, 0, NE_DOWN, NULL, 0);
14401 	mutex_exit(&ill->ill_lock);
14402 }
14403 
14404 static void
14405 ill_dlpi_dispatch(ill_t *ill, mblk_t *mp)
14406 {
14407 	union DL_primitives *dlp;
14408 	t_uscalar_t prim;
14409 
14410 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
14411 
14412 	dlp = (union DL_primitives *)mp->b_rptr;
14413 	prim = dlp->dl_primitive;
14414 
14415 	ip1dbg(("ill_dlpi_dispatch: sending %s (%u) to %s\n",
14416 	    dl_primstr(prim), prim, ill->ill_name));
14417 
14418 	switch (prim) {
14419 	case DL_PHYS_ADDR_REQ:
14420 	{
14421 		dl_phys_addr_req_t *dlpap = (dl_phys_addr_req_t *)mp->b_rptr;
14422 		ill->ill_phys_addr_pend = dlpap->dl_addr_type;
14423 		break;
14424 	}
14425 	case DL_BIND_REQ:
14426 		mutex_enter(&ill->ill_lock);
14427 		ill->ill_state_flags &= ~ILL_DL_UNBIND_IN_PROGRESS;
14428 		mutex_exit(&ill->ill_lock);
14429 		break;
14430 	}
14431 
14432 	/*
14433 	 * Except for the ACKs for the M_PCPROTO messages, all other ACKs
14434 	 * are dropped by ip_rput() if ILL_CONDEMNED is set. Therefore
14435 	 * we only wait for the ACK of the DL_UNBIND_REQ.
14436 	 */
14437 	mutex_enter(&ill->ill_lock);
14438 	if (!(ill->ill_state_flags & ILL_CONDEMNED) || (prim == DL_UNBIND_REQ))
14439 		ill->ill_dlpi_pending = prim;
14440 
14441 	mutex_exit(&ill->ill_lock);
14442 	putnext(ill->ill_wq, mp);
14443 }
14444 
14445 /*
14446  * Helper function for ill_dlpi_send().
14447  */
14448 /* ARGSUSED */
14449 static void
14450 ill_dlpi_send_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
14451 {
14452 	ill_dlpi_send(q->q_ptr, mp);
14453 }
14454 
14455 /*
14456  * Send a DLPI control message to the driver but make sure there
14457  * is only one outstanding message. Uses ill_dlpi_pending to tell
14458  * when it must queue. ip_rput_dlpi_writer calls ill_dlpi_done()
14459  * when an ACK or a NAK is received to process the next queued message.
14460  */
14461 void
14462 ill_dlpi_send(ill_t *ill, mblk_t *mp)
14463 {
14464 	mblk_t **mpp;
14465 
14466 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
14467 
14468 	/*
14469 	 * To ensure that any DLPI requests for current exclusive operation
14470 	 * are always completely sent before any DLPI messages for other
14471 	 * operations, require writer access before enqueuing.
14472 	 */
14473 	if (!IAM_WRITER_ILL(ill)) {
14474 		ill_refhold(ill);
14475 		/* qwriter_ip() does the ill_refrele() */
14476 		qwriter_ip(ill, ill->ill_wq, mp, ill_dlpi_send_writer,
14477 		    NEW_OP, B_TRUE);
14478 		return;
14479 	}
14480 
14481 	mutex_enter(&ill->ill_lock);
14482 	if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
14483 		/* Must queue message. Tail insertion */
14484 		mpp = &ill->ill_dlpi_deferred;
14485 		while (*mpp != NULL)
14486 			mpp = &((*mpp)->b_next);
14487 
14488 		ip1dbg(("ill_dlpi_send: deferring request for %s\n",
14489 		    ill->ill_name));
14490 
14491 		*mpp = mp;
14492 		mutex_exit(&ill->ill_lock);
14493 		return;
14494 	}
14495 	mutex_exit(&ill->ill_lock);
14496 	ill_dlpi_dispatch(ill, mp);
14497 }
14498 
14499 static void
14500 ill_capability_send(ill_t *ill, mblk_t *mp)
14501 {
14502 	ill->ill_capab_pending_cnt++;
14503 	ill_dlpi_send(ill, mp);
14504 }
14505 
14506 void
14507 ill_capability_done(ill_t *ill)
14508 {
14509 	ASSERT(ill->ill_capab_pending_cnt != 0);
14510 
14511 	ill_dlpi_done(ill, DL_CAPABILITY_REQ);
14512 
14513 	ill->ill_capab_pending_cnt--;
14514 	if (ill->ill_capab_pending_cnt == 0 &&
14515 	    ill->ill_dlpi_capab_state == IDCS_OK)
14516 		ill_capability_reset_alloc(ill);
14517 }
14518 
14519 /*
14520  * Send all deferred DLPI messages without waiting for their ACKs.
14521  */
14522 void
14523 ill_dlpi_send_deferred(ill_t *ill)
14524 {
14525 	mblk_t *mp, *nextmp;
14526 
14527 	/*
14528 	 * Clear ill_dlpi_pending so that the message is not queued in
14529 	 * ill_dlpi_send().
14530 	 */
14531 	mutex_enter(&ill->ill_lock);
14532 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
14533 	mp = ill->ill_dlpi_deferred;
14534 	ill->ill_dlpi_deferred = NULL;
14535 	mutex_exit(&ill->ill_lock);
14536 
14537 	for (; mp != NULL; mp = nextmp) {
14538 		nextmp = mp->b_next;
14539 		mp->b_next = NULL;
14540 		ill_dlpi_send(ill, mp);
14541 	}
14542 }
14543 
14544 /*
14545  * Check if the DLPI primitive `prim' is pending; print a warning if not.
14546  */
14547 boolean_t
14548 ill_dlpi_pending(ill_t *ill, t_uscalar_t prim)
14549 {
14550 	t_uscalar_t pending;
14551 
14552 	mutex_enter(&ill->ill_lock);
14553 	if (ill->ill_dlpi_pending == prim) {
14554 		mutex_exit(&ill->ill_lock);
14555 		return (B_TRUE);
14556 	}
14557 
14558 	/*
14559 	 * During teardown, ill_dlpi_dispatch() will send DLPI requests
14560 	 * without waiting, so don't print any warnings in that case.
14561 	 */
14562 	if (ill->ill_state_flags & ILL_CONDEMNED) {
14563 		mutex_exit(&ill->ill_lock);
14564 		return (B_FALSE);
14565 	}
14566 	pending = ill->ill_dlpi_pending;
14567 	mutex_exit(&ill->ill_lock);
14568 
14569 	if (pending == DL_PRIM_INVAL) {
14570 		(void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
14571 		    "received unsolicited ack for %s on %s\n",
14572 		    dl_primstr(prim), ill->ill_name);
14573 	} else {
14574 		(void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
14575 		    "received unexpected ack for %s on %s (expecting %s)\n",
14576 		    dl_primstr(prim), ill->ill_name, dl_primstr(pending));
14577 	}
14578 	return (B_FALSE);
14579 }
14580 
14581 /*
14582  * Complete the current DLPI operation associated with `prim' on `ill' and
14583  * start the next queued DLPI operation (if any).  If there are no queued DLPI
14584  * operations and the ill's current exclusive IPSQ operation has finished
14585  * (i.e., ipsq_current_finish() was called), then clear ipsq_current_ipif to
14586  * allow the next exclusive IPSQ operation to begin upon ipsq_exit().  See
14587  * the comments above ipsq_current_finish() for details.
14588  */
14589 void
14590 ill_dlpi_done(ill_t *ill, t_uscalar_t prim)
14591 {
14592 	mblk_t *mp;
14593 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
14594 	ipxop_t *ipx = ipsq->ipsq_xop;
14595 
14596 	ASSERT(IAM_WRITER_IPSQ(ipsq));
14597 	mutex_enter(&ill->ill_lock);
14598 
14599 	ASSERT(prim != DL_PRIM_INVAL);
14600 	ASSERT(ill->ill_dlpi_pending == prim);
14601 
14602 	ip1dbg(("ill_dlpi_done: %s has completed %s (%u)\n", ill->ill_name,
14603 	    dl_primstr(ill->ill_dlpi_pending), ill->ill_dlpi_pending));
14604 
14605 	if ((mp = ill->ill_dlpi_deferred) == NULL) {
14606 		ill->ill_dlpi_pending = DL_PRIM_INVAL;
14607 		if (ipx->ipx_current_done) {
14608 			mutex_enter(&ipx->ipx_lock);
14609 			ipx->ipx_current_ipif = NULL;
14610 			mutex_exit(&ipx->ipx_lock);
14611 		}
14612 		cv_signal(&ill->ill_cv);
14613 		mutex_exit(&ill->ill_lock);
14614 		return;
14615 	}
14616 
14617 	ill->ill_dlpi_deferred = mp->b_next;
14618 	mp->b_next = NULL;
14619 	mutex_exit(&ill->ill_lock);
14620 
14621 	ill_dlpi_dispatch(ill, mp);
14622 }
14623 
14624 void
14625 conn_delete_ire(conn_t *connp, caddr_t arg)
14626 {
14627 	ipif_t	*ipif = (ipif_t *)arg;
14628 	ire_t	*ire;
14629 
14630 	/*
14631 	 * Look at the cached ires on conns which has pointers to ipifs.
14632 	 * We just call ire_refrele which clears up the reference
14633 	 * to ire. Called when a conn closes. Also called from ipif_free
14634 	 * to cleanup indirect references to the stale ipif via the cached ire.
14635 	 */
14636 	mutex_enter(&connp->conn_lock);
14637 	ire = connp->conn_ire_cache;
14638 	if (ire != NULL && (ipif == NULL || ire->ire_ipif == ipif)) {
14639 		connp->conn_ire_cache = NULL;
14640 		mutex_exit(&connp->conn_lock);
14641 		IRE_REFRELE_NOTR(ire);
14642 		return;
14643 	}
14644 	mutex_exit(&connp->conn_lock);
14645 
14646 }
14647 
14648 /*
14649  * Some operations (e.g., ipif_down()) conditionally delete a number
14650  * of IREs. Those IREs may have been previously cached in the conn structure.
14651  * This ipcl_walk() walker function releases all references to such IREs based
14652  * on the condemned flag.
14653  */
14654 /* ARGSUSED */
14655 void
14656 conn_cleanup_stale_ire(conn_t *connp, caddr_t arg)
14657 {
14658 	ire_t	*ire;
14659 
14660 	mutex_enter(&connp->conn_lock);
14661 	ire = connp->conn_ire_cache;
14662 	if (ire != NULL && (ire->ire_marks & IRE_MARK_CONDEMNED)) {
14663 		connp->conn_ire_cache = NULL;
14664 		mutex_exit(&connp->conn_lock);
14665 		IRE_REFRELE_NOTR(ire);
14666 		return;
14667 	}
14668 	mutex_exit(&connp->conn_lock);
14669 }
14670 
14671 /*
14672  * Take down a specific interface, but don't lose any information about it.
14673  * (Always called as writer.)
14674  * This function goes through the down sequence even if the interface is
14675  * already down. There are 2 reasons.
14676  * a. Currently we permit interface routes that depend on down interfaces
14677  *    to be added. This behaviour itself is questionable. However it appears
14678  *    that both Solaris and 4.3 BSD have exhibited this behaviour for a long
14679  *    time. We go thru the cleanup in order to remove these routes.
14680  * b. The bringup of the interface could fail in ill_dl_up i.e. we get
14681  *    DL_ERROR_ACK in response to the the DL_BIND request. The interface is
14682  *    down, but we need to cleanup i.e. do ill_dl_down and
14683  *    ip_rput_dlpi_writer (DL_ERROR_ACK) -> ipif_down.
14684  *
14685  * IP-MT notes:
14686  *
14687  * Model of reference to interfaces.
14688  *
14689  * The following members in ipif_t track references to the ipif.
14690  *	int     ipif_refcnt;    Active reference count
14691  *	uint_t  ipif_ire_cnt;   Number of ire's referencing this ipif
14692  *	uint_t  ipif_ilm_cnt;   Number of ilms's references this ipif.
14693  *
14694  * The following members in ill_t track references to the ill.
14695  *	int             ill_refcnt;     active refcnt
14696  *	uint_t          ill_ire_cnt;	Number of ires referencing ill
14697  *	uint_t          ill_nce_cnt;	Number of nces referencing ill
14698  *	uint_t          ill_ilm_cnt;	Number of ilms referencing ill
14699  *
14700  * Reference to an ipif or ill can be obtained in any of the following ways.
14701  *
14702  * Through the lookup functions ipif_lookup_* / ill_lookup_* functions
14703  * Pointers to ipif / ill from other data structures viz ire and conn.
14704  * Implicit reference to the ipif / ill by holding a reference to the ire.
14705  *
14706  * The ipif/ill lookup functions return a reference held ipif / ill.
14707  * ipif_refcnt and ill_refcnt track the reference counts respectively.
14708  * This is a purely dynamic reference count associated with threads holding
14709  * references to the ipif / ill. Pointers from other structures do not
14710  * count towards this reference count.
14711  *
14712  * ipif_ire_cnt/ill_ire_cnt is the number of ire's
14713  * associated with the ipif/ill. This is incremented whenever a new
14714  * ire is created referencing the ipif/ill. This is done atomically inside
14715  * ire_add_v[46] where the ire is actually added to the ire hash table.
14716  * The count is decremented in ire_inactive where the ire is destroyed.
14717  *
14718  * nce's reference ill's thru nce_ill and the count of nce's associated with
14719  * an ill is recorded in ill_nce_cnt. This is incremented atomically in
14720  * ndp_add_v4()/ndp_add_v6() where the nce is actually added to the
14721  * table. Similarly it is decremented in ndp_inactive() where the nce
14722  * is destroyed.
14723  *
14724  * ilm's reference to the ipif (for IPv4 ilm's) or the ill (for IPv6 ilm's)
14725  * is incremented in ilm_add_v6() and decremented before the ilm is freed
14726  * in ilm_walker_cleanup() or ilm_delete().
14727  *
14728  * Flow of ioctls involving interface down/up
14729  *
14730  * The following is the sequence of an attempt to set some critical flags on an
14731  * up interface.
14732  * ip_sioctl_flags
14733  * ipif_down
14734  * wait for ipif to be quiescent
14735  * ipif_down_tail
14736  * ip_sioctl_flags_tail
14737  *
14738  * All set ioctls that involve down/up sequence would have a skeleton similar
14739  * to the above. All the *tail functions are called after the refcounts have
14740  * dropped to the appropriate values.
14741  *
14742  * The mechanism to quiesce an ipif is as follows.
14743  *
14744  * Mark the ipif as IPIF_CHANGING. No more lookups will be allowed
14745  * on the ipif. Callers either pass a flag requesting wait or the lookup
14746  *  functions will return NULL.
14747  *
14748  * Delete all ires referencing this ipif
14749  *
14750  * Any thread attempting to do an ipif_refhold on an ipif that has been
14751  * obtained thru a cached pointer will first make sure that
14752  * the ipif can be refheld using the macro IPIF_CAN_LOOKUP and only then
14753  * increment the refcount.
14754  *
14755  * The above guarantees that the ipif refcount will eventually come down to
14756  * zero and the ipif will quiesce, once all threads that currently hold a
14757  * reference to the ipif refrelease the ipif. The ipif is quiescent after the
14758  * ipif_refcount has dropped to zero and all ire's associated with this ipif
14759  * have also been ire_inactive'd. i.e. when ipif_{ire, ill}_cnt and
14760  * ipif_refcnt both drop to zero. See also: comments above IPIF_DOWN_OK()
14761  * in ip.h
14762  *
14763  * Lookups during the IPIF_CHANGING/ILL_CHANGING interval.
14764  *
14765  * Threads trying to lookup an ipif or ill can pass a flag requesting
14766  * wait and restart if the ipif / ill cannot be looked up currently.
14767  * For eg. bind, and route operations (Eg. route add / delete) cannot return
14768  * failure if the ipif is currently undergoing an exclusive operation, and
14769  * hence pass the flag. The mblk is then enqueued in the ipsq and the operation
14770  * is restarted by ipsq_exit() when the current exclusive operation completes.
14771  * The lookup and enqueue is atomic using the ill_lock and ipsq_lock. The
14772  * lookup is done holding the ill_lock. Hence the ill/ipif state flags can't
14773  * change while the ill_lock is held. Before dropping the ill_lock we acquire
14774  * the ipsq_lock and call ipsq_enq. This ensures that ipsq_exit can't finish
14775  * until we release the ipsq_lock, even though the the ill/ipif state flags
14776  * can change after we drop the ill_lock.
14777  *
14778  * An attempt to send out a packet using an ipif that is currently
14779  * IPIF_CHANGING will fail. No attempt is made in this case to enqueue this
14780  * operation and restart it later when the exclusive condition on the ipif ends.
14781  * This is an example of not passing the wait flag to the lookup functions. For
14782  * example an attempt to refhold and use conn->conn_multicast_ipif and send
14783  * out a multicast packet on that ipif will fail while the ipif is
14784  * IPIF_CHANGING. An attempt to create an IRE_CACHE using an ipif that is
14785  * currently IPIF_CHANGING will also fail.
14786  */
14787 int
14788 ipif_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
14789 {
14790 	ill_t		*ill = ipif->ipif_ill;
14791 	conn_t		*connp;
14792 	boolean_t	success;
14793 	boolean_t	ipif_was_up = B_FALSE;
14794 	ip_stack_t	*ipst = ill->ill_ipst;
14795 
14796 	ASSERT(IAM_WRITER_IPIF(ipif));
14797 
14798 	ip1dbg(("ipif_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
14799 
14800 	if (ipif->ipif_flags & IPIF_UP) {
14801 		mutex_enter(&ill->ill_lock);
14802 		ipif->ipif_flags &= ~IPIF_UP;
14803 		ASSERT(ill->ill_ipif_up_count > 0);
14804 		--ill->ill_ipif_up_count;
14805 		mutex_exit(&ill->ill_lock);
14806 		ipif_was_up = B_TRUE;
14807 		/* Update status in SCTP's list */
14808 		sctp_update_ipif(ipif, SCTP_IPIF_DOWN);
14809 		ill_nic_event_dispatch(ipif->ipif_ill,
14810 		    MAP_IPIF_ID(ipif->ipif_id), NE_LIF_DOWN, NULL, 0);
14811 	}
14812 
14813 	/*
14814 	 * Blow away memberships we established in ipif_multicast_up().
14815 	 */
14816 	ipif_multicast_down(ipif);
14817 
14818 	/*
14819 	 * Remove from the mapping for __sin6_src_id. We insert only
14820 	 * when the address is not INADDR_ANY. As IPv4 addresses are
14821 	 * stored as mapped addresses, we need to check for mapped
14822 	 * INADDR_ANY also.
14823 	 */
14824 	if (ipif_was_up && !IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
14825 	    !IN6_IS_ADDR_V4MAPPED_ANY(&ipif->ipif_v6lcl_addr) &&
14826 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14827 		int err;
14828 
14829 		err = ip_srcid_remove(&ipif->ipif_v6lcl_addr,
14830 		    ipif->ipif_zoneid, ipst);
14831 		if (err != 0) {
14832 			ip0dbg(("ipif_down: srcid_remove %d\n", err));
14833 		}
14834 	}
14835 
14836 	/*
14837 	 * Delete all IRE's pointing at this ipif or its source address.
14838 	 */
14839 	if (ipif->ipif_isv6) {
14840 		ire_walk_v6(ipif_down_delete_ire, (char *)ipif, ALL_ZONES,
14841 		    ipst);
14842 	} else {
14843 		ire_walk_v4(ipif_down_delete_ire, (char *)ipif, ALL_ZONES,
14844 		    ipst);
14845 	}
14846 
14847 	if (ipif_was_up && ill->ill_ipif_up_count == 0) {
14848 		/*
14849 		 * Since the interface is now down, it may have just become
14850 		 * inactive.  Note that this needs to be done even for a
14851 		 * lll_logical_down(), or ARP entries will not get correctly
14852 		 * restored when the interface comes back up.
14853 		 */
14854 		if (IS_UNDER_IPMP(ill))
14855 			ipmp_ill_refresh_active(ill);
14856 	}
14857 
14858 	/*
14859 	 * Cleaning up the conn_ire_cache or conns must be done only after the
14860 	 * ires have been deleted above. Otherwise a thread could end up
14861 	 * caching an ire in a conn after we have finished the cleanup of the
14862 	 * conn. The caching is done after making sure that the ire is not yet
14863 	 * condemned. Also documented in the block comment above ip_output
14864 	 */
14865 	ipcl_walk(conn_cleanup_stale_ire, NULL, ipst);
14866 	/* Also, delete the ires cached in SCTP */
14867 	sctp_ire_cache_flush(ipif);
14868 
14869 	/*
14870 	 * Update any other ipifs which have used "our" local address as
14871 	 * a source address. This entails removing and recreating IRE_INTERFACE
14872 	 * entries for such ipifs.
14873 	 */
14874 	if (ipif->ipif_isv6)
14875 		ipif_update_other_ipifs_v6(ipif);
14876 	else
14877 		ipif_update_other_ipifs(ipif);
14878 
14879 	/*
14880 	 * neighbor-discovery or arp entries for this interface.
14881 	 */
14882 	ipif_ndp_down(ipif);
14883 
14884 	/*
14885 	 * If mp is NULL the caller will wait for the appropriate refcnt.
14886 	 * Eg. ip_sioctl_removeif -> ipif_free  -> ipif_down
14887 	 * and ill_delete -> ipif_free -> ipif_down
14888 	 */
14889 	if (mp == NULL) {
14890 		ASSERT(q == NULL);
14891 		return (0);
14892 	}
14893 
14894 	if (CONN_Q(q)) {
14895 		connp = Q_TO_CONN(q);
14896 		mutex_enter(&connp->conn_lock);
14897 	} else {
14898 		connp = NULL;
14899 	}
14900 	mutex_enter(&ill->ill_lock);
14901 	/*
14902 	 * Are there any ire's pointing to this ipif that are still active ?
14903 	 * If this is the last ipif going down, are there any ire's pointing
14904 	 * to this ill that are still active ?
14905 	 */
14906 	if (ipif_is_quiescent(ipif)) {
14907 		mutex_exit(&ill->ill_lock);
14908 		if (connp != NULL)
14909 			mutex_exit(&connp->conn_lock);
14910 		return (0);
14911 	}
14912 
14913 	ip1dbg(("ipif_down: need to wait, adding pending mp %s ill %p",
14914 	    ill->ill_name, (void *)ill));
14915 	/*
14916 	 * Enqueue the mp atomically in ipsq_pending_mp. When the refcount
14917 	 * drops down, the operation will be restarted by ipif_ill_refrele_tail
14918 	 * which in turn is called by the last refrele on the ipif/ill/ire.
14919 	 */
14920 	success = ipsq_pending_mp_add(connp, ipif, q, mp, IPIF_DOWN);
14921 	if (!success) {
14922 		/* The conn is closing. So just return */
14923 		ASSERT(connp != NULL);
14924 		mutex_exit(&ill->ill_lock);
14925 		mutex_exit(&connp->conn_lock);
14926 		return (EINTR);
14927 	}
14928 
14929 	mutex_exit(&ill->ill_lock);
14930 	if (connp != NULL)
14931 		mutex_exit(&connp->conn_lock);
14932 	return (EINPROGRESS);
14933 }
14934 
14935 void
14936 ipif_down_tail(ipif_t *ipif)
14937 {
14938 	ill_t	*ill = ipif->ipif_ill;
14939 
14940 	/*
14941 	 * Skip any loopback interface (null wq).
14942 	 * If this is the last logical interface on the ill
14943 	 * have ill_dl_down tell the driver we are gone (unbind)
14944 	 * Note that lun 0 can ipif_down even though
14945 	 * there are other logical units that are up.
14946 	 * This occurs e.g. when we change a "significant" IFF_ flag.
14947 	 */
14948 	if (ill->ill_wq != NULL && !ill->ill_logical_down &&
14949 	    ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
14950 	    ill->ill_dl_up) {
14951 		ill_dl_down(ill);
14952 	}
14953 	ill->ill_logical_down = 0;
14954 
14955 	/*
14956 	 * Has to be after removing the routes in ipif_down_delete_ire.
14957 	 */
14958 	ipif_resolver_down(ipif);
14959 
14960 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
14961 	ip_rts_newaddrmsg(RTM_DELETE, 0, ipif, RTSQ_DEFAULT);
14962 }
14963 
14964 /*
14965  * Bring interface logically down without bringing the physical interface
14966  * down e.g. when the netmask is changed. This avoids long lasting link
14967  * negotiations between an ethernet interface and a certain switches.
14968  */
14969 static int
14970 ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
14971 {
14972 	/*
14973 	 * The ill_logical_down flag is a transient flag. It is set here
14974 	 * and is cleared once the down has completed in ipif_down_tail.
14975 	 * This flag does not indicate whether the ill stream is in the
14976 	 * DL_BOUND state with the driver. Instead this flag is used by
14977 	 * ipif_down_tail to determine whether to DL_UNBIND the stream with
14978 	 * the driver. The state of the ill stream i.e. whether it is
14979 	 * DL_BOUND with the driver or not is indicated by the ill_dl_up flag.
14980 	 */
14981 	ipif->ipif_ill->ill_logical_down = 1;
14982 	return (ipif_down(ipif, q, mp));
14983 }
14984 
14985 /*
14986  * This is called when the SIOCSLIFUSESRC ioctl is processed in IP.
14987  * If the usesrc client ILL is already part of a usesrc group or not,
14988  * in either case a ire_stq with the matching usesrc client ILL will
14989  * locate the IRE's that need to be deleted. We want IREs to be created
14990  * with the new source address.
14991  */
14992 static void
14993 ipif_delete_cache_ire(ire_t *ire, char *ill_arg)
14994 {
14995 	ill_t	*ucill = (ill_t *)ill_arg;
14996 
14997 	ASSERT(IAM_WRITER_ILL(ucill));
14998 
14999 	if (ire->ire_stq == NULL)
15000 		return;
15001 
15002 	if ((ire->ire_type == IRE_CACHE) &&
15003 	    ((ill_t *)ire->ire_stq->q_ptr == ucill))
15004 		ire_delete(ire);
15005 }
15006 
15007 /*
15008  * ire_walk routine to delete every IRE dependent on the interface
15009  * address that is going down.	(Always called as writer.)
15010  * Works for both v4 and v6.
15011  * In addition for checking for ire_ipif matches it also checks for
15012  * IRE_CACHE entries which have the same source address as the
15013  * disappearing ipif since ipif_select_source might have picked
15014  * that source. Note that ipif_down/ipif_update_other_ipifs takes
15015  * care of any IRE_INTERFACE with the disappearing source address.
15016  */
15017 static void
15018 ipif_down_delete_ire(ire_t *ire, char *ipif_arg)
15019 {
15020 	ipif_t	*ipif = (ipif_t *)ipif_arg;
15021 
15022 	ASSERT(IAM_WRITER_IPIF(ipif));
15023 	if (ire->ire_ipif == NULL)
15024 		return;
15025 
15026 	if (ire->ire_ipif != ipif) {
15027 		/*
15028 		 * Look for a matching source address.
15029 		 */
15030 		if (ire->ire_type != IRE_CACHE)
15031 			return;
15032 		if (ipif->ipif_flags & IPIF_NOLOCAL)
15033 			return;
15034 
15035 		if (ire->ire_ipversion == IPV4_VERSION) {
15036 			if (ire->ire_src_addr != ipif->ipif_src_addr)
15037 				return;
15038 		} else {
15039 			if (!IN6_ARE_ADDR_EQUAL(&ire->ire_src_addr_v6,
15040 			    &ipif->ipif_v6lcl_addr))
15041 				return;
15042 		}
15043 		ire_delete(ire);
15044 		return;
15045 	}
15046 	/*
15047 	 * ire_delete() will do an ire_flush_cache which will delete
15048 	 * all ire_ipif matches
15049 	 */
15050 	ire_delete(ire);
15051 }
15052 
15053 /*
15054  * ire_walk_ill function for deleting all IRE_CACHE entries for an ill when
15055  * 1) an ipif (on that ill) changes the IPIF_DEPRECATED flags, or
15056  * 2) when an interface is brought up or down (on that ill).
15057  * This ensures that the IRE_CACHE entries don't retain stale source
15058  * address selection results.
15059  */
15060 void
15061 ill_ipif_cache_delete(ire_t *ire, char *ill_arg)
15062 {
15063 	ill_t	*ill = (ill_t *)ill_arg;
15064 
15065 	ASSERT(IAM_WRITER_ILL(ill));
15066 	ASSERT(ire->ire_type == IRE_CACHE);
15067 
15068 	/*
15069 	 * We are called for IRE_CACHEs whose ire_stq or ire_ipif matches
15070 	 * ill, but we only want to delete the IRE if ire_ipif matches.
15071 	 */
15072 	ASSERT(ire->ire_ipif != NULL);
15073 	if (ill == ire->ire_ipif->ipif_ill)
15074 		ire_delete(ire);
15075 }
15076 
15077 /*
15078  * Delete all the IREs whose ire_stq's reference `ill_arg'.  IPMP uses this
15079  * instead of ill_ipif_cache_delete() because ire_ipif->ipif_ill references
15080  * the IPMP ill.
15081  */
15082 void
15083 ill_stq_cache_delete(ire_t *ire, char *ill_arg)
15084 {
15085 	ill_t	*ill = (ill_t *)ill_arg;
15086 
15087 	ASSERT(IAM_WRITER_ILL(ill));
15088 	ASSERT(ire->ire_type == IRE_CACHE);
15089 
15090 	/*
15091 	 * We are called for IRE_CACHEs whose ire_stq or ire_ipif matches
15092 	 * ill, but we only want to delete the IRE if ire_stq matches.
15093 	 */
15094 	if (ire->ire_stq->q_ptr == ill_arg)
15095 		ire_delete(ire);
15096 }
15097 
15098 /*
15099  * Delete all broadcast IREs with a source address on `ill_arg'.
15100  */
15101 static void
15102 ill_broadcast_delete(ire_t *ire, char *ill_arg)
15103 {
15104 	ill_t *ill = (ill_t *)ill_arg;
15105 
15106 	ASSERT(IAM_WRITER_ILL(ill));
15107 	ASSERT(ire->ire_type == IRE_BROADCAST);
15108 
15109 	if (ire->ire_ipif->ipif_ill == ill)
15110 		ire_delete(ire);
15111 }
15112 
15113 /*
15114  * Initiate deallocate of an IPIF. Always called as writer. Called by
15115  * ill_delete or ip_sioctl_removeif.
15116  */
15117 static void
15118 ipif_free(ipif_t *ipif)
15119 {
15120 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
15121 
15122 	ASSERT(IAM_WRITER_IPIF(ipif));
15123 
15124 	if (ipif->ipif_recovery_id != 0)
15125 		(void) untimeout(ipif->ipif_recovery_id);
15126 	ipif->ipif_recovery_id = 0;
15127 
15128 	/* Remove conn references */
15129 	reset_conn_ipif(ipif);
15130 
15131 	/*
15132 	 * Make sure we have valid net and subnet broadcast ire's for the
15133 	 * other ipif's which share them with this ipif.
15134 	 */
15135 	if (!ipif->ipif_isv6)
15136 		ipif_check_bcast_ires(ipif);
15137 
15138 	/*
15139 	 * Take down the interface. We can be called either from ill_delete
15140 	 * or from ip_sioctl_removeif.
15141 	 */
15142 	(void) ipif_down(ipif, NULL, NULL);
15143 
15144 	/*
15145 	 * Now that the interface is down, there's no chance it can still
15146 	 * become a duplicate.  Cancel any timer that may have been set while
15147 	 * tearing down.
15148 	 */
15149 	if (ipif->ipif_recovery_id != 0)
15150 		(void) untimeout(ipif->ipif_recovery_id);
15151 	ipif->ipif_recovery_id = 0;
15152 
15153 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15154 	/* Remove pointers to this ill in the multicast routing tables */
15155 	reset_mrt_vif_ipif(ipif);
15156 	/* If necessary, clear the cached source ipif rotor. */
15157 	if (ipif->ipif_ill->ill_src_ipif == ipif)
15158 		ipif->ipif_ill->ill_src_ipif = NULL;
15159 	rw_exit(&ipst->ips_ill_g_lock);
15160 }
15161 
15162 static void
15163 ipif_free_tail(ipif_t *ipif)
15164 {
15165 	mblk_t	*mp;
15166 	ip_stack_t *ipst = ipif->ipif_ill->ill_ipst;
15167 
15168 	/*
15169 	 * Free state for addition IRE_IF_[NO]RESOLVER ire's.
15170 	 */
15171 	mutex_enter(&ipif->ipif_saved_ire_lock);
15172 	mp = ipif->ipif_saved_ire_mp;
15173 	ipif->ipif_saved_ire_mp = NULL;
15174 	mutex_exit(&ipif->ipif_saved_ire_lock);
15175 	freemsg(mp);
15176 
15177 	/*
15178 	 * Need to hold both ill_g_lock and ill_lock while
15179 	 * inserting or removing an ipif from the linked list
15180 	 * of ipifs hanging off the ill.
15181 	 */
15182 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15183 
15184 	ASSERT(ilm_walk_ipif(ipif) == 0);
15185 
15186 #ifdef DEBUG
15187 	ipif_trace_cleanup(ipif);
15188 #endif
15189 
15190 	/* Ask SCTP to take it out of it list */
15191 	sctp_update_ipif(ipif, SCTP_IPIF_REMOVE);
15192 
15193 	/* Get it out of the ILL interface list. */
15194 	ipif_remove(ipif);
15195 	rw_exit(&ipst->ips_ill_g_lock);
15196 
15197 	mutex_destroy(&ipif->ipif_saved_ire_lock);
15198 
15199 	ASSERT(!(ipif->ipif_flags & (IPIF_UP | IPIF_DUPLICATE)));
15200 	ASSERT(ipif->ipif_recovery_id == 0);
15201 
15202 	/* Free the memory. */
15203 	mi_free(ipif);
15204 }
15205 
15206 /*
15207  * Sets `buf' to an ipif name of the form "ill_name:id", or "ill_name" if "id"
15208  * is zero.
15209  */
15210 void
15211 ipif_get_name(const ipif_t *ipif, char *buf, int len)
15212 {
15213 	char	lbuf[LIFNAMSIZ];
15214 	char	*name;
15215 	size_t	name_len;
15216 
15217 	buf[0] = '\0';
15218 	name = ipif->ipif_ill->ill_name;
15219 	name_len = ipif->ipif_ill->ill_name_length;
15220 	if (ipif->ipif_id != 0) {
15221 		(void) sprintf(lbuf, "%s%c%d", name, IPIF_SEPARATOR_CHAR,
15222 		    ipif->ipif_id);
15223 		name = lbuf;
15224 		name_len = mi_strlen(name) + 1;
15225 	}
15226 	len -= 1;
15227 	buf[len] = '\0';
15228 	len = MIN(len, name_len);
15229 	bcopy(name, buf, len);
15230 }
15231 
15232 /*
15233  * Find an IPIF based on the name passed in.  Names can be of the
15234  * form <phys> (e.g., le0), <phys>:<#> (e.g., le0:1),
15235  * The <phys> string can have forms like <dev><#> (e.g., le0),
15236  * <dev><#>.<module> (e.g. le0.foo), or <dev>.<module><#> (e.g. ip.tun3).
15237  * When there is no colon, the implied unit id is zero. <phys> must
15238  * correspond to the name of an ILL.  (May be called as writer.)
15239  */
15240 static ipif_t *
15241 ipif_lookup_on_name(char *name, size_t namelen, boolean_t do_alloc,
15242     boolean_t *exists, boolean_t isv6, zoneid_t zoneid, queue_t *q,
15243     mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst)
15244 {
15245 	char	*cp;
15246 	char	*endp;
15247 	long	id;
15248 	ill_t	*ill;
15249 	ipif_t	*ipif;
15250 	uint_t	ire_type;
15251 	boolean_t did_alloc = B_FALSE;
15252 	ipsq_t	*ipsq;
15253 
15254 	if (error != NULL)
15255 		*error = 0;
15256 
15257 	/*
15258 	 * If the caller wants to us to create the ipif, make sure we have a
15259 	 * valid zoneid
15260 	 */
15261 	ASSERT(!do_alloc || zoneid != ALL_ZONES);
15262 
15263 	if (namelen == 0) {
15264 		if (error != NULL)
15265 			*error = ENXIO;
15266 		return (NULL);
15267 	}
15268 
15269 	*exists = B_FALSE;
15270 	/* Look for a colon in the name. */
15271 	endp = &name[namelen];
15272 	for (cp = endp; --cp > name; ) {
15273 		if (*cp == IPIF_SEPARATOR_CHAR)
15274 			break;
15275 	}
15276 
15277 	if (*cp == IPIF_SEPARATOR_CHAR) {
15278 		/*
15279 		 * Reject any non-decimal aliases for logical
15280 		 * interfaces. Aliases with leading zeroes
15281 		 * are also rejected as they introduce ambiguity
15282 		 * in the naming of the interfaces.
15283 		 * In order to confirm with existing semantics,
15284 		 * and to not break any programs/script relying
15285 		 * on that behaviour, if<0>:0 is considered to be
15286 		 * a valid interface.
15287 		 *
15288 		 * If alias has two or more digits and the first
15289 		 * is zero, fail.
15290 		 */
15291 		if (&cp[2] < endp && cp[1] == '0') {
15292 			if (error != NULL)
15293 				*error = EINVAL;
15294 			return (NULL);
15295 		}
15296 	}
15297 
15298 	if (cp <= name) {
15299 		cp = endp;
15300 	} else {
15301 		*cp = '\0';
15302 	}
15303 
15304 	/*
15305 	 * Look up the ILL, based on the portion of the name
15306 	 * before the slash. ill_lookup_on_name returns a held ill.
15307 	 * Temporary to check whether ill exists already. If so
15308 	 * ill_lookup_on_name will clear it.
15309 	 */
15310 	ill = ill_lookup_on_name(name, do_alloc, isv6,
15311 	    q, mp, func, error, &did_alloc, ipst);
15312 	if (cp != endp)
15313 		*cp = IPIF_SEPARATOR_CHAR;
15314 	if (ill == NULL)
15315 		return (NULL);
15316 
15317 	/* Establish the unit number in the name. */
15318 	id = 0;
15319 	if (cp < endp && *endp == '\0') {
15320 		/* If there was a colon, the unit number follows. */
15321 		cp++;
15322 		if (ddi_strtol(cp, NULL, 0, &id) != 0) {
15323 			ill_refrele(ill);
15324 			if (error != NULL)
15325 				*error = ENXIO;
15326 			return (NULL);
15327 		}
15328 	}
15329 
15330 	GRAB_CONN_LOCK(q);
15331 	mutex_enter(&ill->ill_lock);
15332 	/* Now see if there is an IPIF with this unit number. */
15333 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
15334 		if (ipif->ipif_id == id) {
15335 			if (zoneid != ALL_ZONES &&
15336 			    zoneid != ipif->ipif_zoneid &&
15337 			    ipif->ipif_zoneid != ALL_ZONES) {
15338 				mutex_exit(&ill->ill_lock);
15339 				RELEASE_CONN_LOCK(q);
15340 				ill_refrele(ill);
15341 				if (error != NULL)
15342 					*error = ENXIO;
15343 				return (NULL);
15344 			}
15345 			/*
15346 			 * The block comment at the start of ipif_down
15347 			 * explains the use of the macros used below
15348 			 */
15349 			if (IPIF_CAN_LOOKUP(ipif)) {
15350 				ipif_refhold_locked(ipif);
15351 				mutex_exit(&ill->ill_lock);
15352 				if (!did_alloc)
15353 					*exists = B_TRUE;
15354 				/*
15355 				 * Drop locks before calling ill_refrele
15356 				 * since it can potentially call into
15357 				 * ipif_ill_refrele_tail which can end up
15358 				 * in trying to acquire any lock.
15359 				 */
15360 				RELEASE_CONN_LOCK(q);
15361 				ill_refrele(ill);
15362 				return (ipif);
15363 			} else if (IPIF_CAN_WAIT(ipif, q)) {
15364 				ipsq = ill->ill_phyint->phyint_ipsq;
15365 				mutex_enter(&ipsq->ipsq_lock);
15366 				mutex_enter(&ipsq->ipsq_xop->ipx_lock);
15367 				mutex_exit(&ill->ill_lock);
15368 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
15369 				mutex_exit(&ipsq->ipsq_xop->ipx_lock);
15370 				mutex_exit(&ipsq->ipsq_lock);
15371 				RELEASE_CONN_LOCK(q);
15372 				ill_refrele(ill);
15373 				if (error != NULL)
15374 					*error = EINPROGRESS;
15375 				return (NULL);
15376 			}
15377 		}
15378 	}
15379 	RELEASE_CONN_LOCK(q);
15380 
15381 	if (!do_alloc) {
15382 		mutex_exit(&ill->ill_lock);
15383 		ill_refrele(ill);
15384 		if (error != NULL)
15385 			*error = ENXIO;
15386 		return (NULL);
15387 	}
15388 
15389 	/*
15390 	 * If none found, atomically allocate and return a new one.
15391 	 * Historically, we used IRE_LOOPBACK only for lun 0, and IRE_LOCAL
15392 	 * to support "receive only" use of lo0:1 etc. as is still done
15393 	 * below as an initial guess.
15394 	 * However, this is now likely to be overriden later in ipif_up_done()
15395 	 * when we know for sure what address has been configured on the
15396 	 * interface, since we might have more than one loopback interface
15397 	 * with a loopback address, e.g. in the case of zones, and all the
15398 	 * interfaces with loopback addresses need to be marked IRE_LOOPBACK.
15399 	 */
15400 	if (ill->ill_net_type == IRE_LOOPBACK && id == 0)
15401 		ire_type = IRE_LOOPBACK;
15402 	else
15403 		ire_type = IRE_LOCAL;
15404 	ipif = ipif_allocate(ill, id, ire_type, B_TRUE, B_TRUE);
15405 	if (ipif != NULL)
15406 		ipif_refhold_locked(ipif);
15407 	else if (error != NULL)
15408 		*error = ENOMEM;
15409 	mutex_exit(&ill->ill_lock);
15410 	ill_refrele(ill);
15411 	return (ipif);
15412 }
15413 
15414 /*
15415  * This routine is called whenever a new address comes up on an ipif.  If
15416  * we are configured to respond to address mask requests, then we are supposed
15417  * to broadcast an address mask reply at this time.  This routine is also
15418  * called if we are already up, but a netmask change is made.  This is legal
15419  * but might not make the system manager very popular.	(May be called
15420  * as writer.)
15421  */
15422 void
15423 ipif_mask_reply(ipif_t *ipif)
15424 {
15425 	icmph_t	*icmph;
15426 	ipha_t	*ipha;
15427 	mblk_t	*mp;
15428 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
15429 
15430 #define	REPLY_LEN	(sizeof (icmp_ipha) + sizeof (icmph_t) + IP_ADDR_LEN)
15431 
15432 	if (!ipst->ips_ip_respond_to_address_mask_broadcast)
15433 		return;
15434 
15435 	/* ICMP mask reply is IPv4 only */
15436 	ASSERT(!ipif->ipif_isv6);
15437 	/* ICMP mask reply is not for a loopback interface */
15438 	ASSERT(ipif->ipif_ill->ill_wq != NULL);
15439 
15440 	mp = allocb(REPLY_LEN, BPRI_HI);
15441 	if (mp == NULL)
15442 		return;
15443 	mp->b_wptr = mp->b_rptr + REPLY_LEN;
15444 
15445 	ipha = (ipha_t *)mp->b_rptr;
15446 	bzero(ipha, REPLY_LEN);
15447 	*ipha = icmp_ipha;
15448 	ipha->ipha_ttl = ipst->ips_ip_broadcast_ttl;
15449 	ipha->ipha_src = ipif->ipif_src_addr;
15450 	ipha->ipha_dst = ipif->ipif_brd_addr;
15451 	ipha->ipha_length = htons(REPLY_LEN);
15452 	ipha->ipha_ident = 0;
15453 
15454 	icmph = (icmph_t *)&ipha[1];
15455 	icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY;
15456 	bcopy(&ipif->ipif_net_mask, &icmph[1], IP_ADDR_LEN);
15457 	icmph->icmph_checksum = IP_CSUM(mp, sizeof (ipha_t), 0);
15458 
15459 	put(ipif->ipif_wq, mp);
15460 
15461 #undef	REPLY_LEN
15462 }
15463 
15464 /*
15465  * When the mtu in the ipif changes, we call this routine through ire_walk
15466  * to update all the relevant IREs.
15467  * Skip IRE_LOCAL and "loopback" IRE_BROADCAST by checking ire_stq.
15468  */
15469 static void
15470 ipif_mtu_change(ire_t *ire, char *ipif_arg)
15471 {
15472 	ipif_t *ipif = (ipif_t *)ipif_arg;
15473 
15474 	if (ire->ire_stq == NULL || ire->ire_ipif != ipif)
15475 		return;
15476 	ire->ire_max_frag = MIN(ipif->ipif_mtu, IP_MAXPACKET);
15477 }
15478 
15479 /*
15480  * When the mtu in the ill changes, we call this routine through ire_walk
15481  * to update all the relevant IREs.
15482  * Skip IRE_LOCAL and "loopback" IRE_BROADCAST by checking ire_stq.
15483  */
15484 void
15485 ill_mtu_change(ire_t *ire, char *ill_arg)
15486 {
15487 	ill_t	*ill = (ill_t *)ill_arg;
15488 
15489 	if (ire->ire_stq == NULL || ire->ire_ipif->ipif_ill != ill)
15490 		return;
15491 	ire->ire_max_frag = ire->ire_ipif->ipif_mtu;
15492 }
15493 
15494 /*
15495  * Join the ipif specific multicast groups.
15496  * Must be called after a mapping has been set up in the resolver.  (Always
15497  * called as writer.)
15498  */
15499 void
15500 ipif_multicast_up(ipif_t *ipif)
15501 {
15502 	int err;
15503 	ill_t *ill;
15504 
15505 	ASSERT(IAM_WRITER_IPIF(ipif));
15506 
15507 	ill = ipif->ipif_ill;
15508 
15509 	ip1dbg(("ipif_multicast_up\n"));
15510 	if (!(ill->ill_flags & ILLF_MULTICAST) || ipif->ipif_multicast_up)
15511 		return;
15512 
15513 	if (ipif->ipif_isv6) {
15514 		in6_addr_t v6allmc = ipv6_all_hosts_mcast;
15515 		in6_addr_t v6solmc = ipv6_solicited_node_mcast;
15516 
15517 		v6solmc.s6_addr32[3] |= ipif->ipif_v6lcl_addr.s6_addr32[3];
15518 
15519 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
15520 			return;
15521 
15522 		ip1dbg(("ipif_multicast_up - addmulti\n"));
15523 
15524 		/*
15525 		 * Join the all hosts multicast address.  We skip this for
15526 		 * underlying IPMP interfaces since they should be invisible.
15527 		 */
15528 		if (!IS_UNDER_IPMP(ill)) {
15529 			err = ip_addmulti_v6(&v6allmc, ill, ipif->ipif_zoneid,
15530 			    ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
15531 			if (err != 0) {
15532 				ip0dbg(("ipif_multicast_up: "
15533 				    "all_hosts_mcast failed %d\n", err));
15534 				return;
15535 			}
15536 			ipif->ipif_joined_allhosts = 1;
15537 		}
15538 
15539 		/*
15540 		 * Enable multicast for the solicited node multicast address
15541 		 */
15542 		if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
15543 			err = ip_addmulti_v6(&v6solmc, ill, ipif->ipif_zoneid,
15544 			    ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
15545 			if (err != 0) {
15546 				ip0dbg(("ipif_multicast_up: solicited MC"
15547 				    " failed %d\n", err));
15548 				if (ipif->ipif_joined_allhosts) {
15549 					(void) ip_delmulti_v6(&v6allmc, ill,
15550 					    ipif->ipif_zoneid, B_TRUE, B_TRUE);
15551 					ipif->ipif_joined_allhosts = 0;
15552 				}
15553 				return;
15554 			}
15555 		}
15556 	} else {
15557 		if (ipif->ipif_lcl_addr == INADDR_ANY || IS_UNDER_IPMP(ill))
15558 			return;
15559 
15560 		/* Join the all hosts multicast address */
15561 		ip1dbg(("ipif_multicast_up - addmulti\n"));
15562 		err = ip_addmulti(htonl(INADDR_ALLHOSTS_GROUP), ipif,
15563 		    ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
15564 		if (err) {
15565 			ip0dbg(("ipif_multicast_up: failed %d\n", err));
15566 			return;
15567 		}
15568 	}
15569 	ipif->ipif_multicast_up = 1;
15570 }
15571 
15572 /*
15573  * Blow away any multicast groups that we joined in ipif_multicast_up().
15574  * (Explicit memberships are blown away in ill_leave_multicast() when the
15575  * ill is brought down.)
15576  */
15577 void
15578 ipif_multicast_down(ipif_t *ipif)
15579 {
15580 	int err;
15581 
15582 	ASSERT(IAM_WRITER_IPIF(ipif));
15583 
15584 	ip1dbg(("ipif_multicast_down\n"));
15585 	if (!ipif->ipif_multicast_up)
15586 		return;
15587 
15588 	ip1dbg(("ipif_multicast_down - delmulti\n"));
15589 
15590 	if (!ipif->ipif_isv6) {
15591 		err = ip_delmulti(htonl(INADDR_ALLHOSTS_GROUP), ipif, B_TRUE,
15592 		    B_TRUE);
15593 		if (err != 0)
15594 			ip0dbg(("ipif_multicast_down: failed %d\n", err));
15595 
15596 		ipif->ipif_multicast_up = 0;
15597 		return;
15598 	}
15599 
15600 	/*
15601 	 * Leave the all-hosts multicast address.
15602 	 */
15603 	if (ipif->ipif_joined_allhosts) {
15604 		err = ip_delmulti_v6(&ipv6_all_hosts_mcast, ipif->ipif_ill,
15605 		    ipif->ipif_zoneid, B_TRUE, B_TRUE);
15606 		if (err != 0) {
15607 			ip0dbg(("ipif_multicast_down: all_hosts_mcast "
15608 			    "failed %d\n", err));
15609 		}
15610 		ipif->ipif_joined_allhosts = 0;
15611 	}
15612 
15613 	/*
15614 	 * Disable multicast for the solicited node multicast address
15615 	 */
15616 	if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
15617 		in6_addr_t ipv6_multi = ipv6_solicited_node_mcast;
15618 
15619 		ipv6_multi.s6_addr32[3] |=
15620 		    ipif->ipif_v6lcl_addr.s6_addr32[3];
15621 
15622 		err = ip_delmulti_v6(&ipv6_multi, ipif->ipif_ill,
15623 		    ipif->ipif_zoneid, B_TRUE, B_TRUE);
15624 		if (err != 0) {
15625 			ip0dbg(("ipif_multicast_down: sol MC failed %d\n",
15626 			    err));
15627 		}
15628 	}
15629 
15630 	ipif->ipif_multicast_up = 0;
15631 }
15632 
15633 /*
15634  * Used when an interface comes up to recreate any extra routes on this
15635  * interface.
15636  */
15637 static ire_t **
15638 ipif_recover_ire(ipif_t *ipif)
15639 {
15640 	mblk_t	*mp;
15641 	ire_t	**ipif_saved_irep;
15642 	ire_t	**irep;
15643 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
15644 
15645 	ip1dbg(("ipif_recover_ire(%s:%u)", ipif->ipif_ill->ill_name,
15646 	    ipif->ipif_id));
15647 
15648 	mutex_enter(&ipif->ipif_saved_ire_lock);
15649 	ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) *
15650 	    ipif->ipif_saved_ire_cnt, KM_NOSLEEP);
15651 	if (ipif_saved_irep == NULL) {
15652 		mutex_exit(&ipif->ipif_saved_ire_lock);
15653 		return (NULL);
15654 	}
15655 
15656 	irep = ipif_saved_irep;
15657 	for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
15658 		ire_t		*ire;
15659 		queue_t		*rfq;
15660 		queue_t		*stq;
15661 		ifrt_t		*ifrt;
15662 		uchar_t		*src_addr;
15663 		uchar_t		*gateway_addr;
15664 		ushort_t	type;
15665 
15666 		/*
15667 		 * When the ire was initially created and then added in
15668 		 * ip_rt_add(), it was created either using ipif->ipif_net_type
15669 		 * in the case of a traditional interface route, or as one of
15670 		 * the IRE_OFFSUBNET types (with the exception of
15671 		 * IRE_HOST types ire which is created by icmp_redirect() and
15672 		 * which we don't need to save or recover).  In the case where
15673 		 * ipif->ipif_net_type was IRE_LOOPBACK, ip_rt_add() will update
15674 		 * the ire_type to IRE_IF_NORESOLVER before calling ire_add()
15675 		 * to satisfy software like GateD and Sun Cluster which creates
15676 		 * routes using the the loopback interface's address as a
15677 		 * gateway.
15678 		 *
15679 		 * As ifrt->ifrt_type reflects the already updated ire_type,
15680 		 * ire_create() will be called in the same way here as
15681 		 * in ip_rt_add(), namely using ipif->ipif_net_type when
15682 		 * the route looks like a traditional interface route (where
15683 		 * ifrt->ifrt_type & IRE_INTERFACE is true) and otherwise using
15684 		 * the saved ifrt->ifrt_type.  This means that in the case where
15685 		 * ipif->ipif_net_type is IRE_LOOPBACK, the ire created by
15686 		 * ire_create() will be an IRE_LOOPBACK, it will then be turned
15687 		 * into an IRE_IF_NORESOLVER and then added by ire_add().
15688 		 */
15689 		ifrt = (ifrt_t *)mp->b_rptr;
15690 		ASSERT(ifrt->ifrt_type != IRE_CACHE);
15691 		if (ifrt->ifrt_type & IRE_INTERFACE) {
15692 			rfq = NULL;
15693 			stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
15694 			    ? ipif->ipif_rq : ipif->ipif_wq;
15695 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
15696 			    ? (uint8_t *)&ifrt->ifrt_src_addr
15697 			    : (uint8_t *)&ipif->ipif_src_addr;
15698 			gateway_addr = NULL;
15699 			type = ipif->ipif_net_type;
15700 		} else if (ifrt->ifrt_type & IRE_BROADCAST) {
15701 			/* Recover multiroute broadcast IRE. */
15702 			rfq = ipif->ipif_rq;
15703 			stq = ipif->ipif_wq;
15704 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
15705 			    ? (uint8_t *)&ifrt->ifrt_src_addr
15706 			    : (uint8_t *)&ipif->ipif_src_addr;
15707 			gateway_addr = (uint8_t *)&ifrt->ifrt_gateway_addr;
15708 			type = ifrt->ifrt_type;
15709 		} else {
15710 			rfq = NULL;
15711 			stq = NULL;
15712 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
15713 			    ? (uint8_t *)&ifrt->ifrt_src_addr : NULL;
15714 			gateway_addr = (uint8_t *)&ifrt->ifrt_gateway_addr;
15715 			type = ifrt->ifrt_type;
15716 		}
15717 
15718 		/*
15719 		 * Create a copy of the IRE with the saved address and netmask.
15720 		 */
15721 		ip1dbg(("ipif_recover_ire: creating IRE %s (%d) for "
15722 		    "0x%x/0x%x\n",
15723 		    ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type,
15724 		    ntohl(ifrt->ifrt_addr),
15725 		    ntohl(ifrt->ifrt_mask)));
15726 		ire = ire_create(
15727 		    (uint8_t *)&ifrt->ifrt_addr,
15728 		    (uint8_t *)&ifrt->ifrt_mask,
15729 		    src_addr,
15730 		    gateway_addr,
15731 		    &ifrt->ifrt_max_frag,
15732 		    NULL,
15733 		    rfq,
15734 		    stq,
15735 		    type,
15736 		    ipif,
15737 		    0,
15738 		    0,
15739 		    0,
15740 		    ifrt->ifrt_flags,
15741 		    &ifrt->ifrt_iulp_info,
15742 		    NULL,
15743 		    NULL,
15744 		    ipst);
15745 
15746 		if (ire == NULL) {
15747 			mutex_exit(&ipif->ipif_saved_ire_lock);
15748 			kmem_free(ipif_saved_irep,
15749 			    ipif->ipif_saved_ire_cnt * sizeof (ire_t *));
15750 			return (NULL);
15751 		}
15752 
15753 		/*
15754 		 * Some software (for example, GateD and Sun Cluster) attempts
15755 		 * to create (what amount to) IRE_PREFIX routes with the
15756 		 * loopback address as the gateway.  This is primarily done to
15757 		 * set up prefixes with the RTF_REJECT flag set (for example,
15758 		 * when generating aggregate routes.)
15759 		 *
15760 		 * If the IRE type (as defined by ipif->ipif_net_type) is
15761 		 * IRE_LOOPBACK, then we map the request into a
15762 		 * IRE_IF_NORESOLVER.
15763 		 */
15764 		if (ipif->ipif_net_type == IRE_LOOPBACK)
15765 			ire->ire_type = IRE_IF_NORESOLVER;
15766 		/*
15767 		 * ire held by ire_add, will be refreled' towards the
15768 		 * the end of ipif_up_done
15769 		 */
15770 		(void) ire_add(&ire, NULL, NULL, NULL, B_FALSE);
15771 		*irep = ire;
15772 		irep++;
15773 		ip1dbg(("ipif_recover_ire: added ire %p\n", (void *)ire));
15774 	}
15775 	mutex_exit(&ipif->ipif_saved_ire_lock);
15776 	return (ipif_saved_irep);
15777 }
15778 
15779 /*
15780  * Used to set the netmask and broadcast address to default values when the
15781  * interface is brought up.  (Always called as writer.)
15782  */
15783 static void
15784 ipif_set_default(ipif_t *ipif)
15785 {
15786 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
15787 
15788 	if (!ipif->ipif_isv6) {
15789 		/*
15790 		 * Interface holds an IPv4 address. Default
15791 		 * mask is the natural netmask.
15792 		 */
15793 		if (!ipif->ipif_net_mask) {
15794 			ipaddr_t	v4mask;
15795 
15796 			v4mask = ip_net_mask(ipif->ipif_lcl_addr);
15797 			V4MASK_TO_V6(v4mask, ipif->ipif_v6net_mask);
15798 		}
15799 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
15800 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
15801 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
15802 		} else {
15803 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
15804 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
15805 		}
15806 		/*
15807 		 * NOTE: SunOS 4.X does this even if the broadcast address
15808 		 * has been already set thus we do the same here.
15809 		 */
15810 		if (ipif->ipif_flags & IPIF_BROADCAST) {
15811 			ipaddr_t	v4addr;
15812 
15813 			v4addr = ipif->ipif_subnet | ~ipif->ipif_net_mask;
15814 			IN6_IPADDR_TO_V4MAPPED(v4addr, &ipif->ipif_v6brd_addr);
15815 		}
15816 	} else {
15817 		/*
15818 		 * Interface holds an IPv6-only address.  Default
15819 		 * mask is all-ones.
15820 		 */
15821 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
15822 			ipif->ipif_v6net_mask = ipv6_all_ones;
15823 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
15824 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
15825 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
15826 		} else {
15827 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
15828 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
15829 		}
15830 	}
15831 }
15832 
15833 /*
15834  * Return 0 if this address can be used as local address without causing
15835  * duplicate address problems. Otherwise, return EADDRNOTAVAIL if the address
15836  * is already up on a different ill, and EADDRINUSE if it's up on the same ill.
15837  * Note that the same IPv6 link-local address is allowed as long as the ills
15838  * are not on the same link.
15839  */
15840 int
15841 ip_addr_availability_check(ipif_t *new_ipif)
15842 {
15843 	in6_addr_t our_v6addr;
15844 	ill_t *ill;
15845 	ipif_t *ipif;
15846 	ill_walk_context_t ctx;
15847 	ip_stack_t	*ipst = new_ipif->ipif_ill->ill_ipst;
15848 
15849 	ASSERT(IAM_WRITER_IPIF(new_ipif));
15850 	ASSERT(MUTEX_HELD(&ipst->ips_ip_addr_avail_lock));
15851 	ASSERT(RW_READ_HELD(&ipst->ips_ill_g_lock));
15852 
15853 	new_ipif->ipif_flags &= ~IPIF_UNNUMBERED;
15854 	if (IN6_IS_ADDR_UNSPECIFIED(&new_ipif->ipif_v6lcl_addr) ||
15855 	    IN6_IS_ADDR_V4MAPPED_ANY(&new_ipif->ipif_v6lcl_addr))
15856 		return (0);
15857 
15858 	our_v6addr = new_ipif->ipif_v6lcl_addr;
15859 
15860 	if (new_ipif->ipif_isv6)
15861 		ill = ILL_START_WALK_V6(&ctx, ipst);
15862 	else
15863 		ill = ILL_START_WALK_V4(&ctx, ipst);
15864 
15865 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
15866 		for (ipif = ill->ill_ipif; ipif != NULL;
15867 		    ipif = ipif->ipif_next) {
15868 			if ((ipif == new_ipif) ||
15869 			    !(ipif->ipif_flags & IPIF_UP) ||
15870 			    (ipif->ipif_flags & IPIF_UNNUMBERED) ||
15871 			    !IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
15872 			    &our_v6addr))
15873 				continue;
15874 
15875 			if (new_ipif->ipif_flags & IPIF_POINTOPOINT)
15876 				new_ipif->ipif_flags |= IPIF_UNNUMBERED;
15877 			else if (ipif->ipif_flags & IPIF_POINTOPOINT)
15878 				ipif->ipif_flags |= IPIF_UNNUMBERED;
15879 			else if ((IN6_IS_ADDR_LINKLOCAL(&our_v6addr) ||
15880 			    IN6_IS_ADDR_SITELOCAL(&our_v6addr)) &&
15881 			    !IS_ON_SAME_LAN(ill, new_ipif->ipif_ill))
15882 				continue;
15883 			else if (new_ipif->ipif_zoneid != ipif->ipif_zoneid &&
15884 			    ipif->ipif_zoneid != ALL_ZONES && IS_LOOPBACK(ill))
15885 				continue;
15886 			else if (new_ipif->ipif_ill == ill)
15887 				return (EADDRINUSE);
15888 			else
15889 				return (EADDRNOTAVAIL);
15890 		}
15891 	}
15892 
15893 	return (0);
15894 }
15895 
15896 /*
15897  * Bring up an ipif: bring up arp/ndp, bring up the DLPI stream, and add
15898  * IREs for the ipif.
15899  * When the routine returns EINPROGRESS then mp has been consumed and
15900  * the ioctl will be acked from ip_rput_dlpi.
15901  */
15902 int
15903 ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp)
15904 {
15905 	ill_t		*ill = ipif->ipif_ill;
15906 	boolean_t 	isv6 = ipif->ipif_isv6;
15907 	int		err = 0;
15908 	boolean_t	success;
15909 	uint_t		ipif_orig_id;
15910 	ip_stack_t	*ipst = ill->ill_ipst;
15911 
15912 	ASSERT(IAM_WRITER_IPIF(ipif));
15913 
15914 	ip1dbg(("ipif_up(%s:%u)\n", ill->ill_name, ipif->ipif_id));
15915 
15916 	/* Shouldn't get here if it is already up. */
15917 	if (ipif->ipif_flags & IPIF_UP)
15918 		return (EALREADY);
15919 
15920 	/*
15921 	 * If this is a request to bring up a data address on an interface
15922 	 * under IPMP, then move the address to its IPMP meta-interface and
15923 	 * try to bring it up.  One complication is that the zeroth ipif for
15924 	 * an ill is special, in that every ill always has one, and that code
15925 	 * throughout IP deferences ill->ill_ipif without holding any locks.
15926 	 */
15927 	if (IS_UNDER_IPMP(ill) && ipmp_ipif_is_dataaddr(ipif) &&
15928 	    (!ipif->ipif_isv6 || !V6_IPIF_LINKLOCAL(ipif))) {
15929 		ipif_t	*stubipif = NULL, *moveipif = NULL;
15930 		ill_t	*ipmp_ill = ipmp_illgrp_ipmp_ill(ill->ill_grp);
15931 
15932 		/*
15933 		 * The ipif being brought up should be quiesced.  If it's not,
15934 		 * something has gone amiss and we need to bail out.  (If it's
15935 		 * quiesced, we know it will remain so via IPIF_CHANGING.)
15936 		 */
15937 		mutex_enter(&ill->ill_lock);
15938 		if (!ipif_is_quiescent(ipif)) {
15939 			mutex_exit(&ill->ill_lock);
15940 			return (EINVAL);
15941 		}
15942 		mutex_exit(&ill->ill_lock);
15943 
15944 		/*
15945 		 * If we're going to need to allocate ipifs, do it prior
15946 		 * to starting the move (and grabbing locks).
15947 		 */
15948 		if (ipif->ipif_id == 0) {
15949 			moveipif = ipif_allocate(ill, 0, IRE_LOCAL, B_TRUE,
15950 			    B_FALSE);
15951 			stubipif = ipif_allocate(ill, 0, IRE_LOCAL, B_TRUE,
15952 			    B_FALSE);
15953 			if (moveipif == NULL || stubipif == NULL) {
15954 				mi_free(moveipif);
15955 				mi_free(stubipif);
15956 				return (ENOMEM);
15957 			}
15958 		}
15959 
15960 		/*
15961 		 * Grab or transfer the ipif to move.  During the move, keep
15962 		 * ill_g_lock held to prevent any ill walker threads from
15963 		 * seeing things in an inconsistent state.
15964 		 */
15965 		rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15966 		if (ipif->ipif_id != 0) {
15967 			ipif_remove(ipif);
15968 		} else {
15969 			ipif_transfer(ipif, moveipif, stubipif);
15970 			ipif = moveipif;
15971 		}
15972 
15973 		/*
15974 		 * Place the ipif on the IPMP ill.  If the zeroth ipif on
15975 		 * the IPMP ill is a stub (0.0.0.0 down address) then we
15976 		 * replace that one.  Otherwise, pick the next available slot.
15977 		 */
15978 		ipif->ipif_ill = ipmp_ill;
15979 		ipif_orig_id = ipif->ipif_id;
15980 
15981 		if (ipmp_ipif_is_stubaddr(ipmp_ill->ill_ipif)) {
15982 			ipif_transfer(ipif, ipmp_ill->ill_ipif, NULL);
15983 			ipif = ipmp_ill->ill_ipif;
15984 		} else {
15985 			ipif->ipif_id = -1;
15986 			if (ipif_insert(ipif, B_FALSE) != 0) {
15987 				/*
15988 				 * No more available ipif_id's -- put it back
15989 				 * on the original ill and fail the operation.
15990 				 * Since we're writer on the ill, we can be
15991 				 * sure our old slot is still available.
15992 				 */
15993 				ipif->ipif_id = ipif_orig_id;
15994 				ipif->ipif_ill = ill;
15995 				if (ipif_orig_id == 0) {
15996 					ipif_transfer(ipif, ill->ill_ipif,
15997 					    NULL);
15998 				} else {
15999 					VERIFY(ipif_insert(ipif, B_FALSE) == 0);
16000 				}
16001 				rw_exit(&ipst->ips_ill_g_lock);
16002 				return (ENOMEM);
16003 			}
16004 		}
16005 		rw_exit(&ipst->ips_ill_g_lock);
16006 
16007 		/*
16008 		 * Tell SCTP that the ipif has moved.  Note that even if we
16009 		 * had to allocate a new ipif, the original sequence id was
16010 		 * preserved and therefore SCTP won't know.
16011 		 */
16012 		sctp_move_ipif(ipif, ill, ipmp_ill);
16013 
16014 		/*
16015 		 * If the ipif being brought up was on slot zero, then we
16016 		 * first need to bring up the placeholder we stuck there.  In
16017 		 * ip_rput_dlpi_writer(), ip_arp_done(), or the recursive call
16018 		 * to ipif_up() itself, if we successfully bring up the
16019 		 * placeholder, we'll check ill_move_ipif and bring it up too.
16020 		 */
16021 		if (ipif_orig_id == 0) {
16022 			ASSERT(ill->ill_move_ipif == NULL);
16023 			ill->ill_move_ipif = ipif;
16024 			if ((err = ipif_up(ill->ill_ipif, q, mp)) == 0)
16025 				ASSERT(ill->ill_move_ipif == NULL);
16026 			if (err != EINPROGRESS)
16027 				ill->ill_move_ipif = NULL;
16028 			return (err);
16029 		}
16030 
16031 		/*
16032 		 * Bring it up on the IPMP ill.
16033 		 */
16034 		return (ipif_up(ipif, q, mp));
16035 	}
16036 
16037 	/* Skip arp/ndp for any loopback interface. */
16038 	if (ill->ill_wq != NULL) {
16039 		conn_t *connp = CONN_Q(q) ? Q_TO_CONN(q) : NULL;
16040 		ipsq_t	*ipsq = ill->ill_phyint->phyint_ipsq;
16041 
16042 		if (!ill->ill_dl_up) {
16043 			/*
16044 			 * ill_dl_up is not yet set. i.e. we are yet to
16045 			 * DL_BIND with the driver and this is the first
16046 			 * logical interface on the ill to become "up".
16047 			 * Tell the driver to get going (via DL_BIND_REQ).
16048 			 * Note that changing "significant" IFF_ flags
16049 			 * address/netmask etc cause a down/up dance, but
16050 			 * does not cause an unbind (DL_UNBIND) with the driver
16051 			 */
16052 			return (ill_dl_up(ill, ipif, mp, q));
16053 		}
16054 
16055 		/*
16056 		 * ipif_resolver_up may end up sending an
16057 		 * AR_INTERFACE_UP message to ARP, which would, in
16058 		 * turn send a DLPI message to the driver. ioctls are
16059 		 * serialized and so we cannot send more than one
16060 		 * interface up message at a time. If ipif_resolver_up
16061 		 * does send an interface up message to ARP, we get
16062 		 * EINPROGRESS and we will complete in ip_arp_done.
16063 		 */
16064 
16065 		ASSERT(connp != NULL || !CONN_Q(q));
16066 		if (connp != NULL)
16067 			mutex_enter(&connp->conn_lock);
16068 		mutex_enter(&ill->ill_lock);
16069 		success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
16070 		mutex_exit(&ill->ill_lock);
16071 		if (connp != NULL)
16072 			mutex_exit(&connp->conn_lock);
16073 		if (!success)
16074 			return (EINTR);
16075 
16076 		/*
16077 		 * Crank up the resolver.  For IPv6, this cranks up the
16078 		 * external resolver if one is configured, but even if an
16079 		 * external resolver isn't configured, it must be called to
16080 		 * reset DAD state.  For IPv6, if an external resolver is not
16081 		 * being used, ipif_resolver_up() will never return
16082 		 * EINPROGRESS, so we can always call ipif_ndp_up() here.
16083 		 * Note that if an external resolver is being used, there's no
16084 		 * need to call ipif_ndp_up() since it will do nothing.
16085 		 */
16086 		err = ipif_resolver_up(ipif, Res_act_initial);
16087 		if (err == EINPROGRESS) {
16088 			/* We will complete it in ip_arp_done() */
16089 			return (err);
16090 		}
16091 
16092 		if (isv6 && err == 0)
16093 			err = ipif_ndp_up(ipif, B_TRUE);
16094 
16095 		ASSERT(err != EINPROGRESS);
16096 		mp = ipsq_pending_mp_get(ipsq, &connp);
16097 		ASSERT(mp != NULL);
16098 		if (err != 0)
16099 			return (err);
16100 	} else {
16101 		/*
16102 		 * Interfaces without underlying hardware don't do duplicate
16103 		 * address detection.
16104 		 */
16105 		ASSERT(!(ipif->ipif_flags & IPIF_DUPLICATE));
16106 		ipif->ipif_addr_ready = 1;
16107 	}
16108 
16109 	err = isv6 ? ipif_up_done_v6(ipif) : ipif_up_done(ipif);
16110 	if (err == 0 && ill->ill_move_ipif != NULL) {
16111 		ipif = ill->ill_move_ipif;
16112 		ill->ill_move_ipif = NULL;
16113 		return (ipif_up(ipif, q, mp));
16114 	}
16115 	return (err);
16116 }
16117 
16118 /*
16119  * Perform a bind for the physical device.
16120  * When the routine returns EINPROGRESS then mp has been consumed and
16121  * the ioctl will be acked from ip_rput_dlpi.
16122  * Allocate an unbind message and save it until ipif_down.
16123  */
16124 static int
16125 ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
16126 {
16127 	areq_t	*areq;
16128 	mblk_t	*areq_mp = NULL;
16129 	mblk_t	*bind_mp = NULL;
16130 	mblk_t	*unbind_mp = NULL;
16131 	conn_t	*connp;
16132 	boolean_t success;
16133 	uint16_t sap_addr;
16134 
16135 	ip1dbg(("ill_dl_up(%s)\n", ill->ill_name));
16136 	ASSERT(IAM_WRITER_ILL(ill));
16137 	ASSERT(mp != NULL);
16138 
16139 	/* Create a resolver cookie for ARP */
16140 	if (!ill->ill_isv6 && ill->ill_net_type == IRE_IF_RESOLVER) {
16141 		areq_mp = ill_arp_alloc(ill, (uchar_t *)&ip_areq_template, 0);
16142 		if (areq_mp == NULL)
16143 			return (ENOMEM);
16144 
16145 		freemsg(ill->ill_resolver_mp);
16146 		ill->ill_resolver_mp = areq_mp;
16147 		areq = (areq_t *)areq_mp->b_rptr;
16148 		sap_addr = ill->ill_sap;
16149 		bcopy(&sap_addr, areq->areq_sap, sizeof (sap_addr));
16150 	}
16151 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
16152 	    DL_BIND_REQ);
16153 	if (bind_mp == NULL)
16154 		goto bad;
16155 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
16156 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
16157 
16158 	unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ);
16159 	if (unbind_mp == NULL)
16160 		goto bad;
16161 
16162 	/*
16163 	 * Record state needed to complete this operation when the
16164 	 * DL_BIND_ACK shows up.  Also remember the pre-allocated mblks.
16165 	 */
16166 	ASSERT(WR(q)->q_next == NULL);
16167 	connp = Q_TO_CONN(q);
16168 
16169 	mutex_enter(&connp->conn_lock);
16170 	mutex_enter(&ipif->ipif_ill->ill_lock);
16171 	success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
16172 	mutex_exit(&ipif->ipif_ill->ill_lock);
16173 	mutex_exit(&connp->conn_lock);
16174 	if (!success)
16175 		goto bad;
16176 
16177 	/*
16178 	 * Save the unbind message for ill_dl_down(); it will be consumed when
16179 	 * the interface goes down.
16180 	 */
16181 	ASSERT(ill->ill_unbind_mp == NULL);
16182 	ill->ill_unbind_mp = unbind_mp;
16183 
16184 	ill_dlpi_send(ill, bind_mp);
16185 	/* Send down link-layer capabilities probe if not already done. */
16186 	ill_capability_probe(ill);
16187 
16188 	/*
16189 	 * Sysid used to rely on the fact that netboots set domainname
16190 	 * and the like. Now that miniroot boots aren't strictly netboots
16191 	 * and miniroot network configuration is driven from userland
16192 	 * these things still need to be set. This situation can be detected
16193 	 * by comparing the interface being configured here to the one
16194 	 * dhcifname was set to reference by the boot loader. Once sysid is
16195 	 * converted to use dhcp_ipc_getinfo() this call can go away.
16196 	 */
16197 	if ((ipif->ipif_flags & IPIF_DHCPRUNNING) &&
16198 	    (strcmp(ill->ill_name, dhcifname) == 0) &&
16199 	    (strlen(srpc_domain) == 0)) {
16200 		if (dhcpinit() != 0)
16201 			cmn_err(CE_WARN, "no cached dhcp response");
16202 	}
16203 
16204 	/*
16205 	 * This operation will complete in ip_rput_dlpi with either
16206 	 * a DL_BIND_ACK or DL_ERROR_ACK.
16207 	 */
16208 	return (EINPROGRESS);
16209 bad:
16210 	ip1dbg(("ill_dl_up(%s) FAILED\n", ill->ill_name));
16211 
16212 	freemsg(bind_mp);
16213 	freemsg(unbind_mp);
16214 	return (ENOMEM);
16215 }
16216 
16217 uint_t ip_loopback_mtuplus = IP_LOOPBACK_MTU + IP_SIMPLE_HDR_LENGTH + 20;
16218 
16219 /*
16220  * DLPI and ARP is up.
16221  * Create all the IREs associated with an interface bring up multicast.
16222  * Set the interface flag and finish other initialization
16223  * that potentially had to be differed to after DL_BIND_ACK.
16224  */
16225 int
16226 ipif_up_done(ipif_t *ipif)
16227 {
16228 	ire_t	*ire_array[20];
16229 	ire_t	**irep = ire_array;
16230 	ire_t	**irep1;
16231 	ipaddr_t net_mask = 0;
16232 	ipaddr_t subnet_mask, route_mask;
16233 	ill_t	*ill = ipif->ipif_ill;
16234 	queue_t	*stq;
16235 	ipif_t	 *src_ipif;
16236 	ipif_t   *tmp_ipif;
16237 	boolean_t	flush_ire_cache = B_TRUE;
16238 	int	err = 0;
16239 	ire_t	**ipif_saved_irep = NULL;
16240 	int ipif_saved_ire_cnt;
16241 	int	cnt;
16242 	boolean_t	src_ipif_held = B_FALSE;
16243 	boolean_t	loopback = B_FALSE;
16244 	ip_stack_t	*ipst = ill->ill_ipst;
16245 
16246 	ip1dbg(("ipif_up_done(%s:%u)\n",
16247 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
16248 	/* Check if this is a loopback interface */
16249 	if (ipif->ipif_ill->ill_wq == NULL)
16250 		loopback = B_TRUE;
16251 
16252 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
16253 	/*
16254 	 * If all other interfaces for this ill are down or DEPRECATED,
16255 	 * or otherwise unsuitable for source address selection, remove
16256 	 * any IRE_CACHE entries for this ill to make sure source
16257 	 * address selection gets to take this new ipif into account.
16258 	 * No need to hold ill_lock while traversing the ipif list since
16259 	 * we are writer
16260 	 */
16261 	for (tmp_ipif = ill->ill_ipif; tmp_ipif;
16262 	    tmp_ipif = tmp_ipif->ipif_next) {
16263 		if (((tmp_ipif->ipif_flags &
16264 		    (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
16265 		    !(tmp_ipif->ipif_flags & IPIF_UP)) ||
16266 		    (tmp_ipif == ipif))
16267 			continue;
16268 		/* first useable pre-existing interface */
16269 		flush_ire_cache = B_FALSE;
16270 		break;
16271 	}
16272 	if (flush_ire_cache)
16273 		ire_walk_ill_v4(MATCH_IRE_ILL | MATCH_IRE_TYPE,
16274 		    IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill);
16275 
16276 	/*
16277 	 * Figure out which way the send-to queue should go.  Only
16278 	 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER or IRE_LOOPBACK
16279 	 * should show up here.
16280 	 */
16281 	switch (ill->ill_net_type) {
16282 	case IRE_IF_RESOLVER:
16283 		stq = ill->ill_rq;
16284 		break;
16285 	case IRE_IF_NORESOLVER:
16286 	case IRE_LOOPBACK:
16287 		stq = ill->ill_wq;
16288 		break;
16289 	default:
16290 		return (EINVAL);
16291 	}
16292 
16293 	if (IS_LOOPBACK(ill)) {
16294 		/*
16295 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
16296 		 * ipif_lookup_on_name(), but in the case of zones we can have
16297 		 * several loopback addresses on lo0. So all the interfaces with
16298 		 * loopback addresses need to be marked IRE_LOOPBACK.
16299 		 */
16300 		if (V4_PART_OF_V6(ipif->ipif_v6lcl_addr) ==
16301 		    htonl(INADDR_LOOPBACK))
16302 			ipif->ipif_ire_type = IRE_LOOPBACK;
16303 		else
16304 			ipif->ipif_ire_type = IRE_LOCAL;
16305 	}
16306 
16307 	if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST) ||
16308 	    ((ipif->ipif_flags & IPIF_DEPRECATED) &&
16309 	    !(ipif->ipif_flags & IPIF_NOFAILOVER))) {
16310 		/*
16311 		 * Can't use our source address. Select a different
16312 		 * source address for the IRE_INTERFACE and IRE_LOCAL
16313 		 */
16314 		src_ipif = ipif_select_source(ipif->ipif_ill,
16315 		    ipif->ipif_subnet, ipif->ipif_zoneid);
16316 		if (src_ipif == NULL)
16317 			src_ipif = ipif;	/* Last resort */
16318 		else
16319 			src_ipif_held = B_TRUE;
16320 	} else {
16321 		src_ipif = ipif;
16322 	}
16323 
16324 	/* Create all the IREs associated with this interface */
16325 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
16326 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
16327 
16328 		/*
16329 		 * If we're on a labeled system then make sure that zone-
16330 		 * private addresses have proper remote host database entries.
16331 		 */
16332 		if (is_system_labeled() &&
16333 		    ipif->ipif_ire_type != IRE_LOOPBACK &&
16334 		    !tsol_check_interface_address(ipif))
16335 			return (EINVAL);
16336 
16337 		/* Register the source address for __sin6_src_id */
16338 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
16339 		    ipif->ipif_zoneid, ipst);
16340 		if (err != 0) {
16341 			ip0dbg(("ipif_up_done: srcid_insert %d\n", err));
16342 			return (err);
16343 		}
16344 
16345 		/* If the interface address is set, create the local IRE. */
16346 		ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x for 0x%x\n",
16347 		    (void *)ipif,
16348 		    ipif->ipif_ire_type,
16349 		    ntohl(ipif->ipif_lcl_addr)));
16350 		*irep++ = ire_create(
16351 		    (uchar_t *)&ipif->ipif_lcl_addr,	/* dest address */
16352 		    (uchar_t *)&ip_g_all_ones,		/* mask */
16353 		    (uchar_t *)&src_ipif->ipif_src_addr, /* source address */
16354 		    NULL,				/* no gateway */
16355 		    &ip_loopback_mtuplus,		/* max frag size */
16356 		    NULL,
16357 		    ipif->ipif_rq,			/* recv-from queue */
16358 		    NULL,				/* no send-to queue */
16359 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
16360 		    ipif,
16361 		    0,
16362 		    0,
16363 		    0,
16364 		    (ipif->ipif_flags & IPIF_PRIVATE) ?
16365 		    RTF_PRIVATE : 0,
16366 		    &ire_uinfo_null,
16367 		    NULL,
16368 		    NULL,
16369 		    ipst);
16370 	} else {
16371 		ip1dbg((
16372 		    "ipif_up_done: not creating IRE %d for 0x%x: flags 0x%x\n",
16373 		    ipif->ipif_ire_type,
16374 		    ntohl(ipif->ipif_lcl_addr),
16375 		    (uint_t)ipif->ipif_flags));
16376 	}
16377 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
16378 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
16379 		net_mask = ip_net_mask(ipif->ipif_lcl_addr);
16380 	} else {
16381 		net_mask = htonl(IN_CLASSA_NET);	/* fallback */
16382 	}
16383 
16384 	subnet_mask = ipif->ipif_net_mask;
16385 
16386 	/*
16387 	 * If mask was not specified, use natural netmask of
16388 	 * interface address. Also, store this mask back into the
16389 	 * ipif struct.
16390 	 */
16391 	if (subnet_mask == 0) {
16392 		subnet_mask = net_mask;
16393 		V4MASK_TO_V6(subnet_mask, ipif->ipif_v6net_mask);
16394 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
16395 		    ipif->ipif_v6subnet);
16396 	}
16397 
16398 	/* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */
16399 	if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) &&
16400 	    ipif->ipif_subnet != INADDR_ANY) {
16401 		/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
16402 
16403 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
16404 			route_mask = IP_HOST_MASK;
16405 		} else {
16406 			route_mask = subnet_mask;
16407 		}
16408 
16409 		ip1dbg(("ipif_up_done: ipif 0x%p ill 0x%p "
16410 		    "creating if IRE ill_net_type 0x%x for 0x%x\n",
16411 		    (void *)ipif, (void *)ill,
16412 		    ill->ill_net_type,
16413 		    ntohl(ipif->ipif_subnet)));
16414 		*irep++ = ire_create(
16415 		    (uchar_t *)&ipif->ipif_subnet,	/* dest address */
16416 		    (uchar_t *)&route_mask,		/* mask */
16417 		    (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */
16418 		    NULL,				/* no gateway */
16419 		    &ipif->ipif_mtu,			/* max frag */
16420 		    NULL,
16421 		    NULL,				/* no recv queue */
16422 		    stq,				/* send-to queue */
16423 		    ill->ill_net_type,			/* IF_[NO]RESOLVER */
16424 		    ipif,
16425 		    0,
16426 		    0,
16427 		    0,
16428 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE: 0,
16429 		    &ire_uinfo_null,
16430 		    NULL,
16431 		    NULL,
16432 		    ipst);
16433 	}
16434 
16435 	/*
16436 	 * Create any necessary broadcast IREs.
16437 	 */
16438 	if (ipif->ipif_flags & IPIF_BROADCAST)
16439 		irep = ipif_create_bcast_ires(ipif, irep);
16440 
16441 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
16442 
16443 	/* If an earlier ire_create failed, get out now */
16444 	for (irep1 = irep; irep1 > ire_array; ) {
16445 		irep1--;
16446 		if (*irep1 == NULL) {
16447 			ip1dbg(("ipif_up_done: NULL ire found in ire_array\n"));
16448 			err = ENOMEM;
16449 			goto bad;
16450 		}
16451 	}
16452 
16453 	/*
16454 	 * Need to atomically check for IP address availability under
16455 	 * ip_addr_avail_lock.  ill_g_lock is held as reader to ensure no new
16456 	 * ills or new ipifs can be added while we are checking availability.
16457 	 */
16458 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
16459 	mutex_enter(&ipst->ips_ip_addr_avail_lock);
16460 	/* Mark it up, and increment counters. */
16461 	ipif->ipif_flags |= IPIF_UP;
16462 	ill->ill_ipif_up_count++;
16463 	err = ip_addr_availability_check(ipif);
16464 	mutex_exit(&ipst->ips_ip_addr_avail_lock);
16465 	rw_exit(&ipst->ips_ill_g_lock);
16466 
16467 	if (err != 0) {
16468 		/*
16469 		 * Our address may already be up on the same ill. In this case,
16470 		 * the ARP entry for our ipif replaced the one for the other
16471 		 * ipif. So we don't want to delete it (otherwise the other ipif
16472 		 * would be unable to send packets).
16473 		 * ip_addr_availability_check() identifies this case for us and
16474 		 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL
16475 		 * which is the expected error code.
16476 		 */
16477 		if (err == EADDRINUSE) {
16478 			freemsg(ipif->ipif_arp_del_mp);
16479 			ipif->ipif_arp_del_mp = NULL;
16480 			err = EADDRNOTAVAIL;
16481 		}
16482 		ill->ill_ipif_up_count--;
16483 		ipif->ipif_flags &= ~IPIF_UP;
16484 		goto bad;
16485 	}
16486 
16487 	/*
16488 	 * Add in all newly created IREs.  ire_create_bcast() has
16489 	 * already checked for duplicates of the IRE_BROADCAST type.
16490 	 */
16491 	for (irep1 = irep; irep1 > ire_array; ) {
16492 		irep1--;
16493 		ASSERT(!MUTEX_HELD(&((*irep1)->ire_ipif->ipif_ill->ill_lock)));
16494 		/*
16495 		 * refheld by ire_add. refele towards the end of the func
16496 		 */
16497 		(void) ire_add(irep1, NULL, NULL, NULL, B_FALSE);
16498 	}
16499 
16500 	/* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */
16501 	ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt;
16502 	ipif_saved_irep = ipif_recover_ire(ipif);
16503 
16504 	if (!loopback) {
16505 		/*
16506 		 * If the broadcast address has been set, make sure it makes
16507 		 * sense based on the interface address.
16508 		 * Only match on ill since we are sharing broadcast addresses.
16509 		 */
16510 		if ((ipif->ipif_brd_addr != INADDR_ANY) &&
16511 		    (ipif->ipif_flags & IPIF_BROADCAST)) {
16512 			ire_t	*ire;
16513 
16514 			ire = ire_ctable_lookup(ipif->ipif_brd_addr, 0,
16515 			    IRE_BROADCAST, ipif, ALL_ZONES,
16516 			    NULL, (MATCH_IRE_TYPE | MATCH_IRE_ILL), ipst);
16517 
16518 			if (ire == NULL) {
16519 				/*
16520 				 * If there isn't a matching broadcast IRE,
16521 				 * revert to the default for this netmask.
16522 				 */
16523 				ipif->ipif_v6brd_addr = ipv6_all_zeros;
16524 				mutex_enter(&ipif->ipif_ill->ill_lock);
16525 				ipif_set_default(ipif);
16526 				mutex_exit(&ipif->ipif_ill->ill_lock);
16527 			} else {
16528 				ire_refrele(ire);
16529 			}
16530 		}
16531 
16532 	}
16533 
16534 	if (ill->ill_need_recover_multicast) {
16535 		/*
16536 		 * Need to recover all multicast memberships in the driver.
16537 		 * This had to be deferred until we had attached.  The same
16538 		 * code exists in ipif_up_done_v6() to recover IPv6
16539 		 * memberships.
16540 		 *
16541 		 * Note that it would be preferable to unconditionally do the
16542 		 * ill_recover_multicast() in ill_dl_up(), but we cannot do
16543 		 * that since ill_join_allmulti() depends on ill_dl_up being
16544 		 * set, and it is not set until we receive a DL_BIND_ACK after
16545 		 * having called ill_dl_up().
16546 		 */
16547 		ill_recover_multicast(ill);
16548 	}
16549 
16550 	if (ill->ill_ipif_up_count == 1) {
16551 		/*
16552 		 * Since the interface is now up, it may now be active.
16553 		 */
16554 		if (IS_UNDER_IPMP(ill))
16555 			ipmp_ill_refresh_active(ill);
16556 
16557 		/*
16558 		 * If this is an IPMP interface, we may now be able to
16559 		 * establish ARP entries.
16560 		 */
16561 		if (IS_IPMP(ill))
16562 			ipmp_illgrp_refresh_arpent(ill->ill_grp);
16563 	}
16564 
16565 	/* Join the allhosts multicast address */
16566 	ipif_multicast_up(ipif);
16567 
16568 	/*
16569 	 * See if anybody else would benefit from our new ipif.
16570 	 */
16571 	if (!loopback &&
16572 	    !(ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) {
16573 		ill_update_source_selection(ill);
16574 	}
16575 
16576 	for (irep1 = irep; irep1 > ire_array; ) {
16577 		irep1--;
16578 		if (*irep1 != NULL) {
16579 			/* was held in ire_add */
16580 			ire_refrele(*irep1);
16581 		}
16582 	}
16583 
16584 	cnt = ipif_saved_ire_cnt;
16585 	for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) {
16586 		if (*irep1 != NULL) {
16587 			/* was held in ire_add */
16588 			ire_refrele(*irep1);
16589 		}
16590 	}
16591 
16592 	if (!loopback && ipif->ipif_addr_ready) {
16593 		/* Broadcast an address mask reply. */
16594 		ipif_mask_reply(ipif);
16595 	}
16596 	if (ipif_saved_irep != NULL) {
16597 		kmem_free(ipif_saved_irep,
16598 		    ipif_saved_ire_cnt * sizeof (ire_t *));
16599 	}
16600 	if (src_ipif_held)
16601 		ipif_refrele(src_ipif);
16602 
16603 	/*
16604 	 * This had to be deferred until we had bound.  Tell routing sockets and
16605 	 * others that this interface is up if it looks like the address has
16606 	 * been validated.  Otherwise, if it isn't ready yet, wait for
16607 	 * duplicate address detection to do its thing.
16608 	 */
16609 	if (ipif->ipif_addr_ready)
16610 		ipif_up_notify(ipif);
16611 	return (0);
16612 
16613 bad:
16614 	ip1dbg(("ipif_up_done: FAILED \n"));
16615 
16616 	while (irep > ire_array) {
16617 		irep--;
16618 		if (*irep != NULL)
16619 			ire_delete(*irep);
16620 	}
16621 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst);
16622 
16623 	if (ipif_saved_irep != NULL) {
16624 		kmem_free(ipif_saved_irep,
16625 		    ipif_saved_ire_cnt * sizeof (ire_t *));
16626 	}
16627 	if (src_ipif_held)
16628 		ipif_refrele(src_ipif);
16629 
16630 	ipif_resolver_down(ipif);
16631 	return (err);
16632 }
16633 
16634 /*
16635  * Turn off the ARP with the ILLF_NOARP flag.
16636  */
16637 static int
16638 ill_arp_off(ill_t *ill)
16639 {
16640 	mblk_t	*arp_off_mp = NULL;
16641 	mblk_t	*arp_on_mp = NULL;
16642 
16643 	ip1dbg(("ill_arp_off(%s)\n", ill->ill_name));
16644 
16645 	ASSERT(IAM_WRITER_ILL(ill));
16646 	ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
16647 
16648 	/*
16649 	 * If the on message is still around we've already done
16650 	 * an arp_off without doing an arp_on thus there is no
16651 	 * work needed.
16652 	 */
16653 	if (ill->ill_arp_on_mp != NULL)
16654 		return (0);
16655 
16656 	/*
16657 	 * Allocate an ARP on message (to be saved) and an ARP off message
16658 	 */
16659 	arp_off_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aroff_template, 0);
16660 	if (!arp_off_mp)
16661 		return (ENOMEM);
16662 
16663 	arp_on_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aron_template, 0);
16664 	if (!arp_on_mp)
16665 		goto failed;
16666 
16667 	ASSERT(ill->ill_arp_on_mp == NULL);
16668 	ill->ill_arp_on_mp = arp_on_mp;
16669 
16670 	/* Send an AR_INTERFACE_OFF request */
16671 	putnext(ill->ill_rq, arp_off_mp);
16672 	return (0);
16673 failed:
16674 
16675 	if (arp_off_mp)
16676 		freemsg(arp_off_mp);
16677 	return (ENOMEM);
16678 }
16679 
16680 /*
16681  * Turn on ARP by turning off the ILLF_NOARP flag.
16682  */
16683 static int
16684 ill_arp_on(ill_t *ill)
16685 {
16686 	mblk_t	*mp;
16687 
16688 	ip1dbg(("ipif_arp_on(%s)\n", ill->ill_name));
16689 
16690 	ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
16691 
16692 	ASSERT(IAM_WRITER_ILL(ill));
16693 	/*
16694 	 * Send an AR_INTERFACE_ON request if we have already done
16695 	 * an arp_off (which allocated the message).
16696 	 */
16697 	if (ill->ill_arp_on_mp != NULL) {
16698 		mp = ill->ill_arp_on_mp;
16699 		ill->ill_arp_on_mp = NULL;
16700 		putnext(ill->ill_rq, mp);
16701 	}
16702 	return (0);
16703 }
16704 
16705 /*
16706  * Checks for availbility of a usable source address (if there is one) when the
16707  * destination ILL has the ill_usesrc_ifindex pointing to another ILL. Note
16708  * this selection is done regardless of the destination.
16709  */
16710 boolean_t
16711 ipif_usesrc_avail(ill_t *ill, zoneid_t zoneid)
16712 {
16713 	uint_t	ifindex;
16714 	ipif_t	*ipif = NULL;
16715 	ill_t	*uill;
16716 	boolean_t isv6;
16717 	ip_stack_t	*ipst = ill->ill_ipst;
16718 
16719 	ASSERT(ill != NULL);
16720 
16721 	isv6 = ill->ill_isv6;
16722 	ifindex = ill->ill_usesrc_ifindex;
16723 	if (ifindex != 0) {
16724 		uill = ill_lookup_on_ifindex(ifindex, isv6, NULL, NULL, NULL,
16725 		    NULL, ipst);
16726 		if (uill == NULL)
16727 			return (NULL);
16728 		mutex_enter(&uill->ill_lock);
16729 		for (ipif = uill->ill_ipif; ipif != NULL;
16730 		    ipif = ipif->ipif_next) {
16731 			if (!IPIF_CAN_LOOKUP(ipif))
16732 				continue;
16733 			if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
16734 				continue;
16735 			if (!(ipif->ipif_flags & IPIF_UP))
16736 				continue;
16737 			if (ipif->ipif_zoneid != zoneid)
16738 				continue;
16739 			if ((isv6 &&
16740 			    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) ||
16741 			    (ipif->ipif_lcl_addr == INADDR_ANY))
16742 				continue;
16743 			mutex_exit(&uill->ill_lock);
16744 			ill_refrele(uill);
16745 			return (B_TRUE);
16746 		}
16747 		mutex_exit(&uill->ill_lock);
16748 		ill_refrele(uill);
16749 	}
16750 	return (B_FALSE);
16751 }
16752 
16753 /*
16754  * IP source address type, sorted from worst to best.  For a given type,
16755  * always prefer IP addresses on the same subnet.  All-zones addresses are
16756  * suboptimal because they pose problems with unlabeled destinations.
16757  */
16758 typedef enum {
16759 	IPIF_NONE,
16760 	IPIF_DIFFNET_DEPRECATED, 	/* deprecated and different subnet */
16761 	IPIF_SAMENET_DEPRECATED, 	/* deprecated and same subnet */
16762 	IPIF_DIFFNET_ALLZONES,		/* allzones and different subnet */
16763 	IPIF_SAMENET_ALLZONES,		/* allzones and same subnet */
16764 	IPIF_DIFFNET,			/* normal and different subnet */
16765 	IPIF_SAMENET			/* normal and same subnet */
16766 } ipif_type_t;
16767 
16768 /*
16769  * Pick the optimal ipif on `ill' for sending to destination `dst' from zone
16770  * `zoneid'.  We rate usable ipifs from low -> high as per the ipif_type_t
16771  * enumeration, and return the highest-rated ipif.  If there's a tie, we pick
16772  * the first one, unless IPMP is used in which case we round-robin among them;
16773  * see below for more.
16774  *
16775  * Returns NULL if there is no suitable source address for the ill.
16776  * This only occurs when there is no valid source address for the ill.
16777  */
16778 ipif_t *
16779 ipif_select_source(ill_t *ill, ipaddr_t dst, zoneid_t zoneid)
16780 {
16781 	ill_t	*usill = NULL;
16782 	ill_t	*ipmp_ill = NULL;
16783 	ipif_t	*start_ipif, *next_ipif, *ipif, *best_ipif;
16784 	ipif_type_t type, best_type;
16785 	tsol_tpc_t *src_rhtp, *dst_rhtp;
16786 	ip_stack_t *ipst = ill->ill_ipst;
16787 	boolean_t samenet;
16788 
16789 	if (ill->ill_usesrc_ifindex != 0) {
16790 		usill = ill_lookup_on_ifindex(ill->ill_usesrc_ifindex,
16791 		    B_FALSE, NULL, NULL, NULL, NULL, ipst);
16792 		if (usill != NULL)
16793 			ill = usill;	/* Select source from usesrc ILL */
16794 		else
16795 			return (NULL);
16796 	}
16797 
16798 	/*
16799 	 * Test addresses should never be used for source address selection,
16800 	 * so if we were passed one, switch to the IPMP meta-interface.
16801 	 */
16802 	if (IS_UNDER_IPMP(ill)) {
16803 		if ((ipmp_ill = ipmp_ill_hold_ipmp_ill(ill)) != NULL)
16804 			ill = ipmp_ill;	/* Select source from IPMP ill */
16805 		else
16806 			return (NULL);
16807 	}
16808 
16809 	/*
16810 	 * If we're dealing with an unlabeled destination on a labeled system,
16811 	 * make sure that we ignore source addresses that are incompatible with
16812 	 * the destination's default label.  That destination's default label
16813 	 * must dominate the minimum label on the source address.
16814 	 */
16815 	dst_rhtp = NULL;
16816 	if (is_system_labeled()) {
16817 		dst_rhtp = find_tpc(&dst, IPV4_VERSION, B_FALSE);
16818 		if (dst_rhtp == NULL)
16819 			return (NULL);
16820 		if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
16821 			TPC_RELE(dst_rhtp);
16822 			dst_rhtp = NULL;
16823 		}
16824 	}
16825 
16826 	/*
16827 	 * Hold the ill_g_lock as reader. This makes sure that no ipif/ill
16828 	 * can be deleted. But an ipif/ill can get CONDEMNED any time.
16829 	 * After selecting the right ipif, under ill_lock make sure ipif is
16830 	 * not condemned, and increment refcnt. If ipif is CONDEMNED,
16831 	 * we retry. Inside the loop we still need to check for CONDEMNED,
16832 	 * but not under a lock.
16833 	 */
16834 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
16835 retry:
16836 	/*
16837 	 * For source address selection, we treat the ipif list as circular
16838 	 * and continue until we get back to where we started.  This allows
16839 	 * IPMP to vary source address selection (which improves inbound load
16840 	 * spreading) by caching its last ending point and starting from
16841 	 * there.  NOTE: we don't have to worry about ill_src_ipif changing
16842 	 * ills since that can't happen on the IPMP ill.
16843 	 */
16844 	start_ipif = ill->ill_ipif;
16845 	if (IS_IPMP(ill) && ill->ill_src_ipif != NULL)
16846 		start_ipif = ill->ill_src_ipif;
16847 
16848 	ipif = start_ipif;
16849 	best_ipif = NULL;
16850 	best_type = IPIF_NONE;
16851 	do {
16852 		if ((next_ipif = ipif->ipif_next) == NULL)
16853 			next_ipif = ill->ill_ipif;
16854 
16855 		if (!IPIF_CAN_LOOKUP(ipif))
16856 			continue;
16857 		/* Always skip NOLOCAL and ANYCAST interfaces */
16858 		if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
16859 			continue;
16860 		if (!(ipif->ipif_flags & IPIF_UP) || !ipif->ipif_addr_ready)
16861 			continue;
16862 		if (ipif->ipif_zoneid != zoneid &&
16863 		    ipif->ipif_zoneid != ALL_ZONES)
16864 			continue;
16865 
16866 		/*
16867 		 * Interfaces with 0.0.0.0 address are allowed to be UP, but
16868 		 * are not valid as source addresses.
16869 		 */
16870 		if (ipif->ipif_lcl_addr == INADDR_ANY)
16871 			continue;
16872 
16873 		/*
16874 		 * Check compatibility of local address for destination's
16875 		 * default label if we're on a labeled system.	Incompatible
16876 		 * addresses can't be used at all.
16877 		 */
16878 		if (dst_rhtp != NULL) {
16879 			boolean_t incompat;
16880 
16881 			src_rhtp = find_tpc(&ipif->ipif_lcl_addr,
16882 			    IPV4_VERSION, B_FALSE);
16883 			if (src_rhtp == NULL)
16884 				continue;
16885 			incompat = src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
16886 			    src_rhtp->tpc_tp.tp_doi !=
16887 			    dst_rhtp->tpc_tp.tp_doi ||
16888 			    (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
16889 			    &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
16890 			    !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
16891 			    src_rhtp->tpc_tp.tp_sl_set_cipso));
16892 			TPC_RELE(src_rhtp);
16893 			if (incompat)
16894 				continue;
16895 		}
16896 
16897 		samenet = ((ipif->ipif_net_mask & dst) == ipif->ipif_subnet);
16898 
16899 		if (ipif->ipif_flags & IPIF_DEPRECATED) {
16900 			type = samenet ? IPIF_SAMENET_DEPRECATED :
16901 			    IPIF_DIFFNET_DEPRECATED;
16902 		} else if (ipif->ipif_zoneid == ALL_ZONES) {
16903 			type = samenet ? IPIF_SAMENET_ALLZONES :
16904 			    IPIF_DIFFNET_ALLZONES;
16905 		} else {
16906 			type = samenet ? IPIF_SAMENET : IPIF_DIFFNET;
16907 		}
16908 
16909 		if (type > best_type) {
16910 			best_type = type;
16911 			best_ipif = ipif;
16912 			if (best_type == IPIF_SAMENET)
16913 				break; /* can't get better */
16914 		}
16915 	} while ((ipif = next_ipif) != start_ipif);
16916 
16917 	if ((ipif = best_ipif) != NULL) {
16918 		mutex_enter(&ipif->ipif_ill->ill_lock);
16919 		if (!IPIF_CAN_LOOKUP(ipif)) {
16920 			mutex_exit(&ipif->ipif_ill->ill_lock);
16921 			goto retry;
16922 		}
16923 		ipif_refhold_locked(ipif);
16924 
16925 		/*
16926 		 * For IPMP, update the source ipif rotor to the next ipif,
16927 		 * provided we can look it up.  (We must not use it if it's
16928 		 * IPIF_CONDEMNED since we may have grabbed ill_g_lock after
16929 		 * ipif_free() checked ill_src_ipif.)
16930 		 */
16931 		if (IS_IPMP(ill) && ipif != NULL) {
16932 			next_ipif = ipif->ipif_next;
16933 			if (next_ipif != NULL && IPIF_CAN_LOOKUP(next_ipif))
16934 				ill->ill_src_ipif = next_ipif;
16935 			else
16936 				ill->ill_src_ipif = NULL;
16937 		}
16938 		mutex_exit(&ipif->ipif_ill->ill_lock);
16939 	}
16940 
16941 	rw_exit(&ipst->ips_ill_g_lock);
16942 	if (usill != NULL)
16943 		ill_refrele(usill);
16944 	if (ipmp_ill != NULL)
16945 		ill_refrele(ipmp_ill);
16946 	if (dst_rhtp != NULL)
16947 		TPC_RELE(dst_rhtp);
16948 
16949 #ifdef DEBUG
16950 	if (ipif == NULL) {
16951 		char buf1[INET6_ADDRSTRLEN];
16952 
16953 		ip1dbg(("ipif_select_source(%s, %s) -> NULL\n",
16954 		    ill->ill_name,
16955 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1))));
16956 	} else {
16957 		char buf1[INET6_ADDRSTRLEN];
16958 		char buf2[INET6_ADDRSTRLEN];
16959 
16960 		ip1dbg(("ipif_select_source(%s, %s) -> %s\n",
16961 		    ipif->ipif_ill->ill_name,
16962 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1)),
16963 		    inet_ntop(AF_INET, &ipif->ipif_lcl_addr,
16964 		    buf2, sizeof (buf2))));
16965 	}
16966 #endif /* DEBUG */
16967 	return (ipif);
16968 }
16969 
16970 /*
16971  * If old_ipif is not NULL, see if ipif was derived from old
16972  * ipif and if so, recreate the interface route by re-doing
16973  * source address selection. This happens when ipif_down ->
16974  * ipif_update_other_ipifs calls us.
16975  *
16976  * If old_ipif is NULL, just redo the source address selection
16977  * if needed. This happens when ipif_up_done calls us.
16978  */
16979 static void
16980 ipif_recreate_interface_routes(ipif_t *old_ipif, ipif_t *ipif)
16981 {
16982 	ire_t *ire;
16983 	ire_t *ipif_ire;
16984 	queue_t *stq;
16985 	ipif_t *nipif;
16986 	ill_t *ill;
16987 	boolean_t need_rele = B_FALSE;
16988 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
16989 
16990 	ASSERT(old_ipif == NULL || IAM_WRITER_IPIF(old_ipif));
16991 	ASSERT(IAM_WRITER_IPIF(ipif));
16992 
16993 	ill = ipif->ipif_ill;
16994 	if (!(ipif->ipif_flags &
16995 	    (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) {
16996 		/*
16997 		 * Can't possibly have borrowed the source
16998 		 * from old_ipif.
16999 		 */
17000 		return;
17001 	}
17002 
17003 	/*
17004 	 * Is there any work to be done? No work if the address
17005 	 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST (
17006 	 * ipif_select_source() does not borrow addresses from
17007 	 * NOLOCAL and ANYCAST interfaces).
17008 	 */
17009 	if ((old_ipif != NULL) &&
17010 	    ((old_ipif->ipif_lcl_addr == INADDR_ANY) ||
17011 	    (old_ipif->ipif_ill->ill_wq == NULL) ||
17012 	    (old_ipif->ipif_flags &
17013 	    (IPIF_NOLOCAL|IPIF_ANYCAST)))) {
17014 		return;
17015 	}
17016 
17017 	/*
17018 	 * Perform the same checks as when creating the
17019 	 * IRE_INTERFACE in ipif_up_done.
17020 	 */
17021 	if (!(ipif->ipif_flags & IPIF_UP))
17022 		return;
17023 
17024 	if ((ipif->ipif_flags & IPIF_NOXMIT) ||
17025 	    (ipif->ipif_subnet == INADDR_ANY))
17026 		return;
17027 
17028 	ipif_ire = ipif_to_ire(ipif);
17029 	if (ipif_ire == NULL)
17030 		return;
17031 
17032 	/*
17033 	 * We know that ipif uses some other source for its
17034 	 * IRE_INTERFACE. Is it using the source of this
17035 	 * old_ipif?
17036 	 */
17037 	if (old_ipif != NULL &&
17038 	    old_ipif->ipif_lcl_addr != ipif_ire->ire_src_addr) {
17039 		ire_refrele(ipif_ire);
17040 		return;
17041 	}
17042 	if (ip_debug > 2) {
17043 		/* ip1dbg */
17044 		pr_addr_dbg("ipif_recreate_interface_routes: deleting IRE for"
17045 		    " src %s\n", AF_INET, &ipif_ire->ire_src_addr);
17046 	}
17047 
17048 	stq = ipif_ire->ire_stq;
17049 
17050 	/*
17051 	 * Can't use our source address. Select a different
17052 	 * source address for the IRE_INTERFACE.
17053 	 */
17054 	nipif = ipif_select_source(ill, ipif->ipif_subnet, ipif->ipif_zoneid);
17055 	if (nipif == NULL) {
17056 		/* Last resort - all ipif's have IPIF_NOLOCAL */
17057 		nipif = ipif;
17058 	} else {
17059 		need_rele = B_TRUE;
17060 	}
17061 
17062 	ire = ire_create(
17063 	    (uchar_t *)&ipif->ipif_subnet,	/* dest pref */
17064 	    (uchar_t *)&ipif->ipif_net_mask,	/* mask */
17065 	    (uchar_t *)&nipif->ipif_src_addr,	/* src addr */
17066 	    NULL,				/* no gateway */
17067 	    &ipif->ipif_mtu,			/* max frag */
17068 	    NULL,				/* no src nce */
17069 	    NULL,				/* no recv from queue */
17070 	    stq,				/* send-to queue */
17071 	    ill->ill_net_type,			/* IF_[NO]RESOLVER */
17072 	    ipif,
17073 	    0,
17074 	    0,
17075 	    0,
17076 	    0,
17077 	    &ire_uinfo_null,
17078 	    NULL,
17079 	    NULL,
17080 	    ipst);
17081 
17082 	if (ire != NULL) {
17083 		ire_t *ret_ire;
17084 		int error;
17085 
17086 		/*
17087 		 * We don't need ipif_ire anymore. We need to delete
17088 		 * before we add so that ire_add does not detect
17089 		 * duplicates.
17090 		 */
17091 		ire_delete(ipif_ire);
17092 		ret_ire = ire;
17093 		error = ire_add(&ret_ire, NULL, NULL, NULL, B_FALSE);
17094 		ASSERT(error == 0);
17095 		ASSERT(ire == ret_ire);
17096 		/* Held in ire_add */
17097 		ire_refrele(ret_ire);
17098 	}
17099 	/*
17100 	 * Either we are falling through from above or could not
17101 	 * allocate a replacement.
17102 	 */
17103 	ire_refrele(ipif_ire);
17104 	if (need_rele)
17105 		ipif_refrele(nipif);
17106 }
17107 
17108 /*
17109  * This old_ipif is going away.
17110  *
17111  * Determine if any other ipif's are using our address as
17112  * ipif_lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or
17113  * IPIF_DEPRECATED).
17114  * Find the IRE_INTERFACE for such ipifs and recreate them
17115  * to use an different source address following the rules in
17116  * ipif_up_done.
17117  */
17118 static void
17119 ipif_update_other_ipifs(ipif_t *old_ipif)
17120 {
17121 	ipif_t	*ipif;
17122 	ill_t	*ill;
17123 	char	buf[INET6_ADDRSTRLEN];
17124 
17125 	ASSERT(IAM_WRITER_IPIF(old_ipif));
17126 
17127 	ill = old_ipif->ipif_ill;
17128 
17129 	ip1dbg(("ipif_update_other_ipifs(%s, %s)\n", ill->ill_name,
17130 	    inet_ntop(AF_INET, &old_ipif->ipif_lcl_addr, buf, sizeof (buf))));
17131 
17132 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17133 		if (ipif == old_ipif)
17134 			continue;
17135 		ipif_recreate_interface_routes(old_ipif, ipif);
17136 	}
17137 }
17138 
17139 /* ARGSUSED */
17140 int
17141 if_unitsel_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
17142 	ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
17143 {
17144 	/*
17145 	 * ill_phyint_reinit merged the v4 and v6 into a single
17146 	 * ipsq.  We might not have been able to complete the
17147 	 * operation in ipif_set_values, if we could not become
17148 	 * exclusive.  If so restart it here.
17149 	 */
17150 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
17151 }
17152 
17153 /*
17154  * Can operate on either a module or a driver queue.
17155  * Returns an error if not a module queue.
17156  */
17157 /* ARGSUSED */
17158 int
17159 if_unitsel(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
17160     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
17161 {
17162 	queue_t		*q1 = q;
17163 	char 		*cp;
17164 	char		interf_name[LIFNAMSIZ];
17165 	uint_t		ppa = *(uint_t *)mp->b_cont->b_cont->b_rptr;
17166 
17167 	if (q->q_next == NULL) {
17168 		ip1dbg((
17169 		    "if_unitsel: IF_UNITSEL: no q_next\n"));
17170 		return (EINVAL);
17171 	}
17172 
17173 	if (((ill_t *)(q->q_ptr))->ill_name[0] != '\0')
17174 		return (EALREADY);
17175 
17176 	do {
17177 		q1 = q1->q_next;
17178 	} while (q1->q_next);
17179 	cp = q1->q_qinfo->qi_minfo->mi_idname;
17180 	(void) sprintf(interf_name, "%s%d", cp, ppa);
17181 
17182 	/*
17183 	 * Here we are not going to delay the ioack until after
17184 	 * ACKs from DL_ATTACH_REQ/DL_BIND_REQ. So no need to save the
17185 	 * original ioctl message before sending the requests.
17186 	 */
17187 	return (ipif_set_values(q, mp, interf_name, &ppa));
17188 }
17189 
17190 /* ARGSUSED */
17191 int
17192 ip_sioctl_sifname(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
17193     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
17194 {
17195 	return (ENXIO);
17196 }
17197 
17198 /*
17199  * Refresh all IRE_BROADCAST entries associated with `ill' to ensure the
17200  * minimum (but complete) set exist.  This is necessary when adding or
17201  * removing an interface to/from an IPMP group, since interfaces in an
17202  * IPMP group use the IRE_BROADCAST entries for the IPMP group (whenever
17203  * its test address subnets overlap with IPMP data addresses).	It's also
17204  * used to refresh the IRE_BROADCAST entries associated with the IPMP
17205  * interface when the nominated broadcast interface changes.
17206  */
17207 void
17208 ill_refresh_bcast(ill_t *ill)
17209 {
17210 	ire_t *ire_array[12];	/* max ipif_create_bcast_ires() can create */
17211 	ire_t **irep;
17212 	ipif_t *ipif;
17213 
17214 	ASSERT(!ill->ill_isv6);
17215 	ASSERT(IAM_WRITER_ILL(ill));
17216 
17217 	/*
17218 	 * Remove any old broadcast IREs.
17219 	 */
17220 	ire_walk_ill_v4(MATCH_IRE_ILL | MATCH_IRE_TYPE, IRE_BROADCAST,
17221 	    ill_broadcast_delete, ill, ill);
17222 
17223 	/*
17224 	 * Create new ones for any ipifs that are up and broadcast-capable.
17225 	 */
17226 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17227 		if ((ipif->ipif_flags & (IPIF_UP|IPIF_BROADCAST)) !=
17228 		    (IPIF_UP|IPIF_BROADCAST))
17229 			continue;
17230 
17231 		irep = ipif_create_bcast_ires(ipif, ire_array);
17232 		while (irep-- > ire_array) {
17233 			(void) ire_add(irep, NULL, NULL, NULL, B_FALSE);
17234 			if (*irep != NULL)
17235 				ire_refrele(*irep);
17236 		}
17237 	}
17238 }
17239 
17240 /*
17241  * Create any IRE_BROADCAST entries for `ipif', and store those entries in
17242  * `irep'.  Returns a pointer to the next free `irep' entry (just like
17243  * ire_check_and_create_bcast()).
17244  */
17245 static ire_t **
17246 ipif_create_bcast_ires(ipif_t *ipif, ire_t **irep)
17247 {
17248 	ipaddr_t addr;
17249 	ipaddr_t netmask = ip_net_mask(ipif->ipif_lcl_addr);
17250 	ipaddr_t subnetmask = ipif->ipif_net_mask;
17251 	int flags = MATCH_IRE_TYPE | MATCH_IRE_ILL;
17252 
17253 	ip1dbg(("ipif_create_bcast_ires: creating broadcast IREs\n"));
17254 
17255 	ASSERT(ipif->ipif_flags & IPIF_BROADCAST);
17256 
17257 	if (ipif->ipif_lcl_addr == INADDR_ANY ||
17258 	    (ipif->ipif_flags & IPIF_NOLOCAL))
17259 		netmask = htonl(IN_CLASSA_NET);		/* fallback */
17260 
17261 	irep = ire_check_and_create_bcast(ipif, 0, irep, flags);
17262 	irep = ire_check_and_create_bcast(ipif, INADDR_BROADCAST, irep, flags);
17263 
17264 	/*
17265 	 * For backward compatibility, we create net broadcast IREs based on
17266 	 * the old "IP address class system", since some old machines only
17267 	 * respond to these class derived net broadcast.  However, we must not
17268 	 * create these net broadcast IREs if the subnetmask is shorter than
17269 	 * the IP address class based derived netmask.  Otherwise, we may
17270 	 * create a net broadcast address which is the same as an IP address
17271 	 * on the subnet -- and then TCP will refuse to talk to that address.
17272 	 */
17273 	if (netmask < subnetmask) {
17274 		addr = netmask & ipif->ipif_subnet;
17275 		irep = ire_check_and_create_bcast(ipif, addr, irep, flags);
17276 		irep = ire_check_and_create_bcast(ipif, ~netmask | addr, irep,
17277 		    flags);
17278 	}
17279 
17280 	/*
17281 	 * Don't create IRE_BROADCAST IREs for the interface if the subnetmask
17282 	 * is 0xFFFFFFFF, as an IRE_LOCAL for that interface is already
17283 	 * created.  Creating these broadcast IREs will only create confusion
17284 	 * as `addr' will be the same as the IP address.
17285 	 */
17286 	if (subnetmask != 0xFFFFFFFF) {
17287 		addr = ipif->ipif_subnet;
17288 		irep = ire_check_and_create_bcast(ipif, addr, irep, flags);
17289 		irep = ire_check_and_create_bcast(ipif, ~subnetmask | addr,
17290 		    irep, flags);
17291 	}
17292 
17293 	return (irep);
17294 }
17295 
17296 /*
17297  * Broadcast IRE info structure used in the functions below.  Since we
17298  * allocate BCAST_COUNT of them on the stack, keep the bit layout compact.
17299  */
17300 typedef struct bcast_ireinfo {
17301 	uchar_t		bi_type;	/* BCAST_* value from below */
17302 	uchar_t		bi_willdie:1, 	/* will this IRE be going away? */
17303 			bi_needrep:1,	/* do we need to replace it? */
17304 			bi_haverep:1,	/* have we replaced it? */
17305 			bi_pad:5;
17306 	ipaddr_t	bi_addr;	/* IRE address */
17307 	ipif_t		*bi_backup;	/* last-ditch ipif to replace it on */
17308 } bcast_ireinfo_t;
17309 
17310 enum { BCAST_ALLONES, BCAST_ALLZEROES, BCAST_NET, BCAST_SUBNET, BCAST_COUNT };
17311 
17312 /*
17313  * Check if `ipif' needs the dying broadcast IRE described by `bireinfop', and
17314  * return B_TRUE if it should immediately be used to recreate the IRE.
17315  */
17316 static boolean_t
17317 ipif_consider_bcast(ipif_t *ipif, bcast_ireinfo_t *bireinfop)
17318 {
17319 	ipaddr_t addr;
17320 
17321 	ASSERT(!bireinfop->bi_haverep && bireinfop->bi_willdie);
17322 
17323 	switch (bireinfop->bi_type) {
17324 	case BCAST_NET:
17325 		addr = ipif->ipif_subnet & ip_net_mask(ipif->ipif_subnet);
17326 		if (addr != bireinfop->bi_addr)
17327 			return (B_FALSE);
17328 		break;
17329 	case BCAST_SUBNET:
17330 		if (ipif->ipif_subnet != bireinfop->bi_addr)
17331 			return (B_FALSE);
17332 		break;
17333 	}
17334 
17335 	bireinfop->bi_needrep = 1;
17336 	if (ipif->ipif_flags & (IPIF_DEPRECATED|IPIF_NOLOCAL|IPIF_ANYCAST)) {
17337 		if (bireinfop->bi_backup == NULL)
17338 			bireinfop->bi_backup = ipif;
17339 		return (B_FALSE);
17340 	}
17341 	return (B_TRUE);
17342 }
17343 
17344 /*
17345  * Create the broadcast IREs described by `bireinfop' on `ipif', and return
17346  * them ala ire_check_and_create_bcast().
17347  */
17348 static ire_t **
17349 ipif_create_bcast(ipif_t *ipif, bcast_ireinfo_t *bireinfop, ire_t **irep)
17350 {
17351 	ipaddr_t mask, addr;
17352 
17353 	ASSERT(!bireinfop->bi_haverep && bireinfop->bi_needrep);
17354 
17355 	addr = bireinfop->bi_addr;
17356 	irep = ire_create_bcast(ipif, addr, irep);
17357 
17358 	switch (bireinfop->bi_type) {
17359 	case BCAST_NET:
17360 		mask = ip_net_mask(ipif->ipif_subnet);
17361 		irep = ire_create_bcast(ipif, addr | ~mask, irep);
17362 		break;
17363 	case BCAST_SUBNET:
17364 		mask = ipif->ipif_net_mask;
17365 		irep = ire_create_bcast(ipif, addr | ~mask, irep);
17366 		break;
17367 	}
17368 
17369 	bireinfop->bi_haverep = 1;
17370 	return (irep);
17371 }
17372 
17373 /*
17374  * Walk through all of the ipifs on `ill' that will be affected by `test_ipif'
17375  * going away, and determine if any of the broadcast IREs (named by `bireinfop')
17376  * that are going away are still needed.  If so, have ipif_create_bcast()
17377  * recreate them (except for the deprecated case, as explained below).
17378  */
17379 static ire_t **
17380 ill_create_bcast(ill_t *ill, ipif_t *test_ipif, bcast_ireinfo_t *bireinfo,
17381     ire_t **irep)
17382 {
17383 	int i;
17384 	ipif_t *ipif;
17385 
17386 	ASSERT(!ill->ill_isv6);
17387 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17388 		/*
17389 		 * Skip this ipif if it's (a) the one being taken down, (b)
17390 		 * not in the same zone, or (c) has no valid local address.
17391 		 */
17392 		if (ipif == test_ipif ||
17393 		    ipif->ipif_zoneid != test_ipif->ipif_zoneid ||
17394 		    ipif->ipif_subnet == 0 ||
17395 		    (ipif->ipif_flags & (IPIF_UP|IPIF_BROADCAST|IPIF_NOXMIT)) !=
17396 		    (IPIF_UP|IPIF_BROADCAST))
17397 			continue;
17398 
17399 		/*
17400 		 * For each dying IRE that hasn't yet been replaced, see if
17401 		 * `ipif' needs it and whether the IRE should be recreated on
17402 		 * `ipif'.  If `ipif' is deprecated, ipif_consider_bcast()
17403 		 * will return B_FALSE even if `ipif' needs the IRE on the
17404 		 * hopes that we'll later find a needy non-deprecated ipif.
17405 		 * However, the ipif is recorded in bi_backup for possible
17406 		 * subsequent use by ipif_check_bcast_ires().
17407 		 */
17408 		for (i = 0; i < BCAST_COUNT; i++) {
17409 			if (!bireinfo[i].bi_willdie || bireinfo[i].bi_haverep)
17410 				continue;
17411 			if (!ipif_consider_bcast(ipif, &bireinfo[i]))
17412 				continue;
17413 			irep = ipif_create_bcast(ipif, &bireinfo[i], irep);
17414 		}
17415 
17416 		/*
17417 		 * If we've replaced all of the broadcast IREs that are going
17418 		 * to be taken down, we know we're done.
17419 		 */
17420 		for (i = 0; i < BCAST_COUNT; i++) {
17421 			if (bireinfo[i].bi_willdie && !bireinfo[i].bi_haverep)
17422 				break;
17423 		}
17424 		if (i == BCAST_COUNT)
17425 			break;
17426 	}
17427 	return (irep);
17428 }
17429 
17430 /*
17431  * Check if `test_ipif' (which is going away) is associated with any existing
17432  * broadcast IREs, and whether any other ipifs (e.g., on the same ill) were
17433  * using those broadcast IREs.  If so, recreate the broadcast IREs on one or
17434  * more of those other ipifs.  (The old IREs will be deleted in ipif_down().)
17435  *
17436  * This is necessary because broadcast IREs are shared.  In particular, a
17437  * given ill has one set of all-zeroes and all-ones broadcast IREs (for every
17438  * zone), plus one set of all-subnet-ones, all-subnet-zeroes, all-net-ones,
17439  * and all-net-zeroes for every net/subnet (and every zone) it has IPIF_UP
17440  * ipifs on.  Thus, if there are two IPIF_UP ipifs on the same subnet with the
17441  * same zone, they will share the same set of broadcast IREs.
17442  *
17443  * Note: the upper bound of 12 IREs comes from the worst case of replacing all
17444  * six pairs (loopback and non-loopback) of broadcast IREs (all-zeroes,
17445  * all-ones, subnet-zeroes, subnet-ones, net-zeroes, and net-ones).
17446  */
17447 static void
17448 ipif_check_bcast_ires(ipif_t *test_ipif)
17449 {
17450 	ill_t		*ill = test_ipif->ipif_ill;
17451 	ire_t		*ire, *ire_array[12]; 		/* see note above */
17452 	ire_t		**irep1, **irep = &ire_array[0];
17453 	uint_t 		i, willdie;
17454 	ipaddr_t	mask = ip_net_mask(test_ipif->ipif_subnet);
17455 	bcast_ireinfo_t	bireinfo[BCAST_COUNT];
17456 
17457 	ASSERT(!test_ipif->ipif_isv6);
17458 	ASSERT(IAM_WRITER_IPIF(test_ipif));
17459 
17460 	/*
17461 	 * No broadcast IREs for the LOOPBACK interface
17462 	 * or others such as point to point and IPIF_NOXMIT.
17463 	 */
17464 	if (!(test_ipif->ipif_flags & IPIF_BROADCAST) ||
17465 	    (test_ipif->ipif_flags & IPIF_NOXMIT))
17466 		return;
17467 
17468 	bzero(bireinfo, sizeof (bireinfo));
17469 	bireinfo[0].bi_type = BCAST_ALLZEROES;
17470 	bireinfo[0].bi_addr = 0;
17471 
17472 	bireinfo[1].bi_type = BCAST_ALLONES;
17473 	bireinfo[1].bi_addr = INADDR_BROADCAST;
17474 
17475 	bireinfo[2].bi_type = BCAST_NET;
17476 	bireinfo[2].bi_addr = test_ipif->ipif_subnet & mask;
17477 
17478 	if (test_ipif->ipif_net_mask != 0)
17479 		mask = test_ipif->ipif_net_mask;
17480 	bireinfo[3].bi_type = BCAST_SUBNET;
17481 	bireinfo[3].bi_addr = test_ipif->ipif_subnet & mask;
17482 
17483 	/*
17484 	 * Figure out what (if any) broadcast IREs will die as a result of
17485 	 * `test_ipif' going away.  If none will die, we're done.
17486 	 */
17487 	for (i = 0, willdie = 0; i < BCAST_COUNT; i++) {
17488 		ire = ire_ctable_lookup(bireinfo[i].bi_addr, 0, IRE_BROADCAST,
17489 		    test_ipif, ALL_ZONES, NULL,
17490 		    (MATCH_IRE_TYPE | MATCH_IRE_IPIF), ill->ill_ipst);
17491 		if (ire != NULL) {
17492 			willdie++;
17493 			bireinfo[i].bi_willdie = 1;
17494 			ire_refrele(ire);
17495 		}
17496 	}
17497 
17498 	if (willdie == 0)
17499 		return;
17500 
17501 	/*
17502 	 * Walk through all the ipifs that will be affected by the dying IREs,
17503 	 * and recreate the IREs as necessary. Note that all interfaces in an
17504 	 * IPMP illgrp share the same broadcast IREs, and thus the entire
17505 	 * illgrp must be walked, starting with the IPMP meta-interface (so
17506 	 * that broadcast IREs end up on it whenever possible).
17507 	 */
17508 	if (IS_UNDER_IPMP(ill))
17509 		ill = ipmp_illgrp_ipmp_ill(ill->ill_grp);
17510 
17511 	irep = ill_create_bcast(ill, test_ipif, bireinfo, irep);
17512 
17513 	if (IS_IPMP(ill) || IS_UNDER_IPMP(ill)) {
17514 		ipmp_illgrp_t *illg = ill->ill_grp;
17515 
17516 		ill = list_head(&illg->ig_if);
17517 		for (; ill != NULL; ill = list_next(&illg->ig_if, ill)) {
17518 			for (i = 0; i < BCAST_COUNT; i++) {
17519 				if (bireinfo[i].bi_willdie &&
17520 				    !bireinfo[i].bi_haverep)
17521 					break;
17522 			}
17523 			if (i == BCAST_COUNT)
17524 				break;
17525 
17526 			irep = ill_create_bcast(ill, test_ipif, bireinfo, irep);
17527 		}
17528 	}
17529 
17530 	/*
17531 	 * Scan through the set of broadcast IREs and see if there are any
17532 	 * that we need to replace that have not yet been replaced.  If so,
17533 	 * replace them using the appropriate backup ipif.
17534 	 */
17535 	for (i = 0; i < BCAST_COUNT; i++) {
17536 		if (bireinfo[i].bi_needrep && !bireinfo[i].bi_haverep)
17537 			irep = ipif_create_bcast(bireinfo[i].bi_backup,
17538 			    &bireinfo[i], irep);
17539 	}
17540 
17541 	/*
17542 	 * If we can't create all of them, don't add any of them.  (Code in
17543 	 * ip_wput_ire() and ire_to_ill() assumes that we always have a
17544 	 * non-loopback copy and loopback copy for a given address.)
17545 	 */
17546 	for (irep1 = irep; irep1 > ire_array; ) {
17547 		irep1--;
17548 		if (*irep1 == NULL) {
17549 			ip0dbg(("ipif_check_bcast_ires: can't create "
17550 			    "IRE_BROADCAST, memory allocation failure\n"));
17551 			while (irep > ire_array) {
17552 				irep--;
17553 				if (*irep != NULL)
17554 					ire_delete(*irep);
17555 			}
17556 			return;
17557 		}
17558 	}
17559 
17560 	for (irep1 = irep; irep1 > ire_array; ) {
17561 		irep1--;
17562 		if (ire_add(irep1, NULL, NULL, NULL, B_FALSE) == 0)
17563 			ire_refrele(*irep1);		/* Held in ire_add */
17564 	}
17565 }
17566 
17567 /*
17568  * Extract both the flags (including IFF_CANTCHANGE) such as IFF_IPV*
17569  * from lifr_flags and the name from lifr_name.
17570  * Set IFF_IPV* and ill_isv6 prior to doing the lookup
17571  * since ipif_lookup_on_name uses the _isv6 flags when matching.
17572  * Returns EINPROGRESS when mp has been consumed by queueing it on
17573  * ill_pending_mp and the ioctl will complete in ip_rput.
17574  *
17575  * Can operate on either a module or a driver queue.
17576  * Returns an error if not a module queue.
17577  */
17578 /* ARGSUSED */
17579 int
17580 ip_sioctl_slifname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17581     ip_ioctl_cmd_t *ipip, void *if_req)
17582 {
17583 	ill_t	*ill = q->q_ptr;
17584 	phyint_t *phyi;
17585 	ip_stack_t *ipst;
17586 	struct lifreq *lifr = if_req;
17587 
17588 	ASSERT(ipif != NULL);
17589 	ip1dbg(("ip_sioctl_slifname %s\n", lifr->lifr_name));
17590 
17591 	if (q->q_next == NULL) {
17592 		ip1dbg(("if_sioctl_slifname: SIOCSLIFNAME: no q_next\n"));
17593 		return (EINVAL);
17594 	}
17595 
17596 	/*
17597 	 * If we are not writer on 'q' then this interface exists already
17598 	 * and previous lookups (ip_extract_lifreq()) found this ipif --
17599 	 * so return EALREADY.
17600 	 */
17601 	if (ill != ipif->ipif_ill)
17602 		return (EALREADY);
17603 
17604 	if (ill->ill_name[0] != '\0')
17605 		return (EALREADY);
17606 
17607 	/*
17608 	 * Set all the flags. Allows all kinds of override. Provide some
17609 	 * sanity checking by not allowing IFF_BROADCAST and IFF_MULTICAST
17610 	 * unless there is either multicast/broadcast support in the driver
17611 	 * or it is a pt-pt link.
17612 	 */
17613 	if (lifr->lifr_flags & (IFF_PROMISC|IFF_ALLMULTI)) {
17614 		/* Meaningless to IP thus don't allow them to be set. */
17615 		ip1dbg(("ip_setname: EINVAL 1\n"));
17616 		return (EINVAL);
17617 	}
17618 
17619 	/*
17620 	 * If there's another ill already with the requested name, ensure
17621 	 * that it's of the same type.  Otherwise, ill_phyint_reinit() will
17622 	 * fuse together two unrelated ills, which will cause chaos.
17623 	 */
17624 	ipst = ill->ill_ipst;
17625 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
17626 	    lifr->lifr_name, NULL);
17627 	if (phyi != NULL) {
17628 		ill_t *ill_mate = phyi->phyint_illv4;
17629 
17630 		if (ill_mate == NULL)
17631 			ill_mate = phyi->phyint_illv6;
17632 		ASSERT(ill_mate != NULL);
17633 
17634 		if (ill_mate->ill_media->ip_m_mac_type !=
17635 		    ill->ill_media->ip_m_mac_type) {
17636 			ip1dbg(("if_sioctl_slifname: SIOCSLIFNAME: attempt to "
17637 			    "use the same ill name on differing media\n"));
17638 			return (EINVAL);
17639 		}
17640 	}
17641 
17642 	/*
17643 	 * For a DL_STYLE2 driver (ill_needs_attach), we would not have the
17644 	 * ill_bcast_addr_length info.
17645 	 */
17646 	if (!ill->ill_needs_attach &&
17647 	    ((lifr->lifr_flags & IFF_MULTICAST) &&
17648 	    !(lifr->lifr_flags & IFF_POINTOPOINT) &&
17649 	    ill->ill_bcast_addr_length == 0)) {
17650 		/* Link not broadcast/pt-pt capable i.e. no multicast */
17651 		ip1dbg(("ip_setname: EINVAL 2\n"));
17652 		return (EINVAL);
17653 	}
17654 	if ((lifr->lifr_flags & IFF_BROADCAST) &&
17655 	    ((lifr->lifr_flags & IFF_IPV6) ||
17656 	    (!ill->ill_needs_attach && ill->ill_bcast_addr_length == 0))) {
17657 		/* Link not broadcast capable or IPv6 i.e. no broadcast */
17658 		ip1dbg(("ip_setname: EINVAL 3\n"));
17659 		return (EINVAL);
17660 	}
17661 	if (lifr->lifr_flags & IFF_UP) {
17662 		/* Can only be set with SIOCSLIFFLAGS */
17663 		ip1dbg(("ip_setname: EINVAL 4\n"));
17664 		return (EINVAL);
17665 	}
17666 	if ((lifr->lifr_flags & (IFF_IPV6|IFF_IPV4)) != IFF_IPV6 &&
17667 	    (lifr->lifr_flags & (IFF_IPV6|IFF_IPV4)) != IFF_IPV4) {
17668 		ip1dbg(("ip_setname: EINVAL 5\n"));
17669 		return (EINVAL);
17670 	}
17671 	/*
17672 	 * Only allow the IFF_XRESOLV flag to be set on IPv6 interfaces.
17673 	 */
17674 	if ((lifr->lifr_flags & IFF_XRESOLV) &&
17675 	    !(lifr->lifr_flags & IFF_IPV6) &&
17676 	    !(ipif->ipif_isv6)) {
17677 		ip1dbg(("ip_setname: EINVAL 6\n"));
17678 		return (EINVAL);
17679 	}
17680 
17681 	/*
17682 	 * The user has done SIOCGLIFFLAGS prior to this ioctl and hence
17683 	 * we have all the flags here. So, we assign rather than we OR.
17684 	 * We can't OR the flags here because we don't want to set
17685 	 * both IFF_IPV4 and IFF_IPV6. We start off as IFF_IPV4 in
17686 	 * ipif_allocate and become IFF_IPV4 or IFF_IPV6 here depending
17687 	 * on lifr_flags value here.
17688 	 */
17689 	/*
17690 	 * This ill has not been inserted into the global list.
17691 	 * So we are still single threaded and don't need any lock
17692 	 */
17693 	ipif->ipif_flags = lifr->lifr_flags & IFF_LOGINT_FLAGS & ~IFF_DUPLICATE;
17694 	ill->ill_flags = lifr->lifr_flags & IFF_PHYINTINST_FLAGS;
17695 	ill->ill_phyint->phyint_flags = lifr->lifr_flags & IFF_PHYINT_FLAGS;
17696 
17697 	/* We started off as V4. */
17698 	if (ill->ill_flags & ILLF_IPV6) {
17699 		ill->ill_phyint->phyint_illv6 = ill;
17700 		ill->ill_phyint->phyint_illv4 = NULL;
17701 	}
17702 
17703 	return (ipif_set_values(q, mp, lifr->lifr_name, &lifr->lifr_ppa));
17704 }
17705 
17706 /* ARGSUSED */
17707 int
17708 ip_sioctl_slifname_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17709     ip_ioctl_cmd_t *ipip, void *if_req)
17710 {
17711 	/*
17712 	 * ill_phyint_reinit merged the v4 and v6 into a single
17713 	 * ipsq.  We might not have been able to complete the
17714 	 * slifname in ipif_set_values, if we could not become
17715 	 * exclusive.  If so restart it here
17716 	 */
17717 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
17718 }
17719 
17720 /*
17721  * Return a pointer to the ipif which matches the index, IP version type and
17722  * zoneid.
17723  */
17724 ipif_t *
17725 ipif_lookup_on_ifindex(uint_t index, boolean_t isv6, zoneid_t zoneid,
17726     queue_t *q, mblk_t *mp, ipsq_func_t func, int *err, ip_stack_t *ipst)
17727 {
17728 	ill_t	*ill;
17729 	ipif_t	*ipif = NULL;
17730 
17731 	ASSERT((q == NULL && mp == NULL && func == NULL && err == NULL) ||
17732 	    (q != NULL && mp != NULL && func != NULL && err != NULL));
17733 
17734 	if (err != NULL)
17735 		*err = 0;
17736 
17737 	ill = ill_lookup_on_ifindex(index, isv6, q, mp, func, err, ipst);
17738 	if (ill != NULL) {
17739 		mutex_enter(&ill->ill_lock);
17740 		for (ipif = ill->ill_ipif; ipif != NULL;
17741 		    ipif = ipif->ipif_next) {
17742 			if (IPIF_CAN_LOOKUP(ipif) && (zoneid == ALL_ZONES ||
17743 			    zoneid == ipif->ipif_zoneid ||
17744 			    ipif->ipif_zoneid == ALL_ZONES)) {
17745 				ipif_refhold_locked(ipif);
17746 				break;
17747 			}
17748 		}
17749 		mutex_exit(&ill->ill_lock);
17750 		ill_refrele(ill);
17751 		if (ipif == NULL && err != NULL)
17752 			*err = ENXIO;
17753 	}
17754 	return (ipif);
17755 }
17756 
17757 /*
17758  * Change an existing physical interface's index. If the new index
17759  * is acceptable we update the index and the phyint_list_avl_by_index tree.
17760  * Finally, we update other systems which may have a dependence on the
17761  * index value.
17762  */
17763 /* ARGSUSED */
17764 int
17765 ip_sioctl_slifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17766     ip_ioctl_cmd_t *ipip, void *ifreq)
17767 {
17768 	ill_t		*ill;
17769 	phyint_t	*phyi;
17770 	struct ifreq	*ifr = (struct ifreq *)ifreq;
17771 	struct lifreq	*lifr = (struct lifreq *)ifreq;
17772 	uint_t	old_index, index;
17773 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
17774 	avl_index_t	where;
17775 
17776 	if (ipip->ipi_cmd_type == IF_CMD)
17777 		index = ifr->ifr_index;
17778 	else
17779 		index = lifr->lifr_index;
17780 
17781 	/*
17782 	 * Only allow on physical interface. Also, index zero is illegal.
17783 	 */
17784 	ill = ipif->ipif_ill;
17785 	phyi = ill->ill_phyint;
17786 	if (ipif->ipif_id != 0 || index == 0) {
17787 		return (EINVAL);
17788 	}
17789 
17790 	/* If the index is not changing, no work to do */
17791 	if (phyi->phyint_ifindex == index)
17792 		return (0);
17793 
17794 	/*
17795 	 * Use phyint_exists() to determine if the new interface index
17796 	 * is already in use. If the index is unused then we need to
17797 	 * change the phyint's position in the phyint_list_avl_by_index
17798 	 * tree. If we do not do this, subsequent lookups (using the new
17799 	 * index value) will not find the phyint.
17800 	 */
17801 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
17802 	if (phyint_exists(index, ipst)) {
17803 		rw_exit(&ipst->ips_ill_g_lock);
17804 		return (EEXIST);
17805 	}
17806 
17807 	/* The new index is unused. Set it in the phyint. */
17808 	old_index = phyi->phyint_ifindex;
17809 	phyi->phyint_ifindex = index;
17810 
17811 	avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_index, phyi);
17812 	(void) avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
17813 	    &index, &where);
17814 	avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
17815 	    phyi, where);
17816 	rw_exit(&ipst->ips_ill_g_lock);
17817 
17818 	/* Update SCTP's ILL list */
17819 	sctp_ill_reindex(ill, old_index);
17820 
17821 	/* Send the routing sockets message */
17822 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
17823 	if (ILL_OTHER(ill))
17824 		ip_rts_ifmsg(ILL_OTHER(ill)->ill_ipif, RTSQ_DEFAULT);
17825 
17826 	return (0);
17827 }
17828 
17829 /* ARGSUSED */
17830 int
17831 ip_sioctl_get_lifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17832     ip_ioctl_cmd_t *ipip, void *ifreq)
17833 {
17834 	struct ifreq	*ifr = (struct ifreq *)ifreq;
17835 	struct lifreq	*lifr = (struct lifreq *)ifreq;
17836 
17837 	ip1dbg(("ip_sioctl_get_lifindex(%s:%u %p)\n",
17838 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
17839 	/* Get the interface index */
17840 	if (ipip->ipi_cmd_type == IF_CMD) {
17841 		ifr->ifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
17842 	} else {
17843 		lifr->lifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
17844 	}
17845 	return (0);
17846 }
17847 
17848 /* ARGSUSED */
17849 int
17850 ip_sioctl_get_lifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17851     ip_ioctl_cmd_t *ipip, void *ifreq)
17852 {
17853 	struct lifreq	*lifr = (struct lifreq *)ifreq;
17854 
17855 	ip1dbg(("ip_sioctl_get_lifzone(%s:%u %p)\n",
17856 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
17857 	/* Get the interface zone */
17858 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
17859 	lifr->lifr_zoneid = ipif->ipif_zoneid;
17860 	return (0);
17861 }
17862 
17863 /*
17864  * Set the zoneid of an interface.
17865  */
17866 /* ARGSUSED */
17867 int
17868 ip_sioctl_slifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17869     ip_ioctl_cmd_t *ipip, void *ifreq)
17870 {
17871 	struct lifreq	*lifr = (struct lifreq *)ifreq;
17872 	int err = 0;
17873 	boolean_t need_up = B_FALSE;
17874 	zone_t *zptr;
17875 	zone_status_t status;
17876 	zoneid_t zoneid;
17877 
17878 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
17879 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES) {
17880 		if (!is_system_labeled())
17881 			return (ENOTSUP);
17882 		zoneid = GLOBAL_ZONEID;
17883 	}
17884 
17885 	/* cannot assign instance zero to a non-global zone */
17886 	if (ipif->ipif_id == 0 && zoneid != GLOBAL_ZONEID)
17887 		return (ENOTSUP);
17888 
17889 	/*
17890 	 * Cannot assign to a zone that doesn't exist or is shutting down.  In
17891 	 * the event of a race with the zone shutdown processing, since IP
17892 	 * serializes this ioctl and SIOCGLIFCONF/SIOCLIFREMOVEIF, we know the
17893 	 * interface will be cleaned up even if the zone is shut down
17894 	 * immediately after the status check. If the interface can't be brought
17895 	 * down right away, and the zone is shut down before the restart
17896 	 * function is called, we resolve the possible races by rechecking the
17897 	 * zone status in the restart function.
17898 	 */
17899 	if ((zptr = zone_find_by_id(zoneid)) == NULL)
17900 		return (EINVAL);
17901 	status = zone_status_get(zptr);
17902 	zone_rele(zptr);
17903 
17904 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING)
17905 		return (EINVAL);
17906 
17907 	if (ipif->ipif_flags & IPIF_UP) {
17908 		/*
17909 		 * If the interface is already marked up,
17910 		 * we call ipif_down which will take care
17911 		 * of ditching any IREs that have been set
17912 		 * up based on the old interface address.
17913 		 */
17914 		err = ipif_logical_down(ipif, q, mp);
17915 		if (err == EINPROGRESS)
17916 			return (err);
17917 		ipif_down_tail(ipif);
17918 		need_up = B_TRUE;
17919 	}
17920 
17921 	err = ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp, need_up);
17922 	return (err);
17923 }
17924 
17925 static int
17926 ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
17927     queue_t *q, mblk_t *mp, boolean_t need_up)
17928 {
17929 	int	err = 0;
17930 	ip_stack_t	*ipst;
17931 
17932 	ip1dbg(("ip_sioctl_zoneid_tail(%s:%u %p)\n",
17933 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
17934 
17935 	if (CONN_Q(q))
17936 		ipst = CONNQ_TO_IPST(q);
17937 	else
17938 		ipst = ILLQ_TO_IPST(q);
17939 
17940 	/*
17941 	 * For exclusive stacks we don't allow a different zoneid than
17942 	 * global.
17943 	 */
17944 	if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID &&
17945 	    zoneid != GLOBAL_ZONEID)
17946 		return (EINVAL);
17947 
17948 	/* Set the new zone id. */
17949 	ipif->ipif_zoneid = zoneid;
17950 
17951 	/* Update sctp list */
17952 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
17953 
17954 	if (need_up) {
17955 		/*
17956 		 * Now bring the interface back up.  If this
17957 		 * is the only IPIF for the ILL, ipif_up
17958 		 * will have to re-bind to the device, so
17959 		 * we may get back EINPROGRESS, in which
17960 		 * case, this IOCTL will get completed in
17961 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
17962 		 */
17963 		err = ipif_up(ipif, q, mp);
17964 	}
17965 	return (err);
17966 }
17967 
17968 /* ARGSUSED */
17969 int
17970 ip_sioctl_slifzone_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17971     ip_ioctl_cmd_t *ipip, void *if_req)
17972 {
17973 	struct lifreq *lifr = (struct lifreq *)if_req;
17974 	zoneid_t zoneid;
17975 	zone_t *zptr;
17976 	zone_status_t status;
17977 
17978 	ASSERT(ipif->ipif_id != 0);
17979 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
17980 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES)
17981 		zoneid = GLOBAL_ZONEID;
17982 
17983 	ip1dbg(("ip_sioctl_slifzone_restart(%s:%u %p)\n",
17984 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
17985 
17986 	/*
17987 	 * We recheck the zone status to resolve the following race condition:
17988 	 * 1) process sends SIOCSLIFZONE to put hme0:1 in zone "myzone";
17989 	 * 2) hme0:1 is up and can't be brought down right away;
17990 	 * ip_sioctl_slifzone() returns EINPROGRESS and the request is queued;
17991 	 * 3) zone "myzone" is halted; the zone status switches to
17992 	 * 'shutting_down' and the zones framework sends SIOCGLIFCONF to list
17993 	 * the interfaces to remove - hme0:1 is not returned because it's not
17994 	 * yet in "myzone", so it won't be removed;
17995 	 * 4) the restart function for SIOCSLIFZONE is called; without the
17996 	 * status check here, we would have hme0:1 in "myzone" after it's been
17997 	 * destroyed.
17998 	 * Note that if the status check fails, we need to bring the interface
17999 	 * back to its state prior to ip_sioctl_slifzone(), hence the call to
18000 	 * ipif_up_done[_v6]().
18001 	 */
18002 	status = ZONE_IS_UNINITIALIZED;
18003 	if ((zptr = zone_find_by_id(zoneid)) != NULL) {
18004 		status = zone_status_get(zptr);
18005 		zone_rele(zptr);
18006 	}
18007 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING) {
18008 		if (ipif->ipif_isv6) {
18009 			(void) ipif_up_done_v6(ipif);
18010 		} else {
18011 			(void) ipif_up_done(ipif);
18012 		}
18013 		return (EINVAL);
18014 	}
18015 
18016 	ipif_down_tail(ipif);
18017 
18018 	return (ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp,
18019 	    B_TRUE));
18020 }
18021 
18022 /*
18023  * Return the number of addresses on `ill' with one or more of the values
18024  * in `set' set and all of the values in `clear' clear.
18025  */
18026 static uint_t
18027 ill_flagaddr_cnt(const ill_t *ill, uint64_t set, uint64_t clear)
18028 {
18029 	ipif_t	*ipif;
18030 	uint_t	cnt = 0;
18031 
18032 	ASSERT(IAM_WRITER_ILL(ill));
18033 
18034 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
18035 		if ((ipif->ipif_flags & set) && !(ipif->ipif_flags & clear))
18036 			cnt++;
18037 
18038 	return (cnt);
18039 }
18040 
18041 /*
18042  * Return the number of migratable addresses on `ill' that are under
18043  * application control.
18044  */
18045 uint_t
18046 ill_appaddr_cnt(const ill_t *ill)
18047 {
18048 	return (ill_flagaddr_cnt(ill, IPIF_DHCPRUNNING | IPIF_ADDRCONF,
18049 	    IPIF_NOFAILOVER));
18050 }
18051 
18052 /*
18053  * Return the number of point-to-point addresses on `ill'.
18054  */
18055 uint_t
18056 ill_ptpaddr_cnt(const ill_t *ill)
18057 {
18058 	return (ill_flagaddr_cnt(ill, IPIF_POINTOPOINT, 0));
18059 }
18060 
18061 /* ARGSUSED */
18062 int
18063 ip_sioctl_get_lifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
18064 	ip_ioctl_cmd_t *ipip, void *ifreq)
18065 {
18066 	struct lifreq	*lifr = ifreq;
18067 
18068 	ASSERT(q->q_next == NULL);
18069 	ASSERT(CONN_Q(q));
18070 
18071 	ip1dbg(("ip_sioctl_get_lifusesrc(%s:%u %p)\n",
18072 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
18073 	lifr->lifr_index = ipif->ipif_ill->ill_usesrc_ifindex;
18074 	ip1dbg(("ip_sioctl_get_lifusesrc:lifr_index = %d\n", lifr->lifr_index));
18075 
18076 	return (0);
18077 }
18078 
18079 /* Find the previous ILL in this usesrc group */
18080 static ill_t *
18081 ill_prev_usesrc(ill_t *uill)
18082 {
18083 	ill_t *ill;
18084 
18085 	for (ill = uill->ill_usesrc_grp_next;
18086 	    ASSERT(ill), ill->ill_usesrc_grp_next != uill;
18087 	    ill = ill->ill_usesrc_grp_next)
18088 		/* do nothing */;
18089 	return (ill);
18090 }
18091 
18092 /*
18093  * Release all members of the usesrc group. This routine is called
18094  * from ill_delete when the interface being unplumbed is the
18095  * group head.
18096  */
18097 static void
18098 ill_disband_usesrc_group(ill_t *uill)
18099 {
18100 	ill_t *next_ill, *tmp_ill;
18101 	ip_stack_t	*ipst = uill->ill_ipst;
18102 
18103 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_usesrc_lock));
18104 	next_ill = uill->ill_usesrc_grp_next;
18105 
18106 	do {
18107 		ASSERT(next_ill != NULL);
18108 		tmp_ill = next_ill->ill_usesrc_grp_next;
18109 		ASSERT(tmp_ill != NULL);
18110 		next_ill->ill_usesrc_grp_next = NULL;
18111 		next_ill->ill_usesrc_ifindex = 0;
18112 		next_ill = tmp_ill;
18113 	} while (next_ill->ill_usesrc_ifindex != 0);
18114 	uill->ill_usesrc_grp_next = NULL;
18115 }
18116 
18117 /*
18118  * Remove the client usesrc ILL from the list and relink to a new list
18119  */
18120 int
18121 ill_relink_usesrc_ills(ill_t *ucill, ill_t *uill, uint_t ifindex)
18122 {
18123 	ill_t *ill, *tmp_ill;
18124 	ip_stack_t	*ipst = ucill->ill_ipst;
18125 
18126 	ASSERT((ucill != NULL) && (ucill->ill_usesrc_grp_next != NULL) &&
18127 	    (uill != NULL) && RW_WRITE_HELD(&ipst->ips_ill_g_usesrc_lock));
18128 
18129 	/*
18130 	 * Check if the usesrc client ILL passed in is not already
18131 	 * in use as a usesrc ILL i.e one whose source address is
18132 	 * in use OR a usesrc ILL is not already in use as a usesrc
18133 	 * client ILL
18134 	 */
18135 	if ((ucill->ill_usesrc_ifindex == 0) ||
18136 	    (uill->ill_usesrc_ifindex != 0)) {
18137 		return (-1);
18138 	}
18139 
18140 	ill = ill_prev_usesrc(ucill);
18141 	ASSERT(ill->ill_usesrc_grp_next != NULL);
18142 
18143 	/* Remove from the current list */
18144 	if (ill->ill_usesrc_grp_next->ill_usesrc_grp_next == ill) {
18145 		/* Only two elements in the list */
18146 		ASSERT(ill->ill_usesrc_ifindex == 0);
18147 		ill->ill_usesrc_grp_next = NULL;
18148 	} else {
18149 		ill->ill_usesrc_grp_next = ucill->ill_usesrc_grp_next;
18150 	}
18151 
18152 	if (ifindex == 0) {
18153 		ucill->ill_usesrc_ifindex = 0;
18154 		ucill->ill_usesrc_grp_next = NULL;
18155 		return (0);
18156 	}
18157 
18158 	ucill->ill_usesrc_ifindex = ifindex;
18159 	tmp_ill = uill->ill_usesrc_grp_next;
18160 	uill->ill_usesrc_grp_next = ucill;
18161 	ucill->ill_usesrc_grp_next =
18162 	    (tmp_ill != NULL) ? tmp_ill : uill;
18163 	return (0);
18164 }
18165 
18166 /*
18167  * Set the ill_usesrc and ill_usesrc_head fields. See synchronization notes in
18168  * ip.c for locking details.
18169  */
18170 /* ARGSUSED */
18171 int
18172 ip_sioctl_slifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
18173     ip_ioctl_cmd_t *ipip, void *ifreq)
18174 {
18175 	struct lifreq *lifr = (struct lifreq *)ifreq;
18176 	boolean_t isv6 = B_FALSE, reset_flg = B_FALSE,
18177 	    ill_flag_changed = B_FALSE;
18178 	ill_t *usesrc_ill, *usesrc_cli_ill = ipif->ipif_ill;
18179 	int err = 0, ret;
18180 	uint_t ifindex;
18181 	ipsq_t *ipsq = NULL;
18182 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
18183 
18184 	ASSERT(IAM_WRITER_IPIF(ipif));
18185 	ASSERT(q->q_next == NULL);
18186 	ASSERT(CONN_Q(q));
18187 
18188 	isv6 = (Q_TO_CONN(q))->conn_af_isv6;
18189 
18190 	ifindex = lifr->lifr_index;
18191 	if (ifindex == 0) {
18192 		if (usesrc_cli_ill->ill_usesrc_grp_next == NULL) {
18193 			/* non usesrc group interface, nothing to reset */
18194 			return (0);
18195 		}
18196 		ifindex = usesrc_cli_ill->ill_usesrc_ifindex;
18197 		/* valid reset request */
18198 		reset_flg = B_TRUE;
18199 	}
18200 
18201 	usesrc_ill = ill_lookup_on_ifindex(ifindex, isv6, q, mp,
18202 	    ip_process_ioctl, &err, ipst);
18203 	if (usesrc_ill == NULL) {
18204 		return (err);
18205 	}
18206 
18207 	ipsq = ipsq_try_enter(NULL, usesrc_ill, q, mp, ip_process_ioctl,
18208 	    NEW_OP, B_TRUE);
18209 	if (ipsq == NULL) {
18210 		err = EINPROGRESS;
18211 		/* Operation enqueued on the ipsq of the usesrc ILL */
18212 		goto done;
18213 	}
18214 
18215 	/* USESRC isn't currently supported with IPMP */
18216 	if (IS_IPMP(usesrc_ill) || IS_UNDER_IPMP(usesrc_ill)) {
18217 		err = ENOTSUP;
18218 		goto done;
18219 	}
18220 
18221 	/*
18222 	 * USESRC isn't compatible with the STANDBY flag.  (STANDBY is only
18223 	 * used by IPMP underlying interfaces, but someone might think it's
18224 	 * more general and try to use it independently with VNI.)
18225 	 */
18226 	if (usesrc_ill->ill_phyint->phyint_flags & PHYI_STANDBY) {
18227 		err = ENOTSUP;
18228 		goto done;
18229 	}
18230 
18231 	/*
18232 	 * If the client is already in use as a usesrc_ill or a usesrc_ill is
18233 	 * already a client then return EINVAL
18234 	 */
18235 	if (IS_USESRC_ILL(usesrc_cli_ill) || IS_USESRC_CLI_ILL(usesrc_ill)) {
18236 		err = EINVAL;
18237 		goto done;
18238 	}
18239 
18240 	/*
18241 	 * If the ill_usesrc_ifindex field is already set to what it needs to
18242 	 * be then this is a duplicate operation.
18243 	 */
18244 	if (!reset_flg && usesrc_cli_ill->ill_usesrc_ifindex == ifindex) {
18245 		err = 0;
18246 		goto done;
18247 	}
18248 
18249 	ip1dbg(("ip_sioctl_slifusesrc: usesrc_cli_ill %s, usesrc_ill %s,"
18250 	    " v6 = %d", usesrc_cli_ill->ill_name, usesrc_ill->ill_name,
18251 	    usesrc_ill->ill_isv6));
18252 
18253 	/*
18254 	 * The next step ensures that no new ires will be created referencing
18255 	 * the client ill, until the ILL_CHANGING flag is cleared. Then
18256 	 * we go through an ire walk deleting all ire caches that reference
18257 	 * the client ill. New ires referencing the client ill that are added
18258 	 * to the ire table before the ILL_CHANGING flag is set, will be
18259 	 * cleaned up by the ire walk below. Attempt to add new ires referencing
18260 	 * the client ill while the ILL_CHANGING flag is set will be failed
18261 	 * during the ire_add in ire_atomic_start. ire_atomic_start atomically
18262 	 * checks (under the ill_g_usesrc_lock) that the ire being added
18263 	 * is not stale, i.e the ire_stq and ire_ipif are consistent and
18264 	 * belong to the same usesrc group.
18265 	 */
18266 	mutex_enter(&usesrc_cli_ill->ill_lock);
18267 	usesrc_cli_ill->ill_state_flags |= ILL_CHANGING;
18268 	mutex_exit(&usesrc_cli_ill->ill_lock);
18269 	ill_flag_changed = B_TRUE;
18270 
18271 	if (ipif->ipif_isv6)
18272 		ire_walk_v6(ipif_delete_cache_ire, (char *)usesrc_cli_ill,
18273 		    ALL_ZONES, ipst);
18274 	else
18275 		ire_walk_v4(ipif_delete_cache_ire, (char *)usesrc_cli_ill,
18276 		    ALL_ZONES, ipst);
18277 
18278 	/*
18279 	 * ill_g_usesrc_lock global lock protects the ill_usesrc_grp_next
18280 	 * and the ill_usesrc_ifindex fields
18281 	 */
18282 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
18283 
18284 	if (reset_flg) {
18285 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill, 0);
18286 		if (ret != 0) {
18287 			err = EINVAL;
18288 		}
18289 		rw_exit(&ipst->ips_ill_g_usesrc_lock);
18290 		goto done;
18291 	}
18292 
18293 	/*
18294 	 * Four possibilities to consider:
18295 	 * 1. Both usesrc_ill and usesrc_cli_ill are not part of any usesrc grp
18296 	 * 2. usesrc_ill is part of a group but usesrc_cli_ill isn't
18297 	 * 3. usesrc_cli_ill is part of a group but usesrc_ill isn't
18298 	 * 4. Both are part of their respective usesrc groups
18299 	 */
18300 	if ((usesrc_ill->ill_usesrc_grp_next == NULL) &&
18301 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
18302 		ASSERT(usesrc_ill->ill_usesrc_ifindex == 0);
18303 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
18304 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
18305 		usesrc_cli_ill->ill_usesrc_grp_next = usesrc_ill;
18306 	} else if ((usesrc_ill->ill_usesrc_grp_next != NULL) &&
18307 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
18308 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
18309 		/* Insert at head of list */
18310 		usesrc_cli_ill->ill_usesrc_grp_next =
18311 		    usesrc_ill->ill_usesrc_grp_next;
18312 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
18313 	} else {
18314 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill,
18315 		    ifindex);
18316 		if (ret != 0)
18317 			err = EINVAL;
18318 	}
18319 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
18320 
18321 done:
18322 	if (ill_flag_changed) {
18323 		mutex_enter(&usesrc_cli_ill->ill_lock);
18324 		usesrc_cli_ill->ill_state_flags &= ~ILL_CHANGING;
18325 		mutex_exit(&usesrc_cli_ill->ill_lock);
18326 	}
18327 	if (ipsq != NULL)
18328 		ipsq_exit(ipsq);
18329 	/* The refrele on the lifr_name ipif is done by ip_process_ioctl */
18330 	ill_refrele(usesrc_ill);
18331 	return (err);
18332 }
18333 
18334 /*
18335  * comparison function used by avl.
18336  */
18337 static int
18338 ill_phyint_compare_index(const void *index_ptr, const void *phyip)
18339 {
18340 
18341 	uint_t index;
18342 
18343 	ASSERT(phyip != NULL && index_ptr != NULL);
18344 
18345 	index = *((uint_t *)index_ptr);
18346 	/*
18347 	 * let the phyint with the lowest index be on top.
18348 	 */
18349 	if (((phyint_t *)phyip)->phyint_ifindex < index)
18350 		return (1);
18351 	if (((phyint_t *)phyip)->phyint_ifindex > index)
18352 		return (-1);
18353 	return (0);
18354 }
18355 
18356 /*
18357  * comparison function used by avl.
18358  */
18359 static int
18360 ill_phyint_compare_name(const void *name_ptr, const void *phyip)
18361 {
18362 	ill_t *ill;
18363 	int res = 0;
18364 
18365 	ASSERT(phyip != NULL && name_ptr != NULL);
18366 
18367 	if (((phyint_t *)phyip)->phyint_illv4)
18368 		ill = ((phyint_t *)phyip)->phyint_illv4;
18369 	else
18370 		ill = ((phyint_t *)phyip)->phyint_illv6;
18371 	ASSERT(ill != NULL);
18372 
18373 	res = strcmp(ill->ill_name, (char *)name_ptr);
18374 	if (res > 0)
18375 		return (1);
18376 	else if (res < 0)
18377 		return (-1);
18378 	return (0);
18379 }
18380 
18381 /*
18382  * This function is called on the unplumb path via ill_glist_delete() when
18383  * there are no ills left on the phyint and thus the phyint can be freed.
18384  */
18385 static void
18386 phyint_free(phyint_t *phyi)
18387 {
18388 	ip_stack_t *ipst = PHYINT_TO_IPST(phyi);
18389 
18390 	ASSERT(phyi->phyint_illv4 == NULL && phyi->phyint_illv6 == NULL);
18391 
18392 	/*
18393 	 * If this phyint was an IPMP meta-interface, blow away the group.
18394 	 * This is safe to do because all of the illgrps have already been
18395 	 * removed by I_PUNLINK, and thus SIOCSLIFGROUPNAME cannot find us.
18396 	 * If we're cleaning up as a result of failed initialization,
18397 	 * phyint_grp may be NULL.
18398 	 */
18399 	if ((phyi->phyint_flags & PHYI_IPMP) && (phyi->phyint_grp != NULL)) {
18400 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
18401 		ipmp_grp_destroy(phyi->phyint_grp);
18402 		phyi->phyint_grp = NULL;
18403 		rw_exit(&ipst->ips_ipmp_lock);
18404 	}
18405 
18406 	/*
18407 	 * If this interface was under IPMP, take it out of the group.
18408 	 */
18409 	if (phyi->phyint_grp != NULL)
18410 		ipmp_phyint_leave_grp(phyi);
18411 
18412 	/*
18413 	 * Delete the phyint and disassociate its ipsq.  The ipsq itself
18414 	 * will be freed in ipsq_exit().
18415 	 */
18416 	phyi->phyint_ipsq->ipsq_phyint = NULL;
18417 	phyi->phyint_name[0] = '\0';
18418 
18419 	mi_free(phyi);
18420 }
18421 
18422 /*
18423  * Attach the ill to the phyint structure which can be shared by both
18424  * IPv4 and IPv6 ill. ill_init allocates a phyint to just hold flags. This
18425  * function is called from ipif_set_values and ill_lookup_on_name (for
18426  * loopback) where we know the name of the ill. We lookup the ill and if
18427  * there is one present already with the name use that phyint. Otherwise
18428  * reuse the one allocated by ill_init.
18429  */
18430 static void
18431 ill_phyint_reinit(ill_t *ill)
18432 {
18433 	boolean_t isv6 = ill->ill_isv6;
18434 	phyint_t *phyi_old;
18435 	phyint_t *phyi;
18436 	avl_index_t where = 0;
18437 	ill_t	*ill_other = NULL;
18438 	ip_stack_t	*ipst = ill->ill_ipst;
18439 
18440 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
18441 
18442 	phyi_old = ill->ill_phyint;
18443 	ASSERT(isv6 || (phyi_old->phyint_illv4 == ill &&
18444 	    phyi_old->phyint_illv6 == NULL));
18445 	ASSERT(!isv6 || (phyi_old->phyint_illv6 == ill &&
18446 	    phyi_old->phyint_illv4 == NULL));
18447 	ASSERT(phyi_old->phyint_ifindex == 0);
18448 
18449 	/*
18450 	 * Now that our ill has a name, set it in the phyint.
18451 	 */
18452 	(void) strlcpy(ill->ill_phyint->phyint_name, ill->ill_name, LIFNAMSIZ);
18453 
18454 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
18455 	    ill->ill_name, &where);
18456 
18457 	/*
18458 	 * 1. We grabbed the ill_g_lock before inserting this ill into
18459 	 *    the global list of ills. So no other thread could have located
18460 	 *    this ill and hence the ipsq of this ill is guaranteed to be empty.
18461 	 * 2. Now locate the other protocol instance of this ill.
18462 	 * 3. Now grab both ill locks in the right order, and the phyint lock of
18463 	 *    the new ipsq. Holding ill locks + ill_g_lock ensures that the ipsq
18464 	 *    of neither ill can change.
18465 	 * 4. Merge the phyint and thus the ipsq as well of this ill onto the
18466 	 *    other ill.
18467 	 * 5. Release all locks.
18468 	 */
18469 
18470 	/*
18471 	 * Look for IPv4 if we are initializing IPv6 or look for IPv6 if
18472 	 * we are initializing IPv4.
18473 	 */
18474 	if (phyi != NULL) {
18475 		ill_other = (isv6) ? phyi->phyint_illv4 : phyi->phyint_illv6;
18476 		ASSERT(ill_other->ill_phyint != NULL);
18477 		ASSERT((isv6 && !ill_other->ill_isv6) ||
18478 		    (!isv6 && ill_other->ill_isv6));
18479 		GRAB_ILL_LOCKS(ill, ill_other);
18480 		/*
18481 		 * We are potentially throwing away phyint_flags which
18482 		 * could be different from the one that we obtain from
18483 		 * ill_other->ill_phyint. But it is okay as we are assuming
18484 		 * that the state maintained within IP is correct.
18485 		 */
18486 		mutex_enter(&phyi->phyint_lock);
18487 		if (isv6) {
18488 			ASSERT(phyi->phyint_illv6 == NULL);
18489 			phyi->phyint_illv6 = ill;
18490 		} else {
18491 			ASSERT(phyi->phyint_illv4 == NULL);
18492 			phyi->phyint_illv4 = ill;
18493 		}
18494 
18495 		/*
18496 		 * Delete the old phyint and make its ipsq eligible
18497 		 * to be freed in ipsq_exit().
18498 		 */
18499 		phyi_old->phyint_illv4 = NULL;
18500 		phyi_old->phyint_illv6 = NULL;
18501 		phyi_old->phyint_ipsq->ipsq_phyint = NULL;
18502 		phyi_old->phyint_name[0] = '\0';
18503 		mi_free(phyi_old);
18504 	} else {
18505 		mutex_enter(&ill->ill_lock);
18506 		/*
18507 		 * We don't need to acquire any lock, since
18508 		 * the ill is not yet visible globally  and we
18509 		 * have not yet released the ill_g_lock.
18510 		 */
18511 		phyi = phyi_old;
18512 		mutex_enter(&phyi->phyint_lock);
18513 		/* XXX We need a recovery strategy here. */
18514 		if (!phyint_assign_ifindex(phyi, ipst))
18515 			cmn_err(CE_PANIC, "phyint_assign_ifindex() failed");
18516 
18517 		avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
18518 		    (void *)phyi, where);
18519 
18520 		(void) avl_find(&ipst->ips_phyint_g_list->
18521 		    phyint_list_avl_by_index,
18522 		    &phyi->phyint_ifindex, &where);
18523 		avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
18524 		    (void *)phyi, where);
18525 	}
18526 
18527 	/*
18528 	 * Reassigning ill_phyint automatically reassigns the ipsq also.
18529 	 * pending mp is not affected because that is per ill basis.
18530 	 */
18531 	ill->ill_phyint = phyi;
18532 
18533 	/*
18534 	 * Now that the phyint's ifindex has been assigned, complete the
18535 	 * remaining
18536 	 */
18537 
18538 	ill->ill_ip_mib->ipIfStatsIfIndex = ill->ill_phyint->phyint_ifindex;
18539 	if (ill->ill_isv6) {
18540 		ill->ill_icmp6_mib->ipv6IfIcmpIfIndex =
18541 		    ill->ill_phyint->phyint_ifindex;
18542 		ill->ill_mcast_type = ipst->ips_mld_max_version;
18543 	} else {
18544 		ill->ill_mcast_type = ipst->ips_igmp_max_version;
18545 	}
18546 
18547 	/*
18548 	 * Generate an event within the hooks framework to indicate that
18549 	 * a new interface has just been added to IP.  For this event to
18550 	 * be generated, the network interface must, at least, have an
18551 	 * ifindex assigned to it.
18552 	 *
18553 	 * This needs to be run inside the ill_g_lock perimeter to ensure
18554 	 * that the ordering of delivered events to listeners matches the
18555 	 * order of them in the kernel.
18556 	 *
18557 	 * This function could be called from ill_lookup_on_name. In that case
18558 	 * the interface is loopback "lo", which will not generate a NIC event.
18559 	 */
18560 	if (ill->ill_name_length <= 2 ||
18561 	    ill->ill_name[0] != 'l' || ill->ill_name[1] != 'o') {
18562 		ill_nic_event_dispatch(ill, 0, NE_PLUMB, ill->ill_name,
18563 		    ill->ill_name_length);
18564 	}
18565 	RELEASE_ILL_LOCKS(ill, ill_other);
18566 	mutex_exit(&phyi->phyint_lock);
18567 }
18568 
18569 /*
18570  * Notify any downstream modules of the name of this interface.
18571  * An M_IOCTL is used even though we don't expect a successful reply.
18572  * Any reply message from the driver (presumably an M_IOCNAK) will
18573  * eventually get discarded somewhere upstream.  The message format is
18574  * simply an SIOCSLIFNAME ioctl just as might be sent from ifconfig
18575  * to IP.
18576  */
18577 static void
18578 ip_ifname_notify(ill_t *ill, queue_t *q)
18579 {
18580 	mblk_t *mp1, *mp2;
18581 	struct iocblk *iocp;
18582 	struct lifreq *lifr;
18583 
18584 	mp1 = mkiocb(SIOCSLIFNAME);
18585 	if (mp1 == NULL)
18586 		return;
18587 	mp2 = allocb(sizeof (struct lifreq), BPRI_HI);
18588 	if (mp2 == NULL) {
18589 		freeb(mp1);
18590 		return;
18591 	}
18592 
18593 	mp1->b_cont = mp2;
18594 	iocp = (struct iocblk *)mp1->b_rptr;
18595 	iocp->ioc_count = sizeof (struct lifreq);
18596 
18597 	lifr = (struct lifreq *)mp2->b_rptr;
18598 	mp2->b_wptr += sizeof (struct lifreq);
18599 	bzero(lifr, sizeof (struct lifreq));
18600 
18601 	(void) strncpy(lifr->lifr_name, ill->ill_name, LIFNAMSIZ);
18602 	lifr->lifr_ppa = ill->ill_ppa;
18603 	lifr->lifr_flags = (ill->ill_flags & (ILLF_IPV4|ILLF_IPV6));
18604 
18605 	putnext(q, mp1);
18606 }
18607 
18608 static int
18609 ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
18610 {
18611 	int		err;
18612 	ip_stack_t	*ipst = ill->ill_ipst;
18613 	phyint_t	*phyi = ill->ill_phyint;
18614 
18615 	/* Set the obsolete NDD per-interface forwarding name. */
18616 	err = ill_set_ndd_name(ill);
18617 	if (err != 0) {
18618 		cmn_err(CE_WARN, "ipif_set_values: ill_set_ndd_name (%d)\n",
18619 		    err);
18620 	}
18621 
18622 	/*
18623 	 * Now that ill_name is set, the configuration for the IPMP
18624 	 * meta-interface can be performed.
18625 	 */
18626 	if (IS_IPMP(ill)) {
18627 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
18628 		/*
18629 		 * If phyi->phyint_grp is NULL, then this is the first IPMP
18630 		 * meta-interface and we need to create the IPMP group.
18631 		 */
18632 		if (phyi->phyint_grp == NULL) {
18633 			/*
18634 			 * If someone has renamed another IPMP group to have
18635 			 * the same name as our interface, bail.
18636 			 */
18637 			if (ipmp_grp_lookup(ill->ill_name, ipst) != NULL) {
18638 				rw_exit(&ipst->ips_ipmp_lock);
18639 				return (EEXIST);
18640 			}
18641 			phyi->phyint_grp = ipmp_grp_create(ill->ill_name, phyi);
18642 			if (phyi->phyint_grp == NULL) {
18643 				rw_exit(&ipst->ips_ipmp_lock);
18644 				return (ENOMEM);
18645 			}
18646 		}
18647 		rw_exit(&ipst->ips_ipmp_lock);
18648 	}
18649 
18650 	/* Tell downstream modules where they are. */
18651 	ip_ifname_notify(ill, q);
18652 
18653 	/*
18654 	 * ill_dl_phys returns EINPROGRESS in the usual case.
18655 	 * Error cases are ENOMEM ...
18656 	 */
18657 	err = ill_dl_phys(ill, ipif, mp, q);
18658 
18659 	/*
18660 	 * If there is no IRE expiration timer running, get one started.
18661 	 * igmp and mld timers will be triggered by the first multicast
18662 	 */
18663 	if (ipst->ips_ip_ire_expire_id == 0) {
18664 		/*
18665 		 * acquire the lock and check again.
18666 		 */
18667 		mutex_enter(&ipst->ips_ip_trash_timer_lock);
18668 		if (ipst->ips_ip_ire_expire_id == 0) {
18669 			ipst->ips_ip_ire_expire_id = timeout(
18670 			    ip_trash_timer_expire, ipst,
18671 			    MSEC_TO_TICK(ipst->ips_ip_timer_interval));
18672 		}
18673 		mutex_exit(&ipst->ips_ip_trash_timer_lock);
18674 	}
18675 
18676 	if (ill->ill_isv6) {
18677 		mutex_enter(&ipst->ips_mld_slowtimeout_lock);
18678 		if (ipst->ips_mld_slowtimeout_id == 0) {
18679 			ipst->ips_mld_slowtimeout_id = timeout(mld_slowtimo,
18680 			    (void *)ipst,
18681 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
18682 		}
18683 		mutex_exit(&ipst->ips_mld_slowtimeout_lock);
18684 	} else {
18685 		mutex_enter(&ipst->ips_igmp_slowtimeout_lock);
18686 		if (ipst->ips_igmp_slowtimeout_id == 0) {
18687 			ipst->ips_igmp_slowtimeout_id = timeout(igmp_slowtimo,
18688 			    (void *)ipst,
18689 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
18690 		}
18691 		mutex_exit(&ipst->ips_igmp_slowtimeout_lock);
18692 	}
18693 
18694 	return (err);
18695 }
18696 
18697 /*
18698  * Common routine for ppa and ifname setting. Should be called exclusive.
18699  *
18700  * Returns EINPROGRESS when mp has been consumed by queueing it on
18701  * ill_pending_mp and the ioctl will complete in ip_rput.
18702  *
18703  * NOTE : If ppa is UNIT_MAX, we assign the next valid ppa and return
18704  * the new name and new ppa in lifr_name and lifr_ppa respectively.
18705  * For SLIFNAME, we pass these values back to the userland.
18706  */
18707 static int
18708 ipif_set_values(queue_t *q, mblk_t *mp, char *interf_name, uint_t *new_ppa_ptr)
18709 {
18710 	ill_t	*ill;
18711 	ipif_t	*ipif;
18712 	ipsq_t	*ipsq;
18713 	char	*ppa_ptr;
18714 	char	*old_ptr;
18715 	char	old_char;
18716 	int	error;
18717 	ip_stack_t	*ipst;
18718 
18719 	ip1dbg(("ipif_set_values: interface %s\n", interf_name));
18720 	ASSERT(q->q_next != NULL);
18721 	ASSERT(interf_name != NULL);
18722 
18723 	ill = (ill_t *)q->q_ptr;
18724 	ipst = ill->ill_ipst;
18725 
18726 	ASSERT(ill->ill_ipst != NULL);
18727 	ASSERT(ill->ill_name[0] == '\0');
18728 	ASSERT(IAM_WRITER_ILL(ill));
18729 	ASSERT((mi_strlen(interf_name) + 1) <= LIFNAMSIZ);
18730 	ASSERT(ill->ill_ppa == UINT_MAX);
18731 
18732 	/* The ppa is sent down by ifconfig or is chosen */
18733 	if ((ppa_ptr = ill_get_ppa_ptr(interf_name)) == NULL) {
18734 		return (EINVAL);
18735 	}
18736 
18737 	/*
18738 	 * make sure ppa passed in is same as ppa in the name.
18739 	 * This check is not made when ppa == UINT_MAX in that case ppa
18740 	 * in the name could be anything. System will choose a ppa and
18741 	 * update new_ppa_ptr and inter_name to contain the choosen ppa.
18742 	 */
18743 	if (*new_ppa_ptr != UINT_MAX) {
18744 		/* stoi changes the pointer */
18745 		old_ptr = ppa_ptr;
18746 		/*
18747 		 * ifconfig passed in 0 for the ppa for DLPI 1 style devices
18748 		 * (they don't have an externally visible ppa).  We assign one
18749 		 * here so that we can manage the interface.  Note that in
18750 		 * the past this value was always 0 for DLPI 1 drivers.
18751 		 */
18752 		if (*new_ppa_ptr == 0)
18753 			*new_ppa_ptr = stoi(&old_ptr);
18754 		else if (*new_ppa_ptr != (uint_t)stoi(&old_ptr))
18755 			return (EINVAL);
18756 	}
18757 	/*
18758 	 * terminate string before ppa
18759 	 * save char at that location.
18760 	 */
18761 	old_char = ppa_ptr[0];
18762 	ppa_ptr[0] = '\0';
18763 
18764 	ill->ill_ppa = *new_ppa_ptr;
18765 	/*
18766 	 * Finish as much work now as possible before calling ill_glist_insert
18767 	 * which makes the ill globally visible and also merges it with the
18768 	 * other protocol instance of this phyint. The remaining work is
18769 	 * done after entering the ipsq which may happen sometime later.
18770 	 * ill_set_ndd_name occurs after the ill has been made globally visible.
18771 	 */
18772 	ipif = ill->ill_ipif;
18773 
18774 	/* We didn't do this when we allocated ipif in ip_ll_subnet_defaults */
18775 	ipif_assign_seqid(ipif);
18776 
18777 	if (!(ill->ill_flags & (ILLF_IPV4|ILLF_IPV6)))
18778 		ill->ill_flags |= ILLF_IPV4;
18779 
18780 	ASSERT(ipif->ipif_next == NULL);	/* Only one ipif on ill */
18781 	ASSERT((ipif->ipif_flags & IPIF_UP) == 0);
18782 
18783 	if (ill->ill_flags & ILLF_IPV6) {
18784 
18785 		ill->ill_isv6 = B_TRUE;
18786 		if (ill->ill_rq != NULL) {
18787 			ill->ill_rq->q_qinfo = &iprinitv6;
18788 			ill->ill_wq->q_qinfo = &ipwinitv6;
18789 		}
18790 
18791 		/* Keep the !IN6_IS_ADDR_V4MAPPED assertions happy */
18792 		ipif->ipif_v6lcl_addr = ipv6_all_zeros;
18793 		ipif->ipif_v6src_addr = ipv6_all_zeros;
18794 		ipif->ipif_v6subnet = ipv6_all_zeros;
18795 		ipif->ipif_v6net_mask = ipv6_all_zeros;
18796 		ipif->ipif_v6brd_addr = ipv6_all_zeros;
18797 		ipif->ipif_v6pp_dst_addr = ipv6_all_zeros;
18798 		/*
18799 		 * point-to-point or Non-mulicast capable
18800 		 * interfaces won't do NUD unless explicitly
18801 		 * configured to do so.
18802 		 */
18803 		if (ipif->ipif_flags & IPIF_POINTOPOINT ||
18804 		    !(ill->ill_flags & ILLF_MULTICAST)) {
18805 			ill->ill_flags |= ILLF_NONUD;
18806 		}
18807 		/* Make sure IPv4 specific flag is not set on IPv6 if */
18808 		if (ill->ill_flags & ILLF_NOARP) {
18809 			/*
18810 			 * Note: xresolv interfaces will eventually need
18811 			 * NOARP set here as well, but that will require
18812 			 * those external resolvers to have some
18813 			 * knowledge of that flag and act appropriately.
18814 			 * Not to be changed at present.
18815 			 */
18816 			ill->ill_flags &= ~ILLF_NOARP;
18817 		}
18818 		/*
18819 		 * Set the ILLF_ROUTER flag according to the global
18820 		 * IPv6 forwarding policy.
18821 		 */
18822 		if (ipst->ips_ipv6_forward != 0)
18823 			ill->ill_flags |= ILLF_ROUTER;
18824 	} else if (ill->ill_flags & ILLF_IPV4) {
18825 		ill->ill_isv6 = B_FALSE;
18826 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6lcl_addr);
18827 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6src_addr);
18828 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6subnet);
18829 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6net_mask);
18830 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6brd_addr);
18831 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6pp_dst_addr);
18832 		/*
18833 		 * Set the ILLF_ROUTER flag according to the global
18834 		 * IPv4 forwarding policy.
18835 		 */
18836 		if (ipst->ips_ip_g_forward != 0)
18837 			ill->ill_flags |= ILLF_ROUTER;
18838 	}
18839 
18840 	ASSERT(ill->ill_phyint != NULL);
18841 
18842 	/*
18843 	 * The ipIfStatsIfindex and ipv6IfIcmpIfIndex assignments will
18844 	 * be completed in ill_glist_insert -> ill_phyint_reinit
18845 	 */
18846 	if (!ill_allocate_mibs(ill))
18847 		return (ENOMEM);
18848 
18849 	/*
18850 	 * Pick a default sap until we get the DL_INFO_ACK back from
18851 	 * the driver.
18852 	 */
18853 	if (ill->ill_sap == 0) {
18854 		if (ill->ill_isv6)
18855 			ill->ill_sap = IP6_DL_SAP;
18856 		else
18857 			ill->ill_sap = IP_DL_SAP;
18858 	}
18859 
18860 	ill->ill_ifname_pending = 1;
18861 	ill->ill_ifname_pending_err = 0;
18862 
18863 	/*
18864 	 * When the first ipif comes up in ipif_up_done(), multicast groups
18865 	 * that were joined while this ill was not bound to the DLPI link need
18866 	 * to be recovered by ill_recover_multicast().
18867 	 */
18868 	ill->ill_need_recover_multicast = 1;
18869 
18870 	ill_refhold(ill);
18871 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
18872 	if ((error = ill_glist_insert(ill, interf_name,
18873 	    (ill->ill_flags & ILLF_IPV6) == ILLF_IPV6)) > 0) {
18874 		ill->ill_ppa = UINT_MAX;
18875 		ill->ill_name[0] = '\0';
18876 		/*
18877 		 * undo null termination done above.
18878 		 */
18879 		ppa_ptr[0] = old_char;
18880 		rw_exit(&ipst->ips_ill_g_lock);
18881 		ill_refrele(ill);
18882 		return (error);
18883 	}
18884 
18885 	ASSERT(ill->ill_name_length <= LIFNAMSIZ);
18886 
18887 	/*
18888 	 * When we return the buffer pointed to by interf_name should contain
18889 	 * the same name as in ill_name.
18890 	 * If a ppa was choosen by the system (ppa passed in was UINT_MAX)
18891 	 * the buffer pointed to by new_ppa_ptr would not contain the right ppa
18892 	 * so copy full name and update the ppa ptr.
18893 	 * When ppa passed in != UINT_MAX all values are correct just undo
18894 	 * null termination, this saves a bcopy.
18895 	 */
18896 	if (*new_ppa_ptr == UINT_MAX) {
18897 		bcopy(ill->ill_name, interf_name, ill->ill_name_length);
18898 		*new_ppa_ptr = ill->ill_ppa;
18899 	} else {
18900 		/*
18901 		 * undo null termination done above.
18902 		 */
18903 		ppa_ptr[0] = old_char;
18904 	}
18905 
18906 	/* Let SCTP know about this ILL */
18907 	sctp_update_ill(ill, SCTP_ILL_INSERT);
18908 
18909 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_reprocess_ioctl, NEW_OP,
18910 	    B_TRUE);
18911 
18912 	rw_exit(&ipst->ips_ill_g_lock);
18913 	ill_refrele(ill);
18914 	if (ipsq == NULL)
18915 		return (EINPROGRESS);
18916 
18917 	/*
18918 	 * If ill_phyint_reinit() changed our ipsq, then start on the new ipsq.
18919 	 */
18920 	if (ipsq->ipsq_xop->ipx_current_ipif == NULL)
18921 		ipsq_current_start(ipsq, ipif, SIOCSLIFNAME);
18922 	else
18923 		ASSERT(ipsq->ipsq_xop->ipx_current_ipif == ipif);
18924 
18925 	error = ipif_set_values_tail(ill, ipif, mp, q);
18926 	ipsq_exit(ipsq);
18927 	if (error != 0 && error != EINPROGRESS) {
18928 		/*
18929 		 * restore previous values
18930 		 */
18931 		ill->ill_isv6 = B_FALSE;
18932 	}
18933 	return (error);
18934 }
18935 
18936 void
18937 ipif_init(ip_stack_t *ipst)
18938 {
18939 	int i;
18940 
18941 	for (i = 0; i < MAX_G_HEADS; i++) {
18942 		ipst->ips_ill_g_heads[i].ill_g_list_head =
18943 		    (ill_if_t *)&ipst->ips_ill_g_heads[i];
18944 		ipst->ips_ill_g_heads[i].ill_g_list_tail =
18945 		    (ill_if_t *)&ipst->ips_ill_g_heads[i];
18946 	}
18947 
18948 	avl_create(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
18949 	    ill_phyint_compare_index,
18950 	    sizeof (phyint_t),
18951 	    offsetof(struct phyint, phyint_avl_by_index));
18952 	avl_create(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
18953 	    ill_phyint_compare_name,
18954 	    sizeof (phyint_t),
18955 	    offsetof(struct phyint, phyint_avl_by_name));
18956 }
18957 
18958 /*
18959  * Lookup the ipif corresponding to the onlink destination address. For
18960  * point-to-point interfaces, it matches with remote endpoint destination
18961  * address. For point-to-multipoint interfaces it only tries to match the
18962  * destination with the interface's subnet address. The longest, most specific
18963  * match is found to take care of such rare network configurations like -
18964  * le0: 129.146.1.1/16
18965  * le1: 129.146.2.2/24
18966  *
18967  * This is used by SO_DONTROUTE and IP_NEXTHOP.  Since neither of those are
18968  * supported on underlying interfaces in an IPMP group, underlying interfaces
18969  * are ignored when looking up a match.  (If we didn't ignore them, we'd
18970  * risk using a test address as a source for outgoing traffic.)
18971  */
18972 ipif_t *
18973 ipif_lookup_onlink_addr(ipaddr_t addr, zoneid_t zoneid, ip_stack_t *ipst)
18974 {
18975 	ipif_t	*ipif, *best_ipif;
18976 	ill_t	*ill;
18977 	ill_walk_context_t ctx;
18978 
18979 	ASSERT(zoneid != ALL_ZONES);
18980 	best_ipif = NULL;
18981 
18982 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
18983 	ill = ILL_START_WALK_V4(&ctx, ipst);
18984 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
18985 		if (IS_UNDER_IPMP(ill))
18986 			continue;
18987 		mutex_enter(&ill->ill_lock);
18988 		for (ipif = ill->ill_ipif; ipif != NULL;
18989 		    ipif = ipif->ipif_next) {
18990 			if (!IPIF_CAN_LOOKUP(ipif))
18991 				continue;
18992 			if (ipif->ipif_zoneid != zoneid &&
18993 			    ipif->ipif_zoneid != ALL_ZONES)
18994 				continue;
18995 			/*
18996 			 * Point-to-point case. Look for exact match with
18997 			 * destination address.
18998 			 */
18999 			if (ipif->ipif_flags & IPIF_POINTOPOINT) {
19000 				if (ipif->ipif_pp_dst_addr == addr) {
19001 					ipif_refhold_locked(ipif);
19002 					mutex_exit(&ill->ill_lock);
19003 					rw_exit(&ipst->ips_ill_g_lock);
19004 					if (best_ipif != NULL)
19005 						ipif_refrele(best_ipif);
19006 					return (ipif);
19007 				}
19008 			} else if (ipif->ipif_subnet == (addr &
19009 			    ipif->ipif_net_mask)) {
19010 				/*
19011 				 * Point-to-multipoint case. Looping through to
19012 				 * find the most specific match. If there are
19013 				 * multiple best match ipif's then prefer ipif's
19014 				 * that are UP. If there is only one best match
19015 				 * ipif and it is DOWN we must still return it.
19016 				 */
19017 				if ((best_ipif == NULL) ||
19018 				    (ipif->ipif_net_mask >
19019 				    best_ipif->ipif_net_mask) ||
19020 				    ((ipif->ipif_net_mask ==
19021 				    best_ipif->ipif_net_mask) &&
19022 				    ((ipif->ipif_flags & IPIF_UP) &&
19023 				    (!(best_ipif->ipif_flags & IPIF_UP))))) {
19024 					ipif_refhold_locked(ipif);
19025 					mutex_exit(&ill->ill_lock);
19026 					rw_exit(&ipst->ips_ill_g_lock);
19027 					if (best_ipif != NULL)
19028 						ipif_refrele(best_ipif);
19029 					best_ipif = ipif;
19030 					rw_enter(&ipst->ips_ill_g_lock,
19031 					    RW_READER);
19032 					mutex_enter(&ill->ill_lock);
19033 				}
19034 			}
19035 		}
19036 		mutex_exit(&ill->ill_lock);
19037 	}
19038 	rw_exit(&ipst->ips_ill_g_lock);
19039 	return (best_ipif);
19040 }
19041 
19042 /*
19043  * Save enough information so that we can recreate the IRE if
19044  * the interface goes down and then up.
19045  */
19046 static void
19047 ipif_save_ire(ipif_t *ipif, ire_t *ire)
19048 {
19049 	mblk_t	*save_mp;
19050 
19051 	save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
19052 	if (save_mp != NULL) {
19053 		ifrt_t	*ifrt;
19054 
19055 		save_mp->b_wptr += sizeof (ifrt_t);
19056 		ifrt = (ifrt_t *)save_mp->b_rptr;
19057 		bzero(ifrt, sizeof (ifrt_t));
19058 		ifrt->ifrt_type = ire->ire_type;
19059 		ifrt->ifrt_addr = ire->ire_addr;
19060 		ifrt->ifrt_gateway_addr = ire->ire_gateway_addr;
19061 		ifrt->ifrt_src_addr = ire->ire_src_addr;
19062 		ifrt->ifrt_mask = ire->ire_mask;
19063 		ifrt->ifrt_flags = ire->ire_flags;
19064 		ifrt->ifrt_max_frag = ire->ire_max_frag;
19065 		mutex_enter(&ipif->ipif_saved_ire_lock);
19066 		save_mp->b_cont = ipif->ipif_saved_ire_mp;
19067 		ipif->ipif_saved_ire_mp = save_mp;
19068 		ipif->ipif_saved_ire_cnt++;
19069 		mutex_exit(&ipif->ipif_saved_ire_lock);
19070 	}
19071 }
19072 
19073 static void
19074 ipif_remove_ire(ipif_t *ipif, ire_t *ire)
19075 {
19076 	mblk_t	**mpp;
19077 	mblk_t	*mp;
19078 	ifrt_t	*ifrt;
19079 
19080 	/* Remove from ipif_saved_ire_mp list if it is there */
19081 	mutex_enter(&ipif->ipif_saved_ire_lock);
19082 	for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL;
19083 	    mpp = &(*mpp)->b_cont) {
19084 		/*
19085 		 * On a given ipif, the triple of address, gateway and
19086 		 * mask is unique for each saved IRE (in the case of
19087 		 * ordinary interface routes, the gateway address is
19088 		 * all-zeroes).
19089 		 */
19090 		mp = *mpp;
19091 		ifrt = (ifrt_t *)mp->b_rptr;
19092 		if (ifrt->ifrt_addr == ire->ire_addr &&
19093 		    ifrt->ifrt_gateway_addr == ire->ire_gateway_addr &&
19094 		    ifrt->ifrt_mask == ire->ire_mask) {
19095 			*mpp = mp->b_cont;
19096 			ipif->ipif_saved_ire_cnt--;
19097 			freeb(mp);
19098 			break;
19099 		}
19100 	}
19101 	mutex_exit(&ipif->ipif_saved_ire_lock);
19102 }
19103 
19104 /*
19105  * IP multirouting broadcast routes handling
19106  * Append CGTP broadcast IREs to regular ones created
19107  * at ifconfig time.
19108  */
19109 static void
19110 ip_cgtp_bcast_add(ire_t *ire, ire_t *ire_dst, ip_stack_t *ipst)
19111 {
19112 	ire_t *ire_prim;
19113 
19114 	ASSERT(ire != NULL);
19115 	ASSERT(ire_dst != NULL);
19116 
19117 	ire_prim = ire_ctable_lookup(ire->ire_gateway_addr, 0,
19118 	    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
19119 	if (ire_prim != NULL) {
19120 		/*
19121 		 * We are in the special case of broadcasts for
19122 		 * CGTP. We add an IRE_BROADCAST that holds
19123 		 * the RTF_MULTIRT flag, the destination
19124 		 * address of ire_dst and the low level
19125 		 * info of ire_prim. In other words, CGTP
19126 		 * broadcast is added to the redundant ipif.
19127 		 */
19128 		ipif_t *ipif_prim;
19129 		ire_t  *bcast_ire;
19130 
19131 		ipif_prim = ire_prim->ire_ipif;
19132 
19133 		ip2dbg(("ip_cgtp_filter_bcast_add: "
19134 		    "ire_dst %p, ire_prim %p, ipif_prim %p\n",
19135 		    (void *)ire_dst, (void *)ire_prim,
19136 		    (void *)ipif_prim));
19137 
19138 		bcast_ire = ire_create(
19139 		    (uchar_t *)&ire->ire_addr,
19140 		    (uchar_t *)&ip_g_all_ones,
19141 		    (uchar_t *)&ire_dst->ire_src_addr,
19142 		    (uchar_t *)&ire->ire_gateway_addr,
19143 		    &ipif_prim->ipif_mtu,
19144 		    NULL,
19145 		    ipif_prim->ipif_rq,
19146 		    ipif_prim->ipif_wq,
19147 		    IRE_BROADCAST,
19148 		    ipif_prim,
19149 		    0,
19150 		    0,
19151 		    0,
19152 		    ire->ire_flags,
19153 		    &ire_uinfo_null,
19154 		    NULL,
19155 		    NULL,
19156 		    ipst);
19157 
19158 		if (bcast_ire != NULL) {
19159 
19160 			if (ire_add(&bcast_ire, NULL, NULL, NULL,
19161 			    B_FALSE) == 0) {
19162 				ip2dbg(("ip_cgtp_filter_bcast_add: "
19163 				    "added bcast_ire %p\n",
19164 				    (void *)bcast_ire));
19165 
19166 				ipif_save_ire(bcast_ire->ire_ipif,
19167 				    bcast_ire);
19168 				ire_refrele(bcast_ire);
19169 			}
19170 		}
19171 		ire_refrele(ire_prim);
19172 	}
19173 }
19174 
19175 /*
19176  * IP multirouting broadcast routes handling
19177  * Remove the broadcast ire
19178  */
19179 static void
19180 ip_cgtp_bcast_delete(ire_t *ire, ip_stack_t *ipst)
19181 {
19182 	ire_t *ire_dst;
19183 
19184 	ASSERT(ire != NULL);
19185 	ire_dst = ire_ctable_lookup(ire->ire_addr, 0, IRE_BROADCAST,
19186 	    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
19187 	if (ire_dst != NULL) {
19188 		ire_t *ire_prim;
19189 
19190 		ire_prim = ire_ctable_lookup(ire->ire_gateway_addr, 0,
19191 		    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst);
19192 		if (ire_prim != NULL) {
19193 			ipif_t *ipif_prim;
19194 			ire_t  *bcast_ire;
19195 
19196 			ipif_prim = ire_prim->ire_ipif;
19197 
19198 			ip2dbg(("ip_cgtp_filter_bcast_delete: "
19199 			    "ire_dst %p, ire_prim %p, ipif_prim %p\n",
19200 			    (void *)ire_dst, (void *)ire_prim,
19201 			    (void *)ipif_prim));
19202 
19203 			bcast_ire = ire_ctable_lookup(ire->ire_addr,
19204 			    ire->ire_gateway_addr,
19205 			    IRE_BROADCAST,
19206 			    ipif_prim, ALL_ZONES,
19207 			    NULL,
19208 			    MATCH_IRE_TYPE | MATCH_IRE_GW | MATCH_IRE_IPIF |
19209 			    MATCH_IRE_MASK, ipst);
19210 
19211 			if (bcast_ire != NULL) {
19212 				ip2dbg(("ip_cgtp_filter_bcast_delete: "
19213 				    "looked up bcast_ire %p\n",
19214 				    (void *)bcast_ire));
19215 				ipif_remove_ire(bcast_ire->ire_ipif,
19216 				    bcast_ire);
19217 				ire_delete(bcast_ire);
19218 				ire_refrele(bcast_ire);
19219 			}
19220 			ire_refrele(ire_prim);
19221 		}
19222 		ire_refrele(ire_dst);
19223 	}
19224 }
19225 
19226 /*
19227  * IPsec hardware acceleration capabilities related functions.
19228  */
19229 
19230 /*
19231  * Free a per-ill IPsec capabilities structure.
19232  */
19233 static void
19234 ill_ipsec_capab_free(ill_ipsec_capab_t *capab)
19235 {
19236 	if (capab->auth_hw_algs != NULL)
19237 		kmem_free(capab->auth_hw_algs, capab->algs_size);
19238 	if (capab->encr_hw_algs != NULL)
19239 		kmem_free(capab->encr_hw_algs, capab->algs_size);
19240 	if (capab->encr_algparm != NULL)
19241 		kmem_free(capab->encr_algparm, capab->encr_algparm_size);
19242 	kmem_free(capab, sizeof (ill_ipsec_capab_t));
19243 }
19244 
19245 /*
19246  * Allocate a new per-ill IPsec capabilities structure. This structure
19247  * is specific to an IPsec protocol (AH or ESP). It is implemented as
19248  * an array which specifies, for each algorithm, whether this algorithm
19249  * is supported by the ill or not.
19250  */
19251 static ill_ipsec_capab_t *
19252 ill_ipsec_capab_alloc(void)
19253 {
19254 	ill_ipsec_capab_t *capab;
19255 	uint_t nelems;
19256 
19257 	capab = kmem_zalloc(sizeof (ill_ipsec_capab_t), KM_NOSLEEP);
19258 	if (capab == NULL)
19259 		return (NULL);
19260 
19261 	/* we need one bit per algorithm */
19262 	nelems = MAX_IPSEC_ALGS / BITS(ipsec_capab_elem_t);
19263 	capab->algs_size = nelems * sizeof (ipsec_capab_elem_t);
19264 
19265 	/* allocate memory to store algorithm flags */
19266 	capab->encr_hw_algs = kmem_zalloc(capab->algs_size, KM_NOSLEEP);
19267 	if (capab->encr_hw_algs == NULL)
19268 		goto nomem;
19269 	capab->auth_hw_algs = kmem_zalloc(capab->algs_size, KM_NOSLEEP);
19270 	if (capab->auth_hw_algs == NULL)
19271 		goto nomem;
19272 	/*
19273 	 * Leave encr_algparm NULL for now since we won't need it half
19274 	 * the time
19275 	 */
19276 	return (capab);
19277 
19278 nomem:
19279 	ill_ipsec_capab_free(capab);
19280 	return (NULL);
19281 }
19282 
19283 /*
19284  * Resize capability array.  Since we're exclusive, this is OK.
19285  */
19286 static boolean_t
19287 ill_ipsec_capab_resize_algparm(ill_ipsec_capab_t *capab, int algid)
19288 {
19289 	ipsec_capab_algparm_t *nalp, *oalp;
19290 	uint32_t olen, nlen;
19291 
19292 	oalp = capab->encr_algparm;
19293 	olen = capab->encr_algparm_size;
19294 
19295 	if (oalp != NULL) {
19296 		if (algid < capab->encr_algparm_end)
19297 			return (B_TRUE);
19298 	}
19299 
19300 	nlen = (algid + 1) * sizeof (*nalp);
19301 	nalp = kmem_zalloc(nlen, KM_NOSLEEP);
19302 	if (nalp == NULL)
19303 		return (B_FALSE);
19304 
19305 	if (oalp != NULL) {
19306 		bcopy(oalp, nalp, olen);
19307 		kmem_free(oalp, olen);
19308 	}
19309 	capab->encr_algparm = nalp;
19310 	capab->encr_algparm_size = nlen;
19311 	capab->encr_algparm_end = algid + 1;
19312 
19313 	return (B_TRUE);
19314 }
19315 
19316 /*
19317  * Compare the capabilities of the specified ill with the protocol
19318  * and algorithms specified by the SA passed as argument.
19319  * If they match, returns B_TRUE, B_FALSE if they do not match.
19320  *
19321  * The ill can be passed as a pointer to it, or by specifying its index
19322  * and whether it is an IPv6 ill (ill_index and ill_isv6 arguments).
19323  *
19324  * Called by ipsec_out_is_accelerated() do decide whether an outbound
19325  * packet is eligible for hardware acceleration, and by
19326  * ill_ipsec_capab_send_all() to decide whether a SA must be sent down
19327  * to a particular ill.
19328  */
19329 boolean_t
19330 ipsec_capab_match(ill_t *ill, uint_t ill_index, boolean_t ill_isv6,
19331     ipsa_t *sa, netstack_t *ns)
19332 {
19333 	boolean_t sa_isv6;
19334 	uint_t algid;
19335 	struct ill_ipsec_capab_s *cpp;
19336 	boolean_t need_refrele = B_FALSE;
19337 	ip_stack_t	*ipst = ns->netstack_ip;
19338 
19339 	if (ill == NULL) {
19340 		ill = ill_lookup_on_ifindex(ill_index, ill_isv6, NULL,
19341 		    NULL, NULL, NULL, ipst);
19342 		if (ill == NULL) {
19343 			ip0dbg(("ipsec_capab_match: ill doesn't exist\n"));
19344 			return (B_FALSE);
19345 		}
19346 		need_refrele = B_TRUE;
19347 	}
19348 
19349 	/*
19350 	 * Use the address length specified by the SA to determine
19351 	 * if it corresponds to a IPv6 address, and fail the matching
19352 	 * if the isv6 flag passed as argument does not match.
19353 	 * Note: this check is used for SADB capability checking before
19354 	 * sending SA information to an ill.
19355 	 */
19356 	sa_isv6 = (sa->ipsa_addrfam == AF_INET6);
19357 	if (sa_isv6 != ill_isv6)
19358 		/* protocol mismatch */
19359 		goto done;
19360 
19361 	/*
19362 	 * Check if the ill supports the protocol, algorithm(s) and
19363 	 * key size(s) specified by the SA, and get the pointers to
19364 	 * the algorithms supported by the ill.
19365 	 */
19366 	switch (sa->ipsa_type) {
19367 
19368 	case SADB_SATYPE_ESP:
19369 		if (!(ill->ill_capabilities & ILL_CAPAB_ESP))
19370 			/* ill does not support ESP acceleration */
19371 			goto done;
19372 		cpp = ill->ill_ipsec_capab_esp;
19373 		algid = sa->ipsa_auth_alg;
19374 		if (!IPSEC_ALG_IS_ENABLED(algid, cpp->auth_hw_algs))
19375 			goto done;
19376 		algid = sa->ipsa_encr_alg;
19377 		if (!IPSEC_ALG_IS_ENABLED(algid, cpp->encr_hw_algs))
19378 			goto done;
19379 		if (algid < cpp->encr_algparm_end) {
19380 			ipsec_capab_algparm_t *alp = &cpp->encr_algparm[algid];
19381 			if (sa->ipsa_encrkeybits < alp->minkeylen)
19382 				goto done;
19383 			if (sa->ipsa_encrkeybits > alp->maxkeylen)
19384 				goto done;
19385 		}
19386 		break;
19387 
19388 	case SADB_SATYPE_AH:
19389 		if (!(ill->ill_capabilities & ILL_CAPAB_AH))
19390 			/* ill does not support AH acceleration */
19391 			goto done;
19392 		if (!IPSEC_ALG_IS_ENABLED(sa->ipsa_auth_alg,
19393 		    ill->ill_ipsec_capab_ah->auth_hw_algs))
19394 			goto done;
19395 		break;
19396 	}
19397 
19398 	if (need_refrele)
19399 		ill_refrele(ill);
19400 	return (B_TRUE);
19401 done:
19402 	if (need_refrele)
19403 		ill_refrele(ill);
19404 	return (B_FALSE);
19405 }
19406 
19407 /*
19408  * Add a new ill to the list of IPsec capable ills.
19409  * Called from ill_capability_ipsec_ack() when an ACK was received
19410  * indicating that IPsec hardware processing was enabled for an ill.
19411  *
19412  * ill must point to the ill for which acceleration was enabled.
19413  * dl_cap must be set to DL_CAPAB_IPSEC_AH or DL_CAPAB_IPSEC_ESP.
19414  */
19415 static void
19416 ill_ipsec_capab_add(ill_t *ill, uint_t dl_cap, boolean_t sadb_resync)
19417 {
19418 	ipsec_capab_ill_t **ills, *cur_ill, *new_ill;
19419 	uint_t sa_type;
19420 	uint_t ipproto;
19421 	ip_stack_t	*ipst = ill->ill_ipst;
19422 
19423 	ASSERT((dl_cap == DL_CAPAB_IPSEC_AH) ||
19424 	    (dl_cap == DL_CAPAB_IPSEC_ESP));
19425 
19426 	switch (dl_cap) {
19427 	case DL_CAPAB_IPSEC_AH:
19428 		sa_type = SADB_SATYPE_AH;
19429 		ills = &ipst->ips_ipsec_capab_ills_ah;
19430 		ipproto = IPPROTO_AH;
19431 		break;
19432 	case DL_CAPAB_IPSEC_ESP:
19433 		sa_type = SADB_SATYPE_ESP;
19434 		ills = &ipst->ips_ipsec_capab_ills_esp;
19435 		ipproto = IPPROTO_ESP;
19436 		break;
19437 	}
19438 
19439 	rw_enter(&ipst->ips_ipsec_capab_ills_lock, RW_WRITER);
19440 
19441 	/*
19442 	 * Add ill index to list of hardware accelerators. If
19443 	 * already in list, do nothing.
19444 	 */
19445 	for (cur_ill = *ills; cur_ill != NULL &&
19446 	    (cur_ill->ill_index != ill->ill_phyint->phyint_ifindex ||
19447 	    cur_ill->ill_isv6 != ill->ill_isv6); cur_ill = cur_ill->next)
19448 		;
19449 
19450 	if (cur_ill == NULL) {
19451 		/* if this is a new entry for this ill */
19452 		new_ill = kmem_zalloc(sizeof (ipsec_capab_ill_t), KM_NOSLEEP);
19453 		if (new_ill == NULL) {
19454 			rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19455 			return;
19456 		}
19457 
19458 		new_ill->ill_index = ill->ill_phyint->phyint_ifindex;
19459 		new_ill->ill_isv6 = ill->ill_isv6;
19460 		new_ill->next = *ills;
19461 		*ills = new_ill;
19462 	} else if (!sadb_resync) {
19463 		/* not resync'ing SADB and an entry exists for this ill */
19464 		rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19465 		return;
19466 	}
19467 
19468 	rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19469 
19470 	if (ipst->ips_ipcl_proto_fanout_v6[ipproto].connf_head != NULL)
19471 		/*
19472 		 * IPsec module for protocol loaded, initiate dump
19473 		 * of the SADB to this ill.
19474 		 */
19475 		sadb_ill_download(ill, sa_type);
19476 }
19477 
19478 /*
19479  * Remove an ill from the list of IPsec capable ills.
19480  */
19481 static void
19482 ill_ipsec_capab_delete(ill_t *ill, uint_t dl_cap)
19483 {
19484 	ipsec_capab_ill_t **ills, *cur_ill, *prev_ill;
19485 	ip_stack_t	*ipst = ill->ill_ipst;
19486 
19487 	ASSERT(dl_cap == DL_CAPAB_IPSEC_AH ||
19488 	    dl_cap == DL_CAPAB_IPSEC_ESP);
19489 
19490 	ills = (dl_cap == DL_CAPAB_IPSEC_AH) ? &ipst->ips_ipsec_capab_ills_ah :
19491 	    &ipst->ips_ipsec_capab_ills_esp;
19492 
19493 	rw_enter(&ipst->ips_ipsec_capab_ills_lock, RW_WRITER);
19494 
19495 	prev_ill = NULL;
19496 	for (cur_ill = *ills; cur_ill != NULL && (cur_ill->ill_index !=
19497 	    ill->ill_phyint->phyint_ifindex || cur_ill->ill_isv6 !=
19498 	    ill->ill_isv6); prev_ill = cur_ill, cur_ill = cur_ill->next)
19499 		;
19500 	if (cur_ill == NULL) {
19501 		/* entry not found */
19502 		rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19503 		return;
19504 	}
19505 	if (prev_ill == NULL) {
19506 		/* entry at front of list */
19507 		*ills = NULL;
19508 	} else {
19509 		prev_ill->next = cur_ill->next;
19510 	}
19511 	kmem_free(cur_ill, sizeof (ipsec_capab_ill_t));
19512 	rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19513 }
19514 
19515 /*
19516  * Called by SADB to send a DL_CONTROL_REQ message to every ill
19517  * supporting the specified IPsec protocol acceleration.
19518  * sa_type must be SADB_SATYPE_AH or SADB_SATYPE_ESP.
19519  * We free the mblk and, if sa is non-null, release the held referece.
19520  */
19521 void
19522 ill_ipsec_capab_send_all(uint_t sa_type, mblk_t *mp, ipsa_t *sa,
19523     netstack_t *ns)
19524 {
19525 	ipsec_capab_ill_t *ici, *cur_ici;
19526 	ill_t *ill;
19527 	mblk_t *nmp, *mp_ship_list = NULL, *next_mp;
19528 	ip_stack_t	*ipst = ns->netstack_ip;
19529 
19530 	ici = (sa_type == SADB_SATYPE_AH) ? ipst->ips_ipsec_capab_ills_ah :
19531 	    ipst->ips_ipsec_capab_ills_esp;
19532 
19533 	rw_enter(&ipst->ips_ipsec_capab_ills_lock, RW_READER);
19534 
19535 	for (cur_ici = ici; cur_ici != NULL; cur_ici = cur_ici->next) {
19536 		ill = ill_lookup_on_ifindex(cur_ici->ill_index,
19537 		    cur_ici->ill_isv6, NULL, NULL, NULL, NULL, ipst);
19538 
19539 		/*
19540 		 * Handle the case where the ill goes away while the SADB is
19541 		 * attempting to send messages.  If it's going away, it's
19542 		 * nuking its shadow SADB, so we don't care..
19543 		 */
19544 
19545 		if (ill == NULL)
19546 			continue;
19547 
19548 		if (sa != NULL) {
19549 			/*
19550 			 * Make sure capabilities match before
19551 			 * sending SA to ill.
19552 			 */
19553 			if (!ipsec_capab_match(ill, cur_ici->ill_index,
19554 			    cur_ici->ill_isv6, sa, ipst->ips_netstack)) {
19555 				ill_refrele(ill);
19556 				continue;
19557 			}
19558 
19559 			mutex_enter(&sa->ipsa_lock);
19560 			sa->ipsa_flags |= IPSA_F_HW;
19561 			mutex_exit(&sa->ipsa_lock);
19562 		}
19563 
19564 		/*
19565 		 * Copy template message, and add it to the front
19566 		 * of the mblk ship list. We want to avoid holding
19567 		 * the ipsec_capab_ills_lock while sending the
19568 		 * message to the ills.
19569 		 *
19570 		 * The b_next and b_prev are temporarily used
19571 		 * to build a list of mblks to be sent down, and to
19572 		 * save the ill to which they must be sent.
19573 		 */
19574 		nmp = copymsg(mp);
19575 		if (nmp == NULL) {
19576 			ill_refrele(ill);
19577 			continue;
19578 		}
19579 		ASSERT(nmp->b_next == NULL && nmp->b_prev == NULL);
19580 		nmp->b_next = mp_ship_list;
19581 		mp_ship_list = nmp;
19582 		nmp->b_prev = (mblk_t *)ill;
19583 	}
19584 
19585 	rw_exit(&ipst->ips_ipsec_capab_ills_lock);
19586 
19587 	for (nmp = mp_ship_list; nmp != NULL; nmp = next_mp) {
19588 		/* restore the mblk to a sane state */
19589 		next_mp = nmp->b_next;
19590 		nmp->b_next = NULL;
19591 		ill = (ill_t *)nmp->b_prev;
19592 		nmp->b_prev = NULL;
19593 
19594 		ill_dlpi_send(ill, nmp);
19595 		ill_refrele(ill);
19596 	}
19597 
19598 	if (sa != NULL)
19599 		IPSA_REFRELE(sa);
19600 	freemsg(mp);
19601 }
19602 
19603 /*
19604  * Derive an interface id from the link layer address.
19605  * Knows about IEEE 802 and IEEE EUI-64 mappings.
19606  */
19607 static boolean_t
19608 ip_ether_v6intfid(ill_t *ill, in6_addr_t *v6addr)
19609 {
19610 	char		*addr;
19611 
19612 	if (ill->ill_phys_addr_length != ETHERADDRL)
19613 		return (B_FALSE);
19614 
19615 	/* Form EUI-64 like address */
19616 	addr = (char *)&v6addr->s6_addr32[2];
19617 	bcopy(ill->ill_phys_addr, addr, 3);
19618 	addr[0] ^= 0x2;		/* Toggle Universal/Local bit */
19619 	addr[3] = (char)0xff;
19620 	addr[4] = (char)0xfe;
19621 	bcopy(ill->ill_phys_addr + 3, addr + 5, 3);
19622 	return (B_TRUE);
19623 }
19624 
19625 /* ARGSUSED */
19626 static boolean_t
19627 ip_nodef_v6intfid(ill_t *ill, in6_addr_t *v6addr)
19628 {
19629 	return (B_FALSE);
19630 }
19631 
19632 typedef struct ipmp_ifcookie {
19633 	uint32_t	ic_hostid;
19634 	char		ic_ifname[LIFNAMSIZ];
19635 	char		ic_zonename[ZONENAME_MAX];
19636 } ipmp_ifcookie_t;
19637 
19638 /*
19639  * Construct a pseudo-random interface ID for the IPMP interface that's both
19640  * predictable and (almost) guaranteed to be unique.
19641  */
19642 static boolean_t
19643 ip_ipmp_v6intfid(ill_t *ill, in6_addr_t *v6addr)
19644 {
19645 	zone_t		*zp;
19646 	uint8_t		*addr;
19647 	uchar_t		hash[16];
19648 	ulong_t 	hostid;
19649 	MD5_CTX		ctx;
19650 	ipmp_ifcookie_t	ic = { 0 };
19651 
19652 	ASSERT(IS_IPMP(ill));
19653 
19654 	(void) ddi_strtoul(hw_serial, NULL, 10, &hostid);
19655 	ic.ic_hostid = htonl((uint32_t)hostid);
19656 
19657 	(void) strlcpy(ic.ic_ifname, ill->ill_name, LIFNAMSIZ);
19658 
19659 	if ((zp = zone_find_by_id(ill->ill_zoneid)) != NULL) {
19660 		(void) strlcpy(ic.ic_zonename, zp->zone_name, ZONENAME_MAX);
19661 		zone_rele(zp);
19662 	}
19663 
19664 	MD5Init(&ctx);
19665 	MD5Update(&ctx, &ic, sizeof (ic));
19666 	MD5Final(hash, &ctx);
19667 
19668 	/*
19669 	 * Map the hash to an interface ID per the basic approach in RFC3041.
19670 	 */
19671 	addr = &v6addr->s6_addr8[8];
19672 	bcopy(hash + 8, addr, sizeof (uint64_t));
19673 	addr[0] &= ~0x2;				/* set local bit */
19674 
19675 	return (B_TRUE);
19676 }
19677 
19678 /* ARGSUSED */
19679 static boolean_t
19680 ip_ether_v6mapinfo(uint_t lla_length, uint8_t *bphys_addr, uint8_t *maddr,
19681     uint32_t *hw_start, in6_addr_t *v6_extract_mask)
19682 {
19683 	/*
19684 	 * Multicast address mappings used over Ethernet/802.X.
19685 	 * This address is used as a base for mappings.
19686 	 */
19687 	static uint8_t ipv6_g_phys_multi_addr[] = {0x33, 0x33, 0x00,
19688 	    0x00, 0x00, 0x00};
19689 
19690 	/*
19691 	 * Extract low order 32 bits from IPv6 multicast address.
19692 	 * Or that into the link layer address, starting from the
19693 	 * second byte.
19694 	 */
19695 	*hw_start = 2;
19696 	v6_extract_mask->s6_addr32[0] = 0;
19697 	v6_extract_mask->s6_addr32[1] = 0;
19698 	v6_extract_mask->s6_addr32[2] = 0;
19699 	v6_extract_mask->s6_addr32[3] = 0xffffffffU;
19700 	bcopy(ipv6_g_phys_multi_addr, maddr, lla_length);
19701 	return (B_TRUE);
19702 }
19703 
19704 /*
19705  * Indicate by return value whether multicast is supported. If not,
19706  * this code should not touch/change any parameters.
19707  */
19708 /* ARGSUSED */
19709 static boolean_t
19710 ip_ether_v4mapinfo(uint_t phys_length, uint8_t *bphys_addr, uint8_t *maddr,
19711     uint32_t *hw_start, ipaddr_t *extract_mask)
19712 {
19713 	/*
19714 	 * Multicast address mappings used over Ethernet/802.X.
19715 	 * This address is used as a base for mappings.
19716 	 */
19717 	static uint8_t ip_g_phys_multi_addr[] = { 0x01, 0x00, 0x5e,
19718 	    0x00, 0x00, 0x00 };
19719 
19720 	if (phys_length != ETHERADDRL)
19721 		return (B_FALSE);
19722 
19723 	*extract_mask = htonl(0x007fffff);
19724 	*hw_start = 2;
19725 	bcopy(ip_g_phys_multi_addr, maddr, ETHERADDRL);
19726 	return (B_TRUE);
19727 }
19728 
19729 /*
19730  * Derive IPoIB interface id from the link layer address.
19731  */
19732 static boolean_t
19733 ip_ib_v6intfid(ill_t *ill, in6_addr_t *v6addr)
19734 {
19735 	char		*addr;
19736 
19737 	if (ill->ill_phys_addr_length != 20)
19738 		return (B_FALSE);
19739 	addr = (char *)&v6addr->s6_addr32[2];
19740 	bcopy(ill->ill_phys_addr + 12, addr, 8);
19741 	/*
19742 	 * In IBA 1.1 timeframe, some vendors erroneously set the u/l bit
19743 	 * in the globally assigned EUI-64 GUID to 1, in violation of IEEE
19744 	 * rules. In these cases, the IBA considers these GUIDs to be in
19745 	 * "Modified EUI-64" format, and thus toggling the u/l bit is not
19746 	 * required; vendors are required not to assign global EUI-64's
19747 	 * that differ only in u/l bit values, thus guaranteeing uniqueness
19748 	 * of the interface identifier. Whether the GUID is in modified
19749 	 * or proper EUI-64 format, the ipv6 identifier must have the u/l
19750 	 * bit set to 1.
19751 	 */
19752 	addr[0] |= 2;			/* Set Universal/Local bit to 1 */
19753 	return (B_TRUE);
19754 }
19755 
19756 /*
19757  * Note on mapping from multicast IP addresses to IPoIB multicast link
19758  * addresses. IPoIB multicast link addresses are based on IBA link addresses.
19759  * The format of an IPoIB multicast address is:
19760  *
19761  *  4 byte QPN      Scope Sign.  Pkey
19762  * +--------------------------------------------+
19763  * | 00FFFFFF | FF | 1X | X01B | Pkey | GroupID |
19764  * +--------------------------------------------+
19765  *
19766  * The Scope and Pkey components are properties of the IBA port and
19767  * network interface. They can be ascertained from the broadcast address.
19768  * The Sign. part is the signature, and is 401B for IPv4 and 601B for IPv6.
19769  */
19770 
19771 static boolean_t
19772 ip_ib_v6mapinfo(uint_t lla_length, uint8_t *bphys_addr, uint8_t *maddr,
19773     uint32_t *hw_start, in6_addr_t *v6_extract_mask)
19774 {
19775 	/*
19776 	 * Base IPoIB IPv6 multicast address used for mappings.
19777 	 * Does not contain the IBA scope/Pkey values.
19778 	 */
19779 	static uint8_t ipv6_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
19780 	    0xff, 0x10, 0x60, 0x1b, 0x00, 0x00, 0x00, 0x00,
19781 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
19782 
19783 	/*
19784 	 * Extract low order 80 bits from IPv6 multicast address.
19785 	 * Or that into the link layer address, starting from the
19786 	 * sixth byte.
19787 	 */
19788 	*hw_start = 6;
19789 	bcopy(ipv6_g_phys_ibmulti_addr, maddr, lla_length);
19790 
19791 	/*
19792 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
19793 	 */
19794 	*(maddr + 5) = *(bphys_addr + 5);
19795 	*(maddr + 8) = *(bphys_addr + 8);
19796 	*(maddr + 9) = *(bphys_addr + 9);
19797 
19798 	v6_extract_mask->s6_addr32[0] = 0;
19799 	v6_extract_mask->s6_addr32[1] = htonl(0x0000ffff);
19800 	v6_extract_mask->s6_addr32[2] = 0xffffffffU;
19801 	v6_extract_mask->s6_addr32[3] = 0xffffffffU;
19802 	return (B_TRUE);
19803 }
19804 
19805 static boolean_t
19806 ip_ib_v4mapinfo(uint_t phys_length, uint8_t *bphys_addr, uint8_t *maddr,
19807     uint32_t *hw_start, ipaddr_t *extract_mask)
19808 {
19809 	/*
19810 	 * Base IPoIB IPv4 multicast address used for mappings.
19811 	 * Does not contain the IBA scope/Pkey values.
19812 	 */
19813 	static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
19814 	    0xff, 0x10, 0x40, 0x1b, 0x00, 0x00, 0x00, 0x00,
19815 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
19816 
19817 	if (phys_length != sizeof (ipv4_g_phys_ibmulti_addr))
19818 		return (B_FALSE);
19819 
19820 	/*
19821 	 * Extract low order 28 bits from IPv4 multicast address.
19822 	 * Or that into the link layer address, starting from the
19823 	 * sixteenth byte.
19824 	 */
19825 	*extract_mask = htonl(0x0fffffff);
19826 	*hw_start = 16;
19827 	bcopy(ipv4_g_phys_ibmulti_addr, maddr, phys_length);
19828 
19829 	/*
19830 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
19831 	 */
19832 	*(maddr + 5) = *(bphys_addr + 5);
19833 	*(maddr + 8) = *(bphys_addr + 8);
19834 	*(maddr + 9) = *(bphys_addr + 9);
19835 	return (B_TRUE);
19836 }
19837 
19838 /*
19839  * Returns B_TRUE if an ipif is present in the given zone, matching some flags
19840  * (typically IPIF_UP). If ipifp is non-null, the held ipif is returned there.
19841  * This works for both IPv4 and IPv6; if the passed-in ill is v6, the ipif with
19842  * the link-local address is preferred.
19843  */
19844 boolean_t
19845 ipif_lookup_zoneid(ill_t *ill, zoneid_t zoneid, int flags, ipif_t **ipifp)
19846 {
19847 	ipif_t	*ipif;
19848 	ipif_t	*maybe_ipif = NULL;
19849 
19850 	mutex_enter(&ill->ill_lock);
19851 	if (ill->ill_state_flags & ILL_CONDEMNED) {
19852 		mutex_exit(&ill->ill_lock);
19853 		if (ipifp != NULL)
19854 			*ipifp = NULL;
19855 		return (B_FALSE);
19856 	}
19857 
19858 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
19859 		if (!IPIF_CAN_LOOKUP(ipif))
19860 			continue;
19861 		if (zoneid != ALL_ZONES && ipif->ipif_zoneid != zoneid &&
19862 		    ipif->ipif_zoneid != ALL_ZONES)
19863 			continue;
19864 		if ((ipif->ipif_flags & flags) != flags)
19865 			continue;
19866 
19867 		if (ipifp == NULL) {
19868 			mutex_exit(&ill->ill_lock);
19869 			ASSERT(maybe_ipif == NULL);
19870 			return (B_TRUE);
19871 		}
19872 		if (!ill->ill_isv6 ||
19873 		    IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6src_addr)) {
19874 			ipif_refhold_locked(ipif);
19875 			mutex_exit(&ill->ill_lock);
19876 			*ipifp = ipif;
19877 			return (B_TRUE);
19878 		}
19879 		if (maybe_ipif == NULL)
19880 			maybe_ipif = ipif;
19881 	}
19882 	if (ipifp != NULL) {
19883 		if (maybe_ipif != NULL)
19884 			ipif_refhold_locked(maybe_ipif);
19885 		*ipifp = maybe_ipif;
19886 	}
19887 	mutex_exit(&ill->ill_lock);
19888 	return (maybe_ipif != NULL);
19889 }
19890 
19891 /*
19892  * Return a pointer to an ipif_t given a combination of (ill_idx,ipif_id)
19893  * If a pointer to an ipif_t is returned then the caller will need to do
19894  * an ill_refrele().
19895  */
19896 ipif_t *
19897 ipif_getby_indexes(uint_t ifindex, uint_t lifidx, boolean_t isv6,
19898     ip_stack_t *ipst)
19899 {
19900 	ipif_t *ipif;
19901 	ill_t *ill;
19902 
19903 	ill = ill_lookup_on_ifindex(ifindex, isv6, NULL, NULL, NULL, NULL,
19904 	    ipst);
19905 	if (ill == NULL)
19906 		return (NULL);
19907 
19908 	mutex_enter(&ill->ill_lock);
19909 	if (ill->ill_state_flags & ILL_CONDEMNED) {
19910 		mutex_exit(&ill->ill_lock);
19911 		ill_refrele(ill);
19912 		return (NULL);
19913 	}
19914 
19915 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
19916 		if (!IPIF_CAN_LOOKUP(ipif))
19917 			continue;
19918 		if (lifidx == ipif->ipif_id) {
19919 			ipif_refhold_locked(ipif);
19920 			break;
19921 		}
19922 	}
19923 
19924 	mutex_exit(&ill->ill_lock);
19925 	ill_refrele(ill);
19926 	return (ipif);
19927 }
19928 
19929 /*
19930  * Flush the fastpath by deleting any nce's that are waiting for the fastpath,
19931  * There is one exceptions IRE_BROADCAST are difficult to recreate,
19932  * so instead we just nuke their nce_fp_mp's; see ndp_fastpath_flush()
19933  * for details.
19934  */
19935 void
19936 ill_fastpath_flush(ill_t *ill)
19937 {
19938 	ip_stack_t *ipst = ill->ill_ipst;
19939 
19940 	nce_fastpath_list_dispatch(ill, NULL, NULL);
19941 	ndp_walk_common((ill->ill_isv6 ? ipst->ips_ndp6 : ipst->ips_ndp4),
19942 	    ill, (pfi_t)ndp_fastpath_flush, NULL, B_TRUE);
19943 }
19944 
19945 /*
19946  * Set the physical address information for `ill' to the contents of the
19947  * dl_notify_ind_t pointed to by `mp'.  Must be called as writer, and will be
19948  * asynchronous if `ill' cannot immediately be quiesced -- in which case
19949  * EINPROGRESS will be returned.
19950  */
19951 int
19952 ill_set_phys_addr(ill_t *ill, mblk_t *mp)
19953 {
19954 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
19955 	dl_notify_ind_t	*dlindp = (dl_notify_ind_t *)mp->b_rptr;
19956 
19957 	ASSERT(IAM_WRITER_IPSQ(ipsq));
19958 
19959 	if (dlindp->dl_data != DL_IPV6_LINK_LAYER_ADDR &&
19960 	    dlindp->dl_data != DL_CURR_PHYS_ADDR) {
19961 		/* Changing DL_IPV6_TOKEN is not yet supported */
19962 		return (0);
19963 	}
19964 
19965 	/*
19966 	 * We need to store up to two copies of `mp' in `ill'.  Due to the
19967 	 * design of ipsq_pending_mp_add(), we can't pass them as separate
19968 	 * arguments to ill_set_phys_addr_tail().  Instead, chain them
19969 	 * together here, then pull 'em apart in ill_set_phys_addr_tail().
19970 	 */
19971 	if ((mp = copyb(mp)) == NULL || (mp->b_cont = copyb(mp)) == NULL) {
19972 		freemsg(mp);
19973 		return (ENOMEM);
19974 	}
19975 
19976 	ipsq_current_start(ipsq, ill->ill_ipif, 0);
19977 
19978 	/*
19979 	 * If we can quiesce the ill, then set the address.  If not, then
19980 	 * ill_set_phys_addr_tail() will be called from ipif_ill_refrele_tail().
19981 	 */
19982 	ill_down_ipifs(ill);
19983 	mutex_enter(&ill->ill_lock);
19984 	if (!ill_is_quiescent(ill)) {
19985 		/* call cannot fail since `conn_t *' argument is NULL */
19986 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
19987 		    mp, ILL_DOWN);
19988 		mutex_exit(&ill->ill_lock);
19989 		return (EINPROGRESS);
19990 	}
19991 	mutex_exit(&ill->ill_lock);
19992 
19993 	ill_set_phys_addr_tail(ipsq, ill->ill_rq, mp, NULL);
19994 	return (0);
19995 }
19996 
19997 /*
19998  * Once the ill associated with `q' has quiesced, set its physical address
19999  * information to the values in `addrmp'.  Note that two copies of `addrmp'
20000  * are passed (linked by b_cont), since we sometimes need to save two distinct
20001  * copies in the ill_t, and our context doesn't permit sleeping or allocation
20002  * failure (we'll free the other copy if it's not needed).  Since the ill_t
20003  * is quiesced, we know any stale IREs with the old address information have
20004  * already been removed, so we don't need to call ill_fastpath_flush().
20005  */
20006 /* ARGSUSED */
20007 static void
20008 ill_set_phys_addr_tail(ipsq_t *ipsq, queue_t *q, mblk_t *addrmp, void *dummy)
20009 {
20010 	ill_t		*ill = q->q_ptr;
20011 	mblk_t		*addrmp2 = unlinkb(addrmp);
20012 	dl_notify_ind_t	*dlindp = (dl_notify_ind_t *)addrmp->b_rptr;
20013 	uint_t		addrlen, addroff;
20014 
20015 	ASSERT(IAM_WRITER_IPSQ(ipsq));
20016 
20017 	addroff	= dlindp->dl_addr_offset;
20018 	addrlen = dlindp->dl_addr_length - ABS(ill->ill_sap_length);
20019 
20020 	switch (dlindp->dl_data) {
20021 	case DL_IPV6_LINK_LAYER_ADDR:
20022 		ill_set_ndmp(ill, addrmp, addroff, addrlen);
20023 		freemsg(addrmp2);
20024 		break;
20025 
20026 	case DL_CURR_PHYS_ADDR:
20027 		freemsg(ill->ill_phys_addr_mp);
20028 		ill->ill_phys_addr = addrmp->b_rptr + addroff;
20029 		ill->ill_phys_addr_mp = addrmp;
20030 		ill->ill_phys_addr_length = addrlen;
20031 
20032 		if (ill->ill_isv6 && !(ill->ill_flags & ILLF_XRESOLV))
20033 			ill_set_ndmp(ill, addrmp2, addroff, addrlen);
20034 		else
20035 			freemsg(addrmp2);
20036 		break;
20037 	default:
20038 		ASSERT(0);
20039 	}
20040 
20041 	/*
20042 	 * If there are ipifs to bring up, ill_up_ipifs() will return
20043 	 * EINPROGRESS, and ipsq_current_finish() will be called by
20044 	 * ip_rput_dlpi_writer() or ip_arp_done() when the last ipif is
20045 	 * brought up.
20046 	 */
20047 	if (ill_up_ipifs(ill, q, addrmp) != EINPROGRESS)
20048 		ipsq_current_finish(ipsq);
20049 }
20050 
20051 /*
20052  * Helper routine for setting the ill_nd_lla fields.
20053  */
20054 void
20055 ill_set_ndmp(ill_t *ill, mblk_t *ndmp, uint_t addroff, uint_t addrlen)
20056 {
20057 	freemsg(ill->ill_nd_lla_mp);
20058 	ill->ill_nd_lla = ndmp->b_rptr + addroff;
20059 	ill->ill_nd_lla_mp = ndmp;
20060 	ill->ill_nd_lla_len = addrlen;
20061 }
20062 
20063 major_t IP_MAJ;
20064 #define	IP	"ip"
20065 
20066 #define	UDP6DEV		"/devices/pseudo/udp6@0:udp6"
20067 #define	UDPDEV		"/devices/pseudo/udp@0:udp"
20068 
20069 /*
20070  * Issue REMOVEIF ioctls to have the loopback interfaces
20071  * go away.  Other interfaces are either I_LINKed or I_PLINKed;
20072  * the former going away when the user-level processes in the zone
20073  * are killed  * and the latter are cleaned up by the stream head
20074  * str_stack_shutdown callback that undoes all I_PLINKs.
20075  */
20076 void
20077 ip_loopback_cleanup(ip_stack_t *ipst)
20078 {
20079 	int error;
20080 	ldi_handle_t	lh = NULL;
20081 	ldi_ident_t	li = NULL;
20082 	int		rval;
20083 	cred_t		*cr;
20084 	struct strioctl iocb;
20085 	struct lifreq	lifreq;
20086 
20087 	IP_MAJ = ddi_name_to_major(IP);
20088 
20089 #ifdef NS_DEBUG
20090 	(void) printf("ip_loopback_cleanup() stackid %d\n",
20091 	    ipst->ips_netstack->netstack_stackid);
20092 #endif
20093 
20094 	bzero(&lifreq, sizeof (lifreq));
20095 	(void) strcpy(lifreq.lifr_name, ipif_loopback_name);
20096 
20097 	error = ldi_ident_from_major(IP_MAJ, &li);
20098 	if (error) {
20099 #ifdef DEBUG
20100 		printf("ip_loopback_cleanup: lyr ident get failed error %d\n",
20101 		    error);
20102 #endif
20103 		return;
20104 	}
20105 
20106 	cr = zone_get_kcred(netstackid_to_zoneid(
20107 	    ipst->ips_netstack->netstack_stackid));
20108 	ASSERT(cr != NULL);
20109 	error = ldi_open_by_name(UDP6DEV, FREAD|FWRITE, cr, &lh, li);
20110 	if (error) {
20111 #ifdef DEBUG
20112 		printf("ip_loopback_cleanup: open of UDP6DEV failed error %d\n",
20113 		    error);
20114 #endif
20115 		goto out;
20116 	}
20117 	iocb.ic_cmd = SIOCLIFREMOVEIF;
20118 	iocb.ic_timout = 15;
20119 	iocb.ic_len = sizeof (lifreq);
20120 	iocb.ic_dp = (char *)&lifreq;
20121 
20122 	error = ldi_ioctl(lh, I_STR, (intptr_t)&iocb, FKIOCTL, cr, &rval);
20123 	/* LINTED - statement has no consequent */
20124 	if (error) {
20125 #ifdef NS_DEBUG
20126 		printf("ip_loopback_cleanup: ioctl SIOCLIFREMOVEIF failed on "
20127 		    "UDP6 error %d\n", error);
20128 #endif
20129 	}
20130 	(void) ldi_close(lh, FREAD|FWRITE, cr);
20131 	lh = NULL;
20132 
20133 	error = ldi_open_by_name(UDPDEV, FREAD|FWRITE, cr, &lh, li);
20134 	if (error) {
20135 #ifdef NS_DEBUG
20136 		printf("ip_loopback_cleanup: open of UDPDEV failed error %d\n",
20137 		    error);
20138 #endif
20139 		goto out;
20140 	}
20141 
20142 	iocb.ic_cmd = SIOCLIFREMOVEIF;
20143 	iocb.ic_timout = 15;
20144 	iocb.ic_len = sizeof (lifreq);
20145 	iocb.ic_dp = (char *)&lifreq;
20146 
20147 	error = ldi_ioctl(lh, I_STR, (intptr_t)&iocb, FKIOCTL, cr, &rval);
20148 	/* LINTED - statement has no consequent */
20149 	if (error) {
20150 #ifdef NS_DEBUG
20151 		printf("ip_loopback_cleanup: ioctl SIOCLIFREMOVEIF failed on "
20152 		    "UDP error %d\n", error);
20153 #endif
20154 	}
20155 	(void) ldi_close(lh, FREAD|FWRITE, cr);
20156 	lh = NULL;
20157 
20158 out:
20159 	/* Close layered handles */
20160 	if (lh)
20161 		(void) ldi_close(lh, FREAD|FWRITE, cr);
20162 	if (li)
20163 		ldi_ident_release(li);
20164 
20165 	crfree(cr);
20166 }
20167 
20168 /*
20169  * This needs to be in-sync with nic_event_t definition
20170  */
20171 static const char *
20172 ill_hook_event2str(nic_event_t event)
20173 {
20174 	switch (event) {
20175 	case NE_PLUMB:
20176 		return ("PLUMB");
20177 	case NE_UNPLUMB:
20178 		return ("UNPLUMB");
20179 	case NE_UP:
20180 		return ("UP");
20181 	case NE_DOWN:
20182 		return ("DOWN");
20183 	case NE_ADDRESS_CHANGE:
20184 		return ("ADDRESS_CHANGE");
20185 	case NE_LIF_UP:
20186 		return ("LIF_UP");
20187 	case NE_LIF_DOWN:
20188 		return ("LIF_DOWN");
20189 	default:
20190 		return ("UNKNOWN");
20191 	}
20192 }
20193 
20194 void
20195 ill_nic_event_dispatch(ill_t *ill, lif_if_t lif, nic_event_t event,
20196     nic_event_data_t data, size_t datalen)
20197 {
20198 	ip_stack_t		*ipst = ill->ill_ipst;
20199 	hook_nic_event_int_t	*info;
20200 	const char		*str = NULL;
20201 
20202 	/* create a new nic event info */
20203 	if ((info = kmem_alloc(sizeof (*info), KM_NOSLEEP)) == NULL)
20204 		goto fail;
20205 
20206 	info->hnei_event.hne_nic = ill->ill_phyint->phyint_ifindex;
20207 	info->hnei_event.hne_lif = lif;
20208 	info->hnei_event.hne_event = event;
20209 	info->hnei_event.hne_protocol = ill->ill_isv6 ?
20210 	    ipst->ips_ipv6_net_data : ipst->ips_ipv4_net_data;
20211 	info->hnei_event.hne_data = NULL;
20212 	info->hnei_event.hne_datalen = 0;
20213 	info->hnei_stackid = ipst->ips_netstack->netstack_stackid;
20214 
20215 	if (data != NULL && datalen != 0) {
20216 		info->hnei_event.hne_data = kmem_alloc(datalen, KM_NOSLEEP);
20217 		if (info->hnei_event.hne_data == NULL)
20218 			goto fail;
20219 		bcopy(data, info->hnei_event.hne_data, datalen);
20220 		info->hnei_event.hne_datalen = datalen;
20221 	}
20222 
20223 	if (ddi_taskq_dispatch(eventq_queue_nic, ip_ne_queue_func, info,
20224 	    DDI_NOSLEEP) == DDI_SUCCESS)
20225 		return;
20226 
20227 fail:
20228 	if (info != NULL) {
20229 		if (info->hnei_event.hne_data != NULL) {
20230 			kmem_free(info->hnei_event.hne_data,
20231 			    info->hnei_event.hne_datalen);
20232 		}
20233 		kmem_free(info, sizeof (hook_nic_event_t));
20234 	}
20235 	str = ill_hook_event2str(event);
20236 	ip2dbg(("ill_nic_event_dispatch: could not dispatch %s nic event "
20237 	    "information for %s (ENOMEM)\n", str, ill->ill_name));
20238 }
20239 
20240 void
20241 ipif_up_notify(ipif_t *ipif)
20242 {
20243 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
20244 	ip_rts_newaddrmsg(RTM_ADD, 0, ipif, RTSQ_DEFAULT);
20245 	sctp_update_ipif(ipif, SCTP_IPIF_UP);
20246 	ill_nic_event_dispatch(ipif->ipif_ill, MAP_IPIF_ID(ipif->ipif_id),
20247 	    NE_LIF_UP, NULL, 0);
20248 }
20249