xref: /titanic_51/usr/src/uts/common/inet/ip/ip_if.c (revision 35edde3ca59e6f5aca765251cb3482779948f600)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /* Copyright (c) 1990 Mentat Inc. */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 /*
30  * This file contains the interface control functions for IP.
31  */
32 
33 #include <sys/types.h>
34 #include <sys/stream.h>
35 #include <sys/dlpi.h>
36 #include <sys/stropts.h>
37 #include <sys/strsun.h>
38 #include <sys/sysmacros.h>
39 #include <sys/strlog.h>
40 #include <sys/ddi.h>
41 #include <sys/sunddi.h>
42 #include <sys/cmn_err.h>
43 #include <sys/kstat.h>
44 #include <sys/debug.h>
45 #include <sys/zone.h>
46 
47 #include <sys/kmem.h>
48 #include <sys/systm.h>
49 #include <sys/param.h>
50 #include <sys/socket.h>
51 #define	_SUN_TPI_VERSION	2
52 #include <sys/tihdr.h>
53 #include <sys/isa_defs.h>
54 #include <net/if.h>
55 #include <net/if_arp.h>
56 #include <net/if_types.h>
57 #include <net/if_dl.h>
58 #include <net/route.h>
59 #include <sys/sockio.h>
60 #include <netinet/in.h>
61 #include <netinet/ip6.h>
62 #include <netinet/icmp6.h>
63 #include <netinet/igmp_var.h>
64 #include <sys/strsun.h>
65 #include <sys/policy.h>
66 #include <sys/ethernet.h>
67 
68 #include <inet/common.h>   /* for various inet/mi.h and inet/nd.h needs */
69 #include <inet/mi.h>
70 #include <inet/nd.h>
71 #include <inet/arp.h>
72 #include <inet/mib2.h>
73 #include <inet/ip.h>
74 #include <inet/ip6.h>
75 #include <inet/ip6_asp.h>
76 #include <inet/tcp.h>
77 #include <inet/ip_multi.h>
78 #include <inet/ip_ire.h>
79 #include <inet/ip_rts.h>
80 #include <inet/ip_ndp.h>
81 #include <inet/ip_if.h>
82 #include <inet/ip_impl.h>
83 #include <inet/tun.h>
84 #include <inet/sctp_ip.h>
85 
86 #include <net/pfkeyv2.h>
87 #include <inet/ipsec_info.h>
88 #include <inet/sadb.h>
89 #include <inet/ipsec_impl.h>
90 #include <sys/iphada.h>
91 
92 
93 #include <netinet/igmp.h>
94 #include <inet/ip_listutils.h>
95 #include <netinet/ip_mroute.h>
96 #include <inet/ipclassifier.h>
97 #include <sys/mac.h>
98 
99 #include <sys/systeminfo.h>
100 #include <sys/bootconf.h>
101 
102 /* The character which tells where the ill_name ends */
103 #define	IPIF_SEPARATOR_CHAR	':'
104 
105 /* IP ioctl function table entry */
106 typedef struct ipft_s {
107 	int	ipft_cmd;
108 	pfi_t	ipft_pfi;
109 	int	ipft_min_size;
110 	int	ipft_flags;
111 } ipft_t;
112 #define	IPFT_F_NO_REPLY		0x1	/* IP ioctl does not expect any reply */
113 #define	IPFT_F_SELF_REPLY	0x2	/* ioctl callee does the ioctl reply */
114 
115 typedef struct ip_sock_ar_s {
116 	union {
117 		area_t	ip_sock_area;
118 		ared_t	ip_sock_ared;
119 		areq_t	ip_sock_areq;
120 	} ip_sock_ar_u;
121 	queue_t	*ip_sock_ar_q;
122 } ip_sock_ar_t;
123 
124 static int	nd_ill_forward_get(queue_t *, mblk_t *, caddr_t, cred_t *);
125 static int	nd_ill_forward_set(queue_t *q, mblk_t *mp,
126 		    char *value, caddr_t cp, cred_t *ioc_cr);
127 
128 static boolean_t ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask);
129 static ip_m_t	*ip_m_lookup(t_uscalar_t mac_type);
130 static int	ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
131     mblk_t *mp, boolean_t need_up);
132 static int	ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
133     mblk_t *mp, boolean_t need_up);
134 static int	ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
135     queue_t *q, mblk_t *mp, boolean_t need_up);
136 static int	ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q,
137     mblk_t *mp, boolean_t need_up);
138 static int	ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
139     mblk_t *mp);
140 static int	ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t, in6_addr_t,
141     queue_t *q, mblk_t *mp, boolean_t need_up);
142 static int	ip_sioctl_arp_common(ill_t *ill, queue_t *q, mblk_t *mp,
143     sin_t *sin, boolean_t x_arp_ioctl, boolean_t if_arp_ioctl);
144 static ipaddr_t	ip_subnet_mask(ipaddr_t addr, ipif_t **);
145 static void	ip_wput_ioctl(queue_t *q, mblk_t *mp);
146 static void	ipsq_flush(ill_t *ill);
147 static void	ipsq_clean_all(ill_t *ill);
148 static void	ipsq_clean_ring(ill_t *ill, ill_rx_ring_t *rx_ring);
149 static	int	ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen,
150     queue_t *q, mblk_t *mp, boolean_t need_up);
151 static void	ipsq_delete(ipsq_t *);
152 
153 static ipif_t	*ipif_allocate(ill_t *ill, int id, uint_t ire_type,
154 		    boolean_t initialize);
155 static void	ipif_check_bcast_ires(ipif_t *test_ipif);
156 static void	ipif_down_delete_ire(ire_t *ire, char *ipif);
157 static void	ipif_delete_cache_ire(ire_t *, char *);
158 static int	ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp);
159 static void	ipif_down_tail(ipif_t *ipif);
160 static void	ipif_free(ipif_t *ipif);
161 static void	ipif_free_tail(ipif_t *ipif);
162 static void	ipif_mask_reply(ipif_t *);
163 static void	ipif_mtu_change(ire_t *ire, char *ipif_arg);
164 static void	ipif_multicast_down(ipif_t *ipif);
165 static void	ipif_recreate_interface_routes(ipif_t *old_ipif, ipif_t *ipif);
166 static void	ipif_set_default(ipif_t *ipif);
167 static int	ipif_set_values(queue_t *q, mblk_t *mp,
168     char *interf_name, uint_t *ppa);
169 static int	ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp,
170     queue_t *q);
171 static ipif_t	*ipif_lookup_on_name(char *name, size_t namelen,
172     boolean_t do_alloc, boolean_t *exists, boolean_t isv6, zoneid_t zoneid,
173     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error);
174 static int	ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp);
175 static void	ipif_update_other_ipifs(ipif_t *old_ipif, ill_group_t *illgrp);
176 
177 static int	ill_alloc_ppa(ill_if_t *, ill_t *);
178 static int	ill_arp_off(ill_t *ill);
179 static int	ill_arp_on(ill_t *ill);
180 static void	ill_delete_interface_type(ill_if_t *);
181 static int	ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q);
182 static void	ill_down(ill_t *ill);
183 static void	ill_downi(ire_t *ire, char *ill_arg);
184 static void	ill_downi_mrtun_srcif(ire_t *ire, char *ill_arg);
185 static void	ill_down_tail(ill_t *ill);
186 static void	ill_free_mib(ill_t *ill);
187 static void	ill_glist_delete(ill_t *);
188 static boolean_t ill_has_usable_ipif(ill_t *);
189 static int	ill_lock_ipsq_ills(ipsq_t *sq, ill_t **list, int);
190 static void	ill_nominate_bcast_rcv(ill_group_t *illgrp);
191 static void	ill_phyint_free(ill_t *ill);
192 static void	ill_phyint_reinit(ill_t *ill);
193 static void	ill_set_nce_router_flags(ill_t *, boolean_t);
194 static void	ill_signal_ipsq_ills(ipsq_t *, boolean_t);
195 static boolean_t ill_split_ipsq(ipsq_t *cur_sq);
196 static void	ill_stq_cache_delete(ire_t *, char *);
197 
198 static boolean_t ip_ether_v6intfid(uint_t, uint8_t *, in6_addr_t *);
199 static boolean_t ip_nodef_v6intfid(uint_t, uint8_t *, in6_addr_t *);
200 static boolean_t ip_ether_v6mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
201     in6_addr_t *);
202 static boolean_t ip_ether_v4mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
203     ipaddr_t *);
204 static boolean_t ip_ib_v6intfid(uint_t, uint8_t *, in6_addr_t *);
205 static boolean_t ip_ib_v6mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
206     in6_addr_t *);
207 static boolean_t ip_ib_v4mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
208     ipaddr_t *);
209 
210 static void	ipif_save_ire(ipif_t *, ire_t *);
211 static void	ipif_remove_ire(ipif_t *, ire_t *);
212 static void 	ip_cgtp_bcast_add(ire_t *, ire_t *);
213 static void 	ip_cgtp_bcast_delete(ire_t *);
214 
215 /*
216  * Per-ill IPsec capabilities management.
217  */
218 static ill_ipsec_capab_t *ill_ipsec_capab_alloc(void);
219 static void	ill_ipsec_capab_free(ill_ipsec_capab_t *);
220 static void	ill_ipsec_capab_add(ill_t *, uint_t, boolean_t);
221 static void	ill_ipsec_capab_delete(ill_t *, uint_t);
222 static boolean_t ill_ipsec_capab_resize_algparm(ill_ipsec_capab_t *, int);
223 static void ill_capability_proto(ill_t *, int, mblk_t *);
224 static void ill_capability_dispatch(ill_t *, mblk_t *, dl_capability_sub_t *,
225     boolean_t);
226 static void ill_capability_id_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
227 static void ill_capability_mdt_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
228 static void ill_capability_mdt_reset(ill_t *, mblk_t **);
229 static void ill_capability_ipsec_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
230 static void ill_capability_ipsec_reset(ill_t *, mblk_t **);
231 static void ill_capability_hcksum_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
232 static void ill_capability_hcksum_reset(ill_t *, mblk_t **);
233 static void ill_capability_zerocopy_ack(ill_t *, mblk_t *,
234     dl_capability_sub_t *);
235 static void ill_capability_zerocopy_reset(ill_t *, mblk_t **);
236 
237 static void ill_capability_dls_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
238 static mac_resource_handle_t ill_ring_add(void *, mac_resource_t *);
239 static void ill_capability_dls_reset(ill_t *, mblk_t **);
240 static void ill_capability_dls_disable(ill_t *);
241 
242 static void	illgrp_cache_delete(ire_t *, char *);
243 static void	illgrp_delete(ill_t *ill);
244 static void	illgrp_reset_schednext(ill_t *ill);
245 
246 static ill_t	*ill_prev_usesrc(ill_t *);
247 static int	ill_relink_usesrc_ills(ill_t *, ill_t *, uint_t);
248 static void	ill_disband_usesrc_group(ill_t *);
249 
250 static void	conn_cleanup_stale_ire(conn_t *, caddr_t);
251 
252 /*
253  * if we go over the memory footprint limit more than once in this msec
254  * interval, we'll start pruning aggressively.
255  */
256 int ip_min_frag_prune_time = 0;
257 
258 /*
259  * max # of IPsec algorithms supported.  Limited to 1 byte by PF_KEY
260  * and the IPsec DOI
261  */
262 #define	MAX_IPSEC_ALGS	256
263 
264 #define	BITSPERBYTE	8
265 #define	BITS(type)	(BITSPERBYTE * (long)sizeof (type))
266 
267 #define	IPSEC_ALG_ENABLE(algs, algid) \
268 		((algs)[(algid) / BITS(ipsec_capab_elem_t)] |= \
269 		(1 << ((algid) % BITS(ipsec_capab_elem_t))))
270 
271 #define	IPSEC_ALG_IS_ENABLED(algid, algs) \
272 		((algs)[(algid) / BITS(ipsec_capab_elem_t)] & \
273 		(1 << ((algid) % BITS(ipsec_capab_elem_t))))
274 
275 typedef uint8_t ipsec_capab_elem_t;
276 
277 /*
278  * Per-algorithm parameters.  Note that at present, only encryption
279  * algorithms have variable keysize (IKE does not provide a way to negotiate
280  * auth algorithm keysize).
281  *
282  * All sizes here are in bits.
283  */
284 typedef struct
285 {
286 	uint16_t	minkeylen;
287 	uint16_t	maxkeylen;
288 } ipsec_capab_algparm_t;
289 
290 /*
291  * Per-ill capabilities.
292  */
293 struct ill_ipsec_capab_s {
294 	ipsec_capab_elem_t *encr_hw_algs;
295 	ipsec_capab_elem_t *auth_hw_algs;
296 	uint32_t algs_size;	/* size of _hw_algs in bytes */
297 	/* algorithm key lengths */
298 	ipsec_capab_algparm_t *encr_algparm;
299 	uint32_t encr_algparm_size;
300 	uint32_t encr_algparm_end;
301 };
302 
303 /*
304  * List of AH and ESP IPsec acceleration capable ills
305  */
306 typedef struct ipsec_capab_ill_s {
307 	uint_t ill_index;
308 	boolean_t ill_isv6;
309 	struct ipsec_capab_ill_s *next;
310 } ipsec_capab_ill_t;
311 
312 static ipsec_capab_ill_t *ipsec_capab_ills_ah;
313 static ipsec_capab_ill_t *ipsec_capab_ills_esp;
314 krwlock_t ipsec_capab_ills_lock;
315 
316 /*
317  * The field values are larger than strictly necessary for simple
318  * AR_ENTRY_ADDs but the padding lets us accomodate the socket ioctls.
319  */
320 static area_t	ip_area_template = {
321 	AR_ENTRY_ADD,			/* area_cmd */
322 	sizeof (ip_sock_ar_t) + (IP_ADDR_LEN*2) + sizeof (struct sockaddr_dl),
323 					/* area_name_offset */
324 	/* area_name_length temporarily holds this structure length */
325 	sizeof (area_t),			/* area_name_length */
326 	IP_ARP_PROTO_TYPE,		/* area_proto */
327 	sizeof (ip_sock_ar_t),		/* area_proto_addr_offset */
328 	IP_ADDR_LEN,			/* area_proto_addr_length */
329 	sizeof (ip_sock_ar_t) + IP_ADDR_LEN,
330 					/* area_proto_mask_offset */
331 	0,				/* area_flags */
332 	sizeof (ip_sock_ar_t) + IP_ADDR_LEN + IP_ADDR_LEN,
333 					/* area_hw_addr_offset */
334 	/* Zero length hw_addr_length means 'use your idea of the address' */
335 	0				/* area_hw_addr_length */
336 };
337 
338 /*
339  * AR_ENTRY_ADD/DELETE templates have been added for IPv6 external resolver
340  * support
341  */
342 static area_t	ip6_area_template = {
343 	AR_ENTRY_ADD,			/* area_cmd */
344 	sizeof (ip_sock_ar_t) + (IPV6_ADDR_LEN*2) + sizeof (sin6_t),
345 					/* area_name_offset */
346 	/* area_name_length temporarily holds this structure length */
347 	sizeof (area_t),			/* area_name_length */
348 	IP_ARP_PROTO_TYPE,		/* area_proto */
349 	sizeof (ip_sock_ar_t),		/* area_proto_addr_offset */
350 	IPV6_ADDR_LEN,			/* area_proto_addr_length */
351 	sizeof (ip_sock_ar_t) + IPV6_ADDR_LEN,
352 					/* area_proto_mask_offset */
353 	0,				/* area_flags */
354 	sizeof (ip_sock_ar_t) + IPV6_ADDR_LEN + IPV6_ADDR_LEN,
355 					/* area_hw_addr_offset */
356 	/* Zero length hw_addr_length means 'use your idea of the address' */
357 	0				/* area_hw_addr_length */
358 };
359 
360 static ared_t	ip_ared_template = {
361 	AR_ENTRY_DELETE,
362 	sizeof (ared_t) + IP_ADDR_LEN,
363 	sizeof (ared_t),
364 	IP_ARP_PROTO_TYPE,
365 	sizeof (ared_t),
366 	IP_ADDR_LEN
367 };
368 
369 static ared_t	ip6_ared_template = {
370 	AR_ENTRY_DELETE,
371 	sizeof (ared_t) + IPV6_ADDR_LEN,
372 	sizeof (ared_t),
373 	IP_ARP_PROTO_TYPE,
374 	sizeof (ared_t),
375 	IPV6_ADDR_LEN
376 };
377 
378 /*
379  * A template for an IPv6 AR_ENTRY_QUERY template has not been created, as
380  * as the areq doesn't include an IP address in ill_dl_up() (the only place a
381  * areq is used).
382  */
383 static areq_t	ip_areq_template = {
384 	AR_ENTRY_QUERY,			/* cmd */
385 	sizeof (areq_t)+(2*IP_ADDR_LEN),	/* name offset */
386 	sizeof (areq_t),	/* name len (filled by ill_arp_alloc) */
387 	IP_ARP_PROTO_TYPE,		/* protocol, from arps perspective */
388 	sizeof (areq_t),			/* target addr offset */
389 	IP_ADDR_LEN,			/* target addr_length */
390 	0,				/* flags */
391 	sizeof (areq_t) + IP_ADDR_LEN,	/* sender addr offset */
392 	IP_ADDR_LEN,			/* sender addr length */
393 	6,				/* xmit_count */
394 	1000,				/* (re)xmit_interval in milliseconds */
395 	4				/* max # of requests to buffer */
396 	/* anything else filled in by the code */
397 };
398 
399 static arc_t	ip_aru_template = {
400 	AR_INTERFACE_UP,
401 	sizeof (arc_t),		/* Name offset */
402 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
403 };
404 
405 static arc_t	ip_ard_template = {
406 	AR_INTERFACE_DOWN,
407 	sizeof (arc_t),		/* Name offset */
408 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
409 };
410 
411 static arc_t	ip_aron_template = {
412 	AR_INTERFACE_ON,
413 	sizeof (arc_t),		/* Name offset */
414 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
415 };
416 
417 static arc_t	ip_aroff_template = {
418 	AR_INTERFACE_OFF,
419 	sizeof (arc_t),		/* Name offset */
420 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
421 };
422 
423 
424 static arma_t	ip_arma_multi_template = {
425 	AR_MAPPING_ADD,
426 	sizeof (arma_t) + 3*IP_ADDR_LEN + IP_MAX_HW_LEN,
427 				/* Name offset */
428 	sizeof (arma_t),	/* Name length (set by ill_arp_alloc) */
429 	IP_ARP_PROTO_TYPE,
430 	sizeof (arma_t),			/* proto_addr_offset */
431 	IP_ADDR_LEN,				/* proto_addr_length */
432 	sizeof (arma_t) + IP_ADDR_LEN,		/* proto_mask_offset */
433 	sizeof (arma_t) + 2*IP_ADDR_LEN,	/* proto_extract_mask_offset */
434 	ACE_F_PERMANENT | ACE_F_MAPPING,	/* flags */
435 	sizeof (arma_t) + 3*IP_ADDR_LEN,	/* hw_addr_offset */
436 	IP_MAX_HW_LEN,				/* hw_addr_length */
437 	0,					/* hw_mapping_start */
438 };
439 
440 static ipft_t	ip_ioctl_ftbl[] = {
441 	{ IP_IOC_IRE_DELETE, ip_ire_delete, sizeof (ipid_t), 0 },
442 	{ IP_IOC_IRE_DELETE_NO_REPLY, ip_ire_delete, sizeof (ipid_t),
443 		IPFT_F_NO_REPLY },
444 	{ IP_IOC_IRE_ADVISE_NO_REPLY, ip_ire_advise, sizeof (ipic_t),
445 		IPFT_F_NO_REPLY },
446 	{ IP_IOC_RTS_REQUEST, ip_rts_request, 0, IPFT_F_SELF_REPLY },
447 	{ 0 }
448 };
449 
450 /* Simple ICMP IP Header Template */
451 static ipha_t icmp_ipha = {
452 	IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
453 };
454 
455 /* Flag descriptors for ip_ipif_report */
456 static nv_t	ipif_nv_tbl[] = {
457 	{ IPIF_UP,		"UP" },
458 	{ IPIF_BROADCAST,	"BROADCAST" },
459 	{ ILLF_DEBUG,		"DEBUG" },
460 	{ PHYI_LOOPBACK,	"LOOPBACK" },
461 	{ IPIF_POINTOPOINT,	"POINTOPOINT" },
462 	{ ILLF_NOTRAILERS,	"NOTRAILERS" },
463 	{ PHYI_RUNNING,		"RUNNING" },
464 	{ ILLF_NOARP,		"NOARP" },
465 	{ PHYI_PROMISC,		"PROMISC" },
466 	{ PHYI_ALLMULTI,	"ALLMULTI" },
467 	{ PHYI_INTELLIGENT,	"INTELLIGENT" },
468 	{ ILLF_MULTICAST,	"MULTICAST" },
469 	{ PHYI_MULTI_BCAST,	"MULTI_BCAST" },
470 	{ IPIF_UNNUMBERED,	"UNNUMBERED" },
471 	{ IPIF_DHCPRUNNING,	"DHCP" },
472 	{ IPIF_PRIVATE,		"PRIVATE" },
473 	{ IPIF_NOXMIT,		"NOXMIT" },
474 	{ IPIF_NOLOCAL,		"NOLOCAL" },
475 	{ IPIF_DEPRECATED,	"DEPRECATED" },
476 	{ IPIF_PREFERRED,	"PREFERRED" },
477 	{ IPIF_TEMPORARY,	"TEMPORARY" },
478 	{ IPIF_ADDRCONF,	"ADDRCONF" },
479 	{ PHYI_VIRTUAL,		"VIRTUAL" },
480 	{ ILLF_ROUTER,		"ROUTER" },
481 	{ ILLF_NONUD,		"NONUD" },
482 	{ IPIF_ANYCAST,		"ANYCAST" },
483 	{ ILLF_NORTEXCH,	"NORTEXCH" },
484 	{ ILLF_IPV4,		"IPV4" },
485 	{ ILLF_IPV6,		"IPV6" },
486 	{ IPIF_MIPRUNNING,	"MIP" },
487 	{ IPIF_NOFAILOVER,	"NOFAILOVER" },
488 	{ PHYI_FAILED,		"FAILED" },
489 	{ PHYI_STANDBY,		"STANDBY" },
490 	{ PHYI_INACTIVE,	"INACTIVE" },
491 	{ PHYI_OFFLINE,		"OFFLINE" },
492 };
493 
494 static uchar_t	ip_six_byte_all_ones[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
495 
496 static ip_m_t	ip_m_tbl[] = {
497 	{ DL_ETHER, IFT_ETHER, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
498 	    ip_ether_v6intfid },
499 	{ DL_CSMACD, IFT_ISO88023, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
500 	    ip_nodef_v6intfid },
501 	{ DL_TPB, IFT_ISO88024, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
502 	    ip_nodef_v6intfid },
503 	{ DL_TPR, IFT_ISO88025, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
504 	    ip_nodef_v6intfid },
505 	{ DL_FDDI, IFT_FDDI, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
506 	    ip_ether_v6intfid },
507 	{ DL_IB, IFT_IB, ip_ib_v4mapinfo, ip_ib_v6mapinfo,
508 	    ip_ib_v6intfid },
509 	{ SUNW_DL_VNI, IFT_OTHER, NULL, NULL, NULL},
510 	{ DL_OTHER, IFT_OTHER, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
511 	    ip_nodef_v6intfid }
512 };
513 
514 static ill_t	ill_null;		/* Empty ILL for init. */
515 char	ipif_loopback_name[] = "lo0";
516 static char *ipv4_forward_suffix = ":ip_forwarding";
517 static char *ipv6_forward_suffix = ":ip6_forwarding";
518 static kstat_t *loopback_ksp = NULL;
519 static	sin6_t	sin6_null;	/* Zero address for quick clears */
520 static	sin_t	sin_null;	/* Zero address for quick clears */
521 static	uint_t	ill_index = 1;	/* Used to assign interface indicies */
522 /* When set search for unused index */
523 static boolean_t ill_index_wrap = B_FALSE;
524 /* When set search for unused ipif_seqid */
525 static ipif_t	ipif_zero;
526 uint_t	ipif_src_random;
527 
528 /*
529  * For details on the protection offered by these locks please refer
530  * to the notes under the Synchronization section at the start of ip.c
531  */
532 krwlock_t	ill_g_lock;		/* The global ill_g_lock */
533 kmutex_t	ip_addr_avail_lock;	/* Address availability check lock */
534 ipsq_t		*ipsq_g_head;		/* List of all ipsq's on the system */
535 
536 krwlock_t	ill_g_usesrc_lock;	/* Protects usesrc related fields */
537 
538 /*
539  * illgrp_head/ifgrp_head is protected by IP's perimeter.
540  */
541 static  ill_group_t *illgrp_head_v4;	/* Head of IPv4 ill groups */
542 ill_group_t *illgrp_head_v6;		/* Head of IPv6 ill groups */
543 
544 ill_g_head_t	ill_g_heads[MAX_G_HEADS];   /* ILL List Head */
545 
546 /*
547  * ppa arena is created after these many
548  * interfaces have been plumbed.
549  */
550 uint_t	ill_no_arena = 12;
551 
552 #pragma align CACHE_ALIGN_SIZE(phyint_g_list)
553 static phyint_list_t phyint_g_list;	/* start of phyint list */
554 
555 /*
556  * Reflects value of FAILBACK variable in IPMP config file
557  * /etc/default/mpathd. Default value is B_TRUE.
558  * Set to B_FALSE if user disabled failback by configuring "FAILBACK=no"
559  * in.mpathd uses SIOCSIPMPFAILBACK ioctl to pass this information to kernel.
560  */
561 static boolean_t ipmp_enable_failback = B_TRUE;
562 
563 /*
564  * Enable soft rings if ip_squeue_soft_ring or ip_squeue_fanout
565  * is set and ip_soft_rings_cnt > 0. ip_squeue_soft_ring is
566  * set through platform specific code (Niagara/Ontario).
567  */
568 #define	SOFT_RINGS_ENABLED()	(ip_soft_rings_cnt ? \
569 		(ip_squeue_soft_ring || ip_squeue_fanout) : B_FALSE)
570 
571 #define	ILL_CAPAB_DLS	(ILL_CAPAB_SOFT_RING | ILL_CAPAB_POLL)
572 
573 static uint_t
574 ipif_rand(void)
575 {
576 	ipif_src_random = ipif_src_random * 1103515245 + 12345;
577 	return ((ipif_src_random >> 16) & 0x7fff);
578 }
579 
580 /*
581  * Allocate per-interface mibs. Only used for ipv6.
582  * Returns true if ok. False otherwise.
583  *  ipsq  may not yet be allocated (loopback case ).
584  */
585 static boolean_t
586 ill_allocate_mibs(ill_t *ill)
587 {
588 	ASSERT(ill->ill_isv6);
589 
590 	/* Already allocated? */
591 	if (ill->ill_ip6_mib != NULL) {
592 		ASSERT(ill->ill_icmp6_mib != NULL);
593 		return (B_TRUE);
594 	}
595 
596 	ill->ill_ip6_mib = kmem_zalloc(sizeof (*ill->ill_ip6_mib),
597 	    KM_NOSLEEP);
598 	if (ill->ill_ip6_mib == NULL) {
599 		return (B_FALSE);
600 	}
601 	ill->ill_icmp6_mib = kmem_zalloc(sizeof (*ill->ill_icmp6_mib),
602 	    KM_NOSLEEP);
603 	if (ill->ill_icmp6_mib == NULL) {
604 		kmem_free(ill->ill_ip6_mib, sizeof (*ill->ill_ip6_mib));
605 		ill->ill_ip6_mib = NULL;
606 		return (B_FALSE);
607 	}
608 	/*
609 	 * The ipv6Ifindex and ipv6IfIcmpIndex will be assigned later
610 	 * after the phyint merge occurs in ipif_set_values -> ill_glist_insert
611 	 * -> ill_phyint_reinit
612 	 */
613 	return (B_TRUE);
614 }
615 
616 /*
617  * Common code for preparation of ARP commands.  Two points to remember:
618  * 	1) The ill_name is tacked on at the end of the allocated space so
619  *	   the templates name_offset field must contain the total space
620  *	   to allocate less the name length.
621  *
622  *	2) The templates name_length field should contain the *template*
623  *	   length.  We use it as a parameter to bcopy() and then write
624  *	   the real ill_name_length into the name_length field of the copy.
625  * (Always called as writer.)
626  */
627 mblk_t *
628 ill_arp_alloc(ill_t *ill, uchar_t *template, caddr_t addr)
629 {
630 	arc_t	*arc = (arc_t *)template;
631 	char	*cp;
632 	int	len;
633 	mblk_t	*mp;
634 	uint_t	name_length = ill->ill_name_length;
635 	uint_t	template_len = arc->arc_name_length;
636 
637 	len = arc->arc_name_offset + name_length;
638 	mp = allocb(len, BPRI_HI);
639 	if (mp == NULL)
640 		return (NULL);
641 	cp = (char *)mp->b_rptr;
642 	mp->b_wptr = (uchar_t *)&cp[len];
643 	if (template_len)
644 		bcopy(template, cp, template_len);
645 	if (len > template_len)
646 		bzero(&cp[template_len], len - template_len);
647 	mp->b_datap->db_type = M_PROTO;
648 
649 	arc = (arc_t *)cp;
650 	arc->arc_name_length = name_length;
651 	cp = (char *)arc + arc->arc_name_offset;
652 	bcopy(ill->ill_name, cp, name_length);
653 
654 	if (addr) {
655 		area_t	*area = (area_t *)mp->b_rptr;
656 
657 		cp = (char *)area + area->area_proto_addr_offset;
658 		bcopy(addr, cp, area->area_proto_addr_length);
659 		if (area->area_cmd == AR_ENTRY_ADD) {
660 			cp = (char *)area;
661 			len = area->area_proto_addr_length;
662 			if (area->area_proto_mask_offset)
663 				cp += area->area_proto_mask_offset;
664 			else
665 				cp += area->area_proto_addr_offset + len;
666 			while (len-- > 0)
667 				*cp++ = (char)~0;
668 		}
669 	}
670 	return (mp);
671 }
672 
673 /*
674  * Completely vaporize a lower level tap and all associated interfaces.
675  * ill_delete is called only out of ip_close when the device control
676  * stream is being closed.
677  */
678 void
679 ill_delete(ill_t *ill)
680 {
681 	ipif_t	*ipif;
682 	ill_t	*prev_ill;
683 
684 	/*
685 	 * ill_delete may be forcibly entering the ipsq. The previous
686 	 * ioctl may not have completed and may need to be aborted.
687 	 * ipsq_flush takes care of it. If we don't need to enter the
688 	 * the ipsq forcibly, the 2nd invocation of ipsq_flush in
689 	 * ill_delete_tail is sufficient.
690 	 */
691 	ipsq_flush(ill);
692 
693 	/*
694 	 * Nuke all interfaces.  ipif_free will take down the interface,
695 	 * remove it from the list, and free the data structure.
696 	 * Walk down the ipif list and remove the logical interfaces
697 	 * first before removing the main ipif. We can't unplumb
698 	 * zeroth interface first in the case of IPv6 as reset_conn_ill
699 	 * -> ip_ll_delmulti_v6 de-references ill_ipif for checking
700 	 * POINTOPOINT.
701 	 *
702 	 * If ill_ipif was not properly initialized (i.e low on memory),
703 	 * then no interfaces to clean up. In this case just clean up the
704 	 * ill.
705 	 */
706 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
707 		ipif_free(ipif);
708 
709 	/*
710 	 * Used only by ill_arp_on and ill_arp_off, which are writers.
711 	 * So nobody can be using this mp now. Free the mp allocated for
712 	 * honoring ILLF_NOARP
713 	 */
714 	freemsg(ill->ill_arp_on_mp);
715 	ill->ill_arp_on_mp = NULL;
716 
717 	/* Clean up msgs on pending upcalls for mrouted */
718 	reset_mrt_ill(ill);
719 
720 	/*
721 	 * ipif_free -> reset_conn_ipif will remove all multicast
722 	 * references for IPv4. For IPv6, we need to do it here as
723 	 * it points only at ills.
724 	 */
725 	reset_conn_ill(ill);
726 
727 	/*
728 	 * ill_down will arrange to blow off any IRE's dependent on this
729 	 * ILL, and shut down fragmentation reassembly.
730 	 */
731 	ill_down(ill);
732 
733 	/* Let SCTP know, so that it can remove this from its list. */
734 	sctp_update_ill(ill, SCTP_ILL_REMOVE);
735 
736 	/*
737 	 * If an address on this ILL is being used as a source address then
738 	 * clear out the pointers in other ILLs that point to this ILL.
739 	 */
740 	rw_enter(&ill_g_usesrc_lock, RW_WRITER);
741 	if (ill->ill_usesrc_grp_next != NULL) {
742 		if (ill->ill_usesrc_ifindex == 0) { /* usesrc ILL ? */
743 			ill_disband_usesrc_group(ill);
744 		} else {	/* consumer of the usesrc ILL */
745 			prev_ill = ill_prev_usesrc(ill);
746 			prev_ill->ill_usesrc_grp_next =
747 			    ill->ill_usesrc_grp_next;
748 		}
749 	}
750 	rw_exit(&ill_g_usesrc_lock);
751 }
752 
753 /*
754  * ill_delete_tail is called from ip_modclose after all references
755  * to the closing ill are gone. The wait is done in ip_modclose
756  */
757 void
758 ill_delete_tail(ill_t *ill)
759 {
760 	mblk_t	**mpp;
761 	ipif_t	*ipif;
762 
763 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
764 		ipif_down_tail(ipif);
765 
766 	/*
767 	 * If polling capability is enabled (which signifies direct
768 	 * upcall into IP and driver has ill saved as a handle),
769 	 * we need to make sure that unbind has completed before we
770 	 * let the ill disappear and driver no longer has any reference
771 	 * to this ill.
772 	 */
773 	mutex_enter(&ill->ill_lock);
774 	while (ill->ill_state_flags & ILL_DL_UNBIND_IN_PROGRESS)
775 		cv_wait(&ill->ill_cv, &ill->ill_lock);
776 	mutex_exit(&ill->ill_lock);
777 
778 	/*
779 	 * Clean up polling and soft ring capabilities
780 	 */
781 	if (ill->ill_capabilities & (ILL_CAPAB_POLL|ILL_CAPAB_SOFT_RING))
782 		ill_capability_dls_disable(ill);
783 
784 	/*
785 	 * Send the detach if there's one to send (i.e., if we're above a
786 	 * style 2 DLPI driver).
787 	 */
788 	if (ill->ill_detach_mp != NULL) {
789 		ill_dlpi_send(ill, ill->ill_detach_mp);
790 		ill->ill_detach_mp = NULL;
791 	}
792 
793 	if (ill->ill_net_type != IRE_LOOPBACK)
794 		qprocsoff(ill->ill_rq);
795 
796 	/*
797 	 * We do an ipsq_flush once again now. New messages could have
798 	 * landed up from below (M_ERROR or M_HANGUP). Similarly ioctls
799 	 * could also have landed up if an ioctl thread had looked up
800 	 * the ill before we set the ILL_CONDEMNED flag, but not yet
801 	 * enqueued the ioctl when we did the ipsq_flush last time.
802 	 */
803 	ipsq_flush(ill);
804 
805 	/*
806 	 * Free capabilities.
807 	 */
808 	if (ill->ill_ipsec_capab_ah != NULL) {
809 		ill_ipsec_capab_delete(ill, DL_CAPAB_IPSEC_AH);
810 		ill_ipsec_capab_free(ill->ill_ipsec_capab_ah);
811 		ill->ill_ipsec_capab_ah = NULL;
812 	}
813 
814 	if (ill->ill_ipsec_capab_esp != NULL) {
815 		ill_ipsec_capab_delete(ill, DL_CAPAB_IPSEC_ESP);
816 		ill_ipsec_capab_free(ill->ill_ipsec_capab_esp);
817 		ill->ill_ipsec_capab_esp = NULL;
818 	}
819 
820 	if (ill->ill_mdt_capab != NULL) {
821 		kmem_free(ill->ill_mdt_capab, sizeof (ill_mdt_capab_t));
822 		ill->ill_mdt_capab = NULL;
823 	}
824 
825 	if (ill->ill_hcksum_capab != NULL) {
826 		kmem_free(ill->ill_hcksum_capab, sizeof (ill_hcksum_capab_t));
827 		ill->ill_hcksum_capab = NULL;
828 	}
829 
830 	if (ill->ill_zerocopy_capab != NULL) {
831 		kmem_free(ill->ill_zerocopy_capab,
832 		    sizeof (ill_zerocopy_capab_t));
833 		ill->ill_zerocopy_capab = NULL;
834 	}
835 
836 	if (ill->ill_dls_capab != NULL) {
837 		CONN_DEC_REF(ill->ill_dls_capab->ill_unbind_conn);
838 		ill->ill_dls_capab->ill_unbind_conn = NULL;
839 		kmem_free(ill->ill_dls_capab,
840 		    sizeof (ill_dls_capab_t) +
841 		    (sizeof (ill_rx_ring_t) * ILL_MAX_RINGS));
842 		ill->ill_dls_capab = NULL;
843 	}
844 
845 	ASSERT(!(ill->ill_capabilities & ILL_CAPAB_POLL));
846 
847 	while (ill->ill_ipif != NULL)
848 		ipif_free_tail(ill->ill_ipif);
849 
850 	ill_down_tail(ill);
851 
852 	/*
853 	 * We have removed all references to ilm from conn and the ones joined
854 	 * within the kernel.
855 	 *
856 	 * We don't walk conns, mrts and ires because
857 	 *
858 	 * 1) reset_conn_ill and reset_mrt_ill cleans up conns and mrts.
859 	 * 2) ill_down ->ill_downi walks all the ires and cleans up
860 	 *    ill references.
861 	 */
862 	ASSERT(ilm_walk_ill(ill) == 0);
863 	/*
864 	 * Take us out of the list of ILLs. ill_glist_delete -> ill_phyint_free
865 	 * could free the phyint. No more reference to the phyint after this
866 	 * point.
867 	 */
868 	(void) ill_glist_delete(ill);
869 
870 	rw_enter(&ip_g_nd_lock, RW_WRITER);
871 	if (ill->ill_ndd_name != NULL)
872 		nd_unload(&ip_g_nd, ill->ill_ndd_name);
873 	rw_exit(&ip_g_nd_lock);
874 
875 
876 	if (ill->ill_frag_ptr != NULL) {
877 		uint_t count;
878 
879 		for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
880 			mutex_destroy(&ill->ill_frag_hash_tbl[count].ipfb_lock);
881 		}
882 		mi_free(ill->ill_frag_ptr);
883 		ill->ill_frag_ptr = NULL;
884 		ill->ill_frag_hash_tbl = NULL;
885 	}
886 	if (ill->ill_nd_lla_mp != NULL)
887 		freemsg(ill->ill_nd_lla_mp);
888 	/* Free all retained control messages. */
889 	mpp = &ill->ill_first_mp_to_free;
890 	do {
891 		while (mpp[0]) {
892 			mblk_t  *mp;
893 			mblk_t  *mp1;
894 
895 			mp = mpp[0];
896 			mpp[0] = mp->b_next;
897 			for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont) {
898 				mp1->b_next = NULL;
899 				mp1->b_prev = NULL;
900 			}
901 			freemsg(mp);
902 		}
903 	} while (mpp++ != &ill->ill_last_mp_to_free);
904 
905 	ill_free_mib(ill);
906 	ILL_TRACE_CLEANUP(ill);
907 }
908 
909 static void
910 ill_free_mib(ill_t *ill)
911 {
912 	if (ill->ill_ip6_mib != NULL) {
913 		kmem_free(ill->ill_ip6_mib, sizeof (*ill->ill_ip6_mib));
914 		ill->ill_ip6_mib = NULL;
915 	}
916 	if (ill->ill_icmp6_mib != NULL) {
917 		kmem_free(ill->ill_icmp6_mib, sizeof (*ill->ill_icmp6_mib));
918 		ill->ill_icmp6_mib = NULL;
919 	}
920 }
921 
922 /*
923  * Concatenate together a physical address and a sap.
924  *
925  * Sap_lengths are interpreted as follows:
926  *   sap_length == 0	==>	no sap
927  *   sap_length > 0	==>	sap is at the head of the dlpi address
928  *   sap_length < 0	==>	sap is at the tail of the dlpi address
929  */
930 static void
931 ill_dlur_copy_address(uchar_t *phys_src, uint_t phys_length,
932     t_scalar_t sap_src, t_scalar_t sap_length, uchar_t *dst)
933 {
934 	uint16_t sap_addr = (uint16_t)sap_src;
935 
936 	if (sap_length == 0) {
937 		if (phys_src == NULL)
938 			bzero(dst, phys_length);
939 		else
940 			bcopy(phys_src, dst, phys_length);
941 	} else if (sap_length < 0) {
942 		if (phys_src == NULL)
943 			bzero(dst, phys_length);
944 		else
945 			bcopy(phys_src, dst, phys_length);
946 		bcopy(&sap_addr, (char *)dst + phys_length, sizeof (sap_addr));
947 	} else {
948 		bcopy(&sap_addr, dst, sizeof (sap_addr));
949 		if (phys_src == NULL)
950 			bzero((char *)dst + sap_length, phys_length);
951 		else
952 			bcopy(phys_src, (char *)dst + sap_length, phys_length);
953 	}
954 }
955 
956 /*
957  * Generate a dl_unitdata_req mblk for the device and address given.
958  * addr_length is the length of the physical portion of the address.
959  * If addr is NULL include an all zero address of the specified length.
960  * TRUE? In any case, addr_length is taken to be the entire length of the
961  * dlpi address, including the absolute value of sap_length.
962  */
963 mblk_t *
964 ill_dlur_gen(uchar_t *addr, uint_t addr_length, t_uscalar_t sap,
965 		t_scalar_t sap_length)
966 {
967 	dl_unitdata_req_t *dlur;
968 	mblk_t	*mp;
969 	t_scalar_t	abs_sap_length;		/* absolute value */
970 
971 	abs_sap_length = ABS(sap_length);
972 	mp = ip_dlpi_alloc(sizeof (*dlur) + addr_length + abs_sap_length,
973 		DL_UNITDATA_REQ);
974 	if (mp == NULL)
975 		return (NULL);
976 	dlur = (dl_unitdata_req_t *)mp->b_rptr;
977 	/* HACK: accomodate incompatible DLPI drivers */
978 	if (addr_length == 8)
979 		addr_length = 6;
980 	dlur->dl_dest_addr_length = addr_length + abs_sap_length;
981 	dlur->dl_dest_addr_offset = sizeof (*dlur);
982 	dlur->dl_priority.dl_min = 0;
983 	dlur->dl_priority.dl_max = 0;
984 	ill_dlur_copy_address(addr, addr_length, sap, sap_length,
985 	    (uchar_t *)&dlur[1]);
986 	return (mp);
987 }
988 
989 /*
990  * Add the 'mp' to the list of pending mp's headed by ill_pending_mp
991  * Return an error if we already have 1 or more ioctls in progress.
992  * This is used only for non-exclusive ioctls. Currently this is used
993  * for SIOC*ARP and SIOCGTUNPARAM ioctls. Most set ioctls are exclusive
994  * and thus need to use ipsq_pending_mp_add.
995  */
996 boolean_t
997 ill_pending_mp_add(ill_t *ill, conn_t *connp, mblk_t *add_mp)
998 {
999 	ASSERT(MUTEX_HELD(&ill->ill_lock));
1000 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
1001 	/*
1002 	 * M_IOCDATA from ioctls, M_IOCTL from tunnel ioctls.
1003 	 */
1004 	ASSERT((add_mp->b_datap->db_type == M_IOCDATA) ||
1005 	    (add_mp->b_datap->db_type == M_IOCTL));
1006 
1007 	ASSERT(MUTEX_HELD(&connp->conn_lock));
1008 	/*
1009 	 * Return error if the conn has started closing. The conn
1010 	 * could have finished cleaning up the pending mp list,
1011 	 * If so we should not add another mp to the list negating
1012 	 * the cleanup.
1013 	 */
1014 	if (connp->conn_state_flags & CONN_CLOSING)
1015 		return (B_FALSE);
1016 	/*
1017 	 * Add the pending mp to the head of the list, chained by b_next.
1018 	 * Note down the conn on which the ioctl request came, in b_prev.
1019 	 * This will be used to later get the conn, when we get a response
1020 	 * on the ill queue, from some other module (typically arp)
1021 	 */
1022 	add_mp->b_next = (void *)ill->ill_pending_mp;
1023 	add_mp->b_queue = CONNP_TO_WQ(connp);
1024 	ill->ill_pending_mp = add_mp;
1025 	if (connp != NULL)
1026 		connp->conn_oper_pending_ill = ill;
1027 	return (B_TRUE);
1028 }
1029 
1030 /*
1031  * Retrieve the ill_pending_mp and return it. We have to walk the list
1032  * of mblks starting at ill_pending_mp, and match based on the ioc_id.
1033  */
1034 mblk_t *
1035 ill_pending_mp_get(ill_t *ill, conn_t **connpp, uint_t ioc_id)
1036 {
1037 	mblk_t	*prev = NULL;
1038 	mblk_t	*curr = NULL;
1039 	uint_t	id;
1040 	conn_t	*connp;
1041 
1042 	/*
1043 	 * When the conn closes, conn_ioctl_cleanup needs to clean
1044 	 * up the pending mp, but it does not know the ioc_id and
1045 	 * passes in a zero for it.
1046 	 */
1047 	mutex_enter(&ill->ill_lock);
1048 	if (ioc_id != 0)
1049 		*connpp = NULL;
1050 
1051 	/* Search the list for the appropriate ioctl based on ioc_id */
1052 	for (prev = NULL, curr = ill->ill_pending_mp; curr != NULL;
1053 	    prev = curr, curr = curr->b_next) {
1054 		id = ((struct iocblk *)curr->b_rptr)->ioc_id;
1055 		connp = Q_TO_CONN(curr->b_queue);
1056 		/* Match based on the ioc_id or based on the conn */
1057 		if ((id == ioc_id) || (ioc_id == 0 && connp == *connpp))
1058 			break;
1059 	}
1060 
1061 	if (curr != NULL) {
1062 		/* Unlink the mblk from the pending mp list */
1063 		if (prev != NULL) {
1064 			prev->b_next = curr->b_next;
1065 		} else {
1066 			ASSERT(ill->ill_pending_mp == curr);
1067 			ill->ill_pending_mp = curr->b_next;
1068 		}
1069 
1070 		/*
1071 		 * conn refcnt must have been bumped up at the start of
1072 		 * the ioctl. So we can safely access the conn.
1073 		 */
1074 		ASSERT(CONN_Q(curr->b_queue));
1075 		*connpp = Q_TO_CONN(curr->b_queue);
1076 		curr->b_next = NULL;
1077 		curr->b_queue = NULL;
1078 	}
1079 
1080 	mutex_exit(&ill->ill_lock);
1081 
1082 	return (curr);
1083 }
1084 
1085 /*
1086  * Add the pending mp to the list. There can be only 1 pending mp
1087  * in the list. Any exclusive ioctl that needs to wait for a response
1088  * from another module or driver needs to use this function to set
1089  * the ipsq_pending_mp to the ioctl mblk and wait for the response from
1090  * the other module/driver. This is also used while waiting for the
1091  * ipif/ill/ire refcnts to drop to zero in bringing down an ipif.
1092  */
1093 boolean_t
1094 ipsq_pending_mp_add(conn_t *connp, ipif_t *ipif, queue_t *q, mblk_t *add_mp,
1095     int waitfor)
1096 {
1097 	ipsq_t	*ipsq;
1098 
1099 	ASSERT(IAM_WRITER_IPIF(ipif));
1100 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
1101 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
1102 	/*
1103 	 * M_IOCDATA from ioctls, M_IOCTL from tunnel ioctls,
1104 	 * M_ERROR/M_HANGUP from driver
1105 	 */
1106 	ASSERT((DB_TYPE(add_mp) == M_IOCDATA) || (DB_TYPE(add_mp) == M_IOCTL) ||
1107 	    (DB_TYPE(add_mp) == M_ERROR) || (DB_TYPE(add_mp) == M_HANGUP));
1108 
1109 	ipsq = ipif->ipif_ill->ill_phyint->phyint_ipsq;
1110 	if (connp != NULL) {
1111 		ASSERT(MUTEX_HELD(&connp->conn_lock));
1112 		/*
1113 		 * Return error if the conn has started closing. The conn
1114 		 * could have finished cleaning up the pending mp list,
1115 		 * If so we should not add another mp to the list negating
1116 		 * the cleanup.
1117 		 */
1118 		if (connp->conn_state_flags & CONN_CLOSING)
1119 			return (B_FALSE);
1120 	}
1121 	mutex_enter(&ipsq->ipsq_lock);
1122 	ipsq->ipsq_pending_ipif = ipif;
1123 	/*
1124 	 * Note down the queue in b_queue. This will be returned by
1125 	 * ipsq_pending_mp_get. Caller will then use these values to restart
1126 	 * the processing
1127 	 */
1128 	add_mp->b_next = NULL;
1129 	add_mp->b_queue = q;
1130 	ipsq->ipsq_pending_mp = add_mp;
1131 	ipsq->ipsq_waitfor = waitfor;
1132 	/*
1133 	 * ipsq_current_ipif is needed to restart the operation from
1134 	 * ipif_ill_refrele_tail when the last reference to the ipi/ill
1135 	 * is gone. Since this is not an ioctl ipsq_current_ipif has not
1136 	 * been set until now.
1137 	 */
1138 	if (DB_TYPE(add_mp) == M_ERROR || DB_TYPE(add_mp) == M_HANGUP) {
1139 		ASSERT(ipsq->ipsq_current_ipif == NULL);
1140 		ipsq->ipsq_current_ipif = ipif;
1141 		ipsq->ipsq_last_cmd = DB_TYPE(add_mp);
1142 	}
1143 	if (connp != NULL)
1144 		connp->conn_oper_pending_ill = ipif->ipif_ill;
1145 	mutex_exit(&ipsq->ipsq_lock);
1146 	return (B_TRUE);
1147 }
1148 
1149 /*
1150  * Retrieve the ipsq_pending_mp and return it. There can be only 1 mp
1151  * queued in the list.
1152  */
1153 mblk_t *
1154 ipsq_pending_mp_get(ipsq_t *ipsq, conn_t **connpp)
1155 {
1156 	mblk_t	*curr = NULL;
1157 
1158 	mutex_enter(&ipsq->ipsq_lock);
1159 	*connpp = NULL;
1160 	if (ipsq->ipsq_pending_mp == NULL) {
1161 		mutex_exit(&ipsq->ipsq_lock);
1162 		return (NULL);
1163 	}
1164 
1165 	/* There can be only 1 such excl message */
1166 	curr = ipsq->ipsq_pending_mp;
1167 	ASSERT(curr != NULL && curr->b_next == NULL);
1168 	ipsq->ipsq_pending_ipif = NULL;
1169 	ipsq->ipsq_pending_mp = NULL;
1170 	ipsq->ipsq_waitfor = 0;
1171 	mutex_exit(&ipsq->ipsq_lock);
1172 
1173 	if (CONN_Q(curr->b_queue)) {
1174 		/*
1175 		 * This mp did a refhold on the conn, at the start of the ioctl.
1176 		 * So we can safely return a pointer to the conn to the caller.
1177 		 */
1178 		*connpp = Q_TO_CONN(curr->b_queue);
1179 	} else {
1180 		*connpp = NULL;
1181 	}
1182 	curr->b_next = NULL;
1183 	curr->b_prev = NULL;
1184 	return (curr);
1185 }
1186 
1187 /*
1188  * Cleanup the ioctl mp queued in ipsq_pending_mp
1189  * - Called in the ill_delete path
1190  * - Called in the M_ERROR or M_HANGUP path on the ill.
1191  * - Called in the conn close path.
1192  */
1193 boolean_t
1194 ipsq_pending_mp_cleanup(ill_t *ill, conn_t *connp)
1195 {
1196 	mblk_t	*mp;
1197 	ipsq_t	*ipsq;
1198 	queue_t	*q;
1199 	ipif_t	*ipif;
1200 
1201 	ASSERT(IAM_WRITER_ILL(ill));
1202 	ipsq = ill->ill_phyint->phyint_ipsq;
1203 	mutex_enter(&ipsq->ipsq_lock);
1204 	/*
1205 	 * If connp is null, unconditionally clean up the ipsq_pending_mp.
1206 	 * This happens in M_ERROR/M_HANGUP. We need to abort the current ioctl
1207 	 * even if it is meant for another ill, since we have to enqueue
1208 	 * a new mp now in ipsq_pending_mp to complete the ipif_down.
1209 	 * If connp is non-null we are called from the conn close path.
1210 	 */
1211 	mp = ipsq->ipsq_pending_mp;
1212 	if (mp == NULL || (connp != NULL &&
1213 	    mp->b_queue != CONNP_TO_WQ(connp))) {
1214 		mutex_exit(&ipsq->ipsq_lock);
1215 		return (B_FALSE);
1216 	}
1217 	/* Now remove from the ipsq_pending_mp */
1218 	ipsq->ipsq_pending_mp = NULL;
1219 	q = mp->b_queue;
1220 	mp->b_next = NULL;
1221 	mp->b_prev = NULL;
1222 	mp->b_queue = NULL;
1223 
1224 	/* If MOVE was in progress, clear the move_in_progress fields also. */
1225 	ill = ipsq->ipsq_pending_ipif->ipif_ill;
1226 	if (ill->ill_move_in_progress) {
1227 		ILL_CLEAR_MOVE(ill);
1228 	} else if (ill->ill_up_ipifs) {
1229 		ill_group_cleanup(ill);
1230 	}
1231 
1232 	ipif = ipsq->ipsq_pending_ipif;
1233 	ipsq->ipsq_pending_ipif = NULL;
1234 	ipsq->ipsq_waitfor = 0;
1235 	ipsq->ipsq_current_ipif = NULL;
1236 	mutex_exit(&ipsq->ipsq_lock);
1237 
1238 	if (DB_TYPE(mp) == M_IOCTL || DB_TYPE(mp) == M_IOCDATA) {
1239 		ip_ioctl_finish(q, mp, ENXIO, connp != NULL ? CONN_CLOSE :
1240 		    NO_COPYOUT, connp != NULL ? ipif : NULL, NULL);
1241 	} else {
1242 		/*
1243 		 * IP-MT XXX In the case of TLI/XTI bind / optmgmt this can't
1244 		 * be just inet_freemsg. we have to restart it
1245 		 * otherwise the thread will be stuck.
1246 		 */
1247 		inet_freemsg(mp);
1248 	}
1249 	return (B_TRUE);
1250 }
1251 
1252 /*
1253  * The ill is closing. Cleanup all the pending mps. Called exclusively
1254  * towards the end of ill_delete. The refcount has gone to 0. So nobody
1255  * knows this ill, and hence nobody can add an mp to this list
1256  */
1257 static void
1258 ill_pending_mp_cleanup(ill_t *ill)
1259 {
1260 	mblk_t	*mp;
1261 	queue_t	*q;
1262 
1263 	ASSERT(IAM_WRITER_ILL(ill));
1264 
1265 	mutex_enter(&ill->ill_lock);
1266 	/*
1267 	 * Every mp on the pending mp list originating from an ioctl
1268 	 * added 1 to the conn refcnt, at the start of the ioctl.
1269 	 * So bump it down now.  See comments in ip_wput_nondata()
1270 	 */
1271 	while (ill->ill_pending_mp != NULL) {
1272 		mp = ill->ill_pending_mp;
1273 		ill->ill_pending_mp = mp->b_next;
1274 		mutex_exit(&ill->ill_lock);
1275 
1276 		q = mp->b_queue;
1277 		ASSERT(CONN_Q(q));
1278 		mp->b_next = NULL;
1279 		mp->b_prev = NULL;
1280 		mp->b_queue = NULL;
1281 		ip_ioctl_finish(q, mp, ENXIO, NO_COPYOUT, NULL, NULL);
1282 		mutex_enter(&ill->ill_lock);
1283 	}
1284 	ill->ill_pending_ipif = NULL;
1285 
1286 	mutex_exit(&ill->ill_lock);
1287 }
1288 
1289 /*
1290  * Called in the conn close path and ill delete path
1291  */
1292 static void
1293 ipsq_xopq_mp_cleanup(ill_t *ill, conn_t *connp)
1294 {
1295 	ipsq_t	*ipsq;
1296 	mblk_t	*prev;
1297 	mblk_t	*curr;
1298 	mblk_t	*next;
1299 	queue_t	*q;
1300 	mblk_t	*tmp_list = NULL;
1301 
1302 	ASSERT(IAM_WRITER_ILL(ill));
1303 	if (connp != NULL)
1304 		q = CONNP_TO_WQ(connp);
1305 	else
1306 		q = ill->ill_wq;
1307 
1308 	ipsq = ill->ill_phyint->phyint_ipsq;
1309 	/*
1310 	 * Cleanup the ioctl mp's queued in ipsq_xopq_pending_mp if any.
1311 	 * In the case of ioctl from a conn, there can be only 1 mp
1312 	 * queued on the ipsq. If an ill is being unplumbed, only messages
1313 	 * related to this ill are flushed, like M_ERROR or M_HANGUP message.
1314 	 * ioctls meant for this ill form conn's are not flushed. They will
1315 	 * be processed during ipsq_exit and will not find the ill and will
1316 	 * return error.
1317 	 */
1318 	mutex_enter(&ipsq->ipsq_lock);
1319 	for (prev = NULL, curr = ipsq->ipsq_xopq_mphead; curr != NULL;
1320 	    curr = next) {
1321 		next = curr->b_next;
1322 		if (curr->b_queue == q || curr->b_queue == RD(q)) {
1323 			/* Unlink the mblk from the pending mp list */
1324 			if (prev != NULL) {
1325 				prev->b_next = curr->b_next;
1326 			} else {
1327 				ASSERT(ipsq->ipsq_xopq_mphead == curr);
1328 				ipsq->ipsq_xopq_mphead = curr->b_next;
1329 			}
1330 			if (ipsq->ipsq_xopq_mptail == curr)
1331 				ipsq->ipsq_xopq_mptail = prev;
1332 			/*
1333 			 * Create a temporary list and release the ipsq lock
1334 			 * New elements are added to the head of the tmp_list
1335 			 */
1336 			curr->b_next = tmp_list;
1337 			tmp_list = curr;
1338 		} else {
1339 			prev = curr;
1340 		}
1341 	}
1342 	mutex_exit(&ipsq->ipsq_lock);
1343 
1344 	while (tmp_list != NULL) {
1345 		curr = tmp_list;
1346 		tmp_list = curr->b_next;
1347 		curr->b_next = NULL;
1348 		curr->b_prev = NULL;
1349 		curr->b_queue = NULL;
1350 		if (DB_TYPE(curr) == M_IOCTL || DB_TYPE(curr) == M_IOCDATA) {
1351 			ip_ioctl_finish(q, curr, ENXIO, connp != NULL ?
1352 			    CONN_CLOSE : NO_COPYOUT, NULL, NULL);
1353 		} else {
1354 			/*
1355 			 * IP-MT XXX In the case of TLI/XTI bind / optmgmt
1356 			 * this can't be just inet_freemsg. we have to
1357 			 * restart it otherwise the thread will be stuck.
1358 			 */
1359 			inet_freemsg(curr);
1360 		}
1361 	}
1362 }
1363 
1364 /*
1365  * This conn has started closing. Cleanup any pending ioctl from this conn.
1366  * STREAMS ensures that there can be at most 1 ioctl pending on a stream.
1367  */
1368 void
1369 conn_ioctl_cleanup(conn_t *connp)
1370 {
1371 	mblk_t *curr;
1372 	ipsq_t	*ipsq;
1373 	ill_t	*ill;
1374 	boolean_t refheld;
1375 
1376 	/*
1377 	 * Is any exclusive ioctl pending ? If so clean it up. If the
1378 	 * ioctl has not yet started, the mp is pending in the list headed by
1379 	 * ipsq_xopq_head. If the ioctl has started the mp could be present in
1380 	 * ipsq_pending_mp. If the ioctl timed out in the streamhead but
1381 	 * is currently executing now the mp is not queued anywhere but
1382 	 * conn_oper_pending_ill is null. The conn close will wait
1383 	 * till the conn_ref drops to zero.
1384 	 */
1385 	mutex_enter(&connp->conn_lock);
1386 	ill = connp->conn_oper_pending_ill;
1387 	if (ill == NULL) {
1388 		mutex_exit(&connp->conn_lock);
1389 		return;
1390 	}
1391 
1392 	curr = ill_pending_mp_get(ill, &connp, 0);
1393 	if (curr != NULL) {
1394 		mutex_exit(&connp->conn_lock);
1395 		CONN_DEC_REF(connp);
1396 		inet_freemsg(curr);
1397 		return;
1398 	}
1399 	/*
1400 	 * We may not be able to refhold the ill if the ill/ipif
1401 	 * is changing. But we need to make sure that the ill will
1402 	 * not vanish. So we just bump up the ill_waiter count.
1403 	 */
1404 	refheld = ill_waiter_inc(ill);
1405 	mutex_exit(&connp->conn_lock);
1406 	if (refheld) {
1407 		if (ipsq_enter(ill, B_TRUE)) {
1408 			ill_waiter_dcr(ill);
1409 			/*
1410 			 * Check whether this ioctl has started and is
1411 			 * pending now in ipsq_pending_mp. If it is not
1412 			 * found there then check whether this ioctl has
1413 			 * not even started and is in the ipsq_xopq list.
1414 			 */
1415 			if (!ipsq_pending_mp_cleanup(ill, connp))
1416 				ipsq_xopq_mp_cleanup(ill, connp);
1417 			ipsq = ill->ill_phyint->phyint_ipsq;
1418 			ipsq_exit(ipsq, B_TRUE, B_TRUE);
1419 			return;
1420 		}
1421 	}
1422 
1423 	/*
1424 	 * The ill is also closing and we could not bump up the
1425 	 * ill_waiter_count or we could not enter the ipsq. Leave
1426 	 * the cleanup to ill_delete
1427 	 */
1428 	mutex_enter(&connp->conn_lock);
1429 	while (connp->conn_oper_pending_ill != NULL)
1430 		cv_wait(&connp->conn_refcv, &connp->conn_lock);
1431 	mutex_exit(&connp->conn_lock);
1432 	if (refheld)
1433 		ill_waiter_dcr(ill);
1434 }
1435 
1436 /*
1437  * ipcl_walk function for cleaning up conn_*_ill fields.
1438  */
1439 static void
1440 conn_cleanup_ill(conn_t *connp, caddr_t arg)
1441 {
1442 	ill_t	*ill = (ill_t *)arg;
1443 	ire_t	*ire;
1444 
1445 	mutex_enter(&connp->conn_lock);
1446 	if (connp->conn_multicast_ill == ill) {
1447 		/* Revert to late binding */
1448 		connp->conn_multicast_ill = NULL;
1449 		connp->conn_orig_multicast_ifindex = 0;
1450 	}
1451 	if (connp->conn_incoming_ill == ill)
1452 		connp->conn_incoming_ill = NULL;
1453 	if (connp->conn_outgoing_ill == ill)
1454 		connp->conn_outgoing_ill = NULL;
1455 	if (connp->conn_outgoing_pill == ill)
1456 		connp->conn_outgoing_pill = NULL;
1457 	if (connp->conn_nofailover_ill == ill)
1458 		connp->conn_nofailover_ill = NULL;
1459 	if (connp->conn_xmit_if_ill == ill)
1460 		connp->conn_xmit_if_ill = NULL;
1461 	if (connp->conn_ire_cache != NULL) {
1462 		ire = connp->conn_ire_cache;
1463 		/*
1464 		 * ip_newroute creates IRE_CACHE with ire_stq coming from
1465 		 * interface X and ipif coming from interface Y, if interface
1466 		 * X and Y are part of the same IPMPgroup. Thus whenever
1467 		 * interface X goes down, remove all references to it by
1468 		 * checking both on ire_ipif and ire_stq.
1469 		 */
1470 		if ((ire->ire_ipif != NULL && ire->ire_ipif->ipif_ill == ill) ||
1471 		    (ire->ire_type == IRE_CACHE &&
1472 		    ire->ire_stq == ill->ill_wq)) {
1473 			connp->conn_ire_cache = NULL;
1474 			mutex_exit(&connp->conn_lock);
1475 			ire_refrele_notr(ire);
1476 			return;
1477 		}
1478 	}
1479 	mutex_exit(&connp->conn_lock);
1480 
1481 }
1482 
1483 /* ARGSUSED */
1484 void
1485 ipif_all_down_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
1486 {
1487 	ill_t	*ill = q->q_ptr;
1488 	ipif_t	*ipif;
1489 
1490 	ASSERT(IAM_WRITER_IPSQ(ipsq));
1491 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
1492 		ipif_down_tail(ipif);
1493 	ill_down_tail(ill);
1494 	freemsg(mp);
1495 	ipsq->ipsq_current_ipif = NULL;
1496 }
1497 
1498 /*
1499  * ill_down_start is called when we want to down this ill and bring it up again
1500  * It is called when we receive an M_ERROR / M_HANGUP. In this case we shut down
1501  * all interfaces, but don't tear down any plumbing.
1502  */
1503 boolean_t
1504 ill_down_start(queue_t *q, mblk_t *mp)
1505 {
1506 	ill_t	*ill;
1507 	ipif_t	*ipif;
1508 
1509 	ill = q->q_ptr;
1510 
1511 	ASSERT(IAM_WRITER_ILL(ill));
1512 
1513 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
1514 		(void) ipif_down(ipif, NULL, NULL);
1515 
1516 	ill_down(ill);
1517 
1518 	(void) ipsq_pending_mp_cleanup(ill, NULL);
1519 	mutex_enter(&ill->ill_lock);
1520 	/*
1521 	 * Atomically test and add the pending mp if references are
1522 	 * still active.
1523 	 */
1524 	if (!ill_is_quiescent(ill)) {
1525 		/*
1526 		 * Get rid of any pending mps and cleanup. Call will
1527 		 * not fail since we are passing a null connp.
1528 		 */
1529 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
1530 		    mp, ILL_DOWN);
1531 		mutex_exit(&ill->ill_lock);
1532 		return (B_FALSE);
1533 	}
1534 	mutex_exit(&ill->ill_lock);
1535 	return (B_TRUE);
1536 }
1537 
1538 static void
1539 ill_down(ill_t *ill)
1540 {
1541 	/* Blow off any IREs dependent on this ILL. */
1542 	ire_walk(ill_downi, (char *)ill);
1543 
1544 	mutex_enter(&ire_mrtun_lock);
1545 	if (ire_mrtun_count != 0) {
1546 		mutex_exit(&ire_mrtun_lock);
1547 		ire_walk_ill_mrtun(0, 0, ill_downi_mrtun_srcif,
1548 		    (char *)ill, NULL);
1549 	} else {
1550 		mutex_exit(&ire_mrtun_lock);
1551 	}
1552 
1553 	/*
1554 	 * If any interface based forwarding table exists
1555 	 * Blow off the ires there dependent on this ill
1556 	 */
1557 	mutex_enter(&ire_srcif_table_lock);
1558 	if (ire_srcif_table_count > 0) {
1559 		mutex_exit(&ire_srcif_table_lock);
1560 		ire_walk_srcif_table_v4(ill_downi_mrtun_srcif, (char *)ill);
1561 	} else {
1562 		mutex_exit(&ire_srcif_table_lock);
1563 	}
1564 
1565 	/* Remove any conn_*_ill depending on this ill */
1566 	ipcl_walk(conn_cleanup_ill, (caddr_t)ill);
1567 
1568 	if (ill->ill_group != NULL) {
1569 		illgrp_delete(ill);
1570 	}
1571 
1572 }
1573 
1574 static void
1575 ill_down_tail(ill_t *ill)
1576 {
1577 	int	i;
1578 
1579 	/* Destroy ill_srcif_table if it exists */
1580 	/* Lock not reqd really because nobody should be able to access */
1581 	mutex_enter(&ill->ill_lock);
1582 	if (ill->ill_srcif_table != NULL) {
1583 		ill->ill_srcif_refcnt = 0;
1584 		for (i = 0; i < IP_SRCIF_TABLE_SIZE; i++) {
1585 			rw_destroy(&ill->ill_srcif_table[i].irb_lock);
1586 		}
1587 		kmem_free(ill->ill_srcif_table,
1588 		    IP_SRCIF_TABLE_SIZE * sizeof (irb_t));
1589 		ill->ill_srcif_table = NULL;
1590 		ill->ill_srcif_refcnt = 0;
1591 		ill->ill_mrtun_refcnt = 0;
1592 	}
1593 	mutex_exit(&ill->ill_lock);
1594 }
1595 
1596 /*
1597  * ire_walk routine used to delete every IRE that depends on queues
1598  * associated with 'ill'.  (Always called as writer.)
1599  */
1600 static void
1601 ill_downi(ire_t *ire, char *ill_arg)
1602 {
1603 	ill_t	*ill = (ill_t *)ill_arg;
1604 
1605 	/*
1606 	 * ip_newroute creates IRE_CACHE with ire_stq coming from
1607 	 * interface X and ipif coming from interface Y, if interface
1608 	 * X and Y are part of the same IPMP group. Thus whenever interface
1609 	 * X goes down, remove all references to it by checking both
1610 	 * on ire_ipif and ire_stq.
1611 	 */
1612 	if ((ire->ire_ipif != NULL && ire->ire_ipif->ipif_ill == ill) ||
1613 	    (ire->ire_type == IRE_CACHE && ire->ire_stq == ill->ill_wq)) {
1614 		ire_delete(ire);
1615 	}
1616 }
1617 
1618 /*
1619  * A seperate routine for deleting revtun and srcif based routes
1620  * are needed because the ires only deleted when the interface
1621  * is unplumbed. Also these ires have ire_in_ill non-null as well.
1622  * we want to keep mobile IP specific code separate.
1623  */
1624 static void
1625 ill_downi_mrtun_srcif(ire_t *ire, char *ill_arg)
1626 {
1627 	ill_t   *ill = (ill_t *)ill_arg;
1628 
1629 	ASSERT(ire->ire_in_ill != NULL);
1630 
1631 	if ((ire->ire_in_ill != NULL && ire->ire_in_ill == ill) ||
1632 	    (ire->ire_stq == ill->ill_wq) || (ire->ire_stq == ill->ill_rq)) {
1633 		ire_delete(ire);
1634 	}
1635 }
1636 
1637 /*
1638  * Remove ire/nce from the fastpath list.
1639  */
1640 void
1641 ill_fastpath_nack(ill_t *ill)
1642 {
1643 	if (ill->ill_isv6) {
1644 		nce_fastpath_list_dispatch(ill, NULL, NULL);
1645 	} else {
1646 		ire_fastpath_list_dispatch(ill, NULL, NULL);
1647 	}
1648 }
1649 
1650 /* Consume an M_IOCACK of the fastpath probe. */
1651 void
1652 ill_fastpath_ack(ill_t *ill, mblk_t *mp)
1653 {
1654 	mblk_t	*mp1 = mp;
1655 
1656 	/*
1657 	 * If this was the first attempt turn on the fastpath probing.
1658 	 */
1659 	mutex_enter(&ill->ill_lock);
1660 	if (ill->ill_dlpi_fastpath_state == IDMS_INPROGRESS)
1661 		ill->ill_dlpi_fastpath_state = IDMS_OK;
1662 	mutex_exit(&ill->ill_lock);
1663 
1664 	/* Free the M_IOCACK mblk, hold on to the data */
1665 	mp = mp->b_cont;
1666 	freeb(mp1);
1667 	if (mp == NULL)
1668 		return;
1669 	if (mp->b_cont != NULL) {
1670 		/*
1671 		 * Update all IRE's or NCE's that are waiting for
1672 		 * fastpath update.
1673 		 */
1674 		if (ill->ill_isv6) {
1675 			/*
1676 			 * update nce's in the fastpath list.
1677 			 */
1678 			nce_fastpath_list_dispatch(ill,
1679 			    ndp_fastpath_update, mp);
1680 		} else {
1681 
1682 			/*
1683 			 * update ire's in the fastpath list.
1684 			 */
1685 			ire_fastpath_list_dispatch(ill,
1686 			    ire_fastpath_update, mp);
1687 			/*
1688 			 * Check if we need to traverse reverse tunnel table.
1689 			 * Since there is only single ire_type (IRE_MIPRTUN)
1690 			 * in the table, we don't need to match on ire_type.
1691 			 * We have to check ire_mrtun_count and not the
1692 			 * ill_mrtun_refcnt since ill_mrtun_refcnt is set
1693 			 * on the incoming ill and here we are dealing with
1694 			 * outgoing ill.
1695 			 */
1696 			mutex_enter(&ire_mrtun_lock);
1697 			if (ire_mrtun_count != 0) {
1698 				mutex_exit(&ire_mrtun_lock);
1699 				ire_walk_ill_mrtun(MATCH_IRE_WQ, IRE_MIPRTUN,
1700 				    (void (*)(ire_t *, void *))
1701 					ire_fastpath_update, mp, ill);
1702 			} else {
1703 				mutex_exit(&ire_mrtun_lock);
1704 			}
1705 		}
1706 		mp1 = mp->b_cont;
1707 		freeb(mp);
1708 		mp = mp1;
1709 	} else {
1710 		ip0dbg(("ill_fastpath_ack:  no b_cont\n"));
1711 	}
1712 
1713 	freeb(mp);
1714 }
1715 
1716 /*
1717  * Throw an M_IOCTL message downstream asking "do you know fastpath?"
1718  * The data portion of the request is a dl_unitdata_req_t template for
1719  * what we would send downstream in the absence of a fastpath confirmation.
1720  */
1721 int
1722 ill_fastpath_probe(ill_t *ill, mblk_t *dlur_mp)
1723 {
1724 	struct iocblk	*ioc;
1725 	mblk_t	*mp;
1726 
1727 	if (dlur_mp == NULL)
1728 		return (EINVAL);
1729 
1730 	mutex_enter(&ill->ill_lock);
1731 	switch (ill->ill_dlpi_fastpath_state) {
1732 	case IDMS_FAILED:
1733 		/*
1734 		 * Driver NAKed the first fastpath ioctl - assume it doesn't
1735 		 * support it.
1736 		 */
1737 		mutex_exit(&ill->ill_lock);
1738 		return (ENOTSUP);
1739 	case IDMS_UNKNOWN:
1740 		/* This is the first probe */
1741 		ill->ill_dlpi_fastpath_state = IDMS_INPROGRESS;
1742 		break;
1743 	default:
1744 		break;
1745 	}
1746 	mutex_exit(&ill->ill_lock);
1747 
1748 	if ((mp = mkiocb(DL_IOC_HDR_INFO)) == NULL)
1749 		return (EAGAIN);
1750 
1751 	mp->b_cont = copyb(dlur_mp);
1752 	if (mp->b_cont == NULL) {
1753 		freeb(mp);
1754 		return (EAGAIN);
1755 	}
1756 
1757 	ioc = (struct iocblk *)mp->b_rptr;
1758 	ioc->ioc_count = msgdsize(mp->b_cont);
1759 
1760 	putnext(ill->ill_wq, mp);
1761 	return (0);
1762 }
1763 
1764 void
1765 ill_capability_probe(ill_t *ill)
1766 {
1767 	/*
1768 	 * Do so only if negotiation is enabled, capabilities are unknown,
1769 	 * and a capability negotiation is not already in progress.
1770 	 */
1771 	if (ill->ill_capab_state != IDMS_UNKNOWN &&
1772 	    ill->ill_capab_state != IDMS_RENEG)
1773 		return;
1774 
1775 	ill->ill_capab_state = IDMS_INPROGRESS;
1776 	ip1dbg(("ill_capability_probe: starting capability negotiation\n"));
1777 	ill_capability_proto(ill, DL_CAPABILITY_REQ, NULL);
1778 }
1779 
1780 void
1781 ill_capability_reset(ill_t *ill)
1782 {
1783 	mblk_t *sc_mp = NULL;
1784 	mblk_t *tmp;
1785 
1786 	/*
1787 	 * Note here that we reset the state to UNKNOWN, and later send
1788 	 * down the DL_CAPABILITY_REQ without first setting the state to
1789 	 * INPROGRESS.  We do this in order to distinguish the
1790 	 * DL_CAPABILITY_ACK response which may come back in response to
1791 	 * a "reset" apart from the "probe" DL_CAPABILITY_REQ.  This would
1792 	 * also handle the case where the driver doesn't send us back
1793 	 * a DL_CAPABILITY_ACK in response, since the "probe" routine
1794 	 * requires the state to be in UNKNOWN anyway.  In any case, all
1795 	 * features are turned off until the state reaches IDMS_OK.
1796 	 */
1797 	ill->ill_capab_state = IDMS_UNKNOWN;
1798 
1799 	/*
1800 	 * Disable sub-capabilities and request a list of sub-capability
1801 	 * messages which will be sent down to the driver.  Each handler
1802 	 * allocates the corresponding dl_capability_sub_t inside an
1803 	 * mblk, and links it to the existing sc_mp mblk, or return it
1804 	 * as sc_mp if it's the first sub-capability (the passed in
1805 	 * sc_mp is NULL).  Upon returning from all capability handlers,
1806 	 * sc_mp will be pulled-up, before passing it downstream.
1807 	 */
1808 	ill_capability_mdt_reset(ill, &sc_mp);
1809 	ill_capability_hcksum_reset(ill, &sc_mp);
1810 	ill_capability_zerocopy_reset(ill, &sc_mp);
1811 	ill_capability_ipsec_reset(ill, &sc_mp);
1812 	ill_capability_dls_reset(ill, &sc_mp);
1813 
1814 	/* Nothing to send down in order to disable the capabilities? */
1815 	if (sc_mp == NULL)
1816 		return;
1817 
1818 	tmp = msgpullup(sc_mp, -1);
1819 	freemsg(sc_mp);
1820 	if ((sc_mp = tmp) == NULL) {
1821 		cmn_err(CE_WARN, "ill_capability_reset: unable to send down "
1822 		    "DL_CAPABILITY_REQ (ENOMEM)\n");
1823 		return;
1824 	}
1825 
1826 	ip1dbg(("ill_capability_reset: resetting negotiated capabilities\n"));
1827 	ill_capability_proto(ill, DL_CAPABILITY_REQ, sc_mp);
1828 }
1829 
1830 /*
1831  * Request or set new-style hardware capabilities supported by DLS provider.
1832  */
1833 static void
1834 ill_capability_proto(ill_t *ill, int type, mblk_t *reqp)
1835 {
1836 	mblk_t *mp;
1837 	dl_capability_req_t *capb;
1838 	size_t size = 0;
1839 	uint8_t *ptr;
1840 
1841 	if (reqp != NULL)
1842 		size = MBLKL(reqp);
1843 
1844 	mp = ip_dlpi_alloc(sizeof (dl_capability_req_t) + size, type);
1845 	if (mp == NULL) {
1846 		freemsg(reqp);
1847 		return;
1848 	}
1849 	ptr = mp->b_rptr;
1850 
1851 	capb = (dl_capability_req_t *)ptr;
1852 	ptr += sizeof (dl_capability_req_t);
1853 
1854 	if (reqp != NULL) {
1855 		capb->dl_sub_offset = sizeof (dl_capability_req_t);
1856 		capb->dl_sub_length = size;
1857 		bcopy(reqp->b_rptr, ptr, size);
1858 		ptr += size;
1859 		mp->b_cont = reqp->b_cont;
1860 		freeb(reqp);
1861 	}
1862 	ASSERT(ptr == mp->b_wptr);
1863 
1864 	ill_dlpi_send(ill, mp);
1865 }
1866 
1867 static void
1868 ill_capability_id_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *outers)
1869 {
1870 	dl_capab_id_t *id_ic;
1871 	uint_t sub_dl_cap = outers->dl_cap;
1872 	dl_capability_sub_t *inners;
1873 	uint8_t *capend;
1874 
1875 	ASSERT(sub_dl_cap == DL_CAPAB_ID_WRAPPER);
1876 
1877 	/*
1878 	 * Note: range checks here are not absolutely sufficient to
1879 	 * make us robust against malformed messages sent by drivers;
1880 	 * this is in keeping with the rest of IP's dlpi handling.
1881 	 * (Remember, it's coming from something else in the kernel
1882 	 * address space)
1883 	 */
1884 
1885 	capend = (uint8_t *)(outers + 1) + outers->dl_length;
1886 	if (capend > mp->b_wptr) {
1887 		cmn_err(CE_WARN, "ill_capability_id_ack: "
1888 		    "malformed sub-capability too long for mblk");
1889 		return;
1890 	}
1891 
1892 	id_ic = (dl_capab_id_t *)(outers + 1);
1893 
1894 	if (outers->dl_length < sizeof (*id_ic) ||
1895 	    (inners = &id_ic->id_subcap,
1896 	    inners->dl_length > (outers->dl_length - sizeof (*inners)))) {
1897 		cmn_err(CE_WARN, "ill_capability_id_ack: malformed "
1898 		    "encapsulated capab type %d too long for mblk",
1899 		    inners->dl_cap);
1900 		return;
1901 	}
1902 
1903 	if (!dlcapabcheckqid(&id_ic->id_mid, ill->ill_lmod_rq)) {
1904 		ip1dbg(("ill_capability_id_ack: mid token for capab type %d "
1905 		    "isn't as expected; pass-thru module(s) detected, "
1906 		    "discarding capability\n", inners->dl_cap));
1907 		return;
1908 	}
1909 
1910 	/* Process the encapsulated sub-capability */
1911 	ill_capability_dispatch(ill, mp, inners, B_TRUE);
1912 }
1913 
1914 /*
1915  * Process Multidata Transmit capability negotiation ack received from a
1916  * DLS Provider.  isub must point to the sub-capability (DL_CAPAB_MDT) of a
1917  * DL_CAPABILITY_ACK message.
1918  */
1919 static void
1920 ill_capability_mdt_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1921 {
1922 	mblk_t *nmp = NULL;
1923 	dl_capability_req_t *oc;
1924 	dl_capab_mdt_t *mdt_ic, *mdt_oc;
1925 	ill_mdt_capab_t **ill_mdt_capab;
1926 	uint_t sub_dl_cap = isub->dl_cap;
1927 	uint8_t *capend;
1928 
1929 	ASSERT(sub_dl_cap == DL_CAPAB_MDT);
1930 
1931 	ill_mdt_capab = (ill_mdt_capab_t **)&ill->ill_mdt_capab;
1932 
1933 	/*
1934 	 * Note: range checks here are not absolutely sufficient to
1935 	 * make us robust against malformed messages sent by drivers;
1936 	 * this is in keeping with the rest of IP's dlpi handling.
1937 	 * (Remember, it's coming from something else in the kernel
1938 	 * address space)
1939 	 */
1940 
1941 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1942 	if (capend > mp->b_wptr) {
1943 		cmn_err(CE_WARN, "ill_capability_mdt_ack: "
1944 		    "malformed sub-capability too long for mblk");
1945 		return;
1946 	}
1947 
1948 	mdt_ic = (dl_capab_mdt_t *)(isub + 1);
1949 
1950 	if (mdt_ic->mdt_version != MDT_VERSION_2) {
1951 		cmn_err(CE_CONT, "ill_capability_mdt_ack: "
1952 		    "unsupported MDT sub-capability (version %d, expected %d)",
1953 		    mdt_ic->mdt_version, MDT_VERSION_2);
1954 		return;
1955 	}
1956 
1957 	if (!dlcapabcheckqid(&mdt_ic->mdt_mid, ill->ill_lmod_rq)) {
1958 		ip1dbg(("ill_capability_mdt_ack: mid token for MDT "
1959 		    "capability isn't as expected; pass-thru module(s) "
1960 		    "detected, discarding capability\n"));
1961 		return;
1962 	}
1963 
1964 	if (mdt_ic->mdt_flags & DL_CAPAB_MDT_ENABLE) {
1965 
1966 		if (*ill_mdt_capab == NULL) {
1967 			*ill_mdt_capab = kmem_zalloc(sizeof (ill_mdt_capab_t),
1968 			    KM_NOSLEEP);
1969 
1970 			if (*ill_mdt_capab == NULL) {
1971 				cmn_err(CE_WARN, "ill_capability_mdt_ack: "
1972 				    "could not enable MDT version %d "
1973 				    "for %s (ENOMEM)\n", MDT_VERSION_2,
1974 				    ill->ill_name);
1975 				return;
1976 			}
1977 		}
1978 
1979 		ip1dbg(("ill_capability_mdt_ack: interface %s supports "
1980 		    "MDT version %d (%d bytes leading, %d bytes trailing "
1981 		    "header spaces, %d max pld bufs, %d span limit)\n",
1982 		    ill->ill_name, MDT_VERSION_2,
1983 		    mdt_ic->mdt_hdr_head, mdt_ic->mdt_hdr_tail,
1984 		    mdt_ic->mdt_max_pld, mdt_ic->mdt_span_limit));
1985 
1986 		(*ill_mdt_capab)->ill_mdt_version = MDT_VERSION_2;
1987 		(*ill_mdt_capab)->ill_mdt_on = 1;
1988 		/*
1989 		 * Round the following values to the nearest 32-bit; ULP
1990 		 * may further adjust them to accomodate for additional
1991 		 * protocol headers.  We pass these values to ULP during
1992 		 * bind time.
1993 		 */
1994 		(*ill_mdt_capab)->ill_mdt_hdr_head =
1995 		    roundup(mdt_ic->mdt_hdr_head, 4);
1996 		(*ill_mdt_capab)->ill_mdt_hdr_tail =
1997 		    roundup(mdt_ic->mdt_hdr_tail, 4);
1998 		(*ill_mdt_capab)->ill_mdt_max_pld = mdt_ic->mdt_max_pld;
1999 		(*ill_mdt_capab)->ill_mdt_span_limit = mdt_ic->mdt_span_limit;
2000 
2001 		ill->ill_capabilities |= ILL_CAPAB_MDT;
2002 	} else {
2003 		uint_t size;
2004 		uchar_t *rptr;
2005 
2006 		size = sizeof (dl_capability_req_t) +
2007 		    sizeof (dl_capability_sub_t) + sizeof (dl_capab_mdt_t);
2008 
2009 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2010 			cmn_err(CE_WARN, "ill_capability_mdt_ack: "
2011 			    "could not enable MDT for %s (ENOMEM)\n",
2012 			    ill->ill_name);
2013 			return;
2014 		}
2015 
2016 		rptr = nmp->b_rptr;
2017 		/* initialize dl_capability_req_t */
2018 		oc = (dl_capability_req_t *)nmp->b_rptr;
2019 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
2020 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
2021 		    sizeof (dl_capab_mdt_t);
2022 		nmp->b_rptr += sizeof (dl_capability_req_t);
2023 
2024 		/* initialize dl_capability_sub_t */
2025 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
2026 		nmp->b_rptr += sizeof (*isub);
2027 
2028 		/* initialize dl_capab_mdt_t */
2029 		mdt_oc = (dl_capab_mdt_t *)nmp->b_rptr;
2030 		bcopy(mdt_ic, mdt_oc, sizeof (*mdt_ic));
2031 
2032 		nmp->b_rptr = rptr;
2033 
2034 		ip1dbg(("ill_capability_mdt_ack: asking interface %s "
2035 		    "to enable MDT version %d\n", ill->ill_name,
2036 		    MDT_VERSION_2));
2037 
2038 		/* set ENABLE flag */
2039 		mdt_oc->mdt_flags |= DL_CAPAB_MDT_ENABLE;
2040 
2041 		/* nmp points to a DL_CAPABILITY_REQ message to enable MDT */
2042 		ill_dlpi_send(ill, nmp);
2043 	}
2044 }
2045 
2046 static void
2047 ill_capability_mdt_reset(ill_t *ill, mblk_t **sc_mp)
2048 {
2049 	mblk_t *mp;
2050 	dl_capab_mdt_t *mdt_subcap;
2051 	dl_capability_sub_t *dl_subcap;
2052 	int size;
2053 
2054 	if (!ILL_MDT_CAPABLE(ill))
2055 		return;
2056 
2057 	ASSERT(ill->ill_mdt_capab != NULL);
2058 	/*
2059 	 * Clear the capability flag for MDT but retain the ill_mdt_capab
2060 	 * structure since it's possible that another thread is still
2061 	 * referring to it.  The structure only gets deallocated when
2062 	 * we destroy the ill.
2063 	 */
2064 	ill->ill_capabilities &= ~ILL_CAPAB_MDT;
2065 
2066 	size = sizeof (*dl_subcap) + sizeof (*mdt_subcap);
2067 
2068 	mp = allocb(size, BPRI_HI);
2069 	if (mp == NULL) {
2070 		ip1dbg(("ill_capability_mdt_reset: unable to allocate "
2071 		    "request to disable MDT\n"));
2072 		return;
2073 	}
2074 
2075 	mp->b_wptr = mp->b_rptr + size;
2076 
2077 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
2078 	dl_subcap->dl_cap = DL_CAPAB_MDT;
2079 	dl_subcap->dl_length = sizeof (*mdt_subcap);
2080 
2081 	mdt_subcap = (dl_capab_mdt_t *)(dl_subcap + 1);
2082 	mdt_subcap->mdt_version = ill->ill_mdt_capab->ill_mdt_version;
2083 	mdt_subcap->mdt_flags = 0;
2084 	mdt_subcap->mdt_hdr_head = 0;
2085 	mdt_subcap->mdt_hdr_tail = 0;
2086 
2087 	if (*sc_mp != NULL)
2088 		linkb(*sc_mp, mp);
2089 	else
2090 		*sc_mp = mp;
2091 }
2092 
2093 /*
2094  * Send a DL_NOTIFY_REQ to the specified ill to enable
2095  * DL_NOTE_PROMISC_ON/OFF_PHYS notifications.
2096  * Invoked by ill_capability_ipsec_ack() before enabling IPsec hardware
2097  * acceleration.
2098  * Returns B_TRUE on success, B_FALSE if the message could not be sent.
2099  */
2100 static boolean_t
2101 ill_enable_promisc_notify(ill_t *ill)
2102 {
2103 	mblk_t *mp;
2104 	dl_notify_req_t *req;
2105 
2106 	IPSECHW_DEBUG(IPSECHW_PKT, ("ill_enable_promisc_notify:\n"));
2107 
2108 	mp = ip_dlpi_alloc(sizeof (dl_notify_req_t), DL_NOTIFY_REQ);
2109 	if (mp == NULL)
2110 		return (B_FALSE);
2111 
2112 	req = (dl_notify_req_t *)mp->b_rptr;
2113 	req->dl_notifications = DL_NOTE_PROMISC_ON_PHYS |
2114 	    DL_NOTE_PROMISC_OFF_PHYS;
2115 
2116 	ill_dlpi_send(ill, mp);
2117 
2118 	return (B_TRUE);
2119 }
2120 
2121 
2122 /*
2123  * Allocate an IPsec capability request which will be filled by our
2124  * caller to turn on support for one or more algorithms.
2125  */
2126 static mblk_t *
2127 ill_alloc_ipsec_cap_req(ill_t *ill, dl_capability_sub_t *isub)
2128 {
2129 	mblk_t *nmp;
2130 	dl_capability_req_t	*ocap;
2131 	dl_capab_ipsec_t	*ocip;
2132 	dl_capab_ipsec_t	*icip;
2133 	uint8_t			*ptr;
2134 	icip = (dl_capab_ipsec_t *)(isub + 1);
2135 
2136 	/*
2137 	 * The first time around, we send a DL_NOTIFY_REQ to enable
2138 	 * PROMISC_ON/OFF notification from the provider. We need to
2139 	 * do this before enabling the algorithms to avoid leakage of
2140 	 * cleartext packets.
2141 	 */
2142 
2143 	if (!ill_enable_promisc_notify(ill))
2144 		return (NULL);
2145 
2146 	/*
2147 	 * Allocate new mblk which will contain a new capability
2148 	 * request to enable the capabilities.
2149 	 */
2150 
2151 	nmp = ip_dlpi_alloc(sizeof (dl_capability_req_t) +
2152 	    sizeof (dl_capability_sub_t) + isub->dl_length, DL_CAPABILITY_REQ);
2153 	if (nmp == NULL)
2154 		return (NULL);
2155 
2156 	ptr = nmp->b_rptr;
2157 
2158 	/* initialize dl_capability_req_t */
2159 	ocap = (dl_capability_req_t *)ptr;
2160 	ocap->dl_sub_offset = sizeof (dl_capability_req_t);
2161 	ocap->dl_sub_length = sizeof (dl_capability_sub_t) + isub->dl_length;
2162 	ptr += sizeof (dl_capability_req_t);
2163 
2164 	/* initialize dl_capability_sub_t */
2165 	bcopy(isub, ptr, sizeof (*isub));
2166 	ptr += sizeof (*isub);
2167 
2168 	/* initialize dl_capab_ipsec_t */
2169 	ocip = (dl_capab_ipsec_t *)ptr;
2170 	bcopy(icip, ocip, sizeof (*icip));
2171 
2172 	nmp->b_wptr = (uchar_t *)(&ocip->cip_data[0]);
2173 	return (nmp);
2174 }
2175 
2176 /*
2177  * Process an IPsec capability negotiation ack received from a DLS Provider.
2178  * isub must point to the sub-capability (DL_CAPAB_IPSEC_AH or
2179  * DL_CAPAB_IPSEC_ESP) of a DL_CAPABILITY_ACK message.
2180  */
2181 static void
2182 ill_capability_ipsec_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2183 {
2184 	dl_capab_ipsec_t	*icip;
2185 	dl_capab_ipsec_alg_t	*ialg;	/* ptr to input alg spec. */
2186 	dl_capab_ipsec_alg_t	*oalg;	/* ptr to output alg spec. */
2187 	uint_t cipher, nciphers;
2188 	mblk_t *nmp;
2189 	uint_t alg_len;
2190 	boolean_t need_sadb_dump;
2191 	uint_t sub_dl_cap = isub->dl_cap;
2192 	ill_ipsec_capab_t **ill_capab;
2193 	uint64_t ill_capab_flag;
2194 	uint8_t *capend, *ciphend;
2195 	boolean_t sadb_resync;
2196 
2197 	ASSERT(sub_dl_cap == DL_CAPAB_IPSEC_AH ||
2198 	    sub_dl_cap == DL_CAPAB_IPSEC_ESP);
2199 
2200 	if (sub_dl_cap == DL_CAPAB_IPSEC_AH) {
2201 		ill_capab = (ill_ipsec_capab_t **)&ill->ill_ipsec_capab_ah;
2202 		ill_capab_flag = ILL_CAPAB_AH;
2203 	} else {
2204 		ill_capab = (ill_ipsec_capab_t **)&ill->ill_ipsec_capab_esp;
2205 		ill_capab_flag = ILL_CAPAB_ESP;
2206 	}
2207 
2208 	/*
2209 	 * If the ill capability structure exists, then this incoming
2210 	 * DL_CAPABILITY_ACK is a response to a "renegotiation" cycle.
2211 	 * If this is so, then we'd need to resynchronize the SADB
2212 	 * after re-enabling the offloaded ciphers.
2213 	 */
2214 	sadb_resync = (*ill_capab != NULL);
2215 
2216 	/*
2217 	 * Note: range checks here are not absolutely sufficient to
2218 	 * make us robust against malformed messages sent by drivers;
2219 	 * this is in keeping with the rest of IP's dlpi handling.
2220 	 * (Remember, it's coming from something else in the kernel
2221 	 * address space)
2222 	 */
2223 
2224 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2225 	if (capend > mp->b_wptr) {
2226 		cmn_err(CE_WARN, "ill_capability_ipsec_ack: "
2227 		    "malformed sub-capability too long for mblk");
2228 		return;
2229 	}
2230 
2231 	/*
2232 	 * There are two types of acks we process here:
2233 	 * 1. acks in reply to a (first form) generic capability req
2234 	 *    (no ENABLE flag set)
2235 	 * 2. acks in reply to a ENABLE capability req.
2236 	 *    (ENABLE flag set)
2237 	 *
2238 	 * We process the subcapability passed as argument as follows:
2239 	 * 1 do initializations
2240 	 *   1.1 initialize nmp = NULL
2241 	 *   1.2 set need_sadb_dump to B_FALSE
2242 	 * 2 for each cipher in subcapability:
2243 	 *   2.1 if ENABLE flag is set:
2244 	 *	2.1.1 update per-ill ipsec capabilities info
2245 	 *	2.1.2 set need_sadb_dump to B_TRUE
2246 	 *   2.2 if ENABLE flag is not set:
2247 	 *	2.2.1 if nmp is NULL:
2248 	 *		2.2.1.1 allocate and initialize nmp
2249 	 *		2.2.1.2 init current pos in nmp
2250 	 *	2.2.2 copy current cipher to current pos in nmp
2251 	 *	2.2.3 set ENABLE flag in nmp
2252 	 *	2.2.4 update current pos
2253 	 * 3 if nmp is not equal to NULL, send enable request
2254 	 *   3.1 send capability request
2255 	 * 4 if need_sadb_dump is B_TRUE
2256 	 *   4.1 enable promiscuous on/off notifications
2257 	 *   4.2 call ill_dlpi_send(isub->dlcap) to send all
2258 	 *	AH or ESP SA's to interface.
2259 	 */
2260 
2261 	nmp = NULL;
2262 	oalg = NULL;
2263 	need_sadb_dump = B_FALSE;
2264 	icip = (dl_capab_ipsec_t *)(isub + 1);
2265 	ialg = (dl_capab_ipsec_alg_t *)(&icip->cip_data[0]);
2266 
2267 	nciphers = icip->cip_nciphers;
2268 	ciphend = (uint8_t *)(ialg + icip->cip_nciphers);
2269 
2270 	if (ciphend > capend) {
2271 		cmn_err(CE_WARN, "ill_capability_ipsec_ack: "
2272 		    "too many ciphers for sub-capability len");
2273 		return;
2274 	}
2275 
2276 	for (cipher = 0; cipher < nciphers; cipher++) {
2277 		alg_len = sizeof (dl_capab_ipsec_alg_t);
2278 
2279 		if (ialg->alg_flag & DL_CAPAB_ALG_ENABLE) {
2280 			/*
2281 			 * TBD: when we provide a way to disable capabilities
2282 			 * from above, need to manage the request-pending state
2283 			 * and fail if we were not expecting this ACK.
2284 			 */
2285 			IPSECHW_DEBUG(IPSECHW_CAPAB,
2286 			    ("ill_capability_ipsec_ack: got ENABLE ACK\n"));
2287 
2288 			/*
2289 			 * Update IPsec capabilities for this ill
2290 			 */
2291 
2292 			if (*ill_capab == NULL) {
2293 				IPSECHW_DEBUG(IPSECHW_CAPAB,
2294 				    ("ill_capability_ipsec_ack: "
2295 					"allocating ipsec_capab for ill\n"));
2296 				*ill_capab = ill_ipsec_capab_alloc();
2297 
2298 				if (*ill_capab == NULL) {
2299 					cmn_err(CE_WARN,
2300 					    "ill_capability_ipsec_ack: "
2301 					    "could not enable IPsec Hardware "
2302 					    "acceleration for %s (ENOMEM)\n",
2303 					    ill->ill_name);
2304 					return;
2305 				}
2306 			}
2307 
2308 			ASSERT(ialg->alg_type == DL_CAPAB_IPSEC_ALG_AUTH ||
2309 			    ialg->alg_type == DL_CAPAB_IPSEC_ALG_ENCR);
2310 
2311 			if (ialg->alg_prim >= MAX_IPSEC_ALGS) {
2312 				cmn_err(CE_WARN,
2313 				    "ill_capability_ipsec_ack: "
2314 				    "malformed IPsec algorithm id %d",
2315 				    ialg->alg_prim);
2316 				continue;
2317 			}
2318 
2319 			if (ialg->alg_type == DL_CAPAB_IPSEC_ALG_AUTH) {
2320 				IPSEC_ALG_ENABLE((*ill_capab)->auth_hw_algs,
2321 				    ialg->alg_prim);
2322 			} else {
2323 				ipsec_capab_algparm_t *alp;
2324 
2325 				IPSEC_ALG_ENABLE((*ill_capab)->encr_hw_algs,
2326 				    ialg->alg_prim);
2327 				if (!ill_ipsec_capab_resize_algparm(*ill_capab,
2328 				    ialg->alg_prim)) {
2329 					cmn_err(CE_WARN,
2330 					    "ill_capability_ipsec_ack: "
2331 					    "no space for IPsec alg id %d",
2332 					    ialg->alg_prim);
2333 					continue;
2334 				}
2335 				alp = &((*ill_capab)->encr_algparm[
2336 						ialg->alg_prim]);
2337 				alp->minkeylen = ialg->alg_minbits;
2338 				alp->maxkeylen = ialg->alg_maxbits;
2339 			}
2340 			ill->ill_capabilities |= ill_capab_flag;
2341 			/*
2342 			 * indicate that a capability was enabled, which
2343 			 * will be used below to kick off a SADB dump
2344 			 * to the ill.
2345 			 */
2346 			need_sadb_dump = B_TRUE;
2347 		} else {
2348 			IPSECHW_DEBUG(IPSECHW_CAPAB,
2349 			    ("ill_capability_ipsec_ack: enabling alg 0x%x\n",
2350 				ialg->alg_prim));
2351 
2352 			if (nmp == NULL) {
2353 				nmp = ill_alloc_ipsec_cap_req(ill, isub);
2354 				if (nmp == NULL) {
2355 					/*
2356 					 * Sending the PROMISC_ON/OFF
2357 					 * notification request failed.
2358 					 * We cannot enable the algorithms
2359 					 * since the Provider will not
2360 					 * notify IP of promiscous mode
2361 					 * changes, which could lead
2362 					 * to leakage of packets.
2363 					 */
2364 					cmn_err(CE_WARN,
2365 					    "ill_capability_ipsec_ack: "
2366 					    "could not enable IPsec Hardware "
2367 					    "acceleration for %s (ENOMEM)\n",
2368 					    ill->ill_name);
2369 					return;
2370 				}
2371 				/* ptr to current output alg specifier */
2372 				oalg = (dl_capab_ipsec_alg_t *)nmp->b_wptr;
2373 			}
2374 
2375 			/*
2376 			 * Copy current alg specifier, set ENABLE
2377 			 * flag, and advance to next output alg.
2378 			 * For now we enable all IPsec capabilities.
2379 			 */
2380 			ASSERT(oalg != NULL);
2381 			bcopy(ialg, oalg, alg_len);
2382 			oalg->alg_flag |= DL_CAPAB_ALG_ENABLE;
2383 			nmp->b_wptr += alg_len;
2384 			oalg = (dl_capab_ipsec_alg_t *)nmp->b_wptr;
2385 		}
2386 
2387 		/* move to next input algorithm specifier */
2388 		ialg = (dl_capab_ipsec_alg_t *)
2389 		    ((char *)ialg + alg_len);
2390 	}
2391 
2392 	if (nmp != NULL)
2393 		/*
2394 		 * nmp points to a DL_CAPABILITY_REQ message to enable
2395 		 * IPsec hardware acceleration.
2396 		 */
2397 		ill_dlpi_send(ill, nmp);
2398 
2399 	if (need_sadb_dump)
2400 		/*
2401 		 * An acknowledgement corresponding to a request to
2402 		 * enable acceleration was received, notify SADB.
2403 		 */
2404 		ill_ipsec_capab_add(ill, sub_dl_cap, sadb_resync);
2405 }
2406 
2407 /*
2408  * Given an mblk with enough space in it, create sub-capability entries for
2409  * DL_CAPAB_IPSEC_{AH,ESP} types which consist of previously-advertised
2410  * offloaded ciphers (both AUTH and ENCR) with their enable flags cleared,
2411  * in preparation for the reset the DL_CAPABILITY_REQ message.
2412  */
2413 static void
2414 ill_fill_ipsec_reset(uint_t nciphers, int stype, uint_t slen,
2415     ill_ipsec_capab_t *ill_cap, mblk_t *mp)
2416 {
2417 	dl_capab_ipsec_t *oipsec;
2418 	dl_capab_ipsec_alg_t *oalg;
2419 	dl_capability_sub_t *dl_subcap;
2420 	int i, k;
2421 
2422 	ASSERT(nciphers > 0);
2423 	ASSERT(ill_cap != NULL);
2424 	ASSERT(mp != NULL);
2425 	ASSERT(MBLKTAIL(mp) >= sizeof (*dl_subcap) + sizeof (*oipsec) + slen);
2426 
2427 	/* dl_capability_sub_t for "stype" */
2428 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2429 	dl_subcap->dl_cap = stype;
2430 	dl_subcap->dl_length = sizeof (dl_capab_ipsec_t) + slen;
2431 	mp->b_wptr += sizeof (dl_capability_sub_t);
2432 
2433 	/* dl_capab_ipsec_t for "stype" */
2434 	oipsec = (dl_capab_ipsec_t *)mp->b_wptr;
2435 	oipsec->cip_version = 1;
2436 	oipsec->cip_nciphers = nciphers;
2437 	mp->b_wptr = (uchar_t *)&oipsec->cip_data[0];
2438 
2439 	/* create entries for "stype" AUTH ciphers */
2440 	for (i = 0; i < ill_cap->algs_size; i++) {
2441 		for (k = 0; k < BITSPERBYTE; k++) {
2442 			if ((ill_cap->auth_hw_algs[i] & (1 << k)) == 0)
2443 				continue;
2444 
2445 			oalg = (dl_capab_ipsec_alg_t *)mp->b_wptr;
2446 			bzero((void *)oalg, sizeof (*oalg));
2447 			oalg->alg_type = DL_CAPAB_IPSEC_ALG_AUTH;
2448 			oalg->alg_prim = k + (BITSPERBYTE * i);
2449 			mp->b_wptr += sizeof (dl_capab_ipsec_alg_t);
2450 		}
2451 	}
2452 	/* create entries for "stype" ENCR ciphers */
2453 	for (i = 0; i < ill_cap->algs_size; i++) {
2454 		for (k = 0; k < BITSPERBYTE; k++) {
2455 			if ((ill_cap->encr_hw_algs[i] & (1 << k)) == 0)
2456 				continue;
2457 
2458 			oalg = (dl_capab_ipsec_alg_t *)mp->b_wptr;
2459 			bzero((void *)oalg, sizeof (*oalg));
2460 			oalg->alg_type = DL_CAPAB_IPSEC_ALG_ENCR;
2461 			oalg->alg_prim = k + (BITSPERBYTE * i);
2462 			mp->b_wptr += sizeof (dl_capab_ipsec_alg_t);
2463 		}
2464 	}
2465 }
2466 
2467 /*
2468  * Macro to count number of 1s in a byte (8-bit word).  The total count is
2469  * accumulated into the passed-in argument (sum).  We could use SPARCv9's
2470  * POPC instruction, but our macro is more flexible for an arbitrary length
2471  * of bytes, such as {auth,encr}_hw_algs.  These variables are currently
2472  * 256-bits long (MAX_IPSEC_ALGS), so if we know for sure that the length
2473  * stays that way, we can reduce the number of iterations required.
2474  */
2475 #define	COUNT_1S(val, sum) {					\
2476 	uint8_t x = val & 0xff;					\
2477 	x = (x & 0x55) + ((x >> 1) & 0x55);			\
2478 	x = (x & 0x33) + ((x >> 2) & 0x33);			\
2479 	sum += (x & 0xf) + ((x >> 4) & 0xf);			\
2480 }
2481 
2482 /* ARGSUSED */
2483 static void
2484 ill_capability_ipsec_reset(ill_t *ill, mblk_t **sc_mp)
2485 {
2486 	mblk_t *mp;
2487 	ill_ipsec_capab_t *cap_ah = ill->ill_ipsec_capab_ah;
2488 	ill_ipsec_capab_t *cap_esp = ill->ill_ipsec_capab_esp;
2489 	uint64_t ill_capabilities = ill->ill_capabilities;
2490 	int ah_cnt = 0, esp_cnt = 0;
2491 	int ah_len = 0, esp_len = 0;
2492 	int i, size = 0;
2493 
2494 	if (!(ill_capabilities & (ILL_CAPAB_AH | ILL_CAPAB_ESP)))
2495 		return;
2496 
2497 	ASSERT(cap_ah != NULL || !(ill_capabilities & ILL_CAPAB_AH));
2498 	ASSERT(cap_esp != NULL || !(ill_capabilities & ILL_CAPAB_ESP));
2499 
2500 	/* Find out the number of ciphers for AH */
2501 	if (cap_ah != NULL) {
2502 		for (i = 0; i < cap_ah->algs_size; i++) {
2503 			COUNT_1S(cap_ah->auth_hw_algs[i], ah_cnt);
2504 			COUNT_1S(cap_ah->encr_hw_algs[i], ah_cnt);
2505 		}
2506 		if (ah_cnt > 0) {
2507 			size += sizeof (dl_capability_sub_t) +
2508 			    sizeof (dl_capab_ipsec_t);
2509 			/* dl_capab_ipsec_t contains one dl_capab_ipsec_alg_t */
2510 			ah_len = (ah_cnt - 1) * sizeof (dl_capab_ipsec_alg_t);
2511 			size += ah_len;
2512 		}
2513 	}
2514 
2515 	/* Find out the number of ciphers for ESP */
2516 	if (cap_esp != NULL) {
2517 		for (i = 0; i < cap_esp->algs_size; i++) {
2518 			COUNT_1S(cap_esp->auth_hw_algs[i], esp_cnt);
2519 			COUNT_1S(cap_esp->encr_hw_algs[i], esp_cnt);
2520 		}
2521 		if (esp_cnt > 0) {
2522 			size += sizeof (dl_capability_sub_t) +
2523 			    sizeof (dl_capab_ipsec_t);
2524 			/* dl_capab_ipsec_t contains one dl_capab_ipsec_alg_t */
2525 			esp_len = (esp_cnt - 1) * sizeof (dl_capab_ipsec_alg_t);
2526 			size += esp_len;
2527 		}
2528 	}
2529 
2530 	if (size == 0) {
2531 		ip1dbg(("ill_capability_ipsec_reset: capabilities exist but "
2532 		    "there's nothing to reset\n"));
2533 		return;
2534 	}
2535 
2536 	mp = allocb(size, BPRI_HI);
2537 	if (mp == NULL) {
2538 		ip1dbg(("ill_capability_ipsec_reset: unable to allocate "
2539 		    "request to disable IPSEC Hardware Acceleration\n"));
2540 		return;
2541 	}
2542 
2543 	/*
2544 	 * Clear the capability flags for IPSec HA but retain the ill
2545 	 * capability structures since it's possible that another thread
2546 	 * is still referring to them.  The structures only get deallocated
2547 	 * when we destroy the ill.
2548 	 *
2549 	 * Various places check the flags to see if the ill is capable of
2550 	 * hardware acceleration, and by clearing them we ensure that new
2551 	 * outbound IPSec packets are sent down encrypted.
2552 	 */
2553 	ill->ill_capabilities &= ~(ILL_CAPAB_AH | ILL_CAPAB_ESP);
2554 
2555 	/* Fill in DL_CAPAB_IPSEC_AH sub-capability entries */
2556 	if (ah_cnt > 0) {
2557 		ill_fill_ipsec_reset(ah_cnt, DL_CAPAB_IPSEC_AH, ah_len,
2558 		    cap_ah, mp);
2559 		ASSERT(mp->b_rptr + size >= mp->b_wptr);
2560 	}
2561 
2562 	/* Fill in DL_CAPAB_IPSEC_ESP sub-capability entries */
2563 	if (esp_cnt > 0) {
2564 		ill_fill_ipsec_reset(esp_cnt, DL_CAPAB_IPSEC_ESP, esp_len,
2565 		    cap_esp, mp);
2566 		ASSERT(mp->b_rptr + size >= mp->b_wptr);
2567 	}
2568 
2569 	/*
2570 	 * At this point we've composed a bunch of sub-capabilities to be
2571 	 * encapsulated in a DL_CAPABILITY_REQ and later sent downstream
2572 	 * by the caller.  Upon receiving this reset message, the driver
2573 	 * must stop inbound decryption (by destroying all inbound SAs)
2574 	 * and let the corresponding packets come in encrypted.
2575 	 */
2576 
2577 	if (*sc_mp != NULL)
2578 		linkb(*sc_mp, mp);
2579 	else
2580 		*sc_mp = mp;
2581 }
2582 
2583 static void
2584 ill_capability_dispatch(ill_t *ill, mblk_t *mp, dl_capability_sub_t *subp,
2585     boolean_t encapsulated)
2586 {
2587 	boolean_t legacy = B_FALSE;
2588 
2589 	/*
2590 	 * If this DL_CAPABILITY_ACK came in as a response to our "reset"
2591 	 * DL_CAPABILITY_REQ, ignore it during this cycle.  We've just
2592 	 * instructed the driver to disable its advertised capabilities,
2593 	 * so there's no point in accepting any response at this moment.
2594 	 */
2595 	if (ill->ill_capab_state == IDMS_UNKNOWN)
2596 		return;
2597 
2598 	/*
2599 	 * Note that only the following two sub-capabilities may be
2600 	 * considered as "legacy", since their original definitions
2601 	 * do not incorporate the dl_mid_t module ID token, and hence
2602 	 * may require the use of the wrapper sub-capability.
2603 	 */
2604 	switch (subp->dl_cap) {
2605 	case DL_CAPAB_IPSEC_AH:
2606 	case DL_CAPAB_IPSEC_ESP:
2607 		legacy = B_TRUE;
2608 		break;
2609 	}
2610 
2611 	/*
2612 	 * For legacy sub-capabilities which don't incorporate a queue_t
2613 	 * pointer in their structures, discard them if we detect that
2614 	 * there are intermediate modules in between IP and the driver.
2615 	 */
2616 	if (!encapsulated && legacy && ill->ill_lmod_cnt > 1) {
2617 		ip1dbg(("ill_capability_dispatch: unencapsulated capab type "
2618 		    "%d discarded; %d module(s) present below IP\n",
2619 		    subp->dl_cap, ill->ill_lmod_cnt));
2620 		return;
2621 	}
2622 
2623 	switch (subp->dl_cap) {
2624 	case DL_CAPAB_IPSEC_AH:
2625 	case DL_CAPAB_IPSEC_ESP:
2626 		ill_capability_ipsec_ack(ill, mp, subp);
2627 		break;
2628 	case DL_CAPAB_MDT:
2629 		ill_capability_mdt_ack(ill, mp, subp);
2630 		break;
2631 	case DL_CAPAB_HCKSUM:
2632 		ill_capability_hcksum_ack(ill, mp, subp);
2633 		break;
2634 	case DL_CAPAB_ZEROCOPY:
2635 		ill_capability_zerocopy_ack(ill, mp, subp);
2636 		break;
2637 	case DL_CAPAB_POLL:
2638 		if (!SOFT_RINGS_ENABLED())
2639 			ill_capability_dls_ack(ill, mp, subp);
2640 		break;
2641 	case DL_CAPAB_SOFT_RING:
2642 		if (SOFT_RINGS_ENABLED())
2643 			ill_capability_dls_ack(ill, mp, subp);
2644 		break;
2645 	default:
2646 		ip1dbg(("ill_capability_dispatch: unknown capab type %d\n",
2647 		    subp->dl_cap));
2648 	}
2649 }
2650 
2651 /*
2652  * As part of negotiating polling capability, the driver tells us
2653  * the default (or normal) blanking interval and packet threshold
2654  * (the receive timer fires if blanking interval is reached or
2655  * the packet threshold is reached).
2656  *
2657  * As part of manipulating the polling interval, we always use our
2658  * estimated interval (avg service time * number of packets queued
2659  * on the squeue) but we try to blank for a minimum of
2660  * rr_normal_blank_time * rr_max_blank_ratio. We disable the
2661  * packet threshold during this time. When we are not in polling mode
2662  * we set the blank interval typically lower, rr_normal_pkt_cnt *
2663  * rr_min_blank_ratio but up the packet cnt by a ratio of
2664  * rr_min_pkt_cnt_ratio so that we are still getting chains if
2665  * possible although for a shorter interval.
2666  */
2667 #define	RR_MAX_BLANK_RATIO	20
2668 #define	RR_MIN_BLANK_RATIO	10
2669 #define	RR_MAX_PKT_CNT_RATIO	3
2670 #define	RR_MIN_PKT_CNT_RATIO	3
2671 
2672 /*
2673  * These can be tuned via /etc/system.
2674  */
2675 int rr_max_blank_ratio = RR_MAX_BLANK_RATIO;
2676 int rr_min_blank_ratio = RR_MIN_BLANK_RATIO;
2677 int rr_max_pkt_cnt_ratio = RR_MAX_PKT_CNT_RATIO;
2678 int rr_min_pkt_cnt_ratio = RR_MIN_PKT_CNT_RATIO;
2679 
2680 static mac_resource_handle_t
2681 ill_ring_add(void *arg, mac_resource_t *mrp)
2682 {
2683 	ill_t			*ill = (ill_t *)arg;
2684 	mac_rx_fifo_t		*mrfp = (mac_rx_fifo_t *)mrp;
2685 	ill_rx_ring_t		*rx_ring;
2686 	int			ip_rx_index;
2687 
2688 	ASSERT(mrp != NULL);
2689 	if (mrp->mr_type != MAC_RX_FIFO) {
2690 		return (NULL);
2691 	}
2692 	ASSERT(ill != NULL);
2693 	ASSERT(ill->ill_dls_capab != NULL);
2694 
2695 	mutex_enter(&ill->ill_lock);
2696 	for (ip_rx_index = 0; ip_rx_index < ILL_MAX_RINGS; ip_rx_index++) {
2697 		rx_ring = &ill->ill_dls_capab->ill_ring_tbl[ip_rx_index];
2698 		ASSERT(rx_ring != NULL);
2699 
2700 		if (rx_ring->rr_ring_state == ILL_RING_FREE) {
2701 			time_t normal_blank_time =
2702 			    mrfp->mrf_normal_blank_time;
2703 			uint_t normal_pkt_cnt =
2704 			    mrfp->mrf_normal_pkt_count;
2705 
2706 			bzero(rx_ring, sizeof (ill_rx_ring_t));
2707 
2708 			rx_ring->rr_blank = mrfp->mrf_blank;
2709 			rx_ring->rr_handle = mrfp->mrf_arg;
2710 			rx_ring->rr_ill = ill;
2711 			rx_ring->rr_normal_blank_time = normal_blank_time;
2712 			rx_ring->rr_normal_pkt_cnt = normal_pkt_cnt;
2713 
2714 			rx_ring->rr_max_blank_time =
2715 			    normal_blank_time * rr_max_blank_ratio;
2716 			rx_ring->rr_min_blank_time =
2717 			    normal_blank_time * rr_min_blank_ratio;
2718 			rx_ring->rr_max_pkt_cnt =
2719 			    normal_pkt_cnt * rr_max_pkt_cnt_ratio;
2720 			rx_ring->rr_min_pkt_cnt =
2721 			    normal_pkt_cnt * rr_min_pkt_cnt_ratio;
2722 
2723 			rx_ring->rr_ring_state = ILL_RING_INUSE;
2724 			mutex_exit(&ill->ill_lock);
2725 
2726 			DTRACE_PROBE2(ill__ring__add, (void *), ill,
2727 			    (int), ip_rx_index);
2728 			return ((mac_resource_handle_t)rx_ring);
2729 		}
2730 	}
2731 
2732 	/*
2733 	 * We ran out of ILL_MAX_RINGS worth rx_ring structures. If
2734 	 * we have devices which can overwhelm this limit, ILL_MAX_RING
2735 	 * should be made configurable. Meanwhile it cause no panic because
2736 	 * driver will pass ip_input a NULL handle which will make
2737 	 * IP allocate the default squeue and Polling mode will not
2738 	 * be used for this ring.
2739 	 */
2740 	cmn_err(CE_NOTE, "Reached maximum number of receiving rings (%d) "
2741 	    "for %s\n", ILL_MAX_RINGS, ill->ill_name);
2742 
2743 	mutex_exit(&ill->ill_lock);
2744 	return (NULL);
2745 }
2746 
2747 static boolean_t
2748 ill_capability_dls_init(ill_t *ill)
2749 {
2750 	ill_dls_capab_t	*ill_dls = ill->ill_dls_capab;
2751 	conn_t 			*connp;
2752 	size_t			sz;
2753 
2754 	if (ill->ill_capabilities & ILL_CAPAB_SOFT_RING) {
2755 		if (ill_dls == NULL) {
2756 			cmn_err(CE_PANIC, "ill_capability_dls_init: "
2757 			    "soft_ring enabled for ill=%s (%p) but data "
2758 			    "structs uninitialized\n", ill->ill_name,
2759 			    (void *)ill);
2760 		}
2761 		return (B_TRUE);
2762 	} else if (ill->ill_capabilities & ILL_CAPAB_POLL) {
2763 		if (ill_dls == NULL) {
2764 			cmn_err(CE_PANIC, "ill_capability_dls_init: "
2765 			    "polling enabled for ill=%s (%p) but data "
2766 			    "structs uninitialized\n", ill->ill_name,
2767 			(void *)ill);
2768 		}
2769 		return (B_TRUE);
2770 	}
2771 
2772 	if (ill_dls != NULL) {
2773 		ill_rx_ring_t 	*rx_ring = ill_dls->ill_ring_tbl;
2774 		/* Soft_Ring or polling is being re-enabled */
2775 
2776 		connp = ill_dls->ill_unbind_conn;
2777 		ASSERT(rx_ring != NULL);
2778 		bzero((void *)ill_dls, sizeof (ill_dls_capab_t));
2779 		bzero((void *)rx_ring,
2780 		    sizeof (ill_rx_ring_t) * ILL_MAX_RINGS);
2781 		ill_dls->ill_ring_tbl = rx_ring;
2782 		ill_dls->ill_unbind_conn = connp;
2783 		return (B_TRUE);
2784 	}
2785 
2786 	if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP)) == NULL)
2787 		return (B_FALSE);
2788 
2789 	sz = sizeof (ill_dls_capab_t);
2790 	sz += sizeof (ill_rx_ring_t) * ILL_MAX_RINGS;
2791 
2792 	ill_dls = kmem_zalloc(sz, KM_NOSLEEP);
2793 	if (ill_dls == NULL) {
2794 		cmn_err(CE_WARN, "ill_capability_dls_init: could not "
2795 		    "allocate dls_capab for %s (%p)\n", ill->ill_name,
2796 		    (void *)ill);
2797 		CONN_DEC_REF(connp);
2798 		return (B_FALSE);
2799 	}
2800 
2801 	/* Allocate space to hold ring table */
2802 	ill_dls->ill_ring_tbl = (ill_rx_ring_t *)&ill_dls[1];
2803 	ill->ill_dls_capab = ill_dls;
2804 	ill_dls->ill_unbind_conn = connp;
2805 	return (B_TRUE);
2806 }
2807 
2808 /*
2809  * ill_capability_dls_disable: disable soft_ring and/or polling
2810  * capability. Since any of the rings might already be in use, need
2811  * to call ipsq_clean_all() which gets behind the squeue to disable
2812  * direct calls if necessary.
2813  */
2814 static void
2815 ill_capability_dls_disable(ill_t *ill)
2816 {
2817 	ill_dls_capab_t	*ill_dls = ill->ill_dls_capab;
2818 
2819 	if (ill->ill_capabilities & ILL_CAPAB_DLS) {
2820 		ipsq_clean_all(ill);
2821 		ill_dls->ill_tx = NULL;
2822 		ill_dls->ill_tx_handle = NULL;
2823 		ill_dls->ill_dls_change_status = NULL;
2824 		ill_dls->ill_dls_bind = NULL;
2825 		ill_dls->ill_dls_unbind = NULL;
2826 	}
2827 
2828 	ASSERT(!(ill->ill_capabilities & ILL_CAPAB_DLS));
2829 }
2830 
2831 static void
2832 ill_capability_dls_capable(ill_t *ill, dl_capab_dls_t *idls,
2833     dl_capability_sub_t *isub)
2834 {
2835 	uint_t			size;
2836 	uchar_t			*rptr;
2837 	dl_capab_dls_t	dls, *odls;
2838 	ill_dls_capab_t	*ill_dls;
2839 	mblk_t			*nmp = NULL;
2840 	dl_capability_req_t	*ocap;
2841 	uint_t			sub_dl_cap = isub->dl_cap;
2842 
2843 	if (!ill_capability_dls_init(ill))
2844 		return;
2845 	ill_dls = ill->ill_dls_capab;
2846 
2847 	/* Copy locally to get the members aligned */
2848 	bcopy((void *)idls, (void *)&dls,
2849 	    sizeof (dl_capab_dls_t));
2850 
2851 	/* Get the tx function and handle from dld */
2852 	ill_dls->ill_tx = (ip_dld_tx_t)dls.dls_tx;
2853 	ill_dls->ill_tx_handle = (void *)dls.dls_tx_handle;
2854 
2855 	if (sub_dl_cap == DL_CAPAB_SOFT_RING) {
2856 		ill_dls->ill_dls_change_status =
2857 		    (ip_dls_chg_soft_ring_t)dls.dls_ring_change_status;
2858 		ill_dls->ill_dls_bind = (ip_dls_bind_t)dls.dls_ring_bind;
2859 		ill_dls->ill_dls_unbind =
2860 		    (ip_dls_unbind_t)dls.dls_ring_unbind;
2861 		ill_dls->ill_dls_soft_ring_cnt = ip_soft_rings_cnt;
2862 	}
2863 
2864 	size = sizeof (dl_capability_req_t) + sizeof (dl_capability_sub_t) +
2865 	    isub->dl_length;
2866 
2867 	if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2868 		cmn_err(CE_WARN, "ill_capability_dls_capable: could "
2869 		    "not allocate memory for CAPAB_REQ for %s (%p)\n",
2870 		    ill->ill_name, (void *)ill);
2871 		return;
2872 	}
2873 
2874 	/* initialize dl_capability_req_t */
2875 	rptr = nmp->b_rptr;
2876 	ocap = (dl_capability_req_t *)rptr;
2877 	ocap->dl_sub_offset = sizeof (dl_capability_req_t);
2878 	ocap->dl_sub_length = sizeof (dl_capability_sub_t) + isub->dl_length;
2879 	rptr += sizeof (dl_capability_req_t);
2880 
2881 	/* initialize dl_capability_sub_t */
2882 	bcopy(isub, rptr, sizeof (*isub));
2883 	rptr += sizeof (*isub);
2884 
2885 	odls = (dl_capab_dls_t *)rptr;
2886 	rptr += sizeof (dl_capab_dls_t);
2887 
2888 	/* initialize dl_capab_dls_t to be sent down */
2889 	dls.dls_rx_handle = (uintptr_t)ill;
2890 	dls.dls_rx = (uintptr_t)ip_input;
2891 	dls.dls_ring_add = (uintptr_t)ill_ring_add;
2892 
2893 	if (sub_dl_cap == DL_CAPAB_SOFT_RING) {
2894 		dls.dls_ring_cnt = ip_soft_rings_cnt;
2895 		dls.dls_ring_assign = (uintptr_t)ip_soft_ring_assignment;
2896 		dls.dls_flags = SOFT_RING_ENABLE;
2897 	} else {
2898 		dls.dls_flags = POLL_ENABLE;
2899 		ip1dbg(("ill_capability_dls_capable: asking interface %s "
2900 		    "to enable polling\n", ill->ill_name));
2901 	}
2902 	bcopy((void *)&dls, (void *)odls,
2903 	    sizeof (dl_capab_dls_t));
2904 	ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
2905 	/*
2906 	 * nmp points to a DL_CAPABILITY_REQ message to
2907 	 * enable either soft_ring or polling
2908 	 */
2909 	ill_dlpi_send(ill, nmp);
2910 }
2911 
2912 static void
2913 ill_capability_dls_reset(ill_t *ill, mblk_t **sc_mp)
2914 {
2915 	mblk_t *mp;
2916 	dl_capab_dls_t *idls;
2917 	dl_capability_sub_t *dl_subcap;
2918 	int size;
2919 
2920 	if (!(ill->ill_capabilities & ILL_CAPAB_DLS))
2921 		return;
2922 
2923 	ASSERT(ill->ill_dls_capab != NULL);
2924 
2925 	size = sizeof (*dl_subcap) + sizeof (*idls);
2926 
2927 	mp = allocb(size, BPRI_HI);
2928 	if (mp == NULL) {
2929 		ip1dbg(("ill_capability_dls_reset: unable to allocate "
2930 		    "request to disable soft_ring\n"));
2931 		return;
2932 	}
2933 
2934 	mp->b_wptr = mp->b_rptr + size;
2935 
2936 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
2937 	dl_subcap->dl_length = sizeof (*idls);
2938 	if (ill->ill_capabilities & ILL_CAPAB_SOFT_RING)
2939 		dl_subcap->dl_cap = DL_CAPAB_SOFT_RING;
2940 	else
2941 		dl_subcap->dl_cap = DL_CAPAB_POLL;
2942 
2943 	idls = (dl_capab_dls_t *)(dl_subcap + 1);
2944 	if (ill->ill_capabilities & ILL_CAPAB_SOFT_RING)
2945 		idls->dls_flags = SOFT_RING_DISABLE;
2946 	else
2947 		idls->dls_flags = POLL_DISABLE;
2948 
2949 	if (*sc_mp != NULL)
2950 		linkb(*sc_mp, mp);
2951 	else
2952 		*sc_mp = mp;
2953 }
2954 
2955 /*
2956  * Process a soft_ring/poll capability negotiation ack received
2957  * from a DLS Provider.isub must point to the sub-capability
2958  * (DL_CAPAB_SOFT_RING/DL_CAPAB_POLL) of a DL_CAPABILITY_ACK message.
2959  */
2960 static void
2961 ill_capability_dls_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2962 {
2963 	dl_capab_dls_t		*idls;
2964 	uint_t			sub_dl_cap = isub->dl_cap;
2965 	uint8_t			*capend;
2966 
2967 	ASSERT(sub_dl_cap == DL_CAPAB_SOFT_RING ||
2968 	    sub_dl_cap == DL_CAPAB_POLL);
2969 
2970 	if (ill->ill_isv6)
2971 		return;
2972 
2973 	/*
2974 	 * Note: range checks here are not absolutely sufficient to
2975 	 * make us robust against malformed messages sent by drivers;
2976 	 * this is in keeping with the rest of IP's dlpi handling.
2977 	 * (Remember, it's coming from something else in the kernel
2978 	 * address space)
2979 	 */
2980 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2981 	if (capend > mp->b_wptr) {
2982 		cmn_err(CE_WARN, "ill_capability_dls_ack: "
2983 		    "malformed sub-capability too long for mblk");
2984 		return;
2985 	}
2986 
2987 	/*
2988 	 * There are two types of acks we process here:
2989 	 * 1. acks in reply to a (first form) generic capability req
2990 	 *    (dls_flag will be set to SOFT_RING_CAPABLE or POLL_CAPABLE)
2991 	 * 2. acks in reply to a SOFT_RING_ENABLE or POLL_ENABLE
2992 	 *    capability req.
2993 	 */
2994 	idls = (dl_capab_dls_t *)(isub + 1);
2995 
2996 	if (!dlcapabcheckqid(&idls->dls_mid, ill->ill_lmod_rq)) {
2997 		ip1dbg(("ill_capability_dls_ack: mid token for dls "
2998 		    "capability isn't as expected; pass-thru "
2999 		    "module(s) detected, discarding capability\n"));
3000 		if (ill->ill_capabilities & ILL_CAPAB_DLS) {
3001 			/*
3002 			 * This is a capability renegotitation case.
3003 			 * The interface better be unusable at this
3004 			 * point other wise bad things will happen
3005 			 * if we disable direct calls on a running
3006 			 * and up interface.
3007 			 */
3008 			ill_capability_dls_disable(ill);
3009 		}
3010 		return;
3011 	}
3012 
3013 	switch (idls->dls_flags) {
3014 	default:
3015 		/* Disable if unknown flag */
3016 	case SOFT_RING_DISABLE:
3017 	case POLL_DISABLE:
3018 		ill_capability_dls_disable(ill);
3019 		break;
3020 	case SOFT_RING_CAPABLE:
3021 	case POLL_CAPABLE:
3022 		/*
3023 		 * If the capability was already enabled, its safe
3024 		 * to disable it first to get rid of stale information
3025 		 * and then start enabling it again.
3026 		 */
3027 		ill_capability_dls_disable(ill);
3028 		ill_capability_dls_capable(ill, idls, isub);
3029 		break;
3030 	case SOFT_RING_ENABLE:
3031 	case POLL_ENABLE:
3032 		mutex_enter(&ill->ill_lock);
3033 		if (sub_dl_cap == DL_CAPAB_SOFT_RING &&
3034 		    !(ill->ill_capabilities & ILL_CAPAB_SOFT_RING)) {
3035 			ASSERT(ill->ill_dls_capab != NULL);
3036 			ill->ill_capabilities |= ILL_CAPAB_SOFT_RING;
3037 		}
3038 		if (sub_dl_cap == DL_CAPAB_POLL &&
3039 		    !(ill->ill_capabilities & ILL_CAPAB_POLL)) {
3040 			ASSERT(ill->ill_dls_capab != NULL);
3041 			ill->ill_capabilities |= ILL_CAPAB_POLL;
3042 			ip1dbg(("ill_capability_dls_ack: interface %s "
3043 			    "has enabled polling\n", ill->ill_name));
3044 		}
3045 		mutex_exit(&ill->ill_lock);
3046 		break;
3047 	}
3048 }
3049 
3050 /*
3051  * Process a hardware checksum offload capability negotiation ack received
3052  * from a DLS Provider.isub must point to the sub-capability (DL_CAPAB_HCKSUM)
3053  * of a DL_CAPABILITY_ACK message.
3054  */
3055 static void
3056 ill_capability_hcksum_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
3057 {
3058 	dl_capability_req_t	*ocap;
3059 	dl_capab_hcksum_t	*ihck, *ohck;
3060 	ill_hcksum_capab_t	**ill_hcksum;
3061 	mblk_t			*nmp = NULL;
3062 	uint_t			sub_dl_cap = isub->dl_cap;
3063 	uint8_t			*capend;
3064 
3065 	ASSERT(sub_dl_cap == DL_CAPAB_HCKSUM);
3066 
3067 	ill_hcksum = (ill_hcksum_capab_t **)&ill->ill_hcksum_capab;
3068 
3069 	/*
3070 	 * Note: range checks here are not absolutely sufficient to
3071 	 * make us robust against malformed messages sent by drivers;
3072 	 * this is in keeping with the rest of IP's dlpi handling.
3073 	 * (Remember, it's coming from something else in the kernel
3074 	 * address space)
3075 	 */
3076 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
3077 	if (capend > mp->b_wptr) {
3078 		cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
3079 		    "malformed sub-capability too long for mblk");
3080 		return;
3081 	}
3082 
3083 	/*
3084 	 * There are two types of acks we process here:
3085 	 * 1. acks in reply to a (first form) generic capability req
3086 	 *    (no ENABLE flag set)
3087 	 * 2. acks in reply to a ENABLE capability req.
3088 	 *    (ENABLE flag set)
3089 	 */
3090 	ihck = (dl_capab_hcksum_t *)(isub + 1);
3091 
3092 	if (ihck->hcksum_version != HCKSUM_VERSION_1) {
3093 		cmn_err(CE_CONT, "ill_capability_hcksum_ack: "
3094 		    "unsupported hardware checksum "
3095 		    "sub-capability (version %d, expected %d)",
3096 		    ihck->hcksum_version, HCKSUM_VERSION_1);
3097 		return;
3098 	}
3099 
3100 	if (!dlcapabcheckqid(&ihck->hcksum_mid, ill->ill_lmod_rq)) {
3101 		ip1dbg(("ill_capability_hcksum_ack: mid token for hardware "
3102 		    "checksum capability isn't as expected; pass-thru "
3103 		    "module(s) detected, discarding capability\n"));
3104 		return;
3105 	}
3106 
3107 #define	CURR_HCKSUM_CAPAB				\
3108 	(HCKSUM_INET_PARTIAL | HCKSUM_INET_FULL_V4 |	\
3109 	HCKSUM_INET_FULL_V6 | HCKSUM_IPHDRCKSUM)
3110 
3111 	if ((ihck->hcksum_txflags & HCKSUM_ENABLE) &&
3112 	    (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB)) {
3113 		/* do ENABLE processing */
3114 		if (*ill_hcksum == NULL) {
3115 			*ill_hcksum = kmem_zalloc(sizeof (ill_hcksum_capab_t),
3116 			    KM_NOSLEEP);
3117 
3118 			if (*ill_hcksum == NULL) {
3119 				cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
3120 				    "could not enable hcksum version %d "
3121 				    "for %s (ENOMEM)\n", HCKSUM_CURRENT_VERSION,
3122 				    ill->ill_name);
3123 				return;
3124 			}
3125 		}
3126 
3127 		(*ill_hcksum)->ill_hcksum_version = ihck->hcksum_version;
3128 		(*ill_hcksum)->ill_hcksum_txflags = ihck->hcksum_txflags;
3129 		ill->ill_capabilities |= ILL_CAPAB_HCKSUM;
3130 		ip1dbg(("ill_capability_hcksum_ack: interface %s "
3131 		    "has enabled hardware checksumming\n ",
3132 		    ill->ill_name));
3133 	} else if (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB) {
3134 		/*
3135 		 * Enabling hardware checksum offload
3136 		 * Currently IP supports {TCP,UDP}/IPv4
3137 		 * partial and full cksum offload and
3138 		 * IPv4 header checksum offload.
3139 		 * Allocate new mblk which will
3140 		 * contain a new capability request
3141 		 * to enable hardware checksum offload.
3142 		 */
3143 		uint_t	size;
3144 		uchar_t	*rptr;
3145 
3146 		size = sizeof (dl_capability_req_t) +
3147 		    sizeof (dl_capability_sub_t) + isub->dl_length;
3148 
3149 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
3150 			cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
3151 			    "could not enable hardware cksum for %s (ENOMEM)\n",
3152 			    ill->ill_name);
3153 			return;
3154 		}
3155 
3156 		rptr = nmp->b_rptr;
3157 		/* initialize dl_capability_req_t */
3158 		ocap = (dl_capability_req_t *)nmp->b_rptr;
3159 		ocap->dl_sub_offset =
3160 		    sizeof (dl_capability_req_t);
3161 		ocap->dl_sub_length =
3162 		    sizeof (dl_capability_sub_t) +
3163 		    isub->dl_length;
3164 		nmp->b_rptr += sizeof (dl_capability_req_t);
3165 
3166 		/* initialize dl_capability_sub_t */
3167 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
3168 		nmp->b_rptr += sizeof (*isub);
3169 
3170 		/* initialize dl_capab_hcksum_t */
3171 		ohck = (dl_capab_hcksum_t *)nmp->b_rptr;
3172 		bcopy(ihck, ohck, sizeof (*ihck));
3173 
3174 		nmp->b_rptr = rptr;
3175 		ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
3176 
3177 		/* Set ENABLE flag */
3178 		ohck->hcksum_txflags &= CURR_HCKSUM_CAPAB;
3179 		ohck->hcksum_txflags |= HCKSUM_ENABLE;
3180 
3181 		/*
3182 		 * nmp points to a DL_CAPABILITY_REQ message to enable
3183 		 * hardware checksum acceleration.
3184 		 */
3185 		ill_dlpi_send(ill, nmp);
3186 	} else {
3187 		ip1dbg(("ill_capability_hcksum_ack: interface %s has "
3188 		    "advertised %x hardware checksum capability flags\n",
3189 		    ill->ill_name, ihck->hcksum_txflags));
3190 	}
3191 }
3192 
3193 static void
3194 ill_capability_hcksum_reset(ill_t *ill, mblk_t **sc_mp)
3195 {
3196 	mblk_t *mp;
3197 	dl_capab_hcksum_t *hck_subcap;
3198 	dl_capability_sub_t *dl_subcap;
3199 	int size;
3200 
3201 	if (!ILL_HCKSUM_CAPABLE(ill))
3202 		return;
3203 
3204 	ASSERT(ill->ill_hcksum_capab != NULL);
3205 	/*
3206 	 * Clear the capability flag for hardware checksum offload but
3207 	 * retain the ill_hcksum_capab structure since it's possible that
3208 	 * another thread is still referring to it.  The structure only
3209 	 * gets deallocated when we destroy the ill.
3210 	 */
3211 	ill->ill_capabilities &= ~ILL_CAPAB_HCKSUM;
3212 
3213 	size = sizeof (*dl_subcap) + sizeof (*hck_subcap);
3214 
3215 	mp = allocb(size, BPRI_HI);
3216 	if (mp == NULL) {
3217 		ip1dbg(("ill_capability_hcksum_reset: unable to allocate "
3218 		    "request to disable hardware checksum offload\n"));
3219 		return;
3220 	}
3221 
3222 	mp->b_wptr = mp->b_rptr + size;
3223 
3224 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
3225 	dl_subcap->dl_cap = DL_CAPAB_HCKSUM;
3226 	dl_subcap->dl_length = sizeof (*hck_subcap);
3227 
3228 	hck_subcap = (dl_capab_hcksum_t *)(dl_subcap + 1);
3229 	hck_subcap->hcksum_version = ill->ill_hcksum_capab->ill_hcksum_version;
3230 	hck_subcap->hcksum_txflags = 0;
3231 
3232 	if (*sc_mp != NULL)
3233 		linkb(*sc_mp, mp);
3234 	else
3235 		*sc_mp = mp;
3236 }
3237 
3238 static void
3239 ill_capability_zerocopy_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
3240 {
3241 	mblk_t *nmp = NULL;
3242 	dl_capability_req_t *oc;
3243 	dl_capab_zerocopy_t *zc_ic, *zc_oc;
3244 	ill_zerocopy_capab_t **ill_zerocopy_capab;
3245 	uint_t sub_dl_cap = isub->dl_cap;
3246 	uint8_t *capend;
3247 
3248 	ASSERT(sub_dl_cap == DL_CAPAB_ZEROCOPY);
3249 
3250 	ill_zerocopy_capab = (ill_zerocopy_capab_t **)&ill->ill_zerocopy_capab;
3251 
3252 	/*
3253 	 * Note: range checks here are not absolutely sufficient to
3254 	 * make us robust against malformed messages sent by drivers;
3255 	 * this is in keeping with the rest of IP's dlpi handling.
3256 	 * (Remember, it's coming from something else in the kernel
3257 	 * address space)
3258 	 */
3259 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
3260 	if (capend > mp->b_wptr) {
3261 		cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
3262 		    "malformed sub-capability too long for mblk");
3263 		return;
3264 	}
3265 
3266 	zc_ic = (dl_capab_zerocopy_t *)(isub + 1);
3267 	if (zc_ic->zerocopy_version != ZEROCOPY_VERSION_1) {
3268 		cmn_err(CE_CONT, "ill_capability_zerocopy_ack: "
3269 		    "unsupported ZEROCOPY sub-capability (version %d, "
3270 		    "expected %d)", zc_ic->zerocopy_version,
3271 		    ZEROCOPY_VERSION_1);
3272 		return;
3273 	}
3274 
3275 	if (!dlcapabcheckqid(&zc_ic->zerocopy_mid, ill->ill_lmod_rq)) {
3276 		ip1dbg(("ill_capability_zerocopy_ack: mid token for zerocopy "
3277 		    "capability isn't as expected; pass-thru module(s) "
3278 		    "detected, discarding capability\n"));
3279 		return;
3280 	}
3281 
3282 	if ((zc_ic->zerocopy_flags & DL_CAPAB_VMSAFE_MEM) != 0) {
3283 		if (*ill_zerocopy_capab == NULL) {
3284 			*ill_zerocopy_capab =
3285 			    kmem_zalloc(sizeof (ill_zerocopy_capab_t),
3286 			    KM_NOSLEEP);
3287 
3288 			if (*ill_zerocopy_capab == NULL) {
3289 				cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
3290 				    "could not enable Zero-copy version %d "
3291 				    "for %s (ENOMEM)\n", ZEROCOPY_VERSION_1,
3292 				    ill->ill_name);
3293 				return;
3294 			}
3295 		}
3296 
3297 		ip1dbg(("ill_capability_zerocopy_ack: interface %s "
3298 		    "supports Zero-copy version %d\n", ill->ill_name,
3299 		    ZEROCOPY_VERSION_1));
3300 
3301 		(*ill_zerocopy_capab)->ill_zerocopy_version =
3302 		    zc_ic->zerocopy_version;
3303 		(*ill_zerocopy_capab)->ill_zerocopy_flags =
3304 		    zc_ic->zerocopy_flags;
3305 
3306 		ill->ill_capabilities |= ILL_CAPAB_ZEROCOPY;
3307 	} else {
3308 		uint_t size;
3309 		uchar_t *rptr;
3310 
3311 		size = sizeof (dl_capability_req_t) +
3312 		    sizeof (dl_capability_sub_t) +
3313 		    sizeof (dl_capab_zerocopy_t);
3314 
3315 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
3316 			cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
3317 			    "could not enable zerocopy for %s (ENOMEM)\n",
3318 			    ill->ill_name);
3319 			return;
3320 		}
3321 
3322 		rptr = nmp->b_rptr;
3323 		/* initialize dl_capability_req_t */
3324 		oc = (dl_capability_req_t *)rptr;
3325 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
3326 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
3327 		    sizeof (dl_capab_zerocopy_t);
3328 		rptr += sizeof (dl_capability_req_t);
3329 
3330 		/* initialize dl_capability_sub_t */
3331 		bcopy(isub, rptr, sizeof (*isub));
3332 		rptr += sizeof (*isub);
3333 
3334 		/* initialize dl_capab_zerocopy_t */
3335 		zc_oc = (dl_capab_zerocopy_t *)rptr;
3336 		*zc_oc = *zc_ic;
3337 
3338 		ip1dbg(("ill_capability_zerocopy_ack: asking interface %s "
3339 		    "to enable zero-copy version %d\n", ill->ill_name,
3340 		    ZEROCOPY_VERSION_1));
3341 
3342 		/* set VMSAFE_MEM flag */
3343 		zc_oc->zerocopy_flags |= DL_CAPAB_VMSAFE_MEM;
3344 
3345 		/* nmp points to a DL_CAPABILITY_REQ message to enable zcopy */
3346 		ill_dlpi_send(ill, nmp);
3347 	}
3348 }
3349 
3350 static void
3351 ill_capability_zerocopy_reset(ill_t *ill, mblk_t **sc_mp)
3352 {
3353 	mblk_t *mp;
3354 	dl_capab_zerocopy_t *zerocopy_subcap;
3355 	dl_capability_sub_t *dl_subcap;
3356 	int size;
3357 
3358 	if (!(ill->ill_capabilities & ILL_CAPAB_ZEROCOPY))
3359 		return;
3360 
3361 	ASSERT(ill->ill_zerocopy_capab != NULL);
3362 	/*
3363 	 * Clear the capability flag for Zero-copy but retain the
3364 	 * ill_zerocopy_capab structure since it's possible that another
3365 	 * thread is still referring to it.  The structure only gets
3366 	 * deallocated when we destroy the ill.
3367 	 */
3368 	ill->ill_capabilities &= ~ILL_CAPAB_ZEROCOPY;
3369 
3370 	size = sizeof (*dl_subcap) + sizeof (*zerocopy_subcap);
3371 
3372 	mp = allocb(size, BPRI_HI);
3373 	if (mp == NULL) {
3374 		ip1dbg(("ill_capability_zerocopy_reset: unable to allocate "
3375 		    "request to disable Zero-copy\n"));
3376 		return;
3377 	}
3378 
3379 	mp->b_wptr = mp->b_rptr + size;
3380 
3381 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
3382 	dl_subcap->dl_cap = DL_CAPAB_ZEROCOPY;
3383 	dl_subcap->dl_length = sizeof (*zerocopy_subcap);
3384 
3385 	zerocopy_subcap = (dl_capab_zerocopy_t *)(dl_subcap + 1);
3386 	zerocopy_subcap->zerocopy_version =
3387 	    ill->ill_zerocopy_capab->ill_zerocopy_version;
3388 	zerocopy_subcap->zerocopy_flags = 0;
3389 
3390 	if (*sc_mp != NULL)
3391 		linkb(*sc_mp, mp);
3392 	else
3393 		*sc_mp = mp;
3394 }
3395 
3396 /*
3397  * Consume a new-style hardware capabilities negotiation ack.
3398  * Called from ip_rput_dlpi_writer().
3399  */
3400 void
3401 ill_capability_ack(ill_t *ill, mblk_t *mp)
3402 {
3403 	dl_capability_ack_t *capp;
3404 	dl_capability_sub_t *subp, *endp;
3405 
3406 	if (ill->ill_capab_state == IDMS_INPROGRESS)
3407 		ill->ill_capab_state = IDMS_OK;
3408 
3409 	capp = (dl_capability_ack_t *)mp->b_rptr;
3410 
3411 	if (capp->dl_sub_length == 0)
3412 		/* no new-style capabilities */
3413 		return;
3414 
3415 	/* make sure the driver supplied correct dl_sub_length */
3416 	if ((sizeof (*capp) + capp->dl_sub_length) > MBLKL(mp)) {
3417 		ip0dbg(("ill_capability_ack: bad DL_CAPABILITY_ACK, "
3418 		    "invalid dl_sub_length (%d)\n", capp->dl_sub_length));
3419 		return;
3420 	}
3421 
3422 #define	SC(base, offset) (dl_capability_sub_t *)(((uchar_t *)(base))+(offset))
3423 	/*
3424 	 * There are sub-capabilities. Process the ones we know about.
3425 	 * Loop until we don't have room for another sub-cap header..
3426 	 */
3427 	for (subp = SC(capp, capp->dl_sub_offset),
3428 	    endp = SC(subp, capp->dl_sub_length - sizeof (*subp));
3429 	    subp <= endp;
3430 	    subp = SC(subp, sizeof (dl_capability_sub_t) + subp->dl_length)) {
3431 
3432 		switch (subp->dl_cap) {
3433 		case DL_CAPAB_ID_WRAPPER:
3434 			ill_capability_id_ack(ill, mp, subp);
3435 			break;
3436 		default:
3437 			ill_capability_dispatch(ill, mp, subp, B_FALSE);
3438 			break;
3439 		}
3440 	}
3441 #undef SC
3442 }
3443 
3444 /*
3445  * This routine is called to scan the fragmentation reassembly table for
3446  * the specified ILL for any packets that are starting to smell.
3447  * dead_interval is the maximum time in seconds that will be tolerated.  It
3448  * will either be the value specified in ip_g_frag_timeout, or zero if the
3449  * ILL is shutting down and it is time to blow everything off.
3450  *
3451  * It returns the number of seconds (as a time_t) that the next frag timer
3452  * should be scheduled for, 0 meaning that the timer doesn't need to be
3453  * re-started.  Note that the method of calculating next_timeout isn't
3454  * entirely accurate since time will flow between the time we grab
3455  * current_time and the time we schedule the next timeout.  This isn't a
3456  * big problem since this is the timer for sending an ICMP reassembly time
3457  * exceeded messages, and it doesn't have to be exactly accurate.
3458  *
3459  * This function is
3460  * sometimes called as writer, although this is not required.
3461  */
3462 time_t
3463 ill_frag_timeout(ill_t *ill, time_t dead_interval)
3464 {
3465 	ipfb_t	*ipfb;
3466 	ipfb_t	*endp;
3467 	ipf_t	*ipf;
3468 	ipf_t	*ipfnext;
3469 	mblk_t	*mp;
3470 	time_t	current_time = gethrestime_sec();
3471 	time_t	next_timeout = 0;
3472 	uint32_t	hdr_length;
3473 	mblk_t	*send_icmp_head;
3474 	mblk_t	*send_icmp_head_v6;
3475 
3476 	ipfb = ill->ill_frag_hash_tbl;
3477 	if (ipfb == NULL)
3478 		return (B_FALSE);
3479 	endp = &ipfb[ILL_FRAG_HASH_TBL_COUNT];
3480 	/* Walk the frag hash table. */
3481 	for (; ipfb < endp; ipfb++) {
3482 		send_icmp_head = NULL;
3483 		send_icmp_head_v6 = NULL;
3484 		mutex_enter(&ipfb->ipfb_lock);
3485 		while ((ipf = ipfb->ipfb_ipf) != 0) {
3486 			time_t frag_time = current_time - ipf->ipf_timestamp;
3487 			time_t frag_timeout;
3488 
3489 			if (frag_time < dead_interval) {
3490 				/*
3491 				 * There are some outstanding fragments
3492 				 * that will timeout later.  Make note of
3493 				 * the time so that we can reschedule the
3494 				 * next timeout appropriately.
3495 				 */
3496 				frag_timeout = dead_interval - frag_time;
3497 				if (next_timeout == 0 ||
3498 				    frag_timeout < next_timeout) {
3499 					next_timeout = frag_timeout;
3500 				}
3501 				break;
3502 			}
3503 			/* Time's up.  Get it out of here. */
3504 			hdr_length = ipf->ipf_nf_hdr_len;
3505 			ipfnext = ipf->ipf_hash_next;
3506 			if (ipfnext)
3507 				ipfnext->ipf_ptphn = ipf->ipf_ptphn;
3508 			*ipf->ipf_ptphn = ipfnext;
3509 			mp = ipf->ipf_mp->b_cont;
3510 			for (; mp; mp = mp->b_cont) {
3511 				/* Extra points for neatness. */
3512 				IP_REASS_SET_START(mp, 0);
3513 				IP_REASS_SET_END(mp, 0);
3514 			}
3515 			mp = ipf->ipf_mp->b_cont;
3516 			ill->ill_frag_count -= ipf->ipf_count;
3517 			ASSERT(ipfb->ipfb_count >= ipf->ipf_count);
3518 			ipfb->ipfb_count -= ipf->ipf_count;
3519 			ASSERT(ipfb->ipfb_frag_pkts > 0);
3520 			ipfb->ipfb_frag_pkts--;
3521 			/*
3522 			 * We do not send any icmp message from here because
3523 			 * we currently are holding the ipfb_lock for this
3524 			 * hash chain. If we try and send any icmp messages
3525 			 * from here we may end up via a put back into ip
3526 			 * trying to get the same lock, causing a recursive
3527 			 * mutex panic. Instead we build a list and send all
3528 			 * the icmp messages after we have dropped the lock.
3529 			 */
3530 			if (ill->ill_isv6) {
3531 				BUMP_MIB(ill->ill_ip6_mib, ipv6ReasmFails);
3532 				if (hdr_length != 0) {
3533 					mp->b_next = send_icmp_head_v6;
3534 					send_icmp_head_v6 = mp;
3535 				} else {
3536 					freemsg(mp);
3537 				}
3538 			} else {
3539 				BUMP_MIB(&ip_mib, ipReasmFails);
3540 				if (hdr_length != 0) {
3541 					mp->b_next = send_icmp_head;
3542 					send_icmp_head = mp;
3543 				} else {
3544 					freemsg(mp);
3545 				}
3546 			}
3547 			freeb(ipf->ipf_mp);
3548 		}
3549 		mutex_exit(&ipfb->ipfb_lock);
3550 		/*
3551 		 * Now need to send any icmp messages that we delayed from
3552 		 * above.
3553 		 */
3554 		while (send_icmp_head_v6 != NULL) {
3555 			mp = send_icmp_head_v6;
3556 			send_icmp_head_v6 = send_icmp_head_v6->b_next;
3557 			mp->b_next = NULL;
3558 			icmp_time_exceeded_v6(ill->ill_wq, mp,
3559 			    ICMP_REASSEMBLY_TIME_EXCEEDED, B_FALSE, B_FALSE);
3560 		}
3561 		while (send_icmp_head != NULL) {
3562 			mp = send_icmp_head;
3563 			send_icmp_head = send_icmp_head->b_next;
3564 			mp->b_next = NULL;
3565 			icmp_time_exceeded(ill->ill_wq, mp,
3566 			    ICMP_REASSEMBLY_TIME_EXCEEDED);
3567 		}
3568 	}
3569 	/*
3570 	 * A non-dying ILL will use the return value to decide whether to
3571 	 * restart the frag timer, and for how long.
3572 	 */
3573 	return (next_timeout);
3574 }
3575 
3576 /*
3577  * This routine is called when the approximate count of mblk memory used
3578  * for the specified ILL has exceeded max_count.
3579  */
3580 void
3581 ill_frag_prune(ill_t *ill, uint_t max_count)
3582 {
3583 	ipfb_t	*ipfb;
3584 	ipf_t	*ipf;
3585 	size_t	count;
3586 
3587 	/*
3588 	 * If we are here within ip_min_frag_prune_time msecs remove
3589 	 * ill_frag_free_num_pkts oldest packets from each bucket and increment
3590 	 * ill_frag_free_num_pkts.
3591 	 */
3592 	mutex_enter(&ill->ill_lock);
3593 	if (TICK_TO_MSEC(lbolt - ill->ill_last_frag_clean_time) <=
3594 	    (ip_min_frag_prune_time != 0 ?
3595 	    ip_min_frag_prune_time : msec_per_tick)) {
3596 
3597 		ill->ill_frag_free_num_pkts++;
3598 
3599 	} else {
3600 		ill->ill_frag_free_num_pkts = 0;
3601 	}
3602 	ill->ill_last_frag_clean_time = lbolt;
3603 	mutex_exit(&ill->ill_lock);
3604 
3605 	/*
3606 	 * free ill_frag_free_num_pkts oldest packets from each bucket.
3607 	 */
3608 	if (ill->ill_frag_free_num_pkts != 0) {
3609 		int ix;
3610 
3611 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
3612 			ipfb = &ill->ill_frag_hash_tbl[ix];
3613 			mutex_enter(&ipfb->ipfb_lock);
3614 			if (ipfb->ipfb_ipf != NULL) {
3615 				ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf,
3616 				    ill->ill_frag_free_num_pkts);
3617 			}
3618 			mutex_exit(&ipfb->ipfb_lock);
3619 		}
3620 	}
3621 	/*
3622 	 * While the reassembly list for this ILL is too big, prune a fragment
3623 	 * queue by age, oldest first.  Note that the per ILL count is
3624 	 * approximate, while the per frag hash bucket counts are accurate.
3625 	 */
3626 	while (ill->ill_frag_count > max_count) {
3627 		int	ix;
3628 		ipfb_t	*oipfb = NULL;
3629 		uint_t	oldest = UINT_MAX;
3630 
3631 		count = 0;
3632 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
3633 			ipfb = &ill->ill_frag_hash_tbl[ix];
3634 			mutex_enter(&ipfb->ipfb_lock);
3635 			ipf = ipfb->ipfb_ipf;
3636 			if (ipf != NULL && ipf->ipf_gen < oldest) {
3637 				oldest = ipf->ipf_gen;
3638 				oipfb = ipfb;
3639 			}
3640 			count += ipfb->ipfb_count;
3641 			mutex_exit(&ipfb->ipfb_lock);
3642 		}
3643 		/* Refresh the per ILL count */
3644 		ill->ill_frag_count = count;
3645 		if (oipfb == NULL) {
3646 			ill->ill_frag_count = 0;
3647 			break;
3648 		}
3649 		if (count <= max_count)
3650 			return;	/* Somebody beat us to it, nothing to do */
3651 		mutex_enter(&oipfb->ipfb_lock);
3652 		ipf = oipfb->ipfb_ipf;
3653 		if (ipf != NULL) {
3654 			ill_frag_free_pkts(ill, oipfb, ipf, 1);
3655 		}
3656 		mutex_exit(&oipfb->ipfb_lock);
3657 	}
3658 }
3659 
3660 /*
3661  * free 'free_cnt' fragmented packets starting at ipf.
3662  */
3663 void
3664 ill_frag_free_pkts(ill_t *ill, ipfb_t *ipfb, ipf_t *ipf, int free_cnt)
3665 {
3666 	size_t	count;
3667 	mblk_t	*mp;
3668 	mblk_t	*tmp;
3669 	ipf_t **ipfp = ipf->ipf_ptphn;
3670 
3671 	ASSERT(MUTEX_HELD(&ipfb->ipfb_lock));
3672 	ASSERT(ipfp != NULL);
3673 	ASSERT(ipf != NULL);
3674 
3675 	while (ipf != NULL && free_cnt-- > 0) {
3676 		count = ipf->ipf_count;
3677 		mp = ipf->ipf_mp;
3678 		ipf = ipf->ipf_hash_next;
3679 		for (tmp = mp; tmp; tmp = tmp->b_cont) {
3680 			IP_REASS_SET_START(tmp, 0);
3681 			IP_REASS_SET_END(tmp, 0);
3682 		}
3683 		ill->ill_frag_count -= count;
3684 		ASSERT(ipfb->ipfb_count >= count);
3685 		ipfb->ipfb_count -= count;
3686 		ASSERT(ipfb->ipfb_frag_pkts > 0);
3687 		ipfb->ipfb_frag_pkts--;
3688 		freemsg(mp);
3689 		BUMP_MIB(&ip_mib, ipReasmFails);
3690 	}
3691 
3692 	if (ipf)
3693 		ipf->ipf_ptphn = ipfp;
3694 	ipfp[0] = ipf;
3695 }
3696 
3697 #define	ND_FORWARD_WARNING	"The <if>:ip*_forwarding ndd variables are " \
3698 	"obsolete and may be removed in a future release of Solaris.  Use " \
3699 	"ifconfig(1M) to manipulate the forwarding status of an interface."
3700 
3701 /*
3702  * For obsolete per-interface forwarding configuration;
3703  * called in response to ND_GET.
3704  */
3705 /* ARGSUSED */
3706 static int
3707 nd_ill_forward_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *ioc_cr)
3708 {
3709 	ill_t *ill = (ill_t *)cp;
3710 
3711 	cmn_err(CE_WARN, ND_FORWARD_WARNING);
3712 
3713 	(void) mi_mpprintf(mp, "%d", (ill->ill_flags & ILLF_ROUTER) != 0);
3714 	return (0);
3715 }
3716 
3717 /*
3718  * For obsolete per-interface forwarding configuration;
3719  * called in response to ND_SET.
3720  */
3721 /* ARGSUSED */
3722 static int
3723 nd_ill_forward_set(queue_t *q, mblk_t *mp, char *valuestr, caddr_t cp,
3724     cred_t *ioc_cr)
3725 {
3726 	long value;
3727 	int retval;
3728 
3729 	cmn_err(CE_WARN, ND_FORWARD_WARNING);
3730 
3731 	if (ddi_strtol(valuestr, NULL, 10, &value) != 0 ||
3732 	    value < 0 || value > 1) {
3733 		return (EINVAL);
3734 	}
3735 
3736 	rw_enter(&ill_g_lock, RW_READER);
3737 	retval = ill_forward_set(q, mp, (value != 0), cp);
3738 	rw_exit(&ill_g_lock);
3739 	return (retval);
3740 }
3741 
3742 /*
3743  * Set an ill's ILLF_ROUTER flag appropriately.  If the ill is part of an
3744  * IPMP group, make sure all ill's in the group adopt the new policy.  Send
3745  * up RTS_IFINFO routing socket messages for each interface whose flags we
3746  * change.
3747  */
3748 /* ARGSUSED */
3749 int
3750 ill_forward_set(queue_t *q, mblk_t *mp, boolean_t enable, caddr_t cp)
3751 {
3752 	ill_t *ill = (ill_t *)cp;
3753 	ill_group_t *illgrp;
3754 
3755 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ill_g_lock));
3756 
3757 	if ((enable && (ill->ill_flags & ILLF_ROUTER)) ||
3758 	    (!enable && !(ill->ill_flags & ILLF_ROUTER)) ||
3759 	    (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK))
3760 		return (EINVAL);
3761 
3762 	/*
3763 	 * If the ill is in an IPMP group, set the forwarding policy on all
3764 	 * members of the group to the same value.
3765 	 */
3766 	illgrp = ill->ill_group;
3767 	if (illgrp != NULL) {
3768 		ill_t *tmp_ill;
3769 
3770 		for (tmp_ill = illgrp->illgrp_ill; tmp_ill != NULL;
3771 		    tmp_ill = tmp_ill->ill_group_next) {
3772 			ip1dbg(("ill_forward_set: %s %s forwarding on %s",
3773 			    (enable ? "Enabling" : "Disabling"),
3774 			    (tmp_ill->ill_isv6 ? "IPv6" : "IPv4"),
3775 			    tmp_ill->ill_name));
3776 			mutex_enter(&tmp_ill->ill_lock);
3777 			if (enable)
3778 				tmp_ill->ill_flags |= ILLF_ROUTER;
3779 			else
3780 				tmp_ill->ill_flags &= ~ILLF_ROUTER;
3781 			mutex_exit(&tmp_ill->ill_lock);
3782 			if (tmp_ill->ill_isv6)
3783 				ill_set_nce_router_flags(tmp_ill, enable);
3784 			/* Notify routing socket listeners of this change. */
3785 			ip_rts_ifmsg(tmp_ill->ill_ipif);
3786 		}
3787 	} else {
3788 		ip1dbg(("ill_forward_set: %s %s forwarding on %s",
3789 		    (enable ? "Enabling" : "Disabling"),
3790 		    (ill->ill_isv6 ? "IPv6" : "IPv4"), ill->ill_name));
3791 		mutex_enter(&ill->ill_lock);
3792 		if (enable)
3793 			ill->ill_flags |= ILLF_ROUTER;
3794 		else
3795 			ill->ill_flags &= ~ILLF_ROUTER;
3796 		mutex_exit(&ill->ill_lock);
3797 		if (ill->ill_isv6)
3798 			ill_set_nce_router_flags(ill, enable);
3799 		/* Notify routing socket listeners of this change. */
3800 		ip_rts_ifmsg(ill->ill_ipif);
3801 	}
3802 
3803 	return (0);
3804 }
3805 
3806 /*
3807  * Based on the ILLF_ROUTER flag of an ill, make sure all local nce's for
3808  * addresses assigned to the ill have the NCE_F_ISROUTER flag appropriately
3809  * set or clear.
3810  */
3811 static void
3812 ill_set_nce_router_flags(ill_t *ill, boolean_t enable)
3813 {
3814 	ipif_t *ipif;
3815 	nce_t *nce;
3816 
3817 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
3818 		nce = ndp_lookup(ill, &ipif->ipif_v6lcl_addr, B_FALSE);
3819 		if (nce != NULL) {
3820 			mutex_enter(&nce->nce_lock);
3821 			if (enable)
3822 				nce->nce_flags |= NCE_F_ISROUTER;
3823 			else
3824 				nce->nce_flags &= ~NCE_F_ISROUTER;
3825 			mutex_exit(&nce->nce_lock);
3826 			NCE_REFRELE(nce);
3827 		}
3828 	}
3829 }
3830 
3831 /*
3832  * Given an ill with a _valid_ name, add the ip_forwarding ndd variable
3833  * for this ill.  Make sure the v6/v4 question has been answered about this
3834  * ill.  The creation of this ndd variable is only for backwards compatibility.
3835  * The preferred way to control per-interface IP forwarding is through the
3836  * ILLF_ROUTER interface flag.
3837  */
3838 static int
3839 ill_set_ndd_name(ill_t *ill)
3840 {
3841 	char *suffix;
3842 
3843 	ASSERT(IAM_WRITER_ILL(ill));
3844 
3845 	if (ill->ill_isv6)
3846 		suffix = ipv6_forward_suffix;
3847 	else
3848 		suffix = ipv4_forward_suffix;
3849 
3850 	ill->ill_ndd_name = ill->ill_name + ill->ill_name_length;
3851 	bcopy(ill->ill_name, ill->ill_ndd_name, ill->ill_name_length - 1);
3852 	/*
3853 	 * Copies over the '\0'.
3854 	 * Note that strlen(suffix) is always bounded.
3855 	 */
3856 	bcopy(suffix, ill->ill_ndd_name + ill->ill_name_length - 1,
3857 	    strlen(suffix) + 1);
3858 
3859 	/*
3860 	 * Use of the nd table requires holding the reader lock.
3861 	 * Modifying the nd table thru nd_load/nd_unload requires
3862 	 * the writer lock.
3863 	 */
3864 	rw_enter(&ip_g_nd_lock, RW_WRITER);
3865 	if (!nd_load(&ip_g_nd, ill->ill_ndd_name, nd_ill_forward_get,
3866 	    nd_ill_forward_set, (caddr_t)ill)) {
3867 		/*
3868 		 * If the nd_load failed, it only meant that it could not
3869 		 * allocate a new bunch of room for further NDD expansion.
3870 		 * Because of that, the ill_ndd_name will be set to 0, and
3871 		 * this interface is at the mercy of the global ip_forwarding
3872 		 * variable.
3873 		 */
3874 		rw_exit(&ip_g_nd_lock);
3875 		ill->ill_ndd_name = NULL;
3876 		return (ENOMEM);
3877 	}
3878 	rw_exit(&ip_g_nd_lock);
3879 	return (0);
3880 }
3881 
3882 /*
3883  * Intializes the context structure and returns the first ill in the list
3884  * cuurently start_list and end_list can have values:
3885  * MAX_G_HEADS		Traverse both IPV4 and IPV6 lists.
3886  * IP_V4_G_HEAD		Traverse IPV4 list only.
3887  * IP_V6_G_HEAD		Traverse IPV6 list only.
3888  */
3889 
3890 /*
3891  * We don't check for CONDEMNED ills here. Caller must do that if
3892  * necessary under the ill lock.
3893  */
3894 ill_t *
3895 ill_first(int start_list, int end_list, ill_walk_context_t *ctx)
3896 {
3897 	ill_if_t *ifp;
3898 	ill_t *ill;
3899 	avl_tree_t *avl_tree;
3900 
3901 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
3902 	ASSERT(end_list <= MAX_G_HEADS && start_list >= 0);
3903 
3904 	/*
3905 	 * setup the lists to search
3906 	 */
3907 	if (end_list != MAX_G_HEADS) {
3908 		ctx->ctx_current_list = start_list;
3909 		ctx->ctx_last_list = end_list;
3910 	} else {
3911 		ctx->ctx_last_list = MAX_G_HEADS - 1;
3912 		ctx->ctx_current_list = 0;
3913 	}
3914 
3915 	while (ctx->ctx_current_list <= ctx->ctx_last_list) {
3916 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list);
3917 		if (ifp != (ill_if_t *)
3918 		    &IP_VX_ILL_G_LIST(ctx->ctx_current_list)) {
3919 			avl_tree = &ifp->illif_avl_by_ppa;
3920 			ill = avl_first(avl_tree);
3921 			/*
3922 			 * ill is guaranteed to be non NULL or ifp should have
3923 			 * not existed.
3924 			 */
3925 			ASSERT(ill != NULL);
3926 			return (ill);
3927 		}
3928 		ctx->ctx_current_list++;
3929 	}
3930 
3931 	return (NULL);
3932 }
3933 
3934 /*
3935  * returns the next ill in the list. ill_first() must have been called
3936  * before calling ill_next() or bad things will happen.
3937  */
3938 
3939 /*
3940  * We don't check for CONDEMNED ills here. Caller must do that if
3941  * necessary under the ill lock.
3942  */
3943 ill_t *
3944 ill_next(ill_walk_context_t *ctx, ill_t *lastill)
3945 {
3946 	ill_if_t *ifp;
3947 	ill_t *ill;
3948 
3949 
3950 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
3951 	ASSERT(lastill->ill_ifptr != (ill_if_t *)
3952 	    &IP_VX_ILL_G_LIST(ctx->ctx_current_list));
3953 	if ((ill = avl_walk(&lastill->ill_ifptr->illif_avl_by_ppa, lastill,
3954 	    AVL_AFTER)) != NULL) {
3955 		return (ill);
3956 	}
3957 
3958 	/* goto next ill_ifp in the list. */
3959 	ifp = lastill->ill_ifptr->illif_next;
3960 
3961 	/* make sure not at end of circular list */
3962 	while (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(ctx->ctx_current_list)) {
3963 		if (++ctx->ctx_current_list > ctx->ctx_last_list)
3964 			return (NULL);
3965 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list);
3966 	}
3967 
3968 	return (avl_first(&ifp->illif_avl_by_ppa));
3969 }
3970 
3971 /*
3972  * Check interface name for correct format which is name+ppa.
3973  * name can contain characters and digits, the right most digits
3974  * make up the ppa number. use of octal is not allowed, name must contain
3975  * a ppa, return pointer to the start of ppa.
3976  * In case of error return NULL.
3977  */
3978 static char *
3979 ill_get_ppa_ptr(char *name)
3980 {
3981 	int namelen = mi_strlen(name);
3982 
3983 	int len = namelen;
3984 
3985 	name += len;
3986 	while (len > 0) {
3987 		name--;
3988 		if (*name < '0' || *name > '9')
3989 			break;
3990 		len--;
3991 	}
3992 
3993 	/* empty string, all digits, or no trailing digits */
3994 	if (len == 0 || len == (int)namelen)
3995 		return (NULL);
3996 
3997 	name++;
3998 	/* check for attempted use of octal */
3999 	if (*name == '0' && len != (int)namelen - 1)
4000 		return (NULL);
4001 	return (name);
4002 }
4003 
4004 /*
4005  * use avl tree to locate the ill.
4006  */
4007 static ill_t *
4008 ill_find_by_name(char *name, boolean_t isv6, queue_t *q, mblk_t *mp,
4009     ipsq_func_t func, int *error)
4010 {
4011 	char *ppa_ptr = NULL;
4012 	int len;
4013 	uint_t ppa;
4014 	ill_t *ill = NULL;
4015 	ill_if_t *ifp;
4016 	int list;
4017 	ipsq_t *ipsq;
4018 
4019 	if (error != NULL)
4020 		*error = 0;
4021 
4022 	/*
4023 	 * get ppa ptr
4024 	 */
4025 	if (isv6)
4026 		list = IP_V6_G_HEAD;
4027 	else
4028 		list = IP_V4_G_HEAD;
4029 
4030 	if ((ppa_ptr = ill_get_ppa_ptr(name)) == NULL) {
4031 		if (error != NULL)
4032 			*error = ENXIO;
4033 		return (NULL);
4034 	}
4035 
4036 	len = ppa_ptr - name + 1;
4037 
4038 	ppa = stoi(&ppa_ptr);
4039 
4040 	ifp = IP_VX_ILL_G_LIST(list);
4041 
4042 	while (ifp != (ill_if_t *)&IP_VX_ILL_G_LIST(list)) {
4043 		/*
4044 		 * match is done on len - 1 as the name is not null
4045 		 * terminated it contains ppa in addition to the interface
4046 		 * name.
4047 		 */
4048 		if ((ifp->illif_name_len == len) &&
4049 		    bcmp(ifp->illif_name, name, len - 1) == 0) {
4050 			break;
4051 		} else {
4052 			ifp = ifp->illif_next;
4053 		}
4054 	}
4055 
4056 
4057 	if (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(list)) {
4058 		/*
4059 		 * Even the interface type does not exist.
4060 		 */
4061 		if (error != NULL)
4062 			*error = ENXIO;
4063 		return (NULL);
4064 	}
4065 
4066 	ill = avl_find(&ifp->illif_avl_by_ppa, (void *) &ppa, NULL);
4067 	if (ill != NULL) {
4068 		/*
4069 		 * The block comment at the start of ipif_down
4070 		 * explains the use of the macros used below
4071 		 */
4072 		GRAB_CONN_LOCK(q);
4073 		mutex_enter(&ill->ill_lock);
4074 		if (ILL_CAN_LOOKUP(ill)) {
4075 			ill_refhold_locked(ill);
4076 			mutex_exit(&ill->ill_lock);
4077 			RELEASE_CONN_LOCK(q);
4078 			return (ill);
4079 		} else if (ILL_CAN_WAIT(ill, q)) {
4080 			ipsq = ill->ill_phyint->phyint_ipsq;
4081 			mutex_enter(&ipsq->ipsq_lock);
4082 			mutex_exit(&ill->ill_lock);
4083 			ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
4084 			mutex_exit(&ipsq->ipsq_lock);
4085 			RELEASE_CONN_LOCK(q);
4086 			*error = EINPROGRESS;
4087 			return (NULL);
4088 		}
4089 		mutex_exit(&ill->ill_lock);
4090 		RELEASE_CONN_LOCK(q);
4091 	}
4092 	if (error != NULL)
4093 		*error = ENXIO;
4094 	return (NULL);
4095 }
4096 
4097 /*
4098  * comparison function for use with avl.
4099  */
4100 static int
4101 ill_compare_ppa(const void *ppa_ptr, const void *ill_ptr)
4102 {
4103 	uint_t ppa;
4104 	uint_t ill_ppa;
4105 
4106 	ASSERT(ppa_ptr != NULL && ill_ptr != NULL);
4107 
4108 	ppa = *((uint_t *)ppa_ptr);
4109 	ill_ppa = ((const ill_t *)ill_ptr)->ill_ppa;
4110 	/*
4111 	 * We want the ill with the lowest ppa to be on the
4112 	 * top.
4113 	 */
4114 	if (ill_ppa < ppa)
4115 		return (1);
4116 	if (ill_ppa > ppa)
4117 		return (-1);
4118 	return (0);
4119 }
4120 
4121 /*
4122  * remove an interface type from the global list.
4123  */
4124 static void
4125 ill_delete_interface_type(ill_if_t *interface)
4126 {
4127 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
4128 
4129 	ASSERT(interface != NULL);
4130 	ASSERT(avl_numnodes(&interface->illif_avl_by_ppa) == 0);
4131 
4132 	avl_destroy(&interface->illif_avl_by_ppa);
4133 	if (interface->illif_ppa_arena != NULL)
4134 		vmem_destroy(interface->illif_ppa_arena);
4135 
4136 	remque(interface);
4137 
4138 	mi_free(interface);
4139 }
4140 
4141 /*
4142  * remove ill from the global list.
4143  */
4144 static void
4145 ill_glist_delete(ill_t *ill)
4146 {
4147 	if (ill == NULL)
4148 		return;
4149 
4150 	rw_enter(&ill_g_lock, RW_WRITER);
4151 	/*
4152 	 * If the ill was never inserted into the AVL tree
4153 	 * we skip the if branch.
4154 	 */
4155 	if (ill->ill_ifptr != NULL) {
4156 		/*
4157 		 * remove from AVL tree and free ppa number
4158 		 */
4159 		avl_remove(&ill->ill_ifptr->illif_avl_by_ppa, ill);
4160 
4161 		if (ill->ill_ifptr->illif_ppa_arena != NULL) {
4162 			vmem_free(ill->ill_ifptr->illif_ppa_arena,
4163 			    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
4164 		}
4165 		if (avl_numnodes(&ill->ill_ifptr->illif_avl_by_ppa) == 0) {
4166 			ill_delete_interface_type(ill->ill_ifptr);
4167 		}
4168 
4169 		/*
4170 		 * Indicate ill is no longer in the list.
4171 		 */
4172 		ill->ill_ifptr = NULL;
4173 		ill->ill_name_length = 0;
4174 		ill->ill_name[0] = '\0';
4175 		ill->ill_ppa = UINT_MAX;
4176 	}
4177 	ill_phyint_free(ill);
4178 	rw_exit(&ill_g_lock);
4179 }
4180 
4181 /*
4182  * allocate a ppa, if the number of plumbed interfaces of this type are
4183  * less than ill_no_arena do a linear search to find a unused ppa.
4184  * When the number goes beyond ill_no_arena switch to using an arena.
4185  * Note: ppa value of zero cannot be allocated from vmem_arena as it
4186  * is the return value for an error condition, so allocation starts at one
4187  * and is decremented by one.
4188  */
4189 static int
4190 ill_alloc_ppa(ill_if_t *ifp, ill_t *ill)
4191 {
4192 	ill_t *tmp_ill;
4193 	uint_t start, end;
4194 	int ppa;
4195 
4196 	if (ifp->illif_ppa_arena == NULL &&
4197 	    (avl_numnodes(&ifp->illif_avl_by_ppa) + 1 > ill_no_arena)) {
4198 		/*
4199 		 * Create an arena.
4200 		 */
4201 		ifp->illif_ppa_arena = vmem_create(ifp->illif_name,
4202 		    (void *)1, UINT_MAX - 1, 1, NULL, NULL,
4203 		    NULL, 0, VM_SLEEP | VMC_IDENTIFIER);
4204 			/* allocate what has already been assigned */
4205 		for (tmp_ill = avl_first(&ifp->illif_avl_by_ppa);
4206 		    tmp_ill != NULL; tmp_ill = avl_walk(&ifp->illif_avl_by_ppa,
4207 		    tmp_ill, AVL_AFTER)) {
4208 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
4209 			    1,		/* size */
4210 			    1,		/* align/quantum */
4211 			    0,		/* phase */
4212 			    0,		/* nocross */
4213 		(void *)((uintptr_t)tmp_ill->ill_ppa + 1), /* minaddr */
4214 		(void *)((uintptr_t)tmp_ill->ill_ppa + 2), /* maxaddr */
4215 			    VM_NOSLEEP|VM_FIRSTFIT);
4216 			if (ppa == 0) {
4217 				ip1dbg(("ill_alloc_ppa: ppa allocation"
4218 				    " failed while switching"));
4219 				vmem_destroy(ifp->illif_ppa_arena);
4220 				ifp->illif_ppa_arena = NULL;
4221 				break;
4222 			}
4223 		}
4224 	}
4225 
4226 	if (ifp->illif_ppa_arena != NULL) {
4227 		if (ill->ill_ppa == UINT_MAX) {
4228 			ppa = (int)(uintptr_t)vmem_alloc(ifp->illif_ppa_arena,
4229 			    1, VM_NOSLEEP|VM_FIRSTFIT);
4230 			if (ppa == 0)
4231 				return (EAGAIN);
4232 			ill->ill_ppa = --ppa;
4233 		} else {
4234 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
4235 			    1, 		/* size */
4236 			    1, 		/* align/quantum */
4237 			    0, 		/* phase */
4238 			    0, 		/* nocross */
4239 			    (void *)(uintptr_t)(ill->ill_ppa + 1), /* minaddr */
4240 			    (void *)(uintptr_t)(ill->ill_ppa + 2), /* maxaddr */
4241 			    VM_NOSLEEP|VM_FIRSTFIT);
4242 			/*
4243 			 * Most likely the allocation failed because
4244 			 * the requested ppa was in use.
4245 			 */
4246 			if (ppa == 0)
4247 				return (EEXIST);
4248 		}
4249 		return (0);
4250 	}
4251 
4252 	/*
4253 	 * No arena is in use and not enough (>ill_no_arena) interfaces have
4254 	 * been plumbed to create one. Do a linear search to get a unused ppa.
4255 	 */
4256 	if (ill->ill_ppa == UINT_MAX) {
4257 		end = UINT_MAX - 1;
4258 		start = 0;
4259 	} else {
4260 		end = start = ill->ill_ppa;
4261 	}
4262 
4263 	tmp_ill = avl_find(&ifp->illif_avl_by_ppa, (void *)&start, NULL);
4264 	while (tmp_ill != NULL && tmp_ill->ill_ppa == start) {
4265 		if (start++ >= end) {
4266 			if (ill->ill_ppa == UINT_MAX)
4267 				return (EAGAIN);
4268 			else
4269 				return (EEXIST);
4270 		}
4271 		tmp_ill = avl_walk(&ifp->illif_avl_by_ppa, tmp_ill, AVL_AFTER);
4272 	}
4273 	ill->ill_ppa = start;
4274 	return (0);
4275 }
4276 
4277 /*
4278  * Insert ill into the list of configured ill's. Once this function completes,
4279  * the ill is globally visible and is available through lookups. More precisely
4280  * this happens after the caller drops the ill_g_lock.
4281  */
4282 static int
4283 ill_glist_insert(ill_t *ill, char *name, boolean_t isv6)
4284 {
4285 	ill_if_t *ill_interface;
4286 	avl_index_t where = 0;
4287 	int error;
4288 	int name_length;
4289 	int index;
4290 	boolean_t check_length = B_FALSE;
4291 
4292 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
4293 
4294 	name_length = mi_strlen(name) + 1;
4295 
4296 	if (isv6)
4297 		index = IP_V6_G_HEAD;
4298 	else
4299 		index = IP_V4_G_HEAD;
4300 
4301 	ill_interface = IP_VX_ILL_G_LIST(index);
4302 	/*
4303 	 * Search for interface type based on name
4304 	 */
4305 	while (ill_interface != (ill_if_t *)&IP_VX_ILL_G_LIST(index)) {
4306 		if ((ill_interface->illif_name_len == name_length) &&
4307 		    (strcmp(ill_interface->illif_name, name) == 0)) {
4308 			break;
4309 		}
4310 		ill_interface = ill_interface->illif_next;
4311 	}
4312 
4313 	/*
4314 	 * Interface type not found, create one.
4315 	 */
4316 	if (ill_interface == (ill_if_t *)&IP_VX_ILL_G_LIST(index)) {
4317 
4318 		ill_g_head_t ghead;
4319 
4320 		/*
4321 		 * allocate ill_if_t structure
4322 		 */
4323 
4324 		ill_interface = (ill_if_t *)mi_zalloc(sizeof (ill_if_t));
4325 		if (ill_interface == NULL) {
4326 			return (ENOMEM);
4327 		}
4328 
4329 
4330 
4331 		(void) strcpy(ill_interface->illif_name, name);
4332 		ill_interface->illif_name_len = name_length;
4333 
4334 		avl_create(&ill_interface->illif_avl_by_ppa,
4335 		    ill_compare_ppa, sizeof (ill_t),
4336 		    offsetof(struct ill_s, ill_avl_byppa));
4337 
4338 		/*
4339 		 * link the structure in the back to maintain order
4340 		 * of configuration for ifconfig output.
4341 		 */
4342 		ghead = ill_g_heads[index];
4343 		insque(ill_interface, ghead.ill_g_list_tail);
4344 
4345 	}
4346 
4347 	if (ill->ill_ppa == UINT_MAX)
4348 		check_length = B_TRUE;
4349 
4350 	error = ill_alloc_ppa(ill_interface, ill);
4351 	if (error != 0) {
4352 		if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
4353 			ill_delete_interface_type(ill->ill_ifptr);
4354 		return (error);
4355 	}
4356 
4357 	/*
4358 	 * When the ppa is choosen by the system, check that there is
4359 	 * enough space to insert ppa. if a specific ppa was passed in this
4360 	 * check is not required as the interface name passed in will have
4361 	 * the right ppa in it.
4362 	 */
4363 	if (check_length) {
4364 		/*
4365 		 * UINT_MAX - 1 should fit in 10 chars, alloc 12 chars.
4366 		 */
4367 		char buf[sizeof (uint_t) * 3];
4368 
4369 		/*
4370 		 * convert ppa to string to calculate the amount of space
4371 		 * required for it in the name.
4372 		 */
4373 		numtos(ill->ill_ppa, buf);
4374 
4375 		/* Do we have enough space to insert ppa ? */
4376 
4377 		if ((mi_strlen(name) + mi_strlen(buf) + 1) > LIFNAMSIZ) {
4378 			/* Free ppa and interface type struct */
4379 			if (ill_interface->illif_ppa_arena != NULL) {
4380 				vmem_free(ill_interface->illif_ppa_arena,
4381 				    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
4382 			}
4383 			if (avl_numnodes(&ill_interface->illif_avl_by_ppa) ==
4384 			    0) {
4385 				ill_delete_interface_type(ill->ill_ifptr);
4386 			}
4387 
4388 			return (EINVAL);
4389 		}
4390 	}
4391 
4392 	(void) sprintf(ill->ill_name, "%s%u", name, ill->ill_ppa);
4393 	ill->ill_name_length = mi_strlen(ill->ill_name) + 1;
4394 
4395 	(void) avl_find(&ill_interface->illif_avl_by_ppa, &ill->ill_ppa,
4396 	    &where);
4397 	ill->ill_ifptr = ill_interface;
4398 	avl_insert(&ill_interface->illif_avl_by_ppa, ill, where);
4399 
4400 	ill_phyint_reinit(ill);
4401 	return (0);
4402 }
4403 
4404 /* Initialize the per phyint (per IPMP group) ipsq used for serialization */
4405 static boolean_t
4406 ipsq_init(ill_t *ill)
4407 {
4408 	ipsq_t  *ipsq;
4409 
4410 	/* Init the ipsq and impicitly enter as writer */
4411 	ill->ill_phyint->phyint_ipsq =
4412 	    kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP);
4413 	if (ill->ill_phyint->phyint_ipsq == NULL)
4414 		return (B_FALSE);
4415 	ipsq = ill->ill_phyint->phyint_ipsq;
4416 	ipsq->ipsq_phyint_list = ill->ill_phyint;
4417 	ill->ill_phyint->phyint_ipsq_next = NULL;
4418 	mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, 0);
4419 	ipsq->ipsq_refs = 1;
4420 	ipsq->ipsq_writer = curthread;
4421 	ipsq->ipsq_reentry_cnt = 1;
4422 #ifdef ILL_DEBUG
4423 	ipsq->ipsq_depth = getpcstack((pc_t *)ipsq->ipsq_stack, IP_STACK_DEPTH);
4424 #endif
4425 	(void) strcpy(ipsq->ipsq_name, ill->ill_name);
4426 	return (B_TRUE);
4427 }
4428 
4429 /*
4430  * ill_init is called by ip_open when a device control stream is opened.
4431  * It does a few initializations, and shoots a DL_INFO_REQ message down
4432  * to the driver.  The response is later picked up in ip_rput_dlpi and
4433  * used to set up default mechanisms for talking to the driver.  (Always
4434  * called as writer.)
4435  *
4436  * If this function returns error, ip_open will call ip_close which in
4437  * turn will call ill_delete to clean up any memory allocated here that
4438  * is not yet freed.
4439  */
4440 int
4441 ill_init(queue_t *q, ill_t *ill)
4442 {
4443 	int	count;
4444 	dl_info_req_t	*dlir;
4445 	mblk_t	*info_mp;
4446 	uchar_t *frag_ptr;
4447 
4448 	/*
4449 	 * The ill is initialized to zero by mi_alloc*(). In addition
4450 	 * some fields already contain valid values, initialized in
4451 	 * ip_open(), before we reach here.
4452 	 */
4453 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, 0);
4454 
4455 	ill->ill_rq = q;
4456 	ill->ill_wq = WR(q);
4457 
4458 	info_mp = allocb(MAX(sizeof (dl_info_req_t), sizeof (dl_info_ack_t)),
4459 	    BPRI_HI);
4460 	if (info_mp == NULL)
4461 		return (ENOMEM);
4462 
4463 	/*
4464 	 * Allocate sufficient space to contain our fragment hash table and
4465 	 * the device name.
4466 	 */
4467 	frag_ptr = (uchar_t *)mi_zalloc(ILL_FRAG_HASH_TBL_SIZE +
4468 	    2 * LIFNAMSIZ + 5 + strlen(ipv6_forward_suffix));
4469 	if (frag_ptr == NULL) {
4470 		freemsg(info_mp);
4471 		return (ENOMEM);
4472 	}
4473 	ill->ill_frag_ptr = frag_ptr;
4474 	ill->ill_frag_free_num_pkts = 0;
4475 	ill->ill_last_frag_clean_time = 0;
4476 	ill->ill_frag_hash_tbl = (ipfb_t *)frag_ptr;
4477 	ill->ill_name = (char *)(frag_ptr + ILL_FRAG_HASH_TBL_SIZE);
4478 	for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
4479 		mutex_init(&ill->ill_frag_hash_tbl[count].ipfb_lock,
4480 		    NULL, MUTEX_DEFAULT, NULL);
4481 	}
4482 
4483 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
4484 	if (ill->ill_phyint == NULL) {
4485 		freemsg(info_mp);
4486 		mi_free(frag_ptr);
4487 		return (ENOMEM);
4488 	}
4489 
4490 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
4491 	/*
4492 	 * For now pretend this is a v4 ill. We need to set phyint_ill*
4493 	 * at this point because of the following reason. If we can't
4494 	 * enter the ipsq at some point and cv_wait, the writer that
4495 	 * wakes us up tries to locate us using the list of all phyints
4496 	 * in an ipsq and the ills from the phyint thru the phyint_ill*.
4497 	 * If we don't set it now, we risk a missed wakeup.
4498 	 */
4499 	ill->ill_phyint->phyint_illv4 = ill;
4500 	ill->ill_ppa = UINT_MAX;
4501 	ill->ill_fastpath_list = &ill->ill_fastpath_list;
4502 
4503 	if (!ipsq_init(ill)) {
4504 		freemsg(info_mp);
4505 		mi_free(frag_ptr);
4506 		mi_free(ill->ill_phyint);
4507 		return (ENOMEM);
4508 	}
4509 
4510 	ill->ill_state_flags |= ILL_LL_SUBNET_PENDING;
4511 
4512 
4513 	/* Frag queue limit stuff */
4514 	ill->ill_frag_count = 0;
4515 	ill->ill_ipf_gen = 0;
4516 
4517 	ill->ill_global_timer = INFINITY;
4518 	ill->ill_mcast_type = IGMP_V3_ROUTER;	/* == MLD_V2_ROUTER */
4519 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
4520 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
4521 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
4522 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
4523 
4524 	/*
4525 	 * Initialize IPv6 configuration variables.  The IP module is always
4526 	 * opened as an IPv4 module.  Instead tracking down the cases where
4527 	 * it switches to do ipv6, we'll just initialize the IPv6 configuration
4528 	 * here for convenience, this has no effect until the ill is set to do
4529 	 * IPv6.
4530 	 */
4531 	ill->ill_reachable_time = ND_REACHABLE_TIME;
4532 	ill->ill_reachable_retrans_time = ND_RETRANS_TIMER;
4533 	ill->ill_xmit_count = ND_MAX_MULTICAST_SOLICIT;
4534 	ill->ill_max_buf = ND_MAX_Q;
4535 	ill->ill_refcnt = 0;
4536 
4537 	/* Send down the Info Request to the driver. */
4538 	info_mp->b_datap->db_type = M_PCPROTO;
4539 	dlir = (dl_info_req_t *)info_mp->b_rptr;
4540 	info_mp->b_wptr = (uchar_t *)&dlir[1];
4541 	dlir->dl_primitive = DL_INFO_REQ;
4542 
4543 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
4544 
4545 	qprocson(q);
4546 	ill_dlpi_send(ill, info_mp);
4547 
4548 	return (0);
4549 }
4550 
4551 /*
4552  * ill_dls_info
4553  * creates datalink socket info from the device.
4554  */
4555 int
4556 ill_dls_info(struct sockaddr_dl *sdl, ipif_t *ipif)
4557 {
4558 	size_t	length;
4559 	ill_t	*ill = ipif->ipif_ill;
4560 
4561 	sdl->sdl_family = AF_LINK;
4562 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
4563 	sdl->sdl_type = ipif->ipif_type;
4564 	(void) ipif_get_name(ipif, sdl->sdl_data, sizeof (sdl->sdl_data));
4565 	length = mi_strlen(sdl->sdl_data);
4566 	ASSERT(length < 256);
4567 	sdl->sdl_nlen = (uchar_t)length;
4568 	sdl->sdl_alen = ill->ill_phys_addr_length;
4569 	mutex_enter(&ill->ill_lock);
4570 	if (ill->ill_phys_addr_length != 0 && ill->ill_phys_addr != NULL) {
4571 		bcopy(ill->ill_phys_addr, &sdl->sdl_data[length],
4572 		    ill->ill_phys_addr_length);
4573 	}
4574 	mutex_exit(&ill->ill_lock);
4575 	sdl->sdl_slen = 0;
4576 	return (sizeof (struct sockaddr_dl));
4577 }
4578 
4579 /*
4580  * ill_xarp_info
4581  * creates xarp info from the device.
4582  */
4583 static int
4584 ill_xarp_info(struct sockaddr_dl *sdl, ill_t *ill)
4585 {
4586 	sdl->sdl_family = AF_LINK;
4587 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
4588 	sdl->sdl_type = ill->ill_type;
4589 	(void) ipif_get_name(ill->ill_ipif, sdl->sdl_data,
4590 	    sizeof (sdl->sdl_data));
4591 	sdl->sdl_nlen = (uchar_t)mi_strlen(sdl->sdl_data);
4592 	sdl->sdl_alen = ill->ill_phys_addr_length;
4593 	sdl->sdl_slen = 0;
4594 	return (sdl->sdl_nlen);
4595 }
4596 
4597 static int
4598 loopback_kstat_update(kstat_t *ksp, int rw)
4599 {
4600 	kstat_named_t *kn = KSTAT_NAMED_PTR(ksp);
4601 
4602 	if (rw == KSTAT_WRITE)
4603 		return (EACCES);
4604 	kn[0].value.ui32 = loopback_packets;
4605 	kn[1].value.ui32 = loopback_packets;
4606 	return (0);
4607 }
4608 
4609 
4610 /*
4611  * Has ifindex been plumbed already.
4612  */
4613 static boolean_t
4614 phyint_exists(uint_t index)
4615 {
4616 	phyint_t *phyi;
4617 
4618 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
4619 	/*
4620 	 * Indexes are stored in the phyint - a common structure
4621 	 * to both IPv4 and IPv6.
4622 	 */
4623 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_index,
4624 	    (void *) &index, NULL);
4625 	return (phyi != NULL);
4626 }
4627 
4628 /*
4629  * Assign a unique interface index for the phyint.
4630  */
4631 static boolean_t
4632 phyint_assign_ifindex(phyint_t *phyi)
4633 {
4634 	uint_t starting_index;
4635 
4636 	ASSERT(phyi->phyint_ifindex == 0);
4637 	if (!ill_index_wrap) {
4638 		phyi->phyint_ifindex = ill_index++;
4639 		if (ill_index == 0) {
4640 			/* Reached the uint_t limit Next time wrap  */
4641 			ill_index_wrap = B_TRUE;
4642 		}
4643 		return (B_TRUE);
4644 	}
4645 
4646 	/*
4647 	 * Start reusing unused indexes. Note that we hold the ill_g_lock
4648 	 * at this point and don't want to call any function that attempts
4649 	 * to get the lock again.
4650 	 */
4651 	starting_index = ill_index++;
4652 	for (; ill_index != starting_index; ill_index++) {
4653 		if (ill_index != 0 && !phyint_exists(ill_index)) {
4654 			/* found unused index - use it */
4655 			phyi->phyint_ifindex = ill_index;
4656 			return (B_TRUE);
4657 		}
4658 	}
4659 
4660 	/*
4661 	 * all interface indicies are inuse.
4662 	 */
4663 	return (B_FALSE);
4664 }
4665 
4666 /*
4667  * Return a pointer to the ill which matches the supplied name.  Note that
4668  * the ill name length includes the null termination character.  (May be
4669  * called as writer.)
4670  * If do_alloc and the interface is "lo0" it will be automatically created.
4671  * Cannot bump up reference on condemned ills. So dup detect can't be done
4672  * using this func.
4673  */
4674 ill_t *
4675 ill_lookup_on_name(char *name, boolean_t do_alloc, boolean_t isv6,
4676     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, boolean_t *did_alloc)
4677 {
4678 	ill_t	*ill;
4679 	ipif_t	*ipif;
4680 	kstat_named_t	*kn;
4681 	boolean_t isloopback;
4682 	ipsq_t *old_ipsq;
4683 
4684 	isloopback = mi_strcmp(name, ipif_loopback_name) == 0;
4685 
4686 	rw_enter(&ill_g_lock, RW_READER);
4687 	ill = ill_find_by_name(name, isv6, q, mp, func, error);
4688 	rw_exit(&ill_g_lock);
4689 	if (ill != NULL || (error != NULL && *error == EINPROGRESS))
4690 		return (ill);
4691 
4692 	/*
4693 	 * Couldn't find it.  Does this happen to be a lookup for the
4694 	 * loopback device and are we allowed to allocate it?
4695 	 */
4696 	if (!isloopback || !do_alloc)
4697 		return (NULL);
4698 
4699 	rw_enter(&ill_g_lock, RW_WRITER);
4700 
4701 	ill = ill_find_by_name(name, isv6, q, mp, func, error);
4702 	if (ill != NULL || (error != NULL && *error == EINPROGRESS)) {
4703 		rw_exit(&ill_g_lock);
4704 		return (ill);
4705 	}
4706 
4707 	/* Create the loopback device on demand */
4708 	ill = (ill_t *)(mi_alloc(sizeof (ill_t) +
4709 	    sizeof (ipif_loopback_name), BPRI_MED));
4710 	if (ill == NULL)
4711 		goto done;
4712 
4713 	*ill = ill_null;
4714 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, NULL);
4715 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
4716 	if (ill->ill_phyint == NULL)
4717 		goto done;
4718 
4719 	if (isv6)
4720 		ill->ill_phyint->phyint_illv6 = ill;
4721 	else
4722 		ill->ill_phyint->phyint_illv4 = ill;
4723 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
4724 	ill->ill_max_frag = IP_LOOPBACK_MTU;
4725 	/* Add room for tcp+ip headers */
4726 	if (isv6) {
4727 		ill->ill_isv6 = B_TRUE;
4728 		ill->ill_max_frag += IPV6_HDR_LEN + 20;	/* for TCP */
4729 		if (!ill_allocate_mibs(ill))
4730 			goto done;
4731 	} else {
4732 		ill->ill_max_frag += IP_SIMPLE_HDR_LENGTH + 20;
4733 	}
4734 	ill->ill_max_mtu = ill->ill_max_frag;
4735 	/*
4736 	 * ipif_loopback_name can't be pointed at directly because its used
4737 	 * by both the ipv4 and ipv6 interfaces.  When the ill is removed
4738 	 * from the glist, ill_glist_delete() sets the first character of
4739 	 * ill_name to '\0'.
4740 	 */
4741 	ill->ill_name = (char *)ill + sizeof (*ill);
4742 	(void) strcpy(ill->ill_name, ipif_loopback_name);
4743 	ill->ill_name_length = sizeof (ipif_loopback_name);
4744 	/* Set ill_name_set for ill_phyint_reinit to work properly */
4745 
4746 	ill->ill_global_timer = INFINITY;
4747 	ill->ill_mcast_type = IGMP_V3_ROUTER;	/* == MLD_V2_ROUTER */
4748 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
4749 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
4750 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
4751 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
4752 
4753 	/* No resolver here. */
4754 	ill->ill_net_type = IRE_LOOPBACK;
4755 
4756 	/* Initialize the ipsq */
4757 	if (!ipsq_init(ill))
4758 		goto done;
4759 
4760 	ill->ill_phyint->phyint_ipsq->ipsq_writer = NULL;
4761 	ill->ill_phyint->phyint_ipsq->ipsq_reentry_cnt--;
4762 	ASSERT(ill->ill_phyint->phyint_ipsq->ipsq_reentry_cnt == 0);
4763 #ifdef ILL_DEBUG
4764 	ill->ill_phyint->phyint_ipsq->ipsq_depth = 0;
4765 #endif
4766 	ipif = ipif_allocate(ill, 0L, IRE_LOOPBACK, B_TRUE);
4767 	if (ipif == NULL)
4768 		goto done;
4769 
4770 	ill->ill_flags = ILLF_MULTICAST;
4771 
4772 	/* Set up default loopback address and mask. */
4773 	if (!isv6) {
4774 		ipaddr_t inaddr_loopback = htonl(INADDR_LOOPBACK);
4775 
4776 		IN6_IPADDR_TO_V4MAPPED(inaddr_loopback, &ipif->ipif_v6lcl_addr);
4777 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
4778 		V4MASK_TO_V6(htonl(IN_CLASSA_NET), ipif->ipif_v6net_mask);
4779 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
4780 		    ipif->ipif_v6subnet);
4781 		ill->ill_flags |= ILLF_IPV4;
4782 	} else {
4783 		ipif->ipif_v6lcl_addr = ipv6_loopback;
4784 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
4785 		ipif->ipif_v6net_mask = ipv6_all_ones;
4786 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
4787 		    ipif->ipif_v6subnet);
4788 		ill->ill_flags |= ILLF_IPV6;
4789 	}
4790 
4791 	/*
4792 	 * Chain us in at the end of the ill list. hold the ill
4793 	 * before we make it globally visible. 1 for the lookup.
4794 	 */
4795 	ill->ill_refcnt = 0;
4796 	ill_refhold(ill);
4797 
4798 	ill->ill_frag_count = 0;
4799 	ill->ill_frag_free_num_pkts = 0;
4800 	ill->ill_last_frag_clean_time = 0;
4801 
4802 	old_ipsq = ill->ill_phyint->phyint_ipsq;
4803 
4804 	if (ill_glist_insert(ill, "lo", isv6) != 0)
4805 		cmn_err(CE_PANIC, "cannot insert loopback interface");
4806 
4807 	/* Let SCTP know so that it can add this to its list */
4808 	sctp_update_ill(ill, SCTP_ILL_INSERT);
4809 
4810 	/* Let SCTP know about this IPIF, so that it can add it to its list */
4811 	sctp_update_ipif(ipif, SCTP_IPIF_INSERT);
4812 
4813 	/*
4814 	 * If the ipsq was changed in ill_phyint_reinit free the old ipsq.
4815 	 */
4816 	if (old_ipsq != ill->ill_phyint->phyint_ipsq) {
4817 		/* Loopback ills aren't in any IPMP group */
4818 		ASSERT(!(old_ipsq->ipsq_flags & IPSQ_GROUP));
4819 		ipsq_delete(old_ipsq);
4820 	}
4821 
4822 	/*
4823 	 * Delay this till the ipif is allocated as ipif_allocate
4824 	 * de-references ill_phyint for getting the ifindex. We
4825 	 * can't do this before ipif_allocate because ill_phyint_reinit
4826 	 * -> phyint_assign_ifindex expects ipif to be present.
4827 	 */
4828 	mutex_enter(&ill->ill_phyint->phyint_lock);
4829 	ill->ill_phyint->phyint_flags |= PHYI_LOOPBACK | PHYI_VIRTUAL;
4830 	mutex_exit(&ill->ill_phyint->phyint_lock);
4831 
4832 	if (loopback_ksp == NULL) {
4833 		/* Export loopback interface statistics */
4834 		loopback_ksp = kstat_create("lo", 0, ipif_loopback_name, "net",
4835 		    KSTAT_TYPE_NAMED, 2, 0);
4836 		if (loopback_ksp != NULL) {
4837 			loopback_ksp->ks_update = loopback_kstat_update;
4838 			kn = KSTAT_NAMED_PTR(loopback_ksp);
4839 			kstat_named_init(&kn[0], "ipackets", KSTAT_DATA_UINT32);
4840 			kstat_named_init(&kn[1], "opackets", KSTAT_DATA_UINT32);
4841 			kstat_install(loopback_ksp);
4842 		}
4843 	}
4844 
4845 	if (error != NULL)
4846 		*error = 0;
4847 	*did_alloc = B_TRUE;
4848 	rw_exit(&ill_g_lock);
4849 	return (ill);
4850 done:
4851 	if (ill != NULL) {
4852 		if (ill->ill_phyint != NULL) {
4853 			ipsq_t	*ipsq;
4854 
4855 			ipsq = ill->ill_phyint->phyint_ipsq;
4856 			if (ipsq != NULL)
4857 				kmem_free(ipsq, sizeof (ipsq_t));
4858 			mi_free(ill->ill_phyint);
4859 		}
4860 		ill_free_mib(ill);
4861 		mi_free(ill);
4862 	}
4863 	rw_exit(&ill_g_lock);
4864 	if (error != NULL)
4865 		*error = ENOMEM;
4866 	return (NULL);
4867 }
4868 
4869 /*
4870  * Return a pointer to the ill which matches the index and IP version type.
4871  */
4872 ill_t *
4873 ill_lookup_on_ifindex(uint_t index, boolean_t isv6, queue_t *q, mblk_t *mp,
4874     ipsq_func_t func, int *err)
4875 {
4876 	ill_t	*ill;
4877 	ipsq_t  *ipsq;
4878 	phyint_t *phyi;
4879 
4880 	ASSERT((q == NULL && mp == NULL && func == NULL && err == NULL) ||
4881 	    (q != NULL && mp != NULL && func != NULL && err != NULL));
4882 
4883 	if (err != NULL)
4884 		*err = 0;
4885 
4886 	/*
4887 	 * Indexes are stored in the phyint - a common structure
4888 	 * to both IPv4 and IPv6.
4889 	 */
4890 	rw_enter(&ill_g_lock, RW_READER);
4891 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_index,
4892 	    (void *) &index, NULL);
4893 	if (phyi != NULL) {
4894 		ill = isv6 ? phyi->phyint_illv6: phyi->phyint_illv4;
4895 		if (ill != NULL) {
4896 			/*
4897 			 * The block comment at the start of ipif_down
4898 			 * explains the use of the macros used below
4899 			 */
4900 			GRAB_CONN_LOCK(q);
4901 			mutex_enter(&ill->ill_lock);
4902 			if (ILL_CAN_LOOKUP(ill)) {
4903 				ill_refhold_locked(ill);
4904 				mutex_exit(&ill->ill_lock);
4905 				RELEASE_CONN_LOCK(q);
4906 				rw_exit(&ill_g_lock);
4907 				return (ill);
4908 			} else if (ILL_CAN_WAIT(ill, q)) {
4909 				ipsq = ill->ill_phyint->phyint_ipsq;
4910 				mutex_enter(&ipsq->ipsq_lock);
4911 				rw_exit(&ill_g_lock);
4912 				mutex_exit(&ill->ill_lock);
4913 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
4914 				mutex_exit(&ipsq->ipsq_lock);
4915 				RELEASE_CONN_LOCK(q);
4916 				*err = EINPROGRESS;
4917 				return (NULL);
4918 			}
4919 			RELEASE_CONN_LOCK(q);
4920 			mutex_exit(&ill->ill_lock);
4921 		}
4922 	}
4923 	rw_exit(&ill_g_lock);
4924 	if (err != NULL)
4925 		*err = ENXIO;
4926 	return (NULL);
4927 }
4928 
4929 /*
4930  * Obtain a reference to the ill. The ill_refcnt is a dynamic refcnt
4931  * that gives a running thread a reference to the ill. This reference must be
4932  * released by the thread when it is done accessing the ill and related
4933  * objects. ill_refcnt can not be used to account for static references
4934  * such as other structures pointing to an ill. Callers must generally
4935  * check whether an ill can be refheld by using ILL_CAN_LOOKUP macros
4936  * or be sure that the ill is not being deleted or changing state before
4937  * calling the refhold functions. A non-zero ill_refcnt ensures that the
4938  * ill won't change any of its critical state such as address, netmask etc.
4939  */
4940 void
4941 ill_refhold(ill_t *ill)
4942 {
4943 	mutex_enter(&ill->ill_lock);
4944 	ill->ill_refcnt++;
4945 	ILL_TRACE_REF(ill);
4946 	mutex_exit(&ill->ill_lock);
4947 }
4948 
4949 void
4950 ill_refhold_locked(ill_t *ill)
4951 {
4952 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4953 	ill->ill_refcnt++;
4954 	ILL_TRACE_REF(ill);
4955 }
4956 
4957 int
4958 ill_check_and_refhold(ill_t *ill)
4959 {
4960 	mutex_enter(&ill->ill_lock);
4961 	if (ILL_CAN_LOOKUP(ill)) {
4962 		ill_refhold_locked(ill);
4963 		mutex_exit(&ill->ill_lock);
4964 		return (0);
4965 	}
4966 	mutex_exit(&ill->ill_lock);
4967 	return (ILL_LOOKUP_FAILED);
4968 }
4969 
4970 /*
4971  * Must not be called while holding any locks. Otherwise if this is
4972  * the last reference to be released, there is a chance of recursive mutex
4973  * panic due to ill_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
4974  * to restart an ioctl.
4975  */
4976 void
4977 ill_refrele(ill_t *ill)
4978 {
4979 	mutex_enter(&ill->ill_lock);
4980 	ASSERT(ill->ill_refcnt != 0);
4981 	ill->ill_refcnt--;
4982 	ILL_UNTRACE_REF(ill);
4983 	if (ill->ill_refcnt != 0) {
4984 		/* Every ire pointing to the ill adds 1 to ill_refcnt */
4985 		mutex_exit(&ill->ill_lock);
4986 		return;
4987 	}
4988 
4989 	/* Drops the ill_lock */
4990 	ipif_ill_refrele_tail(ill);
4991 }
4992 
4993 /*
4994  * Obtain a weak reference count on the ill. This reference ensures the
4995  * ill won't be freed, but the ill may change any of its critical state
4996  * such as netmask, address etc. Returns an error if the ill has started
4997  * closing.
4998  */
4999 boolean_t
5000 ill_waiter_inc(ill_t *ill)
5001 {
5002 	mutex_enter(&ill->ill_lock);
5003 	if (ill->ill_state_flags & ILL_CONDEMNED) {
5004 		mutex_exit(&ill->ill_lock);
5005 		return (B_FALSE);
5006 	}
5007 	ill->ill_waiters++;
5008 	mutex_exit(&ill->ill_lock);
5009 	return (B_TRUE);
5010 }
5011 
5012 void
5013 ill_waiter_dcr(ill_t *ill)
5014 {
5015 	mutex_enter(&ill->ill_lock);
5016 	ill->ill_waiters--;
5017 	if (ill->ill_waiters == 0)
5018 		cv_broadcast(&ill->ill_cv);
5019 	mutex_exit(&ill->ill_lock);
5020 }
5021 
5022 /*
5023  * Named Dispatch routine to produce a formatted report on all ILLs.
5024  * This report is accessed by using the ndd utility to "get" ND variable
5025  * "ip_ill_status".
5026  */
5027 /* ARGSUSED */
5028 int
5029 ip_ill_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
5030 {
5031 	ill_t		*ill;
5032 	ill_walk_context_t ctx;
5033 
5034 	(void) mi_mpprintf(mp,
5035 	    "ILL      " MI_COL_HDRPAD_STR
5036 	/*   01234567[89ABCDEF] */
5037 	    "rq       " MI_COL_HDRPAD_STR
5038 	/*   01234567[89ABCDEF] */
5039 	    "wq       " MI_COL_HDRPAD_STR
5040 	/*   01234567[89ABCDEF] */
5041 	    "upcnt mxfrg err name");
5042 	/*   12345 12345 123 xxxxxxxx  */
5043 
5044 	rw_enter(&ill_g_lock, RW_READER);
5045 	ill = ILL_START_WALK_ALL(&ctx);
5046 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5047 		(void) mi_mpprintf(mp,
5048 		    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR
5049 		    "%05u %05u %03d %s",
5050 		    (void *)ill, (void *)ill->ill_rq, (void *)ill->ill_wq,
5051 		    ill->ill_ipif_up_count,
5052 		    ill->ill_max_frag, ill->ill_error, ill->ill_name);
5053 	}
5054 	rw_exit(&ill_g_lock);
5055 
5056 	return (0);
5057 }
5058 
5059 /*
5060  * Named Dispatch routine to produce a formatted report on all IPIFs.
5061  * This report is accessed by using the ndd utility to "get" ND variable
5062  * "ip_ipif_status".
5063  */
5064 /* ARGSUSED */
5065 int
5066 ip_ipif_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
5067 {
5068 	char	buf1[INET6_ADDRSTRLEN];
5069 	char	buf2[INET6_ADDRSTRLEN];
5070 	char	buf3[INET6_ADDRSTRLEN];
5071 	char	buf4[INET6_ADDRSTRLEN];
5072 	char	buf5[INET6_ADDRSTRLEN];
5073 	char	buf6[INET6_ADDRSTRLEN];
5074 	char	buf[LIFNAMSIZ];
5075 	ill_t	*ill;
5076 	ipif_t	*ipif;
5077 	nv_t	*nvp;
5078 	uint64_t flags;
5079 	zoneid_t zoneid;
5080 	ill_walk_context_t ctx;
5081 
5082 	(void) mi_mpprintf(mp,
5083 	    "IPIF metric mtu in/out/forward name zone flags...\n"
5084 	    "\tlocal address\n"
5085 	    "\tsrc address\n"
5086 	    "\tsubnet\n"
5087 	    "\tmask\n"
5088 	    "\tbroadcast\n"
5089 	    "\tp-p-dst");
5090 
5091 	ASSERT(q->q_next == NULL);
5092 	zoneid = Q_TO_CONN(q)->conn_zoneid;	/* IP is a driver */
5093 
5094 	rw_enter(&ill_g_lock, RW_READER);
5095 	ill = ILL_START_WALK_ALL(&ctx);
5096 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5097 		for (ipif = ill->ill_ipif; ipif; ipif = ipif->ipif_next) {
5098 			if (zoneid != GLOBAL_ZONEID &&
5099 			    zoneid != ipif->ipif_zoneid)
5100 				continue;
5101 			(void) mi_mpprintf(mp,
5102 			    MI_COL_PTRFMT_STR
5103 			    "%04u %05u %u/%u/%u %s %d",
5104 			    (void *)ipif,
5105 			    ipif->ipif_metric, ipif->ipif_mtu,
5106 			    ipif->ipif_ib_pkt_count,
5107 			    ipif->ipif_ob_pkt_count,
5108 			    ipif->ipif_fo_pkt_count,
5109 			    ipif_get_name(ipif, buf, sizeof (buf)),
5110 			    ipif->ipif_zoneid);
5111 
5112 		flags = ipif->ipif_flags | ipif->ipif_ill->ill_flags |
5113 		    ipif->ipif_ill->ill_phyint->phyint_flags;
5114 
5115 		/* Tack on text strings for any flags. */
5116 		nvp = ipif_nv_tbl;
5117 		for (; nvp < A_END(ipif_nv_tbl); nvp++) {
5118 			if (nvp->nv_value & flags)
5119 				(void) mi_mpprintf_nr(mp, " %s",
5120 				    nvp->nv_name);
5121 		}
5122 		(void) mi_mpprintf(mp,
5123 		    "\t%s\n\t%s\n\t%s\n\t%s\n\t%s\n\t%s",
5124 		    inet_ntop(AF_INET6,
5125 			&ipif->ipif_v6lcl_addr, buf1, sizeof (buf1)),
5126 		    inet_ntop(AF_INET6,
5127 			&ipif->ipif_v6src_addr, buf2, sizeof (buf2)),
5128 		    inet_ntop(AF_INET6,
5129 			&ipif->ipif_v6subnet, buf3, sizeof (buf3)),
5130 		    inet_ntop(AF_INET6,
5131 			&ipif->ipif_v6net_mask, buf4, sizeof (buf4)),
5132 		    inet_ntop(AF_INET6,
5133 			&ipif->ipif_v6brd_addr, buf5, sizeof (buf5)),
5134 		    inet_ntop(AF_INET6,
5135 			&ipif->ipif_v6pp_dst_addr,
5136 			buf6, sizeof (buf6)));
5137 		}
5138 	}
5139 	rw_exit(&ill_g_lock);
5140 	return (0);
5141 }
5142 
5143 /*
5144  * ip_ll_subnet_defaults is called when we get the DL_INFO_ACK back from the
5145  * driver.  We construct best guess defaults for lower level information that
5146  * we need.  If an interface is brought up without injection of any overriding
5147  * information from outside, we have to be ready to go with these defaults.
5148  * When we get the first DL_INFO_ACK (from ip_open() sending a DL_INFO_REQ)
5149  * we primarely want the dl_provider_style.
5150  * The subsequent DL_INFO_ACK is received after doing a DL_ATTACH and DL_BIND
5151  * at which point we assume the other part of the information is valid.
5152  */
5153 void
5154 ip_ll_subnet_defaults(ill_t *ill, mblk_t *mp)
5155 {
5156 	uchar_t		*brdcst_addr;
5157 	uint_t		brdcst_addr_length, phys_addr_length;
5158 	t_scalar_t	sap_length;
5159 	dl_info_ack_t	*dlia;
5160 	ip_m_t		*ipm;
5161 	dl_qos_cl_sel1_t *sel1;
5162 
5163 	ASSERT(IAM_WRITER_ILL(ill));
5164 
5165 	/*
5166 	 * Till the ill is fully up ILL_CHANGING will be set and
5167 	 * the ill is not globally visible. So no need for a lock.
5168 	 */
5169 	dlia = (dl_info_ack_t *)mp->b_rptr;
5170 	ill->ill_mactype = dlia->dl_mac_type;
5171 
5172 	ipm = ip_m_lookup(dlia->dl_mac_type);
5173 	if (ipm == NULL) {
5174 		ipm = ip_m_lookup(DL_OTHER);
5175 		ASSERT(ipm != NULL);
5176 	}
5177 	ill->ill_media = ipm;
5178 
5179 	/*
5180 	 * When the new DLPI stuff is ready we'll pull lengths
5181 	 * from dlia.
5182 	 */
5183 	if (dlia->dl_version == DL_VERSION_2) {
5184 		brdcst_addr_length = dlia->dl_brdcst_addr_length;
5185 		brdcst_addr = mi_offset_param(mp, dlia->dl_brdcst_addr_offset,
5186 		    brdcst_addr_length);
5187 		if (brdcst_addr == NULL) {
5188 			brdcst_addr_length = 0;
5189 		}
5190 		sap_length = dlia->dl_sap_length;
5191 		phys_addr_length = dlia->dl_addr_length - ABS(sap_length);
5192 		ip1dbg(("ip: bcast_len %d, sap_len %d, phys_len %d\n",
5193 		    brdcst_addr_length, sap_length, phys_addr_length));
5194 	} else {
5195 		brdcst_addr_length = 6;
5196 		brdcst_addr = ip_six_byte_all_ones;
5197 		sap_length = -2;
5198 		phys_addr_length = brdcst_addr_length;
5199 	}
5200 
5201 	ill->ill_bcast_addr_length = brdcst_addr_length;
5202 	ill->ill_phys_addr_length = phys_addr_length;
5203 	ill->ill_sap_length = sap_length;
5204 	ill->ill_max_frag = dlia->dl_max_sdu;
5205 	ill->ill_max_mtu = ill->ill_max_frag;
5206 
5207 	ill->ill_type = ipm->ip_m_type;
5208 
5209 	if (!ill->ill_dlpi_style_set) {
5210 		if (dlia->dl_provider_style == DL_STYLE2)
5211 			ill->ill_needs_attach = 1;
5212 
5213 		/*
5214 		 * Allocate the first ipif on this ill. We don't delay it
5215 		 * further as ioctl handling assumes atleast one ipif to
5216 		 * be present.
5217 		 *
5218 		 * At this point we don't know whether the ill is v4 or v6.
5219 		 * We will know this whan the SIOCSLIFNAME happens and
5220 		 * the correct value for ill_isv6 will be assigned in
5221 		 * ipif_set_values(). We need to hold the ill lock and
5222 		 * clear the ILL_LL_SUBNET_PENDING flag and atomically do
5223 		 * the wakeup.
5224 		 */
5225 		(void) ipif_allocate(ill, 0, IRE_LOCAL,
5226 		    dlia->dl_provider_style == DL_STYLE2 ? B_FALSE : B_TRUE);
5227 		mutex_enter(&ill->ill_lock);
5228 		ASSERT(ill->ill_dlpi_style_set == 0);
5229 		ill->ill_dlpi_style_set = 1;
5230 		ill->ill_state_flags &= ~ILL_LL_SUBNET_PENDING;
5231 		cv_broadcast(&ill->ill_cv);
5232 		mutex_exit(&ill->ill_lock);
5233 		freemsg(mp);
5234 		return;
5235 	}
5236 	ASSERT(ill->ill_ipif != NULL);
5237 	/*
5238 	 * We know whether it is IPv4 or IPv6 now, as this is the
5239 	 * second DL_INFO_ACK we are recieving in response to the
5240 	 * DL_INFO_REQ sent in ipif_set_values.
5241 	 */
5242 	if (ill->ill_isv6)
5243 		ill->ill_sap = IP6_DL_SAP;
5244 	else
5245 		ill->ill_sap = IP_DL_SAP;
5246 	/*
5247 	 * Set ipif_mtu which is used to set the IRE's
5248 	 * ire_max_frag value. The driver could have sent
5249 	 * a different mtu from what it sent last time. No
5250 	 * need to call ipif_mtu_change because IREs have
5251 	 * not yet been created.
5252 	 */
5253 	ill->ill_ipif->ipif_mtu = ill->ill_max_mtu;
5254 	/*
5255 	 * Clear all the flags that were set based on ill_bcast_addr_length
5256 	 * and ill_phys_addr_length (in ipif_set_values) as these could have
5257 	 * changed now and we need to re-evaluate.
5258 	 */
5259 	ill->ill_flags &= ~(ILLF_MULTICAST | ILLF_NONUD | ILLF_NOARP);
5260 	ill->ill_ipif->ipif_flags &= ~(IPIF_BROADCAST | IPIF_POINTOPOINT);
5261 
5262 	/*
5263 	 * Free ill_resolver_mp and ill_bcast_mp as things could have
5264 	 * changed now.
5265 	 */
5266 	if (ill->ill_bcast_addr_length == 0) {
5267 		if (ill->ill_resolver_mp != NULL)
5268 			freemsg(ill->ill_resolver_mp);
5269 		if (ill->ill_bcast_mp != NULL)
5270 			freemsg(ill->ill_bcast_mp);
5271 		if (ill->ill_flags & ILLF_XRESOLV)
5272 			ill->ill_net_type = IRE_IF_RESOLVER;
5273 		else
5274 			ill->ill_net_type = IRE_IF_NORESOLVER;
5275 		ill->ill_resolver_mp = ill_dlur_gen(NULL,
5276 		    ill->ill_phys_addr_length,
5277 		    ill->ill_sap,
5278 		    ill->ill_sap_length);
5279 		ill->ill_bcast_mp = copymsg(ill->ill_resolver_mp);
5280 
5281 		if (ill->ill_isv6)
5282 			/*
5283 			 * Note: xresolv interfaces will eventually need NOARP
5284 			 * set here as well, but that will require those
5285 			 * external resolvers to have some knowledge of
5286 			 * that flag and act appropriately. Not to be changed
5287 			 * at present.
5288 			 */
5289 			ill->ill_flags |= ILLF_NONUD;
5290 		else
5291 			ill->ill_flags |= ILLF_NOARP;
5292 
5293 		if (ill->ill_phys_addr_length == 0) {
5294 			if (ill->ill_media->ip_m_mac_type == SUNW_DL_VNI) {
5295 				ill->ill_ipif->ipif_flags |= IPIF_NOXMIT;
5296 				ill->ill_phyint->phyint_flags |= PHYI_VIRTUAL;
5297 			} else {
5298 				/* pt-pt supports multicast. */
5299 				ill->ill_flags |= ILLF_MULTICAST;
5300 				ill->ill_ipif->ipif_flags |= IPIF_POINTOPOINT;
5301 			}
5302 		}
5303 	} else {
5304 		ill->ill_net_type = IRE_IF_RESOLVER;
5305 		if (ill->ill_bcast_mp != NULL)
5306 			freemsg(ill->ill_bcast_mp);
5307 		ill->ill_bcast_mp = ill_dlur_gen(brdcst_addr,
5308 		    ill->ill_bcast_addr_length, ill->ill_sap,
5309 		    ill->ill_sap_length);
5310 		/*
5311 		 * Later detect lack of DLPI driver multicast
5312 		 * capability by catching DL_ENABMULTI errors in
5313 		 * ip_rput_dlpi.
5314 		 */
5315 		ill->ill_flags |= ILLF_MULTICAST;
5316 		if (!ill->ill_isv6)
5317 			ill->ill_ipif->ipif_flags |= IPIF_BROADCAST;
5318 	}
5319 	/* By default an interface does not support any CoS marking */
5320 	ill->ill_flags &= ~ILLF_COS_ENABLED;
5321 
5322 	/*
5323 	 * If we get QoS information in DL_INFO_ACK, the device supports
5324 	 * some form of CoS marking, set ILLF_COS_ENABLED.
5325 	 */
5326 	sel1 = (dl_qos_cl_sel1_t *)mi_offset_param(mp, dlia->dl_qos_offset,
5327 	    dlia->dl_qos_length);
5328 	if ((sel1 != NULL) && (sel1->dl_qos_type == DL_QOS_CL_SEL1)) {
5329 		ill->ill_flags |= ILLF_COS_ENABLED;
5330 	}
5331 
5332 	/* Clear any previous error indication. */
5333 	ill->ill_error = 0;
5334 	freemsg(mp);
5335 }
5336 
5337 /*
5338  * Perform various checks to verify that an address would make sense as a
5339  * local, remote, or subnet interface address.
5340  */
5341 static boolean_t
5342 ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask)
5343 {
5344 	ipaddr_t	net_mask;
5345 
5346 	/*
5347 	 * Don't allow all zeroes, all ones or experimental address, but allow
5348 	 * all ones netmask.
5349 	 */
5350 	if ((net_mask = ip_net_mask(addr)) == 0)
5351 		return (B_FALSE);
5352 	/* A given netmask overrides the "guess" netmask */
5353 	if (subnet_mask != 0)
5354 		net_mask = subnet_mask;
5355 	if ((net_mask != ~(ipaddr_t)0) && ((addr == (addr & net_mask)) ||
5356 	    (addr == (addr | ~net_mask)))) {
5357 		return (B_FALSE);
5358 	}
5359 	if (CLASSD(addr))
5360 		return (B_FALSE);
5361 
5362 	return (B_TRUE);
5363 }
5364 
5365 /*
5366  * ipif_lookup_group
5367  * Returns held ipif
5368  */
5369 ipif_t *
5370 ipif_lookup_group(ipaddr_t group, zoneid_t zoneid)
5371 {
5372 	ire_t	*ire;
5373 	ipif_t	*ipif;
5374 
5375 	ire = ire_lookup_multi(group, zoneid);
5376 	if (ire == NULL)
5377 		return (NULL);
5378 	ipif = ire->ire_ipif;
5379 	ipif_refhold(ipif);
5380 	ire_refrele(ire);
5381 	return (ipif);
5382 }
5383 
5384 /*
5385  * Look for an ipif with the specified interface address and destination.
5386  * The destination address is used only for matching point-to-point interfaces.
5387  */
5388 ipif_t *
5389 ipif_lookup_interface(ipaddr_t if_addr, ipaddr_t dst, queue_t *q, mblk_t *mp,
5390     ipsq_func_t func, int *error)
5391 {
5392 	ipif_t	*ipif;
5393 	ill_t	*ill;
5394 	ill_walk_context_t ctx;
5395 	ipsq_t	*ipsq;
5396 
5397 	if (error != NULL)
5398 		*error = 0;
5399 
5400 	/*
5401 	 * First match all the point-to-point interfaces
5402 	 * before looking at non-point-to-point interfaces.
5403 	 * This is done to avoid returning non-point-to-point
5404 	 * ipif instead of unnumbered point-to-point ipif.
5405 	 */
5406 	rw_enter(&ill_g_lock, RW_READER);
5407 	ill = ILL_START_WALK_V4(&ctx);
5408 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5409 		GRAB_CONN_LOCK(q);
5410 		mutex_enter(&ill->ill_lock);
5411 		for (ipif = ill->ill_ipif; ipif != NULL;
5412 		    ipif = ipif->ipif_next) {
5413 			/* Allow the ipif to be down */
5414 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
5415 			    (ipif->ipif_lcl_addr == if_addr) &&
5416 			    (ipif->ipif_pp_dst_addr == dst)) {
5417 				/*
5418 				 * The block comment at the start of ipif_down
5419 				 * explains the use of the macros used below
5420 				 */
5421 				if (IPIF_CAN_LOOKUP(ipif)) {
5422 					ipif_refhold_locked(ipif);
5423 					mutex_exit(&ill->ill_lock);
5424 					RELEASE_CONN_LOCK(q);
5425 					rw_exit(&ill_g_lock);
5426 					return (ipif);
5427 				} else if (IPIF_CAN_WAIT(ipif, q)) {
5428 					ipsq = ill->ill_phyint->phyint_ipsq;
5429 					mutex_enter(&ipsq->ipsq_lock);
5430 					mutex_exit(&ill->ill_lock);
5431 					rw_exit(&ill_g_lock);
5432 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
5433 						ill);
5434 					mutex_exit(&ipsq->ipsq_lock);
5435 					RELEASE_CONN_LOCK(q);
5436 					*error = EINPROGRESS;
5437 					return (NULL);
5438 				}
5439 			}
5440 		}
5441 		mutex_exit(&ill->ill_lock);
5442 		RELEASE_CONN_LOCK(q);
5443 	}
5444 	rw_exit(&ill_g_lock);
5445 
5446 	/* lookup the ipif based on interface address */
5447 	ipif = ipif_lookup_addr(if_addr, NULL, ALL_ZONES, q, mp, func, error);
5448 	ASSERT(ipif == NULL || !ipif->ipif_isv6);
5449 	return (ipif);
5450 }
5451 
5452 /*
5453  * Look for an ipif with the specified address. For point-point links
5454  * we look for matches on either the destination address and the local
5455  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
5456  * is set.
5457  * Matches on a specific ill if match_ill is set.
5458  */
5459 ipif_t *
5460 ipif_lookup_addr(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid, queue_t *q,
5461     mblk_t *mp, ipsq_func_t func, int *error)
5462 {
5463 	ipif_t  *ipif;
5464 	ill_t   *ill;
5465 	boolean_t ptp = B_FALSE;
5466 	ipsq_t	*ipsq;
5467 	ill_walk_context_t	ctx;
5468 
5469 	if (error != NULL)
5470 		*error = 0;
5471 
5472 	rw_enter(&ill_g_lock, RW_READER);
5473 	/*
5474 	 * Repeat twice, first based on local addresses and
5475 	 * next time for pointopoint.
5476 	 */
5477 repeat:
5478 	ill = ILL_START_WALK_V4(&ctx);
5479 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5480 		if (match_ill != NULL && ill != match_ill) {
5481 			continue;
5482 		}
5483 		GRAB_CONN_LOCK(q);
5484 		mutex_enter(&ill->ill_lock);
5485 		for (ipif = ill->ill_ipif; ipif != NULL;
5486 		    ipif = ipif->ipif_next) {
5487 			if (zoneid != ALL_ZONES && zoneid != ipif->ipif_zoneid)
5488 				continue;
5489 			/* Allow the ipif to be down */
5490 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
5491 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
5492 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
5493 			    (ipif->ipif_pp_dst_addr == addr))) {
5494 				/*
5495 				 * The block comment at the start of ipif_down
5496 				 * explains the use of the macros used below
5497 				 */
5498 				if (IPIF_CAN_LOOKUP(ipif)) {
5499 					ipif_refhold_locked(ipif);
5500 					mutex_exit(&ill->ill_lock);
5501 					RELEASE_CONN_LOCK(q);
5502 					rw_exit(&ill_g_lock);
5503 					return (ipif);
5504 				} else if (IPIF_CAN_WAIT(ipif, q)) {
5505 					ipsq = ill->ill_phyint->phyint_ipsq;
5506 					mutex_enter(&ipsq->ipsq_lock);
5507 					mutex_exit(&ill->ill_lock);
5508 					rw_exit(&ill_g_lock);
5509 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
5510 						ill);
5511 					mutex_exit(&ipsq->ipsq_lock);
5512 					RELEASE_CONN_LOCK(q);
5513 					*error = EINPROGRESS;
5514 					return (NULL);
5515 				}
5516 			}
5517 		}
5518 		mutex_exit(&ill->ill_lock);
5519 		RELEASE_CONN_LOCK(q);
5520 	}
5521 
5522 	/* Now try the ptp case */
5523 	if (ptp) {
5524 		rw_exit(&ill_g_lock);
5525 		if (error != NULL)
5526 			*error = ENXIO;
5527 		return (NULL);
5528 	}
5529 	ptp = B_TRUE;
5530 	goto repeat;
5531 }
5532 
5533 /*
5534  * Look for an ipif that matches the specified remote address i.e. the
5535  * ipif that would receive the specified packet.
5536  * First look for directly connected interfaces and then do a recursive
5537  * IRE lookup and pick the first ipif corresponding to the source address in the
5538  * ire.
5539  * Returns: held ipif
5540  */
5541 ipif_t *
5542 ipif_lookup_remote(ill_t *ill, ipaddr_t addr, zoneid_t zoneid)
5543 {
5544 	ipif_t	*ipif;
5545 	ire_t	*ire;
5546 
5547 	ASSERT(!ill->ill_isv6);
5548 
5549 	/*
5550 	 * Someone could be changing this ipif currently or change it
5551 	 * after we return this. Thus  a few packets could use the old
5552 	 * old values. However structure updates/creates (ire, ilg, ilm etc)
5553 	 * will atomically be updated or cleaned up with the new value
5554 	 * Thus we don't need a lock to check the flags or other attrs below.
5555 	 */
5556 	mutex_enter(&ill->ill_lock);
5557 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
5558 		if (!IPIF_CAN_LOOKUP(ipif))
5559 			continue;
5560 		if (zoneid != ALL_ZONES && zoneid != ipif->ipif_zoneid)
5561 			continue;
5562 		/* Allow the ipif to be down */
5563 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
5564 			if ((ipif->ipif_pp_dst_addr == addr) ||
5565 			    (!(ipif->ipif_flags & IPIF_UNNUMBERED) &&
5566 			    ipif->ipif_lcl_addr == addr)) {
5567 				ipif_refhold_locked(ipif);
5568 				mutex_exit(&ill->ill_lock);
5569 				return (ipif);
5570 			}
5571 		} else if (ipif->ipif_subnet == (addr & ipif->ipif_net_mask)) {
5572 			ipif_refhold_locked(ipif);
5573 			mutex_exit(&ill->ill_lock);
5574 			return (ipif);
5575 		}
5576 	}
5577 	mutex_exit(&ill->ill_lock);
5578 	ire = ire_route_lookup(addr, 0, 0, 0, NULL, NULL, zoneid,
5579 	    MATCH_IRE_RECURSIVE);
5580 	if (ire != NULL) {
5581 		/*
5582 		 * The callers of this function wants to know the
5583 		 * interface on which they have to send the replies
5584 		 * back. For IRE_CACHES that have ire_stq and ire_ipif
5585 		 * derived from different ills, we really don't care
5586 		 * what we return here.
5587 		 */
5588 		ipif = ire->ire_ipif;
5589 		if (ipif != NULL) {
5590 			ipif_refhold(ipif);
5591 			ire_refrele(ire);
5592 			return (ipif);
5593 		}
5594 		ire_refrele(ire);
5595 	}
5596 	/* Pick the first interface */
5597 	ipif = ipif_get_next_ipif(NULL, ill);
5598 	return (ipif);
5599 }
5600 
5601 /*
5602  * This func does not prevent refcnt from increasing. But if
5603  * the caller has taken steps to that effect, then this func
5604  * can be used to determine whether the ill has become quiescent
5605  */
5606 boolean_t
5607 ill_is_quiescent(ill_t *ill)
5608 {
5609 	ipif_t	*ipif;
5610 
5611 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5612 
5613 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
5614 		if (ipif->ipif_refcnt != 0 || ipif->ipif_ire_cnt != 0)
5615 			return (B_FALSE);
5616 	}
5617 	if (ill->ill_ire_cnt != 0 || ill->ill_refcnt != 0 ||
5618 	    ill->ill_nce_cnt != 0 || ill->ill_srcif_refcnt != 0 ||
5619 	    ill->ill_mrtun_refcnt != 0)
5620 		return (B_FALSE);
5621 	return (B_TRUE);
5622 }
5623 
5624 /*
5625  * This func does not prevent refcnt from increasing. But if
5626  * the caller has taken steps to that effect, then this func
5627  * can be used to determine whether the ipif has become quiescent
5628  */
5629 static boolean_t
5630 ipif_is_quiescent(ipif_t *ipif)
5631 {
5632 	ill_t *ill;
5633 
5634 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5635 
5636 	if (ipif->ipif_refcnt != 0 || ipif->ipif_ire_cnt != 0)
5637 		return (B_FALSE);
5638 
5639 	ill = ipif->ipif_ill;
5640 	if (ill->ill_ipif_up_count != 0 || ill->ill_logical_down)
5641 		return (B_TRUE);
5642 
5643 	/* This is the last ipif going down or being deleted on this ill */
5644 	if (ill->ill_ire_cnt != 0 || ill->ill_refcnt != 0)
5645 		return (B_FALSE);
5646 
5647 	return (B_TRUE);
5648 }
5649 
5650 /*
5651  * This func does not prevent refcnt from increasing. But if
5652  * the caller has taken steps to that effect, then this func
5653  * can be used to determine whether the ipifs marked with IPIF_MOVING
5654  * have become quiescent and can be moved in a failover/failback.
5655  */
5656 static ipif_t *
5657 ill_quiescent_to_move(ill_t *ill)
5658 {
5659 	ipif_t  *ipif;
5660 
5661 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5662 
5663 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
5664 		if (ipif->ipif_state_flags & IPIF_MOVING) {
5665 			if (ipif->ipif_refcnt != 0 || ipif->ipif_ire_cnt != 0) {
5666 				return (ipif);
5667 			}
5668 		}
5669 	}
5670 	return (NULL);
5671 }
5672 
5673 /*
5674  * The ipif/ill/ire has been refreled. Do the tail processing.
5675  * Determine if the ipif or ill in question has become quiescent and if so
5676  * wakeup close and/or restart any queued pending ioctl that is waiting
5677  * for the ipif_down (or ill_down)
5678  */
5679 void
5680 ipif_ill_refrele_tail(ill_t *ill)
5681 {
5682 	mblk_t	*mp;
5683 	conn_t	*connp;
5684 	ipsq_t	*ipsq;
5685 	ipif_t	*ipif;
5686 
5687 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5688 
5689 	if ((ill->ill_state_flags & ILL_CONDEMNED) &&
5690 	    ill_is_quiescent(ill)) {
5691 		/* ill_close may be waiting */
5692 		cv_broadcast(&ill->ill_cv);
5693 	}
5694 
5695 	/* ipsq can't change because ill_lock  is held */
5696 	ipsq = ill->ill_phyint->phyint_ipsq;
5697 	if (ipsq->ipsq_waitfor == 0) {
5698 		/* Not waiting for anything, just return. */
5699 		mutex_exit(&ill->ill_lock);
5700 		return;
5701 	}
5702 	ASSERT(ipsq->ipsq_pending_mp != NULL &&
5703 		ipsq->ipsq_pending_ipif != NULL);
5704 	/*
5705 	 * ipif->ipif_refcnt must go down to zero for restarting REMOVEIF.
5706 	 * Last ipif going down needs to down the ill, so ill_ire_cnt must
5707 	 * be zero for restarting an ioctl that ends up downing the ill.
5708 	 */
5709 	ipif = ipsq->ipsq_pending_ipif;
5710 	if (ipif->ipif_ill != ill) {
5711 		/* The ioctl is pending on some other ill. */
5712 		mutex_exit(&ill->ill_lock);
5713 		return;
5714 	}
5715 
5716 	switch (ipsq->ipsq_waitfor) {
5717 	case IPIF_DOWN:
5718 	case IPIF_FREE:
5719 		if (!ipif_is_quiescent(ipif)) {
5720 			mutex_exit(&ill->ill_lock);
5721 			return;
5722 		}
5723 		break;
5724 
5725 	case ILL_DOWN:
5726 	case ILL_FREE:
5727 		/*
5728 		 * case ILL_FREE arises only for loopback. otherwise ill_delete
5729 		 * waits synchronously in ip_close, and no message is queued in
5730 		 * ipsq_pending_mp at all in this case
5731 		 */
5732 		if (!ill_is_quiescent(ill)) {
5733 			mutex_exit(&ill->ill_lock);
5734 			return;
5735 		}
5736 
5737 		break;
5738 
5739 	case ILL_MOVE_OK:
5740 		if (ill_quiescent_to_move(ill) != NULL) {
5741 			mutex_exit(&ill->ill_lock);
5742 			return;
5743 		}
5744 
5745 		break;
5746 	default:
5747 		cmn_err(CE_PANIC, "ipsq: %p unknown ipsq_waitfor %d\n",
5748 		    (void *)ipsq, ipsq->ipsq_waitfor);
5749 	}
5750 
5751 	/*
5752 	 * Incr refcnt for the qwriter_ip call below which
5753 	 * does a refrele
5754 	 */
5755 	ill_refhold_locked(ill);
5756 	mutex_exit(&ill->ill_lock);
5757 
5758 	mp = ipsq_pending_mp_get(ipsq, &connp);
5759 	ASSERT(mp != NULL);
5760 
5761 	switch (mp->b_datap->db_type) {
5762 	case M_ERROR:
5763 	case M_HANGUP:
5764 		(void) qwriter_ip(NULL, ill, ill->ill_rq, mp,
5765 		    ipif_all_down_tail, CUR_OP, B_TRUE);
5766 		return;
5767 
5768 	case M_IOCTL:
5769 	case M_IOCDATA:
5770 		(void) qwriter_ip(NULL, ill,
5771 		    (connp != NULL ? CONNP_TO_WQ(connp) : ill->ill_wq), mp,
5772 		    ip_reprocess_ioctl, CUR_OP, B_TRUE);
5773 		return;
5774 
5775 	default:
5776 		cmn_err(CE_PANIC, "ipif_ill_refrele_tail mp %p "
5777 		    "db_type %d\n", (void *)mp, mp->b_datap->db_type);
5778 	}
5779 }
5780 
5781 #ifdef ILL_DEBUG
5782 /* Reuse trace buffer from beginning (if reached the end) and record trace */
5783 void
5784 th_trace_rrecord(th_trace_t *th_trace)
5785 {
5786 	tr_buf_t *tr_buf;
5787 	uint_t lastref;
5788 
5789 	lastref = th_trace->th_trace_lastref;
5790 	lastref++;
5791 	if (lastref == TR_BUF_MAX)
5792 		lastref = 0;
5793 	th_trace->th_trace_lastref = lastref;
5794 	tr_buf = &th_trace->th_trbuf[lastref];
5795 	tr_buf->tr_depth = getpcstack(tr_buf->tr_stack, IP_STACK_DEPTH);
5796 }
5797 
5798 th_trace_t *
5799 th_trace_ipif_lookup(ipif_t *ipif)
5800 {
5801 	int bucket_id;
5802 	th_trace_t *th_trace;
5803 
5804 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5805 
5806 	bucket_id = IP_TR_HASH(curthread);
5807 	ASSERT(bucket_id < IP_TR_HASH_MAX);
5808 
5809 	for (th_trace = ipif->ipif_trace[bucket_id]; th_trace != NULL;
5810 	    th_trace = th_trace->th_next) {
5811 		if (th_trace->th_id == curthread)
5812 			return (th_trace);
5813 	}
5814 	return (NULL);
5815 }
5816 
5817 void
5818 ipif_trace_ref(ipif_t *ipif)
5819 {
5820 	int bucket_id;
5821 	th_trace_t *th_trace;
5822 
5823 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5824 
5825 	if (ipif->ipif_trace_disable)
5826 		return;
5827 
5828 	/*
5829 	 * Attempt to locate the trace buffer for the curthread.
5830 	 * If it does not exist, then allocate a new trace buffer
5831 	 * and link it in list of trace bufs for this ipif, at the head
5832 	 */
5833 	th_trace = th_trace_ipif_lookup(ipif);
5834 	if (th_trace == NULL) {
5835 		bucket_id = IP_TR_HASH(curthread);
5836 		th_trace = (th_trace_t *)kmem_zalloc(sizeof (th_trace_t),
5837 		    KM_NOSLEEP);
5838 		if (th_trace == NULL) {
5839 			ipif->ipif_trace_disable = B_TRUE;
5840 			ipif_trace_cleanup(ipif);
5841 			return;
5842 		}
5843 		th_trace->th_id = curthread;
5844 		th_trace->th_next = ipif->ipif_trace[bucket_id];
5845 		th_trace->th_prev = &ipif->ipif_trace[bucket_id];
5846 		if (th_trace->th_next != NULL)
5847 			th_trace->th_next->th_prev = &th_trace->th_next;
5848 		ipif->ipif_trace[bucket_id] = th_trace;
5849 	}
5850 	ASSERT(th_trace->th_refcnt >= 0 &&
5851 		th_trace->th_refcnt < TR_BUF_MAX -1);
5852 	th_trace->th_refcnt++;
5853 	th_trace_rrecord(th_trace);
5854 }
5855 
5856 void
5857 ipif_untrace_ref(ipif_t *ipif)
5858 {
5859 	th_trace_t *th_trace;
5860 
5861 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5862 
5863 	if (ipif->ipif_trace_disable)
5864 		return;
5865 	th_trace = th_trace_ipif_lookup(ipif);
5866 	ASSERT(th_trace != NULL);
5867 	ASSERT(th_trace->th_refcnt > 0);
5868 
5869 	th_trace->th_refcnt--;
5870 	th_trace_rrecord(th_trace);
5871 }
5872 
5873 th_trace_t *
5874 th_trace_ill_lookup(ill_t *ill)
5875 {
5876 	th_trace_t *th_trace;
5877 	int bucket_id;
5878 
5879 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5880 
5881 	bucket_id = IP_TR_HASH(curthread);
5882 	ASSERT(bucket_id < IP_TR_HASH_MAX);
5883 
5884 	for (th_trace = ill->ill_trace[bucket_id]; th_trace != NULL;
5885 	    th_trace = th_trace->th_next) {
5886 		if (th_trace->th_id == curthread)
5887 			return (th_trace);
5888 	}
5889 	return (NULL);
5890 }
5891 
5892 void
5893 ill_trace_ref(ill_t *ill)
5894 {
5895 	int bucket_id;
5896 	th_trace_t *th_trace;
5897 
5898 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5899 	if (ill->ill_trace_disable)
5900 		return;
5901 	/*
5902 	 * Attempt to locate the trace buffer for the curthread.
5903 	 * If it does not exist, then allocate a new trace buffer
5904 	 * and link it in list of trace bufs for this ill, at the head
5905 	 */
5906 	th_trace = th_trace_ill_lookup(ill);
5907 	if (th_trace == NULL) {
5908 		bucket_id = IP_TR_HASH(curthread);
5909 		th_trace = (th_trace_t *)kmem_zalloc(sizeof (th_trace_t),
5910 		    KM_NOSLEEP);
5911 		if (th_trace == NULL) {
5912 			ill->ill_trace_disable = B_TRUE;
5913 			ill_trace_cleanup(ill);
5914 			return;
5915 		}
5916 		th_trace->th_id = curthread;
5917 		th_trace->th_next = ill->ill_trace[bucket_id];
5918 		th_trace->th_prev = &ill->ill_trace[bucket_id];
5919 		if (th_trace->th_next != NULL)
5920 			th_trace->th_next->th_prev = &th_trace->th_next;
5921 		ill->ill_trace[bucket_id] = th_trace;
5922 	}
5923 	ASSERT(th_trace->th_refcnt >= 0 &&
5924 		th_trace->th_refcnt < TR_BUF_MAX - 1);
5925 
5926 	th_trace->th_refcnt++;
5927 	th_trace_rrecord(th_trace);
5928 }
5929 
5930 void
5931 ill_untrace_ref(ill_t *ill)
5932 {
5933 	th_trace_t *th_trace;
5934 
5935 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5936 
5937 	if (ill->ill_trace_disable)
5938 		return;
5939 	th_trace = th_trace_ill_lookup(ill);
5940 	ASSERT(th_trace != NULL);
5941 	ASSERT(th_trace->th_refcnt > 0);
5942 
5943 	th_trace->th_refcnt--;
5944 	th_trace_rrecord(th_trace);
5945 }
5946 
5947 /*
5948  * Verify that this thread has no refs to the ipif and free
5949  * the trace buffers
5950  */
5951 /* ARGSUSED */
5952 void
5953 ipif_thread_exit(ipif_t *ipif, void *dummy)
5954 {
5955 	th_trace_t *th_trace;
5956 
5957 	mutex_enter(&ipif->ipif_ill->ill_lock);
5958 
5959 	th_trace = th_trace_ipif_lookup(ipif);
5960 	if (th_trace == NULL) {
5961 		mutex_exit(&ipif->ipif_ill->ill_lock);
5962 		return;
5963 	}
5964 	ASSERT(th_trace->th_refcnt == 0);
5965 	/* unlink th_trace and free it */
5966 	*th_trace->th_prev = th_trace->th_next;
5967 	if (th_trace->th_next != NULL)
5968 		th_trace->th_next->th_prev = th_trace->th_prev;
5969 	th_trace->th_next = NULL;
5970 	th_trace->th_prev = NULL;
5971 	kmem_free(th_trace, sizeof (th_trace_t));
5972 
5973 	mutex_exit(&ipif->ipif_ill->ill_lock);
5974 }
5975 
5976 /*
5977  * Verify that this thread has no refs to the ill and free
5978  * the trace buffers
5979  */
5980 /* ARGSUSED */
5981 void
5982 ill_thread_exit(ill_t *ill, void *dummy)
5983 {
5984 	th_trace_t *th_trace;
5985 
5986 	mutex_enter(&ill->ill_lock);
5987 
5988 	th_trace = th_trace_ill_lookup(ill);
5989 	if (th_trace == NULL) {
5990 		mutex_exit(&ill->ill_lock);
5991 		return;
5992 	}
5993 	ASSERT(th_trace->th_refcnt == 0);
5994 	/* unlink th_trace and free it */
5995 	*th_trace->th_prev = th_trace->th_next;
5996 	if (th_trace->th_next != NULL)
5997 		th_trace->th_next->th_prev = th_trace->th_prev;
5998 	th_trace->th_next = NULL;
5999 	th_trace->th_prev = NULL;
6000 	kmem_free(th_trace, sizeof (th_trace_t));
6001 
6002 	mutex_exit(&ill->ill_lock);
6003 }
6004 #endif
6005 
6006 #ifdef ILL_DEBUG
6007 void
6008 ip_thread_exit(void)
6009 {
6010 	ill_t	*ill;
6011 	ipif_t	*ipif;
6012 	ill_walk_context_t	ctx;
6013 
6014 	rw_enter(&ill_g_lock, RW_READER);
6015 	ill = ILL_START_WALK_ALL(&ctx);
6016 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
6017 		for (ipif = ill->ill_ipif; ipif != NULL;
6018 		    ipif = ipif->ipif_next) {
6019 			ipif_thread_exit(ipif, NULL);
6020 		}
6021 		ill_thread_exit(ill, NULL);
6022 	}
6023 	rw_exit(&ill_g_lock);
6024 
6025 	ire_walk(ire_thread_exit, NULL);
6026 	ndp_walk_impl(NULL, nce_thread_exit, NULL, B_FALSE);
6027 }
6028 
6029 /*
6030  * Called when ipif is unplumbed or when memory alloc fails
6031  */
6032 void
6033 ipif_trace_cleanup(ipif_t *ipif)
6034 {
6035 	int	i;
6036 	th_trace_t	*th_trace;
6037 	th_trace_t	*th_trace_next;
6038 
6039 	for (i = 0; i < IP_TR_HASH_MAX; i++) {
6040 		for (th_trace = ipif->ipif_trace[i]; th_trace != NULL;
6041 		    th_trace = th_trace_next) {
6042 			th_trace_next = th_trace->th_next;
6043 			kmem_free(th_trace, sizeof (th_trace_t));
6044 		}
6045 		ipif->ipif_trace[i] = NULL;
6046 	}
6047 }
6048 
6049 /*
6050  * Called when ill is unplumbed or when memory alloc fails
6051  */
6052 void
6053 ill_trace_cleanup(ill_t *ill)
6054 {
6055 	int	i;
6056 	th_trace_t	*th_trace;
6057 	th_trace_t	*th_trace_next;
6058 
6059 	for (i = 0; i < IP_TR_HASH_MAX; i++) {
6060 		for (th_trace = ill->ill_trace[i]; th_trace != NULL;
6061 		    th_trace = th_trace_next) {
6062 			th_trace_next = th_trace->th_next;
6063 			kmem_free(th_trace, sizeof (th_trace_t));
6064 		}
6065 		ill->ill_trace[i] = NULL;
6066 	}
6067 }
6068 
6069 #else
6070 void ip_thread_exit(void) {}
6071 #endif
6072 
6073 void
6074 ipif_refhold_locked(ipif_t *ipif)
6075 {
6076 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6077 	ipif->ipif_refcnt++;
6078 	IPIF_TRACE_REF(ipif);
6079 }
6080 
6081 void
6082 ipif_refhold(ipif_t *ipif)
6083 {
6084 	ill_t	*ill;
6085 
6086 	ill = ipif->ipif_ill;
6087 	mutex_enter(&ill->ill_lock);
6088 	ipif->ipif_refcnt++;
6089 	IPIF_TRACE_REF(ipif);
6090 	mutex_exit(&ill->ill_lock);
6091 }
6092 
6093 /*
6094  * Must not be called while holding any locks. Otherwise if this is
6095  * the last reference to be released there is a chance of recursive mutex
6096  * panic due to ipif_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
6097  * to restart an ioctl.
6098  */
6099 void
6100 ipif_refrele(ipif_t *ipif)
6101 {
6102 	ill_t	*ill;
6103 
6104 	ill = ipif->ipif_ill;
6105 
6106 	mutex_enter(&ill->ill_lock);
6107 	ASSERT(ipif->ipif_refcnt != 0);
6108 	ipif->ipif_refcnt--;
6109 	IPIF_UNTRACE_REF(ipif);
6110 	if (ipif->ipif_refcnt != 0) {
6111 		mutex_exit(&ill->ill_lock);
6112 		return;
6113 	}
6114 
6115 	/* Drops the ill_lock */
6116 	ipif_ill_refrele_tail(ill);
6117 }
6118 
6119 ipif_t *
6120 ipif_get_next_ipif(ipif_t *curr, ill_t *ill)
6121 {
6122 	ipif_t	*ipif;
6123 
6124 	mutex_enter(&ill->ill_lock);
6125 	for (ipif = (curr == NULL ? ill->ill_ipif : curr->ipif_next);
6126 	    ipif != NULL; ipif = ipif->ipif_next) {
6127 		if (!IPIF_CAN_LOOKUP(ipif))
6128 			continue;
6129 		ipif_refhold_locked(ipif);
6130 		mutex_exit(&ill->ill_lock);
6131 		return (ipif);
6132 	}
6133 	mutex_exit(&ill->ill_lock);
6134 	return (NULL);
6135 }
6136 
6137 /*
6138  * TODO: make this table extendible at run time
6139  * Return a pointer to the mac type info for 'mac_type'
6140  */
6141 static ip_m_t *
6142 ip_m_lookup(t_uscalar_t mac_type)
6143 {
6144 	ip_m_t	*ipm;
6145 
6146 	for (ipm = ip_m_tbl; ipm < A_END(ip_m_tbl); ipm++)
6147 		if (ipm->ip_m_mac_type == mac_type)
6148 			return (ipm);
6149 	return (NULL);
6150 }
6151 
6152 /*
6153  * ip_rt_add is called to add an IPv4 route to the forwarding table.
6154  * ipif_arg is passed in to associate it with the correct interface.
6155  * We may need to restart this operation if the ipif cannot be looked up
6156  * due to an exclusive operation that is currently in progress. The restart
6157  * entry point is specified by 'func'
6158  */
6159 int
6160 ip_rt_add(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
6161     ipaddr_t src_addr, int flags, ipif_t *ipif_arg, ipif_t *src_ipif,
6162     ire_t **ire_arg, boolean_t ioctl_msg, queue_t *q, mblk_t *mp,
6163     ipsq_func_t func)
6164 {
6165 	ire_t	*ire;
6166 	ire_t	*gw_ire = NULL;
6167 	ipif_t	*ipif = NULL;
6168 	boolean_t ipif_refheld = B_FALSE;
6169 	uint_t	type;
6170 	int	match_flags = MATCH_IRE_TYPE;
6171 	int	error;
6172 
6173 	ip1dbg(("ip_rt_add:"));
6174 
6175 	if (ire_arg != NULL)
6176 		*ire_arg = NULL;
6177 
6178 	/*
6179 	 * If this is the case of RTF_HOST being set, then we set the netmask
6180 	 * to all ones (regardless if one was supplied).
6181 	 */
6182 	if (flags & RTF_HOST)
6183 		mask = IP_HOST_MASK;
6184 
6185 	/*
6186 	 * Prevent routes with a zero gateway from being created (since
6187 	 * interfaces can currently be plumbed and brought up no assigned
6188 	 * address).
6189 	 * For routes with RTA_SRCIFP, the gateway address can be 0.0.0.0.
6190 	 */
6191 	if (gw_addr == 0 && src_ipif == NULL)
6192 		return (ENETUNREACH);
6193 	/*
6194 	 * Get the ipif, if any, corresponding to the gw_addr
6195 	 */
6196 	if (gw_addr != 0) {
6197 		ipif = ipif_lookup_interface(gw_addr, dst_addr, q, mp, func,
6198 		    &error);
6199 		if (ipif != NULL) {
6200 			if (IS_VNI(ipif->ipif_ill)) {
6201 				ipif_refrele(ipif);
6202 				return (EINVAL);
6203 			}
6204 			ipif_refheld = B_TRUE;
6205 		} else if (error == EINPROGRESS) {
6206 			ip1dbg(("ip_rt_add: null and EINPROGRESS"));
6207 			return (EINPROGRESS);
6208 		} else {
6209 			error = 0;
6210 		}
6211 	}
6212 
6213 	if (ipif != NULL) {
6214 		ip1dbg(("ip_rt_add: ipif_lookup_interface done ipif nonnull"));
6215 		ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6216 	} else {
6217 		ip1dbg(("ip_rt_add: ipif_lookup_interface done ipif is null"));
6218 	}
6219 
6220 	/*
6221 	 * GateD will attempt to create routes with a loopback interface
6222 	 * address as the gateway and with RTF_GATEWAY set.  We allow
6223 	 * these routes to be added, but create them as interface routes
6224 	 * since the gateway is an interface address.
6225 	 */
6226 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK))
6227 		flags &= ~RTF_GATEWAY;
6228 
6229 	/*
6230 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
6231 	 * and the gateway address provided is one of the system's interface
6232 	 * addresses.  By using the routing socket interface and supplying an
6233 	 * RTA_IFP sockaddr with an interface index, an alternate method of
6234 	 * specifying an interface route to be created is available which uses
6235 	 * the interface index that specifies the outgoing interface rather than
6236 	 * the address of an outgoing interface (which may not be able to
6237 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
6238 	 * flag, routes can be specified which not only specify the next-hop to
6239 	 * be used when routing to a certain prefix, but also which outgoing
6240 	 * interface should be used.
6241 	 *
6242 	 * Previously, interfaces would have unique addresses assigned to them
6243 	 * and so the address assigned to a particular interface could be used
6244 	 * to identify a particular interface.  One exception to this was the
6245 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
6246 	 *
6247 	 * With the advent of IPv6 and its link-local addresses, this
6248 	 * restriction was relaxed and interfaces could share addresses between
6249 	 * themselves.  In fact, typically all of the link-local interfaces on
6250 	 * an IPv6 node or router will have the same link-local address.  In
6251 	 * order to differentiate between these interfaces, the use of an
6252 	 * interface index is necessary and this index can be carried inside a
6253 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
6254 	 * of using the interface index, however, is that all of the ipif's that
6255 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
6256 	 * cannot be used to differentiate between ipif's (or logical
6257 	 * interfaces) that belong to the same ill (physical interface).
6258 	 *
6259 	 * For example, in the following case involving IPv4 interfaces and
6260 	 * logical interfaces
6261 	 *
6262 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
6263 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0:1
6264 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0:2
6265 	 *
6266 	 * the ipif's corresponding to each of these interface routes can be
6267 	 * uniquely identified by the "gateway" (actually interface address).
6268 	 *
6269 	 * In this case involving multiple IPv6 default routes to a particular
6270 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
6271 	 * default route is of interest:
6272 	 *
6273 	 *	default		fe80::123:4567:89ab:cdef	U	if0
6274 	 *	default		fe80::123:4567:89ab:cdef	U	if1
6275 	 */
6276 
6277 	/* RTF_GATEWAY not set */
6278 	if (!(flags & RTF_GATEWAY)) {
6279 		queue_t	*stq;
6280 		queue_t	*rfq = NULL;
6281 		ill_t	*in_ill = NULL;
6282 
6283 		/*
6284 		 * As the interface index specified with the RTA_IFP sockaddr is
6285 		 * the same for all ipif's off of an ill, the matching logic
6286 		 * below uses MATCH_IRE_ILL if such an index was specified.
6287 		 * This means that routes sharing the same prefix when added
6288 		 * using a RTA_IFP sockaddr must have distinct interface
6289 		 * indices (namely, they must be on distinct ill's).
6290 		 *
6291 		 * On the other hand, since the gateway address will usually be
6292 		 * different for each ipif on the system, the matching logic
6293 		 * uses MATCH_IRE_IPIF in the case of a traditional interface
6294 		 * route.  This means that interface routes for the same prefix
6295 		 * can be created if they belong to distinct ipif's and if a
6296 		 * RTA_IFP sockaddr is not present.
6297 		 */
6298 		if (ipif_arg != NULL) {
6299 			if (ipif_refheld)  {
6300 				ipif_refrele(ipif);
6301 				ipif_refheld = B_FALSE;
6302 			}
6303 			ipif = ipif_arg;
6304 			match_flags |= MATCH_IRE_ILL;
6305 		} else {
6306 			/*
6307 			 * Check the ipif corresponding to the gw_addr
6308 			 */
6309 			if (ipif == NULL)
6310 				return (ENETUNREACH);
6311 			match_flags |= MATCH_IRE_IPIF;
6312 		}
6313 		ASSERT(ipif != NULL);
6314 		/*
6315 		 * If src_ipif is not NULL, we have to create
6316 		 * an ire with non-null ire_in_ill value
6317 		 */
6318 		if (src_ipif != NULL) {
6319 			in_ill = src_ipif->ipif_ill;
6320 		}
6321 
6322 		/*
6323 		 * We check for an existing entry at this point.
6324 		 *
6325 		 * Since a netmask isn't passed in via the ioctl interface
6326 		 * (SIOCADDRT), we don't check for a matching netmask in that
6327 		 * case.
6328 		 */
6329 		if (!ioctl_msg)
6330 			match_flags |= MATCH_IRE_MASK;
6331 		if (src_ipif != NULL) {
6332 			/* Look up in the special table */
6333 			ire = ire_srcif_table_lookup(dst_addr, IRE_INTERFACE,
6334 			    ipif, src_ipif->ipif_ill, match_flags);
6335 		} else {
6336 			ire = ire_ftable_lookup(dst_addr, mask, 0,
6337 			    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0,
6338 			    match_flags);
6339 		}
6340 		if (ire != NULL) {
6341 			ire_refrele(ire);
6342 			if (ipif_refheld)
6343 				ipif_refrele(ipif);
6344 			return (EEXIST);
6345 		}
6346 
6347 		if (src_ipif != NULL) {
6348 			/*
6349 			 * Create the special ire for the IRE table
6350 			 * which hangs out of ire_in_ill. This ire
6351 			 * is in-between IRE_CACHE and IRE_INTERFACE.
6352 			 * Thus rfq is non-NULL.
6353 			 */
6354 			rfq = ipif->ipif_rq;
6355 		}
6356 		/* Create the usual interface ires */
6357 
6358 		stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
6359 		    ? ipif->ipif_rq : ipif->ipif_wq;
6360 
6361 		/*
6362 		 * Create a copy of the IRE_LOOPBACK,
6363 		 * IRE_IF_NORESOLVER or IRE_IF_RESOLVER with
6364 		 * the modified address and netmask.
6365 		 */
6366 		ire = ire_create(
6367 		    (uchar_t *)&dst_addr,
6368 		    (uint8_t *)&mask,
6369 		    (uint8_t *)&ipif->ipif_src_addr,
6370 		    NULL,
6371 		    NULL,
6372 		    &ipif->ipif_mtu,
6373 		    NULL,
6374 		    rfq,
6375 		    stq,
6376 		    ipif->ipif_net_type,
6377 		    ipif->ipif_resolver_mp,
6378 		    ipif,
6379 		    in_ill,
6380 		    0,
6381 		    0,
6382 		    0,
6383 		    flags,
6384 		    &ire_uinfo_null);
6385 		if (ire == NULL) {
6386 			if (ipif_refheld)
6387 				ipif_refrele(ipif);
6388 			return (ENOMEM);
6389 		}
6390 
6391 		/*
6392 		 * Some software (for example, GateD and Sun Cluster) attempts
6393 		 * to create (what amount to) IRE_PREFIX routes with the
6394 		 * loopback address as the gateway.  This is primarily done to
6395 		 * set up prefixes with the RTF_REJECT flag set (for example,
6396 		 * when generating aggregate routes.)
6397 		 *
6398 		 * If the IRE type (as defined by ipif->ipif_net_type) is
6399 		 * IRE_LOOPBACK, then we map the request into a
6400 		 * IRE_IF_NORESOLVER.
6401 		 *
6402 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
6403 		 * routine, but rather using ire_create() directly.
6404 		 */
6405 		if (ipif->ipif_net_type == IRE_LOOPBACK)
6406 			ire->ire_type = IRE_IF_NORESOLVER;
6407 		error = ire_add(&ire, q, mp, func);
6408 		if (error == 0)
6409 			goto save_ire;
6410 
6411 		/*
6412 		 * In the result of failure, ire_add() will have already
6413 		 * deleted the ire in question, so there is no need to
6414 		 * do that here.
6415 		 */
6416 		if (ipif_refheld)
6417 			ipif_refrele(ipif);
6418 		return (error);
6419 	}
6420 	if (ipif_refheld) {
6421 		ipif_refrele(ipif);
6422 		ipif_refheld = B_FALSE;
6423 	}
6424 
6425 	if (src_ipif != NULL) {
6426 		/* RTA_SRCIFP is not supported on RTF_GATEWAY */
6427 		ip2dbg(("ip_rt_add: SRCIF cannot be set with gateway route\n"));
6428 		return (EINVAL);
6429 	}
6430 	/*
6431 	 * Get an interface IRE for the specified gateway.
6432 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
6433 	 * gateway, it is currently unreachable and we fail the request
6434 	 * accordingly.
6435 	 */
6436 	ipif = ipif_arg;
6437 	if (ipif_arg != NULL)
6438 		match_flags |= MATCH_IRE_ILL;
6439 	gw_ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg, NULL,
6440 	    ALL_ZONES, 0, match_flags);
6441 	if (gw_ire == NULL)
6442 		return (ENETUNREACH);
6443 
6444 	/*
6445 	 * We create one of three types of IREs as a result of this request
6446 	 * based on the netmask.  A netmask of all ones (which is automatically
6447 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
6448 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
6449 	 * created.  Otherwise, an IRE_PREFIX route is created for the
6450 	 * destination prefix.
6451 	 */
6452 	if (mask == IP_HOST_MASK)
6453 		type = IRE_HOST;
6454 	else if (mask == 0)
6455 		type = IRE_DEFAULT;
6456 	else
6457 		type = IRE_PREFIX;
6458 
6459 	/* check for a duplicate entry */
6460 	ire = ire_ftable_lookup(dst_addr, mask, gw_addr, type, ipif_arg,
6461 	    NULL, ALL_ZONES, 0, match_flags | MATCH_IRE_MASK | MATCH_IRE_GW);
6462 	if (ire != NULL) {
6463 		ire_refrele(gw_ire);
6464 		ire_refrele(ire);
6465 		return (EEXIST);
6466 	}
6467 
6468 	/* Create the IRE. */
6469 	ire = ire_create(
6470 	    (uchar_t *)&dst_addr,		/* dest address */
6471 	    (uchar_t *)&mask,			/* mask */
6472 	    /* src address assigned by the caller? */
6473 	    (uchar_t *)(((src_addr != INADDR_ANY) &&
6474 		(flags & RTF_SETSRC)) ?  &src_addr : NULL),
6475 	    (uchar_t *)&gw_addr,		/* gateway address */
6476 	    NULL,				/* no in-srcaddress */
6477 	    &gw_ire->ire_max_frag,
6478 	    NULL,				/* no Fast Path header */
6479 	    NULL,				/* no recv-from queue */
6480 	    NULL,				/* no send-to queue */
6481 	    (ushort_t)type,			/* IRE type */
6482 	    NULL,
6483 	    ipif_arg,
6484 	    NULL,
6485 	    0,
6486 	    0,
6487 	    0,
6488 	    flags,
6489 	    &gw_ire->ire_uinfo);		/* Inherit ULP info from gw */
6490 	if (ire == NULL) {
6491 		ire_refrele(gw_ire);
6492 		return (ENOMEM);
6493 	}
6494 
6495 	/*
6496 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
6497 	 * SUN/OS socket stuff does but do we really want to allow 0.0.0.0?
6498 	 */
6499 
6500 	/* Add the new IRE. */
6501 	error = ire_add(&ire, q, mp, func);
6502 	if (error != 0) {
6503 		/*
6504 		 * In the result of failure, ire_add() will have already
6505 		 * deleted the ire in question, so there is no need to
6506 		 * do that here.
6507 		 */
6508 		ire_refrele(gw_ire);
6509 		return (error);
6510 	}
6511 
6512 	if (flags & RTF_MULTIRT) {
6513 		/*
6514 		 * Invoke the CGTP (multirouting) filtering module
6515 		 * to add the dst address in the filtering database.
6516 		 * Replicated inbound packets coming from that address
6517 		 * will be filtered to discard the duplicates.
6518 		 * It is not necessary to call the CGTP filter hook
6519 		 * when the dst address is a broadcast or multicast,
6520 		 * because an IP source address cannot be a broadcast
6521 		 * or a multicast.
6522 		 */
6523 		ire_t *ire_dst = ire_ctable_lookup(ire->ire_addr, 0,
6524 		    IRE_BROADCAST, NULL, NULL, MATCH_IRE_TYPE);
6525 		if (ire_dst != NULL) {
6526 			ip_cgtp_bcast_add(ire, ire_dst);
6527 			ire_refrele(ire_dst);
6528 			goto save_ire;
6529 		}
6530 		if ((ip_cgtp_filter_ops != NULL) && !CLASSD(ire->ire_addr)) {
6531 			int res = ip_cgtp_filter_ops->cfo_add_dest_v4(
6532 			    ire->ire_addr,
6533 			    ire->ire_gateway_addr,
6534 			    ire->ire_src_addr,
6535 			    gw_ire->ire_src_addr);
6536 			if (res != 0) {
6537 				ire_refrele(gw_ire);
6538 				ire_delete(ire);
6539 				return (res);
6540 			}
6541 		}
6542 	}
6543 
6544 save_ire:
6545 	if (gw_ire != NULL) {
6546 		ire_refrele(gw_ire);
6547 	}
6548 	/*
6549 	 * We do not do save_ire for the routes added with RTA_SRCIFP
6550 	 * flag. This route is only added and deleted by mipagent.
6551 	 * So, for simplicity of design, we refrain from saving
6552 	 * ires that are created with srcif value. This may change
6553 	 * in future if we find more usage of srcifp feature.
6554 	 */
6555 	if (ipif != NULL && src_ipif == NULL) {
6556 		/*
6557 		 * Save enough information so that we can recreate the IRE if
6558 		 * the interface goes down and then up.  The metrics associated
6559 		 * with the route will be saved as well when rts_setmetrics() is
6560 		 * called after the IRE has been created.  In the case where
6561 		 * memory cannot be allocated, none of this information will be
6562 		 * saved.
6563 		 */
6564 		ipif_save_ire(ipif, ire);
6565 	}
6566 	if (ioctl_msg)
6567 		ip_rts_rtmsg(RTM_OLDADD, ire, 0);
6568 	if (ire_arg != NULL) {
6569 		/*
6570 		 * Store the ire that was successfully added into where ire_arg
6571 		 * points to so that callers don't have to look it up
6572 		 * themselves (but they are responsible for ire_refrele()ing
6573 		 * the ire when they are finished with it).
6574 		 */
6575 		*ire_arg = ire;
6576 	} else {
6577 		ire_refrele(ire);		/* Held in ire_add */
6578 	}
6579 	if (ipif_refheld)
6580 		ipif_refrele(ipif);
6581 	return (0);
6582 }
6583 
6584 /*
6585  * ip_rt_delete is called to delete an IPv4 route.
6586  * ipif_arg is passed in to associate it with the correct interface.
6587  * src_ipif is passed to associate the incoming interface of the packet.
6588  * We may need to restart this operation if the ipif cannot be looked up
6589  * due to an exclusive operation that is currently in progress. The restart
6590  * entry point is specified by 'func'
6591  */
6592 /* ARGSUSED4 */
6593 int
6594 ip_rt_delete(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
6595     uint_t rtm_addrs, int flags, ipif_t *ipif_arg, ipif_t *src_ipif,
6596     boolean_t ioctl_msg, queue_t *q, mblk_t *mp, ipsq_func_t func)
6597 {
6598 	ire_t	*ire = NULL;
6599 	ipif_t	*ipif;
6600 	boolean_t ipif_refheld = B_FALSE;
6601 	uint_t	type;
6602 	uint_t	match_flags = MATCH_IRE_TYPE;
6603 	int	err = 0;
6604 
6605 	ip1dbg(("ip_rt_delete:"));
6606 	/*
6607 	 * If this is the case of RTF_HOST being set, then we set the netmask
6608 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
6609 	 */
6610 	if (flags & RTF_HOST) {
6611 		mask = IP_HOST_MASK;
6612 		match_flags |= MATCH_IRE_MASK;
6613 	} else if (rtm_addrs & RTA_NETMASK) {
6614 		match_flags |= MATCH_IRE_MASK;
6615 	}
6616 
6617 	/*
6618 	 * Note that RTF_GATEWAY is never set on a delete, therefore
6619 	 * we check if the gateway address is one of our interfaces first,
6620 	 * and fall back on RTF_GATEWAY routes.
6621 	 *
6622 	 * This makes it possible to delete an original
6623 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
6624 	 *
6625 	 * As the interface index specified with the RTA_IFP sockaddr is the
6626 	 * same for all ipif's off of an ill, the matching logic below uses
6627 	 * MATCH_IRE_ILL if such an index was specified.  This means a route
6628 	 * sharing the same prefix and interface index as the the route
6629 	 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr
6630 	 * is specified in the request.
6631 	 *
6632 	 * On the other hand, since the gateway address will usually be
6633 	 * different for each ipif on the system, the matching logic
6634 	 * uses MATCH_IRE_IPIF in the case of a traditional interface
6635 	 * route.  This means that interface routes for the same prefix can be
6636 	 * uniquely identified if they belong to distinct ipif's and if a
6637 	 * RTA_IFP sockaddr is not present.
6638 	 *
6639 	 * For more detail on specifying routes by gateway address and by
6640 	 * interface index, see the comments in ip_rt_add().
6641 	 * gw_addr could be zero in some cases when both RTA_SRCIFP and
6642 	 * RTA_IFP are specified. If RTA_SRCIFP is specified and  both
6643 	 * RTA_IFP and gateway_addr are NULL/zero, then delete will not
6644 	 * succeed.
6645 	 */
6646 	if (src_ipif != NULL) {
6647 		if (ipif_arg == NULL && gw_addr != 0) {
6648 			ipif_arg = ipif_lookup_interface(gw_addr, dst_addr,
6649 			    q, mp, func, &err);
6650 			if (ipif_arg != NULL)
6651 				ipif_refheld = B_TRUE;
6652 		}
6653 		if (ipif_arg == NULL) {
6654 			err = (err == EINPROGRESS) ? err : ESRCH;
6655 			return (err);
6656 		}
6657 		ipif = ipif_arg;
6658 	} else {
6659 		ipif = ipif_lookup_interface(gw_addr, dst_addr,
6660 			    q, mp, func, &err);
6661 		if (ipif != NULL)
6662 			ipif_refheld = B_TRUE;
6663 		else if (err == EINPROGRESS)
6664 			return (err);
6665 		else
6666 			err = 0;
6667 	}
6668 	if (ipif != NULL) {
6669 		if (ipif_arg != NULL) {
6670 			if (ipif_refheld) {
6671 				ipif_refrele(ipif);
6672 				ipif_refheld = B_FALSE;
6673 			}
6674 			ipif = ipif_arg;
6675 			match_flags |= MATCH_IRE_ILL;
6676 		} else {
6677 			match_flags |= MATCH_IRE_IPIF;
6678 		}
6679 		if (src_ipif != NULL) {
6680 			ire = ire_srcif_table_lookup(dst_addr, IRE_INTERFACE,
6681 			    ipif, src_ipif->ipif_ill, match_flags);
6682 		} else {
6683 			if (ipif->ipif_ire_type == IRE_LOOPBACK) {
6684 				ire = ire_ctable_lookup(dst_addr, 0,
6685 				    IRE_LOOPBACK, ipif, ALL_ZONES, match_flags);
6686 			}
6687 			if (ire == NULL) {
6688 				ire = ire_ftable_lookup(dst_addr, mask, 0,
6689 				    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0,
6690 				    match_flags);
6691 			}
6692 		}
6693 	}
6694 
6695 	if (ire == NULL) {
6696 		/*
6697 		 * At this point, the gateway address is not one of our own
6698 		 * addresses or a matching interface route was not found.  We
6699 		 * set the IRE type to lookup based on whether
6700 		 * this is a host route, a default route or just a prefix.
6701 		 *
6702 		 * If an ipif_arg was passed in, then the lookup is based on an
6703 		 * interface index so MATCH_IRE_ILL is added to match_flags.
6704 		 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is
6705 		 * set as the route being looked up is not a traditional
6706 		 * interface route.
6707 		 * Since we do not add gateway route with srcipif, we don't
6708 		 * expect to find it either.
6709 		 */
6710 		if (src_ipif != NULL) {
6711 			if (ipif_refheld)
6712 				ipif_refrele(ipif);
6713 			return (ESRCH);
6714 		} else {
6715 			match_flags &= ~MATCH_IRE_IPIF;
6716 			match_flags |= MATCH_IRE_GW;
6717 			if (ipif_arg != NULL)
6718 				match_flags |= MATCH_IRE_ILL;
6719 			if (mask == IP_HOST_MASK)
6720 				type = IRE_HOST;
6721 			else if (mask == 0)
6722 				type = IRE_DEFAULT;
6723 			else
6724 				type = IRE_PREFIX;
6725 			ire = ire_ftable_lookup(dst_addr, mask, gw_addr, type,
6726 			    ipif_arg, NULL, ALL_ZONES, 0, match_flags);
6727 			if (ire == NULL && type == IRE_HOST) {
6728 				ire = ire_ftable_lookup(dst_addr, mask, gw_addr,
6729 				    IRE_HOST_REDIRECT, ipif_arg, NULL,
6730 				    ALL_ZONES, 0, match_flags);
6731 			}
6732 		}
6733 	}
6734 
6735 	if (ipif_refheld)
6736 		ipif_refrele(ipif);
6737 
6738 	/* ipif is not refheld anymore */
6739 	if (ire == NULL)
6740 		return (ESRCH);
6741 
6742 	if (ire->ire_flags & RTF_MULTIRT) {
6743 		/*
6744 		 * Invoke the CGTP (multirouting) filtering module
6745 		 * to remove the dst address from the filtering database.
6746 		 * Packets coming from that address will no longer be
6747 		 * filtered to remove duplicates.
6748 		 */
6749 		if (ip_cgtp_filter_ops != NULL) {
6750 			err = ip_cgtp_filter_ops->cfo_del_dest_v4(ire->ire_addr,
6751 			    ire->ire_gateway_addr);
6752 		}
6753 		ip_cgtp_bcast_delete(ire);
6754 	}
6755 
6756 	ipif = ire->ire_ipif;
6757 	/*
6758 	 * Removing from ipif_saved_ire_mp is not necessary
6759 	 * when src_ipif being non-NULL. ip_rt_add does not
6760 	 * save the ires which src_ipif being non-NULL.
6761 	 */
6762 	if (ipif != NULL && src_ipif == NULL) {
6763 		ipif_remove_ire(ipif, ire);
6764 	}
6765 	if (ioctl_msg)
6766 		ip_rts_rtmsg(RTM_OLDDEL, ire, 0);
6767 	ire_delete(ire);
6768 	ire_refrele(ire);
6769 	return (err);
6770 }
6771 
6772 /*
6773  * ip_siocaddrt is called to complete processing of an SIOCADDRT IOCTL.
6774  */
6775 /* ARGSUSED */
6776 int
6777 ip_siocaddrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
6778     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
6779 {
6780 	ipaddr_t dst_addr;
6781 	ipaddr_t gw_addr;
6782 	ipaddr_t mask;
6783 	int error = 0;
6784 	mblk_t *mp1;
6785 	struct rtentry *rt;
6786 	ipif_t *ipif = NULL;
6787 
6788 	ip1dbg(("ip_siocaddrt:"));
6789 	/* Existence of mp1 verified in ip_wput_nondata */
6790 	mp1 = mp->b_cont->b_cont;
6791 	rt = (struct rtentry *)mp1->b_rptr;
6792 
6793 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
6794 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
6795 
6796 	/*
6797 	 * If the RTF_HOST flag is on, this is a request to assign a gateway
6798 	 * to a particular host address.  In this case, we set the netmask to
6799 	 * all ones for the particular destination address.  Otherwise,
6800 	 * determine the netmask to be used based on dst_addr and the interfaces
6801 	 * in use.
6802 	 */
6803 	if (rt->rt_flags & RTF_HOST) {
6804 		mask = IP_HOST_MASK;
6805 	} else {
6806 		/*
6807 		 * Note that ip_subnet_mask returns a zero mask in the case of
6808 		 * default (an all-zeroes address).
6809 		 */
6810 		mask = ip_subnet_mask(dst_addr, &ipif);
6811 	}
6812 
6813 	error = ip_rt_add(dst_addr, mask, gw_addr, 0, rt->rt_flags,
6814 	    NULL, NULL, NULL, B_TRUE, q, mp, ip_process_ioctl);
6815 	if (ipif != NULL)
6816 		ipif_refrele(ipif);
6817 	return (error);
6818 }
6819 
6820 /*
6821  * ip_siocdelrt is called to complete processing of an SIOCDELRT IOCTL.
6822  */
6823 /* ARGSUSED */
6824 int
6825 ip_siocdelrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
6826     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
6827 {
6828 	ipaddr_t dst_addr;
6829 	ipaddr_t gw_addr;
6830 	ipaddr_t mask;
6831 	int error;
6832 	mblk_t *mp1;
6833 	struct rtentry *rt;
6834 	ipif_t *ipif = NULL;
6835 
6836 	ip1dbg(("ip_siocdelrt:"));
6837 	/* Existence of mp1 verified in ip_wput_nondata */
6838 	mp1 = mp->b_cont->b_cont;
6839 	rt = (struct rtentry *)mp1->b_rptr;
6840 
6841 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
6842 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
6843 
6844 	/*
6845 	 * If the RTF_HOST flag is on, this is a request to delete a gateway
6846 	 * to a particular host address.  In this case, we set the netmask to
6847 	 * all ones for the particular destination address.  Otherwise,
6848 	 * determine the netmask to be used based on dst_addr and the interfaces
6849 	 * in use.
6850 	 */
6851 	if (rt->rt_flags & RTF_HOST) {
6852 		mask = IP_HOST_MASK;
6853 	} else {
6854 		/*
6855 		 * Note that ip_subnet_mask returns a zero mask in the case of
6856 		 * default (an all-zeroes address).
6857 		 */
6858 		mask = ip_subnet_mask(dst_addr, &ipif);
6859 	}
6860 
6861 	error = ip_rt_delete(dst_addr, mask, gw_addr,
6862 	    RTA_DST | RTA_GATEWAY | RTA_NETMASK, rt->rt_flags, NULL, NULL,
6863 	    B_TRUE, q, mp, ip_process_ioctl);
6864 	if (ipif != NULL)
6865 		ipif_refrele(ipif);
6866 	return (error);
6867 }
6868 
6869 /*
6870  * Enqueue the mp onto the ipsq, chained by b_next.
6871  * b_prev stores the function to be executed later, and b_queue the queue
6872  * where this mp originated.
6873  */
6874 void
6875 ipsq_enq(ipsq_t *ipsq, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
6876     ill_t *pending_ill)
6877 {
6878 	conn_t	*connp = NULL;
6879 
6880 	ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
6881 	ASSERT(func != NULL);
6882 
6883 	mp->b_queue = q;
6884 	mp->b_prev = (void *)func;
6885 	mp->b_next = NULL;
6886 
6887 	switch (type) {
6888 	case CUR_OP:
6889 		if (ipsq->ipsq_mptail != NULL) {
6890 			ASSERT(ipsq->ipsq_mphead != NULL);
6891 			ipsq->ipsq_mptail->b_next = mp;
6892 		} else {
6893 			ASSERT(ipsq->ipsq_mphead == NULL);
6894 			ipsq->ipsq_mphead = mp;
6895 		}
6896 		ipsq->ipsq_mptail = mp;
6897 		break;
6898 
6899 	case NEW_OP:
6900 		if (ipsq->ipsq_xopq_mptail != NULL) {
6901 			ASSERT(ipsq->ipsq_xopq_mphead != NULL);
6902 			ipsq->ipsq_xopq_mptail->b_next = mp;
6903 		} else {
6904 			ASSERT(ipsq->ipsq_xopq_mphead == NULL);
6905 			ipsq->ipsq_xopq_mphead = mp;
6906 		}
6907 		ipsq->ipsq_xopq_mptail = mp;
6908 		break;
6909 	default:
6910 		cmn_err(CE_PANIC, "ipsq_enq %d type \n", type);
6911 	}
6912 
6913 	if (CONN_Q(q) && pending_ill != NULL) {
6914 		connp = Q_TO_CONN(q);
6915 
6916 		ASSERT(MUTEX_HELD(&connp->conn_lock));
6917 		connp->conn_oper_pending_ill = pending_ill;
6918 	}
6919 }
6920 
6921 /*
6922  * Return the mp at the head of the ipsq. After emptying the ipsq
6923  * look at the next ioctl, if this ioctl is complete. Otherwise
6924  * return, we will resume when we complete the current ioctl.
6925  * The current ioctl will wait till it gets a response from the
6926  * driver below.
6927  */
6928 static mblk_t *
6929 ipsq_dq(ipsq_t *ipsq)
6930 {
6931 	mblk_t	*mp;
6932 
6933 	ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
6934 
6935 	mp = ipsq->ipsq_mphead;
6936 	if (mp != NULL) {
6937 		ipsq->ipsq_mphead = mp->b_next;
6938 		if (ipsq->ipsq_mphead == NULL)
6939 			ipsq->ipsq_mptail = NULL;
6940 		mp->b_next = NULL;
6941 		return (mp);
6942 	}
6943 	if (ipsq->ipsq_current_ipif != NULL)
6944 		return (NULL);
6945 	mp = ipsq->ipsq_xopq_mphead;
6946 	if (mp != NULL) {
6947 		ipsq->ipsq_xopq_mphead = mp->b_next;
6948 		if (ipsq->ipsq_xopq_mphead == NULL)
6949 			ipsq->ipsq_xopq_mptail = NULL;
6950 		mp->b_next = NULL;
6951 		return (mp);
6952 	}
6953 	return (NULL);
6954 }
6955 
6956 /*
6957  * Enter the ipsq corresponding to ill, by waiting synchronously till
6958  * we can enter the ipsq exclusively. Unless 'force' is used, the ipsq
6959  * will have to drain completely before ipsq_enter returns success.
6960  * ipsq_current_ipif will be set if some exclusive ioctl is in progress,
6961  * and the ipsq_exit logic will start the next enqueued ioctl after
6962  * completion of the current ioctl. If 'force' is used, we don't wait
6963  * for the enqueued ioctls. This is needed when a conn_close wants to
6964  * enter the ipsq and abort an ioctl that is somehow stuck. Unplumb
6965  * of an ill can also use this option. But we dont' use it currently.
6966  */
6967 #define	ENTER_SQ_WAIT_TICKS 100
6968 boolean_t
6969 ipsq_enter(ill_t *ill, boolean_t force)
6970 {
6971 	ipsq_t	*ipsq;
6972 	boolean_t waited_enough = B_FALSE;
6973 
6974 	/*
6975 	 * Holding the ill_lock prevents <ill-ipsq> assocs from changing.
6976 	 * Since the <ill-ipsq> assocs could change while we wait for the
6977 	 * writer, it is easier to wait on a fixed global rather than try to
6978 	 * cv_wait on a changing ipsq.
6979 	 */
6980 	mutex_enter(&ill->ill_lock);
6981 	for (;;) {
6982 		if (ill->ill_state_flags & ILL_CONDEMNED) {
6983 			mutex_exit(&ill->ill_lock);
6984 			return (B_FALSE);
6985 		}
6986 
6987 		ipsq = ill->ill_phyint->phyint_ipsq;
6988 		mutex_enter(&ipsq->ipsq_lock);
6989 		if (ipsq->ipsq_writer == NULL &&
6990 		    (ipsq->ipsq_current_ipif == NULL || waited_enough)) {
6991 			break;
6992 		} else if (ipsq->ipsq_writer != NULL) {
6993 			mutex_exit(&ipsq->ipsq_lock);
6994 			cv_wait(&ill->ill_cv, &ill->ill_lock);
6995 		} else {
6996 			mutex_exit(&ipsq->ipsq_lock);
6997 			if (force) {
6998 				(void) cv_timedwait(&ill->ill_cv,
6999 				    &ill->ill_lock,
7000 				    lbolt + ENTER_SQ_WAIT_TICKS);
7001 				waited_enough = B_TRUE;
7002 				continue;
7003 			} else {
7004 				cv_wait(&ill->ill_cv, &ill->ill_lock);
7005 			}
7006 		}
7007 	}
7008 
7009 	ASSERT(ipsq->ipsq_mphead == NULL && ipsq->ipsq_mptail == NULL);
7010 	ASSERT(ipsq->ipsq_reentry_cnt == 0);
7011 	ipsq->ipsq_writer = curthread;
7012 	ipsq->ipsq_reentry_cnt++;
7013 #ifdef ILL_DEBUG
7014 	ipsq->ipsq_depth = getpcstack(ipsq->ipsq_stack, IP_STACK_DEPTH);
7015 #endif
7016 	mutex_exit(&ipsq->ipsq_lock);
7017 	mutex_exit(&ill->ill_lock);
7018 	return (B_TRUE);
7019 }
7020 
7021 /*
7022  * The ipsq_t (ipsq) is the synchronization data structure used to serialize
7023  * certain critical operations like plumbing (i.e. most set ioctls),
7024  * multicast joins, igmp/mld timers, IPMP operations etc. On a non-IPMP
7025  * system there is 1 ipsq per phyint. On an IPMP system there is 1 ipsq per
7026  * IPMP group. The ipsq serializes exclusive ioctls issued by applications
7027  * on a per ipsq basis in ipsq_xopq_mphead. It also protects against multiple
7028  * threads executing in the ipsq. Responses from the driver pertain to the
7029  * current ioctl (say a DL_BIND_ACK in response to a DL_BIND_REQUEST initiated
7030  * as part of bringing up the interface) and are enqueued in ipsq_mphead.
7031  *
7032  * If a thread does not want to reenter the ipsq when it is already writer,
7033  * it must make sure that the specified reentry point to be called later
7034  * when the ipsq is empty, nor any code path starting from the specified reentry
7035  * point must never ever try to enter the ipsq again. Otherwise it can lead
7036  * to an infinite loop. The reentry point ip_rput_dlpi_writer is an example.
7037  * When the thread that is currently exclusive finishes, it (ipsq_exit)
7038  * dequeues the requests waiting to become exclusive in ipsq_mphead and calls
7039  * the reentry point. When the list at ipsq_mphead becomes empty ipsq_exit
7040  * proceeds to dequeue the next ioctl in ipsq_xopq_mphead and start the next
7041  * ioctl if the current ioctl has completed. If the current ioctl is still
7042  * in progress it simply returns. The current ioctl could be waiting for
7043  * a response from another module (arp_ or the driver or could be waiting for
7044  * the ipif/ill/ire refcnts to drop to zero. In such a case the ipsq_pending_mp
7045  * and ipsq_pending_ipif are set. ipsq_current_ipif is set throughout the
7046  * execution of the ioctl and ipsq_exit does not start the next ioctl unless
7047  * ipsq_current_ipif is clear which happens only on ioctl completion.
7048  */
7049 
7050 /*
7051  * Try to enter the ipsq exclusively, corresponding to ipif or ill. (only 1 of
7052  * ipif or ill can be specified). The caller ensures ipif or ill is valid by
7053  * ref-holding it if necessary. If the ipsq cannot be entered, the mp is queued
7054  * completion.
7055  */
7056 ipsq_t *
7057 ipsq_try_enter(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
7058     ipsq_func_t func, int type, boolean_t reentry_ok)
7059 {
7060 	ipsq_t	*ipsq;
7061 
7062 	/* Only 1 of ipif or ill can be specified */
7063 	ASSERT((ipif != NULL) ^ (ill != NULL));
7064 	if (ipif != NULL)
7065 		ill = ipif->ipif_ill;
7066 
7067 	/*
7068 	 * lock ordering ill_g_lock -> conn_lock -> ill_lock -> ipsq_lock
7069 	 * ipsq of an ill can't change when ill_lock is held.
7070 	 */
7071 	GRAB_CONN_LOCK(q);
7072 	mutex_enter(&ill->ill_lock);
7073 	ipsq = ill->ill_phyint->phyint_ipsq;
7074 	mutex_enter(&ipsq->ipsq_lock);
7075 
7076 	/*
7077 	 * 1. Enter the ipsq if we are already writer and reentry is ok.
7078 	 *    (Note: If the caller does not specify reentry_ok then neither
7079 	 *    'func' nor any of its callees must ever attempt to enter the ipsq
7080 	 *    again. Otherwise it can lead to an infinite loop
7081 	 * 2. Enter the ipsq if there is no current writer and this attempted
7082 	 *    entry is part of the current ioctl or operation
7083 	 * 3. Enter the ipsq if there is no current writer and this is a new
7084 	 *    ioctl (or operation) and the ioctl (or operation) queue is
7085 	 *    empty and there is no ioctl (or operation) currently in progress
7086 	 */
7087 	if ((ipsq->ipsq_writer == NULL && ((type == CUR_OP) ||
7088 	    (type == NEW_OP && ipsq->ipsq_xopq_mphead == NULL &&
7089 	    ipsq->ipsq_current_ipif == NULL))) ||
7090 	    (ipsq->ipsq_writer == curthread && reentry_ok)) {
7091 		/* Success. */
7092 		ipsq->ipsq_reentry_cnt++;
7093 		ipsq->ipsq_writer = curthread;
7094 		mutex_exit(&ipsq->ipsq_lock);
7095 		mutex_exit(&ill->ill_lock);
7096 		RELEASE_CONN_LOCK(q);
7097 #ifdef ILL_DEBUG
7098 		ipsq->ipsq_depth = getpcstack(ipsq->ipsq_stack, IP_STACK_DEPTH);
7099 #endif
7100 		return (ipsq);
7101 	}
7102 
7103 	ipsq_enq(ipsq, q, mp, func, type, ill);
7104 
7105 	mutex_exit(&ipsq->ipsq_lock);
7106 	mutex_exit(&ill->ill_lock);
7107 	RELEASE_CONN_LOCK(q);
7108 	return (NULL);
7109 }
7110 
7111 /*
7112  * Try to enter the ipsq exclusively, corresponding to ipif or ill. (only 1 of
7113  * ipif or ill can be specified). The caller ensures ipif or ill is valid by
7114  * ref-holding it if necessary. If the ipsq cannot be entered, the mp is queued
7115  * completion.
7116  *
7117  * This function does a refrele on the ipif/ill.
7118  */
7119 void
7120 qwriter_ip(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
7121     ipsq_func_t func, int type, boolean_t reentry_ok)
7122 {
7123 	ipsq_t	*ipsq;
7124 
7125 	ipsq = ipsq_try_enter(ipif, ill, q, mp, func, type, reentry_ok);
7126 	/*
7127 	 * Caller must have done a refhold on the ipif. ipif_refrele
7128 	 * happens on the passed ipif. We can do this since we are
7129 	 * already exclusive, or we won't access ipif henceforth, Both
7130 	 * this func and caller will just return if we ipsq_try_enter
7131 	 * fails above. This is needed because func needs to
7132 	 * see the correct refcount. Eg. removeif can work only then.
7133 	 */
7134 	if (ipif != NULL)
7135 		ipif_refrele(ipif);
7136 	else
7137 		ill_refrele(ill);
7138 	if (ipsq != NULL) {
7139 		(*func)(ipsq, q, mp, NULL);
7140 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
7141 	}
7142 }
7143 
7144 /*
7145  * If there are more than ILL_GRP_CNT ills in a group,
7146  * we use kmem alloc'd buffers, else use the stack
7147  */
7148 #define	ILL_GRP_CNT	14
7149 /*
7150  * Drain the ipsq, if there are messages on it, and then leave the ipsq.
7151  * Called by a thread that is currently exclusive on this ipsq.
7152  */
7153 void
7154 ipsq_exit(ipsq_t *ipsq, boolean_t start_igmp_timer, boolean_t start_mld_timer)
7155 {
7156 	queue_t	*q;
7157 	mblk_t	*mp;
7158 	ipsq_func_t	func;
7159 	int	next;
7160 	ill_t	**ill_list = NULL;
7161 	size_t	ill_list_size = 0;
7162 	int	cnt = 0;
7163 	boolean_t need_ipsq_free = B_FALSE;
7164 
7165 	ASSERT(IAM_WRITER_IPSQ(ipsq));
7166 	mutex_enter(&ipsq->ipsq_lock);
7167 	ASSERT(ipsq->ipsq_reentry_cnt >= 1);
7168 	if (ipsq->ipsq_reentry_cnt != 1) {
7169 		ipsq->ipsq_reentry_cnt--;
7170 		mutex_exit(&ipsq->ipsq_lock);
7171 		return;
7172 	}
7173 
7174 	mp = ipsq_dq(ipsq);
7175 	while (mp != NULL) {
7176 again:
7177 		mutex_exit(&ipsq->ipsq_lock);
7178 		func = (ipsq_func_t)mp->b_prev;
7179 		q = (queue_t *)mp->b_queue;
7180 		mp->b_prev = NULL;
7181 		mp->b_queue = NULL;
7182 
7183 		/*
7184 		 * If 'q' is an conn queue, it is valid, since we did a
7185 		 * a refhold on the connp, at the start of the ioctl.
7186 		 * If 'q' is an ill queue, it is valid, since close of an
7187 		 * ill will clean up the 'ipsq'.
7188 		 */
7189 		(*func)(ipsq, q, mp, NULL);
7190 
7191 		mutex_enter(&ipsq->ipsq_lock);
7192 		mp = ipsq_dq(ipsq);
7193 	}
7194 
7195 	mutex_exit(&ipsq->ipsq_lock);
7196 
7197 	/*
7198 	 * Need to grab the locks in the right order. Need to
7199 	 * atomically check (under ipsq_lock) that there are no
7200 	 * messages before relinquishing the ipsq. Also need to
7201 	 * atomically wakeup waiters on ill_cv while holding ill_lock.
7202 	 * Holding ill_g_lock ensures that ipsq list of ills is stable.
7203 	 * If we need to call ill_split_ipsq and change <ill-ipsq> we need
7204 	 * to grab ill_g_lock as writer.
7205 	 */
7206 	rw_enter(&ill_g_lock, ipsq->ipsq_split ? RW_WRITER : RW_READER);
7207 
7208 	/* ipsq_refs can't change while ill_g_lock is held as reader */
7209 	if (ipsq->ipsq_refs != 0) {
7210 		/* At most 2 ills v4/v6 per phyint */
7211 		cnt = ipsq->ipsq_refs << 1;
7212 		ill_list_size = cnt * sizeof (ill_t *);
7213 		/*
7214 		 * If memory allocation fails, we will do the split
7215 		 * the next time ipsq_exit is called for whatever reason.
7216 		 * As long as the ipsq_split flag is set the need to
7217 		 * split is remembered.
7218 		 */
7219 		ill_list = kmem_zalloc(ill_list_size, KM_NOSLEEP);
7220 		if (ill_list != NULL)
7221 			cnt = ill_lock_ipsq_ills(ipsq, ill_list, cnt);
7222 	}
7223 	mutex_enter(&ipsq->ipsq_lock);
7224 	mp = ipsq_dq(ipsq);
7225 	if (mp != NULL) {
7226 		/* oops, some message has landed up, we can't get out */
7227 		if (ill_list != NULL)
7228 			ill_unlock_ills(ill_list, cnt);
7229 		rw_exit(&ill_g_lock);
7230 		if (ill_list != NULL)
7231 			kmem_free(ill_list, ill_list_size);
7232 		ill_list = NULL;
7233 		ill_list_size = 0;
7234 		cnt = 0;
7235 		goto again;
7236 	}
7237 
7238 	/*
7239 	 * Split only if no ioctl is pending and if memory alloc succeeded
7240 	 * above.
7241 	 */
7242 	if (ipsq->ipsq_split && ipsq->ipsq_current_ipif == NULL &&
7243 		ill_list != NULL) {
7244 		/*
7245 		 * No new ill can join this ipsq since we are holding the
7246 		 * ill_g_lock. Hence ill_split_ipsq can safely traverse the
7247 		 * ipsq. ill_split_ipsq may fail due to memory shortage.
7248 		 * If so we will retry on the next ipsq_exit.
7249 		 */
7250 		ipsq->ipsq_split = ill_split_ipsq(ipsq);
7251 	}
7252 
7253 	/*
7254 	 * We are holding the ipsq lock, hence no new messages can
7255 	 * land up on the ipsq, and there are no messages currently.
7256 	 * Now safe to get out. Wake up waiters and relinquish ipsq
7257 	 * atomically while holding ill locks.
7258 	 */
7259 	ipsq->ipsq_writer = NULL;
7260 	ipsq->ipsq_reentry_cnt--;
7261 	ASSERT(ipsq->ipsq_reentry_cnt == 0);
7262 #ifdef ILL_DEBUG
7263 	ipsq->ipsq_depth = 0;
7264 #endif
7265 	mutex_exit(&ipsq->ipsq_lock);
7266 	/*
7267 	 * For IPMP this should wake up all ills in this ipsq.
7268 	 * We need to hold the ill_lock while waking up waiters to
7269 	 * avoid missed wakeups. But there is no need to acquire all
7270 	 * the ill locks and then wakeup. If we have not acquired all
7271 	 * the locks (due to memory failure above) ill_signal_ipsq_ills
7272 	 * wakes up ills one at a time after getting the right ill_lock
7273 	 */
7274 	ill_signal_ipsq_ills(ipsq, ill_list != NULL);
7275 	if (ill_list != NULL)
7276 		ill_unlock_ills(ill_list, cnt);
7277 	if (ipsq->ipsq_refs == 0)
7278 		need_ipsq_free = B_TRUE;
7279 	rw_exit(&ill_g_lock);
7280 	if (ill_list != 0)
7281 		kmem_free(ill_list, ill_list_size);
7282 
7283 	if (need_ipsq_free) {
7284 		/*
7285 		 * Free the ipsq. ipsq_refs can't increase because ipsq can't be
7286 		 * looked up. ipsq can be looked up only thru ill or phyint
7287 		 * and there are no ills/phyint on this ipsq.
7288 		 */
7289 		ipsq_delete(ipsq);
7290 	}
7291 	/*
7292 	 * Now start any igmp or mld timers that could not be started
7293 	 * while inside the ipsq. The timers can't be started while inside
7294 	 * the ipsq, since igmp_start_timers may need to call untimeout()
7295 	 * which can't be done while holding a lock i.e. the ipsq. Otherwise
7296 	 * there could be a deadlock since the timeout handlers
7297 	 * mld_timeout_handler / igmp_timeout_handler also synchronously
7298 	 * wait in ipsq_enter() trying to get the ipsq.
7299 	 *
7300 	 * However there is one exception to the above. If this thread is
7301 	 * itself the igmp/mld timeout handler thread, then we don't want
7302 	 * to start any new timer until the current handler is done. The
7303 	 * handler thread passes in B_FALSE for start_igmp/mld_timers, while
7304 	 * all others pass B_TRUE.
7305 	 */
7306 	if (start_igmp_timer) {
7307 		mutex_enter(&igmp_timer_lock);
7308 		next = igmp_deferred_next;
7309 		igmp_deferred_next = INFINITY;
7310 		mutex_exit(&igmp_timer_lock);
7311 
7312 		if (next != INFINITY)
7313 			igmp_start_timers(next);
7314 	}
7315 
7316 	if (start_mld_timer) {
7317 		mutex_enter(&mld_timer_lock);
7318 		next = mld_deferred_next;
7319 		mld_deferred_next = INFINITY;
7320 		mutex_exit(&mld_timer_lock);
7321 
7322 		if (next != INFINITY)
7323 			mld_start_timers(next);
7324 	}
7325 }
7326 
7327 /*
7328  * The ill is closing. Flush all messages on the ipsq that originated
7329  * from this ill. Usually there wont' be any messages on the ipsq_xopq_mphead
7330  * for this ill since ipsq_enter could not have entered until then.
7331  * New messages can't be queued since the CONDEMNED flag is set.
7332  */
7333 static void
7334 ipsq_flush(ill_t *ill)
7335 {
7336 	queue_t	*q;
7337 	mblk_t	*prev;
7338 	mblk_t	*mp;
7339 	mblk_t	*mp_next;
7340 	ipsq_t	*ipsq;
7341 
7342 	ASSERT(IAM_WRITER_ILL(ill));
7343 	ipsq = ill->ill_phyint->phyint_ipsq;
7344 	/*
7345 	 * Flush any messages sent up by the driver.
7346 	 */
7347 	mutex_enter(&ipsq->ipsq_lock);
7348 	for (prev = NULL, mp = ipsq->ipsq_mphead; mp != NULL; mp = mp_next) {
7349 		mp_next = mp->b_next;
7350 		q = mp->b_queue;
7351 		if (q == ill->ill_rq || q == ill->ill_wq) {
7352 			/* Remove the mp from the ipsq */
7353 			if (prev == NULL)
7354 				ipsq->ipsq_mphead = mp->b_next;
7355 			else
7356 				prev->b_next = mp->b_next;
7357 			if (ipsq->ipsq_mptail == mp) {
7358 				ASSERT(mp_next == NULL);
7359 				ipsq->ipsq_mptail = prev;
7360 			}
7361 			inet_freemsg(mp);
7362 		} else {
7363 			prev = mp;
7364 		}
7365 	}
7366 	mutex_exit(&ipsq->ipsq_lock);
7367 	(void) ipsq_pending_mp_cleanup(ill, NULL);
7368 	ipsq_xopq_mp_cleanup(ill, NULL);
7369 	ill_pending_mp_cleanup(ill);
7370 }
7371 
7372 /*
7373  * Clean up one squeue element. ill_inuse_ref is protected by ill_lock.
7374  * The real cleanup happens behind the squeue via ip_squeue_clean function but
7375  * we need to protect ourselfs from 2 threads trying to cleanup at the same
7376  * time (possible with one port going down for aggr and someone tearing down the
7377  * entire aggr simultaneously. So we use ill_inuse_ref protected by ill_lock
7378  * to indicate when the cleanup has started (1 ref) and when the cleanup
7379  * is done (0 ref). When a new ring gets assigned to squeue, we start by
7380  * putting 2 ref on ill_inuse_ref.
7381  */
7382 static void
7383 ipsq_clean_ring(ill_t *ill, ill_rx_ring_t *rx_ring)
7384 {
7385 	conn_t *connp;
7386 	squeue_t *sqp;
7387 	mblk_t *mp;
7388 
7389 	ASSERT(rx_ring != NULL);
7390 
7391 	/* Just clean one squeue */
7392 	mutex_enter(&ill->ill_lock);
7393 	/*
7394 	 * Reset the ILL_SOFT_RING_ASSIGN bit so that
7395 	 * ip_squeue_soft_ring_affinty() will not go
7396 	 * ahead with assigning rings.
7397 	 */
7398 	ill->ill_state_flags &= ~ILL_SOFT_RING_ASSIGN;
7399 	while (rx_ring->rr_ring_state == ILL_RING_INPROC)
7400 		/* Some operations pending on the ring. Wait */
7401 		cv_wait(&ill->ill_cv, &ill->ill_lock);
7402 
7403 	if (rx_ring->rr_ring_state != ILL_RING_INUSE) {
7404 		/*
7405 		 * Someone already trying to clean
7406 		 * this squeue or its already been cleaned.
7407 		 */
7408 		mutex_exit(&ill->ill_lock);
7409 		return;
7410 	}
7411 	sqp = rx_ring->rr_sqp;
7412 
7413 	if (sqp == NULL) {
7414 		/*
7415 		 * The rx_ring never had a squeue assigned to it.
7416 		 * We are under ill_lock so we can clean it up
7417 		 * here itself since no one can get to it.
7418 		 */
7419 		rx_ring->rr_blank = NULL;
7420 		rx_ring->rr_handle = NULL;
7421 		rx_ring->rr_sqp = NULL;
7422 		rx_ring->rr_ring_state = ILL_RING_FREE;
7423 		mutex_exit(&ill->ill_lock);
7424 		return;
7425 	}
7426 
7427 	/* Set the state that its being cleaned */
7428 	rx_ring->rr_ring_state = ILL_RING_BEING_FREED;
7429 	ASSERT(sqp != NULL);
7430 	mutex_exit(&ill->ill_lock);
7431 
7432 	/*
7433 	 * Use the preallocated ill_unbind_conn for this purpose
7434 	 */
7435 	connp = ill->ill_dls_capab->ill_unbind_conn;
7436 	mp = &connp->conn_tcp->tcp_closemp;
7437 	CONN_INC_REF(connp);
7438 	squeue_enter(sqp, mp, ip_squeue_clean, connp, NULL);
7439 
7440 	mutex_enter(&ill->ill_lock);
7441 	while (rx_ring->rr_ring_state != ILL_RING_FREE)
7442 		cv_wait(&ill->ill_cv, &ill->ill_lock);
7443 
7444 	mutex_exit(&ill->ill_lock);
7445 }
7446 
7447 static void
7448 ipsq_clean_all(ill_t *ill)
7449 {
7450 	int idx;
7451 
7452 	/*
7453 	 * No need to clean if poll_capab isn't set for this ill
7454 	 */
7455 	if (!(ill->ill_capabilities & (ILL_CAPAB_POLL|ILL_CAPAB_SOFT_RING)))
7456 		return;
7457 
7458 	for (idx = 0; idx < ILL_MAX_RINGS; idx++) {
7459 		ill_rx_ring_t *ipr = &ill->ill_dls_capab->ill_ring_tbl[idx];
7460 		ipsq_clean_ring(ill, ipr);
7461 	}
7462 
7463 	ill->ill_capabilities &= ~(ILL_CAPAB_POLL|ILL_CAPAB_SOFT_RING);
7464 }
7465 
7466 /* ARGSUSED */
7467 int
7468 ip_sioctl_slifoindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
7469     ip_ioctl_cmd_t *ipip, void *ifreq)
7470 {
7471 	ill_t	*ill;
7472 	struct lifreq	*lifr = (struct lifreq *)ifreq;
7473 	boolean_t isv6;
7474 	conn_t	*connp;
7475 
7476 	connp = Q_TO_CONN(q);
7477 	isv6 = connp->conn_af_isv6;
7478 	/*
7479 	 * Set original index.
7480 	 * Failover and failback move logical interfaces
7481 	 * from one physical interface to another.  The
7482 	 * original index indicates the parent of a logical
7483 	 * interface, in other words, the physical interface
7484 	 * the logical interface will be moved back to on
7485 	 * failback.
7486 	 */
7487 
7488 	/*
7489 	 * Don't allow the original index to be changed
7490 	 * for non-failover addresses, autoconfigured
7491 	 * addresses, or IPv6 link local addresses.
7492 	 */
7493 	if (((ipif->ipif_flags & (IPIF_NOFAILOVER | IPIF_ADDRCONF)) != NULL) ||
7494 	    (isv6 && IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6lcl_addr))) {
7495 		return (EINVAL);
7496 	}
7497 	/*
7498 	 * The new original index must be in use by some
7499 	 * physical interface.
7500 	 */
7501 	ill = ill_lookup_on_ifindex(lifr->lifr_index, isv6, NULL, NULL,
7502 	    NULL, NULL);
7503 	if (ill == NULL)
7504 		return (ENXIO);
7505 	ill_refrele(ill);
7506 
7507 	ipif->ipif_orig_ifindex = lifr->lifr_index;
7508 	/*
7509 	 * When this ipif gets failed back, don't
7510 	 * preserve the original id, as it is no
7511 	 * longer applicable.
7512 	 */
7513 	ipif->ipif_orig_ipifid = 0;
7514 	/*
7515 	 * For IPv4, change the original index of any
7516 	 * multicast addresses associated with the
7517 	 * ipif to the new value.
7518 	 */
7519 	if (!isv6) {
7520 		ilm_t *ilm;
7521 
7522 		mutex_enter(&ipif->ipif_ill->ill_lock);
7523 		for (ilm = ipif->ipif_ill->ill_ilm; ilm != NULL;
7524 		    ilm = ilm->ilm_next) {
7525 			if (ilm->ilm_ipif == ipif) {
7526 				ilm->ilm_orig_ifindex = lifr->lifr_index;
7527 			}
7528 		}
7529 		mutex_exit(&ipif->ipif_ill->ill_lock);
7530 	}
7531 	return (0);
7532 }
7533 
7534 /* ARGSUSED */
7535 int
7536 ip_sioctl_get_oindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
7537     ip_ioctl_cmd_t *ipip, void *ifreq)
7538 {
7539 	struct lifreq *lifr = (struct lifreq *)ifreq;
7540 
7541 	/*
7542 	 * Get the original interface index i.e the one
7543 	 * before FAILOVER if it ever happened.
7544 	 */
7545 	lifr->lifr_index = ipif->ipif_orig_ifindex;
7546 	return (0);
7547 }
7548 
7549 /*
7550  * Parse an iftun_req structure coming down SIOC[GS]TUNPARAM ioctls,
7551  * refhold and return the associated ipif
7552  */
7553 int
7554 ip_extract_tunreq(queue_t *q, mblk_t *mp, ipif_t **ipifp, ipsq_func_t func)
7555 {
7556 	boolean_t exists;
7557 	struct iftun_req *ta;
7558 	ipif_t	*ipif;
7559 	ill_t	*ill;
7560 	boolean_t isv6;
7561 	mblk_t	*mp1;
7562 	int	error;
7563 	conn_t	*connp;
7564 
7565 	/* Existence verified in ip_wput_nondata */
7566 	mp1 = mp->b_cont->b_cont;
7567 	ta = (struct iftun_req *)mp1->b_rptr;
7568 	/*
7569 	 * Null terminate the string to protect against buffer
7570 	 * overrun. String was generated by user code and may not
7571 	 * be trusted.
7572 	 */
7573 	ta->ifta_lifr_name[LIFNAMSIZ - 1] = '\0';
7574 
7575 	connp = Q_TO_CONN(q);
7576 	isv6 = connp->conn_af_isv6;
7577 
7578 	/* Disallows implicit create */
7579 	ipif = ipif_lookup_on_name(ta->ifta_lifr_name,
7580 	    mi_strlen(ta->ifta_lifr_name), B_FALSE, &exists, isv6,
7581 	    connp->conn_zoneid, CONNP_TO_WQ(connp), mp, func, &error);
7582 	if (ipif == NULL)
7583 		return (error);
7584 
7585 	if (ipif->ipif_id != 0) {
7586 		/*
7587 		 * We really don't want to set/get tunnel parameters
7588 		 * on virtual tunnel interfaces.  Only allow the
7589 		 * base tunnel to do these.
7590 		 */
7591 		ipif_refrele(ipif);
7592 		return (EINVAL);
7593 	}
7594 
7595 	/*
7596 	 * Send down to tunnel mod for ioctl processing.
7597 	 * Will finish ioctl in ip_rput_other().
7598 	 */
7599 	ill = ipif->ipif_ill;
7600 	if (ill->ill_net_type == IRE_LOOPBACK) {
7601 		ipif_refrele(ipif);
7602 		return (EOPNOTSUPP);
7603 	}
7604 
7605 	if (ill->ill_wq == NULL) {
7606 		ipif_refrele(ipif);
7607 		return (ENXIO);
7608 	}
7609 	/*
7610 	 * Mark the ioctl as coming from an IPv6 interface for
7611 	 * tun's convenience.
7612 	 */
7613 	if (ill->ill_isv6)
7614 		ta->ifta_flags |= 0x80000000;
7615 	*ipifp = ipif;
7616 	return (0);
7617 }
7618 
7619 /*
7620  * Parse an ifreq or lifreq struct coming down ioctls and refhold
7621  * and return the associated ipif.
7622  * Return value:
7623  *	Non zero: An error has occurred. ci may not be filled out.
7624  *	zero : ci is filled out with the ioctl cmd in ci.ci_name, and
7625  *	a held ipif in ci.ci_ipif.
7626  */
7627 int
7628 ip_extract_lifreq_cmn(queue_t *q, mblk_t *mp, int cmd_type, int flags,
7629     cmd_info_t *ci, ipsq_func_t func)
7630 {
7631 	sin_t		*sin;
7632 	sin6_t		*sin6;
7633 	char		*name;
7634 	struct ifreq    *ifr;
7635 	struct lifreq    *lifr;
7636 	ipif_t		*ipif = NULL;
7637 	ill_t		*ill;
7638 	conn_t		*connp;
7639 	boolean_t	isv6;
7640 	struct iocblk   *iocp = (struct iocblk *)mp->b_rptr;
7641 	boolean_t	exists;
7642 	int		err;
7643 	mblk_t		*mp1;
7644 	zoneid_t	zoneid;
7645 
7646 	if (q->q_next != NULL) {
7647 		ill = (ill_t *)q->q_ptr;
7648 		isv6 = ill->ill_isv6;
7649 		connp = NULL;
7650 		zoneid = ALL_ZONES;
7651 	} else {
7652 		ill = NULL;
7653 		connp = Q_TO_CONN(q);
7654 		isv6 = connp->conn_af_isv6;
7655 		zoneid = connp->conn_zoneid;
7656 		if (zoneid == GLOBAL_ZONEID) {
7657 			/* global zone can access ipifs in all zones */
7658 			zoneid = ALL_ZONES;
7659 		}
7660 	}
7661 
7662 	/* Has been checked in ip_wput_nondata */
7663 	mp1 = mp->b_cont->b_cont;
7664 
7665 
7666 	if (cmd_type == IF_CMD) {
7667 		/* This a old style SIOC[GS]IF* command */
7668 		ifr = (struct ifreq *)mp1->b_rptr;
7669 		/*
7670 		 * Null terminate the string to protect against buffer
7671 		 * overrun. String was generated by user code and may not
7672 		 * be trusted.
7673 		 */
7674 		ifr->ifr_name[IFNAMSIZ - 1] = '\0';
7675 		sin = (sin_t *)&ifr->ifr_addr;
7676 		name = ifr->ifr_name;
7677 		ci->ci_sin = sin;
7678 		ci->ci_sin6 = NULL;
7679 		ci->ci_lifr = (struct lifreq *)ifr;
7680 	} else {
7681 		/* This a new style SIOC[GS]LIF* command */
7682 		ASSERT(cmd_type == LIF_CMD);
7683 		lifr = (struct lifreq *)mp1->b_rptr;
7684 		/*
7685 		 * Null terminate the string to protect against buffer
7686 		 * overrun. String was generated by user code and may not
7687 		 * be trusted.
7688 		 */
7689 		lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
7690 		name = lifr->lifr_name;
7691 		sin = (sin_t *)&lifr->lifr_addr;
7692 		sin6 = (sin6_t *)&lifr->lifr_addr;
7693 		if (iocp->ioc_cmd == SIOCSLIFGROUPNAME) {
7694 			(void) strncpy(ci->ci_groupname, lifr->lifr_groupname,
7695 			    LIFNAMSIZ);
7696 		}
7697 		ci->ci_sin = sin;
7698 		ci->ci_sin6 = sin6;
7699 		ci->ci_lifr = lifr;
7700 	}
7701 
7702 
7703 	if (iocp->ioc_cmd == SIOCSLIFNAME) {
7704 		/*
7705 		 * The ioctl will be failed if the ioctl comes down
7706 		 * an conn stream
7707 		 */
7708 		if (ill == NULL) {
7709 			/*
7710 			 * Not an ill queue, return EINVAL same as the
7711 			 * old error code.
7712 			 */
7713 			return (ENXIO);
7714 		}
7715 		ipif = ill->ill_ipif;
7716 		ipif_refhold(ipif);
7717 	} else {
7718 		ipif = ipif_lookup_on_name(name, mi_strlen(name), B_FALSE,
7719 		    &exists, isv6, zoneid,
7720 		    (connp == NULL) ? q : CONNP_TO_WQ(connp), mp, func, &err);
7721 		if (ipif == NULL) {
7722 			if (err == EINPROGRESS)
7723 				return (err);
7724 			if (iocp->ioc_cmd == SIOCLIFFAILOVER ||
7725 			    iocp->ioc_cmd == SIOCLIFFAILBACK) {
7726 				/*
7727 				 * Need to try both v4 and v6 since this
7728 				 * ioctl can come down either v4 or v6
7729 				 * socket. The lifreq.lifr_family passed
7730 				 * down by this ioctl is AF_UNSPEC.
7731 				 */
7732 				ipif = ipif_lookup_on_name(name,
7733 				    mi_strlen(name), B_FALSE, &exists, !isv6,
7734 				    zoneid, (connp == NULL) ? q :
7735 				    CONNP_TO_WQ(connp), mp, func, &err);
7736 				if (err == EINPROGRESS)
7737 					return (err);
7738 			}
7739 			err = 0;	/* Ensure we don't use it below */
7740 		}
7741 	}
7742 
7743 	/*
7744 	 * Old style [GS]IFCMD does not admit IPv6 ipif
7745 	 */
7746 	if (ipif != NULL && ipif->ipif_isv6 && cmd_type == IF_CMD) {
7747 		ipif_refrele(ipif);
7748 		return (ENXIO);
7749 	}
7750 
7751 	if (ipif == NULL && ill != NULL && ill->ill_ipif != NULL &&
7752 	    name[0] == '\0') {
7753 		/*
7754 		 * Handle a or a SIOC?IF* with a null name
7755 		 * during plumb (on the ill queue before the I_PLINK).
7756 		 */
7757 		ipif = ill->ill_ipif;
7758 		ipif_refhold(ipif);
7759 	}
7760 
7761 	if (ipif == NULL)
7762 		return (ENXIO);
7763 
7764 	/*
7765 	 * Allow only GET operations if this ipif has been created
7766 	 * temporarily due to a MOVE operation.
7767 	 */
7768 	if (ipif->ipif_replace_zero && !(flags & IPI_REPL)) {
7769 		ipif_refrele(ipif);
7770 		return (EINVAL);
7771 	}
7772 
7773 	ci->ci_ipif = ipif;
7774 	return (0);
7775 }
7776 
7777 /*
7778  * Return the total number of ipifs.
7779  */
7780 static uint_t
7781 ip_get_numifs(zoneid_t zoneid)
7782 {
7783 	uint_t numifs = 0;
7784 	ill_t	*ill;
7785 	ill_walk_context_t	ctx;
7786 	ipif_t	*ipif;
7787 
7788 	rw_enter(&ill_g_lock, RW_READER);
7789 	ill = ILL_START_WALK_V4(&ctx);
7790 
7791 	while (ill != NULL) {
7792 		for (ipif = ill->ill_ipif; ipif != NULL;
7793 		    ipif = ipif->ipif_next) {
7794 			if (ipif->ipif_zoneid == zoneid)
7795 				numifs++;
7796 		}
7797 		ill = ill_next(&ctx, ill);
7798 	}
7799 	rw_exit(&ill_g_lock);
7800 	return (numifs);
7801 }
7802 
7803 /*
7804  * Return the total number of ipifs.
7805  */
7806 static uint_t
7807 ip_get_numlifs(int family, int lifn_flags, zoneid_t zoneid)
7808 {
7809 	uint_t numifs = 0;
7810 	ill_t	*ill;
7811 	ipif_t	*ipif;
7812 	ill_walk_context_t	ctx;
7813 
7814 	ip1dbg(("ip_get_numlifs(%d %u %d)\n", family, lifn_flags, (int)zoneid));
7815 
7816 	rw_enter(&ill_g_lock, RW_READER);
7817 	if (family == AF_INET)
7818 		ill = ILL_START_WALK_V4(&ctx);
7819 	else if (family == AF_INET6)
7820 		ill = ILL_START_WALK_V6(&ctx);
7821 	else
7822 		ill = ILL_START_WALK_ALL(&ctx);
7823 
7824 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7825 		for (ipif = ill->ill_ipif; ipif != NULL;
7826 		    ipif = ipif->ipif_next) {
7827 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
7828 			    !(lifn_flags & LIFC_NOXMIT))
7829 				continue;
7830 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
7831 			    !(lifn_flags & LIFC_TEMPORARY))
7832 				continue;
7833 			if (((ipif->ipif_flags &
7834 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
7835 			    IPIF_DEPRECATED)) ||
7836 			    (ill->ill_phyint->phyint_flags &
7837 			    PHYI_LOOPBACK) ||
7838 			    !(ipif->ipif_flags & IPIF_UP)) &&
7839 			    (lifn_flags & LIFC_EXTERNAL_SOURCE))
7840 				continue;
7841 
7842 			if (zoneid != ipif->ipif_zoneid &&
7843 			    (zoneid != GLOBAL_ZONEID ||
7844 			    !(lifn_flags & LIFC_ALLZONES)))
7845 				continue;
7846 
7847 			numifs++;
7848 		}
7849 	}
7850 	rw_exit(&ill_g_lock);
7851 	return (numifs);
7852 }
7853 
7854 uint_t
7855 ip_get_lifsrcofnum(ill_t *ill)
7856 {
7857 	uint_t numifs = 0;
7858 	ill_t	*ill_head = ill;
7859 
7860 	/*
7861 	 * ill_g_usesrc_lock protects ill_usesrc_grp_next, for example, some
7862 	 * other thread may be trying to relink the ILLs in this usesrc group
7863 	 * and adjusting the ill_usesrc_grp_next pointers
7864 	 */
7865 	rw_enter(&ill_g_usesrc_lock, RW_READER);
7866 	if ((ill->ill_usesrc_ifindex == 0) &&
7867 	    (ill->ill_usesrc_grp_next != NULL)) {
7868 		for (; (ill != NULL) && (ill->ill_usesrc_grp_next != ill_head);
7869 		    ill = ill->ill_usesrc_grp_next)
7870 			numifs++;
7871 	}
7872 	rw_exit(&ill_g_usesrc_lock);
7873 
7874 	return (numifs);
7875 }
7876 
7877 /* Null values are passed in for ipif, sin, and ifreq */
7878 /* ARGSUSED */
7879 int
7880 ip_sioctl_get_ifnum(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7881     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7882 {
7883 	int *nump;
7884 
7885 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
7886 
7887 	/* Existence of b_cont->b_cont checked in ip_wput_nondata */
7888 	nump = (int *)mp->b_cont->b_cont->b_rptr;
7889 
7890 	*nump = ip_get_numifs(Q_TO_CONN(q)->conn_zoneid);
7891 	ip1dbg(("ip_sioctl_get_ifnum numifs %d", *nump));
7892 	return (0);
7893 }
7894 
7895 /* Null values are passed in for ipif, sin, and ifreq */
7896 /* ARGSUSED */
7897 int
7898 ip_sioctl_get_lifnum(ipif_t *dummy_ipif, sin_t *dummy_sin,
7899     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7900 {
7901 	struct lifnum *lifn;
7902 	mblk_t	*mp1;
7903 
7904 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
7905 
7906 	/* Existence checked in ip_wput_nondata */
7907 	mp1 = mp->b_cont->b_cont;
7908 
7909 	lifn = (struct lifnum *)mp1->b_rptr;
7910 	switch (lifn->lifn_family) {
7911 	case AF_UNSPEC:
7912 	case AF_INET:
7913 	case AF_INET6:
7914 		break;
7915 	default:
7916 		return (EAFNOSUPPORT);
7917 	}
7918 
7919 	lifn->lifn_count = ip_get_numlifs(lifn->lifn_family, lifn->lifn_flags,
7920 	    Q_TO_CONN(q)->conn_zoneid);
7921 	ip1dbg(("ip_sioctl_get_lifnum numifs %d", lifn->lifn_count));
7922 	return (0);
7923 }
7924 
7925 /* ARGSUSED */
7926 int
7927 ip_sioctl_get_ifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7928     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7929 {
7930 	STRUCT_HANDLE(ifconf, ifc);
7931 	mblk_t *mp1;
7932 	struct iocblk *iocp;
7933 	struct ifreq *ifr;
7934 	ill_walk_context_t	ctx;
7935 	ill_t	*ill;
7936 	ipif_t	*ipif;
7937 	struct sockaddr_in *sin;
7938 	int32_t	ifclen;
7939 	zoneid_t zoneid;
7940 
7941 	ASSERT(q->q_next == NULL); /* not valid ioctls for ip as a module */
7942 
7943 	ip1dbg(("ip_sioctl_get_ifconf"));
7944 	/* Existence verified in ip_wput_nondata */
7945 	mp1 = mp->b_cont->b_cont;
7946 	iocp = (struct iocblk *)mp->b_rptr;
7947 	zoneid = Q_TO_CONN(q)->conn_zoneid;
7948 
7949 	/*
7950 	 * The original SIOCGIFCONF passed in a struct ifconf which specified
7951 	 * the user buffer address and length into which the list of struct
7952 	 * ifreqs was to be copied.  Since AT&T Streams does not seem to
7953 	 * allow M_COPYOUT to be used in conjunction with I_STR IOCTLS,
7954 	 * the SIOCGIFCONF operation was redefined to simply provide
7955 	 * a large output buffer into which we are supposed to jam the ifreq
7956 	 * array.  The same ioctl command code was used, despite the fact that
7957 	 * both the applications and the kernel code had to change, thus making
7958 	 * it impossible to support both interfaces.
7959 	 *
7960 	 * For reasons not good enough to try to explain, the following
7961 	 * algorithm is used for deciding what to do with one of these:
7962 	 * If the IOCTL comes in as an I_STR, it is assumed to be of the new
7963 	 * form with the output buffer coming down as the continuation message.
7964 	 * If it arrives as a TRANSPARENT IOCTL, it is assumed to be old style,
7965 	 * and we have to copy in the ifconf structure to find out how big the
7966 	 * output buffer is and where to copy out to.  Sure no problem...
7967 	 *
7968 	 */
7969 	STRUCT_SET_HANDLE(ifc, iocp->ioc_flag, NULL);
7970 	if ((mp1->b_wptr - mp1->b_rptr) == STRUCT_SIZE(ifc)) {
7971 		int numifs = 0;
7972 		size_t ifc_bufsize;
7973 
7974 		/*
7975 		 * Must be (better be!) continuation of a TRANSPARENT
7976 		 * IOCTL.  We just copied in the ifconf structure.
7977 		 */
7978 		STRUCT_SET_HANDLE(ifc, iocp->ioc_flag,
7979 		    (struct ifconf *)mp1->b_rptr);
7980 
7981 		/*
7982 		 * Allocate a buffer to hold requested information.
7983 		 *
7984 		 * If ifc_len is larger than what is needed, we only
7985 		 * allocate what we will use.
7986 		 *
7987 		 * If ifc_len is smaller than what is needed, return
7988 		 * EINVAL.
7989 		 *
7990 		 * XXX: the ill_t structure can hava 2 counters, for
7991 		 * v4 and v6 (not just ill_ipif_up_count) to store the
7992 		 * number of interfaces for a device, so we don't need
7993 		 * to count them here...
7994 		 */
7995 		numifs = ip_get_numifs(zoneid);
7996 
7997 		ifclen = STRUCT_FGET(ifc, ifc_len);
7998 		ifc_bufsize = numifs * sizeof (struct ifreq);
7999 		if (ifc_bufsize > ifclen) {
8000 			if (iocp->ioc_cmd == O_SIOCGIFCONF) {
8001 				/* old behaviour */
8002 				return (EINVAL);
8003 			} else {
8004 				ifc_bufsize = ifclen;
8005 			}
8006 		}
8007 
8008 		mp1 = mi_copyout_alloc(q, mp,
8009 		    STRUCT_FGETP(ifc, ifc_buf), ifc_bufsize, B_FALSE);
8010 		if (mp1 == NULL)
8011 			return (ENOMEM);
8012 
8013 		mp1->b_wptr = mp1->b_rptr + ifc_bufsize;
8014 	}
8015 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
8016 	/*
8017 	 * the SIOCGIFCONF ioctl only knows about
8018 	 * IPv4 addresses, so don't try to tell
8019 	 * it about interfaces with IPv6-only
8020 	 * addresses. (Last parm 'isv6' is B_FALSE)
8021 	 */
8022 
8023 	ifr = (struct ifreq *)mp1->b_rptr;
8024 
8025 	rw_enter(&ill_g_lock, RW_READER);
8026 	ill = ILL_START_WALK_V4(&ctx);
8027 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8028 		for (ipif = ill->ill_ipif; ipif;
8029 		    ipif = ipif->ipif_next) {
8030 			if (zoneid != ipif->ipif_zoneid)
8031 				continue;
8032 			if ((uchar_t *)&ifr[1] > mp1->b_wptr) {
8033 				if (iocp->ioc_cmd == O_SIOCGIFCONF) {
8034 					/* old behaviour */
8035 					rw_exit(&ill_g_lock);
8036 					return (EINVAL);
8037 				} else {
8038 					goto if_copydone;
8039 				}
8040 			}
8041 			(void) ipif_get_name(ipif,
8042 			    ifr->ifr_name,
8043 			    sizeof (ifr->ifr_name));
8044 			sin = (sin_t *)&ifr->ifr_addr;
8045 			*sin = sin_null;
8046 			sin->sin_family = AF_INET;
8047 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
8048 			ifr++;
8049 		}
8050 	}
8051 if_copydone:
8052 	rw_exit(&ill_g_lock);
8053 	mp1->b_wptr = (uchar_t *)ifr;
8054 
8055 	if (STRUCT_BUF(ifc) != NULL) {
8056 		STRUCT_FSET(ifc, ifc_len,
8057 			(int)((uchar_t *)ifr - mp1->b_rptr));
8058 	}
8059 	return (0);
8060 }
8061 
8062 /*
8063  * Get the interfaces using the address hosted on the interface passed in,
8064  * as a source adddress
8065  */
8066 /* ARGSUSED */
8067 int
8068 ip_sioctl_get_lifsrcof(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8069     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8070 {
8071 	mblk_t *mp1;
8072 	ill_t	*ill, *ill_head;
8073 	ipif_t	*ipif, *orig_ipif;
8074 	int	numlifs = 0;
8075 	size_t	lifs_bufsize, lifsmaxlen;
8076 	struct	lifreq *lifr;
8077 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8078 	uint_t	ifindex;
8079 	zoneid_t zoneid;
8080 	int err = 0;
8081 	boolean_t isv6 = B_FALSE;
8082 	struct	sockaddr_in	*sin;
8083 	struct	sockaddr_in6	*sin6;
8084 
8085 	STRUCT_HANDLE(lifsrcof, lifs);
8086 
8087 	ASSERT(q->q_next == NULL);
8088 
8089 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8090 
8091 	/* Existence verified in ip_wput_nondata */
8092 	mp1 = mp->b_cont->b_cont;
8093 
8094 	/*
8095 	 * Must be (better be!) continuation of a TRANSPARENT
8096 	 * IOCTL.  We just copied in the lifsrcof structure.
8097 	 */
8098 	STRUCT_SET_HANDLE(lifs, iocp->ioc_flag,
8099 	    (struct lifsrcof *)mp1->b_rptr);
8100 
8101 	if (MBLKL(mp1) != STRUCT_SIZE(lifs))
8102 		return (EINVAL);
8103 
8104 	ifindex = STRUCT_FGET(lifs, lifs_ifindex);
8105 	isv6 = (Q_TO_CONN(q))->conn_af_isv6;
8106 	ipif = ipif_lookup_on_ifindex(ifindex, isv6, zoneid, q, mp,
8107 	    ip_process_ioctl, &err);
8108 	if (ipif == NULL) {
8109 		ip1dbg(("ip_sioctl_get_lifsrcof: no ipif for ifindex %d\n",
8110 		    ifindex));
8111 		return (err);
8112 	}
8113 
8114 
8115 	/* Allocate a buffer to hold requested information */
8116 	numlifs = ip_get_lifsrcofnum(ipif->ipif_ill);
8117 	lifs_bufsize = numlifs * sizeof (struct lifreq);
8118 	lifsmaxlen =  STRUCT_FGET(lifs, lifs_maxlen);
8119 	/* The actual size needed is always returned in lifs_len */
8120 	STRUCT_FSET(lifs, lifs_len, lifs_bufsize);
8121 
8122 	/* If the amount we need is more than what is passed in, abort */
8123 	if (lifs_bufsize > lifsmaxlen || lifs_bufsize == 0) {
8124 		ipif_refrele(ipif);
8125 		return (0);
8126 	}
8127 
8128 	mp1 = mi_copyout_alloc(q, mp,
8129 	    STRUCT_FGETP(lifs, lifs_buf), lifs_bufsize, B_FALSE);
8130 	if (mp1 == NULL) {
8131 		ipif_refrele(ipif);
8132 		return (ENOMEM);
8133 	}
8134 
8135 	mp1->b_wptr = mp1->b_rptr + lifs_bufsize;
8136 	bzero(mp1->b_rptr, lifs_bufsize);
8137 
8138 	lifr = (struct lifreq *)mp1->b_rptr;
8139 
8140 	ill = ill_head = ipif->ipif_ill;
8141 	orig_ipif = ipif;
8142 
8143 	/* ill_g_usesrc_lock protects ill_usesrc_grp_next */
8144 	rw_enter(&ill_g_usesrc_lock, RW_READER);
8145 	rw_enter(&ill_g_lock, RW_READER);
8146 
8147 	ill = ill->ill_usesrc_grp_next; /* start from next ill */
8148 	for (; (ill != NULL) && (ill != ill_head);
8149 	    ill = ill->ill_usesrc_grp_next) {
8150 
8151 		if ((uchar_t *)&lifr[1] > mp1->b_wptr)
8152 			break;
8153 
8154 		ipif = ill->ill_ipif;
8155 		(void) ipif_get_name(ipif,
8156 		    lifr->lifr_name, sizeof (lifr->lifr_name));
8157 		if (ipif->ipif_isv6) {
8158 			sin6 = (sin6_t *)&lifr->lifr_addr;
8159 			*sin6 = sin6_null;
8160 			sin6->sin6_family = AF_INET6;
8161 			sin6->sin6_addr = ipif->ipif_v6lcl_addr;
8162 			lifr->lifr_addrlen = ip_mask_to_plen_v6(
8163 			    &ipif->ipif_v6net_mask);
8164 		} else {
8165 			sin = (sin_t *)&lifr->lifr_addr;
8166 			*sin = sin_null;
8167 			sin->sin_family = AF_INET;
8168 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
8169 			lifr->lifr_addrlen = ip_mask_to_plen(
8170 			    ipif->ipif_net_mask);
8171 		}
8172 		lifr++;
8173 	}
8174 	rw_exit(&ill_g_usesrc_lock);
8175 	rw_exit(&ill_g_lock);
8176 	ipif_refrele(orig_ipif);
8177 	mp1->b_wptr = (uchar_t *)lifr;
8178 	STRUCT_FSET(lifs, lifs_len, (int)((uchar_t *)lifr - mp1->b_rptr));
8179 
8180 	return (0);
8181 }
8182 
8183 /* ARGSUSED */
8184 int
8185 ip_sioctl_get_lifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8186     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8187 {
8188 	mblk_t *mp1;
8189 	int	list;
8190 	ill_t	*ill;
8191 	ipif_t	*ipif;
8192 	int	flags;
8193 	int	numlifs = 0;
8194 	size_t	lifc_bufsize;
8195 	struct	lifreq *lifr;
8196 	sa_family_t	family;
8197 	struct	sockaddr_in	*sin;
8198 	struct	sockaddr_in6	*sin6;
8199 	ill_walk_context_t	ctx;
8200 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8201 	int32_t	lifclen;
8202 	zoneid_t zoneid;
8203 	STRUCT_HANDLE(lifconf, lifc);
8204 
8205 	ip1dbg(("ip_sioctl_get_lifconf"));
8206 
8207 	ASSERT(q->q_next == NULL);
8208 
8209 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8210 
8211 	/* Existence verified in ip_wput_nondata */
8212 	mp1 = mp->b_cont->b_cont;
8213 
8214 	/*
8215 	 * An extended version of SIOCGIFCONF that takes an
8216 	 * additional address family and flags field.
8217 	 * AF_UNSPEC retrieve both IPv4 and IPv6.
8218 	 * Unless LIFC_NOXMIT is specified the IPIF_NOXMIT
8219 	 * interfaces are omitted.
8220 	 * Similarly, IPIF_TEMPORARY interfaces are omitted
8221 	 * unless LIFC_TEMPORARY is specified.
8222 	 * If LIFC_EXTERNAL_SOURCE is specified, IPIF_NOXMIT,
8223 	 * IPIF_NOLOCAL, PHYI_LOOPBACK, IPIF_DEPRECATED and
8224 	 * not IPIF_UP interfaces are omitted. LIFC_EXTERNAL_SOURCE
8225 	 * has priority over LIFC_NOXMIT.
8226 	 */
8227 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, NULL);
8228 
8229 	if ((mp1->b_wptr - mp1->b_rptr) != STRUCT_SIZE(lifc))
8230 		return (EINVAL);
8231 
8232 	/*
8233 	 * Must be (better be!) continuation of a TRANSPARENT
8234 	 * IOCTL.  We just copied in the lifconf structure.
8235 	 */
8236 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, (struct lifconf *)mp1->b_rptr);
8237 
8238 	family = STRUCT_FGET(lifc, lifc_family);
8239 	flags = STRUCT_FGET(lifc, lifc_flags);
8240 
8241 	switch (family) {
8242 	case AF_UNSPEC:
8243 		/*
8244 		 * walk all ILL's.
8245 		 */
8246 		list = MAX_G_HEADS;
8247 		break;
8248 	case AF_INET:
8249 		/*
8250 		 * walk only IPV4 ILL's.
8251 		 */
8252 		list = IP_V4_G_HEAD;
8253 		break;
8254 	case AF_INET6:
8255 		/*
8256 		 * walk only IPV6 ILL's.
8257 		 */
8258 		list = IP_V6_G_HEAD;
8259 		break;
8260 	default:
8261 		return (EAFNOSUPPORT);
8262 	}
8263 
8264 	/*
8265 	 * Allocate a buffer to hold requested information.
8266 	 *
8267 	 * If lifc_len is larger than what is needed, we only
8268 	 * allocate what we will use.
8269 	 *
8270 	 * If lifc_len is smaller than what is needed, return
8271 	 * EINVAL.
8272 	 */
8273 	numlifs = ip_get_numlifs(family, flags, zoneid);
8274 	lifc_bufsize = numlifs * sizeof (struct lifreq);
8275 	lifclen = STRUCT_FGET(lifc, lifc_len);
8276 	if (lifc_bufsize > lifclen) {
8277 		if (iocp->ioc_cmd == O_SIOCGLIFCONF)
8278 			return (EINVAL);
8279 		else
8280 			lifc_bufsize = lifclen;
8281 	}
8282 
8283 	mp1 = mi_copyout_alloc(q, mp,
8284 	    STRUCT_FGETP(lifc, lifc_buf), lifc_bufsize, B_FALSE);
8285 	if (mp1 == NULL)
8286 		return (ENOMEM);
8287 
8288 	mp1->b_wptr = mp1->b_rptr + lifc_bufsize;
8289 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
8290 
8291 	lifr = (struct lifreq *)mp1->b_rptr;
8292 
8293 	rw_enter(&ill_g_lock, RW_READER);
8294 	ill = ill_first(list, list, &ctx);
8295 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8296 		for (ipif = ill->ill_ipif; ipif != NULL;
8297 		    ipif = ipif->ipif_next) {
8298 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
8299 			    !(flags & LIFC_NOXMIT))
8300 				continue;
8301 
8302 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
8303 			    !(flags & LIFC_TEMPORARY))
8304 				continue;
8305 
8306 			if (((ipif->ipif_flags &
8307 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
8308 			    IPIF_DEPRECATED)) ||
8309 			    (ill->ill_phyint->phyint_flags &
8310 			    PHYI_LOOPBACK) ||
8311 			    !(ipif->ipif_flags & IPIF_UP)) &&
8312 			    (flags & LIFC_EXTERNAL_SOURCE))
8313 				continue;
8314 
8315 			if (zoneid != ipif->ipif_zoneid &&
8316 			    (zoneid != GLOBAL_ZONEID ||
8317 			    !(flags & LIFC_ALLZONES)))
8318 				continue;
8319 
8320 			if ((uchar_t *)&lifr[1] > mp1->b_wptr) {
8321 				if (iocp->ioc_cmd == O_SIOCGLIFCONF) {
8322 					rw_exit(&ill_g_lock);
8323 					return (EINVAL);
8324 				} else {
8325 					goto lif_copydone;
8326 				}
8327 			}
8328 
8329 			(void) ipif_get_name(ipif,
8330 				lifr->lifr_name,
8331 				sizeof (lifr->lifr_name));
8332 			if (ipif->ipif_isv6) {
8333 				sin6 = (sin6_t *)&lifr->lifr_addr;
8334 				*sin6 = sin6_null;
8335 				sin6->sin6_family = AF_INET6;
8336 				sin6->sin6_addr =
8337 				ipif->ipif_v6lcl_addr;
8338 				lifr->lifr_addrlen =
8339 				ip_mask_to_plen_v6(
8340 				    &ipif->ipif_v6net_mask);
8341 			} else {
8342 				sin = (sin_t *)&lifr->lifr_addr;
8343 				*sin = sin_null;
8344 				sin->sin_family = AF_INET;
8345 				sin->sin_addr.s_addr =
8346 				    ipif->ipif_lcl_addr;
8347 				lifr->lifr_addrlen =
8348 				    ip_mask_to_plen(
8349 				    ipif->ipif_net_mask);
8350 			}
8351 			lifr++;
8352 		}
8353 	}
8354 lif_copydone:
8355 	rw_exit(&ill_g_lock);
8356 
8357 	mp1->b_wptr = (uchar_t *)lifr;
8358 	if (STRUCT_BUF(lifc) != NULL) {
8359 		STRUCT_FSET(lifc, lifc_len,
8360 			(int)((uchar_t *)lifr - mp1->b_rptr));
8361 	}
8362 	return (0);
8363 }
8364 
8365 /* ARGSUSED */
8366 int
8367 ip_sioctl_set_ipmpfailback(ipif_t *dummy_ipif, sin_t *dummy_sin,
8368     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8369 {
8370 	/* Existence of b_cont->b_cont checked in ip_wput_nondata */
8371 	ipmp_enable_failback = *(int *)mp->b_cont->b_cont->b_rptr;
8372 	return (0);
8373 }
8374 
8375 static void
8376 ip_sioctl_ip6addrpolicy(queue_t *q, mblk_t *mp)
8377 {
8378 	ip6_asp_t *table;
8379 	size_t table_size;
8380 	mblk_t *data_mp;
8381 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8382 
8383 	/* These two ioctls are I_STR only */
8384 	if (iocp->ioc_count == TRANSPARENT) {
8385 		miocnak(q, mp, 0, EINVAL);
8386 		return;
8387 	}
8388 
8389 	data_mp = mp->b_cont;
8390 	if (data_mp == NULL) {
8391 		/* The user passed us a NULL argument */
8392 		table = NULL;
8393 		table_size = iocp->ioc_count;
8394 	} else {
8395 		/*
8396 		 * The user provided a table.  The stream head
8397 		 * may have copied in the user data in chunks,
8398 		 * so make sure everything is pulled up
8399 		 * properly.
8400 		 */
8401 		if (MBLKL(data_mp) < iocp->ioc_count) {
8402 			mblk_t *new_data_mp;
8403 			if ((new_data_mp = msgpullup(data_mp, -1)) ==
8404 			    NULL) {
8405 				miocnak(q, mp, 0, ENOMEM);
8406 				return;
8407 			}
8408 			freemsg(data_mp);
8409 			data_mp = new_data_mp;
8410 			mp->b_cont = data_mp;
8411 		}
8412 		table = (ip6_asp_t *)data_mp->b_rptr;
8413 		table_size = iocp->ioc_count;
8414 	}
8415 
8416 	switch (iocp->ioc_cmd) {
8417 	case SIOCGIP6ADDRPOLICY:
8418 		iocp->ioc_rval = ip6_asp_get(table, table_size);
8419 		if (iocp->ioc_rval == -1)
8420 			iocp->ioc_error = EINVAL;
8421 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
8422 		else if (table != NULL &&
8423 		    (iocp->ioc_flag & IOC_MODELS) == IOC_ILP32) {
8424 			ip6_asp_t *src = table;
8425 			ip6_asp32_t *dst = (void *)table;
8426 			int count = table_size / sizeof (ip6_asp_t);
8427 			int i;
8428 
8429 			/*
8430 			 * We need to do an in-place shrink of the array
8431 			 * to match the alignment attributes of the
8432 			 * 32-bit ABI looking at it.
8433 			 */
8434 			/* LINTED: logical expression always true: op "||" */
8435 			ASSERT(sizeof (*src) > sizeof (*dst));
8436 			for (i = 1; i < count; i++)
8437 				bcopy(src + i, dst + i, sizeof (*dst));
8438 		}
8439 #endif
8440 		break;
8441 
8442 	case SIOCSIP6ADDRPOLICY:
8443 		ASSERT(mp->b_prev == NULL);
8444 		mp->b_prev = (void *)q;
8445 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
8446 		/*
8447 		 * We pass in the datamodel here so that the ip6_asp_replace()
8448 		 * routine can handle converting from 32-bit to native formats
8449 		 * where necessary.
8450 		 *
8451 		 * A better way to handle this might be to convert the inbound
8452 		 * data structure here, and hang it off a new 'mp'; thus the
8453 		 * ip6_asp_replace() logic would always be dealing with native
8454 		 * format data structures..
8455 		 *
8456 		 * (An even simpler way to handle these ioctls is to just
8457 		 * add a 32-bit trailing 'pad' field to the ip6_asp_t structure
8458 		 * and just recompile everything that depends on it.)
8459 		 */
8460 #endif
8461 		ip6_asp_replace(mp, table, table_size, B_FALSE,
8462 		    iocp->ioc_flag & IOC_MODELS);
8463 		return;
8464 	}
8465 
8466 	DB_TYPE(mp) =  (iocp->ioc_error == 0) ? M_IOCACK : M_IOCNAK;
8467 	qreply(q, mp);
8468 }
8469 
8470 static void
8471 ip_sioctl_dstinfo(queue_t *q, mblk_t *mp)
8472 {
8473 	mblk_t 		*data_mp;
8474 	struct dstinforeq	*dir;
8475 	uint8_t		*end, *cur;
8476 	in6_addr_t	*daddr, *saddr;
8477 	ipaddr_t	v4daddr;
8478 	ire_t		*ire;
8479 	char		*slabel, *dlabel;
8480 	boolean_t	isipv4;
8481 	int		match_ire;
8482 	ill_t		*dst_ill;
8483 	ipif_t		*src_ipif, *ire_ipif;
8484 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8485 	zoneid_t	zoneid;
8486 
8487 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8488 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8489 
8490 	/*
8491 	 * This ioctl is I_STR only, and must have a
8492 	 * data mblk following the M_IOCTL mblk.
8493 	 */
8494 	data_mp = mp->b_cont;
8495 	if (iocp->ioc_count == TRANSPARENT || data_mp == NULL) {
8496 		miocnak(q, mp, 0, EINVAL);
8497 		return;
8498 	}
8499 
8500 	if (MBLKL(data_mp) < iocp->ioc_count) {
8501 		mblk_t *new_data_mp;
8502 
8503 		if ((new_data_mp = msgpullup(data_mp, -1)) == NULL) {
8504 			miocnak(q, mp, 0, ENOMEM);
8505 			return;
8506 		}
8507 		freemsg(data_mp);
8508 		data_mp = new_data_mp;
8509 		mp->b_cont = data_mp;
8510 	}
8511 	match_ire = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | MATCH_IRE_PARENT;
8512 
8513 	for (cur = data_mp->b_rptr, end = data_mp->b_wptr;
8514 	    end - cur >= sizeof (struct dstinforeq);
8515 	    cur += sizeof (struct dstinforeq)) {
8516 		dir = (struct dstinforeq *)cur;
8517 		daddr = &dir->dir_daddr;
8518 		saddr = &dir->dir_saddr;
8519 
8520 		/*
8521 		 * ip_addr_scope_v6() and ip6_asp_lookup() handle
8522 		 * v4 mapped addresses; ire_ftable_lookup[_v6]()
8523 		 * and ipif_select_source[_v6]() do not.
8524 		 */
8525 		dir->dir_dscope = ip_addr_scope_v6(daddr);
8526 		dlabel = ip6_asp_lookup(daddr, &dir->dir_precedence);
8527 
8528 		isipv4 = IN6_IS_ADDR_V4MAPPED(daddr);
8529 		if (isipv4) {
8530 			IN6_V4MAPPED_TO_IPADDR(daddr, v4daddr);
8531 			ire = ire_ftable_lookup(v4daddr, NULL, NULL,
8532 			    0, NULL, NULL, zoneid, 0, match_ire);
8533 		} else {
8534 			ire = ire_ftable_lookup_v6(daddr, NULL, NULL,
8535 			    0, NULL, NULL, zoneid, 0, match_ire);
8536 		}
8537 		if (ire == NULL) {
8538 			dir->dir_dreachable = 0;
8539 
8540 			/* move on to next dst addr */
8541 			continue;
8542 		}
8543 		dir->dir_dreachable = 1;
8544 
8545 		ire_ipif = ire->ire_ipif;
8546 		if (ire_ipif == NULL)
8547 			goto next_dst;
8548 
8549 		/*
8550 		 * We expect to get back an interface ire or a
8551 		 * gateway ire cache entry.  For both types, the
8552 		 * output interface is ire_ipif->ipif_ill.
8553 		 */
8554 		dst_ill = ire_ipif->ipif_ill;
8555 		dir->dir_dmactype = dst_ill->ill_mactype;
8556 
8557 		if (isipv4) {
8558 			src_ipif = ipif_select_source(dst_ill, v4daddr, zoneid);
8559 		} else {
8560 			src_ipif = ipif_select_source_v6(dst_ill,
8561 			    daddr, B_FALSE, IPV6_PREFER_SRC_DEFAULT,
8562 			    zoneid);
8563 		}
8564 		if (src_ipif == NULL)
8565 			goto next_dst;
8566 
8567 		*saddr = src_ipif->ipif_v6lcl_addr;
8568 		dir->dir_sscope = ip_addr_scope_v6(saddr);
8569 		slabel = ip6_asp_lookup(saddr, NULL);
8570 		dir->dir_labelmatch = ip6_asp_labelcmp(dlabel, slabel);
8571 		dir->dir_sdeprecated =
8572 		    (src_ipif->ipif_flags & IPIF_DEPRECATED) ? 1 : 0;
8573 		ipif_refrele(src_ipif);
8574 next_dst:
8575 		ire_refrele(ire);
8576 	}
8577 	miocack(q, mp, iocp->ioc_count, 0);
8578 }
8579 
8580 
8581 /*
8582  * Check if this is an address assigned to this machine.
8583  * Skips interfaces that are down by using ire checks.
8584  * Translates mapped addresses to v4 addresses and then
8585  * treats them as such, returning true if the v4 address
8586  * associated with this mapped address is configured.
8587  * Note: Applications will have to be careful what they do
8588  * with the response; use of mapped addresses limits
8589  * what can be done with the socket, especially with
8590  * respect to socket options and ioctls - neither IPv4
8591  * options nor IPv6 sticky options/ancillary data options
8592  * may be used.
8593  */
8594 /* ARGSUSED */
8595 int
8596 ip_sioctl_tmyaddr(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8597     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
8598 {
8599 	struct sioc_addrreq *sia;
8600 	sin_t *sin;
8601 	ire_t *ire;
8602 	mblk_t *mp1;
8603 	zoneid_t zoneid;
8604 
8605 	ip1dbg(("ip_sioctl_tmyaddr"));
8606 
8607 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8608 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8609 
8610 	/* Existence verified in ip_wput_nondata */
8611 	mp1 = mp->b_cont->b_cont;
8612 	sia = (struct sioc_addrreq *)mp1->b_rptr;
8613 	sin = (sin_t *)&sia->sa_addr;
8614 	switch (sin->sin_family) {
8615 	case AF_INET6: {
8616 		sin6_t *sin6 = (sin6_t *)sin;
8617 
8618 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
8619 			ipaddr_t v4_addr;
8620 
8621 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
8622 			    v4_addr);
8623 			ire = ire_ctable_lookup(v4_addr, 0,
8624 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
8625 			    MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY);
8626 		} else {
8627 			in6_addr_t v6addr;
8628 
8629 			v6addr = sin6->sin6_addr;
8630 			ire = ire_ctable_lookup_v6(&v6addr, 0,
8631 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
8632 			    MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY);
8633 		}
8634 		break;
8635 	}
8636 	case AF_INET: {
8637 		ipaddr_t v4addr;
8638 
8639 		v4addr = sin->sin_addr.s_addr;
8640 		ire = ire_ctable_lookup(v4addr, 0,
8641 		    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
8642 		    MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY);
8643 		break;
8644 	}
8645 	default:
8646 		return (EAFNOSUPPORT);
8647 	}
8648 	if (ire != NULL) {
8649 		sia->sa_res = 1;
8650 		ire_refrele(ire);
8651 	} else {
8652 		sia->sa_res = 0;
8653 	}
8654 	return (0);
8655 }
8656 
8657 /*
8658  * Check if this is an address assigned on-link i.e. neighbor,
8659  * and makes sure it's reachable from the current zone.
8660  * Returns true for my addresses as well.
8661  * Translates mapped addresses to v4 addresses and then
8662  * treats them as such, returning true if the v4 address
8663  * associated with this mapped address is configured.
8664  * Note: Applications will have to be careful what they do
8665  * with the response; use of mapped addresses limits
8666  * what can be done with the socket, especially with
8667  * respect to socket options and ioctls - neither IPv4
8668  * options nor IPv6 sticky options/ancillary data options
8669  * may be used.
8670  */
8671 /* ARGSUSED */
8672 int
8673 ip_sioctl_tonlink(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8674     ip_ioctl_cmd_t *ipip, void *duymmy_ifreq)
8675 {
8676 	struct sioc_addrreq *sia;
8677 	sin_t *sin;
8678 	mblk_t	*mp1;
8679 	ire_t *ire = NULL;
8680 	zoneid_t zoneid;
8681 
8682 	ip1dbg(("ip_sioctl_tonlink"));
8683 
8684 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8685 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8686 
8687 	/* Existence verified in ip_wput_nondata */
8688 	mp1 = mp->b_cont->b_cont;
8689 	sia = (struct sioc_addrreq *)mp1->b_rptr;
8690 	sin = (sin_t *)&sia->sa_addr;
8691 
8692 	/*
8693 	 * Match addresses with a zero gateway field to avoid
8694 	 * routes going through a router.
8695 	 * Exclude broadcast and multicast addresses.
8696 	 */
8697 	switch (sin->sin_family) {
8698 	case AF_INET6: {
8699 		sin6_t *sin6 = (sin6_t *)sin;
8700 
8701 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
8702 			ipaddr_t v4_addr;
8703 
8704 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
8705 			    v4_addr);
8706 			if (!CLASSD(v4_addr)) {
8707 				ire = ire_route_lookup(v4_addr, 0, 0, 0,
8708 				    NULL, NULL, zoneid, MATCH_IRE_GW);
8709 			}
8710 		} else {
8711 			in6_addr_t v6addr;
8712 			in6_addr_t v6gw;
8713 
8714 			v6addr = sin6->sin6_addr;
8715 			v6gw = ipv6_all_zeros;
8716 			if (!IN6_IS_ADDR_MULTICAST(&v6addr)) {
8717 				ire = ire_route_lookup_v6(&v6addr, 0,
8718 				    &v6gw, 0, NULL, NULL, zoneid,
8719 				    MATCH_IRE_GW);
8720 			}
8721 		}
8722 		break;
8723 	}
8724 	case AF_INET: {
8725 		ipaddr_t v4addr;
8726 
8727 		v4addr = sin->sin_addr.s_addr;
8728 		if (!CLASSD(v4addr)) {
8729 			ire = ire_route_lookup(v4addr, 0, 0, 0,
8730 			    NULL, NULL, zoneid, MATCH_IRE_GW);
8731 		}
8732 		break;
8733 	}
8734 	default:
8735 		return (EAFNOSUPPORT);
8736 	}
8737 	sia->sa_res = 0;
8738 	if (ire != NULL) {
8739 		if (ire->ire_type & (IRE_INTERFACE|IRE_CACHE|
8740 		    IRE_LOCAL|IRE_LOOPBACK)) {
8741 			sia->sa_res = 1;
8742 		}
8743 		ire_refrele(ire);
8744 	}
8745 	return (0);
8746 }
8747 
8748 /*
8749  * TBD: implement when kernel maintaines a list of site prefixes.
8750  */
8751 /* ARGSUSED */
8752 int
8753 ip_sioctl_tmysite(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
8754     ip_ioctl_cmd_t *ipip, void *ifreq)
8755 {
8756 	return (ENXIO);
8757 }
8758 
8759 /* ARGSUSED */
8760 int
8761 ip_sioctl_tunparam(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8762     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
8763 {
8764 	ill_t  		*ill;
8765 	mblk_t		*mp1;
8766 	conn_t		*connp;
8767 	boolean_t	success;
8768 
8769 	ip1dbg(("ip_sioctl_tunparam(%s:%u %p)\n",
8770 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
8771 	/* ioctl comes down on an conn */
8772 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
8773 	connp = Q_TO_CONN(q);
8774 
8775 	mp->b_datap->db_type = M_IOCTL;
8776 
8777 	/*
8778 	 * Send down a copy. (copymsg does not copy b_next/b_prev).
8779 	 * The original mp contains contaminated b_next values due to 'mi',
8780 	 * which is needed to do the mi_copy_done. Unfortunately if we
8781 	 * send down the original mblk itself and if we are popped due to an
8782 	 * an unplumb before the response comes back from tunnel,
8783 	 * the streamhead (which does a freemsg) will see this contaminated
8784 	 * message and the assertion in freemsg about non-null b_next/b_prev
8785 	 * will panic a DEBUG kernel.
8786 	 */
8787 	mp1 = copymsg(mp);
8788 	if (mp1 == NULL)
8789 		return (ENOMEM);
8790 
8791 	ill = ipif->ipif_ill;
8792 	mutex_enter(&connp->conn_lock);
8793 	mutex_enter(&ill->ill_lock);
8794 	if (ipip->ipi_cmd == SIOCSTUNPARAM || ipip->ipi_cmd == OSIOCSTUNPARAM) {
8795 		success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp),
8796 		    mp, 0);
8797 	} else {
8798 		success = ill_pending_mp_add(ill, connp, mp);
8799 	}
8800 	mutex_exit(&ill->ill_lock);
8801 	mutex_exit(&connp->conn_lock);
8802 
8803 	if (success) {
8804 		ip1dbg(("sending down tunparam request "));
8805 		putnext(ill->ill_wq, mp1);
8806 		return (EINPROGRESS);
8807 	} else {
8808 		/* The conn has started closing */
8809 		freemsg(mp1);
8810 		return (EINTR);
8811 	}
8812 }
8813 
8814 static int
8815 ip_sioctl_arp_common(ill_t *ill, queue_t *q, mblk_t *mp, sin_t *sin,
8816     boolean_t x_arp_ioctl, boolean_t if_arp_ioctl)
8817 {
8818 	mblk_t *mp1;
8819 	mblk_t *mp2;
8820 	mblk_t *pending_mp;
8821 	ipaddr_t ipaddr;
8822 	area_t *area;
8823 	struct iocblk *iocp;
8824 	conn_t *connp;
8825 	struct arpreq *ar;
8826 	struct xarpreq *xar;
8827 	boolean_t success;
8828 	int flags, alength;
8829 	char *lladdr;
8830 
8831 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
8832 	connp = Q_TO_CONN(q);
8833 
8834 	iocp = (struct iocblk *)mp->b_rptr;
8835 	/*
8836 	 * ill has already been set depending on whether
8837 	 * bsd style or interface style ioctl.
8838 	 */
8839 	ASSERT(ill != NULL);
8840 
8841 	/*
8842 	 * Is this one of the new SIOC*XARP ioctls?
8843 	 */
8844 	if (x_arp_ioctl) {
8845 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->XARPREQ_MBLK */
8846 		xar = (struct xarpreq *)mp->b_cont->b_cont->b_rptr;
8847 		ar = NULL;
8848 
8849 		flags = xar->xarp_flags;
8850 		lladdr = LLADDR(&xar->xarp_ha);
8851 		/*
8852 		 * Validate against user's link layer address length
8853 		 * input and name and addr length limits.
8854 		 */
8855 		alength = ill->ill_phys_addr_length;
8856 		if (iocp->ioc_cmd == SIOCSXARP) {
8857 			if (alength != xar->xarp_ha.sdl_alen ||
8858 			    (alength + xar->xarp_ha.sdl_nlen >
8859 			    sizeof (xar->xarp_ha.sdl_data)))
8860 				return (EINVAL);
8861 		}
8862 	} else {
8863 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->ARPREQ_MBLK */
8864 		ar = (struct arpreq *)mp->b_cont->b_cont->b_rptr;
8865 		xar = NULL;
8866 
8867 		flags = ar->arp_flags;
8868 		lladdr = ar->arp_ha.sa_data;
8869 		/*
8870 		 * Theoretically, the sa_family could tell us what link
8871 		 * layer type this operation is trying to deal with. By
8872 		 * common usage AF_UNSPEC means ethernet. We'll assume
8873 		 * any attempt to use the SIOC?ARP ioctls is for ethernet,
8874 		 * for now. Our new SIOC*XARP ioctls can be used more
8875 		 * generally.
8876 		 *
8877 		 * If the underlying media happens to have a non 6 byte
8878 		 * address, arp module will fail set/get, but the del
8879 		 * operation will succeed.
8880 		 */
8881 		alength = 6;
8882 		if ((iocp->ioc_cmd != SIOCDARP) &&
8883 		    (alength != ill->ill_phys_addr_length)) {
8884 			return (EINVAL);
8885 		}
8886 	}
8887 
8888 	/*
8889 	 * We are going to pass up to ARP a packet chain that looks
8890 	 * like:
8891 	 *
8892 	 * M_IOCTL-->ARP_op_MBLK-->ORIG_M_IOCTL-->MI_COPY_MBLK-->[X]ARPREQ_MBLK
8893 	 *
8894 	 * Get a copy of the original IOCTL mblk to head the chain,
8895 	 * to be sent up (in mp1). Also get another copy to store
8896 	 * in the ill_pending_mp list, for matching the response
8897 	 * when it comes back from ARP.
8898 	 */
8899 	mp1 = copyb(mp);
8900 	pending_mp = copymsg(mp);
8901 	if (mp1 == NULL || pending_mp == NULL) {
8902 		if (mp1 != NULL)
8903 			freeb(mp1);
8904 		if (pending_mp != NULL)
8905 			inet_freemsg(pending_mp);
8906 		return (ENOMEM);
8907 	}
8908 
8909 	ipaddr = sin->sin_addr.s_addr;
8910 
8911 	mp2 = ill_arp_alloc(ill, (uchar_t *)&ip_area_template,
8912 	    (caddr_t)&ipaddr);
8913 	if (mp2 == NULL) {
8914 		freeb(mp1);
8915 		inet_freemsg(pending_mp);
8916 		return (ENOMEM);
8917 	}
8918 	/* Put together the chain. */
8919 	mp1->b_cont = mp2;
8920 	mp1->b_datap->db_type = M_IOCTL;
8921 	mp2->b_cont = mp;
8922 	mp2->b_datap->db_type = M_DATA;
8923 
8924 	iocp = (struct iocblk *)mp1->b_rptr;
8925 
8926 	/*
8927 	 * An M_IOCDATA's payload (struct copyresp) is mostly the same as an
8928 	 * M_IOCTL's payload (struct iocblk), but 'struct copyresp' has a
8929 	 * cp_private field (or cp_rval on 32-bit systems) in place of the
8930 	 * ioc_count field; set ioc_count to be correct.
8931 	 */
8932 	iocp->ioc_count = MBLKL(mp1->b_cont);
8933 
8934 	/*
8935 	 * Set the proper command in the ARP message.
8936 	 * Convert the SIOC{G|S|D}ARP calls into our
8937 	 * AR_ENTRY_xxx calls.
8938 	 */
8939 	area = (area_t *)mp2->b_rptr;
8940 	switch (iocp->ioc_cmd) {
8941 	case SIOCDARP:
8942 	case SIOCDXARP:
8943 		/*
8944 		 * We defer deleting the corresponding IRE until
8945 		 * we return from arp.
8946 		 */
8947 		area->area_cmd = AR_ENTRY_DELETE;
8948 		area->area_proto_mask_offset = 0;
8949 		break;
8950 	case SIOCGARP:
8951 	case SIOCGXARP:
8952 		area->area_cmd = AR_ENTRY_SQUERY;
8953 		area->area_proto_mask_offset = 0;
8954 		break;
8955 	case SIOCSARP:
8956 	case SIOCSXARP: {
8957 		/*
8958 		 * Delete the corresponding ire to make sure IP will
8959 		 * pick up any change from arp.
8960 		 */
8961 		if (!if_arp_ioctl) {
8962 			(void) ip_ire_clookup_and_delete(ipaddr, NULL);
8963 			break;
8964 		} else {
8965 			ipif_t *ipif = ipif_get_next_ipif(NULL, ill);
8966 			if (ipif != NULL) {
8967 				(void) ip_ire_clookup_and_delete(ipaddr, ipif);
8968 				ipif_refrele(ipif);
8969 			}
8970 			break;
8971 		}
8972 	}
8973 	}
8974 	iocp->ioc_cmd = area->area_cmd;
8975 
8976 	/*
8977 	 * Before sending 'mp' to ARP, we have to clear the b_next
8978 	 * and b_prev. Otherwise if STREAMS encounters such a message
8979 	 * in freemsg(), (because ARP can close any time) it can cause
8980 	 * a panic. But mi code needs the b_next and b_prev values of
8981 	 * mp->b_cont, to complete the ioctl. So we store it here
8982 	 * in pending_mp->bcont, and restore it in ip_sioctl_iocack()
8983 	 * when the response comes down from ARP.
8984 	 */
8985 	pending_mp->b_cont->b_next = mp->b_cont->b_next;
8986 	pending_mp->b_cont->b_prev = mp->b_cont->b_prev;
8987 	mp->b_cont->b_next = NULL;
8988 	mp->b_cont->b_prev = NULL;
8989 
8990 	mutex_enter(&connp->conn_lock);
8991 	mutex_enter(&ill->ill_lock);
8992 	/* conn has not yet started closing, hence this can't fail */
8993 	success = ill_pending_mp_add(ill, connp, pending_mp);
8994 	ASSERT(success);
8995 	mutex_exit(&ill->ill_lock);
8996 	mutex_exit(&connp->conn_lock);
8997 
8998 	/*
8999 	 * Fill in the rest of the ARP operation fields.
9000 	 */
9001 	area->area_hw_addr_length = alength;
9002 	bcopy(lladdr,
9003 	    (char *)area + area->area_hw_addr_offset,
9004 	    area->area_hw_addr_length);
9005 	/* Translate the flags. */
9006 	if (flags & ATF_PERM)
9007 		area->area_flags |= ACE_F_PERMANENT;
9008 	if (flags & ATF_PUBL)
9009 		area->area_flags |= ACE_F_PUBLISH;
9010 
9011 	/*
9012 	 * Up to ARP it goes.  The response will come
9013 	 * back in ip_wput as an M_IOCACK message, and
9014 	 * will be handed to ip_sioctl_iocack for
9015 	 * completion.
9016 	 */
9017 	putnext(ill->ill_rq, mp1);
9018 	return (EINPROGRESS);
9019 }
9020 
9021 /* ARGSUSED */
9022 int
9023 ip_sioctl_xarp(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9024     ip_ioctl_cmd_t *ipip, void *ifreq)
9025 {
9026 	struct xarpreq *xar;
9027 	boolean_t isv6;
9028 	mblk_t	*mp1;
9029 	int	err;
9030 	conn_t	*connp;
9031 	int ifnamelen;
9032 	ire_t	*ire = NULL;
9033 	ill_t	*ill = NULL;
9034 	struct sockaddr_in *sin;
9035 	boolean_t if_arp_ioctl = B_FALSE;
9036 
9037 	/* ioctl comes down on an conn */
9038 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9039 	connp = Q_TO_CONN(q);
9040 	isv6 = connp->conn_af_isv6;
9041 
9042 	/* Existance verified in ip_wput_nondata */
9043 	mp1 = mp->b_cont->b_cont;
9044 
9045 	ASSERT(MBLKL(mp1) >= sizeof (*xar));
9046 	xar = (struct xarpreq *)mp1->b_rptr;
9047 	sin = (sin_t *)&xar->xarp_pa;
9048 
9049 	if (isv6 || (xar->xarp_ha.sdl_family != AF_LINK) ||
9050 	    (xar->xarp_pa.ss_family != AF_INET))
9051 		return (ENXIO);
9052 
9053 	ifnamelen = xar->xarp_ha.sdl_nlen;
9054 	if (ifnamelen != 0) {
9055 		char	*cptr, cval;
9056 
9057 		if (ifnamelen >= LIFNAMSIZ)
9058 			return (EINVAL);
9059 
9060 		/*
9061 		 * Instead of bcopying a bunch of bytes,
9062 		 * null-terminate the string in-situ.
9063 		 */
9064 		cptr = xar->xarp_ha.sdl_data + ifnamelen;
9065 		cval = *cptr;
9066 		*cptr = '\0';
9067 		ill = ill_lookup_on_name(xar->xarp_ha.sdl_data,
9068 		    B_FALSE, isv6, CONNP_TO_WQ(connp), mp, ip_process_ioctl,
9069 		    &err, NULL);
9070 		*cptr = cval;
9071 		if (ill == NULL)
9072 			return (err);
9073 		if (ill->ill_net_type != IRE_IF_RESOLVER) {
9074 			ill_refrele(ill);
9075 			return (ENXIO);
9076 		}
9077 
9078 		if_arp_ioctl = B_TRUE;
9079 	} else {
9080 		/*
9081 		 * PSARC 2003/088 states that if sdl_nlen == 0, it behaves
9082 		 * as an extended BSD ioctl. The kernel uses the IP address
9083 		 * to figure out the network interface.
9084 		 */
9085 		ire = ire_cache_lookup(sin->sin_addr.s_addr, ALL_ZONES);
9086 		if ((ire == NULL) || (ire->ire_type == IRE_LOOPBACK) ||
9087 		    ((ill = ire_to_ill(ire)) == NULL)) {
9088 			if (ire != NULL)
9089 				ire_refrele(ire);
9090 			ire = ire_ftable_lookup(sin->sin_addr.s_addr,
9091 			    0, 0, IRE_IF_RESOLVER, NULL, NULL, ALL_ZONES, 0,
9092 			    MATCH_IRE_TYPE);
9093 			if ((ire == NULL) ||
9094 			    ((ill = ire_to_ill(ire)) == NULL)) {
9095 				if (ire != NULL)
9096 					ire_refrele(ire);
9097 				return (ENXIO);
9098 			}
9099 		}
9100 		ASSERT(ire != NULL && ill != NULL);
9101 	}
9102 
9103 	err = ip_sioctl_arp_common(ill, q, mp, sin, B_TRUE, if_arp_ioctl);
9104 	if (if_arp_ioctl)
9105 		ill_refrele(ill);
9106 	if (ire != NULL)
9107 		ire_refrele(ire);
9108 
9109 	return (err);
9110 }
9111 
9112 /*
9113  * ARP IOCTLs.
9114  * How does IP get in the business of fronting ARP configuration/queries?
9115  * Well its like this, the Berkeley ARP IOCTLs (SIOCGARP, SIOCDARP, SIOCSARP)
9116  * are by tradition passed in through a datagram socket.  That lands in IP.
9117  * As it happens, this is just as well since the interface is quite crude in
9118  * that it passes in no information about protocol or hardware types, or
9119  * interface association.  After making the protocol assumption, IP is in
9120  * the position to look up the name of the ILL, which ARP will need, and
9121  * format a request that can be handled by ARP.	 The request is passed up
9122  * stream to ARP, and the original IOCTL is completed by IP when ARP passes
9123  * back a response.  ARP supports its own set of more general IOCTLs, in
9124  * case anyone is interested.
9125  */
9126 /* ARGSUSED */
9127 int
9128 ip_sioctl_arp(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9129     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9130 {
9131 	struct arpreq *ar;
9132 	struct sockaddr_in *sin;
9133 	ire_t	*ire;
9134 	boolean_t isv6;
9135 	mblk_t	*mp1;
9136 	int	err;
9137 	conn_t	*connp;
9138 	ill_t	*ill;
9139 
9140 	/* ioctl comes down on an conn */
9141 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9142 	connp = Q_TO_CONN(q);
9143 	isv6 = connp->conn_af_isv6;
9144 	if (isv6)
9145 		return (ENXIO);
9146 
9147 	/* Existance verified in ip_wput_nondata */
9148 	mp1 = mp->b_cont->b_cont;
9149 
9150 	ar = (struct arpreq *)mp1->b_rptr;
9151 	sin = (sin_t *)&ar->arp_pa;
9152 
9153 	/*
9154 	 * We need to let ARP know on which interface the IP
9155 	 * address has an ARP mapping. In the IPMP case, a
9156 	 * simple forwarding table lookup will return the
9157 	 * IRE_IF_RESOLVER for the first interface in the group,
9158 	 * which might not be the interface on which the
9159 	 * requested IP address was resolved due to the ill
9160 	 * selection algorithm (see ip_newroute_get_dst_ill()).
9161 	 * So we do a cache table lookup first: if the IRE cache
9162 	 * entry for the IP address is still there, it will
9163 	 * contain the ill pointer for the right interface, so
9164 	 * we use that. If the cache entry has been flushed, we
9165 	 * fall back to the forwarding table lookup. This should
9166 	 * be rare enough since IRE cache entries have a longer
9167 	 * life expectancy than ARP cache entries.
9168 	 */
9169 	ire = ire_cache_lookup(sin->sin_addr.s_addr, ALL_ZONES);
9170 	if ((ire == NULL) || (ire->ire_type == IRE_LOOPBACK) ||
9171 	    ((ill = ire_to_ill(ire)) == NULL)) {
9172 		if (ire != NULL)
9173 			ire_refrele(ire);
9174 		ire = ire_ftable_lookup(sin->sin_addr.s_addr,
9175 		    0, 0, IRE_IF_RESOLVER, NULL, NULL, ALL_ZONES, 0,
9176 		    MATCH_IRE_TYPE);
9177 		if ((ire == NULL) || ((ill = ire_to_ill(ire)) == NULL)) {
9178 			if (ire != NULL)
9179 				ire_refrele(ire);
9180 			return (ENXIO);
9181 		}
9182 	}
9183 	ASSERT(ire != NULL && ill != NULL);
9184 
9185 	err = ip_sioctl_arp_common(ill, q, mp, sin, B_FALSE, B_FALSE);
9186 	ire_refrele(ire);
9187 	return (err);
9188 }
9189 
9190 /*
9191  * Do I_PLINK/I_LINK or I_PUNLINK/I_UNLINK with consistency checks and also
9192  * atomically set/clear the muxids. Also complete the ioctl by acking or
9193  * naking it.  Note that the code is structured such that the link type,
9194  * whether it's persistent or not, is treated equally.  ifconfig(1M) and
9195  * its clones use the persistent link, while pppd(1M) and perhaps many
9196  * other daemons may use non-persistent link.  When combined with some
9197  * ill_t states, linking and unlinking lower streams may be used as
9198  * indicators of dynamic re-plumbing events [see PSARC/1999/348].
9199  */
9200 /* ARGSUSED */
9201 void
9202 ip_sioctl_plink(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
9203 {
9204 	mblk_t *mp1;
9205 	mblk_t *mp2;
9206 	struct linkblk *li;
9207 	queue_t	*ipwq;
9208 	char	*name;
9209 	struct qinit *qinfo;
9210 	struct ipmx_s *ipmxp;
9211 	ill_t	*ill = NULL;
9212 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
9213 	int	err = 0;
9214 	boolean_t	entered_ipsq = B_FALSE;
9215 	boolean_t islink;
9216 	queue_t *dwq = NULL;
9217 
9218 	ASSERT(iocp->ioc_cmd == I_PLINK || iocp->ioc_cmd == I_PUNLINK ||
9219 	    iocp->ioc_cmd == I_LINK || iocp->ioc_cmd == I_UNLINK);
9220 
9221 	islink = (iocp->ioc_cmd == I_PLINK || iocp->ioc_cmd == I_LINK) ?
9222 	    B_TRUE : B_FALSE;
9223 
9224 	mp1 = mp->b_cont;	/* This is the linkblk info */
9225 	li = (struct linkblk *)mp1->b_rptr;
9226 
9227 	/*
9228 	 * ARP has added this special mblk, and the utility is asking us
9229 	 * to perform consistency checks, and also atomically set the
9230 	 * muxid. Ifconfig is an example.  It achieves this by using
9231 	 * /dev/arp as the mux to plink the arp stream, and pushes arp on
9232 	 * to /dev/udp[6] stream for use as the mux when plinking the IP
9233 	 * stream. SIOCSLIFMUXID is not required.  See ifconfig.c, arp.c
9234 	 * and other comments in this routine for more details.
9235 	 */
9236 	mp2 = mp1->b_cont;	/* This is added by ARP */
9237 
9238 	/*
9239 	 * If I_{P}LINK/I_{P}UNLINK is issued by a utility other than
9240 	 * ifconfig which didn't push ARP on top of the dummy mux, we won't
9241 	 * get the special mblk above.  For backward compatibility, we just
9242 	 * return success.  The utility will use SIOCSLIFMUXID to store
9243 	 * the muxids.  This is not atomic, and can leave the streams
9244 	 * unplumbable if the utility is interrrupted, before it does the
9245 	 * SIOCSLIFMUXID.
9246 	 */
9247 	if (mp2 == NULL) {
9248 		/*
9249 		 * At this point we don't know whether or not this is the
9250 		 * IP module stream or the ARP device stream.  We need to
9251 		 * walk the lower stream in order to find this out, since
9252 		 * the capability negotiation is done only on the IP module
9253 		 * stream.  IP module instance is identified by the module
9254 		 * name IP, non-null q_next, and it's wput not being ip_lwput.
9255 		 * STREAMS ensures that the lower stream (l_qbot) will not
9256 		 * vanish until this ioctl completes. So we can safely walk
9257 		 * the stream or refer to the q_ptr.
9258 		 */
9259 		ipwq = li->l_qbot;
9260 		while (ipwq != NULL) {
9261 			qinfo = ipwq->q_qinfo;
9262 			name = qinfo->qi_minfo->mi_idname;
9263 			if (name != NULL && name[0] != NULL &&
9264 			    (strcmp(name, ip_mod_info.mi_idname) == 0) &&
9265 			    ((void *)(qinfo->qi_putp) != (void *)ip_lwput) &&
9266 			    (ipwq->q_next != NULL)) {
9267 				break;
9268 			}
9269 			ipwq = ipwq->q_next;
9270 		}
9271 		/*
9272 		 * This looks like an IP module stream, so trigger
9273 		 * the capability reset or re-negotiation if necessary.
9274 		 */
9275 		if (ipwq != NULL) {
9276 			ill = ipwq->q_ptr;
9277 			ASSERT(ill != NULL);
9278 
9279 			if (ipsq == NULL) {
9280 				ipsq = ipsq_try_enter(NULL, ill, q, mp,
9281 				    ip_sioctl_plink, NEW_OP, B_TRUE);
9282 				if (ipsq == NULL)
9283 					return;
9284 				entered_ipsq = B_TRUE;
9285 			}
9286 			ASSERT(IAM_WRITER_ILL(ill));
9287 			/*
9288 			 * Store the upper read queue of the module
9289 			 * immediately below IP, and count the total
9290 			 * number of lower modules.  Do this only
9291 			 * for I_PLINK or I_LINK event.
9292 			 */
9293 			ill->ill_lmod_rq = NULL;
9294 			ill->ill_lmod_cnt = 0;
9295 			if (islink && (dwq = ipwq->q_next) != NULL) {
9296 				ill->ill_lmod_rq = RD(dwq);
9297 
9298 				while (dwq != NULL) {
9299 					ill->ill_lmod_cnt++;
9300 					dwq = dwq->q_next;
9301 				}
9302 			}
9303 			/*
9304 			 * There's no point in resetting or re-negotiating if
9305 			 * we are not bound to the driver, so only do this if
9306 			 * the DLPI state is idle (up); we assume such state
9307 			 * since ill_ipif_up_count gets incremented in
9308 			 * ipif_up_done(), which is after we are bound to the
9309 			 * driver.  Note that in the case of logical
9310 			 * interfaces, IP won't rebind to the driver unless
9311 			 * the ill_ipif_up_count is 0, meaning that all other
9312 			 * IP interfaces (including the main ipif) are in the
9313 			 * down state.  Because of this, we use such counter
9314 			 * as an indicator, instead of relying on the IPIF_UP
9315 			 * flag, which is per ipif instance.
9316 			 */
9317 			if (ill->ill_ipif_up_count > 0) {
9318 				if (islink)
9319 					ill_capability_probe(ill);
9320 				else
9321 					ill_capability_reset(ill);
9322 			}
9323 		}
9324 		goto done;
9325 	}
9326 
9327 	/*
9328 	 * This is an I_{P}LINK sent down by ifconfig on
9329 	 * /dev/arp. ARP has appended this last (3rd) mblk,
9330 	 * giving more info. STREAMS ensures that the lower
9331 	 * stream (l_qbot) will not vanish until this ioctl
9332 	 * completes. So we can safely walk the stream or refer
9333 	 * to the q_ptr.
9334 	 */
9335 	ipmxp = (struct ipmx_s *)mp2->b_rptr;
9336 	if (ipmxp->ipmx_arpdev_stream) {
9337 		/*
9338 		 * The operation is occuring on the arp-device
9339 		 * stream.
9340 		 */
9341 		ill = ill_lookup_on_name(ipmxp->ipmx_name, B_FALSE, B_FALSE,
9342 		    q, mp, ip_sioctl_plink, &err, NULL);
9343 		if (ill == NULL) {
9344 			if (err == EINPROGRESS) {
9345 				return;
9346 			} else {
9347 				err = EINVAL;
9348 				goto done;
9349 			}
9350 		}
9351 
9352 		if (ipsq == NULL) {
9353 			ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_sioctl_plink,
9354 			    NEW_OP, B_TRUE);
9355 			if (ipsq == NULL) {
9356 				ill_refrele(ill);
9357 				return;
9358 			}
9359 			entered_ipsq = B_TRUE;
9360 		}
9361 		ASSERT(IAM_WRITER_ILL(ill));
9362 		ill_refrele(ill);
9363 		/*
9364 		 * To ensure consistency between IP and ARP,
9365 		 * the following LIFO scheme is used in
9366 		 * plink/punlink. (IP first, ARP last).
9367 		 * This is because the muxid's are stored
9368 		 * in the IP stream on the ill.
9369 		 *
9370 		 * I_{P}LINK: ifconfig plinks the IP stream before
9371 		 * plinking the ARP stream. On an arp-dev
9372 		 * stream, IP checks that it is not yet
9373 		 * plinked, and it also checks that the
9374 		 * corresponding IP stream is already plinked.
9375 		 *
9376 		 * I_{P}UNLINK: ifconfig punlinks the ARP stream
9377 		 * before punlinking the IP stream. IP does
9378 		 * not allow punlink of the IP stream unless
9379 		 * the arp stream has been punlinked.
9380 		 *
9381 		 */
9382 		if ((islink &&
9383 		    (ill->ill_arp_muxid != 0 || ill->ill_ip_muxid == 0)) ||
9384 		    (!islink &&
9385 		    ill->ill_arp_muxid != li->l_index)) {
9386 			err = EINVAL;
9387 			goto done;
9388 		}
9389 		if (islink) {
9390 			ill->ill_arp_muxid = li->l_index;
9391 		} else {
9392 			ill->ill_arp_muxid = 0;
9393 		}
9394 	} else {
9395 		/*
9396 		 * This must be the IP module stream with or
9397 		 * without arp. Walk the stream and locate the
9398 		 * IP module. An IP module instance is
9399 		 * identified by the module name IP, non-null
9400 		 * q_next, and it's wput not being ip_lwput.
9401 		 */
9402 		ipwq = li->l_qbot;
9403 		while (ipwq != NULL) {
9404 			qinfo = ipwq->q_qinfo;
9405 			name = qinfo->qi_minfo->mi_idname;
9406 			if (name != NULL && name[0] != NULL &&
9407 			    (strcmp(name, ip_mod_info.mi_idname) == 0) &&
9408 			    ((void *)(qinfo->qi_putp) != (void *)ip_lwput) &&
9409 			    (ipwq->q_next != NULL)) {
9410 				break;
9411 			}
9412 			ipwq = ipwq->q_next;
9413 		}
9414 		if (ipwq != NULL) {
9415 			ill = ipwq->q_ptr;
9416 			ASSERT(ill != NULL);
9417 
9418 			if (ipsq == NULL) {
9419 				ipsq = ipsq_try_enter(NULL, ill, q, mp,
9420 				    ip_sioctl_plink, NEW_OP, B_TRUE);
9421 				if (ipsq == NULL)
9422 					return;
9423 				entered_ipsq = B_TRUE;
9424 			}
9425 			ASSERT(IAM_WRITER_ILL(ill));
9426 			/*
9427 			 * Return error if the ip_mux_id is
9428 			 * non-zero and command is I_{P}LINK.
9429 			 * If command is I_{P}UNLINK, return
9430 			 * error if the arp-devstr is not
9431 			 * yet punlinked.
9432 			 */
9433 			if ((islink && ill->ill_ip_muxid != 0) ||
9434 			    (!islink && ill->ill_arp_muxid != 0)) {
9435 				err = EINVAL;
9436 				goto done;
9437 			}
9438 			ill->ill_lmod_rq = NULL;
9439 			ill->ill_lmod_cnt = 0;
9440 			if (islink) {
9441 				/*
9442 				 * Store the upper read queue of the module
9443 				 * immediately below IP, and count the total
9444 				 * number of lower modules.
9445 				 */
9446 				if ((dwq = ipwq->q_next) != NULL) {
9447 					ill->ill_lmod_rq = RD(dwq);
9448 
9449 					while (dwq != NULL) {
9450 						ill->ill_lmod_cnt++;
9451 						dwq = dwq->q_next;
9452 					}
9453 				}
9454 				ill->ill_ip_muxid = li->l_index;
9455 			} else {
9456 				ill->ill_ip_muxid = 0;
9457 			}
9458 
9459 			/*
9460 			 * See comments above about resetting/re-
9461 			 * negotiating driver sub-capabilities.
9462 			 */
9463 			if (ill->ill_ipif_up_count > 0) {
9464 				if (islink)
9465 					ill_capability_probe(ill);
9466 				else
9467 					ill_capability_reset(ill);
9468 			}
9469 		}
9470 	}
9471 done:
9472 	iocp->ioc_count = 0;
9473 	iocp->ioc_error = err;
9474 	if (err == 0)
9475 		mp->b_datap->db_type = M_IOCACK;
9476 	else
9477 		mp->b_datap->db_type = M_IOCNAK;
9478 	qreply(q, mp);
9479 
9480 	/* Conn was refheld in ip_sioctl_copyin_setup */
9481 	if (CONN_Q(q))
9482 		CONN_OPER_PENDING_DONE(Q_TO_CONN(q));
9483 	if (entered_ipsq)
9484 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
9485 }
9486 
9487 /*
9488  * Search the ioctl command in the ioctl tables and return a pointer
9489  * to the ioctl command information. The ioctl command tables are
9490  * static and fully populated at compile time.
9491  */
9492 ip_ioctl_cmd_t *
9493 ip_sioctl_lookup(int ioc_cmd)
9494 {
9495 	int index;
9496 	ip_ioctl_cmd_t *ipip;
9497 	ip_ioctl_cmd_t *ipip_end;
9498 
9499 	if (ioc_cmd == IPI_DONTCARE)
9500 		return (NULL);
9501 
9502 	/*
9503 	 * Do a 2 step search. First search the indexed table
9504 	 * based on the least significant byte of the ioctl cmd.
9505 	 * If we don't find a match, then search the misc table
9506 	 * serially.
9507 	 */
9508 	index = ioc_cmd & 0xFF;
9509 	if (index < ip_ndx_ioctl_count) {
9510 		ipip = &ip_ndx_ioctl_table[index];
9511 		if (ipip->ipi_cmd == ioc_cmd) {
9512 			/* Found a match in the ndx table */
9513 			return (ipip);
9514 		}
9515 	}
9516 
9517 	/* Search the misc table */
9518 	ipip_end = &ip_misc_ioctl_table[ip_misc_ioctl_count];
9519 	for (ipip = ip_misc_ioctl_table; ipip < ipip_end; ipip++) {
9520 		if (ipip->ipi_cmd == ioc_cmd)
9521 			/* Found a match in the misc table */
9522 			return (ipip);
9523 	}
9524 
9525 	return (NULL);
9526 }
9527 
9528 /*
9529  * Wrapper function for resuming deferred ioctl processing
9530  * Used for SIOCGDSTINFO, SIOCGIP6ADDRPOLICY, SIOCGMSFILTER,
9531  * SIOCSMSFILTER, SIOCGIPMSFILTER, and SIOCSIPMSFILTER currently.
9532  */
9533 /* ARGSUSED */
9534 void
9535 ip_sioctl_copyin_resume(ipsq_t *dummy_ipsq, queue_t *q, mblk_t *mp,
9536     void *dummy_arg)
9537 {
9538 	ip_sioctl_copyin_setup(q, mp);
9539 }
9540 
9541 /*
9542  * ip_sioctl_copyin_setup is called by ip_wput with any M_IOCTL message
9543  * that arrives.  Most of the IOCTLs are "socket" IOCTLs which we handle
9544  * in either I_STR or TRANSPARENT form, using the mi_copy facility.
9545  * We establish here the size of the block to be copied in.  mi_copyin
9546  * arranges for this to happen, an processing continues in ip_wput with
9547  * an M_IOCDATA message.
9548  */
9549 void
9550 ip_sioctl_copyin_setup(queue_t *q, mblk_t *mp)
9551 {
9552 	int	copyin_size;
9553 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
9554 	ip_ioctl_cmd_t *ipip;
9555 	cred_t *cr;
9556 
9557 	ipip = ip_sioctl_lookup(iocp->ioc_cmd);
9558 	if (ipip == NULL) {
9559 		/*
9560 		 * The ioctl is not one we understand or own.
9561 		 * Pass it along to be processed down stream,
9562 		 * if this is a module instance of IP, else nak
9563 		 * the ioctl.
9564 		 */
9565 		if (q->q_next == NULL) {
9566 			goto nak;
9567 		} else {
9568 			putnext(q, mp);
9569 			return;
9570 		}
9571 	}
9572 
9573 	/*
9574 	 * If this is deferred, then we will do all the checks when we
9575 	 * come back.
9576 	 */
9577 	if ((iocp->ioc_cmd == SIOCGDSTINFO ||
9578 	    iocp->ioc_cmd == SIOCGIP6ADDRPOLICY) && !ip6_asp_can_lookup()) {
9579 		ip6_asp_pending_op(q, mp, ip_sioctl_copyin_resume);
9580 		return;
9581 	}
9582 
9583 	/*
9584 	 * Only allow a very small subset of IP ioctls on this stream if
9585 	 * IP is a module and not a driver. Allowing ioctls to be processed
9586 	 * in this case may cause assert failures or data corruption.
9587 	 * Typically G[L]IFFLAGS, SLIFNAME/IF_UNITSEL are the only few
9588 	 * ioctls allowed on an IP module stream, after which this stream
9589 	 * normally becomes a multiplexor (at which time the stream head
9590 	 * will fail all ioctls).
9591 	 */
9592 	if ((q->q_next != NULL) && !(ipip->ipi_flags & IPI_MODOK)) {
9593 		if (ipip->ipi_flags & IPI_PASS_DOWN) {
9594 			/*
9595 			 * Pass common Streams ioctls which the IP
9596 			 * module does not own or consume along to
9597 			 * be processed down stream.
9598 			 */
9599 			putnext(q, mp);
9600 			return;
9601 		} else {
9602 			goto nak;
9603 		}
9604 	}
9605 
9606 	/* Make sure we have ioctl data to process. */
9607 	if (mp->b_cont == NULL && !(ipip->ipi_flags & IPI_NULL_BCONT))
9608 		goto nak;
9609 
9610 	/*
9611 	 * Prefer dblk credential over ioctl credential; some synthesized
9612 	 * ioctls have kcred set because there's no way to crhold()
9613 	 * a credential in some contexts.  (ioc_cr is not crfree() by
9614 	 * the framework; the caller of ioctl needs to hold the reference
9615 	 * for the duration of the call).
9616 	 */
9617 	cr = DB_CREDDEF(mp, iocp->ioc_cr);
9618 
9619 	/* Make sure normal users don't send down privileged ioctls */
9620 	if ((ipip->ipi_flags & IPI_PRIV) &&
9621 	    (cr != NULL) && secpolicy_net_config(cr, B_TRUE) != 0) {
9622 		/* We checked the privilege earlier but log it here */
9623 		miocnak(q, mp, 0, secpolicy_net_config(cr, B_FALSE));
9624 		return;
9625 	}
9626 
9627 	/*
9628 	 * The ioctl command tables can only encode fixed length
9629 	 * ioctl data. If the length is variable, the table will
9630 	 * encode the length as zero. Such special cases are handled
9631 	 * below in the switch.
9632 	 */
9633 	if (ipip->ipi_copyin_size != 0) {
9634 		mi_copyin(q, mp, NULL, ipip->ipi_copyin_size);
9635 		return;
9636 	}
9637 
9638 	switch (iocp->ioc_cmd) {
9639 	case O_SIOCGIFCONF:
9640 	case SIOCGIFCONF:
9641 		/*
9642 		 * This IOCTL is hilarious.  See comments in
9643 		 * ip_sioctl_get_ifconf for the story.
9644 		 */
9645 		if (iocp->ioc_count == TRANSPARENT)
9646 			copyin_size = SIZEOF_STRUCT(ifconf,
9647 			    iocp->ioc_flag);
9648 		else
9649 			copyin_size = iocp->ioc_count;
9650 		mi_copyin(q, mp, NULL, copyin_size);
9651 		return;
9652 
9653 	case O_SIOCGLIFCONF:
9654 	case SIOCGLIFCONF:
9655 		copyin_size = SIZEOF_STRUCT(lifconf, iocp->ioc_flag);
9656 		mi_copyin(q, mp, NULL, copyin_size);
9657 		return;
9658 
9659 	case SIOCGLIFSRCOF:
9660 		copyin_size = SIZEOF_STRUCT(lifsrcof, iocp->ioc_flag);
9661 		mi_copyin(q, mp, NULL, copyin_size);
9662 		return;
9663 	case SIOCGIP6ADDRPOLICY:
9664 		ip_sioctl_ip6addrpolicy(q, mp);
9665 		ip6_asp_table_refrele();
9666 		return;
9667 
9668 	case SIOCSIP6ADDRPOLICY:
9669 		ip_sioctl_ip6addrpolicy(q, mp);
9670 		return;
9671 
9672 	case SIOCGDSTINFO:
9673 		ip_sioctl_dstinfo(q, mp);
9674 		ip6_asp_table_refrele();
9675 		return;
9676 
9677 	case I_PLINK:
9678 	case I_PUNLINK:
9679 	case I_LINK:
9680 	case I_UNLINK:
9681 		/*
9682 		 * We treat non-persistent link similarly as the persistent
9683 		 * link case, in terms of plumbing/unplumbing, as well as
9684 		 * dynamic re-plumbing events indicator.  See comments
9685 		 * in ip_sioctl_plink() for more.
9686 		 *
9687 		 * Request can be enqueued in the 'ipsq' while waiting
9688 		 * to become exclusive. So bump up the conn ref.
9689 		 */
9690 		if (CONN_Q(q))
9691 			CONN_INC_REF(Q_TO_CONN(q));
9692 		ip_sioctl_plink(NULL, q, mp, NULL);
9693 		return;
9694 
9695 	case ND_GET:
9696 	case ND_SET:
9697 		/*
9698 		 * Use of the nd table requires holding the reader lock.
9699 		 * Modifying the nd table thru nd_load/nd_unload requires
9700 		 * the writer lock.
9701 		 */
9702 		rw_enter(&ip_g_nd_lock, RW_READER);
9703 		if (nd_getset(q, ip_g_nd, mp)) {
9704 			rw_exit(&ip_g_nd_lock);
9705 
9706 			if (iocp->ioc_error)
9707 				iocp->ioc_count = 0;
9708 			mp->b_datap->db_type = M_IOCACK;
9709 			qreply(q, mp);
9710 			return;
9711 		}
9712 		rw_exit(&ip_g_nd_lock);
9713 		/*
9714 		 * We don't understand this subioctl of ND_GET / ND_SET.
9715 		 * Maybe intended for some driver / module below us
9716 		 */
9717 		if (q->q_next) {
9718 			putnext(q, mp);
9719 		} else {
9720 			iocp->ioc_error = ENOENT;
9721 			mp->b_datap->db_type = M_IOCNAK;
9722 			iocp->ioc_count = 0;
9723 			qreply(q, mp);
9724 		}
9725 		return;
9726 
9727 	case IP_IOCTL:
9728 		ip_wput_ioctl(q, mp);
9729 		return;
9730 	default:
9731 		cmn_err(CE_PANIC, "should not happen ");
9732 	}
9733 nak:
9734 	if (mp->b_cont != NULL) {
9735 		freemsg(mp->b_cont);
9736 		mp->b_cont = NULL;
9737 	}
9738 	iocp->ioc_error = EINVAL;
9739 	mp->b_datap->db_type = M_IOCNAK;
9740 	iocp->ioc_count = 0;
9741 	qreply(q, mp);
9742 }
9743 
9744 /* ip_wput hands off ARP IOCTL responses to us */
9745 void
9746 ip_sioctl_iocack(queue_t *q, mblk_t *mp)
9747 {
9748 	struct arpreq *ar;
9749 	struct xarpreq *xar;
9750 	area_t	*area;
9751 	mblk_t	*area_mp;
9752 	struct iocblk *iocp;
9753 	mblk_t	*orig_ioc_mp, *tmp;
9754 	struct iocblk	*orig_iocp;
9755 	ill_t *ill;
9756 	conn_t *connp = NULL;
9757 	uint_t ioc_id;
9758 	mblk_t *pending_mp;
9759 	int x_arp_ioctl = B_FALSE, ifx_arp_ioctl = B_FALSE;
9760 	int *flagsp;
9761 	char *storage = NULL;
9762 	sin_t *sin;
9763 	ipaddr_t addr;
9764 	int err;
9765 
9766 	ill = q->q_ptr;
9767 	ASSERT(ill != NULL);
9768 
9769 	/*
9770 	 * We should get back from ARP a packet chain that looks like:
9771 	 * M_IOCACK-->ARP_op_MBLK-->ORIG_M_IOCTL-->MI_COPY_MBLK-->[X]ARPREQ_MBLK
9772 	 */
9773 	if (!(area_mp = mp->b_cont) ||
9774 	    (area_mp->b_wptr - area_mp->b_rptr) < sizeof (ip_sock_ar_t) ||
9775 	    !(orig_ioc_mp = area_mp->b_cont) ||
9776 	    !orig_ioc_mp->b_cont || !orig_ioc_mp->b_cont->b_cont) {
9777 		freemsg(mp);
9778 		return;
9779 	}
9780 
9781 	orig_iocp = (struct iocblk *)orig_ioc_mp->b_rptr;
9782 
9783 	tmp = (orig_ioc_mp->b_cont)->b_cont;
9784 	if ((orig_iocp->ioc_cmd == SIOCGXARP) ||
9785 	    (orig_iocp->ioc_cmd == SIOCSXARP) ||
9786 	    (orig_iocp->ioc_cmd == SIOCDXARP)) {
9787 		x_arp_ioctl = B_TRUE;
9788 		xar = (struct xarpreq *)tmp->b_rptr;
9789 		sin = (sin_t *)&xar->xarp_pa;
9790 		flagsp = &xar->xarp_flags;
9791 		storage = xar->xarp_ha.sdl_data;
9792 		if (xar->xarp_ha.sdl_nlen != 0)
9793 			ifx_arp_ioctl = B_TRUE;
9794 	} else {
9795 		ar = (struct arpreq *)tmp->b_rptr;
9796 		sin = (sin_t *)&ar->arp_pa;
9797 		flagsp = &ar->arp_flags;
9798 		storage = ar->arp_ha.sa_data;
9799 	}
9800 
9801 	iocp = (struct iocblk *)mp->b_rptr;
9802 
9803 	/*
9804 	 * Pick out the originating queue based on the ioc_id.
9805 	 */
9806 	ioc_id = iocp->ioc_id;
9807 	pending_mp = ill_pending_mp_get(ill, &connp, ioc_id);
9808 	if (pending_mp == NULL) {
9809 		ASSERT(connp == NULL);
9810 		inet_freemsg(mp);
9811 		return;
9812 	}
9813 	ASSERT(connp != NULL);
9814 	q = CONNP_TO_WQ(connp);
9815 
9816 	/* Uncouple the internally generated IOCTL from the original one */
9817 	area = (area_t *)area_mp->b_rptr;
9818 	area_mp->b_cont = NULL;
9819 
9820 	/*
9821 	 * Restore the b_next and b_prev used by mi code. This is needed
9822 	 * to complete the ioctl using mi* functions. We stored them in
9823 	 * the pending mp prior to sending the request to ARP.
9824 	 */
9825 	orig_ioc_mp->b_cont->b_next = pending_mp->b_cont->b_next;
9826 	orig_ioc_mp->b_cont->b_prev = pending_mp->b_cont->b_prev;
9827 	inet_freemsg(pending_mp);
9828 
9829 	/*
9830 	 * We're done if there was an error or if this is not an SIOCG{X}ARP
9831 	 * Catch the case where there is an IRE_CACHE by no entry in the
9832 	 * arp table.
9833 	 */
9834 	addr = sin->sin_addr.s_addr;
9835 	if (iocp->ioc_error && iocp->ioc_cmd == AR_ENTRY_SQUERY) {
9836 		ire_t			*ire;
9837 		dl_unitdata_req_t	*dlup;
9838 		mblk_t			*llmp;
9839 		int			addr_len;
9840 		ill_t			*ipsqill = NULL;
9841 
9842 		if (ifx_arp_ioctl) {
9843 			/*
9844 			 * There's no need to lookup the ill, since
9845 			 * we've already done that when we started
9846 			 * processing the ioctl and sent the message
9847 			 * to ARP on that ill.  So use the ill that
9848 			 * is stored in q->q_ptr.
9849 			 */
9850 			ipsqill = ill;
9851 			ire = ire_ctable_lookup(addr, 0, IRE_CACHE,
9852 			    ipsqill->ill_ipif, ALL_ZONES,
9853 			    MATCH_IRE_TYPE | MATCH_IRE_ILL);
9854 		} else {
9855 			ire = ire_ctable_lookup(addr, 0, IRE_CACHE,
9856 			    NULL, ALL_ZONES, MATCH_IRE_TYPE);
9857 			if (ire != NULL)
9858 				ipsqill = ire_to_ill(ire);
9859 		}
9860 
9861 		if ((x_arp_ioctl) && (ipsqill != NULL))
9862 			storage += ill_xarp_info(&xar->xarp_ha, ipsqill);
9863 
9864 		if (ire != NULL) {
9865 			*flagsp = ATF_INUSE;
9866 			llmp = ire->ire_dlureq_mp;
9867 			if (llmp != NULL && ipsqill != NULL) {
9868 				uchar_t *macaddr;
9869 
9870 				addr_len = ipsqill->ill_phys_addr_length;
9871 				if (x_arp_ioctl && ((addr_len +
9872 				    ipsqill->ill_name_length) >
9873 				    sizeof (xar->xarp_ha.sdl_data))) {
9874 					ire_refrele(ire);
9875 					freemsg(mp);
9876 					ip_ioctl_finish(q, orig_ioc_mp,
9877 					    EINVAL, NO_COPYOUT, NULL, NULL);
9878 					return;
9879 				}
9880 				*flagsp |= ATF_COM;
9881 				dlup = (dl_unitdata_req_t *)llmp->b_rptr;
9882 				if (ipsqill->ill_sap_length < 0)
9883 					macaddr = llmp->b_rptr +
9884 					    dlup->dl_dest_addr_offset;
9885 				else
9886 					macaddr = llmp->b_rptr +
9887 					    dlup->dl_dest_addr_offset +
9888 					    ipsqill->ill_sap_length;
9889 				/*
9890 				 * For SIOCGARP, MAC address length
9891 				 * validation has already been done
9892 				 * before the ioctl was issued to ARP to
9893 				 * allow it to progress only on 6 byte
9894 				 * addressable (ethernet like) media. Thus
9895 				 * the mac address copying can not overwrite
9896 				 * the sa_data area below.
9897 				 */
9898 				bcopy(macaddr, storage, addr_len);
9899 			}
9900 			/* Ditch the internal IOCTL. */
9901 			freemsg(mp);
9902 			ire_refrele(ire);
9903 			ip_ioctl_finish(q, orig_ioc_mp, 0, COPYOUT, NULL, NULL);
9904 			return;
9905 		}
9906 	}
9907 
9908 	/*
9909 	 * Delete the coresponding IRE_CACHE if any.
9910 	 * Reset the error if there was one (in case there was no entry
9911 	 * in arp.)
9912 	 */
9913 	if (iocp->ioc_cmd == AR_ENTRY_DELETE) {
9914 		ipif_t *ipintf = NULL;
9915 
9916 		if (ifx_arp_ioctl) {
9917 			/*
9918 			 * There's no need to lookup the ill, since
9919 			 * we've already done that when we started
9920 			 * processing the ioctl and sent the message
9921 			 * to ARP on that ill.  So use the ill that
9922 			 * is stored in q->q_ptr.
9923 			 */
9924 			ipintf = ill->ill_ipif;
9925 		}
9926 		if (ip_ire_clookup_and_delete(addr, ipintf)) {
9927 			/*
9928 			 * The address in "addr" may be an entry for a
9929 			 * router. If that's true, then any off-net
9930 			 * IRE_CACHE entries that go through the router
9931 			 * with address "addr" must be clobbered. Use
9932 			 * ire_walk to achieve this goal.
9933 			 */
9934 			if (ifx_arp_ioctl)
9935 				ire_walk_ill_v4(MATCH_IRE_ILL, 0,
9936 				    ire_delete_cache_gw, (char *)&addr, ill);
9937 			else
9938 				ire_walk_v4(ire_delete_cache_gw, (char *)&addr,
9939 				    ALL_ZONES);
9940 			iocp->ioc_error = 0;
9941 		}
9942 	}
9943 
9944 	if (iocp->ioc_error || iocp->ioc_cmd != AR_ENTRY_SQUERY) {
9945 		err = iocp->ioc_error;
9946 		freemsg(mp);
9947 		ip_ioctl_finish(q, orig_ioc_mp, err, NO_COPYOUT, NULL, NULL);
9948 		return;
9949 	}
9950 
9951 	/*
9952 	 * Completion of an SIOCG{X}ARP.  Translate the information from
9953 	 * the area_t into the struct {x}arpreq.
9954 	 */
9955 	if (x_arp_ioctl) {
9956 		storage += ill_xarp_info(&xar->xarp_ha, ill);
9957 		if ((ill->ill_phys_addr_length + ill->ill_name_length) >
9958 		    sizeof (xar->xarp_ha.sdl_data)) {
9959 			freemsg(mp);
9960 			ip_ioctl_finish(q, orig_ioc_mp, EINVAL,
9961 			    NO_COPYOUT, NULL, NULL);
9962 			return;
9963 		}
9964 	}
9965 	*flagsp = ATF_INUSE;
9966 	if (area->area_flags & ACE_F_PERMANENT)
9967 		*flagsp |= ATF_PERM;
9968 	if (area->area_flags & ACE_F_PUBLISH)
9969 		*flagsp |= ATF_PUBL;
9970 	if (area->area_hw_addr_length != 0) {
9971 		*flagsp |= ATF_COM;
9972 		/*
9973 		 * For SIOCGARP, MAC address length validation has
9974 		 * already been done before the ioctl was issued to ARP
9975 		 * to allow it to progress only on 6 byte addressable
9976 		 * (ethernet like) media. Thus the mac address copying
9977 		 * can not overwrite the sa_data area below.
9978 		 */
9979 		bcopy((char *)area + area->area_hw_addr_offset,
9980 		    storage, area->area_hw_addr_length);
9981 	}
9982 
9983 	/* Ditch the internal IOCTL. */
9984 	freemsg(mp);
9985 	/* Complete the original. */
9986 	ip_ioctl_finish(q, orig_ioc_mp, 0, COPYOUT, NULL, NULL);
9987 }
9988 
9989 /*
9990  * Create a new logical interface. If ipif_id is zero (i.e. not a logical
9991  * interface) create the next available logical interface for this
9992  * physical interface.
9993  * If ipif is NULL (i.e. the lookup didn't find one) attempt to create an
9994  * ipif with the specified name.
9995  *
9996  * If the address family is not AF_UNSPEC then set the address as well.
9997  *
9998  * If ip_sioctl_addr returns EINPROGRESS then the ioctl (the copyout)
9999  * is completed when the DL_BIND_ACK arrive in ip_rput_dlpi_writer.
10000  *
10001  * Executed as a writer on the ill or ill group.
10002  * So no lock is needed to traverse the ipif chain, or examine the
10003  * phyint flags.
10004  */
10005 /* ARGSUSED */
10006 int
10007 ip_sioctl_addif(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
10008     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
10009 {
10010 	mblk_t	*mp1;
10011 	struct lifreq *lifr;
10012 	boolean_t	isv6;
10013 	boolean_t	exists;
10014 	char 	*name;
10015 	char	*endp;
10016 	char	*cp;
10017 	int	namelen;
10018 	ipif_t	*ipif;
10019 	long	id;
10020 	ipsq_t	*ipsq;
10021 	ill_t	*ill;
10022 	sin_t	*sin;
10023 	int	err = 0;
10024 	boolean_t found_sep = B_FALSE;
10025 	conn_t	*connp;
10026 	zoneid_t zoneid;
10027 	int	orig_ifindex = 0;
10028 
10029 	ip1dbg(("ip_sioctl_addif\n"));
10030 	/* Existence of mp1 has been checked in ip_wput_nondata */
10031 	mp1 = mp->b_cont->b_cont;
10032 	/*
10033 	 * Null terminate the string to protect against buffer
10034 	 * overrun. String was generated by user code and may not
10035 	 * be trusted.
10036 	 */
10037 	lifr = (struct lifreq *)mp1->b_rptr;
10038 	lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
10039 	name = lifr->lifr_name;
10040 	ASSERT(CONN_Q(q));
10041 	connp = Q_TO_CONN(q);
10042 	isv6 = connp->conn_af_isv6;
10043 	zoneid = connp->conn_zoneid;
10044 	namelen = mi_strlen(name);
10045 	if (namelen == 0)
10046 		return (EINVAL);
10047 
10048 	exists = B_FALSE;
10049 	if ((namelen + 1 == sizeof (ipif_loopback_name)) &&
10050 	    (mi_strcmp(name, ipif_loopback_name) == 0)) {
10051 		/*
10052 		 * Allow creating lo0 using SIOCLIFADDIF.
10053 		 * can't be any other writer thread. So can pass null below
10054 		 * for the last 4 args to ipif_lookup_name.
10055 		 */
10056 		ipif = ipif_lookup_on_name(lifr->lifr_name, namelen,
10057 		    B_TRUE, &exists, isv6, zoneid, NULL, NULL, NULL, NULL);
10058 		/* Prevent any further action */
10059 		if (ipif == NULL) {
10060 			return (ENOBUFS);
10061 		} else if (!exists) {
10062 			/* We created the ipif now and as writer */
10063 			ipif_refrele(ipif);
10064 			return (0);
10065 		} else {
10066 			ill = ipif->ipif_ill;
10067 			ill_refhold(ill);
10068 			ipif_refrele(ipif);
10069 		}
10070 	} else {
10071 		/* Look for a colon in the name. */
10072 		endp = &name[namelen];
10073 		for (cp = endp; --cp > name; ) {
10074 			if (*cp == IPIF_SEPARATOR_CHAR) {
10075 				found_sep = B_TRUE;
10076 				/*
10077 				 * Reject any non-decimal aliases for plumbing
10078 				 * of logical interfaces. Aliases with leading
10079 				 * zeroes are also rejected as they introduce
10080 				 * ambiguity in the naming of the interfaces.
10081 				 * Comparing with "0" takes care of all such
10082 				 * cases.
10083 				 */
10084 				if ((strncmp("0", cp+1, 1)) == 0)
10085 					return (EINVAL);
10086 
10087 				if (ddi_strtol(cp+1, &endp, 10, &id) != 0 ||
10088 				    id <= 0 || *endp != '\0') {
10089 					return (EINVAL);
10090 				}
10091 				*cp = '\0';
10092 				break;
10093 			}
10094 		}
10095 		ill = ill_lookup_on_name(name, B_FALSE, isv6,
10096 		    CONNP_TO_WQ(connp), mp, ip_process_ioctl, &err, NULL);
10097 		if (found_sep)
10098 			*cp = IPIF_SEPARATOR_CHAR;
10099 		if (ill == NULL)
10100 			return (err);
10101 	}
10102 
10103 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_process_ioctl, NEW_OP,
10104 	    B_TRUE);
10105 
10106 	/*
10107 	 * Release the refhold due to the lookup, now that we are excl
10108 	 * or we are just returning
10109 	 */
10110 	ill_refrele(ill);
10111 
10112 	if (ipsq == NULL)
10113 		return (EINPROGRESS);
10114 
10115 	/*
10116 	 * If the interface is failed, inactive or offlined, look for a working
10117 	 * interface in the ill group and create the ipif there. If we can't
10118 	 * find a good interface, create the ipif anyway so that in.mpathd can
10119 	 * move it to the first repaired interface.
10120 	 */
10121 	if ((ill->ill_phyint->phyint_flags &
10122 	    (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) &&
10123 	    ill->ill_phyint->phyint_groupname_len != 0) {
10124 		phyint_t *phyi;
10125 		char *groupname = ill->ill_phyint->phyint_groupname;
10126 
10127 		/*
10128 		 * We're looking for a working interface, but it doesn't matter
10129 		 * if it's up or down; so instead of following the group lists,
10130 		 * we look at each physical interface and compare the groupname.
10131 		 * We're only interested in interfaces with IPv4 (resp. IPv6)
10132 		 * plumbed when we're adding an IPv4 (resp. IPv6) ipif.
10133 		 * Otherwise we create the ipif on the failed interface.
10134 		 */
10135 		rw_enter(&ill_g_lock, RW_READER);
10136 		phyi = avl_first(&phyint_g_list.phyint_list_avl_by_index);
10137 		for (; phyi != NULL;
10138 		    phyi = avl_walk(&phyint_g_list.phyint_list_avl_by_index,
10139 		    phyi, AVL_AFTER)) {
10140 			if (phyi->phyint_groupname_len == 0)
10141 				continue;
10142 			ASSERT(phyi->phyint_groupname != NULL);
10143 			if (mi_strcmp(groupname, phyi->phyint_groupname) == 0 &&
10144 			    !(phyi->phyint_flags &
10145 			    (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) &&
10146 			    (ill->ill_isv6 ? (phyi->phyint_illv6 != NULL) :
10147 			    (phyi->phyint_illv4 != NULL))) {
10148 				break;
10149 			}
10150 		}
10151 		rw_exit(&ill_g_lock);
10152 
10153 		if (phyi != NULL) {
10154 			orig_ifindex = ill->ill_phyint->phyint_ifindex;
10155 			ill = (ill->ill_isv6 ? phyi->phyint_illv6 :
10156 			    phyi->phyint_illv4);
10157 		}
10158 	}
10159 
10160 	/*
10161 	 * We are now exclusive on the ipsq, so an ill move will be serialized
10162 	 * before or after us.
10163 	 */
10164 	ASSERT(IAM_WRITER_ILL(ill));
10165 	ASSERT(ill->ill_move_in_progress == B_FALSE);
10166 
10167 	if (found_sep && orig_ifindex == 0) {
10168 		/* Now see if there is an IPIF with this unit number. */
10169 		for (ipif = ill->ill_ipif; ipif; ipif = ipif->ipif_next) {
10170 			if (ipif->ipif_id == id) {
10171 				err = EEXIST;
10172 				goto done;
10173 			}
10174 		}
10175 	}
10176 
10177 	/*
10178 	 * We use IRE_LOCAL for lo0:1 etc. for "receive only" use
10179 	 * of lo0. We never come here when we plumb lo0:0. It
10180 	 * happens in ipif_lookup_on_name.
10181 	 * The specified unit number is ignored when we create the ipif on a
10182 	 * different interface. However, we save it in ipif_orig_ipifid below so
10183 	 * that the ipif fails back to the right position.
10184 	 */
10185 	if ((ipif = ipif_allocate(ill, (found_sep && orig_ifindex == 0) ?
10186 	    id : -1, IRE_LOCAL, B_TRUE)) == NULL) {
10187 		err = ENOBUFS;
10188 		goto done;
10189 	}
10190 
10191 	/* Return created name with ioctl */
10192 	(void) sprintf(lifr->lifr_name, "%s%c%d", ill->ill_name,
10193 	    IPIF_SEPARATOR_CHAR, ipif->ipif_id);
10194 	ip1dbg(("created %s\n", lifr->lifr_name));
10195 
10196 	/* Set address */
10197 	sin = (sin_t *)&lifr->lifr_addr;
10198 	if (sin->sin_family != AF_UNSPEC) {
10199 		err = ip_sioctl_addr(ipif, sin, q, mp,
10200 		    &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], lifr);
10201 	}
10202 
10203 	/* Set ifindex and unit number for failback */
10204 	if (err == 0 && orig_ifindex != 0) {
10205 		ipif->ipif_orig_ifindex = orig_ifindex;
10206 		if (found_sep) {
10207 			ipif->ipif_orig_ipifid = id;
10208 		}
10209 	}
10210 
10211 done:
10212 	ipsq_exit(ipsq, B_TRUE, B_TRUE);
10213 	return (err);
10214 }
10215 
10216 /*
10217  * Remove an existing logical interface. If ipif_id is zero (i.e. not a logical
10218  * interface) delete it based on the IP address (on this physical interface).
10219  * Otherwise delete it based on the ipif_id.
10220  * Also, special handling to allow a removeif of lo0.
10221  */
10222 /* ARGSUSED */
10223 int
10224 ip_sioctl_removeif(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10225     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
10226 {
10227 	conn_t		*connp;
10228 	ill_t		*ill = ipif->ipif_ill;
10229 	boolean_t	 success;
10230 
10231 	ip1dbg(("ip_sioctl_remove_if(%s:%u %p)\n",
10232 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10233 	ASSERT(IAM_WRITER_IPIF(ipif));
10234 
10235 	connp = Q_TO_CONN(q);
10236 	/*
10237 	 * Special case for unplumbing lo0 (the loopback physical interface).
10238 	 * If unplumbing lo0, the incoming address structure has been
10239 	 * initialized to all zeros. When unplumbing lo0, all its logical
10240 	 * interfaces must be removed too.
10241 	 *
10242 	 * Note that this interface may be called to remove a specific
10243 	 * loopback logical interface (eg, lo0:1). But in that case
10244 	 * ipif->ipif_id != 0 so that the code path for that case is the
10245 	 * same as any other interface (meaning it skips the code directly
10246 	 * below).
10247 	 */
10248 	if (ipif->ipif_id == 0 && ipif->ipif_net_type == IRE_LOOPBACK) {
10249 		if (sin->sin_family == AF_UNSPEC &&
10250 		    (IN6_IS_ADDR_UNSPECIFIED(&((sin6_t *)sin)->sin6_addr))) {
10251 			/*
10252 			 * Mark it condemned. No new ref. will be made to ill.
10253 			 */
10254 			mutex_enter(&ill->ill_lock);
10255 			ill->ill_state_flags |= ILL_CONDEMNED;
10256 			for (ipif = ill->ill_ipif; ipif != NULL;
10257 			    ipif = ipif->ipif_next) {
10258 				ipif->ipif_state_flags |= IPIF_CONDEMNED;
10259 			}
10260 			mutex_exit(&ill->ill_lock);
10261 
10262 			ipif = ill->ill_ipif;
10263 			/* unplumb the loopback interface */
10264 			ill_delete(ill);
10265 			mutex_enter(&connp->conn_lock);
10266 			mutex_enter(&ill->ill_lock);
10267 			ASSERT(ill->ill_group == NULL);
10268 
10269 			/* Are any references to this ill active */
10270 			if (ill_is_quiescent(ill)) {
10271 				mutex_exit(&ill->ill_lock);
10272 				mutex_exit(&connp->conn_lock);
10273 				ill_delete_tail(ill);
10274 				mi_free(ill);
10275 				return (0);
10276 			}
10277 			success = ipsq_pending_mp_add(connp, ipif,
10278 			    CONNP_TO_WQ(connp), mp, ILL_FREE);
10279 			mutex_exit(&connp->conn_lock);
10280 			mutex_exit(&ill->ill_lock);
10281 			if (success)
10282 				return (EINPROGRESS);
10283 			else
10284 				return (EINTR);
10285 		}
10286 	}
10287 
10288 	/*
10289 	 * We are exclusive on the ipsq, so an ill move will be serialized
10290 	 * before or after us.
10291 	 */
10292 	ASSERT(ill->ill_move_in_progress == B_FALSE);
10293 
10294 	if (ipif->ipif_id == 0) {
10295 		/* Find based on address */
10296 		if (ipif->ipif_isv6) {
10297 			sin6_t *sin6;
10298 
10299 			if (sin->sin_family != AF_INET6)
10300 				return (EAFNOSUPPORT);
10301 
10302 			sin6 = (sin6_t *)sin;
10303 			/* We are a writer, so we should be able to lookup */
10304 			ipif = ipif_lookup_addr_v6(&sin6->sin6_addr,
10305 			    ill, ALL_ZONES, NULL, NULL, NULL, NULL);
10306 			if (ipif == NULL) {
10307 				/*
10308 				 * Maybe the address in on another interface in
10309 				 * the same IPMP group? We check this below.
10310 				 */
10311 				ipif = ipif_lookup_addr_v6(&sin6->sin6_addr,
10312 				    NULL, ALL_ZONES, NULL, NULL, NULL, NULL);
10313 			}
10314 		} else {
10315 			ipaddr_t addr;
10316 
10317 			if (sin->sin_family != AF_INET)
10318 				return (EAFNOSUPPORT);
10319 
10320 			addr = sin->sin_addr.s_addr;
10321 			/* We are a writer, so we should be able to lookup */
10322 			ipif = ipif_lookup_addr(addr, ill, ALL_ZONES, NULL,
10323 			    NULL, NULL, NULL);
10324 			if (ipif == NULL) {
10325 				/*
10326 				 * Maybe the address in on another interface in
10327 				 * the same IPMP group? We check this below.
10328 				 */
10329 				ipif = ipif_lookup_addr(addr, NULL, ALL_ZONES,
10330 				    NULL, NULL, NULL, NULL);
10331 			}
10332 		}
10333 		if (ipif == NULL) {
10334 			return (EADDRNOTAVAIL);
10335 		}
10336 		/*
10337 		 * When the address to be removed is hosted on a different
10338 		 * interface, we check if the interface is in the same IPMP
10339 		 * group as the specified one; if so we proceed with the
10340 		 * removal.
10341 		 * ill->ill_group is NULL when the ill is down, so we have to
10342 		 * compare the group names instead.
10343 		 */
10344 		if (ipif->ipif_ill != ill &&
10345 		    (ipif->ipif_ill->ill_phyint->phyint_groupname_len == 0 ||
10346 		    ill->ill_phyint->phyint_groupname_len == 0 ||
10347 		    mi_strcmp(ipif->ipif_ill->ill_phyint->phyint_groupname,
10348 		    ill->ill_phyint->phyint_groupname) != 0)) {
10349 			ipif_refrele(ipif);
10350 			return (EADDRNOTAVAIL);
10351 		}
10352 
10353 		/* This is a writer */
10354 		ipif_refrele(ipif);
10355 	}
10356 
10357 	/*
10358 	 * Can not delete instance zero since it is tied to the ill.
10359 	 */
10360 	if (ipif->ipif_id == 0)
10361 		return (EBUSY);
10362 
10363 	mutex_enter(&ill->ill_lock);
10364 	ipif->ipif_state_flags |= IPIF_CONDEMNED;
10365 	mutex_exit(&ill->ill_lock);
10366 
10367 	ipif_free(ipif);
10368 
10369 	mutex_enter(&connp->conn_lock);
10370 	mutex_enter(&ill->ill_lock);
10371 
10372 	/* Are any references to this ipif active */
10373 	if (ipif->ipif_refcnt == 0 && ipif->ipif_ire_cnt == 0) {
10374 		mutex_exit(&ill->ill_lock);
10375 		mutex_exit(&connp->conn_lock);
10376 		ipif_down_tail(ipif);
10377 		ipif_free_tail(ipif);
10378 		return (0);
10379 	    }
10380 	success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp), mp,
10381 	    IPIF_FREE);
10382 	mutex_exit(&ill->ill_lock);
10383 	mutex_exit(&connp->conn_lock);
10384 	if (success)
10385 		return (EINPROGRESS);
10386 	else
10387 		return (EINTR);
10388 }
10389 
10390 /*
10391  * Restart the removeif ioctl. The refcnt has gone down to 0.
10392  * The ipif is already condemned. So can't find it thru lookups.
10393  */
10394 /* ARGSUSED */
10395 int
10396 ip_sioctl_removeif_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
10397     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_if_req)
10398 {
10399 	ill_t *ill;
10400 
10401 	ip1dbg(("ip_sioctl_removeif_restart(%s:%u %p)\n",
10402 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10403 	if (ipif->ipif_id == 0 && ipif->ipif_net_type == IRE_LOOPBACK) {
10404 		ill = ipif->ipif_ill;
10405 		ASSERT(IAM_WRITER_ILL(ill));
10406 		ASSERT((ipif->ipif_state_flags & IPIF_CONDEMNED) &&
10407 		    (ill->ill_state_flags & IPIF_CONDEMNED));
10408 		ill_delete_tail(ill);
10409 		mi_free(ill);
10410 		return (0);
10411 	}
10412 
10413 	ill = ipif->ipif_ill;
10414 	ASSERT(IAM_WRITER_IPIF(ipif));
10415 	ASSERT(ipif->ipif_state_flags & IPIF_CONDEMNED);
10416 
10417 	ipif_down_tail(ipif);
10418 	ipif_free_tail(ipif);
10419 
10420 	ILL_UNMARK_CHANGING(ill);
10421 	return (0);
10422 }
10423 
10424 /*
10425  * Set the local interface address.
10426  * Allow an address of all zero when the interface is down.
10427  */
10428 /* ARGSUSED */
10429 int
10430 ip_sioctl_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10431     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
10432 {
10433 	int err = 0;
10434 	in6_addr_t v6addr;
10435 	boolean_t need_up = B_FALSE;
10436 
10437 	ip1dbg(("ip_sioctl_addr(%s:%u %p)\n",
10438 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10439 
10440 	ASSERT(IAM_WRITER_IPIF(ipif));
10441 
10442 	if (ipif->ipif_isv6) {
10443 		sin6_t *sin6;
10444 		ill_t *ill;
10445 		phyint_t *phyi;
10446 
10447 		if (sin->sin_family != AF_INET6)
10448 			return (EAFNOSUPPORT);
10449 
10450 		sin6 = (sin6_t *)sin;
10451 		v6addr = sin6->sin6_addr;
10452 		ill = ipif->ipif_ill;
10453 		phyi = ill->ill_phyint;
10454 
10455 		/*
10456 		 * Enforce that true multicast interfaces have a link-local
10457 		 * address for logical unit 0.
10458 		 */
10459 		if (ipif->ipif_id == 0 &&
10460 		    (ill->ill_flags & ILLF_MULTICAST) &&
10461 		    !(ipif->ipif_flags & (IPIF_POINTOPOINT)) &&
10462 		    !(phyi->phyint_flags & (PHYI_LOOPBACK)) &&
10463 		    !IN6_IS_ADDR_LINKLOCAL(&v6addr)) {
10464 			return (EADDRNOTAVAIL);
10465 		}
10466 
10467 		/*
10468 		 * up interfaces shouldn't have the unspecified address
10469 		 * unless they also have the IPIF_NOLOCAL flags set and
10470 		 * have a subnet assigned.
10471 		 */
10472 		if ((ipif->ipif_flags & IPIF_UP) &&
10473 		    IN6_IS_ADDR_UNSPECIFIED(&v6addr) &&
10474 		    (!(ipif->ipif_flags & IPIF_NOLOCAL) ||
10475 		    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) {
10476 			return (EADDRNOTAVAIL);
10477 		}
10478 
10479 		if (!ip_local_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
10480 			return (EADDRNOTAVAIL);
10481 	} else {
10482 		ipaddr_t addr;
10483 
10484 		if (sin->sin_family != AF_INET)
10485 			return (EAFNOSUPPORT);
10486 
10487 		addr = sin->sin_addr.s_addr;
10488 
10489 		/* Allow 0 as the local address. */
10490 		if (addr != 0 && !ip_addr_ok_v4(addr, ipif->ipif_net_mask))
10491 			return (EADDRNOTAVAIL);
10492 
10493 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10494 	}
10495 
10496 
10497 	/*
10498 	 * Even if there is no change we redo things just to rerun
10499 	 * ipif_set_default.
10500 	 */
10501 	if (ipif->ipif_flags & IPIF_UP) {
10502 		/*
10503 		 * Setting a new local address, make sure
10504 		 * we have net and subnet bcast ire's for
10505 		 * the old address if we need them.
10506 		 */
10507 		if (!ipif->ipif_isv6)
10508 			ipif_check_bcast_ires(ipif);
10509 		/*
10510 		 * If the interface is already marked up,
10511 		 * we call ipif_down which will take care
10512 		 * of ditching any IREs that have been set
10513 		 * up based on the old interface address.
10514 		 */
10515 		err = ipif_logical_down(ipif, q, mp);
10516 		if (err == EINPROGRESS)
10517 			return (err);
10518 		ipif_down_tail(ipif);
10519 		need_up = 1;
10520 	}
10521 
10522 	err = ip_sioctl_addr_tail(ipif, sin, q, mp, need_up);
10523 	return (err);
10524 }
10525 
10526 int
10527 ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10528     boolean_t need_up)
10529 {
10530 	in6_addr_t v6addr;
10531 	ipaddr_t addr;
10532 	sin6_t	*sin6;
10533 	int	err = 0;
10534 
10535 	ip1dbg(("ip_sioctl_addr_tail(%s:%u %p)\n",
10536 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10537 	ASSERT(IAM_WRITER_IPIF(ipif));
10538 	if (ipif->ipif_isv6) {
10539 		sin6 = (sin6_t *)sin;
10540 		v6addr = sin6->sin6_addr;
10541 	} else {
10542 		addr = sin->sin_addr.s_addr;
10543 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10544 	}
10545 	mutex_enter(&ipif->ipif_ill->ill_lock);
10546 	ipif->ipif_v6lcl_addr = v6addr;
10547 	if (ipif->ipif_flags & (IPIF_ANYCAST | IPIF_NOLOCAL)) {
10548 		ipif->ipif_v6src_addr = ipv6_all_zeros;
10549 	} else {
10550 		ipif->ipif_v6src_addr = v6addr;
10551 	}
10552 
10553 	if ((ipif->ipif_isv6) && IN6_IS_ADDR_6TO4(&v6addr) &&
10554 		(!ipif->ipif_ill->ill_is_6to4tun)) {
10555 		queue_t *wqp = ipif->ipif_ill->ill_wq;
10556 
10557 		/*
10558 		 * The local address of this interface is a 6to4 address,
10559 		 * check if this interface is in fact a 6to4 tunnel or just
10560 		 * an interface configured with a 6to4 address.  We are only
10561 		 * interested in the former.
10562 		 */
10563 		if (wqp != NULL) {
10564 			while ((wqp->q_next != NULL) &&
10565 			    (wqp->q_next->q_qinfo != NULL) &&
10566 			    (wqp->q_next->q_qinfo->qi_minfo != NULL)) {
10567 
10568 				if (wqp->q_next->q_qinfo->qi_minfo->mi_idnum
10569 				    == TUN6TO4_MODID) {
10570 					/* set for use in IP */
10571 					ipif->ipif_ill->ill_is_6to4tun = 1;
10572 					break;
10573 				}
10574 				wqp = wqp->q_next;
10575 			}
10576 		}
10577 	}
10578 
10579 	ipif_set_default(ipif);
10580 	mutex_exit(&ipif->ipif_ill->ill_lock);
10581 
10582 	if (need_up) {
10583 		/*
10584 		 * Now bring the interface back up.  If this
10585 		 * is the only IPIF for the ILL, ipif_up
10586 		 * will have to re-bind to the device, so
10587 		 * we may get back EINPROGRESS, in which
10588 		 * case, this IOCTL will get completed in
10589 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
10590 		 */
10591 		err = ipif_up(ipif, q, mp);
10592 	} else {
10593 		/*
10594 		 * Update the IPIF list in SCTP, ipif_up_done() will do it
10595 		 * if need_up is true.
10596 		 */
10597 		sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
10598 	}
10599 
10600 	return (err);
10601 }
10602 
10603 
10604 /*
10605  * Restart entry point to restart the address set operation after the
10606  * refcounts have dropped to zero.
10607  */
10608 /* ARGSUSED */
10609 int
10610 ip_sioctl_addr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10611     ip_ioctl_cmd_t *ipip, void *ifreq)
10612 {
10613 	ip1dbg(("ip_sioctl_addr_restart(%s:%u %p)\n",
10614 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10615 	ASSERT(IAM_WRITER_IPIF(ipif));
10616 	ipif_down_tail(ipif);
10617 	return (ip_sioctl_addr_tail(ipif, sin, q, mp, B_TRUE));
10618 }
10619 
10620 /* ARGSUSED */
10621 int
10622 ip_sioctl_get_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10623     ip_ioctl_cmd_t *ipip, void *if_req)
10624 {
10625 	sin6_t *sin6 = (struct sockaddr_in6 *)sin;
10626 	struct lifreq *lifr = (struct lifreq *)if_req;
10627 
10628 	ip1dbg(("ip_sioctl_get_addr(%s:%u %p)\n",
10629 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10630 	/*
10631 	 * The net mask and address can't change since we have a
10632 	 * reference to the ipif. So no lock is necessary.
10633 	 */
10634 	if (ipif->ipif_isv6) {
10635 		*sin6 = sin6_null;
10636 		sin6->sin6_family = AF_INET6;
10637 		sin6->sin6_addr = ipif->ipif_v6lcl_addr;
10638 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
10639 		lifr->lifr_addrlen =
10640 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
10641 	} else {
10642 		*sin = sin_null;
10643 		sin->sin_family = AF_INET;
10644 		sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
10645 		if (ipip->ipi_cmd_type == LIF_CMD) {
10646 			lifr->lifr_addrlen =
10647 			    ip_mask_to_plen(ipif->ipif_net_mask);
10648 		}
10649 	}
10650 	return (0);
10651 }
10652 
10653 /*
10654  * Set the destination address for a pt-pt interface.
10655  */
10656 /* ARGSUSED */
10657 int
10658 ip_sioctl_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10659     ip_ioctl_cmd_t *ipip, void *if_req)
10660 {
10661 	int err = 0;
10662 	in6_addr_t v6addr;
10663 	boolean_t need_up = B_FALSE;
10664 
10665 	ip1dbg(("ip_sioctl_dstaddr(%s:%u %p)\n",
10666 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10667 	ASSERT(IAM_WRITER_IPIF(ipif));
10668 
10669 	if (ipif->ipif_isv6) {
10670 		sin6_t *sin6;
10671 
10672 		if (sin->sin_family != AF_INET6)
10673 			return (EAFNOSUPPORT);
10674 
10675 		sin6 = (sin6_t *)sin;
10676 		v6addr = sin6->sin6_addr;
10677 
10678 		if (!ip_remote_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
10679 			return (EADDRNOTAVAIL);
10680 	} else {
10681 		ipaddr_t addr;
10682 
10683 		if (sin->sin_family != AF_INET)
10684 			return (EAFNOSUPPORT);
10685 
10686 		addr = sin->sin_addr.s_addr;
10687 		if (!ip_addr_ok_v4(addr, ipif->ipif_net_mask))
10688 			return (EADDRNOTAVAIL);
10689 
10690 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10691 	}
10692 
10693 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, &v6addr))
10694 		return (0);	/* No change */
10695 
10696 	if (ipif->ipif_flags & IPIF_UP) {
10697 		/*
10698 		 * If the interface is already marked up,
10699 		 * we call ipif_down which will take care
10700 		 * of ditching any IREs that have been set
10701 		 * up based on the old pp dst address.
10702 		 */
10703 		err = ipif_logical_down(ipif, q, mp);
10704 		if (err == EINPROGRESS)
10705 			return (err);
10706 		ipif_down_tail(ipif);
10707 		need_up = B_TRUE;
10708 	}
10709 	/*
10710 	 * could return EINPROGRESS. If so ioctl will complete in
10711 	 * ip_rput_dlpi_writer
10712 	 */
10713 	err = ip_sioctl_dstaddr_tail(ipif, sin, q, mp, need_up);
10714 	return (err);
10715 }
10716 
10717 static int
10718 ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10719     boolean_t need_up)
10720 {
10721 	in6_addr_t v6addr;
10722 	ill_t	*ill = ipif->ipif_ill;
10723 	int	err = 0;
10724 
10725 	ip1dbg(("ip_sioctl_dstaddr_tail(%s:%u %p)\n",
10726 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10727 	if (ipif->ipif_isv6) {
10728 		sin6_t *sin6;
10729 
10730 		sin6 = (sin6_t *)sin;
10731 		v6addr = sin6->sin6_addr;
10732 	} else {
10733 		ipaddr_t addr;
10734 
10735 		addr = sin->sin_addr.s_addr;
10736 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10737 	}
10738 	mutex_enter(&ill->ill_lock);
10739 	/* Set point to point destination address. */
10740 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
10741 		/*
10742 		 * Allow this as a means of creating logical
10743 		 * pt-pt interfaces on top of e.g. an Ethernet.
10744 		 * XXX Undocumented HACK for testing.
10745 		 * pt-pt interfaces are created with NUD disabled.
10746 		 */
10747 		ipif->ipif_flags |= IPIF_POINTOPOINT;
10748 		ipif->ipif_flags &= ~IPIF_BROADCAST;
10749 		if (ipif->ipif_isv6)
10750 			ipif->ipif_ill->ill_flags |= ILLF_NONUD;
10751 	}
10752 
10753 	/* Set the new address. */
10754 	ipif->ipif_v6pp_dst_addr = v6addr;
10755 	/* Make sure subnet tracks pp_dst */
10756 	ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
10757 	mutex_exit(&ill->ill_lock);
10758 
10759 	if (need_up) {
10760 		/*
10761 		 * Now bring the interface back up.  If this
10762 		 * is the only IPIF for the ILL, ipif_up
10763 		 * will have to re-bind to the device, so
10764 		 * we may get back EINPROGRESS, in which
10765 		 * case, this IOCTL will get completed in
10766 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
10767 		 */
10768 		err = ipif_up(ipif, q, mp);
10769 	}
10770 	return (err);
10771 }
10772 
10773 /*
10774  * Restart entry point to restart the dstaddress set operation after the
10775  * refcounts have dropped to zero.
10776  */
10777 /* ARGSUSED */
10778 int
10779 ip_sioctl_dstaddr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10780     ip_ioctl_cmd_t *ipip, void *ifreq)
10781 {
10782 	ip1dbg(("ip_sioctl_dstaddr_restart(%s:%u %p)\n",
10783 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10784 	ipif_down_tail(ipif);
10785 	return (ip_sioctl_dstaddr_tail(ipif, sin, q, mp, B_TRUE));
10786 }
10787 
10788 /* ARGSUSED */
10789 int
10790 ip_sioctl_get_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10791     ip_ioctl_cmd_t *ipip, void *if_req)
10792 {
10793 	sin6_t	*sin6 = (struct sockaddr_in6 *)sin;
10794 
10795 	ip1dbg(("ip_sioctl_get_dstaddr(%s:%u %p)\n",
10796 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10797 	/*
10798 	 * Get point to point destination address. The addresses can't
10799 	 * change since we hold a reference to the ipif.
10800 	 */
10801 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0)
10802 		return (EADDRNOTAVAIL);
10803 
10804 	if (ipif->ipif_isv6) {
10805 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
10806 		*sin6 = sin6_null;
10807 		sin6->sin6_family = AF_INET6;
10808 		sin6->sin6_addr = ipif->ipif_v6pp_dst_addr;
10809 	} else {
10810 		*sin = sin_null;
10811 		sin->sin_family = AF_INET;
10812 		sin->sin_addr.s_addr = ipif->ipif_pp_dst_addr;
10813 	}
10814 	return (0);
10815 }
10816 
10817 /*
10818  * part of ipmp, make this func return the active/inactive state and
10819  * caller can set once atomically instead of multiple mutex_enter/mutex_exit
10820  */
10821 /*
10822  * This function either sets or clears the IFF_INACTIVE flag.
10823  *
10824  * As long as there are some addresses or multicast memberships on the
10825  * IPv4 or IPv6 interface of the "phyi" that does not belong in here, we
10826  * will consider it to be ACTIVE (clear IFF_INACTIVE) i.e the interface
10827  * will be used for outbound packets.
10828  *
10829  * Caller needs to verify the validity of setting IFF_INACTIVE.
10830  */
10831 static void
10832 phyint_inactive(phyint_t *phyi)
10833 {
10834 	ill_t *ill_v4;
10835 	ill_t *ill_v6;
10836 	ipif_t *ipif;
10837 	ilm_t *ilm;
10838 
10839 	ill_v4 = phyi->phyint_illv4;
10840 	ill_v6 = phyi->phyint_illv6;
10841 
10842 	/*
10843 	 * No need for a lock while traversing the list since iam
10844 	 * a writer
10845 	 */
10846 	if (ill_v4 != NULL) {
10847 		ASSERT(IAM_WRITER_ILL(ill_v4));
10848 		for (ipif = ill_v4->ill_ipif; ipif != NULL;
10849 		    ipif = ipif->ipif_next) {
10850 			if (ipif->ipif_orig_ifindex != phyi->phyint_ifindex) {
10851 				mutex_enter(&phyi->phyint_lock);
10852 				phyi->phyint_flags &= ~PHYI_INACTIVE;
10853 				mutex_exit(&phyi->phyint_lock);
10854 				return;
10855 			}
10856 		}
10857 		for (ilm = ill_v4->ill_ilm; ilm != NULL;
10858 		    ilm = ilm->ilm_next) {
10859 			if (ilm->ilm_orig_ifindex != phyi->phyint_ifindex) {
10860 				mutex_enter(&phyi->phyint_lock);
10861 				phyi->phyint_flags &= ~PHYI_INACTIVE;
10862 				mutex_exit(&phyi->phyint_lock);
10863 				return;
10864 			}
10865 		}
10866 	}
10867 	if (ill_v6 != NULL) {
10868 		ill_v6 = phyi->phyint_illv6;
10869 		for (ipif = ill_v6->ill_ipif; ipif != NULL;
10870 		    ipif = ipif->ipif_next) {
10871 			if (ipif->ipif_orig_ifindex != phyi->phyint_ifindex) {
10872 				mutex_enter(&phyi->phyint_lock);
10873 				phyi->phyint_flags &= ~PHYI_INACTIVE;
10874 				mutex_exit(&phyi->phyint_lock);
10875 				return;
10876 			}
10877 		}
10878 		for (ilm = ill_v6->ill_ilm; ilm != NULL;
10879 		    ilm = ilm->ilm_next) {
10880 			if (ilm->ilm_orig_ifindex != phyi->phyint_ifindex) {
10881 				mutex_enter(&phyi->phyint_lock);
10882 				phyi->phyint_flags &= ~PHYI_INACTIVE;
10883 				mutex_exit(&phyi->phyint_lock);
10884 				return;
10885 			}
10886 		}
10887 	}
10888 	mutex_enter(&phyi->phyint_lock);
10889 	phyi->phyint_flags |= PHYI_INACTIVE;
10890 	mutex_exit(&phyi->phyint_lock);
10891 }
10892 
10893 /*
10894  * This function is called only when the phyint flags change. Currently
10895  * called from ip_sioctl_flags. We re-do the broadcast nomination so
10896  * that we can select a good ill.
10897  */
10898 static void
10899 ip_redo_nomination(phyint_t *phyi)
10900 {
10901 	ill_t *ill_v4;
10902 
10903 	ill_v4 = phyi->phyint_illv4;
10904 
10905 	if (ill_v4 != NULL && ill_v4->ill_group != NULL) {
10906 		ASSERT(IAM_WRITER_ILL(ill_v4));
10907 		if (ill_v4->ill_group->illgrp_ill_count > 1)
10908 			ill_nominate_bcast_rcv(ill_v4->ill_group);
10909 	}
10910 }
10911 
10912 /*
10913  * Heuristic to check if ill is INACTIVE.
10914  * Checks if ill has an ipif with an usable ip address.
10915  *
10916  * Return values:
10917  *	B_TRUE	- ill is INACTIVE; has no usable ipif
10918  *	B_FALSE - ill is not INACTIVE; ill has at least one usable ipif
10919  */
10920 static boolean_t
10921 ill_is_inactive(ill_t *ill)
10922 {
10923 	ipif_t *ipif;
10924 
10925 	/* Check whether it is in an IPMP group */
10926 	if (ill->ill_phyint->phyint_groupname == NULL)
10927 		return (B_FALSE);
10928 
10929 	if (ill->ill_ipif_up_count == 0)
10930 		return (B_TRUE);
10931 
10932 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
10933 		uint64_t flags = ipif->ipif_flags;
10934 
10935 		/*
10936 		 * This ipif is usable if it is IPIF_UP and not a
10937 		 * dedicated test address.  A dedicated test address
10938 		 * is marked IPIF_NOFAILOVER *and* IPIF_DEPRECATED
10939 		 * (note in particular that V6 test addresses are
10940 		 * link-local data addresses and thus are marked
10941 		 * IPIF_NOFAILOVER but not IPIF_DEPRECATED).
10942 		 */
10943 		if ((flags & IPIF_UP) &&
10944 		    ((flags & (IPIF_DEPRECATED|IPIF_NOFAILOVER)) !=
10945 		    (IPIF_DEPRECATED|IPIF_NOFAILOVER)))
10946 			return (B_FALSE);
10947 	}
10948 	return (B_TRUE);
10949 }
10950 
10951 /*
10952  * Set interface flags.
10953  * Need to do special action for IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT,
10954  * IPIF_NOLOCAL, ILLF_NONUD, ILLF_NOARP, IPIF_PRIVATE, IPIF_ANYCAST,
10955  * IPIF_PREFERRED, PHYI_STANDBY, PHYI_FAILED and PHYI_OFFLINE.
10956  *
10957  * NOTE : We really don't enforce that ipif_id zero should be used
10958  *	  for setting any flags other than IFF_LOGINT_FLAGS. This
10959  *	  is because applications generally does SICGLIFFLAGS and
10960  *	  ORs in the new flags (that affects the logical) and does a
10961  *	  SIOCSLIFFLAGS. Thus, "flags" below could contain bits other
10962  *	  than IFF_LOGINT_FLAGS. One could check whether "turn_on" - the
10963  *	  flags that will be turned on is correct with respect to
10964  *	  ipif_id 0. For backward compatibility reasons, it is not done.
10965  */
10966 /* ARGSUSED */
10967 int
10968 ip_sioctl_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10969     ip_ioctl_cmd_t *ipip, void *if_req)
10970 {
10971 	uint64_t turn_on;
10972 	uint64_t turn_off;
10973 	int	err;
10974 	boolean_t need_up = B_FALSE;
10975 	phyint_t *phyi;
10976 	ill_t *ill;
10977 	uint64_t intf_flags;
10978 	boolean_t phyint_flags_modified = B_FALSE;
10979 	uint64_t flags;
10980 	struct ifreq *ifr;
10981 	struct lifreq *lifr;
10982 	boolean_t set_linklocal = B_FALSE;
10983 	boolean_t zero_source = B_FALSE;
10984 
10985 	ip1dbg(("ip_sioctl_flags(%s:%u %p)\n",
10986 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10987 
10988 	ASSERT(IAM_WRITER_IPIF(ipif));
10989 
10990 	ill = ipif->ipif_ill;
10991 	phyi = ill->ill_phyint;
10992 
10993 	if (ipip->ipi_cmd_type == IF_CMD) {
10994 		ifr = (struct ifreq *)if_req;
10995 		flags =  (uint64_t)(ifr->ifr_flags & 0x0000ffff);
10996 	} else {
10997 		lifr = (struct lifreq *)if_req;
10998 		flags = lifr->lifr_flags;
10999 	}
11000 
11001 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
11002 
11003 	/*
11004 	 * Has the flags been set correctly till now ?
11005 	 */
11006 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
11007 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
11008 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
11009 	/*
11010 	 * Compare the new flags to the old, and partition
11011 	 * into those coming on and those going off.
11012 	 * For the 16 bit command keep the bits above bit 16 unchanged.
11013 	 */
11014 	if (ipip->ipi_cmd == SIOCSIFFLAGS)
11015 		flags |= intf_flags & ~0xFFFF;
11016 
11017 	/*
11018 	 * First check which bits will change and then which will
11019 	 * go on and off
11020 	 */
11021 	turn_on = (flags ^ intf_flags) & ~IFF_CANTCHANGE;
11022 	if (!turn_on)
11023 		return (0);	/* No change */
11024 
11025 	turn_off = intf_flags & turn_on;
11026 	turn_on ^= turn_off;
11027 	err = 0;
11028 
11029 	/*
11030 	 * Don't allow any bits belonging to the logical interface
11031 	 * to be set or cleared on the replacement ipif that was
11032 	 * created temporarily during a MOVE.
11033 	 */
11034 	if (ipif->ipif_replace_zero &&
11035 	    ((turn_on|turn_off) & IFF_LOGINT_FLAGS) != 0) {
11036 		return (EINVAL);
11037 	}
11038 
11039 	/*
11040 	 * Only allow the IFF_XRESOLV and IFF_TEMPORARY flags to be set on
11041 	 * IPv6 interfaces.
11042 	 */
11043 	if ((turn_on & (IFF_XRESOLV|IFF_TEMPORARY)) && !(ipif->ipif_isv6))
11044 		return (EINVAL);
11045 
11046 	/*
11047 	 * Don't allow the IFF_ROUTER flag to be turned on on loopback
11048 	 * interfaces.  It makes no sense in that context.
11049 	 */
11050 	if ((turn_on & IFF_ROUTER) && (phyi->phyint_flags & PHYI_LOOPBACK))
11051 		return (EINVAL);
11052 
11053 	if (flags & (IFF_NOLOCAL|IFF_ANYCAST))
11054 		zero_source = B_TRUE;
11055 
11056 	/*
11057 	 * For IPv6 ipif_id 0, don't allow the interface to be up without
11058 	 * a link local address if IFF_NOLOCAL or IFF_ANYCAST are not set.
11059 	 * If the link local address isn't set, and can be set, it will get
11060 	 * set later on in this function.
11061 	 */
11062 	if (ipif->ipif_id == 0 && ipif->ipif_isv6 &&
11063 	    (flags & IFF_UP) && !zero_source &&
11064 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
11065 		if (ipif_cant_setlinklocal(ipif))
11066 			return (EINVAL);
11067 		set_linklocal = B_TRUE;
11068 	}
11069 
11070 	/*
11071 	 * ILL cannot be part of a usesrc group and and IPMP group at the
11072 	 * same time. No need to grab ill_g_usesrc_lock here, see
11073 	 * synchronization notes in ip.c
11074 	 */
11075 	if (turn_on & PHYI_STANDBY &&
11076 	    ipif->ipif_ill->ill_usesrc_grp_next != NULL) {
11077 		return (EINVAL);
11078 	}
11079 
11080 	/*
11081 	 * If we modify physical interface flags, we'll potentially need to
11082 	 * send up two routing socket messages for the changes (one for the
11083 	 * IPv4 ill, and another for the IPv6 ill).  Note that here.
11084 	 */
11085 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
11086 		phyint_flags_modified = B_TRUE;
11087 
11088 	/*
11089 	 * If we are setting or clearing FAILED or STANDBY or OFFLINE,
11090 	 * we need to flush the IRE_CACHES belonging to this ill.
11091 	 * We handle this case here without doing the DOWN/UP dance
11092 	 * like it is done for other flags. If some other flags are
11093 	 * being turned on/off with FAILED/STANDBY/OFFLINE, the code
11094 	 * below will handle it by bringing it down and then
11095 	 * bringing it UP.
11096 	 */
11097 	if ((turn_on|turn_off) & (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE)) {
11098 		ill_t *ill_v4, *ill_v6;
11099 
11100 		ill_v4 = phyi->phyint_illv4;
11101 		ill_v6 = phyi->phyint_illv6;
11102 
11103 		/*
11104 		 * First set the INACTIVE flag if needed. Then delete the ires.
11105 		 * ire_add will atomically prevent creating new IRE_CACHEs
11106 		 * unless hidden flag is set.
11107 		 * PHYI_FAILED and PHYI_INACTIVE are exclusive
11108 		 */
11109 		if ((turn_on & PHYI_FAILED) &&
11110 		    ((intf_flags & PHYI_STANDBY) || !ipmp_enable_failback)) {
11111 			/* Reset PHYI_INACTIVE when PHYI_FAILED is being set */
11112 			phyi->phyint_flags &= ~PHYI_INACTIVE;
11113 		}
11114 		if ((turn_off & PHYI_FAILED) &&
11115 		    ((intf_flags & PHYI_STANDBY) ||
11116 		    (!ipmp_enable_failback && ill_is_inactive(ill)))) {
11117 			phyint_inactive(phyi);
11118 		}
11119 
11120 		if (turn_on & PHYI_STANDBY) {
11121 			/*
11122 			 * We implicitly set INACTIVE only when STANDBY is set.
11123 			 * INACTIVE is also set on non-STANDBY phyint when user
11124 			 * disables FAILBACK using configuration file.
11125 			 * Do not allow STANDBY to be set on such INACTIVE
11126 			 * phyint
11127 			 */
11128 			if (phyi->phyint_flags & PHYI_INACTIVE)
11129 				return (EINVAL);
11130 			if (!(phyi->phyint_flags & PHYI_FAILED))
11131 				phyint_inactive(phyi);
11132 		}
11133 		if (turn_off & PHYI_STANDBY) {
11134 			if (ipmp_enable_failback) {
11135 				/*
11136 				 * Reset PHYI_INACTIVE.
11137 				 */
11138 				phyi->phyint_flags &= ~PHYI_INACTIVE;
11139 			} else if (ill_is_inactive(ill) &&
11140 			    !(phyi->phyint_flags & PHYI_FAILED)) {
11141 				/*
11142 				 * Need to set INACTIVE, when user sets
11143 				 * STANDBY on a non-STANDBY phyint and
11144 				 * later resets STANDBY
11145 				 */
11146 				phyint_inactive(phyi);
11147 			}
11148 		}
11149 		/*
11150 		 * We should always send up a message so that the
11151 		 * daemons come to know of it. Note that the zeroth
11152 		 * interface can be down and the check below for IPIF_UP
11153 		 * will not make sense as we are actually setting
11154 		 * a phyint flag here. We assume that the ipif used
11155 		 * is always the zeroth ipif. (ip_rts_ifmsg does not
11156 		 * send up any message for non-zero ipifs).
11157 		 */
11158 		phyint_flags_modified = B_TRUE;
11159 
11160 		if (ill_v4 != NULL) {
11161 			ire_walk_ill_v4(MATCH_IRE_ILL | MATCH_IRE_TYPE,
11162 			    IRE_CACHE, ill_stq_cache_delete,
11163 			    (char *)ill_v4, ill_v4);
11164 			illgrp_reset_schednext(ill_v4);
11165 		}
11166 		if (ill_v6 != NULL) {
11167 			ire_walk_ill_v6(MATCH_IRE_ILL | MATCH_IRE_TYPE,
11168 			    IRE_CACHE, ill_stq_cache_delete,
11169 			    (char *)ill_v6, ill_v6);
11170 			illgrp_reset_schednext(ill_v6);
11171 		}
11172 	}
11173 
11174 	/*
11175 	 * If ILLF_ROUTER changes, we need to change the ip forwarding
11176 	 * status of the interface and, if the interface is part of an IPMP
11177 	 * group, all other interfaces that are part of the same IPMP
11178 	 * group.
11179 	 */
11180 	if ((turn_on | turn_off) & ILLF_ROUTER) {
11181 		(void) ill_forward_set(q, mp, ((turn_on & ILLF_ROUTER) != 0),
11182 		    (caddr_t)ill);
11183 	}
11184 
11185 	/*
11186 	 * If the interface is not UP and we are not going to
11187 	 * bring it UP, record the flags and return. When the
11188 	 * interface comes UP later, the right actions will be
11189 	 * taken.
11190 	 */
11191 	if (!(ipif->ipif_flags & IPIF_UP) &&
11192 	    !(turn_on & IPIF_UP)) {
11193 		/* Record new flags in their respective places. */
11194 		mutex_enter(&ill->ill_lock);
11195 		mutex_enter(&ill->ill_phyint->phyint_lock);
11196 		ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
11197 		ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
11198 		ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
11199 		ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
11200 		phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
11201 		phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
11202 		mutex_exit(&ill->ill_lock);
11203 		mutex_exit(&ill->ill_phyint->phyint_lock);
11204 
11205 		/*
11206 		 * We do the broadcast and nomination here rather
11207 		 * than waiting for a FAILOVER/FAILBACK to happen. In
11208 		 * the case of FAILBACK from INACTIVE standby to the
11209 		 * interface that has been repaired, PHYI_FAILED has not
11210 		 * been cleared yet. If there are only two interfaces in
11211 		 * that group, all we have is a FAILED and INACTIVE
11212 		 * interface. If we do the nomination soon after a failback,
11213 		 * the broadcast nomination code would select the
11214 		 * INACTIVE interface for receiving broadcasts as FAILED is
11215 		 * not yet cleared. As we don't want STANDBY/INACTIVE to
11216 		 * receive broadcast packets, we need to redo nomination
11217 		 * when the FAILED is cleared here. Thus, in general we
11218 		 * always do the nomination here for FAILED, STANDBY
11219 		 * and OFFLINE.
11220 		 */
11221 		if (((turn_on | turn_off) &
11222 		    (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE))) {
11223 			ip_redo_nomination(phyi);
11224 		}
11225 		if (phyint_flags_modified) {
11226 			if (phyi->phyint_illv4 != NULL) {
11227 				ip_rts_ifmsg(phyi->phyint_illv4->
11228 				    ill_ipif);
11229 			}
11230 			if (phyi->phyint_illv6 != NULL) {
11231 				ip_rts_ifmsg(phyi->phyint_illv6->
11232 				    ill_ipif);
11233 			}
11234 		}
11235 		return (0);
11236 	} else if (set_linklocal || zero_source) {
11237 		mutex_enter(&ill->ill_lock);
11238 		if (set_linklocal)
11239 			ipif->ipif_state_flags |= IPIF_SET_LINKLOCAL;
11240 		if (zero_source)
11241 			ipif->ipif_state_flags |= IPIF_ZERO_SOURCE;
11242 		mutex_exit(&ill->ill_lock);
11243 	}
11244 
11245 	/*
11246 	 * Disallow IPv6 interfaces coming up that have the unspecified address,
11247 	 * or point-to-point interfaces with an unspecified destination. We do
11248 	 * allow the address to be unspecified for IPIF_NOLOCAL interfaces that
11249 	 * have a subnet assigned, which is how in.ndpd currently manages its
11250 	 * onlink prefix list when no addresses are configured with those
11251 	 * prefixes.
11252 	 */
11253 	if (ipif->ipif_isv6 &&
11254 	    ((IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
11255 	    (!(ipif->ipif_flags & IPIF_NOLOCAL) && !(turn_on & IPIF_NOLOCAL) ||
11256 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) ||
11257 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
11258 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)))) {
11259 		return (EINVAL);
11260 	}
11261 
11262 	/*
11263 	 * Prevent IPv4 point-to-point interfaces with a 0.0.0.0 destination
11264 	 * from being brought up.
11265 	 */
11266 	if (!ipif->ipif_isv6 &&
11267 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
11268 	    ipif->ipif_pp_dst_addr == INADDR_ANY)) {
11269 		return (EINVAL);
11270 	}
11271 
11272 	/*
11273 	 * The only flag changes that we currently take specific action on
11274 	 * is IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT, IPIF_NOLOCAL,
11275 	 * ILLF_NOARP, ILLF_NONUD, IPIF_PRIVATE, IPIF_ANYCAST, and
11276 	 * IPIF_PREFERRED.  This is done by bring the ipif down, changing
11277 	 * the flags and bringing it back up again.
11278 	 */
11279 	if ((turn_on|turn_off) &
11280 	    (IPIF_UP|IPIF_DEPRECATED|IPIF_NOXMIT|IPIF_NOLOCAL|ILLF_NOARP|
11281 	    ILLF_NONUD|IPIF_PRIVATE|IPIF_ANYCAST|IPIF_PREFERRED)) {
11282 		/*
11283 		 * Taking this ipif down, make sure we have
11284 		 * valid net and subnet bcast ire's for other
11285 		 * logical interfaces, if we need them.
11286 		 */
11287 		if (!ipif->ipif_isv6)
11288 			ipif_check_bcast_ires(ipif);
11289 
11290 		if (((ipif->ipif_flags | turn_on) & IPIF_UP) &&
11291 		    !(turn_off & IPIF_UP)) {
11292 			need_up = B_TRUE;
11293 			if (ipif->ipif_flags & IPIF_UP)
11294 				ill->ill_logical_down = 1;
11295 			turn_on &= ~IPIF_UP;
11296 		}
11297 		err = ipif_down(ipif, q, mp);
11298 		ip1dbg(("ipif_down returns %d err ", err));
11299 		if (err == EINPROGRESS)
11300 			return (err);
11301 		ipif_down_tail(ipif);
11302 	}
11303 	return (ip_sioctl_flags_tail(ipif, flags, q, mp, need_up));
11304 }
11305 
11306 static int
11307 ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q, mblk_t *mp,
11308     boolean_t need_up)
11309 {
11310 	ill_t	*ill;
11311 	phyint_t *phyi;
11312 	uint64_t turn_on;
11313 	uint64_t turn_off;
11314 	uint64_t intf_flags;
11315 	boolean_t phyint_flags_modified = B_FALSE;
11316 	int	err = 0;
11317 	boolean_t set_linklocal = B_FALSE;
11318 	boolean_t zero_source = B_FALSE;
11319 
11320 	ip1dbg(("ip_sioctl_flags_tail(%s:%u)\n",
11321 		ipif->ipif_ill->ill_name, ipif->ipif_id));
11322 
11323 	ASSERT(IAM_WRITER_IPIF(ipif));
11324 
11325 	ill = ipif->ipif_ill;
11326 	phyi = ill->ill_phyint;
11327 
11328 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
11329 	turn_on = (flags ^ intf_flags) & ~(IFF_CANTCHANGE | IFF_UP);
11330 
11331 	turn_off = intf_flags & turn_on;
11332 	turn_on ^= turn_off;
11333 
11334 	if ((turn_on|turn_off) & (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE))
11335 		phyint_flags_modified = B_TRUE;
11336 
11337 	/*
11338 	 * Now we change the flags. Track current value of
11339 	 * other flags in their respective places.
11340 	 */
11341 	mutex_enter(&ill->ill_lock);
11342 	mutex_enter(&phyi->phyint_lock);
11343 	ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
11344 	ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
11345 	ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
11346 	ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
11347 	phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
11348 	phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
11349 	if (ipif->ipif_state_flags & IPIF_SET_LINKLOCAL) {
11350 		set_linklocal = B_TRUE;
11351 		ipif->ipif_state_flags &= ~IPIF_SET_LINKLOCAL;
11352 	}
11353 	if (ipif->ipif_state_flags & IPIF_ZERO_SOURCE) {
11354 		zero_source = B_TRUE;
11355 		ipif->ipif_state_flags &= ~IPIF_ZERO_SOURCE;
11356 	}
11357 	mutex_exit(&ill->ill_lock);
11358 	mutex_exit(&phyi->phyint_lock);
11359 
11360 	if (((turn_on | turn_off) & (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE)))
11361 		ip_redo_nomination(phyi);
11362 
11363 	if (set_linklocal)
11364 		(void) ipif_setlinklocal(ipif);
11365 
11366 	if (zero_source)
11367 		ipif->ipif_v6src_addr = ipv6_all_zeros;
11368 	else
11369 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
11370 
11371 	if (need_up) {
11372 		/*
11373 		 * XXX ipif_up really does not know whether a phyint flags
11374 		 * was modified or not. So, it sends up information on
11375 		 * only one routing sockets message. As we don't bring up
11376 		 * the interface and also set STANDBY/FAILED simultaneously
11377 		 * it should be okay.
11378 		 */
11379 		err = ipif_up(ipif, q, mp);
11380 	} else {
11381 		/*
11382 		 * Make sure routing socket sees all changes to the flags.
11383 		 * ipif_up_done* handles this when we use ipif_up.
11384 		 */
11385 		if (phyint_flags_modified) {
11386 			if (phyi->phyint_illv4 != NULL) {
11387 				ip_rts_ifmsg(phyi->phyint_illv4->
11388 				    ill_ipif);
11389 			}
11390 			if (phyi->phyint_illv6 != NULL) {
11391 				ip_rts_ifmsg(phyi->phyint_illv6->
11392 				    ill_ipif);
11393 			}
11394 		} else {
11395 			ip_rts_ifmsg(ipif);
11396 		}
11397 	}
11398 	return (err);
11399 }
11400 
11401 /*
11402  * Restart entry point to restart the flags restart operation after the
11403  * refcounts have dropped to zero.
11404  */
11405 /* ARGSUSED */
11406 int
11407 ip_sioctl_flags_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11408     ip_ioctl_cmd_t *ipip, void *if_req)
11409 {
11410 	int	err;
11411 	struct ifreq *ifr = (struct ifreq *)if_req;
11412 	struct lifreq *lifr = (struct lifreq *)if_req;
11413 
11414 	ip1dbg(("ip_sioctl_flags_restart(%s:%u %p)\n",
11415 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11416 
11417 	ipif_down_tail(ipif);
11418 	if (ipip->ipi_cmd_type == IF_CMD) {
11419 		/*
11420 		 * Since ip_sioctl_flags expects an int and ifr_flags
11421 		 * is a short we need to cast ifr_flags into an int
11422 		 * to avoid having sign extension cause bits to get
11423 		 * set that should not be.
11424 		 */
11425 		err = ip_sioctl_flags_tail(ipif,
11426 		    (uint64_t)(ifr->ifr_flags & 0x0000ffff),
11427 		    q, mp, B_TRUE);
11428 	} else {
11429 		err = ip_sioctl_flags_tail(ipif, lifr->lifr_flags,
11430 		    q, mp, B_TRUE);
11431 	}
11432 	return (err);
11433 }
11434 
11435 /* ARGSUSED */
11436 int
11437 ip_sioctl_get_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11438     ip_ioctl_cmd_t *ipip, void *if_req)
11439 {
11440 	/*
11441 	 * Has the flags been set correctly till now ?
11442 	 */
11443 	ill_t *ill = ipif->ipif_ill;
11444 	phyint_t *phyi = ill->ill_phyint;
11445 
11446 	ip1dbg(("ip_sioctl_get_flags(%s:%u %p)\n",
11447 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11448 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
11449 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
11450 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
11451 
11452 	/*
11453 	 * Need a lock since some flags can be set even when there are
11454 	 * references to the ipif.
11455 	 */
11456 	mutex_enter(&ill->ill_lock);
11457 	if (ipip->ipi_cmd_type == IF_CMD) {
11458 		struct ifreq *ifr = (struct ifreq *)if_req;
11459 
11460 		/* Get interface flags (low 16 only). */
11461 		ifr->ifr_flags = ((ipif->ipif_flags |
11462 		    ill->ill_flags | phyi->phyint_flags) & 0xffff);
11463 	} else {
11464 		struct lifreq *lifr = (struct lifreq *)if_req;
11465 
11466 		/* Get interface flags. */
11467 		lifr->lifr_flags = ipif->ipif_flags |
11468 		    ill->ill_flags | phyi->phyint_flags;
11469 	}
11470 	mutex_exit(&ill->ill_lock);
11471 	return (0);
11472 }
11473 
11474 /* ARGSUSED */
11475 int
11476 ip_sioctl_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11477     ip_ioctl_cmd_t *ipip, void *if_req)
11478 {
11479 	int mtu;
11480 	int ip_min_mtu;
11481 	struct ifreq	*ifr;
11482 	struct lifreq *lifr;
11483 	ire_t	*ire;
11484 
11485 	ip1dbg(("ip_sioctl_mtu(%s:%u %p)\n", ipif->ipif_ill->ill_name,
11486 	    ipif->ipif_id, (void *)ipif));
11487 	if (ipip->ipi_cmd_type == IF_CMD) {
11488 		ifr = (struct ifreq *)if_req;
11489 		mtu = ifr->ifr_metric;
11490 	} else {
11491 		lifr = (struct lifreq *)if_req;
11492 		mtu = lifr->lifr_mtu;
11493 	}
11494 
11495 	if (ipif->ipif_isv6)
11496 		ip_min_mtu = IPV6_MIN_MTU;
11497 	else
11498 		ip_min_mtu = IP_MIN_MTU;
11499 
11500 	if (mtu > ipif->ipif_ill->ill_max_frag || mtu < ip_min_mtu)
11501 		return (EINVAL);
11502 
11503 	/*
11504 	 * Change the MTU size in all relevant ire's.
11505 	 * Mtu change Vs. new ire creation - protocol below.
11506 	 * First change ipif_mtu and the ire_max_frag of the
11507 	 * interface ire. Then do an ire walk and change the
11508 	 * ire_max_frag of all affected ires. During ire_add
11509 	 * under the bucket lock, set the ire_max_frag of the
11510 	 * new ire being created from the ipif/ire from which
11511 	 * it is being derived. If an mtu change happens after
11512 	 * the ire is added, the new ire will be cleaned up.
11513 	 * Conversely if the mtu change happens before the ire
11514 	 * is added, ire_add will see the new value of the mtu.
11515 	 */
11516 	ipif->ipif_mtu = mtu;
11517 	ipif->ipif_flags |= IPIF_FIXEDMTU;
11518 
11519 	if (ipif->ipif_isv6)
11520 		ire = ipif_to_ire_v6(ipif);
11521 	else
11522 		ire = ipif_to_ire(ipif);
11523 	if (ire != NULL) {
11524 		ire->ire_max_frag = ipif->ipif_mtu;
11525 		ire_refrele(ire);
11526 	}
11527 	if (ipif->ipif_flags & IPIF_UP) {
11528 		if (ipif->ipif_isv6)
11529 			ire_walk_v6(ipif_mtu_change, (char *)ipif, ALL_ZONES);
11530 		else
11531 			ire_walk_v4(ipif_mtu_change, (char *)ipif, ALL_ZONES);
11532 	}
11533 	/* Update the MTU in SCTP's list */
11534 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
11535 	return (0);
11536 }
11537 
11538 /* Get interface MTU. */
11539 /* ARGSUSED */
11540 int
11541 ip_sioctl_get_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11542 	ip_ioctl_cmd_t *ipip, void *if_req)
11543 {
11544 	struct ifreq	*ifr;
11545 	struct lifreq	*lifr;
11546 
11547 	ip1dbg(("ip_sioctl_get_mtu(%s:%u %p)\n",
11548 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11549 	if (ipip->ipi_cmd_type == IF_CMD) {
11550 		ifr = (struct ifreq *)if_req;
11551 		ifr->ifr_metric = ipif->ipif_mtu;
11552 	} else {
11553 		lifr = (struct lifreq *)if_req;
11554 		lifr->lifr_mtu = ipif->ipif_mtu;
11555 	}
11556 	return (0);
11557 }
11558 
11559 /* Set interface broadcast address. */
11560 /* ARGSUSED2 */
11561 int
11562 ip_sioctl_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11563 	ip_ioctl_cmd_t *ipip, void *if_req)
11564 {
11565 	ipaddr_t addr;
11566 	ire_t	*ire;
11567 
11568 	ip1dbg(("ip_sioctl_brdaddr(%s:%u)\n", ipif->ipif_ill->ill_name,
11569 	    ipif->ipif_id));
11570 
11571 	ASSERT(IAM_WRITER_IPIF(ipif));
11572 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
11573 		return (EADDRNOTAVAIL);
11574 
11575 	ASSERT(!(ipif->ipif_isv6));	/* No IPv6 broadcast */
11576 
11577 	if (sin->sin_family != AF_INET)
11578 		return (EAFNOSUPPORT);
11579 
11580 	addr = sin->sin_addr.s_addr;
11581 	if (ipif->ipif_flags & IPIF_UP) {
11582 		/*
11583 		 * If we are already up, make sure the new
11584 		 * broadcast address makes sense.  If it does,
11585 		 * there should be an IRE for it already.
11586 		 * Don't match on ipif, only on the ill
11587 		 * since we are sharing these now. Don't use
11588 		 * MATCH_IRE_ILL_GROUP as we are looking for
11589 		 * the broadcast ire on this ill and each ill
11590 		 * in the group has its own broadcast ire.
11591 		 */
11592 		ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST,
11593 		    ipif, ALL_ZONES, (MATCH_IRE_ILL | MATCH_IRE_TYPE));
11594 		if (ire == NULL) {
11595 			return (EINVAL);
11596 		} else {
11597 			ire_refrele(ire);
11598 		}
11599 	}
11600 	/*
11601 	 * Changing the broadcast addr for this ipif.
11602 	 * Make sure we have valid net and subnet bcast
11603 	 * ire's for other logical interfaces, if needed.
11604 	 */
11605 	if (addr != ipif->ipif_brd_addr)
11606 		ipif_check_bcast_ires(ipif);
11607 	IN6_IPADDR_TO_V4MAPPED(addr, &ipif->ipif_v6brd_addr);
11608 	return (0);
11609 }
11610 
11611 /* Get interface broadcast address. */
11612 /* ARGSUSED */
11613 int
11614 ip_sioctl_get_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11615     ip_ioctl_cmd_t *ipip, void *if_req)
11616 {
11617 	ip1dbg(("ip_sioctl_get_brdaddr(%s:%u %p)\n",
11618 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11619 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
11620 		return (EADDRNOTAVAIL);
11621 
11622 	/* IPIF_BROADCAST not possible with IPv6 */
11623 	ASSERT(!ipif->ipif_isv6);
11624 	*sin = sin_null;
11625 	sin->sin_family = AF_INET;
11626 	sin->sin_addr.s_addr = ipif->ipif_brd_addr;
11627 	return (0);
11628 }
11629 
11630 /*
11631  * This routine is called to handle the SIOCS*IFNETMASK IOCTL.
11632  */
11633 /* ARGSUSED */
11634 int
11635 ip_sioctl_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11636     ip_ioctl_cmd_t *ipip, void *if_req)
11637 {
11638 	int err = 0;
11639 	in6_addr_t v6mask;
11640 
11641 	ip1dbg(("ip_sioctl_netmask(%s:%u %p)\n",
11642 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11643 
11644 	ASSERT(IAM_WRITER_IPIF(ipif));
11645 
11646 	if (ipif->ipif_isv6) {
11647 		sin6_t *sin6;
11648 
11649 		if (sin->sin_family != AF_INET6)
11650 			return (EAFNOSUPPORT);
11651 
11652 		sin6 = (sin6_t *)sin;
11653 		v6mask = sin6->sin6_addr;
11654 	} else {
11655 		ipaddr_t mask;
11656 
11657 		if (sin->sin_family != AF_INET)
11658 			return (EAFNOSUPPORT);
11659 
11660 		mask = sin->sin_addr.s_addr;
11661 		V4MASK_TO_V6(mask, v6mask);
11662 	}
11663 
11664 	/*
11665 	 * No big deal if the interface isn't already up, or the mask
11666 	 * isn't really changing, or this is pt-pt.
11667 	 */
11668 	if (!(ipif->ipif_flags & IPIF_UP) ||
11669 	    IN6_ARE_ADDR_EQUAL(&v6mask, &ipif->ipif_v6net_mask) ||
11670 	    (ipif->ipif_flags & IPIF_POINTOPOINT)) {
11671 		ipif->ipif_v6net_mask = v6mask;
11672 		if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11673 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
11674 			    ipif->ipif_v6net_mask,
11675 			    ipif->ipif_v6subnet);
11676 		}
11677 		return (0);
11678 	}
11679 	/*
11680 	 * Make sure we have valid net and subnet broadcast ire's
11681 	 * for the old netmask, if needed by other logical interfaces.
11682 	 */
11683 	if (!ipif->ipif_isv6)
11684 		ipif_check_bcast_ires(ipif);
11685 
11686 	err = ipif_logical_down(ipif, q, mp);
11687 	if (err == EINPROGRESS)
11688 		return (err);
11689 	ipif_down_tail(ipif);
11690 	err = ip_sioctl_netmask_tail(ipif, sin, q, mp);
11691 	return (err);
11692 }
11693 
11694 static int
11695 ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp)
11696 {
11697 	in6_addr_t v6mask;
11698 	int err = 0;
11699 
11700 	ip1dbg(("ip_sioctl_netmask_tail(%s:%u %p)\n",
11701 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11702 
11703 	if (ipif->ipif_isv6) {
11704 		sin6_t *sin6;
11705 
11706 		sin6 = (sin6_t *)sin;
11707 		v6mask = sin6->sin6_addr;
11708 	} else {
11709 		ipaddr_t mask;
11710 
11711 		mask = sin->sin_addr.s_addr;
11712 		V4MASK_TO_V6(mask, v6mask);
11713 	}
11714 
11715 	ipif->ipif_v6net_mask = v6mask;
11716 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11717 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
11718 		    ipif->ipif_v6subnet);
11719 	}
11720 	err = ipif_up(ipif, q, mp);
11721 
11722 	if (err == 0 || err == EINPROGRESS) {
11723 		/*
11724 		 * The interface must be DL_BOUND if this packet has to
11725 		 * go out on the wire. Since we only go through a logical
11726 		 * down and are bound with the driver during an internal
11727 		 * down/up that is satisfied.
11728 		 */
11729 		if (!ipif->ipif_isv6 && ipif->ipif_ill->ill_wq != NULL) {
11730 			/* Potentially broadcast an address mask reply. */
11731 			ipif_mask_reply(ipif);
11732 		}
11733 	}
11734 	return (err);
11735 }
11736 
11737 /* ARGSUSED */
11738 int
11739 ip_sioctl_netmask_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11740     ip_ioctl_cmd_t *ipip, void *if_req)
11741 {
11742 	ip1dbg(("ip_sioctl_netmask_restart(%s:%u %p)\n",
11743 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11744 	ipif_down_tail(ipif);
11745 	return (ip_sioctl_netmask_tail(ipif, sin, q, mp));
11746 }
11747 
11748 /* Get interface net mask. */
11749 /* ARGSUSED */
11750 int
11751 ip_sioctl_get_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11752     ip_ioctl_cmd_t *ipip, void *if_req)
11753 {
11754 	struct lifreq *lifr = (struct lifreq *)if_req;
11755 	struct sockaddr_in6 *sin6 = (sin6_t *)sin;
11756 
11757 	ip1dbg(("ip_sioctl_get_netmask(%s:%u %p)\n",
11758 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11759 
11760 	/*
11761 	 * net mask can't change since we have a reference to the ipif.
11762 	 */
11763 	if (ipif->ipif_isv6) {
11764 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11765 		*sin6 = sin6_null;
11766 		sin6->sin6_family = AF_INET6;
11767 		sin6->sin6_addr = ipif->ipif_v6net_mask;
11768 		lifr->lifr_addrlen =
11769 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
11770 	} else {
11771 		*sin = sin_null;
11772 		sin->sin_family = AF_INET;
11773 		sin->sin_addr.s_addr = ipif->ipif_net_mask;
11774 		if (ipip->ipi_cmd_type == LIF_CMD) {
11775 			lifr->lifr_addrlen =
11776 			    ip_mask_to_plen(ipif->ipif_net_mask);
11777 		}
11778 	}
11779 	return (0);
11780 }
11781 
11782 /* ARGSUSED */
11783 int
11784 ip_sioctl_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11785     ip_ioctl_cmd_t *ipip, void *if_req)
11786 {
11787 
11788 	ip1dbg(("ip_sioctl_metric(%s:%u %p)\n",
11789 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11790 	/*
11791 	 * Set interface metric.  We don't use this for
11792 	 * anything but we keep track of it in case it is
11793 	 * important to routing applications or such.
11794 	 */
11795 	if (ipip->ipi_cmd_type == IF_CMD) {
11796 		struct ifreq    *ifr;
11797 
11798 		ifr = (struct ifreq *)if_req;
11799 		ipif->ipif_metric = ifr->ifr_metric;
11800 	} else {
11801 		struct lifreq   *lifr;
11802 
11803 		lifr = (struct lifreq *)if_req;
11804 		ipif->ipif_metric = lifr->lifr_metric;
11805 	}
11806 	return (0);
11807 }
11808 
11809 
11810 /* ARGSUSED */
11811 int
11812 ip_sioctl_get_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11813     ip_ioctl_cmd_t *ipip, void *if_req)
11814 {
11815 
11816 	/* Get interface metric. */
11817 	ip1dbg(("ip_sioctl_get_metric(%s:%u %p)\n",
11818 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11819 	if (ipip->ipi_cmd_type == IF_CMD) {
11820 		struct ifreq    *ifr;
11821 
11822 		ifr = (struct ifreq *)if_req;
11823 		ifr->ifr_metric = ipif->ipif_metric;
11824 	} else {
11825 		struct lifreq   *lifr;
11826 
11827 		lifr = (struct lifreq *)if_req;
11828 		lifr->lifr_metric = ipif->ipif_metric;
11829 	}
11830 
11831 	return (0);
11832 }
11833 
11834 /* ARGSUSED */
11835 int
11836 ip_sioctl_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11837     ip_ioctl_cmd_t *ipip, void *if_req)
11838 {
11839 
11840 	ip1dbg(("ip_sioctl_muxid(%s:%u %p)\n",
11841 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11842 	/*
11843 	 * Set the muxid returned from I_PLINK.
11844 	 */
11845 	if (ipip->ipi_cmd_type == IF_CMD) {
11846 		struct ifreq *ifr = (struct ifreq *)if_req;
11847 
11848 		ipif->ipif_ill->ill_ip_muxid = ifr->ifr_ip_muxid;
11849 		ipif->ipif_ill->ill_arp_muxid = ifr->ifr_arp_muxid;
11850 	} else {
11851 		struct lifreq *lifr = (struct lifreq *)if_req;
11852 
11853 		ipif->ipif_ill->ill_ip_muxid = lifr->lifr_ip_muxid;
11854 		ipif->ipif_ill->ill_arp_muxid = lifr->lifr_arp_muxid;
11855 	}
11856 	return (0);
11857 }
11858 
11859 /* ARGSUSED */
11860 int
11861 ip_sioctl_get_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11862     ip_ioctl_cmd_t *ipip, void *if_req)
11863 {
11864 
11865 	ip1dbg(("ip_sioctl_get_muxid(%s:%u %p)\n",
11866 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11867 	/*
11868 	 * Get the muxid saved in ill for I_PUNLINK.
11869 	 */
11870 	if (ipip->ipi_cmd_type == IF_CMD) {
11871 		struct ifreq *ifr = (struct ifreq *)if_req;
11872 
11873 		ifr->ifr_ip_muxid = ipif->ipif_ill->ill_ip_muxid;
11874 		ifr->ifr_arp_muxid = ipif->ipif_ill->ill_arp_muxid;
11875 	} else {
11876 		struct lifreq *lifr = (struct lifreq *)if_req;
11877 
11878 		lifr->lifr_ip_muxid = ipif->ipif_ill->ill_ip_muxid;
11879 		lifr->lifr_arp_muxid = ipif->ipif_ill->ill_arp_muxid;
11880 	}
11881 	return (0);
11882 }
11883 
11884 /*
11885  * Set the subnet prefix. Does not modify the broadcast address.
11886  */
11887 /* ARGSUSED */
11888 int
11889 ip_sioctl_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11890     ip_ioctl_cmd_t *ipip, void *if_req)
11891 {
11892 	int err = 0;
11893 	in6_addr_t v6addr;
11894 	in6_addr_t v6mask;
11895 	boolean_t need_up = B_FALSE;
11896 	int addrlen;
11897 
11898 	ip1dbg(("ip_sioctl_subnet(%s:%u %p)\n",
11899 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11900 
11901 	ASSERT(IAM_WRITER_IPIF(ipif));
11902 	addrlen = ((struct lifreq *)if_req)->lifr_addrlen;
11903 
11904 	if (ipif->ipif_isv6) {
11905 		sin6_t *sin6;
11906 
11907 		if (sin->sin_family != AF_INET6)
11908 			return (EAFNOSUPPORT);
11909 
11910 		sin6 = (sin6_t *)sin;
11911 		v6addr = sin6->sin6_addr;
11912 		if (!ip_remote_addr_ok_v6(&v6addr, &ipv6_all_ones))
11913 			return (EADDRNOTAVAIL);
11914 	} else {
11915 		ipaddr_t addr;
11916 
11917 		if (sin->sin_family != AF_INET)
11918 			return (EAFNOSUPPORT);
11919 
11920 		addr = sin->sin_addr.s_addr;
11921 		if (!ip_addr_ok_v4(addr, 0xFFFFFFFF))
11922 			return (EADDRNOTAVAIL);
11923 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11924 		/* Add 96 bits */
11925 		addrlen += IPV6_ABITS - IP_ABITS;
11926 	}
11927 
11928 	if (ip_plen_to_mask_v6(addrlen, &v6mask) == NULL)
11929 		return (EINVAL);
11930 
11931 	/* Check if bits in the address is set past the mask */
11932 	if (!V6_MASK_EQ(v6addr, v6mask, v6addr))
11933 		return (EINVAL);
11934 
11935 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6subnet, &v6addr) &&
11936 	    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6net_mask, &v6mask))
11937 		return (0);	/* No change */
11938 
11939 	if (ipif->ipif_flags & IPIF_UP) {
11940 		/*
11941 		 * If the interface is already marked up,
11942 		 * we call ipif_down which will take care
11943 		 * of ditching any IREs that have been set
11944 		 * up based on the old interface address.
11945 		 */
11946 		err = ipif_logical_down(ipif, q, mp);
11947 		if (err == EINPROGRESS)
11948 			return (err);
11949 		ipif_down_tail(ipif);
11950 		need_up = B_TRUE;
11951 	}
11952 
11953 	err = ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, need_up);
11954 	return (err);
11955 }
11956 
11957 static int
11958 ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t v6addr, in6_addr_t v6mask,
11959     queue_t *q, mblk_t *mp, boolean_t need_up)
11960 {
11961 	ill_t	*ill = ipif->ipif_ill;
11962 	int	err = 0;
11963 
11964 	ip1dbg(("ip_sioctl_subnet_tail(%s:%u %p)\n",
11965 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11966 
11967 	/* Set the new address. */
11968 	mutex_enter(&ill->ill_lock);
11969 	ipif->ipif_v6net_mask = v6mask;
11970 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11971 		V6_MASK_COPY(v6addr, ipif->ipif_v6net_mask,
11972 		    ipif->ipif_v6subnet);
11973 	}
11974 	mutex_exit(&ill->ill_lock);
11975 
11976 	if (need_up) {
11977 		/*
11978 		 * Now bring the interface back up.  If this
11979 		 * is the only IPIF for the ILL, ipif_up
11980 		 * will have to re-bind to the device, so
11981 		 * we may get back EINPROGRESS, in which
11982 		 * case, this IOCTL will get completed in
11983 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11984 		 */
11985 		err = ipif_up(ipif, q, mp);
11986 		if (err == EINPROGRESS)
11987 			return (err);
11988 	}
11989 	return (err);
11990 }
11991 
11992 /* ARGSUSED */
11993 int
11994 ip_sioctl_subnet_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11995     ip_ioctl_cmd_t *ipip, void *if_req)
11996 {
11997 	int	addrlen;
11998 	in6_addr_t v6addr;
11999 	in6_addr_t v6mask;
12000 	struct lifreq *lifr = (struct lifreq *)if_req;
12001 
12002 	ip1dbg(("ip_sioctl_subnet_restart(%s:%u %p)\n",
12003 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12004 	ipif_down_tail(ipif);
12005 
12006 	addrlen = lifr->lifr_addrlen;
12007 	if (ipif->ipif_isv6) {
12008 		sin6_t *sin6;
12009 
12010 		sin6 = (sin6_t *)sin;
12011 		v6addr = sin6->sin6_addr;
12012 	} else {
12013 		ipaddr_t addr;
12014 
12015 		addr = sin->sin_addr.s_addr;
12016 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
12017 		addrlen += IPV6_ABITS - IP_ABITS;
12018 	}
12019 	(void) ip_plen_to_mask_v6(addrlen, &v6mask);
12020 
12021 	return (ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, B_TRUE));
12022 }
12023 
12024 /* ARGSUSED */
12025 int
12026 ip_sioctl_get_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12027     ip_ioctl_cmd_t *ipip, void *if_req)
12028 {
12029 	struct lifreq *lifr = (struct lifreq *)if_req;
12030 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sin;
12031 
12032 	ip1dbg(("ip_sioctl_get_subnet(%s:%u %p)\n",
12033 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12034 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
12035 
12036 	if (ipif->ipif_isv6) {
12037 		*sin6 = sin6_null;
12038 		sin6->sin6_family = AF_INET6;
12039 		sin6->sin6_addr = ipif->ipif_v6subnet;
12040 		lifr->lifr_addrlen =
12041 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
12042 	} else {
12043 		*sin = sin_null;
12044 		sin->sin_family = AF_INET;
12045 		sin->sin_addr.s_addr = ipif->ipif_subnet;
12046 		lifr->lifr_addrlen = ip_mask_to_plen(ipif->ipif_net_mask);
12047 	}
12048 	return (0);
12049 }
12050 
12051 /*
12052  * Set the IPv6 address token.
12053  */
12054 /* ARGSUSED */
12055 int
12056 ip_sioctl_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12057     ip_ioctl_cmd_t *ipi, void *if_req)
12058 {
12059 	ill_t *ill = ipif->ipif_ill;
12060 	int err;
12061 	in6_addr_t v6addr;
12062 	in6_addr_t v6mask;
12063 	boolean_t need_up = B_FALSE;
12064 	int i;
12065 	sin6_t *sin6 = (sin6_t *)sin;
12066 	struct lifreq *lifr = (struct lifreq *)if_req;
12067 	int addrlen;
12068 
12069 	ip1dbg(("ip_sioctl_token(%s:%u %p)\n",
12070 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12071 	ASSERT(IAM_WRITER_IPIF(ipif));
12072 
12073 	addrlen = lifr->lifr_addrlen;
12074 	/* Only allow for logical unit zero i.e. not on "le0:17" */
12075 	if (ipif->ipif_id != 0)
12076 		return (EINVAL);
12077 
12078 	if (!ipif->ipif_isv6)
12079 		return (EINVAL);
12080 
12081 	if (addrlen > IPV6_ABITS)
12082 		return (EINVAL);
12083 
12084 	v6addr = sin6->sin6_addr;
12085 
12086 	/*
12087 	 * The length of the token is the length from the end.  To get
12088 	 * the proper mask for this, compute the mask of the bits not
12089 	 * in the token; ie. the prefix, and then xor to get the mask.
12090 	 */
12091 	if (ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask) == NULL)
12092 		return (EINVAL);
12093 	for (i = 0; i < 4; i++) {
12094 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
12095 	}
12096 
12097 	if (V6_MASK_EQ(v6addr, v6mask, ill->ill_token) &&
12098 	    ill->ill_token_length == addrlen)
12099 		return (0);	/* No change */
12100 
12101 	if (ipif->ipif_flags & IPIF_UP) {
12102 		err = ipif_logical_down(ipif, q, mp);
12103 		if (err == EINPROGRESS)
12104 			return (err);
12105 		ipif_down_tail(ipif);
12106 		need_up = B_TRUE;
12107 	}
12108 	err = ip_sioctl_token_tail(ipif, sin6, addrlen, q, mp, need_up);
12109 	return (err);
12110 }
12111 
12112 static int
12113 ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen, queue_t *q,
12114     mblk_t *mp, boolean_t need_up)
12115 {
12116 	in6_addr_t v6addr;
12117 	in6_addr_t v6mask;
12118 	ill_t	*ill = ipif->ipif_ill;
12119 	int	i;
12120 	int	err = 0;
12121 
12122 	ip1dbg(("ip_sioctl_token_tail(%s:%u %p)\n",
12123 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12124 	v6addr = sin6->sin6_addr;
12125 	/*
12126 	 * The length of the token is the length from the end.  To get
12127 	 * the proper mask for this, compute the mask of the bits not
12128 	 * in the token; ie. the prefix, and then xor to get the mask.
12129 	 */
12130 	(void) ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask);
12131 	for (i = 0; i < 4; i++)
12132 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
12133 
12134 	mutex_enter(&ill->ill_lock);
12135 	V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
12136 	ill->ill_token_length = addrlen;
12137 	mutex_exit(&ill->ill_lock);
12138 
12139 	if (need_up) {
12140 		/*
12141 		 * Now bring the interface back up.  If this
12142 		 * is the only IPIF for the ILL, ipif_up
12143 		 * will have to re-bind to the device, so
12144 		 * we may get back EINPROGRESS, in which
12145 		 * case, this IOCTL will get completed in
12146 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
12147 		 */
12148 		err = ipif_up(ipif, q, mp);
12149 		if (err == EINPROGRESS)
12150 			return (err);
12151 	}
12152 	return (err);
12153 }
12154 
12155 /* ARGSUSED */
12156 int
12157 ip_sioctl_get_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12158     ip_ioctl_cmd_t *ipi, void *if_req)
12159 {
12160 	ill_t *ill;
12161 	sin6_t *sin6 = (sin6_t *)sin;
12162 	struct lifreq *lifr = (struct lifreq *)if_req;
12163 
12164 	ip1dbg(("ip_sioctl_get_token(%s:%u %p)\n",
12165 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12166 	if (ipif->ipif_id != 0)
12167 		return (EINVAL);
12168 
12169 	ill = ipif->ipif_ill;
12170 	if (!ill->ill_isv6)
12171 		return (ENXIO);
12172 
12173 	*sin6 = sin6_null;
12174 	sin6->sin6_family = AF_INET6;
12175 	ASSERT(!IN6_IS_ADDR_V4MAPPED(&ill->ill_token));
12176 	sin6->sin6_addr = ill->ill_token;
12177 	lifr->lifr_addrlen = ill->ill_token_length;
12178 	return (0);
12179 }
12180 
12181 /*
12182  * Set (hardware) link specific information that might override
12183  * what was acquired through the DL_INFO_ACK.
12184  * The logic is as follows.
12185  *
12186  * become exclusive
12187  * set CHANGING flag
12188  * change mtu on affected IREs
12189  * clear CHANGING flag
12190  *
12191  * An ire add that occurs before the CHANGING flag is set will have its mtu
12192  * changed by the ip_sioctl_lnkinfo.
12193  *
12194  * During the time the CHANGING flag is set, no new ires will be added to the
12195  * bucket, and ire add will fail (due the CHANGING flag).
12196  *
12197  * An ire add that occurs after the CHANGING flag is set will have the right mtu
12198  * before it is added to the bucket.
12199  *
12200  * Obviously only 1 thread can set the CHANGING flag and we need to become
12201  * exclusive to set the flag.
12202  */
12203 /* ARGSUSED */
12204 int
12205 ip_sioctl_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12206     ip_ioctl_cmd_t *ipi, void *if_req)
12207 {
12208 	ill_t		*ill = ipif->ipif_ill;
12209 	ipif_t		*nipif;
12210 	int		ip_min_mtu;
12211 	boolean_t	mtu_walk = B_FALSE;
12212 	struct lifreq	*lifr = (struct lifreq *)if_req;
12213 	lif_ifinfo_req_t *lir;
12214 	ire_t		*ire;
12215 
12216 	ip1dbg(("ip_sioctl_lnkinfo(%s:%u %p)\n",
12217 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12218 	lir = &lifr->lifr_ifinfo;
12219 	ASSERT(IAM_WRITER_IPIF(ipif));
12220 
12221 	/* Only allow for logical unit zero i.e. not on "le0:17" */
12222 	if (ipif->ipif_id != 0)
12223 		return (EINVAL);
12224 
12225 	/* Set interface MTU. */
12226 	if (ipif->ipif_isv6)
12227 		ip_min_mtu = IPV6_MIN_MTU;
12228 	else
12229 		ip_min_mtu = IP_MIN_MTU;
12230 
12231 	/*
12232 	 * Verify values before we set anything. Allow zero to
12233 	 * mean unspecified.
12234 	 */
12235 	if (lir->lir_maxmtu != 0 &&
12236 	    (lir->lir_maxmtu > ill->ill_max_frag ||
12237 	    lir->lir_maxmtu < ip_min_mtu))
12238 		return (EINVAL);
12239 	if (lir->lir_reachtime != 0 &&
12240 	    lir->lir_reachtime > ND_MAX_REACHTIME)
12241 		return (EINVAL);
12242 	if (lir->lir_reachretrans != 0 &&
12243 	    lir->lir_reachretrans > ND_MAX_REACHRETRANSTIME)
12244 		return (EINVAL);
12245 
12246 	mutex_enter(&ill->ill_lock);
12247 	ill->ill_state_flags |= ILL_CHANGING;
12248 	for (nipif = ill->ill_ipif; nipif != NULL;
12249 	    nipif = nipif->ipif_next) {
12250 		nipif->ipif_state_flags |= IPIF_CHANGING;
12251 	}
12252 
12253 	mutex_exit(&ill->ill_lock);
12254 
12255 	if (lir->lir_maxmtu != 0) {
12256 		ill->ill_max_mtu = lir->lir_maxmtu;
12257 		ill->ill_mtu_userspecified = 1;
12258 		mtu_walk = B_TRUE;
12259 	}
12260 
12261 	if (lir->lir_reachtime != 0)
12262 		ill->ill_reachable_time = lir->lir_reachtime;
12263 
12264 	if (lir->lir_reachretrans != 0)
12265 		ill->ill_reachable_retrans_time = lir->lir_reachretrans;
12266 
12267 	ill->ill_max_hops = lir->lir_maxhops;
12268 
12269 	ill->ill_max_buf = ND_MAX_Q;
12270 
12271 	if (mtu_walk) {
12272 		/*
12273 		 * Set the MTU on all ipifs associated with this ill except
12274 		 * for those whose MTU was fixed via SIOCSLIFMTU.
12275 		 */
12276 		for (nipif = ill->ill_ipif; nipif != NULL;
12277 		    nipif = nipif->ipif_next) {
12278 			if (nipif->ipif_flags & IPIF_FIXEDMTU)
12279 				continue;
12280 
12281 			nipif->ipif_mtu = ill->ill_max_mtu;
12282 
12283 			if (!(nipif->ipif_flags & IPIF_UP))
12284 				continue;
12285 
12286 			if (nipif->ipif_isv6)
12287 				ire = ipif_to_ire_v6(nipif);
12288 			else
12289 				ire = ipif_to_ire(nipif);
12290 			if (ire != NULL) {
12291 				ire->ire_max_frag = ipif->ipif_mtu;
12292 				ire_refrele(ire);
12293 			}
12294 			if (ill->ill_isv6) {
12295 				ire_walk_ill_v6(MATCH_IRE_ILL, 0,
12296 				    ipif_mtu_change, (char *)nipif,
12297 				    ill);
12298 			} else {
12299 				ire_walk_ill_v4(MATCH_IRE_ILL, 0,
12300 				    ipif_mtu_change, (char *)nipif,
12301 				    ill);
12302 			}
12303 		}
12304 	}
12305 
12306 	mutex_enter(&ill->ill_lock);
12307 	for (nipif = ill->ill_ipif; nipif != NULL;
12308 	    nipif = nipif->ipif_next) {
12309 		nipif->ipif_state_flags &= ~IPIF_CHANGING;
12310 	}
12311 	ILL_UNMARK_CHANGING(ill);
12312 	mutex_exit(&ill->ill_lock);
12313 
12314 	return (0);
12315 }
12316 
12317 /* ARGSUSED */
12318 int
12319 ip_sioctl_get_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12320     ip_ioctl_cmd_t *ipi, void *if_req)
12321 {
12322 	struct lif_ifinfo_req *lir;
12323 	ill_t *ill = ipif->ipif_ill;
12324 
12325 	ip1dbg(("ip_sioctl_get_lnkinfo(%s:%u %p)\n",
12326 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12327 	if (ipif->ipif_id != 0)
12328 		return (EINVAL);
12329 
12330 	lir = &((struct lifreq *)if_req)->lifr_ifinfo;
12331 	lir->lir_maxhops = ill->ill_max_hops;
12332 	lir->lir_reachtime = ill->ill_reachable_time;
12333 	lir->lir_reachretrans = ill->ill_reachable_retrans_time;
12334 	lir->lir_maxmtu = ill->ill_max_mtu;
12335 
12336 	return (0);
12337 }
12338 
12339 /*
12340  * Return best guess as to the subnet mask for the specified address.
12341  * Based on the subnet masks for all the configured interfaces.
12342  *
12343  * We end up returning a zero mask in the case of default, multicast or
12344  * experimental.
12345  */
12346 static ipaddr_t
12347 ip_subnet_mask(ipaddr_t addr, ipif_t **ipifp)
12348 {
12349 	ipaddr_t net_mask;
12350 	ill_t	*ill;
12351 	ipif_t	*ipif;
12352 	ill_walk_context_t ctx;
12353 	ipif_t	*fallback_ipif = NULL;
12354 
12355 	net_mask = ip_net_mask(addr);
12356 	if (net_mask == 0) {
12357 		*ipifp = NULL;
12358 		return (0);
12359 	}
12360 
12361 	/* Let's check to see if this is maybe a local subnet route. */
12362 	/* this function only applies to IPv4 interfaces */
12363 	rw_enter(&ill_g_lock, RW_READER);
12364 	ill = ILL_START_WALK_V4(&ctx);
12365 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
12366 		mutex_enter(&ill->ill_lock);
12367 		for (ipif = ill->ill_ipif; ipif != NULL;
12368 		    ipif = ipif->ipif_next) {
12369 			if (!IPIF_CAN_LOOKUP(ipif))
12370 				continue;
12371 			if (!(ipif->ipif_flags & IPIF_UP))
12372 				continue;
12373 			if ((ipif->ipif_subnet & net_mask) ==
12374 			    (addr & net_mask)) {
12375 				/*
12376 				 * Don't trust pt-pt interfaces if there are
12377 				 * other interfaces.
12378 				 */
12379 				if (ipif->ipif_flags & IPIF_POINTOPOINT) {
12380 					if (fallback_ipif == NULL) {
12381 						ipif_refhold_locked(ipif);
12382 						fallback_ipif = ipif;
12383 					}
12384 					continue;
12385 				}
12386 
12387 				/*
12388 				 * Fine. Just assume the same net mask as the
12389 				 * directly attached subnet interface is using.
12390 				 */
12391 				ipif_refhold_locked(ipif);
12392 				mutex_exit(&ill->ill_lock);
12393 				rw_exit(&ill_g_lock);
12394 				if (fallback_ipif != NULL)
12395 					ipif_refrele(fallback_ipif);
12396 				*ipifp = ipif;
12397 				return (ipif->ipif_net_mask);
12398 			}
12399 		}
12400 		mutex_exit(&ill->ill_lock);
12401 	}
12402 	rw_exit(&ill_g_lock);
12403 
12404 	*ipifp = fallback_ipif;
12405 	return ((fallback_ipif != NULL) ?
12406 	    fallback_ipif->ipif_net_mask : net_mask);
12407 }
12408 
12409 /*
12410  * ip_sioctl_copyin_setup calls ip_wput_ioctl to process the IP_IOCTL ioctl.
12411  */
12412 static void
12413 ip_wput_ioctl(queue_t *q, mblk_t *mp)
12414 {
12415 	IOCP	iocp;
12416 	ipft_t	*ipft;
12417 	ipllc_t	*ipllc;
12418 	mblk_t	*mp1;
12419 	cred_t	*cr;
12420 	int	error = 0;
12421 	conn_t	*connp;
12422 
12423 	ip1dbg(("ip_wput_ioctl"));
12424 	iocp = (IOCP)mp->b_rptr;
12425 	mp1 = mp->b_cont;
12426 	if (mp1 == NULL) {
12427 		iocp->ioc_error = EINVAL;
12428 		mp->b_datap->db_type = M_IOCNAK;
12429 		iocp->ioc_count = 0;
12430 		qreply(q, mp);
12431 		return;
12432 	}
12433 
12434 	/*
12435 	 * These IOCTLs provide various control capabilities to
12436 	 * upstream agents such as ULPs and processes.	There
12437 	 * are currently two such IOCTLs implemented.  They
12438 	 * are used by TCP to provide update information for
12439 	 * existing IREs and to forcibly delete an IRE for a
12440 	 * host that is not responding, thereby forcing an
12441 	 * attempt at a new route.
12442 	 */
12443 	iocp->ioc_error = EINVAL;
12444 	if (!pullupmsg(mp1, sizeof (ipllc->ipllc_cmd)))
12445 		goto done;
12446 
12447 	ipllc = (ipllc_t *)mp1->b_rptr;
12448 	for (ipft = ip_ioctl_ftbl; ipft->ipft_pfi; ipft++) {
12449 		if (ipllc->ipllc_cmd == ipft->ipft_cmd)
12450 			break;
12451 	}
12452 	/*
12453 	 * prefer credential from mblk over ioctl;
12454 	 * see ip_sioctl_copyin_setup
12455 	 */
12456 	cr = DB_CREDDEF(mp, iocp->ioc_cr);
12457 
12458 	/*
12459 	 * Refhold the conn in case the request gets queued up in some lookup
12460 	 */
12461 	ASSERT(CONN_Q(q));
12462 	connp = Q_TO_CONN(q);
12463 	CONN_INC_REF(connp);
12464 	if (ipft->ipft_pfi &&
12465 	    ((mp1->b_wptr - mp1->b_rptr) >= ipft->ipft_min_size ||
12466 		pullupmsg(mp1, ipft->ipft_min_size))) {
12467 		error = (*ipft->ipft_pfi)(q,
12468 		    (ipft->ipft_flags & IPFT_F_SELF_REPLY) ? mp : mp1, cr);
12469 	}
12470 	if (ipft->ipft_flags & IPFT_F_SELF_REPLY) {
12471 		/*
12472 		 * CONN_OPER_PENDING_DONE happens in the function called
12473 		 * through ipft_pfi above.
12474 		 */
12475 		return;
12476 	}
12477 
12478 	CONN_OPER_PENDING_DONE(connp);
12479 	if (ipft->ipft_flags & IPFT_F_NO_REPLY) {
12480 		freemsg(mp);
12481 		return;
12482 	}
12483 	iocp->ioc_error = error;
12484 
12485 done:
12486 	mp->b_datap->db_type = M_IOCACK;
12487 	if (iocp->ioc_error)
12488 		iocp->ioc_count = 0;
12489 	qreply(q, mp);
12490 }
12491 
12492 /*
12493  * Lookup an ipif using the sequence id (ipif_seqid)
12494  */
12495 ipif_t *
12496 ipif_lookup_seqid(ill_t *ill, uint_t seqid)
12497 {
12498 	ipif_t *ipif;
12499 
12500 	ASSERT(MUTEX_HELD(&ill->ill_lock));
12501 
12502 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12503 		if (ipif->ipif_seqid == seqid && IPIF_CAN_LOOKUP(ipif))
12504 			return (ipif);
12505 	}
12506 	return (NULL);
12507 }
12508 
12509 uint64_t ipif_g_seqid;
12510 
12511 /*
12512  * Assign a unique id for the ipif. This is used later when we send
12513  * IRES to ARP for resolution where we initialize ire_ipif_seqid
12514  * to the value pointed by ire_ipif->ipif_seqid. Later when the
12515  * IRE is added, we verify that ipif has not disappeared.
12516  */
12517 
12518 static void
12519 ipif_assign_seqid(ipif_t *ipif)
12520 {
12521 	ipif->ipif_seqid = atomic_add_64_nv(&ipif_g_seqid, 1);
12522 }
12523 
12524 /*
12525  * Insert the ipif, so that the list of ipifs on the ill will be sorted
12526  * with respect to ipif_id. Note that an ipif with an ipif_id of -1 will
12527  * be inserted into the first space available in the list. The value of
12528  * ipif_id will then be set to the appropriate value for its position.
12529  */
12530 static int
12531 ipif_insert(ipif_t *ipif, boolean_t acquire_g_lock, boolean_t acquire_ill_lock)
12532 {
12533 	ill_t *ill;
12534 	ipif_t *tipif;
12535 	ipif_t **tipifp;
12536 	int id;
12537 
12538 	ASSERT(ipif->ipif_ill->ill_net_type == IRE_LOOPBACK ||
12539 	    IAM_WRITER_IPIF(ipif));
12540 
12541 	ill = ipif->ipif_ill;
12542 	ASSERT(ill != NULL);
12543 
12544 	/*
12545 	 * In the case of lo0:0 we already hold the ill_g_lock.
12546 	 * ill_lookup_on_name (acquires ill_g_lock) -> ipif_allocate ->
12547 	 * ipif_insert. Another such caller is ipif_move.
12548 	 */
12549 	if (acquire_g_lock)
12550 		rw_enter(&ill_g_lock, RW_WRITER);
12551 	if (acquire_ill_lock)
12552 		mutex_enter(&ill->ill_lock);
12553 	id = ipif->ipif_id;
12554 	tipifp = &(ill->ill_ipif);
12555 	if (id == -1) {	/* need to find a real id */
12556 		id = 0;
12557 		while ((tipif = *tipifp) != NULL) {
12558 			ASSERT(tipif->ipif_id >= id);
12559 			if (tipif->ipif_id != id)
12560 				break; /* non-consecutive id */
12561 			id++;
12562 			tipifp = &(tipif->ipif_next);
12563 		}
12564 		/* limit number of logical interfaces */
12565 		if (id >= ip_addrs_per_if) {
12566 			if (acquire_ill_lock)
12567 				mutex_exit(&ill->ill_lock);
12568 			if (acquire_g_lock)
12569 				rw_exit(&ill_g_lock);
12570 			return (-1);
12571 		}
12572 		ipif->ipif_id = id; /* assign new id */
12573 	} else if (id < ip_addrs_per_if) {
12574 		/* we have a real id; insert ipif in the right place */
12575 		while ((tipif = *tipifp) != NULL) {
12576 			ASSERT(tipif->ipif_id != id);
12577 			if (tipif->ipif_id > id)
12578 				break; /* found correct location */
12579 			tipifp = &(tipif->ipif_next);
12580 		}
12581 	} else {
12582 		if (acquire_ill_lock)
12583 			mutex_exit(&ill->ill_lock);
12584 		if (acquire_g_lock)
12585 			rw_exit(&ill_g_lock);
12586 		return (-1);
12587 	}
12588 
12589 	ASSERT(tipifp != &(ill->ill_ipif) || id == 0);
12590 
12591 	ipif->ipif_next = tipif;
12592 	*tipifp = ipif;
12593 	if (acquire_ill_lock)
12594 		mutex_exit(&ill->ill_lock);
12595 	if (acquire_g_lock)
12596 		rw_exit(&ill_g_lock);
12597 	return (0);
12598 }
12599 
12600 /*
12601  * Allocate and initialize a new interface control structure.  (Always
12602  * called as writer.)
12603  * When ipif_allocate() is called from ip_ll_subnet_defaults, the ill
12604  * is not part of the global linked list of ills. ipif_seqid is unique
12605  * in the system and to preserve the uniqueness, it is assigned only
12606  * when ill becomes part of the global list. At that point ill will
12607  * have a name. If it doesn't get assigned here, it will get assigned
12608  * in ipif_set_values() as part of SIOCSLIFNAME processing.
12609  * Aditionally, if we come here from ip_ll_subnet_defaults, we don't set
12610  * the interface flags or any other information from the DL_INFO_ACK for
12611  * DL_STYLE2 drivers (initialize == B_FALSE), since we won't have them at
12612  * this point. The flags etc. will be set in ip_ll_subnet_defaults when the
12613  * second DL_INFO_ACK comes in from the driver.
12614  */
12615 static ipif_t *
12616 ipif_allocate(ill_t *ill, int id, uint_t ire_type, boolean_t initialize)
12617 {
12618 	ipif_t	*ipif;
12619 	phyint_t *phyi;
12620 
12621 	ip1dbg(("ipif_allocate(%s:%d ill %p)\n",
12622 	    ill->ill_name, id, (void *)ill));
12623 	ASSERT(ire_type == IRE_LOOPBACK || IAM_WRITER_ILL(ill));
12624 
12625 	if ((ipif = (ipif_t *)mi_alloc(sizeof (ipif_t), BPRI_MED)) == NULL)
12626 		return (NULL);
12627 	*ipif = ipif_zero;	/* start clean */
12628 
12629 	ipif->ipif_ill = ill;
12630 	ipif->ipif_id = id;	/* could be -1 */
12631 	ipif->ipif_zoneid = GLOBAL_ZONEID;
12632 
12633 	mutex_init(&ipif->ipif_saved_ire_lock, NULL, MUTEX_DEFAULT, NULL);
12634 
12635 	ipif->ipif_refcnt = 0;
12636 	ipif->ipif_saved_ire_cnt = 0;
12637 
12638 	if (ipif_insert(ipif, ire_type != IRE_LOOPBACK, B_TRUE)) {
12639 		mi_free(ipif);
12640 		return (NULL);
12641 	}
12642 	/* -1 id should have been replaced by real id */
12643 	id = ipif->ipif_id;
12644 	ASSERT(id >= 0);
12645 
12646 	if (ill->ill_name[0] != '\0') {
12647 		ipif_assign_seqid(ipif);
12648 		if (ill->ill_phyint->phyint_ifindex != 0)
12649 			sctp_update_ipif(ipif, SCTP_IPIF_INSERT);
12650 	}
12651 	/*
12652 	 * Keep a copy of original id in ipif_orig_ipifid.  Failback
12653 	 * will attempt to restore the original id.  The SIOCSLIFOINDEX
12654 	 * ioctl sets ipif_orig_ipifid to zero.
12655 	 */
12656 	ipif->ipif_orig_ipifid = id;
12657 
12658 	/*
12659 	 * We grab the ill_lock and phyint_lock to protect the flag changes.
12660 	 * The ipif is still not up and can't be looked up until the
12661 	 * ioctl completes and the IPIF_CHANGING flag is cleared.
12662 	 */
12663 	mutex_enter(&ill->ill_lock);
12664 	mutex_enter(&ill->ill_phyint->phyint_lock);
12665 	/*
12666 	 * Set the running flag when logical interface zero is created.
12667 	 * For subsequent logical interfaces, a DLPI link down
12668 	 * notification message may have cleared the running flag to
12669 	 * indicate the link is down, so we shouldn't just blindly set it.
12670 	 */
12671 	if (id == 0)
12672 		ill->ill_phyint->phyint_flags |= PHYI_RUNNING;
12673 	ipif->ipif_ire_type = ire_type;
12674 	phyi = ill->ill_phyint;
12675 	ipif->ipif_orig_ifindex = phyi->phyint_ifindex;
12676 
12677 	if (ipif->ipif_isv6) {
12678 		ill->ill_flags |= ILLF_IPV6;
12679 	} else {
12680 		ipaddr_t inaddr_any = INADDR_ANY;
12681 
12682 		ill->ill_flags |= ILLF_IPV4;
12683 
12684 		/* Keep the IN6_IS_ADDR_V4MAPPED assertions happy */
12685 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12686 		    &ipif->ipif_v6lcl_addr);
12687 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12688 		    &ipif->ipif_v6src_addr);
12689 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12690 		    &ipif->ipif_v6subnet);
12691 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12692 		    &ipif->ipif_v6net_mask);
12693 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12694 		    &ipif->ipif_v6brd_addr);
12695 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12696 		    &ipif->ipif_v6pp_dst_addr);
12697 	}
12698 
12699 	/*
12700 	 * Don't set the interface flags etc. now, will do it in
12701 	 * ip_ll_subnet_defaults.
12702 	 */
12703 	if (!initialize) {
12704 		mutex_exit(&ill->ill_lock);
12705 		mutex_exit(&ill->ill_phyint->phyint_lock);
12706 		return (ipif);
12707 	}
12708 	ipif->ipif_mtu = ill->ill_max_mtu;
12709 
12710 	if (ill->ill_bcast_addr_length != 0) {
12711 		/*
12712 		 * Later detect lack of DLPI driver multicast
12713 		 * capability by catching DL_ENABMULTI errors in
12714 		 * ip_rput_dlpi.
12715 		 */
12716 		ill->ill_flags |= ILLF_MULTICAST;
12717 		if (!ipif->ipif_isv6)
12718 			ipif->ipif_flags |= IPIF_BROADCAST;
12719 	} else {
12720 		if (ill->ill_net_type != IRE_LOOPBACK) {
12721 			if (ipif->ipif_isv6)
12722 				/*
12723 				 * Note: xresolv interfaces will eventually need
12724 				 * NOARP set here as well, but that will require
12725 				 * those external resolvers to have some
12726 				 * knowledge of that flag and act appropriately.
12727 				 * Not to be changed at present.
12728 				 */
12729 				ill->ill_flags |= ILLF_NONUD;
12730 			else
12731 				ill->ill_flags |= ILLF_NOARP;
12732 		}
12733 		if (ill->ill_phys_addr_length == 0) {
12734 			if (ill->ill_media &&
12735 			    ill->ill_media->ip_m_mac_type == SUNW_DL_VNI) {
12736 				ipif->ipif_flags |= IPIF_NOXMIT;
12737 				phyi->phyint_flags |= PHYI_VIRTUAL;
12738 			} else {
12739 				/* pt-pt supports multicast. */
12740 				ill->ill_flags |= ILLF_MULTICAST;
12741 				if (ill->ill_net_type == IRE_LOOPBACK) {
12742 					phyi->phyint_flags |=
12743 					    (PHYI_LOOPBACK | PHYI_VIRTUAL);
12744 				} else {
12745 					ipif->ipif_flags |= IPIF_POINTOPOINT;
12746 				}
12747 			}
12748 		}
12749 	}
12750 	mutex_exit(&ill->ill_lock);
12751 	mutex_exit(&ill->ill_phyint->phyint_lock);
12752 	return (ipif);
12753 }
12754 
12755 /*
12756  * If appropriate, send a message up to the resolver delete the entry
12757  * for the address of this interface which is going out of business.
12758  * (Always called as writer).
12759  *
12760  * NOTE : We need to check for NULL mps as some of the fields are
12761  *	  initialized only for some interface types. See ipif_resolver_up()
12762  *	  for details.
12763  */
12764 void
12765 ipif_arp_down(ipif_t *ipif)
12766 {
12767 	mblk_t	*mp;
12768 
12769 	ip1dbg(("ipif_arp_down(%s:%u)\n",
12770 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
12771 	ASSERT(IAM_WRITER_IPIF(ipif));
12772 
12773 	/* Delete the mapping for the local address */
12774 	mp = ipif->ipif_arp_del_mp;
12775 	if (mp != NULL) {
12776 		ip1dbg(("ipif_arp_down: %s (%u) for %s:%u\n",
12777 		    dlpi_prim_str(*(int *)mp->b_rptr), *(int *)mp->b_rptr,
12778 		    ipif->ipif_ill->ill_name, ipif->ipif_id));
12779 		putnext(ipif->ipif_ill->ill_rq, mp);
12780 		ipif->ipif_arp_del_mp = NULL;
12781 	}
12782 
12783 	/*
12784 	 * If this is the last ipif that is going down, we need
12785 	 * to clean up ARP completely.
12786 	 */
12787 	if (ipif->ipif_ill->ill_ipif_up_count == 0) {
12788 
12789 		/* Send up AR_INTERFACE_DOWN message */
12790 		mp = ipif->ipif_ill->ill_arp_down_mp;
12791 		if (mp != NULL) {
12792 			ip1dbg(("ipif_arp_down: %s (%u) for %s:%u\n",
12793 			    dlpi_prim_str(*(int *)mp->b_rptr),
12794 			    *(int *)mp->b_rptr, ipif->ipif_ill->ill_name,
12795 			    ipif->ipif_id));
12796 			putnext(ipif->ipif_ill->ill_rq, mp);
12797 			ipif->ipif_ill->ill_arp_down_mp = NULL;
12798 		}
12799 
12800 		/* Tell ARP to delete the multicast mappings */
12801 		mp = ipif->ipif_ill->ill_arp_del_mapping_mp;
12802 		if (mp != NULL) {
12803 			ip1dbg(("ipif_arp_down: %s (%u) for %s:%u\n",
12804 			    dlpi_prim_str(*(int *)mp->b_rptr),
12805 			    *(int *)mp->b_rptr, ipif->ipif_ill->ill_name,
12806 			    ipif->ipif_id));
12807 			putnext(ipif->ipif_ill->ill_rq, mp);
12808 			ipif->ipif_ill->ill_arp_del_mapping_mp = NULL;
12809 		}
12810 	}
12811 }
12812 
12813 /*
12814  * This function sets up the multicast mappings in ARP. When ipif_resolver_up
12815  * calls this function, it passes a non-NULL arp_add_mapping_mp indicating
12816  * that it wants the add_mp allocated in this function to be returned
12817  * wihtout sending it to arp. When ip_rput_dlpi_writer calls this to
12818  * just re-do the multicast, it wants us to send the add_mp to ARP also.
12819  * ipif_resolver_up does not want us to do the "add" i.e sending to ARP,
12820  * as it does a ipif_arp_down after calling this function - which will
12821  * remove what we add here.
12822  *
12823  * Returns -1 on failures and 0 on success.
12824  */
12825 int
12826 ipif_arp_setup_multicast(ipif_t *ipif, mblk_t **arp_add_mapping_mp)
12827 {
12828 	mblk_t	*del_mp = NULL;
12829 	mblk_t *add_mp = NULL;
12830 	mblk_t *mp;
12831 	ill_t	*ill = ipif->ipif_ill;
12832 	phyint_t *phyi = ill->ill_phyint;
12833 	ipaddr_t addr, mask, extract_mask = 0;
12834 	arma_t	*arma;
12835 	uint8_t *maddr, *bphys_addr;
12836 	uint32_t hw_start;
12837 	dl_unitdata_req_t *dlur;
12838 
12839 	ASSERT(IAM_WRITER_IPIF(ipif));
12840 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
12841 		return (0);
12842 
12843 	/*
12844 	 * Delete the existing mapping from ARP. Normally ipif_down
12845 	 * -> ipif_arp_down should send this up to ARP. The only
12846 	 * reason we would find this when we are switching from
12847 	 * Multicast to Broadcast where we did not do a down.
12848 	 */
12849 	mp = ill->ill_arp_del_mapping_mp;
12850 	if (mp != NULL) {
12851 		ip1dbg(("ipif_arp_down: %s (%u) for %s:%u\n",
12852 		    dlpi_prim_str(*(int *)mp->b_rptr),
12853 		    *(int *)mp->b_rptr, ill->ill_name, ipif->ipif_id));
12854 		putnext(ill->ill_rq, mp);
12855 		ill->ill_arp_del_mapping_mp = NULL;
12856 	}
12857 
12858 	if (arp_add_mapping_mp != NULL)
12859 		*arp_add_mapping_mp = NULL;
12860 
12861 	/*
12862 	 * Check that the address is not to long for the constant
12863 	 * length reserved in the template arma_t.
12864 	 */
12865 	if (ill->ill_phys_addr_length > IP_MAX_HW_LEN)
12866 		return (-1);
12867 
12868 	/* Add mapping mblk */
12869 	addr = (ipaddr_t)htonl(INADDR_UNSPEC_GROUP);
12870 	mask = (ipaddr_t)htonl(IN_CLASSD_NET);
12871 	add_mp = ill_arp_alloc(ill, (uchar_t *)&ip_arma_multi_template,
12872 	    (caddr_t)&addr);
12873 	if (add_mp == NULL)
12874 		return (-1);
12875 	arma = (arma_t *)add_mp->b_rptr;
12876 	maddr = (uint8_t *)arma + arma->arma_hw_addr_offset;
12877 	bcopy(&mask, (char *)arma + arma->arma_proto_mask_offset, IP_ADDR_LEN);
12878 	arma->arma_hw_addr_length = ill->ill_phys_addr_length;
12879 
12880 	/*
12881 	 * Determine the broadcast address.
12882 	 */
12883 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
12884 	if (ill->ill_sap_length < 0)
12885 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
12886 	else
12887 		bphys_addr = (uchar_t *)dlur +
12888 		    dlur->dl_dest_addr_offset + ill->ill_sap_length;
12889 	/*
12890 	 * Check PHYI_MULTI_BCAST and length of physical
12891 	 * address to determine if we use the mapping or the
12892 	 * broadcast address.
12893 	 */
12894 	if (!(phyi->phyint_flags & PHYI_MULTI_BCAST))
12895 		if (!MEDIA_V4MINFO(ill->ill_media, ill->ill_phys_addr_length,
12896 		    bphys_addr, maddr, &hw_start, &extract_mask))
12897 			phyi->phyint_flags |= PHYI_MULTI_BCAST;
12898 
12899 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) ||
12900 	    (ill->ill_flags & ILLF_MULTICAST)) {
12901 		/* Make sure this will not match the "exact" entry. */
12902 		addr = (ipaddr_t)htonl(INADDR_ALLHOSTS_GROUP);
12903 		del_mp = ill_arp_alloc(ill, (uchar_t *)&ip_ared_template,
12904 		    (caddr_t)&addr);
12905 		if (del_mp == NULL) {
12906 			freemsg(add_mp);
12907 			return (-1);
12908 		}
12909 		bcopy(&extract_mask, (char *)arma +
12910 		    arma->arma_proto_extract_mask_offset, IP_ADDR_LEN);
12911 		if (phyi->phyint_flags & PHYI_MULTI_BCAST) {
12912 			/* Use link-layer broadcast address for MULTI_BCAST */
12913 			bcopy(bphys_addr, maddr, ill->ill_phys_addr_length);
12914 			ip2dbg(("ipif_arp_setup_multicast: adding"
12915 			    " MULTI_BCAST ARP setup for %s\n", ill->ill_name));
12916 		} else {
12917 			arma->arma_hw_mapping_start = hw_start;
12918 			ip2dbg(("ipif_arp_setup_multicast: adding multicast"
12919 			    " ARP setup for %s\n", ill->ill_name));
12920 		}
12921 	} else {
12922 		freemsg(add_mp);
12923 		ASSERT(del_mp == NULL);
12924 		/* It is neither MULTICAST nor MULTI_BCAST */
12925 		return (0);
12926 	}
12927 	ASSERT(add_mp != NULL && del_mp != NULL);
12928 	ill->ill_arp_del_mapping_mp = del_mp;
12929 	if (arp_add_mapping_mp != NULL) {
12930 		/* The caller just wants the mblks allocated */
12931 		*arp_add_mapping_mp = add_mp;
12932 	} else {
12933 		/* The caller wants us to send it to arp */
12934 		putnext(ill->ill_rq, add_mp);
12935 	}
12936 	return (0);
12937 }
12938 
12939 /*
12940  * Get the resolver set up for a new interface address.
12941  * (Always called as writer.)
12942  * Called both for IPv4 and IPv6 interfaces,
12943  * though it only sets up the resolver for v6
12944  * if it's an xresolv interface (one using an external resolver).
12945  * Honors ILLF_NOARP.
12946  * The boolean value arp_just_publish, if B_TRUE, indicates that
12947  * it only needs to send an AR_ENTRY_ADD message up to ARP for
12948  * IPv4 interfaces. Currently, B_TRUE is only set when this
12949  * function is called by ip_rput_dlpi_writer() to handle
12950  * asynchronous hardware address change notification.
12951  * Returns error on failure.
12952  */
12953 int
12954 ipif_resolver_up(ipif_t *ipif, boolean_t arp_just_publish)
12955 {
12956 	caddr_t	addr;
12957 	mblk_t	*arp_up_mp = NULL;
12958 	mblk_t	*arp_down_mp = NULL;
12959 	mblk_t	*arp_add_mp = NULL;
12960 	mblk_t	*arp_del_mp = NULL;
12961 	mblk_t	*arp_add_mapping_mp = NULL;
12962 	mblk_t	*arp_del_mapping_mp = NULL;
12963 	ill_t	*ill = ipif->ipif_ill;
12964 	uchar_t	*area_p = NULL;
12965 	uchar_t	*ared_p = NULL;
12966 	int	err = ENOMEM;
12967 
12968 	ip1dbg(("ipif_resolver_up(%s:%u) flags 0x%x\n",
12969 	    ipif->ipif_ill->ill_name, ipif->ipif_id,
12970 	    (uint_t)ipif->ipif_flags));
12971 	ASSERT(IAM_WRITER_IPIF(ipif));
12972 
12973 	if ((ill->ill_net_type != IRE_IF_RESOLVER) ||
12974 	    (ill->ill_isv6 && !(ill->ill_flags & ILLF_XRESOLV))) {
12975 		return (0);
12976 	}
12977 
12978 	if (ill->ill_isv6) {
12979 		/*
12980 		 * External resolver for IPv6
12981 		 */
12982 		ASSERT(!arp_just_publish);
12983 		if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
12984 			addr = (caddr_t)&ipif->ipif_v6lcl_addr;
12985 			area_p = (uchar_t *)&ip6_area_template;
12986 			ared_p = (uchar_t *)&ip6_ared_template;
12987 		}
12988 	} else {
12989 		/*
12990 		 * IPv4 arp case. If the ARP stream has already started
12991 		 * closing, fail this request for ARP bringup. Else
12992 		 * record the fact that an ARP bringup is pending.
12993 		 */
12994 		mutex_enter(&ill->ill_lock);
12995 		if (ill->ill_arp_closing) {
12996 			mutex_exit(&ill->ill_lock);
12997 			err = EINVAL;
12998 			goto failed;
12999 		} else {
13000 			if (ill->ill_ipif_up_count == 0)
13001 				ill->ill_arp_bringup_pending = 1;
13002 			mutex_exit(&ill->ill_lock);
13003 		}
13004 		if (ipif->ipif_lcl_addr != INADDR_ANY) {
13005 			addr = (caddr_t)&ipif->ipif_lcl_addr;
13006 			area_p = (uchar_t *)&ip_area_template;
13007 			ared_p = (uchar_t *)&ip_ared_template;
13008 		}
13009 	}
13010 
13011 	/*
13012 	 * Add an entry for the local address in ARP only if it
13013 	 * is not UNNUMBERED and the address is not INADDR_ANY.
13014 	 */
13015 	if (((ipif->ipif_flags & IPIF_UNNUMBERED) == 0) && area_p != NULL) {
13016 		/* Now ask ARP to publish our address. */
13017 		arp_add_mp = ill_arp_alloc(ill, area_p, addr);
13018 		if (arp_add_mp == NULL)
13019 			goto failed;
13020 		if (arp_just_publish) {
13021 			/*
13022 			 * Copy the new hardware address and length into
13023 			 * arp_add_mp to be sent to ARP.
13024 			 */
13025 			area_t *area = (area_t *)arp_add_mp->b_rptr;
13026 			area->area_hw_addr_length =
13027 			    ill->ill_phys_addr_length;
13028 			bcopy((char *)ill->ill_phys_addr,
13029 			    ((char *)area + area->area_hw_addr_offset),
13030 			    area->area_hw_addr_length);
13031 		}
13032 
13033 		((area_t *)arp_add_mp->b_rptr)->area_flags =
13034 		    ACE_F_PERMANENT | ACE_F_PUBLISH | ACE_F_MYADDR;
13035 
13036 		if (arp_just_publish)
13037 			goto arp_setup_multicast;
13038 
13039 		/*
13040 		 * Allocate an ARP deletion message so we know we can tell ARP
13041 		 * when the interface goes down.
13042 		 */
13043 		arp_del_mp = ill_arp_alloc(ill, ared_p, addr);
13044 		if (arp_del_mp == NULL)
13045 			goto failed;
13046 
13047 	} else {
13048 		if (arp_just_publish)
13049 			goto done;
13050 	}
13051 	/*
13052 	 * Need to bring up ARP or setup multicast mapping only
13053 	 * when the first interface is coming UP.
13054 	 */
13055 	if (ill->ill_ipif_up_count != 0)
13056 		goto done;
13057 
13058 	/*
13059 	 * Allocate an ARP down message (to be saved) and an ARP up
13060 	 * message.
13061 	 */
13062 	arp_down_mp = ill_arp_alloc(ill, (uchar_t *)&ip_ard_template, 0);
13063 	if (arp_down_mp == NULL)
13064 		goto failed;
13065 
13066 	arp_up_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aru_template, 0);
13067 	if (arp_up_mp == NULL)
13068 		goto failed;
13069 
13070 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
13071 		goto done;
13072 
13073 arp_setup_multicast:
13074 	/*
13075 	 * Setup the multicast mappings. This function initializes
13076 	 * ill_arp_del_mapping_mp also. This does not need to be done for
13077 	 * IPv6.
13078 	 */
13079 	if (!ill->ill_isv6) {
13080 		err = ipif_arp_setup_multicast(ipif, &arp_add_mapping_mp);
13081 		if (err != 0)
13082 			goto failed;
13083 		ASSERT(ill->ill_arp_del_mapping_mp != NULL);
13084 		ASSERT(arp_add_mapping_mp != NULL);
13085 	}
13086 
13087 done:;
13088 	if (arp_del_mp != NULL) {
13089 		ASSERT(ipif->ipif_arp_del_mp == NULL);
13090 		ipif->ipif_arp_del_mp = arp_del_mp;
13091 	}
13092 	if (arp_down_mp != NULL) {
13093 		ASSERT(ill->ill_arp_down_mp == NULL);
13094 		ill->ill_arp_down_mp = arp_down_mp;
13095 	}
13096 	if (arp_del_mapping_mp != NULL) {
13097 		ASSERT(ill->ill_arp_del_mapping_mp == NULL);
13098 		ill->ill_arp_del_mapping_mp = arp_del_mapping_mp;
13099 	}
13100 	if (arp_up_mp != NULL) {
13101 		ip1dbg(("ipif_resolver_up: ARP_UP for %s:%u\n",
13102 			ipif->ipif_ill->ill_name, ipif->ipif_id));
13103 		putnext(ill->ill_rq, arp_up_mp);
13104 	}
13105 	if (arp_add_mp != NULL) {
13106 		ip1dbg(("ipif_resolver_up: ARP_ADD for %s:%u\n",
13107 			ipif->ipif_ill->ill_name, ipif->ipif_id));
13108 		putnext(ill->ill_rq, arp_add_mp);
13109 	}
13110 	if (arp_add_mapping_mp != NULL) {
13111 		ip1dbg(("ipif_resolver_up: MAPPING_ADD for %s:%u\n",
13112 			ipif->ipif_ill->ill_name, ipif->ipif_id));
13113 		putnext(ill->ill_rq, arp_add_mapping_mp);
13114 	}
13115 	if (arp_just_publish)
13116 		return (0);
13117 
13118 	if (ill->ill_flags & ILLF_NOARP)
13119 		err = ill_arp_off(ill);
13120 	else
13121 		err = ill_arp_on(ill);
13122 	if (err) {
13123 		ip0dbg(("ipif_resolver_up: arp_on/off failed %d\n", err));
13124 		freemsg(ipif->ipif_arp_del_mp);
13125 		if (arp_down_mp != NULL)
13126 			freemsg(ill->ill_arp_down_mp);
13127 		if (ill->ill_arp_del_mapping_mp != NULL)
13128 			freemsg(ill->ill_arp_del_mapping_mp);
13129 		ipif->ipif_arp_del_mp = NULL;
13130 		ill->ill_arp_down_mp = NULL;
13131 		ill->ill_arp_del_mapping_mp = NULL;
13132 		return (err);
13133 	}
13134 	return (ill->ill_ipif_up_count != 0 ? 0 : EINPROGRESS);
13135 
13136 failed:;
13137 	ip1dbg(("ipif_resolver_up: FAILED\n"));
13138 	freemsg(arp_add_mp);
13139 	freemsg(arp_del_mp);
13140 	freemsg(arp_add_mapping_mp);
13141 	freemsg(arp_up_mp);
13142 	freemsg(arp_down_mp);
13143 	ill->ill_arp_bringup_pending = 0;
13144 	return (err);
13145 }
13146 
13147 /*
13148  * Wakeup all threads waiting to enter the ipsq, and sleeping
13149  * on any of the ills in this ipsq. The ill_lock of the ill
13150  * must be held so that waiters don't miss wakeups
13151  */
13152 static void
13153 ill_signal_ipsq_ills(ipsq_t *ipsq, boolean_t caller_holds_lock)
13154 {
13155 	phyint_t *phyint;
13156 
13157 	phyint = ipsq->ipsq_phyint_list;
13158 	while (phyint != NULL) {
13159 		if (phyint->phyint_illv4) {
13160 			if (!caller_holds_lock)
13161 				mutex_enter(&phyint->phyint_illv4->ill_lock);
13162 			ASSERT(MUTEX_HELD(&phyint->phyint_illv4->ill_lock));
13163 			cv_broadcast(&phyint->phyint_illv4->ill_cv);
13164 			if (!caller_holds_lock)
13165 				mutex_exit(&phyint->phyint_illv4->ill_lock);
13166 		}
13167 		if (phyint->phyint_illv6) {
13168 			if (!caller_holds_lock)
13169 				mutex_enter(&phyint->phyint_illv6->ill_lock);
13170 			ASSERT(MUTEX_HELD(&phyint->phyint_illv6->ill_lock));
13171 			cv_broadcast(&phyint->phyint_illv6->ill_cv);
13172 			if (!caller_holds_lock)
13173 				mutex_exit(&phyint->phyint_illv6->ill_lock);
13174 		}
13175 		phyint = phyint->phyint_ipsq_next;
13176 	}
13177 }
13178 
13179 static ipsq_t *
13180 ipsq_create(char *groupname)
13181 {
13182 	ipsq_t	*ipsq;
13183 
13184 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
13185 	ipsq = kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP);
13186 	if (ipsq == NULL) {
13187 		return (NULL);
13188 	}
13189 
13190 	if (groupname != NULL)
13191 		(void) strcpy(ipsq->ipsq_name, groupname);
13192 	else
13193 		ipsq->ipsq_name[0] = '\0';
13194 
13195 	mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, NULL);
13196 	ipsq->ipsq_flags |= IPSQ_GROUP;
13197 	ipsq->ipsq_next = ipsq_g_head;
13198 	ipsq_g_head = ipsq;
13199 	return (ipsq);
13200 }
13201 
13202 /*
13203  * Return an ipsq correspoding to the groupname. If 'create' is true
13204  * allocate a new ipsq if one does not exist. Usually an ipsq is associated
13205  * uniquely with an IPMP group. However during IPMP groupname operations,
13206  * multiple IPMP groups may be associated with a single ipsq. But no
13207  * IPMP group can be associated with more than 1 ipsq at any time.
13208  * For example
13209  *	Interfaces		IPMP grpname	ipsq	ipsq_name      ipsq_refs
13210  * 	hme1, hme2		mpk17-84	ipsq1	mpk17-84	2
13211  *	hme3, hme4		mpk17-85	ipsq2	mpk17-85	2
13212  *
13213  * Now the command ifconfig hme3 group mpk17-84 results in the temporary
13214  * status shown below during the execution of the above command.
13215  * 	hme1, hme2, hme3, hme4	mpk17-84, mpk17-85	ipsq1	mpk17-84  4
13216  *
13217  * After the completion of the above groupname command we return to the stable
13218  * state shown below.
13219  * 	hme1, hme2, hme3	mpk17-84	ipsq1	mpk17-84	3
13220  *	hme4			mpk17-85	ipsq2	mpk17-85	1
13221  *
13222  * Because of the above, we don't search based on the ipsq_name since that
13223  * would miss the correct ipsq during certain windows as shown above.
13224  * The ipsq_name is only used during split of an ipsq to return the ipsq to its
13225  * natural state.
13226  */
13227 static ipsq_t *
13228 ip_ipsq_lookup(char *groupname, boolean_t create, ipsq_t *exclude_ipsq)
13229 {
13230 	ipsq_t	*ipsq;
13231 	int	group_len;
13232 	phyint_t *phyint;
13233 
13234 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
13235 
13236 	group_len = strlen(groupname);
13237 	ASSERT(group_len != 0);
13238 	group_len++;
13239 
13240 	for (ipsq = ipsq_g_head; ipsq != NULL; ipsq = ipsq->ipsq_next) {
13241 		/*
13242 		 * When an ipsq is being split, and ill_split_ipsq
13243 		 * calls this function, we exclude it from being considered.
13244 		 */
13245 		if (ipsq == exclude_ipsq)
13246 			continue;
13247 
13248 		/*
13249 		 * Compare against the ipsq_name. The groupname change happens
13250 		 * in 2 phases. The 1st phase merges the from group into
13251 		 * the to group's ipsq, by calling ill_merge_groups and restarts
13252 		 * the ioctl. The 2nd phase then locates the ipsq again thru
13253 		 * ipsq_name. At this point the phyint_groupname has not been
13254 		 * updated.
13255 		 */
13256 		if ((group_len == strlen(ipsq->ipsq_name) + 1) &&
13257 		    (bcmp(ipsq->ipsq_name, groupname, group_len) == 0)) {
13258 			/*
13259 			 * Verify that an ipmp groupname is exactly
13260 			 * part of 1 ipsq and is not found in any other
13261 			 * ipsq.
13262 			 */
13263 			ASSERT(ip_ipsq_lookup(groupname, B_FALSE, ipsq) ==
13264 			    NULL);
13265 			return (ipsq);
13266 		}
13267 
13268 		/*
13269 		 * Comparison against ipsq_name alone is not sufficient.
13270 		 * In the case when groups are currently being
13271 		 * merged, the ipsq could hold other IPMP groups temporarily.
13272 		 * so we walk the phyint list and compare against the
13273 		 * phyint_groupname as well.
13274 		 */
13275 		phyint = ipsq->ipsq_phyint_list;
13276 		while (phyint != NULL) {
13277 			if ((group_len == phyint->phyint_groupname_len) &&
13278 			    (bcmp(phyint->phyint_groupname, groupname,
13279 			    group_len) == 0)) {
13280 				/*
13281 				 * Verify that an ipmp groupname is exactly
13282 				 * part of 1 ipsq and is not found in any other
13283 				 * ipsq.
13284 				 */
13285 				ASSERT(ip_ipsq_lookup(groupname, B_FALSE, ipsq)
13286 					== NULL);
13287 				return (ipsq);
13288 			}
13289 			phyint = phyint->phyint_ipsq_next;
13290 		}
13291 	}
13292 	if (create)
13293 		ipsq = ipsq_create(groupname);
13294 	return (ipsq);
13295 }
13296 
13297 static void
13298 ipsq_delete(ipsq_t *ipsq)
13299 {
13300 	ipsq_t *nipsq;
13301 	ipsq_t *pipsq = NULL;
13302 
13303 	/*
13304 	 * We don't hold the ipsq lock, but we are sure no new
13305 	 * messages can land up, since the ipsq_refs is zero.
13306 	 * i.e. this ipsq is unnamed and no phyint or phyint group
13307 	 * is associated with this ipsq. (Lookups are based on ill_name
13308 	 * or phyint_group_name)
13309 	 */
13310 	ASSERT(ipsq->ipsq_refs == 0);
13311 	ASSERT(ipsq->ipsq_xopq_mphead == NULL && ipsq->ipsq_mphead == NULL);
13312 	ASSERT(ipsq->ipsq_pending_mp == NULL);
13313 	if (!(ipsq->ipsq_flags & IPSQ_GROUP)) {
13314 		/*
13315 		 * This is not the ipsq of an IPMP group.
13316 		 */
13317 		kmem_free(ipsq, sizeof (ipsq_t));
13318 		return;
13319 	}
13320 
13321 	rw_enter(&ill_g_lock, RW_WRITER);
13322 
13323 	/*
13324 	 * Locate the ipsq  before we can remove it from
13325 	 * the singly linked list of ipsq's.
13326 	 */
13327 	for (nipsq = ipsq_g_head; nipsq != NULL; nipsq = nipsq->ipsq_next) {
13328 		if (nipsq == ipsq) {
13329 			break;
13330 		}
13331 		pipsq = nipsq;
13332 	}
13333 
13334 	ASSERT(nipsq == ipsq);
13335 
13336 	/* unlink ipsq from the list */
13337 	if (pipsq != NULL)
13338 		pipsq->ipsq_next = ipsq->ipsq_next;
13339 	else
13340 		ipsq_g_head = ipsq->ipsq_next;
13341 	kmem_free(ipsq, sizeof (ipsq_t));
13342 	rw_exit(&ill_g_lock);
13343 }
13344 
13345 static void
13346 ill_move_to_new_ipsq(ipsq_t *old_ipsq, ipsq_t *new_ipsq, mblk_t *current_mp,
13347     queue_t *q)
13348 
13349 {
13350 
13351 	ASSERT(MUTEX_HELD(&new_ipsq->ipsq_lock));
13352 	ASSERT(old_ipsq->ipsq_mphead == NULL && old_ipsq->ipsq_mptail == NULL);
13353 	ASSERT(old_ipsq->ipsq_pending_ipif == NULL);
13354 	ASSERT(old_ipsq->ipsq_pending_mp == NULL);
13355 	ASSERT(current_mp != NULL);
13356 
13357 	ipsq_enq(new_ipsq, q, current_mp, (ipsq_func_t)ip_process_ioctl,
13358 		NEW_OP, NULL);
13359 
13360 	ASSERT(new_ipsq->ipsq_xopq_mptail != NULL &&
13361 	    new_ipsq->ipsq_xopq_mphead != NULL);
13362 
13363 	/*
13364 	 * move from old ipsq to the new ipsq.
13365 	 */
13366 	new_ipsq->ipsq_xopq_mptail->b_next = old_ipsq->ipsq_xopq_mphead;
13367 	if (old_ipsq->ipsq_xopq_mphead != NULL)
13368 		new_ipsq->ipsq_xopq_mptail = old_ipsq->ipsq_xopq_mptail;
13369 
13370 	old_ipsq->ipsq_xopq_mphead = old_ipsq->ipsq_xopq_mptail = NULL;
13371 }
13372 
13373 void
13374 ill_group_cleanup(ill_t *ill)
13375 {
13376 	ill_t *ill_v4;
13377 	ill_t *ill_v6;
13378 	ipif_t *ipif;
13379 
13380 	ill_v4 = ill->ill_phyint->phyint_illv4;
13381 	ill_v6 = ill->ill_phyint->phyint_illv6;
13382 
13383 	if (ill_v4 != NULL) {
13384 		mutex_enter(&ill_v4->ill_lock);
13385 		for (ipif = ill_v4->ill_ipif; ipif != NULL;
13386 		    ipif = ipif->ipif_next) {
13387 			IPIF_UNMARK_MOVING(ipif);
13388 		}
13389 		ill_v4->ill_up_ipifs = B_FALSE;
13390 		mutex_exit(&ill_v4->ill_lock);
13391 	}
13392 
13393 	if (ill_v6 != NULL) {
13394 		mutex_enter(&ill_v6->ill_lock);
13395 		for (ipif = ill_v6->ill_ipif; ipif != NULL;
13396 		    ipif = ipif->ipif_next) {
13397 			IPIF_UNMARK_MOVING(ipif);
13398 		}
13399 		ill_v6->ill_up_ipifs = B_FALSE;
13400 		mutex_exit(&ill_v6->ill_lock);
13401 	}
13402 }
13403 /*
13404  * This function is called when an ill has had a change in its group status
13405  * to bring up all the ipifs that were up before the change.
13406  */
13407 int
13408 ill_up_ipifs(ill_t *ill, queue_t *q, mblk_t *mp)
13409 {
13410 	ipif_t *ipif;
13411 	ill_t *ill_v4;
13412 	ill_t *ill_v6;
13413 	ill_t *from_ill;
13414 	int err = 0;
13415 
13416 
13417 	ASSERT(IAM_WRITER_ILL(ill));
13418 
13419 	/*
13420 	 * Except for ipif_state_flags and ill_state_flags the other
13421 	 * fields of the ipif/ill that are modified below are protected
13422 	 * implicitly since we are a writer. We would have tried to down
13423 	 * even an ipif that was already down, in ill_down_ipifs. So we
13424 	 * just blindly clear the IPIF_CHANGING flag here on all ipifs.
13425 	 */
13426 	ill_v4 = ill->ill_phyint->phyint_illv4;
13427 	ill_v6 = ill->ill_phyint->phyint_illv6;
13428 	if (ill_v4 != NULL) {
13429 		ill_v4->ill_up_ipifs = B_TRUE;
13430 		for (ipif = ill_v4->ill_ipif; ipif != NULL;
13431 		    ipif = ipif->ipif_next) {
13432 			mutex_enter(&ill_v4->ill_lock);
13433 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
13434 			IPIF_UNMARK_MOVING(ipif);
13435 			mutex_exit(&ill_v4->ill_lock);
13436 			if (ipif->ipif_was_up) {
13437 				if (!(ipif->ipif_flags & IPIF_UP))
13438 					err = ipif_up(ipif, q, mp);
13439 				ipif->ipif_was_up = B_FALSE;
13440 				if (err != 0) {
13441 					/*
13442 					 * Can there be any other error ?
13443 					 */
13444 					ASSERT(err == EINPROGRESS);
13445 					return (err);
13446 				}
13447 			}
13448 		}
13449 		mutex_enter(&ill_v4->ill_lock);
13450 		ill_v4->ill_state_flags &= ~ILL_CHANGING;
13451 		mutex_exit(&ill_v4->ill_lock);
13452 		ill_v4->ill_up_ipifs = B_FALSE;
13453 		if (ill_v4->ill_move_in_progress) {
13454 			ASSERT(ill_v4->ill_move_peer != NULL);
13455 			ill_v4->ill_move_in_progress = B_FALSE;
13456 			from_ill = ill_v4->ill_move_peer;
13457 			from_ill->ill_move_in_progress = B_FALSE;
13458 			from_ill->ill_move_peer = NULL;
13459 			mutex_enter(&from_ill->ill_lock);
13460 			from_ill->ill_state_flags &= ~ILL_CHANGING;
13461 			mutex_exit(&from_ill->ill_lock);
13462 			if (ill_v6 == NULL) {
13463 				if (from_ill->ill_phyint->phyint_flags &
13464 				    PHYI_STANDBY) {
13465 					phyint_inactive(from_ill->ill_phyint);
13466 				}
13467 				if (ill_v4->ill_phyint->phyint_flags &
13468 				    PHYI_STANDBY) {
13469 					phyint_inactive(ill_v4->ill_phyint);
13470 				}
13471 			}
13472 			ill_v4->ill_move_peer = NULL;
13473 		}
13474 	}
13475 
13476 	if (ill_v6 != NULL) {
13477 		ill_v6->ill_up_ipifs = B_TRUE;
13478 		for (ipif = ill_v6->ill_ipif; ipif != NULL;
13479 		    ipif = ipif->ipif_next) {
13480 			mutex_enter(&ill_v6->ill_lock);
13481 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
13482 			IPIF_UNMARK_MOVING(ipif);
13483 			mutex_exit(&ill_v6->ill_lock);
13484 			if (ipif->ipif_was_up) {
13485 				if (!(ipif->ipif_flags & IPIF_UP))
13486 					err = ipif_up(ipif, q, mp);
13487 				ipif->ipif_was_up = B_FALSE;
13488 				if (err != 0) {
13489 					/*
13490 					 * Can there be any other error ?
13491 					 */
13492 					ASSERT(err == EINPROGRESS);
13493 					return (err);
13494 				}
13495 			}
13496 		}
13497 		mutex_enter(&ill_v6->ill_lock);
13498 		ill_v6->ill_state_flags &= ~ILL_CHANGING;
13499 		mutex_exit(&ill_v6->ill_lock);
13500 		ill_v6->ill_up_ipifs = B_FALSE;
13501 		if (ill_v6->ill_move_in_progress) {
13502 			ASSERT(ill_v6->ill_move_peer != NULL);
13503 			ill_v6->ill_move_in_progress = B_FALSE;
13504 			from_ill = ill_v6->ill_move_peer;
13505 			from_ill->ill_move_in_progress = B_FALSE;
13506 			from_ill->ill_move_peer = NULL;
13507 			mutex_enter(&from_ill->ill_lock);
13508 			from_ill->ill_state_flags &= ~ILL_CHANGING;
13509 			mutex_exit(&from_ill->ill_lock);
13510 			if (from_ill->ill_phyint->phyint_flags & PHYI_STANDBY) {
13511 				phyint_inactive(from_ill->ill_phyint);
13512 			}
13513 			if (ill_v6->ill_phyint->phyint_flags & PHYI_STANDBY) {
13514 				phyint_inactive(ill_v6->ill_phyint);
13515 			}
13516 			ill_v6->ill_move_peer = NULL;
13517 		}
13518 	}
13519 	return (0);
13520 }
13521 
13522 /*
13523  * bring down all the approriate ipifs.
13524  */
13525 /* ARGSUSED */
13526 static void
13527 ill_down_ipifs(ill_t *ill, mblk_t *mp, int index, boolean_t chk_nofailover)
13528 {
13529 	ipif_t *ipif;
13530 
13531 	ASSERT(IAM_WRITER_ILL(ill));
13532 
13533 	/*
13534 	 * Except for ipif_state_flags the other fields of the ipif/ill that
13535 	 * are modified below are protected implicitly since we are a writer
13536 	 */
13537 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13538 		if (chk_nofailover && (ipif->ipif_flags & IPIF_NOFAILOVER))
13539 			continue;
13540 		if (index == 0 || index == ipif->ipif_orig_ifindex) {
13541 			/*
13542 			 * We go through the ipif_down logic even if the ipif
13543 			 * is already down, since routes can be added based
13544 			 * on down ipifs. Going through ipif_down once again
13545 			 * will delete any IREs created based on these routes.
13546 			 */
13547 			if (ipif->ipif_flags & IPIF_UP)
13548 				ipif->ipif_was_up = B_TRUE;
13549 			/*
13550 			 * If called with chk_nofailover true ipif is moving.
13551 			 */
13552 			mutex_enter(&ill->ill_lock);
13553 			if (chk_nofailover) {
13554 				ipif->ipif_state_flags |=
13555 					IPIF_MOVING | IPIF_CHANGING;
13556 			} else {
13557 				ipif->ipif_state_flags |= IPIF_CHANGING;
13558 			}
13559 			mutex_exit(&ill->ill_lock);
13560 			/*
13561 			 * Need to re-create net/subnet bcast ires if
13562 			 * they are dependent on ipif.
13563 			 */
13564 			if (!ipif->ipif_isv6)
13565 				ipif_check_bcast_ires(ipif);
13566 			(void) ipif_logical_down(ipif, NULL, NULL);
13567 			ipif_down_tail(ipif);
13568 			/*
13569 			 * We don't do ipif_multicast_down for IPv4 in
13570 			 * ipif_down. We need to set this so that
13571 			 * ipif_multicast_up will join the
13572 			 * ALLHOSTS_GROUP on to_ill.
13573 			 */
13574 			ipif->ipif_multicast_up = B_FALSE;
13575 		}
13576 	}
13577 }
13578 
13579 #define	IPSQ_INC_REF(ipsq)	{			\
13580 	ASSERT(RW_WRITE_HELD(&ill_g_lock));		\
13581 	(ipsq)->ipsq_refs++;				\
13582 }
13583 
13584 #define	IPSQ_DEC_REF(ipsq)	{			\
13585 	ASSERT(RW_WRITE_HELD(&ill_g_lock));		\
13586 	(ipsq)->ipsq_refs--;				\
13587 	if ((ipsq)->ipsq_refs == 0)				\
13588 		(ipsq)->ipsq_name[0] = '\0'; 		\
13589 }
13590 
13591 /*
13592  * Change the ipsq of all the ill's whose current ipsq is 'cur_ipsq' to
13593  * new_ipsq.
13594  */
13595 static void
13596 ill_merge_ipsq(ipsq_t *cur_ipsq, ipsq_t *new_ipsq)
13597 {
13598 	phyint_t *phyint;
13599 	phyint_t *next_phyint;
13600 
13601 	/*
13602 	 * To change the ipsq of an ill, we need to hold the ill_g_lock as
13603 	 * writer and the ill_lock of the ill in question. Also the dest
13604 	 * ipsq can't vanish while we hold the ill_g_lock as writer.
13605 	 */
13606 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
13607 
13608 	phyint = cur_ipsq->ipsq_phyint_list;
13609 	cur_ipsq->ipsq_phyint_list = NULL;
13610 	while (phyint != NULL) {
13611 		next_phyint = phyint->phyint_ipsq_next;
13612 		IPSQ_DEC_REF(cur_ipsq);
13613 		phyint->phyint_ipsq_next = new_ipsq->ipsq_phyint_list;
13614 		new_ipsq->ipsq_phyint_list = phyint;
13615 		IPSQ_INC_REF(new_ipsq);
13616 		phyint->phyint_ipsq = new_ipsq;
13617 		phyint = next_phyint;
13618 	}
13619 }
13620 
13621 #define	SPLIT_SUCCESS		0
13622 #define	SPLIT_NOT_NEEDED	1
13623 #define	SPLIT_FAILED		2
13624 
13625 int
13626 ill_split_to_grp_ipsq(phyint_t *phyint, ipsq_t *cur_ipsq, boolean_t need_retry)
13627 {
13628 	ipsq_t *newipsq = NULL;
13629 
13630 	/*
13631 	 * Assertions denote pre-requisites for changing the ipsq of
13632 	 * a phyint
13633 	 */
13634 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
13635 	/*
13636 	 * <ill-phyint> assocs can't change while ill_g_lock
13637 	 * is held as writer. See ill_phyint_reinit()
13638 	 */
13639 	ASSERT(phyint->phyint_illv4 == NULL ||
13640 	    MUTEX_HELD(&phyint->phyint_illv4->ill_lock));
13641 	ASSERT(phyint->phyint_illv6 == NULL ||
13642 	    MUTEX_HELD(&phyint->phyint_illv6->ill_lock));
13643 
13644 	if ((phyint->phyint_groupname_len !=
13645 	    (strlen(cur_ipsq->ipsq_name) + 1) ||
13646 	    bcmp(phyint->phyint_groupname, cur_ipsq->ipsq_name,
13647 	    phyint->phyint_groupname_len) != 0)) {
13648 		/*
13649 		 * Once we fail in creating a new ipsq due to memory shortage,
13650 		 * don't attempt to create new ipsq again, based on another
13651 		 * phyint, since we want all phyints belonging to an IPMP group
13652 		 * to be in the same ipsq even in the event of mem alloc fails.
13653 		 */
13654 		newipsq = ip_ipsq_lookup(phyint->phyint_groupname, !need_retry,
13655 		    cur_ipsq);
13656 		if (newipsq == NULL) {
13657 			/* Memory allocation failure */
13658 			return (SPLIT_FAILED);
13659 		} else {
13660 			/* ipsq_refs protected by ill_g_lock (writer) */
13661 			IPSQ_DEC_REF(cur_ipsq);
13662 			phyint->phyint_ipsq = newipsq;
13663 			phyint->phyint_ipsq_next = newipsq->ipsq_phyint_list;
13664 			newipsq->ipsq_phyint_list = phyint;
13665 			IPSQ_INC_REF(newipsq);
13666 			return (SPLIT_SUCCESS);
13667 		}
13668 	}
13669 	return (SPLIT_NOT_NEEDED);
13670 }
13671 
13672 /*
13673  * The ill locks of the phyint and the ill_g_lock (writer) must be held
13674  * to do this split
13675  */
13676 static int
13677 ill_split_to_own_ipsq(phyint_t *phyint, ipsq_t *cur_ipsq)
13678 {
13679 	ipsq_t *newipsq;
13680 
13681 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
13682 	/*
13683 	 * <ill-phyint> assocs can't change while ill_g_lock
13684 	 * is held as writer. See ill_phyint_reinit()
13685 	 */
13686 
13687 	ASSERT(phyint->phyint_illv4 == NULL ||
13688 	    MUTEX_HELD(&phyint->phyint_illv4->ill_lock));
13689 	ASSERT(phyint->phyint_illv6 == NULL ||
13690 	    MUTEX_HELD(&phyint->phyint_illv6->ill_lock));
13691 
13692 	if (!ipsq_init((phyint->phyint_illv4 != NULL) ?
13693 	    phyint->phyint_illv4: phyint->phyint_illv6)) {
13694 		/*
13695 		 * ipsq_init failed due to no memory
13696 		 * caller will use the same ipsq
13697 		 */
13698 		return (SPLIT_FAILED);
13699 	}
13700 
13701 	/* ipsq_ref is protected by ill_g_lock (writer) */
13702 	IPSQ_DEC_REF(cur_ipsq);
13703 
13704 	/*
13705 	 * This is a new ipsq that is unknown to the world.
13706 	 * So we don't need to hold ipsq_lock,
13707 	 */
13708 	newipsq = phyint->phyint_ipsq;
13709 	newipsq->ipsq_writer = NULL;
13710 	newipsq->ipsq_reentry_cnt--;
13711 	ASSERT(newipsq->ipsq_reentry_cnt == 0);
13712 #ifdef ILL_DEBUG
13713 	newipsq->ipsq_depth = 0;
13714 #endif
13715 
13716 	return (SPLIT_SUCCESS);
13717 }
13718 
13719 /*
13720  * Change the ipsq of all the ill's whose current ipsq is 'cur_ipsq' to
13721  * ipsq's representing their individual groups or themselves. Return
13722  * whether split needs to be retried again later.
13723  */
13724 static boolean_t
13725 ill_split_ipsq(ipsq_t *cur_ipsq)
13726 {
13727 	phyint_t *phyint;
13728 	phyint_t *next_phyint;
13729 	int	error;
13730 	boolean_t need_retry = B_FALSE;
13731 
13732 	phyint = cur_ipsq->ipsq_phyint_list;
13733 	cur_ipsq->ipsq_phyint_list = NULL;
13734 	while (phyint != NULL) {
13735 		next_phyint = phyint->phyint_ipsq_next;
13736 		/*
13737 		 * 'created' will tell us whether the callee actually
13738 		 * created an ipsq. Lack of memory may force the callee
13739 		 * to return without creating an ipsq.
13740 		 */
13741 		if (phyint->phyint_groupname == NULL) {
13742 			error = ill_split_to_own_ipsq(phyint, cur_ipsq);
13743 		} else {
13744 			error = ill_split_to_grp_ipsq(phyint, cur_ipsq,
13745 					need_retry);
13746 		}
13747 
13748 		switch (error) {
13749 		case SPLIT_FAILED:
13750 			need_retry = B_TRUE;
13751 			/* FALLTHRU */
13752 		case SPLIT_NOT_NEEDED:
13753 			/*
13754 			 * Keep it on the list.
13755 			 */
13756 			phyint->phyint_ipsq_next = cur_ipsq->ipsq_phyint_list;
13757 			cur_ipsq->ipsq_phyint_list = phyint;
13758 			break;
13759 		case SPLIT_SUCCESS:
13760 			break;
13761 		default:
13762 			ASSERT(0);
13763 		}
13764 
13765 		phyint = next_phyint;
13766 	}
13767 	return (need_retry);
13768 }
13769 
13770 /*
13771  * given an ipsq 'ipsq' lock all ills associated with this ipsq.
13772  * and return the ills in the list. This list will be
13773  * needed to unlock all the ills later on by the caller.
13774  * The <ill-ipsq> associations could change between the
13775  * lock and unlock. Hence the unlock can't traverse the
13776  * ipsq to get the list of ills.
13777  */
13778 static int
13779 ill_lock_ipsq_ills(ipsq_t *ipsq, ill_t **list, int list_max)
13780 {
13781 	int	cnt = 0;
13782 	phyint_t	*phyint;
13783 
13784 	/*
13785 	 * The caller holds ill_g_lock to ensure that the ill memberships
13786 	 * of the ipsq don't change
13787 	 */
13788 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
13789 
13790 	phyint = ipsq->ipsq_phyint_list;
13791 	while (phyint != NULL) {
13792 		if (phyint->phyint_illv4 != NULL) {
13793 			ASSERT(cnt < list_max);
13794 			list[cnt++] = phyint->phyint_illv4;
13795 		}
13796 		if (phyint->phyint_illv6 != NULL) {
13797 			ASSERT(cnt < list_max);
13798 			list[cnt++] = phyint->phyint_illv6;
13799 		}
13800 		phyint = phyint->phyint_ipsq_next;
13801 	}
13802 	ill_lock_ills(list, cnt);
13803 	return (cnt);
13804 }
13805 
13806 void
13807 ill_lock_ills(ill_t **list, int cnt)
13808 {
13809 	int	i;
13810 
13811 	if (cnt > 1) {
13812 		boolean_t try_again;
13813 		do {
13814 			try_again = B_FALSE;
13815 			for (i = 0; i < cnt - 1; i++) {
13816 				if (list[i] < list[i + 1]) {
13817 					ill_t	*tmp;
13818 
13819 					/* swap the elements */
13820 					tmp = list[i];
13821 					list[i] = list[i + 1];
13822 					list[i + 1] = tmp;
13823 					try_again = B_TRUE;
13824 				}
13825 			}
13826 		} while (try_again);
13827 	}
13828 
13829 	for (i = 0; i < cnt; i++) {
13830 		if (i == 0) {
13831 			if (list[i] != NULL)
13832 				mutex_enter(&list[i]->ill_lock);
13833 			else
13834 				return;
13835 		} else if ((list[i-1] != list[i]) && (list[i] != NULL)) {
13836 			mutex_enter(&list[i]->ill_lock);
13837 		}
13838 	}
13839 }
13840 
13841 void
13842 ill_unlock_ills(ill_t **list, int cnt)
13843 {
13844 	int	i;
13845 
13846 	for (i = 0; i < cnt; i++) {
13847 		if ((i == 0) && (list[i] != NULL)) {
13848 			mutex_exit(&list[i]->ill_lock);
13849 		} else if ((list[i-1] != list[i]) && (list[i] != NULL)) {
13850 			mutex_exit(&list[i]->ill_lock);
13851 		}
13852 	}
13853 }
13854 
13855 /*
13856  * Merge all the ills from 1 ipsq group into another ipsq group.
13857  * The source ipsq group is specified by the ipsq associated with
13858  * 'from_ill'. The destination ipsq group is specified by the ipsq
13859  * associated with 'to_ill' or 'groupname' respectively.
13860  * Note that ipsq itself does not have a reference count mechanism
13861  * and functions don't look up an ipsq and pass it around. Instead
13862  * functions pass around an ill or groupname, and the ipsq is looked
13863  * up from the ill or groupname and the required operation performed
13864  * atomically with the lookup on the ipsq.
13865  */
13866 static int
13867 ill_merge_groups(ill_t *from_ill, ill_t *to_ill, char *groupname, mblk_t *mp,
13868     queue_t *q)
13869 {
13870 	ipsq_t *old_ipsq;
13871 	ipsq_t *new_ipsq;
13872 	ill_t	**ill_list;
13873 	int	cnt;
13874 	size_t	ill_list_size;
13875 	boolean_t became_writer_on_new_sq = B_FALSE;
13876 
13877 	/* Exactly 1 of 'to_ill' and groupname can be specified. */
13878 	ASSERT((to_ill != NULL) ^ (groupname != NULL));
13879 
13880 	/*
13881 	 * Need to hold ill_g_lock as writer and also the ill_lock to
13882 	 * change the <ill-ipsq> assoc of an ill. Need to hold the
13883 	 * ipsq_lock to prevent new messages from landing on an ipsq.
13884 	 */
13885 	rw_enter(&ill_g_lock, RW_WRITER);
13886 
13887 	old_ipsq = from_ill->ill_phyint->phyint_ipsq;
13888 	if (groupname != NULL)
13889 		new_ipsq = ip_ipsq_lookup(groupname, B_TRUE, NULL);
13890 	else {
13891 		new_ipsq = to_ill->ill_phyint->phyint_ipsq;
13892 	}
13893 
13894 	ASSERT(old_ipsq != NULL && new_ipsq != NULL);
13895 
13896 	/*
13897 	 * both groups are on the same ipsq.
13898 	 */
13899 	if (old_ipsq == new_ipsq) {
13900 		rw_exit(&ill_g_lock);
13901 		return (0);
13902 	}
13903 
13904 	cnt = old_ipsq->ipsq_refs << 1;
13905 	ill_list_size = cnt * sizeof (ill_t *);
13906 	ill_list = kmem_zalloc(ill_list_size, KM_NOSLEEP);
13907 	if (ill_list == NULL) {
13908 		rw_exit(&ill_g_lock);
13909 		return (ENOMEM);
13910 	}
13911 	cnt = ill_lock_ipsq_ills(old_ipsq, ill_list, cnt);
13912 
13913 	/* Need ipsq lock to enque messages on new ipsq or to become writer */
13914 	mutex_enter(&new_ipsq->ipsq_lock);
13915 	if ((new_ipsq->ipsq_writer == NULL &&
13916 		new_ipsq->ipsq_current_ipif == NULL) ||
13917 	    (new_ipsq->ipsq_writer == curthread)) {
13918 		new_ipsq->ipsq_writer = curthread;
13919 		new_ipsq->ipsq_reentry_cnt++;
13920 		became_writer_on_new_sq = B_TRUE;
13921 	}
13922 
13923 	/*
13924 	 * We are holding ill_g_lock as writer and all the ill locks of
13925 	 * the old ipsq. So the old_ipsq can't be looked up, and hence no new
13926 	 * message can land up on the old ipsq even though we don't hold the
13927 	 * ipsq_lock of the old_ipsq. Now move all messages to the newipsq.
13928 	 */
13929 	ill_move_to_new_ipsq(old_ipsq, new_ipsq, mp, q);
13930 
13931 	/*
13932 	 * now change the ipsq of all ills in the 'old_ipsq' to 'new_ipsq'.
13933 	 * 'new_ipsq' has been looked up, and it can't change its <ill-ipsq>
13934 	 * assocs. till we release the ill_g_lock, and hence it can't vanish.
13935 	 */
13936 	ill_merge_ipsq(old_ipsq, new_ipsq);
13937 
13938 	/*
13939 	 * Mark the new ipsq as needing a split since it is currently
13940 	 * being shared by more than 1 IPMP group. The split will
13941 	 * occur at the end of ipsq_exit
13942 	 */
13943 	new_ipsq->ipsq_split = B_TRUE;
13944 
13945 	/* Now release all the locks */
13946 	mutex_exit(&new_ipsq->ipsq_lock);
13947 	ill_unlock_ills(ill_list, cnt);
13948 	rw_exit(&ill_g_lock);
13949 
13950 	kmem_free(ill_list, ill_list_size);
13951 
13952 	/*
13953 	 * If we succeeded in becoming writer on the new ipsq, then
13954 	 * drain the new ipsq and start processing  all enqueued messages
13955 	 * including the current ioctl we are processing which is either
13956 	 * a set groupname or failover/failback.
13957 	 */
13958 	if (became_writer_on_new_sq)
13959 		ipsq_exit(new_ipsq, B_TRUE, B_TRUE);
13960 
13961 	/*
13962 	 * syncq has been changed and all the messages have been moved.
13963 	 */
13964 	mutex_enter(&old_ipsq->ipsq_lock);
13965 	old_ipsq->ipsq_current_ipif = NULL;
13966 	mutex_exit(&old_ipsq->ipsq_lock);
13967 	return (EINPROGRESS);
13968 }
13969 
13970 /*
13971  * Delete and add the loopback copy and non-loopback copy of
13972  * the BROADCAST ire corresponding to ill and addr. Used to
13973  * group broadcast ires together when ill becomes part of
13974  * a group.
13975  *
13976  * This function is also called when ill is leaving the group
13977  * so that the ires belonging to the group gets re-grouped.
13978  */
13979 static void
13980 ill_bcast_delete_and_add(ill_t *ill, ipaddr_t addr)
13981 {
13982 	ire_t *ire, *nire, *nire_next, *ire_head = NULL;
13983 	ire_t **ire_ptpn = &ire_head;
13984 
13985 	/*
13986 	 * The loopback and non-loopback IREs are inserted in the order in which
13987 	 * they're found, on the basis that they are correctly ordered (loopback
13988 	 * first).
13989 	 */
13990 	for (;;) {
13991 		ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, ill->ill_ipif,
13992 		    ALL_ZONES, MATCH_IRE_TYPE | MATCH_IRE_ILL);
13993 		if (ire == NULL)
13994 			break;
13995 
13996 		/*
13997 		 * we are passing in KM_SLEEP because it is not easy to
13998 		 * go back to a sane state in case of memory failure.
13999 		 */
14000 		nire = kmem_cache_alloc(ire_cache, KM_SLEEP);
14001 		ASSERT(nire != NULL);
14002 		bzero(nire, sizeof (ire_t));
14003 		/*
14004 		 * Don't use ire_max_frag directly since we don't
14005 		 * hold on to 'ire' until we add the new ire 'nire' and
14006 		 * we don't want the new ire to have a dangling reference
14007 		 * to 'ire'. The ire_max_frag of a broadcast ire must
14008 		 * be in sync with the ipif_mtu of the associate ipif.
14009 		 * For eg. this happens as a result of SIOCSLIFNAME,
14010 		 * SIOCSLIFLNKINFO or a DL_NOTE_SDU_SIZE inititated by
14011 		 * the driver. A change in ire_max_frag triggered as
14012 		 * as a result of path mtu discovery, or due to an
14013 		 * IP_IOC_IRE_ADVISE_NOREPLY from the transport or due a
14014 		 * route change -mtu command does not apply to broadcast ires.
14015 		 *
14016 		 * XXX We need a recovery strategy here if ire_init fails
14017 		 */
14018 		if (ire_init(nire,
14019 		    (uchar_t *)&ire->ire_addr,
14020 		    (uchar_t *)&ire->ire_mask,
14021 		    (uchar_t *)&ire->ire_src_addr,
14022 		    (uchar_t *)&ire->ire_gateway_addr,
14023 		    (uchar_t *)&ire->ire_in_src_addr,
14024 		    ire->ire_stq == NULL ? &ip_loopback_mtu :
14025 			&ire->ire_ipif->ipif_mtu,
14026 		    ire->ire_fp_mp,
14027 		    ire->ire_rfq,
14028 		    ire->ire_stq,
14029 		    ire->ire_type,
14030 		    ire->ire_dlureq_mp,
14031 		    ire->ire_ipif,
14032 		    ire->ire_in_ill,
14033 		    ire->ire_cmask,
14034 		    ire->ire_phandle,
14035 		    ire->ire_ihandle,
14036 		    ire->ire_flags,
14037 		    &ire->ire_uinfo) == NULL) {
14038 			cmn_err(CE_PANIC, "ire_init() failed");
14039 		}
14040 		ire_delete(ire);
14041 		ire_refrele(ire);
14042 
14043 		/*
14044 		 * The newly created IREs are inserted at the tail of the list
14045 		 * starting with ire_head. As we've just allocated them no one
14046 		 * knows about them so it's safe.
14047 		 */
14048 		*ire_ptpn = nire;
14049 		ire_ptpn = &nire->ire_next;
14050 	}
14051 
14052 	for (nire = ire_head; nire != NULL; nire = nire_next) {
14053 		int error;
14054 		ire_t *oire;
14055 		/* unlink the IRE from our list before calling ire_add() */
14056 		nire_next = nire->ire_next;
14057 		nire->ire_next = NULL;
14058 
14059 		/* ire_add adds the ire at the right place in the list */
14060 		oire = nire;
14061 		error = ire_add(&nire, NULL, NULL, NULL);
14062 		ASSERT(error == 0);
14063 		ASSERT(oire == nire);
14064 		ire_refrele(nire);	/* Held in ire_add */
14065 	}
14066 }
14067 
14068 /*
14069  * This function is usually called when an ill is inserted in
14070  * a group and all the ipifs are already UP. As all the ipifs
14071  * are already UP, the broadcast ires have already been created
14072  * and been inserted. But, ire_add_v4 would not have grouped properly.
14073  * We need to re-group for the benefit of ip_wput_ire which
14074  * expects BROADCAST ires to be grouped properly to avoid sending
14075  * more than one copy of the broadcast packet per group.
14076  *
14077  * NOTE : We don't check for ill_ipif_up_count to be non-zero here
14078  *	  because when ipif_up_done ends up calling this, ires have
14079  *        already been added before illgrp_insert i.e before ill_group
14080  *	  has been initialized.
14081  */
14082 static void
14083 ill_group_bcast_for_xmit(ill_t *ill)
14084 {
14085 	ill_group_t *illgrp;
14086 	ipif_t *ipif;
14087 	ipaddr_t addr;
14088 	ipaddr_t net_mask;
14089 	ipaddr_t subnet_netmask;
14090 
14091 	illgrp = ill->ill_group;
14092 
14093 	/*
14094 	 * This function is called even when an ill is deleted from
14095 	 * the group. Hence, illgrp could be null.
14096 	 */
14097 	if (illgrp != NULL && illgrp->illgrp_ill_count == 1)
14098 		return;
14099 
14100 	/*
14101 	 * Delete all the BROADCAST ires matching this ill and add
14102 	 * them back. This time, ire_add_v4 should take care of
14103 	 * grouping them with others because ill is part of the
14104 	 * group.
14105 	 */
14106 	ill_bcast_delete_and_add(ill, 0);
14107 	ill_bcast_delete_and_add(ill, INADDR_BROADCAST);
14108 
14109 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
14110 
14111 		if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14112 		    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14113 			net_mask = ip_net_mask(ipif->ipif_lcl_addr);
14114 		} else {
14115 			net_mask = htonl(IN_CLASSA_NET);
14116 		}
14117 		addr = net_mask & ipif->ipif_subnet;
14118 		ill_bcast_delete_and_add(ill, addr);
14119 		ill_bcast_delete_and_add(ill, ~net_mask | addr);
14120 
14121 		subnet_netmask = ipif->ipif_net_mask;
14122 		addr = ipif->ipif_subnet;
14123 		ill_bcast_delete_and_add(ill, addr);
14124 		ill_bcast_delete_and_add(ill, ~subnet_netmask | addr);
14125 	}
14126 }
14127 
14128 /*
14129  * This function is called from illgrp_delete when ill is being deleted
14130  * from the group.
14131  *
14132  * As ill is not there in the group anymore, any address belonging
14133  * to this ill should be cleared of IRE_MARK_NORECV.
14134  */
14135 static void
14136 ill_clear_bcast_mark(ill_t *ill, ipaddr_t addr)
14137 {
14138 	ire_t *ire;
14139 	irb_t *irb;
14140 
14141 	ASSERT(ill->ill_group == NULL);
14142 
14143 	ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, ill->ill_ipif,
14144 	    ALL_ZONES, MATCH_IRE_TYPE | MATCH_IRE_ILL);
14145 
14146 	if (ire != NULL) {
14147 		/*
14148 		 * IPMP and plumbing operations are serialized on the ipsq, so
14149 		 * no one will insert or delete a broadcast ire under our feet.
14150 		 */
14151 		irb = ire->ire_bucket;
14152 		rw_enter(&irb->irb_lock, RW_READER);
14153 		ire_refrele(ire);
14154 
14155 		for (; ire != NULL; ire = ire->ire_next) {
14156 			if (ire->ire_addr != addr)
14157 				break;
14158 			if (ire_to_ill(ire) != ill)
14159 				continue;
14160 
14161 			ASSERT(!(ire->ire_marks & IRE_MARK_CONDEMNED));
14162 			ire->ire_marks &= ~IRE_MARK_NORECV;
14163 		}
14164 		rw_exit(&irb->irb_lock);
14165 	}
14166 }
14167 
14168 /*
14169  * This function must be called only after the broadcast ires
14170  * have been grouped together. For a given address addr, nominate
14171  * only one of the ires whose interface is not FAILED or OFFLINE.
14172  *
14173  * This is also called when an ipif goes down, so that we can nominate
14174  * a different ire with the same address for receiving.
14175  */
14176 static void
14177 ill_mark_bcast(ill_group_t *illgrp, ipaddr_t addr)
14178 {
14179 	irb_t *irb;
14180 	ire_t *ire;
14181 	ire_t *ire1;
14182 	ire_t *save_ire;
14183 	ire_t **irep = NULL;
14184 	boolean_t first = B_TRUE;
14185 	ire_t *clear_ire = NULL;
14186 	ire_t *start_ire = NULL;
14187 	ire_t	*new_lb_ire;
14188 	ire_t	*new_nlb_ire;
14189 	boolean_t new_lb_ire_used = B_FALSE;
14190 	boolean_t new_nlb_ire_used = B_FALSE;
14191 	uint64_t match_flags;
14192 	uint64_t phyi_flags;
14193 	boolean_t fallback = B_FALSE;
14194 
14195 	ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, NULL, ALL_ZONES,
14196 	    MATCH_IRE_TYPE);
14197 	/*
14198 	 * We may not be able to find some ires if a previous
14199 	 * ire_create failed. This happens when an ipif goes
14200 	 * down and we are unable to create BROADCAST ires due
14201 	 * to memory failure. Thus, we have to check for NULL
14202 	 * below. This should handle the case for LOOPBACK,
14203 	 * POINTOPOINT and interfaces with some POINTOPOINT
14204 	 * logicals for which there are no BROADCAST ires.
14205 	 */
14206 	if (ire == NULL)
14207 		return;
14208 	/*
14209 	 * Currently IRE_BROADCASTS are deleted when an ipif
14210 	 * goes down which runs exclusively. Thus, setting
14211 	 * IRE_MARK_RCVD should not race with ire_delete marking
14212 	 * IRE_MARK_CONDEMNED. We grab the lock below just to
14213 	 * be consistent with other parts of the code that walks
14214 	 * a given bucket.
14215 	 */
14216 	save_ire = ire;
14217 	irb = ire->ire_bucket;
14218 	new_lb_ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
14219 	if (new_lb_ire == NULL) {
14220 		ire_refrele(ire);
14221 		return;
14222 	}
14223 	new_nlb_ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
14224 	if (new_nlb_ire == NULL) {
14225 		ire_refrele(ire);
14226 		kmem_cache_free(ire_cache, new_lb_ire);
14227 		return;
14228 	}
14229 	IRB_REFHOLD(irb);
14230 	rw_enter(&irb->irb_lock, RW_WRITER);
14231 	/*
14232 	 * Get to the first ire matching the address and the
14233 	 * group. If the address does not match we are done
14234 	 * as we could not find the IRE. If the address matches
14235 	 * we should get to the first one matching the group.
14236 	 */
14237 	while (ire != NULL) {
14238 		if (ire->ire_addr != addr ||
14239 		    ire->ire_ipif->ipif_ill->ill_group == illgrp) {
14240 			break;
14241 		}
14242 		ire = ire->ire_next;
14243 	}
14244 	match_flags = PHYI_FAILED | PHYI_INACTIVE;
14245 	start_ire = ire;
14246 redo:
14247 	while (ire != NULL && ire->ire_addr == addr &&
14248 	    ire->ire_ipif->ipif_ill->ill_group == illgrp) {
14249 		/*
14250 		 * The first ire for any address within a group
14251 		 * should always be the one with IRE_MARK_NORECV cleared
14252 		 * so that ip_wput_ire can avoid searching for one.
14253 		 * Note down the insertion point which will be used
14254 		 * later.
14255 		 */
14256 		if (first && (irep == NULL))
14257 			irep = ire->ire_ptpn;
14258 		/*
14259 		 * PHYI_FAILED is set when the interface fails.
14260 		 * This interface might have become good, but the
14261 		 * daemon has not yet detected. We should still
14262 		 * not receive on this. PHYI_OFFLINE should never
14263 		 * be picked as this has been offlined and soon
14264 		 * be removed.
14265 		 */
14266 		phyi_flags = ire->ire_ipif->ipif_ill->ill_phyint->phyint_flags;
14267 		if (phyi_flags & PHYI_OFFLINE) {
14268 			ire->ire_marks |= IRE_MARK_NORECV;
14269 			ire = ire->ire_next;
14270 			continue;
14271 		}
14272 		if (phyi_flags & match_flags) {
14273 			ire->ire_marks |= IRE_MARK_NORECV;
14274 			ire = ire->ire_next;
14275 			if ((phyi_flags & (PHYI_FAILED | PHYI_INACTIVE)) ==
14276 			    PHYI_INACTIVE) {
14277 				fallback = B_TRUE;
14278 			}
14279 			continue;
14280 		}
14281 		if (first) {
14282 			/*
14283 			 * We will move this to the front of the list later
14284 			 * on.
14285 			 */
14286 			clear_ire = ire;
14287 			ire->ire_marks &= ~IRE_MARK_NORECV;
14288 		} else {
14289 			ire->ire_marks |= IRE_MARK_NORECV;
14290 		}
14291 		first = B_FALSE;
14292 		ire = ire->ire_next;
14293 	}
14294 	/*
14295 	 * If we never nominated anybody, try nominating at least
14296 	 * an INACTIVE, if we found one. Do it only once though.
14297 	 */
14298 	if (first && (match_flags == (PHYI_FAILED | PHYI_INACTIVE)) &&
14299 	    fallback) {
14300 		match_flags = PHYI_FAILED;
14301 		ire = start_ire;
14302 		irep = NULL;
14303 		goto redo;
14304 	}
14305 	ire_refrele(save_ire);
14306 
14307 	/*
14308 	 * irep non-NULL indicates that we entered the while loop
14309 	 * above. If clear_ire is at the insertion point, we don't
14310 	 * have to do anything. clear_ire will be NULL if all the
14311 	 * interfaces are failed.
14312 	 *
14313 	 * We cannot unlink and reinsert the ire at the right place
14314 	 * in the list since there can be other walkers of this bucket.
14315 	 * Instead we delete and recreate the ire
14316 	 */
14317 	if (clear_ire != NULL && irep != NULL && *irep != clear_ire) {
14318 		ire_t *clear_ire_stq = NULL;
14319 		bzero(new_lb_ire, sizeof (ire_t));
14320 		/* XXX We need a recovery strategy here. */
14321 		if (ire_init(new_lb_ire,
14322 		    (uchar_t *)&clear_ire->ire_addr,
14323 		    (uchar_t *)&clear_ire->ire_mask,
14324 		    (uchar_t *)&clear_ire->ire_src_addr,
14325 		    (uchar_t *)&clear_ire->ire_gateway_addr,
14326 		    (uchar_t *)&clear_ire->ire_in_src_addr,
14327 		    &clear_ire->ire_max_frag,
14328 		    clear_ire->ire_fp_mp,
14329 		    clear_ire->ire_rfq,
14330 		    clear_ire->ire_stq,
14331 		    clear_ire->ire_type,
14332 		    clear_ire->ire_dlureq_mp,
14333 		    clear_ire->ire_ipif,
14334 		    clear_ire->ire_in_ill,
14335 		    clear_ire->ire_cmask,
14336 		    clear_ire->ire_phandle,
14337 		    clear_ire->ire_ihandle,
14338 		    clear_ire->ire_flags,
14339 		    &clear_ire->ire_uinfo) == NULL)
14340 			cmn_err(CE_PANIC, "ire_init() failed");
14341 		if (clear_ire->ire_stq == NULL) {
14342 			ire_t *ire_next = clear_ire->ire_next;
14343 			if (ire_next != NULL &&
14344 			    ire_next->ire_stq != NULL &&
14345 			    ire_next->ire_addr == clear_ire->ire_addr &&
14346 			    ire_next->ire_ipif->ipif_ill ==
14347 			    clear_ire->ire_ipif->ipif_ill) {
14348 				clear_ire_stq = ire_next;
14349 
14350 				bzero(new_nlb_ire, sizeof (ire_t));
14351 				/* XXX We need a recovery strategy here. */
14352 				if (ire_init(new_nlb_ire,
14353 				    (uchar_t *)&clear_ire_stq->ire_addr,
14354 				    (uchar_t *)&clear_ire_stq->ire_mask,
14355 				    (uchar_t *)&clear_ire_stq->ire_src_addr,
14356 				    (uchar_t *)&clear_ire_stq->ire_gateway_addr,
14357 				    (uchar_t *)&clear_ire_stq->ire_in_src_addr,
14358 				    &clear_ire_stq->ire_max_frag,
14359 				    clear_ire_stq->ire_fp_mp,
14360 				    clear_ire_stq->ire_rfq,
14361 				    clear_ire_stq->ire_stq,
14362 				    clear_ire_stq->ire_type,
14363 				    clear_ire_stq->ire_dlureq_mp,
14364 				    clear_ire_stq->ire_ipif,
14365 				    clear_ire_stq->ire_in_ill,
14366 				    clear_ire_stq->ire_cmask,
14367 				    clear_ire_stq->ire_phandle,
14368 				    clear_ire_stq->ire_ihandle,
14369 				    clear_ire_stq->ire_flags,
14370 				    &clear_ire_stq->ire_uinfo) == NULL)
14371 					cmn_err(CE_PANIC, "ire_init() failed");
14372 			}
14373 		}
14374 
14375 		/*
14376 		 * Delete the ire. We can't call ire_delete() since
14377 		 * we are holding the bucket lock. We can't release the
14378 		 * bucket lock since we can't allow irep to change. So just
14379 		 * mark it CONDEMNED. The IRB_REFRELE will delete the
14380 		 * ire from the list and do the refrele.
14381 		 */
14382 		clear_ire->ire_marks |= IRE_MARK_CONDEMNED;
14383 		irb->irb_marks |= IRE_MARK_CONDEMNED;
14384 
14385 		if (clear_ire_stq != NULL) {
14386 			ire_fastpath_list_delete(
14387 			    (ill_t *)clear_ire_stq->ire_stq->q_ptr,
14388 			    clear_ire_stq);
14389 			clear_ire_stq->ire_marks |= IRE_MARK_CONDEMNED;
14390 		}
14391 
14392 		/*
14393 		 * Also take care of otherfields like ib/ob pkt count
14394 		 * etc. Need to dup them. ditto in ill_bcast_delete_and_add
14395 		 */
14396 
14397 		/* Add the new ire's. Insert at *irep */
14398 		new_lb_ire->ire_bucket = clear_ire->ire_bucket;
14399 		ire1 = *irep;
14400 		if (ire1 != NULL)
14401 			ire1->ire_ptpn = &new_lb_ire->ire_next;
14402 		new_lb_ire->ire_next = ire1;
14403 		/* Link the new one in. */
14404 		new_lb_ire->ire_ptpn = irep;
14405 		membar_producer();
14406 		*irep = new_lb_ire;
14407 		new_lb_ire_used = B_TRUE;
14408 		BUMP_IRE_STATS(ire_stats_v4, ire_stats_inserted);
14409 		new_lb_ire->ire_bucket->irb_ire_cnt++;
14410 		new_lb_ire->ire_ipif->ipif_ire_cnt++;
14411 
14412 		if (clear_ire_stq != NULL) {
14413 			new_nlb_ire->ire_bucket = clear_ire->ire_bucket;
14414 			irep = &new_lb_ire->ire_next;
14415 			/* Add the new ire. Insert at *irep */
14416 			ire1 = *irep;
14417 			if (ire1 != NULL)
14418 				ire1->ire_ptpn = &new_nlb_ire->ire_next;
14419 			new_nlb_ire->ire_next = ire1;
14420 			/* Link the new one in. */
14421 			new_nlb_ire->ire_ptpn = irep;
14422 			membar_producer();
14423 			*irep = new_nlb_ire;
14424 			new_nlb_ire_used = B_TRUE;
14425 			BUMP_IRE_STATS(ire_stats_v4, ire_stats_inserted);
14426 			new_nlb_ire->ire_bucket->irb_ire_cnt++;
14427 			new_nlb_ire->ire_ipif->ipif_ire_cnt++;
14428 			((ill_t *)new_nlb_ire->ire_stq->q_ptr)->ill_ire_cnt++;
14429 		}
14430 	}
14431 	rw_exit(&irb->irb_lock);
14432 	if (!new_lb_ire_used)
14433 		kmem_cache_free(ire_cache, new_lb_ire);
14434 	if (!new_nlb_ire_used)
14435 		kmem_cache_free(ire_cache, new_nlb_ire);
14436 	IRB_REFRELE(irb);
14437 }
14438 
14439 /*
14440  * Whenever an ipif goes down we have to renominate a different
14441  * broadcast ire to receive. Whenever an ipif comes up, we need
14442  * to make sure that we have only one nominated to receive.
14443  */
14444 static void
14445 ipif_renominate_bcast(ipif_t *ipif)
14446 {
14447 	ill_t *ill = ipif->ipif_ill;
14448 	ipaddr_t subnet_addr;
14449 	ipaddr_t net_addr;
14450 	ipaddr_t net_mask = 0;
14451 	ipaddr_t subnet_netmask;
14452 	ipaddr_t addr;
14453 	ill_group_t *illgrp;
14454 
14455 	illgrp = ill->ill_group;
14456 	/*
14457 	 * If this is the last ipif going down, it might take
14458 	 * the ill out of the group. In that case ipif_down ->
14459 	 * illgrp_delete takes care of doing the nomination.
14460 	 * ipif_down does not call for this case.
14461 	 */
14462 	ASSERT(illgrp != NULL);
14463 
14464 	/* There could not have been any ires associated with this */
14465 	if (ipif->ipif_subnet == 0)
14466 		return;
14467 
14468 	ill_mark_bcast(illgrp, 0);
14469 	ill_mark_bcast(illgrp, INADDR_BROADCAST);
14470 
14471 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14472 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14473 		net_mask = ip_net_mask(ipif->ipif_lcl_addr);
14474 	} else {
14475 		net_mask = htonl(IN_CLASSA_NET);
14476 	}
14477 	addr = net_mask & ipif->ipif_subnet;
14478 	ill_mark_bcast(illgrp, addr);
14479 
14480 	net_addr = ~net_mask | addr;
14481 	ill_mark_bcast(illgrp, net_addr);
14482 
14483 	subnet_netmask = ipif->ipif_net_mask;
14484 	addr = ipif->ipif_subnet;
14485 	ill_mark_bcast(illgrp, addr);
14486 
14487 	subnet_addr = ~subnet_netmask | addr;
14488 	ill_mark_bcast(illgrp, subnet_addr);
14489 }
14490 
14491 /*
14492  * Whenever we form or delete ill groups, we need to nominate one set of
14493  * BROADCAST ires for receiving in the group.
14494  *
14495  * 1) When ipif_up_done -> ilgrp_insert calls this function, BROADCAST ires
14496  *    have been added, but ill_ipif_up_count is 0. Thus, we don't assert
14497  *    for ill_ipif_up_count to be non-zero. This is the only case where
14498  *    ill_ipif_up_count is zero and we would still find the ires.
14499  *
14500  * 2) ip_sioctl_group_name/ifgrp_insert calls this function, at least one
14501  *    ipif is UP and we just have to do the nomination.
14502  *
14503  * 3) When ill_handoff_responsibility calls us, some ill has been removed
14504  *    from the group. So, we have to do the nomination.
14505  *
14506  * Because of (3), there could be just one ill in the group. But we have
14507  * to nominate still as IRE_MARK_NORCV may have been marked on this.
14508  * Thus, this function does not optimize when there is only one ill as
14509  * it is not correct for (3).
14510  */
14511 static void
14512 ill_nominate_bcast_rcv(ill_group_t *illgrp)
14513 {
14514 	ill_t *ill;
14515 	ipif_t *ipif;
14516 	ipaddr_t subnet_addr;
14517 	ipaddr_t prev_subnet_addr = 0;
14518 	ipaddr_t net_addr;
14519 	ipaddr_t prev_net_addr = 0;
14520 	ipaddr_t net_mask = 0;
14521 	ipaddr_t subnet_netmask;
14522 	ipaddr_t addr;
14523 
14524 	/*
14525 	 * When the last memeber is leaving, there is nothing to
14526 	 * nominate.
14527 	 */
14528 	if (illgrp->illgrp_ill_count == 0) {
14529 		ASSERT(illgrp->illgrp_ill == NULL);
14530 		return;
14531 	}
14532 
14533 	ill = illgrp->illgrp_ill;
14534 	ASSERT(!ill->ill_isv6);
14535 	/*
14536 	 * We assume that ires with same address and belonging to the
14537 	 * same group, has been grouped together. Nominating a *single*
14538 	 * ill in the group for sending and receiving broadcast is done
14539 	 * by making sure that the first BROADCAST ire (which will be
14540 	 * the one returned by ire_ctable_lookup for ip_rput and the
14541 	 * one that will be used in ip_wput_ire) will be the one that
14542 	 * will not have IRE_MARK_NORECV set.
14543 	 *
14544 	 * 1) ip_rput checks and discards packets received on ires marked
14545 	 *    with IRE_MARK_NORECV. Thus, we don't send up duplicate
14546 	 *    broadcast packets. We need to clear IRE_MARK_NORECV on the
14547 	 *    first ire in the group for every broadcast address in the group.
14548 	 *    ip_rput will accept packets only on the first ire i.e only
14549 	 *    one copy of the ill.
14550 	 *
14551 	 * 2) ip_wput_ire needs to send out just one copy of the broadcast
14552 	 *    packet for the whole group. It needs to send out on the ill
14553 	 *    whose ire has not been marked with IRE_MARK_NORECV. If it sends
14554 	 *    on the one marked with IRE_MARK_NORECV, ip_rput will accept
14555 	 *    the copy echoed back on other port where the ire is not marked
14556 	 *    with IRE_MARK_NORECV.
14557 	 *
14558 	 * Note that we just need to have the first IRE either loopback or
14559 	 * non-loopback (either of them may not exist if ire_create failed
14560 	 * during ipif_down) with IRE_MARK_NORECV not set. ip_rput will
14561 	 * always hit the first one and hence will always accept one copy.
14562 	 *
14563 	 * We have a broadcast ire per ill for all the unique prefixes
14564 	 * hosted on that ill. As we don't have a way of knowing the
14565 	 * unique prefixes on a given ill and hence in the whole group,
14566 	 * we just call ill_mark_bcast on all the prefixes that exist
14567 	 * in the group. For the common case of one prefix, the code
14568 	 * below optimizes by remebering the last address used for
14569 	 * markng. In the case of multiple prefixes, this will still
14570 	 * optimize depending the order of prefixes.
14571 	 *
14572 	 * The only unique address across the whole group is 0.0.0.0 and
14573 	 * 255.255.255.255 and thus we call only once. ill_mark_bcast enables
14574 	 * the first ire in the bucket for receiving and disables the
14575 	 * others.
14576 	 */
14577 	ill_mark_bcast(illgrp, 0);
14578 	ill_mark_bcast(illgrp, INADDR_BROADCAST);
14579 	for (; ill != NULL; ill = ill->ill_group_next) {
14580 
14581 		for (ipif = ill->ill_ipif; ipif != NULL;
14582 		    ipif = ipif->ipif_next) {
14583 
14584 			if (!(ipif->ipif_flags & IPIF_UP) ||
14585 			    ipif->ipif_subnet == 0) {
14586 				continue;
14587 			}
14588 			if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14589 			    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14590 				net_mask = ip_net_mask(ipif->ipif_lcl_addr);
14591 			} else {
14592 				net_mask = htonl(IN_CLASSA_NET);
14593 			}
14594 			addr = net_mask & ipif->ipif_subnet;
14595 			if (prev_net_addr == 0 || prev_net_addr != addr) {
14596 				ill_mark_bcast(illgrp, addr);
14597 				net_addr = ~net_mask | addr;
14598 				ill_mark_bcast(illgrp, net_addr);
14599 			}
14600 			prev_net_addr = addr;
14601 
14602 			subnet_netmask = ipif->ipif_net_mask;
14603 			addr = ipif->ipif_subnet;
14604 			if (prev_subnet_addr == 0 ||
14605 			    prev_subnet_addr != addr) {
14606 				ill_mark_bcast(illgrp, addr);
14607 				subnet_addr = ~subnet_netmask | addr;
14608 				ill_mark_bcast(illgrp, subnet_addr);
14609 			}
14610 			prev_subnet_addr = addr;
14611 		}
14612 	}
14613 }
14614 
14615 /*
14616  * This function is called while forming ill groups.
14617  *
14618  * Currently, we handle only allmulti groups. We want to join
14619  * allmulti on only one of the ills in the groups. In future,
14620  * when we have link aggregation, we may have to join normal
14621  * multicast groups on multiple ills as switch does inbound load
14622  * balancing. Following are the functions that calls this
14623  * function :
14624  *
14625  * 1) ill_recover_multicast : Interface is coming back UP.
14626  *    When the first ipif comes back UP, ipif_up_done/ipif_up_done_v6
14627  *    will call ill_recover_multicast to recover all the multicast
14628  *    groups. We need to make sure that only one member is joined
14629  *    in the ill group.
14630  *
14631  * 2) ip_addmulti/ip_addmulti_v6 : ill groups has already been formed.
14632  *    Somebody is joining allmulti. We need to make sure that only one
14633  *    member is joined in the group.
14634  *
14635  * 3) illgrp_insert : If allmulti has already joined, we need to make
14636  *    sure that only one member is joined in the group.
14637  *
14638  * 4) ip_delmulti/ip_delmulti_v6 : Somebody in the group is leaving
14639  *    allmulti who we have nominated. We need to pick someother ill.
14640  *
14641  * 5) illgrp_delete : The ill we nominated is leaving the group,
14642  *    we need to pick a new ill to join the group.
14643  *
14644  * For (1), (2), (5) - we just have to check whether there is
14645  * a good ill joined in the group. If we could not find any ills
14646  * joined the group, we should join.
14647  *
14648  * For (4), the one that was nominated to receive, left the group.
14649  * There could be nobody joined in the group when this function is
14650  * called.
14651  *
14652  * For (3) - we need to explicitly check whether there are multiple
14653  * ills joined in the group.
14654  *
14655  * For simplicity, we don't differentiate any of the above cases. We
14656  * just leave the group if it is joined on any of them and join on
14657  * the first good ill.
14658  */
14659 int
14660 ill_nominate_mcast_rcv(ill_group_t *illgrp)
14661 {
14662 	ilm_t *ilm;
14663 	ill_t *ill;
14664 	ill_t *fallback_inactive_ill = NULL;
14665 	ill_t *fallback_failed_ill = NULL;
14666 	int ret = 0;
14667 
14668 	/*
14669 	 * Leave the allmulti on all the ills and start fresh.
14670 	 */
14671 	for (ill = illgrp->illgrp_ill; ill != NULL;
14672 	    ill = ill->ill_group_next) {
14673 		if (ill->ill_join_allmulti)
14674 			(void) ip_leave_allmulti(ill->ill_ipif);
14675 	}
14676 
14677 	/*
14678 	 * Choose a good ill. Fallback to inactive or failed if
14679 	 * none available. We need to fallback to FAILED in the
14680 	 * case where we have 2 interfaces in a group - where
14681 	 * one of them is failed and another is a good one and
14682 	 * the good one (not marked inactive) is leaving the group.
14683 	 */
14684 	ret = 0;
14685 	for (ill = illgrp->illgrp_ill; ill != NULL;
14686 	    ill = ill->ill_group_next) {
14687 		/* Never pick an offline interface */
14688 		if (ill->ill_phyint->phyint_flags & PHYI_OFFLINE)
14689 			continue;
14690 
14691 		if (ill->ill_phyint->phyint_flags & PHYI_FAILED) {
14692 			fallback_failed_ill = ill;
14693 			continue;
14694 		}
14695 		if (ill->ill_phyint->phyint_flags & PHYI_INACTIVE) {
14696 			fallback_inactive_ill = ill;
14697 			continue;
14698 		}
14699 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
14700 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
14701 				ret = ip_join_allmulti(ill->ill_ipif);
14702 				/*
14703 				 * ip_join_allmulti can fail because of memory
14704 				 * failures. So, make sure we join at least
14705 				 * on one ill.
14706 				 */
14707 				if (ill->ill_join_allmulti)
14708 					return (0);
14709 			}
14710 		}
14711 	}
14712 	if (ret != 0) {
14713 		/*
14714 		 * If we tried nominating above and failed to do so,
14715 		 * return error. We might have tried multiple times.
14716 		 * But, return the latest error.
14717 		 */
14718 		return (ret);
14719 	}
14720 	if ((ill = fallback_inactive_ill) != NULL) {
14721 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
14722 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
14723 				ret = ip_join_allmulti(ill->ill_ipif);
14724 				return (ret);
14725 			}
14726 		}
14727 	} else if ((ill = fallback_failed_ill) != NULL) {
14728 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
14729 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
14730 				ret = ip_join_allmulti(ill->ill_ipif);
14731 				return (ret);
14732 			}
14733 		}
14734 	}
14735 	return (0);
14736 }
14737 
14738 /*
14739  * This function is called from illgrp_delete after it is
14740  * deleted from the group to reschedule responsibilities
14741  * to a different ill.
14742  */
14743 static void
14744 ill_handoff_responsibility(ill_t *ill, ill_group_t *illgrp)
14745 {
14746 	ilm_t	*ilm;
14747 	ipif_t	*ipif;
14748 	ipaddr_t subnet_addr;
14749 	ipaddr_t net_addr;
14750 	ipaddr_t net_mask = 0;
14751 	ipaddr_t subnet_netmask;
14752 	ipaddr_t addr;
14753 
14754 	ASSERT(ill->ill_group == NULL);
14755 	/*
14756 	 * Broadcast Responsibility:
14757 	 *
14758 	 * 1. If this ill has been nominated for receiving broadcast
14759 	 * packets, we need to find a new one. Before we find a new
14760 	 * one, we need to re-group the ires that are part of this new
14761 	 * group (assumed by ill_nominate_bcast_rcv). We do this by
14762 	 * calling ill_group_bcast_for_xmit(ill) which will do the right
14763 	 * thing for us.
14764 	 *
14765 	 * 2. If this ill was not nominated for receiving broadcast
14766 	 * packets, we need to clear the IRE_MARK_NORECV flag
14767 	 * so that we continue to send up broadcast packets.
14768 	 */
14769 	if (!ill->ill_isv6) {
14770 		/*
14771 		 * Case 1 above : No optimization here. Just redo the
14772 		 * nomination.
14773 		 */
14774 		ill_group_bcast_for_xmit(ill);
14775 		ill_nominate_bcast_rcv(illgrp);
14776 
14777 		/*
14778 		 * Case 2 above : Lookup and clear IRE_MARK_NORECV.
14779 		 */
14780 		ill_clear_bcast_mark(ill, 0);
14781 		ill_clear_bcast_mark(ill, INADDR_BROADCAST);
14782 
14783 		for (ipif = ill->ill_ipif; ipif != NULL;
14784 		    ipif = ipif->ipif_next) {
14785 
14786 			if (!(ipif->ipif_flags & IPIF_UP) ||
14787 			    ipif->ipif_subnet == 0) {
14788 				continue;
14789 			}
14790 			if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14791 			    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14792 				net_mask = ip_net_mask(ipif->ipif_lcl_addr);
14793 			} else {
14794 				net_mask = htonl(IN_CLASSA_NET);
14795 			}
14796 			addr = net_mask & ipif->ipif_subnet;
14797 			ill_clear_bcast_mark(ill, addr);
14798 
14799 			net_addr = ~net_mask | addr;
14800 			ill_clear_bcast_mark(ill, net_addr);
14801 
14802 			subnet_netmask = ipif->ipif_net_mask;
14803 			addr = ipif->ipif_subnet;
14804 			ill_clear_bcast_mark(ill, addr);
14805 
14806 			subnet_addr = ~subnet_netmask | addr;
14807 			ill_clear_bcast_mark(ill, subnet_addr);
14808 		}
14809 	}
14810 
14811 	/*
14812 	 * Multicast Responsibility.
14813 	 *
14814 	 * If we have joined allmulti on this one, find a new member
14815 	 * in the group to join allmulti. As this ill is already part
14816 	 * of allmulti, we don't have to join on this one.
14817 	 *
14818 	 * If we have not joined allmulti on this one, there is no
14819 	 * responsibility to handoff. But we need to take new
14820 	 * responsibility i.e, join allmulti on this one if we need
14821 	 * to.
14822 	 */
14823 	if (ill->ill_join_allmulti) {
14824 		(void) ill_nominate_mcast_rcv(illgrp);
14825 	} else {
14826 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
14827 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
14828 				(void) ip_join_allmulti(ill->ill_ipif);
14829 				break;
14830 			}
14831 		}
14832 	}
14833 
14834 	/*
14835 	 * We intentionally do the flushing of IRE_CACHES only matching
14836 	 * on the ill and not on groups. Note that we are already deleted
14837 	 * from the group.
14838 	 *
14839 	 * This will make sure that all IRE_CACHES whose stq is pointing
14840 	 * at ill_wq or ire_ipif->ipif_ill pointing at this ill will get
14841 	 * deleted and IRE_CACHES that are not pointing at this ill will
14842 	 * be left alone.
14843 	 */
14844 	if (ill->ill_isv6) {
14845 		ire_walk_ill_v6(MATCH_IRE_ILL | MATCH_IRE_TYPE,
14846 		    IRE_CACHE, illgrp_cache_delete, (char *)ill, ill);
14847 	} else {
14848 		ire_walk_ill_v4(MATCH_IRE_ILL | MATCH_IRE_TYPE,
14849 		    IRE_CACHE, illgrp_cache_delete, (char *)ill, ill);
14850 	}
14851 
14852 	/*
14853 	 * Some conn may have cached one of the IREs deleted above. By removing
14854 	 * the ire reference, we clean up the extra reference to the ill held in
14855 	 * ire->ire_stq.
14856 	 */
14857 	ipcl_walk(conn_cleanup_stale_ire, NULL);
14858 
14859 	/*
14860 	 * Re-do source address selection for all the members in the
14861 	 * group, if they borrowed source address from one of the ipifs
14862 	 * in this ill.
14863 	 */
14864 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
14865 		if (ill->ill_isv6) {
14866 			ipif_update_other_ipifs_v6(ipif, illgrp);
14867 		} else {
14868 			ipif_update_other_ipifs(ipif, illgrp);
14869 		}
14870 	}
14871 }
14872 
14873 /*
14874  * Delete the ill from the group. The caller makes sure that it is
14875  * in a group and it okay to delete from the group. So, we always
14876  * delete here.
14877  */
14878 static void
14879 illgrp_delete(ill_t *ill)
14880 {
14881 	ill_group_t *illgrp;
14882 	ill_group_t *tmpg;
14883 	ill_t *tmp_ill;
14884 
14885 	/*
14886 	 * Reset illgrp_ill_schednext if it was pointing at us.
14887 	 * We need to do this before we set ill_group to NULL.
14888 	 */
14889 	rw_enter(&ill_g_lock, RW_WRITER);
14890 	mutex_enter(&ill->ill_lock);
14891 
14892 	illgrp_reset_schednext(ill);
14893 
14894 	illgrp = ill->ill_group;
14895 
14896 	/* Delete the ill from illgrp. */
14897 	if (illgrp->illgrp_ill == ill) {
14898 		illgrp->illgrp_ill = ill->ill_group_next;
14899 	} else {
14900 		tmp_ill = illgrp->illgrp_ill;
14901 		while (tmp_ill->ill_group_next != ill) {
14902 			tmp_ill = tmp_ill->ill_group_next;
14903 			ASSERT(tmp_ill != NULL);
14904 		}
14905 		tmp_ill->ill_group_next = ill->ill_group_next;
14906 	}
14907 	ill->ill_group = NULL;
14908 	ill->ill_group_next = NULL;
14909 
14910 	illgrp->illgrp_ill_count--;
14911 	mutex_exit(&ill->ill_lock);
14912 	rw_exit(&ill_g_lock);
14913 
14914 	/*
14915 	 * As this ill is leaving the group, we need to hand off
14916 	 * the responsibilities to the other ills in the group, if
14917 	 * this ill had some responsibilities.
14918 	 */
14919 
14920 	ill_handoff_responsibility(ill, illgrp);
14921 
14922 	rw_enter(&ill_g_lock, RW_WRITER);
14923 
14924 	if (illgrp->illgrp_ill_count == 0) {
14925 
14926 		ASSERT(illgrp->illgrp_ill == NULL);
14927 		if (ill->ill_isv6) {
14928 			if (illgrp == illgrp_head_v6) {
14929 				illgrp_head_v6 = illgrp->illgrp_next;
14930 			} else {
14931 				tmpg = illgrp_head_v6;
14932 				while (tmpg->illgrp_next != illgrp) {
14933 					tmpg = tmpg->illgrp_next;
14934 					ASSERT(tmpg != NULL);
14935 				}
14936 				tmpg->illgrp_next = illgrp->illgrp_next;
14937 			}
14938 		} else {
14939 			if (illgrp == illgrp_head_v4) {
14940 				illgrp_head_v4 = illgrp->illgrp_next;
14941 			} else {
14942 				tmpg = illgrp_head_v4;
14943 				while (tmpg->illgrp_next != illgrp) {
14944 					tmpg = tmpg->illgrp_next;
14945 					ASSERT(tmpg != NULL);
14946 				}
14947 				tmpg->illgrp_next = illgrp->illgrp_next;
14948 			}
14949 		}
14950 		mutex_destroy(&illgrp->illgrp_lock);
14951 		mi_free(illgrp);
14952 	}
14953 	rw_exit(&ill_g_lock);
14954 
14955 	/*
14956 	 * Even though the ill is out of the group its not necessary
14957 	 * to set ipsq_split as TRUE as the ipifs could be down temporarily
14958 	 * We will split the ipsq when phyint_groupname is set to NULL.
14959 	 */
14960 
14961 	/*
14962 	 * Send a routing sockets message if we are deleting from
14963 	 * groups with names.
14964 	 */
14965 	if (ill->ill_phyint->phyint_groupname_len != 0)
14966 		ip_rts_ifmsg(ill->ill_ipif);
14967 }
14968 
14969 /*
14970  * Re-do source address selection. This is normally called when
14971  * an ill joins the group or when a non-NOLOCAL/DEPRECATED/ANYCAST
14972  * ipif comes up.
14973  */
14974 void
14975 ill_update_source_selection(ill_t *ill)
14976 {
14977 	ipif_t *ipif;
14978 
14979 	ASSERT(IAM_WRITER_ILL(ill));
14980 
14981 	if (ill->ill_group != NULL)
14982 		ill = ill->ill_group->illgrp_ill;
14983 
14984 	for (; ill != NULL; ill = ill->ill_group_next) {
14985 		for (ipif = ill->ill_ipif; ipif != NULL;
14986 		    ipif = ipif->ipif_next) {
14987 			if (ill->ill_isv6)
14988 				ipif_recreate_interface_routes_v6(NULL, ipif);
14989 			else
14990 				ipif_recreate_interface_routes(NULL, ipif);
14991 		}
14992 	}
14993 }
14994 
14995 /*
14996  * Insert ill in a group headed by illgrp_head. The caller can either
14997  * pass a groupname in which case we search for a group with the
14998  * same name to insert in or pass a group to insert in. This function
14999  * would only search groups with names.
15000  *
15001  * NOTE : The caller should make sure that there is at least one ipif
15002  *	  UP on this ill so that illgrp_scheduler can pick this ill
15003  *	  for outbound packets. If ill_ipif_up_count is zero, we have
15004  *	  already sent a DL_UNBIND to the driver and we don't want to
15005  *	  send anymore packets. We don't assert for ipif_up_count
15006  *	  to be greater than zero, because ipif_up_done wants to call
15007  *	  this function before bumping up the ipif_up_count. See
15008  *	  ipif_up_done() for details.
15009  */
15010 int
15011 illgrp_insert(ill_group_t **illgrp_head, ill_t *ill, char *groupname,
15012     ill_group_t *grp_to_insert, boolean_t ipif_is_coming_up)
15013 {
15014 	ill_group_t *illgrp;
15015 	ill_t *prev_ill;
15016 	phyint_t *phyi;
15017 
15018 	ASSERT(ill->ill_group == NULL);
15019 
15020 	rw_enter(&ill_g_lock, RW_WRITER);
15021 	mutex_enter(&ill->ill_lock);
15022 
15023 	if (groupname != NULL) {
15024 		/*
15025 		 * Look for a group with a matching groupname to insert.
15026 		 */
15027 		for (illgrp = *illgrp_head; illgrp != NULL;
15028 		    illgrp = illgrp->illgrp_next) {
15029 
15030 			ill_t *tmp_ill;
15031 
15032 			/*
15033 			 * If we have an ill_group_t in the list which has
15034 			 * no ill_t assigned then we must be in the process of
15035 			 * removing this group. We skip this as illgrp_delete()
15036 			 * will remove it from the list.
15037 			 */
15038 			if ((tmp_ill = illgrp->illgrp_ill) == NULL) {
15039 				ASSERT(illgrp->illgrp_ill_count == 0);
15040 				continue;
15041 			}
15042 
15043 			ASSERT(tmp_ill->ill_phyint != NULL);
15044 			phyi = tmp_ill->ill_phyint;
15045 			/*
15046 			 * Look at groups which has names only.
15047 			 */
15048 			if (phyi->phyint_groupname_len == 0)
15049 				continue;
15050 			/*
15051 			 * Names are stored in the phyint common to both
15052 			 * IPv4 and IPv6.
15053 			 */
15054 			if (mi_strcmp(phyi->phyint_groupname,
15055 			    groupname) == 0) {
15056 				break;
15057 			}
15058 		}
15059 	} else {
15060 		/*
15061 		 * If the caller passes in a NULL "grp_to_insert", we
15062 		 * allocate one below and insert this singleton.
15063 		 */
15064 		illgrp = grp_to_insert;
15065 	}
15066 
15067 	ill->ill_group_next = NULL;
15068 
15069 	if (illgrp == NULL) {
15070 		illgrp = (ill_group_t *)mi_zalloc(sizeof (ill_group_t));
15071 		if (illgrp == NULL) {
15072 			return (ENOMEM);
15073 		}
15074 		illgrp->illgrp_next = *illgrp_head;
15075 		*illgrp_head = illgrp;
15076 		illgrp->illgrp_ill = ill;
15077 		illgrp->illgrp_ill_count = 1;
15078 		ill->ill_group = illgrp;
15079 		/*
15080 		 * Used in illgrp_scheduler to protect multiple threads
15081 		 * from traversing the list.
15082 		 */
15083 		mutex_init(&illgrp->illgrp_lock, NULL, MUTEX_DEFAULT, 0);
15084 	} else {
15085 		ASSERT(ill->ill_net_type ==
15086 		    illgrp->illgrp_ill->ill_net_type);
15087 		ASSERT(ill->ill_type == illgrp->illgrp_ill->ill_type);
15088 
15089 		/* Insert ill at tail of this group */
15090 		prev_ill = illgrp->illgrp_ill;
15091 		while (prev_ill->ill_group_next != NULL)
15092 			prev_ill = prev_ill->ill_group_next;
15093 		prev_ill->ill_group_next = ill;
15094 		ill->ill_group = illgrp;
15095 		illgrp->illgrp_ill_count++;
15096 		/*
15097 		 * Inherit group properties. Currently only forwarding
15098 		 * is the property we try to keep the same with all the
15099 		 * ills. When there are more, we will abstract this into
15100 		 * a function.
15101 		 */
15102 		ill->ill_flags &= ~ILLF_ROUTER;
15103 		ill->ill_flags |= (illgrp->illgrp_ill->ill_flags & ILLF_ROUTER);
15104 	}
15105 	mutex_exit(&ill->ill_lock);
15106 	rw_exit(&ill_g_lock);
15107 
15108 	/*
15109 	 * 1) When ipif_up_done() calls this function, ipif_up_count
15110 	 *    may be zero as it has not yet been bumped. But the ires
15111 	 *    have already been added. So, we do the nomination here
15112 	 *    itself. But, when ip_sioctl_groupname calls this, it checks
15113 	 *    for ill_ipif_up_count != 0. Thus we don't check for
15114 	 *    ill_ipif_up_count here while nominating broadcast ires for
15115 	 *    receive.
15116 	 *
15117 	 * 2) Similarly, we need to call ill_group_bcast_for_xmit here
15118 	 *    to group them properly as ire_add() has already happened
15119 	 *    in the ipif_up_done() case. For ip_sioctl_groupname/ifgrp_insert
15120 	 *    case, we need to do it here anyway.
15121 	 */
15122 	if (!ill->ill_isv6) {
15123 		ill_group_bcast_for_xmit(ill);
15124 		ill_nominate_bcast_rcv(illgrp);
15125 	}
15126 
15127 	if (!ipif_is_coming_up) {
15128 		/*
15129 		 * When ipif_up_done() calls this function, the multicast
15130 		 * groups have not been joined yet. So, there is no point in
15131 		 * nomination. ip_join_allmulti will handle groups when
15132 		 * ill_recover_multicast is called from ipif_up_done() later.
15133 		 */
15134 		(void) ill_nominate_mcast_rcv(illgrp);
15135 		/*
15136 		 * ipif_up_done calls ill_update_source_selection
15137 		 * anyway. Moreover, we don't want to re-create
15138 		 * interface routes while ipif_up_done() still has reference
15139 		 * to them. Refer to ipif_up_done() for more details.
15140 		 */
15141 		ill_update_source_selection(ill);
15142 	}
15143 
15144 	/*
15145 	 * Send a routing sockets message if we are inserting into
15146 	 * groups with names.
15147 	 */
15148 	if (groupname != NULL)
15149 		ip_rts_ifmsg(ill->ill_ipif);
15150 	return (0);
15151 }
15152 
15153 /*
15154  * Return the first phyint matching the groupname. There could
15155  * be more than one when there are ill groups.
15156  *
15157  * Needs work: called only from ip_sioctl_groupname
15158  */
15159 static phyint_t *
15160 phyint_lookup_group(char *groupname)
15161 {
15162 	phyint_t *phyi;
15163 
15164 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
15165 	/*
15166 	 * Group names are stored in the phyint - a common structure
15167 	 * to both IPv4 and IPv6.
15168 	 */
15169 	phyi = avl_first(&phyint_g_list.phyint_list_avl_by_index);
15170 	for (; phyi != NULL;
15171 	    phyi = avl_walk(&phyint_g_list.phyint_list_avl_by_index,
15172 	    phyi, AVL_AFTER)) {
15173 		if (phyi->phyint_groupname_len == 0)
15174 			continue;
15175 		ASSERT(phyi->phyint_groupname != NULL);
15176 		if (mi_strcmp(groupname, phyi->phyint_groupname) == 0)
15177 			return (phyi);
15178 	}
15179 	return (NULL);
15180 }
15181 
15182 
15183 
15184 /*
15185  * MT notes on creation and deletion of IPMP groups
15186  *
15187  * Creation and deletion of IPMP groups introduce the need to merge or
15188  * split the associated serialization objects i.e the ipsq's. Normally all
15189  * the ills in an IPMP group would map to a single ipsq. If IPMP is not enabled
15190  * an ill-pair(v4, v6) i.e. phyint would map to a single ipsq. However during
15191  * the execution of the SIOCSLIFGROUPNAME command the picture changes. There
15192  * is a need to change the <ill-ipsq> association and we have to operate on both
15193  * the source and destination IPMP groups. For eg. attempting to set the
15194  * groupname of hme0 to mpk17-85 when it already belongs to mpk17-84 has to
15195  * handle 2 IPMP groups and 2 ipsqs. All the ills belonging to either of the
15196  * source or destination IPMP group are mapped to a single ipsq for executing
15197  * the SIOCSLIFGROUPNAME command. This is termed as a merge of the ipsq's.
15198  * The <ill-ipsq> mapping is restored back to normal at a later point. This is
15199  * termed as a split of the ipsq. The converse of the merge i.e. a split of the
15200  * ipsq happens while unwinding from ipsq_exit. If at least 1 set groupname
15201  * occurred on the ipsq, then the ipsq_split flag is set. This indicates the
15202  * ipsq has to be examined for redoing the <ill-ipsq> associations.
15203  *
15204  * In the above example the ioctl handling code locates the current ipsq of hme0
15205  * which is ipsq(mpk17-84). It then enters the above ipsq immediately or
15206  * eventually (after queueing the ioctl in ipsq(mpk17-84)). Then it locates
15207  * the destination ipsq which is ipsq(mpk17-85) and merges the source ipsq into
15208  * the destination ipsq. If the destination ipsq is not busy, it also enters
15209  * the destination ipsq exclusively. Now the actual groupname setting operation
15210  * can proceed. If the destination ipsq is busy, the operation is enqueued
15211  * on the destination (merged) ipsq and will be handled in the unwind from
15212  * ipsq_exit.
15213  *
15214  * To prevent other threads accessing the ill while the group name change is
15215  * in progres, we bring down the ipifs which also removes the ill from the
15216  * group. The group is changed in phyint and when the first ipif on the ill
15217  * is brought up, the ill is inserted into the right IPMP group by
15218  * illgrp_insert.
15219  */
15220 /* ARGSUSED */
15221 int
15222 ip_sioctl_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15223     ip_ioctl_cmd_t *ipip, void *ifreq)
15224 {
15225 	int i;
15226 	char *tmp;
15227 	int namelen;
15228 	ill_t *ill = ipif->ipif_ill;
15229 	ill_t *ill_v4, *ill_v6;
15230 	int err = 0;
15231 	phyint_t *phyi;
15232 	phyint_t *phyi_tmp;
15233 	struct lifreq *lifr;
15234 	mblk_t	*mp1;
15235 	char *groupname;
15236 	ipsq_t *ipsq;
15237 
15238 	ASSERT(IAM_WRITER_IPIF(ipif));
15239 
15240 	/* Existance verified in ip_wput_nondata */
15241 	mp1 = mp->b_cont->b_cont;
15242 	lifr = (struct lifreq *)mp1->b_rptr;
15243 	groupname = lifr->lifr_groupname;
15244 
15245 	if (ipif->ipif_id != 0)
15246 		return (EINVAL);
15247 
15248 	phyi = ill->ill_phyint;
15249 	ASSERT(phyi != NULL);
15250 
15251 	if (phyi->phyint_flags & PHYI_VIRTUAL)
15252 		return (EINVAL);
15253 
15254 	tmp = groupname;
15255 	for (i = 0; i < LIFNAMSIZ && *tmp != '\0'; tmp++, i++)
15256 		;
15257 
15258 	if (i == LIFNAMSIZ) {
15259 		/* no null termination */
15260 		return (EINVAL);
15261 	}
15262 
15263 	/*
15264 	 * Calculate the namelen exclusive of the null
15265 	 * termination character.
15266 	 */
15267 	namelen = tmp - groupname;
15268 
15269 	ill_v4 = phyi->phyint_illv4;
15270 	ill_v6 = phyi->phyint_illv6;
15271 
15272 	/*
15273 	 * ILL cannot be part of a usesrc group and and IPMP group at the
15274 	 * same time. No need to grab the ill_g_usesrc_lock here, see
15275 	 * synchronization notes in ip.c
15276 	 */
15277 	if (ipif->ipif_ill->ill_usesrc_grp_next != NULL) {
15278 		return (EINVAL);
15279 	}
15280 
15281 	/*
15282 	 * mark the ill as changing.
15283 	 * this should queue all new requests on the syncq.
15284 	 */
15285 	GRAB_ILL_LOCKS(ill_v4, ill_v6);
15286 
15287 	if (ill_v4 != NULL)
15288 		ill_v4->ill_state_flags |= ILL_CHANGING;
15289 	if (ill_v6 != NULL)
15290 		ill_v6->ill_state_flags |= ILL_CHANGING;
15291 	RELEASE_ILL_LOCKS(ill_v4, ill_v6);
15292 
15293 	if (namelen == 0) {
15294 		/*
15295 		 * Null string means remove this interface from the
15296 		 * existing group.
15297 		 */
15298 		if (phyi->phyint_groupname_len == 0) {
15299 			/*
15300 			 * Never was in a group.
15301 			 */
15302 			err = 0;
15303 			goto done;
15304 		}
15305 
15306 		/*
15307 		 * IPv4 or IPv6 may be temporarily out of the group when all
15308 		 * the ipifs are down. Thus, we need to check for ill_group to
15309 		 * be non-NULL.
15310 		 */
15311 		if (ill_v4 != NULL && ill_v4->ill_group != NULL) {
15312 			ill_down_ipifs(ill_v4, mp, 0, B_FALSE);
15313 			mutex_enter(&ill_v4->ill_lock);
15314 			if (!ill_is_quiescent(ill_v4)) {
15315 				/*
15316 				 * ipsq_pending_mp_add will not fail since
15317 				 * connp is NULL
15318 				 */
15319 				(void) ipsq_pending_mp_add(NULL,
15320 				    ill_v4->ill_ipif, q, mp, ILL_DOWN);
15321 				mutex_exit(&ill_v4->ill_lock);
15322 				err = EINPROGRESS;
15323 				goto done;
15324 			}
15325 			mutex_exit(&ill_v4->ill_lock);
15326 		}
15327 
15328 		if (ill_v6 != NULL && ill_v6->ill_group != NULL) {
15329 			ill_down_ipifs(ill_v6, mp, 0, B_FALSE);
15330 			mutex_enter(&ill_v6->ill_lock);
15331 			if (!ill_is_quiescent(ill_v6)) {
15332 				(void) ipsq_pending_mp_add(NULL,
15333 				    ill_v6->ill_ipif, q, mp, ILL_DOWN);
15334 				mutex_exit(&ill_v6->ill_lock);
15335 				err = EINPROGRESS;
15336 				goto done;
15337 			}
15338 			mutex_exit(&ill_v6->ill_lock);
15339 		}
15340 
15341 		rw_enter(&ill_g_lock, RW_WRITER);
15342 		GRAB_ILL_LOCKS(ill_v4, ill_v6);
15343 		mutex_enter(&phyi->phyint_lock);
15344 		ASSERT(phyi->phyint_groupname != NULL);
15345 		mi_free(phyi->phyint_groupname);
15346 		phyi->phyint_groupname = NULL;
15347 		phyi->phyint_groupname_len = 0;
15348 		mutex_exit(&phyi->phyint_lock);
15349 		RELEASE_ILL_LOCKS(ill_v4, ill_v6);
15350 		rw_exit(&ill_g_lock);
15351 		err = ill_up_ipifs(ill, q, mp);
15352 
15353 		/*
15354 		 * set the split flag so that the ipsq can be split
15355 		 */
15356 		mutex_enter(&phyi->phyint_ipsq->ipsq_lock);
15357 		phyi->phyint_ipsq->ipsq_split = B_TRUE;
15358 		mutex_exit(&phyi->phyint_ipsq->ipsq_lock);
15359 
15360 	} else {
15361 		if (phyi->phyint_groupname_len != 0) {
15362 			ASSERT(phyi->phyint_groupname != NULL);
15363 			/* Are we inserting in the same group ? */
15364 			if (mi_strcmp(groupname,
15365 			    phyi->phyint_groupname) == 0) {
15366 				err = 0;
15367 				goto done;
15368 			}
15369 		}
15370 
15371 		rw_enter(&ill_g_lock, RW_READER);
15372 		/*
15373 		 * Merge ipsq for the group's.
15374 		 * This check is here as multiple groups/ills might be
15375 		 * sharing the same ipsq.
15376 		 * If we have to merege than the operation is restarted
15377 		 * on the new ipsq.
15378 		 */
15379 		ipsq = ip_ipsq_lookup(groupname, B_FALSE, NULL);
15380 		if (phyi->phyint_ipsq != ipsq) {
15381 			rw_exit(&ill_g_lock);
15382 			err = ill_merge_groups(ill, NULL, groupname, mp, q);
15383 			goto done;
15384 		}
15385 		/*
15386 		 * Running exclusive on new ipsq.
15387 		 */
15388 
15389 		ASSERT(ipsq != NULL);
15390 		ASSERT(ipsq->ipsq_writer == curthread);
15391 
15392 		/*
15393 		 * Check whether the ill_type and ill_net_type matches before
15394 		 * we allocate any memory so that the cleanup is easier.
15395 		 *
15396 		 * We can't group dissimilar ones as we can't load spread
15397 		 * packets across the group because of potential link-level
15398 		 * header differences.
15399 		 */
15400 		phyi_tmp = phyint_lookup_group(groupname);
15401 		if (phyi_tmp != NULL) {
15402 			if ((ill_v4 != NULL &&
15403 			    phyi_tmp->phyint_illv4 != NULL) &&
15404 			    ((ill_v4->ill_net_type !=
15405 			    phyi_tmp->phyint_illv4->ill_net_type) ||
15406 			    (ill_v4->ill_type !=
15407 			    phyi_tmp->phyint_illv4->ill_type))) {
15408 				mutex_enter(&phyi->phyint_ipsq->ipsq_lock);
15409 				phyi->phyint_ipsq->ipsq_split = B_TRUE;
15410 				mutex_exit(&phyi->phyint_ipsq->ipsq_lock);
15411 				rw_exit(&ill_g_lock);
15412 				return (EINVAL);
15413 			}
15414 			if ((ill_v6 != NULL &&
15415 			    phyi_tmp->phyint_illv6 != NULL) &&
15416 			    ((ill_v6->ill_net_type !=
15417 			    phyi_tmp->phyint_illv6->ill_net_type) ||
15418 			    (ill_v6->ill_type !=
15419 			    phyi_tmp->phyint_illv6->ill_type))) {
15420 				mutex_enter(&phyi->phyint_ipsq->ipsq_lock);
15421 				phyi->phyint_ipsq->ipsq_split = B_TRUE;
15422 				mutex_exit(&phyi->phyint_ipsq->ipsq_lock);
15423 				rw_exit(&ill_g_lock);
15424 				return (EINVAL);
15425 			}
15426 		}
15427 
15428 		rw_exit(&ill_g_lock);
15429 
15430 		/*
15431 		 * bring down all v4 ipifs.
15432 		 */
15433 		if (ill_v4 != NULL) {
15434 			ill_down_ipifs(ill_v4, mp, 0, B_FALSE);
15435 		}
15436 
15437 		/*
15438 		 * bring down all v6 ipifs.
15439 		 */
15440 		if (ill_v6 != NULL) {
15441 			ill_down_ipifs(ill_v6, mp, 0, B_FALSE);
15442 		}
15443 
15444 		/*
15445 		 * make sure all ipifs are down and there are no active
15446 		 * references. Call to ipsq_pending_mp_add will not fail
15447 		 * since connp is NULL.
15448 		 */
15449 		if (ill_v4 != NULL) {
15450 			mutex_enter(&ill_v4->ill_lock);
15451 			if (!ill_is_quiescent(ill_v4)) {
15452 				(void) ipsq_pending_mp_add(NULL,
15453 				    ill_v4->ill_ipif, q, mp, ILL_DOWN);
15454 				mutex_exit(&ill_v4->ill_lock);
15455 				err = EINPROGRESS;
15456 				goto done;
15457 			}
15458 			mutex_exit(&ill_v4->ill_lock);
15459 		}
15460 
15461 		if (ill_v6 != NULL) {
15462 			mutex_enter(&ill_v6->ill_lock);
15463 			if (!ill_is_quiescent(ill_v6)) {
15464 				(void) ipsq_pending_mp_add(NULL,
15465 				    ill_v6->ill_ipif, q, mp, ILL_DOWN);
15466 				mutex_exit(&ill_v6->ill_lock);
15467 				err = EINPROGRESS;
15468 				goto done;
15469 			}
15470 			mutex_exit(&ill_v6->ill_lock);
15471 		}
15472 
15473 		/*
15474 		 * allocate including space for null terminator
15475 		 * before we insert.
15476 		 */
15477 		tmp = (char *)mi_alloc(namelen + 1, BPRI_MED);
15478 		if (tmp == NULL)
15479 			return (ENOMEM);
15480 
15481 		rw_enter(&ill_g_lock, RW_WRITER);
15482 		GRAB_ILL_LOCKS(ill_v4, ill_v6);
15483 		mutex_enter(&phyi->phyint_lock);
15484 		if (phyi->phyint_groupname_len != 0) {
15485 			ASSERT(phyi->phyint_groupname != NULL);
15486 			mi_free(phyi->phyint_groupname);
15487 		}
15488 
15489 		/*
15490 		 * setup the new group name.
15491 		 */
15492 		phyi->phyint_groupname = tmp;
15493 		bcopy(groupname, phyi->phyint_groupname, namelen + 1);
15494 		phyi->phyint_groupname_len = namelen + 1;
15495 		mutex_exit(&phyi->phyint_lock);
15496 		RELEASE_ILL_LOCKS(ill_v4, ill_v6);
15497 		rw_exit(&ill_g_lock);
15498 
15499 		err = ill_up_ipifs(ill, q, mp);
15500 	}
15501 
15502 done:
15503 	/*
15504 	 *  normally ILL_CHANGING is cleared in ill_up_ipifs.
15505 	 */
15506 	if (err != EINPROGRESS) {
15507 		GRAB_ILL_LOCKS(ill_v4, ill_v6);
15508 		if (ill_v4 != NULL)
15509 			ill_v4->ill_state_flags &= ~ILL_CHANGING;
15510 		if (ill_v6 != NULL)
15511 			ill_v6->ill_state_flags &= ~ILL_CHANGING;
15512 		RELEASE_ILL_LOCKS(ill_v4, ill_v6);
15513 	}
15514 	return (err);
15515 }
15516 
15517 /* ARGSUSED */
15518 int
15519 ip_sioctl_get_groupname(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
15520     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15521 {
15522 	ill_t *ill;
15523 	phyint_t *phyi;
15524 	struct lifreq *lifr;
15525 	mblk_t	*mp1;
15526 
15527 	/* Existence verified in ip_wput_nondata */
15528 	mp1 = mp->b_cont->b_cont;
15529 	lifr = (struct lifreq *)mp1->b_rptr;
15530 	ill = ipif->ipif_ill;
15531 	phyi = ill->ill_phyint;
15532 
15533 	lifr->lifr_groupname[0] = '\0';
15534 	/*
15535 	 * ill_group may be null if all the interfaces
15536 	 * are down. But still, the phyint should always
15537 	 * hold the name.
15538 	 */
15539 	if (phyi->phyint_groupname_len != 0) {
15540 		bcopy(phyi->phyint_groupname, lifr->lifr_groupname,
15541 		    phyi->phyint_groupname_len);
15542 	}
15543 
15544 	return (0);
15545 }
15546 
15547 
15548 typedef struct conn_move_s {
15549 	ill_t	*cm_from_ill;
15550 	ill_t	*cm_to_ill;
15551 	int	cm_ifindex;
15552 } conn_move_t;
15553 
15554 /*
15555  * ipcl_walk function for moving conn_multicast_ill for a given ill.
15556  */
15557 static void
15558 conn_move(conn_t *connp, caddr_t arg)
15559 {
15560 	conn_move_t *connm;
15561 	int ifindex;
15562 	int i;
15563 	ill_t *from_ill;
15564 	ill_t *to_ill;
15565 	ilg_t *ilg;
15566 	ilm_t *ret_ilm;
15567 
15568 	connm = (conn_move_t *)arg;
15569 	ifindex = connm->cm_ifindex;
15570 	from_ill = connm->cm_from_ill;
15571 	to_ill = connm->cm_to_ill;
15572 
15573 	/* Change IP_BOUND_IF/IPV6_BOUND_IF associations. */
15574 
15575 	/* All multicast fields protected by conn_lock */
15576 	mutex_enter(&connp->conn_lock);
15577 	ASSERT(connp->conn_outgoing_ill == connp->conn_incoming_ill);
15578 	if ((connp->conn_outgoing_ill == from_ill) &&
15579 	    (ifindex == 0 || connp->conn_orig_bound_ifindex == ifindex)) {
15580 		connp->conn_outgoing_ill = to_ill;
15581 		connp->conn_incoming_ill = to_ill;
15582 	}
15583 
15584 	/* Change IP_MULTICAST_IF/IPV6_MULTICAST_IF associations */
15585 
15586 	if ((connp->conn_multicast_ill == from_ill) &&
15587 	    (ifindex == 0 || connp->conn_orig_multicast_ifindex == ifindex)) {
15588 		connp->conn_multicast_ill = connm->cm_to_ill;
15589 	}
15590 
15591 	/* Change IP_XMIT_IF associations */
15592 	if ((connp->conn_xmit_if_ill == from_ill) &&
15593 	    (ifindex == 0 || connp->conn_orig_xmit_ifindex == ifindex)) {
15594 		connp->conn_xmit_if_ill = to_ill;
15595 	}
15596 	/*
15597 	 * Change the ilg_ill to point to the new one. This assumes
15598 	 * ilm_move_v6 has moved the ilms to new_ill and the driver
15599 	 * has been told to receive packets on this interface.
15600 	 * ilm_move_v6 FAILBACKS all the ilms successfully always.
15601 	 * But when doing a FAILOVER, it might fail with ENOMEM and so
15602 	 * some ilms may not have moved. We check to see whether
15603 	 * the ilms have moved to to_ill. We can't check on from_ill
15604 	 * as in the process of moving, we could have split an ilm
15605 	 * in to two - which has the same orig_ifindex and v6group.
15606 	 *
15607 	 * For IPv4, ilg_ipif moves implicitly. The code below really
15608 	 * does not do anything for IPv4 as ilg_ill is NULL for IPv4.
15609 	 */
15610 	for (i = connp->conn_ilg_inuse - 1; i >= 0; i--) {
15611 		ilg = &connp->conn_ilg[i];
15612 		if ((ilg->ilg_ill == from_ill) &&
15613 		    (ifindex == 0 || ilg->ilg_orig_ifindex == ifindex)) {
15614 			/* ifindex != 0 indicates failback */
15615 			if (ifindex != 0) {
15616 				connp->conn_ilg[i].ilg_ill = to_ill;
15617 				continue;
15618 			}
15619 
15620 			ret_ilm = ilm_lookup_ill_index_v6(to_ill,
15621 			    &ilg->ilg_v6group, ilg->ilg_orig_ifindex,
15622 			    connp->conn_zoneid);
15623 
15624 			if (ret_ilm != NULL)
15625 				connp->conn_ilg[i].ilg_ill = to_ill;
15626 		}
15627 	}
15628 	mutex_exit(&connp->conn_lock);
15629 }
15630 
15631 static void
15632 conn_move_ill(ill_t *from_ill, ill_t *to_ill, int ifindex)
15633 {
15634 	conn_move_t connm;
15635 
15636 	connm.cm_from_ill = from_ill;
15637 	connm.cm_to_ill = to_ill;
15638 	connm.cm_ifindex = ifindex;
15639 
15640 	ipcl_walk(conn_move, (caddr_t)&connm);
15641 }
15642 
15643 /*
15644  * ilm has been moved from from_ill to to_ill.
15645  * Send DL_DISABMULTI_REQ to ill and DL_ENABMULTI_REQ on to_ill.
15646  * appropriately.
15647  *
15648  * NOTE : We can't reuse the code in ip_ll_addmulti/delmulti because
15649  *	  the code there de-references ipif_ill to get the ill to
15650  *	  send multicast requests. It does not work as ipif is on its
15651  *	  move and already moved when this function is called.
15652  *	  Thus, we need to use from_ill and to_ill send down multicast
15653  *	  requests.
15654  */
15655 static void
15656 ilm_send_multicast_reqs(ill_t *from_ill, ill_t *to_ill)
15657 {
15658 	ipif_t *ipif;
15659 	ilm_t *ilm;
15660 
15661 	/*
15662 	 * See whether we need to send down DL_ENABMULTI_REQ on
15663 	 * to_ill as ilm has just been added.
15664 	 */
15665 	ASSERT(IAM_WRITER_ILL(to_ill));
15666 	ASSERT(IAM_WRITER_ILL(from_ill));
15667 
15668 	ILM_WALKER_HOLD(to_ill);
15669 	for (ilm = to_ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
15670 
15671 		if (!ilm->ilm_is_new || (ilm->ilm_flags & ILM_DELETED))
15672 			continue;
15673 		/*
15674 		 * no locks held, ill/ipif cannot dissappear as long
15675 		 * as we are writer.
15676 		 */
15677 		ipif = to_ill->ill_ipif;
15678 		/*
15679 		 * No need to hold any lock as we are the writer and this
15680 		 * can only be changed by a writer.
15681 		 */
15682 		ilm->ilm_is_new = B_FALSE;
15683 
15684 		if (to_ill->ill_net_type != IRE_IF_RESOLVER ||
15685 		    ipif->ipif_flags & IPIF_POINTOPOINT) {
15686 			ip1dbg(("ilm_send_multicast_reqs: to_ill not "
15687 			    "resolver\n"));
15688 			continue;		/* Must be IRE_IF_NORESOLVER */
15689 		}
15690 
15691 
15692 		if (to_ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST) {
15693 			ip1dbg(("ilm_send_multicast_reqs: "
15694 			    "to_ill MULTI_BCAST\n"));
15695 			goto from;
15696 		}
15697 
15698 		if (to_ill->ill_isv6)
15699 			mld_joingroup(ilm);
15700 		else
15701 			igmp_joingroup(ilm);
15702 
15703 		if (to_ill->ill_ipif_up_count == 0) {
15704 			/*
15705 			 * Nobody there. All multicast addresses will be
15706 			 * re-joined when we get the DL_BIND_ACK bringing the
15707 			 * interface up.
15708 			 */
15709 			ilm->ilm_notify_driver = B_FALSE;
15710 			ip1dbg(("ilm_send_multicast_reqs: to_ill nobody up\n"));
15711 			goto from;
15712 		}
15713 
15714 		/*
15715 		 * For allmulti address, we want to join on only one interface.
15716 		 * Checking for ilm_numentries_v6 is not correct as you may
15717 		 * find an ilm with zero address on to_ill, but we may not
15718 		 * have nominated to_ill for receiving. Thus, if we have
15719 		 * nominated from_ill (ill_join_allmulti is set), nominate
15720 		 * only if to_ill is not already nominated (to_ill normally
15721 		 * should not have been nominated if "from_ill" has already
15722 		 * been nominated. As we don't prevent failovers from happening
15723 		 * across groups, we don't assert).
15724 		 */
15725 		if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
15726 			/*
15727 			 * There is no need to hold ill locks as we are
15728 			 * writer on both ills and when ill_join_allmulti
15729 			 * is changed the thread is always a writer.
15730 			 */
15731 			if (from_ill->ill_join_allmulti &&
15732 			    !to_ill->ill_join_allmulti) {
15733 				(void) ip_join_allmulti(to_ill->ill_ipif);
15734 			}
15735 		} else if (ilm->ilm_notify_driver) {
15736 
15737 			/*
15738 			 * This is a newly moved ilm so we need to tell the
15739 			 * driver about the new group. There can be more than
15740 			 * one ilm's for the same group in the list each with a
15741 			 * different orig_ifindex. We have to inform the driver
15742 			 * once. In ilm_move_v[4,6] we only set the flag
15743 			 * ilm_notify_driver for the first ilm.
15744 			 */
15745 
15746 			(void) ip_ll_send_enabmulti_req(to_ill,
15747 			    &ilm->ilm_v6addr);
15748 		}
15749 
15750 		ilm->ilm_notify_driver = B_FALSE;
15751 
15752 		/*
15753 		 * See whether we need to send down DL_DISABMULTI_REQ on
15754 		 * from_ill as ilm has just been removed.
15755 		 */
15756 from:
15757 		ipif = from_ill->ill_ipif;
15758 		if (from_ill->ill_net_type != IRE_IF_RESOLVER ||
15759 		    ipif->ipif_flags & IPIF_POINTOPOINT) {
15760 			ip1dbg(("ilm_send_multicast_reqs: "
15761 			    "from_ill not resolver\n"));
15762 			continue;		/* Must be IRE_IF_NORESOLVER */
15763 		}
15764 
15765 		if (from_ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST) {
15766 			ip1dbg(("ilm_send_multicast_reqs: "
15767 			    "from_ill MULTI_BCAST\n"));
15768 			continue;
15769 		}
15770 
15771 		if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
15772 			if (from_ill->ill_join_allmulti)
15773 			    (void) ip_leave_allmulti(from_ill->ill_ipif);
15774 		} else if (ilm_numentries_v6(from_ill, &ilm->ilm_v6addr) == 0) {
15775 			(void) ip_ll_send_disabmulti_req(from_ill,
15776 		    &ilm->ilm_v6addr);
15777 		}
15778 	}
15779 	ILM_WALKER_RELE(to_ill);
15780 }
15781 
15782 /*
15783  * This function is called when all multicast memberships needs
15784  * to be moved from "from_ill" to "to_ill" for IPv6. This function is
15785  * called only once unlike the IPv4 counterpart where it is called after
15786  * every logical interface is moved. The reason is due to multicast
15787  * memberships are joined using an interface address in IPv4 while in
15788  * IPv6, interface index is used.
15789  */
15790 static void
15791 ilm_move_v6(ill_t *from_ill, ill_t *to_ill, int ifindex)
15792 {
15793 	ilm_t	*ilm;
15794 	ilm_t	*ilm_next;
15795 	ilm_t	*new_ilm;
15796 	ilm_t	**ilmp;
15797 	int	count;
15798 	char buf[INET6_ADDRSTRLEN];
15799 	in6_addr_t ipv6_snm = ipv6_solicited_node_mcast;
15800 
15801 	ASSERT(MUTEX_HELD(&to_ill->ill_lock));
15802 	ASSERT(MUTEX_HELD(&from_ill->ill_lock));
15803 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
15804 
15805 	if (ifindex == 0) {
15806 		/*
15807 		 * Form the solicited node mcast address which is used later.
15808 		 */
15809 		ipif_t *ipif;
15810 
15811 		ipif = from_ill->ill_ipif;
15812 		ASSERT(ipif->ipif_id == 0);
15813 
15814 		ipv6_snm.s6_addr32[3] |= ipif->ipif_v6lcl_addr.s6_addr32[3];
15815 	}
15816 
15817 	ilmp = &from_ill->ill_ilm;
15818 	for (ilm = from_ill->ill_ilm; ilm != NULL; ilm = ilm_next) {
15819 		ilm_next = ilm->ilm_next;
15820 
15821 		if (ilm->ilm_flags & ILM_DELETED) {
15822 			ilmp = &ilm->ilm_next;
15823 			continue;
15824 		}
15825 
15826 		new_ilm = ilm_lookup_ill_index_v6(to_ill, &ilm->ilm_v6addr,
15827 		    ilm->ilm_orig_ifindex, ilm->ilm_zoneid);
15828 		ASSERT(ilm->ilm_orig_ifindex != 0);
15829 		if (ilm->ilm_orig_ifindex == ifindex) {
15830 			/*
15831 			 * We are failing back multicast memberships.
15832 			 * If the same ilm exists in to_ill, it means somebody
15833 			 * has joined the same group there e.g. ff02::1
15834 			 * is joined within the kernel when the interfaces
15835 			 * came UP.
15836 			 */
15837 			ASSERT(ilm->ilm_ipif == NULL);
15838 			if (new_ilm != NULL) {
15839 				new_ilm->ilm_refcnt += ilm->ilm_refcnt;
15840 				if (new_ilm->ilm_fmode != MODE_IS_EXCLUDE ||
15841 				    !SLIST_IS_EMPTY(new_ilm->ilm_filter)) {
15842 					new_ilm->ilm_is_new = B_TRUE;
15843 				}
15844 			} else {
15845 				/*
15846 				 * check if we can just move the ilm
15847 				 */
15848 				if (from_ill->ill_ilm_walker_cnt != 0) {
15849 					/*
15850 					 * We have walkers we cannot move
15851 					 * the ilm, so allocate a new ilm,
15852 					 * this (old) ilm will be marked
15853 					 * ILM_DELETED at the end of the loop
15854 					 * and will be freed when the
15855 					 * last walker exits.
15856 					 */
15857 					new_ilm = (ilm_t *)mi_zalloc
15858 					    (sizeof (ilm_t));
15859 					if (new_ilm == NULL) {
15860 						ip0dbg(("ilm_move_v6: "
15861 						    "FAILBACK of IPv6"
15862 						    " multicast address %s : "
15863 						    "from %s to"
15864 						    " %s failed : ENOMEM \n",
15865 						    inet_ntop(AF_INET6,
15866 						    &ilm->ilm_v6addr, buf,
15867 						    sizeof (buf)),
15868 						    from_ill->ill_name,
15869 						    to_ill->ill_name));
15870 
15871 							ilmp = &ilm->ilm_next;
15872 							continue;
15873 					}
15874 					*new_ilm = *ilm;
15875 					/*
15876 					 * we don't want new_ilm linked to
15877 					 * ilm's filter list.
15878 					 */
15879 					new_ilm->ilm_filter = NULL;
15880 				} else {
15881 					/*
15882 					 * No walkers we can move the ilm.
15883 					 * lets take it out of the list.
15884 					 */
15885 					*ilmp = ilm->ilm_next;
15886 					ilm->ilm_next = NULL;
15887 					new_ilm = ilm;
15888 				}
15889 
15890 				/*
15891 				 * if this is the first ilm for the group
15892 				 * set ilm_notify_driver so that we notify the
15893 				 * driver in ilm_send_multicast_reqs.
15894 				 */
15895 				if (ilm_lookup_ill_v6(to_ill,
15896 				    &new_ilm->ilm_v6addr, ALL_ZONES) == NULL)
15897 					new_ilm->ilm_notify_driver = B_TRUE;
15898 
15899 				new_ilm->ilm_ill = to_ill;
15900 				/* Add to the to_ill's list */
15901 				new_ilm->ilm_next = to_ill->ill_ilm;
15902 				to_ill->ill_ilm = new_ilm;
15903 				/*
15904 				 * set the flag so that mld_joingroup is
15905 				 * called in ilm_send_multicast_reqs().
15906 				 */
15907 				new_ilm->ilm_is_new = B_TRUE;
15908 			}
15909 			goto bottom;
15910 		} else if (ifindex != 0) {
15911 			/*
15912 			 * If this is FAILBACK (ifindex != 0) and the ifindex
15913 			 * has not matched above, look at the next ilm.
15914 			 */
15915 			ilmp = &ilm->ilm_next;
15916 			continue;
15917 		}
15918 		/*
15919 		 * If we are here, it means ifindex is 0. Failover
15920 		 * everything.
15921 		 *
15922 		 * We need to handle solicited node mcast address
15923 		 * and all_nodes mcast address differently as they
15924 		 * are joined witin the kenrel (ipif_multicast_up)
15925 		 * and potentially from the userland. We are called
15926 		 * after the ipifs of from_ill has been moved.
15927 		 * If we still find ilms on ill with solicited node
15928 		 * mcast address or all_nodes mcast address, it must
15929 		 * belong to the UP interface that has not moved e.g.
15930 		 * ipif_id 0 with the link local prefix does not move.
15931 		 * We join this on the new ill accounting for all the
15932 		 * userland memberships so that applications don't
15933 		 * see any failure.
15934 		 *
15935 		 * We need to make sure that we account only for the
15936 		 * solicited node and all node multicast addresses
15937 		 * that was brought UP on these. In the case of
15938 		 * a failover from A to B, we might have ilms belonging
15939 		 * to A (ilm_orig_ifindex pointing at A) on B accounting
15940 		 * for the membership from the userland. If we are failing
15941 		 * over from B to C now, we will find the ones belonging
15942 		 * to A on B. These don't account for the ill_ipif_up_count.
15943 		 * They just move from B to C. The check below on
15944 		 * ilm_orig_ifindex ensures that.
15945 		 */
15946 		if ((ilm->ilm_orig_ifindex ==
15947 		    from_ill->ill_phyint->phyint_ifindex) &&
15948 		    (IN6_ARE_ADDR_EQUAL(&ipv6_snm, &ilm->ilm_v6addr) ||
15949 		    IN6_ARE_ADDR_EQUAL(&ipv6_all_hosts_mcast,
15950 		    &ilm->ilm_v6addr))) {
15951 			ASSERT(ilm->ilm_refcnt > 0);
15952 			count = ilm->ilm_refcnt - from_ill->ill_ipif_up_count;
15953 			/*
15954 			 * For indentation reasons, we are not using a
15955 			 * "else" here.
15956 			 */
15957 			if (count == 0) {
15958 				ilmp = &ilm->ilm_next;
15959 				continue;
15960 			}
15961 			ilm->ilm_refcnt -= count;
15962 			if (new_ilm != NULL) {
15963 				/*
15964 				 * Can find one with the same
15965 				 * ilm_orig_ifindex, if we are failing
15966 				 * over to a STANDBY. This happens
15967 				 * when somebody wants to join a group
15968 				 * on a STANDBY interface and we
15969 				 * internally join on a different one.
15970 				 * If we had joined on from_ill then, a
15971 				 * failover now will find a new ilm
15972 				 * with this index.
15973 				 */
15974 				ip1dbg(("ilm_move_v6: FAILOVER, found"
15975 				    " new ilm on %s, group address %s\n",
15976 				    to_ill->ill_name,
15977 				    inet_ntop(AF_INET6,
15978 				    &ilm->ilm_v6addr, buf,
15979 				    sizeof (buf))));
15980 				new_ilm->ilm_refcnt += count;
15981 				if (new_ilm->ilm_fmode != MODE_IS_EXCLUDE ||
15982 				    !SLIST_IS_EMPTY(new_ilm->ilm_filter)) {
15983 					new_ilm->ilm_is_new = B_TRUE;
15984 				}
15985 			} else {
15986 				new_ilm = (ilm_t *)mi_zalloc(sizeof (ilm_t));
15987 				if (new_ilm == NULL) {
15988 					ip0dbg(("ilm_move_v6: FAILOVER of IPv6"
15989 					    " multicast address %s : from %s to"
15990 					    " %s failed : ENOMEM \n",
15991 					    inet_ntop(AF_INET6,
15992 					    &ilm->ilm_v6addr, buf,
15993 					    sizeof (buf)), from_ill->ill_name,
15994 					    to_ill->ill_name));
15995 					ilmp = &ilm->ilm_next;
15996 					continue;
15997 				}
15998 				*new_ilm = *ilm;
15999 				new_ilm->ilm_filter = NULL;
16000 				new_ilm->ilm_refcnt = count;
16001 				new_ilm->ilm_timer = INFINITY;
16002 				new_ilm->ilm_rtx.rtx_timer = INFINITY;
16003 				new_ilm->ilm_is_new = B_TRUE;
16004 				/*
16005 				 * If the to_ill has not joined this
16006 				 * group we need to tell the driver in
16007 				 * ill_send_multicast_reqs.
16008 				 */
16009 				if (ilm_lookup_ill_v6(to_ill,
16010 				    &new_ilm->ilm_v6addr, ALL_ZONES) == NULL)
16011 					new_ilm->ilm_notify_driver = B_TRUE;
16012 
16013 				new_ilm->ilm_ill = to_ill;
16014 				/* Add to the to_ill's list */
16015 				new_ilm->ilm_next = to_ill->ill_ilm;
16016 				to_ill->ill_ilm = new_ilm;
16017 				ASSERT(new_ilm->ilm_ipif == NULL);
16018 			}
16019 			if (ilm->ilm_refcnt == 0) {
16020 				goto bottom;
16021 			} else {
16022 				new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
16023 				CLEAR_SLIST(new_ilm->ilm_filter);
16024 				ilmp = &ilm->ilm_next;
16025 			}
16026 			continue;
16027 		} else {
16028 			/*
16029 			 * ifindex = 0 means, move everything pointing at
16030 			 * from_ill. We are doing this becuase ill has
16031 			 * either FAILED or became INACTIVE.
16032 			 *
16033 			 * As we would like to move things later back to
16034 			 * from_ill, we want to retain the identity of this
16035 			 * ilm. Thus, we don't blindly increment the reference
16036 			 * count on the ilms matching the address alone. We
16037 			 * need to match on the ilm_orig_index also. new_ilm
16038 			 * was obtained by matching ilm_orig_index also.
16039 			 */
16040 			if (new_ilm != NULL) {
16041 				/*
16042 				 * This is possible only if a previous restore
16043 				 * was incomplete i.e restore to
16044 				 * ilm_orig_ifindex left some ilms because
16045 				 * of some failures. Thus when we are failing
16046 				 * again, we might find our old friends there.
16047 				 */
16048 				ip1dbg(("ilm_move_v6: FAILOVER, found new ilm"
16049 				    " on %s, group address %s\n",
16050 				    to_ill->ill_name,
16051 				    inet_ntop(AF_INET6,
16052 				    &ilm->ilm_v6addr, buf,
16053 				    sizeof (buf))));
16054 				new_ilm->ilm_refcnt += ilm->ilm_refcnt;
16055 				if (new_ilm->ilm_fmode != MODE_IS_EXCLUDE ||
16056 				    !SLIST_IS_EMPTY(new_ilm->ilm_filter)) {
16057 					new_ilm->ilm_is_new = B_TRUE;
16058 				}
16059 			} else {
16060 				if (from_ill->ill_ilm_walker_cnt != 0) {
16061 					new_ilm = (ilm_t *)
16062 					    mi_zalloc(sizeof (ilm_t));
16063 					if (new_ilm == NULL) {
16064 						ip0dbg(("ilm_move_v6: "
16065 						    "FAILOVER of IPv6"
16066 						    " multicast address %s : "
16067 						    "from %s to"
16068 						    " %s failed : ENOMEM \n",
16069 						    inet_ntop(AF_INET6,
16070 						    &ilm->ilm_v6addr, buf,
16071 						    sizeof (buf)),
16072 						    from_ill->ill_name,
16073 						    to_ill->ill_name));
16074 
16075 							ilmp = &ilm->ilm_next;
16076 							continue;
16077 					}
16078 					*new_ilm = *ilm;
16079 					new_ilm->ilm_filter = NULL;
16080 				} else {
16081 					*ilmp = ilm->ilm_next;
16082 					new_ilm = ilm;
16083 				}
16084 				/*
16085 				 * If the to_ill has not joined this
16086 				 * group we need to tell the driver in
16087 				 * ill_send_multicast_reqs.
16088 				 */
16089 				if (ilm_lookup_ill_v6(to_ill,
16090 				    &new_ilm->ilm_v6addr, ALL_ZONES) == NULL)
16091 					new_ilm->ilm_notify_driver = B_TRUE;
16092 
16093 				/* Add to the to_ill's list */
16094 				new_ilm->ilm_next = to_ill->ill_ilm;
16095 				to_ill->ill_ilm = new_ilm;
16096 				ASSERT(ilm->ilm_ipif == NULL);
16097 				new_ilm->ilm_ill = to_ill;
16098 				new_ilm->ilm_is_new = B_TRUE;
16099 			}
16100 
16101 		}
16102 
16103 bottom:
16104 		/*
16105 		 * Revert multicast filter state to (EXCLUDE, NULL).
16106 		 * new_ilm->ilm_is_new should already be set if needed.
16107 		 */
16108 		new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
16109 		CLEAR_SLIST(new_ilm->ilm_filter);
16110 		/*
16111 		 * We allocated/got a new ilm, free the old one.
16112 		 */
16113 		if (new_ilm != ilm) {
16114 			if (from_ill->ill_ilm_walker_cnt == 0) {
16115 				*ilmp = ilm->ilm_next;
16116 				ilm->ilm_next = NULL;
16117 				FREE_SLIST(ilm->ilm_filter);
16118 				FREE_SLIST(ilm->ilm_pendsrcs);
16119 				FREE_SLIST(ilm->ilm_rtx.rtx_allow);
16120 				FREE_SLIST(ilm->ilm_rtx.rtx_block);
16121 				mi_free((char *)ilm);
16122 			} else {
16123 				ilm->ilm_flags |= ILM_DELETED;
16124 				from_ill->ill_ilm_cleanup_reqd = 1;
16125 				ilmp = &ilm->ilm_next;
16126 			}
16127 		}
16128 	}
16129 }
16130 
16131 /*
16132  * Move all the multicast memberships to to_ill. Called when
16133  * an ipif moves from "from_ill" to "to_ill". This function is slightly
16134  * different from IPv6 counterpart as multicast memberships are associated
16135  * with ills in IPv6. This function is called after every ipif is moved
16136  * unlike IPv6, where it is moved only once.
16137  */
16138 static void
16139 ilm_move_v4(ill_t *from_ill, ill_t *to_ill, ipif_t *ipif)
16140 {
16141 	ilm_t	*ilm;
16142 	ilm_t	*ilm_next;
16143 	ilm_t	*new_ilm;
16144 	ilm_t	**ilmp;
16145 
16146 	ASSERT(MUTEX_HELD(&to_ill->ill_lock));
16147 	ASSERT(MUTEX_HELD(&from_ill->ill_lock));
16148 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
16149 
16150 	ilmp = &from_ill->ill_ilm;
16151 	for (ilm = from_ill->ill_ilm; ilm != NULL; ilm = ilm_next) {
16152 		ilm_next = ilm->ilm_next;
16153 
16154 		if (ilm->ilm_flags & ILM_DELETED) {
16155 			ilmp = &ilm->ilm_next;
16156 			continue;
16157 		}
16158 
16159 		ASSERT(ilm->ilm_ipif != NULL);
16160 
16161 		if (ilm->ilm_ipif != ipif) {
16162 			ilmp = &ilm->ilm_next;
16163 			continue;
16164 		}
16165 
16166 		if (V4_PART_OF_V6(ilm->ilm_v6addr) ==
16167 		    htonl(INADDR_ALLHOSTS_GROUP)) {
16168 			/*
16169 			 * We joined this in ipif_multicast_up
16170 			 * and we never did an ipif_multicast_down
16171 			 * for IPv4. If nobody else from the userland
16172 			 * has reference, we free the ilm, and later
16173 			 * when this ipif comes up on the new ill,
16174 			 * we will join this again.
16175 			 */
16176 			if (--ilm->ilm_refcnt == 0)
16177 				goto delete_ilm;
16178 
16179 			new_ilm = ilm_lookup_ipif(ipif,
16180 			    V4_PART_OF_V6(ilm->ilm_v6addr));
16181 			if (new_ilm != NULL) {
16182 				new_ilm->ilm_refcnt += ilm->ilm_refcnt;
16183 				/*
16184 				 * We still need to deal with the from_ill.
16185 				 */
16186 				new_ilm->ilm_is_new = B_TRUE;
16187 				new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
16188 				CLEAR_SLIST(new_ilm->ilm_filter);
16189 				goto delete_ilm;
16190 			}
16191 			/*
16192 			 * If we could not find one e.g. ipif is
16193 			 * still down on to_ill, we add this ilm
16194 			 * on ill_new to preserve the reference
16195 			 * count.
16196 			 */
16197 		}
16198 		/*
16199 		 * When ipifs move, ilms always move with it
16200 		 * to the NEW ill. Thus we should never be
16201 		 * able to find ilm till we really move it here.
16202 		 */
16203 		ASSERT(ilm_lookup_ipif(ipif,
16204 		    V4_PART_OF_V6(ilm->ilm_v6addr)) == NULL);
16205 
16206 		if (from_ill->ill_ilm_walker_cnt != 0) {
16207 			new_ilm = (ilm_t *)mi_zalloc(sizeof (ilm_t));
16208 			if (new_ilm == NULL) {
16209 				char buf[INET6_ADDRSTRLEN];
16210 				ip0dbg(("ilm_move_v4: FAILBACK of IPv4"
16211 				    " multicast address %s : "
16212 				    "from %s to"
16213 				    " %s failed : ENOMEM \n",
16214 				    inet_ntop(AF_INET,
16215 				    &ilm->ilm_v6addr, buf,
16216 				    sizeof (buf)),
16217 				    from_ill->ill_name,
16218 				    to_ill->ill_name));
16219 
16220 				ilmp = &ilm->ilm_next;
16221 				continue;
16222 			}
16223 			*new_ilm = *ilm;
16224 			/* We don't want new_ilm linked to ilm's filter list */
16225 			new_ilm->ilm_filter = NULL;
16226 		} else {
16227 			/* Remove from the list */
16228 			*ilmp = ilm->ilm_next;
16229 			new_ilm = ilm;
16230 		}
16231 
16232 		/*
16233 		 * If we have never joined this group on the to_ill
16234 		 * make sure we tell the driver.
16235 		 */
16236 		if (ilm_lookup_ill_v6(to_ill, &new_ilm->ilm_v6addr,
16237 		    ALL_ZONES) == NULL)
16238 			new_ilm->ilm_notify_driver = B_TRUE;
16239 
16240 		/* Add to the to_ill's list */
16241 		new_ilm->ilm_next = to_ill->ill_ilm;
16242 		to_ill->ill_ilm = new_ilm;
16243 		new_ilm->ilm_is_new = B_TRUE;
16244 
16245 		/*
16246 		 * Revert multicast filter state to (EXCLUDE, NULL)
16247 		 */
16248 		new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
16249 		CLEAR_SLIST(new_ilm->ilm_filter);
16250 
16251 		/*
16252 		 * Delete only if we have allocated a new ilm.
16253 		 */
16254 		if (new_ilm != ilm) {
16255 delete_ilm:
16256 			if (from_ill->ill_ilm_walker_cnt == 0) {
16257 				/* Remove from the list */
16258 				*ilmp = ilm->ilm_next;
16259 				ilm->ilm_next = NULL;
16260 				FREE_SLIST(ilm->ilm_filter);
16261 				FREE_SLIST(ilm->ilm_pendsrcs);
16262 				FREE_SLIST(ilm->ilm_rtx.rtx_allow);
16263 				FREE_SLIST(ilm->ilm_rtx.rtx_block);
16264 				mi_free((char *)ilm);
16265 			} else {
16266 				ilm->ilm_flags |= ILM_DELETED;
16267 				from_ill->ill_ilm_cleanup_reqd = 1;
16268 				ilmp = &ilm->ilm_next;
16269 			}
16270 		}
16271 	}
16272 }
16273 
16274 static uint_t
16275 ipif_get_id(ill_t *ill, uint_t id)
16276 {
16277 	uint_t	unit;
16278 	ipif_t	*tipif;
16279 	boolean_t found = B_FALSE;
16280 
16281 	/*
16282 	 * During failback, we want to go back to the same id
16283 	 * instead of the smallest id so that the original
16284 	 * configuration is maintained. id is non-zero in that
16285 	 * case.
16286 	 */
16287 	if (id != 0) {
16288 		/*
16289 		 * While failing back, if we still have an ipif with
16290 		 * MAX_ADDRS_PER_IF, it means this will be replaced
16291 		 * as soon as we return from this function. It was
16292 		 * to set to MAX_ADDRS_PER_IF by the caller so that
16293 		 * we can choose the smallest id. Thus we return zero
16294 		 * in that case ignoring the hint.
16295 		 */
16296 		if (ill->ill_ipif->ipif_id == MAX_ADDRS_PER_IF)
16297 			return (0);
16298 		for (tipif = ill->ill_ipif; tipif != NULL;
16299 		    tipif = tipif->ipif_next) {
16300 			if (tipif->ipif_id == id) {
16301 				found = B_TRUE;
16302 				break;
16303 			}
16304 		}
16305 		/*
16306 		 * If somebody already plumbed another logical
16307 		 * with the same id, we won't be able to find it.
16308 		 */
16309 		if (!found)
16310 			return (id);
16311 	}
16312 	for (unit = 0; unit <= ip_addrs_per_if; unit++) {
16313 		found = B_FALSE;
16314 		for (tipif = ill->ill_ipif; tipif != NULL;
16315 		    tipif = tipif->ipif_next) {
16316 			if (tipif->ipif_id == unit) {
16317 				found = B_TRUE;
16318 				break;
16319 			}
16320 		}
16321 		if (!found)
16322 			break;
16323 	}
16324 	return (unit);
16325 }
16326 
16327 /* ARGSUSED */
16328 static int
16329 ipif_move(ipif_t *ipif, ill_t *to_ill, queue_t *q, mblk_t *mp,
16330     ipif_t **rep_ipif_ptr)
16331 {
16332 	ill_t	*from_ill;
16333 	ipif_t	*rep_ipif;
16334 	ipif_t	**ipifp;
16335 	uint_t	unit;
16336 	int err = 0;
16337 	ipif_t	*to_ipif;
16338 	struct iocblk	*iocp;
16339 	boolean_t failback_cmd;
16340 	boolean_t remove_ipif;
16341 	int	rc;
16342 
16343 	ASSERT(IAM_WRITER_ILL(to_ill));
16344 	ASSERT(IAM_WRITER_IPIF(ipif));
16345 
16346 	iocp = (struct iocblk *)mp->b_rptr;
16347 	failback_cmd = (iocp->ioc_cmd == SIOCLIFFAILBACK);
16348 	remove_ipif = B_FALSE;
16349 
16350 	from_ill = ipif->ipif_ill;
16351 
16352 	ASSERT(MUTEX_HELD(&to_ill->ill_lock));
16353 	ASSERT(MUTEX_HELD(&from_ill->ill_lock));
16354 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
16355 
16356 	/*
16357 	 * Don't move LINK LOCAL addresses as they are tied to
16358 	 * physical interface.
16359 	 */
16360 	if (from_ill->ill_isv6 &&
16361 	    IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6lcl_addr)) {
16362 		ipif->ipif_was_up = B_FALSE;
16363 		IPIF_UNMARK_MOVING(ipif);
16364 		return (0);
16365 	}
16366 
16367 	/*
16368 	 * We set the ipif_id to maximum so that the search for
16369 	 * ipif_id will pick the lowest number i.e 0 in the
16370 	 * following 2 cases :
16371 	 *
16372 	 * 1) We have a replacement ipif at the head of to_ill.
16373 	 *    We can't remove it yet as we can exceed ip_addrs_per_if
16374 	 *    on to_ill and hence the MOVE might fail. We want to
16375 	 *    remove it only if we could move the ipif. Thus, by
16376 	 *    setting it to the MAX value, we make the search in
16377 	 *    ipif_get_id return the zeroth id.
16378 	 *
16379 	 * 2) When DR pulls out the NIC and re-plumbs the interface,
16380 	 *    we might just have a zero address plumbed on the ipif
16381 	 *    with zero id in the case of IPv4. We remove that while
16382 	 *    doing the failback. We want to remove it only if we
16383 	 *    could move the ipif. Thus, by setting it to the MAX
16384 	 *    value, we make the search in ipif_get_id return the
16385 	 *    zeroth id.
16386 	 *
16387 	 * Both (1) and (2) are done only when when we are moving
16388 	 * an ipif (either due to failover/failback) which originally
16389 	 * belonged to this interface i.e the ipif_orig_ifindex is
16390 	 * the same as to_ill's ifindex. This is needed so that
16391 	 * FAILOVER from A -> B ( A failed) followed by FAILOVER
16392 	 * from B -> A (B is being removed from the group) and
16393 	 * FAILBACK from A -> B restores the original configuration.
16394 	 * Without the check for orig_ifindex, the second FAILOVER
16395 	 * could make the ipif belonging to B replace the A's zeroth
16396 	 * ipif and the subsequent failback re-creating the replacement
16397 	 * ipif again.
16398 	 *
16399 	 * NOTE : We created the replacement ipif when we did a
16400 	 * FAILOVER (See below). We could check for FAILBACK and
16401 	 * then look for replacement ipif to be removed. But we don't
16402 	 * want to do that because we wan't to allow the possibility
16403 	 * of a FAILOVER from A -> B (which creates the replacement ipif),
16404 	 * followed by a *FAILOVER* from B -> A instead of a FAILBACK
16405 	 * from B -> A.
16406 	 */
16407 	to_ipif = to_ill->ill_ipif;
16408 	if ((to_ill->ill_phyint->phyint_ifindex ==
16409 	    ipif->ipif_orig_ifindex) &&
16410 	    IPIF_REPL_CHECK(to_ipif, failback_cmd)) {
16411 		ASSERT(to_ipif->ipif_id == 0);
16412 		remove_ipif = B_TRUE;
16413 		to_ipif->ipif_id = MAX_ADDRS_PER_IF;
16414 	}
16415 	/*
16416 	 * Find the lowest logical unit number on the to_ill.
16417 	 * If we are failing back, try to get the original id
16418 	 * rather than the lowest one so that the original
16419 	 * configuration is maintained.
16420 	 *
16421 	 * XXX need a better scheme for this.
16422 	 */
16423 	if (failback_cmd) {
16424 		unit = ipif_get_id(to_ill, ipif->ipif_orig_ipifid);
16425 	} else {
16426 		unit = ipif_get_id(to_ill, 0);
16427 	}
16428 
16429 	/* Reset back to zero in case we fail below */
16430 	if (to_ipif->ipif_id == MAX_ADDRS_PER_IF)
16431 		to_ipif->ipif_id = 0;
16432 
16433 	if (unit == ip_addrs_per_if) {
16434 		ipif->ipif_was_up = B_FALSE;
16435 		IPIF_UNMARK_MOVING(ipif);
16436 		return (EINVAL);
16437 	}
16438 
16439 	/*
16440 	 * ipif is ready to move from "from_ill" to "to_ill".
16441 	 *
16442 	 * 1) If we are moving ipif with id zero, create a
16443 	 *    replacement ipif for this ipif on from_ill. If this fails
16444 	 *    fail the MOVE operation.
16445 	 *
16446 	 * 2) Remove the replacement ipif on to_ill if any.
16447 	 *    We could remove the replacement ipif when we are moving
16448 	 *    the ipif with id zero. But what if somebody already
16449 	 *    unplumbed it ? Thus we always remove it if it is present.
16450 	 *    We want to do it only if we are sure we are going to
16451 	 *    move the ipif to to_ill which is why there are no
16452 	 *    returns due to error till ipif is linked to to_ill.
16453 	 *    Note that the first ipif that we failback will always
16454 	 *    be zero if it is present.
16455 	 */
16456 	if (ipif->ipif_id == 0) {
16457 		ipaddr_t inaddr_any = INADDR_ANY;
16458 
16459 		rep_ipif = (ipif_t *)mi_alloc(sizeof (ipif_t), BPRI_MED);
16460 		if (rep_ipif == NULL) {
16461 			ipif->ipif_was_up = B_FALSE;
16462 			IPIF_UNMARK_MOVING(ipif);
16463 			return (ENOMEM);
16464 		}
16465 		*rep_ipif = ipif_zero;
16466 		/*
16467 		 * Before we put the ipif on the list, store the addresses
16468 		 * as mapped addresses as some of the ioctls e.g SIOCGIFADDR
16469 		 * assumes so. This logic is not any different from what
16470 		 * ipif_allocate does.
16471 		 */
16472 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16473 		    &rep_ipif->ipif_v6lcl_addr);
16474 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16475 		    &rep_ipif->ipif_v6src_addr);
16476 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16477 		    &rep_ipif->ipif_v6subnet);
16478 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16479 		    &rep_ipif->ipif_v6net_mask);
16480 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16481 		    &rep_ipif->ipif_v6brd_addr);
16482 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
16483 		    &rep_ipif->ipif_v6pp_dst_addr);
16484 		/*
16485 		 * We mark IPIF_NOFAILOVER so that this can never
16486 		 * move.
16487 		 */
16488 		rep_ipif->ipif_flags = ipif->ipif_flags | IPIF_NOFAILOVER;
16489 		rep_ipif->ipif_flags &= ~IPIF_UP;
16490 		rep_ipif->ipif_replace_zero = B_TRUE;
16491 		mutex_init(&rep_ipif->ipif_saved_ire_lock, NULL,
16492 		    MUTEX_DEFAULT, NULL);
16493 		rep_ipif->ipif_id = 0;
16494 		rep_ipif->ipif_ire_type = ipif->ipif_ire_type;
16495 		rep_ipif->ipif_ill = from_ill;
16496 		rep_ipif->ipif_orig_ifindex =
16497 		    from_ill->ill_phyint->phyint_ifindex;
16498 		/* Insert at head */
16499 		rep_ipif->ipif_next = from_ill->ill_ipif;
16500 		from_ill->ill_ipif = rep_ipif;
16501 		/*
16502 		 * We don't really care to let apps know about
16503 		 * this interface.
16504 		 */
16505 	}
16506 
16507 	if (remove_ipif) {
16508 		/*
16509 		 * We set to a max value above for this case to get
16510 		 * id zero. ASSERT that we did get one.
16511 		 */
16512 		ASSERT((to_ipif->ipif_id == 0) && (unit == 0));
16513 		rep_ipif = to_ipif;
16514 		to_ill->ill_ipif = rep_ipif->ipif_next;
16515 		rep_ipif->ipif_next = NULL;
16516 		/*
16517 		 * If some apps scanned and find this interface,
16518 		 * it is time to let them know, so that they can
16519 		 * delete it.
16520 		 */
16521 
16522 		*rep_ipif_ptr = rep_ipif;
16523 	}
16524 
16525 	/* Get it out of the ILL interface list. */
16526 	ipifp = &ipif->ipif_ill->ill_ipif;
16527 	for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
16528 		if (*ipifp == ipif) {
16529 			*ipifp = ipif->ipif_next;
16530 			break;
16531 		}
16532 	}
16533 
16534 	/* Assign the new ill */
16535 	ipif->ipif_ill = to_ill;
16536 	ipif->ipif_id = unit;
16537 	/* id has already been checked */
16538 	rc = ipif_insert(ipif, B_FALSE, B_FALSE);
16539 	ASSERT(rc == 0);
16540 	/* Let SCTP update its list */
16541 	sctp_move_ipif(ipif, from_ill, to_ill);
16542 	/*
16543 	 * Handle the failover and failback of ipif_t between
16544 	 * ill_t that have differing maximum mtu values.
16545 	 */
16546 	if (ipif->ipif_mtu > to_ill->ill_max_mtu) {
16547 		if (ipif->ipif_saved_mtu == 0) {
16548 			/*
16549 			 * As this ipif_t is moving to an ill_t
16550 			 * that has a lower ill_max_mtu, its
16551 			 * ipif_mtu needs to be saved so it can
16552 			 * be restored during failback or during
16553 			 * failover to an ill_t which has a
16554 			 * higher ill_max_mtu.
16555 			 */
16556 			ipif->ipif_saved_mtu = ipif->ipif_mtu;
16557 			ipif->ipif_mtu = to_ill->ill_max_mtu;
16558 		} else {
16559 			/*
16560 			 * The ipif_t is, once again, moving to
16561 			 * an ill_t that has a lower maximum mtu
16562 			 * value.
16563 			 */
16564 			ipif->ipif_mtu = to_ill->ill_max_mtu;
16565 		}
16566 	} else if (ipif->ipif_mtu < to_ill->ill_max_mtu &&
16567 	    ipif->ipif_saved_mtu != 0) {
16568 		/*
16569 		 * The mtu of this ipif_t had to be reduced
16570 		 * during an earlier failover; this is an
16571 		 * opportunity for it to be increased (either as
16572 		 * part of another failover or a failback).
16573 		 */
16574 		if (ipif->ipif_saved_mtu <= to_ill->ill_max_mtu) {
16575 			ipif->ipif_mtu = ipif->ipif_saved_mtu;
16576 			ipif->ipif_saved_mtu = 0;
16577 		} else {
16578 			ipif->ipif_mtu = to_ill->ill_max_mtu;
16579 		}
16580 	}
16581 
16582 	/*
16583 	 * We preserve all the other fields of the ipif including
16584 	 * ipif_saved_ire_mp. The routes that are saved here will
16585 	 * be recreated on the new interface and back on the old
16586 	 * interface when we move back.
16587 	 */
16588 	ASSERT(ipif->ipif_arp_del_mp == NULL);
16589 
16590 	return (err);
16591 }
16592 
16593 static int
16594 ipif_move_all(ill_t *from_ill, ill_t *to_ill, queue_t *q, mblk_t *mp,
16595     int ifindex, ipif_t **rep_ipif_ptr)
16596 {
16597 	ipif_t *mipif;
16598 	ipif_t *ipif_next;
16599 	int err;
16600 
16601 	/*
16602 	 * We don't really try to MOVE back things if some of the
16603 	 * operations fail. The daemon will take care of moving again
16604 	 * later on.
16605 	 */
16606 	for (mipif = from_ill->ill_ipif; mipif != NULL; mipif = ipif_next) {
16607 		ipif_next = mipif->ipif_next;
16608 		if (!(mipif->ipif_flags & IPIF_NOFAILOVER) &&
16609 		    (ifindex == 0 || ifindex == mipif->ipif_orig_ifindex)) {
16610 
16611 			err = ipif_move(mipif, to_ill, q, mp, rep_ipif_ptr);
16612 
16613 			/*
16614 			 * When the MOVE fails, it is the job of the
16615 			 * application to take care of this properly
16616 			 * i.e try again if it is ENOMEM.
16617 			 */
16618 			if (mipif->ipif_ill != from_ill) {
16619 				/*
16620 				 * ipif has moved.
16621 				 *
16622 				 * Move the multicast memberships associated
16623 				 * with this ipif to the new ill. For IPv6, we
16624 				 * do it once after all the ipifs are moved
16625 				 * (in ill_move) as they are not associated
16626 				 * with ipifs.
16627 				 *
16628 				 * We need to move the ilms as the ipif has
16629 				 * already been moved to a new ill even
16630 				 * in the case of errors. Neither
16631 				 * ilm_free(ipif) will find the ilm
16632 				 * when somebody unplumbs this ipif nor
16633 				 * ilm_delete(ilm) will be able to find the
16634 				 * ilm, if we don't move now.
16635 				 */
16636 				if (!from_ill->ill_isv6)
16637 					ilm_move_v4(from_ill, to_ill, mipif);
16638 			}
16639 
16640 			if (err != 0)
16641 				return (err);
16642 		}
16643 	}
16644 	return (0);
16645 }
16646 
16647 static int
16648 ill_move(ill_t *from_ill, ill_t *to_ill, queue_t *q, mblk_t *mp)
16649 {
16650 	int ifindex;
16651 	int err;
16652 	struct iocblk	*iocp;
16653 	ipif_t	*ipif;
16654 	ipif_t *rep_ipif_ptr = NULL;
16655 	ipif_t	*from_ipif = NULL;
16656 	boolean_t check_rep_if = B_FALSE;
16657 
16658 	iocp = (struct iocblk *)mp->b_rptr;
16659 	if (iocp->ioc_cmd == SIOCLIFFAILOVER) {
16660 		/*
16661 		 * Move everything pointing at from_ill to to_ill.
16662 		 * We acheive this by passing in 0 as ifindex.
16663 		 */
16664 		ifindex = 0;
16665 	} else {
16666 		/*
16667 		 * Move everything pointing at from_ill whose original
16668 		 * ifindex of connp, ipif, ilm points at to_ill->ill_index.
16669 		 * We acheive this by passing in ifindex rather than 0.
16670 		 * Multicast vifs, ilgs move implicitly because ipifs move.
16671 		 */
16672 		ASSERT(iocp->ioc_cmd == SIOCLIFFAILBACK);
16673 		ifindex = to_ill->ill_phyint->phyint_ifindex;
16674 	}
16675 
16676 	/*
16677 	 * Determine if there is at least one ipif that would move from
16678 	 * 'from_ill' to 'to_ill'. If so, it is possible that the replacement
16679 	 * ipif (if it exists) on the to_ill would be consumed as a result of
16680 	 * the move, in which case we need to quiesce the replacement ipif also.
16681 	 */
16682 	for (from_ipif = from_ill->ill_ipif; from_ipif != NULL;
16683 	    from_ipif = from_ipif->ipif_next) {
16684 		if (((ifindex == 0) ||
16685 		    (ifindex == from_ipif->ipif_orig_ifindex)) &&
16686 		    !(from_ipif->ipif_flags & IPIF_NOFAILOVER)) {
16687 			check_rep_if = B_TRUE;
16688 			break;
16689 		}
16690 	}
16691 
16692 
16693 	ill_down_ipifs(from_ill, mp, ifindex, B_TRUE);
16694 
16695 	GRAB_ILL_LOCKS(from_ill, to_ill);
16696 	if ((ipif = ill_quiescent_to_move(from_ill)) != NULL) {
16697 		(void) ipsq_pending_mp_add(NULL, ipif, q,
16698 		    mp, ILL_MOVE_OK);
16699 		RELEASE_ILL_LOCKS(from_ill, to_ill);
16700 		return (EINPROGRESS);
16701 	}
16702 
16703 	/* Check if the replacement ipif is quiescent to delete */
16704 	if (check_rep_if && IPIF_REPL_CHECK(to_ill->ill_ipif,
16705 	    (iocp->ioc_cmd == SIOCLIFFAILBACK))) {
16706 		to_ill->ill_ipif->ipif_state_flags |=
16707 		    IPIF_MOVING | IPIF_CHANGING;
16708 		if ((ipif = ill_quiescent_to_move(to_ill)) != NULL) {
16709 			(void) ipsq_pending_mp_add(NULL, ipif, q,
16710 			    mp, ILL_MOVE_OK);
16711 			RELEASE_ILL_LOCKS(from_ill, to_ill);
16712 			return (EINPROGRESS);
16713 		}
16714 	}
16715 	RELEASE_ILL_LOCKS(from_ill, to_ill);
16716 
16717 	ASSERT(!MUTEX_HELD(&to_ill->ill_lock));
16718 	rw_enter(&ill_g_lock, RW_WRITER);
16719 	GRAB_ILL_LOCKS(from_ill, to_ill);
16720 	err = ipif_move_all(from_ill, to_ill, q, mp, ifindex, &rep_ipif_ptr);
16721 
16722 	/* ilm_move is done inside ipif_move for IPv4 */
16723 	if (err == 0 && from_ill->ill_isv6)
16724 		ilm_move_v6(from_ill, to_ill, ifindex);
16725 
16726 	RELEASE_ILL_LOCKS(from_ill, to_ill);
16727 	rw_exit(&ill_g_lock);
16728 
16729 	/*
16730 	 * send rts messages and multicast messages.
16731 	 */
16732 	if (rep_ipif_ptr != NULL) {
16733 		ip_rts_ifmsg(rep_ipif_ptr);
16734 		ip_rts_newaddrmsg(RTM_DELETE, 0, rep_ipif_ptr);
16735 		IPIF_TRACE_CLEANUP(rep_ipif_ptr);
16736 		mi_free(rep_ipif_ptr);
16737 	}
16738 
16739 	ilm_send_multicast_reqs(from_ill, to_ill);
16740 
16741 	conn_move_ill(from_ill, to_ill, ifindex);
16742 
16743 	return (err);
16744 }
16745 
16746 /*
16747  * Used to extract arguments for FAILOVER/FAILBACK ioctls.
16748  * Also checks for the validity of the arguments.
16749  * Note: We are already exclusive inside the from group.
16750  * It is upto the caller to release refcnt on the to_ill's.
16751  */
16752 static int
16753 ip_extract_move_args(queue_t *q, mblk_t *mp, ill_t **ill_from_v4,
16754     ill_t **ill_from_v6, ill_t **ill_to_v4, ill_t **ill_to_v6)
16755 {
16756 	int dst_index;
16757 	ipif_t *ipif_v4, *ipif_v6;
16758 	struct lifreq *lifr;
16759 	mblk_t *mp1;
16760 	boolean_t exists;
16761 	sin_t	*sin;
16762 	int	err = 0;
16763 
16764 	if ((mp1 = mp->b_cont) == NULL)
16765 		return (EPROTO);
16766 
16767 	if ((mp1 = mp1->b_cont) == NULL)
16768 		return (EPROTO);
16769 
16770 	lifr = (struct lifreq *)mp1->b_rptr;
16771 	sin = (sin_t *)&lifr->lifr_addr;
16772 
16773 	/*
16774 	 * We operate on both IPv4 and IPv6. Thus, we don't allow IPv4/IPv6
16775 	 * specific operations.
16776 	 */
16777 	if (sin->sin_family != AF_UNSPEC)
16778 		return (EINVAL);
16779 
16780 	/*
16781 	 * Get ipif with id 0. We are writer on the from ill. So we can pass
16782 	 * NULLs for the last 4 args and we know the lookup won't fail
16783 	 * with EINPROGRESS.
16784 	 */
16785 	ipif_v4 = ipif_lookup_on_name(lifr->lifr_name,
16786 	    mi_strlen(lifr->lifr_name), B_FALSE, &exists, B_FALSE,
16787 	    ALL_ZONES, NULL, NULL, NULL, NULL);
16788 	ipif_v6 = ipif_lookup_on_name(lifr->lifr_name,
16789 	    mi_strlen(lifr->lifr_name), B_FALSE, &exists, B_TRUE,
16790 	    ALL_ZONES, NULL, NULL, NULL, NULL);
16791 
16792 	if (ipif_v4 == NULL && ipif_v6 == NULL)
16793 		return (ENXIO);
16794 
16795 	if (ipif_v4 != NULL) {
16796 		ASSERT(ipif_v4->ipif_refcnt != 0);
16797 		if (ipif_v4->ipif_id != 0) {
16798 			err = EINVAL;
16799 			goto done;
16800 		}
16801 
16802 		ASSERT(IAM_WRITER_IPIF(ipif_v4));
16803 		*ill_from_v4 = ipif_v4->ipif_ill;
16804 	}
16805 
16806 	if (ipif_v6 != NULL) {
16807 		ASSERT(ipif_v6->ipif_refcnt != 0);
16808 		if (ipif_v6->ipif_id != 0) {
16809 			err = EINVAL;
16810 			goto done;
16811 		}
16812 
16813 		ASSERT(IAM_WRITER_IPIF(ipif_v6));
16814 		*ill_from_v6 = ipif_v6->ipif_ill;
16815 	}
16816 
16817 	err = 0;
16818 	dst_index = lifr->lifr_movetoindex;
16819 	*ill_to_v4 = ill_lookup_on_ifindex(dst_index, B_FALSE,
16820 	    q, mp, ip_process_ioctl, &err);
16821 	if (err != 0) {
16822 		/*
16823 		 * There could be only v6.
16824 		 */
16825 		if (err != ENXIO)
16826 			goto done;
16827 		err = 0;
16828 	}
16829 
16830 	*ill_to_v6 = ill_lookup_on_ifindex(dst_index, B_TRUE,
16831 	    q, mp, ip_process_ioctl, &err);
16832 	if (err != 0) {
16833 		if (err != ENXIO)
16834 			goto done;
16835 		if (*ill_to_v4 == NULL) {
16836 			err = ENXIO;
16837 			goto done;
16838 		}
16839 		err = 0;
16840 	}
16841 
16842 	/*
16843 	 * If we have something to MOVE i.e "from" not NULL,
16844 	 * "to" should be non-NULL.
16845 	 */
16846 	if ((*ill_from_v4 != NULL && *ill_to_v4 == NULL) ||
16847 	    (*ill_from_v6 != NULL && *ill_to_v6 == NULL)) {
16848 		err = EINVAL;
16849 	}
16850 
16851 done:
16852 	if (ipif_v4 != NULL)
16853 		ipif_refrele(ipif_v4);
16854 	if (ipif_v6 != NULL)
16855 		ipif_refrele(ipif_v6);
16856 	return (err);
16857 }
16858 
16859 /*
16860  * FAILOVER and FAILBACK are modelled as MOVE operations.
16861  *
16862  * We don't check whether the MOVE is within the same group or
16863  * not, because this ioctl can be used as a generic mechanism
16864  * to failover from interface A to B, though things will function
16865  * only if they are really part of the same group. Moreover,
16866  * all ipifs may be down and hence temporarily out of the group.
16867  *
16868  * ipif's that need to be moved are first brought down; V4 ipifs are brought
16869  * down first and then V6.  For each we wait for the ipif's to become quiescent.
16870  * Bringing down the ipifs ensures that all ires pointing to these ipifs's
16871  * have been deleted and there are no active references. Once quiescent the
16872  * ipif's are moved and brought up on the new ill.
16873  *
16874  * Normally the source ill and destination ill belong to the same IPMP group
16875  * and hence the same ipsq_t. In the event they don't belong to the same
16876  * same group the two ipsq's are first merged into one ipsq - that of the
16877  * to_ill. The multicast memberships on the source and destination ill cannot
16878  * change during the move operation since multicast joins/leaves also have to
16879  * execute on the same ipsq and are hence serialized.
16880  */
16881 /* ARGSUSED */
16882 int
16883 ip_sioctl_move(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16884     ip_ioctl_cmd_t *ipip, void *ifreq)
16885 {
16886 	ill_t *ill_to_v4 = NULL;
16887 	ill_t *ill_to_v6 = NULL;
16888 	ill_t *ill_from_v4 = NULL;
16889 	ill_t *ill_from_v6 = NULL;
16890 	int err = 0;
16891 
16892 	/*
16893 	 * setup from and to ill's, we can get EINPROGRESS only for
16894 	 * to_ill's.
16895 	 */
16896 	err = ip_extract_move_args(q, mp, &ill_from_v4, &ill_from_v6,
16897 	    &ill_to_v4, &ill_to_v6);
16898 
16899 	if (err != 0) {
16900 		ip0dbg(("ip_sioctl_move: extract args failed\n"));
16901 		goto done;
16902 	}
16903 
16904 	/*
16905 	 * nothing to do.
16906 	 */
16907 	if ((ill_from_v4 != NULL) && (ill_from_v4 == ill_to_v4)) {
16908 		goto done;
16909 	}
16910 
16911 	/*
16912 	 * nothing to do.
16913 	 */
16914 	if ((ill_from_v6 != NULL) && (ill_from_v6 == ill_to_v6)) {
16915 		goto done;
16916 	}
16917 
16918 	/*
16919 	 * Mark the ill as changing.
16920 	 * ILL_CHANGING flag is cleared when the ipif's are brought up
16921 	 * in ill_up_ipifs in case of error they are cleared below.
16922 	 */
16923 
16924 	GRAB_ILL_LOCKS(ill_from_v4, ill_from_v6);
16925 	if (ill_from_v4 != NULL)
16926 		ill_from_v4->ill_state_flags |= ILL_CHANGING;
16927 	if (ill_from_v6 != NULL)
16928 		ill_from_v6->ill_state_flags |= ILL_CHANGING;
16929 	RELEASE_ILL_LOCKS(ill_from_v4, ill_from_v6);
16930 
16931 	/*
16932 	 * Make sure that both src and dst are
16933 	 * in the same syncq group. If not make it happen.
16934 	 * We are not holding any locks because we are the writer
16935 	 * on the from_ipsq and we will hold locks in ill_merge_groups
16936 	 * to protect to_ipsq against changing.
16937 	 */
16938 	if (ill_from_v4 != NULL) {
16939 		if (ill_from_v4->ill_phyint->phyint_ipsq !=
16940 		    ill_to_v4->ill_phyint->phyint_ipsq) {
16941 			err = ill_merge_groups(ill_from_v4, ill_to_v4,
16942 			    NULL, mp, q);
16943 			goto err_ret;
16944 
16945 		}
16946 		ASSERT(!MUTEX_HELD(&ill_to_v4->ill_lock));
16947 	} else {
16948 
16949 		if (ill_from_v6->ill_phyint->phyint_ipsq !=
16950 		    ill_to_v6->ill_phyint->phyint_ipsq) {
16951 			err = ill_merge_groups(ill_from_v6, ill_to_v6,
16952 			    NULL, mp, q);
16953 			goto err_ret;
16954 
16955 		}
16956 		ASSERT(!MUTEX_HELD(&ill_to_v6->ill_lock));
16957 	}
16958 
16959 	/*
16960 	 * Now that the ipsq's have been merged and we are the writer
16961 	 * lets mark to_ill as changing as well.
16962 	 */
16963 
16964 	GRAB_ILL_LOCKS(ill_to_v4, ill_to_v6);
16965 	if (ill_to_v4 != NULL)
16966 		ill_to_v4->ill_state_flags |= ILL_CHANGING;
16967 	if (ill_to_v6 != NULL)
16968 		ill_to_v6->ill_state_flags |= ILL_CHANGING;
16969 	RELEASE_ILL_LOCKS(ill_to_v4, ill_to_v6);
16970 
16971 	/*
16972 	 * Its ok for us to proceed with the move even if
16973 	 * ill_pending_mp is non null on one of the from ill's as the reply
16974 	 * should not be looking at the ipif, it should only care about the
16975 	 * ill itself.
16976 	 */
16977 
16978 	/*
16979 	 * lets move ipv4 first.
16980 	 */
16981 	if (ill_from_v4 != NULL) {
16982 		ASSERT(IAM_WRITER_ILL(ill_to_v4));
16983 		ill_from_v4->ill_move_in_progress = B_TRUE;
16984 		ill_to_v4->ill_move_in_progress = B_TRUE;
16985 		ill_to_v4->ill_move_peer = ill_from_v4;
16986 		ill_from_v4->ill_move_peer = ill_to_v4;
16987 		err = ill_move(ill_from_v4, ill_to_v4, q, mp);
16988 	}
16989 
16990 	/*
16991 	 * Now lets move ipv6.
16992 	 */
16993 	if (err == 0 && ill_from_v6 != NULL) {
16994 		ASSERT(IAM_WRITER_ILL(ill_to_v6));
16995 		ill_from_v6->ill_move_in_progress = B_TRUE;
16996 		ill_to_v6->ill_move_in_progress = B_TRUE;
16997 		ill_to_v6->ill_move_peer = ill_from_v6;
16998 		ill_from_v6->ill_move_peer = ill_to_v6;
16999 		err = ill_move(ill_from_v6, ill_to_v6, q, mp);
17000 	}
17001 
17002 err_ret:
17003 	/*
17004 	 * EINPROGRESS means we are waiting for the ipif's that need to be
17005 	 * moved to become quiescent.
17006 	 */
17007 	if (err == EINPROGRESS) {
17008 		goto done;
17009 	}
17010 
17011 	/*
17012 	 * if err is set ill_up_ipifs will not be called
17013 	 * lets clear the flags.
17014 	 */
17015 
17016 	GRAB_ILL_LOCKS(ill_to_v4, ill_to_v6);
17017 	GRAB_ILL_LOCKS(ill_from_v4, ill_from_v6);
17018 	/*
17019 	 * Some of the clearing may be redundant. But it is simple
17020 	 * not making any extra checks.
17021 	 */
17022 	if (ill_from_v6 != NULL) {
17023 		ill_from_v6->ill_move_in_progress = B_FALSE;
17024 		ill_from_v6->ill_move_peer = NULL;
17025 		ill_from_v6->ill_state_flags &= ~ILL_CHANGING;
17026 	}
17027 	if (ill_from_v4 != NULL) {
17028 		ill_from_v4->ill_move_in_progress = B_FALSE;
17029 		ill_from_v4->ill_move_peer = NULL;
17030 		ill_from_v4->ill_state_flags &= ~ILL_CHANGING;
17031 	}
17032 	if (ill_to_v6 != NULL) {
17033 		ill_to_v6->ill_move_in_progress = B_FALSE;
17034 		ill_to_v6->ill_move_peer = NULL;
17035 		ill_to_v6->ill_state_flags &= ~ILL_CHANGING;
17036 	}
17037 	if (ill_to_v4 != NULL) {
17038 		ill_to_v4->ill_move_in_progress = B_FALSE;
17039 		ill_to_v4->ill_move_peer = NULL;
17040 		ill_to_v4->ill_state_flags &= ~ILL_CHANGING;
17041 	}
17042 
17043 	/*
17044 	 * Check for setting INACTIVE, if STANDBY is set and FAILED is not set.
17045 	 * Do this always to maintain proper state i.e even in case of errors.
17046 	 * As phyint_inactive looks at both v4 and v6 interfaces,
17047 	 * we need not call on both v4 and v6 interfaces.
17048 	 */
17049 	if (ill_from_v4 != NULL) {
17050 		if ((ill_from_v4->ill_phyint->phyint_flags &
17051 		    (PHYI_STANDBY | PHYI_FAILED)) == PHYI_STANDBY) {
17052 			phyint_inactive(ill_from_v4->ill_phyint);
17053 		}
17054 	} else if (ill_from_v6 != NULL) {
17055 		if ((ill_from_v6->ill_phyint->phyint_flags &
17056 		    (PHYI_STANDBY | PHYI_FAILED)) == PHYI_STANDBY) {
17057 			phyint_inactive(ill_from_v6->ill_phyint);
17058 		}
17059 	}
17060 
17061 	if (ill_to_v4 != NULL) {
17062 		if (ill_to_v4->ill_phyint->phyint_flags & PHYI_INACTIVE) {
17063 			ill_to_v4->ill_phyint->phyint_flags &= ~PHYI_INACTIVE;
17064 		}
17065 	} else if (ill_to_v6 != NULL) {
17066 		if (ill_to_v6->ill_phyint->phyint_flags & PHYI_INACTIVE) {
17067 			ill_to_v6->ill_phyint->phyint_flags &= ~PHYI_INACTIVE;
17068 		}
17069 	}
17070 
17071 	RELEASE_ILL_LOCKS(ill_to_v4, ill_to_v6);
17072 	RELEASE_ILL_LOCKS(ill_from_v4, ill_from_v6);
17073 
17074 no_err:
17075 	/*
17076 	 * lets bring the interfaces up on the to_ill.
17077 	 */
17078 	if (err == 0) {
17079 		err = ill_up_ipifs(ill_to_v4 == NULL ? ill_to_v6:ill_to_v4,
17080 		    q, mp);
17081 	}
17082 done:
17083 
17084 	if (ill_to_v4 != NULL) {
17085 		ill_refrele(ill_to_v4);
17086 	}
17087 	if (ill_to_v6 != NULL) {
17088 		ill_refrele(ill_to_v6);
17089 	}
17090 
17091 	return (err);
17092 }
17093 
17094 static void
17095 ill_dl_down(ill_t *ill)
17096 {
17097 	/*
17098 	 * The ill is down; unbind but stay attached since we're still
17099 	 * associated with a PPA.
17100 	 */
17101 	mblk_t	*mp = ill->ill_unbind_mp;
17102 
17103 	ill->ill_unbind_mp = NULL;
17104 	ip1dbg(("ill_dl_down(%s)\n", ill->ill_name));
17105 	if (mp != NULL) {
17106 		ip1dbg(("ill_dl_down: %s (%u) for %s\n",
17107 		    dlpi_prim_str(*(int *)mp->b_rptr), *(int *)mp->b_rptr,
17108 		    ill->ill_name));
17109 		mutex_enter(&ill->ill_lock);
17110 		ill->ill_state_flags |= ILL_DL_UNBIND_IN_PROGRESS;
17111 		mutex_exit(&ill->ill_lock);
17112 		ill_dlpi_send(ill, mp);
17113 	}
17114 
17115 	/*
17116 	 * Toss all of our multicast memberships.  We could keep them, but
17117 	 * then we'd have to do bookkeeping of any joins and leaves performed
17118 	 * by the application while the the interface is down (we can't just
17119 	 * issue them because arp cannot currently process AR_ENTRY_SQUERY's
17120 	 * on a downed interface).
17121 	 */
17122 	ill_leave_multicast(ill);
17123 
17124 	mutex_enter(&ill->ill_lock);
17125 	ill->ill_dl_up = 0;
17126 	mutex_exit(&ill->ill_lock);
17127 }
17128 
17129 void
17130 ill_dlpi_dispatch(ill_t *ill, mblk_t *mp)
17131 {
17132 	union DL_primitives *dlp;
17133 	t_uscalar_t prim;
17134 
17135 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
17136 
17137 	dlp = (union DL_primitives *)mp->b_rptr;
17138 	prim = dlp->dl_primitive;
17139 
17140 	ip1dbg(("ill_dlpi_dispatch: sending %s (%u) to %s\n",
17141 		dlpi_prim_str(prim), prim, ill->ill_name));
17142 
17143 	switch (prim) {
17144 	case DL_PHYS_ADDR_REQ:
17145 	{
17146 		dl_phys_addr_req_t *dlpap = (dl_phys_addr_req_t *)mp->b_rptr;
17147 		ill->ill_phys_addr_pend = dlpap->dl_addr_type;
17148 		break;
17149 	}
17150 	case DL_BIND_REQ:
17151 		mutex_enter(&ill->ill_lock);
17152 		ill->ill_state_flags &= ~ILL_DL_UNBIND_IN_PROGRESS;
17153 		mutex_exit(&ill->ill_lock);
17154 		break;
17155 	}
17156 
17157 	ill->ill_dlpi_pending = prim;
17158 
17159 	/*
17160 	 * Some drivers send M_FLUSH up to IP as part of unbind
17161 	 * request.  When this M_FLUSH is sent back to the driver,
17162 	 * this can go after we send the detach request if the
17163 	 * M_FLUSH ends up in IP's syncq. To avoid that, we reply
17164 	 * to the M_FLUSH in ip_rput and locally generate another
17165 	 * M_FLUSH for the correctness.  This will get freed in
17166 	 * ip_wput_nondata.
17167 	 */
17168 	if (prim == DL_UNBIND_REQ)
17169 		(void) putnextctl1(ill->ill_rq, M_FLUSH, FLUSHRW);
17170 
17171 	putnext(ill->ill_wq, mp);
17172 }
17173 
17174 /*
17175  * Send a DLPI control message to the driver but make sure there
17176  * is only one outstanding message. Uses ill_dlpi_pending to tell
17177  * when it must queue. ip_rput_dlpi_writer calls ill_dlpi_done()
17178  * when an ACK or a NAK is received to process the next queued message.
17179  *
17180  * We don't protect ill_dlpi_pending with any lock. This is okay as
17181  * every place where its accessed, ip is exclusive while accessing
17182  * ill_dlpi_pending except when this function is called from ill_init()
17183  */
17184 void
17185 ill_dlpi_send(ill_t *ill, mblk_t *mp)
17186 {
17187 	mblk_t **mpp;
17188 
17189 	ASSERT(IAM_WRITER_ILL(ill));
17190 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
17191 
17192 	if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
17193 		/* Must queue message. Tail insertion */
17194 		mpp = &ill->ill_dlpi_deferred;
17195 		while (*mpp != NULL)
17196 			mpp = &((*mpp)->b_next);
17197 
17198 		ip1dbg(("ill_dlpi_send: deferring request for %s\n",
17199 		    ill->ill_name));
17200 
17201 		*mpp = mp;
17202 		return;
17203 	}
17204 
17205 	ill_dlpi_dispatch(ill, mp);
17206 }
17207 
17208 /*
17209  * Called when an DLPI control message has been acked or nacked to
17210  * send down the next queued message (if any).
17211  */
17212 void
17213 ill_dlpi_done(ill_t *ill, t_uscalar_t prim)
17214 {
17215 	mblk_t *mp;
17216 
17217 	ASSERT(IAM_WRITER_ILL(ill));
17218 
17219 	ASSERT(prim != DL_PRIM_INVAL);
17220 	if (ill->ill_dlpi_pending != prim) {
17221 		if (ill->ill_dlpi_pending == DL_PRIM_INVAL) {
17222 			(void) mi_strlog(ill->ill_rq, 1,
17223 			    SL_CONSOLE|SL_ERROR|SL_TRACE,
17224 			    "ill_dlpi_done: unsolicited ack for %s from %s\n",
17225 			    dlpi_prim_str(prim), ill->ill_name);
17226 		} else {
17227 			(void) mi_strlog(ill->ill_rq, 1,
17228 			    SL_CONSOLE|SL_ERROR|SL_TRACE,
17229 			    "ill_dlpi_done: unexpected ack for %s from %s "
17230 			    "(expecting ack for %s)\n",
17231 			    dlpi_prim_str(prim), ill->ill_name,
17232 			    dlpi_prim_str(ill->ill_dlpi_pending));
17233 		}
17234 		return;
17235 	}
17236 
17237 	ip1dbg(("ill_dlpi_done: %s has completed %s (%u)\n", ill->ill_name,
17238 	    dlpi_prim_str(ill->ill_dlpi_pending), ill->ill_dlpi_pending));
17239 
17240 	if ((mp = ill->ill_dlpi_deferred) == NULL) {
17241 		ill->ill_dlpi_pending = DL_PRIM_INVAL;
17242 		return;
17243 	}
17244 
17245 	ill->ill_dlpi_deferred = mp->b_next;
17246 	mp->b_next = NULL;
17247 
17248 	ill_dlpi_dispatch(ill, mp);
17249 }
17250 
17251 void
17252 conn_delete_ire(conn_t *connp, caddr_t arg)
17253 {
17254 	ipif_t	*ipif = (ipif_t *)arg;
17255 	ire_t	*ire;
17256 
17257 	/*
17258 	 * Look at the cached ires on conns which has pointers to ipifs.
17259 	 * We just call ire_refrele which clears up the reference
17260 	 * to ire. Called when a conn closes. Also called from ipif_free
17261 	 * to cleanup indirect references to the stale ipif via the cached ire.
17262 	 */
17263 	mutex_enter(&connp->conn_lock);
17264 	ire = connp->conn_ire_cache;
17265 	if (ire != NULL && (ipif == NULL || ire->ire_ipif == ipif)) {
17266 		connp->conn_ire_cache = NULL;
17267 		mutex_exit(&connp->conn_lock);
17268 		IRE_REFRELE_NOTR(ire);
17269 		return;
17270 	}
17271 	mutex_exit(&connp->conn_lock);
17272 
17273 }
17274 
17275 /*
17276  * Some operations (illgrp_delete(), ipif_down()) conditionally delete a number
17277  * of IREs. Those IREs may have been previously cached in the conn structure.
17278  * This ipcl_walk() walker function releases all references to such IREs based
17279  * on the condemned flag.
17280  */
17281 /* ARGSUSED */
17282 void
17283 conn_cleanup_stale_ire(conn_t *connp, caddr_t arg)
17284 {
17285 	ire_t	*ire;
17286 
17287 	mutex_enter(&connp->conn_lock);
17288 	ire = connp->conn_ire_cache;
17289 	if (ire != NULL && (ire->ire_marks & IRE_MARK_CONDEMNED)) {
17290 		connp->conn_ire_cache = NULL;
17291 		mutex_exit(&connp->conn_lock);
17292 		IRE_REFRELE_NOTR(ire);
17293 		return;
17294 	}
17295 	mutex_exit(&connp->conn_lock);
17296 }
17297 
17298 /*
17299  * Take down a specific interface, but don't lose any information about it.
17300  * Also delete interface from its interface group (ifgrp).
17301  * (Always called as writer.)
17302  * This function goes through the down sequence even if the interface is
17303  * already down. There are 2 reasons.
17304  * a. Currently we permit interface routes that depend on down interfaces
17305  *    to be added. This behaviour itself is questionable. However it appears
17306  *    that both Solaris and 4.3 BSD have exhibited this behaviour for a long
17307  *    time. We go thru the cleanup in order to remove these routes.
17308  * b. The bringup of the interface could fail in ill_dl_up i.e. we get
17309  *    DL_ERROR_ACK in response to the the DL_BIND request. The interface is
17310  *    down, but we need to cleanup i.e. do ill_dl_down and
17311  *    ip_rput_dlpi_writer (DL_ERROR_ACK) -> ipif_down.
17312  *
17313  * IP-MT notes:
17314  *
17315  * Model of reference to interfaces.
17316  *
17317  * The following members in ipif_t track references to the ipif.
17318  *	int     ipif_refcnt;    Active reference count
17319  *	uint_t  ipif_ire_cnt;   Number of ire's referencing this ipif
17320  * The following members in ill_t track references to the ill.
17321  *	int             ill_refcnt;     active refcnt
17322  *	uint_t          ill_ire_cnt;	Number of ires referencing ill
17323  *	uint_t          ill_nce_cnt;	Number of nces referencing ill
17324  *
17325  * Reference to an ipif or ill can be obtained in any of the following ways.
17326  *
17327  * Through the lookup functions ipif_lookup_* / ill_lookup_* functions
17328  * Pointers to ipif / ill from other data structures viz ire and conn.
17329  * Implicit reference to the ipif / ill by holding a reference to the ire.
17330  *
17331  * The ipif/ill lookup functions return a reference held ipif / ill.
17332  * ipif_refcnt and ill_refcnt track the reference counts respectively.
17333  * This is a purely dynamic reference count associated with threads holding
17334  * references to the ipif / ill. Pointers from other structures do not
17335  * count towards this reference count.
17336  *
17337  * ipif_ire_cnt/ill_ire_cnt is the number of ire's associated with the
17338  * ipif/ill. This is incremented whenever a new ire is created referencing the
17339  * ipif/ill. This is done atomically inside ire_add_v[46] where the ire is
17340  * actually added to the ire hash table. The count is decremented in
17341  * ire_inactive where the ire is destroyed.
17342  *
17343  * nce's reference ill's thru nce_ill and the count of nce's associated with
17344  * an ill is recorded in ill_nce_cnt. This is incremented atomically in
17345  * ndp_add() where the nce is actually added to the table. Similarly it is
17346  * decremented in ndp_inactive where the nce is destroyed.
17347  *
17348  * Flow of ioctls involving interface down/up
17349  *
17350  * The following is the sequence of an attempt to set some critical flags on an
17351  * up interface.
17352  * ip_sioctl_flags
17353  * ipif_down
17354  * wait for ipif to be quiescent
17355  * ipif_down_tail
17356  * ip_sioctl_flags_tail
17357  *
17358  * All set ioctls that involve down/up sequence would have a skeleton similar
17359  * to the above. All the *tail functions are called after the refcounts have
17360  * dropped to the appropriate values.
17361  *
17362  * The mechanism to quiesce an ipif is as follows.
17363  *
17364  * Mark the ipif as IPIF_CHANGING. No more lookups will be allowed
17365  * on the ipif. Callers either pass a flag requesting wait or the lookup
17366  *  functions will return NULL.
17367  *
17368  * Delete all ires referencing this ipif
17369  *
17370  * Any thread attempting to do an ipif_refhold on an ipif that has been
17371  * obtained thru a cached pointer will first make sure that
17372  * the ipif can be refheld using the macro IPIF_CAN_LOOKUP and only then
17373  * increment the refcount.
17374  *
17375  * The above guarantees that the ipif refcount will eventually come down to
17376  * zero and the ipif will quiesce, once all threads that currently hold a
17377  * reference to the ipif refrelease the ipif. The ipif is quiescent after the
17378  * ipif_refcount has dropped to zero and all ire's associated with this ipif
17379  * have also been ire_inactive'd. i.e. when ipif_ire_cnt and ipif_refcnt both
17380  * drop to zero.
17381  *
17382  * Lookups during the IPIF_CHANGING/ILL_CHANGING interval.
17383  *
17384  * Threads trying to lookup an ipif or ill can pass a flag requesting
17385  * wait and restart if the ipif / ill cannot be looked up currently.
17386  * For eg. bind, and route operations (Eg. route add / delete) cannot return
17387  * failure if the ipif is currently undergoing an exclusive operation, and
17388  * hence pass the flag. The mblk is then enqueued in the ipsq and the operation
17389  * is restarted by ipsq_exit() when the currently exclusive ioctl completes.
17390  * The lookup and enqueue is atomic using the ill_lock and ipsq_lock. The
17391  * lookup is done holding the ill_lock. Hence the ill/ipif state flags can't
17392  * change while the ill_lock is held. Before dropping the ill_lock we acquire
17393  * the ipsq_lock and call ipsq_enq. This ensures that ipsq_exit can't finish
17394  * until we release the ipsq_lock, even though the the ill/ipif state flags
17395  * can change after we drop the ill_lock.
17396  *
17397  * An attempt to send out a packet using an ipif that is currently
17398  * IPIF_CHANGING will fail. No attempt is made in this case to enqueue this
17399  * operation and restart it later when the exclusive condition on the ipif ends.
17400  * This is an example of not passing the wait flag to the lookup functions. For
17401  * example an attempt to refhold and use conn->conn_multicast_ipif and send
17402  * out a multicast packet on that ipif will fail while the ipif is
17403  * IPIF_CHANGING. An attempt to create an IRE_CACHE using an ipif that is
17404  * currently IPIF_CHANGING will also fail.
17405  */
17406 int
17407 ipif_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
17408 {
17409 	ill_t		*ill = ipif->ipif_ill;
17410 	phyint_t	*phyi;
17411 	conn_t		*connp;
17412 	boolean_t	success;
17413 	boolean_t	ipif_was_up = B_FALSE;
17414 
17415 	ASSERT(IAM_WRITER_IPIF(ipif));
17416 
17417 	ip1dbg(("ipif_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
17418 
17419 	if (ipif->ipif_flags & IPIF_UP) {
17420 		mutex_enter(&ill->ill_lock);
17421 		ipif->ipif_flags &= ~IPIF_UP;
17422 		ASSERT(ill->ill_ipif_up_count > 0);
17423 		--ill->ill_ipif_up_count;
17424 		mutex_exit(&ill->ill_lock);
17425 		ipif_was_up = B_TRUE;
17426 		/* Update status in SCTP's list */
17427 		sctp_update_ipif(ipif, SCTP_IPIF_DOWN);
17428 	}
17429 
17430 	/*
17431 	 * Blow away v6 memberships we established in ipif_multicast_up(); the
17432 	 * v4 ones are left alone (as is the ipif_multicast_up flag, so we
17433 	 * know not to rejoin when the interface is brought back up).
17434 	 */
17435 	if (ipif->ipif_isv6)
17436 		ipif_multicast_down(ipif);
17437 	/*
17438 	 * Remove from the mapping for __sin6_src_id. We insert only
17439 	 * when the address is not INADDR_ANY. As IPv4 addresses are
17440 	 * stored as mapped addresses, we need to check for mapped
17441 	 * INADDR_ANY also.
17442 	 */
17443 	if (ipif_was_up && !IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
17444 	    !IN6_IS_ADDR_V4MAPPED_ANY(&ipif->ipif_v6lcl_addr) &&
17445 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
17446 		int err;
17447 
17448 		err = ip_srcid_remove(&ipif->ipif_v6lcl_addr,
17449 		    ipif->ipif_zoneid);
17450 		if (err != 0) {
17451 			ip0dbg(("ipif_down: srcid_remove %d\n", err));
17452 		}
17453 	}
17454 
17455 	/*
17456 	 * Before we delete the ill from the group (if any), we need
17457 	 * to make sure that we delete all the routes dependent on
17458 	 * this and also any ipifs dependent on this ipif for
17459 	 * source address. We need to do before we delete from
17460 	 * the group because
17461 	 *
17462 	 * 1) ipif_down_delete_ire de-references ill->ill_group.
17463 	 *
17464 	 * 2) ipif_update_other_ipifs needs to walk the whole group
17465 	 *    for re-doing source address selection. Note that
17466 	 *    ipif_select_source[_v6] called from
17467 	 *    ipif_update_other_ipifs[_v6] will not pick this ipif
17468 	 *    because we have already marked down here i.e cleared
17469 	 *    IPIF_UP.
17470 	 */
17471 	if (ipif->ipif_isv6)
17472 		ire_walk_v6(ipif_down_delete_ire, (char *)ipif, ALL_ZONES);
17473 	else
17474 		ire_walk_v4(ipif_down_delete_ire, (char *)ipif, ALL_ZONES);
17475 
17476 	/*
17477 	 * Need to add these also to be saved and restored when the
17478 	 * ipif is brought down and up
17479 	 */
17480 	mutex_enter(&ire_mrtun_lock);
17481 	if (ire_mrtun_count != 0) {
17482 		mutex_exit(&ire_mrtun_lock);
17483 		ire_walk_ill_mrtun(0, 0, ipif_down_delete_ire,
17484 		    (char *)ipif, NULL);
17485 	} else {
17486 		mutex_exit(&ire_mrtun_lock);
17487 	}
17488 
17489 	mutex_enter(&ire_srcif_table_lock);
17490 	if (ire_srcif_table_count > 0) {
17491 		mutex_exit(&ire_srcif_table_lock);
17492 		ire_walk_srcif_table_v4(ipif_down_delete_ire, (char *)ipif);
17493 	} else {
17494 		mutex_exit(&ire_srcif_table_lock);
17495 	}
17496 
17497 	/*
17498 	 * Cleaning up the conn_ire_cache or conns must be done only after the
17499 	 * ires have been deleted above. Otherwise a thread could end up
17500 	 * caching an ire in a conn after we have finished the cleanup of the
17501 	 * conn. The caching is done after making sure that the ire is not yet
17502 	 * condemned. Also documented in the block comment above ip_output
17503 	 */
17504 	ipcl_walk(conn_cleanup_stale_ire, NULL);
17505 	/* Also, delete the ires cached in SCTP */
17506 	sctp_ire_cache_flush(ipif);
17507 
17508 	/* Resolve any IPsec/IKE NAT-T instances that depend on this ipif. */
17509 	nattymod_clean_ipif(ipif);
17510 
17511 	/*
17512 	 * Update any other ipifs which have used "our" local address as
17513 	 * a source address. This entails removing and recreating IRE_INTERFACE
17514 	 * entries for such ipifs.
17515 	 */
17516 	if (ipif->ipif_isv6)
17517 		ipif_update_other_ipifs_v6(ipif, ill->ill_group);
17518 	else
17519 		ipif_update_other_ipifs(ipif, ill->ill_group);
17520 
17521 	if (ipif_was_up) {
17522 		/*
17523 		 * Check whether it is last ipif to leave this group.
17524 		 * If this is the last ipif to leave, we should remove
17525 		 * this ill from the group as ipif_select_source will not
17526 		 * be able to find any useful ipifs if this ill is selected
17527 		 * for load balancing.
17528 		 *
17529 		 * For nameless groups, we should call ifgrp_delete if this
17530 		 * belongs to some group. As this ipif is going down, we may
17531 		 * need to reconstruct groups.
17532 		 */
17533 		phyi = ill->ill_phyint;
17534 		/*
17535 		 * If the phyint_groupname_len is 0, it may or may not
17536 		 * be in the nameless group. If the phyint_groupname_len is
17537 		 * not 0, then this ill should be part of some group.
17538 		 * As we always insert this ill in the group if
17539 		 * phyint_groupname_len is not zero when the first ipif
17540 		 * comes up (in ipif_up_done), it should be in a group
17541 		 * when the namelen is not 0.
17542 		 *
17543 		 * NOTE : When we delete the ill from the group,it will
17544 		 * blow away all the IRE_CACHES pointing either at this ipif or
17545 		 * ill_wq (illgrp_cache_delete does this). Thus, no IRES
17546 		 * should be pointing at this ill.
17547 		 */
17548 		ASSERT(phyi->phyint_groupname_len == 0 ||
17549 		    (phyi->phyint_groupname != NULL && ill->ill_group != NULL));
17550 
17551 		if (phyi->phyint_groupname_len != 0) {
17552 			if (ill->ill_ipif_up_count == 0)
17553 				illgrp_delete(ill);
17554 		}
17555 
17556 		/*
17557 		 * If we have deleted some of the broadcast ires associated
17558 		 * with this ipif, we need to re-nominate somebody else if
17559 		 * the ires that we deleted were the nominated ones.
17560 		 */
17561 		if (ill->ill_group != NULL && !ill->ill_isv6)
17562 			ipif_renominate_bcast(ipif);
17563 	}
17564 
17565 	if (ipif->ipif_isv6)
17566 		ipif_ndp_down(ipif);
17567 
17568 	/*
17569 	 * If mp is NULL the caller will wait for the appropriate refcnt.
17570 	 * Eg. ip_sioctl_removeif -> ipif_free  -> ipif_down
17571 	 * and ill_delete -> ipif_free -> ipif_down
17572 	 */
17573 	if (mp == NULL) {
17574 		ASSERT(q == NULL);
17575 		return (0);
17576 	}
17577 
17578 	if (CONN_Q(q)) {
17579 		connp = Q_TO_CONN(q);
17580 		mutex_enter(&connp->conn_lock);
17581 	} else {
17582 		connp = NULL;
17583 	}
17584 	mutex_enter(&ill->ill_lock);
17585 	/*
17586 	 * Are there any ire's pointing to this ipif that are still active ?
17587 	 * If this is the last ipif going down, are there any ire's pointing
17588 	 * to this ill that are still active ?
17589 	 */
17590 	if (ipif_is_quiescent(ipif)) {
17591 		mutex_exit(&ill->ill_lock);
17592 		if (connp != NULL)
17593 			mutex_exit(&connp->conn_lock);
17594 		return (0);
17595 	}
17596 
17597 	ip1dbg(("ipif_down: need to wait, adding pending mp %s ill %p",
17598 	    ill->ill_name, (void *)ill));
17599 	/*
17600 	 * Enqueue the mp atomically in ipsq_pending_mp. When the refcount
17601 	 * drops down, the operation will be restarted by ipif_ill_refrele_tail
17602 	 * which in turn is called by the last refrele on the ipif/ill/ire.
17603 	 */
17604 	success = ipsq_pending_mp_add(connp, ipif, q, mp, IPIF_DOWN);
17605 	if (!success) {
17606 		/* The conn is closing. So just return */
17607 		ASSERT(connp != NULL);
17608 		mutex_exit(&ill->ill_lock);
17609 		mutex_exit(&connp->conn_lock);
17610 		return (EINTR);
17611 	}
17612 
17613 	mutex_exit(&ill->ill_lock);
17614 	if (connp != NULL)
17615 		mutex_exit(&connp->conn_lock);
17616 	return (EINPROGRESS);
17617 }
17618 
17619 static void
17620 ipif_down_tail(ipif_t *ipif)
17621 {
17622 	ill_t	*ill = ipif->ipif_ill;
17623 
17624 	/*
17625 	 * Skip any loopback interface (null wq).
17626 	 * If this is the last logical interface on the ill
17627 	 * have ill_dl_down tell the driver we are gone (unbind)
17628 	 * Note that lun 0 can ipif_down even though
17629 	 * there are other logical units that are up.
17630 	 * This occurs e.g. when we change a "significant" IFF_ flag.
17631 	 */
17632 	if (ipif->ipif_ill->ill_wq != NULL) {
17633 		if (!ill->ill_logical_down && (ill->ill_ipif_up_count == 0) &&
17634 		    ill->ill_dl_up) {
17635 			ill_dl_down(ill);
17636 		}
17637 	}
17638 	ill->ill_logical_down = 0;
17639 
17640 	/*
17641 	 * Have to be after removing the routes in ipif_down_delete_ire.
17642 	 */
17643 	if (ipif->ipif_isv6) {
17644 		if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV)
17645 			ipif_arp_down(ipif);
17646 	} else {
17647 		ipif_arp_down(ipif);
17648 	}
17649 
17650 	ip_rts_ifmsg(ipif);
17651 	ip_rts_newaddrmsg(RTM_DELETE, 0, ipif);
17652 }
17653 
17654 /*
17655  * Bring interface logically down without bringing the physical interface
17656  * down e.g. when the netmask is changed. This avoids long lasting link
17657  * negotiations between an ethernet interface and a certain switches.
17658  */
17659 static int
17660 ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
17661 {
17662 	/*
17663 	 * The ill_logical_down flag is a transient flag. It is set here
17664 	 * and is cleared once the down has completed in ipif_down_tail.
17665 	 * This flag does not indicate whether the ill stream is in the
17666 	 * DL_BOUND state with the driver. Instead this flag is used by
17667 	 * ipif_down_tail to determine whether to DL_UNBIND the stream with
17668 	 * the driver. The state of the ill stream i.e. whether it is
17669 	 * DL_BOUND with the driver or not is indicated by the ill_dl_up flag.
17670 	 */
17671 	ipif->ipif_ill->ill_logical_down = 1;
17672 	return (ipif_down(ipif, q, mp));
17673 }
17674 
17675 /*
17676  * This is called when the SIOCSLIFUSESRC ioctl is processed in IP.
17677  * If the usesrc client ILL is already part of a usesrc group or not,
17678  * in either case a ire_stq with the matching usesrc client ILL will
17679  * locate the IRE's that need to be deleted. We want IREs to be created
17680  * with the new source address.
17681  */
17682 static void
17683 ipif_delete_cache_ire(ire_t *ire, char *ill_arg)
17684 {
17685 	ill_t	*ucill = (ill_t *)ill_arg;
17686 
17687 	ASSERT(IAM_WRITER_ILL(ucill));
17688 
17689 	if (ire->ire_stq == NULL)
17690 		return;
17691 
17692 	if ((ire->ire_type == IRE_CACHE) &&
17693 	    ((ill_t *)ire->ire_stq->q_ptr == ucill))
17694 		ire_delete(ire);
17695 }
17696 
17697 /*
17698  * ire_walk routine to delete every IRE dependent on the interface
17699  * address that is going down.	(Always called as writer.)
17700  * Works for both v4 and v6.
17701  * In addition for checking for ire_ipif matches it also checks for
17702  * IRE_CACHE entries which have the same source address as the
17703  * disappearing ipif since ipif_select_source might have picked
17704  * that source. Note that ipif_down/ipif_update_other_ipifs takes
17705  * care of any IRE_INTERFACE with the disappearing source address.
17706  */
17707 static void
17708 ipif_down_delete_ire(ire_t *ire, char *ipif_arg)
17709 {
17710 	ipif_t	*ipif = (ipif_t *)ipif_arg;
17711 	ill_t *ire_ill;
17712 	ill_t *ipif_ill;
17713 
17714 	ASSERT(IAM_WRITER_IPIF(ipif));
17715 	if (ire->ire_ipif == NULL)
17716 		return;
17717 
17718 	/*
17719 	 * For IPv4, we derive source addresses for an IRE from ipif's
17720 	 * belonging to the same IPMP group as the IRE's outgoing
17721 	 * interface.  If an IRE's outgoing interface isn't in the
17722 	 * same IPMP group as a particular ipif, then that ipif
17723 	 * couldn't have been used as a source address for this IRE.
17724 	 *
17725 	 * For IPv6, source addresses are only restricted to the IPMP group
17726 	 * if the IRE is for a link-local address or a multicast address.
17727 	 * Otherwise, source addresses for an IRE can be chosen from
17728 	 * interfaces other than the the outgoing interface for that IRE.
17729 	 *
17730 	 * For source address selection details, see ipif_select_source()
17731 	 * and ipif_select_source_v6().
17732 	 */
17733 	if (ire->ire_ipversion == IPV4_VERSION ||
17734 	    IN6_IS_ADDR_LINKLOCAL(&ire->ire_addr_v6) ||
17735 	    IN6_IS_ADDR_MULTICAST(&ire->ire_addr_v6)) {
17736 		ire_ill = ire->ire_ipif->ipif_ill;
17737 		ipif_ill = ipif->ipif_ill;
17738 
17739 		if (ire_ill->ill_group != ipif_ill->ill_group) {
17740 			return;
17741 		}
17742 	}
17743 
17744 
17745 	if (ire->ire_ipif != ipif) {
17746 		/*
17747 		 * Look for a matching source address.
17748 		 */
17749 		if (ire->ire_type != IRE_CACHE)
17750 			return;
17751 		if (ipif->ipif_flags & IPIF_NOLOCAL)
17752 			return;
17753 
17754 		if (ire->ire_ipversion == IPV4_VERSION) {
17755 			if (ire->ire_src_addr != ipif->ipif_src_addr)
17756 				return;
17757 		} else {
17758 			if (!IN6_ARE_ADDR_EQUAL(&ire->ire_src_addr_v6,
17759 			    &ipif->ipif_v6lcl_addr))
17760 				return;
17761 		}
17762 		ire_delete(ire);
17763 		return;
17764 	}
17765 	/*
17766 	 * ire_delete() will do an ire_flush_cache which will delete
17767 	 * all ire_ipif matches
17768 	 */
17769 	ire_delete(ire);
17770 }
17771 
17772 /*
17773  * ire_walk_ill function for deleting all IRE_CACHE entries for an ill when
17774  * 1) an ipif (on that ill) changes the IPIF_DEPRECATED flags, or
17775  * 2) when an interface is brought up or down (on that ill).
17776  * This ensures that the IRE_CACHE entries don't retain stale source
17777  * address selection results.
17778  */
17779 void
17780 ill_ipif_cache_delete(ire_t *ire, char *ill_arg)
17781 {
17782 	ill_t	*ill = (ill_t *)ill_arg;
17783 	ill_t	*ipif_ill;
17784 
17785 	ASSERT(IAM_WRITER_ILL(ill));
17786 	/*
17787 	 * We use MATCH_IRE_TYPE/IRE_CACHE while calling ire_walk_ill_v4.
17788 	 * Hence this should be IRE_CACHE.
17789 	 */
17790 	ASSERT(ire->ire_type == IRE_CACHE);
17791 
17792 	/*
17793 	 * We are called for IRE_CACHES whose ire_ipif matches ill.
17794 	 * We are only interested in IRE_CACHES that has borrowed
17795 	 * the source address from ill_arg e.g. ipif_up_done[_v6]
17796 	 * for which we need to look at ire_ipif->ipif_ill match
17797 	 * with ill.
17798 	 */
17799 	ASSERT(ire->ire_ipif != NULL);
17800 	ipif_ill = ire->ire_ipif->ipif_ill;
17801 	if (ipif_ill == ill || (ill->ill_group != NULL &&
17802 	    ipif_ill->ill_group == ill->ill_group)) {
17803 		ire_delete(ire);
17804 	}
17805 }
17806 
17807 /*
17808  * Delete all the ire whose stq references ill_arg.
17809  */
17810 static void
17811 ill_stq_cache_delete(ire_t *ire, char *ill_arg)
17812 {
17813 	ill_t	*ill = (ill_t *)ill_arg;
17814 	ill_t	*ire_ill;
17815 
17816 	ASSERT(IAM_WRITER_ILL(ill));
17817 	/*
17818 	 * We use MATCH_IRE_TYPE/IRE_CACHE while calling ire_walk_ill_v4.
17819 	 * Hence this should be IRE_CACHE.
17820 	 */
17821 	ASSERT(ire->ire_type == IRE_CACHE);
17822 
17823 	/*
17824 	 * We are called for IRE_CACHES whose ire_stq and ire_ipif
17825 	 * matches ill. We are only interested in IRE_CACHES that
17826 	 * has ire_stq->q_ptr pointing at ill_arg. Thus we do the
17827 	 * filtering here.
17828 	 */
17829 	ire_ill = (ill_t *)ire->ire_stq->q_ptr;
17830 
17831 	if (ire_ill == ill)
17832 		ire_delete(ire);
17833 }
17834 
17835 /*
17836  * This is called when an ill leaves the group. We want to delete
17837  * all IRE_CACHES whose stq is pointing at ill_wq or ire_ipif is
17838  * pointing at ill.
17839  */
17840 static void
17841 illgrp_cache_delete(ire_t *ire, char *ill_arg)
17842 {
17843 	ill_t	*ill = (ill_t *)ill_arg;
17844 
17845 	ASSERT(IAM_WRITER_ILL(ill));
17846 	ASSERT(ill->ill_group == NULL);
17847 	/*
17848 	 * We use MATCH_IRE_TYPE/IRE_CACHE while calling ire_walk_ill_v4.
17849 	 * Hence this should be IRE_CACHE.
17850 	 */
17851 	ASSERT(ire->ire_type == IRE_CACHE);
17852 	/*
17853 	 * We are called for IRE_CACHES whose ire_stq and ire_ipif
17854 	 * matches ill. We are interested in both.
17855 	 */
17856 	ASSERT((ill == (ill_t *)ire->ire_stq->q_ptr) ||
17857 	    (ire->ire_ipif->ipif_ill == ill));
17858 
17859 	ire_delete(ire);
17860 }
17861 
17862 /*
17863  * Initiate deallocate of an IPIF. Always called as writer. Called by
17864  * ill_delete or ip_sioctl_removeif.
17865  */
17866 static void
17867 ipif_free(ipif_t *ipif)
17868 {
17869 	ASSERT(IAM_WRITER_IPIF(ipif));
17870 
17871 	/* Remove conn references */
17872 	reset_conn_ipif(ipif);
17873 
17874 	/*
17875 	 * Make sure we have valid net and subnet broadcast ire's for the
17876 	 * other ipif's which share them with this ipif.
17877 	 */
17878 	if (!ipif->ipif_isv6)
17879 		ipif_check_bcast_ires(ipif);
17880 
17881 	/*
17882 	 * Take down the interface. We can be called either from ill_delete
17883 	 * or from ip_sioctl_removeif.
17884 	 */
17885 	(void) ipif_down(ipif, NULL, NULL);
17886 
17887 	rw_enter(&ill_g_lock, RW_WRITER);
17888 	/* Remove pointers to this ill in the multicast routing tables */
17889 	reset_mrt_vif_ipif(ipif);
17890 	rw_exit(&ill_g_lock);
17891 }
17892 
17893 static void
17894 ipif_free_tail(ipif_t *ipif)
17895 {
17896 	mblk_t	*mp;
17897 	ipif_t	**ipifp;
17898 
17899 	/*
17900 	 * Free state for addition IRE_IF_[NO]RESOLVER ire's.
17901 	 */
17902 	mutex_enter(&ipif->ipif_saved_ire_lock);
17903 	mp = ipif->ipif_saved_ire_mp;
17904 	ipif->ipif_saved_ire_mp = NULL;
17905 	mutex_exit(&ipif->ipif_saved_ire_lock);
17906 	freemsg(mp);
17907 
17908 	/*
17909 	 * Need to hold both ill_g_lock and ill_lock while
17910 	 * inserting or removing an ipif from the linked list
17911 	 * of ipifs hanging off the ill.
17912 	 */
17913 	rw_enter(&ill_g_lock, RW_WRITER);
17914 	/*
17915 	 * Remove all multicast memberships on the interface now.
17916 	 * This removes IPv4 multicast memberships joined within
17917 	 * the kernel as ipif_down does not do ipif_multicast_down
17918 	 * for IPv4. IPv6 is not handled here as the multicast memberships
17919 	 * are based on ill and not on ipif.
17920 	 */
17921 	ilm_free(ipif);
17922 
17923 	/*
17924 	 * Since we held the ill_g_lock while doing the ilm_free above,
17925 	 * we can assert the ilms were really deleted and not just marked
17926 	 * ILM_DELETED.
17927 	 */
17928 	ASSERT(ilm_walk_ipif(ipif) == 0);
17929 
17930 
17931 	IPIF_TRACE_CLEANUP(ipif);
17932 
17933 	/* Ask SCTP to take it out of it list */
17934 	sctp_update_ipif(ipif, SCTP_IPIF_REMOVE);
17935 
17936 	mutex_enter(&ipif->ipif_ill->ill_lock);
17937 	/* Get it out of the ILL interface list. */
17938 	ipifp = &ipif->ipif_ill->ill_ipif;
17939 	for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
17940 		if (*ipifp == ipif) {
17941 			*ipifp = ipif->ipif_next;
17942 			break;
17943 		}
17944 	}
17945 
17946 	mutex_exit(&ipif->ipif_ill->ill_lock);
17947 	rw_exit(&ill_g_lock);
17948 
17949 	mutex_destroy(&ipif->ipif_saved_ire_lock);
17950 	/* Free the memory. */
17951 	mi_free((char *)ipif);
17952 }
17953 
17954 /*
17955  * Returns an ipif name in the form "ill_name/unit" if ipif_id is not zero,
17956  * "ill_name" otherwise.
17957  */
17958 char *
17959 ipif_get_name(ipif_t *ipif, char *buf, int len)
17960 {
17961 	char	lbuf[32];
17962 	char	*name;
17963 	size_t	name_len;
17964 
17965 	buf[0] = '\0';
17966 	if (!ipif)
17967 		return (buf);
17968 	name = ipif->ipif_ill->ill_name;
17969 	name_len = ipif->ipif_ill->ill_name_length;
17970 	if (ipif->ipif_id != 0) {
17971 		(void) sprintf(lbuf, "%s%c%d", name, IPIF_SEPARATOR_CHAR,
17972 		    ipif->ipif_id);
17973 		name = lbuf;
17974 		name_len = mi_strlen(name) + 1;
17975 	}
17976 	len -= 1;
17977 	buf[len] = '\0';
17978 	len = MIN(len, name_len);
17979 	bcopy(name, buf, len);
17980 	return (buf);
17981 }
17982 
17983 /*
17984  * Find an IPIF based on the name passed in.  Names can be of the
17985  * form <phys> (e.g., le0), <phys>:<#> (e.g., le0:1),
17986  * The <phys> string can have forms like <dev><#> (e.g., le0),
17987  * <dev><#>.<module> (e.g. le0.foo), or <dev>.<module><#> (e.g. ip.tun3).
17988  * When there is no colon, the implied unit id is zero. <phys> must
17989  * correspond to the name of an ILL.  (May be called as writer.)
17990  */
17991 static ipif_t *
17992 ipif_lookup_on_name(char *name, size_t namelen, boolean_t do_alloc,
17993     boolean_t *exists, boolean_t isv6, zoneid_t zoneid, queue_t *q,
17994     mblk_t *mp, ipsq_func_t func, int *error)
17995 {
17996 	char	*cp;
17997 	char	*endp;
17998 	long	id;
17999 	ill_t	*ill;
18000 	ipif_t	*ipif;
18001 	uint_t	ire_type;
18002 	boolean_t did_alloc = B_FALSE;
18003 	ipsq_t	*ipsq;
18004 
18005 	if (error != NULL)
18006 		*error = 0;
18007 
18008 	/*
18009 	 * If the caller wants to us to create the ipif, make sure we have a
18010 	 * valid zoneid
18011 	 */
18012 	ASSERT(!do_alloc || zoneid != ALL_ZONES);
18013 
18014 	if (namelen == 0) {
18015 		if (error != NULL)
18016 			*error = ENXIO;
18017 		return (NULL);
18018 	}
18019 
18020 	*exists = B_FALSE;
18021 	/* Look for a colon in the name. */
18022 	endp = &name[namelen];
18023 	for (cp = endp; --cp > name; ) {
18024 		if (*cp == IPIF_SEPARATOR_CHAR)
18025 			break;
18026 	}
18027 
18028 	if (*cp == IPIF_SEPARATOR_CHAR) {
18029 		/*
18030 		 * Reject any non-decimal aliases for logical
18031 		 * interfaces. Aliases with leading zeroes
18032 		 * are also rejected as they introduce ambiguity
18033 		 * in the naming of the interfaces.
18034 		 * In order to confirm with existing semantics,
18035 		 * and to not break any programs/script relying
18036 		 * on that behaviour, if<0>:0 is considered to be
18037 		 * a valid interface.
18038 		 *
18039 		 * If alias has two or more digits and the first
18040 		 * is zero, fail.
18041 		 */
18042 		if (&cp[2] < endp && cp[1] == '0')
18043 			return (NULL);
18044 	}
18045 
18046 	if (cp <= name) {
18047 		cp = endp;
18048 	} else {
18049 		*cp = '\0';
18050 	}
18051 
18052 	/*
18053 	 * Look up the ILL, based on the portion of the name
18054 	 * before the slash. ill_lookup_on_name returns a held ill.
18055 	 * Temporary to check whether ill exists already. If so
18056 	 * ill_lookup_on_name will clear it.
18057 	 */
18058 	ill = ill_lookup_on_name(name, do_alloc, isv6,
18059 	    q, mp, func, error, &did_alloc);
18060 	if (cp != endp)
18061 		*cp = IPIF_SEPARATOR_CHAR;
18062 	if (ill == NULL)
18063 		return (NULL);
18064 
18065 	/* Establish the unit number in the name. */
18066 	id = 0;
18067 	if (cp < endp && *endp == '\0') {
18068 		/* If there was a colon, the unit number follows. */
18069 		cp++;
18070 		if (ddi_strtol(cp, NULL, 0, &id) != 0) {
18071 			ill_refrele(ill);
18072 			if (error != NULL)
18073 				*error = ENXIO;
18074 			return (NULL);
18075 		}
18076 	}
18077 
18078 	GRAB_CONN_LOCK(q);
18079 	mutex_enter(&ill->ill_lock);
18080 	/* Now see if there is an IPIF with this unit number. */
18081 	for (ipif = ill->ill_ipif; ipif; ipif = ipif->ipif_next) {
18082 		if (ipif->ipif_id == id) {
18083 			if (zoneid != ALL_ZONES &&
18084 			    zoneid != ipif->ipif_zoneid) {
18085 				mutex_exit(&ill->ill_lock);
18086 				RELEASE_CONN_LOCK(q);
18087 				ill_refrele(ill);
18088 				if (error != NULL)
18089 					*error = ENXIO;
18090 				return (NULL);
18091 			}
18092 			/*
18093 			 * The block comment at the start of ipif_down
18094 			 * explains the use of the macros used below
18095 			 */
18096 			if (IPIF_CAN_LOOKUP(ipif)) {
18097 				ipif_refhold_locked(ipif);
18098 				mutex_exit(&ill->ill_lock);
18099 				if (!did_alloc)
18100 					*exists = B_TRUE;
18101 				/*
18102 				 * Drop locks before calling ill_refrele
18103 				 * since it can potentially call into
18104 				 * ipif_ill_refrele_tail which can end up
18105 				 * in trying to acquire any lock.
18106 				 */
18107 				RELEASE_CONN_LOCK(q);
18108 				ill_refrele(ill);
18109 				return (ipif);
18110 			} else if (IPIF_CAN_WAIT(ipif, q)) {
18111 				ipsq = ill->ill_phyint->phyint_ipsq;
18112 				mutex_enter(&ipsq->ipsq_lock);
18113 				mutex_exit(&ill->ill_lock);
18114 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
18115 				mutex_exit(&ipsq->ipsq_lock);
18116 				RELEASE_CONN_LOCK(q);
18117 				ill_refrele(ill);
18118 				*error = EINPROGRESS;
18119 				return (NULL);
18120 			}
18121 		}
18122 	}
18123 	RELEASE_CONN_LOCK(q);
18124 
18125 	if (!do_alloc) {
18126 		mutex_exit(&ill->ill_lock);
18127 		ill_refrele(ill);
18128 		if (error != NULL)
18129 			*error = ENXIO;
18130 		return (NULL);
18131 	}
18132 
18133 	/*
18134 	 * If none found, atomically allocate and return a new one.
18135 	 * Historically, we used IRE_LOOPBACK only for lun 0, and IRE_LOCAL
18136 	 * to support "receive only" use of lo0:1 etc. as is still done
18137 	 * below as an initial guess.
18138 	 * However, this is now likely to be overriden later in ipif_up_done()
18139 	 * when we know for sure what address has been configured on the
18140 	 * interface, since we might have more than one loopback interface
18141 	 * with a loopback address, e.g. in the case of zones, and all the
18142 	 * interfaces with loopback addresses need to be marked IRE_LOOPBACK.
18143 	 */
18144 	if (ill->ill_net_type == IRE_LOOPBACK && id == 0)
18145 		ire_type = IRE_LOOPBACK;
18146 	else
18147 		ire_type = IRE_LOCAL;
18148 	ipif = ipif_allocate(ill, id, ire_type, B_TRUE);
18149 	if (ipif != NULL)
18150 		ipif_refhold_locked(ipif);
18151 	else if (error != NULL)
18152 		*error = ENOMEM;
18153 	mutex_exit(&ill->ill_lock);
18154 	ill_refrele(ill);
18155 	return (ipif);
18156 }
18157 
18158 /*
18159  * This routine is called whenever a new address comes up on an ipif.  If
18160  * we are configured to respond to address mask requests, then we are supposed
18161  * to broadcast an address mask reply at this time.  This routine is also
18162  * called if we are already up, but a netmask change is made.  This is legal
18163  * but might not make the system manager very popular.	(May be called
18164  * as writer.)
18165  */
18166 static void
18167 ipif_mask_reply(ipif_t *ipif)
18168 {
18169 	icmph_t	*icmph;
18170 	ipha_t	*ipha;
18171 	mblk_t	*mp;
18172 
18173 #define	REPLY_LEN	(sizeof (icmp_ipha) + sizeof (icmph_t) + IP_ADDR_LEN)
18174 
18175 	if (!ip_respond_to_address_mask_broadcast)
18176 		return;
18177 
18178 	/* ICMP mask reply is IPv4 only */
18179 	ASSERT(!ipif->ipif_isv6);
18180 	/* ICMP mask reply is not for a loopback interface */
18181 	ASSERT(ipif->ipif_ill->ill_wq != NULL);
18182 
18183 	mp = allocb(REPLY_LEN, BPRI_HI);
18184 	if (mp == NULL)
18185 		return;
18186 	mp->b_wptr = mp->b_rptr + REPLY_LEN;
18187 
18188 	ipha = (ipha_t *)mp->b_rptr;
18189 	bzero(ipha, REPLY_LEN);
18190 	*ipha = icmp_ipha;
18191 	ipha->ipha_ttl = ip_broadcast_ttl;
18192 	ipha->ipha_src = ipif->ipif_src_addr;
18193 	ipha->ipha_dst = ipif->ipif_brd_addr;
18194 	ipha->ipha_length = htons(REPLY_LEN);
18195 	ipha->ipha_ident = 0;
18196 
18197 	icmph = (icmph_t *)&ipha[1];
18198 	icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY;
18199 	bcopy(&ipif->ipif_net_mask, &icmph[1], IP_ADDR_LEN);
18200 	icmph->icmph_checksum = IP_CSUM(mp, sizeof (ipha_t), 0);
18201 	if (icmph->icmph_checksum == 0)
18202 		icmph->icmph_checksum = 0xffff;
18203 
18204 	put(ipif->ipif_wq, mp);
18205 
18206 #undef	REPLY_LEN
18207 }
18208 
18209 /*
18210  * When the mtu in the ipif changes, we call this routine through ire_walk
18211  * to update all the relevant IREs.
18212  * Skip IRE_LOCAL and "loopback" IRE_BROADCAST by checking ire_stq.
18213  */
18214 static void
18215 ipif_mtu_change(ire_t *ire, char *ipif_arg)
18216 {
18217 	ipif_t *ipif = (ipif_t *)ipif_arg;
18218 
18219 	if (ire->ire_stq == NULL || ire->ire_ipif != ipif)
18220 		return;
18221 	ire->ire_max_frag = MIN(ipif->ipif_mtu, IP_MAXPACKET);
18222 }
18223 
18224 /*
18225  * When the mtu in the ill changes, we call this routine through ire_walk
18226  * to update all the relevant IREs.
18227  * Skip IRE_LOCAL and "loopback" IRE_BROADCAST by checking ire_stq.
18228  */
18229 void
18230 ill_mtu_change(ire_t *ire, char *ill_arg)
18231 {
18232 	ill_t	*ill = (ill_t *)ill_arg;
18233 
18234 	if (ire->ire_stq == NULL || ire->ire_ipif->ipif_ill != ill)
18235 		return;
18236 	ire->ire_max_frag = ire->ire_ipif->ipif_mtu;
18237 }
18238 
18239 /*
18240  * Join the ipif specific multicast groups.
18241  * Must be called after a mapping has been set up in the resolver.  (Always
18242  * called as writer.)
18243  */
18244 void
18245 ipif_multicast_up(ipif_t *ipif)
18246 {
18247 	int err, index;
18248 	ill_t *ill;
18249 
18250 	ASSERT(IAM_WRITER_IPIF(ipif));
18251 
18252 	ill = ipif->ipif_ill;
18253 	index = ill->ill_phyint->phyint_ifindex;
18254 
18255 	ip1dbg(("ipif_multicast_up\n"));
18256 	if (!(ill->ill_flags & ILLF_MULTICAST) || ipif->ipif_multicast_up)
18257 		return;
18258 
18259 	if (ipif->ipif_isv6) {
18260 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
18261 			return;
18262 
18263 		/* Join the all hosts multicast address */
18264 		ip1dbg(("ipif_multicast_up - addmulti\n"));
18265 		/*
18266 		 * Passing B_TRUE means we have to join the multicast
18267 		 * membership on this interface even though this is
18268 		 * FAILED. If we join on a different one in the group,
18269 		 * we will not be able to delete the membership later
18270 		 * as we currently don't track where we join when we
18271 		 * join within the kernel unlike applications where
18272 		 * we have ilg/ilg_orig_index. See ip_addmulti_v6
18273 		 * for more on this.
18274 		 */
18275 		err = ip_addmulti_v6(&ipv6_all_hosts_mcast, ill, index,
18276 		    ipif->ipif_zoneid, ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
18277 		if (err != 0) {
18278 			ip0dbg(("ipif_multicast_up: "
18279 			    "all_hosts_mcast failed %d\n",
18280 			    err));
18281 			return;
18282 		}
18283 		/*
18284 		 * Enable multicast for the solicited node multicast address
18285 		 */
18286 		if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
18287 			in6_addr_t ipv6_multi = ipv6_solicited_node_mcast;
18288 
18289 			ipv6_multi.s6_addr32[3] |=
18290 			    ipif->ipif_v6lcl_addr.s6_addr32[3];
18291 
18292 			err = ip_addmulti_v6(&ipv6_multi, ill, index,
18293 			    ipif->ipif_zoneid, ILGSTAT_NONE, MODE_IS_EXCLUDE,
18294 			    NULL);
18295 			if (err != 0) {
18296 				ip0dbg(("ipif_multicast_up: solicited MC"
18297 				    " failed %d\n", err));
18298 				(void) ip_delmulti_v6(&ipv6_all_hosts_mcast,
18299 				    ill, ill->ill_phyint->phyint_ifindex,
18300 				    ipif->ipif_zoneid, B_TRUE, B_TRUE);
18301 				return;
18302 			}
18303 		}
18304 	} else {
18305 		if (ipif->ipif_lcl_addr == INADDR_ANY)
18306 			return;
18307 
18308 		/* Join the all hosts multicast address */
18309 		ip1dbg(("ipif_multicast_up - addmulti\n"));
18310 		err = ip_addmulti(htonl(INADDR_ALLHOSTS_GROUP), ipif,
18311 		    ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
18312 		if (err) {
18313 			ip0dbg(("ipif_multicast_up: failed %d\n", err));
18314 			return;
18315 		}
18316 	}
18317 	ipif->ipif_multicast_up = 1;
18318 }
18319 
18320 /*
18321  * Blow away any IPv6 multicast groups that we joined in ipif_multicast_up();
18322  * any explicit memberships are blown away in ill_leave_multicast() when the
18323  * ill is brought down.
18324  */
18325 static void
18326 ipif_multicast_down(ipif_t *ipif)
18327 {
18328 	int err;
18329 
18330 	ASSERT(IAM_WRITER_IPIF(ipif));
18331 
18332 	ip1dbg(("ipif_multicast_down\n"));
18333 	if (!ipif->ipif_multicast_up)
18334 		return;
18335 
18336 	ASSERT(ipif->ipif_isv6);
18337 
18338 	ip1dbg(("ipif_multicast_down - delmulti\n"));
18339 
18340 	/*
18341 	 * Leave the all hosts multicast address. Similar to ip_addmulti_v6,
18342 	 * we should look for ilms on this ill rather than the ones that have
18343 	 * been failed over here.  They are here temporarily. As
18344 	 * ipif_multicast_up has joined on this ill, we should delete only
18345 	 * from this ill.
18346 	 */
18347 	err = ip_delmulti_v6(&ipv6_all_hosts_mcast, ipif->ipif_ill,
18348 	    ipif->ipif_ill->ill_phyint->phyint_ifindex, ipif->ipif_zoneid,
18349 	    B_TRUE, B_TRUE);
18350 	if (err != 0) {
18351 		ip0dbg(("ipif_multicast_down: all_hosts_mcast failed %d\n",
18352 		    err));
18353 	}
18354 	/*
18355 	 * Disable multicast for the solicited node multicast address
18356 	 */
18357 	if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
18358 		in6_addr_t ipv6_multi = ipv6_solicited_node_mcast;
18359 
18360 		ipv6_multi.s6_addr32[3] |=
18361 		    ipif->ipif_v6lcl_addr.s6_addr32[3];
18362 
18363 		err = ip_delmulti_v6(&ipv6_multi, ipif->ipif_ill,
18364 		    ipif->ipif_ill->ill_phyint->phyint_ifindex,
18365 		    ipif->ipif_zoneid, B_TRUE, B_TRUE);
18366 
18367 		if (err != 0) {
18368 			ip0dbg(("ipif_multicast_down: sol MC failed %d\n",
18369 			    err));
18370 		}
18371 	}
18372 
18373 	ipif->ipif_multicast_up = 0;
18374 }
18375 
18376 /*
18377  * Used when an interface comes up to recreate any extra routes on this
18378  * interface.
18379  */
18380 static ire_t **
18381 ipif_recover_ire(ipif_t *ipif)
18382 {
18383 	mblk_t	*mp;
18384 	ire_t	**ipif_saved_irep;
18385 	ire_t	**irep;
18386 
18387 	ip1dbg(("ipif_recover_ire(%s:%u)", ipif->ipif_ill->ill_name,
18388 	    ipif->ipif_id));
18389 
18390 	mutex_enter(&ipif->ipif_saved_ire_lock);
18391 	ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) *
18392 	    ipif->ipif_saved_ire_cnt, KM_NOSLEEP);
18393 	if (ipif_saved_irep == NULL) {
18394 		mutex_exit(&ipif->ipif_saved_ire_lock);
18395 		return (NULL);
18396 	}
18397 
18398 	irep = ipif_saved_irep;
18399 	for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
18400 		ire_t		*ire;
18401 		queue_t		*rfq;
18402 		queue_t		*stq;
18403 		ifrt_t		*ifrt;
18404 		uchar_t		*src_addr;
18405 		uchar_t		*gateway_addr;
18406 		mblk_t		*resolver_mp;
18407 		ushort_t	type;
18408 
18409 		/*
18410 		 * When the ire was initially created and then added in
18411 		 * ip_rt_add(), it was created either using ipif->ipif_net_type
18412 		 * in the case of a traditional interface route, or as one of
18413 		 * the IRE_OFFSUBNET types (with the exception of
18414 		 * IRE_HOST_REDIRECT which is created by icmp_redirect() and
18415 		 * which we don't need to save or recover).  In the case where
18416 		 * ipif->ipif_net_type was IRE_LOOPBACK, ip_rt_add() will update
18417 		 * the ire_type to IRE_IF_NORESOLVER before calling ire_add()
18418 		 * to satisfy software like GateD and Sun Cluster which creates
18419 		 * routes using the the loopback interface's address as a
18420 		 * gateway.
18421 		 *
18422 		 * As ifrt->ifrt_type reflects the already updated ire_type and
18423 		 * since ire_create() expects that IRE_IF_NORESOLVER will have
18424 		 * a valid ire_dlureq_mp field (which doesn't make sense for a
18425 		 * IRE_LOOPBACK), ire_create() will be called in the same way
18426 		 * here as in ip_rt_add(), namely using ipif->ipif_net_type when
18427 		 * the route looks like a traditional interface route (where
18428 		 * ifrt->ifrt_type & IRE_INTERFACE is true) and otherwise using
18429 		 * the saved ifrt->ifrt_type.  This means that in the case where
18430 		 * ipif->ipif_net_type is IRE_LOOPBACK, the ire created by
18431 		 * ire_create() will be an IRE_LOOPBACK, it will then be turned
18432 		 * into an IRE_IF_NORESOLVER and then added by ire_add().
18433 		 */
18434 		ifrt = (ifrt_t *)mp->b_rptr;
18435 		if (ifrt->ifrt_type & IRE_INTERFACE) {
18436 			rfq = NULL;
18437 			stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
18438 			    ? ipif->ipif_rq : ipif->ipif_wq;
18439 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
18440 			    ? (uint8_t *)&ifrt->ifrt_src_addr
18441 			    : (uint8_t *)&ipif->ipif_src_addr;
18442 			gateway_addr = NULL;
18443 			resolver_mp = ipif->ipif_resolver_mp;
18444 			type = ipif->ipif_net_type;
18445 		} else if (ifrt->ifrt_type & IRE_BROADCAST) {
18446 			/* Recover multiroute broadcast IRE. */
18447 			rfq = ipif->ipif_rq;
18448 			stq = ipif->ipif_wq;
18449 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
18450 			    ? (uint8_t *)&ifrt->ifrt_src_addr
18451 			    : (uint8_t *)&ipif->ipif_src_addr;
18452 			gateway_addr = (uint8_t *)&ifrt->ifrt_gateway_addr;
18453 			resolver_mp = ipif->ipif_bcast_mp;
18454 			type = ifrt->ifrt_type;
18455 		} else {
18456 			rfq = NULL;
18457 			stq = NULL;
18458 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
18459 			    ? (uint8_t *)&ifrt->ifrt_src_addr : NULL;
18460 			gateway_addr = (uint8_t *)&ifrt->ifrt_gateway_addr;
18461 			resolver_mp = NULL;
18462 			type = ifrt->ifrt_type;
18463 		}
18464 
18465 		/*
18466 		 * Create a copy of the IRE with the saved address and netmask.
18467 		 */
18468 		ip1dbg(("ipif_recover_ire: creating IRE %s (%d) for "
18469 		    "0x%x/0x%x\n",
18470 		    ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type,
18471 		    ntohl(ifrt->ifrt_addr),
18472 		    ntohl(ifrt->ifrt_mask)));
18473 		ire = ire_create(
18474 		    (uint8_t *)&ifrt->ifrt_addr,
18475 		    (uint8_t *)&ifrt->ifrt_mask,
18476 		    src_addr,
18477 		    gateway_addr,
18478 		    NULL,
18479 		    &ifrt->ifrt_max_frag,
18480 		    NULL,
18481 		    rfq,
18482 		    stq,
18483 		    type,
18484 		    resolver_mp,
18485 		    ipif,
18486 		    NULL,
18487 		    0,
18488 		    0,
18489 		    0,
18490 		    ifrt->ifrt_flags,
18491 		    &ifrt->ifrt_iulp_info);
18492 
18493 		if (ire == NULL) {
18494 			mutex_exit(&ipif->ipif_saved_ire_lock);
18495 			kmem_free(ipif_saved_irep,
18496 			    ipif->ipif_saved_ire_cnt * sizeof (ire_t *));
18497 			return (NULL);
18498 		}
18499 
18500 		/*
18501 		 * Some software (for example, GateD and Sun Cluster) attempts
18502 		 * to create (what amount to) IRE_PREFIX routes with the
18503 		 * loopback address as the gateway.  This is primarily done to
18504 		 * set up prefixes with the RTF_REJECT flag set (for example,
18505 		 * when generating aggregate routes.)
18506 		 *
18507 		 * If the IRE type (as defined by ipif->ipif_net_type) is
18508 		 * IRE_LOOPBACK, then we map the request into a
18509 		 * IRE_IF_NORESOLVER.
18510 		 */
18511 		if (ipif->ipif_net_type == IRE_LOOPBACK)
18512 			ire->ire_type = IRE_IF_NORESOLVER;
18513 		/*
18514 		 * ire held by ire_add, will be refreled' towards the
18515 		 * the end of ipif_up_done
18516 		 */
18517 		(void) ire_add(&ire, NULL, NULL, NULL);
18518 		*irep = ire;
18519 		irep++;
18520 		ip1dbg(("ipif_recover_ire: added ire %p\n", (void *)ire));
18521 	}
18522 	mutex_exit(&ipif->ipif_saved_ire_lock);
18523 	return (ipif_saved_irep);
18524 }
18525 
18526 /*
18527  * Used to set the netmask and broadcast address to default values when the
18528  * interface is brought up.  (Always called as writer.)
18529  */
18530 static void
18531 ipif_set_default(ipif_t *ipif)
18532 {
18533 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
18534 
18535 	if (!ipif->ipif_isv6) {
18536 		/*
18537 		 * Interface holds an IPv4 address. Default
18538 		 * mask is the natural netmask.
18539 		 */
18540 		if (!ipif->ipif_net_mask) {
18541 			ipaddr_t	v4mask;
18542 
18543 			v4mask = ip_net_mask(ipif->ipif_lcl_addr);
18544 			V4MASK_TO_V6(v4mask, ipif->ipif_v6net_mask);
18545 		}
18546 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
18547 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
18548 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
18549 		} else {
18550 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
18551 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
18552 		}
18553 		/*
18554 		 * NOTE: SunOS 4.X does this even if the broadcast address
18555 		 * has been already set thus we do the same here.
18556 		 */
18557 		if (ipif->ipif_flags & IPIF_BROADCAST) {
18558 			ipaddr_t	v4addr;
18559 
18560 			v4addr = ipif->ipif_subnet | ~ipif->ipif_net_mask;
18561 			IN6_IPADDR_TO_V4MAPPED(v4addr, &ipif->ipif_v6brd_addr);
18562 		}
18563 	} else {
18564 		/*
18565 		 * Interface holds an IPv6-only address.  Default
18566 		 * mask is all-ones.
18567 		 */
18568 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
18569 			ipif->ipif_v6net_mask = ipv6_all_ones;
18570 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
18571 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
18572 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
18573 		} else {
18574 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
18575 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
18576 		}
18577 	}
18578 }
18579 
18580 /*
18581  * Return 0 if this address can be used as local address without causing
18582  * duplicate address problems. Otherwise, return EADDRNOTAVAIL if the address
18583  * is already up on a different ill, and EADDRINUSE if it's up on the same ill.
18584  * Special checks are needed to allow the same IPv6 link-local address
18585  * on different ills.
18586  * TODO: allowing the same site-local address on different ill's.
18587  */
18588 int
18589 ip_addr_availability_check(ipif_t *new_ipif)
18590 {
18591 	in6_addr_t our_v6addr;
18592 	ill_t *ill;
18593 	ipif_t *ipif;
18594 	ill_walk_context_t ctx;
18595 
18596 	ASSERT(IAM_WRITER_IPIF(new_ipif));
18597 	ASSERT(MUTEX_HELD(&ip_addr_avail_lock));
18598 	ASSERT(RW_READ_HELD(&ill_g_lock));
18599 
18600 	new_ipif->ipif_flags &= ~IPIF_UNNUMBERED;
18601 	if (IN6_IS_ADDR_UNSPECIFIED(&new_ipif->ipif_v6lcl_addr) ||
18602 	    IN6_IS_ADDR_V4MAPPED_ANY(&new_ipif->ipif_v6lcl_addr))
18603 		return (0);
18604 
18605 	our_v6addr = new_ipif->ipif_v6lcl_addr;
18606 
18607 	if (new_ipif->ipif_isv6)
18608 		ill = ILL_START_WALK_V6(&ctx);
18609 	else
18610 		ill = ILL_START_WALK_V4(&ctx);
18611 
18612 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
18613 		for (ipif = ill->ill_ipif; ipif != NULL;
18614 		    ipif = ipif->ipif_next) {
18615 			if ((ipif == new_ipif) ||
18616 			    !(ipif->ipif_flags & IPIF_UP) ||
18617 			    (ipif->ipif_flags & IPIF_UNNUMBERED))
18618 				continue;
18619 			if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
18620 			    &our_v6addr)) {
18621 				if (new_ipif->ipif_flags & IPIF_POINTOPOINT)
18622 				    new_ipif->ipif_flags |= IPIF_UNNUMBERED;
18623 				else if (ipif->ipif_flags & IPIF_POINTOPOINT)
18624 				    ipif->ipif_flags |= IPIF_UNNUMBERED;
18625 				else if (IN6_IS_ADDR_LINKLOCAL(&our_v6addr) &&
18626 				    new_ipif->ipif_ill != ill)
18627 					continue;
18628 				else if (IN6_IS_ADDR_SITELOCAL(&our_v6addr) &&
18629 				    new_ipif->ipif_ill != ill)
18630 					continue;
18631 				else if (new_ipif->ipif_zoneid !=
18632 				    ipif->ipif_zoneid &&
18633 				    (ill->ill_phyint->phyint_flags &
18634 				    PHYI_LOOPBACK))
18635 					continue;
18636 				else if (new_ipif->ipif_ill == ill)
18637 					return (EADDRINUSE);
18638 				else
18639 					return (EADDRNOTAVAIL);
18640 			}
18641 		}
18642 	}
18643 
18644 	return (0);
18645 }
18646 
18647 /*
18648  * Bring up an ipif: bring up arp/ndp, bring up the DLPI stream, and add
18649  * IREs for the ipif.
18650  * When the routine returns EINPROGRESS then mp has been consumed and
18651  * the ioctl will be acked from ip_rput_dlpi.
18652  */
18653 static int
18654 ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp)
18655 {
18656 	ill_t	*ill = ipif->ipif_ill;
18657 	boolean_t isv6 = ipif->ipif_isv6;
18658 	int	err = 0;
18659 	boolean_t success;
18660 
18661 	ASSERT(IAM_WRITER_IPIF(ipif));
18662 
18663 	ip1dbg(("ipif_up(%s:%u)\n", ill->ill_name, ipif->ipif_id));
18664 
18665 	/* Shouldn't get here if it is already up. */
18666 	if (ipif->ipif_flags & IPIF_UP)
18667 		return (EALREADY);
18668 
18669 	/* Skip arp/ndp for any loopback interface. */
18670 	if (ill->ill_wq != NULL) {
18671 		conn_t *connp = Q_TO_CONN(q);
18672 		ipsq_t	*ipsq = ill->ill_phyint->phyint_ipsq;
18673 
18674 		if (!ill->ill_dl_up) {
18675 			/*
18676 			 * ill_dl_up is not yet set. i.e. we are yet to
18677 			 * DL_BIND with the driver and this is the first
18678 			 * logical interface on the ill to become "up".
18679 			 * Tell the driver to get going (via DL_BIND_REQ).
18680 			 * Note that changing "significant" IFF_ flags
18681 			 * address/netmask etc cause a down/up dance, but
18682 			 * does not cause an unbind (DL_UNBIND) with the driver
18683 			 */
18684 			return (ill_dl_up(ill, ipif, mp, q));
18685 		}
18686 
18687 		/*
18688 		 * ipif_resolver_up may end up sending an
18689 		 * AR_INTERFACE_UP message to ARP, which would, in
18690 		 * turn send a DLPI message to the driver. ioctls are
18691 		 * serialized and so we cannot send more than one
18692 		 * interface up message at a time. If ipif_resolver_up
18693 		 * does send an interface up message to ARP, we get
18694 		 * EINPROGRESS and we will complete in ip_arp_done.
18695 		 */
18696 
18697 		ASSERT(connp != NULL);
18698 		ASSERT(ipsq->ipsq_pending_mp == NULL);
18699 		mutex_enter(&connp->conn_lock);
18700 		mutex_enter(&ill->ill_lock);
18701 		success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
18702 		mutex_exit(&ill->ill_lock);
18703 		mutex_exit(&connp->conn_lock);
18704 		if (!success)
18705 			return (EINTR);
18706 
18707 		/*
18708 		 * Crank up IPv6 neighbor discovery
18709 		 * Unlike ARP, this should complete when
18710 		 * ipif_ndp_up returns. However, for
18711 		 * ILLF_XRESOLV interfaces we also send a
18712 		 * AR_INTERFACE_UP to the external resolver.
18713 		 * That ioctl will complete in ip_rput.
18714 		 */
18715 		if (isv6) {
18716 			err = ipif_ndp_up(ipif, &ipif->ipif_v6lcl_addr,
18717 			    B_FALSE);
18718 			if (err != 0) {
18719 				mp = ipsq_pending_mp_get(ipsq, &connp);
18720 				return (err);
18721 			}
18722 		}
18723 		/* Now, ARP */
18724 		if ((err = ipif_resolver_up(ipif, B_FALSE)) ==
18725 		    EINPROGRESS) {
18726 			/* We will complete it in ip_arp_done */
18727 			return (err);
18728 		}
18729 		mp = ipsq_pending_mp_get(ipsq, &connp);
18730 		ASSERT(mp != NULL);
18731 		if (err != 0)
18732 			return (err);
18733 	}
18734 	return (isv6 ? ipif_up_done_v6(ipif) : ipif_up_done(ipif));
18735 }
18736 
18737 /*
18738  * Perform a bind for the physical device.
18739  * When the routine returns EINPROGRESS then mp has been consumed and
18740  * the ioctl will be acked from ip_rput_dlpi.
18741  * Allocate an unbind message and save it until ipif_down.
18742  */
18743 static int
18744 ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
18745 {
18746 	mblk_t	*areq_mp = NULL;
18747 	mblk_t	*bind_mp = NULL;
18748 	mblk_t	*unbind_mp = NULL;
18749 	conn_t	*connp;
18750 	boolean_t success;
18751 
18752 	ip1dbg(("ill_dl_up(%s)\n", ill->ill_name));
18753 	ASSERT(IAM_WRITER_ILL(ill));
18754 
18755 	ASSERT(mp != NULL);
18756 
18757 	/* Create a resolver cookie for ARP */
18758 	if (!ill->ill_isv6 && ill->ill_net_type == IRE_IF_RESOLVER) {
18759 		areq_t		*areq;
18760 		uint16_t	sap_addr;
18761 
18762 		areq_mp = ill_arp_alloc(ill,
18763 			(uchar_t *)&ip_areq_template, 0);
18764 		if (areq_mp == NULL) {
18765 			return (ENOMEM);
18766 		}
18767 		freemsg(ill->ill_resolver_mp);
18768 		ill->ill_resolver_mp = areq_mp;
18769 		areq = (areq_t *)areq_mp->b_rptr;
18770 		sap_addr = ill->ill_sap;
18771 		bcopy(&sap_addr, areq->areq_sap, sizeof (sap_addr));
18772 		/*
18773 		 * Wait till we call ill_pending_mp_add to determine
18774 		 * the success before we free the ill_resolver_mp and
18775 		 * attach areq_mp in it's place.
18776 		 */
18777 	}
18778 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
18779 	    DL_BIND_REQ);
18780 	if (bind_mp == NULL)
18781 		goto bad;
18782 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
18783 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
18784 
18785 	unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ);
18786 	if (unbind_mp == NULL)
18787 		goto bad;
18788 
18789 	/*
18790 	 * Record state needed to complete this operation when the
18791 	 * DL_BIND_ACK shows up.  Also remember the pre-allocated mblks.
18792 	 */
18793 	if (WR(q)->q_next == NULL) {
18794 		connp = Q_TO_CONN(q);
18795 		mutex_enter(&connp->conn_lock);
18796 	} else {
18797 		connp = NULL;
18798 	}
18799 	mutex_enter(&ipif->ipif_ill->ill_lock);
18800 	success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
18801 	mutex_exit(&ipif->ipif_ill->ill_lock);
18802 	if (connp != NULL)
18803 		mutex_exit(&connp->conn_lock);
18804 	if (!success)
18805 		goto bad;
18806 
18807 	/*
18808 	 * Save the unbind message for ill_dl_down(); it will be consumed when
18809 	 * the interface goes down.
18810 	 */
18811 	ASSERT(ill->ill_unbind_mp == NULL);
18812 	ill->ill_unbind_mp = unbind_mp;
18813 
18814 	ill_dlpi_send(ill, bind_mp);
18815 	/* Send down link-layer capabilities probe if not already done. */
18816 	ill_capability_probe(ill);
18817 
18818 	/*
18819 	 * Sysid used to rely on the fact that netboots set domainname
18820 	 * and the like. Now that miniroot boots aren't strictly netboots
18821 	 * and miniroot network configuration is driven from userland
18822 	 * these things still need to be set. This situation can be detected
18823 	 * by comparing the interface being configured here to the one
18824 	 * dhcack was set to reference by the boot loader. Once sysid is
18825 	 * converted to use dhcp_ipc_getinfo() this call can go away.
18826 	 */
18827 	if ((ipif->ipif_flags & IPIF_DHCPRUNNING) && (dhcack != NULL) &&
18828 	    (strcmp(ill->ill_name, dhcack) == 0) &&
18829 	    (strlen(srpc_domain) == 0)) {
18830 		if (dhcpinit() != 0)
18831 			cmn_err(CE_WARN, "no cached dhcp response");
18832 	}
18833 
18834 	/*
18835 	 * This operation will complete in ip_rput_dlpi with either
18836 	 * a DL_BIND_ACK or DL_ERROR_ACK.
18837 	 */
18838 	return (EINPROGRESS);
18839 bad:
18840 	ip1dbg(("ill_dl_up(%s) FAILED\n", ill->ill_name));
18841 	/*
18842 	 * We don't have to check for possible removal from illgrp
18843 	 * as we have not yet inserted in illgrp. For groups
18844 	 * without names, this ipif is still not UP and hence
18845 	 * this could not have possibly had any influence in forming
18846 	 * groups.
18847 	 */
18848 
18849 	if (bind_mp != NULL)
18850 		freemsg(bind_mp);
18851 	if (unbind_mp != NULL)
18852 		freemsg(unbind_mp);
18853 	return (ENOMEM);
18854 }
18855 
18856 uint_t ip_loopback_mtuplus = IP_LOOPBACK_MTU + IP_SIMPLE_HDR_LENGTH + 20;
18857 
18858 /*
18859  * DLPI and ARP is up.
18860  * Create all the IREs associated with an interface bring up multicast.
18861  * Set the interface flag and finish other initialization
18862  * that potentially had to be differed to after DL_BIND_ACK.
18863  */
18864 int
18865 ipif_up_done(ipif_t *ipif)
18866 {
18867 	ire_t	*ire_array[20];
18868 	ire_t	**irep = ire_array;
18869 	ire_t	**irep1;
18870 	ipaddr_t net_mask = 0;
18871 	ipaddr_t subnet_mask, route_mask;
18872 	ill_t	*ill = ipif->ipif_ill;
18873 	queue_t	*stq;
18874 	ipif_t	 *src_ipif;
18875 	ipif_t   *tmp_ipif;
18876 	boolean_t	flush_ire_cache = B_TRUE;
18877 	int	err = 0;
18878 	phyint_t *phyi;
18879 	ire_t	**ipif_saved_irep = NULL;
18880 	int ipif_saved_ire_cnt;
18881 	int	cnt;
18882 	boolean_t	src_ipif_held = B_FALSE;
18883 	boolean_t	ire_added = B_FALSE;
18884 	boolean_t	loopback = B_FALSE;
18885 
18886 	ip1dbg(("ipif_up_done(%s:%u)\n",
18887 		ipif->ipif_ill->ill_name, ipif->ipif_id));
18888 	/* Check if this is a loopback interface */
18889 	if (ipif->ipif_ill->ill_wq == NULL)
18890 		loopback = B_TRUE;
18891 
18892 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
18893 	/*
18894 	 * If all other interfaces for this ill are down or DEPRECATED,
18895 	 * or otherwise unsuitable for source address selection, remove
18896 	 * any IRE_CACHE entries for this ill to make sure source
18897 	 * address selection gets to take this new ipif into account.
18898 	 * No need to hold ill_lock while traversing the ipif list since
18899 	 * we are writer
18900 	 */
18901 	for (tmp_ipif = ill->ill_ipif; tmp_ipif;
18902 		tmp_ipif = tmp_ipif->ipif_next) {
18903 		if (((tmp_ipif->ipif_flags &
18904 		    (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
18905 		    !(tmp_ipif->ipif_flags & IPIF_UP)) ||
18906 		    (tmp_ipif == ipif))
18907 			continue;
18908 		/* first useable pre-existing interface */
18909 		flush_ire_cache = B_FALSE;
18910 		break;
18911 	}
18912 	if (flush_ire_cache)
18913 		ire_walk_ill_v4(MATCH_IRE_ILL_GROUP | MATCH_IRE_TYPE,
18914 		    IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill);
18915 
18916 	/*
18917 	 * Figure out which way the send-to queue should go.  Only
18918 	 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER or IRE_LOOPBACK
18919 	 * should show up here.
18920 	 */
18921 	switch (ill->ill_net_type) {
18922 	case IRE_IF_RESOLVER:
18923 		stq = ill->ill_rq;
18924 		break;
18925 	case IRE_IF_NORESOLVER:
18926 	case IRE_LOOPBACK:
18927 		stq = ill->ill_wq;
18928 		break;
18929 	default:
18930 		return (EINVAL);
18931 	}
18932 
18933 	if (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK) {
18934 		/*
18935 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
18936 		 * ipif_lookup_on_name(), but in the case of zones we can have
18937 		 * several loopback addresses on lo0. So all the interfaces with
18938 		 * loopback addresses need to be marked IRE_LOOPBACK.
18939 		 */
18940 		if (V4_PART_OF_V6(ipif->ipif_v6lcl_addr) ==
18941 		    htonl(INADDR_LOOPBACK))
18942 			ipif->ipif_ire_type = IRE_LOOPBACK;
18943 		else
18944 			ipif->ipif_ire_type = IRE_LOCAL;
18945 	}
18946 
18947 	if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)) {
18948 		/*
18949 		 * Can't use our source address. Select a different
18950 		 * source address for the IRE_INTERFACE and IRE_LOCAL
18951 		 */
18952 		src_ipif = ipif_select_source(ipif->ipif_ill,
18953 		    ipif->ipif_subnet, ipif->ipif_zoneid);
18954 		if (src_ipif == NULL)
18955 			src_ipif = ipif;	/* Last resort */
18956 		else
18957 			src_ipif_held = B_TRUE;
18958 	} else {
18959 		src_ipif = ipif;
18960 	}
18961 
18962 	/* Create all the IREs associated with this interface */
18963 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
18964 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
18965 		/* Register the source address for __sin6_src_id */
18966 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
18967 		    ipif->ipif_zoneid);
18968 		if (err != 0) {
18969 			ip0dbg(("ipif_up_done: srcid_insert %d\n", err));
18970 			return (err);
18971 		}
18972 		/* If the interface address is set, create the local IRE. */
18973 		ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x for 0x%x\n",
18974 			(void *)ipif,
18975 			ipif->ipif_ire_type,
18976 			ntohl(ipif->ipif_lcl_addr)));
18977 		*irep++ = ire_create(
18978 		    (uchar_t *)&ipif->ipif_lcl_addr,	/* dest address */
18979 		    (uchar_t *)&ip_g_all_ones,		/* mask */
18980 		    (uchar_t *)&src_ipif->ipif_src_addr, /* source address */
18981 		    NULL,				/* no gateway */
18982 		    NULL,
18983 		    &ip_loopback_mtuplus,		/* max frag size */
18984 		    NULL,
18985 		    ipif->ipif_rq,			/* recv-from queue */
18986 		    NULL,				/* no send-to queue */
18987 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
18988 		    NULL,
18989 		    ipif,
18990 		    NULL,
18991 		    0,
18992 		    0,
18993 		    0,
18994 		    (ipif->ipif_flags & IPIF_PRIVATE) ?
18995 		    RTF_PRIVATE : 0,
18996 		    &ire_uinfo_null);
18997 	} else {
18998 		ip1dbg((
18999 		    "ipif_up_done: not creating IRE %d for 0x%x: flags 0x%x\n",
19000 		    ipif->ipif_ire_type,
19001 		    ntohl(ipif->ipif_lcl_addr),
19002 		    (uint_t)ipif->ipif_flags));
19003 	}
19004 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
19005 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
19006 		net_mask = ip_net_mask(ipif->ipif_lcl_addr);
19007 	} else {
19008 		net_mask = htonl(IN_CLASSA_NET);	/* fallback */
19009 	}
19010 
19011 	subnet_mask = ipif->ipif_net_mask;
19012 
19013 	/*
19014 	 * If mask was not specified, use natural netmask of
19015 	 * interface address. Also, store this mask back into the
19016 	 * ipif struct.
19017 	 */
19018 	if (subnet_mask == 0) {
19019 		subnet_mask = net_mask;
19020 		V4MASK_TO_V6(subnet_mask, ipif->ipif_v6net_mask);
19021 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
19022 		    ipif->ipif_v6subnet);
19023 	}
19024 
19025 	/* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */
19026 	if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) &&
19027 	    ipif->ipif_subnet != INADDR_ANY) {
19028 		/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
19029 
19030 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
19031 			route_mask = IP_HOST_MASK;
19032 		} else {
19033 			route_mask = subnet_mask;
19034 		}
19035 
19036 		ip1dbg(("ipif_up_done: ipif 0x%p ill 0x%p "
19037 		    "creating if IRE ill_net_type 0x%x for 0x%x\n",
19038 			(void *)ipif, (void *)ill,
19039 			ill->ill_net_type,
19040 			ntohl(ipif->ipif_subnet)));
19041 		*irep++ = ire_create(
19042 		    (uchar_t *)&ipif->ipif_subnet,	/* dest address */
19043 		    (uchar_t *)&route_mask,		/* mask */
19044 		    (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */
19045 		    NULL,				/* no gateway */
19046 		    NULL,
19047 		    &ipif->ipif_mtu,			/* max frag */
19048 		    NULL,
19049 		    NULL,				/* no recv queue */
19050 		    stq,				/* send-to queue */
19051 		    ill->ill_net_type,			/* IF_[NO]RESOLVER */
19052 		    ill->ill_resolver_mp,		/* xmit header */
19053 		    ipif,
19054 		    NULL,
19055 		    0,
19056 		    0,
19057 		    0,
19058 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE: 0,
19059 		    &ire_uinfo_null);
19060 	}
19061 
19062 	/*
19063 	 * If the interface address is set, create the broadcast IREs.
19064 	 *
19065 	 * ire_create_bcast checks if the proposed new IRE matches
19066 	 * any existing IRE's with the same physical interface (ILL).
19067 	 * This should get rid of duplicates.
19068 	 * ire_create_bcast also check IPIF_NOXMIT and does not create
19069 	 * any broadcast ires.
19070 	 */
19071 	if ((ipif->ipif_subnet != INADDR_ANY) &&
19072 	    (ipif->ipif_flags & IPIF_BROADCAST)) {
19073 		ipaddr_t addr;
19074 
19075 		ip1dbg(("ipif_up_done: creating broadcast IRE\n"));
19076 		irep = ire_check_and_create_bcast(ipif, 0, irep,
19077 		    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19078 		irep = ire_check_and_create_bcast(ipif, INADDR_BROADCAST, irep,
19079 		    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19080 
19081 		/*
19082 		 * For backward compatibility, we need to create net
19083 		 * broadcast ire's based on the old "IP address class
19084 		 * system."  The reason is that some old machines only
19085 		 * respond to these class derived net broadcast.
19086 		 *
19087 		 * But we should not create these net broadcast ire's if
19088 		 * the subnet_mask is shorter than the IP address class based
19089 		 * derived netmask.  Otherwise, we may create a net
19090 		 * broadcast address which is the same as an IP address
19091 		 * on the subnet.  Then TCP will refuse to talk to that
19092 		 * address.
19093 		 *
19094 		 * Nor do we need IRE_BROADCAST ire's for the interface
19095 		 * with the netmask as 0xFFFFFFFF, as IRE_LOCAL for that
19096 		 * interface is already created.  Creating these broadcast
19097 		 * ire's will only create confusion as the "addr" is going
19098 		 * to be same as that of the IP address of the interface.
19099 		 */
19100 		if (net_mask < subnet_mask) {
19101 			addr = net_mask & ipif->ipif_subnet;
19102 			irep = ire_check_and_create_bcast(ipif, addr, irep,
19103 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19104 			irep = ire_check_and_create_bcast(ipif,
19105 			    ~net_mask | addr, irep,
19106 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19107 		}
19108 
19109 		if (subnet_mask != 0xFFFFFFFF) {
19110 			addr = ipif->ipif_subnet;
19111 			irep = ire_check_and_create_bcast(ipif, addr, irep,
19112 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19113 			irep = ire_check_and_create_bcast(ipif,
19114 			    ~subnet_mask|addr, irep,
19115 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19116 		}
19117 	}
19118 
19119 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
19120 
19121 	/* If an earlier ire_create failed, get out now */
19122 	for (irep1 = irep; irep1 > ire_array; ) {
19123 		irep1--;
19124 		if (*irep1 == NULL) {
19125 			ip1dbg(("ipif_up_done: NULL ire found in ire_array\n"));
19126 			err = ENOMEM;
19127 			goto bad;
19128 		}
19129 	}
19130 
19131 	/*
19132 	 * Need to atomically check for ip_addr_availablity_check
19133 	 * under ip_addr_avail_lock, and if it fails got bad, and remove
19134 	 * from group also.The ill_g_lock is grabbed as reader
19135 	 * just to make sure no new ills or new ipifs are being added
19136 	 * to the system while we are checking the uniqueness of addresses.
19137 	 */
19138 	rw_enter(&ill_g_lock, RW_READER);
19139 	mutex_enter(&ip_addr_avail_lock);
19140 	/* Mark it up, and increment counters. */
19141 	ill->ill_ipif_up_count++;
19142 	ipif->ipif_flags |= IPIF_UP;
19143 	err = ip_addr_availability_check(ipif);
19144 	mutex_exit(&ip_addr_avail_lock);
19145 	rw_exit(&ill_g_lock);
19146 
19147 	if (err != 0) {
19148 		/*
19149 		 * Our address may already be up on the same ill. In this case,
19150 		 * the ARP entry for our ipif replaced the one for the other
19151 		 * ipif. So we don't want to delete it (otherwise the other ipif
19152 		 * would be unable to send packets).
19153 		 * ip_addr_availability_check() identifies this case for us and
19154 		 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL
19155 		 * which is the expected error code.
19156 		 */
19157 		if (err == EADDRINUSE) {
19158 			freemsg(ipif->ipif_arp_del_mp);
19159 			ipif->ipif_arp_del_mp = NULL;
19160 			err = EADDRNOTAVAIL;
19161 		}
19162 		ill->ill_ipif_up_count--;
19163 		ipif->ipif_flags &= ~IPIF_UP;
19164 		goto bad;
19165 	}
19166 
19167 	/*
19168 	 * Add in all newly created IREs.  ire_create_bcast() has
19169 	 * already checked for duplicates of the IRE_BROADCAST type.
19170 	 * We want to add before we call ifgrp_insert which wants
19171 	 * to know whether IRE_IF_RESOLVER exists or not.
19172 	 *
19173 	 * NOTE : We refrele the ire though we may branch to "bad"
19174 	 *	  later on where we do ire_delete. This is okay
19175 	 *	  because nobody can delete it as we are running
19176 	 *	  exclusively.
19177 	 */
19178 	for (irep1 = irep; irep1 > ire_array; ) {
19179 		irep1--;
19180 		ASSERT(!MUTEX_HELD(&((*irep1)->ire_ipif->ipif_ill->ill_lock)));
19181 		/*
19182 		 * refheld by ire_add. refele towards the end of the func
19183 		 */
19184 		(void) ire_add(irep1, NULL, NULL, NULL);
19185 	}
19186 	ire_added = B_TRUE;
19187 	/*
19188 	 * Form groups if possible.
19189 	 *
19190 	 * If we are supposed to be in a ill_group with a name, insert it
19191 	 * now as we know that at least one ipif is UP. Otherwise form
19192 	 * nameless groups.
19193 	 *
19194 	 * If ip_enable_group_ifs is set and ipif address is not 0, insert
19195 	 * this ipif into the appropriate interface group, or create a
19196 	 * new one. If this is already in a nameless group, we try to form
19197 	 * a bigger group looking at other ills potentially sharing this
19198 	 * ipif's prefix.
19199 	 */
19200 	phyi = ill->ill_phyint;
19201 	if (phyi->phyint_groupname_len != 0) {
19202 		ASSERT(phyi->phyint_groupname != NULL);
19203 		if (ill->ill_ipif_up_count == 1) {
19204 			ASSERT(ill->ill_group == NULL);
19205 			err = illgrp_insert(&illgrp_head_v4, ill,
19206 			    phyi->phyint_groupname, NULL, B_TRUE);
19207 			if (err != 0) {
19208 				ip1dbg(("ipif_up_done: illgrp allocation "
19209 				    "failed, error %d\n", err));
19210 				goto bad;
19211 			}
19212 		}
19213 		ASSERT(ill->ill_group != NULL);
19214 	}
19215 
19216 	/*
19217 	 * When this is part of group, we need to make sure that
19218 	 * any broadcast ires created because of this ipif coming
19219 	 * UP gets marked/cleared with IRE_MARK_NORECV appropriately
19220 	 * so that we don't receive duplicate broadcast packets.
19221 	 */
19222 	if (ill->ill_group != NULL && ill->ill_ipif_up_count != 0)
19223 		ipif_renominate_bcast(ipif);
19224 
19225 	/* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */
19226 	ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt;
19227 	ipif_saved_irep = ipif_recover_ire(ipif);
19228 
19229 	if (!loopback) {
19230 		/*
19231 		 * If the broadcast address has been set, make sure it makes
19232 		 * sense based on the interface address.
19233 		 * Only match on ill since we are sharing broadcast addresses.
19234 		 */
19235 		if ((ipif->ipif_brd_addr != INADDR_ANY) &&
19236 		    (ipif->ipif_flags & IPIF_BROADCAST)) {
19237 			ire_t	*ire;
19238 
19239 			ire = ire_ctable_lookup(ipif->ipif_brd_addr, 0,
19240 			    IRE_BROADCAST, ipif, ALL_ZONES,
19241 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19242 
19243 			if (ire == NULL) {
19244 				/*
19245 				 * If there isn't a matching broadcast IRE,
19246 				 * revert to the default for this netmask.
19247 				 */
19248 				ipif->ipif_v6brd_addr = ipv6_all_zeros;
19249 				mutex_enter(&ipif->ipif_ill->ill_lock);
19250 				ipif_set_default(ipif);
19251 				mutex_exit(&ipif->ipif_ill->ill_lock);
19252 			} else {
19253 				ire_refrele(ire);
19254 			}
19255 		}
19256 
19257 	}
19258 
19259 
19260 	/* This is the first interface on this ill */
19261 	if (ipif->ipif_ipif_up_count == 1 && !loopback) {
19262 		/*
19263 		 * Need to recover all multicast memberships in the driver.
19264 		 * This had to be deferred until we had attached.
19265 		 */
19266 		ill_recover_multicast(ill);
19267 	}
19268 	/* Join the allhosts multicast address */
19269 	ipif_multicast_up(ipif);
19270 
19271 	if (!loopback) {
19272 		/*
19273 		 * See whether anybody else would benefit from the
19274 		 * new ipif that we added. We call this always rather
19275 		 * than while adding a non-IPIF_NOLOCAL/DEPRECATED/ANYCAST
19276 		 * ipif is for the benefit of illgrp_insert (done above)
19277 		 * which does not do source address selection as it does
19278 		 * not want to re-create interface routes that we are
19279 		 * having reference to it here.
19280 		 */
19281 		ill_update_source_selection(ill);
19282 	}
19283 
19284 	for (irep1 = irep; irep1 > ire_array; ) {
19285 		irep1--;
19286 		if (*irep1 != NULL) {
19287 			/* was held in ire_add */
19288 			ire_refrele(*irep1);
19289 		}
19290 	}
19291 
19292 	cnt = ipif_saved_ire_cnt;
19293 	for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) {
19294 		if (*irep1 != NULL) {
19295 			/* was held in ire_add */
19296 			ire_refrele(*irep1);
19297 		}
19298 	}
19299 
19300 	/*
19301 	 * This had to be deferred until we had bound.
19302 	 * tell routing sockets that this interface is up
19303 	 */
19304 	ip_rts_ifmsg(ipif);
19305 	ip_rts_newaddrmsg(RTM_ADD, 0, ipif);
19306 
19307 	if (!loopback) {
19308 		/* Broadcast an address mask reply. */
19309 		ipif_mask_reply(ipif);
19310 	}
19311 	if (ipif_saved_irep != NULL) {
19312 		kmem_free(ipif_saved_irep,
19313 		    ipif_saved_ire_cnt * sizeof (ire_t *));
19314 	}
19315 	if (src_ipif_held)
19316 		ipif_refrele(src_ipif);
19317 	/* Let SCTP update the status for this ipif */
19318 	sctp_update_ipif(ipif, SCTP_IPIF_UP);
19319 	return (0);
19320 
19321 bad:
19322 	ip1dbg(("ipif_up_done: FAILED \n"));
19323 	/*
19324 	 * We don't have to bother removing from ill groups because
19325 	 *
19326 	 * 1) For groups with names, we insert only when the first ipif
19327 	 *    comes up. In that case if it fails, it will not be in any
19328 	 *    group. So, we need not try to remove for that case.
19329 	 *
19330 	 * 2) For groups without names, either we tried to insert ipif_ill
19331 	 *    in a group as singleton or found some other group to become
19332 	 *    a bigger group. For the former, if it fails we don't have
19333 	 *    anything to do as ipif_ill is not in the group and for the
19334 	 *    latter, there are no failures in illgrp_insert/illgrp_delete
19335 	 *    (ENOMEM can't occur for this. Check ifgrp_insert).
19336 	 */
19337 	while (irep > ire_array) {
19338 		irep--;
19339 		if (*irep != NULL) {
19340 			ire_delete(*irep);
19341 			if (ire_added)
19342 				ire_refrele(*irep);
19343 		}
19344 	}
19345 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid);
19346 
19347 	if (ipif_saved_irep != NULL) {
19348 		kmem_free(ipif_saved_irep,
19349 		    ipif_saved_ire_cnt * sizeof (ire_t *));
19350 	}
19351 	if (src_ipif_held)
19352 		ipif_refrele(src_ipif);
19353 
19354 	ipif_arp_down(ipif);
19355 	return (err);
19356 }
19357 
19358 /*
19359  * Turn off the ARP with the ILLF_NOARP flag.
19360  */
19361 static int
19362 ill_arp_off(ill_t *ill)
19363 {
19364 	mblk_t	*arp_off_mp = NULL;
19365 	mblk_t	*arp_on_mp = NULL;
19366 
19367 	ip1dbg(("ill_arp_off(%s)\n", ill->ill_name));
19368 
19369 	ASSERT(IAM_WRITER_ILL(ill));
19370 	ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
19371 
19372 	/*
19373 	 * If the on message is still around we've already done
19374 	 * an arp_off without doing an arp_on thus there is no
19375 	 * work needed.
19376 	 */
19377 	if (ill->ill_arp_on_mp != NULL)
19378 		return (0);
19379 
19380 	/*
19381 	 * Allocate an ARP on message (to be saved) and an ARP off message
19382 	 */
19383 	arp_off_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aroff_template, 0);
19384 	if (!arp_off_mp)
19385 		return (ENOMEM);
19386 
19387 	arp_on_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aron_template, 0);
19388 	if (!arp_on_mp)
19389 		goto failed;
19390 
19391 	ASSERT(ill->ill_arp_on_mp == NULL);
19392 	ill->ill_arp_on_mp = arp_on_mp;
19393 
19394 	/* Send an AR_INTERFACE_OFF request */
19395 	putnext(ill->ill_rq, arp_off_mp);
19396 	return (0);
19397 failed:
19398 
19399 	if (arp_off_mp)
19400 		freemsg(arp_off_mp);
19401 	return (ENOMEM);
19402 }
19403 
19404 /*
19405  * Turn on ARP by turning off the ILLF_NOARP flag.
19406  */
19407 static int
19408 ill_arp_on(ill_t *ill)
19409 {
19410 	mblk_t	*mp;
19411 
19412 	ip1dbg(("ipif_arp_on(%s)\n", ill->ill_name));
19413 
19414 	ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
19415 
19416 	ASSERT(IAM_WRITER_ILL(ill));
19417 	/*
19418 	 * Send an AR_INTERFACE_ON request if we have already done
19419 	 * an arp_off (which allocated the message).
19420 	 */
19421 	if (ill->ill_arp_on_mp != NULL) {
19422 		mp = ill->ill_arp_on_mp;
19423 		ill->ill_arp_on_mp = NULL;
19424 		putnext(ill->ill_rq, mp);
19425 	}
19426 	return (0);
19427 }
19428 
19429 /*
19430  * Called after either deleting ill from the group or when setting
19431  * FAILED or STANDBY on the interface.
19432  */
19433 static void
19434 illgrp_reset_schednext(ill_t *ill)
19435 {
19436 	ill_group_t *illgrp;
19437 	ill_t *save_ill;
19438 
19439 	ASSERT(IAM_WRITER_ILL(ill));
19440 	/*
19441 	 * When called from illgrp_delete, ill_group will be non-NULL.
19442 	 * But when called from ip_sioctl_flags, it could be NULL if
19443 	 * somebody is setting FAILED/INACTIVE on some interface which
19444 	 * is not part of a group.
19445 	 */
19446 	illgrp = ill->ill_group;
19447 	if (illgrp == NULL)
19448 		return;
19449 	if (illgrp->illgrp_ill_schednext != ill)
19450 		return;
19451 
19452 	illgrp->illgrp_ill_schednext = NULL;
19453 	save_ill = ill;
19454 	/*
19455 	 * Choose a good ill to be the next one for
19456 	 * outbound traffic. As the flags FAILED/STANDBY is
19457 	 * not yet marked when called from ip_sioctl_flags,
19458 	 * we check for ill separately.
19459 	 */
19460 	for (ill = illgrp->illgrp_ill; ill != NULL;
19461 	    ill = ill->ill_group_next) {
19462 		if ((ill != save_ill) &&
19463 		    !(ill->ill_phyint->phyint_flags &
19464 		    (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE))) {
19465 			illgrp->illgrp_ill_schednext = ill;
19466 			return;
19467 		}
19468 	}
19469 }
19470 
19471 /*
19472  * Given an ill, find the next ill in the group to be scheduled.
19473  * (This should be called by ip_newroute() before ire_create().)
19474  * The passed in ill may be pulled out of the group, after we have picked
19475  * up a different outgoing ill from the same group. However ire add will
19476  * atomically check this.
19477  */
19478 ill_t *
19479 illgrp_scheduler(ill_t *ill)
19480 {
19481 	ill_t *retill;
19482 	ill_group_t *illgrp;
19483 	int illcnt;
19484 	int i;
19485 	uint64_t flags;
19486 
19487 	/*
19488 	 * We don't use a lock to check for the ill_group. If this ill
19489 	 * is currently being inserted we may end up just returning this
19490 	 * ill itself. That is ok.
19491 	 */
19492 	if (ill->ill_group == NULL) {
19493 		ill_refhold(ill);
19494 		return (ill);
19495 	}
19496 
19497 	/*
19498 	 * Grab the ill_g_lock as reader to make sure we are dealing with
19499 	 * a set of stable ills. No ill can be added or deleted or change
19500 	 * group while we hold the reader lock.
19501 	 */
19502 	rw_enter(&ill_g_lock, RW_READER);
19503 	if ((illgrp = ill->ill_group) == NULL) {
19504 		rw_exit(&ill_g_lock);
19505 		ill_refhold(ill);
19506 		return (ill);
19507 	}
19508 
19509 	illcnt = illgrp->illgrp_ill_count;
19510 	mutex_enter(&illgrp->illgrp_lock);
19511 	retill = illgrp->illgrp_ill_schednext;
19512 
19513 	if (retill == NULL)
19514 		retill = illgrp->illgrp_ill;
19515 
19516 	/*
19517 	 * We do a circular search beginning at illgrp_ill_schednext
19518 	 * or illgrp_ill. We don't check the flags against the ill lock
19519 	 * since it can change anytime. The ire creation will be atomic
19520 	 * and will fail if the ill is FAILED or OFFLINE.
19521 	 */
19522 	for (i = 0; i < illcnt; i++) {
19523 		flags = retill->ill_phyint->phyint_flags;
19524 
19525 		if (!(flags & (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) &&
19526 		    ILL_CAN_LOOKUP(retill)) {
19527 			illgrp->illgrp_ill_schednext = retill->ill_group_next;
19528 			ill_refhold(retill);
19529 			break;
19530 		}
19531 		retill = retill->ill_group_next;
19532 		if (retill == NULL)
19533 			retill = illgrp->illgrp_ill;
19534 	}
19535 	mutex_exit(&illgrp->illgrp_lock);
19536 	rw_exit(&ill_g_lock);
19537 
19538 	return (i == illcnt ? NULL : retill);
19539 }
19540 
19541 /*
19542  * Checks for availbility of a usable source address (if there is one) when the
19543  * destination ILL has the ill_usesrc_ifindex pointing to another ILL. Note
19544  * this selection is done regardless of the destination.
19545  */
19546 boolean_t
19547 ipif_usesrc_avail(ill_t *ill, zoneid_t zoneid)
19548 {
19549 	uint_t	ifindex;
19550 	ipif_t	*ipif = NULL;
19551 	ill_t	*uill;
19552 	boolean_t isv6;
19553 
19554 	ASSERT(ill != NULL);
19555 
19556 	isv6 = ill->ill_isv6;
19557 	ifindex = ill->ill_usesrc_ifindex;
19558 	if (ifindex != 0) {
19559 		uill = ill_lookup_on_ifindex(ifindex, isv6, NULL, NULL, NULL,
19560 		    NULL);
19561 		if (uill == NULL)
19562 			return (NULL);
19563 		mutex_enter(&uill->ill_lock);
19564 		for (ipif = uill->ill_ipif; ipif != NULL;
19565 		    ipif = ipif->ipif_next) {
19566 			if (!IPIF_CAN_LOOKUP(ipif))
19567 				continue;
19568 			if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
19569 				continue;
19570 			if (!(ipif->ipif_flags & IPIF_UP))
19571 				continue;
19572 			if (ipif->ipif_zoneid != zoneid)
19573 				continue;
19574 			if ((isv6 &&
19575 			    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) ||
19576 			    (ipif->ipif_lcl_addr == INADDR_ANY))
19577 				continue;
19578 			mutex_exit(&uill->ill_lock);
19579 			ill_refrele(uill);
19580 			return (B_TRUE);
19581 		}
19582 		mutex_exit(&uill->ill_lock);
19583 		ill_refrele(uill);
19584 	}
19585 	return (B_FALSE);
19586 }
19587 
19588 /*
19589  * Determine the best source address given a destination address and an ill.
19590  * Prefers non-deprecated over deprecated but will return a deprecated
19591  * address if there is no other choice. If there is a usable source address
19592  * on the interface pointed to by ill_usesrc_ifindex then that is given
19593  * first preference.
19594  *
19595  * Returns NULL if there is no suitable source address for the ill.
19596  * This only occurs when there is no valid source address for the ill.
19597  */
19598 ipif_t *
19599 ipif_select_source(ill_t *ill, ipaddr_t dst, zoneid_t zoneid)
19600 {
19601 	ipif_t *ipif;
19602 	ipif_t *ipif_dep = NULL;	/* Fallback to deprecated */
19603 	ipif_t *ipif_arr[MAX_IPIF_SELECT_SOURCE];
19604 	int index = 0;
19605 	boolean_t wrapped = B_FALSE;
19606 	boolean_t same_subnet_only = B_FALSE;
19607 	boolean_t ipif_same_found, ipif_other_found;
19608 	ill_t	*till, *usill = NULL;
19609 
19610 	if (ill->ill_usesrc_ifindex != 0) {
19611 		usill = ill_lookup_on_ifindex(ill->ill_usesrc_ifindex, B_FALSE,
19612 		    NULL, NULL, NULL, NULL);
19613 		if (usill != NULL)
19614 			ill = usill;	/* Select source from usesrc ILL */
19615 		else
19616 			return (NULL);
19617 	}
19618 
19619 	/*
19620 	 * Holds the ill_g_lock as reader. This makes sure that no ipif/ill
19621 	 * can be deleted. But an ipif/ill can get CONDEMNED any time.
19622 	 * After selecting the right ipif, under ill_lock make sure ipif is
19623 	 * not condemned, and increment refcnt. If ipif is CONDEMNED,
19624 	 * we retry. Inside the loop we still need to check for CONDEMNED,
19625 	 * but not under a lock.
19626 	 */
19627 	rw_enter(&ill_g_lock, RW_READER);
19628 
19629 retry:
19630 	till = ill;
19631 	ipif_arr[0] = NULL;
19632 
19633 	if (till->ill_group != NULL)
19634 		till = till->ill_group->illgrp_ill;
19635 
19636 	/*
19637 	 * Choose one good source address from each ill across the group.
19638 	 * If possible choose a source address in the same subnet as
19639 	 * the destination address.
19640 	 *
19641 	 * We don't check for PHYI_FAILED or PHYI_INACTIVE or PHYI_OFFLINE
19642 	 * This is okay because of the following.
19643 	 *
19644 	 *    If PHYI_FAILED is set and we still have non-deprecated
19645 	 *    addresses, it means the addresses have not yet been
19646 	 *    failed over to a different interface. We potentially
19647 	 *    select them to create IRE_CACHES, which will be later
19648 	 *    flushed when the addresses move over.
19649 	 *
19650 	 *    If PHYI_INACTIVE is set and we still have non-deprecated
19651 	 *    addresses, it means either the user has configured them
19652 	 *    or PHYI_INACTIVE has not been cleared after the addresses
19653 	 *    been moved over. For the former, in.mpathd does a failover
19654 	 *    when the interface becomes INACTIVE and hence we should
19655 	 *    not find them. Once INACTIVE is set, we don't allow them
19656 	 *    to create logical interfaces anymore. For the latter, a
19657 	 *    flush will happen when INACTIVE is cleared which will
19658 	 *    flush the IRE_CACHES.
19659 	 *
19660 	 *    If PHYI_OFFLINE is set, all the addresses will be failed
19661 	 *    over soon. We potentially select them to create IRE_CACHEs,
19662 	 *    which will be later flushed when the addresses move over.
19663 	 *
19664 	 * NOTE : As ipif_select_source is called to borrow source address
19665 	 * for an ipif that is part of a group, source address selection
19666 	 * will be re-done whenever the group changes i.e either an
19667 	 * insertion/deletion in the group.
19668 	 *
19669 	 * Fill ipif_arr[] with source addresses, using these rules:
19670 	 *
19671 	 *	1. At most one source address from a given ill ends up
19672 	 *	   in ipif_arr[] -- that is, at most one of the ipif's
19673 	 *	   associated with a given ill ends up in ipif_arr[].
19674 	 *
19675 	 *	2. If there is at least one non-deprecated ipif in the
19676 	 *	   IPMP group with a source address on the same subnet as
19677 	 *	   our destination, then fill ipif_arr[] only with
19678 	 *	   source addresses on the same subnet as our destination.
19679 	 *	   Note that because of (1), only the first
19680 	 *	   non-deprecated ipif found with a source address
19681 	 *	   matching the destination ends up in ipif_arr[].
19682 	 *
19683 	 *	3. Otherwise, fill ipif_arr[] with non-deprecated source
19684 	 *	   addresses not in the same subnet as our destination.
19685 	 *	   Again, because of (1), only the first off-subnet source
19686 	 *	   address will be chosen.
19687 	 *
19688 	 *	4. If there are no non-deprecated ipifs, then just use
19689 	 *	   the source address associated with the last deprecated
19690 	 *	   one we find that happens to be on the same subnet,
19691 	 *	   otherwise the first one not in the same subnet.
19692 	 */
19693 	for (; till != NULL; till = till->ill_group_next) {
19694 		ipif_same_found = B_FALSE;
19695 		ipif_other_found = B_FALSE;
19696 		for (ipif = till->ill_ipif; ipif != NULL;
19697 		    ipif = ipif->ipif_next) {
19698 			if (!IPIF_CAN_LOOKUP(ipif))
19699 				continue;
19700 			/* Always skip NOLOCAL and ANYCAST interfaces */
19701 			if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
19702 				continue;
19703 			if (!(ipif->ipif_flags & IPIF_UP))
19704 				continue;
19705 			if (ipif->ipif_zoneid != zoneid)
19706 				continue;
19707 			/*
19708 			 * Interfaces with 0.0.0.0 address are allowed to be UP,
19709 			 * but are not valid as source addresses.
19710 			 */
19711 			if (ipif->ipif_lcl_addr == INADDR_ANY)
19712 				continue;
19713 			if (ipif->ipif_flags & IPIF_DEPRECATED) {
19714 				if (ipif_dep == NULL ||
19715 				    (ipif->ipif_net_mask & dst) ==
19716 				    ipif->ipif_subnet)
19717 					ipif_dep = ipif;
19718 				continue;
19719 			}
19720 			if ((ipif->ipif_net_mask & dst) == ipif->ipif_subnet) {
19721 				/* found a source address in the same subnet */
19722 				if (same_subnet_only == B_FALSE) {
19723 					same_subnet_only = B_TRUE;
19724 					index = 0;
19725 				}
19726 				ipif_same_found = B_TRUE;
19727 			} else {
19728 				if (same_subnet_only == B_TRUE ||
19729 				    ipif_other_found == B_TRUE)
19730 					continue;
19731 				ipif_other_found = B_TRUE;
19732 			}
19733 			ipif_arr[index++] = ipif;
19734 			if (index == MAX_IPIF_SELECT_SOURCE) {
19735 				wrapped = B_TRUE;
19736 				index = 0;
19737 			}
19738 			if (ipif_same_found == B_TRUE)
19739 				break;
19740 		}
19741 	}
19742 
19743 	if (ipif_arr[0] == NULL) {
19744 		ipif = ipif_dep;
19745 	} else {
19746 		if (wrapped)
19747 			index = MAX_IPIF_SELECT_SOURCE;
19748 		ipif = ipif_arr[ipif_rand() % index];
19749 		ASSERT(ipif != NULL);
19750 	}
19751 
19752 	if (ipif != NULL) {
19753 		mutex_enter(&ipif->ipif_ill->ill_lock);
19754 		if (!IPIF_CAN_LOOKUP(ipif)) {
19755 			mutex_exit(&ipif->ipif_ill->ill_lock);
19756 			goto retry;
19757 		}
19758 		ipif_refhold_locked(ipif);
19759 		mutex_exit(&ipif->ipif_ill->ill_lock);
19760 	}
19761 
19762 	rw_exit(&ill_g_lock);
19763 	if (usill != NULL)
19764 		ill_refrele(usill);
19765 
19766 #ifdef DEBUG
19767 	if (ipif == NULL) {
19768 		char buf1[INET6_ADDRSTRLEN];
19769 
19770 		ip1dbg(("ipif_select_source(%s, %s) -> NULL\n",
19771 		    ill->ill_name,
19772 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1))));
19773 	} else {
19774 		char buf1[INET6_ADDRSTRLEN];
19775 		char buf2[INET6_ADDRSTRLEN];
19776 
19777 		ip1dbg(("ipif_select_source(%s, %s) -> %s\n",
19778 		    ipif->ipif_ill->ill_name,
19779 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1)),
19780 		    inet_ntop(AF_INET, &ipif->ipif_lcl_addr,
19781 		    buf2, sizeof (buf2))));
19782 	}
19783 #endif /* DEBUG */
19784 	return (ipif);
19785 }
19786 
19787 
19788 /*
19789  * If old_ipif is not NULL, see if ipif was derived from old
19790  * ipif and if so, recreate the interface route by re-doing
19791  * source address selection. This happens when ipif_down ->
19792  * ipif_update_other_ipifs calls us.
19793  *
19794  * If old_ipif is NULL, just redo the source address selection
19795  * if needed. This happens when illgrp_insert or ipif_up_done
19796  * calls us.
19797  */
19798 static void
19799 ipif_recreate_interface_routes(ipif_t *old_ipif, ipif_t *ipif)
19800 {
19801 	ire_t *ire;
19802 	ire_t *ipif_ire;
19803 	queue_t *stq;
19804 	ipif_t *nipif;
19805 	ill_t *ill;
19806 	boolean_t need_rele = B_FALSE;
19807 
19808 	ASSERT(old_ipif == NULL || IAM_WRITER_IPIF(old_ipif));
19809 	ASSERT(IAM_WRITER_IPIF(ipif));
19810 
19811 	ill = ipif->ipif_ill;
19812 	if (!(ipif->ipif_flags &
19813 	    (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) {
19814 		/*
19815 		 * Can't possibly have borrowed the source
19816 		 * from old_ipif.
19817 		 */
19818 		return;
19819 	}
19820 
19821 	/*
19822 	 * Is there any work to be done? No work if the address
19823 	 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST (
19824 	 * ipif_select_source() does not borrow addresses from
19825 	 * NOLOCAL and ANYCAST interfaces).
19826 	 */
19827 	if ((old_ipif != NULL) &&
19828 	    ((old_ipif->ipif_lcl_addr == INADDR_ANY) ||
19829 	    (old_ipif->ipif_ill->ill_wq == NULL) ||
19830 	    (old_ipif->ipif_flags &
19831 	    (IPIF_NOLOCAL|IPIF_ANYCAST)))) {
19832 		return;
19833 	}
19834 
19835 	/*
19836 	 * Perform the same checks as when creating the
19837 	 * IRE_INTERFACE in ipif_up_done.
19838 	 */
19839 	if (!(ipif->ipif_flags & IPIF_UP))
19840 		return;
19841 
19842 	if ((ipif->ipif_flags & IPIF_NOXMIT) ||
19843 	    (ipif->ipif_subnet == INADDR_ANY))
19844 		return;
19845 
19846 	ipif_ire = ipif_to_ire(ipif);
19847 	if (ipif_ire == NULL)
19848 		return;
19849 
19850 	/*
19851 	 * We know that ipif uses some other source for its
19852 	 * IRE_INTERFACE. Is it using the source of this
19853 	 * old_ipif?
19854 	 */
19855 	if (old_ipif != NULL &&
19856 	    old_ipif->ipif_lcl_addr != ipif_ire->ire_src_addr) {
19857 		ire_refrele(ipif_ire);
19858 		return;
19859 	}
19860 	if (ip_debug > 2) {
19861 		/* ip1dbg */
19862 		pr_addr_dbg("ipif_recreate_interface_routes: deleting IRE for"
19863 		    " src %s\n", AF_INET, &ipif_ire->ire_src_addr);
19864 	}
19865 
19866 	stq = ipif_ire->ire_stq;
19867 
19868 	/*
19869 	 * Can't use our source address. Select a different
19870 	 * source address for the IRE_INTERFACE.
19871 	 */
19872 	nipif = ipif_select_source(ill, ipif->ipif_subnet, ipif->ipif_zoneid);
19873 	if (nipif == NULL) {
19874 		/* Last resort - all ipif's have IPIF_NOLOCAL */
19875 		nipif = ipif;
19876 	} else {
19877 		need_rele = B_TRUE;
19878 	}
19879 
19880 	ire = ire_create(
19881 	    (uchar_t *)&ipif->ipif_subnet,	/* dest pref */
19882 	    (uchar_t *)&ipif->ipif_net_mask,	/* mask */
19883 	    (uchar_t *)&nipif->ipif_src_addr,	/* src addr */
19884 	    NULL,				/* no gateway */
19885 	    NULL,
19886 	    &ipif->ipif_mtu,			/* max frag */
19887 	    NULL,				/* fast path header */
19888 	    NULL,				/* no recv from queue */
19889 	    stq,				/* send-to queue */
19890 	    ill->ill_net_type,			/* IF_[NO]RESOLVER */
19891 	    ill->ill_resolver_mp,		/* xmit header */
19892 	    ipif,
19893 	    NULL,
19894 	    0,
19895 	    0,
19896 	    0,
19897 	    0,
19898 	    &ire_uinfo_null);
19899 
19900 	if (ire != NULL) {
19901 		ire_t *ret_ire;
19902 		int error;
19903 
19904 		/*
19905 		 * We don't need ipif_ire anymore. We need to delete
19906 		 * before we add so that ire_add does not detect
19907 		 * duplicates.
19908 		 */
19909 		ire_delete(ipif_ire);
19910 		ret_ire = ire;
19911 		error = ire_add(&ret_ire, NULL, NULL, NULL);
19912 		ASSERT(error == 0);
19913 		ASSERT(ire == ret_ire);
19914 		/* Held in ire_add */
19915 		ire_refrele(ret_ire);
19916 	}
19917 	/*
19918 	 * Either we are falling through from above or could not
19919 	 * allocate a replacement.
19920 	 */
19921 	ire_refrele(ipif_ire);
19922 	if (need_rele)
19923 		ipif_refrele(nipif);
19924 }
19925 
19926 /*
19927  * This old_ipif is going away.
19928  *
19929  * Determine if any other ipif's is using our address as
19930  * ipif_lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or
19931  * IPIF_DEPRECATED).
19932  * Find the IRE_INTERFACE for such ipifs and recreate them
19933  * to use an different source address following the rules in
19934  * ipif_up_done.
19935  *
19936  * This function takes an illgrp as an argument so that illgrp_delete
19937  * can call this to update source address even after deleting the
19938  * old_ipif->ipif_ill from the ill group.
19939  */
19940 static void
19941 ipif_update_other_ipifs(ipif_t *old_ipif, ill_group_t *illgrp)
19942 {
19943 	ipif_t *ipif;
19944 	ill_t *ill;
19945 	char	buf[INET6_ADDRSTRLEN];
19946 
19947 	ASSERT(IAM_WRITER_IPIF(old_ipif));
19948 	ASSERT(illgrp == NULL || IAM_WRITER_IPIF(old_ipif));
19949 
19950 	ill = old_ipif->ipif_ill;
19951 
19952 	ip1dbg(("ipif_update_other_ipifs(%s, %s)\n",
19953 	    ill->ill_name,
19954 	    inet_ntop(AF_INET, &old_ipif->ipif_lcl_addr,
19955 	    buf, sizeof (buf))));
19956 	/*
19957 	 * If this part of a group, look at all ills as ipif_select_source
19958 	 * borrows source address across all the ills in the group.
19959 	 */
19960 	if (illgrp != NULL)
19961 		ill = illgrp->illgrp_ill;
19962 
19963 	for (; ill != NULL; ill = ill->ill_group_next) {
19964 		for (ipif = ill->ill_ipif; ipif != NULL;
19965 		    ipif = ipif->ipif_next) {
19966 
19967 			if (ipif == old_ipif)
19968 				continue;
19969 
19970 			ipif_recreate_interface_routes(old_ipif, ipif);
19971 		}
19972 	}
19973 }
19974 
19975 /* ARGSUSED */
19976 int
19977 if_unitsel_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
19978 	ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
19979 {
19980 	/*
19981 	 * ill_phyint_reinit merged the v4 and v6 into a single
19982 	 * ipsq. Could also have become part of a ipmp group in the
19983 	 * process, and we might not have been able to complete the
19984 	 * operation in ipif_set_values, if we could not become
19985 	 * exclusive.  If so restart it here.
19986 	 */
19987 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
19988 }
19989 
19990 
19991 /* ARGSUSED */
19992 int
19993 if_unitsel(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
19994     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
19995 {
19996 	queue_t		*q1 = q;
19997 	char 		*cp;
19998 	char		interf_name[LIFNAMSIZ];
19999 	uint_t		ppa = *(uint_t *)mp->b_cont->b_cont->b_rptr;
20000 
20001 	if (!q->q_next) {
20002 		ip1dbg((
20003 		    "if_unitsel: IF_UNITSEL: no q_next\n"));
20004 		return (EINVAL);
20005 	}
20006 
20007 	if (((ill_t *)(q->q_ptr))->ill_name[0] != '\0')
20008 		return (EALREADY);
20009 
20010 	do {
20011 		q1 = q1->q_next;
20012 	} while (q1->q_next);
20013 	cp = q1->q_qinfo->qi_minfo->mi_idname;
20014 	(void) sprintf(interf_name, "%s%d", cp, ppa);
20015 
20016 	/*
20017 	 * Here we are not going to delay the ioack until after
20018 	 * ACKs from DL_ATTACH_REQ/DL_BIND_REQ. So no need to save the
20019 	 * original ioctl message before sending the requests.
20020 	 */
20021 	return (ipif_set_values(q, mp, interf_name, &ppa));
20022 }
20023 
20024 /* ARGSUSED */
20025 int
20026 ip_sioctl_sifname(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
20027     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
20028 {
20029 	return (ENXIO);
20030 }
20031 
20032 /*
20033  * Net and subnet broadcast ire's are now specific to the particular
20034  * physical interface (ill) and not to any one locigal interface (ipif).
20035  * However, if a particular logical interface is being taken down, it's
20036  * associated ire's will be taken down as well.  Hence, when we go to
20037  * take down or change the local address, broadcast address or netmask
20038  * of a specific logical interface, we must check to make sure that we
20039  * have valid net and subnet broadcast ire's for the other logical
20040  * interfaces which may have been shared with the logical interface
20041  * being brought down or changed.
20042  *
20043  * There is one set of 0.0.0.0 and 255.255.255.255 per ill. Usually it
20044  * is tied to the first interface coming UP. If that ipif is going down,
20045  * we need to recreate them on the next valid ipif.
20046  *
20047  * Note: assume that the ipif passed in is still up so that it's IRE
20048  * entries are still valid.
20049  */
20050 static void
20051 ipif_check_bcast_ires(ipif_t *test_ipif)
20052 {
20053 	ipif_t	*ipif;
20054 	ire_t	*test_subnet_ire, *test_net_ire;
20055 	ire_t	*test_allzero_ire, *test_allone_ire;
20056 	ire_t	*ire_array[12];
20057 	ire_t	**irep = &ire_array[0];
20058 	ire_t	**irep1;
20059 
20060 	ipaddr_t net_addr, subnet_addr, net_mask, subnet_mask;
20061 	ipaddr_t test_net_addr, test_subnet_addr;
20062 	ipaddr_t test_net_mask, test_subnet_mask;
20063 	boolean_t need_net_bcast_ire = B_FALSE;
20064 	boolean_t need_subnet_bcast_ire = B_FALSE;
20065 	boolean_t allzero_bcast_ire_created = B_FALSE;
20066 	boolean_t allone_bcast_ire_created = B_FALSE;
20067 	boolean_t net_bcast_ire_created = B_FALSE;
20068 	boolean_t subnet_bcast_ire_created = B_FALSE;
20069 
20070 	ipif_t  *backup_ipif_net = (ipif_t *)NULL;
20071 	ipif_t  *backup_ipif_subnet = (ipif_t *)NULL;
20072 	ipif_t  *backup_ipif_allzeros = (ipif_t *)NULL;
20073 	ipif_t  *backup_ipif_allones = (ipif_t *)NULL;
20074 	uint64_t check_flags = IPIF_DEPRECATED | IPIF_NOLOCAL | IPIF_ANYCAST;
20075 
20076 	ASSERT(!test_ipif->ipif_isv6);
20077 	ASSERT(IAM_WRITER_IPIF(test_ipif));
20078 
20079 	/*
20080 	 * No broadcast IREs for the LOOPBACK interface
20081 	 * or others such as point to point and IPIF_NOXMIT.
20082 	 */
20083 	if (!(test_ipif->ipif_flags & IPIF_BROADCAST) ||
20084 	    (test_ipif->ipif_flags & IPIF_NOXMIT))
20085 		return;
20086 
20087 	test_allzero_ire = ire_ctable_lookup(0, 0, IRE_BROADCAST,
20088 	    test_ipif, ALL_ZONES, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
20089 
20090 	test_allone_ire = ire_ctable_lookup(INADDR_BROADCAST, 0, IRE_BROADCAST,
20091 	    test_ipif, ALL_ZONES, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
20092 
20093 	test_net_mask = ip_net_mask(test_ipif->ipif_subnet);
20094 	test_subnet_mask = test_ipif->ipif_net_mask;
20095 
20096 	/*
20097 	 * If no net mask set, assume the default based on net class.
20098 	 */
20099 	if (test_subnet_mask == 0)
20100 		test_subnet_mask = test_net_mask;
20101 
20102 	/*
20103 	 * Check if there is a network broadcast ire associated with this ipif
20104 	 */
20105 	test_net_addr = test_net_mask  & test_ipif->ipif_subnet;
20106 	test_net_ire = ire_ctable_lookup(test_net_addr, 0, IRE_BROADCAST,
20107 	    test_ipif, ALL_ZONES, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
20108 
20109 	/*
20110 	 * Check if there is a subnet broadcast IRE associated with this ipif
20111 	 */
20112 	test_subnet_addr = test_subnet_mask  & test_ipif->ipif_subnet;
20113 	test_subnet_ire = ire_ctable_lookup(test_subnet_addr, 0, IRE_BROADCAST,
20114 	    test_ipif, ALL_ZONES, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
20115 
20116 	/*
20117 	 * No broadcast ire's associated with this ipif.
20118 	 */
20119 	if ((test_subnet_ire == NULL) && (test_net_ire == NULL) &&
20120 	    (test_allzero_ire == NULL) && (test_allone_ire == NULL)) {
20121 		return;
20122 	}
20123 
20124 	/*
20125 	 * We have established which bcast ires have to be replaced.
20126 	 * Next we try to locate ipifs that match there ires.
20127 	 * The rules are simple: If we find an ipif that matches on the subnet
20128 	 * address it will also match on the net address, the allzeros and
20129 	 * allones address. Any ipif that matches only on the net address will
20130 	 * also match the allzeros and allones addresses.
20131 	 * The other criterion is the ipif_flags. We look for non-deprecated
20132 	 * (and non-anycast and non-nolocal) ipifs as the best choice.
20133 	 * ipifs with check_flags matching (deprecated, etc) are used only
20134 	 * if good ipifs are not available. While looping, we save existing
20135 	 * deprecated ipifs as backup_ipif.
20136 	 * We loop through all the ipifs for this ill looking for ipifs
20137 	 * whose broadcast addr match the ipif passed in, but do not have
20138 	 * their own broadcast ires. For creating 0.0.0.0 and
20139 	 * 255.255.255.255 we just need an ipif on this ill to create.
20140 	 */
20141 	for (ipif = test_ipif->ipif_ill->ill_ipif; ipif != NULL;
20142 	    ipif = ipif->ipif_next) {
20143 
20144 		ASSERT(!ipif->ipif_isv6);
20145 		/*
20146 		 * Already checked the ipif passed in.
20147 		 */
20148 		if (ipif == test_ipif) {
20149 			continue;
20150 		}
20151 
20152 		/*
20153 		 * We only need to recreate broadcast ires if another ipif in
20154 		 * the same zone uses them. The new ires must be created in the
20155 		 * same zone.
20156 		 */
20157 		if (ipif->ipif_zoneid != test_ipif->ipif_zoneid) {
20158 			continue;
20159 		}
20160 
20161 		/*
20162 		 * Only interested in logical interfaces with valid local
20163 		 * addresses or with the ability to broadcast.
20164 		 */
20165 		if ((ipif->ipif_subnet == 0) ||
20166 		    !(ipif->ipif_flags & IPIF_BROADCAST) ||
20167 		    (ipif->ipif_flags & IPIF_NOXMIT) ||
20168 		    !(ipif->ipif_flags & IPIF_UP)) {
20169 			continue;
20170 		}
20171 		/*
20172 		 * Check if there is a net broadcast ire for this
20173 		 * net address.  If it turns out that the ipif we are
20174 		 * about to take down owns this ire, we must make a
20175 		 * new one because it is potentially going away.
20176 		 */
20177 		if (test_net_ire && (!net_bcast_ire_created)) {
20178 			net_mask = ip_net_mask(ipif->ipif_subnet);
20179 			net_addr = net_mask & ipif->ipif_subnet;
20180 			if (net_addr == test_net_addr) {
20181 				need_net_bcast_ire = B_TRUE;
20182 				/*
20183 				 * Use DEPRECATED ipif only if no good
20184 				 * ires are available. subnet_addr is
20185 				 * a better match than net_addr.
20186 				 */
20187 				if ((ipif->ipif_flags & check_flags) &&
20188 				    (backup_ipif_net == NULL)) {
20189 					backup_ipif_net = ipif;
20190 				}
20191 			}
20192 		}
20193 		/*
20194 		 * Check if there is a subnet broadcast ire for this
20195 		 * net address.  If it turns out that the ipif we are
20196 		 * about to take down owns this ire, we must make a
20197 		 * new one because it is potentially going away.
20198 		 */
20199 		if (test_subnet_ire && (!subnet_bcast_ire_created)) {
20200 			subnet_mask = ipif->ipif_net_mask;
20201 			subnet_addr = ipif->ipif_subnet;
20202 			if (subnet_addr == test_subnet_addr) {
20203 				need_subnet_bcast_ire = B_TRUE;
20204 				if ((ipif->ipif_flags & check_flags) &&
20205 				    (backup_ipif_subnet == NULL)) {
20206 					backup_ipif_subnet = ipif;
20207 				}
20208 			}
20209 		}
20210 
20211 
20212 		/* Short circuit here if this ipif is deprecated */
20213 		if (ipif->ipif_flags & check_flags) {
20214 			if ((test_allzero_ire != NULL) &&
20215 			    (!allzero_bcast_ire_created) &&
20216 			    (backup_ipif_allzeros == NULL)) {
20217 				backup_ipif_allzeros = ipif;
20218 			}
20219 			if ((test_allone_ire != NULL) &&
20220 			    (!allone_bcast_ire_created) &&
20221 			    (backup_ipif_allones == NULL)) {
20222 				backup_ipif_allones = ipif;
20223 			}
20224 			continue;
20225 		}
20226 
20227 		/*
20228 		 * Found an ipif which has the same broadcast ire as the
20229 		 * ipif passed in and the ipif passed in "owns" the ire.
20230 		 * Create new broadcast ire's for this broadcast addr.
20231 		 */
20232 		if (need_net_bcast_ire && !net_bcast_ire_created) {
20233 			irep = ire_create_bcast(ipif, net_addr, irep);
20234 			irep = ire_create_bcast(ipif,
20235 			    ~net_mask | net_addr, irep);
20236 			net_bcast_ire_created = B_TRUE;
20237 		}
20238 		if (need_subnet_bcast_ire && !subnet_bcast_ire_created) {
20239 			irep = ire_create_bcast(ipif, subnet_addr, irep);
20240 			irep = ire_create_bcast(ipif,
20241 			    ~subnet_mask | subnet_addr, irep);
20242 			subnet_bcast_ire_created = B_TRUE;
20243 		}
20244 		if (test_allzero_ire != NULL && !allzero_bcast_ire_created) {
20245 			irep = ire_create_bcast(ipif, 0, irep);
20246 			allzero_bcast_ire_created = B_TRUE;
20247 		}
20248 		if (test_allone_ire != NULL && !allone_bcast_ire_created) {
20249 			irep = ire_create_bcast(ipif, INADDR_BROADCAST, irep);
20250 			allone_bcast_ire_created = B_TRUE;
20251 		}
20252 		/*
20253 		 * Once we have created all the appropriate ires, we
20254 		 * just break out of this loop to add what we have created.
20255 		 * This has been indented similar to ire_match_args for
20256 		 * readability.
20257 		 */
20258 		if (((test_net_ire == NULL) ||
20259 			(net_bcast_ire_created)) &&
20260 		    ((test_subnet_ire == NULL) ||
20261 			(subnet_bcast_ire_created)) &&
20262 		    ((test_allzero_ire == NULL) ||
20263 			(allzero_bcast_ire_created)) &&
20264 		    ((test_allone_ire == NULL) ||
20265 			(allone_bcast_ire_created))) {
20266 			break;
20267 		}
20268 	}
20269 
20270 	/*
20271 	 * Create bcast ires on deprecated ipifs if no non-deprecated ipifs
20272 	 * exist. 6 pairs of bcast ires are needed.
20273 	 * Note - the old ires are deleted in ipif_down.
20274 	 */
20275 	if (need_net_bcast_ire && !net_bcast_ire_created && backup_ipif_net) {
20276 		ipif = backup_ipif_net;
20277 		irep = ire_create_bcast(ipif, net_addr, irep);
20278 		irep = ire_create_bcast(ipif, ~net_mask | net_addr, irep);
20279 		net_bcast_ire_created = B_TRUE;
20280 	}
20281 	if (need_subnet_bcast_ire && !subnet_bcast_ire_created &&
20282 	    backup_ipif_subnet) {
20283 		ipif = backup_ipif_subnet;
20284 		irep = ire_create_bcast(ipif, subnet_addr, irep);
20285 		irep = ire_create_bcast(ipif,
20286 		    ~subnet_mask | subnet_addr, irep);
20287 		subnet_bcast_ire_created = B_TRUE;
20288 	}
20289 	if (test_allzero_ire != NULL && !allzero_bcast_ire_created &&
20290 	    backup_ipif_allzeros) {
20291 		irep = ire_create_bcast(backup_ipif_allzeros, 0, irep);
20292 		allzero_bcast_ire_created = B_TRUE;
20293 	}
20294 	if (test_allone_ire != NULL && !allone_bcast_ire_created &&
20295 	    backup_ipif_allones) {
20296 		irep = ire_create_bcast(backup_ipif_allones,
20297 		    INADDR_BROADCAST, irep);
20298 		allone_bcast_ire_created = B_TRUE;
20299 	}
20300 
20301 	/*
20302 	 * If we can't create all of them, don't add any of them.
20303 	 * Code in ip_wput_ire and ire_to_ill assumes that we
20304 	 * always have a non-loopback copy and loopback copy
20305 	 * for a given address.
20306 	 */
20307 	for (irep1 = irep; irep1 > ire_array; ) {
20308 		irep1--;
20309 		if (*irep1 == NULL) {
20310 			ip0dbg(("ipif_check_bcast_ires: can't create "
20311 			    "IRE_BROADCAST, memory allocation failure\n"));
20312 			while (irep > ire_array) {
20313 				irep--;
20314 				if (*irep != NULL)
20315 					ire_delete(*irep);
20316 			}
20317 			goto bad;
20318 		}
20319 	}
20320 	for (irep1 = irep; irep1 > ire_array; ) {
20321 		int error;
20322 
20323 		irep1--;
20324 		error = ire_add(irep1, NULL, NULL, NULL);
20325 		if (error == 0) {
20326 			ire_refrele(*irep1);		/* Held in ire_add */
20327 		}
20328 	}
20329 bad:
20330 	if (test_allzero_ire != NULL)
20331 		ire_refrele(test_allzero_ire);
20332 	if (test_allone_ire != NULL)
20333 		ire_refrele(test_allone_ire);
20334 	if (test_net_ire != NULL)
20335 		ire_refrele(test_net_ire);
20336 	if (test_subnet_ire != NULL)
20337 		ire_refrele(test_subnet_ire);
20338 }
20339 
20340 /*
20341  * Extract both the flags (including IFF_CANTCHANGE) such as IFF_IPV*
20342  * from lifr_flags and the name from lifr_name.
20343  * Set IFF_IPV* and ill_isv6 prior to doing the lookup
20344  * since ipif_lookup_on_name uses the _isv6 flags when matching.
20345  * Returns EINPROGRESS when mp has been consumed by queueing it on
20346  * ill_pending_mp and the ioctl will complete in ip_rput.
20347  */
20348 /* ARGSUSED */
20349 int
20350 ip_sioctl_slifname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20351     ip_ioctl_cmd_t *ipip, void *if_req)
20352 {
20353 	int	err;
20354 	ill_t	*ill;
20355 	struct lifreq *lifr = (struct lifreq *)if_req;
20356 
20357 	ASSERT(ipif != NULL);
20358 	ip1dbg(("ip_sioctl_slifname %s\n", lifr->lifr_name));
20359 	ASSERT(q->q_next != NULL);
20360 
20361 	ill = (ill_t *)q->q_ptr;
20362 	/*
20363 	 * If we are not writer on 'q' then this interface exists already
20364 	 * and previous lookups (ipif_extract_lifreq_cmn) found this ipif.
20365 	 * So return EALREADY
20366 	 */
20367 	if (ill != ipif->ipif_ill)
20368 		return (EALREADY);
20369 
20370 	if (ill->ill_name[0] != '\0')
20371 		return (EALREADY);
20372 
20373 	/*
20374 	 * Set all the flags. Allows all kinds of override. Provide some
20375 	 * sanity checking by not allowing IFF_BROADCAST and IFF_MULTICAST
20376 	 * unless there is either multicast/broadcast support in the driver
20377 	 * or it is a pt-pt link.
20378 	 */
20379 	if (lifr->lifr_flags & (IFF_PROMISC|IFF_ALLMULTI)) {
20380 		/* Meaningless to IP thus don't allow them to be set. */
20381 		ip1dbg(("ip_setname: EINVAL 1\n"));
20382 		return (EINVAL);
20383 	}
20384 	/*
20385 	 * For a DL_STYLE2 driver (ill_needs_attach), we would not have the
20386 	 * ill_bcast_addr_length info.
20387 	 */
20388 	if (!ill->ill_needs_attach &&
20389 	    ((lifr->lifr_flags & IFF_MULTICAST) &&
20390 	    !(lifr->lifr_flags & IFF_POINTOPOINT) &&
20391 	    ill->ill_bcast_addr_length == 0)) {
20392 		/* Link not broadcast/pt-pt capable i.e. no multicast */
20393 		ip1dbg(("ip_setname: EINVAL 2\n"));
20394 		return (EINVAL);
20395 	}
20396 	if ((lifr->lifr_flags & IFF_BROADCAST) &&
20397 	    ((lifr->lifr_flags & IFF_IPV6) ||
20398 	    (!ill->ill_needs_attach && ill->ill_bcast_addr_length == 0))) {
20399 		/* Link not broadcast capable or IPv6 i.e. no broadcast */
20400 		ip1dbg(("ip_setname: EINVAL 3\n"));
20401 		return (EINVAL);
20402 	}
20403 	if (lifr->lifr_flags & IFF_UP) {
20404 		/* Can only be set with SIOCSLIFFLAGS */
20405 		ip1dbg(("ip_setname: EINVAL 4\n"));
20406 		return (EINVAL);
20407 	}
20408 	if ((lifr->lifr_flags & (IFF_IPV6|IFF_IPV4)) != IFF_IPV6 &&
20409 	    (lifr->lifr_flags & (IFF_IPV6|IFF_IPV4)) != IFF_IPV4) {
20410 		ip1dbg(("ip_setname: EINVAL 5\n"));
20411 		return (EINVAL);
20412 	}
20413 	/*
20414 	 * Only allow the IFF_XRESOLV flag to be set on IPv6 interfaces.
20415 	 */
20416 	if ((lifr->lifr_flags & IFF_XRESOLV) &&
20417 	    !(lifr->lifr_flags & IFF_IPV6) &&
20418 	    !(ipif->ipif_isv6)) {
20419 		ip1dbg(("ip_setname: EINVAL 6\n"));
20420 		return (EINVAL);
20421 	}
20422 
20423 	/*
20424 	 * The user has done SIOCGLIFFLAGS prior to this ioctl and hence
20425 	 * we have all the flags here. So, we assign rather than we OR.
20426 	 * We can't OR the flags here because we don't want to set
20427 	 * both IFF_IPV4 and IFF_IPV6. We start off as IFF_IPV4 in
20428 	 * ipif_allocate and become IFF_IPV4 or IFF_IPV6 here depending
20429 	 * on lifr_flags value here.
20430 	 */
20431 	/*
20432 	 * This ill has not been inserted into the global list.
20433 	 * So we are still single threaded and don't need any lock
20434 	 */
20435 	ipif->ipif_flags = lifr->lifr_flags & IFF_LOGINT_FLAGS;
20436 	ill->ill_flags = lifr->lifr_flags & IFF_PHYINTINST_FLAGS;
20437 	ill->ill_phyint->phyint_flags = lifr->lifr_flags & IFF_PHYINT_FLAGS;
20438 
20439 	/* We started off as V4. */
20440 	if (ill->ill_flags & ILLF_IPV6) {
20441 		ill->ill_phyint->phyint_illv6 = ill;
20442 		ill->ill_phyint->phyint_illv4 = NULL;
20443 	}
20444 	err = ipif_set_values(q, mp, lifr->lifr_name, &lifr->lifr_ppa);
20445 	return (err);
20446 }
20447 
20448 /* ARGSUSED */
20449 int
20450 ip_sioctl_slifname_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20451     ip_ioctl_cmd_t *ipip, void *if_req)
20452 {
20453 	/*
20454 	 * ill_phyint_reinit merged the v4 and v6 into a single
20455 	 * ipsq. Could also have become part of a ipmp group in the
20456 	 * process, and we might not have been able to complete the
20457 	 * slifname in ipif_set_values, if we could not become
20458 	 * exclusive.  If so restart it here
20459 	 */
20460 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
20461 }
20462 
20463 /*
20464  * Return a pointer to the ipif which matches the index, IP version type and
20465  * zoneid.
20466  */
20467 ipif_t *
20468 ipif_lookup_on_ifindex(uint_t index, boolean_t isv6, zoneid_t zoneid,
20469     queue_t *q, mblk_t *mp, ipsq_func_t func, int *err)
20470 {
20471 	ill_t	*ill;
20472 	ipsq_t  *ipsq;
20473 	phyint_t *phyi;
20474 	ipif_t	*ipif;
20475 
20476 	ASSERT((q == NULL && mp == NULL && func == NULL && err == NULL) ||
20477 	    (q != NULL && mp != NULL && func != NULL && err != NULL));
20478 
20479 	if (err != NULL)
20480 		*err = 0;
20481 
20482 	/*
20483 	 * Indexes are stored in the phyint - a common structure
20484 	 * to both IPv4 and IPv6.
20485 	 */
20486 
20487 	rw_enter(&ill_g_lock, RW_READER);
20488 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_index,
20489 	    (void *) &index, NULL);
20490 	if (phyi != NULL) {
20491 		ill = isv6 ? phyi->phyint_illv6 : phyi->phyint_illv4;
20492 		if (ill == NULL) {
20493 			rw_exit(&ill_g_lock);
20494 			if (err != NULL)
20495 				*err = ENXIO;
20496 			return (NULL);
20497 		}
20498 		GRAB_CONN_LOCK(q);
20499 		mutex_enter(&ill->ill_lock);
20500 		if (ILL_CAN_LOOKUP(ill)) {
20501 			for (ipif = ill->ill_ipif; ipif != NULL;
20502 			    ipif = ipif->ipif_next) {
20503 				if (IPIF_CAN_LOOKUP(ipif) &&
20504 				    (zoneid == ALL_ZONES ||
20505 				    zoneid == ipif->ipif_zoneid)) {
20506 					ipif_refhold_locked(ipif);
20507 					mutex_exit(&ill->ill_lock);
20508 					RELEASE_CONN_LOCK(q);
20509 					rw_exit(&ill_g_lock);
20510 					return (ipif);
20511 				}
20512 			}
20513 		} else if (ILL_CAN_WAIT(ill, q)) {
20514 			ipsq = ill->ill_phyint->phyint_ipsq;
20515 			mutex_enter(&ipsq->ipsq_lock);
20516 			rw_exit(&ill_g_lock);
20517 			mutex_exit(&ill->ill_lock);
20518 			ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
20519 			mutex_exit(&ipsq->ipsq_lock);
20520 			RELEASE_CONN_LOCK(q);
20521 			*err = EINPROGRESS;
20522 			return (NULL);
20523 		}
20524 		mutex_exit(&ill->ill_lock);
20525 		RELEASE_CONN_LOCK(q);
20526 	}
20527 	rw_exit(&ill_g_lock);
20528 	if (err != NULL)
20529 		*err = ENXIO;
20530 	return (NULL);
20531 }
20532 
20533 typedef struct conn_change_s {
20534 	uint_t cc_old_ifindex;
20535 	uint_t cc_new_ifindex;
20536 } conn_change_t;
20537 
20538 /*
20539  * ipcl_walk function for changing interface index.
20540  */
20541 static void
20542 conn_change_ifindex(conn_t *connp, caddr_t arg)
20543 {
20544 	conn_change_t *connc;
20545 	uint_t old_ifindex;
20546 	uint_t new_ifindex;
20547 	int i;
20548 	ilg_t *ilg;
20549 
20550 	connc = (conn_change_t *)arg;
20551 	old_ifindex = connc->cc_old_ifindex;
20552 	new_ifindex = connc->cc_new_ifindex;
20553 
20554 	if (connp->conn_orig_bound_ifindex == old_ifindex)
20555 		connp->conn_orig_bound_ifindex = new_ifindex;
20556 
20557 	if (connp->conn_orig_multicast_ifindex == old_ifindex)
20558 		connp->conn_orig_multicast_ifindex = new_ifindex;
20559 
20560 	if (connp->conn_orig_xmit_ifindex == old_ifindex)
20561 		connp->conn_orig_xmit_ifindex = new_ifindex;
20562 
20563 	for (i = connp->conn_ilg_inuse - 1; i >= 0; i--) {
20564 		ilg = &connp->conn_ilg[i];
20565 		if (ilg->ilg_orig_ifindex == old_ifindex)
20566 			ilg->ilg_orig_ifindex = new_ifindex;
20567 	}
20568 }
20569 
20570 /*
20571  * Walk all the ipifs and ilms on this ill and change the orig_ifindex
20572  * to new_index if it matches the old_index.
20573  *
20574  * Failovers typically happen within a group of ills. But somebody
20575  * can remove an ill from the group after a failover happened. If
20576  * we are setting the ifindex after this, we potentially need to
20577  * look at all the ills rather than just the ones in the group.
20578  * We cut down the work by looking at matching ill_net_types
20579  * and ill_types as we could not possibly grouped them together.
20580  */
20581 static void
20582 ip_change_ifindex(ill_t *ill_orig, conn_change_t *connc)
20583 {
20584 	ill_t *ill;
20585 	ipif_t *ipif;
20586 	uint_t old_ifindex;
20587 	uint_t new_ifindex;
20588 	ilm_t *ilm;
20589 	ill_walk_context_t ctx;
20590 
20591 	old_ifindex = connc->cc_old_ifindex;
20592 	new_ifindex = connc->cc_new_ifindex;
20593 
20594 	rw_enter(&ill_g_lock, RW_READER);
20595 	ill = ILL_START_WALK_ALL(&ctx);
20596 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
20597 		if ((ill_orig->ill_net_type != ill->ill_net_type) ||
20598 			(ill_orig->ill_type != ill->ill_type)) {
20599 			continue;
20600 		}
20601 		for (ipif = ill->ill_ipif; ipif != NULL;
20602 				ipif = ipif->ipif_next) {
20603 			if (ipif->ipif_orig_ifindex == old_ifindex)
20604 				ipif->ipif_orig_ifindex = new_ifindex;
20605 		}
20606 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
20607 			if (ilm->ilm_orig_ifindex == old_ifindex)
20608 				ilm->ilm_orig_ifindex = new_ifindex;
20609 		}
20610 	}
20611 	rw_exit(&ill_g_lock);
20612 }
20613 
20614 /*
20615  * We first need to ensure that the new index is unique, and
20616  * then carry the change across both v4 and v6 ill representation
20617  * of the physical interface.
20618  */
20619 /* ARGSUSED */
20620 int
20621 ip_sioctl_slifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20622     ip_ioctl_cmd_t *ipip, void *ifreq)
20623 {
20624 	ill_t		*ill;
20625 	ill_t		*ill_other;
20626 	phyint_t	*phyi;
20627 	int		old_index;
20628 	conn_change_t	connc;
20629 	struct ifreq	*ifr = (struct ifreq *)ifreq;
20630 	struct lifreq	*lifr = (struct lifreq *)ifreq;
20631 	uint_t	index;
20632 	ill_t	*ill_v4;
20633 	ill_t	*ill_v6;
20634 
20635 	if (ipip->ipi_cmd_type == IF_CMD)
20636 		index = ifr->ifr_index;
20637 	else
20638 		index = lifr->lifr_index;
20639 
20640 	/*
20641 	 * Only allow on physical interface. Also, index zero is illegal.
20642 	 *
20643 	 * Need to check for PHYI_FAILED and PHYI_INACTIVE
20644 	 *
20645 	 * 1) If PHYI_FAILED is set, a failover could have happened which
20646 	 *    implies a possible failback might have to happen. As failback
20647 	 *    depends on the old index, we should fail setting the index.
20648 	 *
20649 	 * 2) If PHYI_INACTIVE is set, in.mpathd does a failover so that
20650 	 *    any addresses or multicast memberships are failed over to
20651 	 *    a non-STANDBY interface. As failback depends on the old
20652 	 *    index, we should fail setting the index for this case also.
20653 	 *
20654 	 * 3) If PHYI_OFFLINE is set, a possible failover has happened.
20655 	 *    Be consistent with PHYI_FAILED and fail the ioctl.
20656 	 */
20657 	ill = ipif->ipif_ill;
20658 	phyi = ill->ill_phyint;
20659 	if ((phyi->phyint_flags & (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) ||
20660 	    ipif->ipif_id != 0 || index == 0) {
20661 		return (EINVAL);
20662 	}
20663 	old_index = phyi->phyint_ifindex;
20664 
20665 	/* If the index is not changing, no work to do */
20666 	if (old_index == index)
20667 		return (0);
20668 
20669 	/*
20670 	 * Use ill_lookup_on_ifindex to determine if the
20671 	 * new index is unused and if so allow the change.
20672 	 */
20673 	ill_v6 = ill_lookup_on_ifindex(index, B_TRUE, NULL, NULL, NULL, NULL);
20674 	ill_v4 = ill_lookup_on_ifindex(index, B_FALSE, NULL, NULL, NULL, NULL);
20675 	if (ill_v6 != NULL || ill_v4 != NULL) {
20676 		if (ill_v4 != NULL)
20677 			ill_refrele(ill_v4);
20678 		if (ill_v6 != NULL)
20679 			ill_refrele(ill_v6);
20680 		return (EBUSY);
20681 	}
20682 
20683 	/*
20684 	 * The new index is unused. Set it in the phyint.
20685 	 * Locate the other ill so that we can send a routing
20686 	 * sockets message.
20687 	 */
20688 	if (ill->ill_isv6) {
20689 		ill_other = phyi->phyint_illv4;
20690 	} else {
20691 		ill_other = phyi->phyint_illv6;
20692 	}
20693 
20694 	phyi->phyint_ifindex = index;
20695 
20696 	connc.cc_old_ifindex = old_index;
20697 	connc.cc_new_ifindex = index;
20698 	ip_change_ifindex(ill, &connc);
20699 	ipcl_walk(conn_change_ifindex, (caddr_t)&connc);
20700 
20701 	/* Send the routing sockets message */
20702 	ip_rts_ifmsg(ipif);
20703 	if (ill_other != NULL)
20704 		ip_rts_ifmsg(ill_other->ill_ipif);
20705 
20706 	return (0);
20707 }
20708 
20709 /* ARGSUSED */
20710 int
20711 ip_sioctl_get_lifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20712     ip_ioctl_cmd_t *ipip, void *ifreq)
20713 {
20714 	struct ifreq	*ifr = (struct ifreq *)ifreq;
20715 	struct lifreq	*lifr = (struct lifreq *)ifreq;
20716 
20717 	ip1dbg(("ip_sioctl_get_lifindex(%s:%u %p)\n",
20718 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
20719 	/* Get the interface index */
20720 	if (ipip->ipi_cmd_type == IF_CMD) {
20721 		ifr->ifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
20722 	} else {
20723 		lifr->lifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
20724 	}
20725 	return (0);
20726 }
20727 
20728 /* ARGSUSED */
20729 int
20730 ip_sioctl_get_lifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20731     ip_ioctl_cmd_t *ipip, void *ifreq)
20732 {
20733 	struct lifreq	*lifr = (struct lifreq *)ifreq;
20734 
20735 	ip1dbg(("ip_sioctl_get_lifzone(%s:%u %p)\n",
20736 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
20737 	/* Get the interface zone */
20738 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
20739 	lifr->lifr_zoneid = ipif->ipif_zoneid;
20740 	return (0);
20741 }
20742 
20743 /*
20744  * Set the zoneid of an interface.
20745  */
20746 /* ARGSUSED */
20747 int
20748 ip_sioctl_slifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20749     ip_ioctl_cmd_t *ipip, void *ifreq)
20750 {
20751 	struct lifreq	*lifr = (struct lifreq *)ifreq;
20752 	int err = 0;
20753 	boolean_t need_up = B_FALSE;
20754 	zone_t *zptr;
20755 	zone_status_t status;
20756 	zoneid_t zoneid;
20757 
20758 	/* cannot assign instance zero to a non-global zone */
20759 	if (ipif->ipif_id == 0)
20760 		return (ENOTSUP);
20761 
20762 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
20763 	zoneid = lifr->lifr_zoneid;
20764 
20765 	/*
20766 	 * Cannot assign to a zone that doesn't exist or is shutting down.  In
20767 	 * the event of a race with the zone shutdown processing, since IP
20768 	 * serializes this ioctl and SIOCGLIFCONF/SIOCLIFREMOVEIF, we know the
20769 	 * interface will be cleaned up even if the zone is shut down
20770 	 * immediately after the status check. If the interface can't be brought
20771 	 * down right away, and the zone is shut down before the restart
20772 	 * function is called, we resolve the possible races by rechecking the
20773 	 * zone status in the restart function.
20774 	 */
20775 	if ((zptr = zone_find_by_id(zoneid)) == NULL)
20776 		return (EINVAL);
20777 	status = zone_status_get(zptr);
20778 	zone_rele(zptr);
20779 
20780 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING)
20781 		return (EINVAL);
20782 
20783 	if (ipif->ipif_flags & IPIF_UP) {
20784 		/*
20785 		 * If the interface is already marked up,
20786 		 * we call ipif_down which will take care
20787 		 * of ditching any IREs that have been set
20788 		 * up based on the old interface address.
20789 		 */
20790 		err = ipif_logical_down(ipif, q, mp);
20791 		if (err == EINPROGRESS)
20792 			return (err);
20793 		ipif_down_tail(ipif);
20794 		need_up = B_TRUE;
20795 	}
20796 
20797 	err = ip_sioctl_slifzone_tail(ipif, zoneid, q, mp, need_up);
20798 	return (err);
20799 }
20800 
20801 static int
20802 ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
20803     queue_t *q, mblk_t *mp, boolean_t need_up)
20804 {
20805 	int	err = 0;
20806 
20807 	ip1dbg(("ip_sioctl_zoneid_tail(%s:%u %p)\n",
20808 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
20809 
20810 	/* Set the new zone id. */
20811 	ipif->ipif_zoneid = zoneid;
20812 
20813 	/* Update sctp list */
20814 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
20815 
20816 	if (need_up) {
20817 		/*
20818 		 * Now bring the interface back up.  If this
20819 		 * is the only IPIF for the ILL, ipif_up
20820 		 * will have to re-bind to the device, so
20821 		 * we may get back EINPROGRESS, in which
20822 		 * case, this IOCTL will get completed in
20823 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
20824 		 */
20825 		err = ipif_up(ipif, q, mp);
20826 	}
20827 	return (err);
20828 }
20829 
20830 /* ARGSUSED */
20831 int
20832 ip_sioctl_slifzone_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20833     ip_ioctl_cmd_t *ipip, void *if_req)
20834 {
20835 	struct lifreq *lifr = (struct lifreq *)if_req;
20836 	zoneid_t zoneid;
20837 	zone_t *zptr;
20838 	zone_status_t status;
20839 
20840 	ASSERT(ipif->ipif_id != 0);
20841 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
20842 	zoneid = lifr->lifr_zoneid;
20843 
20844 	ip1dbg(("ip_sioctl_slifzone_restart(%s:%u %p)\n",
20845 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
20846 
20847 	/*
20848 	 * We recheck the zone status to resolve the following race condition:
20849 	 * 1) process sends SIOCSLIFZONE to put hme0:1 in zone "myzone";
20850 	 * 2) hme0:1 is up and can't be brought down right away;
20851 	 * ip_sioctl_slifzone() returns EINPROGRESS and the request is queued;
20852 	 * 3) zone "myzone" is halted; the zone status switches to
20853 	 * 'shutting_down' and the zones framework sends SIOCGLIFCONF to list
20854 	 * the interfaces to remove - hme0:1 is not returned because it's not
20855 	 * yet in "myzone", so it won't be removed;
20856 	 * 4) the restart function for SIOCSLIFZONE is called; without the
20857 	 * status check here, we would have hme0:1 in "myzone" after it's been
20858 	 * destroyed.
20859 	 * Note that if the status check fails, we need to bring the interface
20860 	 * back to its state prior to ip_sioctl_slifzone(), hence the call to
20861 	 * ipif_up_done[_v6]().
20862 	 */
20863 	status = ZONE_IS_UNINITIALIZED;
20864 	if ((zptr = zone_find_by_id(zoneid)) != NULL) {
20865 		status = zone_status_get(zptr);
20866 		zone_rele(zptr);
20867 	}
20868 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING) {
20869 		if (ipif->ipif_isv6) {
20870 			(void) ipif_up_done_v6(ipif);
20871 		} else {
20872 			(void) ipif_up_done(ipif);
20873 		}
20874 		return (EINVAL);
20875 	}
20876 
20877 	ipif_down_tail(ipif);
20878 
20879 	return (ip_sioctl_slifzone_tail(ipif, zoneid, q, mp, B_TRUE));
20880 }
20881 
20882 /* ARGSUSED */
20883 int
20884 ip_sioctl_get_lifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20885 	ip_ioctl_cmd_t *ipip, void *ifreq)
20886 {
20887 	struct lifreq	*lifr = ifreq;
20888 
20889 	ASSERT(q->q_next == NULL);
20890 	ASSERT(CONN_Q(q));
20891 
20892 	ip1dbg(("ip_sioctl_get_lifusesrc(%s:%u %p)\n",
20893 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
20894 	lifr->lifr_index = ipif->ipif_ill->ill_usesrc_ifindex;
20895 	ip1dbg(("ip_sioctl_get_lifusesrc:lifr_index = %d\n", lifr->lifr_index));
20896 
20897 	return (0);
20898 }
20899 
20900 
20901 /* Find the previous ILL in this usesrc group */
20902 static ill_t *
20903 ill_prev_usesrc(ill_t *uill)
20904 {
20905 	ill_t *ill;
20906 
20907 	for (ill = uill->ill_usesrc_grp_next;
20908 	    ASSERT(ill), ill->ill_usesrc_grp_next != uill;
20909 	    ill = ill->ill_usesrc_grp_next)
20910 		/* do nothing */;
20911 	return (ill);
20912 }
20913 
20914 /*
20915  * Release all members of the usesrc group. This routine is called
20916  * from ill_delete when the interface being unplumbed is the
20917  * group head.
20918  */
20919 static void
20920 ill_disband_usesrc_group(ill_t *uill)
20921 {
20922 	ill_t *next_ill, *tmp_ill;
20923 	ASSERT(RW_WRITE_HELD(&ill_g_usesrc_lock));
20924 	next_ill = uill->ill_usesrc_grp_next;
20925 
20926 	do {
20927 		ASSERT(next_ill != NULL);
20928 		tmp_ill = next_ill->ill_usesrc_grp_next;
20929 		ASSERT(tmp_ill != NULL);
20930 		next_ill->ill_usesrc_grp_next = NULL;
20931 		next_ill->ill_usesrc_ifindex = 0;
20932 		next_ill = tmp_ill;
20933 	} while (next_ill->ill_usesrc_ifindex != 0);
20934 	uill->ill_usesrc_grp_next = NULL;
20935 }
20936 
20937 /*
20938  * Remove the client usesrc ILL from the list and relink to a new list
20939  */
20940 int
20941 ill_relink_usesrc_ills(ill_t *ucill, ill_t *uill, uint_t ifindex)
20942 {
20943 	ill_t *ill, *tmp_ill;
20944 
20945 	ASSERT((ucill != NULL) && (ucill->ill_usesrc_grp_next != NULL) &&
20946 	    (uill != NULL) && RW_WRITE_HELD(&ill_g_usesrc_lock));
20947 
20948 	/*
20949 	 * Check if the usesrc client ILL passed in is not already
20950 	 * in use as a usesrc ILL i.e one whose source address is
20951 	 * in use OR a usesrc ILL is not already in use as a usesrc
20952 	 * client ILL
20953 	 */
20954 	if ((ucill->ill_usesrc_ifindex == 0) ||
20955 	    (uill->ill_usesrc_ifindex != 0)) {
20956 		return (-1);
20957 	}
20958 
20959 	ill = ill_prev_usesrc(ucill);
20960 	ASSERT(ill->ill_usesrc_grp_next != NULL);
20961 
20962 	/* Remove from the current list */
20963 	if (ill->ill_usesrc_grp_next->ill_usesrc_grp_next == ill) {
20964 		/* Only two elements in the list */
20965 		ASSERT(ill->ill_usesrc_ifindex == 0);
20966 		ill->ill_usesrc_grp_next = NULL;
20967 	} else {
20968 		ill->ill_usesrc_grp_next = ucill->ill_usesrc_grp_next;
20969 	}
20970 
20971 	if (ifindex == 0) {
20972 		ucill->ill_usesrc_ifindex = 0;
20973 		ucill->ill_usesrc_grp_next = NULL;
20974 		return (0);
20975 	}
20976 
20977 	ucill->ill_usesrc_ifindex = ifindex;
20978 	tmp_ill = uill->ill_usesrc_grp_next;
20979 	uill->ill_usesrc_grp_next = ucill;
20980 	ucill->ill_usesrc_grp_next =
20981 	    (tmp_ill != NULL) ? tmp_ill : uill;
20982 	return (0);
20983 }
20984 
20985 /*
20986  * Set the ill_usesrc and ill_usesrc_head fields. See synchronization notes in
20987  * ip.c for locking details.
20988  */
20989 /* ARGSUSED */
20990 int
20991 ip_sioctl_slifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
20992     ip_ioctl_cmd_t *ipip, void *ifreq)
20993 {
20994 	struct lifreq *lifr = (struct lifreq *)ifreq;
20995 	boolean_t isv6 = B_FALSE, reset_flg = B_FALSE,
20996 	    ill_flag_changed = B_FALSE;
20997 	ill_t *usesrc_ill, *usesrc_cli_ill = ipif->ipif_ill;
20998 	int err = 0, ret;
20999 	uint_t ifindex;
21000 	phyint_t *us_phyint, *us_cli_phyint;
21001 	ipsq_t *ipsq = NULL;
21002 
21003 	ASSERT(IAM_WRITER_IPIF(ipif));
21004 	ASSERT(q->q_next == NULL);
21005 	ASSERT(CONN_Q(q));
21006 
21007 	isv6 = (Q_TO_CONN(q))->conn_af_isv6;
21008 	us_cli_phyint = usesrc_cli_ill->ill_phyint;
21009 
21010 	ASSERT(us_cli_phyint != NULL);
21011 
21012 	/*
21013 	 * If the client ILL is being used for IPMP, abort.
21014 	 * Note, this can be done before ipsq_try_enter since we are already
21015 	 * exclusive on this ILL
21016 	 */
21017 	if ((us_cli_phyint->phyint_groupname != NULL) ||
21018 	    (us_cli_phyint->phyint_flags & PHYI_STANDBY)) {
21019 		return (EINVAL);
21020 	}
21021 
21022 	ifindex = lifr->lifr_index;
21023 	if (ifindex == 0) {
21024 		if (usesrc_cli_ill->ill_usesrc_grp_next == NULL) {
21025 			/* non usesrc group interface, nothing to reset */
21026 			return (0);
21027 		}
21028 		ifindex = usesrc_cli_ill->ill_usesrc_ifindex;
21029 		/* valid reset request */
21030 		reset_flg = B_TRUE;
21031 	}
21032 
21033 	usesrc_ill = ill_lookup_on_ifindex(ifindex, isv6, q, mp,
21034 	    ip_process_ioctl, &err);
21035 
21036 	if (usesrc_ill == NULL) {
21037 		return (err);
21038 	}
21039 
21040 	/*
21041 	 * The usesrc_cli_ill or the usesrc_ill cannot be part of an IPMP
21042 	 * group nor can either of the interfaces be used for standy. So
21043 	 * to guarantee mutual exclusion with ip_sioctl_flags (which sets
21044 	 * PHYI_STANDBY) and ip_sioctl_groupname (which sets the groupname)
21045 	 * we need to be exclusive on the ipsq belonging to the usesrc_ill.
21046 	 * We are already exlusive on this ipsq i.e ipsq corresponding to
21047 	 * the usesrc_cli_ill
21048 	 */
21049 	ipsq = ipsq_try_enter(NULL, usesrc_ill, q, mp, ip_process_ioctl,
21050 	    NEW_OP, B_TRUE);
21051 	if (ipsq == NULL) {
21052 		err = EINPROGRESS;
21053 		/* Operation enqueued on the ipsq of the usesrc ILL */
21054 		goto done;
21055 	}
21056 
21057 	/* Check if the usesrc_ill is used for IPMP */
21058 	us_phyint = usesrc_ill->ill_phyint;
21059 	if ((us_phyint->phyint_groupname != NULL) ||
21060 	    (us_phyint->phyint_flags & PHYI_STANDBY)) {
21061 		err = EINVAL;
21062 		goto done;
21063 	}
21064 
21065 	/*
21066 	 * If the client is already in use as a usesrc_ill or a usesrc_ill is
21067 	 * already a client then return EINVAL
21068 	 */
21069 	if (IS_USESRC_ILL(usesrc_cli_ill) || IS_USESRC_CLI_ILL(usesrc_ill)) {
21070 		err = EINVAL;
21071 		goto done;
21072 	}
21073 
21074 	/*
21075 	 * If the ill_usesrc_ifindex field is already set to what it needs to
21076 	 * be then this is a duplicate operation.
21077 	 */
21078 	if (!reset_flg && usesrc_cli_ill->ill_usesrc_ifindex == ifindex) {
21079 		err = 0;
21080 		goto done;
21081 	}
21082 
21083 	ip1dbg(("ip_sioctl_slifusesrc: usesrc_cli_ill %s, usesrc_ill %s,"
21084 	    " v6 = %d", usesrc_cli_ill->ill_name, usesrc_ill->ill_name,
21085 	    usesrc_ill->ill_isv6));
21086 
21087 	/*
21088 	 * The next step ensures that no new ires will be created referencing
21089 	 * the client ill, until the ILL_CHANGING flag is cleared. Then
21090 	 * we go through an ire walk deleting all ire caches that reference
21091 	 * the client ill. New ires referencing the client ill that are added
21092 	 * to the ire table before the ILL_CHANGING flag is set, will be
21093 	 * cleaned up by the ire walk below. Attempt to add new ires referencing
21094 	 * the client ill while the ILL_CHANGING flag is set will be failed
21095 	 * during the ire_add in ire_atomic_start. ire_atomic_start atomically
21096 	 * checks (under the ill_g_usesrc_lock) that the ire being added
21097 	 * is not stale, i.e the ire_stq and ire_ipif are consistent and
21098 	 * belong to the same usesrc group.
21099 	 */
21100 	mutex_enter(&usesrc_cli_ill->ill_lock);
21101 	usesrc_cli_ill->ill_state_flags |= ILL_CHANGING;
21102 	mutex_exit(&usesrc_cli_ill->ill_lock);
21103 	ill_flag_changed = B_TRUE;
21104 
21105 	if (ipif->ipif_isv6)
21106 		ire_walk_v6(ipif_delete_cache_ire, (char *)usesrc_cli_ill,
21107 		    ALL_ZONES);
21108 	else
21109 		ire_walk_v4(ipif_delete_cache_ire, (char *)usesrc_cli_ill,
21110 		    ALL_ZONES);
21111 
21112 	/*
21113 	 * ill_g_usesrc_lock global lock protects the ill_usesrc_grp_next
21114 	 * and the ill_usesrc_ifindex fields
21115 	 */
21116 	rw_enter(&ill_g_usesrc_lock, RW_WRITER);
21117 
21118 	if (reset_flg) {
21119 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill, 0);
21120 		if (ret != 0) {
21121 			err = EINVAL;
21122 		}
21123 		rw_exit(&ill_g_usesrc_lock);
21124 		goto done;
21125 	}
21126 
21127 	/*
21128 	 * Four possibilities to consider:
21129 	 * 1. Both usesrc_ill and usesrc_cli_ill are not part of any usesrc grp
21130 	 * 2. usesrc_ill is part of a group but usesrc_cli_ill isn't
21131 	 * 3. usesrc_cli_ill is part of a group but usesrc_ill isn't
21132 	 * 4. Both are part of their respective usesrc groups
21133 	 */
21134 	if ((usesrc_ill->ill_usesrc_grp_next == NULL) &&
21135 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
21136 		ASSERT(usesrc_ill->ill_usesrc_ifindex == 0);
21137 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
21138 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
21139 		usesrc_cli_ill->ill_usesrc_grp_next = usesrc_ill;
21140 	} else if ((usesrc_ill->ill_usesrc_grp_next != NULL) &&
21141 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
21142 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
21143 		/* Insert at head of list */
21144 		usesrc_cli_ill->ill_usesrc_grp_next =
21145 		    usesrc_ill->ill_usesrc_grp_next;
21146 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
21147 	} else {
21148 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill,
21149 		    ifindex);
21150 		if (ret != 0)
21151 			err = EINVAL;
21152 	}
21153 	rw_exit(&ill_g_usesrc_lock);
21154 
21155 done:
21156 	if (ill_flag_changed) {
21157 		mutex_enter(&usesrc_cli_ill->ill_lock);
21158 		usesrc_cli_ill->ill_state_flags &= ~ILL_CHANGING;
21159 		mutex_exit(&usesrc_cli_ill->ill_lock);
21160 	}
21161 	if (ipsq != NULL)
21162 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
21163 	/* The refrele on the lifr_name ipif is done by ip_process_ioctl */
21164 	ill_refrele(usesrc_ill);
21165 	return (err);
21166 }
21167 
21168 /*
21169  * comparison function used by avl.
21170  */
21171 static int
21172 ill_phyint_compare_index(const void *index_ptr, const void *phyip)
21173 {
21174 
21175 	uint_t index;
21176 
21177 	ASSERT(phyip != NULL && index_ptr != NULL);
21178 
21179 	index = *((uint_t *)index_ptr);
21180 	/*
21181 	 * let the phyint with the lowest index be on top.
21182 	 */
21183 	if (((phyint_t *)phyip)->phyint_ifindex < index)
21184 		return (1);
21185 	if (((phyint_t *)phyip)->phyint_ifindex > index)
21186 		return (-1);
21187 	return (0);
21188 }
21189 
21190 /*
21191  * comparison function used by avl.
21192  */
21193 static int
21194 ill_phyint_compare_name(const void *name_ptr, const void *phyip)
21195 {
21196 	ill_t *ill;
21197 	int res = 0;
21198 
21199 	ASSERT(phyip != NULL && name_ptr != NULL);
21200 
21201 	if (((phyint_t *)phyip)->phyint_illv4)
21202 		ill = ((phyint_t *)phyip)->phyint_illv4;
21203 	else
21204 		ill = ((phyint_t *)phyip)->phyint_illv6;
21205 	ASSERT(ill != NULL);
21206 
21207 	res = strcmp(ill->ill_name, (char *)name_ptr);
21208 	if (res > 0)
21209 		return (1);
21210 	else if (res < 0)
21211 		return (-1);
21212 	return (0);
21213 }
21214 /*
21215  * This function is called from ill_delete when the ill is being
21216  * unplumbed. We remove the reference from the phyint and we also
21217  * free the phyint when there are no more references to it.
21218  */
21219 static void
21220 ill_phyint_free(ill_t *ill)
21221 {
21222 	phyint_t *phyi;
21223 	phyint_t *next_phyint;
21224 	ipsq_t *cur_ipsq;
21225 
21226 	ASSERT(ill->ill_phyint != NULL);
21227 
21228 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
21229 	phyi = ill->ill_phyint;
21230 	ill->ill_phyint = NULL;
21231 	/*
21232 	 * ill_init allocates a phyint always to store the copy
21233 	 * of flags relevant to phyint. At that point in time, we could
21234 	 * not assign the name and hence phyint_illv4/v6 could not be
21235 	 * initialized. Later in ipif_set_values, we assign the name to
21236 	 * the ill, at which point in time we assign phyint_illv4/v6.
21237 	 * Thus we don't rely on phyint_illv6 to be initialized always.
21238 	 */
21239 	if (ill->ill_flags & ILLF_IPV6) {
21240 		phyi->phyint_illv6 = NULL;
21241 	} else {
21242 		phyi->phyint_illv4 = NULL;
21243 	}
21244 	/*
21245 	 * ipif_down removes it from the group when the last ipif goes
21246 	 * down.
21247 	 */
21248 	ASSERT(ill->ill_group == NULL);
21249 
21250 	if (phyi->phyint_illv4 != NULL || phyi->phyint_illv6 != NULL)
21251 		return;
21252 
21253 	/*
21254 	 * Make sure this phyint was put in the list.
21255 	 */
21256 	if (phyi->phyint_ifindex > 0) {
21257 		avl_remove(&phyint_g_list.phyint_list_avl_by_index,
21258 		    phyi);
21259 		avl_remove(&phyint_g_list.phyint_list_avl_by_name,
21260 		    phyi);
21261 	}
21262 	/*
21263 	 * remove phyint from the ipsq list.
21264 	 */
21265 	cur_ipsq = phyi->phyint_ipsq;
21266 	if (phyi == cur_ipsq->ipsq_phyint_list) {
21267 		cur_ipsq->ipsq_phyint_list = phyi->phyint_ipsq_next;
21268 	} else {
21269 		next_phyint = cur_ipsq->ipsq_phyint_list;
21270 		while (next_phyint != NULL) {
21271 			if (next_phyint->phyint_ipsq_next == phyi) {
21272 				next_phyint->phyint_ipsq_next =
21273 					phyi->phyint_ipsq_next;
21274 				break;
21275 			}
21276 			next_phyint = next_phyint->phyint_ipsq_next;
21277 		}
21278 		ASSERT(next_phyint != NULL);
21279 	}
21280 	IPSQ_DEC_REF(cur_ipsq);
21281 
21282 	if (phyi->phyint_groupname_len != 0) {
21283 		ASSERT(phyi->phyint_groupname != NULL);
21284 		mi_free(phyi->phyint_groupname);
21285 	}
21286 	mi_free(phyi);
21287 }
21288 
21289 /*
21290  * Attach the ill to the phyint structure which can be shared by both
21291  * IPv4 and IPv6 ill. ill_init allocates a phyint to just hold flags. This
21292  * function is called from ipif_set_values and ill_lookup_on_name (for
21293  * loopback) where we know the name of the ill. We lookup the ill and if
21294  * there is one present already with the name use that phyint. Otherwise
21295  * reuse the one allocated by ill_init.
21296  */
21297 static void
21298 ill_phyint_reinit(ill_t *ill)
21299 {
21300 	boolean_t isv6 = ill->ill_isv6;
21301 	phyint_t *phyi_old;
21302 	phyint_t *phyi;
21303 	avl_index_t where = 0;
21304 	ill_t	*ill_other = NULL;
21305 	ipsq_t	*ipsq;
21306 
21307 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
21308 
21309 	phyi_old = ill->ill_phyint;
21310 	ASSERT(isv6 || (phyi_old->phyint_illv4 == ill &&
21311 	    phyi_old->phyint_illv6 == NULL));
21312 	ASSERT(!isv6 || (phyi_old->phyint_illv6 == ill &&
21313 	    phyi_old->phyint_illv4 == NULL));
21314 	ASSERT(phyi_old->phyint_ifindex == 0);
21315 
21316 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_name,
21317 	    ill->ill_name, &where);
21318 
21319 	/*
21320 	 * 1. We grabbed the ill_g_lock before inserting this ill into
21321 	 *    the global list of ills. So no other thread could have located
21322 	 *    this ill and hence the ipsq of this ill is guaranteed to be empty.
21323 	 * 2. Now locate the other protocol instance of this ill.
21324 	 * 3. Now grab both ill locks in the right order, and the phyint lock of
21325 	 *    the new ipsq. Holding ill locks + ill_g_lock ensures that the ipsq
21326 	 *    of neither ill can change.
21327 	 * 4. Merge the phyint and thus the ipsq as well of this ill onto the
21328 	 *    other ill.
21329 	 * 5. Release all locks.
21330 	 */
21331 
21332 	/*
21333 	 * Look for IPv4 if we are initializing IPv6 or look for IPv6 if
21334 	 * we are initializing IPv4.
21335 	 */
21336 	if (phyi != NULL) {
21337 		ill_other = (isv6) ? phyi->phyint_illv4 :
21338 		    phyi->phyint_illv6;
21339 		ASSERT(ill_other->ill_phyint != NULL);
21340 		ASSERT((isv6 && !ill_other->ill_isv6) ||
21341 		    (!isv6 && ill_other->ill_isv6));
21342 		GRAB_ILL_LOCKS(ill, ill_other);
21343 		/*
21344 		 * We are potentially throwing away phyint_flags which
21345 		 * could be different from the one that we obtain from
21346 		 * ill_other->ill_phyint. But it is okay as we are assuming
21347 		 * that the state maintained within IP is correct.
21348 		 */
21349 		mutex_enter(&phyi->phyint_lock);
21350 		if (isv6) {
21351 			ASSERT(phyi->phyint_illv6 == NULL);
21352 			phyi->phyint_illv6 = ill;
21353 		} else {
21354 			ASSERT(phyi->phyint_illv4 == NULL);
21355 			phyi->phyint_illv4 = ill;
21356 		}
21357 		/*
21358 		 * This is a new ill, currently undergoing SLIFNAME
21359 		 * So we could not have joined an IPMP group until now.
21360 		 */
21361 		ASSERT(phyi_old->phyint_ipsq_next == NULL &&
21362 		    phyi_old->phyint_groupname == NULL);
21363 
21364 		/*
21365 		 * This phyi_old is going away. Decref ipsq_refs and
21366 		 * assert it is zero. The ipsq itself will be freed in
21367 		 * ipsq_exit
21368 		 */
21369 		ipsq = phyi_old->phyint_ipsq;
21370 		IPSQ_DEC_REF(ipsq);
21371 		ASSERT(ipsq->ipsq_refs == 0);
21372 		/* Get the singleton phyint out of the ipsq list */
21373 		ASSERT(phyi_old->phyint_ipsq_next == NULL);
21374 		ipsq->ipsq_phyint_list = NULL;
21375 		phyi_old->phyint_illv4 = NULL;
21376 		phyi_old->phyint_illv6 = NULL;
21377 		mi_free(phyi_old);
21378 	} else {
21379 		mutex_enter(&ill->ill_lock);
21380 		/*
21381 		 * We don't need to acquire any lock, since
21382 		 * the ill is not yet visible globally  and we
21383 		 * have not yet released the ill_g_lock.
21384 		 */
21385 		phyi = phyi_old;
21386 		mutex_enter(&phyi->phyint_lock);
21387 		/* XXX We need a recovery strategy here. */
21388 		if (!phyint_assign_ifindex(phyi))
21389 			cmn_err(CE_PANIC, "phyint_assign_ifindex() failed");
21390 
21391 		avl_insert(&phyint_g_list.phyint_list_avl_by_name,
21392 		    (void *)phyi, where);
21393 
21394 		(void) avl_find(&phyint_g_list.phyint_list_avl_by_index,
21395 		    &phyi->phyint_ifindex, &where);
21396 		avl_insert(&phyint_g_list.phyint_list_avl_by_index,
21397 		    (void *)phyi, where);
21398 	}
21399 
21400 	/*
21401 	 * Reassigning ill_phyint automatically reassigns the ipsq also.
21402 	 * pending mp is not affected because that is per ill basis.
21403 	 */
21404 	ill->ill_phyint = phyi;
21405 
21406 	/*
21407 	 * Keep the index on ipif_orig_index to be used by FAILOVER.
21408 	 * We do this here as when the first ipif was allocated,
21409 	 * ipif_allocate does not know the right interface index.
21410 	 */
21411 
21412 	ill->ill_ipif->ipif_orig_ifindex = ill->ill_phyint->phyint_ifindex;
21413 	/*
21414 	 * Now that the phyint's ifindex has been assigned, complete the
21415 	 * remaining
21416 	 */
21417 	if (ill->ill_isv6) {
21418 		ill->ill_ip6_mib->ipv6IfIndex =
21419 		    ill->ill_phyint->phyint_ifindex;
21420 		ill->ill_icmp6_mib->ipv6IfIcmpIfIndex =
21421 		    ill->ill_phyint->phyint_ifindex;
21422 	}
21423 
21424 	RELEASE_ILL_LOCKS(ill, ill_other);
21425 	mutex_exit(&phyi->phyint_lock);
21426 }
21427 
21428 /*
21429  * Notify any downstream modules of the name of this interface.
21430  * An M_IOCTL is used even though we don't expect a successful reply.
21431  * Any reply message from the driver (presumably an M_IOCNAK) will
21432  * eventually get discarded somewhere upstream.  The message format is
21433  * simply an SIOCSLIFNAME ioctl just as might be sent from ifconfig
21434  * to IP.
21435  */
21436 static void
21437 ip_ifname_notify(ill_t *ill, queue_t *q)
21438 {
21439 	mblk_t *mp1, *mp2;
21440 	struct iocblk *iocp;
21441 	struct lifreq *lifr;
21442 
21443 	mp1 = mkiocb(SIOCSLIFNAME);
21444 	if (mp1 == NULL)
21445 		return;
21446 	mp2 = allocb(sizeof (struct lifreq), BPRI_HI);
21447 	if (mp2 == NULL) {
21448 		freeb(mp1);
21449 		return;
21450 	}
21451 
21452 	mp1->b_cont = mp2;
21453 	iocp = (struct iocblk *)mp1->b_rptr;
21454 	iocp->ioc_count = sizeof (struct lifreq);
21455 
21456 	lifr = (struct lifreq *)mp2->b_rptr;
21457 	mp2->b_wptr += sizeof (struct lifreq);
21458 	bzero(lifr, sizeof (struct lifreq));
21459 
21460 	(void) strncpy(lifr->lifr_name, ill->ill_name, LIFNAMSIZ);
21461 	lifr->lifr_ppa = ill->ill_ppa;
21462 	lifr->lifr_flags = (ill->ill_flags & (ILLF_IPV4|ILLF_IPV6));
21463 
21464 	putnext(q, mp1);
21465 }
21466 
21467 static boolean_t ip_trash_timer_started = B_FALSE;
21468 
21469 static int
21470 ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
21471 {
21472 	int err;
21473 
21474 	/* Set the obsolete NDD per-interface forwarding name. */
21475 	err = ill_set_ndd_name(ill);
21476 	if (err != 0) {
21477 		cmn_err(CE_WARN, "ipif_set_values: ill_set_ndd_name (%d)\n",
21478 		    err);
21479 	}
21480 
21481 	/* Tell downstream modules where they are. */
21482 	ip_ifname_notify(ill, q);
21483 
21484 	/*
21485 	 * ill_dl_phys returns EINPROGRESS in the usual case.
21486 	 * Error cases are ENOMEM ...
21487 	 */
21488 	err = ill_dl_phys(ill, ipif, mp, q);
21489 
21490 	/*
21491 	 * If there is no IRE expiration timer running, get one started.
21492 	 * igmp and mld timers will be triggered by the first multicast
21493 	 */
21494 	if (!ip_trash_timer_started) {
21495 		/*
21496 		 * acquire the lock and check again.
21497 		 */
21498 		mutex_enter(&ip_trash_timer_lock);
21499 		if (!ip_trash_timer_started) {
21500 			ip_ire_expire_id = timeout(ip_trash_timer_expire, NULL,
21501 			    MSEC_TO_TICK(ip_timer_interval));
21502 			ip_trash_timer_started = B_TRUE;
21503 		}
21504 		mutex_exit(&ip_trash_timer_lock);
21505 	}
21506 
21507 	if (ill->ill_isv6) {
21508 		mutex_enter(&mld_slowtimeout_lock);
21509 		if (mld_slowtimeout_id == 0) {
21510 			mld_slowtimeout_id = timeout(mld_slowtimo, NULL,
21511 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
21512 		}
21513 		mutex_exit(&mld_slowtimeout_lock);
21514 	} else {
21515 		mutex_enter(&igmp_slowtimeout_lock);
21516 		if (igmp_slowtimeout_id == 0) {
21517 			igmp_slowtimeout_id = timeout(igmp_slowtimo, NULL,
21518 				MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
21519 		}
21520 		mutex_exit(&igmp_slowtimeout_lock);
21521 	}
21522 
21523 	return (err);
21524 }
21525 
21526 /*
21527  * Common routine for ppa and ifname setting. Should be called exclusive.
21528  *
21529  * Returns EINPROGRESS when mp has been consumed by queueing it on
21530  * ill_pending_mp and the ioctl will complete in ip_rput.
21531  *
21532  * NOTE : If ppa is UNIT_MAX, we assign the next valid ppa and return
21533  * the new name and new ppa in lifr_name and lifr_ppa respectively.
21534  * For SLIFNAME, we pass these values back to the userland.
21535  */
21536 static int
21537 ipif_set_values(queue_t *q, mblk_t *mp, char *interf_name, uint_t *new_ppa_ptr)
21538 {
21539 	ill_t	*ill;
21540 	ipif_t	*ipif;
21541 	ipsq_t	*ipsq;
21542 	char	*ppa_ptr;
21543 	char	*old_ptr;
21544 	char	old_char;
21545 	int	error;
21546 
21547 	ip1dbg(("ipif_set_values: interface %s\n", interf_name));
21548 	ASSERT(q->q_next != NULL);
21549 	ASSERT(interf_name != NULL);
21550 
21551 	ill = (ill_t *)q->q_ptr;
21552 
21553 	ASSERT(ill->ill_name[0] == '\0');
21554 	ASSERT(IAM_WRITER_ILL(ill));
21555 	ASSERT((mi_strlen(interf_name) + 1) <= LIFNAMSIZ);
21556 	ASSERT(ill->ill_ppa == UINT_MAX);
21557 
21558 	/* The ppa is sent down by ifconfig or is chosen */
21559 	if ((ppa_ptr = ill_get_ppa_ptr(interf_name)) == NULL) {
21560 		return (EINVAL);
21561 	}
21562 
21563 	/*
21564 	 * make sure ppa passed in is same as ppa in the name.
21565 	 * This check is not made when ppa == UINT_MAX in that case ppa
21566 	 * in the name could be anything. System will choose a ppa and
21567 	 * update new_ppa_ptr and inter_name to contain the choosen ppa.
21568 	 */
21569 	if (*new_ppa_ptr != UINT_MAX) {
21570 		/* stoi changes the pointer */
21571 		old_ptr = ppa_ptr;
21572 		/*
21573 		 * ifconfig passed in 0 for the ppa for DLPI 1 style devices
21574 		 * (they don't have an externally visible ppa).  We assign one
21575 		 * here so that we can manage the interface.  Note that in
21576 		 * the past this value was always 0 for DLPI 1 drivers.
21577 		 */
21578 		if (*new_ppa_ptr == 0)
21579 			*new_ppa_ptr = stoi(&old_ptr);
21580 		else if (*new_ppa_ptr != (uint_t)stoi(&old_ptr))
21581 			return (EINVAL);
21582 	}
21583 	/*
21584 	 * terminate string before ppa
21585 	 * save char at that location.
21586 	 */
21587 	old_char = ppa_ptr[0];
21588 	ppa_ptr[0] = '\0';
21589 
21590 	ill->ill_ppa = *new_ppa_ptr;
21591 	/*
21592 	 * Finish as much work now as possible before calling ill_glist_insert
21593 	 * which makes the ill globally visible and also merges it with the
21594 	 * other protocol instance of this phyint. The remaining work is
21595 	 * done after entering the ipsq which may happen sometime later.
21596 	 * ill_set_ndd_name occurs after the ill has been made globally visible.
21597 	 */
21598 	ipif = ill->ill_ipif;
21599 
21600 	/* We didn't do this when we allocated ipif in ip_ll_subnet_defaults */
21601 	ipif_assign_seqid(ipif);
21602 
21603 	if (!(ill->ill_flags & (ILLF_IPV4|ILLF_IPV6)))
21604 		ill->ill_flags |= ILLF_IPV4;
21605 
21606 	ASSERT(ipif->ipif_next == NULL);	/* Only one ipif on ill */
21607 	ASSERT((ipif->ipif_flags & IPIF_UP) == 0);
21608 
21609 	if (ill->ill_flags & ILLF_IPV6) {
21610 
21611 		ill->ill_isv6 = B_TRUE;
21612 		if (ill->ill_rq != NULL) {
21613 			ill->ill_rq->q_qinfo = &rinit_ipv6;
21614 			ill->ill_wq->q_qinfo = &winit_ipv6;
21615 		}
21616 
21617 		/* Keep the !IN6_IS_ADDR_V4MAPPED assertions happy */
21618 		ipif->ipif_v6lcl_addr = ipv6_all_zeros;
21619 		ipif->ipif_v6src_addr = ipv6_all_zeros;
21620 		ipif->ipif_v6subnet = ipv6_all_zeros;
21621 		ipif->ipif_v6net_mask = ipv6_all_zeros;
21622 		ipif->ipif_v6brd_addr = ipv6_all_zeros;
21623 		ipif->ipif_v6pp_dst_addr = ipv6_all_zeros;
21624 		/*
21625 		 * point-to-point or Non-mulicast capable
21626 		 * interfaces won't do NUD unless explicitly
21627 		 * configured to do so.
21628 		 */
21629 		if (ipif->ipif_flags & IPIF_POINTOPOINT ||
21630 		    !(ill->ill_flags & ILLF_MULTICAST)) {
21631 			ill->ill_flags |= ILLF_NONUD;
21632 		}
21633 		/* Make sure IPv4 specific flag is not set on IPv6 if */
21634 		if (ill->ill_flags & ILLF_NOARP) {
21635 			/*
21636 			 * Note: xresolv interfaces will eventually need
21637 			 * NOARP set here as well, but that will require
21638 			 * those external resolvers to have some
21639 			 * knowledge of that flag and act appropriately.
21640 			 * Not to be changed at present.
21641 			 */
21642 			ill->ill_flags &= ~ILLF_NOARP;
21643 		}
21644 		/*
21645 		 * Set the ILLF_ROUTER flag according to the global
21646 		 * IPv6 forwarding policy.
21647 		 */
21648 		if (ipv6_forward != 0)
21649 			ill->ill_flags |= ILLF_ROUTER;
21650 	} else if (ill->ill_flags & ILLF_IPV4) {
21651 		ill->ill_isv6 = B_FALSE;
21652 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6lcl_addr);
21653 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6src_addr);
21654 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6subnet);
21655 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6net_mask);
21656 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6brd_addr);
21657 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6pp_dst_addr);
21658 		/*
21659 		 * Set the ILLF_ROUTER flag according to the global
21660 		 * IPv4 forwarding policy.
21661 		 */
21662 		if (ip_g_forward != 0)
21663 			ill->ill_flags |= ILLF_ROUTER;
21664 	}
21665 
21666 	ASSERT(ill->ill_phyint != NULL);
21667 
21668 	/*
21669 	 * The ipv6Ifindex and ipv6IfIcmpIfIndex assignments will
21670 	 * be completed in ill_glist_insert -> ill_phyint_reinit
21671 	 */
21672 	if (ill->ill_isv6) {
21673 		/* allocate v6 mib */
21674 		if (!ill_allocate_mibs(ill))
21675 			return (ENOMEM);
21676 	}
21677 
21678 	/*
21679 	 * Pick a default sap until we get the DL_INFO_ACK back from
21680 	 * the driver.
21681 	 */
21682 	if (ill->ill_sap == 0) {
21683 		if (ill->ill_isv6)
21684 			ill->ill_sap  = IP6_DL_SAP;
21685 		else
21686 			ill->ill_sap  = IP_DL_SAP;
21687 	}
21688 
21689 	ill->ill_ifname_pending = 1;
21690 	ill->ill_ifname_pending_err = 0;
21691 
21692 	ill_refhold(ill);
21693 	rw_enter(&ill_g_lock, RW_WRITER);
21694 	if ((error = ill_glist_insert(ill, interf_name,
21695 	    (ill->ill_flags & ILLF_IPV6) == ILLF_IPV6)) > 0) {
21696 		ill->ill_ppa = UINT_MAX;
21697 		ill->ill_name[0] = '\0';
21698 		/*
21699 		 * undo null termination done above.
21700 		 */
21701 		ppa_ptr[0] = old_char;
21702 		rw_exit(&ill_g_lock);
21703 		ill_refrele(ill);
21704 		return (error);
21705 	}
21706 
21707 	ASSERT(ill->ill_name_length <= LIFNAMSIZ);
21708 
21709 	/*
21710 	 * When we return the buffer pointed to by interf_name should contain
21711 	 * the same name as in ill_name.
21712 	 * If a ppa was choosen by the system (ppa passed in was UINT_MAX)
21713 	 * the buffer pointed to by new_ppa_ptr would not contain the right ppa
21714 	 * so copy full name and update the ppa ptr.
21715 	 * When ppa passed in != UINT_MAX all values are correct just undo
21716 	 * null termination, this saves a bcopy.
21717 	 */
21718 	if (*new_ppa_ptr == UINT_MAX) {
21719 		bcopy(ill->ill_name, interf_name, ill->ill_name_length);
21720 		*new_ppa_ptr = ill->ill_ppa;
21721 	} else {
21722 		/*
21723 		 * undo null termination done above.
21724 		 */
21725 		ppa_ptr[0] = old_char;
21726 	}
21727 
21728 	/* Let SCTP know about this ILL */
21729 	sctp_update_ill(ill, SCTP_ILL_INSERT);
21730 
21731 	/* and also about the first ipif */
21732 	sctp_update_ipif(ipif, SCTP_IPIF_INSERT);
21733 
21734 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_reprocess_ioctl, NEW_OP,
21735 	    B_TRUE);
21736 
21737 	rw_exit(&ill_g_lock);
21738 	ill_refrele(ill);
21739 	if (ipsq == NULL)
21740 		return (EINPROGRESS);
21741 
21742 	/*
21743 	 * Need to set the ipsq_current_ipif now, if we have changed ipsq
21744 	 * due to the phyint merge in ill_phyint_reinit.
21745 	 */
21746 	ASSERT(ipsq->ipsq_current_ipif == NULL ||
21747 		ipsq->ipsq_current_ipif == ipif);
21748 	ipsq->ipsq_current_ipif = ipif;
21749 	ipsq->ipsq_last_cmd = SIOCSLIFNAME;
21750 	error = ipif_set_values_tail(ill, ipif, mp, q);
21751 	ipsq_exit(ipsq, B_TRUE, B_TRUE);
21752 	if (error != 0 && error != EINPROGRESS) {
21753 		/*
21754 		 * restore previous values
21755 		 */
21756 		ill->ill_isv6 = B_FALSE;
21757 	}
21758 	return (error);
21759 }
21760 
21761 
21762 extern void (*ip_cleanup_func)(void);
21763 
21764 void
21765 ipif_init(void)
21766 {
21767 	hrtime_t hrt;
21768 	int i;
21769 
21770 	/*
21771 	 * Can't call drv_getparm here as it is too early in the boot.
21772 	 * As we use ipif_src_random just for picking a different
21773 	 * source address everytime, this need not be really random.
21774 	 */
21775 	hrt = gethrtime();
21776 	ipif_src_random = ((hrt >> 32) & 0xffffffff) * (hrt & 0xffffffff);
21777 
21778 	for (i = 0; i < MAX_G_HEADS; i++) {
21779 		ill_g_heads[i].ill_g_list_head = (ill_if_t *)&ill_g_heads[i];
21780 		ill_g_heads[i].ill_g_list_tail = (ill_if_t *)&ill_g_heads[i];
21781 	}
21782 
21783 	avl_create(&phyint_g_list.phyint_list_avl_by_index,
21784 	    ill_phyint_compare_index,
21785 	    sizeof (phyint_t),
21786 	    offsetof(struct phyint, phyint_avl_by_index));
21787 	avl_create(&phyint_g_list.phyint_list_avl_by_name,
21788 	    ill_phyint_compare_name,
21789 	    sizeof (phyint_t),
21790 	    offsetof(struct phyint, phyint_avl_by_name));
21791 
21792 	ip_cleanup_func = ip_thread_exit;
21793 }
21794 
21795 /*
21796  * This is called by ip_rt_add when src_addr value is other than zero.
21797  * src_addr signifies the source address of the incoming packet. For
21798  * reverse tunnel route we need to create a source addr based routing
21799  * table. This routine creates ip_mrtun_table if it's empty and then
21800  * it adds the route entry hashed by source address. It verifies that
21801  * the outgoing interface is always a non-resolver interface (tunnel).
21802  */
21803 int
21804 ip_mrtun_rt_add(ipaddr_t in_src_addr, int flags, ipif_t *ipif_arg,
21805     ipif_t *src_ipif, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func)
21806 {
21807 	ire_t   *ire;
21808 	ire_t	*save_ire;
21809 	ipif_t  *ipif;
21810 	ill_t   *in_ill = NULL;
21811 	ill_t	*out_ill;
21812 	queue_t	*stq;
21813 	mblk_t	*dlureq_mp;
21814 	int	error;
21815 
21816 	if (ire_arg != NULL)
21817 		*ire_arg = NULL;
21818 	ASSERT(in_src_addr != INADDR_ANY);
21819 
21820 	ipif = ipif_arg;
21821 	if (ipif != NULL) {
21822 		out_ill = ipif->ipif_ill;
21823 	} else {
21824 		ip1dbg(("ip_mrtun_rt_add: ipif is NULL\n"));
21825 		return (EINVAL);
21826 	}
21827 
21828 	if (src_ipif == NULL) {
21829 		ip1dbg(("ip_mrtun_rt_add: src_ipif is NULL\n"));
21830 		return (EINVAL);
21831 	}
21832 	in_ill = src_ipif->ipif_ill;
21833 
21834 	/*
21835 	 * Check for duplicates. We don't need to
21836 	 * match out_ill, because the uniqueness of
21837 	 * a route is only dependent on src_addr and
21838 	 * in_ill.
21839 	 */
21840 	ire = ire_mrtun_lookup(in_src_addr, in_ill);
21841 	if (ire != NULL) {
21842 		ire_refrele(ire);
21843 		return (EEXIST);
21844 	}
21845 	if (ipif->ipif_net_type != IRE_IF_NORESOLVER) {
21846 		ip2dbg(("ip_mrtun_rt_add: outgoing interface is type %d\n",
21847 		    ipif->ipif_net_type));
21848 		return (EINVAL);
21849 	}
21850 
21851 	stq = ipif->ipif_wq;
21852 	ASSERT(stq != NULL);
21853 
21854 	/*
21855 	 * The outgoing interface must be non-resolver
21856 	 * interface.
21857 	 */
21858 	dlureq_mp = ill_dlur_gen(NULL,
21859 	    out_ill->ill_phys_addr_length, out_ill->ill_sap,
21860 	    out_ill->ill_sap_length);
21861 
21862 	if (dlureq_mp == NULL) {
21863 		ip1dbg(("ip_newroute: dlureq_mp NULL\n"));
21864 		return (ENOMEM);
21865 	}
21866 
21867 	/* Create the IRE. */
21868 
21869 	ire = ire_create(
21870 	    NULL,				/* Zero dst addr */
21871 	    NULL,				/* Zero mask */
21872 	    NULL,				/* Zero gateway addr */
21873 	    NULL,				/* Zero ipif_src addr */
21874 	    (uint8_t *)&in_src_addr,		/* in_src-addr */
21875 	    &ipif->ipif_mtu,
21876 	    NULL,
21877 	    NULL,				/* rfq */
21878 	    stq,
21879 	    IRE_MIPRTUN,
21880 	    dlureq_mp,
21881 	    ipif,
21882 	    in_ill,
21883 	    0,
21884 	    0,
21885 	    0,
21886 	    flags,
21887 	    &ire_uinfo_null);
21888 
21889 	if (ire == NULL)
21890 		return (ENOMEM);
21891 	ip2dbg(("ip_mrtun_rt_add: mrtun route is created with type %d\n",
21892 	    ire->ire_type));
21893 	save_ire = ire;
21894 	ASSERT(save_ire != NULL);
21895 	error = ire_add_mrtun(&ire, q, mp, func);
21896 	/*
21897 	 * If ire_add_mrtun() failed, the ire passed in was freed
21898 	 * so there is no need to do so here.
21899 	 */
21900 	if (error != 0) {
21901 		return (error);
21902 	}
21903 
21904 	/* Duplicate check */
21905 	if (ire != save_ire) {
21906 		/* route already exists by now */
21907 		ire_refrele(ire);
21908 		return (EEXIST);
21909 	}
21910 
21911 	if (ire_arg != NULL) {
21912 		/*
21913 		 * Store the ire that was just added. the caller
21914 		 * ip_rts_request responsible for doing ire_refrele()
21915 		 * on it.
21916 		 */
21917 		*ire_arg = ire;
21918 	} else {
21919 		ire_refrele(ire);	/* held in ire_add_mrtun */
21920 	}
21921 
21922 	return (0);
21923 }
21924 
21925 /*
21926  * It is called by ip_rt_delete() only when mipagent requests to delete
21927  * a reverse tunnel route that was added by ip_mrtun_rt_add() before.
21928  */
21929 
21930 int
21931 ip_mrtun_rt_delete(ipaddr_t in_src_addr, ipif_t *src_ipif)
21932 {
21933 	ire_t   *ire = NULL;
21934 
21935 	if (in_src_addr == INADDR_ANY)
21936 		return (EINVAL);
21937 	if (src_ipif == NULL)
21938 		return (EINVAL);
21939 
21940 	/* search if this route exists in the ip_mrtun_table */
21941 	ire = ire_mrtun_lookup(in_src_addr, src_ipif->ipif_ill);
21942 	if (ire == NULL) {
21943 		ip2dbg(("ip_mrtun_rt_delete: ire not found\n"));
21944 		return (ESRCH);
21945 	}
21946 	ire_delete(ire);
21947 	ire_refrele(ire);
21948 	return (0);
21949 }
21950 
21951 /*
21952  * Lookup the ipif corresponding to the onlink destination address. For
21953  * point-to-point interfaces, it matches with remote endpoint destination
21954  * address. For point-to-multipoint interfaces it only tries to match the
21955  * destination with the interface's subnet address. The longest, most specific
21956  * match is found to take care of such rare network configurations like -
21957  * le0: 129.146.1.1/16
21958  * le1: 129.146.2.2/24
21959  * It is used only by SO_DONTROUTE at the moment.
21960  */
21961 ipif_t *
21962 ipif_lookup_onlink_addr(ipaddr_t addr, zoneid_t zoneid)
21963 {
21964 	ipif_t	*ipif, *best_ipif;
21965 	ill_t	*ill;
21966 	ill_walk_context_t ctx;
21967 
21968 	ASSERT(zoneid != ALL_ZONES);
21969 	best_ipif = NULL;
21970 
21971 	rw_enter(&ill_g_lock, RW_READER);
21972 	ill = ILL_START_WALK_V4(&ctx);
21973 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
21974 		mutex_enter(&ill->ill_lock);
21975 		for (ipif = ill->ill_ipif; ipif != NULL;
21976 		    ipif = ipif->ipif_next) {
21977 			if (!IPIF_CAN_LOOKUP(ipif))
21978 				continue;
21979 			if (ipif->ipif_zoneid != zoneid)
21980 				continue;
21981 			/*
21982 			 * Point-to-point case. Look for exact match with
21983 			 * destination address.
21984 			 */
21985 			if (ipif->ipif_flags & IPIF_POINTOPOINT) {
21986 				if (ipif->ipif_pp_dst_addr == addr) {
21987 					ipif_refhold_locked(ipif);
21988 					mutex_exit(&ill->ill_lock);
21989 					rw_exit(&ill_g_lock);
21990 					if (best_ipif != NULL)
21991 						ipif_refrele(best_ipif);
21992 					return (ipif);
21993 				}
21994 			} else if (ipif->ipif_subnet == (addr &
21995 			    ipif->ipif_net_mask)) {
21996 				/*
21997 				 * Point-to-multipoint case. Looping through to
21998 				 * find the most specific match. If there are
21999 				 * multiple best match ipif's then prefer ipif's
22000 				 * that are UP. If there is only one best match
22001 				 * ipif and it is DOWN we must still return it.
22002 				 */
22003 				if ((best_ipif == NULL) ||
22004 				    (ipif->ipif_net_mask >
22005 				    best_ipif->ipif_net_mask) ||
22006 				    ((ipif->ipif_net_mask ==
22007 				    best_ipif->ipif_net_mask) &&
22008 				    ((ipif->ipif_flags & IPIF_UP) &&
22009 				    (!(best_ipif->ipif_flags & IPIF_UP))))) {
22010 					ipif_refhold_locked(ipif);
22011 					mutex_exit(&ill->ill_lock);
22012 					rw_exit(&ill_g_lock);
22013 					if (best_ipif != NULL)
22014 						ipif_refrele(best_ipif);
22015 					best_ipif = ipif;
22016 					rw_enter(&ill_g_lock, RW_READER);
22017 					mutex_enter(&ill->ill_lock);
22018 				}
22019 			}
22020 		}
22021 		mutex_exit(&ill->ill_lock);
22022 	}
22023 	rw_exit(&ill_g_lock);
22024 	return (best_ipif);
22025 }
22026 
22027 
22028 /*
22029  * Save enough information so that we can recreate the IRE if
22030  * the interface goes down and then up.
22031  */
22032 static void
22033 ipif_save_ire(ipif_t *ipif, ire_t *ire)
22034 {
22035 	mblk_t	*save_mp;
22036 
22037 	save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
22038 	if (save_mp != NULL) {
22039 		ifrt_t	*ifrt;
22040 
22041 		save_mp->b_wptr += sizeof (ifrt_t);
22042 		ifrt = (ifrt_t *)save_mp->b_rptr;
22043 		bzero(ifrt, sizeof (ifrt_t));
22044 		ifrt->ifrt_type = ire->ire_type;
22045 		ifrt->ifrt_addr = ire->ire_addr;
22046 		ifrt->ifrt_gateway_addr = ire->ire_gateway_addr;
22047 		ifrt->ifrt_src_addr = ire->ire_src_addr;
22048 		ifrt->ifrt_mask = ire->ire_mask;
22049 		ifrt->ifrt_flags = ire->ire_flags;
22050 		ifrt->ifrt_max_frag = ire->ire_max_frag;
22051 		mutex_enter(&ipif->ipif_saved_ire_lock);
22052 		save_mp->b_cont = ipif->ipif_saved_ire_mp;
22053 		ipif->ipif_saved_ire_mp = save_mp;
22054 		ipif->ipif_saved_ire_cnt++;
22055 		mutex_exit(&ipif->ipif_saved_ire_lock);
22056 	}
22057 }
22058 
22059 
22060 static void
22061 ipif_remove_ire(ipif_t *ipif, ire_t *ire)
22062 {
22063 	mblk_t	**mpp;
22064 	mblk_t	*mp;
22065 	ifrt_t	*ifrt;
22066 
22067 	/* Remove from ipif_saved_ire_mp list if it is there */
22068 	mutex_enter(&ipif->ipif_saved_ire_lock);
22069 	for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL;
22070 	    mpp = &(*mpp)->b_cont) {
22071 		/*
22072 		 * On a given ipif, the triple of address, gateway and
22073 		 * mask is unique for each saved IRE (in the case of
22074 		 * ordinary interface routes, the gateway address is
22075 		 * all-zeroes).
22076 		 */
22077 		mp = *mpp;
22078 		ifrt = (ifrt_t *)mp->b_rptr;
22079 		if (ifrt->ifrt_addr == ire->ire_addr &&
22080 		    ifrt->ifrt_gateway_addr == ire->ire_gateway_addr &&
22081 		    ifrt->ifrt_mask == ire->ire_mask) {
22082 			*mpp = mp->b_cont;
22083 			ipif->ipif_saved_ire_cnt--;
22084 			freeb(mp);
22085 			break;
22086 		}
22087 	}
22088 	mutex_exit(&ipif->ipif_saved_ire_lock);
22089 }
22090 
22091 
22092 /*
22093  * IP multirouting broadcast routes handling
22094  * Append CGTP broadcast IREs to regular ones created
22095  * at ifconfig time.
22096  */
22097 static void
22098 ip_cgtp_bcast_add(ire_t *ire, ire_t *ire_dst)
22099 {
22100 	ire_t *ire_prim;
22101 
22102 	ASSERT(ire != NULL);
22103 	ASSERT(ire_dst != NULL);
22104 
22105 	ire_prim = ire_ctable_lookup(ire->ire_gateway_addr, 0,
22106 	    IRE_BROADCAST, NULL, NULL, MATCH_IRE_TYPE);
22107 	if (ire_prim != NULL) {
22108 		/*
22109 		 * We are in the special case of broadcasts for
22110 		 * CGTP. We add an IRE_BROADCAST that holds
22111 		 * the RTF_MULTIRT flag, the destination
22112 		 * address of ire_dst and the low level
22113 		 * info of ire_prim. In other words, CGTP
22114 		 * broadcast is added to the redundant ipif.
22115 		 */
22116 		ipif_t *ipif_prim;
22117 		ire_t  *bcast_ire;
22118 
22119 		ipif_prim = ire_prim->ire_ipif;
22120 
22121 		ip2dbg(("ip_cgtp_filter_bcast_add: "
22122 		    "ire_dst %p, ire_prim %p, ipif_prim %p\n",
22123 		    (void *)ire_dst, (void *)ire_prim,
22124 		    (void *)ipif_prim));
22125 
22126 		bcast_ire = ire_create(
22127 		    (uchar_t *)&ire->ire_addr,
22128 		    (uchar_t *)&ip_g_all_ones,
22129 		    (uchar_t *)&ire_dst->ire_src_addr,
22130 		    (uchar_t *)&ire->ire_gateway_addr,
22131 		    NULL,
22132 		    &ipif_prim->ipif_mtu,
22133 		    NULL,
22134 		    ipif_prim->ipif_rq,
22135 		    ipif_prim->ipif_wq,
22136 		    IRE_BROADCAST,
22137 		    ipif_prim->ipif_bcast_mp,
22138 		    ipif_prim,
22139 		    NULL,
22140 		    0,
22141 		    0,
22142 		    0,
22143 		    ire->ire_flags,
22144 		    &ire_uinfo_null);
22145 
22146 		if (bcast_ire != NULL) {
22147 
22148 			if (ire_add(&bcast_ire, NULL, NULL, NULL) == 0) {
22149 				ip2dbg(("ip_cgtp_filter_bcast_add: "
22150 				    "added bcast_ire %p\n",
22151 				    (void *)bcast_ire));
22152 
22153 				ipif_save_ire(bcast_ire->ire_ipif,
22154 				    bcast_ire);
22155 				ire_refrele(bcast_ire);
22156 			}
22157 		}
22158 		ire_refrele(ire_prim);
22159 	}
22160 }
22161 
22162 
22163 /*
22164  * IP multirouting broadcast routes handling
22165  * Remove the broadcast ire
22166  */
22167 static void
22168 ip_cgtp_bcast_delete(ire_t *ire)
22169 {
22170 	ire_t *ire_dst;
22171 
22172 	ASSERT(ire != NULL);
22173 	ire_dst = ire_ctable_lookup(ire->ire_addr, 0, IRE_BROADCAST,
22174 	    NULL, NULL, MATCH_IRE_TYPE);
22175 	if (ire_dst != NULL) {
22176 		ire_t *ire_prim;
22177 
22178 		ire_prim = ire_ctable_lookup(ire->ire_gateway_addr, 0,
22179 		    IRE_BROADCAST, NULL, NULL, MATCH_IRE_TYPE);
22180 		if (ire_prim != NULL) {
22181 			ipif_t *ipif_prim;
22182 			ire_t  *bcast_ire;
22183 
22184 			ipif_prim = ire_prim->ire_ipif;
22185 
22186 			ip2dbg(("ip_cgtp_filter_bcast_delete: "
22187 			    "ire_dst %p, ire_prim %p, ipif_prim %p\n",
22188 			    (void *)ire_dst, (void *)ire_prim,
22189 			    (void *)ipif_prim));
22190 
22191 			bcast_ire = ire_ctable_lookup(ire->ire_addr,
22192 			    ire->ire_gateway_addr,
22193 			    IRE_BROADCAST,
22194 			    ipif_prim,
22195 			    NULL,
22196 			    MATCH_IRE_TYPE | MATCH_IRE_GW | MATCH_IRE_IPIF |
22197 			    MATCH_IRE_MASK);
22198 
22199 			if (bcast_ire != NULL) {
22200 				ip2dbg(("ip_cgtp_filter_bcast_delete: "
22201 				    "looked up bcast_ire %p\n",
22202 				    (void *)bcast_ire));
22203 				ipif_remove_ire(bcast_ire->ire_ipif,
22204 					bcast_ire);
22205 				ire_delete(bcast_ire);
22206 			}
22207 			ire_refrele(ire_prim);
22208 		}
22209 		ire_refrele(ire_dst);
22210 	}
22211 }
22212 
22213 /*
22214  * IPsec hardware acceleration capabilities related functions.
22215  */
22216 
22217 /*
22218  * Free a per-ill IPsec capabilities structure.
22219  */
22220 static void
22221 ill_ipsec_capab_free(ill_ipsec_capab_t *capab)
22222 {
22223 	if (capab->auth_hw_algs != NULL)
22224 		kmem_free(capab->auth_hw_algs, capab->algs_size);
22225 	if (capab->encr_hw_algs != NULL)
22226 		kmem_free(capab->encr_hw_algs, capab->algs_size);
22227 	if (capab->encr_algparm != NULL)
22228 		kmem_free(capab->encr_algparm, capab->encr_algparm_size);
22229 	kmem_free(capab, sizeof (ill_ipsec_capab_t));
22230 }
22231 
22232 /*
22233  * Allocate a new per-ill IPsec capabilities structure. This structure
22234  * is specific to an IPsec protocol (AH or ESP). It is implemented as
22235  * an array which specifies, for each algorithm, whether this algorithm
22236  * is supported by the ill or not.
22237  */
22238 static ill_ipsec_capab_t *
22239 ill_ipsec_capab_alloc(void)
22240 {
22241 	ill_ipsec_capab_t *capab;
22242 	uint_t nelems;
22243 
22244 	capab = kmem_zalloc(sizeof (ill_ipsec_capab_t), KM_NOSLEEP);
22245 	if (capab == NULL)
22246 		return (NULL);
22247 
22248 	/* we need one bit per algorithm */
22249 	nelems = MAX_IPSEC_ALGS / BITS(ipsec_capab_elem_t);
22250 	capab->algs_size = nelems * sizeof (ipsec_capab_elem_t);
22251 
22252 	/* allocate memory to store algorithm flags */
22253 	capab->encr_hw_algs = kmem_zalloc(capab->algs_size, KM_NOSLEEP);
22254 	if (capab->encr_hw_algs == NULL)
22255 		goto nomem;
22256 	capab->auth_hw_algs = kmem_zalloc(capab->algs_size, KM_NOSLEEP);
22257 	if (capab->auth_hw_algs == NULL)
22258 		goto nomem;
22259 	/*
22260 	 * Leave encr_algparm NULL for now since we won't need it half
22261 	 * the time
22262 	 */
22263 	return (capab);
22264 
22265 nomem:
22266 	ill_ipsec_capab_free(capab);
22267 	return (NULL);
22268 }
22269 
22270 /*
22271  * Resize capability array.  Since we're exclusive, this is OK.
22272  */
22273 static boolean_t
22274 ill_ipsec_capab_resize_algparm(ill_ipsec_capab_t *capab, int algid)
22275 {
22276 	ipsec_capab_algparm_t *nalp, *oalp;
22277 	uint32_t olen, nlen;
22278 
22279 	oalp = capab->encr_algparm;
22280 	olen = capab->encr_algparm_size;
22281 
22282 	if (oalp != NULL) {
22283 		if (algid < capab->encr_algparm_end)
22284 			return (B_TRUE);
22285 	}
22286 
22287 	nlen = (algid + 1) * sizeof (*nalp);
22288 	nalp = kmem_zalloc(nlen, KM_NOSLEEP);
22289 	if (nalp == NULL)
22290 		return (B_FALSE);
22291 
22292 	if (oalp != NULL) {
22293 		bcopy(oalp, nalp, olen);
22294 		kmem_free(oalp, olen);
22295 	}
22296 	capab->encr_algparm = nalp;
22297 	capab->encr_algparm_size = nlen;
22298 	capab->encr_algparm_end = algid + 1;
22299 
22300 	return (B_TRUE);
22301 }
22302 
22303 /*
22304  * Compare the capabilities of the specified ill with the protocol
22305  * and algorithms specified by the SA passed as argument.
22306  * If they match, returns B_TRUE, B_FALSE if they do not match.
22307  *
22308  * The ill can be passed as a pointer to it, or by specifying its index
22309  * and whether it is an IPv6 ill (ill_index and ill_isv6 arguments).
22310  *
22311  * Called by ipsec_out_is_accelerated() do decide whether an outbound
22312  * packet is eligible for hardware acceleration, and by
22313  * ill_ipsec_capab_send_all() to decide whether a SA must be sent down
22314  * to a particular ill.
22315  */
22316 boolean_t
22317 ipsec_capab_match(ill_t *ill, uint_t ill_index, boolean_t ill_isv6,
22318     ipsa_t *sa)
22319 {
22320 	boolean_t sa_isv6;
22321 	uint_t algid;
22322 	struct ill_ipsec_capab_s *cpp;
22323 	boolean_t need_refrele = B_FALSE;
22324 
22325 	if (ill == NULL) {
22326 		ill = ill_lookup_on_ifindex(ill_index, ill_isv6, NULL,
22327 		    NULL, NULL, NULL);
22328 		if (ill == NULL) {
22329 			ip0dbg(("ipsec_capab_match: ill doesn't exist\n"));
22330 			return (B_FALSE);
22331 		}
22332 		need_refrele = B_TRUE;
22333 	}
22334 
22335 	/*
22336 	 * Use the address length specified by the SA to determine
22337 	 * if it corresponds to a IPv6 address, and fail the matching
22338 	 * if the isv6 flag passed as argument does not match.
22339 	 * Note: this check is used for SADB capability checking before
22340 	 * sending SA information to an ill.
22341 	 */
22342 	sa_isv6 = (sa->ipsa_addrfam == AF_INET6);
22343 	if (sa_isv6 != ill_isv6)
22344 		/* protocol mismatch */
22345 		goto done;
22346 
22347 	/*
22348 	 * Check if the ill supports the protocol, algorithm(s) and
22349 	 * key size(s) specified by the SA, and get the pointers to
22350 	 * the algorithms supported by the ill.
22351 	 */
22352 	switch (sa->ipsa_type) {
22353 
22354 	case SADB_SATYPE_ESP:
22355 		if (!(ill->ill_capabilities & ILL_CAPAB_ESP))
22356 			/* ill does not support ESP acceleration */
22357 			goto done;
22358 		cpp = ill->ill_ipsec_capab_esp;
22359 		algid = sa->ipsa_auth_alg;
22360 		if (!IPSEC_ALG_IS_ENABLED(algid, cpp->auth_hw_algs))
22361 			goto done;
22362 		algid = sa->ipsa_encr_alg;
22363 		if (!IPSEC_ALG_IS_ENABLED(algid, cpp->encr_hw_algs))
22364 			goto done;
22365 		if (algid < cpp->encr_algparm_end) {
22366 			ipsec_capab_algparm_t *alp = &cpp->encr_algparm[algid];
22367 			if (sa->ipsa_encrkeybits < alp->minkeylen)
22368 				goto done;
22369 			if (sa->ipsa_encrkeybits > alp->maxkeylen)
22370 				goto done;
22371 		}
22372 		break;
22373 
22374 	case SADB_SATYPE_AH:
22375 		if (!(ill->ill_capabilities & ILL_CAPAB_AH))
22376 			/* ill does not support AH acceleration */
22377 			goto done;
22378 		if (!IPSEC_ALG_IS_ENABLED(sa->ipsa_auth_alg,
22379 		    ill->ill_ipsec_capab_ah->auth_hw_algs))
22380 			goto done;
22381 		break;
22382 	}
22383 
22384 	if (need_refrele)
22385 		ill_refrele(ill);
22386 	return (B_TRUE);
22387 done:
22388 	if (need_refrele)
22389 		ill_refrele(ill);
22390 	return (B_FALSE);
22391 }
22392 
22393 
22394 /*
22395  * Add a new ill to the list of IPsec capable ills.
22396  * Called from ill_capability_ipsec_ack() when an ACK was received
22397  * indicating that IPsec hardware processing was enabled for an ill.
22398  *
22399  * ill must point to the ill for which acceleration was enabled.
22400  * dl_cap must be set to DL_CAPAB_IPSEC_AH or DL_CAPAB_IPSEC_ESP.
22401  */
22402 static void
22403 ill_ipsec_capab_add(ill_t *ill, uint_t dl_cap, boolean_t sadb_resync)
22404 {
22405 	ipsec_capab_ill_t **ills, *cur_ill, *new_ill;
22406 	uint_t sa_type;
22407 	uint_t ipproto;
22408 
22409 	ASSERT((dl_cap == DL_CAPAB_IPSEC_AH) ||
22410 	    (dl_cap == DL_CAPAB_IPSEC_ESP));
22411 
22412 	switch (dl_cap) {
22413 	case DL_CAPAB_IPSEC_AH:
22414 		sa_type = SADB_SATYPE_AH;
22415 		ills = &ipsec_capab_ills_ah;
22416 		ipproto = IPPROTO_AH;
22417 		break;
22418 	case DL_CAPAB_IPSEC_ESP:
22419 		sa_type = SADB_SATYPE_ESP;
22420 		ills = &ipsec_capab_ills_esp;
22421 		ipproto = IPPROTO_ESP;
22422 		break;
22423 	}
22424 
22425 	rw_enter(&ipsec_capab_ills_lock, RW_WRITER);
22426 
22427 	/*
22428 	 * Add ill index to list of hardware accelerators. If
22429 	 * already in list, do nothing.
22430 	 */
22431 	for (cur_ill = *ills; cur_ill != NULL &&
22432 	    (cur_ill->ill_index != ill->ill_phyint->phyint_ifindex ||
22433 	    cur_ill->ill_isv6 != ill->ill_isv6); cur_ill = cur_ill->next)
22434 		;
22435 
22436 	if (cur_ill == NULL) {
22437 		/* if this is a new entry for this ill */
22438 		new_ill = kmem_zalloc(sizeof (ipsec_capab_ill_t), KM_NOSLEEP);
22439 		if (new_ill == NULL) {
22440 			rw_exit(&ipsec_capab_ills_lock);
22441 			return;
22442 		}
22443 
22444 		new_ill->ill_index = ill->ill_phyint->phyint_ifindex;
22445 		new_ill->ill_isv6 = ill->ill_isv6;
22446 		new_ill->next = *ills;
22447 		*ills = new_ill;
22448 	} else if (!sadb_resync) {
22449 		/* not resync'ing SADB and an entry exists for this ill */
22450 		rw_exit(&ipsec_capab_ills_lock);
22451 		return;
22452 	}
22453 
22454 	rw_exit(&ipsec_capab_ills_lock);
22455 
22456 	if (ipcl_proto_fanout_v6[ipproto].connf_head != NULL)
22457 		/*
22458 		 * IPsec module for protocol loaded, initiate dump
22459 		 * of the SADB to this ill.
22460 		 */
22461 		sadb_ill_download(ill, sa_type);
22462 }
22463 
22464 /*
22465  * Remove an ill from the list of IPsec capable ills.
22466  */
22467 static void
22468 ill_ipsec_capab_delete(ill_t *ill, uint_t dl_cap)
22469 {
22470 	ipsec_capab_ill_t **ills, *cur_ill, *prev_ill;
22471 
22472 	ASSERT(dl_cap == DL_CAPAB_IPSEC_AH ||
22473 	    dl_cap == DL_CAPAB_IPSEC_ESP);
22474 
22475 	ills = (dl_cap == DL_CAPAB_IPSEC_AH) ? &ipsec_capab_ills_ah :
22476 	    &ipsec_capab_ills_esp;
22477 
22478 	rw_enter(&ipsec_capab_ills_lock, RW_WRITER);
22479 
22480 	prev_ill = NULL;
22481 	for (cur_ill = *ills; cur_ill != NULL && (cur_ill->ill_index !=
22482 	    ill->ill_phyint->phyint_ifindex || cur_ill->ill_isv6 !=
22483 	    ill->ill_isv6); prev_ill = cur_ill, cur_ill = cur_ill->next)
22484 		;
22485 	if (cur_ill == NULL) {
22486 		/* entry not found */
22487 		rw_exit(&ipsec_capab_ills_lock);
22488 		return;
22489 	}
22490 	if (prev_ill == NULL) {
22491 		/* entry at front of list */
22492 		*ills = NULL;
22493 	} else {
22494 		prev_ill->next = cur_ill->next;
22495 	}
22496 	kmem_free(cur_ill, sizeof (ipsec_capab_ill_t));
22497 	rw_exit(&ipsec_capab_ills_lock);
22498 }
22499 
22500 
22501 /*
22502  * Handling of DL_CONTROL_REQ messages that must be sent down to
22503  * an ill while having exclusive access.
22504  */
22505 /* ARGSUSED */
22506 static void
22507 ill_ipsec_capab_send_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
22508 {
22509 	ill_t *ill = (ill_t *)q->q_ptr;
22510 
22511 	ill_dlpi_send(ill, mp);
22512 }
22513 
22514 
22515 /*
22516  * Called by SADB to send a DL_CONTROL_REQ message to every ill
22517  * supporting the specified IPsec protocol acceleration.
22518  * sa_type must be SADB_SATYPE_AH or SADB_SATYPE_ESP.
22519  * We free the mblk and, if sa is non-null, release the held referece.
22520  */
22521 void
22522 ill_ipsec_capab_send_all(uint_t sa_type, mblk_t *mp, ipsa_t *sa)
22523 {
22524 	ipsec_capab_ill_t *ici, *cur_ici;
22525 	ill_t *ill;
22526 	mblk_t *nmp, *mp_ship_list = NULL, *next_mp;
22527 
22528 	ici = (sa_type == SADB_SATYPE_AH) ? ipsec_capab_ills_ah :
22529 	    ipsec_capab_ills_esp;
22530 
22531 	rw_enter(&ipsec_capab_ills_lock, RW_READER);
22532 
22533 	for (cur_ici = ici; cur_ici != NULL; cur_ici = cur_ici->next) {
22534 		ill = ill_lookup_on_ifindex(cur_ici->ill_index,
22535 		    cur_ici->ill_isv6, NULL, NULL, NULL, NULL);
22536 
22537 		/*
22538 		 * Handle the case where the ill goes away while the SADB is
22539 		 * attempting to send messages.  If it's going away, it's
22540 		 * nuking its shadow SADB, so we don't care..
22541 		 */
22542 
22543 		if (ill == NULL)
22544 			continue;
22545 
22546 		if (sa != NULL) {
22547 			/*
22548 			 * Make sure capabilities match before
22549 			 * sending SA to ill.
22550 			 */
22551 			if (!ipsec_capab_match(ill, cur_ici->ill_index,
22552 			    cur_ici->ill_isv6, sa)) {
22553 				ill_refrele(ill);
22554 				continue;
22555 			}
22556 
22557 			mutex_enter(&sa->ipsa_lock);
22558 			sa->ipsa_flags |= IPSA_F_HW;
22559 			mutex_exit(&sa->ipsa_lock);
22560 		}
22561 
22562 		/*
22563 		 * Copy template message, and add it to the front
22564 		 * of the mblk ship list. We want to avoid holding
22565 		 * the ipsec_capab_ills_lock while sending the
22566 		 * message to the ills.
22567 		 *
22568 		 * The b_next and b_prev are temporarily used
22569 		 * to build a list of mblks to be sent down, and to
22570 		 * save the ill to which they must be sent.
22571 		 */
22572 		nmp = copymsg(mp);
22573 		if (nmp == NULL) {
22574 			ill_refrele(ill);
22575 			continue;
22576 		}
22577 		ASSERT(nmp->b_next == NULL && nmp->b_prev == NULL);
22578 		nmp->b_next = mp_ship_list;
22579 		mp_ship_list = nmp;
22580 		nmp->b_prev = (mblk_t *)ill;
22581 	}
22582 
22583 	rw_exit(&ipsec_capab_ills_lock);
22584 
22585 	nmp = mp_ship_list;
22586 	while (nmp != NULL) {
22587 		/* restore the mblk to a sane state */
22588 		next_mp = nmp->b_next;
22589 		nmp->b_next = NULL;
22590 		ill = (ill_t *)nmp->b_prev;
22591 		nmp->b_prev = NULL;
22592 
22593 		/*
22594 		 * Ship the mblk to the ill, must be exclusive. Keep the
22595 		 * reference to the ill as qwriter_ip() does a ill_referele().
22596 		 */
22597 		(void) qwriter_ip(NULL, ill, ill->ill_wq, nmp,
22598 		    ill_ipsec_capab_send_writer, NEW_OP, B_TRUE);
22599 
22600 		nmp = next_mp;
22601 	}
22602 
22603 	if (sa != NULL)
22604 		IPSA_REFRELE(sa);
22605 	freemsg(mp);
22606 }
22607 
22608 
22609 /*
22610  * Derive an interface id from the link layer address.
22611  * Knows about IEEE 802 and IEEE EUI-64 mappings.
22612  */
22613 static boolean_t
22614 ip_ether_v6intfid(uint_t phys_length, uint8_t *phys_addr, in6_addr_t *v6addr)
22615 {
22616 	char		*addr;
22617 
22618 	if (phys_length != ETHERADDRL)
22619 		return (B_FALSE);
22620 
22621 	/* Form EUI-64 like address */
22622 	addr = (char *)&v6addr->s6_addr32[2];
22623 	bcopy((char *)phys_addr, addr, 3);
22624 	addr[0] ^= 0x2;		/* Toggle Universal/Local bit */
22625 	addr[3] = (char)0xff;
22626 	addr[4] = (char)0xfe;
22627 	bcopy((char *)phys_addr + 3, addr + 5, 3);
22628 	return (B_TRUE);
22629 }
22630 
22631 /* ARGSUSED */
22632 static boolean_t
22633 ip_nodef_v6intfid(uint_t phys_length, uint8_t *phys_addr, in6_addr_t *v6addr)
22634 {
22635 	return (B_FALSE);
22636 }
22637 
22638 /* ARGSUSED */
22639 static boolean_t
22640 ip_ether_v6mapinfo(uint_t lla_length, uint8_t *bphys_addr, uint8_t *maddr,
22641     uint32_t *hw_start, in6_addr_t *v6_extract_mask)
22642 {
22643 	/*
22644 	 * Multicast address mappings used over Ethernet/802.X.
22645 	 * This address is used as a base for mappings.
22646 	 */
22647 	static uint8_t ipv6_g_phys_multi_addr[] = {0x33, 0x33, 0x00,
22648 	    0x00, 0x00, 0x00};
22649 
22650 	/*
22651 	 * Extract low order 32 bits from IPv6 multicast address.
22652 	 * Or that into the link layer address, starting from the
22653 	 * second byte.
22654 	 */
22655 	*hw_start = 2;
22656 	v6_extract_mask->s6_addr32[0] = 0;
22657 	v6_extract_mask->s6_addr32[1] = 0;
22658 	v6_extract_mask->s6_addr32[2] = 0;
22659 	v6_extract_mask->s6_addr32[3] = 0xffffffffU;
22660 	bcopy(ipv6_g_phys_multi_addr, maddr, lla_length);
22661 	return (B_TRUE);
22662 }
22663 
22664 /*
22665  * Indicate by return value whether multicast is supported. If not,
22666  * this code should not touch/change any parameters.
22667  */
22668 /* ARGSUSED */
22669 static boolean_t
22670 ip_ether_v4mapinfo(uint_t phys_length, uint8_t *bphys_addr, uint8_t *maddr,
22671     uint32_t *hw_start, ipaddr_t *extract_mask)
22672 {
22673 	/*
22674 	 * Multicast address mappings used over Ethernet/802.X.
22675 	 * This address is used as a base for mappings.
22676 	 */
22677 	static uint8_t ip_g_phys_multi_addr[] = { 0x01, 0x00, 0x5e,
22678 	    0x00, 0x00, 0x00 };
22679 
22680 	if (phys_length != ETHERADDRL)
22681 		return (B_FALSE);
22682 
22683 	*extract_mask = htonl(0x007fffff);
22684 	*hw_start = 2;
22685 	bcopy(ip_g_phys_multi_addr, maddr, ETHERADDRL);
22686 	return (B_TRUE);
22687 }
22688 
22689 /*
22690  * Derive IPoIB interface id from the link layer address.
22691  */
22692 static boolean_t
22693 ip_ib_v6intfid(uint_t phys_length, uint8_t *phys_addr, in6_addr_t *v6addr)
22694 {
22695 	char		*addr;
22696 
22697 	if (phys_length != 20)
22698 		return (B_FALSE);
22699 	addr = (char *)&v6addr->s6_addr32[2];
22700 	bcopy(phys_addr + 12, addr, 8);
22701 	/*
22702 	 * In IBA 1.1 timeframe, some vendors erroneously set the u/l bit
22703 	 * in the globally assigned EUI-64 GUID to 1, in violation of IEEE
22704 	 * rules. In these cases, the IBA considers these GUIDs to be in
22705 	 * "Modified EUI-64" format, and thus toggling the u/l bit is not
22706 	 * required; vendors are required not to assign global EUI-64's
22707 	 * that differ only in u/l bit values, thus guaranteeing uniqueness
22708 	 * of the interface identifier. Whether the GUID is in modified
22709 	 * or proper EUI-64 format, the ipv6 identifier must have the u/l
22710 	 * bit set to 1.
22711 	 */
22712 	addr[0] |= 2;			/* Set Universal/Local bit to 1 */
22713 	return (B_TRUE);
22714 }
22715 
22716 /*
22717  * Note on mapping from multicast IP addresses to IPoIB multicast link
22718  * addresses. IPoIB multicast link addresses are based on IBA link addresses.
22719  * The format of an IPoIB multicast address is:
22720  *
22721  *  4 byte QPN      Scope Sign.  Pkey
22722  * +--------------------------------------------+
22723  * | 00FFFFFF | FF | 1X | X01B | Pkey | GroupID |
22724  * +--------------------------------------------+
22725  *
22726  * The Scope and Pkey components are properties of the IBA port and
22727  * network interface. They can be ascertained from the broadcast address.
22728  * The Sign. part is the signature, and is 401B for IPv4 and 601B for IPv6.
22729  */
22730 
22731 static boolean_t
22732 ip_ib_v6mapinfo(uint_t lla_length, uint8_t *bphys_addr, uint8_t *maddr,
22733     uint32_t *hw_start, in6_addr_t *v6_extract_mask)
22734 {
22735 	/*
22736 	 * Base IPoIB IPv6 multicast address used for mappings.
22737 	 * Does not contain the IBA scope/Pkey values.
22738 	 */
22739 	static uint8_t ipv6_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
22740 	    0xff, 0x10, 0x60, 0x1b, 0x00, 0x00, 0x00, 0x00,
22741 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
22742 
22743 	/*
22744 	 * Extract low order 80 bits from IPv6 multicast address.
22745 	 * Or that into the link layer address, starting from the
22746 	 * sixth byte.
22747 	 */
22748 	*hw_start = 6;
22749 	bcopy(ipv6_g_phys_ibmulti_addr, maddr, lla_length);
22750 
22751 	/*
22752 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
22753 	 */
22754 	*(maddr + 5) = *(bphys_addr + 5);
22755 	*(maddr + 8) = *(bphys_addr + 8);
22756 	*(maddr + 9) = *(bphys_addr + 9);
22757 
22758 	v6_extract_mask->s6_addr32[0] = 0;
22759 	v6_extract_mask->s6_addr32[1] = htonl(0x0000ffff);
22760 	v6_extract_mask->s6_addr32[2] = 0xffffffffU;
22761 	v6_extract_mask->s6_addr32[3] = 0xffffffffU;
22762 	return (B_TRUE);
22763 }
22764 
22765 static boolean_t
22766 ip_ib_v4mapinfo(uint_t phys_length, uint8_t *bphys_addr, uint8_t *maddr,
22767     uint32_t *hw_start, ipaddr_t *extract_mask)
22768 {
22769 	/*
22770 	 * Base IPoIB IPv4 multicast address used for mappings.
22771 	 * Does not contain the IBA scope/Pkey values.
22772 	 */
22773 	static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
22774 	    0xff, 0x10, 0x40, 0x1b, 0x00, 0x00, 0x00, 0x00,
22775 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
22776 
22777 	if (phys_length != sizeof (ipv4_g_phys_ibmulti_addr))
22778 		return (B_FALSE);
22779 
22780 	/*
22781 	 * Extract low order 28 bits from IPv4 multicast address.
22782 	 * Or that into the link layer address, starting from the
22783 	 * sixteenth byte.
22784 	 */
22785 	*extract_mask = htonl(0x0fffffff);
22786 	*hw_start = 16;
22787 	bcopy(ipv4_g_phys_ibmulti_addr, maddr, phys_length);
22788 
22789 	/*
22790 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
22791 	 */
22792 	*(maddr + 5) = *(bphys_addr + 5);
22793 	*(maddr + 8) = *(bphys_addr + 8);
22794 	*(maddr + 9) = *(bphys_addr + 9);
22795 	return (B_TRUE);
22796 }
22797 
22798 /*
22799  * Returns B_TRUE if an ipif is present in the given zone, matching some flags
22800  * (typically IPIF_UP). If ipifp is non-null, the held ipif is returned there.
22801  * This works for both IPv4 and IPv6; if the passed-in ill is v6, the ipif with
22802  * the link-local address is preferred.
22803  */
22804 boolean_t
22805 ipif_lookup_zoneid(ill_t *ill, zoneid_t zoneid, int flags, ipif_t **ipifp)
22806 {
22807 	ipif_t	*ipif;
22808 	ipif_t	*maybe_ipif = NULL;
22809 
22810 	mutex_enter(&ill->ill_lock);
22811 	if (ill->ill_state_flags & ILL_CONDEMNED) {
22812 		mutex_exit(&ill->ill_lock);
22813 		if (ipifp != NULL)
22814 			*ipifp = NULL;
22815 		return (B_FALSE);
22816 	}
22817 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
22818 		if (!IPIF_CAN_LOOKUP(ipif))
22819 			continue;
22820 		if (zoneid != ALL_ZONES && ipif->ipif_zoneid != zoneid)
22821 			continue;
22822 		if ((ipif->ipif_flags & flags) != flags)
22823 			continue;
22824 
22825 		if (ipifp == NULL) {
22826 			mutex_exit(&ill->ill_lock);
22827 			ASSERT(maybe_ipif == NULL);
22828 			return (B_TRUE);
22829 		}
22830 		if (!ill->ill_isv6 ||
22831 		    IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6src_addr)) {
22832 			ipif_refhold_locked(ipif);
22833 			mutex_exit(&ill->ill_lock);
22834 			*ipifp = ipif;
22835 			return (B_TRUE);
22836 		}
22837 		if (maybe_ipif == NULL)
22838 			maybe_ipif = ipif;
22839 	}
22840 	if (ipifp != NULL) {
22841 		if (maybe_ipif != NULL)
22842 			ipif_refhold_locked(maybe_ipif);
22843 		*ipifp = maybe_ipif;
22844 	}
22845 	mutex_exit(&ill->ill_lock);
22846 	return (maybe_ipif != NULL);
22847 }
22848 
22849 /*
22850  * Same as ipif_lookup_zoneid() but looks at all the ills in the same group.
22851  */
22852 boolean_t
22853 ipif_lookup_zoneid_group(ill_t *ill, zoneid_t zoneid, int flags, ipif_t **ipifp)
22854 {
22855 	ill_t *illg;
22856 
22857 	/*
22858 	 * We look at the passed-in ill first without grabbing ill_g_lock.
22859 	 */
22860 	if (ipif_lookup_zoneid(ill, zoneid, flags, ipifp)) {
22861 		return (B_TRUE);
22862 	}
22863 	rw_enter(&ill_g_lock, RW_READER);
22864 	if (ill->ill_group == NULL) {
22865 		/* ill not in a group */
22866 		rw_exit(&ill_g_lock);
22867 		return (B_FALSE);
22868 	}
22869 
22870 	/*
22871 	 * There's no ipif in the zone on ill, however ill is part of an IPMP
22872 	 * group. We need to look for an ipif in the zone on all the ills in the
22873 	 * group.
22874 	 */
22875 	illg = ill->ill_group->illgrp_ill;
22876 	do {
22877 		/*
22878 		 * We don't call ipif_lookup_zoneid() on ill as we already know
22879 		 * that it's not there.
22880 		 */
22881 		if (illg != ill &&
22882 		    ipif_lookup_zoneid(illg, zoneid, flags, ipifp)) {
22883 			break;
22884 		}
22885 	} while ((illg = illg->ill_group_next) != NULL);
22886 	rw_exit(&ill_g_lock);
22887 	return (illg != NULL);
22888 }
22889 
22890 /*
22891  * Check if this ill is only being used to send ICMP probes for IPMP
22892  */
22893 boolean_t
22894 ill_is_probeonly(ill_t *ill)
22895 {
22896 	/*
22897 	 * Check if the interface is FAILED, or INACTIVE
22898 	 */
22899 	if (ill->ill_phyint->phyint_flags & (PHYI_FAILED|PHYI_INACTIVE))
22900 		return (B_TRUE);
22901 
22902 	return (B_FALSE);
22903 }
22904