xref: /titanic_50/usr/src/uts/common/inet/ip/ip_multi.c (revision c7158ae983f5a04c4a998f468ecefba6d23ba721)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /* Copyright (c) 1990 Mentat Inc. */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include <sys/types.h>
30 #include <sys/stream.h>
31 #include <sys/dlpi.h>
32 #include <sys/stropts.h>
33 #include <sys/strsun.h>
34 #include <sys/ddi.h>
35 #include <sys/cmn_err.h>
36 #include <sys/sdt.h>
37 #include <sys/zone.h>
38 
39 #include <sys/param.h>
40 #include <sys/socket.h>
41 #include <sys/sockio.h>
42 #include <net/if.h>
43 #include <sys/systm.h>
44 #include <sys/strsubr.h>
45 #include <net/route.h>
46 #include <netinet/in.h>
47 #include <net/if_dl.h>
48 #include <netinet/ip6.h>
49 #include <netinet/icmp6.h>
50 
51 #include <inet/common.h>
52 #include <inet/mi.h>
53 #include <inet/nd.h>
54 #include <inet/arp.h>
55 #include <inet/ip.h>
56 #include <inet/ip6.h>
57 #include <inet/ip_if.h>
58 #include <inet/ip_ndp.h>
59 #include <inet/ip_multi.h>
60 #include <inet/ipclassifier.h>
61 #include <inet/ipsec_impl.h>
62 #include <inet/sctp_ip.h>
63 #include <inet/ip_listutils.h>
64 #include <inet/udp_impl.h>
65 
66 /* igmpv3/mldv2 source filter manipulation */
67 static void	ilm_bld_flists(conn_t *conn, void *arg);
68 static void	ilm_gen_filter(ilm_t *ilm, mcast_record_t *fmode,
69     slist_t *flist);
70 
71 static ilm_t	*ilm_add_v6(ipif_t *ipif, const in6_addr_t *group,
72     ilg_stat_t ilgstat, mcast_record_t ilg_fmode, slist_t *ilg_flist,
73     int orig_ifindex, zoneid_t zoneid);
74 static void	ilm_delete(ilm_t *ilm);
75 static int	ip_ll_addmulti_v6(ipif_t *ipif, const in6_addr_t *group);
76 static int	ip_ll_delmulti_v6(ipif_t *ipif, const in6_addr_t *group);
77 static ilg_t	*ilg_lookup_ill_index_v6(conn_t *connp,
78     const in6_addr_t *v6group, int index);
79 static ilg_t	*ilg_lookup_ipif(conn_t *connp, ipaddr_t group,
80     ipif_t *ipif);
81 static int	ilg_add(conn_t *connp, ipaddr_t group, ipif_t *ipif,
82     mcast_record_t fmode, ipaddr_t src);
83 static int	ilg_add_v6(conn_t *connp, const in6_addr_t *group, ill_t *ill,
84     mcast_record_t fmode, const in6_addr_t *v6src);
85 static void	ilg_delete(conn_t *connp, ilg_t *ilg, const in6_addr_t *src);
86 static mblk_t	*ill_create_dl(ill_t *ill, uint32_t dl_primitive,
87     uint32_t length, uint32_t *addr_lenp, uint32_t *addr_offp);
88 static mblk_t	*ill_create_squery(ill_t *ill, ipaddr_t ipaddr,
89     uint32_t addrlen, uint32_t addroff, mblk_t *mp_tail);
90 static void	conn_ilg_reap(conn_t *connp);
91 static int	ip_opt_delete_group_excl(conn_t *connp, ipaddr_t group,
92     ipif_t *ipif, mcast_record_t fmode, ipaddr_t src);
93 static int	ip_opt_delete_group_excl_v6(conn_t *connp,
94     const in6_addr_t *v6group, ill_t *ill, mcast_record_t fmode,
95     const in6_addr_t *v6src);
96 
97 /*
98  * MT notes:
99  *
100  * Multicast joins operate on both the ilg and ilm structures. Multiple
101  * threads operating on an conn (socket) trying to do multicast joins
102  * need to synchronize  when operating on the ilg. Multiple threads
103  * potentially operating on different conn (socket endpoints) trying to
104  * do multicast joins could eventually end up trying to manipulate the
105  * ilm simulatenously and need to synchronize on the access to the ilm.
106  * Both are amenable to standard Solaris MT techniques, but it would be
107  * complex to handle a failover or failback which needs to manipulate
108  * ilg/ilms if an applications can also simultaenously join/leave
109  * multicast groups. Hence multicast join/leave also go through the ipsq_t
110  * serialization.
111  *
112  * Multicast joins and leaves are single-threaded per phyint/IPMP group
113  * using the ipsq serialization mechanism.
114  *
115  * An ilm is an IP data structure used to track multicast join/leave.
116  * An ilm is associated with a <multicast group, ipif> tuple in IPv4 and
117  * with just <multicast group> in IPv6. ilm_refcnt is the number of ilg's
118  * referencing the ilm. ilms are created / destroyed only as writer. ilms
119  * are not passed around, instead they are looked up and used under the
120  * ill_lock or as writer. So we don't need a dynamic refcount of the number
121  * of threads holding reference to an ilm.
122  *
123  * Multicast Join operation:
124  *
125  * The first step is to determine the ipif (v4) or ill (v6) on which
126  * the join operation is to be done. The join is done after becoming
127  * exclusive on the ipsq associated with the ipif or ill. The conn->conn_ilg
128  * and ill->ill_ilm are thus accessed and modified exclusively per ill.
129  * Multiple threads can attempt to join simultaneously on different ipif/ill
130  * on the same conn. In this case the ipsq serialization does not help in
131  * protecting the ilg. It is the conn_lock that is used to protect the ilg.
132  * The conn_lock also protects all the ilg_t members.
133  *
134  * Leave operation.
135  *
136  * Similar to the join operation, the first step is to determine the ipif
137  * or ill (v6) on which the leave operation is to be done. The leave operation
138  * is done after becoming exclusive on the ipsq associated with the ipif or ill.
139  * As with join ilg modification is done under the protection of the conn lock.
140  */
141 
142 #define	IPSQ_ENTER_IPIF(ipif, connp, first_mp, func, ipsq, type)	\
143 	ASSERT(connp != NULL);					\
144 	(ipsq) = ipsq_try_enter((ipif), NULL, CONNP_TO_WQ(connp),	\
145 	    (first_mp), (func), (type), B_TRUE);		\
146 	if ((ipsq) == NULL) {					\
147 		ipif_refrele(ipif);				\
148 		return (EINPROGRESS);				\
149 	}
150 
151 #define	IPSQ_ENTER_ILL(ill, connp, first_mp, func, ipsq, type)	\
152 	ASSERT(connp != NULL);					\
153 	(ipsq) = ipsq_try_enter(NULL, ill, CONNP_TO_WQ(connp),	\
154 	    (first_mp),	(func), (type), B_TRUE);		\
155 	if ((ipsq) == NULL) {					\
156 		ill_refrele(ill);				\
157 		return (EINPROGRESS);				\
158 	}
159 
160 #define	IPSQ_EXIT(ipsq)	\
161 	if (ipsq != NULL)	\
162 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
163 
164 #define	ILG_WALKER_HOLD(connp)	(connp)->conn_ilg_walker_cnt++
165 
166 #define	ILG_WALKER_RELE(connp)				\
167 	{						\
168 		(connp)->conn_ilg_walker_cnt--;		\
169 		if ((connp)->conn_ilg_walker_cnt == 0)	\
170 			conn_ilg_reap(connp);		\
171 	}
172 
173 static void
174 conn_ilg_reap(conn_t *connp)
175 {
176 	int	to;
177 	int	from;
178 	ilg_t	*ilg;
179 
180 	ASSERT(MUTEX_HELD(&connp->conn_lock));
181 
182 	to = 0;
183 	from = 0;
184 	while (from < connp->conn_ilg_inuse) {
185 		if (connp->conn_ilg[from].ilg_flags & ILG_DELETED) {
186 			ilg = &connp->conn_ilg[from];
187 			FREE_SLIST(ilg->ilg_filter);
188 			ilg->ilg_flags &= ~ILG_DELETED;
189 			from++;
190 			continue;
191 		}
192 		if (to != from)
193 			connp->conn_ilg[to] = connp->conn_ilg[from];
194 		to++;
195 		from++;
196 	}
197 
198 	connp->conn_ilg_inuse = to;
199 
200 	if (connp->conn_ilg_inuse == 0) {
201 		mi_free((char *)connp->conn_ilg);
202 		connp->conn_ilg = NULL;
203 		cv_broadcast(&connp->conn_refcv);
204 	}
205 }
206 
207 #define	GETSTRUCT(structure, number)	\
208 	((structure *)mi_zalloc(sizeof (structure) * (number)))
209 
210 #define	ILG_ALLOC_CHUNK	16
211 
212 /*
213  * Returns a pointer to the next available ilg in conn_ilg.  Allocs more
214  * buffers in size of ILG_ALLOC_CHUNK ilgs when needed, and updates conn's
215  * ilg tracking fields appropriately (conn_ilg_inuse reflects usage of the
216  * returned ilg).  Returns NULL on failure (ENOMEM).
217  *
218  * Assumes connp->conn_lock is held.
219  */
220 static ilg_t *
221 conn_ilg_alloc(conn_t *connp)
222 {
223 	ilg_t *new, *ret;
224 	int curcnt;
225 
226 	ASSERT(MUTEX_HELD(&connp->conn_lock));
227 	ASSERT(connp->conn_ilg_inuse <= connp->conn_ilg_allocated);
228 
229 	if (connp->conn_ilg == NULL) {
230 		connp->conn_ilg = GETSTRUCT(ilg_t, ILG_ALLOC_CHUNK);
231 		if (connp->conn_ilg == NULL)
232 			return (NULL);
233 		connp->conn_ilg_allocated = ILG_ALLOC_CHUNK;
234 		connp->conn_ilg_inuse = 0;
235 	}
236 	if (connp->conn_ilg_inuse == connp->conn_ilg_allocated) {
237 		if (connp->conn_ilg_walker_cnt != 0) {
238 			/*
239 			 * XXX We cannot grow the array at this point
240 			 * because a list walker could be in progress, and
241 			 * we cannot wipe out the existing array until the
242 			 * walker is done. Just return NULL for now.
243 			 * ilg_delete_all() will have to be changed when
244 			 * this logic is changed.
245 			 */
246 			return (NULL);
247 		}
248 		curcnt = connp->conn_ilg_allocated;
249 		new = GETSTRUCT(ilg_t, curcnt + ILG_ALLOC_CHUNK);
250 		if (new == NULL)
251 			return (NULL);
252 		bcopy(connp->conn_ilg, new, sizeof (ilg_t) * curcnt);
253 		mi_free((char *)connp->conn_ilg);
254 		connp->conn_ilg = new;
255 		connp->conn_ilg_allocated += ILG_ALLOC_CHUNK;
256 	}
257 
258 	ret = &connp->conn_ilg[connp->conn_ilg_inuse++];
259 	ASSERT((ret->ilg_flags & ILG_DELETED) == 0);
260 	bzero(ret, sizeof (*ret));
261 	return (ret);
262 }
263 
264 typedef struct ilm_fbld_s {
265 	ilm_t		*fbld_ilm;
266 	int		fbld_in_cnt;
267 	int		fbld_ex_cnt;
268 	slist_t		fbld_in;
269 	slist_t		fbld_ex;
270 	boolean_t	fbld_in_overflow;
271 } ilm_fbld_t;
272 
273 static void
274 ilm_bld_flists(conn_t *conn, void *arg)
275 {
276 	int i;
277 	ilm_fbld_t *fbld = (ilm_fbld_t *)(arg);
278 	ilm_t *ilm = fbld->fbld_ilm;
279 	in6_addr_t *v6group = &ilm->ilm_v6addr;
280 
281 	if (conn->conn_ilg_inuse == 0)
282 		return;
283 
284 	/*
285 	 * Since we can't break out of the ipcl_walk once started, we still
286 	 * have to look at every conn.  But if we've already found one
287 	 * (EXCLUDE, NULL) list, there's no need to keep checking individual
288 	 * ilgs--that will be our state.
289 	 */
290 	if (fbld->fbld_ex_cnt > 0 && fbld->fbld_ex.sl_numsrc == 0)
291 		return;
292 
293 	/*
294 	 * Check this conn's ilgs to see if any are interested in our
295 	 * ilm (group, interface match).  If so, update the master
296 	 * include and exclude lists we're building in the fbld struct
297 	 * with this ilg's filter info.
298 	 */
299 	mutex_enter(&conn->conn_lock);
300 	for (i = 0; i < conn->conn_ilg_inuse; i++) {
301 		ilg_t *ilg = &conn->conn_ilg[i];
302 		if ((ilg->ilg_ill == ilm->ilm_ill) &&
303 		    (ilg->ilg_ipif == ilm->ilm_ipif) &&
304 		    IN6_ARE_ADDR_EQUAL(&ilg->ilg_v6group, v6group)) {
305 			if (ilg->ilg_fmode == MODE_IS_INCLUDE) {
306 				fbld->fbld_in_cnt++;
307 				if (!fbld->fbld_in_overflow)
308 					l_union_in_a(&fbld->fbld_in,
309 					    ilg->ilg_filter,
310 					    &fbld->fbld_in_overflow);
311 			} else {
312 				fbld->fbld_ex_cnt++;
313 				/*
314 				 * On the first exclude list, don't try to do
315 				 * an intersection, as the master exclude list
316 				 * is intentionally empty.  If the master list
317 				 * is still empty on later iterations, that
318 				 * means we have at least one ilg with an empty
319 				 * exclude list, so that should be reflected
320 				 * when we take the intersection.
321 				 */
322 				if (fbld->fbld_ex_cnt == 1) {
323 					if (ilg->ilg_filter != NULL)
324 						l_copy(ilg->ilg_filter,
325 						    &fbld->fbld_ex);
326 				} else {
327 					l_intersection_in_a(&fbld->fbld_ex,
328 					    ilg->ilg_filter);
329 				}
330 			}
331 			/* there will only be one match, so break now. */
332 			break;
333 		}
334 	}
335 	mutex_exit(&conn->conn_lock);
336 }
337 
338 static void
339 ilm_gen_filter(ilm_t *ilm, mcast_record_t *fmode, slist_t *flist)
340 {
341 	ilm_fbld_t fbld;
342 	ip_stack_t *ipst = ilm->ilm_ipst;
343 
344 	fbld.fbld_ilm = ilm;
345 	fbld.fbld_in_cnt = fbld.fbld_ex_cnt = 0;
346 	fbld.fbld_in.sl_numsrc = fbld.fbld_ex.sl_numsrc = 0;
347 	fbld.fbld_in_overflow = B_FALSE;
348 
349 	/* first, construct our master include and exclude lists */
350 	ipcl_walk(ilm_bld_flists, (caddr_t)&fbld, ipst);
351 
352 	/* now use those master lists to generate the interface filter */
353 
354 	/* if include list overflowed, filter is (EXCLUDE, NULL) */
355 	if (fbld.fbld_in_overflow) {
356 		*fmode = MODE_IS_EXCLUDE;
357 		flist->sl_numsrc = 0;
358 		return;
359 	}
360 
361 	/* if nobody interested, interface filter is (INCLUDE, NULL) */
362 	if (fbld.fbld_in_cnt == 0 && fbld.fbld_ex_cnt == 0) {
363 		*fmode = MODE_IS_INCLUDE;
364 		flist->sl_numsrc = 0;
365 		return;
366 	}
367 
368 	/*
369 	 * If there are no exclude lists, then the interface filter
370 	 * is INCLUDE, with its filter list equal to fbld_in.  A single
371 	 * exclude list makes the interface filter EXCLUDE, with its
372 	 * filter list equal to (fbld_ex - fbld_in).
373 	 */
374 	if (fbld.fbld_ex_cnt == 0) {
375 		*fmode = MODE_IS_INCLUDE;
376 		l_copy(&fbld.fbld_in, flist);
377 	} else {
378 		*fmode = MODE_IS_EXCLUDE;
379 		l_difference(&fbld.fbld_ex, &fbld.fbld_in, flist);
380 	}
381 }
382 
383 /*
384  * If the given interface has failed, choose a new one to join on so
385  * that we continue to receive packets.  ilg_orig_ifindex remembers
386  * what the application used to join on so that we know the ilg to
387  * delete even though we change the ill here.  Callers will store the
388  * ilg returned from this function in ilg_ill.  Thus when we receive
389  * a packet on ilg_ill, conn_wantpacket_v6 will deliver the packets.
390  *
391  * This function must be called as writer so we can walk the group
392  * list and examine flags without holding a lock.
393  */
394 ill_t *
395 ip_choose_multi_ill(ill_t *ill, const in6_addr_t *grp)
396 {
397 	ill_t	*till;
398 	ill_group_t *illgrp = ill->ill_group;
399 
400 	ASSERT(IAM_WRITER_ILL(ill));
401 
402 	if (IN6_IS_ADDR_UNSPECIFIED(grp) || illgrp == NULL)
403 		return (ill);
404 
405 	if ((ill->ill_phyint->phyint_flags & (PHYI_FAILED|PHYI_INACTIVE)) == 0)
406 		return (ill);
407 
408 	till = illgrp->illgrp_ill;
409 	while (till != NULL &&
410 	    (till->ill_phyint->phyint_flags & (PHYI_FAILED|PHYI_INACTIVE))) {
411 		till = till->ill_group_next;
412 	}
413 	if (till != NULL)
414 		return (till);
415 
416 	return (ill);
417 }
418 
419 static int
420 ilm_update_add(ilm_t *ilm, ilg_stat_t ilgstat, slist_t *ilg_flist,
421     boolean_t isv6)
422 {
423 	mcast_record_t fmode;
424 	slist_t *flist;
425 	boolean_t fdefault;
426 	char buf[INET6_ADDRSTRLEN];
427 	ill_t *ill = isv6 ? ilm->ilm_ill : ilm->ilm_ipif->ipif_ill;
428 
429 	/*
430 	 * There are several cases where the ilm's filter state
431 	 * defaults to (EXCLUDE, NULL):
432 	 *	- we've had previous joins without associated ilgs
433 	 *	- this join has no associated ilg
434 	 *	- the ilg's filter state is (EXCLUDE, NULL)
435 	 */
436 	fdefault = (ilm->ilm_no_ilg_cnt > 0) ||
437 	    (ilgstat == ILGSTAT_NONE) || SLIST_IS_EMPTY(ilg_flist);
438 
439 	/* attempt mallocs (if needed) before doing anything else */
440 	if ((flist = l_alloc()) == NULL)
441 		return (ENOMEM);
442 	if (!fdefault && ilm->ilm_filter == NULL) {
443 		ilm->ilm_filter = l_alloc();
444 		if (ilm->ilm_filter == NULL) {
445 			l_free(flist);
446 			return (ENOMEM);
447 		}
448 	}
449 
450 	if (ilgstat != ILGSTAT_CHANGE)
451 		ilm->ilm_refcnt++;
452 
453 	if (ilgstat == ILGSTAT_NONE)
454 		ilm->ilm_no_ilg_cnt++;
455 
456 	/*
457 	 * Determine new filter state.  If it's not the default
458 	 * (EXCLUDE, NULL), we must walk the conn list to find
459 	 * any ilgs interested in this group, and re-build the
460 	 * ilm filter.
461 	 */
462 	if (fdefault) {
463 		fmode = MODE_IS_EXCLUDE;
464 		flist->sl_numsrc = 0;
465 	} else {
466 		ilm_gen_filter(ilm, &fmode, flist);
467 	}
468 
469 	/* make sure state actually changed; nothing to do if not. */
470 	if ((ilm->ilm_fmode == fmode) &&
471 	    !lists_are_different(ilm->ilm_filter, flist)) {
472 		l_free(flist);
473 		return (0);
474 	}
475 
476 	/* send the state change report */
477 	if (!IS_LOOPBACK(ill)) {
478 		if (isv6)
479 			mld_statechange(ilm, fmode, flist);
480 		else
481 			igmp_statechange(ilm, fmode, flist);
482 	}
483 
484 	/* update the ilm state */
485 	ilm->ilm_fmode = fmode;
486 	if (flist->sl_numsrc > 0)
487 		l_copy(flist, ilm->ilm_filter);
488 	else
489 		CLEAR_SLIST(ilm->ilm_filter);
490 
491 	ip1dbg(("ilm_update: new if filter mode %d, group %s\n", ilm->ilm_fmode,
492 	    inet_ntop(AF_INET6, &ilm->ilm_v6addr, buf, sizeof (buf))));
493 
494 	l_free(flist);
495 	return (0);
496 }
497 
498 static int
499 ilm_update_del(ilm_t *ilm, boolean_t isv6)
500 {
501 	mcast_record_t fmode;
502 	slist_t *flist;
503 	ill_t *ill = isv6 ? ilm->ilm_ill : ilm->ilm_ipif->ipif_ill;
504 
505 	ip1dbg(("ilm_update_del: still %d left; updating state\n",
506 	    ilm->ilm_refcnt));
507 
508 	if ((flist = l_alloc()) == NULL)
509 		return (ENOMEM);
510 
511 	/*
512 	 * If present, the ilg in question has already either been
513 	 * updated or removed from our list; so all we need to do
514 	 * now is walk the list to update the ilm filter state.
515 	 *
516 	 * Skip the list walk if we have any no-ilg joins, which
517 	 * cause the filter state to revert to (EXCLUDE, NULL).
518 	 */
519 	if (ilm->ilm_no_ilg_cnt != 0) {
520 		fmode = MODE_IS_EXCLUDE;
521 		flist->sl_numsrc = 0;
522 	} else {
523 		ilm_gen_filter(ilm, &fmode, flist);
524 	}
525 
526 	/* check to see if state needs to be updated */
527 	if ((ilm->ilm_fmode == fmode) &&
528 	    (!lists_are_different(ilm->ilm_filter, flist))) {
529 		l_free(flist);
530 		return (0);
531 	}
532 
533 	if (!IS_LOOPBACK(ill)) {
534 		if (isv6)
535 			mld_statechange(ilm, fmode, flist);
536 		else
537 			igmp_statechange(ilm, fmode, flist);
538 	}
539 
540 	ilm->ilm_fmode = fmode;
541 	if (flist->sl_numsrc > 0) {
542 		if (ilm->ilm_filter == NULL) {
543 			ilm->ilm_filter = l_alloc();
544 			if (ilm->ilm_filter == NULL) {
545 				char buf[INET6_ADDRSTRLEN];
546 				ip1dbg(("ilm_update_del: failed to alloc ilm "
547 				    "filter; no source filtering for %s on %s",
548 				    inet_ntop(AF_INET6, &ilm->ilm_v6addr,
549 				    buf, sizeof (buf)), ill->ill_name));
550 				ilm->ilm_fmode = MODE_IS_EXCLUDE;
551 				l_free(flist);
552 				return (0);
553 			}
554 		}
555 		l_copy(flist, ilm->ilm_filter);
556 	} else {
557 		CLEAR_SLIST(ilm->ilm_filter);
558 	}
559 
560 	l_free(flist);
561 	return (0);
562 }
563 
564 /*
565  * INADDR_ANY means all multicast addresses. This is only used
566  * by the multicast router.
567  * INADDR_ANY is stored as IPv6 unspecified addr.
568  */
569 int
570 ip_addmulti(ipaddr_t group, ipif_t *ipif, ilg_stat_t ilgstat,
571     mcast_record_t ilg_fmode, slist_t *ilg_flist)
572 {
573 	ill_t	*ill = ipif->ipif_ill;
574 	ilm_t 	*ilm;
575 	in6_addr_t v6group;
576 	int	ret;
577 
578 	ASSERT(IAM_WRITER_IPIF(ipif));
579 
580 	if (!CLASSD(group) && group != INADDR_ANY)
581 		return (EINVAL);
582 
583 	/*
584 	 * INADDR_ANY is represented as the IPv6 unspecifed addr.
585 	 */
586 	if (group == INADDR_ANY)
587 		v6group = ipv6_all_zeros;
588 	else
589 		IN6_IPADDR_TO_V4MAPPED(group, &v6group);
590 
591 	mutex_enter(&ill->ill_lock);
592 	ilm = ilm_lookup_ipif(ipif, group);
593 	mutex_exit(&ill->ill_lock);
594 	/*
595 	 * Since we are writer, we know the ilm_flags itself cannot
596 	 * change at this point, and ilm_lookup_ipif would not have
597 	 * returned a DELETED ilm. However, the data path can free
598 	 * ilm->next via ilm_walker_cleanup() so we can safely
599 	 * access anything in ilm except ilm_next (for safe access to
600 	 * ilm_next we'd have  to take the ill_lock).
601 	 */
602 	if (ilm != NULL)
603 		return (ilm_update_add(ilm, ilgstat, ilg_flist, B_FALSE));
604 
605 	/*
606 	 * ilms are associated with ipifs in IPv4. It moves with the
607 	 * ipif if the ipif moves to a new ill when the interface
608 	 * fails. Thus we really don't check whether the ipif_ill
609 	 * has failed like in IPv6. If it has FAILED the ipif
610 	 * will move (daemon will move it) and hence the ilm, if the
611 	 * ipif is not IPIF_NOFAILOVER. For the IPIF_NOFAILOVER ipifs,
612 	 * we continue to receive in the same place even if the
613 	 * interface fails.
614 	 */
615 	ilm = ilm_add_v6(ipif, &v6group, ilgstat, ilg_fmode, ilg_flist,
616 	    ill->ill_phyint->phyint_ifindex, ipif->ipif_zoneid);
617 	if (ilm == NULL)
618 		return (ENOMEM);
619 
620 	if (group == INADDR_ANY) {
621 		/*
622 		 * Check how many ipif's have members in this group -
623 		 * if more then one we should not tell the driver to join
624 		 * this time
625 		 */
626 		if (ilm_numentries_v6(ill, &v6group) > 1)
627 			return (0);
628 		if (ill->ill_group == NULL)
629 			ret = ip_join_allmulti(ipif);
630 		else
631 			ret = ill_nominate_mcast_rcv(ill->ill_group);
632 		if (ret != 0)
633 			ilm_delete(ilm);
634 		return (ret);
635 	}
636 
637 	if (!IS_LOOPBACK(ill))
638 		igmp_joingroup(ilm);
639 
640 	if (ilm_numentries_v6(ill, &v6group) > 1)
641 		return (0);
642 
643 	ret = ip_ll_addmulti_v6(ipif, &v6group);
644 	if (ret != 0)
645 		ilm_delete(ilm);
646 	return (ret);
647 }
648 
649 /*
650  * The unspecified address means all multicast addresses.
651  * This is only used by the multicast router.
652  *
653  * ill identifies the interface to join on; it may not match the
654  * interface requested by the application of a failover has taken
655  * place.  orig_ifindex always identifies the interface requested
656  * by the app.
657  *
658  * ilgstat tells us if there's an ilg associated with this join,
659  * and if so, if it's a new ilg or a change to an existing one.
660  * ilg_fmode and ilg_flist give us the current filter state of
661  * the ilg (and will be EXCLUDE {NULL} in the case of no ilg).
662  */
663 int
664 ip_addmulti_v6(const in6_addr_t *v6group, ill_t *ill, int orig_ifindex,
665     zoneid_t zoneid, ilg_stat_t ilgstat, mcast_record_t ilg_fmode,
666     slist_t *ilg_flist)
667 {
668 	ilm_t	*ilm;
669 	int	ret;
670 
671 	ASSERT(IAM_WRITER_ILL(ill));
672 
673 	if (!IN6_IS_ADDR_MULTICAST(v6group) &&
674 	    !IN6_IS_ADDR_UNSPECIFIED(v6group)) {
675 		return (EINVAL);
676 	}
677 
678 	/*
679 	 * An ilm is uniquely identified by the tuple of (group, ill,
680 	 * orig_ill).  group is the multicast group address, ill is
681 	 * the interface on which it is currently joined, and orig_ill
682 	 * is the interface on which the application requested the
683 	 * join.  orig_ill and ill are the same unless orig_ill has
684 	 * failed over.
685 	 *
686 	 * Both orig_ill and ill are required, which means we may have
687 	 * 2 ilms on an ill for the same group, but with different
688 	 * orig_ills.  These must be kept separate, so that when failback
689 	 * occurs, the appropriate ilms are moved back to their orig_ill
690 	 * without disrupting memberships on the ill to which they had
691 	 * been moved.
692 	 *
693 	 * In order to track orig_ill, we store orig_ifindex in the
694 	 * ilm and ilg.
695 	 */
696 	mutex_enter(&ill->ill_lock);
697 	ilm = ilm_lookup_ill_index_v6(ill, v6group, orig_ifindex, zoneid);
698 	mutex_exit(&ill->ill_lock);
699 	if (ilm != NULL)
700 		return (ilm_update_add(ilm, ilgstat, ilg_flist, B_TRUE));
701 
702 	/*
703 	 * We need to remember where the application really wanted
704 	 * to join. This will be used later if we want to failback
705 	 * to the original interface.
706 	 */
707 	ilm = ilm_add_v6(ill->ill_ipif, v6group, ilgstat, ilg_fmode,
708 	    ilg_flist, orig_ifindex, zoneid);
709 	if (ilm == NULL)
710 		return (ENOMEM);
711 
712 	if (IN6_IS_ADDR_UNSPECIFIED(v6group)) {
713 		/*
714 		 * Check how many ipif's that have members in this group -
715 		 * if more then one we should not tell the driver to join
716 		 * this time
717 		 */
718 		if (ilm_numentries_v6(ill, v6group) > 1)
719 			return (0);
720 		if (ill->ill_group == NULL)
721 			ret = ip_join_allmulti(ill->ill_ipif);
722 		else
723 			ret = ill_nominate_mcast_rcv(ill->ill_group);
724 
725 		if (ret != 0)
726 			ilm_delete(ilm);
727 		return (ret);
728 	}
729 
730 	if (!IS_LOOPBACK(ill))
731 		mld_joingroup(ilm);
732 
733 	/*
734 	 * If we have more then one we should not tell the driver
735 	 * to join this time.
736 	 */
737 	if (ilm_numentries_v6(ill, v6group) > 1)
738 		return (0);
739 
740 	ret = ip_ll_addmulti_v6(ill->ill_ipif, v6group);
741 	if (ret != 0)
742 		ilm_delete(ilm);
743 	return (ret);
744 }
745 
746 /*
747  * Send a multicast request to the driver for enabling multicast reception
748  * for v6groupp address. The caller has already checked whether it is
749  * appropriate to send one or not.
750  */
751 int
752 ip_ll_send_enabmulti_req(ill_t *ill, const in6_addr_t *v6groupp)
753 {
754 	mblk_t	*mp;
755 	uint32_t addrlen, addroff;
756 	char	group_buf[INET6_ADDRSTRLEN];
757 
758 	ASSERT(IAM_WRITER_ILL(ill));
759 
760 	/*
761 	 * Create a AR_ENTRY_SQUERY message with a dl_enabmulti_req tacked
762 	 * on.
763 	 */
764 	mp = ill_create_dl(ill, DL_ENABMULTI_REQ, sizeof (dl_enabmulti_req_t),
765 	    &addrlen, &addroff);
766 	if (!mp)
767 		return (ENOMEM);
768 	if (IN6_IS_ADDR_V4MAPPED(v6groupp)) {
769 		ipaddr_t v4group;
770 
771 		IN6_V4MAPPED_TO_IPADDR(v6groupp, v4group);
772 		/*
773 		 * NOTE!!!
774 		 * The "addroff" passed in here was calculated by
775 		 * ill_create_dl(), and will be used by ill_create_squery()
776 		 * to perform some twisted coding magic. It is the offset
777 		 * into the dl_xxx_req of the hw addr. Here, it will be
778 		 * added to b_wptr - b_rptr to create a magic number that
779 		 * is not an offset into this squery mblk.
780 		 * The actual hardware address will be accessed only in the
781 		 * dl_xxx_req, not in the squery. More importantly,
782 		 * that hardware address can *only* be accessed in this
783 		 * mblk chain by calling mi_offset_param_c(), which uses
784 		 * the magic number in the squery hw offset field to go
785 		 * to the *next* mblk (the dl_xxx_req), subtract the
786 		 * (b_wptr - b_rptr), and find the actual offset into
787 		 * the dl_xxx_req.
788 		 * Any method that depends on using the
789 		 * offset field in the dl_disabmulti_req or squery
790 		 * to find either hardware address will similarly fail.
791 		 *
792 		 * Look in ar_entry_squery() in arp.c to see how this offset
793 		 * is used.
794 		 */
795 		mp = ill_create_squery(ill, v4group, addrlen, addroff, mp);
796 		if (!mp)
797 			return (ENOMEM);
798 		ip1dbg(("ip_ll_send_enabmulti_req: IPv4 putnext %s on %s\n",
799 		    inet_ntop(AF_INET6, v6groupp, group_buf,
800 		    sizeof (group_buf)),
801 		    ill->ill_name));
802 		putnext(ill->ill_rq, mp);
803 	} else {
804 		ip1dbg(("ip_ll_send_enabmulti_req: IPv6 ndp_mcastreq %s on"
805 		    " %s\n",
806 		    inet_ntop(AF_INET6, v6groupp, group_buf,
807 		    sizeof (group_buf)),
808 		    ill->ill_name));
809 		return (ndp_mcastreq(ill, v6groupp, addrlen, addroff, mp));
810 	}
811 	return (0);
812 }
813 
814 /*
815  * Send a multicast request to the driver for enabling multicast
816  * membership for v6group if appropriate.
817  */
818 static int
819 ip_ll_addmulti_v6(ipif_t *ipif, const in6_addr_t *v6groupp)
820 {
821 	ill_t	*ill = ipif->ipif_ill;
822 
823 	ASSERT(IAM_WRITER_IPIF(ipif));
824 
825 	if (ill->ill_net_type != IRE_IF_RESOLVER ||
826 	    ipif->ipif_flags & IPIF_POINTOPOINT) {
827 		ip1dbg(("ip_ll_addmulti_v6: not resolver\n"));
828 		return (0);	/* Must be IRE_IF_NORESOLVER */
829 	}
830 
831 	if (ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST) {
832 		ip1dbg(("ip_ll_addmulti_v6: MULTI_BCAST\n"));
833 		return (0);
834 	}
835 	if (!ill->ill_dl_up) {
836 		/*
837 		 * Nobody there. All multicast addresses will be re-joined
838 		 * when we get the DL_BIND_ACK bringing the interface up.
839 		 */
840 		ip1dbg(("ip_ll_addmulti_v6: nobody up\n"));
841 		return (0);
842 	}
843 	return (ip_ll_send_enabmulti_req(ill, v6groupp));
844 }
845 
846 /*
847  * INADDR_ANY means all multicast addresses. This is only used
848  * by the multicast router.
849  * INADDR_ANY is stored as the IPv6 unspecifed addr.
850  */
851 int
852 ip_delmulti(ipaddr_t group, ipif_t *ipif, boolean_t no_ilg, boolean_t leaving)
853 {
854 	ill_t	*ill = ipif->ipif_ill;
855 	ilm_t *ilm;
856 	in6_addr_t v6group;
857 	int	ret;
858 
859 	ASSERT(IAM_WRITER_IPIF(ipif));
860 
861 	if (!CLASSD(group) && group != INADDR_ANY)
862 		return (EINVAL);
863 
864 	/*
865 	 * INADDR_ANY is represented as the IPv6 unspecifed addr.
866 	 */
867 	if (group == INADDR_ANY)
868 		v6group = ipv6_all_zeros;
869 	else
870 		IN6_IPADDR_TO_V4MAPPED(group, &v6group);
871 
872 	/*
873 	 * Look for a match on the ipif.
874 	 * (IP_DROP_MEMBERSHIP specifies an ipif using an IP address).
875 	 */
876 	mutex_enter(&ill->ill_lock);
877 	ilm = ilm_lookup_ipif(ipif, group);
878 	mutex_exit(&ill->ill_lock);
879 	if (ilm == NULL)
880 		return (ENOENT);
881 
882 	/* Update counters */
883 	if (no_ilg)
884 		ilm->ilm_no_ilg_cnt--;
885 
886 	if (leaving)
887 		ilm->ilm_refcnt--;
888 
889 	if (ilm->ilm_refcnt > 0)
890 		return (ilm_update_del(ilm, B_FALSE));
891 
892 	if (group == INADDR_ANY) {
893 		ilm_delete(ilm);
894 		/*
895 		 * Check how many ipif's that have members in this group -
896 		 * if there are still some left then don't tell the driver
897 		 * to drop it.
898 		 */
899 		if (ilm_numentries_v6(ill, &v6group) != 0)
900 			return (0);
901 
902 		/*
903 		 * If we never joined, then don't leave.  This can happen
904 		 * if we're in an IPMP group, since only one ill per IPMP
905 		 * group receives all multicast packets.
906 		 */
907 		if (!ill->ill_join_allmulti) {
908 			ASSERT(ill->ill_group != NULL);
909 			return (0);
910 		}
911 
912 		ret = ip_leave_allmulti(ipif);
913 		if (ill->ill_group != NULL)
914 			(void) ill_nominate_mcast_rcv(ill->ill_group);
915 		return (ret);
916 	}
917 
918 	if (!IS_LOOPBACK(ill))
919 		igmp_leavegroup(ilm);
920 
921 	ilm_delete(ilm);
922 	/*
923 	 * Check how many ipif's that have members in this group -
924 	 * if there are still some left then don't tell the driver
925 	 * to drop it.
926 	 */
927 	if (ilm_numentries_v6(ill, &v6group) != 0)
928 		return (0);
929 	return (ip_ll_delmulti_v6(ipif, &v6group));
930 }
931 
932 /*
933  * The unspecified address means all multicast addresses.
934  * This is only used by the multicast router.
935  */
936 int
937 ip_delmulti_v6(const in6_addr_t *v6group, ill_t *ill, int orig_ifindex,
938     zoneid_t zoneid, boolean_t no_ilg, boolean_t leaving)
939 {
940 	ipif_t	*ipif;
941 	ilm_t *ilm;
942 	int	ret;
943 
944 	ASSERT(IAM_WRITER_ILL(ill));
945 
946 	if (!IN6_IS_ADDR_MULTICAST(v6group) &&
947 	    !IN6_IS_ADDR_UNSPECIFIED(v6group))
948 		return (EINVAL);
949 
950 	/*
951 	 * Look for a match on the ill.
952 	 * (IPV6_LEAVE_GROUP specifies an ill using an ifindex).
953 	 *
954 	 * Similar to ip_addmulti_v6, we should always look using
955 	 * the orig_ifindex.
956 	 *
957 	 * 1) If orig_ifindex is different from ill's ifindex
958 	 *    we should have an ilm with orig_ifindex created in
959 	 *    ip_addmulti_v6. We should delete that here.
960 	 *
961 	 * 2) If orig_ifindex is same as ill's ifindex, we should
962 	 *    not delete the ilm that is temporarily here because of
963 	 *    a FAILOVER. Those ilms will have a ilm_orig_ifindex
964 	 *    different from ill's ifindex.
965 	 *
966 	 * Thus, always lookup using orig_ifindex.
967 	 */
968 	mutex_enter(&ill->ill_lock);
969 	ilm = ilm_lookup_ill_index_v6(ill, v6group, orig_ifindex, zoneid);
970 	mutex_exit(&ill->ill_lock);
971 	if (ilm == NULL)
972 		return (ENOENT);
973 
974 	ASSERT(ilm->ilm_ill == ill);
975 
976 	ipif = ill->ill_ipif;
977 
978 	/* Update counters */
979 	if (no_ilg)
980 		ilm->ilm_no_ilg_cnt--;
981 
982 	if (leaving)
983 		ilm->ilm_refcnt--;
984 
985 	if (ilm->ilm_refcnt > 0)
986 		return (ilm_update_del(ilm, B_TRUE));
987 
988 	if (IN6_IS_ADDR_UNSPECIFIED(v6group)) {
989 		ilm_delete(ilm);
990 		/*
991 		 * Check how many ipif's that have members in this group -
992 		 * if there are still some left then don't tell the driver
993 		 * to drop it.
994 		 */
995 		if (ilm_numentries_v6(ill, v6group) != 0)
996 			return (0);
997 
998 		/*
999 		 * If we never joined, then don't leave.  This can happen
1000 		 * if we're in an IPMP group, since only one ill per IPMP
1001 		 * group receives all multicast packets.
1002 		 */
1003 		if (!ill->ill_join_allmulti) {
1004 			ASSERT(ill->ill_group != NULL);
1005 			return (0);
1006 		}
1007 
1008 		ret = ip_leave_allmulti(ipif);
1009 		if (ill->ill_group != NULL)
1010 			(void) ill_nominate_mcast_rcv(ill->ill_group);
1011 		return (ret);
1012 	}
1013 
1014 	if (!IS_LOOPBACK(ill))
1015 		mld_leavegroup(ilm);
1016 
1017 	ilm_delete(ilm);
1018 	/*
1019 	 * Check how many ipif's that have members in this group -
1020 	 * if there are still some left then don't tell the driver
1021 	 * to drop it.
1022 	 */
1023 	if (ilm_numentries_v6(ill, v6group) != 0)
1024 		return (0);
1025 	return (ip_ll_delmulti_v6(ipif, v6group));
1026 }
1027 
1028 /*
1029  * Send a multicast request to the driver for disabling multicast reception
1030  * for v6groupp address. The caller has already checked whether it is
1031  * appropriate to send one or not.
1032  */
1033 int
1034 ip_ll_send_disabmulti_req(ill_t *ill, const in6_addr_t *v6groupp)
1035 {
1036 	mblk_t	*mp;
1037 	char	group_buf[INET6_ADDRSTRLEN];
1038 	uint32_t	addrlen, addroff;
1039 
1040 	ASSERT(IAM_WRITER_ILL(ill));
1041 	/*
1042 	 * Create a AR_ENTRY_SQUERY message with a dl_disabmulti_req tacked
1043 	 * on.
1044 	 */
1045 	mp = ill_create_dl(ill, DL_DISABMULTI_REQ,
1046 	    sizeof (dl_disabmulti_req_t), &addrlen, &addroff);
1047 
1048 	if (!mp)
1049 		return (ENOMEM);
1050 
1051 	if (IN6_IS_ADDR_V4MAPPED(v6groupp)) {
1052 		ipaddr_t v4group;
1053 
1054 		IN6_V4MAPPED_TO_IPADDR(v6groupp, v4group);
1055 		/*
1056 		 * NOTE!!!
1057 		 * The "addroff" passed in here was calculated by
1058 		 * ill_create_dl(), and will be used by ill_create_squery()
1059 		 * to perform some twisted coding magic. It is the offset
1060 		 * into the dl_xxx_req of the hw addr. Here, it will be
1061 		 * added to b_wptr - b_rptr to create a magic number that
1062 		 * is not an offset into this mblk.
1063 		 *
1064 		 * Please see the comment in ip_ll_send)enabmulti_req()
1065 		 * for a complete explanation.
1066 		 *
1067 		 * Look in ar_entry_squery() in arp.c to see how this offset
1068 		 * is used.
1069 		 */
1070 		mp = ill_create_squery(ill, v4group, addrlen, addroff, mp);
1071 		if (!mp)
1072 			return (ENOMEM);
1073 		ip1dbg(("ip_ll_send_disabmulti_req: IPv4 putnext %s on %s\n",
1074 		    inet_ntop(AF_INET6, v6groupp, group_buf,
1075 		    sizeof (group_buf)),
1076 		    ill->ill_name));
1077 		putnext(ill->ill_rq, mp);
1078 	} else {
1079 		ip1dbg(("ip_ll_send_disabmulti_req: IPv6 ndp_mcastreq %s on"
1080 		    " %s\n",
1081 		    inet_ntop(AF_INET6, v6groupp, group_buf,
1082 		    sizeof (group_buf)),
1083 		    ill->ill_name));
1084 		return (ndp_mcastreq(ill, v6groupp, addrlen, addroff, mp));
1085 	}
1086 	return (0);
1087 }
1088 
1089 /*
1090  * Send a multicast request to the driver for disabling multicast
1091  * membership for v6group if appropriate.
1092  */
1093 static int
1094 ip_ll_delmulti_v6(ipif_t *ipif, const in6_addr_t *v6group)
1095 {
1096 	ill_t	*ill = ipif->ipif_ill;
1097 
1098 	ASSERT(IAM_WRITER_IPIF(ipif));
1099 
1100 	if (ill->ill_net_type != IRE_IF_RESOLVER ||
1101 	    ipif->ipif_flags & IPIF_POINTOPOINT) {
1102 		return (0);	/* Must be IRE_IF_NORESOLVER */
1103 	}
1104 	if (ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST) {
1105 		ip1dbg(("ip_ll_delmulti_v6: MULTI_BCAST\n"));
1106 		return (0);
1107 	}
1108 	if (!ill->ill_dl_up) {
1109 		/*
1110 		 * Nobody there. All multicast addresses will be re-joined
1111 		 * when we get the DL_BIND_ACK bringing the interface up.
1112 		 */
1113 		ip1dbg(("ip_ll_delmulti_v6: nobody up\n"));
1114 		return (0);
1115 	}
1116 	return (ip_ll_send_disabmulti_req(ill, v6group));
1117 }
1118 
1119 /*
1120  * Make the driver pass up all multicast packets
1121  *
1122  * With ill groups, the caller makes sure that there is only
1123  * one ill joining the allmulti group.
1124  */
1125 int
1126 ip_join_allmulti(ipif_t *ipif)
1127 {
1128 	ill_t	*ill = ipif->ipif_ill;
1129 	mblk_t	*mp;
1130 	uint32_t	addrlen, addroff;
1131 
1132 	ASSERT(IAM_WRITER_IPIF(ipif));
1133 
1134 	if (!ill->ill_dl_up) {
1135 		/*
1136 		 * Nobody there. All multicast addresses will be re-joined
1137 		 * when we get the DL_BIND_ACK bringing the interface up.
1138 		 */
1139 		return (0);
1140 	}
1141 
1142 	ASSERT(!ill->ill_join_allmulti);
1143 
1144 	/*
1145 	 * Create a DL_PROMISCON_REQ message and send it directly to
1146 	 * the DLPI provider.  We don't need to do this for certain
1147 	 * media types for which we never need to turn promiscuous
1148 	 * mode on.
1149 	 */
1150 	if ((ill->ill_net_type == IRE_IF_RESOLVER) &&
1151 	    !(ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST)) {
1152 		mp = ill_create_dl(ill, DL_PROMISCON_REQ,
1153 		    sizeof (dl_promiscon_req_t), &addrlen, &addroff);
1154 		if (mp == NULL)
1155 			return (ENOMEM);
1156 		ill_dlpi_send(ill, mp);
1157 	}
1158 
1159 	ill->ill_join_allmulti = B_TRUE;
1160 	return (0);
1161 }
1162 
1163 /*
1164  * Make the driver stop passing up all multicast packets
1165  *
1166  * With ill groups, we need to nominate some other ill as
1167  * this ipif->ipif_ill is leaving the group.
1168  */
1169 int
1170 ip_leave_allmulti(ipif_t *ipif)
1171 {
1172 	ill_t	*ill = ipif->ipif_ill;
1173 	mblk_t	*mp;
1174 	uint32_t	addrlen, addroff;
1175 
1176 	ASSERT(IAM_WRITER_IPIF(ipif));
1177 
1178 	if (!ill->ill_dl_up) {
1179 		/*
1180 		 * Nobody there. All multicast addresses will be re-joined
1181 		 * when we get the DL_BIND_ACK bringing the interface up.
1182 		 */
1183 		return (0);
1184 	}
1185 
1186 	ASSERT(ill->ill_join_allmulti);
1187 
1188 	/*
1189 	 * Create a DL_PROMISCOFF_REQ message and send it directly to
1190 	 * the DLPI provider.  We don't need to do this for certain
1191 	 * media types for which we never need to turn promiscuous
1192 	 * mode on.
1193 	 */
1194 	if ((ill->ill_net_type == IRE_IF_RESOLVER) &&
1195 	    !(ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST)) {
1196 		mp = ill_create_dl(ill, DL_PROMISCOFF_REQ,
1197 		    sizeof (dl_promiscoff_req_t), &addrlen, &addroff);
1198 		if (mp == NULL)
1199 			return (ENOMEM);
1200 		ill_dlpi_send(ill, mp);
1201 	}
1202 
1203 	ill->ill_join_allmulti = B_FALSE;
1204 	return (0);
1205 }
1206 
1207 /*
1208  * Copy mp_orig and pass it in as a local message.
1209  */
1210 void
1211 ip_multicast_loopback(queue_t *q, ill_t *ill, mblk_t *mp_orig, int fanout_flags,
1212     zoneid_t zoneid)
1213 {
1214 	mblk_t	*mp;
1215 	mblk_t	*ipsec_mp;
1216 	ipha_t	*iph;
1217 	ip_stack_t *ipst = ill->ill_ipst;
1218 
1219 	if (DB_TYPE(mp_orig) == M_DATA &&
1220 	    ((ipha_t *)mp_orig->b_rptr)->ipha_protocol == IPPROTO_UDP) {
1221 		uint_t hdrsz;
1222 
1223 		hdrsz = IPH_HDR_LENGTH((ipha_t *)mp_orig->b_rptr) +
1224 		    sizeof (udpha_t);
1225 		ASSERT(MBLKL(mp_orig) >= hdrsz);
1226 
1227 		if (((mp = allocb(hdrsz, BPRI_MED)) != NULL) &&
1228 		    (mp_orig = dupmsg(mp_orig)) != NULL) {
1229 			bcopy(mp_orig->b_rptr, mp->b_rptr, hdrsz);
1230 			mp->b_wptr += hdrsz;
1231 			mp->b_cont = mp_orig;
1232 			mp_orig->b_rptr += hdrsz;
1233 			if (is_system_labeled() && DB_CRED(mp_orig) != NULL)
1234 				mblk_setcred(mp, DB_CRED(mp_orig));
1235 			if (MBLKL(mp_orig) == 0) {
1236 				mp->b_cont = mp_orig->b_cont;
1237 				mp_orig->b_cont = NULL;
1238 				freeb(mp_orig);
1239 			}
1240 		} else if (mp != NULL) {
1241 			freeb(mp);
1242 			mp = NULL;
1243 		}
1244 	} else {
1245 		mp = ip_copymsg(mp_orig); /* No refcnt on ipsec_out netstack */
1246 	}
1247 
1248 	if (mp == NULL)
1249 		return;
1250 	if (DB_TYPE(mp) == M_CTL) {
1251 		ipsec_mp = mp;
1252 		mp = mp->b_cont;
1253 	} else {
1254 		ipsec_mp = mp;
1255 	}
1256 
1257 	iph = (ipha_t *)mp->b_rptr;
1258 
1259 	DTRACE_PROBE4(ip4__loopback__out__start,
1260 	    ill_t *, NULL, ill_t *, ill,
1261 	    ipha_t *, iph, mblk_t *, ipsec_mp);
1262 
1263 	FW_HOOKS(ipst->ips_ip4_loopback_out_event,
1264 	    ipst->ips_ipv4firewall_loopback_out,
1265 	    NULL, ill, iph, ipsec_mp, mp, HPE_MULTICAST, ipst);
1266 
1267 	DTRACE_PROBE1(ip4__loopback__out__end, mblk_t *, ipsec_mp);
1268 
1269 	if (ipsec_mp != NULL)
1270 		ip_wput_local(q, ill, iph, ipsec_mp, NULL,
1271 		    fanout_flags, zoneid);
1272 }
1273 
1274 static area_t	ip_aresq_template = {
1275 	AR_ENTRY_SQUERY,		/* cmd */
1276 	sizeof (area_t)+IP_ADDR_LEN,	/* name offset */
1277 	sizeof (area_t),	/* name len (filled by ill_arp_alloc) */
1278 	IP_ARP_PROTO_TYPE,		/* protocol, from arps perspective */
1279 	sizeof (area_t),			/* proto addr offset */
1280 	IP_ADDR_LEN,			/* proto addr_length */
1281 	0,				/* proto mask offset */
1282 	/* Rest is initialized when used */
1283 	0,				/* flags */
1284 	0,				/* hw addr offset */
1285 	0,				/* hw addr length */
1286 };
1287 
1288 static mblk_t *
1289 ill_create_squery(ill_t *ill, ipaddr_t ipaddr, uint32_t addrlen,
1290     uint32_t addroff, mblk_t *mp_tail)
1291 {
1292 	mblk_t	*mp;
1293 	area_t	*area;
1294 
1295 	mp = ill_arp_alloc(ill, (uchar_t *)&ip_aresq_template,
1296 	    (caddr_t)&ipaddr);
1297 	if (!mp) {
1298 		freemsg(mp_tail);
1299 		return (NULL);
1300 	}
1301 	area = (area_t *)mp->b_rptr;
1302 	area->area_hw_addr_length = addrlen;
1303 	area->area_hw_addr_offset = mp->b_wptr - mp->b_rptr + addroff;
1304 	/*
1305 	 * NOTE!
1306 	 *
1307 	 * The area_hw_addr_offset, as can be seen, does not hold the
1308 	 * actual hardware address offset. Rather, it holds the offset
1309 	 * to the hw addr in the dl_xxx_req in mp_tail, modified by
1310 	 * adding (mp->b_wptr - mp->b_rptr). This allows the function
1311 	 * mi_offset_paramc() to find the hardware address in the
1312 	 * *second* mblk (dl_xxx_req), not this mblk.
1313 	 *
1314 	 * Using mi_offset_paramc() is thus the *only* way to access
1315 	 * the dl_xxx_hw address.
1316 	 *
1317 	 * The squery hw address should *not* be accessed.
1318 	 *
1319 	 * See ar_entry_squery() in arp.c for an example of how all this works.
1320 	 */
1321 
1322 	mp->b_cont = mp_tail;
1323 	return (mp);
1324 }
1325 
1326 /*
1327  * Create a dlpi message with room for phys+sap. When we come back in
1328  * ip_wput_ctl() we will strip the sap for those primitives which
1329  * only need a physical address.
1330  */
1331 static mblk_t *
1332 ill_create_dl(ill_t *ill, uint32_t dl_primitive, uint32_t length,
1333     uint32_t *addr_lenp, uint32_t *addr_offp)
1334 {
1335 	mblk_t	*mp;
1336 	uint32_t	hw_addr_length;
1337 	char		*cp;
1338 	uint32_t	offset;
1339 	uint32_t 	size;
1340 
1341 	*addr_lenp = *addr_offp = 0;
1342 
1343 	hw_addr_length = ill->ill_phys_addr_length;
1344 	if (!hw_addr_length) {
1345 		ip0dbg(("ip_create_dl: hw addr length = 0\n"));
1346 		return (NULL);
1347 	}
1348 
1349 	size = length;
1350 	switch (dl_primitive) {
1351 	case DL_ENABMULTI_REQ:
1352 	case DL_DISABMULTI_REQ:
1353 		size += hw_addr_length;
1354 		break;
1355 	case DL_PROMISCON_REQ:
1356 	case DL_PROMISCOFF_REQ:
1357 		break;
1358 	default:
1359 		return (NULL);
1360 	}
1361 	mp = allocb(size, BPRI_HI);
1362 	if (!mp)
1363 		return (NULL);
1364 	mp->b_wptr += size;
1365 	mp->b_datap->db_type = M_PROTO;
1366 
1367 	cp = (char *)mp->b_rptr;
1368 	offset = length;
1369 
1370 	switch (dl_primitive) {
1371 	case DL_ENABMULTI_REQ: {
1372 		dl_enabmulti_req_t *dl = (dl_enabmulti_req_t *)cp;
1373 
1374 		dl->dl_primitive = dl_primitive;
1375 		dl->dl_addr_offset = offset;
1376 		*addr_lenp = dl->dl_addr_length = hw_addr_length;
1377 		*addr_offp = offset;
1378 		break;
1379 	}
1380 	case DL_DISABMULTI_REQ: {
1381 		dl_disabmulti_req_t *dl = (dl_disabmulti_req_t *)cp;
1382 
1383 		dl->dl_primitive = dl_primitive;
1384 		dl->dl_addr_offset = offset;
1385 		*addr_lenp = dl->dl_addr_length = hw_addr_length;
1386 		*addr_offp = offset;
1387 		break;
1388 	}
1389 	case DL_PROMISCON_REQ:
1390 	case DL_PROMISCOFF_REQ: {
1391 		dl_promiscon_req_t *dl = (dl_promiscon_req_t *)cp;
1392 
1393 		dl->dl_primitive = dl_primitive;
1394 		dl->dl_level = DL_PROMISC_MULTI;
1395 		break;
1396 	}
1397 	}
1398 	ip1dbg(("ill_create_dl: addr_len %d, addr_off %d\n",
1399 	    *addr_lenp, *addr_offp));
1400 	return (mp);
1401 }
1402 
1403 void
1404 ip_wput_ctl(queue_t *q, mblk_t *mp_orig)
1405 {
1406 	ill_t	*ill = (ill_t *)q->q_ptr;
1407 	mblk_t	*mp = mp_orig;
1408 	area_t	*area = (area_t *)mp->b_rptr;
1409 
1410 	/* Check that we have a AR_ENTRY_SQUERY with a tacked on mblk */
1411 	if (MBLKL(mp) < sizeof (area_t) || mp->b_cont == NULL ||
1412 	    area->area_cmd != AR_ENTRY_SQUERY) {
1413 		putnext(q, mp);
1414 		return;
1415 	}
1416 	mp = mp->b_cont;
1417 
1418 	/*
1419 	 * Update dl_addr_length and dl_addr_offset for primitives that
1420 	 * have physical addresses as opposed to full saps
1421 	 */
1422 	switch (((union DL_primitives *)mp->b_rptr)->dl_primitive) {
1423 	case DL_ENABMULTI_REQ:
1424 		/* Track the state if this is the first enabmulti */
1425 		if (ill->ill_dlpi_multicast_state == IDS_UNKNOWN)
1426 			ill->ill_dlpi_multicast_state = IDS_INPROGRESS;
1427 		ip1dbg(("ip_wput_ctl: ENABMULTI\n"));
1428 		break;
1429 	case DL_DISABMULTI_REQ:
1430 		ip1dbg(("ip_wput_ctl: DISABMULTI\n"));
1431 		break;
1432 	default:
1433 		ip1dbg(("ip_wput_ctl: default\n"));
1434 		break;
1435 	}
1436 	freeb(mp_orig);
1437 	ill_dlpi_send(ill, mp);
1438 }
1439 
1440 /*
1441  * Rejoin any groups which have been explicitly joined by the application (we
1442  * left all explicitly joined groups as part of ill_leave_multicast() prior to
1443  * bringing the interface down).  Note that because groups can be joined and
1444  * left while an interface is down, this may not be the same set of groups
1445  * that we left in ill_leave_multicast().
1446  */
1447 void
1448 ill_recover_multicast(ill_t *ill)
1449 {
1450 	ilm_t	*ilm;
1451 	char    addrbuf[INET6_ADDRSTRLEN];
1452 
1453 	ASSERT(IAM_WRITER_ILL(ill));
1454 	ILM_WALKER_HOLD(ill);
1455 	for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
1456 		/*
1457 		 * Check how many ipif's that have members in this group -
1458 		 * if more then one we make sure that this entry is first
1459 		 * in the list.
1460 		 */
1461 		if (ilm_numentries_v6(ill, &ilm->ilm_v6addr) > 1 &&
1462 		    ilm_lookup_ill_v6(ill, &ilm->ilm_v6addr, ALL_ZONES) != ilm)
1463 			continue;
1464 		ip1dbg(("ill_recover_multicast: %s\n",
1465 		    inet_ntop(AF_INET6, &ilm->ilm_v6addr, addrbuf,
1466 		    sizeof (addrbuf))));
1467 		if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
1468 			if (ill->ill_group == NULL) {
1469 				(void) ip_join_allmulti(ill->ill_ipif);
1470 			} else {
1471 				/*
1472 				 * We don't want to join on this ill,
1473 				 * if somebody else in the group has
1474 				 * already been nominated.
1475 				 */
1476 				(void) ill_nominate_mcast_rcv(ill->ill_group);
1477 			}
1478 		} else {
1479 			(void) ip_ll_addmulti_v6(ill->ill_ipif,
1480 			    &ilm->ilm_v6addr);
1481 		}
1482 	}
1483 	ILM_WALKER_RELE(ill);
1484 }
1485 
1486 /*
1487  * The opposite of ill_recover_multicast() -- leaves all multicast groups
1488  * that were explicitly joined.  Note that both these functions could be
1489  * disposed of if we enhanced ARP to allow us to handle DL_DISABMULTI_REQ
1490  * and DL_ENABMULTI_REQ messages when an interface is down.
1491  */
1492 void
1493 ill_leave_multicast(ill_t *ill)
1494 {
1495 	ilm_t	*ilm;
1496 	char    addrbuf[INET6_ADDRSTRLEN];
1497 
1498 	ASSERT(IAM_WRITER_ILL(ill));
1499 	ILM_WALKER_HOLD(ill);
1500 	for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
1501 		/*
1502 		 * Check how many ipif's that have members in this group -
1503 		 * if more then one we make sure that this entry is first
1504 		 * in the list.
1505 		 */
1506 		if (ilm_numentries_v6(ill, &ilm->ilm_v6addr) > 1 &&
1507 		    ilm_lookup_ill_v6(ill, &ilm->ilm_v6addr, ALL_ZONES) != ilm)
1508 			continue;
1509 		ip1dbg(("ill_leave_multicast: %s\n",
1510 		    inet_ntop(AF_INET6, &ilm->ilm_v6addr, addrbuf,
1511 		    sizeof (addrbuf))));
1512 		if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
1513 			(void) ip_leave_allmulti(ill->ill_ipif);
1514 			/*
1515 			 * If we were part of an IPMP group, then
1516 			 * ill_handoff_responsibility() has already
1517 			 * nominated a new member (so we don't).
1518 			 */
1519 			ASSERT(ill->ill_group == NULL);
1520 		} else {
1521 			(void) ip_ll_delmulti_v6(ill->ill_ipif,
1522 			    &ilm->ilm_v6addr);
1523 		}
1524 	}
1525 	ILM_WALKER_RELE(ill);
1526 }
1527 
1528 /* Find an ilm for matching the ill */
1529 ilm_t *
1530 ilm_lookup_ill(ill_t *ill, ipaddr_t group, zoneid_t zoneid)
1531 {
1532 	in6_addr_t	v6group;
1533 
1534 	ASSERT(ill->ill_ilm_walker_cnt != 0 || MUTEX_HELD(&ill->ill_lock));
1535 	/*
1536 	 * INADDR_ANY is represented as the IPv6 unspecifed addr.
1537 	 */
1538 	if (group == INADDR_ANY)
1539 		v6group = ipv6_all_zeros;
1540 	else
1541 		IN6_IPADDR_TO_V4MAPPED(group, &v6group);
1542 
1543 	return (ilm_lookup_ill_v6(ill, &v6group, zoneid));
1544 }
1545 
1546 /*
1547  * Find an ilm for matching the ill. All the ilm lookup functions
1548  * ignore ILM_DELETED ilms. These have been logically deleted, and
1549  * igmp and linklayer disable multicast have been done. Only mi_free
1550  * yet to be done. Still there in the list due to ilm_walkers. The
1551  * last walker will release it.
1552  */
1553 ilm_t *
1554 ilm_lookup_ill_v6(ill_t *ill, const in6_addr_t *v6group, zoneid_t zoneid)
1555 {
1556 	ilm_t	*ilm;
1557 
1558 	ASSERT(ill->ill_ilm_walker_cnt != 0 || MUTEX_HELD(&ill->ill_lock));
1559 
1560 	for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
1561 		if (ilm->ilm_flags & ILM_DELETED)
1562 			continue;
1563 		if (IN6_ARE_ADDR_EQUAL(&ilm->ilm_v6addr, v6group) &&
1564 		    (zoneid == ALL_ZONES || zoneid == ilm->ilm_zoneid))
1565 			return (ilm);
1566 	}
1567 	return (NULL);
1568 }
1569 
1570 ilm_t *
1571 ilm_lookup_ill_index_v6(ill_t *ill, const in6_addr_t *v6group, int index,
1572     zoneid_t zoneid)
1573 {
1574 	ilm_t *ilm;
1575 
1576 	ASSERT(ill->ill_ilm_walker_cnt != 0 || MUTEX_HELD(&ill->ill_lock));
1577 
1578 	for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
1579 		if (ilm->ilm_flags & ILM_DELETED)
1580 			continue;
1581 		if (IN6_ARE_ADDR_EQUAL(&ilm->ilm_v6addr, v6group) &&
1582 		    (zoneid == ALL_ZONES || zoneid == ilm->ilm_zoneid) &&
1583 		    ilm->ilm_orig_ifindex == index) {
1584 			return (ilm);
1585 		}
1586 	}
1587 	return (NULL);
1588 }
1589 
1590 
1591 /*
1592  * Found an ilm for the ipif. Only needed for IPv4 which does
1593  * ipif specific socket options.
1594  */
1595 ilm_t *
1596 ilm_lookup_ipif(ipif_t *ipif, ipaddr_t group)
1597 {
1598 	ill_t	*ill = ipif->ipif_ill;
1599 	ilm_t	*ilm;
1600 	in6_addr_t	v6group;
1601 
1602 	ASSERT(ill->ill_ilm_walker_cnt != 0 || MUTEX_HELD(&ill->ill_lock));
1603 	/*
1604 	 * INADDR_ANY is represented as the IPv6 unspecifed addr.
1605 	 */
1606 	if (group == INADDR_ANY)
1607 		v6group = ipv6_all_zeros;
1608 	else
1609 		IN6_IPADDR_TO_V4MAPPED(group, &v6group);
1610 
1611 	for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
1612 		if (ilm->ilm_flags & ILM_DELETED)
1613 			continue;
1614 		if (ilm->ilm_ipif == ipif &&
1615 		    IN6_ARE_ADDR_EQUAL(&ilm->ilm_v6addr, &v6group))
1616 			return (ilm);
1617 	}
1618 	return (NULL);
1619 }
1620 
1621 /*
1622  * How many members on this ill?
1623  */
1624 int
1625 ilm_numentries_v6(ill_t *ill, const in6_addr_t *v6group)
1626 {
1627 	ilm_t	*ilm;
1628 	int i = 0;
1629 
1630 	mutex_enter(&ill->ill_lock);
1631 	for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
1632 		if (ilm->ilm_flags & ILM_DELETED)
1633 			continue;
1634 		if (IN6_ARE_ADDR_EQUAL(&ilm->ilm_v6addr, v6group)) {
1635 			i++;
1636 		}
1637 	}
1638 	mutex_exit(&ill->ill_lock);
1639 	return (i);
1640 }
1641 
1642 /* Caller guarantees that the group is not already on the list */
1643 static ilm_t *
1644 ilm_add_v6(ipif_t *ipif, const in6_addr_t *v6group, ilg_stat_t ilgstat,
1645     mcast_record_t ilg_fmode, slist_t *ilg_flist, int orig_ifindex,
1646     zoneid_t zoneid)
1647 {
1648 	ill_t	*ill = ipif->ipif_ill;
1649 	ilm_t	*ilm;
1650 	ilm_t	*ilm_cur;
1651 	ilm_t	**ilm_ptpn;
1652 
1653 	ASSERT(IAM_WRITER_IPIF(ipif));
1654 
1655 	ilm = GETSTRUCT(ilm_t, 1);
1656 	if (ilm == NULL)
1657 		return (NULL);
1658 	if (ilgstat != ILGSTAT_NONE && !SLIST_IS_EMPTY(ilg_flist)) {
1659 		ilm->ilm_filter = l_alloc();
1660 		if (ilm->ilm_filter == NULL) {
1661 			mi_free(ilm);
1662 			return (NULL);
1663 		}
1664 	}
1665 	ilm->ilm_v6addr = *v6group;
1666 	ilm->ilm_refcnt = 1;
1667 	ilm->ilm_zoneid = zoneid;
1668 	ilm->ilm_timer = INFINITY;
1669 	ilm->ilm_rtx.rtx_timer = INFINITY;
1670 
1671 	/*
1672 	 * IPv4 Multicast groups are joined using ipif.
1673 	 * IPv6 Multicast groups are joined using ill.
1674 	 */
1675 	if (ill->ill_isv6) {
1676 		ilm->ilm_ill = ill;
1677 		ilm->ilm_ipif = NULL;
1678 		DTRACE_PROBE3(ill__incr__cnt, (ill_t *), ill,
1679 		    (char *), "ilm", (void *), ilm);
1680 		ill->ill_ilm_cnt++;
1681 	} else {
1682 		ASSERT(ilm->ilm_zoneid == ipif->ipif_zoneid);
1683 		ilm->ilm_ipif = ipif;
1684 		ilm->ilm_ill = NULL;
1685 		DTRACE_PROBE3(ipif__incr__cnt, (ipif_t *), ipif,
1686 		    (char *), "ilm", (void *), ilm);
1687 		ipif->ipif_ilm_cnt++;
1688 	}
1689 	ASSERT(ill->ill_ipst);
1690 	ilm->ilm_ipst = ill->ill_ipst;	/* No netstack_hold */
1691 
1692 	/*
1693 	 * After this if ilm moves to a new ill, we don't change
1694 	 * the ilm_orig_ifindex. Thus, if ill_index != ilm_orig_ifindex,
1695 	 * it has been moved. Indexes don't match even when the application
1696 	 * wants to join on a FAILED/INACTIVE interface because we choose
1697 	 * a new interface to join in. This is considered as an implicit
1698 	 * move.
1699 	 */
1700 	ilm->ilm_orig_ifindex = orig_ifindex;
1701 
1702 	ASSERT(!(ipif->ipif_state_flags & IPIF_CONDEMNED));
1703 	ASSERT(!(ill->ill_state_flags & ILL_CONDEMNED));
1704 
1705 	/*
1706 	 * Grab lock to give consistent view to readers
1707 	 */
1708 	mutex_enter(&ill->ill_lock);
1709 	/*
1710 	 * All ilms in the same zone are contiguous in the ill_ilm list.
1711 	 * The loops in ip_proto_input() and ip_wput_local() use this to avoid
1712 	 * sending duplicates up when two applications in the same zone join the
1713 	 * same group on different logical interfaces.
1714 	 */
1715 	ilm_cur = ill->ill_ilm;
1716 	ilm_ptpn = &ill->ill_ilm;
1717 	while (ilm_cur != NULL && ilm_cur->ilm_zoneid != ilm->ilm_zoneid) {
1718 		ilm_ptpn = &ilm_cur->ilm_next;
1719 		ilm_cur = ilm_cur->ilm_next;
1720 	}
1721 	ilm->ilm_next = ilm_cur;
1722 	*ilm_ptpn = ilm;
1723 
1724 	/*
1725 	 * If we have an associated ilg, use its filter state; if not,
1726 	 * default to (EXCLUDE, NULL) and set no_ilg_cnt to track this.
1727 	 */
1728 	if (ilgstat != ILGSTAT_NONE) {
1729 		if (!SLIST_IS_EMPTY(ilg_flist))
1730 			l_copy(ilg_flist, ilm->ilm_filter);
1731 		ilm->ilm_fmode = ilg_fmode;
1732 	} else {
1733 		ilm->ilm_no_ilg_cnt = 1;
1734 		ilm->ilm_fmode = MODE_IS_EXCLUDE;
1735 	}
1736 
1737 	mutex_exit(&ill->ill_lock);
1738 	return (ilm);
1739 }
1740 
1741 static void
1742 ilm_inactive(ilm_t *ilm)
1743 {
1744 	FREE_SLIST(ilm->ilm_filter);
1745 	FREE_SLIST(ilm->ilm_pendsrcs);
1746 	FREE_SLIST(ilm->ilm_rtx.rtx_allow);
1747 	FREE_SLIST(ilm->ilm_rtx.rtx_block);
1748 	ilm->ilm_ipst = NULL;
1749 	mi_free((char *)ilm);
1750 }
1751 
1752 void
1753 ilm_walker_cleanup(ill_t *ill)
1754 {
1755 	ilm_t	**ilmp;
1756 	ilm_t	*ilm;
1757 	boolean_t need_wakeup = B_FALSE;
1758 
1759 	ASSERT(MUTEX_HELD(&ill->ill_lock));
1760 	ASSERT(ill->ill_ilm_walker_cnt == 0);
1761 
1762 	ilmp = &ill->ill_ilm;
1763 	while (*ilmp != NULL) {
1764 		if ((*ilmp)->ilm_flags & ILM_DELETED) {
1765 			ilm = *ilmp;
1766 			*ilmp = ilm->ilm_next;
1767 			/*
1768 			 * check if there are any pending FREE or unplumb
1769 			 * operations that need to be restarted.
1770 			 */
1771 			if (ilm->ilm_ipif != NULL) {
1772 				/*
1773 				 * IPv4 ilms hold a ref on the ipif.
1774 				 */
1775 				DTRACE_PROBE3(ipif__decr__cnt,
1776 				    (ipif_t *), ilm->ilm_ipif,
1777 				    (char *), "ilm", (void *), ilm);
1778 				ilm->ilm_ipif->ipif_ilm_cnt--;
1779 				if (IPIF_FREE_OK(ilm->ilm_ipif))
1780 					need_wakeup = B_TRUE;
1781 			} else {
1782 				/*
1783 				 * IPv6 ilms hold a ref on the ill.
1784 				 */
1785 				ASSERT(ilm->ilm_ill == ill);
1786 				DTRACE_PROBE3(ill__decr__cnt,
1787 				    (ill_t *), ill,
1788 				    (char *), "ilm", (void *), ilm);
1789 				ill->ill_ilm_cnt--;
1790 				if (ILL_FREE_OK(ill))
1791 					need_wakeup = B_TRUE;
1792 			}
1793 			ilm_inactive(ilm); /* frees ilm */
1794 		} else {
1795 			ilmp = &(*ilmp)->ilm_next;
1796 		}
1797 	}
1798 	ill->ill_ilm_cleanup_reqd = 0;
1799 	if (need_wakeup)
1800 		ipif_ill_refrele_tail(ill);
1801 	else
1802 		mutex_exit(&ill->ill_lock);
1803 }
1804 
1805 /*
1806  * Unlink ilm and free it.
1807  */
1808 static void
1809 ilm_delete(ilm_t *ilm)
1810 {
1811 	ill_t		*ill;
1812 	ilm_t		**ilmp;
1813 	boolean_t	need_wakeup;
1814 
1815 
1816 	if (ilm->ilm_ipif != NULL) {
1817 		ASSERT(IAM_WRITER_IPIF(ilm->ilm_ipif));
1818 		ASSERT(ilm->ilm_ill == NULL);
1819 		ill = ilm->ilm_ipif->ipif_ill;
1820 		ASSERT(!ill->ill_isv6);
1821 	} else {
1822 		ASSERT(IAM_WRITER_ILL(ilm->ilm_ill));
1823 		ASSERT(ilm->ilm_ipif == NULL);
1824 		ill = ilm->ilm_ill;
1825 		ASSERT(ill->ill_isv6);
1826 	}
1827 	/*
1828 	 * Delete under lock protection so that readers don't stumble
1829 	 * on bad ilm_next
1830 	 */
1831 	mutex_enter(&ill->ill_lock);
1832 	if (ill->ill_ilm_walker_cnt != 0) {
1833 		ilm->ilm_flags |= ILM_DELETED;
1834 		ill->ill_ilm_cleanup_reqd = 1;
1835 		mutex_exit(&ill->ill_lock);
1836 		return;
1837 	}
1838 
1839 	for (ilmp = &ill->ill_ilm; *ilmp != ilm; ilmp = &(*ilmp)->ilm_next)
1840 				;
1841 	*ilmp = ilm->ilm_next;
1842 
1843 	/*
1844 	 * if we are the last reference to the ipif (for IPv4 ilms)
1845 	 * or the ill (for IPv6 ilms), we may need to wakeup any
1846 	 * pending FREE or unplumb operations.
1847 	 */
1848 	need_wakeup = B_FALSE;
1849 	if (ilm->ilm_ipif != NULL) {
1850 		DTRACE_PROBE3(ipif__decr__cnt, (ipif_t *), ilm->ilm_ipif,
1851 		    (char *), "ilm", (void *), ilm);
1852 		ilm->ilm_ipif->ipif_ilm_cnt--;
1853 		if (IPIF_FREE_OK(ilm->ilm_ipif))
1854 			need_wakeup = B_TRUE;
1855 	} else {
1856 		DTRACE_PROBE3(ill__decr__cnt, (ill_t *), ill,
1857 		    (char *), "ilm", (void *), ilm);
1858 		ill->ill_ilm_cnt--;
1859 		if (ILL_FREE_OK(ill))
1860 			need_wakeup = B_TRUE;
1861 	}
1862 
1863 	ilm_inactive(ilm); /* frees this ilm */
1864 
1865 	if (need_wakeup) {
1866 		/* drops ill lock */
1867 		ipif_ill_refrele_tail(ill);
1868 	} else {
1869 		mutex_exit(&ill->ill_lock);
1870 	}
1871 }
1872 
1873 
1874 /*
1875  * Looks up the appropriate ipif given a v4 multicast group and interface
1876  * address.  On success, returns 0, with *ipifpp pointing to the found
1877  * struct.  On failure, returns an errno and *ipifpp is NULL.
1878  */
1879 int
1880 ip_opt_check(conn_t *connp, ipaddr_t group, ipaddr_t src, ipaddr_t ifaddr,
1881     uint_t *ifindexp, mblk_t *first_mp, ipsq_func_t func, ipif_t **ipifpp)
1882 {
1883 	ipif_t *ipif;
1884 	int err = 0;
1885 	zoneid_t zoneid;
1886 	ip_stack_t	*ipst =  connp->conn_netstack->netstack_ip;
1887 
1888 	if (!CLASSD(group) || CLASSD(src)) {
1889 		return (EINVAL);
1890 	}
1891 	*ipifpp = NULL;
1892 
1893 	zoneid = IPCL_ZONEID(connp);
1894 
1895 	ASSERT(!(ifaddr != INADDR_ANY && ifindexp != NULL && *ifindexp != 0));
1896 	if (ifaddr != INADDR_ANY) {
1897 		ipif = ipif_lookup_addr(ifaddr, NULL, zoneid,
1898 		    CONNP_TO_WQ(connp), first_mp, func, &err, ipst);
1899 		if (err != 0 && err != EINPROGRESS)
1900 			err = EADDRNOTAVAIL;
1901 	} else if (ifindexp != NULL && *ifindexp != 0) {
1902 		ipif = ipif_lookup_on_ifindex(*ifindexp, B_FALSE, zoneid,
1903 		    CONNP_TO_WQ(connp), first_mp, func, &err, ipst);
1904 	} else {
1905 		ipif = ipif_lookup_group(group, zoneid, ipst);
1906 		if (ipif == NULL)
1907 			return (EADDRNOTAVAIL);
1908 	}
1909 	if (ipif == NULL)
1910 		return (err);
1911 
1912 	*ipifpp = ipif;
1913 	return (0);
1914 }
1915 
1916 /*
1917  * Looks up the appropriate ill (or ipif if v4mapped) given an interface
1918  * index and IPv6 multicast group.  On success, returns 0, with *illpp (or
1919  * *ipifpp if v4mapped) pointing to the found struct.  On failure, returns
1920  * an errno and *illpp and *ipifpp are undefined.
1921  */
1922 int
1923 ip_opt_check_v6(conn_t *connp, const in6_addr_t *v6group, ipaddr_t *v4group,
1924     const in6_addr_t *v6src, ipaddr_t *v4src, boolean_t *isv6, int ifindex,
1925     mblk_t *first_mp, ipsq_func_t func, ill_t **illpp, ipif_t **ipifpp)
1926 {
1927 	boolean_t src_unspec;
1928 	ill_t *ill = NULL;
1929 	ipif_t *ipif = NULL;
1930 	int err;
1931 	zoneid_t zoneid = connp->conn_zoneid;
1932 	queue_t *wq = CONNP_TO_WQ(connp);
1933 	ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
1934 
1935 	src_unspec = IN6_IS_ADDR_UNSPECIFIED(v6src);
1936 
1937 	if (IN6_IS_ADDR_V4MAPPED(v6group)) {
1938 		if (!IN6_IS_ADDR_V4MAPPED(v6src) && !src_unspec)
1939 			return (EINVAL);
1940 		IN6_V4MAPPED_TO_IPADDR(v6group, *v4group);
1941 		if (src_unspec) {
1942 			*v4src = INADDR_ANY;
1943 		} else {
1944 			IN6_V4MAPPED_TO_IPADDR(v6src, *v4src);
1945 		}
1946 		if (!CLASSD(*v4group) || CLASSD(*v4src))
1947 			return (EINVAL);
1948 		*ipifpp = NULL;
1949 		*isv6 = B_FALSE;
1950 	} else {
1951 		if (IN6_IS_ADDR_V4MAPPED(v6src) && !src_unspec)
1952 			return (EINVAL);
1953 		if (!IN6_IS_ADDR_MULTICAST(v6group) ||
1954 		    IN6_IS_ADDR_MULTICAST(v6src)) {
1955 			return (EINVAL);
1956 		}
1957 		*illpp = NULL;
1958 		*isv6 = B_TRUE;
1959 	}
1960 
1961 	if (ifindex == 0) {
1962 		if (*isv6)
1963 			ill = ill_lookup_group_v6(v6group, zoneid, ipst);
1964 		else
1965 			ipif = ipif_lookup_group(*v4group, zoneid, ipst);
1966 		if (ill == NULL && ipif == NULL)
1967 			return (EADDRNOTAVAIL);
1968 	} else {
1969 		if (*isv6) {
1970 			ill = ill_lookup_on_ifindex(ifindex, B_TRUE,
1971 			    wq, first_mp, func, &err, ipst);
1972 			if (ill != NULL &&
1973 			    !ipif_lookup_zoneid(ill, zoneid, 0, NULL)) {
1974 				ill_refrele(ill);
1975 				ill = NULL;
1976 				err = EADDRNOTAVAIL;
1977 			}
1978 		} else {
1979 			ipif = ipif_lookup_on_ifindex(ifindex, B_FALSE,
1980 			    zoneid, wq, first_mp, func, &err, ipst);
1981 		}
1982 		if (ill == NULL && ipif == NULL)
1983 			return (err);
1984 	}
1985 
1986 	*ipifpp = ipif;
1987 	*illpp = ill;
1988 	return (0);
1989 }
1990 
1991 static int
1992 ip_get_srcfilter(conn_t *connp, struct group_filter *gf,
1993     struct ip_msfilter *imsf, ipaddr_t grp, ipif_t *ipif, boolean_t isv4mapped)
1994 {
1995 	ilg_t *ilg;
1996 	int i, numsrc, fmode, outsrcs;
1997 	struct sockaddr_in *sin;
1998 	struct sockaddr_in6 *sin6;
1999 	struct in_addr *addrp;
2000 	slist_t *fp;
2001 	boolean_t is_v4only_api;
2002 
2003 	mutex_enter(&connp->conn_lock);
2004 
2005 	ilg = ilg_lookup_ipif(connp, grp, ipif);
2006 	if (ilg == NULL) {
2007 		mutex_exit(&connp->conn_lock);
2008 		return (EADDRNOTAVAIL);
2009 	}
2010 
2011 	if (gf == NULL) {
2012 		ASSERT(imsf != NULL);
2013 		ASSERT(!isv4mapped);
2014 		is_v4only_api = B_TRUE;
2015 		outsrcs = imsf->imsf_numsrc;
2016 	} else {
2017 		ASSERT(imsf == NULL);
2018 		is_v4only_api = B_FALSE;
2019 		outsrcs = gf->gf_numsrc;
2020 	}
2021 
2022 	/*
2023 	 * In the kernel, we use the state definitions MODE_IS_[IN|EX]CLUDE
2024 	 * to identify the filter mode; but the API uses MCAST_[IN|EX]CLUDE.
2025 	 * So we need to translate here.
2026 	 */
2027 	fmode = (ilg->ilg_fmode == MODE_IS_INCLUDE) ?
2028 	    MCAST_INCLUDE : MCAST_EXCLUDE;
2029 	if ((fp = ilg->ilg_filter) == NULL) {
2030 		numsrc = 0;
2031 	} else {
2032 		for (i = 0; i < outsrcs; i++) {
2033 			if (i == fp->sl_numsrc)
2034 				break;
2035 			if (isv4mapped) {
2036 				sin6 = (struct sockaddr_in6 *)&gf->gf_slist[i];
2037 				sin6->sin6_family = AF_INET6;
2038 				sin6->sin6_addr = fp->sl_addr[i];
2039 			} else {
2040 				if (is_v4only_api) {
2041 					addrp = &imsf->imsf_slist[i];
2042 				} else {
2043 					sin = (struct sockaddr_in *)
2044 					    &gf->gf_slist[i];
2045 					sin->sin_family = AF_INET;
2046 					addrp = &sin->sin_addr;
2047 				}
2048 				IN6_V4MAPPED_TO_INADDR(&fp->sl_addr[i], addrp);
2049 			}
2050 		}
2051 		numsrc = fp->sl_numsrc;
2052 	}
2053 
2054 	if (is_v4only_api) {
2055 		imsf->imsf_numsrc = numsrc;
2056 		imsf->imsf_fmode = fmode;
2057 	} else {
2058 		gf->gf_numsrc = numsrc;
2059 		gf->gf_fmode = fmode;
2060 	}
2061 
2062 	mutex_exit(&connp->conn_lock);
2063 
2064 	return (0);
2065 }
2066 
2067 static int
2068 ip_get_srcfilter_v6(conn_t *connp, struct group_filter *gf,
2069     const struct in6_addr *grp, ill_t *ill)
2070 {
2071 	ilg_t *ilg;
2072 	int i;
2073 	struct sockaddr_storage *sl;
2074 	struct sockaddr_in6 *sin6;
2075 	slist_t *fp;
2076 
2077 	mutex_enter(&connp->conn_lock);
2078 
2079 	ilg = ilg_lookup_ill_v6(connp, grp, ill);
2080 	if (ilg == NULL) {
2081 		mutex_exit(&connp->conn_lock);
2082 		return (EADDRNOTAVAIL);
2083 	}
2084 
2085 	/*
2086 	 * In the kernel, we use the state definitions MODE_IS_[IN|EX]CLUDE
2087 	 * to identify the filter mode; but the API uses MCAST_[IN|EX]CLUDE.
2088 	 * So we need to translate here.
2089 	 */
2090 	gf->gf_fmode = (ilg->ilg_fmode == MODE_IS_INCLUDE) ?
2091 	    MCAST_INCLUDE : MCAST_EXCLUDE;
2092 	if ((fp = ilg->ilg_filter) == NULL) {
2093 		gf->gf_numsrc = 0;
2094 	} else {
2095 		for (i = 0, sl = gf->gf_slist; i < gf->gf_numsrc; i++, sl++) {
2096 			if (i == fp->sl_numsrc)
2097 				break;
2098 			sin6 = (struct sockaddr_in6 *)sl;
2099 			sin6->sin6_family = AF_INET6;
2100 			sin6->sin6_addr = fp->sl_addr[i];
2101 		}
2102 		gf->gf_numsrc = fp->sl_numsrc;
2103 	}
2104 
2105 	mutex_exit(&connp->conn_lock);
2106 
2107 	return (0);
2108 }
2109 
2110 static int
2111 ip_set_srcfilter(conn_t *connp, struct group_filter *gf,
2112     struct ip_msfilter *imsf, ipaddr_t grp, ipif_t *ipif, boolean_t isv4mapped)
2113 {
2114 	ilg_t *ilg;
2115 	int i, err, insrcs, infmode, new_fmode;
2116 	struct sockaddr_in *sin;
2117 	struct sockaddr_in6 *sin6;
2118 	struct in_addr *addrp;
2119 	slist_t *orig_filter = NULL;
2120 	slist_t *new_filter = NULL;
2121 	mcast_record_t orig_fmode;
2122 	boolean_t leave_grp, is_v4only_api;
2123 	ilg_stat_t ilgstat;
2124 
2125 	if (gf == NULL) {
2126 		ASSERT(imsf != NULL);
2127 		ASSERT(!isv4mapped);
2128 		is_v4only_api = B_TRUE;
2129 		insrcs = imsf->imsf_numsrc;
2130 		infmode = imsf->imsf_fmode;
2131 	} else {
2132 		ASSERT(imsf == NULL);
2133 		is_v4only_api = B_FALSE;
2134 		insrcs = gf->gf_numsrc;
2135 		infmode = gf->gf_fmode;
2136 	}
2137 
2138 	/* Make sure we can handle the source list */
2139 	if (insrcs > MAX_FILTER_SIZE)
2140 		return (ENOBUFS);
2141 
2142 	/*
2143 	 * setting the filter to (INCLUDE, NULL) is treated
2144 	 * as a request to leave the group.
2145 	 */
2146 	leave_grp = (infmode == MCAST_INCLUDE && insrcs == 0);
2147 
2148 	ASSERT(IAM_WRITER_IPIF(ipif));
2149 
2150 	mutex_enter(&connp->conn_lock);
2151 
2152 	ilg = ilg_lookup_ipif(connp, grp, ipif);
2153 	if (ilg == NULL) {
2154 		/*
2155 		 * if the request was actually to leave, and we
2156 		 * didn't find an ilg, there's nothing to do.
2157 		 */
2158 		if (!leave_grp)
2159 			ilg = conn_ilg_alloc(connp);
2160 		if (leave_grp || ilg == NULL) {
2161 			mutex_exit(&connp->conn_lock);
2162 			return (leave_grp ? 0 : ENOMEM);
2163 		}
2164 		ilgstat = ILGSTAT_NEW;
2165 		IN6_IPADDR_TO_V4MAPPED(grp, &ilg->ilg_v6group);
2166 		ilg->ilg_ipif = ipif;
2167 		ilg->ilg_ill = NULL;
2168 		ilg->ilg_orig_ifindex = 0;
2169 	} else if (leave_grp) {
2170 		ilg_delete(connp, ilg, NULL);
2171 		mutex_exit(&connp->conn_lock);
2172 		(void) ip_delmulti(grp, ipif, B_FALSE, B_TRUE);
2173 		return (0);
2174 	} else {
2175 		ilgstat = ILGSTAT_CHANGE;
2176 		/* Preserve existing state in case ip_addmulti() fails */
2177 		orig_fmode = ilg->ilg_fmode;
2178 		if (ilg->ilg_filter == NULL) {
2179 			orig_filter = NULL;
2180 		} else {
2181 			orig_filter = l_alloc_copy(ilg->ilg_filter);
2182 			if (orig_filter == NULL) {
2183 				mutex_exit(&connp->conn_lock);
2184 				return (ENOMEM);
2185 			}
2186 		}
2187 	}
2188 
2189 	/*
2190 	 * Alloc buffer to copy new state into (see below) before
2191 	 * we make any changes, so we can bail if it fails.
2192 	 */
2193 	if ((new_filter = l_alloc()) == NULL) {
2194 		mutex_exit(&connp->conn_lock);
2195 		err = ENOMEM;
2196 		goto free_and_exit;
2197 	}
2198 
2199 	if (insrcs == 0) {
2200 		CLEAR_SLIST(ilg->ilg_filter);
2201 	} else {
2202 		slist_t *fp;
2203 		if (ilg->ilg_filter == NULL) {
2204 			fp = l_alloc();
2205 			if (fp == NULL) {
2206 				if (ilgstat == ILGSTAT_NEW)
2207 					ilg_delete(connp, ilg, NULL);
2208 				mutex_exit(&connp->conn_lock);
2209 				err = ENOMEM;
2210 				goto free_and_exit;
2211 			}
2212 		} else {
2213 			fp = ilg->ilg_filter;
2214 		}
2215 		for (i = 0; i < insrcs; i++) {
2216 			if (isv4mapped) {
2217 				sin6 = (struct sockaddr_in6 *)&gf->gf_slist[i];
2218 				fp->sl_addr[i] = sin6->sin6_addr;
2219 			} else {
2220 				if (is_v4only_api) {
2221 					addrp = &imsf->imsf_slist[i];
2222 				} else {
2223 					sin = (struct sockaddr_in *)
2224 					    &gf->gf_slist[i];
2225 					addrp = &sin->sin_addr;
2226 				}
2227 				IN6_INADDR_TO_V4MAPPED(addrp, &fp->sl_addr[i]);
2228 			}
2229 		}
2230 		fp->sl_numsrc = insrcs;
2231 		ilg->ilg_filter = fp;
2232 	}
2233 	/*
2234 	 * In the kernel, we use the state definitions MODE_IS_[IN|EX]CLUDE
2235 	 * to identify the filter mode; but the API uses MCAST_[IN|EX]CLUDE.
2236 	 * So we need to translate here.
2237 	 */
2238 	ilg->ilg_fmode = (infmode == MCAST_INCLUDE) ?
2239 	    MODE_IS_INCLUDE : MODE_IS_EXCLUDE;
2240 
2241 	/*
2242 	 * Save copy of ilg's filter state to pass to other functions,
2243 	 * so we can release conn_lock now.
2244 	 */
2245 	new_fmode = ilg->ilg_fmode;
2246 	l_copy(ilg->ilg_filter, new_filter);
2247 
2248 	mutex_exit(&connp->conn_lock);
2249 
2250 	err = ip_addmulti(grp, ipif, ilgstat, new_fmode, new_filter);
2251 	if (err != 0) {
2252 		/*
2253 		 * Restore the original filter state, or delete the
2254 		 * newly-created ilg.  We need to look up the ilg
2255 		 * again, though, since we've not been holding the
2256 		 * conn_lock.
2257 		 */
2258 		mutex_enter(&connp->conn_lock);
2259 		ilg = ilg_lookup_ipif(connp, grp, ipif);
2260 		ASSERT(ilg != NULL);
2261 		if (ilgstat == ILGSTAT_NEW) {
2262 			ilg_delete(connp, ilg, NULL);
2263 		} else {
2264 			ilg->ilg_fmode = orig_fmode;
2265 			if (SLIST_IS_EMPTY(orig_filter)) {
2266 				CLEAR_SLIST(ilg->ilg_filter);
2267 			} else {
2268 				/*
2269 				 * We didn't free the filter, even if we
2270 				 * were trying to make the source list empty;
2271 				 * so if orig_filter isn't empty, the ilg
2272 				 * must still have a filter alloc'd.
2273 				 */
2274 				l_copy(orig_filter, ilg->ilg_filter);
2275 			}
2276 		}
2277 		mutex_exit(&connp->conn_lock);
2278 	}
2279 
2280 free_and_exit:
2281 	l_free(orig_filter);
2282 	l_free(new_filter);
2283 
2284 	return (err);
2285 }
2286 
2287 static int
2288 ip_set_srcfilter_v6(conn_t *connp, struct group_filter *gf,
2289     const struct in6_addr *grp, ill_t *ill)
2290 {
2291 	ilg_t *ilg;
2292 	int i, orig_ifindex, orig_fmode, new_fmode, err;
2293 	slist_t *orig_filter = NULL;
2294 	slist_t *new_filter = NULL;
2295 	struct sockaddr_storage *sl;
2296 	struct sockaddr_in6 *sin6;
2297 	boolean_t leave_grp;
2298 	ilg_stat_t ilgstat;
2299 
2300 	/* Make sure we can handle the source list */
2301 	if (gf->gf_numsrc > MAX_FILTER_SIZE)
2302 		return (ENOBUFS);
2303 
2304 	/*
2305 	 * setting the filter to (INCLUDE, NULL) is treated
2306 	 * as a request to leave the group.
2307 	 */
2308 	leave_grp = (gf->gf_fmode == MCAST_INCLUDE && gf->gf_numsrc == 0);
2309 
2310 	ASSERT(IAM_WRITER_ILL(ill));
2311 
2312 	/*
2313 	 * Use the ifindex to do the lookup.  We can't use the ill
2314 	 * directly because ilg_ill could point to a different ill
2315 	 * if things have moved.
2316 	 */
2317 	orig_ifindex = ill->ill_phyint->phyint_ifindex;
2318 
2319 	mutex_enter(&connp->conn_lock);
2320 	ilg = ilg_lookup_ill_index_v6(connp, grp, orig_ifindex);
2321 	if (ilg == NULL) {
2322 		/*
2323 		 * if the request was actually to leave, and we
2324 		 * didn't find an ilg, there's nothing to do.
2325 		 */
2326 		if (!leave_grp)
2327 			ilg = conn_ilg_alloc(connp);
2328 		if (leave_grp || ilg == NULL) {
2329 			mutex_exit(&connp->conn_lock);
2330 			return (leave_grp ? 0 : ENOMEM);
2331 		}
2332 		ilgstat = ILGSTAT_NEW;
2333 		ilg->ilg_v6group = *grp;
2334 		ilg->ilg_ipif = NULL;
2335 		/*
2336 		 * Choose our target ill to join on. This might be
2337 		 * different from the ill we've been given if it's
2338 		 * currently down and part of a group.
2339 		 *
2340 		 * new ill is not refheld; we are writer.
2341 		 */
2342 		ill = ip_choose_multi_ill(ill, grp);
2343 		ASSERT(!(ill->ill_state_flags & ILL_CONDEMNED));
2344 		ilg->ilg_ill = ill;
2345 		/*
2346 		 * Remember the index that we joined on, so that we can
2347 		 * successfully delete them later on and also search for
2348 		 * duplicates if the application wants to join again.
2349 		 */
2350 		ilg->ilg_orig_ifindex = orig_ifindex;
2351 	} else if (leave_grp) {
2352 		/*
2353 		 * Use the ilg's current ill for the deletion,
2354 		 * we might have failed over.
2355 		 */
2356 		ill = ilg->ilg_ill;
2357 		ilg_delete(connp, ilg, NULL);
2358 		mutex_exit(&connp->conn_lock);
2359 		(void) ip_delmulti_v6(grp, ill, orig_ifindex,
2360 		    connp->conn_zoneid, B_FALSE, B_TRUE);
2361 		return (0);
2362 	} else {
2363 		ilgstat = ILGSTAT_CHANGE;
2364 		/*
2365 		 * The current ill might be different from the one we were
2366 		 * asked to join on (if failover has occurred); we should
2367 		 * join on the ill stored in the ilg.  The original ill
2368 		 * is noted in ilg_orig_ifindex, which matched our request.
2369 		 */
2370 		ill = ilg->ilg_ill;
2371 		/* preserve existing state in case ip_addmulti() fails */
2372 		orig_fmode = ilg->ilg_fmode;
2373 		if (ilg->ilg_filter == NULL) {
2374 			orig_filter = NULL;
2375 		} else {
2376 			orig_filter = l_alloc_copy(ilg->ilg_filter);
2377 			if (orig_filter == NULL) {
2378 				mutex_exit(&connp->conn_lock);
2379 				return (ENOMEM);
2380 			}
2381 		}
2382 	}
2383 
2384 	/*
2385 	 * Alloc buffer to copy new state into (see below) before
2386 	 * we make any changes, so we can bail if it fails.
2387 	 */
2388 	if ((new_filter = l_alloc()) == NULL) {
2389 		mutex_exit(&connp->conn_lock);
2390 		err = ENOMEM;
2391 		goto free_and_exit;
2392 	}
2393 
2394 	if (gf->gf_numsrc == 0) {
2395 		CLEAR_SLIST(ilg->ilg_filter);
2396 	} else {
2397 		slist_t *fp;
2398 		if (ilg->ilg_filter == NULL) {
2399 			fp = l_alloc();
2400 			if (fp == NULL) {
2401 				if (ilgstat == ILGSTAT_NEW)
2402 					ilg_delete(connp, ilg, NULL);
2403 				mutex_exit(&connp->conn_lock);
2404 				err = ENOMEM;
2405 				goto free_and_exit;
2406 			}
2407 		} else {
2408 			fp = ilg->ilg_filter;
2409 		}
2410 		for (i = 0, sl = gf->gf_slist; i < gf->gf_numsrc; i++, sl++) {
2411 			sin6 = (struct sockaddr_in6 *)sl;
2412 			fp->sl_addr[i] = sin6->sin6_addr;
2413 		}
2414 		fp->sl_numsrc = gf->gf_numsrc;
2415 		ilg->ilg_filter = fp;
2416 	}
2417 	/*
2418 	 * In the kernel, we use the state definitions MODE_IS_[IN|EX]CLUDE
2419 	 * to identify the filter mode; but the API uses MCAST_[IN|EX]CLUDE.
2420 	 * So we need to translate here.
2421 	 */
2422 	ilg->ilg_fmode = (gf->gf_fmode == MCAST_INCLUDE) ?
2423 	    MODE_IS_INCLUDE : MODE_IS_EXCLUDE;
2424 
2425 	/*
2426 	 * Save copy of ilg's filter state to pass to other functions,
2427 	 * so we can release conn_lock now.
2428 	 */
2429 	new_fmode = ilg->ilg_fmode;
2430 	l_copy(ilg->ilg_filter, new_filter);
2431 
2432 	mutex_exit(&connp->conn_lock);
2433 
2434 	err = ip_addmulti_v6(grp, ill, orig_ifindex, connp->conn_zoneid,
2435 	    ilgstat, new_fmode, new_filter);
2436 	if (err != 0) {
2437 		/*
2438 		 * Restore the original filter state, or delete the
2439 		 * newly-created ilg.  We need to look up the ilg
2440 		 * again, though, since we've not been holding the
2441 		 * conn_lock.
2442 		 */
2443 		mutex_enter(&connp->conn_lock);
2444 		ilg = ilg_lookup_ill_index_v6(connp, grp, orig_ifindex);
2445 		ASSERT(ilg != NULL);
2446 		if (ilgstat == ILGSTAT_NEW) {
2447 			ilg_delete(connp, ilg, NULL);
2448 		} else {
2449 			ilg->ilg_fmode = orig_fmode;
2450 			if (SLIST_IS_EMPTY(orig_filter)) {
2451 				CLEAR_SLIST(ilg->ilg_filter);
2452 			} else {
2453 				/*
2454 				 * We didn't free the filter, even if we
2455 				 * were trying to make the source list empty;
2456 				 * so if orig_filter isn't empty, the ilg
2457 				 * must still have a filter alloc'd.
2458 				 */
2459 				l_copy(orig_filter, ilg->ilg_filter);
2460 			}
2461 		}
2462 		mutex_exit(&connp->conn_lock);
2463 	}
2464 
2465 free_and_exit:
2466 	l_free(orig_filter);
2467 	l_free(new_filter);
2468 
2469 	return (err);
2470 }
2471 
2472 /*
2473  * Process the SIOC[GS]MSFILTER and SIOC[GS]IPMSFILTER ioctls.
2474  */
2475 /* ARGSUSED */
2476 int
2477 ip_sioctl_msfilter(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
2478     ip_ioctl_cmd_t *ipip, void *ifreq)
2479 {
2480 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
2481 	/* existence verified in ip_wput_nondata() */
2482 	mblk_t *data_mp = mp->b_cont->b_cont;
2483 	int datalen, err, cmd, minsize;
2484 	int expsize = 0;
2485 	conn_t *connp;
2486 	boolean_t isv6, is_v4only_api, getcmd;
2487 	struct sockaddr_in *gsin;
2488 	struct sockaddr_in6 *gsin6;
2489 	ipaddr_t v4grp;
2490 	in6_addr_t v6grp;
2491 	struct group_filter *gf = NULL;
2492 	struct ip_msfilter *imsf = NULL;
2493 	mblk_t *ndp;
2494 
2495 	if (data_mp->b_cont != NULL) {
2496 		if ((ndp = msgpullup(data_mp, -1)) == NULL)
2497 			return (ENOMEM);
2498 		freemsg(data_mp);
2499 		data_mp = ndp;
2500 		mp->b_cont->b_cont = data_mp;
2501 	}
2502 
2503 	cmd = iocp->ioc_cmd;
2504 	getcmd = (cmd == SIOCGIPMSFILTER || cmd == SIOCGMSFILTER);
2505 	is_v4only_api = (cmd == SIOCGIPMSFILTER || cmd == SIOCSIPMSFILTER);
2506 	minsize = (is_v4only_api) ? IP_MSFILTER_SIZE(0) : GROUP_FILTER_SIZE(0);
2507 	datalen = MBLKL(data_mp);
2508 
2509 	if (datalen < minsize)
2510 		return (EINVAL);
2511 
2512 	/*
2513 	 * now we know we have at least have the initial structure,
2514 	 * but need to check for the source list array.
2515 	 */
2516 	if (is_v4only_api) {
2517 		imsf = (struct ip_msfilter *)data_mp->b_rptr;
2518 		isv6 = B_FALSE;
2519 		expsize = IP_MSFILTER_SIZE(imsf->imsf_numsrc);
2520 	} else {
2521 		gf = (struct group_filter *)data_mp->b_rptr;
2522 		if (gf->gf_group.ss_family == AF_INET6) {
2523 			gsin6 = (struct sockaddr_in6 *)&gf->gf_group;
2524 			isv6 = !(IN6_IS_ADDR_V4MAPPED(&gsin6->sin6_addr));
2525 		} else {
2526 			isv6 = B_FALSE;
2527 		}
2528 		expsize = GROUP_FILTER_SIZE(gf->gf_numsrc);
2529 	}
2530 	if (datalen < expsize)
2531 		return (EINVAL);
2532 
2533 	connp = Q_TO_CONN(q);
2534 
2535 	/* operation not supported on the virtual network interface */
2536 	if (IS_VNI(ipif->ipif_ill))
2537 		return (EINVAL);
2538 
2539 	if (isv6) {
2540 		ill_t *ill = ipif->ipif_ill;
2541 		ill_refhold(ill);
2542 
2543 		gsin6 = (struct sockaddr_in6 *)&gf->gf_group;
2544 		v6grp = gsin6->sin6_addr;
2545 		if (getcmd)
2546 			err = ip_get_srcfilter_v6(connp, gf, &v6grp, ill);
2547 		else
2548 			err = ip_set_srcfilter_v6(connp, gf, &v6grp, ill);
2549 
2550 		ill_refrele(ill);
2551 	} else {
2552 		boolean_t isv4mapped = B_FALSE;
2553 		if (is_v4only_api) {
2554 			v4grp = (ipaddr_t)imsf->imsf_multiaddr.s_addr;
2555 		} else {
2556 			if (gf->gf_group.ss_family == AF_INET) {
2557 				gsin = (struct sockaddr_in *)&gf->gf_group;
2558 				v4grp = (ipaddr_t)gsin->sin_addr.s_addr;
2559 			} else {
2560 				gsin6 = (struct sockaddr_in6 *)&gf->gf_group;
2561 				IN6_V4MAPPED_TO_IPADDR(&gsin6->sin6_addr,
2562 				    v4grp);
2563 				isv4mapped = B_TRUE;
2564 			}
2565 		}
2566 		if (getcmd)
2567 			err = ip_get_srcfilter(connp, gf, imsf, v4grp, ipif,
2568 			    isv4mapped);
2569 		else
2570 			err = ip_set_srcfilter(connp, gf, imsf, v4grp, ipif,
2571 			    isv4mapped);
2572 	}
2573 
2574 	return (err);
2575 }
2576 
2577 /*
2578  * Finds the ipif based on information in the ioctl headers.  Needed to make
2579  * ip_process_ioctl() happy (it needs to know the ipif for IPI_WR-flagged
2580  * ioctls prior to calling the ioctl's handler function).
2581  */
2582 int
2583 ip_extract_msfilter(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
2584     cmd_info_t *ci, ipsq_func_t func)
2585 {
2586 	int cmd = ipip->ipi_cmd;
2587 	int err = 0;
2588 	conn_t *connp;
2589 	ipif_t *ipif;
2590 	/* caller has verified this mblk exists */
2591 	char *dbuf = (char *)mp->b_cont->b_cont->b_rptr;
2592 	struct ip_msfilter *imsf;
2593 	struct group_filter *gf;
2594 	ipaddr_t v4addr, v4grp;
2595 	in6_addr_t v6grp;
2596 	uint32_t index;
2597 	zoneid_t zoneid;
2598 	ip_stack_t *ipst;
2599 
2600 	connp = Q_TO_CONN(q);
2601 	zoneid = connp->conn_zoneid;
2602 	ipst = connp->conn_netstack->netstack_ip;
2603 
2604 	/* don't allow multicast operations on a tcp conn */
2605 	if (IPCL_IS_TCP(connp))
2606 		return (ENOPROTOOPT);
2607 
2608 	if (cmd == SIOCSIPMSFILTER || cmd == SIOCGIPMSFILTER) {
2609 		/* don't allow v4-specific ioctls on v6 socket */
2610 		if (connp->conn_af_isv6)
2611 			return (EAFNOSUPPORT);
2612 
2613 		imsf = (struct ip_msfilter *)dbuf;
2614 		v4addr = imsf->imsf_interface.s_addr;
2615 		v4grp = imsf->imsf_multiaddr.s_addr;
2616 		if (v4addr == INADDR_ANY) {
2617 			ipif = ipif_lookup_group(v4grp, zoneid, ipst);
2618 			if (ipif == NULL)
2619 				err = EADDRNOTAVAIL;
2620 		} else {
2621 			ipif = ipif_lookup_addr(v4addr, NULL, zoneid, q, mp,
2622 			    func, &err, ipst);
2623 		}
2624 	} else {
2625 		boolean_t isv6 = B_FALSE;
2626 		gf = (struct group_filter *)dbuf;
2627 		index = gf->gf_interface;
2628 		if (gf->gf_group.ss_family == AF_INET6) {
2629 			struct sockaddr_in6 *sin6;
2630 			sin6 = (struct sockaddr_in6 *)&gf->gf_group;
2631 			v6grp = sin6->sin6_addr;
2632 			if (IN6_IS_ADDR_V4MAPPED(&v6grp))
2633 				IN6_V4MAPPED_TO_IPADDR(&v6grp, v4grp);
2634 			else
2635 				isv6 = B_TRUE;
2636 		} else if (gf->gf_group.ss_family == AF_INET) {
2637 			struct sockaddr_in *sin;
2638 			sin = (struct sockaddr_in *)&gf->gf_group;
2639 			v4grp = sin->sin_addr.s_addr;
2640 		} else {
2641 			return (EAFNOSUPPORT);
2642 		}
2643 		if (index == 0) {
2644 			if (isv6) {
2645 				ipif = ipif_lookup_group_v6(&v6grp, zoneid,
2646 				    ipst);
2647 			} else {
2648 				ipif = ipif_lookup_group(v4grp, zoneid, ipst);
2649 			}
2650 			if (ipif == NULL)
2651 				err = EADDRNOTAVAIL;
2652 		} else {
2653 			ipif = ipif_lookup_on_ifindex(index, isv6, zoneid,
2654 			    q, mp, func, &err, ipst);
2655 		}
2656 	}
2657 
2658 	ci->ci_ipif = ipif;
2659 	return (err);
2660 }
2661 
2662 /*
2663  * The structures used for the SIOC*MSFILTER ioctls usually must be copied
2664  * in in two stages, as the first copyin tells us the size of the attached
2665  * source buffer.  This function is called by ip_wput_nondata() after the
2666  * first copyin has completed; it figures out how big the second stage
2667  * needs to be, and kicks it off.
2668  *
2669  * In some cases (numsrc < 2), the second copyin is not needed as the
2670  * first one gets a complete structure containing 1 source addr.
2671  *
2672  * The function returns 0 if a second copyin has been started (i.e. there's
2673  * no more work to be done right now), or 1 if the second copyin is not
2674  * needed and ip_wput_nondata() can continue its processing.
2675  */
2676 int
2677 ip_copyin_msfilter(queue_t *q, mblk_t *mp)
2678 {
2679 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
2680 	int cmd = iocp->ioc_cmd;
2681 	/* validity of this checked in ip_wput_nondata() */
2682 	mblk_t *mp1 = mp->b_cont->b_cont;
2683 	int copysize = 0;
2684 	int offset;
2685 
2686 	if (cmd == SIOCSMSFILTER || cmd == SIOCGMSFILTER) {
2687 		struct group_filter *gf = (struct group_filter *)mp1->b_rptr;
2688 		if (gf->gf_numsrc >= 2) {
2689 			offset = sizeof (struct group_filter);
2690 			copysize = GROUP_FILTER_SIZE(gf->gf_numsrc) - offset;
2691 		}
2692 	} else {
2693 		struct ip_msfilter *imsf = (struct ip_msfilter *)mp1->b_rptr;
2694 		if (imsf->imsf_numsrc >= 2) {
2695 			offset = sizeof (struct ip_msfilter);
2696 			copysize = IP_MSFILTER_SIZE(imsf->imsf_numsrc) - offset;
2697 		}
2698 	}
2699 	if (copysize > 0) {
2700 		mi_copyin_n(q, mp, offset, copysize);
2701 		return (0);
2702 	}
2703 	return (1);
2704 }
2705 
2706 /*
2707  * Handle the following optmgmt:
2708  *	IP_ADD_MEMBERSHIP		must not have joined already
2709  *	MCAST_JOIN_GROUP		must not have joined already
2710  *	IP_BLOCK_SOURCE			must have joined already
2711  *	MCAST_BLOCK_SOURCE		must have joined already
2712  *	IP_JOIN_SOURCE_GROUP		may have joined already
2713  *	MCAST_JOIN_SOURCE_GROUP		may have joined already
2714  *
2715  * fmode and src parameters may be used to determine which option is
2716  * being set, as follows (the IP_* and MCAST_* versions of each option
2717  * are functionally equivalent):
2718  *	opt			fmode			src
2719  *	IP_ADD_MEMBERSHIP	MODE_IS_EXCLUDE		INADDR_ANY
2720  *	MCAST_JOIN_GROUP	MODE_IS_EXCLUDE		INADDR_ANY
2721  *	IP_BLOCK_SOURCE		MODE_IS_EXCLUDE		v4 addr
2722  *	MCAST_BLOCK_SOURCE	MODE_IS_EXCLUDE		v4 addr
2723  *	IP_JOIN_SOURCE_GROUP	MODE_IS_INCLUDE		v4 addr
2724  *	MCAST_JOIN_SOURCE_GROUP	MODE_IS_INCLUDE		v4 addr
2725  *
2726  * Changing the filter mode is not allowed; if a matching ilg already
2727  * exists and fmode != ilg->ilg_fmode, EINVAL is returned.
2728  *
2729  * Verifies that there is a source address of appropriate scope for
2730  * the group; if not, EADDRNOTAVAIL is returned.
2731  *
2732  * The interface to be used may be identified by an address or by an
2733  * index.  A pointer to the index is passed; if it is NULL, use the
2734  * address, otherwise, use the index.
2735  */
2736 int
2737 ip_opt_add_group(conn_t *connp, boolean_t checkonly, ipaddr_t group,
2738     ipaddr_t ifaddr, uint_t *ifindexp, mcast_record_t fmode, ipaddr_t src,
2739     mblk_t *first_mp)
2740 {
2741 	ipif_t	*ipif;
2742 	ipsq_t	*ipsq;
2743 	int err = 0;
2744 	ill_t	*ill;
2745 
2746 	err = ip_opt_check(connp, group, src, ifaddr, ifindexp, first_mp,
2747 	    ip_restart_optmgmt, &ipif);
2748 	if (err != 0) {
2749 		if (err != EINPROGRESS) {
2750 			ip1dbg(("ip_opt_add_group: no ipif for group 0x%x, "
2751 			    "ifaddr 0x%x, ifindex %d\n", ntohl(group),
2752 			    ntohl(ifaddr), (ifindexp == NULL) ? 0 : *ifindexp));
2753 		}
2754 		return (err);
2755 	}
2756 	ASSERT(ipif != NULL);
2757 
2758 	ill = ipif->ipif_ill;
2759 	/* Operation not supported on a virtual network interface */
2760 	if (IS_VNI(ill)) {
2761 		ipif_refrele(ipif);
2762 		return (EINVAL);
2763 	}
2764 
2765 	if (checkonly) {
2766 		/*
2767 		 * do not do operation, just pretend to - new T_CHECK
2768 		 * semantics. The error return case above if encountered
2769 		 * considered a good enough "check" here.
2770 		 */
2771 		ipif_refrele(ipif);
2772 		return (0);
2773 	}
2774 
2775 	IPSQ_ENTER_IPIF(ipif, connp, first_mp, ip_restart_optmgmt, ipsq,
2776 	    NEW_OP);
2777 
2778 	/* unspecified source addr => no source filtering */
2779 	err = ilg_add(connp, group, ipif, fmode, src);
2780 
2781 	IPSQ_EXIT(ipsq);
2782 
2783 	ipif_refrele(ipif);
2784 	return (err);
2785 }
2786 
2787 /*
2788  * Handle the following optmgmt:
2789  *	IPV6_JOIN_GROUP			must not have joined already
2790  *	MCAST_JOIN_GROUP		must not have joined already
2791  *	MCAST_BLOCK_SOURCE		must have joined already
2792  *	MCAST_JOIN_SOURCE_GROUP		may have joined already
2793  *
2794  * fmode and src parameters may be used to determine which option is
2795  * being set, as follows (IPV6_JOIN_GROUP and MCAST_JOIN_GROUP options
2796  * are functionally equivalent):
2797  *	opt			fmode			v6src
2798  *	IPV6_JOIN_GROUP		MODE_IS_EXCLUDE		unspecified
2799  *	MCAST_JOIN_GROUP	MODE_IS_EXCLUDE		unspecified
2800  *	MCAST_BLOCK_SOURCE	MODE_IS_EXCLUDE		v6 addr
2801  *	MCAST_JOIN_SOURCE_GROUP	MODE_IS_INCLUDE		v6 addr
2802  *
2803  * Changing the filter mode is not allowed; if a matching ilg already
2804  * exists and fmode != ilg->ilg_fmode, EINVAL is returned.
2805  *
2806  * Verifies that there is a source address of appropriate scope for
2807  * the group; if not, EADDRNOTAVAIL is returned.
2808  *
2809  * Handles IPv4-mapped IPv6 multicast addresses by associating them
2810  * with the link-local ipif.  Assumes that if v6group is v4-mapped,
2811  * v6src is also v4-mapped.
2812  */
2813 int
2814 ip_opt_add_group_v6(conn_t *connp, boolean_t checkonly,
2815     const in6_addr_t *v6group, int ifindex, mcast_record_t fmode,
2816     const in6_addr_t *v6src, mblk_t *first_mp)
2817 {
2818 	ill_t *ill;
2819 	ipif_t	*ipif;
2820 	char buf[INET6_ADDRSTRLEN];
2821 	ipaddr_t v4group, v4src;
2822 	boolean_t isv6;
2823 	ipsq_t	*ipsq;
2824 	int	err;
2825 
2826 	err = ip_opt_check_v6(connp, v6group, &v4group, v6src, &v4src, &isv6,
2827 	    ifindex, first_mp, ip_restart_optmgmt, &ill, &ipif);
2828 	if (err != 0) {
2829 		if (err != EINPROGRESS) {
2830 			ip1dbg(("ip_opt_add_group_v6: no ill for group %s/"
2831 			    "index %d\n", inet_ntop(AF_INET6, v6group, buf,
2832 			    sizeof (buf)), ifindex));
2833 		}
2834 		return (err);
2835 	}
2836 	ASSERT((!isv6 && ipif != NULL) || (isv6 && ill != NULL));
2837 
2838 	/* operation is not supported on the virtual network interface */
2839 	if (isv6) {
2840 		if (IS_VNI(ill)) {
2841 			ill_refrele(ill);
2842 			return (EINVAL);
2843 		}
2844 	} else {
2845 		if (IS_VNI(ipif->ipif_ill)) {
2846 			ipif_refrele(ipif);
2847 			return (EINVAL);
2848 		}
2849 	}
2850 
2851 	if (checkonly) {
2852 		/*
2853 		 * do not do operation, just pretend to - new T_CHECK
2854 		 * semantics. The error return case above if encountered
2855 		 * considered a good enough "check" here.
2856 		 */
2857 		if (isv6)
2858 			ill_refrele(ill);
2859 		else
2860 			ipif_refrele(ipif);
2861 		return (0);
2862 	}
2863 
2864 	if (!isv6) {
2865 		IPSQ_ENTER_IPIF(ipif, connp, first_mp, ip_restart_optmgmt,
2866 		    ipsq, NEW_OP);
2867 		err = ilg_add(connp, v4group, ipif, fmode, v4src);
2868 		IPSQ_EXIT(ipsq);
2869 		ipif_refrele(ipif);
2870 	} else {
2871 		IPSQ_ENTER_ILL(ill, connp, first_mp, ip_restart_optmgmt,
2872 		    ipsq, NEW_OP);
2873 		err = ilg_add_v6(connp, v6group, ill, fmode, v6src);
2874 		IPSQ_EXIT(ipsq);
2875 		ill_refrele(ill);
2876 	}
2877 
2878 	return (err);
2879 }
2880 
2881 static int
2882 ip_opt_delete_group_excl(conn_t *connp, ipaddr_t group, ipif_t *ipif,
2883     mcast_record_t fmode, ipaddr_t src)
2884 {
2885 	ilg_t	*ilg;
2886 	in6_addr_t v6src;
2887 	boolean_t leaving = B_FALSE;
2888 
2889 	ASSERT(IAM_WRITER_IPIF(ipif));
2890 
2891 	/*
2892 	 * The ilg is valid only while we hold the conn lock. Once we drop
2893 	 * the lock, another thread can locate another ilg on this connp,
2894 	 * but on a different ipif, and delete it, and cause the ilg array
2895 	 * to be reallocated and copied. Hence do the ilg_delete before
2896 	 * dropping the lock.
2897 	 */
2898 	mutex_enter(&connp->conn_lock);
2899 	ilg = ilg_lookup_ipif(connp, group, ipif);
2900 	if ((ilg == NULL) || (ilg->ilg_flags & ILG_DELETED)) {
2901 		mutex_exit(&connp->conn_lock);
2902 		return (EADDRNOTAVAIL);
2903 	}
2904 
2905 	/*
2906 	 * Decide if we're actually deleting the ilg or just removing a
2907 	 * source filter address; if just removing an addr, make sure we
2908 	 * aren't trying to change the filter mode, and that the addr is
2909 	 * actually in our filter list already.  If we're removing the
2910 	 * last src in an include list, just delete the ilg.
2911 	 */
2912 	if (src == INADDR_ANY) {
2913 		v6src = ipv6_all_zeros;
2914 		leaving = B_TRUE;
2915 	} else {
2916 		int err = 0;
2917 		IN6_IPADDR_TO_V4MAPPED(src, &v6src);
2918 		if (fmode != ilg->ilg_fmode)
2919 			err = EINVAL;
2920 		else if (ilg->ilg_filter == NULL ||
2921 		    !list_has_addr(ilg->ilg_filter, &v6src))
2922 			err = EADDRNOTAVAIL;
2923 		if (err != 0) {
2924 			mutex_exit(&connp->conn_lock);
2925 			return (err);
2926 		}
2927 		if (fmode == MODE_IS_INCLUDE &&
2928 		    ilg->ilg_filter->sl_numsrc == 1) {
2929 			v6src = ipv6_all_zeros;
2930 			leaving = B_TRUE;
2931 		}
2932 	}
2933 
2934 	ilg_delete(connp, ilg, &v6src);
2935 	mutex_exit(&connp->conn_lock);
2936 
2937 	(void) ip_delmulti(group, ipif, B_FALSE, leaving);
2938 	return (0);
2939 }
2940 
2941 static int
2942 ip_opt_delete_group_excl_v6(conn_t *connp, const in6_addr_t *v6group,
2943     ill_t *ill, mcast_record_t fmode, const in6_addr_t *v6src)
2944 {
2945 	ilg_t	*ilg;
2946 	ill_t	*ilg_ill;
2947 	uint_t	ilg_orig_ifindex;
2948 	boolean_t leaving = B_TRUE;
2949 
2950 	ASSERT(IAM_WRITER_ILL(ill));
2951 
2952 	/*
2953 	 * Use the index that we originally used to join. We can't
2954 	 * use the ill directly because ilg_ill could point to
2955 	 * a new ill if things have moved.
2956 	 */
2957 	mutex_enter(&connp->conn_lock);
2958 	ilg = ilg_lookup_ill_index_v6(connp, v6group,
2959 	    ill->ill_phyint->phyint_ifindex);
2960 	if ((ilg == NULL) || (ilg->ilg_flags & ILG_DELETED)) {
2961 		mutex_exit(&connp->conn_lock);
2962 		return (EADDRNOTAVAIL);
2963 	}
2964 
2965 	/*
2966 	 * Decide if we're actually deleting the ilg or just removing a
2967 	 * source filter address; if just removing an addr, make sure we
2968 	 * aren't trying to change the filter mode, and that the addr is
2969 	 * actually in our filter list already.  If we're removing the
2970 	 * last src in an include list, just delete the ilg.
2971 	 */
2972 	if (!IN6_IS_ADDR_UNSPECIFIED(v6src)) {
2973 		int err = 0;
2974 		if (fmode != ilg->ilg_fmode)
2975 			err = EINVAL;
2976 		else if (ilg->ilg_filter == NULL ||
2977 		    !list_has_addr(ilg->ilg_filter, v6src))
2978 			err = EADDRNOTAVAIL;
2979 		if (err != 0) {
2980 			mutex_exit(&connp->conn_lock);
2981 			return (err);
2982 		}
2983 		if (fmode == MODE_IS_INCLUDE &&
2984 		    ilg->ilg_filter->sl_numsrc == 1)
2985 			v6src = NULL;
2986 		else
2987 			leaving = B_FALSE;
2988 	}
2989 
2990 	ilg_ill = ilg->ilg_ill;
2991 	ilg_orig_ifindex = ilg->ilg_orig_ifindex;
2992 	ilg_delete(connp, ilg, v6src);
2993 	mutex_exit(&connp->conn_lock);
2994 	(void) ip_delmulti_v6(v6group, ilg_ill, ilg_orig_ifindex,
2995 	    connp->conn_zoneid, B_FALSE, leaving);
2996 
2997 	return (0);
2998 }
2999 
3000 /*
3001  * Handle the following optmgmt:
3002  *	IP_DROP_MEMBERSHIP		will leave
3003  *	MCAST_LEAVE_GROUP		will leave
3004  *	IP_UNBLOCK_SOURCE		will not leave
3005  *	MCAST_UNBLOCK_SOURCE		will not leave
3006  *	IP_LEAVE_SOURCE_GROUP		may leave (if leaving last source)
3007  *	MCAST_LEAVE_SOURCE_GROUP	may leave (if leaving last source)
3008  *
3009  * fmode and src parameters may be used to determine which option is
3010  * being set, as follows (the IP_* and MCAST_* versions of each option
3011  * are functionally equivalent):
3012  *	opt			 fmode			src
3013  *	IP_DROP_MEMBERSHIP	 MODE_IS_INCLUDE	INADDR_ANY
3014  *	MCAST_LEAVE_GROUP	 MODE_IS_INCLUDE	INADDR_ANY
3015  *	IP_UNBLOCK_SOURCE	 MODE_IS_EXCLUDE	v4 addr
3016  *	MCAST_UNBLOCK_SOURCE	 MODE_IS_EXCLUDE	v4 addr
3017  *	IP_LEAVE_SOURCE_GROUP	 MODE_IS_INCLUDE	v4 addr
3018  *	MCAST_LEAVE_SOURCE_GROUP MODE_IS_INCLUDE	v4 addr
3019  *
3020  * Changing the filter mode is not allowed; if a matching ilg already
3021  * exists and fmode != ilg->ilg_fmode, EINVAL is returned.
3022  *
3023  * The interface to be used may be identified by an address or by an
3024  * index.  A pointer to the index is passed; if it is NULL, use the
3025  * address, otherwise, use the index.
3026  */
3027 int
3028 ip_opt_delete_group(conn_t *connp, boolean_t checkonly, ipaddr_t group,
3029     ipaddr_t ifaddr, uint_t *ifindexp, mcast_record_t fmode, ipaddr_t src,
3030     mblk_t *first_mp)
3031 {
3032 	ipif_t	*ipif;
3033 	ipsq_t	*ipsq;
3034 	int	err;
3035 	ill_t	*ill;
3036 
3037 	err = ip_opt_check(connp, group, src, ifaddr, ifindexp, first_mp,
3038 	    ip_restart_optmgmt, &ipif);
3039 	if (err != 0) {
3040 		if (err != EINPROGRESS) {
3041 			ip1dbg(("ip_opt_delete_group: no ipif for group "
3042 			    "0x%x, ifaddr 0x%x\n",
3043 			    (int)ntohl(group), (int)ntohl(ifaddr)));
3044 		}
3045 		return (err);
3046 	}
3047 	ASSERT(ipif != NULL);
3048 
3049 	ill = ipif->ipif_ill;
3050 	/* Operation not supported on a virtual network interface */
3051 	if (IS_VNI(ill)) {
3052 		ipif_refrele(ipif);
3053 		return (EINVAL);
3054 	}
3055 
3056 	if (checkonly) {
3057 		/*
3058 		 * do not do operation, just pretend to - new T_CHECK
3059 		 * semantics. The error return case above if encountered
3060 		 * considered a good enough "check" here.
3061 		 */
3062 		ipif_refrele(ipif);
3063 		return (0);
3064 	}
3065 
3066 	IPSQ_ENTER_IPIF(ipif, connp, first_mp, ip_restart_optmgmt, ipsq,
3067 	    NEW_OP);
3068 	err = ip_opt_delete_group_excl(connp, group, ipif, fmode, src);
3069 	IPSQ_EXIT(ipsq);
3070 
3071 	ipif_refrele(ipif);
3072 	return (err);
3073 }
3074 
3075 /*
3076  * Handle the following optmgmt:
3077  *	IPV6_LEAVE_GROUP		will leave
3078  *	MCAST_LEAVE_GROUP		will leave
3079  *	MCAST_UNBLOCK_SOURCE		will not leave
3080  *	MCAST_LEAVE_SOURCE_GROUP	may leave (if leaving last source)
3081  *
3082  * fmode and src parameters may be used to determine which option is
3083  * being set, as follows (IPV6_LEAVE_GROUP and MCAST_LEAVE_GROUP options
3084  * are functionally equivalent):
3085  *	opt			 fmode			v6src
3086  *	IPV6_LEAVE_GROUP	 MODE_IS_INCLUDE	unspecified
3087  *	MCAST_LEAVE_GROUP	 MODE_IS_INCLUDE	unspecified
3088  *	MCAST_UNBLOCK_SOURCE	 MODE_IS_EXCLUDE	v6 addr
3089  *	MCAST_LEAVE_SOURCE_GROUP MODE_IS_INCLUDE	v6 addr
3090  *
3091  * Changing the filter mode is not allowed; if a matching ilg already
3092  * exists and fmode != ilg->ilg_fmode, EINVAL is returned.
3093  *
3094  * Handles IPv4-mapped IPv6 multicast addresses by associating them
3095  * with the link-local ipif.  Assumes that if v6group is v4-mapped,
3096  * v6src is also v4-mapped.
3097  */
3098 int
3099 ip_opt_delete_group_v6(conn_t *connp, boolean_t checkonly,
3100     const in6_addr_t *v6group, int ifindex, mcast_record_t fmode,
3101     const in6_addr_t *v6src, mblk_t *first_mp)
3102 {
3103 	ill_t *ill;
3104 	ipif_t	*ipif;
3105 	char	buf[INET6_ADDRSTRLEN];
3106 	ipaddr_t v4group, v4src;
3107 	boolean_t isv6;
3108 	ipsq_t	*ipsq;
3109 	int	err;
3110 
3111 	err = ip_opt_check_v6(connp, v6group, &v4group, v6src, &v4src, &isv6,
3112 	    ifindex, first_mp, ip_restart_optmgmt, &ill, &ipif);
3113 	if (err != 0) {
3114 		if (err != EINPROGRESS) {
3115 			ip1dbg(("ip_opt_delete_group_v6: no ill for group %s/"
3116 			    "index %d\n", inet_ntop(AF_INET6, v6group, buf,
3117 			    sizeof (buf)), ifindex));
3118 		}
3119 		return (err);
3120 	}
3121 	ASSERT((isv6 && ill != NULL) || (!isv6 && ipif != NULL));
3122 
3123 	/* operation is not supported on the virtual network interface */
3124 	if (isv6) {
3125 		if (IS_VNI(ill)) {
3126 			ill_refrele(ill);
3127 			return (EINVAL);
3128 		}
3129 	} else {
3130 		if (IS_VNI(ipif->ipif_ill)) {
3131 			ipif_refrele(ipif);
3132 			return (EINVAL);
3133 		}
3134 	}
3135 
3136 	if (checkonly) {
3137 		/*
3138 		 * do not do operation, just pretend to - new T_CHECK
3139 		 * semantics. The error return case above if encountered
3140 		 * considered a good enough "check" here.
3141 		 */
3142 		if (isv6)
3143 			ill_refrele(ill);
3144 		else
3145 			ipif_refrele(ipif);
3146 		return (0);
3147 	}
3148 
3149 	if (!isv6) {
3150 		IPSQ_ENTER_IPIF(ipif, connp, first_mp, ip_restart_optmgmt,
3151 		    ipsq, NEW_OP);
3152 		err = ip_opt_delete_group_excl(connp, v4group, ipif, fmode,
3153 		    v4src);
3154 		IPSQ_EXIT(ipsq);
3155 		ipif_refrele(ipif);
3156 	} else {
3157 		IPSQ_ENTER_ILL(ill, connp, first_mp, ip_restart_optmgmt,
3158 		    ipsq, NEW_OP);
3159 		err = ip_opt_delete_group_excl_v6(connp, v6group, ill, fmode,
3160 		    v6src);
3161 		IPSQ_EXIT(ipsq);
3162 		ill_refrele(ill);
3163 	}
3164 
3165 	return (err);
3166 }
3167 
3168 /*
3169  * Group mgmt for upper conn that passes things down
3170  * to the interface multicast list (and DLPI)
3171  * These routines can handle new style options that specify an interface name
3172  * as opposed to an interface address (needed for general handling of
3173  * unnumbered interfaces.)
3174  */
3175 
3176 /*
3177  * Add a group to an upper conn group data structure and pass things down
3178  * to the interface multicast list (and DLPI)
3179  */
3180 static int
3181 ilg_add(conn_t *connp, ipaddr_t group, ipif_t *ipif, mcast_record_t fmode,
3182     ipaddr_t src)
3183 {
3184 	int	error = 0;
3185 	ill_t	*ill;
3186 	ilg_t	*ilg;
3187 	ilg_stat_t ilgstat;
3188 	slist_t	*new_filter = NULL;
3189 	int	new_fmode;
3190 
3191 	ASSERT(IAM_WRITER_IPIF(ipif));
3192 
3193 	ill = ipif->ipif_ill;
3194 
3195 	if (!(ill->ill_flags & ILLF_MULTICAST))
3196 		return (EADDRNOTAVAIL);
3197 
3198 	/*
3199 	 * conn_ilg[] is protected by conn_lock. Need to hold the conn_lock
3200 	 * to walk the conn_ilg[] list in ilg_lookup_ipif(); also needed to
3201 	 * serialize 2 threads doing join (sock, group1, hme0:0) and
3202 	 * (sock, group2, hme1:0) where hme0 and hme1 map to different ipsqs,
3203 	 * but both operations happen on the same conn.
3204 	 */
3205 	mutex_enter(&connp->conn_lock);
3206 	ilg = ilg_lookup_ipif(connp, group, ipif);
3207 
3208 	/*
3209 	 * Depending on the option we're handling, may or may not be okay
3210 	 * if group has already been added.  Figure out our rules based
3211 	 * on fmode and src params.  Also make sure there's enough room
3212 	 * in the filter if we're adding a source to an existing filter.
3213 	 */
3214 	if (src == INADDR_ANY) {
3215 		/* we're joining for all sources, must not have joined */
3216 		if (ilg != NULL)
3217 			error = EADDRINUSE;
3218 	} else {
3219 		if (fmode == MODE_IS_EXCLUDE) {
3220 			/* (excl {addr}) => block source, must have joined */
3221 			if (ilg == NULL)
3222 				error = EADDRNOTAVAIL;
3223 		}
3224 		/* (incl {addr}) => join source, may have joined */
3225 
3226 		if (ilg != NULL &&
3227 		    SLIST_CNT(ilg->ilg_filter) == MAX_FILTER_SIZE)
3228 			error = ENOBUFS;
3229 	}
3230 	if (error != 0) {
3231 		mutex_exit(&connp->conn_lock);
3232 		return (error);
3233 	}
3234 
3235 	ASSERT(!(ipif->ipif_state_flags & IPIF_CONDEMNED));
3236 
3237 	/*
3238 	 * Alloc buffer to copy new state into (see below) before
3239 	 * we make any changes, so we can bail if it fails.
3240 	 */
3241 	if ((new_filter = l_alloc()) == NULL) {
3242 		mutex_exit(&connp->conn_lock);
3243 		return (ENOMEM);
3244 	}
3245 
3246 	if (ilg == NULL) {
3247 		ilgstat = ILGSTAT_NEW;
3248 		if ((ilg = conn_ilg_alloc(connp)) == NULL) {
3249 			mutex_exit(&connp->conn_lock);
3250 			l_free(new_filter);
3251 			return (ENOMEM);
3252 		}
3253 		if (src != INADDR_ANY) {
3254 			ilg->ilg_filter = l_alloc();
3255 			if (ilg->ilg_filter == NULL) {
3256 				ilg_delete(connp, ilg, NULL);
3257 				mutex_exit(&connp->conn_lock);
3258 				l_free(new_filter);
3259 				return (ENOMEM);
3260 			}
3261 			ilg->ilg_filter->sl_numsrc = 1;
3262 			IN6_IPADDR_TO_V4MAPPED(src,
3263 			    &ilg->ilg_filter->sl_addr[0]);
3264 		}
3265 		if (group == INADDR_ANY) {
3266 			ilg->ilg_v6group = ipv6_all_zeros;
3267 		} else {
3268 			IN6_IPADDR_TO_V4MAPPED(group, &ilg->ilg_v6group);
3269 		}
3270 		ilg->ilg_ipif = ipif;
3271 		ilg->ilg_ill = NULL;
3272 		ilg->ilg_orig_ifindex = 0;
3273 		ilg->ilg_fmode = fmode;
3274 	} else {
3275 		int index;
3276 		in6_addr_t v6src;
3277 		ilgstat = ILGSTAT_CHANGE;
3278 		if (ilg->ilg_fmode != fmode || src == INADDR_ANY) {
3279 			mutex_exit(&connp->conn_lock);
3280 			l_free(new_filter);
3281 			return (EINVAL);
3282 		}
3283 		if (ilg->ilg_filter == NULL) {
3284 			ilg->ilg_filter = l_alloc();
3285 			if (ilg->ilg_filter == NULL) {
3286 				mutex_exit(&connp->conn_lock);
3287 				l_free(new_filter);
3288 				return (ENOMEM);
3289 			}
3290 		}
3291 		IN6_IPADDR_TO_V4MAPPED(src, &v6src);
3292 		if (list_has_addr(ilg->ilg_filter, &v6src)) {
3293 			mutex_exit(&connp->conn_lock);
3294 			l_free(new_filter);
3295 			return (EADDRNOTAVAIL);
3296 		}
3297 		index = ilg->ilg_filter->sl_numsrc++;
3298 		ilg->ilg_filter->sl_addr[index] = v6src;
3299 	}
3300 
3301 	/*
3302 	 * Save copy of ilg's filter state to pass to other functions,
3303 	 * so we can release conn_lock now.
3304 	 */
3305 	new_fmode = ilg->ilg_fmode;
3306 	l_copy(ilg->ilg_filter, new_filter);
3307 
3308 	mutex_exit(&connp->conn_lock);
3309 
3310 	error = ip_addmulti(group, ipif, ilgstat, new_fmode, new_filter);
3311 	if (error != 0) {
3312 		/*
3313 		 * Need to undo what we did before calling ip_addmulti()!
3314 		 * Must look up the ilg again since we've not been holding
3315 		 * conn_lock.
3316 		 */
3317 		in6_addr_t v6src;
3318 		if (ilgstat == ILGSTAT_NEW)
3319 			v6src = ipv6_all_zeros;
3320 		else
3321 			IN6_IPADDR_TO_V4MAPPED(src, &v6src);
3322 		mutex_enter(&connp->conn_lock);
3323 		ilg = ilg_lookup_ipif(connp, group, ipif);
3324 		ASSERT(ilg != NULL);
3325 		ilg_delete(connp, ilg, &v6src);
3326 		mutex_exit(&connp->conn_lock);
3327 		l_free(new_filter);
3328 		return (error);
3329 	}
3330 
3331 	l_free(new_filter);
3332 	return (0);
3333 }
3334 
3335 static int
3336 ilg_add_v6(conn_t *connp, const in6_addr_t *v6group, ill_t *ill,
3337     mcast_record_t fmode, const in6_addr_t *v6src)
3338 {
3339 	int	error = 0;
3340 	int	orig_ifindex;
3341 	ilg_t	*ilg;
3342 	ilg_stat_t ilgstat;
3343 	slist_t	*new_filter = NULL;
3344 	int	new_fmode;
3345 
3346 	ASSERT(IAM_WRITER_ILL(ill));
3347 
3348 	if (!(ill->ill_flags & ILLF_MULTICAST))
3349 		return (EADDRNOTAVAIL);
3350 
3351 	/*
3352 	 * conn_lock protects the ilg list.  Serializes 2 threads doing
3353 	 * join (sock, group1, hme0) and (sock, group2, hme1) where hme0
3354 	 * and hme1 map to different ipsq's, but both operations happen
3355 	 * on the same conn.
3356 	 */
3357 	mutex_enter(&connp->conn_lock);
3358 
3359 	/*
3360 	 * Use the ifindex to do the lookup. We can't use the ill
3361 	 * directly because ilg_ill could point to a different ill if
3362 	 * things have moved.
3363 	 */
3364 	orig_ifindex = ill->ill_phyint->phyint_ifindex;
3365 	ilg = ilg_lookup_ill_index_v6(connp, v6group, orig_ifindex);
3366 
3367 	/*
3368 	 * Depending on the option we're handling, may or may not be okay
3369 	 * if group has already been added.  Figure out our rules based
3370 	 * on fmode and src params.  Also make sure there's enough room
3371 	 * in the filter if we're adding a source to an existing filter.
3372 	 */
3373 	if (IN6_IS_ADDR_UNSPECIFIED(v6src)) {
3374 		/* we're joining for all sources, must not have joined */
3375 		if (ilg != NULL)
3376 			error = EADDRINUSE;
3377 	} else {
3378 		if (fmode == MODE_IS_EXCLUDE) {
3379 			/* (excl {addr}) => block source, must have joined */
3380 			if (ilg == NULL)
3381 				error = EADDRNOTAVAIL;
3382 		}
3383 		/* (incl {addr}) => join source, may have joined */
3384 
3385 		if (ilg != NULL &&
3386 		    SLIST_CNT(ilg->ilg_filter) == MAX_FILTER_SIZE)
3387 			error = ENOBUFS;
3388 	}
3389 	if (error != 0) {
3390 		mutex_exit(&connp->conn_lock);
3391 		return (error);
3392 	}
3393 
3394 	/*
3395 	 * Alloc buffer to copy new state into (see below) before
3396 	 * we make any changes, so we can bail if it fails.
3397 	 */
3398 	if ((new_filter = l_alloc()) == NULL) {
3399 		mutex_exit(&connp->conn_lock);
3400 		return (ENOMEM);
3401 	}
3402 
3403 	if (ilg == NULL) {
3404 		if ((ilg = conn_ilg_alloc(connp)) == NULL) {
3405 			mutex_exit(&connp->conn_lock);
3406 			l_free(new_filter);
3407 			return (ENOMEM);
3408 		}
3409 		if (!IN6_IS_ADDR_UNSPECIFIED(v6src)) {
3410 			ilg->ilg_filter = l_alloc();
3411 			if (ilg->ilg_filter == NULL) {
3412 				ilg_delete(connp, ilg, NULL);
3413 				mutex_exit(&connp->conn_lock);
3414 				l_free(new_filter);
3415 				return (ENOMEM);
3416 			}
3417 			ilg->ilg_filter->sl_numsrc = 1;
3418 			ilg->ilg_filter->sl_addr[0] = *v6src;
3419 		}
3420 		ilgstat = ILGSTAT_NEW;
3421 		ilg->ilg_v6group = *v6group;
3422 		ilg->ilg_fmode = fmode;
3423 		ilg->ilg_ipif = NULL;
3424 		/*
3425 		 * Choose our target ill to join on. This might be different
3426 		 * from the ill we've been given if it's currently down and
3427 		 * part of a group.
3428 		 *
3429 		 * new ill is not refheld; we are writer.
3430 		 */
3431 		ill = ip_choose_multi_ill(ill, v6group);
3432 		ASSERT(!(ill->ill_state_flags & ILL_CONDEMNED));
3433 		ilg->ilg_ill = ill;
3434 		/*
3435 		 * Remember the orig_ifindex that we joined on, so that we
3436 		 * can successfully delete them later on and also search
3437 		 * for duplicates if the application wants to join again.
3438 		 */
3439 		ilg->ilg_orig_ifindex = orig_ifindex;
3440 	} else {
3441 		int index;
3442 		if (ilg->ilg_fmode != fmode || IN6_IS_ADDR_UNSPECIFIED(v6src)) {
3443 			mutex_exit(&connp->conn_lock);
3444 			l_free(new_filter);
3445 			return (EINVAL);
3446 		}
3447 		if (ilg->ilg_filter == NULL) {
3448 			ilg->ilg_filter = l_alloc();
3449 			if (ilg->ilg_filter == NULL) {
3450 				mutex_exit(&connp->conn_lock);
3451 				l_free(new_filter);
3452 				return (ENOMEM);
3453 			}
3454 		}
3455 		if (list_has_addr(ilg->ilg_filter, v6src)) {
3456 			mutex_exit(&connp->conn_lock);
3457 			l_free(new_filter);
3458 			return (EADDRNOTAVAIL);
3459 		}
3460 		ilgstat = ILGSTAT_CHANGE;
3461 		index = ilg->ilg_filter->sl_numsrc++;
3462 		ilg->ilg_filter->sl_addr[index] = *v6src;
3463 		/*
3464 		 * The current ill might be different from the one we were
3465 		 * asked to join on (if failover has occurred); we should
3466 		 * join on the ill stored in the ilg.  The original ill
3467 		 * is noted in ilg_orig_ifindex, which matched our request.
3468 		 */
3469 		ill = ilg->ilg_ill;
3470 	}
3471 
3472 	/*
3473 	 * Save copy of ilg's filter state to pass to other functions,
3474 	 * so we can release conn_lock now.
3475 	 */
3476 	new_fmode = ilg->ilg_fmode;
3477 	l_copy(ilg->ilg_filter, new_filter);
3478 
3479 	mutex_exit(&connp->conn_lock);
3480 
3481 	/*
3482 	 * Now update the ill. We wait to do this until after the ilg
3483 	 * has been updated because we need to update the src filter
3484 	 * info for the ill, which involves looking at the status of
3485 	 * all the ilgs associated with this group/interface pair.
3486 	 */
3487 	error = ip_addmulti_v6(v6group, ill, orig_ifindex, connp->conn_zoneid,
3488 	    ilgstat, new_fmode, new_filter);
3489 	if (error != 0) {
3490 		/*
3491 		 * But because we waited, we have to undo the ilg update
3492 		 * if ip_addmulti_v6() fails.  We also must lookup ilg
3493 		 * again, since we've not been holding conn_lock.
3494 		 */
3495 		in6_addr_t delsrc =
3496 		    (ilgstat == ILGSTAT_NEW) ? ipv6_all_zeros : *v6src;
3497 		mutex_enter(&connp->conn_lock);
3498 		ilg = ilg_lookup_ill_index_v6(connp, v6group, orig_ifindex);
3499 		ASSERT(ilg != NULL);
3500 		ilg_delete(connp, ilg, &delsrc);
3501 		mutex_exit(&connp->conn_lock);
3502 		l_free(new_filter);
3503 		return (error);
3504 	}
3505 
3506 	l_free(new_filter);
3507 
3508 	return (0);
3509 }
3510 
3511 /*
3512  * Find an IPv4 ilg matching group, ill and source
3513  */
3514 ilg_t *
3515 ilg_lookup_ill_withsrc(conn_t *connp, ipaddr_t group, ipaddr_t src, ill_t *ill)
3516 {
3517 	in6_addr_t v6group, v6src;
3518 	int i;
3519 	boolean_t isinlist;
3520 	ilg_t *ilg;
3521 	ipif_t *ipif;
3522 	ill_t *ilg_ill;
3523 
3524 	ASSERT(MUTEX_HELD(&connp->conn_lock));
3525 
3526 	/*
3527 	 * INADDR_ANY is represented as the IPv6 unspecified addr.
3528 	 */
3529 	if (group == INADDR_ANY)
3530 		v6group = ipv6_all_zeros;
3531 	else
3532 		IN6_IPADDR_TO_V4MAPPED(group, &v6group);
3533 
3534 	for (i = 0; i < connp->conn_ilg_inuse; i++) {
3535 		ilg = &connp->conn_ilg[i];
3536 		if ((ipif = ilg->ilg_ipif) == NULL ||
3537 		    (ilg->ilg_flags & ILG_DELETED) != 0)
3538 			continue;
3539 		ASSERT(ilg->ilg_ill == NULL);
3540 		ilg_ill = ipif->ipif_ill;
3541 		ASSERT(!ilg_ill->ill_isv6);
3542 		if (ilg_ill == ill &&
3543 		    IN6_ARE_ADDR_EQUAL(&ilg->ilg_v6group, &v6group)) {
3544 			if (SLIST_IS_EMPTY(ilg->ilg_filter)) {
3545 				/* no source filter, so this is a match */
3546 				return (ilg);
3547 			}
3548 			break;
3549 		}
3550 	}
3551 	if (i == connp->conn_ilg_inuse)
3552 		return (NULL);
3553 
3554 	/*
3555 	 * we have an ilg with matching ill and group; but
3556 	 * the ilg has a source list that we must check.
3557 	 */
3558 	IN6_IPADDR_TO_V4MAPPED(src, &v6src);
3559 	isinlist = B_FALSE;
3560 	for (i = 0; i < ilg->ilg_filter->sl_numsrc; i++) {
3561 		if (IN6_ARE_ADDR_EQUAL(&v6src, &ilg->ilg_filter->sl_addr[i])) {
3562 			isinlist = B_TRUE;
3563 			break;
3564 		}
3565 	}
3566 
3567 	if ((isinlist && ilg->ilg_fmode == MODE_IS_INCLUDE) ||
3568 	    (!isinlist && ilg->ilg_fmode == MODE_IS_EXCLUDE))
3569 		return (ilg);
3570 
3571 	return (NULL);
3572 }
3573 
3574 /*
3575  * Find an IPv6 ilg matching group, ill, and source
3576  */
3577 ilg_t *
3578 ilg_lookup_ill_withsrc_v6(conn_t *connp, const in6_addr_t *v6group,
3579     const in6_addr_t *v6src, ill_t *ill)
3580 {
3581 	int i;
3582 	boolean_t isinlist;
3583 	ilg_t *ilg;
3584 	ill_t *ilg_ill;
3585 
3586 	ASSERT(MUTEX_HELD(&connp->conn_lock));
3587 
3588 	for (i = 0; i < connp->conn_ilg_inuse; i++) {
3589 		ilg = &connp->conn_ilg[i];
3590 		if ((ilg_ill = ilg->ilg_ill) == NULL ||
3591 		    (ilg->ilg_flags & ILG_DELETED) != 0)
3592 			continue;
3593 		ASSERT(ilg->ilg_ipif == NULL);
3594 		ASSERT(ilg_ill->ill_isv6);
3595 		if (ilg_ill == ill &&
3596 		    IN6_ARE_ADDR_EQUAL(&ilg->ilg_v6group, v6group)) {
3597 			if (SLIST_IS_EMPTY(ilg->ilg_filter)) {
3598 				/* no source filter, so this is a match */
3599 				return (ilg);
3600 			}
3601 			break;
3602 		}
3603 	}
3604 	if (i == connp->conn_ilg_inuse)
3605 		return (NULL);
3606 
3607 	/*
3608 	 * we have an ilg with matching ill and group; but
3609 	 * the ilg has a source list that we must check.
3610 	 */
3611 	isinlist = B_FALSE;
3612 	for (i = 0; i < ilg->ilg_filter->sl_numsrc; i++) {
3613 		if (IN6_ARE_ADDR_EQUAL(v6src, &ilg->ilg_filter->sl_addr[i])) {
3614 			isinlist = B_TRUE;
3615 			break;
3616 		}
3617 	}
3618 
3619 	if ((isinlist && ilg->ilg_fmode == MODE_IS_INCLUDE) ||
3620 	    (!isinlist && ilg->ilg_fmode == MODE_IS_EXCLUDE))
3621 		return (ilg);
3622 
3623 	return (NULL);
3624 }
3625 
3626 /*
3627  * Get the ilg whose ilg_orig_ifindex is associated with ifindex.
3628  * This is useful when the interface fails and we have moved
3629  * to a new ill, but still would like to locate using the index
3630  * that we originally used to join. Used only for IPv6 currently.
3631  */
3632 static ilg_t *
3633 ilg_lookup_ill_index_v6(conn_t *connp, const in6_addr_t *v6group, int ifindex)
3634 {
3635 	ilg_t	*ilg;
3636 	int	i;
3637 
3638 	ASSERT(MUTEX_HELD(&connp->conn_lock));
3639 	for (i = 0; i < connp->conn_ilg_inuse; i++) {
3640 		ilg = &connp->conn_ilg[i];
3641 		if (ilg->ilg_ill == NULL ||
3642 		    (ilg->ilg_flags & ILG_DELETED) != 0)
3643 			continue;
3644 		/* ilg_ipif is NULL for V6 */
3645 		ASSERT(ilg->ilg_ipif == NULL);
3646 		ASSERT(ilg->ilg_orig_ifindex != 0);
3647 		if (IN6_ARE_ADDR_EQUAL(&ilg->ilg_v6group, v6group) &&
3648 		    ilg->ilg_orig_ifindex == ifindex) {
3649 			return (ilg);
3650 		}
3651 	}
3652 	return (NULL);
3653 }
3654 
3655 /*
3656  * Find an IPv6 ilg matching group and ill
3657  */
3658 ilg_t *
3659 ilg_lookup_ill_v6(conn_t *connp, const in6_addr_t *v6group, ill_t *ill)
3660 {
3661 	ilg_t	*ilg;
3662 	int	i;
3663 	ill_t 	*mem_ill;
3664 
3665 	ASSERT(MUTEX_HELD(&connp->conn_lock));
3666 
3667 	for (i = 0; i < connp->conn_ilg_inuse; i++) {
3668 		ilg = &connp->conn_ilg[i];
3669 		if ((mem_ill = ilg->ilg_ill) == NULL ||
3670 		    (ilg->ilg_flags & ILG_DELETED) != 0)
3671 			continue;
3672 		ASSERT(ilg->ilg_ipif == NULL);
3673 		ASSERT(mem_ill->ill_isv6);
3674 		if (mem_ill == ill &&
3675 		    IN6_ARE_ADDR_EQUAL(&ilg->ilg_v6group, v6group))
3676 			return (ilg);
3677 	}
3678 	return (NULL);
3679 }
3680 
3681 /*
3682  * Find an IPv4 ilg matching group and ipif
3683  */
3684 static ilg_t *
3685 ilg_lookup_ipif(conn_t *connp, ipaddr_t group, ipif_t *ipif)
3686 {
3687 	in6_addr_t v6group;
3688 	int	i;
3689 	ilg_t	*ilg;
3690 
3691 	ASSERT(MUTEX_HELD(&connp->conn_lock));
3692 	ASSERT(!ipif->ipif_ill->ill_isv6);
3693 
3694 	if (group == INADDR_ANY)
3695 		v6group = ipv6_all_zeros;
3696 	else
3697 		IN6_IPADDR_TO_V4MAPPED(group, &v6group);
3698 
3699 	for (i = 0; i < connp->conn_ilg_inuse; i++) {
3700 		ilg = &connp->conn_ilg[i];
3701 		if ((ilg->ilg_flags & ILG_DELETED) == 0 &&
3702 		    IN6_ARE_ADDR_EQUAL(&ilg->ilg_v6group, &v6group) &&
3703 		    ilg->ilg_ipif == ipif)
3704 			return (ilg);
3705 	}
3706 	return (NULL);
3707 }
3708 
3709 /*
3710  * If a source address is passed in (src != NULL and src is not
3711  * unspecified), remove the specified src addr from the given ilg's
3712  * filter list, else delete the ilg.
3713  */
3714 static void
3715 ilg_delete(conn_t *connp, ilg_t *ilg, const in6_addr_t *src)
3716 {
3717 	int	i;
3718 
3719 	ASSERT((ilg->ilg_ipif != NULL) ^ (ilg->ilg_ill != NULL));
3720 	ASSERT(ilg->ilg_ipif == NULL || IAM_WRITER_IPIF(ilg->ilg_ipif));
3721 	ASSERT(ilg->ilg_ill == NULL || IAM_WRITER_ILL(ilg->ilg_ill));
3722 	ASSERT(MUTEX_HELD(&connp->conn_lock));
3723 	ASSERT(!(ilg->ilg_flags & ILG_DELETED));
3724 
3725 	if (src == NULL || IN6_IS_ADDR_UNSPECIFIED(src)) {
3726 		if (connp->conn_ilg_walker_cnt != 0) {
3727 			ilg->ilg_flags |= ILG_DELETED;
3728 			return;
3729 		}
3730 
3731 		FREE_SLIST(ilg->ilg_filter);
3732 
3733 		i = ilg - &connp->conn_ilg[0];
3734 		ASSERT(i >= 0 && i < connp->conn_ilg_inuse);
3735 
3736 		/* Move other entries up one step */
3737 		connp->conn_ilg_inuse--;
3738 		for (; i < connp->conn_ilg_inuse; i++)
3739 			connp->conn_ilg[i] = connp->conn_ilg[i+1];
3740 
3741 		if (connp->conn_ilg_inuse == 0) {
3742 			mi_free((char *)connp->conn_ilg);
3743 			connp->conn_ilg = NULL;
3744 			cv_broadcast(&connp->conn_refcv);
3745 		}
3746 	} else {
3747 		l_remove(ilg->ilg_filter, src);
3748 	}
3749 }
3750 
3751 /*
3752  * Called from conn close. No new ilg can be added or removed.
3753  * because CONN_CLOSING has been set by ip_close. ilg_add / ilg_delete
3754  * will return error if conn has started closing.
3755  */
3756 void
3757 ilg_delete_all(conn_t *connp)
3758 {
3759 	int	i;
3760 	ipif_t	*ipif = NULL;
3761 	ill_t	*ill = NULL;
3762 	ilg_t	*ilg;
3763 	in6_addr_t v6group;
3764 	boolean_t success;
3765 	ipsq_t	*ipsq;
3766 	int	orig_ifindex;
3767 
3768 	mutex_enter(&connp->conn_lock);
3769 retry:
3770 	ILG_WALKER_HOLD(connp);
3771 	for (i = connp->conn_ilg_inuse - 1; i >= 0; ) {
3772 		ilg = &connp->conn_ilg[i];
3773 		/*
3774 		 * Since this walk is not atomic (we drop the
3775 		 * conn_lock and wait in ipsq_enter) we need
3776 		 * to check for the ILG_DELETED flag.
3777 		 */
3778 		if (ilg->ilg_flags & ILG_DELETED) {
3779 			/* Go to the next ilg */
3780 			i--;
3781 			continue;
3782 		}
3783 		v6group = ilg->ilg_v6group;
3784 
3785 		if (IN6_IS_ADDR_V4MAPPED(&v6group)) {
3786 			ipif = ilg->ilg_ipif;
3787 			ill = ipif->ipif_ill;
3788 		} else {
3789 			ipif = NULL;
3790 			ill = ilg->ilg_ill;
3791 		}
3792 		/*
3793 		 * We may not be able to refhold the ill if the ill/ipif
3794 		 * is changing. But we need to make sure that the ill will
3795 		 * not vanish. So we just bump up the ill_waiter count.
3796 		 * If we are unable to do even that, then the ill is closing,
3797 		 * in which case the unplumb thread will handle the cleanup,
3798 		 * and we move on to the next ilg.
3799 		 */
3800 		if (!ill_waiter_inc(ill)) {
3801 			/* Go to the next ilg */
3802 			i--;
3803 			continue;
3804 		}
3805 		mutex_exit(&connp->conn_lock);
3806 		/*
3807 		 * To prevent deadlock between ill close which waits inside
3808 		 * the perimeter, and conn close, ipsq_enter returns error,
3809 		 * the moment ILL_CONDEMNED is set, in which case ill close
3810 		 * takes responsibility to cleanup the ilgs. Note that we
3811 		 * have not yet set condemned flag, otherwise the conn can't
3812 		 * be refheld for cleanup by those routines and it would be
3813 		 * a mutual deadlock.
3814 		 */
3815 		success = ipsq_enter(ill, B_FALSE);
3816 		ipsq = ill->ill_phyint->phyint_ipsq;
3817 		ill_waiter_dcr(ill);
3818 		mutex_enter(&connp->conn_lock);
3819 		if (!success) {
3820 			/* Go to the next ilg */
3821 			i--;
3822 			continue;
3823 		}
3824 
3825 		/*
3826 		 * Make sure that nothing has changed under. For eg.
3827 		 * a failover/failback can change ilg_ill while we were
3828 		 * waiting to become exclusive above
3829 		 */
3830 		if (IN6_IS_ADDR_V4MAPPED(&v6group)) {
3831 			ipif = ilg->ilg_ipif;
3832 			ill = ipif->ipif_ill;
3833 		} else {
3834 			ipif = NULL;
3835 			ill = ilg->ilg_ill;
3836 		}
3837 		if (!IAM_WRITER_ILL(ill) || (ilg->ilg_flags & ILG_DELETED)) {
3838 			/*
3839 			 * The ilg has changed under us probably due
3840 			 * to a failover or unplumb. Retry on the same ilg.
3841 			 */
3842 			mutex_exit(&connp->conn_lock);
3843 			ipsq_exit(ipsq, B_TRUE, B_TRUE);
3844 			mutex_enter(&connp->conn_lock);
3845 			continue;
3846 		}
3847 		v6group = ilg->ilg_v6group;
3848 		orig_ifindex = ilg->ilg_orig_ifindex;
3849 		ilg_delete(connp, ilg, NULL);
3850 		mutex_exit(&connp->conn_lock);
3851 
3852 		if (ipif != NULL)
3853 			(void) ip_delmulti(V4_PART_OF_V6(v6group), ipif,
3854 			    B_FALSE, B_TRUE);
3855 
3856 		else
3857 			(void) ip_delmulti_v6(&v6group, ill, orig_ifindex,
3858 			    connp->conn_zoneid, B_FALSE, B_TRUE);
3859 
3860 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
3861 		mutex_enter(&connp->conn_lock);
3862 		/* Go to the next ilg */
3863 		i--;
3864 	}
3865 	ILG_WALKER_RELE(connp);
3866 
3867 	/* If any ill was skipped above wait and retry */
3868 	if (connp->conn_ilg_inuse != 0) {
3869 		cv_wait(&connp->conn_refcv, &connp->conn_lock);
3870 		goto retry;
3871 	}
3872 	mutex_exit(&connp->conn_lock);
3873 }
3874 
3875 /*
3876  * Called from ill close by ipcl_walk for clearing conn_ilg and
3877  * conn_multicast_ipif for a given ipif. conn is held by caller.
3878  * Note that ipcl_walk only walks conns that are not yet condemned.
3879  * condemned conns can't be refheld. For this reason, conn must become clean
3880  * first, i.e. it must not refer to any ill/ire/ipif and then only set
3881  * condemned flag.
3882  */
3883 static void
3884 conn_delete_ipif(conn_t *connp, caddr_t arg)
3885 {
3886 	ipif_t	*ipif = (ipif_t *)arg;
3887 	int	i;
3888 	char	group_buf1[INET6_ADDRSTRLEN];
3889 	char	group_buf2[INET6_ADDRSTRLEN];
3890 	ipaddr_t group;
3891 	ilg_t	*ilg;
3892 
3893 	/*
3894 	 * Even though conn_ilg_inuse can change while we are in this loop,
3895 	 * i.e.ilgs can be created or deleted on this connp, no new ilgs can
3896 	 * be created or deleted for this connp, on this ill, since this ill
3897 	 * is the perimeter. So we won't miss any ilg in this cleanup.
3898 	 */
3899 	mutex_enter(&connp->conn_lock);
3900 
3901 	/*
3902 	 * Increment the walker count, so that ilg repacking does not
3903 	 * occur while we are in the loop.
3904 	 */
3905 	ILG_WALKER_HOLD(connp);
3906 	for (i = connp->conn_ilg_inuse - 1; i >= 0; i--) {
3907 		ilg = &connp->conn_ilg[i];
3908 		if (ilg->ilg_ipif != ipif || (ilg->ilg_flags & ILG_DELETED))
3909 			continue;
3910 		/*
3911 		 * ip_close cannot be cleaning this ilg at the same time.
3912 		 * since it also has to execute in this ill's perimeter which
3913 		 * we are now holding. Only a clean conn can be condemned.
3914 		 */
3915 		ASSERT(!(connp->conn_state_flags & CONN_CONDEMNED));
3916 
3917 		/* Blow away the membership */
3918 		ip1dbg(("conn_delete_ilg_ipif: %s on %s (%s)\n",
3919 		    inet_ntop(AF_INET6, &connp->conn_ilg[i].ilg_v6group,
3920 		    group_buf1, sizeof (group_buf1)),
3921 		    inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr,
3922 		    group_buf2, sizeof (group_buf2)),
3923 		    ipif->ipif_ill->ill_name));
3924 
3925 		/* ilg_ipif is NULL for V6, so we won't be here */
3926 		ASSERT(IN6_IS_ADDR_V4MAPPED(&ilg->ilg_v6group));
3927 
3928 		group = V4_PART_OF_V6(ilg->ilg_v6group);
3929 		ilg_delete(connp, &connp->conn_ilg[i], NULL);
3930 		mutex_exit(&connp->conn_lock);
3931 
3932 		(void) ip_delmulti(group, ipif, B_FALSE, B_TRUE);
3933 		mutex_enter(&connp->conn_lock);
3934 	}
3935 
3936 	/*
3937 	 * If we are the last walker, need to physically delete the
3938 	 * ilgs and repack.
3939 	 */
3940 	ILG_WALKER_RELE(connp);
3941 
3942 	if (connp->conn_multicast_ipif == ipif) {
3943 		/* Revert to late binding */
3944 		connp->conn_multicast_ipif = NULL;
3945 	}
3946 	mutex_exit(&connp->conn_lock);
3947 
3948 	conn_delete_ire(connp, (caddr_t)ipif);
3949 }
3950 
3951 /*
3952  * Called from ill close by ipcl_walk for clearing conn_ilg and
3953  * conn_multicast_ill for a given ill. conn is held by caller.
3954  * Note that ipcl_walk only walks conns that are not yet condemned.
3955  * condemned conns can't be refheld. For this reason, conn must become clean
3956  * first, i.e. it must not refer to any ill/ire/ipif and then only set
3957  * condemned flag.
3958  */
3959 static void
3960 conn_delete_ill(conn_t *connp, caddr_t arg)
3961 {
3962 	ill_t	*ill = (ill_t *)arg;
3963 	int	i;
3964 	char	group_buf[INET6_ADDRSTRLEN];
3965 	in6_addr_t v6group;
3966 	int	orig_ifindex;
3967 	ilg_t	*ilg;
3968 
3969 	/*
3970 	 * Even though conn_ilg_inuse can change while we are in this loop,
3971 	 * no new ilgs can be created/deleted for this connp, on this
3972 	 * ill, since this ill is the perimeter. So we won't miss any ilg
3973 	 * in this cleanup.
3974 	 */
3975 	mutex_enter(&connp->conn_lock);
3976 
3977 	/*
3978 	 * Increment the walker count, so that ilg repacking does not
3979 	 * occur while we are in the loop.
3980 	 */
3981 	ILG_WALKER_HOLD(connp);
3982 	for (i = connp->conn_ilg_inuse - 1; i >= 0; i--) {
3983 		ilg = &connp->conn_ilg[i];
3984 		if ((ilg->ilg_ill == ill) && !(ilg->ilg_flags & ILG_DELETED)) {
3985 			/*
3986 			 * ip_close cannot be cleaning this ilg at the same
3987 			 * time, since it also has to execute in this ill's
3988 			 * perimeter which we are now holding. Only a clean
3989 			 * conn can be condemned.
3990 			 */
3991 			ASSERT(!(connp->conn_state_flags & CONN_CONDEMNED));
3992 
3993 			/* Blow away the membership */
3994 			ip1dbg(("conn_delete_ilg_ill: %s on %s\n",
3995 			    inet_ntop(AF_INET6, &ilg->ilg_v6group,
3996 			    group_buf, sizeof (group_buf)),
3997 			    ill->ill_name));
3998 
3999 			v6group = ilg->ilg_v6group;
4000 			orig_ifindex = ilg->ilg_orig_ifindex;
4001 			ilg_delete(connp, ilg, NULL);
4002 			mutex_exit(&connp->conn_lock);
4003 
4004 			(void) ip_delmulti_v6(&v6group, ill, orig_ifindex,
4005 			    connp->conn_zoneid, B_FALSE, B_TRUE);
4006 			mutex_enter(&connp->conn_lock);
4007 		}
4008 	}
4009 	/*
4010 	 * If we are the last walker, need to physically delete the
4011 	 * ilgs and repack.
4012 	 */
4013 	ILG_WALKER_RELE(connp);
4014 
4015 	if (connp->conn_multicast_ill == ill) {
4016 		/* Revert to late binding */
4017 		connp->conn_multicast_ill = NULL;
4018 		connp->conn_orig_multicast_ifindex = 0;
4019 	}
4020 	mutex_exit(&connp->conn_lock);
4021 }
4022 
4023 /*
4024  * Called when an ipif is unplumbed to make sure that there are no
4025  * dangling conn references to that ipif.
4026  * Handles ilg_ipif and conn_multicast_ipif
4027  */
4028 void
4029 reset_conn_ipif(ipif)
4030 	ipif_t	*ipif;
4031 {
4032 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
4033 
4034 	ipcl_walk(conn_delete_ipif, (caddr_t)ipif, ipst);
4035 }
4036 
4037 /*
4038  * Called when an ill is unplumbed to make sure that there are no
4039  * dangling conn references to that ill.
4040  * Handles ilg_ill, conn_multicast_ill.
4041  */
4042 void
4043 reset_conn_ill(ill_t *ill)
4044 {
4045 	ip_stack_t	*ipst = ill->ill_ipst;
4046 
4047 	ipcl_walk(conn_delete_ill, (caddr_t)ill, ipst);
4048 }
4049 
4050 #ifdef DEBUG
4051 /*
4052  * Walk functions walk all the interfaces in the system to make
4053  * sure that there is no refernece to the ipif or ill that is
4054  * going away.
4055  */
4056 int
4057 ilm_walk_ill(ill_t *ill)
4058 {
4059 	int cnt = 0;
4060 	ill_t *till;
4061 	ilm_t *ilm;
4062 	ill_walk_context_t ctx;
4063 	ip_stack_t	*ipst = ill->ill_ipst;
4064 
4065 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4066 	till = ILL_START_WALK_ALL(&ctx, ipst);
4067 	for (; till != NULL; till = ill_next(&ctx, till)) {
4068 		mutex_enter(&till->ill_lock);
4069 		for (ilm = till->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
4070 			if (ilm->ilm_ill == ill) {
4071 				cnt++;
4072 			}
4073 		}
4074 		mutex_exit(&till->ill_lock);
4075 	}
4076 	rw_exit(&ipst->ips_ill_g_lock);
4077 
4078 	return (cnt);
4079 }
4080 
4081 /*
4082  * This function is called before the ipif is freed.
4083  */
4084 int
4085 ilm_walk_ipif(ipif_t *ipif)
4086 {
4087 	int cnt = 0;
4088 	ill_t *till;
4089 	ilm_t *ilm;
4090 	ill_walk_context_t ctx;
4091 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
4092 
4093 	till = ILL_START_WALK_ALL(&ctx, ipst);
4094 	for (; till != NULL; till = ill_next(&ctx, till)) {
4095 		mutex_enter(&till->ill_lock);
4096 		for (ilm = till->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
4097 			if (ilm->ilm_ipif == ipif) {
4098 					cnt++;
4099 			}
4100 		}
4101 		mutex_exit(&till->ill_lock);
4102 	}
4103 	return (cnt);
4104 }
4105 #endif
4106